跳转到帖子
官方通告：安全方向 - WEB渗透 /Windows & 安卓远控/ 逆向破解 /安全审计 /嵌入式开发联系 Telegram：@APTs37，或者点击此处查看详细介绍。收SHELL、出SHELL。劫持合作。

ISHACK AI BOT

Members

  • 注册日期

  • 上次访问

查看个人空间 查看他们的动态

ISHACK AI BOT 发布的所有帖子

  1. ISHACK AI BOT

    MFSA2023-34 Firefox: Security Vulnerabilities fixed in Firefox 117 (CVE-2023-4575)

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    MFSA2023-34 Firefox: Security Vulnerabilities fixed in Firefox 117 (CVE-2023-4575) Severity 7 CVSS (AV:N/AC:M/Au:N/C:N/I:N/A:C) Published 08/29/2023 Created 08/30/2023 Added 08/30/2023 Modified 01/28/2025 Description When creating a callback over IPC for showing the File Picker window, multiple of the same callbacks could have been created at a time and eventually all simultaneously destroyed as soon as one of the callbacks finished. This could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2. Solution(s) mozilla-firefox-upgrade-117_0 References https://attackerkb.com/topics/cve-2023-4575 CVE - 2023-4575 http://www.mozilla.org/security/announce/2023/mfsa2023-34.html
  2. ISHACK AI BOT

    MFSA2023-35 Firefox: Security Vulnerabilities fixed in Firefox ESR 102.15 (CVE-2023-4584)

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    MFSA2023-35 Firefox: Security Vulnerabilities fixed in Firefox ESR 102.15 (CVE-2023-4584) Severity 9 CVSS (AV:N/AC:M/Au:N/C:C/I:C/A:C) Published 08/29/2023 Created 08/30/2023 Added 08/30/2023 Modified 01/28/2025 Description Memory safety bugs present in Firefox 116, Firefox ESR 102.14, Firefox ESR 115.1, Thunderbird 102.14, and Thunderbird 115.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2. Solution(s) mozilla-firefox-esr-upgrade-102_15 References https://attackerkb.com/topics/cve-2023-4584 CVE - 2023-4584 http://www.mozilla.org/security/announce/2023/mfsa2023-35.html
  3. ISHACK AI BOT

    MFSA2023-36 Firefox: Security Vulnerabilities fixed in Firefox ESR 115.2 (CVE-2023-4576)

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    MFSA2023-36 Firefox: Security Vulnerabilities fixed in Firefox ESR 115.2 (CVE-2023-4576) Severity 8 CVSS (AV:N/AC:L/Au:N/C:C/I:N/A:N) Published 08/29/2023 Created 08/30/2023 Added 08/30/2023 Modified 01/28/2025 Description On Windows, an integer overflow could occur in `RecordedSourceSurfaceCreation` which resulted in a heap buffer overflow potentially leaking sensitive data that could have led to a sandbox escape. *This bug only affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2. Solution(s) mozilla-firefox-esr-upgrade-115_2 References https://attackerkb.com/topics/cve-2023-4576 CVE - 2023-4576 http://www.mozilla.org/security/announce/2023/mfsa2023-36.html
  4. ISHACK AI BOT

    MFSA2023-34 Firefox: Security Vulnerabilities fixed in Firefox 117 (CVE-2023-4576)

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    MFSA2023-34 Firefox: Security Vulnerabilities fixed in Firefox 117 (CVE-2023-4576) Severity 8 CVSS (AV:N/AC:L/Au:N/C:C/I:N/A:N) Published 08/29/2023 Created 08/30/2023 Added 08/30/2023 Modified 01/28/2025 Description On Windows, an integer overflow could occur in `RecordedSourceSurfaceCreation` which resulted in a heap buffer overflow potentially leaking sensitive data that could have led to a sandbox escape. *This bug only affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2. Solution(s) mozilla-firefox-upgrade-117_0 References https://attackerkb.com/topics/cve-2023-4576 CVE - 2023-4576 http://www.mozilla.org/security/announce/2023/mfsa2023-34.html
  5. ISHACK AI BOT

    MFSA2023-34 Firefox: Security Vulnerabilities fixed in Firefox 117 (CVE-2023-4579)

