Search: 16.5-2

A denial of service vulnerability exists in rust-wasmtime versions before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1. The flaw is in wasmtime-wasi where guest WASI programs can cause the host to panic by overflowing filesystem timestamp fields. Specifically, attackers can pass atim or mtim values with sub-second fields that overflow the seconds field to certain filesystem time-setting functions, crashing the host process.

Mistune versions before 3.3.0 have a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by using ../ sequences in include paths. Additionally, attackers can inject HTML through unescaped error messages and included file contents, enabling cross-site scripting (XSS) even when escape=True is set. This vulnerability has a high severity with a CVSS score of 7.5.

Mistune versions before 3.3.0 have a path traversal vulnerability in the optional Include directive. This flaw allows attackers to read arbitrary local files by providing relative or absolute paths during Markdown rendering. Exploitation can lead to disclosure of sensitive files such as /etc/passwd and injection of unescaped HTML or script content into the rendered output.

Mistune versions before 3.3.0 have a path traversal vulnerability in the RST include directive. This flaw allows attackers to craft markdown with include directives that reference relative or absolute paths, enabling them to read arbitrary files. Sensitive files such as credentials or environment data can be exposed in the rendered HTML output. The vulnerability has a high severity with a CVSS score of 8.6.

Mistune versions from 3.2.1 up to but not including 3.3.0 contain a CSS injection vulnerability. This flaw allows attackers who can control markdown input to inject arbitrary CSS style declarations via the unvalidated figwidth option of the figure directive. Exploitation can cause victim browsers to send requests to attacker-controlled servers, potentially leaking attribute values. The vulnerability has a medium severity rating with a CVSS score of 4.7.

Mistune versions before 3.3.0 have a cross-site scripting (XSS) vulnerability in the Include directive. This flaw occurs because included .html, .xhtml, or .htm files are emitted as raw HTML tokens without proper escaping. An attacker who can place a readable HTML file on the system and leverage path traversal can cause stored scripts to execute if escape=False is set in the renderer.

Mistune versions from 3.0.0 up to but not including 3.3.0 contain an algorithmic complexity denial of service (DoS) vulnerability in the parse_link_text function. This flaw allows attackers to craft markdown input with deeply nested square brackets that cause quadratic parsing time, leading to excessive CPU consumption and potential service disruption.

Mistune versions from 3.0.0 up to but not including 3.3.0 contain an algorithmic complexity vulnerability in the inline link parser's parse_link_text function. This flaw allows unauthenticated attackers to cause high CPU usage by submitting Markdown with many unbalanced '[' or '![' characters, resulting in repeated unbounded forward scans that can tie up worker processes for minutes. The vulnerability has a high severity with a CVSS score of 7.5.

Mistune versions before 3.3.0 have an inefficient algorithmic complexity vulnerability in the parse_link_text function. This flaw allows remote attackers to cause denial of service by submitting markdown with long runs of unmatched square brackets. The vulnerability triggers repeated forward scans in mistune.html(), stalling worker processes for extended periods.

Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not adequately account for host allocations when lifting guest values through the dynamically-typed Val API, bypassing the hostcall fuel limit. A malicious WebAssembly guest can return crafted values that allocate at least ~100x more host memory than tracked, causing denial of service.

wasmtime-wasi-http in Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not enforce the wasi:io/streams check-write allowance for WASIp2 outgoing HTTP bodies, so oversized writes succeed instead of trapping. A malicious guest can pass large buffers to write on outgoing-body resources, holding host allocations for the store's lifetime and exhausting host memory.

Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of unmatched '[' characters. Attackers can send small markdown payloads that trigger O(N^2) parse_link_text and parse_link_label probing, occupying rendering workers for 30+ seconds per 16 KB input.

This analysis covers advanced Android threats that operate beyond the standard application sandbox, leveraging new OS-level telemetry features. Android's Delegated Scope allows enterprises to grant security apps access to logs on managed devices without full MDM control. The Intrusion Logging feature extends forensic visibility to BYOD users with Advanced Protection on Android 16 or later. This capability enables collection and sharing of encrypted security, DNS, and connection logs for threat analysis. The analysis reveals the full RatHat attack chain, including Wireless Debugging self-pairing, ADB shell command execution, daemon staging, and command-and-control communications, providing actionable indicators of compromise.

Pylint versions from 0.15.2 up to 4.0.8 store module statistics in predictable cache files under PYLINT_HOME and load them using pickle.load. An attacker with write access to a shared or group-writable cache directory can replace these cache files with malicious serialized data, leading to arbitrary code execution with the privileges of the user running Pylint. The default per-user cache is typically not writable by others. This vulnerability is fixed in Pylint version 4.0.9.

dnspython versions prior to 2.9.0 contain a vulnerability in the dns.name.from_wire_parser function, which follows attacker-controlled DNS compression pointer chains without a hop limit. This can allow a malicious DNS message to cause excessive pointer traversal during name decompression, resulting in high CPU usage, application degradation, or denial of service. The issue is fixed in version 2.9.0.

A memory-related vulnerability in an upstream library used by Next.js for Image Optimization can lead to unauthenticated remote code execution (RCE) when processing SVG files on glibc-based Linux systems. This affects Next.js versions from 10.0.0 up to but excluding 15.5.28, and from 16.0.0 up to but excluding 16.4.1. The vulnerability is critical and can be mitigated by upgrading the 'sharp' library to version 0.35.5 or later, which is included in patched Next.js releases.

Next.js versions from 13.0.0 up to but excluding 15.5.28, and from 16.0.0 up to but excluding 16.4.1, contain a vulnerability where crafted requests targeting App Router applications with Server Actions can cause excessive CPU usage and block further request processing in the same process. Applications using the Pages Router or App Router without Server Actions are not affected. This issue is fixed in versions 15.5.28 and 16.4.1.