{"id":110388,"date":"2023-10-02T10:28:03","date_gmt":"2023-10-02T08:28:03","guid":{"rendered":"https:\/\/prohoster.info\/?p=110388"},"modified":"2023-10-02T10:28:03","modified_gmt":"2023-10-02T08:28:03","slug":"uyazvimosti-v-yadre-linux-glibc-gstreamer-ghostscript-bind-i-cups","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimosti-v-yadre-linux-glibc-gstreamer-ghostscript-bind-i-cups","title":{"rendered":"Vulnerabilities in the Linux kernel, Glibc, GStreamer, Ghostscript, BIND, and CUPS","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Several recently discovered vulnerabilities: <\/p>\n
\n
CVE-2023-39191 \u2014 a vulnerability in the eBPF subsystem that allows a local user to escalate privileges and execute code at the Linux kernel level. The vulnerability is caused by inadequate validation of eBPF programs supplied by the user for execution. To exploit this vulnerability, the user must be able to load their BPF program (if the kernel.unprivileged_bpf_disabled parameter is set to 0, such as in Ubuntu 20.04). Information about the vulnerability was sent to the kernel developers back in December last year, and a fix was quietly added in January.\n
CVE-2023-42753 \u2014 an error in handling array indexes in the ipset implementation within the netfilter core subsystem, which can be used to increment\/decrement pointers and create conditions for writing or reading outside the allocated buffer. A prototype exploit has been prepared to check for the vulnerability, which causes a crash (more dangerous exploitation scenarios cannot be ruled out). The fix is included in kernel releases 5.4.257, 6.5.3, 6.4.16, 6.1.53, 5.10.195, 5.15.132.\n
CVE-2023-39192, CVE-2023-39193, CVE-2023-39193 \u2014 several vulnerabilities in the Linux kernel that lead to the leakage of kernel memory contents due to the ability to read from areas outside the allocated buffer in the match_flags and u32_match_it functions of the Netfilter subsystem, as well as in stateful filter handling code. The vulnerabilities were fixed in August (1, 2) and June.\n
CVE-2023-42755 \u2014 a vulnerability that allows a non-privileged local user to cause a kernel crash due to an error in pointer handling in the RSVP traffic classifier. This issue affects LTS kernels 6.1, 5.15, 5.10, 5.4, 4.19, and 4.14. A prototype exploit has been prepared. The fix has not yet been integrated into the kernel and is available as a patch.\n
CVE-2023-42756 \u2014 a race condition in the NetFilter kernel subsystem that can be used to trigger a panic state by a local user. A prototype exploit is available that works on at least the 6.5.rc7, 6.1, and 5.10 kernels. The fix has not yet been integrated into the kernel and is available as a patch.\n
CVE-2023-4527 \u2014 stack overflow in the Glibc library occurring in the getaddrinfo function when processing a DNS response larger than 2048 bytes. The vulnerability may lead to data leakage from the stack or a crash. It manifests only in Glibc versions newer than 2.36 when the 'no-aaaa' option is used in \/etc\/resolv.conf.\n
CVE-2023-40474, CVE-2023-40475 \u2014 vulnerabilities in the GStreamer multimedia framework caused by integer overflow in the handlers for MXF video files. These vulnerabilities can allow the attacker to execute code when processing specially crafted MXF files in an application using GStreamer. The issue has been resolved in the gst-plugins-bad package 1.22.6.\n
CVE-2023-40476 \u2014 buffer overflow in the GStreamer video handler for H.265, allowing for code execution when processing specially crafted video. The vulnerability has been fixed in the gst-plugins-bad package 1.22.6.\n
Analysis \u2014 an analysis of the exploit that uses the CVE-2023-36664 vulnerability in the Ghostscript package to execute its code when opening specially crafted PostScript documents. The issue arises from improper handling of file names starting with the character \u2018|\u2019 or the prefix %pipe%. The vulnerability has been addressed in Ghostscript version 10.01.2.\n
CVE-2023-3341, CVE-2023-4236 \u2014 vulnerabilities in the BIND 9 DNS server that lead to the named process crashing when handling specially crafted control messages (only access to the TCP port that is used to manage named is needed (by default only open for the loopback interface), knowledge of the RNDC key is not required) or creating a specific high load in DNS-over-TLS mode. The vulnerabilities have been fixed in BIND 9.16.44, 9.18.19, and 9.19.17.\n