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    MFSA2023-34 Firefox: Security Vulnerabilities fixed in Firefox 117 (CVE-2023-4579) Severity 3 CVSS (AV:N/AC:H/Au:N/C:N/I:P/A:N) Published 08/29/2023 Created 08/30/2023 Added 08/30/2023 Modified 01/28/2025 Description Search queries in the default search engine could appear to have been the currently navigated URL if the search query itself was a well formed URL. This could have led to a site spoofing another if it had been maliciously set as the default search engine. This vulnerability affects Firefox < 117. Solution(s) mozilla-firefox-upgrade-117_0 References https://attackerkb.com/topics/cve-2023-4579 CVE - 2023-4579 http://www.mozilla.org/security/announce/2023/mfsa2023-34.html
  6. ISHACK AI BOT

    FreeBSD: VID-2FE004F5-83FD-11EE-9F5D-31909FB2F495 (CVE-2023-46850): openvpn -- 2.6.0...2.6.6 --fragment option division by zero crash, and TLS data leak

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    FreeBSD: VID-2FE004F5-83FD-11EE-9F5D-31909FB2F495 (CVE-2023-46850): openvpn -- 2.6.0...2.6.6 --fragment option division by zero crash, and TLS data leak Severity 10 CVSS (AV:N/AC:L/Au:N/C:C/I:C/A:C) Published 08/29/2023 Created 11/18/2023 Added 11/16/2023 Modified 01/28/2025 Description Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execution when sending network buffers to a remote peer. Solution(s) freebsd-upgrade-package-openvpn freebsd-upgrade-package-openvpn-devel References CVE-2023-46850
  7. ISHACK AI BOT

    MFSA2023-35 Firefox: Security Vulnerabilities fixed in Firefox ESR 102.15 (CVE-2023-4575)

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    MFSA2023-35 Firefox: Security Vulnerabilities fixed in Firefox ESR 102.15 (CVE-2023-4575) Severity 7 CVSS (AV:N/AC:M/Au:N/C:N/I:N/A:C) Published 08/29/2023 Created 08/30/2023 Added 08/30/2023 Modified 01/28/2025 Description When creating a callback over IPC for showing the File Picker window, multiple of the same callbacks could have been created at a time and eventually all simultaneously destroyed as soon as one of the callbacks finished. This could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2. Solution(s) mozilla-firefox-esr-upgrade-102_15 References https://attackerkb.com/topics/cve-2023-4575 CVE - 2023-4575 http://www.mozilla.org/security/announce/2023/mfsa2023-35.html
  8. ISHACK AI BOT

    VMware Photon OS: CVE-2023-39615

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    VMware Photon OS: CVE-2023-39615 Severity 8 CVSS (AV:N/AC:L/Au:N/C:N/I:N/A:C) Published 08/29/2023 Created 01/21/2025 Added 01/20/2025 Modified 02/04/2025 Description Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file. NOTE: the vendor's position is that the product does not support the legacy SAX1 interface with custom callbacks; there is a crash even without crafted input. Solution(s) vmware-photon_os_update_tdnf References https://attackerkb.com/topics/cve-2023-39615 CVE - 2023-39615
  9. ISHACK AI BOT

    Alpine Linux: CVE-2023-40890: Out-of-bounds Write

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    Alpine Linux: CVE-2023-40890: Out-of-bounds Write Severity 10 CVSS (AV:N/AC:L/Au:N/C:C/I:C/A:C) Published 08/29/2023 Created 08/23/2024 Added 08/22/2024 Modified 10/02/2024 Description A stack-based buffer overflow vulnerability exists in the lookup_sequence function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically scanned by the vulnerable scanner. Solution(s) alpine-linux-upgrade-zbar References https://attackerkb.com/topics/cve-2023-40890 CVE - 2023-40890 https://security.alpinelinux.org/vuln/CVE-2023-40890
  10. ISHACK AI BOT

    MFSA2023-34 Firefox: Security Vulnerabilities fixed in Firefox 117 (CVE-2023-4585)

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    MFSA2023-34 Firefox: Security Vulnerabilities fixed in Firefox 117 (CVE-2023-4585) Severity 9 CVSS (AV:N/AC:M/Au:N/C:C/I:C/A:C) Published 08/29/2023 Created 08/30/2023 Added 08/30/2023 Modified 01/28/2025 Description Memory safety bugs present in Firefox 116, Firefox ESR 115.1, and Thunderbird 115.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2. Solution(s) mozilla-firefox-upgrade-117_0 References https://attackerkb.com/topics/cve-2023-4585 CVE - 2023-4585 http://www.mozilla.org/security/announce/2023/mfsa2023-34.html
  11. ISHACK AI BOT

    MFSA2023-34 Firefox: Security Vulnerabilities fixed in Firefox 117 (CVE-2023-4573)

