From 5952f85233d1ae2e1f530a18780e86d8ba31a34d Mon Sep 17 00:00:00 2001 From: Rene Ladan Date: Tue, 6 Apr 2021 10:49:52 +0200 Subject: Add vuln-flat.xml to the ignore list and remove the one committed by accident --- security/vuxml/vuln-flat.xml | 180293 ---------------------------------------- 1 file changed, 180293 deletions(-) delete mode 100644 security/vuxml/vuln-flat.xml (limited to 'security') diff --git a/security/vuxml/vuln-flat.xml b/security/vuxml/vuln-flat.xml deleted file mode 100644 index c6ae358f80cd..000000000000 --- a/security/vuxml/vuln-flat.xml +++ /dev/null @@ -1,180293 +0,0 @@ - - - - - - - - - - - - - - - - - - - -]> - - - - Gitlab -- Multiple vulnerabilities - - - gitlab-ce - 13.10.013.10.1 - 13.9.013.9.5 - 13.8.013.8.7 - - - - -

Gitlab reports:

-
-

Arbitrary File Read During Project Import

-

Kroki Arbitrary File Read/Write

-

Stored Cross-Site-Scripting in merge requests

-

Access data of an internal project through a public project fork as an anonymous user

-

Incident metric images can be deleted by any user

-

Infinite Loop When a User Access a Merge Request

-

Stored XSS in scoped labels

-

Admin CSRF in System Hooks Execution Through API

-

Update OpenSSL dependency

-

Update PostgreSQL dependency

-
- - - - https://about.gitlab.com/releases/2021/03/31/security-release-gitlab-13-10-1-released/ - - - 2021-03-31 - 2021-04-06 - - - - - samba -- Multiple Vulnerabilities - - - samba411 - 4.11.15 - - - samba412 - 4.12.14 - - - samba413 - 4.13.7 - - - samba414 - 4.14.2 - - - - -

The Samba Team reports:

-
-
    -
  • CVE-2020-27840: An anonymous attacker can crash the Samba AD DC - LDAP server by sending easily crafted DNs as - part of a bind request. More serious heap corruption - is likely also possible.
    • -
  • CVE-2021-20277: User-controlled LDAP filter strings against - the AD DC LDAP server may crash the LDAP server.
    • -
-
- - - - https://www.samba.org/samba/security/CVE-2020-27840.html - https://www.samba.org/samba/security/CVE-2021-20277.html - CVE-2020-27840 - CVE-2021-20277 - - - 2021-03-24 - 2021-03-28 - - - - - nettle 3.7.2 -- fix serious ECDSA signature verify bug - - - nettle - 3.7.2 - - - linux-c7-nettle - 3.7.2 - - - - -

Niels Möller reports:

-
-

- I've prepared a new bug-fix release of Nettle, a low-level - cryptographics library, to fix a serious bug in the function to - verify ECDSA signatures. Implications include an assertion failure, - which could be used for denial-of-service, when verifying signatures - on the secp_224r1 and secp521_r1 curves. -

-

- Even when no assert is triggered in ecdsa_verify, ECC point - multiplication may get invalid intermediate values as input, and - produce incorrect results. [...] It appears difficult to construct - an alleged signature that makes the function misbehave in such a way - that an invalid signature is accepted as valid, but such attacks - can't be ruled out without further analysis. -

-
- - - - https://lists.lysator.liu.se/pipermail/nettle-bugs/2021/009458.html - - - 2021-03-21 - 2021-03-27 - - - - - OpenSSL -- Multiple vulnerabilities - - - openssl - 1.1.1k,1 - - - - -

The OpenSSL project reports:

-
-

High: CA certificate check bypass with X509_V_FLAG_X509_STRICT - (CVE-2021-3450)
The X509_V_FLAG_X509_STRICT flag enables - additional security checks of the certificates present in a - certificate chain. It is not set by default.

-

High: NULL pointer deref in signature_algorithms processing - (CVE-2021-3449)
An OpenSSL TLS server may crash if sent a - maliciously crafted renegotiation ClientHello message from a client. - If a TLSv1.2 renegotiation ClientHello omits the - signature_algorithms extension (where it was present in the initial - ClientHello), but includes a signature_algorithms_cert extension - then a NULL pointer dereference will result, leading to a crash and - a denial of service attack.

-
- - - - https://www.openssl.org/news/secadv/20210325.txt - CVE-2021-3449 - CVE-2021-3450 - - - 2021-03-25 - 2021-03-26 - - - - - spamassassin -- Malicious rule configuration (.cf) files can be configured to run system commands - - - spamassassin - 3.4.5 - - - - -

The Apache SpamAssassin project reports:

-
-

Apache SpamAssassin 3.4.5 was recently released [1], and fixes - an issue of security note where malicious rule configuration (.cf) - files can be configured to run system commands.

-

In Apache SpamAssassin before 3.4.5, exploits can be injected in - a number of scenarios. In addition to upgrading to SA 3.4.5, - users should only use update channels or 3rd party .cf files from - trusted places.

-
- - - - https://spamassassin.apache.org/news.html - https://mail-archives.apache.org/mod_mbox/spamassassin-announce/202103.mbox/%3C5b7cfd35-27b7-584b-1b39-b7ff0a55f586%40apache.org%3E - https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-1946 - CVE-2020-1946 - - - 2021-03-24 - 2021-03-24 - - - - - gitea -- multiple vulnerabilities - - - gitea - 1.13.6 - - - - -

The Gitea Team reports for release 1.13.6:

-
-
    -
  • Fix bug on avatar middleware
    • -
  • Fix another clusterfuzz identified issue
    • -
-
- - - - https://github.com/go-gitea/gitea/releases/tag/v1.13.5 - ports/254515 - - - 2021-03-21 - 2021-03-23 - - - - - gitea -- quoting in markdown text - - - gitea - 1.13.5 - - - - -

The Gitea Team reports for release 1.13.5:

-
-
    -
  • Update to goldmark 1.3.3
    • -
-
- - - - https://github.com/go-gitea/gitea/releases/tag/v1.13.5 - ports/254130 - - - 2021-03-20 - 2021-03-21 - - - - - OpenSSH -- Double-free memory corruption in ssh-agent - - - openssh-portable - openssh-portable-hpn - openssh-portable-gssapi - 8.2p1,18.4p1,1_4 - - - - -

OpenBSD Project reports:

-
-

- ssh-agent(1): fixed a double-free memory corruption that was - introduced in OpenSSH 8.2 . We treat all such memory faults as - potentially exploitable. This bug could be reached by an attacker - with access to the agent socket. -

-

- On modern operating systems where the OS can provide information - about the user identity connected to a socket, OpenSSH ssh-agent - and sshd limit agent socket access only to the originating user - and root. Additional mitigation may be afforded by the system's - malloc(3)/free(3) implementation, if it detects double-free - conditions. -

-

- The most likely scenario for exploitation is a user forwarding an - agent either to an account shared with a malicious user or to a - host with an attacker holding root access. -

-
- - - - CVE-2021-28041 - https://www.openssh.com/txt/release-8.5 - - - 2021-03-03 - 2021-03-13 - - - - - Gitlab -- Multiple vulnerabilities - - - gitlab-ce - 13.9.013.9.4 - 13.8.013.8.6 - 13.2.013.7.9 - - - - -

Gigtlab reports:

-
-

Remote code execution via unsafe user-controlled markdown rendering options

-
- - - - https://about.gitlab.com/releases/2021/03/17/security-release-gitlab-13-9-4-released/ - - - 2021-03-17 - 2021-03-18 - - - - - dnsmasq -- cache poisoning vulnerability in certain configurations - - - dnsmasq - 2.85.r1,1 - - - dnsmasq-devel - 2.85.r1,3 - - - - -

Simon Kelley reports:

-
-

- [In configurations where the forwarding server address contains an @ - character for specifying a sending interface or source address, the] - random source port behavior was disabled, making cache poisoning - attacks possible. -

-
-

- This only affects configurations of the form server=1.1.1.1@em0 or - server=1.1.1.1@192.0.2.1, i. e. those that specify an interface to - send through, or an IP address to send from, or use together with - NetworkManager. -

- - - - https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2021q1/014835.html - CVE-2021-3448 - - - 2021-03-17 - 2021-03-18 - - - - - minio -- MITM attack - - - minio - 2021.03.17.02.33.02 - - - - -

minio developer report:

-
-

- This is a security issue because it enables MITM modification of - request bodies that are meant to have integrity guaranteed by chunk - signatures. -

-

- In a PUT request using aws-chunked encoding, MinIO ordinarily - verifies signatures at the end of a chunk. This check can be skipped - if the client sends a false chunk size that is much greater than the - actual data sent: the server accepts and completes the request - without ever reaching the end of the chunk + thereby without ever - checking the chunk signature. -

-
- - - - https://github.com/minio/minio/security/advisories/GHSA-xr7r-7gpj-5pgp - - - 2021-03-17 - 2021-03-17 - - - - - LibreSSL -- use-after-free - - - libressl - 3.2.4_1 - - - - -

OpenBSD reports:

-
-

A TLS client using session resumption may cause a use-after-free.

-
- - - - https://marc.info/?l=openbsd-announce&m=161582456312832&w=2 - https://ftp.openbsd.org/pub/OpenBSD/patches/6.8/common/017_libssl.patch.sig - - - 2021-03-15 - 2021-03-16 - - - - - chromium -- multiple vulnerabilities - - - chromium - 89.0.4389.90 - - - - -

Chrome Releases reports:

-
-

This release includes 5 security fixes, including:

-
    -
  • [1167357] High CVE-2021-21191: Use after free in WebRTC. - Reported by raven (@raid_akame) on 2021-01-15
    • -
  • [1181387] High CVE-2021-21192: Heap buffer overflow in tab - groups. Reported by Abdulrahman Alqabandi, Microsoft Browser - Vulnerability Research on 2021-02-23
    • -
  • [1186287] High CVE-2021-21193: Use after free in Blink. - Reported by Anonymous on 2021-03-09
    • -
-
- - - - CVE-2021-11191 - CVE-2021-11192 - CVE-2021-11193 - https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-desktop_12.html - - - 2021-03-12 - 2021-03-16 - - - - - squashfs-tools -- Integer overflow - - - squashfs-tools - 4.4 - - - - -

Phillip Lougher reports:

-
-

Integer overflow in the read_fragment_table_4 function in unsquash-4.c in Squashfs and sasquatch allows remote attackers to cause a denial of service (application crash) via a crafted input, which triggers a stack-based buffer overflow.

-
- - - - CVE-2015-4645 - https://nvd.nist.gov/vuln/detail/CVE-2015-4645 - - - 2017-03-17 - 2021-03-15 - - - - - go -- encoding/xml: infinite loop when using xml.NewTokenDecoder with a custom TokenReader; archive/zip: panic when calling Reader.Open - - - go - 1.16.1,1 - - - - -

The Go project reports:

-
-

The Decode, DecodeElement, and Skip methods of an xml.Decoder - provided by xml.NewTokenDecoder may enter an infinite loop when - operating on a custom xml.TokenReader which returns an EOF in the - middle of an open XML element.

-
-
-

The Reader.Open API, new in Go 1.16, will panic when used on a ZIP - archive containing files that start with "../".

-
- - - - CVE-2021-27918 - http://golang.org/issue/44913 - CVE-2021-27919 - http://golang.org/issue/44916 - - - 2021-03-05 - 2021-03-10 - - - - - gitea -- multiple vulnerabilities - - - gitea - 1.13.4 - - - - -

The Gitea Team reports for release 1.13.3:

-
-
    -
  • Turn default hash password algorithm back to pbkdf2 from argon2 until we find a better one
    • -
-
-

The Gitea Team reports for release 1.13.4:

-
-
    -
  • Fix issue popups
    • -
-
- - - - https://github.com/go-gitea/gitea/releases/tag/v1.13.3 - https://github.com/go-gitea/gitea/releases/tag/v1.13.4 - ports/254130 - - - 2021-01-07 - 2021-02-06 - - - - - mantis -- multiple vulnerabilities - - - mantis-php72 - mantis-php73 - mantis-php74 - mantis-php80 - 2.24.4,1 - - - - -

Mantis 2.24.4 release reports:

-
-

Security and maintenance release, addressing 6 CVEs:

-
    -
  • 0027726: CVE-2020-29603: disclosure of private project name
    • -
  • 0027727: CVE-2020-29605: disclosure of private issue summary
    • -
  • 0027728: CVE-2020-29604: full disclosure of private issue contents, including bugnotes and attachments
    • -
  • 0027361: Private category can be access/used by a non member of a private project (IDOR)
    • -
  • 0027779: CVE-2020-35571: XSS in helper_ensure_confirmed() calls
    • -
  • 0026794: User Account - Takeover
    • -
  • 0027363: Fixed in version can be changed to a version that doesn't exist
    • -
  • 0027350: When updating an issue, a Viewer user can be set as Reporter
    • -
  • 0027370: CVE-2020-35849: Revisions allow viewing private bugnotes id and summary
    • -
  • 0027495: CVE-2020-28413: SQL injection in the parameter "access" on the mc_project_get_users function throught the API SOAP.
    • -
  • 0027444: Printing unsanitized user input in install.php
    • -
-
- - - - CVE-2020-28413 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28413 - CVE-2020-35849 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35849 - - - 2020-11-10 - 2021-03-10 - - - - - Node.js -- February 2021 Security Releases - - - node10 - 10.24.0 - - - node12 - 12.21.0 - - - node14 - 14.16.0 - - - node - 15.10.0 - - - - -

Node.js reports:

-
-

HTTP2 'unknownProtocol' cause Denial of Service by resource exhaustion (Critical) (CVE-2021-22883)

-

Affected Node.js versions are vulnerable to denial of service attacks when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also from opening, e.g. a file. If no file descriptor limit is configured, then this lead to an excessive memory usage and cause the system to run out of memory.

-

DNS rebinding in --inspect (CVE-2021-22884)

-

Affected Node.js versions are vulnerable to a DNS rebinding attack when the whitelist includes "localhost6". When "localhost6" is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the "localhost6" domain. As long as the attacker uses the "localhost6" domain, they can still apply the attack described in CVE-2018-7160.

-

OpenSSL - Integer overflow in CipherUpdate (CVE-2021-23840)

-

This is a vulnerability in OpenSSL which may be exploited through Node.js. You can read more about it in https://www.openssl.org/news/secadv/20210216.txt

-
- - - - https://nodejs.org/en/blog/vulnerability/february-2021-security-releases/ - CVE-2021-22883 - CVE-2021-22884 - CVE-2021-23840 - - - 2021-02-23 - 2021-03-09 - - - - - Gitlab -- Multiple vulnerabilities - - - gitlab-ce - 13.9.013.9.2 - 13.8.013.8.5 - 13.7.8 - - - - -

Gitlab reports:

-
-

JWT token leak via Workhorse

-

Stored XSS in wiki pages

-

Group Maintainers are able to use the Group CI/CD Variables API

-

Insecure storage of GitLab session keys

-
- - - - https://about.gitlab.com/releases/2021/03/04/security-release-gitlab-13-9-2-released/ - CVE-2021-22185 - CVE-2021-22186 - - - 2021-03-04 - 2021-03-05 - - - - - asterisk -- Crash when negotiating T.38 with a zero port - - - asterisk16 - 16.16.2 - - - asterisk18 - 18.2.2 - - - - -

The Asterisk project reports:

-
-

When Asterisk sends a re-invite initiating T.38 faxing - and the endpoint responds with a m=image line and zero - port, a crash will occur in Asterisk. This is a reoccurrence - of AST-2019-004.

-
- - - - CVE-2019-15297 - https://downloads.asterisk.org/pub/security/AST-2021-006.html - - - 2021-02-20 - 2021-03-04 - - - - - chromium -- multiple vulnerabilities - - - chromium - 89.0.4389.72 - - - - -

Chrome Releases reports:

-
-

This release includes 47 security fixes, including the below. - Google is aware of reports that an exploit for CVE-2021-21166 exists - in the wild.

-
    -
  • [1171049] High CVE-2021-21159: Heap buffer overflow in - TabStrip. Reported by Khalil Zhani on 2021-01-27
    • -
  • [1170531] High CVE-2021-21160: Heap buffer overflow in - WebAudio. Reported by Marcin 'Icewall' Noga of Cisco Talos on - 2021-01-25
    • -
  • [1173702] High CVE-2021-21161: Heap buffer overflow in - TabStrip. Reported by Khalil Zhani on 2021-02-02
    • -
  • [1172054] High CVE-2021-21162: Use after free in WebRTC. - Reported by Anonymous on 2021-01-29
    • -
  • [1111239] High CVE-2021-21163: Insufficient data validation in - Reader Mode. Reported by Alison Huffman, Microsoft Browser - Vulnerability Research on 2020-07-30
    • -
  • [1164846] High CVE-2021-21164: Insufficient data validation in - Chrome for iOS. Reported by Muneaki Nishimura (nishimunea) on - 2021-01-11
    • -
  • [1174582] High CVE-2021-21165: Object lifecycle issue in audio. - Reported by Alison Huffman, Microsoft Browser Vulnerability - Research on 2021-02-04
    • -
  • [1177465] High CVE-2021-21166: Object lifecycle issue in audio. - Reported by Alison Huffman, Microsoft Browser Vulnerability - Research on 2021-02-11
    • -
  • [1161144] Medium CVE-2021-21167: Use after free in bookmarks. - Reported by Leecraso and Guang Gong of 360 Alpha Lab on - 2020-12-22
    • -
  • [1152226] Medium CVE-2021-21168: Insufficient policy - enforcement in appcache. Reported by Luan Herrera (@lbherrera_) - on 2020-11-24
    • -
  • [1166138] Medium CVE-2021-21169: Out of bounds memory access in - V8. Reported by Bohan Liu (@P4nda20371774) and Moon Liang of - Tencent Security Xuanwu Lab on 2021-01-13
    • -
  • [1111646] Medium CVE-2021-21170: Incorrect security UI in - Loader. Reported by David Erceg on 2020-07-31
    • -
  • [1152894] Medium CVE-2021-21171: Incorrect security UI in - TabStrip and Navigation. Reported by Irvan Kurniawan (sourc7) on - 2020-11-25
    • -
  • [1150810] Medium CVE-2021-21172: Insufficient policy - enforcement in File System API. Reported by Maciej Pulikowski on - 2020-11-19
    • -
  • [1154250] Medium CVE-2021-21173: Side-channel information - leakage in Network Internals. Reported by Tom Van Goethem from - imec-DistriNet, KU Leuven on 2020-12-01
    • -
  • [1158010] Medium CVE-2021-21174: Inappropriate implementation - in Referrer. Reported by Ashish Gautam Kamble on 2020-12-11
    • -
  • [1146651] Medium CVE-2021-21175: Inappropriate implementation - in Site isolation. Reported by Jun Kokatsu, Microsoft Browser - Vulnerability Research on 2020-11-07
    • -
  • [1170584] Medium CVE-2021-21176: Inappropriate implementation - in full screen mode. Reported by Luan Herrera (@lbherrera_) on - 2021-01-26
    • -
  • [1173879] Medium CVE-2021-21177: Insufficient policy - enforcement in Autofill. Reported by Abdulrahman Alqabandi, - Microsoft Browser Vulnerability Research on 2021-02-03
    • -
  • [1174186] Medium CVE-2021-21178: Inappropriate implementation - in Compositing. Reported by Japong on 2021-02-03
    • -
  • [1174943] Medium CVE-2021-21179: Use after free in Network - Internals. Reported by Anonymous on 2021-02-05
    • -
  • [1175507] Medium CVE-2021-21180: Use after free in tab search. - Reported by Abdulrahman Alqabandi, Microsoft Browser - Vulnerability Research on 2021-02-07
    • -
  • [1177875] Medium CVE-2020-27844: Heap buffer overflow in - OpenJPEG. Reported by Sean Campbell at Tableau on 2021-02-12
    • -
  • [1182767] Medium CVE-2021-21181: Side-channel information - leakage in autofill. Reported by Xu Lin (University of Illinois - at Chicago), Panagiotis Ilia (University of Illinois at Chicago), - Jason Polakis (University of Illinois at Chicago) on - 2021-02-26
    • -
  • [1049265] Low CVE-2021-21182: Insufficient policy enforcement - in navigations. Reported by Luan Herrera (@lbherrera_) on - 2020-02-05
    • -
  • [1105875] Low CVE-2021-21183: Inappropriate implementation in - performance APIs. Reported by Takashi Yoneuchi (@y0n3uchy) on - 2020-07-15
    • -
  • [1131929] Low CVE-2021-21184: Inappropriate implementation in - performance APIs. Reported by James Hartig on 2020-09-24
    • -
  • [1100748] Low CVE-2021-21185: Insufficient policy enforcement - in extensions. Reported by David Erceg on 2020-06-30
    • -
  • [1153445] Low CVE-2021-21186: Insufficient policy enforcement - in QR scanning. Reported by dhirajkumarnifty on 2020-11-28
    • -
  • [1155516] Low CVE-2021-21187: Insufficient data validation in - URL formatting. Reported by Kirtikumar Anandrao Ramchandani on - 2020-12-04
    • -
  • [1161739] Low CVE-2021-21188: Use after free in Blink. Reported - by Woojin Oh(@pwn_expoit) of STEALIEN on 2020-12-24
    • -
  • [1165392] Low CVE-2021-21189: Insufficient policy enforcement - in payments. Reported by Khalil Zhani on 2021-01-11
    • -
  • [1166091] Low CVE-2021-21190: Uninitialized Use in PDFium. - Reported by Zhou Aiting(@zhouat1) of Qihoo 360 Vulcan Team on - 2021-01-13
    • -
-
- - - - CVE-2021-21159 - CVE-2021-21160 - CVE-2021-21161 - CVE-2021-21162 - CVE-2021-21163 - CVE-2021-21164 - CVE-2021-21165 - CVE-2021-21166 - CVE-2021-21167 - CVE-2021-21168 - CVE-2021-21169 - CVE-2021-21170 - CVE-2021-21171 - CVE-2021-21172 - CVE-2021-21173 - CVE-2021-21174 - CVE-2021-21175 - CVE-2021-21176 - CVE-2021-21177 - CVE-2021-21178 - CVE-2021-21179 - CVE-2021-21180 - CVE-2021-21181 - CVE-2021-21182 - CVE-2021-21183 - CVE-2021-21184 - CVE-2021-21185 - CVE-2021-21186 - CVE-2021-21187 - CVE-2021-21188 - CVE-2021-21189 - CVE-2021-21190 - CVE-2020-27844 - https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-desktop.html - - - 2021-03-02 - 2021-03-04 - - - - - jasper -- multiple vulnerabilities - - - jasper - 2.0.25 - - - - -

JasPer Releases:

-
-

- Fix memory-related bugs in the JPEG-2000 codec resulting from - attempting to decode invalid code streams. (#264, #265)

-

This fix is associated with CVE-2021-26926 and CVE-2021-26927.

-

- Fix wrong return value under some compilers (#260)

-

- Fix CVE-2021-3272 heap buffer overflow in jp2_decode (#259)

-
- - - - https://github.com/jasper-software/jasper/releases - CVE-2021-26926 - CVE-2021-26927 - CVE-2021-3272 - - - 2021-02-07 - 2021-03-03 - - - - - salt -- multiple vulnerabilities - - - py36-salt-2019 - py37-salt-2019 - py38-salt-2019 - py36-salt - py37-salt - py38-salt - py39-salt - 2019.2.8 - 30003002.5 - - - - -

SaltStack reports multiple security vulnerabilities in Salt

-
-
    -
  • CVE-2021-3197: The Salt-API.s SSH client is vulnerable to a shell injection by including ProxyCommand in an argument, or via ssh_options provided in an API request.
    • -
  • CVE-2021-25281: The Salt-API does not have eAuth credentials for the wheel_async client.
    • -
  • CVE-2021-25282: The salt.wheel.pillar_roots.write method is vulnerable to directory traversal.
    • -
  • CVE-2021-25283: The jinja renderer does not protect against server-side template injection attacks.
    • -
  • CVE-2021-25284: webutils write passwords in cleartext to /var/log/salt/minion
    • -
  • CVE-2021-3148: command injection in salt.utils.thin.gen_thin()
    • -
  • CVE-2020-35662: Several places where Salt was not verifying the SSL cert by default.
    • -
  • CVE-2021-3144: eauth Token can be used once after expiration.
    • -
  • CVE-2020-28972: Code base not validating SSL/TLS certificate of the server, which might allow attackers to obtain sensitive information via a man-in-the-middle attack
    • -
  • CVE-2020-28243: Local Privilege Escalation in the Minion.
    • -
-
- - - - "https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/" - CVE-2021-3197 - CVE-2021-25281 - CVE-2021-25282 - CVE-2021-25283 - CVE-2021-25284 - CVE-2021-3148 - CVE-2020-35662 - CVE-2021-3144 - CVE-2020-28972 - CVE-2020-28243 - - - 2021-02-25 - 2021-03-03 - - - - - vault -- unauthenticated license read - - - vault - 1.6.3 - - - - -

vault developers report:

-
-

Limited Unauthenticated License Read: We addressed a security vulnerability that allowed for the unauthenticated reading of Vault licenses from DR Secondaries.

-
- - - - CVE-2021-27668 - https://github.com/hashicorp/vault/releases/tag/v1.6.3 - - - 2021-02-26 - 2021-02-27 - - - - - FreeBSD -- jail_remove(2) fails to kill all jailed processes - - - FreeBSD-kernel - 12.212.2_4 - 11.411.4_8 - - - - -

Problem Description:

-

Due to a race condition in the jail_remove(2) implementation, it - may fail to kill some of the processes.

-

Impact:

-

A process running inside a jail can avoid being killed during jail - termination. If a jail is subsequently started with the same root - path, a lingering jailed process may be able to exploit the window - during which a devfs filesystem is mounted but the jail's devfs - ruleset has not been applied, to access device nodes which are - ordinarily inaccessible. If the process is privileged, it may be able - to escape the jail and gain full access to the system.

- - - - CVE-2020-25581 - SA-21:04.jail_remove - - - 2021-02-24 - 2021-02-25 - - - - - FreeBSD -- Xen grant mapping error handling issues - - - FreeBSD-kernel - 12.212.2_4 - 11.411.4_8 - - - - -

Problem Description:

-

Grant mapping operations often occur in batch hypercalls, where a - number of operations are done in a single hypercall, the success or - failure of each one reported to the backend driver, and the backend - driver then loops over the results, performing follow-up actions - based on the success or failure of each operation.

-

Unfortunately, when running in HVM/PVH mode, the FreeBSD backend - drivers mishandle this: Some errors are ignored, effectively implying - their success from the success of related batch elements. In other - cases, errors resulting from one batch element lead to further batch - elements not being inspected, and hence successful ones to not be - possible to properly unmap upon error recovery.

-

Impact:

-

A malicious or buggy frontend driver may be able to cause resource - leaks in the domain running the corresponding backend driver.

- - - - CVE-2021-26932 - SA-21:06.xen - - - 2021-02-24 - 2021-02-25 - - - - - FreeBSD -- jail_attach(2) relies on the caller to change the cwd - - - FreeBSD-kernel - 12.212.2_4 - 11.411.4_8 - - - - -

Problem Description:

-

When a process, such as jexec(8) or killall(1), calls jail_attach(2) - to enter a jail, the jailed root can attach to it using ptrace(2) before - the current working directory is changed.

