deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-47264
Published: 2023-11-16
Description: Certain WithSecure products have a buffer over-read whereby processing certain fuzz file types may cause a denial of service (DoS). This affects WithSecure Client Security 15, WithSecure Server Security 15, WithSecure Email and Server Security 15, WithSecure Elements Endpoint Protection 17 and later, WithSecure Client Security for Mac 15, WithSecure Elements Endpoint Protection for Mac 17 and later, WithSecure Linux Security 64 12.0, WithSecure Linux Protection 12.0, and WithSecure Atlant (formerly F-Secure Atlant) 15 and later.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://www.withsecure.com/en/support/security-advisories/cve-2023-47264; https://www.withsecure.com/en/support/security-advisories/cve-2023-47264
CVE: CVE-2023-47470
Published: 2023-11-16
Description: Buffer Overflow vulnerability in Ffmpeg before github commit[PII_REDACTED]a11356210ed8edcecb920105e40b60 allows a remote attacker to achieve an out-of-array write, execute arbitrary code, and cause a denial of service (DoS) via the ref_pic_list_struct function in libavcodec/evc_ps.c
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/FFmpeg/FFmpeg/commit/[PII_REDACTED]a11356210ed8edcecb920105e40b60; https://github.com/goldds96/Report/tree/main/FFmpeg; https://patchwork.ffmpeg.org/project/ffmpeg/patch/[PII_REDACTED]1147.5945-2-michael%40niedermayer.cc/
CVE: CVE-2023-47471
Published: 2023-11-16
Description: Buffer Overflow vulnerability in strukturag libde265 v1.10.12 allows a local attacker to cause a denial of service via the slice_segment_header function in the slice.cc component.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: https://github.com/strukturag/libde265/commit/e36b4a1b0bafa53df47514c419d5be3e8916ebc7; https://github.com/strukturag/libde265/issues/426; https://lists.debian.org/debian-lts-announce/2023/11/msg00032.html
CVE: CVE-2021-35437
Published: 2023-11-16
Description: SQL injection vulnerability in LMXCMS v.1.4 allows attacker to execute arbitrary code via the TagsAction.class.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/GHA193/Vulns/blob/main/lmxcms%20injection.md; https://github.com/GHA193/Vulns/blob/main/lmxcms%20injection.md
CVE: CVE-2023-43275
Published: 2023-11-16
Description: Cross-Site Request Forgery (CSRF) vulnerability in DedeCMS v5.7 in 110 backend management interface via /catalog_add.php, allows attackers to create crafted web pages due to a lack of verification of the token value of the submitted form.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/thedarknessdied/dedecms/blob/main/v5.7_110-CSRF.md; https://github.com/thedarknessdied/dedecms/blob/main/v5.7_110-CSRF.md
CVE: CVE-2023-47003
Published: 2023-11-16
Description: An issue in RedisGraph v.2.12.10 allows an attacker to execute arbitrary code and cause a denial of service via a crafted string in DataBlock_ItemIsDeleted.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-476, CWE-20, CWE-94
References: https://github.com/RedisGraph/RedisGraph/issues/3063; https://github.com/RedisGraph/RedisGraph/issues/3063
CVE: CVE-2023-47335
Published: 2023-11-16
Description: Insecure permissions in the setNFZEnable function of Autel Robotics EVO Nano drone v1.6.5 allows attackers to breach the geo-fence and fly into no-fly zones.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-276, CWE-276
References: https://github.com/czbxzm/AUTEL-smart-drones-have-a-vulnerability-to-unauthorised-breaches-of-no-fly-zone; https://github.com/czbxzm/AUTEL-smart-drones-have-a-vulnerability-to-unauthorised-breaches-of-no-fly-zone
CVE: CVE-2023-43752
Published: 2023-11-16
Description: OS command injection vulnerability in WRC-X3000GS2-W v1.05 and earlier, WRC-X3000GS2-B v1.05 and earlier, and WRC-X3000GS2A-B v1.05 and earlier allows a network-adjacent authenticated user to execute an arbitrary OS command by sending a specially crafted request.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://jvn.jp/en/vu/JVNVU94119876/; https://www.elecom.co.jp/news/security/20231114-01/; https://jvn.jp/en/vu/JVNVU94119876/
CVE: CVE-2023-43757
Published: 2023-11-16
Description: Inadequate encryption strength vulnerability in multiple routers provided by ELECOM CO.,LTD. and LOGITEC CORPORATION allows a network-adjacent unauthenticated attacker to guess the encryption key used for wireless LAN communication and intercept the communication. As for the affected products/versions, see the information provided by the vendor under [References] section.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-326
References: https://jvn.jp/en/vu/JVNVU94119876/; https://www.elecom.co.jp/news/security/20210706-01/; https://www.elecom.co.jp/news/security/20230810-01/
CVE: CVE-2023-44296
Published: 2023-11-16
Description: 
Dell ELab-Navigator, version 3.1.9 contains a hard-coded credential vulnerability. A local attacker could potentially exploit this vulnerability, leading to unauthorized access to sensitive data. Successful exploitation may result in the compromise of confidential user information.


