최신 보안 정보
10월 24일 (토)어제
Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
影響: rust:wasmtime < 36.0.19 → 36.0.19, rust:wasmtime >= 37.0.0, < 43.0.0 → 43.0.0 In Wasmtime prior to v43, the Cranelift compiler backend bit-packs its SSA value indices in a way that can result in silent overflow in release builds, and result in incorrect value references in the IR resulting in arbitrary miscompilation. A very large Wasm function body, or one that is specially crafted to use many SSA values, can use this to force type-confusion or other arbitrary side-effects and escape the sandbox. Cranelift was changed in Wasmtime v43 to use a full u32 index, with checks…
gitoxide gix: untrusted .git/config disables filesystem .git-protection path checks via unfiltered protect_options()
影響: rust:gix >= 0.88.0, <= 0.89.0 → 0.90.0 In the gix crate, Cache::protect_options() in gix/src/config/cache/access.rs reads the three filesystem path-protection settings (core.protectHFS, core.protectNTFS, and gitoxide.core.protectWindows) with the unfiltered gix_config::File::boolean() accessor instead of the trust-aware boolean_filter() accessor used by every other security-critical config read in the same file. When a repository is opened with reduced trust (an ownership mismatch, which maps .git/config sections to Trust::Reduced),…
10월 23일 (금)
Librsvg: Use-after-free when XML includes have duplicated entities
影響: rust:librsvg < 2.57.5 → 2.57.5, rust:librsvg >= 2.60.0-beta.0, < 2.60.3 → 2.60.3, rust:librsvg >= 2.61.0, < 2.61.5 → 2.61.5, rust:librsvg >= 2.62.0-beta.0, < 2.62.4 → 2.62.4, rust:librsvg >= 2.63.0-beta.0, < 2.63.2 → 2.63.2 Librsvg uses libxml2, a C library, to parse XML. When librsvg parses an SVG document which has a nested Xinclude, an XML entity declaration with a duplicate name as an existing one can cause a use-after-free error. While libxml2 is expanding an internal entity, a recursive XInclude can parse another document that declares an entity with the same name. Both parses use the same XmlState entity map on the librsvg side. entity_insert() replaces the first entry, whose Drop implementation calls xmlFr…
10월 17일 (토)
lopdf has a stack overflow via deeply nested PDF objects
影響: rust:lopdf < 0.42.0 → 0.42.0 lopdf::Document::load_mem (and the other load entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (/X [[[ … ]]], on the order of 10,000 levels) exhausts the call stack and aborts the process with SIGABRT. Because this is a stack-overflow abort rather than a panic!, it cannot be caught with catch_unwind: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting i…