-

Impact:

-

A process with superuser privileges running inside a jail could change - the root directory outside of the jail, thereby gaining full read and - writing access to all files and directories in the system.

- - - - CVE-2020-25582 - SA-21:05.jail_chdir - - - 2021-02-24 - 2021-02-25 - - - - - FreeBSD -- login.access fails to apply rules - - - FreeBSD - 12.212.2_4 - 11.411.4_8 - - - - -

Problem Description:

-

A regression in the login.access(5) rule processor has the effect - of causing rules to fail to match even when they should not. This - means that rules denying access may be ignored.

-

Impact:

-

The configuration in login.access(5) may not be applied, permitting - login access to users even when the system is configured to deny it.

- - - - CVE-2020-25580 - SA-21:03.pam_login_access - - - 2021-02-24 - 2021-02-25 - - - - - redis -- Integer overflow on 32-bit systems - - - redis-devel - 6.2.0 - - - redis - 6.0.11 - - - redis5 - 5.0.11 - - - - -

Redis Development team reports:

-
-

Redis 4.0 or newer uses a configurable limit for - the maximum supported bulk input size. By default, - it is 512MB which is a safe value for all platforms. - If the limit is significantly increased, receiving a - large request from a client may trigger several - integer overflow scenarios, which would result with - buffer overflow and heap corruption.

-
- - - - CVE-2021-21309 - - - 2021-02-22 - 2021-02-23 - - - - - zeek -- Remote crash vulnerability - - - zeek - 3.0.13 - - - - -

Jon Siwek of Corelight reports:

-
-

Fix ASCII Input reader's treatment of input files - containing null-bytes. An input file containing null-bytes - could lead to a buffer-over-read, crash Zeek, and be - exploited to cause Denial of Service.

-
- - - - https://github.com/zeek/zeek/releases/tag/v3.0.13 - - - 2021-02-10 - 2021-02-22 - - - - - raptor2 -- malformed input file can lead to a segfault - - - raptor2 - 2.0.15_17 - - - - -

Redland Issue Tracker reports:

-
-

due to an out of bounds array access in -raptor_xml_writer_start_element_common.

-
- - - - https://bugs.librdf.org/mantis/view.php?id=650 - - - 2020-11-24 - 2021-02-20 - - - - - jenkins -- Privilege escalation vulnerability in bundled Spring Security library - - - jenkins - 2.280 - - - - -

Jenkins Security Advisory:

-
-

Description

-
(high) SECURITY-2195 / CVE-2021-22112
-

Privilege escalation vulnerability in bundled Spring Security library

-
- - - - https://www.jenkins.io/security/advisory/2021-02-19/ - - - 2021-02-19 - 2021-02-20 - - - - - asterisk -- Remote Crash Vulnerability in PJSIP channel driver - - - asterisk13 - 13.38.2 - - - asterisk16 - 16.16.1 - - - asterisk18 - 18.2.1 - - - - -

The Asterisk project reports:

-
-

Given a scenario where an outgoing call is placed from - Asterisk to a remote SIP server it is possible for a crash - to occur.

-
- - - - CVE-2021-26906 - https://downloads.asterisk.org/pub/security/AST-2021-005.html - - - 2021-02-08 - 2021-02-18 - - - - - asterisk -- An unsuspecting user could crash Asterisk with multiple hold/unhold requests - - - asterisk16 - 16.16.016.16.1 - - - asterisk18 - 18.2.018.2.1 - - - - -

The Asterisk project reports:

-
-

Due to a signedness comparison mismatch, an authenticated - WebRTC client could cause a stack overflow and Asterisk - crash by sending multiple hold/unhold requests in quick - succession.

-
- - - - CVE-2021-26714 - https://downloads.asterisk.org/pub/security/AST-2021-004.html - - - 2021-02-11 - 2021-02-18 - - - - - asterisk -- Remote attacker could prematurely tear down SRTP calls - - - asterisk13 - 13.38.113.38.2 - - - asterisk16 - 16.16.016.16.1 - - - asterisk18 - 18.2.018.2.1 - - - - -

The Asterisk project reports:

-
-

An unauthenticated remote attacker could replay SRTP - packets which could cause an Asterisk instance configured - without strict RTP validation to tear down calls - prematurely.

-
- - - - CVE-2021-26712 - https://downloads.asterisk.org/pub/security/AST-2021-003.html - - - 2021-02-18 - 2021-02-18 - - - - - asterisk -- Remote crash possible when negotiating T.38 - - - asterisk16 - 16.15.016.16.1 - - - asterisk18 - 18.1.018.2.1 - - - - -

The Asterisk project reports:

-
-

When re-negotiating for T.38 if the initial remote - response was delayed just enough Asterisk would send both - audio and T.38 in the SDP. If this happened, and the - remote responded with a declined T.38 stream then Asterisk - would crash.

-
- - - - CVE-2021-26717 - https://downloads.asterisk.org/pub/security/AST-2021-002.html - - - 2021-02-05 - 2021-02-18 - - - - - asterisk -- Remote crash in res_pjsip_diversion - - - asterisk13 - 13.38.113.38.2 - - - asterisk16 - 16.15.116.16.1 - - - asterisk18 - 18.1.118.2.1 - - - - -

The Asterisk project reports:

-
-

If a registered user is tricked into dialing a malicious - number that sends lots of 181 responses to Asterisk, each - one will cause a 181 to be sent back to the original - caller with an increasing number of entries in the - "Supported" header. Eventually the number of entries in - the header exceeds the size of the entry array and causes - a crash.

-
- - - - CVE-2020-35776 - https://downloads.asterisk.org/pub/security/AST-2021-001.html - - - 2021-01-04 - 2021-02-18 - - - - - Rails -- multiple vulnerabilities - - - rubygem-activerecord52 - 5.2.4.5 - - - rubygem-actionpack60 - rubygem-activerecord60 - 6.0.3.5 - - - rubygem-actionpack61 - rubygem-activerecord61 - 6.1.2.1 - - - - -

Ruby on Rails blog:

-
-

Rails version 5.2.4.5, 6.0.3.5 and 6.1.2.1 have been released! Those - version are security releases and addresses two issues:

-

CVE-2021-22880: Possible DoS Vulnerability in Active Record PostgreSQL adapter.

-

CVE-2021-22881: Possible Open Redirect in Host Authorization Middleware.

-

-

- - - - https://weblog.rubyonrails.org/2021/2/10/Rails-5-2-4-5-6-0-3-5-and-6-1-2-1-have-been-released/ - https://discuss.rubyonrails.org/t/cve-2021-22880-possible-dos-vulnerability-in-active-record-postgresql-adapter/77129 - https://discuss.rubyonrails.org/t/cve-2021-22881-possible-open-redirect-in-host-authorization-middleware/77130 - CVE-2021-22880 - CVE-2021-22881 - - - 2021-02-10 - 2021-02-17 - - - - - chromium -- multiple vulnerabilities - - - chromium - 88.0.4324.182 - - - - -

Chrome Releases reports:

-
-

This release contains 10 security fixes, including:

-
    -
  • [1138143] High CVE-2021-21149: Stack overflow in Data Transfer. - Reported by Ryoya Tsukasaki on 2020-10-14
    • -
  • [1172192] High CVE-2021-21150: Use after free in Downloads. - Reported by Woojin Oh(@pwn_expoit) of STEALIEN on 2021-01-29
    • -
  • [1165624] High CVE-2021-21151: Use after free in Payments. - Reported by Khalil Zhani on 2021-01-12
    • -
  • [1166504] High CVE-2021-21152: Heap buffer overflow in Media. - Reported by Anonymous on 2021-01-14
    • -
  • [1155974] High CVE-2021-21153: Stack overflow in GPU Process. - Reported by Jan Ruge of ERNW GmbH on 2020-12-06
    • -
  • [1173269] High CVE-2021-21154: Heap buffer overflow in Tab - Strip. Reported by Abdulrahman Alqabandi, Microsoft Browser - Vulnerability Research on 2021-02-01
    • -
  • [1175500] High CVE-2021-21155: Heap buffer overflow in Tab - Strip. Reported by Khalil Zhani on 2021-02-07
    • -
  • [1177341] High CVE-2021-21156: Heap buffer overflow in V8. - Reported by Sergei Glazunov of Google Project Zero on - 2021-02-11
    • -
  • [1170657] Medium CVE-2021-21157: Use after free in Web - Sockets. Reported by Anonymous on 2021-01-26
    • -
-
- - - - CVE-2021-21149 - CVE-2021-21150 - CVE-2021-21151 - CVE-2021-21152 - CVE-2021-21153 - CVE-2021-21154 - CVE-2021-21155 - CVE-2021-21156 - CVE-2021-21157 - https://chromereleases.googleblog.com/2021/02/stable-channel-update-for-desktop_16.html - - - 2021-02-16 - 2021-02-17 - - - - - OpenSSL -- Multiple vulnerabilities - - - openssl - 1.1.1j,1 - - - openssl-devel - 3.0.0a12 - - - - -

The OpenSSL project reports:

-
-

Null pointer deref in X509_issuer_and_serial_hash() - CVE-2021-23841
(Moderate) The OpenSSL public API function - X509_issuer_and_serial_hash() attempts to create a unique hash - value based on the issuer and serial number data contained within - an X509 certificate. However it fails to correctly handle any errors - that may occur while parsing the issuer field (which might occur if - the issuer field is maliciously constructed). This may subsequently - result in a NULL pointer deref and a crash leading to a potential - denial of service attack.

-

Integer overflow in CipherUpdate CVE-2021-23840
(Low) - Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate - may overflow the output length argument in some cases where the - input length is close to the maximum permissable length for an - integer on the platform. In such cases the return value from the - function call will be 1 (indicating success), but the output length - value will be negative. This could cause applications to behave - incorrectly or crash.

-
- - - - https://www.openssl.org/news/secadv/20210216.txt - CVE-2021-23841 - CVE-2021-23840 - CVE-2021-23839 - - - 2021-02-16 - 2021-02-16 - 2021-02-18 - - - - - openexr, ilmbase -- security fixes related to reading corrupted input files - - - ilmbase - 2.5.5 - - - openexr - 2.5.5 - - - - -

Cary Phillips reports:

-
-

Patch release with various bug/sanitizer/security fixes, primarily related to reading corrupted input files[...].

-
- - - - https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.5.5 - - - 2021-02-12 - 2021-02-12 - - - - - Gitlab -- Multiple Vulnerabilities - - - gitlab-ce - 13.8.013.8.4 - 13.7.013.7.7 - 10.513.6.7 - - - - -

Gitlab reports:

-
-

Improper Certificate Validation for Fortinet OTP

-

Denial of Service Attack on gitlab-shell

-

Resource exhaustion due to pending jobs

-

Confidential issue titles were exposed

-

Improper access control allowed demoted project members to access authored merge requests

-

Improper access control allowed unauthorized users to access analytic pages

-

Unauthenticated CI lint API may lead to information disclosure and SSRF

-

Prometheus integration in Gitlab may lead to SSRF

-
- - - - https://about.gitlab.com/releases/2021/02/11/security-release-gitlab-13-8-4-released/ - - - 2021-02-11 - 2021-02-12 - - - - - oauth2-proxy -- domain whitelist could be used as redirect - - - oauth2-proxy - 7.0.0 - - - - -

SO-AND-SO reports:

-
-

In OAuth2 Proxy before version 7.0.0, for users that use the - whitelist domain feature, a domain that ended in a similar way to - the intended domain could have been allowed as a redirect.

-
- - - - https://nvd.nist.gov/vuln/detail/CVE-2021-21291 - - - 2021-02-02 - 2021-02-12 - - - - - mod_dav_svn -- server crash - - - mod_dav_svn - 1.9.01.10.6 - 1.11.01.14.0 - - - - -

Subversion project reports:

-
-

Subversion's mod_authz_svn module will crash if the server is using - in-repository authz rules with the AuthzSVNReposRelativeAccessFile - option and a client sends a request for a non-existing repository URL.

-
- - - - https://subversion.apache.org/security/CVE-2020-17525-advisory.txt - - - 2021-01-29 - 2021-02-10 - - - - - gitea -- multiple vulnerabilities - - - gitea - 1.13.2 - - - - -

The Gitea Team reports for release 1.13.2:

-
-
    -
  • Prevent panic on fuzzer provided string
    • -
  • Add secure/httpOnly attributes to the lang cookie
    • -
-
- - - - https://github.com/go-gitea/gitea/releases/tag/v1.13.2 - ports/253295 - - - 2021-01-07 - 2021-02-06 - - - - - chromium -- heap buffer overflow in V8 - - - chromium - 88.0.4324.150 - - - - -

Chrome Releases reports:

-
-

[1170176] High CVE-2021-21148: Heap buffer overflow in V8. - Reported by Mattias Buelens on 2021-01-24. Google is aware of - reports that an exploit for CVE-2021-21148 exists in the wild.

-
- - - - CVE-2021-21148 - https://chromereleases.googleblog.com/2021/02/stable-channel-update-for-desktop_4.html - - - 2021-02-04 - 2021-02-05 - - - - - www/chromium -- multiple vulnerabilities - - - chromium - 88.0.4324.146 - - - - -

Chrome Releases reports:

-
-

This update include 6 security fixes:

-
    -
  • 1169317] Critical CVE-2021-21142: Use after free in Payments. - Reported by Khalil Zhani on 2021-01-21
    • -
  • [1163504] High CVE-2021-21143: Heap buffer overflow in - Extensions. Reported by Allen Parker and Alex Morgan of MU on - 2021-01-06
    • -
  • [1163845] High CVE-2021-21144: Heap buffer overflow in Tab - Groups. Reported by Leecraso and Guang Gong of 360 Alpha Lab on - 2021-01-07
    • -
  • [1154965] High CVE-2021-21145: Use after free in Fonts. Reported - by Anonymous on 2020-12-03
    • -
  • [1161705] High CVE-2021-21146: Use after free in Navigation. - Reported by Alison Huffman and Choongwoo Han of Microsoft Browser - Vulnerability Research on 2020-12-24
    • -
  • [1162942] Medium CVE-2021-21147: Inappropriate implementation in - Skia. Reported by Roman Starkov on 2021-01-04
    • -
-
- - - - CVE-2021-21142 - CVE-2021-21143 - CVE-2021-21144 - CVE-2021-21145 - CVE-2021-21146 - CVE-2021-21147 - https://chromereleases.googleblog.com/2021/02/stable-channel-update-for-desktop.html - - - 2021-02-02 - 2021-02-03 - - - - - Gitlab -- Multiple vulnerabilities - - - gitlab-ce - 13.8.013.8.2 - 13.7.013.7.6 - 11.813.6.6 - - - - -

Gitlab reports:

-
-

Stored XSS in merge request

-

Stored XSS in epic's pages

-

Sensitive GraphQL variables exposed in structured log

-

Guest user can see tag names in private projects

-

Information disclosure via error message

-

DNS rebinding protection bypass

-

Validate existence of private project

-
- - - - https://about.gitlab.com/blog/2021/02/01/security-release-gitlab-13-8-2-released/ - CVE-2021-22172 - CVE-2021-22169 - - - 2021-02-01 - 2021-02-02 - - - - - minio -- Server Side Request Forgery - - - minio - 2021.01.30.00.20.58 - - - - -

Minio developers report:

-
-

Thanks to @phith0n from our community upon a code review, discovered an SSRF (Server Side Request Forgery) in our Browser API implementation. We have not observed this report/attack in the wild or reported elsewhere in the community at large.

-

All users are advised to upgrade ASAP.

-

The target application may have functionality for importing data from a URL, publishing data to a URL, or otherwise reading data from a URL that can be tampered with. The attacker modifies the calls to this functionality by supplying a completely different URL or by manipulating how URLs are built (path traversal etc.).

-

In a Server-Side Request Forgery (SSRF) attack, the attacker can abuse functionality on the server to read or update internal resources. The attacker can supply or modify a URL which the code running on the server will read or submit data, and by carefully selecting the URLs, the attacker may be able to read server configuration such as AWS metadata, connect to internal services like HTTP enabled databases, or perform post requests towards internal services which are not intended to be exposed.

-
- - - - https://github.com/minio/minio/security/advisories/GHSA-m4qq-5f7c-693q - - - 2021-01-29 - 2021-01-31 - - - - - FreeBSD -- Xen guests can triger backend Out Of Memory - - - FreeBSD-kernel - 12.212.2_3 - 12.112.1_13 - 11.411.4_7 - - - - -

Problem Description:

-

Some OSes (including Linux, FreeBSD, and NetBSD) are processing watch - events using a single thread. If the events are received faster than - the thread is able to handle, they will get queued.

-

As the queue is unbound, a guest may be able to trigger a OOM in - the backend.

- - - - CVE-2020-29568 - SA-21:02.xenoom - - - 2021-01-29 - 2021-01-29 - - - - - FreeBSD -- Uninitialized kernel stack leaks in several file systems - - - FreeBSD-kernel - 12.212.2_3 - 12.112.1_13 - 11.411.4_7 - - - - -

Problem Description:

-

Several file systems were not properly initializing the d_off field - of the dirent structures returned by VOP_READDIR. In particular, - tmpfs(5), smbfs(5), autofs(5) and mqueuefs(5) were failing to do so. - As a result, eight uninitialized kernel stack bytes may be leaked to - userspace by these file systems. This problem is not present in - FreeBSD 11.

-

Additionally, msdosfs(5) was failing to zero-fill a pair of padding - fields in the dirent structure, resulting in a leak of three - uninitialized bytes.

-

Impact:

-

Kernel stack disclosures may leak sensitive information which could - be used to compromise the security of the system.

- - - - CVE-2020-25578 - CVE-2020-25579 - SA-21:01.fsdisclosure - - - 2021-01-29 - 2021-01-29 - - - - - pngcheck -- Buffer-overrun vulnerability - - - pngcheck - 3.0.1 - - - - -

The libpng project reports:

-
-

pngcheck versions 3.0.0 and earlier have a pair of buffer-overrun - bugs related to the sPLT and PPLT chunks (the latter is a MNG-only - chunk, but it gets noticed even in PNG files if the -s option is used). - Both bugs are fixed in version 3.0.1, released on 24 January 2021. - Again, while all known vulnerabilities are fixed in this version, - the code is quite crufty, so it would be safest to assume there are - still some problems hidden in there. As always, use at your own risk.

-
- - - - http://www.libpng.org/pub/png/apps/pngcheck.html - - - 2021-01-24 - 2021-01-28 - - - - - sudo -- Multiple vulnerabilities - - - sudo - 1.9.5p2 - - - - -

Todd C. Miller reports:

-
-

When invoked as sudoedit, the same set of command line options - are now accepted as for sudo -e. The -H and -P options are now - rejected for sudoedit and sudo -e which matches the sudo 1.7 - behavior. This is part of the fix for CVE-2021-3156.

-

Fixed a potential buffer overflow when unescaping backslashes in - the command's arguments. Normally, sudo escapes special characters - when running a command via a shell (sudo -s or sudo -i). However, - it was also possible to run sudoedit with the -s or -i flags in - which case no escaping had actually been done, making a buffer - overflow possible. This fixes CVE-2021-3156.

-
- - - - https://www.sudo.ws/stable.html#1.9.5p2 - CVE-2021-3156 - - - 2021-01-26 - 2021-01-26 - - - - - pysaml2 -- multiple vulnerabilities - - - py36-pysaml2 - py37-pysaml2 - py38-pysaml2 - py39-pysaml2 - 6.5.0 - - - - -

pysaml2 Releases:

-
-

Fix processing of invalid SAML XML documents - CVE-2021-21238

-

Fix unspecified xmlsec1 key-type preference - CVE-2021-21239

-
- - - - https://github.com/IdentityPython/pysaml2/releases - https://github.com/IdentityPython/pysaml2/security/advisories/GHSA-f4g9-h89h-jgv9 - https://github.com/IdentityPython/pysaml2/security/advisories/GHSA-5p3x-r448-pc62 - CVE-2021-21238 - CVE-2021-21239 - - - 2021-01-20 - 2021-01-26 - - - - - jenkins -- Arbitrary file read vulnerability in workspace browsers - - - jenkins - 2.276 - - - jenkins-lts - 2.263.3 - - - - -

Jenkins Security Advisory:

-
-

Description

-
(Medium) SECURITY-2197 / CVE-2021-21615
-

Arbitrary file read vulnerability in workspace browsers

-
- - - - https://www.jenkins.io/security/advisory/2021-01-26/ - - - 2021-01-26 - 2021-01-26 - - - - - mutt -- denial of service - - - mutt - 2.0.5 - - - - -

Tavis Ormandy reports:

-
-

- rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a - denial of service (mailbox unavailability) by sending email messages - with sequences of semicolon characters in RFC822 address fields - (aka terminators of empty groups). A small email message from the - attacker can cause large memory consumption, and the victim - may then be unable to see email messages from other persons. -

-
- - - - https://gitlab.com/muttmua/mutt/-/issues/323 - CVE-2021-3181 - - - 2021-01-17 - 2021-01-23 - - - - - MySQL -- Multiple vulnerabilities - - - mysql56-client - 5.6.51 - - - mysql57-client - 5.7.33 - - - mysql80-client - 8.0.23 - - - mysql56-server - 5.6.51 - - - mysql57-server - 5.7.33 - - - mysql80-server - 8.0.23 - - - - -

Oracle reports:

-
-

This Critical Patch Update contains 34 new security patches for - Oracle MySQL Server and 4 for MySQL Client.

-

The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle - MySQL is 6.8.

-
- - - - https://www.oracle.com/security-alerts/cpujan2021.html#AppendixMSQL - CVE-2021-2046 - CVE-2021-2020 - CVE-2021-2024 - CVE-2021-2011 - CVE-2021-2006 - CVE-2021-2048 - CVE-2021-2028 - CVE-2021-2122 - CVE-2021-2058 - CVE-2021-2001 - CVE-2021-2016 - CVE-2021-2021 - CVE-2021-2030 - CVE-2021-2031 - CVE-2021-2036 - CVE-2021-2055 - CVE-2021-2060 - CVE-2021-2070 - CVE-2021-2076 - CVE-2021-2065 - CVE-2021-2014 - CVE-2021-2002 - CVE-2021-2012 - CVE-2021-2009 - CVE-2021-2072 - CVE-2021-2081 - CVE-2021-2022 - CVE-2021-2038 - CVE-2021-2061 - CVE-2021-2056 - CVE-2021-2087 - CVE-2021-2088 - CVE-2021-2032 - CVE-2021-2010 - CVE-2021-1998 - CVE-2021-2007 - CVE-2021-2019 - CVE-2021-2042 - - - 2021-01-23 - 2021-01-23 - - - - - chromium -- multiple vulnerabilities - - - chromium - 88.0.4324.96 - - - - -

Chrome Releases reports:

-
-

This release contains 36 security fixes, including:

-
    -
  • [1137179] Critical CVE-2021-21117: Insufficient policy - enforcement in Cryptohome. Reported by Rory McNamara on - 2020-10-10
    • -
  • [1161357] High CVE-2021-21118: Insufficient data validation in - V8. Reported by Tyler Nighswander (@tylerni7) of Theori on - 2020-12-23
    • -
  • [1160534] High CVE-2021-21119: Use after free in Media. Reported - by Anonymous on 2020-12-20
    • -
  • [1160602] High CVE-2021-21120: Use after free in WebSQL. - Reported by Nan Wang(@eternalsakura13) and Guang Gong of 360 Alpha - Lab on 2020-12-21
    • -
  • [1161143] High CVE-2021-21121: Use after free in Omnibox. - Reported by Leecraso and Guang Gong of 360 Alpha Lab on - 2020-12-22
    • -
  • [1162131] High CVE-2021-21122: Use after free in Blink. Reported - by Renata Hodovan on 2020-12-28
    • -
  • [1137247] High CVE-2021-21123: Insufficient data validation in - File System API. Reported by Maciej Pulikowski on 2020-10-11
    • -
  • [1131346] High CVE-2021-21124: Potential user after free in - Speech Recognizer. Reported by Chaoyang Ding(@V4kst1z) from - Codesafe Team of Legendsec at Qi'anxin Group on 2020-09-23
    • -
  • [1152327] High CVE-2021-21125: Insufficient policy enforcement - in File System API. Reported by Ron Masas (Imperva) on - 2020-11-24
    • -
  • [1163228] High CVE-2020-16044: Use after free in WebRTC. - Reported by Ned Williamson of Project Zero on 2021-01-05
    • -
  • [1108126] Medium CVE-2021-21126: Insufficient policy enforcement - in extensions. Reported by David Erceg on 2020-07-22
    • -
  • [1115590] Medium CVE-2021-21127: Insufficient policy enforcement - in extensions. Reported by Jasminder Pal Singh, Web Services Point - WSP, Kotkapura on 2020-08-12
    • -
  • [1138877] Medium CVE-2021-21128: Heap buffer overflow in Blink. - Reported by Liang Dong on 2020-10-15
    • -
  • [1140403] Medium CVE-2021-21129: Insufficient policy enforcement - in File System API. Reported by Maciej Pulikowski on - 2020-10-20
    • -
  • [1140410] Medium CVE-2021-21130: Insufficient policy enforcement - in File System API. Reported by Maciej Pulikowski on - 2020-10-20
    • -
  • [1140417] Medium CVE-2021-21131: Insufficient policy enforcement - in File System API. Reported by Maciej Pulikowski on - 2020-10-20
    • -
  • [1128206] Medium CVE-2021-21132: Inappropriate implementation in - DevTools. Reported by David Erceg on 2020-09-15
    • -
  • [1157743] Medium CVE-2021-21133: Insufficient policy enforcement - in Downloads. Reported by wester0x01 - (https://twitter.com/wester0x01) on 2020-12-11
    • -
  • [1157800] Medium CVE-2021-21134: Incorrect security UI in Page - Info. Reported by wester0x01 (https://twitter.com/wester0x01) on - 2020-12-11
    • -
  • [1157818] Medium CVE-2021-21135: Inappropriate implementation in - Performance API. Reported by ndevtk on 2020-12-11
    • -
  • [1038002] Low CVE-2021-21136: Insufficient policy enforcement in - WebView. Reported by Shiv Sahni, Movnavinothan V and Imdad - Mohammed on 2019-12-27
    • -
  • [1093791] Low CVE-2021-21137: Inappropriate implementation in - DevTools. Reported by bobblybear on 2020-06-11
    • -
  • [1122487] Low CVE-2021-21138: Use after free in DevTools. - Reported by Weipeng Jiang (@Krace) from Codesafe Team of Legendsec - at Qi'anxin Group on 2020-08-27
    • -
  • [1136327] Low CVE-2021-21140: Uninitialized Use in USB. Reported - by David Manouchehri on 2020-10-08
    • -
  • [1140435] Low CVE-2021-21141: Insufficient policy enforcement in - File System API. Reported by Maciej Pulikowski on 2020-10-20
    • -
-
- - - - CVE-2020-16044 - CVE-2021-21117 - CVE-2021-21118 - CVE-2021-21119 - CVE-2021-21120 - CVE-2021-21121 - CVE-2021-21122 - CVE-2021-21123 - CVE-2021-21124 - CVE-2021-21125 - CVE-2021-21126 - CVE-2021-21127 - CVE-2021-21128 - CVE-2021-21129 - CVE-2021-21130 - CVE-2021-21131 - CVE-2021-21132 - CVE-2021-21133 - CVE-2021-21134 - CVE-2021-21135 - CVE-2021-21136 - CVE-2021-21137 - CVE-2021-21138 - CVE-2021-21139 - CVE-2021-21140 - CVE-2021-21141 - https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop_19.html - - - 2021-01-19 - 2021-01-22 - - - - - chocolate-doom -- Arbitrary code execution - - - chocolate-doom - 3.0.1 - - - crispy-doom - 5.9.0 - - - - -

Michal Dardas from LogicalTrust reports:

-
-

- The server in Chocolate Doom 3.0.0 and Crispy Doom 5.8.0 doesn't validate - the user-controlled num_players value, leading to a buffer overflow. A - malicious user can overwrite the server's stack. -

-
- - - - https://github.com/chocolate-doom/chocolate-doom/issues/1293 - CVE-2020-14983 - - - 2020-06-22 - 2021-01-22 - - - - - nokogiri -- Security vulnerability - - - rubygem-nokogiri - rubygem-nokogiri18 - 1.11.0.rc3 - - - - -

Nokogiri reports:

-
-

In Nokogiri versions <= 1.11.0.rc3, XML Schemas parsed by Nokogiri::XML::Schema were trusted by default, allowing external resources to be accessed over the network, potentially enabling XXE or SSRF attacks.

