Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
erences: - https://go.dev/issue/62266 - https://go.dev/cl/523039 - https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ - https://pkg.go.dev/vuln/GO-2023-2045 - https://security.netapp.com/advisory/ntap-20231020-0004/ - https://security.gentoo.org/glsa/202311-09
CVE ID: CVE-2023-39323 State: PUBLISHED Published: 2023-10-05T20:36:58.756Z Last Updated: 2025-06-12T15:15:12.065Z Vendors: Go toolchain Products: cmd/go Problem Types: CWE 94: Improper Control of Generation of Code ('Code Injection') Description: Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution of arbitrary code when running "go build". The line directive requires the absolute path of the file in which the directive lives, which makes exploiting this issue significantly more complex. Additional Analyst Notes: - CVE Program Container:
lives, which makes exploiting this issue significantly more complex. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://go.dev/issue/63211 - https://go.dev/cl/533215 - https://groups.google.com/g/golang-announce/c/XBa1oHDevAo - https://pkg.go.dev/vuln/GO-2023-2095 - https://security.netapp.com/advisory/ntap-20231020-0001/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/ - https://lists.fedoraproject.org/archives/list/package-announce@l
project.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/ - https://security.gentoo.org/glsa/202311-09
CVE ID: CVE-2023-39324 State: REJECTED Published: N/A Last Updated: 2024-07-02T16:19:54.031Z Description: No description available.
CVE ID: CVE-2023-39325 State: PUBLISHED Published: 2023-10-11T21:15:02.727Z Last Updated: 2025-02-13T17:02:50.341Z Vendors: Go standard library, golang.org/x/net Products: net/http, golang.org/x/net/http2 Problem Types: CWE-400: Uncontrolled Resource Consumption Description: A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound the number of simultaneousl
st while the existing one is still executing. With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the
streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function. Additional Analyst Notes: - CVE Program Container: References: - https://go.dev/issue/63417 - https://go.dev/cl/534215 - https://go.dev/cl/534235 - https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ - https://pkg.go.dev/vuln/GO-2023-2102 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7O
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/ - https://security.netapp.com/advisory/ntap-20231110-0008/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OXGWPQOJ3JNDW2XIYKIVJ7N7QUIFNM2Q/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZQIELEIRSZUYTFFH5KTH2YJ4IIQG2KE/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QF5QSYAOPDOWLY6DUHI
KE/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QF5QSYAOPDOWLY6DUHID56Q4HQFYB45I/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XTNLSL44Y5FB6JWADSZH6DCV4JJAAEQY/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ECRC75BQJP6FJN2L7KCKYZW4DSBD7QSD/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YRKEXKANQ7BKJW2YTAMP625LJUJZLJ4P/ - https://lists.fedoraproject.org/archive
age-announce@lists.fedoraproject.org/message/YRKEXKANQ7BKJW2YTAMP625LJUJZLJ4P/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D2BBIDR2ZMB3X5BC7SR4SLQMHRMVPY6L/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UTT7DG3QOF5ZNJLUGHDNLRUIN6OWZARP/ - https://security.gentoo.org/glsa/202311-09 - https://lists.fedoraproject.org/archives/list/pack
ZNJLUGHDNLRUIN6OWZARP/ - https://security.gentoo.org/glsa/202311-09 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ULQQONMSCQSH5Z5OWFFQHCGEZ3NL4DRJ/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R3UETKPUB3V5JS5TLZOF3SMTGT5K5APS/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3SZN67IL7HMGMNAVLOTIXLIHUDXZK4LH/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NG7IMPL55MVWU3LCI4JQJT3K2U5CHDV7/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GSY7SXFFTPZ
3K2U5CHDV7/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GSY7SXFFTPZFWDM6XELSDSHZLVW3AHK7/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WCNCBYKZXLDFGAJUB7ZP5VLC3YTHJNVH/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AVZDNSMVDAQJ64LJC5I5U5LDM5753647/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZSVEMQV5ROY5YW5QE3I57HT3ITWG5GCV/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B/ - https://lists.fedoraproject.org
