SB2024041274 - openEuler update for mozjs78

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) OS Command Injection (CVE-ID: CVE-2023-23599)

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation when copying a network request from the developer tools panel as a curl command in devtools on Windows. A remote attacker can trick the victim to copy and paste data from the network request into a console and execute arbitrary commands.

2) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-23601)

The vulnerability allows a remote attacker to perform spoofing attacks.

The vulnerability exists due to the way browser treats dragging of URL from the cross-origin iframe into the same tab. A remote attacker can perform spoofing attack.

Remediation

Install update from vendor's website.

References

• https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1405