-
- - - - https://nokogiri.org/CHANGELOG.html - CVE-2020-26247 - - - 2021-01-22 - 2021-01-22 - - - - - dnsmasq -- DNS cache poisoning, and DNSSEC buffer overflow, vulnerabilities - - - dnsmasq - 2.83 - - - dnsmasq-devel - 2.83 - - - - -

Simon Kelley reports:

-
-

- There are broadly two sets of problems. The first is subtle errors - in dnsmasq's protections against the chronic weakness of the DNS - protocol to cache-poisoning attacks; the Birthday attack, Kaminsky, - etc.[...] -

-

- the second set of errors is a good old fashioned buffer overflow in - dnsmasq's DNSSEC code. If DNSSEC validation is enabled, an - installation is at risk. -

-
- - - - https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2021q1/014599.html - https://www.jsof-tech.com/disclosures/dnspooq/ - CVE-2020-25684 - CVE-2020-25685 - CVE-2020-25686 - CVE-2020-25681 - CVE-2020-25682 - CVE-2020-25683 - CVE-2020-25687 - - - 2020-09-16 - 2021-01-20 - - - - - go -- cmd/go: packages using cgo can cause arbitrary code execution at build time; crypto/elliptic: incorrect operations on the P-224 curve - - - go - 1.15.7,1 - - - - -

The Go project reports:

-
-

The go command may execute arbitrary code at build time when cgo is - in use on Windows. This may occur when running "go get", or - any other command that builds code. Only users who build untrusted - code (and don't execute it) are affected. In addition to Windows - users, this can also affect Unix users who have "." listed - explicitly in their PATH and are running "go get" or build - commands outside of a module or with module mode disabled.

-
-
-

The P224() Curve implementation can in rare circumstances generate - incorrect outputs, including returning invalid points from - ScalarMult. The crypto/x509 and golang.org/x/crypto/ocsp (but not - crypto/tls) packages support P-224 ECDSA keys, but they are not - supported by publicly trusted certificate authorities. No other - standard library or golang.org/x/crypto package supports or uses the - P-224 curve.

-
- - - - CVE-2021-3115 - http://golang.org/issue/43783 - CVE-2021-3114 - http://golang.org/issue/43786 - - - 2021-01-13 - 2021-01-19 - - - - - cloud-init -- Wrong access permissions of authorized keys - - - cloud-init - 20.420.4.1 - - - - -

cloud-init reports:

-
-

cloud-init release 20.4.1 is now available. This is a hotfix - release, that contains a single patch to address a security issue in - cloud-init 20.4.

- -

Briefly, for users who provide more than one unique SSH key to - cloud-init and have a shared AuthorizedKeysFile configured in - sshd_config, cloud-init 20.4 started writing all of these keys to such a - file, granting all such keys SSH access as root.

- -

It's worth restating this implication: if you are using the default - AuthorizedKeysFile setting in /etc/ssh/sshd_config, as most will be, - then you are _not_ affected by this issue.

-
- - - - https://bugs.launchpad.net/cloud-init/+bug/1911680 - - - 2021-01-14 - 2021-01-19 - - - - - moinmoin -- multiple vulnerabilities - - - moinmoin - 1.9.11 - - - - -

MoinMoin reports:

-
-
    -

  • Security fix for CVE-2020-25074: fix remote code execution via cache action

    • -

  • Security fix for CVE-2020-15275: fix malicious SVG attachment causing stored XSS vulnerability

    • -
-
- - - - https://github.com/moinwiki/moin-1.9/blob/1.9.11/docs/CHANGES#L13 - CVE-2020-25074 - CVE-2020-15275 - - - 2020-11-08 - 2021-01-18 - - - - - Ghostscript -- SAFER Sandbox Breakout - - - ghostscript9-agpl-base - 9.509.52_8 - - - - -

SO-AND-SO reports:

-
-

A memory corruption issue was found in Artifex - Ghostscript 9.50 and 9.52. Use of a non-standard - PostScript operator can allow overriding of file access - controls. The 'rsearch' calculation for the 'post' size - resulted in a size that was too large, and could underflow - to max uint32_t. This was fixed in commit - 5d499272b95a6b890a1397e11d20937de000d31b.

-
- - - - https://nvd.nist.gov/vuln/detail/CVE-2020-15900 - - - 2020-07-28 - 2021-01-17 - - - - - Node.js -- January 2021 Security Releases - - - node10 - 10.23.1 - - - node12 - 12.20.1 - - - node14 - 14.15.4 - - - node - 15.5.1 - - - - -

Node.js reports:

-
-

use-after-free in TLSWrap (High) (CVE-2020-8265)

-

Affected Node.js versions are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits.

-

HTTP Request Smuggling in nodejs (Low) (CVE-2020-8287)

-

Affected versions of Node.js allow two copies of a header field in a http request. For example, two Transfer-Encoding header fields. In this case Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling.

-

OpenSSL - EDIPARTYNAME NULL pointer de-reference (CVE-2020-1971)

-

iThis is a vulnerability in OpenSSL which may be exploited through Node.js. You can read more about it in https://www.openssl.org/news/secadv/20201208.txt.

-
- - - - https://nodejs.org/en/blog/vulnerability/january-2021-security-releases/ - https://www.openssl.org/news/secadv/20201208.txt - CVE-2020-8265 - CVE-2020-8287 - CVE-2020-1971 - - - 2021-01-04 - 2021-01-14 - - - - - Gitlab -- vulnerability - - - gitlab-ce - 13.7.013.7.4 - 13.6.013.6.5 - 12.213.5.7 - - - - -

SO-AND-SO reports:

-
-

Ability to steal a user's API access token through GitLab Pages

-
- - - - https://about.gitlab.com/releases/2021/01/14/critical-security-release-gitlab-13-7-4-released/ - - - 2021-01-14 - 2021-01-14 - - - - - wavpack -- integer overflow in pack_utils.c - - - wavpack - 5.4.0 - - - - -

The wavpack project reports:

-
-

src/pack_utils.c - - issue #91: fix integer overflows resulting in buffer overruns (CVE-2020-35738) - - sanitize configuration parameters better (improves clarity and aids debugging)

-
- - - - https://github.com/dbry/WavPack/blob/733616993d53cc1f9a7ffb88a858447ba51eb0ee/ChangeLog - CVE-2020-35738 - - - 2020-12-29 - 2021-01-14 - - - - - jenkins -- multiple vulnerabilities - - - jenkins - 2.275 - - - jenkins-lts - 2.263.2 - - - - -

Jenkins Security Advisory:

-
-

Description

-
(Medium) SECURITY-1452 / CVE-2021-21602
-

Arbitrary file read vulnerability in workspace browsers

-
(High) SECURITY-1889 / CVE-2021-21603
-

XSS vulnerability in notification bar

-
(High) SECURITY-1923 / CVE-2021-21604
-

Improper handling of REST API XML deserialization errors

-
(High) SECURITY-2021 / CVE-2021-21605
-

Path traversal vulnerability in agent names

-
(Medium) SECURITY-2023 / CVE-2021-21606
-

Arbitrary file existence check in file fingerprints

-
(Medium) SECURITY-2025 / CVE-2021-21607
-

Excessive memory allocation in graph URLs leads to denial of service

-
(High) SECURITY-2035 / CVE-2021-21608
-

Stored XSS vulnerability in button labels

-
(Low) SECURITY-2047 / CVE-2021-21609
-

Missing permission check for paths with specific prefix

-
(High) SECURITY-2153 / CVE-2021-21610
-

Reflected XSS vulnerability in markup formatter preview

-
(High) SECURITY-2171 / CVE-2021-21611
-

Stored XSS vulnerability on new item page

-
- - - - https://www.jenkins.io/security/advisory/2021-01-13/ - - - 2021-01-13 - 2021-01-13 - - - - - phpmyfaq -- XSS vulnerability - - - phpmyfaq - 3.0.6 - - - - -

phpmyfaq developers report:

-
-

phpMyFAQ does not implement sufficient checks to avoid XSS - injection for displaying tags.

-
- - - - https://www.phpmyfaq.de/security/advisory-2020-12-23 - - - 2020-12-23 - 2021-01-12 - - - - - sudo -- Potential information leak in sudoedit - - - sudo - 1.9.5 - - - - -

Todd C. Miller reports:

-
-

A potential information leak in sudoedit that could be used to - test for the existence of directories not normally accessible to - the user in certain circumstances. When creating a new file, - sudoedit checks to make sure the parent directory of the new file - exists before running the editor. However, a race condition exists - if the invoking user can replace (or create) the parent directory. - If a symbolic link is created in place of the parent directory, - sudoedit will run the editor as long as the target of the link - exists.If the target of the link does not exist, an error message - will be displayed. The race condition can be used to test for the - existence of an arbitrary directory. However, it _cannot_ be used - to write to an arbitrary location.

-
- - - - https://www.sudo.ws/stable.html#1.9.5 - CVE-2021-23239 - - - 2021-01-11 - 2021-01-11 - - - - - CairoSVG -- Regular Expression Denial of Service vulnerability - - - py36-cairosvg - py37-cairosvg - py38-cairosvg - py39-cairosvg - 2.0.02.5.1 - - - - -

CairoSVG security advisories:

-
-

When processing SVG files, the python package CairoSVG uses two regular - expressions which are vulnerable to Regular Expression Denial of Service - (REDoS).

-

If an attacker provides a malicious SVG, it can make cairosvg get stuck - processing the file for a very long time.

-
- - - - https://github.com/Kozea/CairoSVG/security/advisories/GHSA-hq37-853p-g5cf - - - 2020-12-30 - 2021-01-10 - - - - - Gitlab -- multiple vulnerabilities - - - gitlab-ce - 13.7.013.7.2 - 13.6.013.6.4 - 12.213.5.6 - - - - -

Gitlab reports:

-
-

Ability to steal a user's API access token through GitLab Pages

-

Prometheus denial of service via HTTP request with custom method

-

Unauthorized user is able to access private repository information under specific conditions

-

Regular expression denial of service in NuGet API

-

Regular expression denial of service in package uploads

-

Update curl dependency

-

CVE-2019-3881 mitigation

-
- - - - https://about.gitlab.com/releases/2021/01/07/security-release-gitlab-13-7-2-released/ - CVE-2021-22166 - CVE-2020-26414 - CVE-2019-3881 - - - 2021-01-07 - 2021-01-09 - - - - - chromium -- multiple vulnerabilities - - - chromium - 87.0.4280.141 - - - - -

Chrome Releases reports:

-
-

This release includes 16 security fixes, including:

-
    -
  • [1148749] High CVE-2021-21106: Use after free in autofill. - Reported by Weipeng Jiang (@Krace) from Codesafe Team of - Legendsec at Qi'anxin Group on 2020-11-13
    • -
  • [1153595] High CVE-2021-21107: Use after free in drag and - drop. Reported by Leecraso and Guang Gong of 360 Alpha Lab on - 2020-11-30
    • -
  • [1155426] High CVE-2021-21108: Use after free in media. - Reported by Leecraso and Guang Gong of 360 Alpha Lab on - 2020-12-04
    • -
  • [1152334] High CVE-2021-21109: Use after free in payments. - Reported by Rong Jian and Guang Gong of 360 Alpha Lab on - 2020-11-24
    • -
  • [1152451] High CVE-2021-21110: Use after free in safe - browsing. Reported by Anonymous on 2020-11-24
    • -
  • [1149125] High CVE-2021-21111: Insufficient policy enforcement - in WebUI. Reported by Alesandro Ortiz on 2020-11-15
    • -
  • [1151298] High CVE-2021-21112: Use after free in Blink. - Reported by YoungJoo Lee(@ashuu_lee) of Raon Whitehat on - 2020-11-20
    • -
  • [1155178] High CVE-2021-21113: Heap buffer overflow in Skia. - Reported by tsubmunu on 2020-12-03
    • -
  • [1148309] High CVE-2020-16043: Insufficient data validation in - networking. Reported by Samy Kamkar, Ben Seri at Armis, Gregory - Vishnepolsky at Armis on 2020-11-12
    • -
  • [1150065] High CVE-2021-21114: Use after free in audio. - Reported by Man Yue Mo of GitHub Security Lab on 2020-11-17
    • -
  • [1157790] High CVE-2020-15995: Out of bounds write in V8. - Reported by Bohan Liu (@P4nda20371774) of Tencent Security Xuanwu - Lab on 2020-12-11
    • -
  • [1157814] High CVE-2021-21115: Use after free in safe browsing. - Reported by Leecraso and Guang Gong of 360 Alpha Lab on - 2020-12-11
    • -
  • [1151069] Medium CVE-2021-21116: Heap buffer overflow in audio. - Reported by Alison Huffman, Microsoft Browser Vulnerability - Research on 2020-11-19
    • -
-
- - - - CVE-2020-15995 - CVE-2020-16043 - CVE-2021-21106 - CVE-2021-21107 - CVE-2021-21108 - CVE-2021-21109 - CVE-2021-21110 - CVE-2021-21111 - CVE-2021-21112 - CVE-2021-21113 - CVE-2021-21114 - CVE-2021-21115 - CVE-2021-21116 - https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop.html - - - 2021-01-06 - 2021-01-07 - - - - - mail/dovecot -- multiple vulnerabilities - - - dovecot - 2.3.13 - - - - -

Aki Tuomi reports:

-
-

When imap hibernation is active, an attacker can cause Dovecot to - discover file system directory structure and access other users' - emails using specially crafted command. - The attacker must have valid credentials to access the - mail server.

-
-
-

Mail delivery / parsing crashed when the 10 000th MIME part was - message/rfc822 (or if parent was multipart/digest). This happened - due to earlier MIME parsing changes for CVE-2020-12100.

-
- - - - https://dovecot.org/pipermail/dovecot-news/2021-January/000448.html - CVE-2020-24386 - CVE-2020-25275 - - - 2020-08-17 - 2021-01-04 - - - - - gitea -- multiple vulnerabilities - - - gitea - 1.13.1 - - - - -

The Gitea Team reports for release 1.13.1:

-
-
    -
  • Hide private participation in Orgs
    • -
  • Fix escaping issue in diff
    • -
-
- - - - https://github.com/go-gitea/gitea/releases/tag/v1.13.1 - ports/252310 - - - 2020-12-15 - 2020-12-31 - - - - - InspIRCd websocket module double free vulnerability - - - inspircd - 3.8.1 - - - - -

The InspIRCd development team reports:

-
-

The websocket module before v3.8.1 contains a double free - vulnerability. When combined with a HTTP reverse proxy this - vulnerability can be used by any user who is [GKZ]-lined to remotely - crash an InspIRCd server.

-
- - - - https://docs.inspircd.org/security/2020-02/ - - - 2020-02-01 - 2021-01-01 - - - - - Intel CPU issues - - - devcpu-data - 1.31 - - - - -

Intel reports:

-
-

Intel CPUs suffer Special Register Buffer Data Sampling vulnerability

-
- - - - https://software.intel.com/security-software-guidance/insights/processors-affected-special-register-buffer-data-sampling - CVE-2020-0543 - - - 2020-06-09 - 2020-12-28 - - - - - asterisk -- Remote crash in res_pjsip_diversion - - - asterisk13 - 13.38.1 - - - asterisk16 - 16.15.1 - - - asterisk18 - 18.1.1 - - - - -

The Asterisk project reports:

-
-

AST-2020-003: A crash can occur in Asterisk when a SIP - message is received that has a History-Info header, which - contains a tel-uri.

-

AST-2020-004: A crash can occur in Asterisk when a SIP - 181 response is received that has a Diversion header, - which contains a tel-uri.

-
- - - - https://downloads.asterisk.org/pub/security/AST-2020-003.html - https://downloads.asterisk.org/pub/security/AST-2020-004.html - - - 2020-12-02 - 2020-12-22 - - - - - postsrsd -- Denial of service vulnerability - - - postsrsd - 1.10 - - - - -

postsrsd developer reports:

-
-

PostSRSd could be tricked into consuming a lot of CPU time with - an SRS address that has an excessively long time stamp tag.

-
- - - - CVE-2020-35573 - https://github.com/roehling/postsrsd/commit/4733fb11f6bec6524bb8518c5e1a699288c26bac - https://github.com/roehling/postsrsd/releases/tag/1.10 - - - 2020-12-12 - 2020-12-21 - - - - - powerdns -- Various issues in GSS-TSIG support - - - powerdns - 4.4.0 - - - - -

PowerDNS developers report:

-
-

A remote, unauthenticated attacker can trigger a race condition - leading to a crash, or possibly arbitrary code execution, by sending crafted queries with a GSS-TSIG signature.

-

A remote, unauthenticated attacker can cause a denial of service by - sending crafted queries with a GSS-TSIG signature.

-

A remote, unauthenticated attacker might be able to cause a double-free, - leading to a crash or possibly arbitrary code execution by sending crafted queries with a GSS-TSIG signature.

-
- - - - CVE-2020-24696 - CVE-2020-24697 - CVE-2020-24698 - https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2020-06.html - - - 2020-08-27 - 2020-12-21 - - - - - vault -- User Enumeration via LDAP auth - - - vault - 1.6.1 - - - - -

Vault developers report:

-
-

Vault allowed enumeration of users via the LDAP auth method. This vulnerability, was fixed in Vault 1.6.1 and 1.5.6.

-

An external party reported that they were able to enumerate LDAP users via error messages returned by Vault’s LDAP auth method

-
- - - - CVE-2020-35177 - https://discuss.hashicorp.com/t/hcsec-2020-25-vault-s-ldap-auth-method-allows-user-enumeration/18984 - - - 2020-12-16 - 2020-12-17 - - - - - jasper -- heap overflow vulnerability - - - jasper - 2.0.23 - - - - -

JasPer NEWS:

-
-

Fix CVE-2020-27828, heap-overflow in cp_create() in jpc_enc.c.

-
- - - - CVE-2020-27828 - https://github.com/jasper-software/jasper/blob/master/NEWS - https://github.com/jasper-software/jasper/issues/252 - - - 2020-12-08 - 2020-12-13 - - - - - py-matrix-synapse -- DoS on Federation API - - - py36-matrix-synapse - py37-matrix-synapse - py38-matrix-synapse - py39-matrix-synapse - 1.23.1 - - - - -

Matrix developers reports:

-
-

A malicious or poorly-implemented homeserver can inject malformed events - into a room by specifying a different room id in the path of a /send_join, - /send_leave, /invite or /exchange_third_party_invite request. - This can lead to a denial of service in which future events will not be - correctly sent to other servers over federation. - This affects any server which accepts federation requests from untrusted - servers.

-
- - - - CVE-2020-26257 - https://github.com/matrix-org/synapse/security/advisories/GHSA-hxmp-pqch-c8mm - ports/251768 - - - 2020-12-09 - 2020-12-13 - - - - - p11-kit -- Multiple vulnerabilities - - - p11-kit - 0.23.22 - - - - -

The p11-glue project reports:

-
-

CVE-2020-29363: Out-of-bounds write in - p11_rpc_buffer_get_byte_array_value function
A heap-based buffer - overflow has been discovered in the RPC protocol used by p11-kit - server/remote commands and the client library. When the remote - entity supplies a serialized byte array in a CK_ATTRIBUTE, the - receiving entity may not allocate sufficient length for the buffer - to store the deserialized value.

-

CVE-2020-29362: Out-of-bounds read in p11_rpc_buffer_get_byte_array - function
A heap-based buffer over-read has been discovered in - the RPC protocol used by thep11-kit server/remote commands and the - client library. When the remote entity supplies a byte array through - a serialized PKCS#11 function call, the receiving entity may allow - the reading of up to 4 bytes of memory past the heap - allocation.

-

CVE-2020-29361: Integer overflow when allocating memory for arrays - of attributes and object identifiers
Multiple integer overflows - have been discovered in the array allocations in the p11-kit library - and the p11-kit list command, where overflow checks are missing - before calling realloc or calloc.

-
- - - - https://lists.freedesktop.org/archives/p11-glue/2020-December/000712.html - CVE-2020-29361 - CVE-2020-29362 - CVE-2020-29363 - - - 2020-12-12 - 2020-12-12 - - - - - Unbound/NSD -- Denial of service vulnerability - - - unbound - 1.13.0 - - - nsd - 4.3.4 - - - - -

NLNetLabs reports:

-
-

Unbound and NSD when writing the PID file would not check if an - existing file was a symlink. This could allow for a local symlink \ - attack if an attacker has access to the user Unbound/NSD runs as.

-
- - - - https://nlnetlabs.nl/downloads/unbound/CVE-2020-28935.txt - CVE-2020-28935 - - - 2020-12-01 - 2020-12-12 - - - - - LibreSSL -- NULL pointer dereference - - - libressl - 3.2.03.2.3 - 3.1.5 - - - libressl-devel - 3.3.1 - - - - -

The LibreSSL project reports:

-
-

Malformed ASN.1 in a certificate revocation list or a timestamp - response token can lead to a NULL pointer dereference.

-
- - - - https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.2.3-relnotes.txt - - - 2020-12-08 - 2020-12-11 - 2020-12-12 - - - - - glpi -- Public GLPIKEY can be used to decrypt any data - - - glpi - 9.4.6 - - - - -

MITRE Corporation reports:

-
-

GLPI before before version 9.4.6 has a vulnerability involving a default encryption key. GLPIKEY is public and is used on every instance. This means anyone can decrypt sensitive data stored using this key. It is possible to change the key before installing GLPI. But on existing instances, data must be reencrypted with the new key. Problem is we can not know which columns or rows in the database are using that; espcially from plugins. Changing the key without updating data would lend in bad password sent from glpi; but storing them again from the UI will work.

-
- - - - https://github.com/glpi-project/glpi/security/advisories/GHSA-j222-j9mf-h6j9 - https://github.com/glpi-project/glpi/commit/efd14468c92c4da43333aa9735e65fd20cbc7c6c - CVE-2020-5248 - - - 2020-01-02 - 2020-01-02 - - - - - glpi -- Insecure Direct Object Reference on ajax/getDropdownValue.php - - - glpi - 9.5.3 - - - - -

MITRE Corporation reports:

-
-

In GLPI before 9.5.3, ajax/getDropdownValue.php has an Insecure Direct Object Reference (IDOR) vulnerability that allows an attacker to read data from any itemType (e.g., Ticket, Users, etc.).

-
- - - - https://github.com/glpi-project/glpi/security/advisories/GHSA-pqfv-4pvr-55r4 - CVE-2020-27663 - - - 2020-10-22 - 2020-10-22 - - - - - glpi -- Insecure Direct Object Reference on ajax/comments.ph - - - glpi - 9.5.3 - - - - -

MITRE Corporation reports:

-
-

In GLPI before 9.5.3, ajax/comments.php has an Insecure Direct Object Reference (IDOR) vulnerability that allows an attacker to read data from any database table (e.g., glpi_tickets, glpi_users, etc.).

-
- - - - https://github.com/glpi-project/glpi/security/advisories/GHSA-wq38-gwxp-8p5p - CVE-2020-27662 - - - 2020-10-22 - 2020-10-22 - - - - - glpi -- Any CalDAV calendars is read-only for every authenticated user - - - glpi - 9.5.0 - 9.5.3 - - - - -

MITRE Corporation reports:

-
-

In GLPI before version 9.5.3, any authenticated user has read-only permissions to the planning of every other user, even admin ones. This issue is fixed in version 9.5.3. As a workaround, one can remove the caldav.php file to block access to CalDAV server.

-
- - - - https://github.com/glpi-project/glpi/security/advisories/GHSA-qmw3-87hr-5wgx - https://github.com/glpi-project/glpi/commit/527280358ec78988ac57e9809d2eb21fcd74caf7 - https://github.com/glpi-project/glpi/releases/tag/9.5.3 - CVE-2020-26212 - - - 2020-10-01 - 2020-10-01 - - - - - glpi -- SQL Injection in Search API - - - glpi - 9.1 - 9.5.2 - - - - -

MITRE Corporation reports:

-
-

In GLPI before version 9.5.2, there is a SQL Injection in the API's search function. Not only is it possible to break the SQL syntax, but it is also possible to utilise a UNION SELECT query to reflect sensitive information such as the current database version, or database user. The most likely scenario for this vulnerability is with someone who has an API account to the system. The issue is patched in version 9.5.2. A proof-of-concept with technical details is available in the linked advisory.

-
- - - - https://github.com/glpi-project/glpi/commit/3dc4475c56b241ad659cc5c7cb5fb65727409cf0 - https://github.com/glpi-project/glpi/security/advisories/GHSA-jwpv-7m4h-5gvc - CVE-2020-15226 - - - 2020-06-25 - 2020-06-25 - - - - - glpi -- leakage issue with knowledge base - - - glpi - 9.5.0 - 9.5.2 - - - - -

MITRE Corporation reports:

-
-

In GLPI before version 9.5.2, there is a leakage of user information through the public FAQ. The issue was introduced in version 9.5.0 and patched in 9.5.2. As a workaround, disable public access to the FAQ.

-
- - - - https://github.com/glpi-project/glpi/commit/39e25591efddc560e3679ab07e443ee6198705e2 - https://github.com/glpi-project/glpi/security/advisories/GHSA-x9hg-j29f-wvvv - CVE-2020-15217 - - - 2020-06-25 - 2020-06-25 - - - - - glpi -- Unauthenticated Stored XSS - - - glpi - 0.65 - 9.5.2 - - - - -

MITRE Corporation reports:

-
-

In GLPI before version 9.5.2, the `install/install.php` endpoint insecurely stores user input into the database as `url_base` and `url_base_api`. These settings are referenced throughout the application and allow for vulnerabilities like Cross-Site Scripting and Insecure Redirection Since authentication is not required to perform these changes,anyone could point these fields at malicious websites or form input in a way to trigger XSS. Leveraging JavaScript it's possible to steal cookies, perform actions as the user, etc. The issue is patched in version 9.5.2.