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    MFSA2023-34 Firefox: Security Vulnerabilities fixed in Firefox 117 (CVE-2023-4573) Severity 7 CVSS (AV:N/AC:M/Au:N/C:N/I:N/A:C) Published 08/29/2023 Created 08/30/2023 Added 08/30/2023 Modified 01/28/2025 Description When receiving rendering data over IPC `mStream` could have been destroyed when initialized, which could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2. Solution(s) mozilla-firefox-upgrade-117_0 References https://attackerkb.com/topics/cve-2023-4573 CVE - 2023-4573 http://www.mozilla.org/security/announce/2023/mfsa2023-34.html
  12. ISHACK AI BOT

    MFSA2023-35 Firefox: Security Vulnerabilities fixed in Firefox ESR 102.15 (CVE-2023-4581)

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    MFSA2023-35 Firefox: Security Vulnerabilities fixed in Firefox ESR 102.15 (CVE-2023-4581) Severity 4 CVSS (AV:N/AC:M/Au:N/C:P/I:N/A:N) Published 08/29/2023 Created 08/30/2023 Added 08/30/2023 Modified 01/30/2025 Description Excel `.xll` add-in files did not have a blocklist entry in Firefox's executable blocklist which allowed them to be downloaded without any warning of their potential harm. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2. Solution(s) mozilla-firefox-esr-upgrade-102_15 References https://attackerkb.com/topics/cve-2023-4581 CVE - 2023-4581 http://www.mozilla.org/security/announce/2023/mfsa2023-35.html
  13. ISHACK AI BOT

    MFSA2023-38 Thunderbird: Security Vulnerabilities fixed in Thunderbird 115.2 (CVE-2023-4573)

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    MFSA2023-38 Thunderbird: Security Vulnerabilities fixed in Thunderbird 115.2 (CVE-2023-4573) Severity 7 CVSS (AV:N/AC:M/Au:N/C:N/I:N/A:C) Published 08/29/2023 Created 09/05/2023 Added 09/05/2023 Modified 02/14/2025 Description When receiving rendering data over IPC `mStream` could have been destroyed when initialized, which could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2. Solution(s) mozilla-thunderbird-upgrade-115_2 References https://attackerkb.com/topics/cve-2023-4573 CVE - 2023-4573 http://www.mozilla.org/security/announce/2023/mfsa2023-38.html
  14. ISHACK AI BOT

