openssh: the functions order_hostkeyalgs() and list_hostkey_types() leads to double-free vulnerability

OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states "remote code execution is theoretically possible."

python: urllib.parse url blocklisting bypass

An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.

curl: HTTP multi-header compression denial of service

An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with differentalgorithms. The number of acceptable "links" in this "decompression chain" wascapped, but the cap was implemented on a per-header basis allowing a maliciousserver to insert a virtually unlimited number of compression steps simply byusing many headers. The use of such a decompression chain could result in a "malloc bomb", making curl end up spending enormous amounts of allocated heap memory, or trying to and returning out of memory errors.

curl: HSTS amnesia with --parallel

A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality to behave incorrectly when multiple URLs are requested in parallel. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. This HSTS mechanism would however surprisingly fail when multiple transfers are done in parallel as the HSTS cache file gets overwritten by the most recentlycompleted transfer. A later HTTP-only transfer to the earlier host name would then *not* get upgraded properly to HSTS.

curl: HSTS ignored on multiple requests

A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially. Using its HSTS support, curl can be instructed to use HTTPS instead of usingan insecure clear-text HTTP step even when HTTP is provided in the URL. ThisHSTS mechanism would however surprisingly be ignored by subsequent transferswhen done on the same command line because the state would not be properlycarried on.

kernel: Integer overflow in function rndis_query_oid of rndis_wlan.c

In rndis_query_oid in drivers/net/wireless/rndis_wlan.c in the Linux kernel through 6.1.5, there is an integer overflow in an addition.

Kernel: denial of service in atm_tc_enqueue in net/sched/sch_atm.c due to type confusion

atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results).

kernel: slab-out-of-bounds read vulnerabilities in cbq_classify

cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results).

Roo-Code through 3.54.0 Auto-Approve Bypass via Redirect Operator Stripping

Roo Code through 3.54.0 contains a command approval bypass vulnerability in getCommandDecision() that allows attackers to auto-approve denied shell commands by prefixing them with a bare >& redirect. Attackers using indirect prompt injection can make the allowlist match a redirect target like echo while the shell runs the denied command on the developer machine.

Windows Security Health Service Elevation of Privilege Vulnerability

Use after free in Windows Security App allows an authorized attacker to elevate privileges locally.

Microsoft 365 Copilot Business Chat Information Disclosure Vulnerability

Improper neutralization of special elements used in a command ('command injection') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose information over a network.

Microsoft Copilot Information Disclosure Vulnerability

Ai command injection in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.

Microsoft Partner Center Elevation of Privilege Vulnerability

Improper certificate validation in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network.

Windows Projected File System Elevation of Privilege Vulnerability

Use after free in Windows Projected File System allows an authorized attacker to elevate privileges locally.

Windows Shell Security Feature Bypass Vulnerability

Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.

SQL Server Elevation of Privilege Vulnerability

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.

Windows Projected File System Elevation of Privilege Vulnerability

Double free in Windows Projected File System allows an authorized attacker to elevate privileges locally.

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

Windows Projected File System Elevation of Privilege Vulnerability

Double free in Windows Projected File System allows an authorized attacker to elevate privileges locally.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.