ist/package-announce@lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3OVW5V2DM5K5IC3H7O42YDUGNJ74J35O/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MZQYOOKHQDQ57LV2IAG6NRFOVXKHJJ3Z/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5RSKA2II6QTD4YUKUNDVJQSRYSFC4VFR/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/
KA2II6QTD4YUKUNDVJQSRYSFC4VFR/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FTMJ3NJIDAZFWJQQSP3L22MUFJ3UP2PT/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPWCNYB5PQ5PCVZ4NJT6G56ZYFZ5QBU6/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LZSWTV4NV4SNQARNXG5T6LRHP26EW2/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PJCUNGIQDUMZ4Z6HWVYIMR66A35F5S74/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L5E5JSJBZLYXOTZWXHJKRVCIXIHVWKJ6/ - https://list
ject.org/archives/list/package-announce@lists.fedoraproject.org/message/L5E5JSJBZLYXOTZWXHJKRVCIXIHVWKJ6/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YJWHBLVZDM5KQSDFRBFRKU5KSSOLIRQ4/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3WJ4QVX2AMUJ2F2S27POOAHRC4K3CHU4/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ODBY7RVMGZCBSTWF2OZGIZS57FNFUL67/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QXOU2JZUBEBP7GBKAYIJRPRBZSJCD7ST/
CVE ID: CVE-2023-39326 State: PUBLISHED Published: 2023-12-06T16:27:53.832Z Last Updated: 2025-02-13T17:02:50.990Z Vendors: Go standard library Products: net/http/internal Problem Types: CWE-400: Uncontrolled Resource Consumption Description: A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which permit including additional metadata in a
ntire body of a request. Chunk extensions are a little-used HTTP feature which permit including additional metadata in a request or response body sent using the chunked encoding. The net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real body to encoded bytes grows too small. Additional Analyst Notes: - CVE Program Container: References: - https://go.dev/issue/64433 - https://go.dev/cl/547335 - https://groups.google.com/g/golang-dev/c/6ypN5EjibjM/m/KmLVYH_uAgAJ - https://pkg.go.dev/vuln/GO-2023-2382 - https://lists.fedoraproject.org/archive
golang-dev/c/6ypN5EjibjM/m/KmLVYH_uAgAJ - https://pkg.go.dev/vuln/GO-2023-2382 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UIU6HOGV6RRIKWM57LOXQA75BGZSIH6G/
CVE ID: CVE-2023-39327 State: PUBLISHED Published: 2024-07-13T03:08:48.501Z Last Updated: 2025-11-21T07:05:47.817Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: Red Hat Products: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 Problem Types: CWE-400 Description: A flaw was found in OpenJPEG. Maliciously constructed pictures can cause the program to enter a large loop and continuously print warning messages on the terminal. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2023-39327 - https://bugzilla.redhat.com/
VE Program Container: References: - https://access.redhat.com/security/cve/CVE-2023-39327 - https://bugzilla.redhat.com/show_bug.cgi?id=2295812
CVE ID: CVE-2023-39328 State: PUBLISHED Published: 2024-07-09T13:53:07.111Z Last Updated: 2025-11-20T19:52:57.131Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 Problem Types: CWE-400 Description: A vulnerability was found in OpenJPEG similar to CVE-2019-6988. This flaw allows an attacker to bypass existing protections and cause an application crash through a maliciously crafted file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2023-39328 - h
CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2023-39328 - https://bugzilla.redhat.com/show_bug.cgi?id=2219236
CVE ID: CVE-2023-39329 State: PUBLISHED Published: 2024-07-13T03:09:18.573Z Last Updated: 2025-11-20T19:52:59.173Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 Problem Types: CWE-400 Description: A flaw was found in OpenJPEG. A resource exhaustion can occur in the opj_t1_decode_cblks function in tcd.c through a crafted image file, causing a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2023-39329 - https://bugzilla.redhat.co
CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2023-39329 - https://bugzilla.redhat.com/show_bug.cgi?id=2295816
CVE ID: CVE-2023-39331 State: PUBLISHED Published: 2023-10-18T03:55:18.506Z Last Updated: 2025-11-03T21:49:16.116Z Severity: HIGH (CVSS 7.7 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: NodeJS Products: Node Description: A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the implementation does not protect itself against the application overwriting built-in utility functions with user-defined implementations. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnr
