Category: Uncategorized

  • New MongoDB Flaw Lets Unauthenticated Attackers Read Uninitialized Memory

    New MongoDB Flaw Lets Unauthenticated Attackers Read Uninitialized Memory


    Dec 27, 2025Ravie LakshmananDatabase Security / Vulnerability

    MongoDB Flaw

    A high-severity security flaw has been disclosed in MongoDB that could allow unauthenticated users to read uninitialized heap memory.

    The vulnerability, tracked as CVE-2025-14847 (CVSS score: 8.7), has been described as a case of improper handling of length parameter inconsistency, which arises when a program fails to appropriately tackle scenarios where a length field is inconsistent with the actual length of the associated data.

    “Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client,” according to a description of the flaw in CVE.org.

    Cybersecurity

    The flaw impacts the following versions of the database –

    • MongoDB 8.2.0 through 8.2.3
    • MongoDB 8.0.0 through 8.0.16
    • MongoDB 7.0.0 through 7.0.26
    • MongoDB 6.0.0 through 6.0.26
    • MongoDB 5.0.0 through 5.0.31
    • MongoDB 4.4.0 through 4.4.29
    • All MongoDB Server v4.2 versions
    • All MongoDB Server v4.0 versions
    • All MongoDB Server v3.6 versions

    The issue has been addressed in MongoDB versions 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, and 4.4.30.

    “An client-side exploit of the Server’s zlib implementation can return uninitialized heap memory without authenticating to the server,” MongoDB said. “We strongly recommend upgrading to a fixed version as soon as possible.”

    Cybersecurity

    If immediate update is not an option, it’s recommended to disable zlib compression on the MongoDB Server by starting mongod or mongos with a networkMessageCompressors or a net.compression.compressors option that explicitly omits zlib. The other compressor options supported by MongoDB are snappy and zstd.

    “CVE-2025-14847 allows a remote, unauthenticated attacker to trigger a condition in which the MongoDB server may return uninitialized memory from its heap,” OP Innovate said. “This could result in the disclosure of sensitive in-memory data, including internal state information, pointers, or other data that may assist an attacker in further exploitation.”



    Source link

  • Thailand and Cambodia agree ceasefire after weeks of deadly clashes

    Thailand and Cambodia agree ceasefire after weeks of deadly clashes


    Thailand and Cambodia have agreed to an immediate ceasefire, the defence ministers of both countries have said in a joint statement.

    The two sides have agreed to freeze the front lines where they are now, and allow civilians living in border areas to return home, halting almost three weeks of intense clashes in which hundreds of soldiers are believed to have died and nearly one million people displaced.

    The ceasefire took effect at noon local time (05:00 GMT) on Saturday. Once it has been in place for 72 hours, 18 Cambodian soldiers held by Thailand since July will be released, the statement said.

    The breakthrough came after days of talks between the two countries, with diplomatic encouragement from China and the US.

    The agreement prioritises getting the displaced back to their homes, and also includes an agreement to remove landmines.

    Thailand’s Defence Minister Natthaphon Narkphanit described the ceasefire as a test for the “other party’s sincerity”.

    “Should the ceasefire fail to materialise or be violated, Thailand retains its legitimate right to self-defence under international law,” he told reporters.

    Thailand had been reluctant to accept the ceasefire, saying the last one was not properly implemented. They also resented what they saw as Cambodia’s efforts to internationalise the conflict.

    Unlike the last ceasefire in July, US President Donald Trump was conspicuously absent from this one, although the US State Department was involved.

    That ceasefire agreement collapsed earlier this month, when fresh clashes erupted.

    Both sides have blamed each other for the breakdown of the truce.

    The Thai army said its troops had responded to Cambodian fire in Thailand’s Si Sa Ket province, in which two Thai soldiers were injured.

    Cambodia’s defence ministry said it was Thai forces that had attacked first, in Preah Vihear province, and insisted that Cambodia did not retaliate.

    Clashes have continued throughout December. On Friday, Thailand carried out more air strikes inside Cambodia.

    The Thai Air Force said it had hit a Cambodian “fortified military position” after civilians had left the area. Cambodia’s defence ministry said the strikes were “indiscriminate attacks” against civilian houses.

    How well the ceasefire holds this time depends to a large extent on political will. Nationalist sentiment has been inflamed in both countries.

    Cambodia, in particular, has lost many soldiers and a lot of its military equipment. It has been driven back from positions it held on the border, and suffered extensive damage from the Thai air strikes, grievances which could make a lasting peace harder to achieve.

