A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159. — CVE-2023-42366

Zusammenfassung

Sicherheitshinweis CVE-2023-42366. A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159. Hersteller: Microsoft. Quelle: MSRC. Risiko: medium. CVSS 5.5. Details in der offiziellen Quelle.

Was tun?

Allgemeine, vorsichtige Schritte (bitte prüfe die offizielle Quelle für Details):

• Prüfe Exponierung und plane Maßnahmen nach Risiko und Umfeld.
• Identifiziere betroffene Produktversionen und prüfe, ob du betroffen bist.
• Spiele Hersteller-Updates/Patches ein oder setze empfohlene Mitigations um.
• Lies das offizielle Advisory für betroffene Versionen und konkrete Schritte.

Offizielles Advisory

Zur offiziellen Quelle

Mehr dazu

• <vuln:Note Title="Mariner" Type="Tag" Ordinal="20">Mariner CVE-2023-46316
• A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a crafted awk pattern in the awk.c evaluate function. CVE-2023-42364
• An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information. CVE-2023-45857
• ASP.NET Core Security Feature Bypass Vulnerability CVE-2023-36558
• Floating point Exception in adjust_plines_for_skipcol() in vim CVE-2023-48232
• Heap-buffer-overflow in extractimagesection() CVE-2023-3164
• HTTP request body disclosure in github.com/go-resty/resty/v2 CVE-2023-45286
• Incorrect detection of reserved device names on Windows in path/filepath CVE-2023-45284
• Kernel: kvm: svm: improper check in svm_set_x2apic_msr_interception allows direct access to host x2apic msrs CVE-2023-5090
• Kernel: qxl: race condition leading to use-after-free in qxl_mode_dumb_create() CVE-2023-39198
• Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability CVE-2023-36016
• Microsoft Dynamics 365 Sales Spoofing Vulnerability CVE-2023-36030