HyperForum — [Hyperbola] Current security-threads overview

Re: [Hyperbola] Current security-threads overview

2025-06-24T21:31:28Z

CVE-2025-5222: A stack buffer overflow was found in ICU version 76.0.1. While running the genrb binary the 'subtag' struct is overflowed in SRBRoot::addTag function. This may lead to memory corruption and arbitrary code execution.

Conclusion: Our version of icu is not affected and there is no need for a fix.

Re: [Hyperbola] Current security-threads overview

2025-05-22T00:11:26Z

CVE-2025-40775: When an incoming DNS protocol message includes a Transaction Signature (TSIG), BIND always checks it. If the TSIG contains an invalid value in the algorithm field, BIND immediately aborts with an assertion failure. This issue affects BIND 9 versions 9.20.0 through 9.20.8 and 9.21.0 through 9.21.7.

Conclusion: Our version of bind is not affected and there is no need for a fix.

Re: [Hyperbola] Current security-threads overview

2025-05-06T22:21:43Z

CVE-2025-23016: FastCGI fcgi2 (aka fcgi) 2.x through 2.4.4 has an integer overflow (and resultant heap-based buffer overflow) via crafted nameLen or valueLen values in data to the IPC socket. This occurs in ReadParams in fcgiapp.c.

Conclusion: We have prepared and backported security-patches for our version of fcgi.

Re: [Hyperbola] Current security-threads overview

2025-05-06T21:26:00Z

CVE-2025-2760: GIMP XWD File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XWD files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25082.

CVE-2025-2761: GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of FLI files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25100.

Conclusion: We have prepared security-patches for our version of gimp. Furthermore we will remove the following plugins:

file-dds
file-ico
file-fax3g
file-psd

Sorry for everyone using PSD-files for import / export. But we do not plan with those file-formats as gimp has sufficient others. ico-files can be converted and created on different ways (graphicsmagick). So there is no loss in any way, just a win in security-fixes.

Re: [Hyperbola] Current security-threads overview

2025-04-26T10:03:09Z

CVE-2025-32414: In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API (Python bindings) because of an incorrect return value. This occurs in xmlPythonFileRead and xmlPythonFileReadRaw because of a difference between bytes and characters.

CVE-2025-32415: In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used.

Conclusion: We have prepared security-patches for our version of libxml2.

Re: [Hyperbola] Current security-threads overview

2025-04-23T21:59:01Z

CVE-2025-32464: HAProxy 2.2 through 3.1.6, in certain uncommon configurations, has a sample_conv_regsub heap-based buffer overflow because of mishandling of the replacement of multiple short patterns with a longer one.

Conclusion: We have prepared already security-patches for our version of haproxy.

Re: [Hyperbola] Current security-threads overview

2025-04-23T21:51:20Z

CVE-2025-3155: A flaw was found in Yelp. The Gnome user help application allows the help document to execute arbitrary scripts. This vulnerability allows malicious users to input help documents, which may exfiltrate user files to an external environment.

Conclusion: We have prepared already security-patches for our version of yelp.

Re: [Hyperbola] Current security-threads overview

2025-02-23T23:39:11Z

CVE-2022-49043: xmlXIncludeAddNode in xinclude.c in libxml2 before 2.11.0 has a use-after-free.

CVE-2023-39615: Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file. NOTE: the vendor's position is that the product does not support the legacy SAX1 interface with custom callbacks; there is a crash even without crafted input.

CVE-2023-45322: libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is "I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when memory allocations fail."

CVE-2024-25062: An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to an xmlValidatePopElement use-after-free.

Conclusion: We have prepared already security-patches for our version of libxml2.

Re: [Hyperbola] Current security-threads overview

2025-02-17T00:04:58Z

CVE-2021-41160: In affected versions a malicious server might trigger out of bound writes in a connected client. Connections using GDI or SurfaceCommands to send graphics updates to the client might send `0` width/height or out of bound rectangles to trigger out of bound writes. With `0` width or heigth the memory allocation will be `0` but the missing bounds checks allow writing to the pointer at this (not allocated) region.

CVE-2022-24883: Prior to version 2.7.0, server side authentication against a `SAM` file might be successful for invalid credentials if the server has configured an invalid `SAM` file path. FreeRDP based clients are not affected. RDP server implementations using FreeRDP to authenticate against a `SAM` file are affected. Version 2.7.0 contains a fix for this issue. As a workaround, use custom authentication via `HashCallback` and/or ensure the `SAM` database path configured is valid and the application has file handles left.