mission model is an experimental feature of Node.js. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/2092852 - https://security.netapp.com/advisory/ntap-20231116-0009/
CVE ID: CVE-2023-39332 State: PUBLISHED Published: 2023-10-18T03:55:18.469Z Last Updated: 2025-11-03T21:49:17.572Z Vendors: NodeJS Products: Node Description: Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In Node.js environments, the `Buffer` class extends the `Uint8Array` class. Node.js prevents path traversal through strings (see CVE-2023-30584) and `Buffer` objects (see CVE-2023-32004), but not through non-`Buffer` `Uint8Array` objects. This is distinct from CVE-2023-32004 which only referred to `Buffer` objects. However, the vulnerability follows the same pattern using `Uint8Array` instead of `Buffer`. Please note that at the time this CVE
he vulnerability follows the same pattern using `Uint8Array` instead of `Buffer`. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/2199818 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/ - https://security.netapp.com/advisory/ntap-20231116-0009/
CVE ID: CVE-2023-39333 State: PUBLISHED Published: 2024-09-07T16:00:36.005Z Last Updated: 2025-11-03T21:49:19.026Z Vendors: NodeJS Products: Node Description: Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module. This vulnerability affects users of any active release line of Node.js. The vulnerable feature is only available if Node.js is started with the `--experimental-wasm-modules` command line option. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnr
e `--experimental-wasm-modules` command line option. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nodejs.org/en/blog/vulnerability/october-2023-security-releases
CVE ID: CVE-2023-39335 State: PUBLISHED Published: 2023-11-14T23:18:08.402Z Last Updated: 2024-08-29T17:17:07.805Z Vendors: Ivanti Products: EPMM Description: A security vulnerability has been identified in EPMM Versions 11.10, 11.9 and 11.8 and older allowing an unauthenticated threat actor to impersonate any existing user during the device enrollment process. This issue poses a significant security risk, as it enables unauthorized access and potential misuse of user accounts and resources. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/CVE-2023-39335?language=en_US
CVE ID: CVE-2023-39336 State: PUBLISHED Published: 2024-01-09T01:33:05.875Z Last Updated: 2025-06-03T14:33:22.988Z Severity: CRITICAL (CVSS 9.6 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Ivanti Products: Endpoint Manager Description: An unspecified SQL Injection vulnerability in Ivanti Endpoint Manager released prior to 2022 SU 5 allows an attacker with access to the internal network to execute arbitrary SQL queries and retrieve output without the need for authentication. Under specific circumstances, this may also lead to RCE on the core server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/SA-2023-1
yst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/SA-2023-12-19-CVE-2023-39336?language=en_US
CVE ID: CVE-2023-39337 State: PUBLISHED Published: 2023-11-14T23:18:08.440Z Last Updated: 2024-08-29T17:14:47.553Z Vendors: Ivanti Products: EPMM Description: A security vulnerability in EPMM Versions 11.10, 11.9 and 11.8 older allows a threat actor with knowledge of an enrolled device identifier to access and extract sensitive information, including device and environment configuration details, as well as secrets. This vulnerability poses a serious security risk, potentially exposing confidential data and system integrity. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/CVE-2023-39337?language=en_US
CVE ID: CVE-2023-39338 State: PUBLISHED Published: 2025-07-12T03:30:40.285Z Last Updated: 2025-07-15T03:55:09.051Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: Ivanti Products: Sentry Description: Enables an authenticated user (enrolled device) to access a service protected by Sentry even if they are not authorized according to the sentry policy to access that service. It does not enable the user to authenticate to or use the service, it just provides the tunnel access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/CVE-2023-39338