    Ubuntu: (Multiple Advisories) (CVE-2023-3777): Linux kernel vulnerabilities

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    Ubuntu: (Multiple Advisories) (CVE-2023-3777): Linux kernel vulnerabilities Severity 7 CVSS (AV:L/AC:L/Au:S/C:C/I:C/A:C) Published 08/29/2023 Created 08/31/2023 Added 08/31/2023 Modified 01/30/2025 Description A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. When nf_tables_delrule() is flushing table rules, it is not checked whether the chain is bound and the chain's owner rule can also release the objects in certain circumstances. We recommend upgrading past commit 6eaf41e87a223ae6f8e7a28d6e78384ad7e407f8. Solution(s) ubuntu-upgrade-linux-image-5-15-0-1026-gkeop ubuntu-upgrade-linux-image-5-15-0-1031-nvidia ubuntu-upgrade-linux-image-5-15-0-1031-nvidia-lowlatency ubuntu-upgrade-linux-image-5-15-0-1036-ibm ubuntu-upgrade-linux-image-5-15-0-1036-raspi ubuntu-upgrade-linux-image-5-15-0-1038-intel-iotg ubuntu-upgrade-linux-image-5-15-0-1040-gcp ubuntu-upgrade-linux-image-5-15-0-1040-gke ubuntu-upgrade-linux-image-5-15-0-1040-kvm ubuntu-upgrade-linux-image-5-15-0-1041-oracle ubuntu-upgrade-linux-image-5-15-0-1043-aws ubuntu-upgrade-linux-image-5-15-0-1045-azure ubuntu-upgrade-linux-image-5-15-0-1045-azure-fde ubuntu-upgrade-linux-image-5-15-0-82-generic ubuntu-upgrade-linux-image-5-15-0-82-generic-64k ubuntu-upgrade-linux-image-5-15-0-82-generic-lpae ubuntu-upgrade-linux-image-5-15-0-82-lowlatency ubuntu-upgrade-linux-image-5-15-0-82-lowlatency-64k ubuntu-upgrade-linux-image-6-0-0-1021-oem ubuntu-upgrade-linux-image-6-1-0-1020-oem ubuntu-upgrade-linux-image-6-2-0-1003-starfive ubuntu-upgrade-linux-image-6-2-0-1008-ibm ubuntu-upgrade-linux-image-6-2-0-1010-aws ubuntu-upgrade-linux-image-6-2-0-1010-azure ubuntu-upgrade-linux-image-6-2-0-1010-oracle ubuntu-upgrade-linux-image-6-2-0-1011-kvm ubuntu-upgrade-linux-image-6-2-0-1011-lowlatency ubuntu-upgrade-linux-image-6-2-0-1011-lowlatency-64k ubuntu-upgrade-linux-image-6-2-0-1011-raspi ubuntu-upgrade-linux-image-6-2-0-1012-gcp ubuntu-upgrade-linux-image-6-2-0-31-generic ubuntu-upgrade-linux-image-6-2-0-31-generic-64k ubuntu-upgrade-linux-image-6-2-0-31-generic-lpae ubuntu-upgrade-linux-image-aws ubuntu-upgrade-linux-image-aws-lts-22-04 ubuntu-upgrade-linux-image-azure ubuntu-upgrade-linux-image-azure-cvm ubuntu-upgrade-linux-image-azure-fde-lts-22-04 ubuntu-upgrade-linux-image-azure-lts-22-04 ubuntu-upgrade-linux-image-gcp ubuntu-upgrade-linux-image-gcp-lts-22-04 ubuntu-upgrade-linux-image-generic ubuntu-upgrade-linux-image-generic-64k ubuntu-upgrade-linux-image-generic-64k-hwe-20-04 ubuntu-upgrade-linux-image-generic-64k-hwe-22-04 ubuntu-upgrade-linux-image-generic-hwe-20-04 ubuntu-upgrade-linux-image-generic-hwe-22-04 ubuntu-upgrade-linux-image-generic-lpae ubuntu-upgrade-linux-image-generic-lpae-hwe-20-04 ubuntu-upgrade-linux-image-generic-lpae-hwe-22-04 ubuntu-upgrade-linux-image-gke ubuntu-upgrade-linux-image-gke-5-15 ubuntu-upgrade-linux-image-gkeop ubuntu-upgrade-linux-image-gkeop-5-15 ubuntu-upgrade-linux-image-ibm ubuntu-upgrade-linux-image-intel ubuntu-upgrade-linux-image-intel-iotg ubuntu-upgrade-linux-image-kvm ubuntu-upgrade-linux-image-lowlatency ubuntu-upgrade-linux-image-lowlatency-64k ubuntu-upgrade-linux-image-lowlatency-64k-hwe-20-04 ubuntu-upgrade-linux-image-lowlatency-64k-hwe-22-04 ubuntu-upgrade-linux-image-lowlatency-hwe-20-04 ubuntu-upgrade-linux-image-lowlatency-hwe-22-04 ubuntu-upgrade-linux-image-nvidia ubuntu-upgrade-linux-image-nvidia-lowlatency ubuntu-upgrade-linux-image-oem-20-04 ubuntu-upgrade-linux-image-oem-20-04b ubuntu-upgrade-linux-image-oem-20-04c ubuntu-upgrade-linux-image-oem-20-04d ubuntu-upgrade-linux-image-oem-22-04b ubuntu-upgrade-linux-image-oem-22-04c ubuntu-upgrade-linux-image-oracle ubuntu-upgrade-linux-image-oracle-lts-22-04 ubuntu-upgrade-linux-image-raspi ubuntu-upgrade-linux-image-raspi-nolpae ubuntu-upgrade-linux-image-starfive ubuntu-upgrade-linux-image-virtual ubuntu-upgrade-linux-image-virtual-hwe-20-04 ubuntu-upgrade-linux-image-virtual-hwe-22-04 References https://attackerkb.com/topics/cve-2023-3777 CVE - 2023-3777 USN-6315-1 USN-6316-1 USN-6318-1 USN-6321-1 USN-6325-1 USN-6328-1 USN-6330-1 USN-6332-1 USN-6348-1 USN-6385-1 View more
  15. ISHACK AI BOT

    Oracle Linux: CVE-2023-41359: ELSA-2024-2156: frr security update (MODERATE) (Multiple Advisories)

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    Oracle Linux: CVE-2023-41359: ELSA-2024-2156:frr security update (MODERATE) (Multiple Advisories) Severity 5 CVSS (AV:N/AC:H/Au:N/C:N/I:N/A:C) Published 08/29/2023 Created 05/21/2024 Added 05/15/2024 Modified 11/25/2024 Description An issue was discovered in FRRouting FRR through 9.0. There is an out-of-bounds read in bgp_attr_aigp_valid in bgpd/bgp_attr.c because there is no check for the availability of two bytes during AIGP validation. A flaw was found in FRRouting that involves a heap-based buffer overflow in the bgp_attr_aigp_valid() function within bgpd/bgp_attr.c. This flaw allows a remote attacker to send specially crafted data to the application, initiating an out-of-bounds read error and executing a denial of service (DoS) attack. Solution(s) oracle-linux-upgrade-frr oracle-linux-upgrade-frr-selinux References https://attackerkb.com/topics/cve-2023-41359 CVE - 2023-41359 ELSA-2024-2156
  16. ISHACK AI BOT

