Forge (node-forge) is a JavaScript implementation of TLS. A remote, unauthenticated peer can send a TLS record of another content type in the middle of a fragmented handshake message, which causes an uncaught TypeError in process(). This terminates the affected connection or the Node.js process hosting it, so the impact is limited to availability (CVSS 7.5, A:H). Exposure is highest for Node.js services that use forge's TLS code and accept connections from untrusted peers.
Digital Bazaar · Forge (node-forge)
Forge (node-forge) is a JavaScript implementation of TLS. Before version 1.4.1, the TLS record processing in forge.tls.createConnection() handled each received record recursively, so a single input chunk with thousands of small records (for example heartbeat records) exhausts the JavaScript call stack. The attack needs no authentication and can be started by any peer that connects to a forge TLS server or to a server a forge TLS client connects to. In Node.js applications that call process() from a socket data handler, the uncaught exception terminates the process and drops the connections it serves.
Digital Bazaar · Forge (node-forge)
Research and translation in progress – available shortly.
A heap-based buffer overflow in the vtkWindBladeReader component of VTK 9.6.1 can be triggered by a specially crafted WindBlade .wind data set. A signed byteCount value in the binary data file can produce a zero-sized buffer, and out-of-bounds reads then follow. An attacker who can supply such a file to a vulnerable application can cause a deterministic denial of service and may expose heap-resident data.
Kitware · VTK
A out-of-bounds read vulnerability in the vtkChacoReader InputGraph2 function of VTK 9.6.1 allows an attacker to read memory outside the intended buffer. The flaw is caused by missing validation of neighbor vertex IDs in Chaco graph files, which are later used as point indices. An attacker can trigger it by supplying a specially crafted Chaco file to an application that parses such input, which may lead to a crash or limited information disclosure.
Kitware · VTK
The vtkBMPReader component of the VTK (Visualization Toolkit) library, version 9.6.1 according to the CNA, contains a memory corruption flaw when parsing BMP files with an unsupported bit depth. A specially crafted BMP file can cause a heap-buffer-overflow write, which can crash the application that opens the file. The attack requires that an application using VTK opens a malicious file, which is why exposure mainly concerns upload features or image-processing pipelines.
Kitware · VTK
A memory corruption flaw (out-of-bounds write) in the vtkDEMReader ReadProfiles function of VTK 9.6.1 causes a heap buffer overflow when a specially crafted USGS DEM file is parsed. An attacker who can supply such a file to an application that uses VTK can trigger the flaw, which the advisory describes as an availability impact (crash or denial of service). No authentication is required, but the malicious file must reach the parser. Code execution has not been confirmed.
Kitware · VTK
Research and translation in progress – available shortly.
The PNG reader (vtkPNGReader::vtkPNGReaderUpdate2) of the Visualization Toolkit (VTK) 9.6 contains an invalid pointer dereference. A specially crafted PNG file can crash the process, causing a denial of service. An attacker only needs to supply the malicious file to the application, without authentication or user interaction, if the application accepts untrusted PNG files.
Kitware · VTK
VTK 9.6 contains an invalid pointer dereference in vtkPNGReader::ExecuteInformation. A specially crafted PNG file can crash the process, causing a denial of service. The flaw is in error handling after a libpng longjmp, which can leave a dangling file pointer that is later passed to fclose(). The CVSS score of 7.5 reflects availability impact only, as the CNA rates it, but the NVD entry was still awaiting analysis at the time of writing.
Kitware · VTK
Research and translation in progress – available shortly.
A local attacker with low privileges can exploit an External Control of File Name or Path vulnerability in WiFiman Desktop to run arbitrary commands with root privileges on the host. The attacker must already have an account on the device, and internet exposure is not a factor. According to the CNA record, the macOS build is affected; the NVD entry was still awaiting analysis at the time of research.
Ubiquiti · WiFiman Desktop
WiFiman Desktop, a Wi-Fi diagnostic utility from Ubiquiti, binds to an unrestricted IP address. An attacker on the same network can exploit this to obtain information about the host device. The attack requires no authentication and no user interaction, but the impact is limited to confidentiality; remote code execution is not described.
Ubiquiti Inc · WiFiman Desktop
HashiCorp Nomad and Nomad Enterprise follow symbolic links during same-client allocation data migration. A workload that can submit or update jobs can plant a symlink in a task-local directory, which Nomad preserves and later follows when setting directory permissions and ownership. On clients running as root, this can change permissions and ownership of host directories outside the allocation, enabling unauthorized access to host data, modification of host files and possibly privilege escalation (CVSS 8.8).
HashiCorp · Nomad
Forge (node-forge) is a JavaScript library implementing TLS and cryptography. Versions before 1.4.1 accept a PKCS#12 MAC or password-based encryption iteration count of zero, which makes the derived key a constant independent of the password and salt. An attacker can modify PKCS#12/PFX files or encrypted private keys and forge a valid MAC without knowing the password, so an application may accept an attacker's certificate and key. The attack requires no authentication, but only applies if the application parses such files from untrusted sources; confidentiality is not affected.
Digital Bazaar · Forge (node-forge)
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Forge (node-forge) is a JavaScript implementation of Transport Layer Security. Its PEM parser uses regular expressions whose processing time grows polynomially with malformed input, so an unauthenticated attacker can block the Node.js event loop with a long crafted message. The issue affects applications that pass untrusted PEM data to node-forge, for example services that accept uploaded certificates or keys.
Digital Bazaar · Forge (node-forge)
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
The joi validation library for Node.js is affected when the string().email({ multiple: true }) rule processes long runs of whitespace without a separator. An attacker who can submit a crafted value to such a field can cause one request to consume seconds of CPU time and block the Node.js event loop, which delays all other work in the application. The issue applies only where attacker-controlled input is validated with the multiple option and no effective length limit runs first; a .max() rule alone is not sufficient when abortEarly is set to false.
hapijs · joi