CVE ID: CVE-2023-39339 State: PUBLISHED Published: 2025-07-12T03:31:11.142Z Last Updated: 2025-07-14T16:08:15.813Z Severity: MEDIUM (CVSS 4.9 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Ivanti Products: Policy Secure Description: A vulnerability exists on all versions of Ivanti Policy Secure below 22.6R1 where an authenticated administrator can perform an arbitrary file read via a maliciously crafted web request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-patch-release-Ivanti-Policy-Secure-22-6R1
CVE ID: CVE-2023-39340 State: PUBLISHED Published: 2023-12-16T01:49:21.623Z Last Updated: 2024-11-27T15:14:36.145Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Ivanti Products: Connect Secure Description: A vulnerability exists on all versions of Ivanti Connect Secure below 22.6R2 where an attacker can send a specific request which may lead to Denial of Service (DoS) of the appliance. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-fix-release-Ivanti-Connect-Secure-22-6R2-and-22-6R2-1?language=en_US
CVE ID: CVE-2023-39341 State: PUBLISHED Published: 2023-08-09T02:42:51.631Z Last Updated: 2024-10-17T14:20:49.179Z Vendors: FFRI Security, Inc. , Soliton Systems K.K., NEC Corporation, SOURCENEXT CORPORATION , Sky Co., Ltd. Products: FFRI yarai, FFRI yarai Home and Business Edition, InfoTrace Mark II Malware Protection (Mark II Zerona), Zerona / Zerona PLUS, ActSecure χ, Dual Safe Powered by FFRI yarai, EDR Plus Pack, EDR Plus Pack Cloud Problem Types: Improper check or handling of exceptional conditions Description: "FFRI yarai", "FFRI yarai Home and Business Edition" and their OEM products handle exceptional conditions improperly, which may lead to denial-of-service (DoS) condition. Affect
their OEM products handle exceptional conditions improperly, which may lead to denial-of-service (DoS) condition. Affected products and versions are as follows: FFRI yarai versions 3.4.0 to 3.4.6 and 3.5.0, FFRI yarai Home and Business Edition version 1.4.0, InfoTrace Mark II Malware Protection (Mark II Zerona) versions 3.0.1 to 3.2.2, Zerona / Zerona PLUS versions 3.2.32 to 3.2.36, ActSecure χ versions 3.4.0 to 3.4.6 and 3.5.0, Dual Safe Powered by FFRI yarai version 1.4.1, EDR Plus Pack (Bundled FFRI yarai versions 3.4.0 to 3.4.6 and 3.5.0), and EDR Plus Pack Cloud (Bundled FFRI yarai versions 3.4.0 to 3.4.6 and 3.5.0). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrich
ed FFRI yarai versions 3.4.0 to 3.4.6 and 3.5.0). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ffri.jp/security-info/index.htm - https://www.soliton.co.jp/support/zerona_notice_2023.html - https://www.support.nec.co.jp/View.aspx?id=3140109240 - https://www.sourcenext.com/support/i/2023/230718_01 - https://www.skyseaclientview.net/news/230807_01/ - https://jvn.jp/en/jp/JVN42527152/
CVE ID: CVE-2023-39342 State: PUBLISHED Published: 2023-08-08T17:31:10.609Z Last Updated: 2024-10-04T15:06:10.772Z Severity: LOW (CVSS 3.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N) Vendors: freedomofpress Products: dangerzone Problem Types: CWE-150 Description: Dangerzone is software for converting potentially dangerous PDFs, office documents, or images to safe PDFs. The Dangerzone CLI (`dangerzone-cli` command) logs output from the container where the file sanitization takes place, to the user's terminal. Prior to version 0.4.2, if the container is compromised and can return attacker-controlled strings, then the attacker may be able to spoof messages in the user's terminal or change the
return attacker-controlled strings, then the attacker may be able to spoof messages in the user's terminal or change the window title. Besides logging output from containers, it also logs the names of the files it sanitizes. If these files contain ANSI escape sequences, then the same issue applies. Dangerzone is predominantly a GUI application, so this issue should leave most of our users unaffected. Nevertheless, we always suggest updating to the newest version. This issue is fixed in Dangerzone 0.4.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/freedomofpress/dangerzone/security/advisories/GHSA-pvwq-6vpp-2632 - https://github
ent: References: - https://github.com/freedomofpress/dangerzone/security/advisories/GHSA-pvwq-6vpp-2632 - https://github.com/freedomofpress/dangerzone/pull/491 - https://github.com/freedomofpress/dangerzone/releases/tag/v0.4.2