-
- - - - https://github.com/glpi-project/glpi/commit/a8109d4ee970a222faf48cf48fae2d2f06465796 - https://github.com/glpi-project/glpi/security/advisories/GHSA-prvh-9m4h-4m79 - CVE-2020-15177 - - - 2020-06-25 - 2020-06-25 - - - - - glpi -- Multiple SQL Injections Stemming From isNameQuoted() - - - glpi - 0.68 - 9.5.2 - - - - -

MITRE Corporation reports:

-
-

In GLPI before version 9.5.2, when supplying a back tick in input that gets put into a SQL query,the application does not escape or sanitize allowing for SQL Injection to occur. Leveraging this vulnerability an attacker is able to exfiltrate sensitive information like passwords, reset tokens, personal details, and more. The issue is patched in version 9.5.2

-
- - - - https://github.com/glpi-project/glpi/commit/f021f1f365b4acea5066d3e57c6d22658cf32575 - https://github.com/glpi-project/glpi/security/advisories/GHSA-x93w-64x9-58qw - CVE-2020-15176 - - - 2020-06-25 - 2020-06-25 - - - - - glpi -- Unauthenticated File Deletion - - - glpi - 0.70 - 9.5.2 - - - - -

MITRE Corporation reports:

-
-

In GLPI before version 9.5.2, the pluginimage.send.php endpoint allows a user to specify an image from a plugin. The parameters can be maliciously crafted to instead delete the .htaccess file for the files directory. Any user becomes able to read all the files and folders contained in /files/. Some of the sensitive information that is compromised are the user sessions, logs, and more. An attacker would be able to get the Administrators session token and use that to authenticate. The issue is patched in version 9.5.2.

-
- - - - https://github.com/glpi-project/glpi/security/advisories/GHSA-rm52-jx9h-rwcp - https://github.com/glpi-project/glpi/commit/6ca9a0e77299a755c356d758344a23278df67f65 - CVE-2020-15175 - - - 2020-06-25 - 2020-06-25 - - - - - glpi -- SQL injection for all usages of "Clone" feature - - - glpi - 9.5.0 - 9.5.1 - - - - -

MITRE Corporation reports:

-
-

In glpi before 9.5.1, there is a SQL injection for all usages of "Clone" feature. This has been fixed in 9.5.1.

-
- - - - https://github.com/glpi-project/glpi/security/advisories/GHSA-qv6w-68gq-wx2v - https://github.com/glpi-project/glpi/commit/a4baa64114eb92fd2adf6056a36e0582324414ba - https://github.com/glpi-project/glpi/pull/6684 - CVE-2020-15108 - - - 2020-06-25 - 2020-06-25 - - - - - glpi -- Reflexive XSS in Dropdown menus - - - glpi - 0.68.1 - 9.4.6 - - - - -

MITRE Corporation reports:

-
-

In GLPI after 0.68.1 and before 9.4.6, multiple reflexive XSS occur in Dropdown endpoints due to an invalid Content-Type. This has been fixed in version 9.4.6.

-
- - - - https://github.com/glpi-project/glpi/security/advisories/GHSA-3xxh-f5p2-jg3h - https://github.com/glpi-project/glpi/commit/5e1c52c5e8a30ceb4e9572964da7ed89ddfb1aaf - CVE-2020-11062 - - - 2020-03-30 - 2020-03-30 - - - - - glpi -- Remote Code Execution (RCE) via the backup functionality - - - glpi - 9.4.6 - - - - -

MITRE Corporation reports:

-
-

In GLPI before 9.4.6, an attacker can execute system commands by abusing the backup functionality. Theoretically, this vulnerability can be exploited by an attacker without a valid account by using a CSRF. Due to the difficulty of the exploitation, the attack is only conceivable by an account having Maintenance privileges and the right to add WIFI networks. This is fixed in version 9.4.6.

-
- - - - https://github.com/glpi-project/glpi/security/advisories/GHSA-cvvq-3fww-5v6f - https://github.com/glpi-project/glpi/commit/ad748d59c94da177a3ed25111c453902396f320c - CVE-2020-11060 - - - 2020-03-30 - 2020-03-30 - - - - - glpi -- multiple related stored XSS vulnerabilities - - - glpi - 9.4.6 - - - - -

MITRE Corporation reports:

-
-

In GLPI before version 9.4.6 there are multiple related stored XSS vulnerabilities. The package is vulnerable to Stored XSS in the comments of items in the Knowledge base. Adding a comment with content "alert(1)" reproduces the attack. This can be exploited by a user with administrator privileges in the User-Agent field. It can also be exploited by an outside party through the following steps: 1. Create a user with the surname `" onmouseover="alert(document.cookie)` and an empty first name. 2. With this user, create a ticket 3. As an administrator (or other privileged user) open the created ticket 4. On the "last update" field, put your mouse on the name of the user 5. The XSS fires This is fixed in version 9.4.6.

-
- - - - https://github.com/glpi-project/glpi/security/advisories/GHSA-3g3h-rwhr-7385 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5WQMONZRWLWOXMHMYWR7A5Q5JJERPMVC/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q4BG2UTINBVV7MTJRXKBQ26GV2UINA6L/ - CVE-2020-11036 - - - 2020-03-30 - 2020-03-30 - - - - - glpi -- weak csrf tokens - - - glpi - 0.83.3 - 9.4.6 - - - - -

MITRE Corporation reports:

-
-

In GLPI after version 0.83.3 and before version 9.4.6, the CSRF tokens are generated using an insecure algorithm. The implementation uses rand and uniqid and MD5 which does not provide secure values. This is fixed in version 9.4.6.

-
- - - - https://github.com/glpi-project/glpi/security/advisories/GHSA-w7q8-58qp-vmpf - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5WQMONZRWLWOXMHMYWR7A5Q5JJERPMVC/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q4BG2UTINBVV7MTJRXKBQ26GV2UINA6L/ - CVE-2020-11035 - - - 2020-03-30 - 2020-03-30 - - - - - glpi -- bypass of the open redirect protection - - - glpi - 9.4.6 - - - - -

MITRE Corporation reports:

-
-

In GLPI before version 9.4.6, there is a vulnerability that allows bypassing the open redirect protection based which is based on a regexp. This is fixed in version 9.4.6.

-
- - - - https://github.com/glpi-project/glpi/security/advisories/GHSA-gxv6-xq9q-37hg - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5WQMONZRWLWOXMHMYWR7A5Q5JJERPMVC/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q4BG2UTINBVV7MTJRXKBQ26GV2UINA6L/ - CVE-2020-11034 - - - 2020-03-30 - 2020-03-30 - - - - - glpi -- able to read any token through API user endpoint - - - glpi - 9.1 - 9.4.6 - - - - -

MITRE Corporation reports:

-
-

In GLPI from version 9.1 and before version 9.4.6, any API user with READ right on User itemtype will have access to full list of users when querying apirest.php/User. The response contains: - All api_tokens which can be used to do privileges escalations or read/update/delete data normally non accessible to the current user. - All personal_tokens can display another users planning. Exploiting this vulnerability requires the api to be enabled, a technician account. It can be mitigated by adding an application token. This is fixed in version 9.4.6.

-
- - - - https://github.com/glpi-project/glpi/security/advisories/GHSA-rf54-3r4w-4h55 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5WQMONZRWLWOXMHMYWR7A5Q5JJERPMVC/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q4BG2UTINBVV7MTJRXKBQ26GV2UINA6L/ - CVE-2020-11033 - - - 2020-03-30 - 2020-03-30 - - - - - glpi -- SQL injection for all helpdesk instances - - - glpi - 9.4.6 - - - - -

MITRE Corporation reports:

-
-

In GLPI before version 9.4.6, there is a SQL injection vulnerability for all helpdesk instances. Exploiting this vulnerability requires a technician account. This is fixed in version 9.4.6.

-
- - - - https://github.com/glpi-project/glpi/security/advisories/GHSA-344w-34h9-wwhh - CVE-2020-11032 - - - 2020-03-30 - 2020-03-30 - - - - - glpi -- Improve encryption algorithm - - - glpi - 9.5.0 - - - - -

MITRE Corporation reports:

-
-

In GLPI before version 9.5.0, the encryption algorithm used is insecure. The security of the data encrypted relies on the password used, if a user sets a weak/predictable password, an attacker could decrypt data. This is fixed in version 9.5.0 by using a more secure encryption library. The library chosen is sodium.

-
- - - - https://github.com/glpi-project/glpi/security/advisories/GHSA-7xwm-4vjr-jvqh - https://github.com/glpi-project/glpi/commit/f1ae6c8481e5c19a6f1801a5548cada45702e01a#diff-b5d0ee8c97c7abd7e3fa29b9a27d1780 - https://github.com/glpi-project/glpi/commit/f1ae6c8481e5c19a6f1801a5548cada45702e01a#diff-b5d0ee8c97c7abd7e3fa29b9a27d1780 - CVE-2020-11031 - - - 2020-03-30 - 2020-03-30 - - - - - glpi -- Account takeover vulnerability - - - glpi - 9.4.4 - - - - -

MITRE Corporation reports:

-
-

GLPI through 9.4.3 is prone to account takeover by abusing the ajax/autocompletion.php autocompletion feature. The lack of correct validation leads to recovery of the token generated via the password reset functionality, and thus an authenticated attacker can set an arbitrary password for any user. This vulnerability can be exploited to take control of admin account. This vulnerability could be also abused to obtain other sensitive fields like API keys or password hashes.

-
- - - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14666 - https://github.com/glpi-project/glpi/security/advisories/GHSA-47hq-pfrr-jh5q - https://www.tarlogic.com/advisories/Tarlogic-2019-GPLI-Account-Takeover.txt - CVE-2019-14666 - - - 2019-08-05 - 2019-08-05 - - - - - cURL -- Multiple vulnerabilities - - - curl - 4.07.74.0 - - - - -

The cURL project reports:

-
-

Trusting FTP PASV responses (CVE-2020-8284)

-

FTP wildcard stack overflow (CVE-2020-8285)

-

Inferior OCSP verification (CVE-2020-8286)

-
- - - - https://curl.se/docs/security.html - CVE-2020-8284 - CVE-2020-8285 - CVE-2020-8286 - - - 2020-12-09 - 2020-12-09 - - - - - OpenSSL -- NULL pointer de-reference - - - openssl - 1.0.2,11.1.1i,1 - - - FreeBSD - 12.212.2_2 - 12.112.1_12 - 11.411.4_6 - - - - -

The OpenSSL project reports:

-
-

EDIPARTYNAME NULL pointer de-reference (High)

-

The X.509 GeneralName type is a generic type for representing - different types of names. One of those name types is known as - EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which - compares different instances of a GENERAL_NAME to see if they - are equal or not. This function behaves incorrectly when both - GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer - dereference and a crash may occur leading to a possible denial - of service attack.

-
- - - - https://www.openssl.org/news/secadv/20201208.txt - CVE-2020-1971 - SA-20:33.openssl - - - 2020-12-08 - 2020-12-08 - 2020-12-15 - - - - - Gitlab -- Multiple vulnerabilities - - - gitlab-ce - 13.6.013.6.2 - 13.5.013.5.5 - 12.213.4.9 - - - - -

Gitlab reports:

-
-

XSS in Zoom Meeting URL

-

Limited Information Disclosure in Private Profile

-

User email exposed via GraphQL endpoint

-

Group and project membership potentially exposed via GraphQL

-

Search terms logged in search parameter in rails logs

-

Un-authorised access to feature flag user list

-

A specific query on the explore page causes statement timeouts

-

Exposure of starred projects on private user profiles

-

Uncontrolled Resource Consumption in any Markdown field using Mermaid

-

Former group members able to view updates to confidential epics

-

Update GraphicsMagick dependency

-

Update GnuPG dependency

-

Update libxml dependency

-
- - - - https://about.gitlab.com/releases/2020/12/07/security-release-gitlab-13-6-2-released/ - CVE-2020-26407 - CVE-2020-26408 - CVE-2020-13357 - CVE-2020-26411 - CVE-2020-26409 - - - 2020-12-07 - 2020-12-07 - - - - - consul -- Fix Consul Connect CA private key configuration - - - consul - 1.9.0 - - - - -

Hashicorp reports:

-
-

Increase the permissions to read from the - /connect/ca/configuration endpoint to operator:write. - Previously Connect CA configuration, including the private - key, set via this endpoint could be read back by an operator - with operator:read privileges.

-
- - - - https://github.com/hashicorp/consul/blob/master/CHANGELOG.md - CVE-2020-28053 - - - 2020-11-02 - 2020-12-06 - - - - - chromium -- multiple vulnerabilities - - - chromium - 87.0.4280.88 - - - - -

Chrome Releases reports:

-
-

This release contains 8 security fixes, including:

-
    -
  • [1142331] High CVE-2020-16037: Use after free in clipboard. - Reported by Ryoya Tsukasaki on 2020-10-26
    • -
  • [1138683] High CVE-2020-16038: Use after free in media. - Reported by Khalil Zhani on 2020-10-14
    • -
  • [1149177] High CVE-2020-16039: Use after free in extensions. - Reported by Anonymous on 2020-11-15
    • -
  • [1150649] High CVE-2020-16040: Insufficient data validation in - V8. Reported by Lucas Pinheiro, Microsoft Browser Vulnerability - Research on 2020-11-19
    • -
  • [1151865] Medium CVE-2020-16041: Out of bounds read in - networking. Reported by Sergei Glazunov and Mark Brand of Google - Project Zero on 2020-11-23
    • -
  • [1151890] Medium CVE-2020-16042: Uninitialized Use in V8. - Reported by André Bargull on 2020-11-2
    • -
-
- - - - CVE-2020-16037 - CVE-2020-16038 - CVE-2020-16039 - CVE-2020-16040 - CVE-2020-16041 - CVE-2020-16042 - https://chromereleases.googleblog.com/2020/12/stable-channel-update-for-desktop.html - - - 2020-12-02 - 2020-12-05 - - - - - gitea -- multiple vulnerabilities - - - gitea - 1.13.0 - - - - -

The Gitea Team reports for release 1.13.0:

-
-
    -
  • Add Allow-/Block-List for Migrate and Mirrors
    • -
  • Prevent git operations for inactive users
    • -
  • Disallow urlencoded new lines in git protocol paths if there is a port
    • -
  • Mitigate Security vulnerability in the git hook feature
    • -
  • Disable DSA ssh keys by default
    • -
  • Set TLS minimum version to 1.2
    • -
  • Use argon as default password hash algorithm
    • -
  • Escape failed highlighted files
    • -
-
- - - - https://github.com/go-gitea/gitea/releases/tag/v1.13.0 - ports/251577 - - - 2020-12-01 - 2020-12-04 - - - - - FreeBSD -- Multiple vulnerabilities in rtsold - - - FreeBSD - 12.212.2_1 - 12.112.1_11 - 11.411.4_5 - - - - -

Problem Description:

-

Two bugs exist in rtsold(8)'s RDNSS and DNSSL option handling. - First, rtsold(8) failed to perform sufficient bounds checking on the - extent of the option. In particular, it does not verify that the - option does not extend past the end of the received packet before - processing its contents. The kernel currently ignores such - malformed packets but still passes them to userspace programs.

-

Second, when processing a DNSSL option, rtsold(8) decodes domain - name labels per an encoding specified in RFC 1035 in which the first - octet of each label contains the label's length. rtsold(8) did not - validate label lengths correctly and could overflow the destination - buffer.

-

Impact:

-

It is believed that these bugs could be exploited to gain remote - code execution within the rtsold(8) daemon, which runs as root. - Note that rtsold(8) only processes messages received from hosts - attached to the same physical link as the interface(s) on which - rtsold(8) is listening.

-

In FreeBSD 12.2 rtsold(8) runs in a Capsicum sandbox, limiting the - scope of a compromised rtsold(8) process.

- - - - CVE-2020-25577 - SA-20:32.rtsold - - - 2020-12-01 - 2020-12-02 - - - - - FreeBSD -- ICMPv6 use-after-free in error message handling - - - FreeBSD-kernel - 12.212.2_1 - 12.112.1_11 - 11.411.4_5 - - - - -

Problem Description:

-

When an ICMPv6 error message is received, the FreeBSD ICMPv6 stack - may extract information from the message to hand to upper-layer - protocols. As a part of this operation, it may parse IPv6 header - options from a packet embedded in the ICMPv6 message.

-

The handler for a routing option caches a pointer into the packet - buffer holding the ICMPv6 message. However, when processing - subsequent options the packet buffer may be freed, rendering the - cached pointer invalid. The network stack may later dereference the - pointer, potentially triggering a use-after-free.

-

Impact:

-

A remote host may be able to trigger a read of freed kernel memory. - This may trigger a kernel panic if the address had been unmapped.

- - - - CVE-2020-7469 - SA-20:31.icmp6 - - - 2020-12-01 - 2020-12-02 - - - - - xorg-server -- Multiple input validation failures in X server XKB extension - - - xorg-server - 1.20.9_1,1 - - - xephyr - 1.20.9_1,1 - - - xorg-vfbserver - 1.20.9_1,1 - - - xorg-nestserver - 1.20.9_1,1 - - - xwayland - 1.20.9_2,1 - - - xorg-dmx - 1.20.9_1,1 - - - - -

The X.org project reports:

-
-

These issues can lead to privileges elevations for authorized - clients on systems where the X server is running privileged.

-

Insufficient checks on the lengths of the XkbSetMap request can - lead to out of bounds memory accesses in the X server.

-

Insufficient checks on input of the XkbSetDeviceInfo request can - lead to a buffer overflow on the head in the X server.

-
- - - - https://lists.x.org/archives/xorg-announce/2020-December/003066.html - CVE-2020-14360 - CVE-2020-25712 - - - 2020-12-01 - 2020-12-01 - - - - - nomad -- multiple vulnerabilities - - - nomad - 0.12.6 - - - - -

The HashiCorp team reports:

-
-
    -
  • artifact: Fixed a bug where interpolation can be used in the - artifact destination field to write artifact payloads outside - the allocation directory.
    • -
  • template: Fixed a bug where interpolation can be used in the - template source and destination fields to read or write files - outside the allocation directory even when disable_file_sandbox - was set to false (the default).
    • -
  • template: Fixed a bug where the disable_file_sandbox - configuration was only respected for the template file function - and not the template source and destination fields.
    • -
-
- - - - https://github.com/hashicorp/nomad/blob/master/CHANGELOG.md - CVE-2020-27195 - - - 2020-10-21 - 2020-11-27 - - - - - gitea -- multiple vulnerabilities - - - gitea - 1.12.6 - - - - -

The Gitea Team reports for release 1.12.6:

-
-
    -
  • Prevent git operations for inactive users
    • -
  • Disallow urlencoded new lines in git protocol paths if there is a port
    • -
-
- - - - Disallow urlencoded new lines in git protocol paths if there is a port - ports/251296 - - - 2020-11-16 - 2020-11-21 - - - - - Node.js -- November 2020 Security Releases - - - node - 15.2.1 - - - node14 - 14.15.1 - - - node12 - 12.19.1 - - - - -

Node.js reports:

-
-

Updates are now available for v12.x, v14.x and v15.x Node.js release lines for the following issues.

-

Denial of Service through DNS request (CVE-2020-8277)

-

A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of service by getting the application to resolve a DNS record with a larger number of responses.

-
- - - - https://nodejs.org/en/blog/vulnerability/november-2020-security-releases/ - CVE-2020-8277 - - - 2020-11-16 - 2020-11-21 - - - - - mutt -- authentication credentials being sent over an unencrypted connection - - - mutt - 2.0.2 - - - - -

Kevin J. McCarthy reports:

-
-

Mutt had incorrect error handling when initially connecting to an IMAP - server, which could result in an attempt to authenticate without enabling TLS.

-
- - - - CVE-2020-28896 - https://gitlab.com/muttmua/mutt/-/commit/04b06aaa3e0cc0022b9b01dbca2863756ebbf59a - - - 2020-11-20 - 2020-11-20 - - - - - mozjpeg -- heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed PPM input file - - - mozjpeg - 4.0.0 - - - - -

NIST reports:

-
-
    -
  • Heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed PPM input file.
    • -
-
- - - - CVE-2020-13790 - https://nvd.nist.gov/vuln/detail/CVE-2020-13790 - - - 2020-06-03 - 2020-10-10 - - - - - libjpeg-turbo -- Issue in the PPM reader causing a buffer overrun in cjpeg, TJBench, or the tjLoadImage() function. - - - libjpeg-turbo - 2.0.4 - - - - -

libjpeg-turbo releases reports:

-
-

This release fixes the following security issue:

-
    -
  • Heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed PPM input file.
    • -
-
- - - - CVE-2020-13790 - https://nvd.nist.gov/vuln/detail/CVE-2020-13790 - - - 2020-06-03 - 2020-10-10 - - - - - mantis -- multiple vulnerabilities - - - mantis-php72 - mantis-php73 - mantis-php74 - mantis-php80 - 2.24.3,1 - - - - -

Mantis 2.24.3 release reports:

-
-

This release fixes 3 security issues:

-
    -
  • 0027039: CVE-2020-25781: Access to private bug note attachments
    • -
  • 0027275: CVE-2020-25288: HTML Injection on bug_update_page.php
    • -
  • 0027304: CVE-2020-25830: HTML Injection in bug_actiongroup_page.php
    • -
-
- - - - ports/251141 - CVE-2020-25781 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25781 - CVE-2020-25288 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25288 - CVE-2020-25830 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25830 - - - 2020-09-13 - 2020-11-14 - 2020-11-15 - - - - - go -- math/big: panic during recursive division of very large numbers; cmd/go: arbitrary code execution at build time through cgo - - - go - 1.15.5,1 - - - - -

The Go project reports:

-
-

A number of math/big.Int methods (Div, Exp, DivMod, Quo, Rem, - QuoRem, Mod, ModInverse, ModSqrt, Jacobi, and GCD) can panic - when provided crafted large inputs. For the panic to happen, - the divisor or modulo argument must be larger than 3168 bits - (on 32-bit architectures) or 6336 bits (on 64-bit architectures). - Multiple math/big.Rat methods are similarly affected.

-
-
-

The go command may execute arbitrary code at build time when - cgo is in use. This may occur when running go get on a malicious - package, or any other command that builds untrusted code. This - can be caused by a malicious gcc flags specified via a #cgo - directive.

-
-
-

The go command may execute arbitrary code at build time when - cgo is in use. This may occur when running go get on a malicious - package, or any other command that builds untrusted code. This - can be caused by malicious unquoted symbol names.

-
- - - - CVE-2020-28362 - https://github.com/golang/go/issues/42552 - CVE-2020-28367 - https://github.com/golang/go/issues/42556 - CVE-2020-28366 - https://github.com/golang/go/issues/42559 - - - 2020-11-09 - 2020-11-12 - - - - - salt -- multiple vulnerabilities - - - py36-salt - py37-salt - py38-salt - 30023002.1 - - - - -

SaltStack reports multiple security vulnerabilities in Salt 3002:

-
-
    -
  • CVE-2020-16846: Prevent shell injections in netapi ssh client.
    • -
  • CVE-2020-17490: Prevent creating world readable private keys with the tls execution module.
    • -
  • CVE-2020-25592: Properly validate eauth credentials and tokens along with their ACLs. - Prior to this change eauth was not properly validated when calling Salt ssh via the salt-api. - Any value for 'eauth' or 'token' would allow a user to bypass authentication and make calls - to Salt ssh.
    • -
-
- - - - https://docs.saltstack.com/en/latest/topics/releases/3002.1.html - CVE-2020-16846 - https://nvd.nist.gov/vuln/detail/CVE-2020-16846 - CVE-2020-17490 - https://nvd.nist.gov/vuln/detail/CVE-2020-17490 - CVE-2020-25592 - https://nvd.nist.gov/vuln/detail/CVE-2020-25592 - - - 2020-11-06 - 2020-11-12 - - - - - Apache OpenOffice -- Unrestricted actions leads to arbitrary code execution in crafted documents - - - apache-openoffice - 4.1.8 - - - apache-openoffice-devel - 4.2.1602022694,4 - - - - -

The Apache Openofffice project reports:

-
-

CVE-2020-13958 Unrestricted actions leads to arbitrary code execution in crafted documents

-

Description

-

A vulnerability in Apache OpenOffice scripting events allows an attacker to construct documents containing hyperlinks pointing to an executable on the target users file system. These hyperlinks can be triggered unconditionally. In fixed versions no internal protocol may be called from the document event handler and other hyperlinks require a control-click.

-

Severity: Low

-

There are no known exploits of this vulnerability.
A proof-of-concept demonstration exists.

-

Thanks to the reporter for discovering this issue.

-

Acknowledgments

-

The Apache OpenOffice Security Team would like to thank Imre Rad for discovering and reporting this attack vector.

-
- - - - https://www.openoffice.org/security/cves/CVE-2020-13958.html - CVE-2020-13958 - - - 2020-04-28 - 2020-11-10 - - - - - raptor2 -- buffer overflow - - - raptor2 - 2.0.15_16 - - - - -

CVE MITRE reports:

-
-

- raptor_xml_writer_start_element_common in raptor_xml_writer.c in Raptor RDF Syntax Library 2.0.15 miscalculates the maximum nspace declarations for the XML writer, leading to heap-based buffer overflows (sometimes seen in raptor_qname_format_as_xml). -

-
- - - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18926 - https://github.com/LibreOffice/core/blob/master/external/redland/raptor/0001-Calcualte-max-nspace-declarations-correctly-for-XML-.patch.1 - CVE-2017-18926 - - - 2017-04-16 - 2020-11-09 - - - - - jupyter notebook -- open redirect vulnerability - - - py37-notebook - py38-notebook - py39-notebook - 6.1.5 - - - - -

Jupyter reports:

-
-

6.1.5 is a security release, fixing one vulnerability: - Fix open redirect vulnerability GHSA-c7vm-f5p4-8fqh (CVE to be assigned) -

-
- - - - https://jupyter-notebook.readthedocs.io/en/stable/changelog.html#release-6-1-5 - https://github.com/jupyter/notebook/blob/6.1.5/docs/source/changelog.rst - - - 2020-10-15 - 2020-11-08 - - - - - asterisk -- Outbound INVITE loop on challenge with different nonce - - - asterisk13 - 13.37.1 - - - asterisk16 - 16.14.1 - - - asterisk18 - 18.0.1 - - - - -

The Asterisk project reports:

-
-

If Asterisk is challenged on an outbound INVITE and - the nonce is changed in each response, Asterisk will - continually send INVITEs in a loop. This causes Asterisk - to consume more and more memory since the transaction - will never terminate (even if the call is hung up), - ultimately leading to a restart or shutdown of Asterisk. - Outbound authentication must be configured on the endpoint - for this to occur.

-
- - - - https://downloads.asterisk.org/pub/security/AST-2020-002.html - - - 2020-11-05 - 2020-11-05 - - - - - asterisk -- Remote crash in res_pjsip_session - - - asterisk13 - 13.37.1 - - - asterisk16 - 16.14.1 - - - asterisk18 - 18.0.1 - - - - -

The Asterisk project reports:

-
-

Upon receiving a new SIP Invite, Asterisk did not - return the created dialog locked or referenced. This - caused a gap between the creation of the dialog object, - and its next use by the thread that created it. Depending - upon some off nominal circumstances, and timing it was - possible for another thread to free said dialog in this - gap. Asterisk could then crash when the dialog object, - or any of its dependent objects were de-referenced, or - accessed next by the initial creation thread.