    Ubuntu: USN-7118-1 (CVE-2023-40890): ZBar vulnerabilities

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    Ubuntu: USN-7118-1 (CVE-2023-40890): ZBar vulnerabilities Severity 10 CVSS (AV:N/AC:L/Au:N/C:C/I:C/A:C) Published 08/29/2023 Created 11/23/2024 Added 11/22/2024 Modified 01/28/2025 Description A stack-based buffer overflow vulnerability exists in the lookup_sequence function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically scanned by the vulnerable scanner. Solution(s) ubuntu-pro-upgrade-libzbar0 References https://attackerkb.com/topics/cve-2023-40890 CVE - 2023-40890 USN-7118-1
  17. ISHACK AI BOT

    Alma Linux: CVE-2023-41358: Moderate: frr security update (Multiple Advisories)

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    Alma Linux: CVE-2023-41358: Moderate: frr security update (Multiple Advisories) Severity 8 CVSS (AV:N/AC:L/Au:N/C:N/I:N/A:C) Published 08/29/2023 Created 05/08/2024 Added 05/08/2024 Modified 01/28/2025 Description An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c processes NLRIs if the attribute length is zero. Solution(s) alma-upgrade-frr alma-upgrade-frr-selinux References https://attackerkb.com/topics/cve-2023-41358 CVE - 2023-41358 https://errata.almalinux.org/8/ALSA-2024-2981.html https://errata.almalinux.org/9/ALSA-2024-2156.html
  18. ISHACK AI BOT

    Qlik Sense Enterprise: CVE-2023-41265: HTTP Tunneling vulnerability in Qlik Sense Enterprise for Windows

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    Qlik Sense Enterprise: CVE-2023-41265: HTTP Tunneling vulnerability in Qlik Sense Enterprise for Windows Severity 9 CVSS (AV:N/AC:L/Au:N/C:C/I:C/A:N) Published 08/29/2023 Created 03/27/2024 Added 03/26/2024 Modified 03/27/2024 Description Due to improper validation of HTTP Headers a remote attacker is able to elevate their privilege by tunnelling HTTP requests, allowing them to execute HTTP requests on the backend server hosting the repository application. Solution(s) qlik-sense-enterprise-upgrade-latest References https://attackerkb.com/topics/cve-2023-41265 CVE - 2023-41265 https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/ta-p/2110801
  19. ISHACK AI BOT

    Amazon Linux 2023: CVE-2023-4244: Important priority package update for kernel

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    Amazon Linux 2023: CVE-2023-4244: Important priority package update for kernel Severity 6 CVSS (AV:L/AC:H/Au:S/C:C/I:C/A:C) Published 08/28/2023 Created 02/14/2025 Added 02/14/2025 Modified 02/14/2025 Description A use-after-free vulnerability in the Linux kernel&apos;s netfilter: nf_tables component can be exploited to achieve local privilege escalation. Due to a race condition between nf_tables netlink control plane transaction and nft_set element garbage collection, it is possible to underflow the reference counter causing a use-after-free vulnerability. We recommend upgrading past commit 3e91b0ebd994635df2346353322ac51ce84ce6d8. A use-after-free flaw was found in the Linux kernel’s nftables sub-component due to a race problem between the set GC and transaction in the Linux Kernel. This flaw allows a local attacker to crash the system due to a missing call to `nft_set_elem_mark_busy`, causing double deactivation of the element and possibly leading to a kernel information leak problem. Solution(s) amazon-linux-2023-upgrade-bpftool amazon-linux-2023-upgrade-bpftool-debuginfo amazon-linux-2023-upgrade-kernel amazon-linux-2023-upgrade-kernel-debuginfo amazon-linux-2023-upgrade-kernel-debuginfo-common-aarch64 amazon-linux-2023-upgrade-kernel-debuginfo-common-x86-64 amazon-linux-2023-upgrade-kernel-devel amazon-linux-2023-upgrade-kernel-headers amazon-linux-2023-upgrade-kernel-libbpf amazon-linux-2023-upgrade-kernel-libbpf-devel amazon-linux-2023-upgrade-kernel-libbpf-static amazon-linux-2023-upgrade-kernel-livepatch-6-1-56-82-125 amazon-linux-2023-upgrade-kernel-modules-extra amazon-linux-2023-upgrade-kernel-tools amazon-linux-2023-upgrade-kernel-tools-debuginfo amazon-linux-2023-upgrade-kernel-tools-devel amazon-linux-2023-upgrade-perf amazon-linux-2023-upgrade-perf-debuginfo amazon-linux-2023-upgrade-python3-perf amazon-linux-2023-upgrade-python3-perf-debuginfo References https://attackerkb.com/topics/cve-2023-4244 CVE - 2023-4244 https://alas.aws.amazon.com/AL2023/ALAS-2023-385.html
  20. ISHACK AI BOT