CVSS Score: 8.4 (HIGH)
CWE: CWE-798, CWE-798
References: https://www.dell.com/support/kbdoc/en-us/000219558/dsa-2023-419-security-update-for-mobility-e-lab-navigator-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000219558/dsa-2023-419-security-update-for-mobility-e-lab-navigator-vulnerabilities
CVE: CVE-2023-47213
Published: 2023-11-16
Description: First Corporation's DVRs use a hard-coded password, which may allow a remote unauthenticated attacker to rewrite or obtain the configuration information of the affected device. Note that updates are provided only for Late model of CFR-4EABC, CFR-4EAB, CFR-8EAB, CFR-16EAB, MD-404AB, and MD-808AB. As for the other products, apply the workaround.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-798
References: https://jvn.jp/en/vu/JVNVU99077347/; https://www.c-first.co.jp/information/ddososhirase/; https://www.c-first.co.jp/wp/wp-content/uploads/2023/11/tuushin.pdf
CVE: CVE-2023-47674
Published: 2023-11-16
Description: Missing authentication for critical function vulnerability in First Corporation's DVRs allows a remote unauthenticated attacker to rewrite or obtain the configuration information of the affected device. Note that updates are provided only for Late model of CFR-4EABC, CFR-4EAB, CFR-8EAB, CFR-16EAB, MD-404AB, and MD-808AB. As for the other products, apply the workaround.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306, CWE-306
References: https://jvn.jp/en/vu/JVNVU99077347/; https://www.c-first.co.jp/information/ddososhirase/; https://www.c-first.co.jp/wp/wp-content/uploads/2023/11/tuushin.pdf
CVE: CVE-2023-26031
Published: 2023-11-16
Description: Relative library resolution in linux container-executor binary in Apache Hadoop 3.3.1-3.3.4 on Linux allows local user to gain root privileges. If the YARN cluster is accepting work from remote (authenticated) users, this MAY permit remote users to gain root privileges.

Hadoop 3.3.0 updated the " YARN Secure Containers https://hadoop.apache.org/docs/stable/hadoop-yarn/hadoop-yarn-site/SecureContainer.html " to add a feature for executing user-submitted applications in isolated linux containers.

The native binary HADOOP_HOME/bin/container-executor is used to launch these containers; it must be owned by root and have the suid bit set in order for the YARN processes to run the containers as the specific users submitting the jobs.

The patch " YARN-10495 https://issues.apache.org/jira/browse/YARN-10495 . make the rpath of container-executor configurable" modified the library loading path for loading .so files from "$ORIGIN/" to ""$ORIGIN/:../lib/native/". This is the a path through which libcrypto.so is located. Thus it is is possible for a user with reduced privileges to install a malicious libcrypto library into a path to which they have write access, invoke the container-executor command, and have their modified library executed as root.
If the YARN cluster is accepting work from remote (authenticated) users, and these users' submitted job are executed in the physical host, rather than a container, then the CVE permits remote users to gain root privileges.

The fix for the vulnerability is to revert the change, which is done in  YARN-11441 https://issues.apache.org/jira/browse/YARN-11441 , "Revert YARN-10495". This patch is in hadoop-3.3.5.

To determine whether a version of container-executor is vulnerable, use the readelf command. If the RUNPATH or RPATH value contains the relative path "./lib/native/" then it  is at risk

$ readelf -d container-executor|grep 'RUNPATH\|RPATH' 
0x[PII_REDACTED]00001d (RUNPATH)            Library runpath: [$ORIGIN/:../lib/native/]

If it does not, then it is safe:

$ readelf -d container-executor|grep 'RUNPATH\|RPATH' 
0x[PII_REDACTED]00001d (RUNPATH)            Library runpath: [$ORIGIN/]

For an at-risk version of container-executor to enable privilege escalation, the owner must be root and the suid bit must be set

$ ls -laF /opt/hadoop/bin/container-executor
---Sr-s---. 1 root hadoop 802968 May 9 20:21 /opt/hadoop/bin/container-executor

A safe installation lacks the suid bit; ideally is also not owned by root.