-
- - - - https://downloads.asterisk.org/pub/security/AST-2020-001.html - - - 2020-11-05 - 2020-11-05 - - - - - chromium -- multiple vulnerabilities - - - chromium - 86.0.4240.183 - - - - -

Chrome Releases reports:

-
-

This release contains 10 security fixes, including:

-
    -
  • [1138911] High CVE-2020-16004: Use after free in user interface. - Reported by Leecraso and Guang Gong of 360 Alpha Lab working with - 360 BugCloud on 2020-10-15
    • -
  • [1139398] High CVE-2020-16005: Insufficient policy enforcement - in ANGLE. Reported by Jaehun Jeong (@n3sk) of Theori on - 2020-10-16
    • -
  • [1133527] High CVE-2020-16006: Inappropriate implementation in - V8. Reported by Bill Parks on 2020-09-29
    • -
  • [1125018] High CVE-2020-16007: Insufficient data validation in - installer. Reported by Abdelhamid Naceri (halov) on - 2020-09-04
    • -
  • [1134107] High CVE-2020-16008: Stack buffer overflow in WebRTC. - Reported by Tolya Korniltsev on 2020-10-01
    • -
  • [1143772] High CVE-2020-16009: Inappropriate implementation in - V8. Reported by Clement Lecigne of Google's Threat Analysis Group - and Samuel Groß of Google Project Zero on 2020-10-29
    • -
  • [1144489] High CVE-2020-16011: Heap buffer overflow in UI on - Windows. Reported by Sergei Glazunov of Google Project Zero on - 2020-11-01
    • -
-

There are reports that an exploit for CVE-2020-16009 exists in the - wild.

-
- - - - CVE-2020-16004 - CVE-2020-16005 - CVE-2020-16006 - CVE-2020-16007 - CVE-2020-16008 - CVE-2020-16009 - CVE-2020-16011 - https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop.html - - - 2020-11-02 - 2020-11-03 - - - - - Gitlab -- Multiple vulnerabilities - - - gitlab-ce - 13.5.013.5.2 - 13.4.013.4.5 - 8.8.913.3.9 - - - - -

Gitlab reports:

-
-

Path Traversal in LFS Upload

-

Path traversal allows saving packages in arbitrary location

-

Kubernetes agent API leaks private repos

-

Terraform state deletion API exposes object storage URL

-

Stored-XSS in error message of build-dependencies

-

Git credentials persisted on disk

-

Potential Denial of service via container registry

-

Info leak when group is transferred from private to public group

-

Limited File Disclosure Via Multipart Bypass

-

Unauthorized user is able to access scheduled pipeline variables and values

-

CSRF in runner administration page allows an attacker to pause/resume runners

-

Regex backtracking attack in path parsing of Advanced Search result

-

Bypass of required CODEOWNERS approval

-

SAST CiConfiguration information visible without permissions

-
- - - - https://about.gitlab.com/releases/2020/11/02/security-release-gitlab-13-5-2-released/ - CVE-2020-13355 - CVE-2020-26405 - CVE-2020-13358 - CVE-2020-13359 - CVE-2020-13340 - CVE-2020-13353 - CVE-2020-13354 - CVE-2020-13352 - CVE-2020-13356 - CVE-2020-13351 - CVE-2020-13350 - CVE-2020-13349 - CVE-2020-13348 - - - 2020-11-02 - 2020-11-02 - - - - - wordpress -- multiple issues - - - wordpress - fr-wordpress - 5.5.2,1 - - - de-wordpress - zh_CN-wordpress - zh_TW-wordpress - ja-wordpress - ru-wordpress - 5.5.2 - - - - -

wordpress developers reports:

-
-

Ten security issues affect WordPress versions 5.5.1 and earlier. If you havent yet updated to 5.5, - all WordPress versions since 3.7 have also been updated to fix the following security issues: - -Props to Alex Concha of the WordPress Security Team for their work in hardening deserialization requests. - -Props to David Binovec on a fix to disable spam embeds from disabled sites on a multisite network. - -Thanks to Marc Montas from Sucuri for reporting an issue that could lead to XSS from global variables. - -Thanks to Justin Tran who reported an issue surrounding privilege escalation in XML-RPC. He also found and disclosed an issue around privilege escalation around post commenting via XML-RPC. - -Props to Omar Ganiev who reported a method where a DoS attack could lead to RCE. - -Thanks to Karim El Ouerghemmi from RIPS who disclosed a method to store XSS in post slugs. - -Thanks to Slavco for reporting, and confirmation from Karim El Ouerghemmi, a method to bypass protected meta that could lead to arbitrary file deletion.

-
- - - - https://wordpress.org/news/2020/10/wordpress-5-5-2-security-and-maintenance-release/ - - - 2020-10-29 - 2020-11-02 - - - - - samba -- Multiple Vulnerabilities - - - samba410 - 4.10.18 - - - samba411 - 4.11.15 - - - samba412 - 4.12.9 - - - samba413 - 4.13.1 - - - - -

The Samba Team reports:

-
-
    -
  • CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify
    • -
  • CVE-2020-14323: Unprivileged user can crash winbind
    • -
  • CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily crafted records
    • -
-
- - - - https://www.samba.org/samba/security/CVE-2020-14318.html - https://www.samba.org/samba/security/CVE-2020-14323.html - https://www.samba.org/samba/security/CVE-2020-14383.html - CVE-2020-14318 - CVE-2020-14323 - CVE-2020-14383 - - - 2020-10-29 - 2020-10-30 - - - - - tmux -- stack overflow in CSI parsing - - - tmux - 3.1c - - - - -

Nicholas Marriott reports:

-
-

tmux has a stack overflow in CSI parsing.

-
- - - - https://groups.google.com/g/tmux-users/c/DGfmsD9CM00/m/Six6uZG0AQAJ - https://marc.info/?l=openbsd-announce&m=160399126725142&w=2 - - - 2020-10-29 - 2020-10-30 - - - - - motion -- Denial of Service - - - motion - 3.24.3.1 - - - - -

cxsecurity.com reports:

-
-

A Denial of Service condition in Motion-Project Motion 3.2 through - 4.3.1 allows remote unauthenticated users to cause a webu.c - segmentation fault and kill the main process via a crafted HTTP - request

-
- - - - https://cve-search.iicrai.org/cve/CVE-2020-26566 - - - 2020-10-05 - 2020-10-28 - - - - - freetype2 -- heap buffer overlfow - - - freetype2 - 2.10.4 - - - - -

The freetype project reports:

-
-

A heap buffer overflow has been found in the handling of embedded - PNG bitmaps, introduced in FreeType version 2.6. -

-
- - - - https://sourceforge.net/projects/freetype/files/freetype2/2.10.4/ - CVE-2020-15999 - - - 2020-10-20 - 2020-10-22 - - - - - MySQL -- Multiple vulnerabilities - - - mariadb103-server - 10.3.26 - - - mariadb104-server - 10.4.16 - - - mariadb105-server - 10.5.7 - - - mysql56-server - 5.6.50 - - - mysql57-server - 5.7.32 - - - mysql80-server - 8.0.22 - - - - -

Oracle reports:

-
-

This Critical Patch Update contains 48 new security patches for - Oracle MySQL.

-

The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle - MySQL is 8.

-

NOTE: MariaDB only contains CVE-2020-14812 CVE-2020-14765 - CVE-2020-14776 and CVE-2020-14789

-
- - - - https://www.oracle.com/security-alerts/cpuoct2020.html#AppendixMSQL - CVE-2020-14878 - CVE-2020-14828 - CVE-2020-14775 - CVE-2020-14765 - CVE-2020-14769 - CVE-2020-14830 - CVE-2020-14836 - CVE-2020-14846 - CVE-2020-14800 - CVE-2020-14827 - CVE-2020-14760 - CVE-2020-14776 - CVE-2020-14821 - CVE-2020-14829 - CVE-2020-14848 - CVE-2020-14852 - CVE-2020-14814 - CVE-2020-14789 - CVE-2020-14804 - CVE-2020-14812 - CVE-2020-14773 - CVE-2020-14777 - CVE-2020-14785 - CVE-2020-14793 - CVE-2020-14794 - CVE-2020-14809 - CVE-2020-14837 - CVE-2020-14839 - CVE-2020-14845 - CVE-2020-14861 - CVE-2020-14866 - CVE-2020-14868 - CVE-2020-14888 - CVE-2020-14891 - CVE-2020-14893 - CVE-2020-14786 - CVE-2020-14790 - CVE-2020-14844 - CVE-2020-14799 - CVE-2020-14869 - CVE-2020-14672 - CVE-2020-14870 - CVE-2020-14867 - CVE-2020-14873 - CVE-2020-14838 - CVE-2020-14860 - CVE-2020-14791 - CVE-2020-14771 - - - 2020-10-20 - 2020-10-21 - 2020-11-07 - - - - - chromium -- multiple vulnerabilities - - - chromium - 86.0.4240.111 - - - - -

Chrome Releases reports:

-
-

This release includes 5 security fixes:

-
    -
  • [1125337] High CVE-2020-16000: Inappropriate implementation in - Blink. Reported by amaebi_jp on 2020-09-06
    • -
  • [1135018] High CVE-2020-16001: Use after free in media. - Reported by Khalil Zhani on 2020-10-05
    • -
  • [1137630] High CVE-2020-16002: Use after free in PDFium. - Reported by Weipeng Jiang (@Krace) from Codesafe Team of Legendsec - at Qi'anxin Group on 2020-10-13
    • -
  • [1139963] High CVE-2020-15999: Heap buffer overflow in - Freetype. Reported by Sergei Glazunov of Google Project Zero on - 2020-10-19
    • -
  • [1134960] Medium CVE-2020-16003: Use after free in printing. - Reported by Khalil Zhani on 2020-10-04
    • -
-
- - - - CVE-2020-15999 - CVE-2020-16000 - CVE-2020-16001 - CVE-2020-16002 - CVE-2020-16003 - https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop_20.html - - - 2020-10-20 - 2020-10-21 - - - - - powerdns-recursor -- cache pollution - - - powerdns-recursor - 4.3.04.3.5 - 4.2.04.2.5 - 4.1.04.1.18 - - - - -

PowerDNS Team reports:

-
-

CVE-2020-25829: An issue has been found in PowerDNS Recursor where a - remote attacker can cause the cached records for a given name to be - updated to the ‘Bogus’ DNSSEC validation state, instead of their actual - DNSSEC ‘Secure’ state, via a DNS ANY query. This results in a denial - of service for installations that always validate (dnssec=validate) - and for clients requesting validation when on-demand validation is - enabled (dnssec=process).

-
- - - - https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2020-07.html - CVE-2020-25829 - - - 2020-10-13 - 2020-10-14 - - - - - MariaDB -- Undisclosed vulnerability - - - mariadb103-client - 10.3.25 - - - mariadb103-server - 10.3.25 - - - mariadb104-client - 10.4.15 - - - mariadb104-server - 10.4.15 - - - mariadb105-client - 10.5.6 - - - mariadb105-server - 10.5.6 - - - - -

The MariaDB project reports:

-
-

Details of this vulnerability have not yet been disclosed

-
- - - - https://mariadb.com/kb/en/mariadb-1056-release-notes/ - https://mariadb.com/kb/en/mariadb-10415-release-notes/ - https://mariadb.com/kb/en/mariadb-10325-release-notes/ - CVE-2020-15180 - - - 2020-10-07 - 2020-10-18 - - - - - py-matrix-synapse -- XSS vulnerability - - - py36-matrix-synapse - py37-matrix-synapse - py38-matrix-synapse - py39-matrix-synapse - 1.21.0 - - - - -

Matrix developers reports:

-
-

The fallback authentication endpoint served via Synapse were vulnerable - to cross-site scripting (XSS) attacks. The impact depends on the - configuration of the domain that Synapse is deployed on, but may allow - access to cookies and other browser data, CSRF vulnerabilities, and - access to other resources served on the same domain or parent domains.

-
- - - - CVE-2020-26891 - https://github.com/matrix-org/synapse/security/advisories/GHSA-3x8c-fmpc-5rmq - https://github.com/matrix-org/synapse/releases/tag/v1.21.2 - ports/249948 - - - 2020-10-01 - 2020-10-17 - - - - - drupal -- Multiple Vulnerabilities - - - drupal7 - 7.72 - - - - -

Drupal Security Team reports:

-
-

The Drupal AJAX API does not disable JSONP by default, which can - lead to cross-site scripting.

-
- - - - https://www.drupal.org/sa-core-2020-007 - - - 2020-09-16 - 2020-10-17 - - - - - Flash Player -- arbitrary code execution - - - linux-flashplayer - 32.0.0.445 - - - - -

Adobe reports:

-
-
    -
  • This update resolves a NULL pointer dereference vulnerability - that could lead to arbitrary code execution (CVE-2020-9746).
    • -
-
- - - - CVE-2020-9746 - https://helpx.adobe.com/security/products/flash-player/apsb20-58.html - - - 2020-10-13 - 2020-10-13 - - - - - Rails -- Possible XSS vulnerability - - - rubygem-actionpack60 - 6.0.3.4 - - - - -

Ruby on Rails blog:

-
-

Rails version 6.0.3.4 has been released! This version is a security - release and addresses one possible XSS attack vector in Actionable - Exceptions.

-
- - - - https://weblog.rubyonrails.org/2020/10/7/Rails-6-0-3-4-has-been-released/ - CVE-2020-8264 - - - 2020-10-07 - 2020-10-10 - - - - - Payara -- path trasversal flaw via either loc/con parameters in Eclipse Mojarra - - - payara - 5.201 - - - - -

Payara Releases reports:

-
-

The following is a list of tracked Common Vulnerabilities and Exposures that have been reported and analyzed, which can or have impacted Payara Server across releases:

-
    -
  • CVE-2020-6950 Eclipse Mojarra vulnerable to path trasversal flaw via either loc/con parameters
    • -
-
- - - - CVE-2020-6950 - https://docs.payara.fish/community/docs/5.2020.4/security/security-fix-list.html - - - 2020-01-13 - 2020-10-06 - - - - - Payara -- A Polymorphic Typing issue in FasterXML jackson-databind - - - payara - 5.193 - - - - -

Payara Releases reports:

-
-

The following is a list of tracked Common Vulnerabilities and Exposures that have been reported and analyzed, which can or have impacted Payara Server across releases:

-
    -
  • CVE-2019-12086 A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9
    • -
-
- - - - CVE-2019-12086 - https://docs.payara.fish/community/docs/5.193/security/security-fix-list.html - - - 2019-05-17 - 2020-10-06 - - - - - payara -- multiple vulnerabilities - - - payara - 5.191 - - - - -

Payara Releases reports:

-
-

The following is a list of tracked Common Vulnerabilities and Exposures that have been reported and analyzed, which can or have impacted Payara Server across releases:

-
    -
  • CVE-2018-14721 FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks
    • -
  • CVE-2018-14720 FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct external XML entity (XXE) attacks
    • -
  • CVE-2018-14719 FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code
    • -
  • CVE-2018-14718 FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code
    • -
  • CVE-2018-14371 Eclipse Mojarra before 2.3.7 is affected by Directory Traversal via the loc parameter
    • -
-
- - - - CVE-2018-14721 - CVE-2018-14720 - CVE-2018-14719 - CVE-2018-14718 - CVE-2018-14371 - https://docs.payara.fish/community/docs/5.191/security/security-fix-list.html - - - 2019-02-01 - 2020-10-06 - - - - - zeek -- Vulnerability due to memory leak - - - zeek - 3.0.11 - - - - -

Jon Siwek of Corelight reports:

-
-

This release fixes the following security issue:

-
    -
  • A memory leak in multipart MIME code has potential - for remote exploitation and cause for Denial of Service - via resource exhaustion.
    • -
-
- - - - https://github.com/zeek/zeek/releases/tag/v3.0.11 - - - 2020-09-29 - 2020-10-07 - - - - - chromium -- multiple vulnerabilities - - - chromium - 86.0.4240.75 - - - - -

Chrome releases reports:

-
-

This release contains 35 security fixes, including:

-
    -
  • [1127322] Critical CVE-2020-15967: Use after free in payments. - Reported by Man Yue Mo of GitHub Security Lab on 2020-09-11
    • -
  • [1126424] High CVE-2020-15968: Use after free in Blink. - Reported by Anonymous on 2020-09-09
    • -
  • [1124659] High CVE-2020-15969: Use after free in WebRTC. - Reported by Anonymous on 2020-09-03
    • -
  • [1108299] High CVE-2020-15970: Use after free in NFC. Reported - by Man Yue Mo of GitHub Security Lab on 2020-07-22
    • -
  • [1114062] High CVE-2020-15971: Use after free in printing. - Reported by Jun Kokatsu, Microsoft Browser Vulnerability Research on - 2020-08-07
    • -
  • [1115901] High CVE-2020-15972: Use after free in audio. - Reported by Anonymous on 2020-08-13
    • -
  • [1133671] High CVE-2020-15990: Use after free in autofill. - Reported by Rong Jian and Guang Gong of Alpha Lab, Qihoo 360 on - 2020-09-30
    • -
  • [1133688] High CVE-2020-15991: Use after free in password - manager. Reported by Rong Jian and Guang Gong of Alpha Lab, Qihoo - 360 on 2020-09-30
    • -
  • [1106890] Medium CVE-2020-15973: Insufficient policy - enforcement in extensions. Reported by David Erceg on - 2020-07-17
    • -
  • [1104103] Medium CVE-2020-15974: Integer overflow in Blink. - Reported by Juno Im (junorouse) of Theori on 2020-07-10
    • -
  • [1110800] Medium CVE-2020-15975: Integer overflow in - SwiftShader. Reported by Anonymous on 2020-07-29
    • -
  • [1123522] Medium CVE-2020-15976: Use after free in WebXR. - Reported by YoungJoo Lee (@ashuu_lee) of Raon Whitehat on - 2020-08-31
    • -
  • [1083278] Medium CVE-2020-6557: Inappropriate implementation - in networking. Reported by Matthias Gierlings and Marcus Brinkmann - (NDS Ruhr-University Bochum) on 2020-05-15
    • -
  • [1097724] Medium CVE-2020-15977: Insufficient data validation - in dialogs. Reported by Narendra Bhati (@imnarendrabhati) on - 2020-06-22
    • -
  • [1116280] Medium CVE-2020-15978: Insufficient data validation - in navigation. Reported by Luan Herrera (@lbherrera_) on - 2020-08-14
    • -
  • [1127319] Medium CVE-2020-15979: Inappropriate implementation - in V8. Reported by Avihay Cohen (@SeraphicAlgorithms) on - 2020-09-11
    • -
  • [1092453] Medium CVE-2020-15980: Insufficient policy - enforcement in Intents. Reported by Yongke Wang (@Rudykewang) and - Aryb1n (@aryb1n) of Tencent Security Xuanwu Lab on 2020-06-08
    • -
  • [1123023] Medium CVE-2020-15981: Out of bounds read in audio. - Reported by Christoph Guttandin on 2020-08-28
    • -
  • [1039882] Medium CVE-2020-15982: Side-channel information - leakage in cache. Reported by Luan Herrera (@lbherrera_) on - 2020-01-07
    • -
  • [1076786] Medium CVE-2020-15983: Insufficient data validation - in webUI. Reported by Jun Kokatsu, Microsoft Browser Vulnerability - Research on 2020-04-30
    • -
  • [1080395] Medium CVE-2020-15984: Insufficient policy - enforcement in Omnibox. Reported by Rayyan Bijoora on - 2020-05-07
    • -
  • [1099276] Medium CVE-2020-15985: Inappropriate implementation - in Blink. Reported by Abdulrahman Alqabandi, Microsoft Browser - Vulnerability Research on 2020-06-25
    • -
  • [1100247] Medium CVE-2020-15986: Integer overflow in media. - Reported by Mark Brand of Google Project Zero on 2020-06-29
    • -
  • [1127774] Medium CVE-2020-15987: Use after free in WebRTC. - Reported by Philipp Hancke on 2020-09-14
    • -
  • [1110195] Medium CVE-2020-15992: Insufficient policy - enforcement in networking. Reported by Alison Huffman, Microsoft - Browser Vulnerability Research on 2020-07-28
    • -
  • [1092518] Low CVE-2020-15988: Insufficient policy enforcement - in downloads. Reported by Samuel Attard on 2020-06-08
    • -
  • [1108351] Low CVE-2020-15989: Uninitialized Use in PDFium. - Reported by Gareth Evans (Microsoft) on 2020-07-22
    • -
-
- - - - CVE-2020-6557 - CVE-2020-15967 - CVE-2020-15968 - CVE-2020-15969 - CVE-2020-15970 - CVE-2020-15971 - CVE-2020-15972 - CVE-2020-15973 - CVE-2020-15974 - CVE-2020-15975 - CVE-2020-15976 - CVE-2020-15977 - CVE-2020-15978 - CVE-2020-15979 - CVE-2020-15980 - CVE-2020-15981 - CVE-2020-15982 - CVE-2020-15983 - CVE-2020-15984 - CVE-2020-15985 - CVE-2020-15986 - CVE-2020-15987 - CVE-2020-15988 - CVE-2020-15989 - CVE-2020-15990 - CVE-2020-15991 - CVE-2020-15992 - https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html - - - 2020-10-06 - 2020-10-07 - - - - - libexif -- multiple vulnerabilities - - - libexif - 0.6.22 - - - - -

Release notes:

-
-

Lots of fixes exposed by fuzzers like AFL, ClusterFuzz, OSSFuzz and others:

-

CVE-2016-6328: fixed integer overflow when parsing maker notes

-

CVE-2017-7544: fixed buffer overread

-

CVE-2018-20030: Fix for recursion DoS

-

CVE-2019-9278: replaced integer overflow checks the compiler could optimize away by safer constructs

-

CVE-2020-0093: read overflow

-

CVE-2020-12767: fixed division by zero

-

CVE-2020-13112: Various buffer overread fixes due to integer overflows in maker notes

-

CVE-2020-13113: Potential use of uninitialized memory

-

CVE-2020-13114: Time consumption DoS when parsing canon array markers

-
- - - - https://github.com/libexif/libexif/blob/master/NEWS - CVE-2016-6328 - CVE-2017-7544 - CVE-2018-20030 - CVE-2019-9278 - CVE-2020-0093 - CVE-2020-12767 - CVE-2020-13112 - CVE-2020-13113 - CVE-2020-13114 - - - 2020-05-18 - 2020-10-05 - - - - - kdeconnect -- packet manipulation can be exploited in a Denial of Service attack - - - kdeconnect-kde - 20.08.1 - - - - -

Albert Astals Cid reports:

-
-

KDE Project Security Advisory

- - - - - - - - - - - - - - - - - - - - - - - - - -
TitleKDE Connect: packet manipulation can be exploited in a Denial of Service attack
Risk RatingImportant
CVECVE-2020-26164
Versionskdeconnect <= 20.08.1
AuthorAlbert Vaca Cintora <albertvaka@gmail.com>
Date2 October 2020
-

Overview

-

- An attacker on your local network could send maliciously crafted - packets to other hosts running kdeconnect on the network, causing - them to use large amounts of CPU, memory or network connections, - which could be used in a Denial of Service attack within the - network. -

- -

Impact

-

- Computers that run kdeconnect are susceptible to DoS attacks from - the local network. -

- -

Workaround

-

- We advise you to stop KDE Connect when on untrusted networks like - those on airports or conferences. -

-

- Since kdeconnect is dbus activated it is relatively hard to make - sure it stays stopped so the brute force approach is to uninstall - the kdeconnect package from your system and then run -

- 
-	      kquitapp5 kdeconnectd
-
-

- Just install the package again once you're back in a trusted - network. -

-

Solution

-

- KDE Connect 20.08.2 patches several code paths that could result - in a DoS. -

-

You can apply these patches on top of 20.08.1:

-
    -
  • - https://invent.kde.org/network/kdeconnect-kde/-/commit/f183b5447bad47655c21af87214579f03bf3a163 -
    • -
  • - https://invent.kde.org/network/kdeconnect-kde/-/commit/b279c52101d3f7cc30a26086d58de0b5f1c547fa -
    • -
  • - https://invent.kde.org/network/kdeconnect-kde/-/commit/d35b88c1b25fe13715f9170f18674d476ca9acdc -
    • -
  • - https://invent.kde.org/network/kdeconnect-kde/-/commit/b496e66899e5bc9547b6537a7f44ab44dd0aaf38 -
    • -
  • - https://invent.kde.org/network/kdeconnect-kde/-/commit/5310eae85dbdf92fba30375238a2481f2e34943e -
    • -
  • - https://invent.kde.org/network/kdeconnect-kde/-/commit/721ba9faafb79aac73973410ee1dd3624ded97a5 -
    • -
  • - https://invent.kde.org/network/kdeconnect-kde/-/commit/ae58b9dec49c809b85b5404cee17946116f8a706 -
    • -
  • - https://invent.kde.org/network/kdeconnect-kde/-/commit/66c768aa9e7fba30b119c8b801efd49ed1270b0a -
    • -
  • - https://invent.kde.org/network/kdeconnect-kde/-/commit/85b691e40f525e22ca5cc4ebe79c361d71d7dc05 -
    • -
  • - https://invent.kde.org/network/kdeconnect-kde/-/commit/48180b46552d40729a36b7431e97bbe2b5379306 -
    • -
-

Credits

-

- Thanks Matthias Gerstner and the openSUSE security team for - reporting the issue. -

-

- Thanks to Aleix Pol, Nicolas Fella and Albert Vaca Cintora for the - patches. -

-
- - - - https://kde.org/info/security/advisory-20201002-1.txt - CVE-2020-26164 - - - 2020-10-02 - 2020-10-04 - - - - - upnp -- denial of service (crash) - - - upnp - 1.12.1_1,1 - - - - -

CVE mitre reports:

-
-

Portable UPnP SDK (aka libupnp) 1.12.1 and earlier allows remote attackers to cause a denial of service (crash) via a crafted SSDP message due to a NULL pointer dereference in the functions FindServiceControlURLPath and FindServiceEventURLPath in genlib/service_table/service_table.c.

-
- - - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13848 - https://nvd.nist.gov/vuln/detail/CVE-2020-13848 - https://github.com/pupnp/pupnp/issues/177 - https://github.com/pupnp/pupnp/commit/c805c1de1141cb22f74c0d94dd5664bda37398e0 - CVE-2020-13848 - - - 2020-06-04 - 2020-10-03 - - - - - Gitlab -- multiple vulnerabilities - - - gitlab-ce - 13.4.013.4.2 - 13.3.013.3.7 - 7.1213.2.10 - - - - -

Gitlab reports:

-
-

Potential Denial Of Service Via Update Release Links API

-

Insecure Storage of Session Key In Redis

-

Improper Access Expiration Date Validation

-

Cross-Site Scripting in Multiple Pages

-

Unauthorized Users Can View Custom Project Template

-

Cross-Site Scripting in SVG Image Preview

-

Incomplete Handling in Account Deletion

-

Insufficient Rate Limiting at Re-Sending Confirmation Email

-

Improper Type Check in GraphQL

-

To-dos Are Not Redacted When Membership Changes

-

Guest users can modify confidentiality attribute

-

Command injection on runner host

-

Insecure Runner Configuration in Kubernetes Environments

-
- - - - https://about.gitlab.com/releases/2020/10/01/security-release-13-4-2-release/ - CVE-2020-13333 - CVE-2020-13332 - CVE-2020-13335 - CVE-2020-13334 - CVE-2020-13327 - - - 2020-10-01 - 2020-10-02 - - - - - tt-rss -- multiple vulnerabilities - - - tt-rss - g20200919 - - - - -

tt-rss project reports:

-
-

The cached_url feature mishandles JavaScript inside an SVG document.