    Disagreement over the border dates back more than a century, but tension increased early this year after a group of Cambodian women sang patriotic songs in a disputed temple.

    A Cambodian soldier was killed in a clash in May, and two months later, in July, there were five days of intense fighting along the border, which left dozens of soldiers and civilians dead. Thousands more civilians were displaced.

    Following intervention by Malaysia and President Trump, a fragile ceasefire was negotiated between the two countries, and signed in late October.

    Trump dubbed the agreement the “Kuala Lumpur Peace Accords”. It mandated both sides to withdraw their heavy weapons from the disputed region, and to establish an interim observer team to monitor it.

    However, the agreement was suspended by Thailand in November after Thai soldiers were injured by landmines, with Thai Prime Minister Anutin Charnvirakul announcing that the security threat had “not actually decreased”.



    Source link

  • Thailand and Cambodia agree to ‘immediate’ ceasefire

    Thailand and Cambodia agree to ‘immediate’ ceasefire


    Thailand and Cambodia agreed to an “immediate” ceasefire on Saturday, the two countries said in a joint statement, pledging to end weeks of deadly border clashes.

    At least 47 people were killed and more than a million displaced in three weeks of fighting with artillery, tanks, drones and jets, according to official tallies.

    The conflict spread to nearly every border province on both sides, shattering an earlier truce for which US President Donald Trump took credit.

    “Both sides agree to an immediate ceasefire after the time of signature of this Joint Statement with effect from 12:00 hours noon (local time) on 27 December 2025,” said the statement signed by the two countries’ defence ministers.

    The truce applies to “all types of weapons, including attacks on civilians, civilian objects and infrastructures, and military objectives of either side, in all cases and all areas”, it said.

    Both sides agreed to freeze all troop movements and allow civilians living in border areas to return home as soon as possible, the statement added.

    They also agreed to cooperate on demining efforts and combatting cybercrime, while Thailand is to return 18 captured Cambodian soldiers within 72 hours.

    Thai Defence Minister Nattaphon Narkphanit said that initial three-day window would be an “observation period to confirm that the ceasefire is real”.

    In a speech Saturday morning he called the truce “a door to a peaceful resolution” of the border issue.

    Oeum Raksmey, 22, who was evacuated with her family from their home near the border to a shelter in Cambodia’s Siem Reap province, said she was “very happy” to hear news of the ceasefire.

    “If they stop fighting from now, I am very happy so that that people can return home,” she told AFP by telephone.

    “But I dare not return home yet. I am still scared. I don’t trust the Thai side yet.”

    – Broken ceasefires –

    The ceasefire comes after three days of border talks announced following a crisis meeting of foreign ministers from the Association of Southeast Asian Nations (ASEAN), of which both Cambodia and Thailand are members.

    The United States and China also pushed for the neighbours to cease fighting.

    The conflict stems from a territorial dispute over the colonial-era demarcation of their 800-kilometre (500-mile) border, where ancient temples are claimed by both sides.

    Five days of fighting between the two countries in July killed dozens of people before a truce was brokered by the United States, China and Malaysia.

    Trump witnessed the signing of an expanded agreement between Thailand and Cambodia in October, but it was broken within months.

    Each side blamed the other for instigating the fresh fighting this month and traded accusations of attacks on civilians.

    At least 25 Thai soldiers and one Thai civilian were killed in the latest round of clashes, officials said.

    Cambodia, which is outgunned and outspent by Bangkok’s military, said 21 civilians were killed but reported no military deaths — even as the wife of its leader Hun Manet attended a funeral of troops killed in the fighting, according to an official Facebook post.

    – ‘Final signing’ –

    The fighting was still raging on Friday, with Cambodia accusing Thailand of intensifying its bombardment of disputed border areas and Thai media reporting overnight Cambodian attacks.

    The contested temples are claimed by both nations because of a vague demarcation made by Cambodia’s French colonial administrators in 1907.

    Those demarcations will still need to be resolved following the ceasefire.

    But Thai Prime Minister Anutin Charnvirakul sounded an upbeat note Friday night, announcing that the two countries’ defence ministers would meet the following day and potentially sign a truce.

    “You can trust Thailand. We always uphold our agreements and commitments. Let this be the final signing, so that peace can be restored and our people can return home,” he said.

    General elections are scheduled to take place in Thailand on February 8.

    bur-tym/mtp



    Source link