$ ls -laF /opt/hadoop/bin/container-executor
-rwxr-xr-x. 1 yarn hadoop 802968 May 9 20:21 /opt/hadoop/bin/container-executor

This configuration does not support Yarn Secure Containers, but all other hadoop services, including YARN job execution outside secure containers continue to work.
CVSS Score: 7.5 (HIGH)
CWE: CWE-426, CWE-426
References: https://hadoop.apache.org/cve_list.html; https://issues.apache.org/jira/browse/YARN-11441; https://lists.apache.org/thread/q9qpdlv952gb4kphpndd5phvl7fkh71r
CVE: CVE-2023-32469
Published: 2023-11-16
Description: 
Dell Precision Tower BIOS contains an Improper Input Validation vulnerability. A locally authenticated malicious user with admin privileges could potentially exploit this vulnerability to perform arbitrary code execution.


CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.dell.com/support/kbdoc/en-us/000216242/dsa-2023-223-security-update-for-a-dell-precision-tower-bios-vulnerability; https://www.dell.com/support/kbdoc/en-us/000216242/dsa-2023-223-security-update-for-a-dell-precision-tower-bios-vulnerability
CVE: CVE-2023-39246
Published: 2023-11-16
Description: 
Dell Encryption, Dell Endpoint Security Suite Enterprise, and Dell Security Management Server version prior to 11.8.1 contain an Insecure Operation on Windows Junction Vulnerability during installation. A local malicious user could potentially exploit this vulnerability to create an arbitrary folder inside a restricted directory, leading to Privilege Escalation


CVSS Score: 4.6 (MEDIUM)
CWE: CWE-61, CWE-59
References: https://www.dell.com/support/kbdoc/en-us/000217572/dsa-2023-271; https://www.dell.com/support/kbdoc/en-us/000217572/dsa-2023-271
CVE: CVE-2023-39259
Published: 2023-11-16
Description: 
Dell OS Recovery Tool, versions 2.2.4013, 2.3.7012.0, and 2.3.7515.0 contain an Improper Access Control Vulnerability. A local authenticated non-administrator user could potentially exploit this vulnerability, leading to the elevation of privilege on the system.


CVSS Score: 7.3 (HIGH)
CWE: CWE-284
References: https://www.dell.com/support/kbdoc/en-us/000217078/dsa-2023-319dsa-2023-319; https://www.dell.com/support/kbdoc/en-us/000217078/dsa-2023-319dsa-2023-319
CVE: CVE-2023-44282
Published: 2023-11-16
Description: 
Dell Repository Manager, 3.4.3 and prior, contains an Improper Access Control vulnerability in its installation module. A local low-privileged attacker could potentially exploit this vulnerability, leading to gaining escalated privileges.


CVSS Score: 6.7 (MEDIUM)
CWE: CWE-284, CWE-269
References: https://www.dell.com/support/kbdoc/en-us/000219303/dsa-2023-415-security-update-for-dell-repository-manager-vulnerability; https://www.dell.com/support/kbdoc/en-us/000219303/dsa-2023-415-security-update-for-dell-repository-manager-vulnerability
CVE: CVE-2023-44292
Published: 2023-11-16
Description: 
Dell Repository Manager, 3.4.3 and prior, contains an Improper Access Control vulnerability in its installation module. A local low-privileged attacker could potentially exploit this vulnerability, leading to gaining escalated privileges.