    VMware Photon OS: CVE-2023-4569

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    VMware Photon OS: CVE-2023-4569 Severity 5 CVSS (AV:L/AC:L/Au:S/C:C/I:N/A:N) Published 08/28/2023 Created 01/21/2025 Added 01/20/2025 Modified 02/04/2025 Description A memory leak flaw was found in nft_set_catchall_flush in net/netfilter/nf_tables_api.c in the Linux Kernel. This issue may allow a local attacker to cause double-deactivations of catchall elements, which can result in a memory leak. Solution(s) vmware-photon_os_update_tdnf References https://attackerkb.com/topics/cve-2023-4569 CVE - 2023-4569
  21. ISHACK AI BOT

    Amazon Linux AMI 2: CVE-2023-4569: Security patch for kernel (ALASKERNEL-5.15-2023-026)

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    Amazon Linux AMI 2: CVE-2023-4569: Security patch for kernel (ALASKERNEL-5.15-2023-026) Severity 5 CVSS (AV:L/AC:L/Au:S/C:N/I:N/A:C) Published 08/28/2023 Created 09/21/2023 Added 09/21/2023 Modified 01/28/2025 Description A memory leak flaw was found in nft_set_catchall_flush in net/netfilter/nf_tables_api.c in the Linux Kernel. This issue may allow a local attacker to cause double-deactivations of catchall elements, which can result in a memory leak. Solution(s) amazon-linux-ami-2-upgrade-bpftool amazon-linux-ami-2-upgrade-bpftool-debuginfo amazon-linux-ami-2-upgrade-kernel amazon-linux-ami-2-upgrade-kernel-debuginfo amazon-linux-ami-2-upgrade-kernel-debuginfo-common-aarch64 amazon-linux-ami-2-upgrade-kernel-debuginfo-common-x86_64 amazon-linux-ami-2-upgrade-kernel-devel amazon-linux-ami-2-upgrade-kernel-headers amazon-linux-ami-2-upgrade-kernel-livepatch-5-15-128-80-144 amazon-linux-ami-2-upgrade-kernel-tools amazon-linux-ami-2-upgrade-kernel-tools-debuginfo amazon-linux-ami-2-upgrade-kernel-tools-devel amazon-linux-ami-2-upgrade-perf amazon-linux-ami-2-upgrade-perf-debuginfo amazon-linux-ami-2-upgrade-python-perf amazon-linux-ami-2-upgrade-python-perf-debuginfo References https://attackerkb.com/topics/cve-2023-4569 AL2/ALASKERNEL-5.15-2023-026 CVE - 2023-4569
  22. ISHACK AI BOT

    Oracle Linux: CVE-2023-41080: ELSA-2024-0474: tomcat security update (MODERATE) (Multiple Advisories)

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    Oracle Linux: CVE-2023-41080: ELSA-2024-0474:tomcat security update (MODERATE) (Multiple Advisories) Severity 6 CVSS (AV:N/AC:L/Au:N/C:P/I:P/A:N) Published 08/28/2023 Created 01/13/2024 Added 01/11/2024 Modified 12/18/2024 Description URL Redirection to Untrusted Site (&apos;Open Redirect&apos;) vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92. The vulnerability is limited to the ROOT (default) web application. A flaw was found in Apache Tomcat if the default web application is configured with FormAuthenticator. This issue allows a specially crafted URL to trigger a redirect to an arbitrary URL. Solution(s) oracle-linux-upgrade-tomcat oracle-linux-upgrade-tomcat-admin-webapps oracle-linux-upgrade-tomcat-docs-webapp oracle-linux-upgrade-tomcat-el-3-0-api oracle-linux-upgrade-tomcat-jsp-2-3-api oracle-linux-upgrade-tomcat-lib oracle-linux-upgrade-tomcat-servlet-4-0-api oracle-linux-upgrade-tomcat-webapps References https://attackerkb.com/topics/cve-2023-41080 CVE - 2023-41080 ELSA-2024-0474 ELSA-2024-0125
  23. ISHACK AI BOT

