diff --git a/security/vuxml/vuln/2024.xml b/security/vuxml/vuln/2024.xml index 82db275e300c..283da1e3066b 100644 --- a/security/vuxml/vuln/2024.xml +++ b/security/vuxml/vuln/2024.xml @@ -1,33 +1,71 @@ + + electron26 -- multiple vulnerabilities + + + electron26 + 26.6.4 + + + + +

Electron developers report:

+
+

This update fixes the following vulnerabilities:

+
    +
  • Security: backported fix for CVE-2023-6704.
    • +
  • Security: backported fix for CVE-2023-6705.
    • +
  • Security: backported fix for CVE-2023-6703.
    • +
  • Security: backported fix for CVE-2023-6702.
    • +
+
+ + + + CVE-2023-6704 + https://github.com/advisories/GHSA-587x-fmc5-99p9 + CVE-2023-6705 + https://github.com/advisories/GHSA-h27f-fw5q-c2gh + CVE-2023-6703 + https://github.com/advisories/GHSA-9v72-359m-2vx4 + CVE-2023-6702 + https://github.com/advisories/GHSA-7hjc-c62g-4w73 + + + 2024-01-04 + 2024-01-04 + + + FreeBSD -- Prefix Truncation Attack in the SSH protocol FreeBSD 14.014.0_4 13.213.2_9

Problem Description:

The SSH protocol executes an initial handshake between the server and the client. This protocol handshake includes the possibility of several extensions allowing different options to be selected. Validation of the packets in the handshake is done through sequence numbers.

Impact:

A man in the middle attacker can silently manipulate handshake messages to truncate extension negotiation messages potentially leading to less secure client authentication algorithms or deactivating keystroke timing attack countermeasures.

 CVE-2023-48795 SA-23:19.openssh 2023-12-19 2024-01-02