-

imgproxy in plugins/af_proxy_http/init.php mishandles $_REQUEST["url"] in an error message.

-

It does not validate all URLs before requesting them.

-
-
-

Allows remote attackers to execute arbitrary PHP code via a crafted plural forms header.

-
- - - - https://community.tt-rss.org/t/heads-up-several-vulnerabilities-fixed/3799 - https://community.tt-rss.org/t/replace-php-gettext/2889 - CVE-2020-25789 - CVE-2020-25788 - CVE-2020-25787 - CVE-2016-6175 - - - 2020-09-15 - 2020-09-20 - - - - - Apache Ant leaks sensitive information via the java.io.tmpdir - - - apache-ant - 1.11.10.8 - - - - -

Apache reports:

-
-

Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the - default temporary directory identified by the Java - system property java.io.tmpdir for several tasks and - may thus leak sensitive information. The fixcrlf and - replaceregexp tasks also copy files from the temporary - directory back into the build tree allowing an attacker - to inject modified source files into the build - process.

-
- - - - https://issues.apache.org/jira/browse/RAT-269?page=com.atlassian.jira.plugin.system.issuetabpanels%3Aall-tabpanel - CVE-2020-1945 - - - 2020-05-14 - 2020-09-28 - - - - - powerdns -- Leaking uninitialised memory through crafted zone records - - - powerdns - 4.3.04.3.1 - 4.2.04.2.3 - 4.1.04.1.14 - - - - -

PowerDNS Team reports

-
-

CVE-2020-17482: An issue has been found in PowerDNS Authoritative - Server before 4.3.1 where an authorized user with the - ability to insert crafted records into a zone might - be able to leak the content of uninitialized memory. - Such a user could be a customer inserting data via a - control panel, or somebody with access to the REST - API. Crafted records cannot be inserted via AXFR.

-
- - - - https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2020-05.html - CVE-2020-17482 - - - 2020-09-22 - 2020-09-24 - - - - - chromium -- multiple vulnerabilities - - - chromium - 85.0.4183.121 - - - - -

Chrome Releases reports:

-
-

This release fixes 10 security issues, including:

-
    -
  • [1100136] High CVE-2020-15960: Out of bounds read in storage. - Reported by Anonymous on 2020-06-28
    • - -
  • [1114636] High CVE-2020-15961: Insufficient policy - enforcement in extensions. Reported by David Erceg on - 2020-08-10
    • - -
  • [1121836] High CVE-2020-15962: Insufficient policy - enforcement in serial. Reported by Leecraso and Guang Gong of 360 - Alpha Lab working with 360 BugCloud on 2020-08-26
    • - -
  • [1113558] High CVE-2020-15963: Insufficient policy - enforcement in extensions. Reported by David Erceg on - 2020-08-06
    • - -
  • [1126249] High CVE-2020-15965: Out of bounds write in V8. - Reported by Lucas Pinheiro, Microsoft Browser Vulnerability - Research on 2020-09-08
    • - -
  • [1113565] Medium CVE-2020-15966: Insufficient policy - enforcement in extensions. Reported by David Erceg on - 2020-08-06
    • - -
  • [1121414] Low CVE-2020-15964: Insufficient data validation in - media. Reported by Woojin Oh(@pwn_expoit) of STEALIEN on - 2020-08-25
    • -
-
- - - - CVE-2020-15960 - CVE-2020-15961 - CVE-2020-15962 - CVE-2020-15963 - CVE-2020-15964 - CVE-2020-15965 - CVE-2020-15966 - https://chromereleases.googleblog.com/2020/09/stable-channel-update-for-desktop_21.html - - - 2020-09-21 - 2020-09-22 - - - - - libxml -- multiple vulnerabilities - - - libxml2 - 2.9.10_1 - - - - -

CVE mitre reports:

-
-

CVE-2019-20388

-

- xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak. -

-

CVE-2020-7595

-

- xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation. -

-

CVE-2020-24977

-

- GNOME project libxml2 v2.9.10 and earlier have a global buffer over-read vulnerability in xmlEncodeEntitiesInternal -

-
- - - - https://nvd.nist.gov/vuln/detail/CVE-2019-20388 - https://nvd.nist.gov/vuln/detail/CVE-2020-7595 - https://nvd.nist.gov/vuln/detail/CVE-2020-24977 - - - 2020-01-21 - 2020-09-22 - - - - - py-matrix-synapse -- malformed events may prevent users from joining federated rooms - - - py36-matrix-synapse - py37-matrix-synapse - py38-matrix-synapse - 1.19.2 - - - - -

Problem Description:

-

Affected Synapse versions assume that all events have an "origin" field set. If an event - without the "origin" field is sent into a federated room, servers not already joined to - the room will be unable to do so due to failing to fetch the malformed event.

-

Impact:

-

An attacker could cause a denial of service by deliberately sending a malformed event - into a room, thus preventing new servers (and thus their users) from joining the - room.

- - - - https://github.com/matrix-org/synapse/issues/8319 - https://github.com/matrix-org/synapse/pull/8324 - https://github.com/matrix-org/synapse/blob/v1.19.3/CHANGES.md - - - 2020-09-16 - 2020-09-21 - - - - - Python -- multiple vulnerabilities - - - python35 - 3.5.10 - - - - -

Python reports:

-
-

bpo-39603: Prevent http header injection by rejecting control characters in http.client.putrequest(…).

-

bpo-29778: Ensure python3.dll is loaded from correct locations when Python is embedded (CVE-2020-15523).

-

bpo-41004: CVE-2020-14422: The __hash__() methods of ipaddress.IPv4Interface and ipaddress.IPv6Interface incorrectly generated constant hash values of 32 and 128 respectively. This resulted in always causing hash collisions. The fix uses hash() to generate hash values for the tuple of (address, mask length, network address).

-

bpo-39073: Disallow CR or LF in email.headerregistry.Address arguments to guard against header injection attacks.

-

bpo-38576: Disallow control characters in hostnames in http.client, addressing CVE-2019-18348. Such potentially malicious header injection URLs now cause a InvalidURL to be raised.

-

bpo-39503: CVE-2020-8492: The AbstractBasicAuthHandler class of the urllib.request module uses an inefficient regular expression which can be exploited by an attacker to cause a denial of service. Fix the regex to prevent the catastrophic backtracking. Vulnerability reported by Ben Caller and Matt Schwager.

-

bpo-38945: Newline characters have been escaped when performing uu encoding to prevent them from overflowing into to content section of the encoded file. This prevents malicious or accidental modification of data during the decoding process.

-

bpo-38804: Fixes a ReDoS vulnerability in http.cookiejar. Patch by Ben Caller.

-

bpo-39017: Avoid infinite loop when reading specially crafted TAR files using the tarfile module (CVE-2019-20907).

-

bpo-41183: Use 3072 RSA keys and SHA-256 signature for test certs and keys.

-

bpo-39503: AbstractBasicAuthHandler of urllib.request now parses all WWW-Authenticate HTTP headers and accepts multiple challenges per header: use the realm of the first Basic challenge.

-
- - - - CVE-2020-15523 - CVE-2020-14422 - CVE-2019-18348 - CVE-2020-8492 - CVE-2019-20907 - - - 2020-08-19 - 2020-09-20 - - - - - samba -- Unauthenticated domain takeover via netlogon - - - samba410 - 4.10.18 - - - samba411 - 4.11.13 - - - samba412 - 4.12.7 - - - - -

The Samba Team reports:

-
-

An unauthenticated attacker on the network can gain - administrator access by exploiting a netlogon protocol flaw.

-
- - - - https://www.samba.org/samba/security/CVE-2020-1472.html - CVE-2020-1472 - - - 2020-01-01 - 2020-09-20 - - - - - Nextcloud -- Password share by mail not hashed - - - nextcloud - 19.0.1 - - - - -

The Nextcloud project reports:

-
-

NC-SA-2020-026 (low): Password of share by mail is not hashed when - given on the create share call
- A logic error in Nextcloud Server 19.0.0 caused a plaintext storage - of the share password when it was given on the initial create API - call.

-
- - - - https://nextcloud.com/security/advisory/?id=NC-SA-2020-026 - CVE-2020-8183 - - - 2020-06-04 - 2020-09-19 - - - - - webkit2-gtk3 -- multible vulnerabilities - - - webkit2-gtk3 - 2.28.3 - - - - -

The WebKitGTK project reports vulnerabilities:

-
-
    -
  • CVE-2020-9802: Processing maliciously crafted web content may lead to arbitrary code execution.
    • -
  • CVE-2020-9803: Processing maliciously crafted web content may lead to arbitrary code execution.
    • -
  • CVE-2020-9805: Processing maliciously crafted web content may lead to universal cross site scripting.
    • -
  • CVE-2020-9806: Processing maliciously crafted web content may lead to arbitrary code execution.
    • -
  • CVE-2020-9807: Processing maliciously crafted web content may lead to arbitrary code execution.
    • -
  • CVE-2020-9843: Processing maliciously crafted web content may lead to a cross site scripting attack.
    • -
  • CVE-2020-9850: A remote attacker may be able to cause arbitrary code execution.
    • -
  • CVE-2020-13753: CLONE_NEWUSER could potentially be used to confuse xdg- desktop-portal, which allows access outside the sandbox. TIOCSTI can be used to directly execute commands outside the sandbox by writing to the controlling terminal’s input buffer.
    • -
-
- - - - https://webkitgtk.org/security/WSA-2020-0006.html - CVE-2020-9802 - CVE-2020-9803 - CVE-2020-9805 - CVE-2020-9806 - CVE-2020-9807 - CVE-2020-9843 - CVE-2020-9850 - CVE-2020-13753 - - - 2020-07-10 - 2020-07-10 - - - - - Node.js -- September 2020 Security Releases - - - node - 14.11.0 - - - node12 - 12.18.4 - - - node10 - 10.22.1 - - - - -

Node.js reports:

-
-

Updates are now available for v10,x, v12.x and v14.x Node.js release lines for the following issues.

-

HTTP Request Smuggling due to CR-to-Hyphen conversion (High) (CVE-2020-8201)

-

Affected Node.js versions converted carriage returns in HTTP request headers to a hyphen before parsing. This can lead to HTTP Request Smuggling as it is a non-standard interpretation of the header.

-

Impacts:

-
    -
  • All versions of the 14.x and 12.x releases line
    • -
-

Denial of Service by resource exhaustion CWE-400 due to unfinished HTTP/1.1 requests (Critical) (CVE-2020-8251)

-

Node.js is vulnerable to HTTP denial of service (DOS) attacks based on delayed requests submission which can make the server unable to accept new connections. The fix a new http.Server option called requestTimeout with a default value of 0 which means it is disabled by default. This should be set when Node.js is used as an edge server, for more details refer to the documentation.

-

Impacts:

-
    -
  • All versions of the 14.x release line
    • -
-

fs.realpath.native on may cause buffer overflow (Medium) (CVE-2020-8252)

-

libuv's realpath implementation incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.

-

Impacts:

-
    -
  • All versions of the 10.x release line
    • -
  • All versions of the 12.x release line
    • -
  • All versions of the 14.x release line before 14.9.0
    • -
-
- - - - https://nodejs.org/en/blog/vulnerability/september-2020-security-releases/ - CVE-2020-8201 - CVE-2020-8251 - CVE-2020-8252 - - - 2020-09-08 - 2020-09-16 - - - - - FreeBSD -- ftpd privilege escalation via ftpchroot feature - - - FreeBSD - 12.112.1_10 - 11.411.4_4 - 11.311.3_14 - - - - -

Problem Description:

-

A ftpd(8) bug in the implementation of the file system sandbox, combined - with capabilities available to an authenticated FTP user, can be used to - escape the file system restriction configured in ftpchroot(5). - Moreover, the bug allows a malicious client to gain root privileges.

-

Impact:

-

A malicious FTP user can gain privileged access to an affected system.

- - - - CVE-2020-7468 - SA-20:30.ftpd - - - 2020-09-15 - 2020-09-16 - - - - - FreeBSD -- bhyve SVM guest escape - - - FreeBSD-kernel - 12.112.1_10 - 11.411.4_4 - 11.311.3_14 - - - - -

Problem Description:

-

A number of AMD virtualization instructions operate on host physical - addresses, are not subject to nested page table translation, and guest use of - these instructions was not trapped.

-

Impact:

-

From kernel mode a malicious guest can write to arbitrary host memory (with - some constraints), affording the guest full control of the host.

- - - - CVE-2020-7467 - SA-20:29.bhyve_svm - - - 2020-09-15 - 2020-09-16 - - - - - FreeBSD -- bhyve privilege escalation via VMCS access - - - FreeBSD-kernel - 12.112.1_10 - 11.411.4_4 - 11.311.3_14 - - - - -

Problem Description:

-

AMD and Intel CPUs support hardware virtualization using specialized data - structures that control various aspects of guest operation. These are the - Virtual Machine Control Structure (VMCS) on Intel CPUs, and the Virtual - Machine Control Block (VMCB) on AMD CPUs. Insufficient access controls allow - root users, including those running in a jail, to change these data - structures.

-

Impact:

-

An attacker with host root access (including to a jailed bhyve instance) can - use this vulnerability to achieve kernel code execution.

- - - - CVE-2020-24718 - SA-20:28.bhyve_vmcs - - - 2020-09-15 - 2020-09-16 - - - - - FreeBSD -- ure device driver susceptible to packet-in-packet attack - - - FreeBSD-kernel - 12.112.1_10 - 11.411.4_4 - 11.311.3_14 - - - - -

Problem Description:

-

A programming error in the ure(4) device driver caused some Realtek USB - Ethernet interfaces to incorrectly report packets with more than 2048 bytes - in a single USB transfer as having a length of only 2048 bytes.

-

An adversary can exploit this to cause the driver to misinterpret part of the - payload of a large packet as a separate packet, and thereby inject packets - across security boundaries such as VLANs.

-

Impact:

-

An attacker that can send large frames (larger than 2048 bytes in size) to be - received by the host (be it VLAN, or non-VLAN tagged packet), can inject - arbitrary packets to be received and processed by the host. This includes - spoofing packets from other hosts, or injecting packets to other VLANs than - the host is on.

- - - - CVE-2020-7464 - SA-20:27.ure - - - 2020-09-15 - 2020-09-16 - - - - - Rails -- Potential XSS vulnerability - - - rubygem-actionview52 - 5.2.4.4 - - - rubygem-actionview60 - 6.0.3.3 - - - - -

Ruby on Rails blog:

-
-

Rails 5.2.4.4 and 6.0.3.3 have been released! These releases contain an - important security fix, so please upgrade when you can.

-

Both releases contain the following fix: [CVE-2020-15169] Potential XSS - vulnerability in Action View

-
- - - - https://weblog.rubyonrails.org/2020/9/10/Rails-5-2-4-4-and-6-0-3-3-have-been-released/ - https://groups.google.com/forum/#!topic/rubyonrails-security/b-C9kSGXYrc - https://github.com/rails/rails/blob/5-2-stable/actionview/CHANGELOG.md - https://github.com/rails/rails/blob/6-0-stable/actionview/CHANGELOG.md - CVE-2020-15169 - - - 2020-09-09 - 2020-09-12 - - - - - zeek -- Various vulnerabilities - - - zeek - 3.0.10 - - - - -

Jon Siwek of Corelight reports:

-
-

This release fixes the following security issue:

-
    -
  • The AYIYA and GTPv1 parsing/decapsulation logic may - leak memory -- These leaks have potential for remote - exploitation to cause Denial of Service via resource - exhaustion.
    • -
-
- - - - https://github.com/zeek/zeek/releases/tag/v3.0.10 - - - 2020-08-28 - 2020-09-09 - - - - - chromium -- multiple vulnerabilities - - - chromium - 85.0.4183.102 - - - - -

Chrome Releases reports:

-
-

This release contains 5 security fixes:

-
    -
  • [1116304] High CVE-2020-6573: Use after free in video. Reported - by Leecraso and Guang Gong of 360 Alpha Lab working with 360 - BugCloud on 2020-08-14
    • -
  • [1102196] High CVE-2020-6574: Insufficient policy - enforcement in installer. Reported by CodeColorist of - Ant-Financial LightYear Labs on 2020-07-05
    • -
  • [1081874] High CVE-2020-6575: Race in Mojo. Reported by - Microsoft on 2020-05-12
    • -
  • [1111737] High CVE-2020-6576: Use after free in offscreen - canvas. Reported by Looben Yang on 2020-07-31
    • -
  • [1122684] High CVE-2020-15959: Insufficient policy enforcement - in networking. Reported by Eric Lawrence of Microsoft on - 2020-08-27
    • -
-
- - - - CVE-2020-6573 - CVE-2020-6574 - CVE-2020-6575 - CVE-2020-6576 - CVE-2020-15969 - https://chromereleases.googleblog.com/2020/09/stable-channel-update-for-desktop.html - - - 2020-09-08 - 2020-09-09 - - - - - Multi-link PPP protocol daemon MPD5 remotely exploitable crash - - - mpd5 - 5.9 - - - - -

Version 5.9 contains security fix for L2TP clients and servers. - Insufficient validation of incoming L2TP control packet - specially crafted by unauthenticated user might lead to unexpected - termination of the process. The problem affects mpd versions - since 4.0 that brought in initial support for L2TP. - Installations not using L2TP clients nor L2TP server configuration were not affected.

- - - - CVE-2020-7465 - CVE-2020-7466 - http://mpd.sourceforge.net/doc5/mpd4.html#4 - - - 2020-09-04 - 2020-09-06 - 2020-09-07 - - - - - Mbed TLS -- Local side channel attack on RSA and static Diffie-Hellman - - - mbedtls - 2.16.8 - - - - -

Manuel Pégourié-Gonnard reports:

-
-

An attacker with access to precise enough timing and memory access - information (typically an untrusted operating system attacking a - secure enclave such as SGX or the TrustZone secure world) can - recover the private keys used in RSA or static (finite-field) - Diffie-Hellman operations.

-
- - - - https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-09-2 - - - 2020-09-01 - 2020-09-06 - - - - - Mbed TLS -- Local side channel attack on classical CBC decryption in (D)TLS - - - mbedtls - 2.16.8 - - - - -

Manuel Pégourié-Gonnard reports:

-
-

When decrypting/authenticating (D)TLS record in a connection using - a CBC ciphersuite without the Encrypt-then-Mac extension RFC 7366, - Mbed TLS used dummy rounds of the compression function associated - with the hash used for HMAC in order to hide the length of the - padding to remote attackers, as recommended in the original Lucky - Thirteen paper.

-

A local attacker who is able to observe the state of the cache - could monitor the presence of mbedtls_md_process() in the cache in - order to determine when the actual computation ends and when the - dummy rounds start. This is a reliable target as it's always called - at least once, in response to a previous attack. The attacker can - then continue with one of many well-documented Lucky 13 - variants.

-
- - - - https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-09-1 - CVE-2020-16150 - - - 2020-09-01 - 2020-09-06 - - - - - GnuTLS -- null pointer dereference - - - gnutls - 3.6.15 - - - - -

The GnuTLS project reports:

-
-

It was found by oss-fuzz that the server sending a - "no_renegotiation" alert in an unexpected timing, followed by an - invalid second handshake can cause a TLS 1.3 client to crash via a - null-pointer dereference. The crash happens in the application's - error handling path, where the gnutls_deinit function is called - after detecting a handshake failure.

-
- - - - https://gnutls.org/security-new.html#GNUTLS-SA-2020-09-04 - CVE-2020-24659 - - - 2020-09-04 - 2020-09-06 - - - - - Django -- multiple vulnerabilities - - - py35-django22 - py36-django22 - py37-django22 - py38-django22 - 2.2.16 - - - py36-django30 - py37-django30 - py38-django30 - 3.0.10 - - - py36-django31 - py37-django31 - py38-django31 - 3.1.1 - - - - -

Django Release notes:

-
-

CVE-2020-24583: Incorrect permissions on intermediate-level directories - on Python 3.7+

-

On Python 3.7+, FILE_UPLOAD_DIRECTORY_PERMISSIONS mode was not applied - to intermediate-level directories created in the process of uploading - files and to intermediate-level collected static directories when using - the collectstatic management command.

-

CVE-2020-24584: Permission escalation in intermediate-level directories - of the file system cache on Python 3.7+

-

On Python 3.7+, the intermediate-level directories of the file system - cache had the system's standard umask rather than 0o077 (no group or - others permissions).

-
- - - - https://docs.djangoproject.com/en/2.2/releases/2.2.16/ - https://docs.djangoproject.com/en/3.0/releases/3.0.10/ - https://docs.djangoproject.com/en/3.1/releases/3.1.1/ - CVE-2020-24583 - CVE-2020-24584 - - - 2020-09-01 - 2020-09-05 - - - - - gnupg -- AEAD key import overflow - - - gnupg - 2.2.212.2.23 - - - - -

Importing an OpenPGP key having a preference list for AEAD algorithms - will lead to an array overflow and thus often to a crash or other - undefined behaviour.

- -

Importing an arbitrary key can often easily be triggered by an attacker - and thus triggering this bug. Exploiting the bug aside from crashes is - not trivial but likely possible for a dedicated attacker. The major - hurdle for an attacker is that only every second byte is under their - control with every first byte having a fixed value of 0x04.

- - - - CVE-2020-25125 - https://dev.gnupg.org/T5050 - - - 2020-09-03 - 2020-09-03 - - - - - FreeBSD -- dhclient heap overflow - - - FreeBSD - 12.112.1_9 - 11.411.4_3 - 11.311.3_13 - - - - -

Problem Description:

-

When parsing option 119 data, dhclient(8) computes the uncompressed domain - list length so that it can allocate an appropriately sized buffer to store - the uncompressed list. The code to compute the length failed to handle - certain malformed input, resulting in a heap overflow when the uncompressed - list is copied into in inadequately sized buffer.

-

Impact:

-

The heap overflow could in principle be exploited to achieve remote code - execution. The affected process runs with reduced privileges in a Capsicum - sandbox, limiting the immediate impact of an exploit. However, it is - possible the bug could be combined with other vulnerabilities to escape the - sandbox.

- - - - CVE-2020-7461 - SA-20:26.dhclient - - - 2020-09-02 - 2020-09-02 - - - - - FreeBSD -- SCTP socket use-after-free bug - - - FreeBSD-kernel - 12.112.1_9 - 11.411.4_3 - 11.311.3_13 - - - - -

Problem Description:

-

Due to improper handling in the kernel, a use-after-free bug can be triggered - by sending large user messages from multiple threads on the same socket.

-

Impact:

-

Triggering the use-after-free situation may result in unintended kernel - behaviour including a kernel panic.

- - - - CVE-2020-7463 - SA-20:25.sctp - - - 2020-09-02 - 2020-09-02 - - - - - FreeBSD -- IPv6 Hop-by-Hop options use-after-free bug - - - FreeBSD-kernel - 11.311.3_13 - - - - -

Problem Description:

-

Due to improper mbuf handling in the kernel, a use-after-free bug might be - triggered by sending IPv6 Hop-by-Hop options over the loopback interface.

-

Impact:

-

Triggering the use-after-free situation may result in unintended kernel - behaviour including a kernel panic.

- - - - CVE-2020-7462 - SA-20:24.ipv6 - - - 2020-09-02 - 2020-09-02 - - - - - Gitlab -- multiple vulnerabilities - - - gitlab-ce - 13.3.013.3.4 - 13.2.013.2.8 - 013.1.10 - - - - -

Gitlab reports:

-
-

Vendor Cross-Account Assume-Role Attack

-

Stored XSS on the Vulnerability Page

-

Outdated Job Token Can Be Reused to Access Unauthorized Resources

-

File Disclosure Via Workhorse File Upload Bypass

-

Unauthorized Maintainer Can Edit Group Badge

-

Denial of Service Within Wiki Functionality

-

Sign-in Vulnerable to Brute-force Attacks

-

Invalidated Session Allows Account Access With an Old Password

-

GitLab Omniauth Endpoint Renders User Controlled Messages

-

Blind SSRF Through Repository Mirroring

-

Information Disclosure Through Incorrect Group Permission Verifications

-

No Rate Limit on GitLab Webhook Feature

-

GitLab Session Revocation Feature Does Not Invalidate All Sessions

-

OAuth Authorization Scope for an External Application Can Be Changed Without User Consent

-

Unauthorized Maintainer Can Delete Repository

-

Improper Verification of Deploy-Key Leads to Access Restricted Repository

-

Disabled Repository Still Accessible With a Deploy-Token

-

Duplicated Secret Code Generated by 2 Factor Authentication Mechanism

-

Lack of Validation Within Project Invitation Flow

-

Current Sessions Not Invalidated Upon Enabling 2 Factor Authentication

-

Users Without 2 Factor Authentication Can Be Blocked Accessing GitLab

-

Lack of Upper Bound Check Leading to Possible Denial of Service

-

2 Factor Authentication for Groups Was Not Enforced Within API Endpoint

-

GitLab Runner Denial of Service via CI Jobs

-

Update jQuery Dependency

-
- - - - https://about.gitlab.com/releases/2020/09/02/security-release-gitlab-13-3-3-released/ - CVE-2020-13318 - CVE-2020-13301 - CVE-2020-13284 - CVE-2020-13298 - CVE-2020-13313 - CVE-2020-13311 - CVE-2020-13289 - CVE-2020-13302 - CVE-2020-13314 - CVE-2020-13309 - CVE-2020-13287 - CVE-2020-13306 - CVE-2020-13299 - CVE-2020-13300 - CVE-2020-13317 - CVE-2020-13303 - CVE-2020-13316 - CVE-2020-13304 - CVE-2020-13305 - CVE-2020-13307 - CVE-2020-13308 - CVE-2020-13315 - CVE-2020-13297 - CVE-2020-13310 - CVE-2020-11022 - - - 2020-09-02 - 2020-09-02 - - - - - go -- net/http/cgi, net/http/fcgi: Cross-Site Scripting (XSS) when Content-Type is not specified - - - go - 1.14.8,1 - 1.15,11.15.1,1 - - - - -

The Go project reports:

-
-

When a Handler does not explicitly set the Content-Type header, both - CGI implementations default to “text/html”. If an attacker can make - a server generate content under their control (e.g. a JSON - containing user data or an uploaded image file) this might be - mistakenly returned by the server as “text/html”. If a victim visits - such a page they could get the attacker's code executed in the - context of the server origin. If an attacker can make a server - generate content under their control (e.g. a JSON containing user - data or an uploaded image file) this might be mistakenly returned by - the server as “text/html”. If a victim visits such a page they could - get the attacker's code executed in the context of the server - origin.