Conclusion: We have prepared already security-patches for our version of freerdp.

Re: [Hyperbola] Current security-threads overview

2024-12-04T17:18:49Z

CVE-2022-0847: A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system.

Conclusion: The security-threat does not apply to our system / kernel.

Re: [Hyperbola] Current security-threads overview

2024-11-29T02:42:33Z

Generic: A generic warning about interpreter-projects like Godot. As of now further details gone clear we can clearly state that we won't package and include any of those interpreter-engines at any given time, especially not the Godot named framework. The reasoning behind is here to read: https://research.checkpoint.com/2024/ga … e-loaders/

We can only warn about too much trust, even though the projects and packages are marked as "free and permissive". Nevertheless never forget they are software running and the more complex it gets the more problematic it can be.

Use also verification of attack-vectors, common known steps from recurring attacks:

Manipulated repositories: Attacker using widely known and used platforms like Github to create false or fake projects, including malicious code
Compromised dependencies: In this case malicious code is added within the libraries and frameworks other projects are using
Social engineering: In some cases attacking groups and / or individuals pretend first to grant help and support for a project and when getting more rights likewise to modify and add code start with adding their malicious actions

Free software is always based on trust and therefore those attacks are very harmful for the future of free and libre software and culture. Also the further analysis of this current thread shows exactly why Hyperbola as project persists on exactly a full package and software running only local after the installation. We do not plan to include any kind of software sideloading further data after its installation without the users knowledge and we will always patch or remove packages (applications) when adding such demands and features.

Re: [Hyperbola] Current security-threads overview

2024-11-28T00:04:50Z

CVE-2024-9680: An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox < 131.0.2, Firefox ESR < 128.3.1, Firefox ESR < 115.16.1, Thunderbird < 131.0.1, Thunderbird < 128.3.1, and Thunderbird < 115.16.0.

Conclusion: The security-threat does not apply to UXP and therefore not to iceweasel-uxp and icedove-uxp.

Re: [Hyperbola] Current security-threads overview

2024-09-11T00:34:58Z

CVE-2024-43167: A NULL pointer dereference flaw was found in the ub_ctx_set_fwd function in Unbound. This issue could allow an attacker who can invoke specific sequences of API calls to cause a segmentation fault. When certain API functions such as ub_ctx_set_fwd and ub_ctx_resolvconf are called in a particular order, the program attempts to read from a NULL pointer, leading to a crash. This issue can result in a denial of service by causing the application to terminate unexpectedly.

Conclusion: We have backported a fix and patch our package unbound.

Re: [Hyperbola] Current security-threads overview

2024-09-10T20:54:53Z

CVE-2024-7055: A vulnerability was found in FFmpeg up to 7.0.1. It has been classified as critical. This affects the function pnm_decode_frame in the library /libavcodec/pnmdec.c. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Conclusion: We will update our package ffmpeg to version 4.4.5.

Re: [Hyperbola] Current security-threads overview

2024-09-10T20:50:38Z

CVE-2024-41957: Vim is a command line text editor. Vim < v9.1.0647 has double free in src/alloc.c:616. When closing a window, the corresponding tagstack data will be cleared and freed. However a bit later, the quickfix list belonging to that window will also be cleared and if that quickfix list points to the same tagstack data, Vim will try to free it again, resulting in a double-free/use-after-free access exception. Impact is low since the user must intentionally execute vim with several non-default flags, but it may cause a crash of Vim. The issue has been fixed as of Vim patch v9.1.0647

CVE-2024-43374: The UNIX editor Vim prior to version 9.1.0678 has a use-after-free error in argument list handling. When adding a new file to the argument list, this triggers `Buf*` autocommands. If in such an autocommand the buffer that was just opened is closed (including the window where it is shown), this causes the window structure to be freed which contains a reference to the argument list that we are actually modifying. Once the autocommands are completed, the references to the window and argument list are no longer valid and as such cause an use-after-free. Impact is low since the user must either intentionally add some unusual autocommands that wipe a buffer during creation (either manually or by sourcing a malicious plugin), but it will crash Vim. The issue has been fixed as of Vim patch v9.1.0678.

Conclusion: We will update our package vim to version 9.1.0707.