CVSS Score: 6.7 (MEDIUM)
CWE: CWE-284, CWE-269
References: https://www.dell.com/support/kbdoc/en-us/000219303/dsa-2023-415-security-update-for-dell-repository-manager-vulnerability; https://www.dell.com/support/kbdoc/en-us/000219303/dsa-2023-415-security-update-for-dell-repository-manager-vulnerability
CVE: CVE-2023-44336
Published: 2023-11-16
Description: Adobe Acrobat Reader versions 23.006.20360 (and earlier) and 20.005.30524 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb23-54.htm; https://helpx.adobe.com/security/products/acrobat/apsb23-54.htm; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1794
CVE: CVE-2023-44337
Published: 2023-11-16
Description: Adobe Acrobat Reader versions 23.006.20360 (and earlier) and 20.005.30524 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb23-54.htm; https://helpx.adobe.com/security/products/acrobat/apsb23-54.htm
CVE: CVE-2023-44338
Published: 2023-11-16
Description: Adobe Acrobat Reader versions 23.006.20360 (and earlier) and 20.005.30524 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb23-54.htm; https://helpx.adobe.com/security/products/acrobat/apsb23-54.htm
CVE: CVE-2023-44339
Published: 2023-11-16
Description: Adobe Acrobat Reader versions 23.006.20360 (and earlier) and 20.005.30524 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb23-54.htm; https://helpx.adobe.com/security/products/acrobat/apsb23-54.htm
CVE: CVE-2023-44340
Published: 2023-11-16
Description: Adobe Acrobat Reader versions 23.006.20360 (and earlier) and 20.005.30524 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb23-54.htm; https://helpx.adobe.com/security/products/acrobat/apsb23-54.htm
CVE: CVE-2023-44348
Published: 2023-11-16
Description: Adobe Acrobat Reader versions 23.006.20360 (and earlier) and 20.005.30524 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb23-54.htm; https://helpx.adobe.com/security/products/acrobat/apsb23-54.htm
CVE: CVE-2023-44356
Published: 2023-11-16
Description: Adobe Acrobat Reader versions 23.006.20360 (and earlier) and 20.005.30524 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb23-54.htm; https://helpx.adobe.com/security/products/acrobat/apsb23-54.htm
CVE: CVE-2023-44357
Published: 2023-11-16
Description: Adobe Acrobat Reader versions 23.006.20360 (and earlier) and 20.005.30524 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb23-54.htm; https://helpx.adobe.com/security/products/acrobat/apsb23-54.htm
CVE: CVE-2023-44358
Published: 2023-11-16
Description: Adobe Acrobat Reader versions 23.006.20360 (and earlier) and 20.005.30524 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb23-54.htm; https://helpx.adobe.com/security/products/acrobat/apsb23-54.htm
CVE: CVE-2023-44359
Published: 2023-11-16
Description: Adobe Acrobat Reader versions 23.006.20360 (and earlier) and 20.005.30524 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb23-54.htm; https://helpx.adobe.com/security/products/acrobat/apsb23-54.htm
CVE: CVE-2023-44360
Published: 2023-11-16
Description: Adobe Acrobat Reader versions 23.006.20360 (and earlier) and 20.005.30524 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb23-54.htm; https://helpx.adobe.com/security/products/acrobat/apsb23-54.htm
CVE: CVE-2023-44361
Published: 2023-11-16
Description: Adobe Acrobat Reader versions 23.006.20360 (and earlier) and 20.005.30524 (and earlier) are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb23-54.htm; https://helpx.adobe.com/security/products/acrobat/apsb23-54.htm
CVE: CVE-2023-44365
Published: 2023-11-16
Description: Adobe Acrobat Reader versions 23.006.20360 (and earlier) and 20.005.30524 (and earlier) are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-824
References: https://helpx.adobe.com/security/products/acrobat/apsb23-54.htm; https://helpx.adobe.com/security/products/acrobat/apsb23-54.htm
CVE: CVE-2023-44366
Published: 2023-11-16
Description: Adobe Acrobat Reader versions 23.006.20360 (and earlier) and 20.005.30524 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/acrobat/apsb23-54.htm; https://helpx.adobe.com/security/products/acrobat/apsb23-54.htm
CVE: CVE-2023-44367
Published: 2023-11-16
Description: Adobe Acrobat Reader versions 23.006.20360 (and earlier) and 20.005.30524 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb23-54.htm; https://helpx.adobe.com/security/products/acrobat/apsb23-54.htm
CVE: CVE-2023-44371
Published: 2023-11-16
Description: Adobe Acrobat Reader versions 23.006.20360 (and earlier) and 20.005.30524 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb23-54.htm; https://helpx.adobe.com/security/products/acrobat/apsb23-54.htm
CVE: CVE-2023-44372
Published: 2023-11-16
Description: Adobe Acrobat Reader versions 23.006.20360 (and earlier) and 20.005.30524 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb23-54.htm; https://helpx.adobe.com/security/products/acrobat/apsb23-54.html; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1842
CVE: CVE-2023-6119
Published: 2023-11-16
Description: 
An Improper Privilege Management vulnerability in Trellix GetSusp prior to version 5.0.0.27 allows a local, low privilege attacker to gain access to files that usually require a higher privilege level.  This is caused by GetSusp not correctly protecting a directory that it creates during execution, allowing an attacker to take over file handles used by GetSusp. As this runs with high privileges, the attacker gains elevated permissions. The file handles are opened as read-only. 


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-269, CWE-269
References: https://kcm.trellix.com/corporate/index?page=content&id=SB10412; https://kcm.trellix.com/corporate/index?page=content&id=SB10412
CVE: CVE-2023-6174
Published: 2023-11-16
Description: SSH dissector crash in Wireshark 4.0.0 to 4.0.10 allows denial of service via packet injection or crafted capture file
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-125, CWE-74
References: https://gitlab.com/wireshark/wireshark/-/issues/19369; https://www.wireshark.org/security/wnpa-sec-2023-28.html; https://gitlab.com/wireshark/wireshark/-/issues/19369