Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Nov 04

SEC Consult Vulnerability Lab Security Advisory < 20261104-0 >
=======================================================================
title: Improper device certificate validation enables AiTM attacks
product: Siemens SICAM Toolbox II device communication
vulnerable version: <V07.11
      fixed version: V07.11
         CVE number: CVE-2024-31853, CVE-2024-31854
           impact: High...

Posted by Daniel Owens via Fulldisclosure on Nov 04

The Apache Struts2 Tiles plugin version <=7.4.0 (and >=6.3.0) codebase includes a `ViewPreparer` construct, replete
with multiple ViewPreparer factories, that contains several important vulnerabilities including unsynchronised,
unbounded caches. The lack of proper synchronisation means that certain factories will create caches that race,
risking lost cache entries, corrupted internal bucket states under load (this can result in infinite...

Posted by Daniel Owens via Fulldisclosure on Nov 04

unixODBC versions <=2.3.14 contain a rude truncation of a 64-bit `SQLLEN` `buffer_length` to a 32-bit `int` without
verifying that it produces a valid, positive value. The result is later passed to `memcpy`, causing the information
system to crash or, if carefully chosen, enabling attackers to write adjacent memory under certain circumstances (e.g.,
a buffer length that wraps to a small positive integer or triggers an undersized allocation...

Posted by Daniel Owens via Fulldisclosure on Nov 04

The unixODBC driver manager library contains multiple races of importance / interest, including a set of data races in
the connection-pooling configuration state data that can cause one thread to read a half-written pool-size or timeout
value, which can lead to a variety of harmful effects, as well as a race between teardown and error-handling
functionality that can result in double-frees and use-after-frees. Other races exist within the...

Posted by Daniel Owens via Fulldisclosure on Nov 04

unixODBC versions 2.3.14 and below contain multiple heap buffer overflows, underflows, and over-reads. Attackers who
can influence various arguments passed thereto can trigger the heap-based buffer overflows inside of the unixODBC
driver manager itself, potentially corrupting the shared heap state across connections, crash the driver manager
(thereby causing denial of service conditions, multi-tenant data loss, and such related issues,...