    Debian: CVE-2020-24165: qemu -- security update

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    Debian: CVE-2020-24165: qemu -- security update Severity 7 CVSS (AV:L/AC:L/Au:S/C:C/I:C/A:C) Published 08/28/2023 Created 10/11/2023 Added 10/10/2023 Modified 01/28/2025 Description An issue was discovered in TCG Accelerator in QEMU 4.2.0, allows local attackers to execute arbitrary code, escalate privileges, and cause a denial of service (DoS). Note: This is disputed as a bug and not a valid security issue by multiple third parties. Solution(s) debian-upgrade-qemu References https://attackerkb.com/topics/cve-2020-24165 CVE - 2020-24165 DLA-3604-1
  24. ISHACK AI BOT

    Oracle Linux: CVE-2023-4244: ELSA-2024-1248: kernel security update (IMPORTANT) (Multiple Advisories)

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    Oracle Linux: CVE-2023-4244: ELSA-2024-1248:kernel security update (IMPORTANT) (Multiple Advisories) Severity 6 CVSS (AV:L/AC:H/Au:S/C:C/I:C/A:C) Published 08/28/2023 Created 12/20/2023 Added 12/14/2023 Modified 01/23/2025 Description A use-after-free vulnerability in the Linux kernel&apos;s netfilter: nf_tables component can be exploited to achieve local privilege escalation. Due to a race condition between nf_tables netlink control plane transaction and nft_set element garbage collection, it is possible to underflow the reference counter causing a use-after-free vulnerability. We recommend upgrading past commit 3e91b0ebd994635df2346353322ac51ce84ce6d8. A use-after-free flaw was found in the Linux kernel’s nftables sub-component due to a race problem between the set GC and transaction in the Linux Kernel. This flaw allows a local attacker to crash the system due to a missing call to `nft_set_elem_mark_busy`, causing double deactivation of the element and possibly leading to a kernel information leak problem. Solution(s) oracle-linux-upgrade-kernel oracle-linux-upgrade-kernel-uek References https://attackerkb.com/topics/cve-2023-4244 CVE - 2023-4244 ELSA-2024-1248 ELSA-2023-13043 ELSA-2024-12151 ELSA-2024-12153 ELSA-2024-12154 ELSA-2024-3138 View more
  25. ISHACK AI BOT

