[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 6 Jun 2023 13:34:20 -0400
From: Demi Marie Obenour <demi@...isiblethingslab.com>
To: oss-security@...ts.openwall.com, announce@...che.org,
announce@...camole.apache.org, dev@...camole.apache.org,
user@...camole.apache.org
Cc: security@...camole.apache.org
Subject: Re: [SECURITY] CVE-2023-30576: Apache Guacamole:
Use-after-free in handling of RDP audio input buffer
On Tue, Jun 06, 2023 at 10:12:29AM -0700, Michael Jumper wrote:
> Severity: moderate
> Base CVSS Score: 6.8 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N)
Why is this A:N and AC:H?
> Affected versions:
>
> - Apache Guacamole 0.9.10 through 1.5.1
>
> Description:
>
> Apache Guacamole 0.9.10 through 1.5.1 may continue to reference a freed RDP
> audio input buffer. Depending on timing, this may allow an attacker to
> execute arbitrary code with the privileges of the guacd process.
>
> Mitigation:
>
> Users of versions of Apache Guacamole 1.5.1 and older should upgrade to the
> 1.5.2 release.
>
> Credit:
>
> We would like to thank Stefan Schiller (Sonar) for reporting this issue.
>
> References:
>
> https://guacamole.apache.org/
> https://www.cve.org/CVERecord?id=CVE-2023-30576
>
> Timeline:
>
> 2023-04-11: Reported to security@...camole.apache.org
> 2023-04-11: Report acknowledged by project
> 2023-04-12: Report confirmed by project
> 2023-05-09: Fix completed and merged
> 2023-05-09: Fix tested and confirmed by reporter
> 2023-05-25: Fix released
--
Sincerely,
Demi Marie Obenour (she/her/hers)
Invisible Things Lab
Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