-
- - - - CVE-2020-24553 - https://github.com/golang/go/issues/40928 - - - 2020-08-20 - 2020-09-01 - - - - - ark -- extraction outside of extraction directory - - - ark - 20.08.0_1 - - - - -

Albert Astals Cid reports:

-
-

Overview

-

A maliciously crafted TAR archive containing symlink entries - would install files anywhere in the user's home directory upon extraction.

-

Proof of concept

-

For testing, an example of malicious archive can be found at - dirsymlink.tar -

-

Impact

-

Users can unwillingly install files like a modified .bashrc, or a malicious - script placed in ~/.config/autostart.

-

Workaround

-

Before extracting a downloaded archive using the Ark GUI, users should inspect it - to make sure it doesn't contain symlink entries pointing outside the extraction folder.

-

The 'Extract' context menu from the Dolphin file manager shouldn't be used.

-

Solution

-

Ark 20.08.1 skips maliciously crafted symlinks when extracting TAR archives.

-

Alternatively, 8bf8c5ef07b0ac5e914d752681e470dea403a5bd can be applied to previous releases.

-

Credits

-

Thanks to Fabian Vogt for reporting this issue and for fixing it.

-
- - - - https://kde.org/info/security/advisory-20200827-1.txt - CVE-2020-24654 - - - 2020-08-27 - 2020-08-28 - - - - - php72 -- use of freed hash key - - - php72 - 7.2.33 - - - php73 - 7.3.21 - - - php74 - 7.4.9 - - - - -

grigoritchy at gmail dot com reports:

-
-

The phar_parse_zipfile function had use-after-free - vulnerability because of mishandling of the actual_alias - variable.

-
- - - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7068 - CVE-2020-7068 - - - 2020-07-06 - 2020-08-27 - - - - - chromium -- multiple vulnerabilities - - - chromium - 85.0.4183.83 - - - - -

Chrome Releases reports:

-
-

This update includes 20 security fixes, including:

-
    -
  • [1109120] High CVE-2020-6558: Insufficient policy - enforcement in iOS. Reported by Alison Huffman, Microsoft Browser - Vulnerability Research on 2020-07-24
    • -
  • [1116706] High CVE-2020-6559: Use after free in presentation - API. Reported by Liu Wei and Wu Zekai of Tencent Security Xuanwu - Lab on 2020-08-15
    • -
  • [1108181] Medium CVE-2020-6560: Insufficient policy - enforcement in autofill. Reported by Nadja Ungethuem from - www.unnex.de on 2020-07-22
    • -
  • [932892] Medium CVE-2020-6561: Inappropriate implementation - in Content Security Policy. Reported by Rob Wu on 2019-02-16
    • -
  • [1086845] Medium CVE-2020-6562: Insufficient policy - enforcement in Blink. Reported by Masato Kinugawa on - 2020-05-27
    • -
  • [1104628] Medium CVE-2020-6563: Insufficient policy - enforcement in intent handling. Reported by Pedro Oliveira on - 2020-07-12
    • -
  • [841622] Medium CVE-2020-6564: Incorrect security UI in - permissions. Reported by Khalil Zhani on 2018-05-10
    • -
  • [1029907] Medium CVE-2020-6565: Incorrect security UI in - Omnibox. Reported by Khalil Zhani on 2019-12-02
    • -
  • [1065264] Medium CVE-2020-6566: Insufficient policy - enforcement in media. Reported by Jun Kokatsu, Microsoft Browser - Vulnerability Research on 2020-03-27
    • -
  • [937179] Low CVE-2020-6567: Insufficient validation of - untrusted input in command line handling. Reported by Joshua - Graham of TSS on 2019-03-01
    • -
  • [1092451] Low CVE-2020-6568: Insufficient policy enforcement - in intent handling. Reported by Yongke Wang(@Rudykewang) and - Aryb1n(@aryb1n) of Tencent Security Xuanwu Lab on 2020-06-08
    • -
  • [995732] Low CVE-2020-6569: Integer overflow in WebUSB. - Reported by guaixiaomei on 2019-08-20
    • -
  • [1084699] Low CVE-2020-6570: Side-channel information leakage - in WebRTC. Reported by Signal/Tenable on 2020-05-19
    • -
  • [1085315] Low CVE-2020-6571: Incorrect security UI in Omnibox. - Reported by Rayyan Bijoora on 2020-05-21
    • -
-
- - - - CVE-2020-6558 - CVE-2020-6559 - CVE-2020-6560 - CVE-2020-6561 - CVE-2020-6562 - CVE-2020-6563 - CVE-2020-6564 - CVE-2020-6565 - CVE-2020-6566 - CVE-2020-6567 - CVE-2020-6568 - CVE-2020-6569 - CVE-2020-6570 - CVE-2020-6571 - https://chromereleases.googleblog.com/2020/08/stable-channel-update-for-desktop_25.html - - - 2020-08-25 - 2020-08-26 - - - - - jasper -- multiple vulnerabilities - - - jasper - 2.0.20 - - - - -

JasPer NEWS:

-
-

- Fix CVE-2018-9154

-

- Fix CVE-2018-19541

-

- Fix CVE-2016-9399, CVE-2017-13751

-

- Fix CVE-2018-19540

-

- Fix CVE-2018-9055

-

- Fix CVE-2017-13748

-

- Fix CVE-2017-5503, CVE-2017-5504, CVE-2017-5505

-

- Fix CVE-2018-9252

-

- Fix CVE-2018-19139

-

- Fix CVE-2018-19543, CVE-2017-9782

-

- Fix CVE-2018-20570

-

- Fix CVE-2018-20622

-

- Fix CVE-2016-9398

-

- Fix CVE-2017-14132

-

- Fix CVE-2017-5499

-

- Fix CVE-2018-18873

-

- Fix CVE-2017-13750

-
- - - - https://github.com/jasper-software/jasper/blob/master/NEWS - CVE-2018-9154 - CVE-2018-19541 - CVE-2016-9399 - CVE-2017-13751 - CVE-2018-19540 - CVE-2018-9055 - CVE-2017-13748 - CVE-2017-5503 - CVE-2017-5504 - CVE-2017-5505 - CVE-2018-9252 - CVE-2018-19139 - CVE-2018-19543 - CVE-2017-9782 - CVE-2018-20570 - CVE-2018-20622 - CVE-2016-9398 - CVE-2017-14132 - CVE-2017-5499 - CVE-2018-18873 - CVE-2017-13750 - - - 2020-07-28 - 2020-08-25 - 2020-09-05 - - - - - xorg-server -- Multiple input validation failures in X server extensions - - - xorg-server - 1.20.8_4,1 - - - xephyr - 1.20.8_4,1 - - - xorg-vfbserver - 1.20.8_4,1 - - - xorg-nestserver - 1.20.8_4,1 - - - xwayland - 1.20.8_4,1 - - - xorg-dmx - 1.20.8_4,1 - - - - -

The X.org project reports:

-
-

All theses issuses can lead to local privileges elevation on - systems where the X server is running privileged.

-

The handler for the XkbSetNames request does not validate the - request length before accessing its contents.

-

An integer underflow exists in the handler for the - XIChangeHierarchy request.

-

An integer underflow exist in the handler for the XkbSelectEvents - request.

-

An integer underflow exist in the handler for the CreateRegister - request of the X record extension.

-
- - - - CVE-2020-14345 - CVE-2020-14346 - CVE-2020-14361 - CVE-2020-14362 - https://lists.x.org/archives/xorg-announce/2020-August/003058.html - - - 2020-08-25 - 2020-08-25 - - - - - libX11 -- Doublefree in locale handlng code - - - libX11 - 1.6.12,1 - - - - -

The X.org project reports:

-
-

There is an integer overflow and a double free vulnerability in - the way LibX11 handles locales. The integer overflow is a necessary - precursor to the double free.

-
- - - - CVE-2020-14363 - https://lists.x.org/archives/xorg-announce/2020-August/003056.html - - - 2020-08-25 - 2020-08-25 - 2020-11-15 - - - - - chrony <= 3.5.1 data corruption through symlink vulnerability writing the pidfile - - - chrony - 3.5.1 - - - - -

Miroslav Lichvar reports:

-
-

chrony-3.5.1 [...] fixes a security issue in writing of the pidfile.

-

When chronyd is configured to save the pidfile in a directory where the - chrony user has write permissions (e.g. /var/run/chrony - the default - since chrony-3.4), an attacker that compromised the chrony user account - could create a symbolic link at the location of the pidfile to make - chronyd starting with root privileges follow the symlink and write its - process ID to a file for which the chrony user doesn't have write - permissions, causing a denial of service, or data loss.

-

This issue was reported by Matthias Gerstner of SUSE.

-
- - - - https://listengine.tuxfamily.org/chrony.tuxfamily.org/chrony-announce/2020/08/msg00000.html - CVE-2020-14367 - - - 2020-08-06 - 2020-08-22 - - - - - sysutils/openzfs-kmod -- critical permissions issues - - - openzfs-kmod - 2020081800 - - - - -

Andrew Walker reports:

-
-
Issue 1:
-

- Users are always granted permissions to cd into a directory. The - check for whether execute is present on directories is a de-facto - no-op. This cannot be mitigated without upgrading. Even setting - an explicit "deny - execute" NFSv4 ACE will be bypassed. -

-
Issue 2:
-

- All ACEs for the owner_group (group@) and regular groups - (group:<foo>) are granted the current user. This means that - POSIX mode 770 is de-facto 777, and the below ACL is also de-facto - 777 because the groupmember check for builtin_administrators - returns True. -

- 
-root@TESTBOX[~]# getfacl testfile
-# file: testfile
-# owner: root
-# group: wheel
-group:builtin_administrators:rwxpDdaARWcCos:-------:allow
-
-
- - - - ports/248787 - https://github.com/openzfs/zfs/commit/716b53d0a14c72bda16c0872565dd1909757e73f - https://reviews.freebsd.org/D26107 - - - 2020-08-13 - 2020-08-20 - - - - - textproc/elasticsearch6 -- field disclosure flaw - - - elasticsearch6 - 6.8.12 - - - - -

Elastic reports:

-
-

A field disclosure flaw was found in Elasticsearch when running - a scrolling search with Field Level Security. If a user runs - the same query another more privileged user recently ran, - the scrolling search can leak fields that should be hidden. - This could result in an attacker gaining additional permissions - against a restricted index.

-
- - - - CVE-2020-7019 - https://discuss.elastic.co/t/elastic-stack-7-9-0-and-6-8-12-security-update/245456 - https://github.com/elastic/elasticsearch/pull/39490 - - - 2020-08-19 - 2020-08-20 - - - - - adns -- multiple vulnerabilities - - - adns - 1.5.2 - - - - -

Ian Jackson and the adns project reports:

-
-

Vulnerable applications: all adns callers. - Exploitable by: the local recursive resolver. - Likely worst case: Remote code execution.

-

Vulnerable applications: those that make SOA queries. - Exploitable by: upstream DNS data sources. - Likely worst case: DoS (crash of the adns-using application)

-

Vulnerable applications: those that use adns_qf_quoteok_query. - Exploitable by: sources of query domain names. - Likely worst case: DoS (crash of the adns-using application)

-

Vulnerable applications: adnshost. - Exploitable by: code responsible for framing the input. - Likely worst case: DoS (adnshost crashes at EOF).

-
- - - - https://www.chiark.greenend.org.uk/pipermail/adns-announce/2020/000004.html - CVE-2017-9103 - CVE-2017-9104 - CVE-2017-9105 - CVE-2017-9106 - CVE-2017-9107 - CVE-2017-9108 - CVE-2017-9109 - - - 2017-05-21 - 2020-08-20 - - - - - Icinga Web 2 -- directory traversal vulnerability - - - icingaweb2 - 2.8.1 - - - - -

Icinga development team reports:

-
-

CVE-2020-24368

-

- Icinga Icinga Web2 2.0.0 through 2.6.4, 2.7.4 and 2.8.2 has a - Directory Traversal vulnerability which allows an attacker to access - arbitrary files that are readable by the process running Icinga Web - 2. This issue is fixed in Icinga Web 2 in v2.6.4, v2.7.4 and v2.8.2. -

-
- - - - https://icinga.com/2020/08/19/icinga-web-security-release-v2-6-4-v2-7-4-and-v2-8-2/ - CVE-2020-24368 - - - 2020-08-19 - 2020-08-19 - - - - - curl -- expired pointer dereference vulnerability - - - curl - 7.29.07.72.0 - - - - -

curl security problems:

-
-

CVE-2020-8231: wrong connect-only connection

-

An application that performs multiple requests with libcurl's multi API - and sets the CURLOPT_CONNECT_ONLY option, might in rare circumstances - experience that when subsequently using the setup connect-only transfer, - libcurl will pick and use the wrong connection - and instead pick - another one the application has created since then.

-

CURLOPT_CONNECT_ONLY is the option to tell libcurl to not perform an - actual transfer, only connect. When that operation is completed, libcurl - remembers which connection it used for that transfer and "easy handle". - It remembers the connection using a pointer to the internal connectdata - struct in memory.

-

If more transfers are then done with the same multi handle before the - connect-only connection is used, leading to the initial connect-only - connection to get closed (for example due to idle time-out) while also - new transfers (and connections) are setup, such a new connection might - end up getting the exact same memory address as the now closed - connect-only connection.

-

If after those operations, the application then wants to use the - original transfer's connect-only setup to for example use - curl_easy_send() to send raw data over that connection, libcurl could - erroneously find an existing connection still being alive at the address - it remembered since before even though this is now a new and different - connection.

-

The application could then accidentally send data over that connection - which wasn't at all intended for that recipient, entirely unknowingly.

-
- - - - https://curl.haxx.se/docs/security.html - https://curl.haxx.se/docs/CVE-2020-8231.html - CVE-2020-8231 - - - 2020-08-19 - 2020-08-19 - - - - - Python -- multiple vulnerabilities - - - python37 - 3.7.9 - - - python36 - 3.6.12 - - - - -

Python reports:

-
-

bpo-29778: Ensure python3.dll is loaded from correct locations when - Python is embedded (CVE-2020-15523).

-

bpo-41004: CVE-2020-14422: The __hash__() methods of ipaddress.IPv4Interface - and ipaddress.IPv6Interface incorrectly generated constant hash values - of 32 and 128 respectively. This resulted in always causing hash collisions. - The fix uses hash() to generate hash values for the tuple of (address, mask - length, network address).

-

bpo-39603: Prevent http header injection by rejecting control characters - in http.client.putrequest(...).

-
- - - - https://docs.python.org/release/3.7.9/whatsnew/changelog.html#changelog - https://docs.python.org/release/3.6.12/whatsnew/changelog.html#changelog - CVE-2020-14422 - CVE-2020-15523 - - - 2020-06-17 - 2020-08-19 - - - - - security/trousers -- several vulnerabilities - - - trousers - 0.3.14_3 - - - - -

the TrouSerS project reports reports:

-
-

If the tcsd daemon is started with root privileges, it fails to - drop the root gid after it is no longer needed.

-

If the tcsd daemon is started with root privileges, the tss user - has read and write access to the /etc/tcsd.conf file.

-

If the tcsd daemon is started with root privileges, the creation - of the system.data file is prone to symlink attacks.

-
- - - - https://sourceforge.net/p/trousers/trousers/ci/e74dd1d96753b0538192143adf58d04fcd3b242b/ - https://www.openwall.com/lists/oss-security/2020/05/20/3 - CVE-2020-24330 - CVE-2020-24331 - CVE-2020-24332 - - - 2020-05-20 - 2020-08-18 - - - - - chromium -- heap buffer overflow - - - chromium - 84.0.4147.135 - - - - -

Chrome Releases reports:

-
-

This release contains one security fix:

-
    -
  • [1115345] High CVE-2020-6556: Heap buffer overflow in - SwiftShader. Reported by Alison Huffman, Microsoft Browser - Vulnerability Research on 2020-08-12
    • -
-
- - - - CVE-2020-6556 - https://chromereleases.googleblog.com/2020/08/stable-channel-update-for-desktop_18.html - - - 2020-08-18 - 2020-08-18 - - - - - ceph14 -- HTTP header injection via CORS ExposeHeader tag - - - ceph14 - 14.2.11 - - - - -

Red Hat bugzilla reports:

-
-

A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway). - The vulnerability is related to the injection of HTTP headers via a CORS - ExposeHeader tag. The newline character in the ExposeHeader tag in the - CORS configuration file generates a header injection in the response - when the CORS request is made.

-
- - - - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10753 - CVE-2020-10753 - ports/248673 - - - 2020-05-27 - 2020-08-16 - - - - - jenkins -- Buffer corruption in bundled Jetty - - - jenkins - 2.243 - - - jenkins-lts - 2.235.5 - - - - -

Jenkins Security Advisory:

-
-

Description

-
(Critical) SECURITY-1983 / CVE-2019-17638
-

Buffer corruption in bundled Jetty

-
- - - - CVE-2019-17638 - https://www.jenkins.io/security/advisory/2020-08-17/ - - - 2020-08-17 - 2020-08-17 - - - - - net/rsync -- multiple zlib issues - - - rsync - 3.2.0 - - - - -

rsync developers reports:

-
-

Various zlib fixes, including security fixes for CVE-2016-9843, CVE-2016-9842, CVE-2016-9841, and CVE-2016-9840

-
- - - - https://download.samba.org/pub/rsync/NEWS#3.2.0 - CVE-2016-9843 - CVE-2016-9842 - CVE-2016-9841 - CVE-2016-9840 - - - 2020-06-19 - 2020-08-16 - - - - - security/py-ecdsa -- multiple issues - - - py27-ecdsa - 0.13.3 - - - py37-ecdsa - 0.13.3 - - - - -

py-ecdsa developers report:

-
-

Fix CVE-2019-14853 - possible DoS caused by malformed signature decoding.

-

Fix CVE-2019-14859 - signature malleability caused by insufficient checks of DER encoding

-
- - - - https://github.com/warner/python-ecdsa/releases/tag/python-ecdsa-0.13.3 - CVE-2019-14853 - CVE-2019-14859 - - - 2019-10-07 - 2020-08-16 - - - - - snmptt -- malicious shell code - - - snmptt - 1.4.2 - - - - -

Snmptt reports:

-
-

Fixed a security issue with EXEC / PREXEC / unknown_trap_exec that could - allow malicious shell code to be executed.

-

Fixed a bug with EXEC / PREXEC / unknown_trap_exec that caused commands to be - run as root instead of the user defined in daemon_uid.

-
- - - - http://snmptt.sourceforge.net/changelog.shtml - ports/248162 - - - 2020-07-23 - 2020-08-15 - - - - - mail/dovecot -- multiple vulnerabilities - - - dovecot - 2.3.11 - - - - -

Aki Tuomi reports:

-
-

Parsing mails with a large number of MIME parts could - have resulted in excessive CPU usage or a crash due to running out of - stack memory..

-
-
-

Dovecot's NTLM implementation does not correctly check - message buffer size, which leads to reading past allocation which can - lead to crash

-
-
-

lmtp/submission: Issuing the RCPT command with an - address that has the empty quoted string as local-part causes the lmtp - service to crash.

-
-
-

Dovecot's RPA mechanism implementation accepts - zero-length message, which leads to assert-crash later on.

-
- - - - https://dovecot.org/pipermail/dovecot-news/2020-August/000440.html - CVE-2020-12100 - CVE-2020-12673 - CVE-2020-10967 - CVE-2020-12674 - - - 2020-04-23 - 2020-08-13 - - - - - ilmbase, openexr -- v2.5.3 is a patch release with various bug/security fixes - - - ilmbase - 2.5.3 - - - openexr - 2.5.3 - - - - -

Cary Phillips reports:

-
-

v2.5.3 - Patch release with various bug/security fixes [...]:

-
  • Various sanitizer/fuzz-identified issues related to handling of invalid input
-
- - - - https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.5.3 - - - 2020-07-13 - 2020-08-13 - - - - - jenkins -- multiple vulnerabilities - - - jenkins - 2.252 - - - jenkins-lts - 2.235.4 - - - - -

Jenkins Security Advisory:

-
-

Description

-
(High) SECURITY-1955 / CVE-2020-2229
-

Stored XSS vulnerability in help icons

-
(High) SECURITY-1957 / CVE-2020-2230
-

Stored XSS vulnerability in project naming strategy

-
(High) SECURITY-1960 / CVE-2020-2231
-

Stored XSS vulnerability in 'Trigger builds remotely'

-
- - - - CVE-2020-2229 - CVE-2020-2230 - CVE-2020-2231 - https://www.jenkins.io/security/advisory/2020-08-12/ - - - 2020-08-12 - 2020-08-12 - - - - - chromium -- multiple vulnerabilities - - - chromium - 84.0.4147.125 - - - - -

Chrome Releases reports:

-
-

This release contains 15 security fixes, including:

-
    -
  • [1107433] High CVE-2020-6542: Use after free in ANGLE. - Reported by Piotr Bania of Cisco Talos on 2020-07-20
    • -
  • [1104046] High CVE-2020-6543: Use after free in task - scheduling. Reported by Looben Yang on 2020-07-10
    • -
  • [1108497] High CVE-2020-6544: Use after free in media. Reported - by Tim Becker of Theori on 2020-07-22
    • -
  • [1095584] High CVE-2020-6545: Use after free in audio. Reported - by Anonymous on 2020-06-16
    • -
  • [1100280] High CVE-2020-6546: Inappropriate implementation in - installer. Reported by Andrew Hess (any1) on 2020-06-29
    • -
  • [1102153] High CVE-2020-6547: Incorrect security UI in media. - Reported by David Albert on 2020-07-05
    • -
  • [1103827] High CVE-2020-6548: Heap buffer overflow in Skia. - Reported by Choongwoo Han, Microsoft Browser Vulnerability - Research on 2020-07-09
    • -
  • [1105426] High CVE-2020-6549: Use after free in media. Reported - by Sergei Glazunov of Google Project Zero on 2020-07-14
    • -
  • [1106682] High CVE-2020-6550: Use after free in IndexedDB. - Reported by Sergei Glazunov of Google Project Zero on - 2020-07-17
    • -
  • [1107815] High CVE-2020-6551: Use after free in WebXR. Reported - by Sergei Glazunov of Google Project Zero on 2020-07-21
    • -
  • [1108518] High CVE-2020-6552: Use after free in Blink. Reported - by Tim Becker of Theori on 2020-07-22
    • -
  • [1111307] High CVE-2020-6553: Use after free in offline mode. - Reported by Alison Huffman, Microsoft Browser Vulnerability - Research on 2020-07-30
    • -
  • [1094235] Medium CVE-2020-6554: Use after free in extensions. - Reported by Anonymous on 2020-06-12
    • -
  • [1105202] Medium CVE-2020-6555: Out of bounds read in WebGL. - Reported by Marcin Towalski of Cisco Talos on 2020-07-13
    • -
-
- - - - CVE-2020-6542 - CVE-2020-6543 - CVE-2020-6544 - CVE-2020-6545 - CVE-2020-6546 - CVE-2020-6547 - CVE-2020-6548 - CVE-2020-6549 - CVE-2020-6550 - CVE-2020-6551 - CVE-2020-6552 - CVE-2020-6553 - CVE-2020-6554 - CVE-2020-6555 - https://chromereleases.googleblog.com/2020/08/stable-channel-update-for-desktop.html - - - 2020-08-10 - 2020-08-11 - - - - - puppetdb -- Multiple vulnerabilities - - - puppetdb5 - 5.2.18 - - - - -

Puppetlabs reports:

-
-

In June 2020, jackson-databind published security updates addressing several CVEs. Previous releases of PuppetDB contain a vulnerable version of jackson.core:jackson-databind. PuppetDB 5.2.18 contains an updated version of jackson-databind that has patched the vulnerabilities.

-
- - - - https://puppet.com/security/cve/jackson-july-2020-security-fixes/ - CVE-2020-9548 - CVE-2020-14062 - CVE-2020-14060 - CVE-2020-14061 - CVE-2020-14195 - - - 2020-07-23 - 2020-08-11 - - - - - bftpd -- Multiple vulnerabilities - - - bftpd - 5.6 - - - - -

Bftpd project reports:

-
-

Bftpd is vulnerable to out of bounds memory access, file descriptor leak and a potential buffer overflow.

-
- - - - http://bftpd.sourceforge.net/news.html - - - 2020-04-16 - 2020-08-10 - - - - - trafficserver -- resource consumption - - - trafficserver - 8.0.8 - - - - -

Bryan Call reports:

-
-

ATS is vulnerable to certain types of HTTP/2 HEADERS frames that can cause the server to allocate a large amount of memory and spin the thread.

-
- - - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9494 - CVE-2020-9494 - - - 2020-06-24 - 2020-07-02 - - - - - Apache httpd -- Multiple vulnerabilities - - - apache24 - 2.4.46 - - - mod_http2 - 1.15.14 - - - - -

The Apache httpd projec reports:

-
-
    -
  • mod_http2: Important: Push Diary Crash on Specifically - Crafted HTTP/2 Header (CVE-2020-9490)
    - A specially crafted value for the 'Cache-Digest' header in a HTTP/2 - request would result in a crash when the server actually tries to - HTTP/2 PUSH a resource afterwards.
    • -
  • mod_proxy_uwsgi: Moderate: mod_proxy_uwsgi buffer overflow - (CVE-2020-11984)
    - info disclosure and possible RCE
    • -
  • mod_http2: Moderate: Push Diary Crash on Specifically Crafted - HTTP/2 Header (CVE-2020-11993)
    - When trace/debug was enabled for the HTTP/2 module and on certain - traffic edge patterns, logging statements were made on the wrong - connection, causing concurrent use of memory pools.
    • -
-
- - - - https://downloads.apache.org/httpd/CHANGES_2.4.46 - https://httpd.apache.org/security/vulnerabilities_24.html - CVE-2020-9490 - CVE-2020-11984 - CVE-2020-11993 - - - 2020-08-07 - 2020-08-08 - 2020-08-08 - - - - - go -- encoding/binary: ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs - - - go - 1.14.7,1 - - - - -

The Go project reports:

-
-

Certain invalid inputs to ReadUvarint or ReadVarint could cause - those functions to read an unlimited number of bytes from the - ByteReader argument before returning an error. This could lead to - processing more input than expected when the caller is reading - directly from the network and depends on ReadUvarint and ReadVarint - only consuming a small, bounded number of bytes, even from invalid - inputs.