    Ubuntu: (Multiple Advisories) (CVE-2023-4569): Linux kernel vulnerabilities

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    Ubuntu: (Multiple Advisories) (CVE-2023-4569): Linux kernel vulnerabilities Severity 5 CVSS (AV:L/AC:L/Au:S/C:N/I:N/A:C) Published 08/28/2023 Created 09/20/2023 Added 09/20/2023 Modified 01/28/2025 Description A memory leak flaw was found in nft_set_catchall_flush in net/netfilter/nf_tables_api.c in the Linux Kernel. This issue may allow a local attacker to cause double-deactivations of catchall elements, which can result in a memory leak. Solution(s) ubuntu-upgrade-linux-image-5-15-0-1028-gkeop ubuntu-upgrade-linux-image-5-15-0-1033-nvidia ubuntu-upgrade-linux-image-5-15-0-1033-nvidia-lowlatency ubuntu-upgrade-linux-image-5-15-0-1038-ibm ubuntu-upgrade-linux-image-5-15-0-1038-raspi ubuntu-upgrade-linux-image-5-15-0-1040-intel-iotg ubuntu-upgrade-linux-image-5-15-0-1042-gcp ubuntu-upgrade-linux-image-5-15-0-1042-gke ubuntu-upgrade-linux-image-5-15-0-1042-kvm ubuntu-upgrade-linux-image-5-15-0-1044-oracle ubuntu-upgrade-linux-image-5-15-0-1045-aws ubuntu-upgrade-linux-image-5-15-0-1047-azure ubuntu-upgrade-linux-image-5-15-0-1047-azure-fde ubuntu-upgrade-linux-image-5-15-0-84-generic ubuntu-upgrade-linux-image-5-15-0-84-generic-64k ubuntu-upgrade-linux-image-5-15-0-84-generic-lpae ubuntu-upgrade-linux-image-5-15-0-84-lowlatency ubuntu-upgrade-linux-image-5-15-0-84-lowlatency-64k ubuntu-upgrade-linux-image-6-0-0-1021-oem ubuntu-upgrade-linux-image-6-1-0-1022-oem ubuntu-upgrade-linux-image-6-2-0-1005-starfive ubuntu-upgrade-linux-image-6-2-0-1010-ibm ubuntu-upgrade-linux-image-6-2-0-1011-nvidia ubuntu-upgrade-linux-image-6-2-0-1011-nvidia-64k ubuntu-upgrade-linux-image-6-2-0-1012-aws ubuntu-upgrade-linux-image-6-2-0-1012-azure ubuntu-upgrade-linux-image-6-2-0-1012-azure-fde ubuntu-upgrade-linux-image-6-2-0-1012-oracle ubuntu-upgrade-linux-image-6-2-0-1013-kvm ubuntu-upgrade-linux-image-6-2-0-1013-lowlatency ubuntu-upgrade-linux-image-6-2-0-1013-lowlatency-64k ubuntu-upgrade-linux-image-6-2-0-1013-raspi ubuntu-upgrade-linux-image-6-2-0-1014-gcp ubuntu-upgrade-linux-image-6-2-0-33-generic ubuntu-upgrade-linux-image-6-2-0-33-generic-64k ubuntu-upgrade-linux-image-6-2-0-33-generic-lpae ubuntu-upgrade-linux-image-aws ubuntu-upgrade-linux-image-aws-lts-22-04 ubuntu-upgrade-linux-image-azure ubuntu-upgrade-linux-image-azure-cvm ubuntu-upgrade-linux-image-azure-fde ubuntu-upgrade-linux-image-azure-fde-lts-22-04 ubuntu-upgrade-linux-image-azure-lts-22-04 ubuntu-upgrade-linux-image-gcp ubuntu-upgrade-linux-image-gcp-lts-22-04 ubuntu-upgrade-linux-image-generic ubuntu-upgrade-linux-image-generic-64k ubuntu-upgrade-linux-image-generic-64k-hwe-20-04 ubuntu-upgrade-linux-image-generic-64k-hwe-22-04 ubuntu-upgrade-linux-image-generic-hwe-20-04 ubuntu-upgrade-linux-image-generic-hwe-22-04 ubuntu-upgrade-linux-image-generic-lpae ubuntu-upgrade-linux-image-generic-lpae-hwe-20-04 ubuntu-upgrade-linux-image-generic-lpae-hwe-22-04 ubuntu-upgrade-linux-image-gke ubuntu-upgrade-linux-image-gke-5-15 ubuntu-upgrade-linux-image-gkeop ubuntu-upgrade-linux-image-gkeop-5-15 ubuntu-upgrade-linux-image-ibm ubuntu-upgrade-linux-image-intel ubuntu-upgrade-linux-image-intel-iotg ubuntu-upgrade-linux-image-kvm ubuntu-upgrade-linux-image-lowlatency ubuntu-upgrade-linux-image-lowlatency-64k ubuntu-upgrade-linux-image-lowlatency-64k-hwe-20-04 ubuntu-upgrade-linux-image-lowlatency-64k-hwe-22-04 ubuntu-upgrade-linux-image-lowlatency-hwe-20-04 ubuntu-upgrade-linux-image-lowlatency-hwe-22-04 ubuntu-upgrade-linux-image-nvidia ubuntu-upgrade-linux-image-nvidia-6-2 ubuntu-upgrade-linux-image-nvidia-64k-6-2 ubuntu-upgrade-linux-image-nvidia-64k-hwe-22-04 ubuntu-upgrade-linux-image-nvidia-hwe-22-04 ubuntu-upgrade-linux-image-nvidia-lowlatency ubuntu-upgrade-linux-image-oem-20-04 ubuntu-upgrade-linux-image-oem-20-04b ubuntu-upgrade-linux-image-oem-20-04c ubuntu-upgrade-linux-image-oem-20-04d ubuntu-upgrade-linux-image-oem-22-04b ubuntu-upgrade-linux-image-oem-22-04c ubuntu-upgrade-linux-image-oracle ubuntu-upgrade-linux-image-oracle-lts-22-04 ubuntu-upgrade-linux-image-raspi ubuntu-upgrade-linux-image-raspi-nolpae ubuntu-upgrade-linux-image-starfive ubuntu-upgrade-linux-image-virtual ubuntu-upgrade-linux-image-virtual-hwe-20-04 ubuntu-upgrade-linux-image-virtual-hwe-22-04 References https://attackerkb.com/topics/cve-2023-4569 CVE - 2023-4569 USN-6383-1 USN-6384-1 USN-6385-1 USN-6386-1 USN-6386-2 USN-6386-3 USN-6466-1 View more