-
- - - - CVE-2020-16845 - https://github.com/golang/go/issues/40618 - - - 2020-08-06 - 2020-08-06 - - - - - Gitlab -- Multiple Vulnerabilities - - - gitlab-ce - 13.3.0 - - - - -

Gitlab reports:

-
-

Arbitrary File Read when Moving an Issue

-

Memory Exhaustion via Excessive Logging of Invite Email Error

-

Denial of Service Through Project Import Feature

-

User Controlled Git Configuration Settings Resulting in SSRF

-

Stored XSS in Issue Reference Number Tooltip

-

Stored XSS in Issues List via Milestone Title

-

Improper Access Control After Group Transfer

-

Bypass Email Verification Required for OAuth Flow

-

Confusion When Using Hexadecimal Branch Names

-

Insufficient OAuth Revocation

-

Improper Access Control for Project Sharing

-

Stored XSS in Jobs Page

-

Improper Access Control of Applications Page

-

SSRF into Shared Runner

-

Update Kramdown Gem

-
- - - - https://about.gitlab.com/releases/2020/08/05/gitlab-13-2-3-released/ - CVE-2020-10977 - CVE-2020-13280 - CVE-2020-13281 - CVE-2020-14001 - - - 2020-08-05 - 2020-08-06 - 2020-08-25 - - - - - FreeBSD -- sendmsg(2) privilege escalation - - - FreeBSD-kernel - 12.112.1_8 - 11.411.4_2 - 11.311.3_12 - - - - -

Problem Description:

-

When handling a 32-bit sendmsg(2) call, the compat32 subsystem copies the - control message to be transmitted (if any) into kernel memory, and adjusts - alignment of control message headers. The code which performs this work - contained a time-of-check to time-of-use (TOCTOU) vulnerability which allows a - malicious userspace program to modify control message headers after they were - validated by the kernel.

-

Impact:

-

The TOCTOU bug can be exploited by an unprivileged malicious userspace program - to trigger privilege escalation.

- - - - CVE-2020-7460 - SA-20:23.sendmsg - - - 2020-08-05 - 2020-08-06 - - - - - FreeBSD -- Potential memory corruption in USB network device drivers - - - FreeBSD-kernel - 12.112.1_8 - 11.411.4_2 - 11.311.3_12 - - - - -

Problem Description:

-

A missing length validation code common to these three drivers means that a - malicious USB device could write beyond the end of an allocated network - packet buffer.

-

Impact:

-

An attacker with physical access to a USB port and the ability to bring a - network interface up may be able to use a specially crafted USB device to - gain kernel or user-space code execution.

- - - - CVE-2020-7459 - SA-20:21.usb_net - - - 2020-08-05 - 2020-08-06 - - - - - typo3 -- multiple vulnerabilities - - - typo3-9-php72 - typo3-9-php73 - typo3-9-php74 - 9.5.20 - - - typo3-10-php72 - typo3-10-php73 - typo3-10-php74 - 10.4.6 - - - - -

Typo3 Team reports:

-
-

In case an attacker manages to generate a valid cryptographic message authentication - code (HMAC-SHA1) - either by using a different existing vulnerability or in case the - internal encryptionKey was exposed - it is possible to retrieve arbitrary files of a - TYPO3 installation. This includes the possibility to fetch typo3conf/LocalConfiguration.php - which again contains the encryptionKey as well as credentials of the database management - system being used. - In case a database server is directly accessible either via internet or in a shared hosting - network, this allows to completely retrieve, manipulate or delete database contents. - This includes creating an administration user account - which can be used to trigger remote - code execution by injecting custom extensions.

-

It has been discovered that an internal verification mechanism can be used to generate - arbitrary checksums. This allows to inject arbitrary data having a valid cryptographic - message authentication code (HMAC-SHA1) and can lead to various attack chains as described - below.

-
- - - - https://typo3.org/article/typo3-1046-and-9520-security-releases-published - https://typo3.org/security/advisory/typo3-core-sa-2020-007 - https://typo3.org/security/advisory/typo3-core-sa-2020-008 - CVE-2020-15098 - CVE-2020-15099 - - - 2020-07-28 - 2020-08-04 - - - - - xorg-server -- Pixel Data Uninitialized Memory Information Disclosure - - - xorg-server - 1.20.8_3,1 - - - xephyr - 1.20.8_3,1 - - - xorg-vfbserver - 1.20.8_3,1 - - - xorg-nestserver - 1.20.8_3,1 - - - xwayland - 1.20.8_3,1 - - - xorg-dmx - 1.20.8_3,1 - - - - -

The X.org project reports:

-
-

Allocation for pixmap data in AllocatePixmap() does not initialize - the memory in xserver, it leads to leak uninitialize heap memory to - clients. When the X server runs with elevated privileges.

-

This flaw can lead to ASLR bypass, which when combined with other - flaws (known/unknown) could lead to lead to privilege elevation in - the client.

-
- - - - https://lists.x.org/archives/xorg-announce/2020-July/003051.html - CVE-2020-14347 - - - 2020-07-31 - 2020-08-01 - - - - - libX11 -- Heap corruption in the X input method client in libX11 - - - libX11 - 1.6.9_3,1 - - - - -

The X.org project reports:

-
-

The X Input Method (XIM) client implementation in libX11 has some - integer overflows and signed/unsigned comparison issues that can - lead to heap corruption when handling malformed messages from an - input method.

-
- - - - https://lists.x.org/archives/xorg-announce/2020-July/003050.html - CVE-2020-14344 - - - 2020-07-31 - 2020-08-01 - - - - - Python -- multiple vulnerabilities - - - python38 - 3.8.5 - - - - -

Python reports:

-
-

bpo-41304: Fixes python3x._pth being ignored on Windows, caused by the fix for - bpo-29778 (CVE-2020-15801).

-

bpo-39603: Prevent http header injection by rejecting control characters in - http.client.putreques().

-
- - - - https://docs.python.org/3/whatsnew/changelog.html#python-3-8-5-final - CVE-2020-15801 - - - 2020-02-11 - 2020-07-31 - - - - - ark -- directory traversal - - - ark - 20.04.2_1 - 20.04.3 - - - - -

KDE Project Security Advisory reports:

-
-

KDE Project Security Advisory

- - - - - - - - - - - - - - - - - - - - - - - - - -
Title:Ark: maliciously crafted archive can install files outside the extraction directory.
Risk Rating:Important
CVE:CVE-2020-16116
Versions:ark <= 20.04.3
Author:Elvis Angelaccio <elvis.angelaccio@kde.org>
Date:30 July 2020
-

Overview

-

A maliciously crafted archive with "../" in the file paths - would install files anywhere in the user's home directory upon extraction.

- -

Proof of concept

-

For testing, an example of malicious archive can be found at - https://github.com/jwilk/traversal-archives/releases/download/0/relative2.zip

- -

Impact

-

Users can unwillingly install files like a modified .bashrc, or a malicious - script placed in ~/.config/autostart

- -

Workaround

-

Users should not use the 'Extract' context menu from the Dolphin file manager. - Before extracting a downloaded archive using the Ark GUI, users should inspect it - to make sure it doesn't contain entries with "../" in the file path.

- -

Solution

-

Ark 20.08.0 prevents loading of malicious archives and shows a warning message - to the users.

- -

Alternatively, - https://invent.kde.org/utilities/ark/-/commit/0df592524fed305d6fbe74ddf8a196bc9ffdb92f - can be applied to previous releases.

- -

Credits

-

Thanks to Dominik Penner for finding and reporting this issue and thanks to - Elvis Angelaccio and Albert Astals Cid for fixing it.

-
- - - - CVE-2020-16116 - https://kde.org/info/security/advisory-20200730-1.txt - - - 2020-07-30 - 2020-07-30 - - - - - chromium -- multiple vulnerabilities - - - chromium - 84.0.4147.105 - - - - -

Chrome Releases reports:

-
-

This update contains 8 security fixes, including:

-
    -
  • [1105318] High CVE-2020-6537: Type Confusion in V8. Reported by - Alphalaab on 2020-07-14
    • -
  • [1096677] High CVE-2020-6538: Inappropriate implementation in - WebView. Reported by Yongke Wang(@Rudykewang) and Aryb1n(@aryb1n) - of Tencent Security Xuanwu Lab on 2020-06-18
    • -
  • [1104061] High CVE-2020-6532: Use after free in SCTP. Reported - by Anonymous on 2020-07-09
    • -
  • [1105635] High CVE-2020-6539: Use after free in CSS. Reported - by Oriol Brufau on 2020-07-14
    • -
  • [1105720] High CVE-2020-6540: Heap buffer overflow in Skia. - Reported by Zhen Zhou of NSFOCUS Security Team on 2020-07-15
    • -
  • [1106773] High CVE-2020-6541: Use after free in WebUSB. Reported - by Sergei Glazunov of Google Project Zero on 2020-07-17
    • -
-
- - - - CVE-2020-6532 - CVE-2020-6537 - CVE-2020-6538 - CVE-2020-6539 - CVE-2020-6540 - CVE-2020-6541 - https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop_27.html - - - 2020-07-27 - 2020-07-28 - - - - - libsndfile -- out-of-bounds read memory access - - - libsndfile - 1.0.29.p.20200620 - - - - -

RedHat reports:

-
-

It was discovered the fix for CVE-2018-19758 was not complete and - still allows a read beyond the limits of a buffer in - wav_write_header() function in wav.c. A local attacker may use - this flaw to make the application crash.

-
- - - - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3832 - - - 2019-02-14 - 2020-07-28 - - - - - FreeRDP -- Integer overflow in RDPEGFX channel - - - freerdp - 2.2.0 - - - - -

Bernhard Miklautz reports:

-
-
    -
  • - Integer overflow due to missing input sanitation in rdpegfx channel -
    • -
  • All FreeRDP clients are affected
    • -
  • - The input rectangles from the server are not checked against local - surface coordinates and blindly accepted. A malicious server can send - data that will crash the client later on (invalid length arguments to - a memcpy) -
    • -
-
- - - - https://www.freerdp.com/2020/07/20/2_2_0-released - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15103 - CVE-2020-15103 - - - 2020-06-25 - 2020-07-28 - - - - - zeek -- Various vulnerabilities - - - zeek - 3.0.8 - - - - -

Jon Siwek of Corelight reports:

-
-

This release fixes the following security issues:

-
    -
  • Fix potential DNS analyzer stack overflow
    • -
  • Fix potential NetbiosSSN analyzer stack overflow
    • -
-
- - - - https://github.com/zeek/zeek/releases/tag/v3.0.8 - - - 2020-07-28 - 2020-07-28 - - - - - Cacti -- multiple vulnerabilities - - - cacti - 1.2.13 - - - - -

Cacti developers reports:

-
-

Multiple fixes for bundled jQuery to prevent - code exec (CVE-2020-11022, CVE-2020-11023).

-

PHPMail contains a escaping bug - (CVE-2020-13625).

-

SQL Injection via color.php in Cacti - (CVE-2020-14295).

-
- - - - https://www.cacti.net/release_notes.php?version=1.2.13 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11022 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11023 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13625 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14295 - CVE-2020-11022 - CVE-2020-11023 - CVE-2020-13625 - CVE-2020-14295 - - - 2020-07-15 - 2020-07-27 - - - - - Wagtail -- XSS vulnerability - - - py36-wagtail - py37-wagtail - py38-wagtail - 2.8.02.9.3 - 2.7.4 - - - - -

GitHub Advisory Database:

-
-

When a form page type is made available to Wagtail editors through the - wagtail.contrib.forms app, and the page template is built using - Django's standard form rendering helpers such as form.as_p (as directed - in the documentation), any HTML tags used within a form field's help - text will be rendered unescaped in the page. Allowing HTML within help - text is an intentional design decision by Django; however, as a matter - of policy Wagtail does not allow editors to insert arbitrary HTML by - default, as this could potentially be used to carry out cross-site - scripting attacks, including privilege escalation. This functionality - should therefore not have been made available to editor-level users.

-

The vulnerability is not exploitable by an ordinary site visitor - without access to the Wagtail admin.

-
- - - - https://github.com/advisories/GHSA-2473-9hgq-j7xw - CVE-2020-15118 - - - 2020-07-20 - 2020-07-24 - - - - - pango -- buffer overflow - - - pango - 1.42.4_5 - - - - -
-

Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: - The heap based buffer overflow can be used to get code execution. The component is: - function name: pango_log2vis_get_embedding_levels, assignment of nchars and the loop - condition. The attack vector is: Bug can be used when application pass invalid utf-8 - strings to functions like pango_itemize.

-
- - - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010238 - https://nvd.nist.gov/vuln/detail/CVE-2019-1010238 - CVE-2019-1010238 - - - 2019-07-19 - 2020-07-23 - 2020-09-26 - - - - - Apache Tomcat -- Multiple Vulnerabilities - - - tomcat7 - 7.0.105 - - - tomcat85 - 8.5.57 - - - tomcat9 - 9.0.37 - - - tomcat-devel - 10.0.0.M7 - - - - -

The Apache Software Foundation reports:

-

An h2c direct connection did not release the HTTP/1.1 processor after - the upgrade to HTTP/2. If a sufficient number of such requests were - made, an OutOfMemoryException could occur leading to a denial of service.

-

The payload length in a WebSocket frame was not correctly validated. - Invalid payload lengths could trigger an infinite loop. Multiple - requests with invalid payload lengths could lead to a denial of service.

-

A specially crafted sequence of HTTP/2 requests could trigger high CPU - usage for several seconds. If a sufficient number of such requests were - made on concurrent HTTP/2 connections, the server could become unresponsive.

- - - - https://tomcat.apache.org/security-7.html - https://tomcat.apache.org/security-8.html - https://tomcat.apache.org/security-9.html - https://tomcat.apache.org/security-10.html - CVE-2020-11996 - CVE-2020-13934 - CVE-2020-13935 - - - 2020-07-05 - 2020-07-23 - 2020-07-23 - - - - - Python -- multiple vulnerabilities - - - python38 - 3.8.4 - - - - -

Python reports:

-
-

bpo-41162:Audit hooks are now cleared later during finalization to avoid missing - events.

-

bpo-29778:Ensure python3.dll is loaded from correct locations when Python is - embedded.

-
- - - - https://docs.python.org/3/whatsnew/changelog.html#python-3-8-4-final - CVE-2020-15523 - - - 2020-06-29 - 2020-07-20 - - - - - VirtualBox -- Multiple vulnerabilities - - - virtualbox-ose - 5.25.2.44 - 6.06.0.24 - 6.16.1.12 - - - - -

Oracle reports:

-
-

Vulnerabilities in VirtualBox core can allow users - with logon access to the infrastructure where Oracle VM - VirtualBox executes to compromise Oracle VM VirtualBox. - Successful attacks of these vulnerabilities can result - in unauthorized access to critical data, access to all - Oracle VM VirtualBox accessible data, unauthorized ability - to cause a hang or frequently repeatable crash (complete - DOS) or takeover of Oracle VM VirtualBox.

-
- - - - https://www.oracle.com/security-alerts/cpujul2020.html - CVE-2020-14628 - CVE-2020-14629 - CVE-2020-14646 - CVE-2020-14647 - CVE-2020-14648 - CVE-2020-14649 - CVE-2020-14650 - CVE-2020-14673 - CVE-2020-14674 - CVE-2020-14675 - CVE-2020-14676 - CVE-2020-14677 - CVE-2020-14694 - CVE-2020-14695 - CVE-2020-14698 - CVE-2020-14699 - CVE-2020-14700 - CVE-2020-14703 - CVE-2020-14704 - CVE-2020-14707 - CVE-2020-14711 - CVE-2020-14712 - CVE-2020-14713 - CVE-2020-14714 - CVE-2020-14715 - - - 2020-07-14 - 2020-07-19 - - - - - clamav -- multiple vulnerabilities - - - clamav - 0.102.4,1 - - - - -

Micah Snyder reports:

-
-
-
CVE-2020-3350
-
- Fixed a vulnerability a malicious user could exploit to replace - a scan target's directory with a symlink to another path to trick - clamscan, clamdscan, or clamonacc into removing or moving a different - file (such as a critical system file). The issue would affect users - that use the --move or --remove options for clamscan, clamdscan and - clamonacc. -
-
CVE-2020-3327
-
- Fixed a vulnerability in the ARJ archive-parsing module in ClamAV - 0.102.3 that could cause a denial-of-service (DoS) condition. - Improper bounds checking resulted in an out-of-bounds read that could - cause a crash. The previous fix for this CVE in version 0.102.3 was - incomplete. This fix correctly resolves the issue. -
-
CVE-2020-3481
-
- Fixed a vulnerability in the EGG archive module in ClamAV 0.102.0 - - 0.102.3 that could cause a denial-of-service (DoS) condition. - Improper error handling could cause a crash due to a NULL pointer - dereference. This vulnerability is mitigated for those using the - official ClamAV signature databases because the file type signatures - in daily.cvd will not enable the EGG archive parser in affected - versions. -
-
-
- - - - https://blog.clamav.net/2020/07/clamav-01024-security-patch-released.html - CVE-2020-3350 - CVE-2020-3327 - CVE-2020-3481 - - - 2020-07-16 - 2020-07-16 - - - - - OpenEXR/ilmbase 2.5.2 -- patch release with various bug/security fixes - - - ilmbase - 2.5.2 - - - openexr - 2.5.2 - - - - -

Cary Phillips reports:

-
-

openexr 2.5.2 [is a p]atch release with various bug/security and build/install fixes:

-
    -
  • Invalid input could cause a heap-use-after-free error in DeepScanLineInputFile::DeepScanLineInputFile()
    • -
  • Invalid chunkCount attributes could cause heap buffer overflow in getChunkOffsetTableSize()
    • -
  • Invalid tiled input file could cause invalid memory access TiledInputFile::TiledInputFile()
    • -
-
- - - - https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.5.2 - - - 2020-05-18 - 2020-07-16 - - - - - chromium -- multiple vulnerabilities - - - chromium - 84.0.4147.89 - - - - -

Chrome Releases reports:

-
-

This update contains 38 security fixes, including:

-
    -
  • [1103195] Critical CVE-2020-6510: Heap buffer overflow in - background fetch. Reported by Leecraso and Guang Gong of 360 - Alpha Lab working with 360 BugCloud on 2020-07-08
    • -
  • [1074317] High CVE-2020-6511: Side-channel information leakage - in content security policy. Reported by Mikhail Oblozhikhin on - 2020-04-24
    • -
  • [1084820] High CVE-2020-6512: Type Confusion in V8. Reported by - nocma, leogan, cheneyxu of WeChat Open Platform Security Team on - 2020-05-20
    • -
  • [1091404] High CVE-2020-6513: Heap buffer overflow in PDFium. - Reported by Aleksandar Nikolic of Cisco Talos on 2020-06-04
    • -
  • [1076703] High CVE-2020-6514: Inappropriate implementation in - WebRTC. Reported by Natalie Silvanovich of Google Project Zero on - 2020-04-30
    • -
  • [1082755] High CVE-2020-6515: Use after free in tab strip. - Reported by DDV_UA on 2020-05-14
    • -
  • [1092449] High CVE-2020-6516: Policy bypass in CORS. Reported by - Yongke Wang(@Rudykewang) and Aryb1n(@aryb1n) of Tencent Security - Xuanwu Lab on 2020-06-08
    • -
  • [1095560] High CVE-2020-6517: Heap buffer overflow in history. - Reported by ZeKai Wu (@hellowuzekai) of Tencent Security Xuanwu - Lab on 2020-06-16
    • -
  • [986051] Medium CVE-2020-6518: Use after free in developer - tools. Reported by David Erceg on 2019-07-20
    • -
  • [1064676] Medium CVE-2020-6519: Policy bypass in CSP. Reported - by Gal Weizman (@WeizmanGal) of PerimeterX on 2020-03-25
    • -
  • [1092274] Medium CVE-2020-6520: Heap buffer overflow in Skia. - Reported by Zhen Zhou of NSFOCUS Security Team on 2020-06-08
    • -
  • [1075734] Medium CVE-2020-6521: Side-channel information leakage - in autofill. Reported by Xu Lin (University of Illinois at - Chicago), Panagiotis Ilia (University of Illinois at Chicago), - Jason Polakis (University of Illinois at Chicago) on - 2020-04-27
    • -
  • [1052093] Medium CVE-2020-6522: Inappropriate implementation in - external protocol handlers. Reported by Eric Lawrence of Microsoft - on 2020-02-13
    • -
  • [1080481] Medium CVE-2020-6523: Out of bounds write in Skia. - Reported by Liu Wei and Wu Zekai of Tencent Security Xuanwu Lab on - 2020-05-08
    • -
  • [1081722] Medium CVE-2020-6524: Heap buffer overflow in - WebAudio. Reported by Sung Ta (@Mipu94) of SEFCOM Lab, Arizona - State University on 2020-05-12
    • -
  • [1091670] Medium CVE-2020-6525: Heap buffer overflow in Skia. - Reported by Zhen Zhou of NSFOCUS Security Team on 2020-06-05
    • -
  • [1074340] Low CVE-2020-6526: Inappropriate implementation in - iframe sandbox. Reported by Jonathan Kingston on 2020-04-24
    • -
  • [992698] Low CVE-2020-6527: Insufficient policy enforcement in - CSP. Reported by Zhong Zhaochen of andsecurity.cn on - 2019-08-10
    • -
  • [1063690] Low CVE-2020-6528: Incorrect security UI in basic - auth. Reported by Rayyan Bijoora on 2020-03-22
    • -
  • [978779] Low CVE-2020-6529: Inappropriate implementation in - WebRTC. Reported by kaustubhvats7 on 2019-06-26
    • -
  • [1016278] Low CVE-2020-6530: Out of bounds memory access in - developer tools. Reported by myvyang on 2019-10-21
    • -
  • [1042986] Low CVE-2020-6531: Side-channel information leakage in - scroll to text. Reported by Jun Kokatsu, Microsoft Browser - Vulnerability Research on 2020-01-17
    • -
  • [1069964] Low CVE-2020-6533: Type Confusion in V8. Reported by - Avihay Cohen @ SeraphicAlgorithms on 2020-04-11
    • -
  • [1072412] Low CVE-2020-6534: Heap buffer overflow in WebRTC. - Reported by Anonymous on 2020-04-20
    • -
  • [1073409] Low CVE-2020-6535: Insufficient data validation in - WebUI. Reported by Jun Kokatsu, Microsoft Browser Vulnerability - Research on 2020-04-22
    • -
  • [1080934] Low CVE-2020-6536: Incorrect security UI in PWAs. - Reported by Zhiyang Zeng of Tencent security platform department - on 2020-05-09
    • -
-
- - - - CVE-2020-6510 - CVE-2020-6511 - CVE-2020-6512 - CVE-2020-6513 - CVE-2020-6514 - CVE-2020-6515 - CVE-2020-6516 - CVE-2020-6517 - CVE-2020-6518 - CVE-2020-6519 - CVE-2020-6520 - CVE-2020-6521 - CVE-2020-6522 - CVE-2020-6523 - CVE-2020-6524 - CVE-2020-6525 - CVE-2020-6526 - CVE-2020-6527 - CVE-2020-6528 - CVE-2020-6529 - CVE-2020-6530 - CVE-2020-6531 - CVE-2020-6533 - CVE-2020-6534 - CVE-2020-6535 - CVE-2020-6536 - https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop.html - - - 2020-07-14 - 2020-07-15 - - - - - jenkins -- multiple vulnerabilities - - - jenkins - 2.245 - - - jenkins-lts - 2.235.2 - - - - -

Jenkins Security Advisory:

-
-

Description

-
(High) SECURITY-1868 / CVE-2020-2220
-

Stored XSS vulnerability in job build time trend

-
(High) SECURITY-1901 / CVE-2020-2221
-

Stored XSS vulnerability in upstream cause

-
(High) SECURITY-1902 / CVE-2020-2222
-

Stored XSS vulnerability in 'keep forever' badge icons

-
(High) SECURITY-1945 / CVE-2020-2223
-

Stored XSS vulnerability in console links

-
- - - - CVE-2020-2220 - CVE-2020-2221 - CVE-2020-2222 - CVE-2020-2223 - https://www.jenkins.io/security/advisory/2020-07-15/ - - - 2020-07-15 - 2020-07-15 - - - - - MySQL -- Multiple vulnerabilities - - - mysql56-client - 5.6.49 - - - mysql56-server - 5.6.49 - - - mysql57-client - 5.7.31 - - - mysql57-server - 5.7.31 - - - mysql80-client - 8.0.21 - - - mysql80-server - 8.0.21 - - - - -

Oracle reports:

-
-

This Critical Patch Update contains 40 new security patches for - Oracle MySQL. 6 of these vulnerabilities may be remotely exploitable - without authentication, i.e., may be exploited over a network without - requiring user credentials.

-

The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle - MySQL is 9.8.

-

This Pre-Release Announcement provides advance information about the - Oracle Critical Patch Update for July 2020, which will be released on - Tuesday, July 14, 2020.

-
- - - - https://www.oracle.com/security-alerts/cpujul2020.html - - - 2020-07-07 - 2020-07-11 - - - - - FreeBSD -- IPv6 socket option race condition and use after free - - - FreeBSD-kernel - 12.112.1_7 - 11.411.4_1 - 11.311.3_11 - - - - -

Problem Description:

-

The IPV6_2292PKTOPTIONS set handler was missing synchronization, - so racing accesses could modify freed memory.

-

Impact:

-

A malicious user application could trigger memory corruption, leading - to privilege escalation.

- - - - CVE-2020-7457 - SA-20:20.ipv6 - - - 2020-07-09 - 2020-07-10 - - - - - FreeBSD -- posix_spawnp(3) buffer overflow - - - FreeBSD - 11.411.4_1 - - - - -

Problem Description:

-

posix_spawnp spawns a new thread with a limited stack allocated on the heap - before delegating to execvp for the final execution within that thread.

-

execvp would previously make unbounded allocations on the stack, directly - proportional to the length of the user-controlled PATH environment variable.

-

Impact:

-

Long values in the user-controlled PATH environment variable cause - posix_spawnp to write beyond the end of stack that was allocated, ultimately - overflowing the heap-allocated stack with a direct copy of the value stored - in PATH.

- - - - CVE-2020-7458 - SA-20:18.posix_spawnp - - - 2020-07-09 - 2020-07-10 - - - - - mybb -- multible vulnerabilities - - - mybb - 1.8.22 - - - - -

mybb Team reports:

-
-

High risk: Installer RCE on settings file write

-

Medium risk: Arbitrary upload paths and Local File Inclusion RCE

-

Medium risk: XSS via insufficient HTML sanitization of Blog feed and Extend data

-

Low risk: Open redirect on login

-

Low risk: SCEditor reflected XSS

-
- - - - https://blog.mybb.com/2019/12/30/mybb-1-8-22-released-security-maintenance-release/ - - - 2019-12-30 - 2020-07-09 - - - - - kramdown -- template option vulnerability - - - rubygem-kramdown - 2.3.0 - - - - -

kramdown news:

-
-

CVE-2020-14001 is addressed to avoid problems when using the - {::options /} extension together with the 'template' option.

-
- - - - https://kramdown.gettalong.org/news.html - CVE-2020-14001 - - - 2020-06-28 - 2020-07-08 - - - - - Mbed TLS -- Side-channel attack on ECC key import and validation - - - mbedtls - 2.16.7 - - - - -

Manuel Pégourié-Gonnard reports:

-
-

The scalar multiplication function in Mbed TLS accepts a random - number generator (RNG) as an optional argument and, if provided, - uses it to protect against some attacks.

-

It is the caller's responsibility to provide a RNG if protection - against side-channel attacks is desired; however two groups of - functions in Mbed TLS itself fail to pass a RNG:

-
    -
  1. mbedtls_pk_parse_key() and mbedtls_pk_parse_keyfile()
    2. -
  2. mbedtls_ecp_check_pub_priv() and mbedtls_pk_check_pair()
    3. -
-

When those functions are called, scalar multiplication is computed - without randomisation, a number of old and new attacks apply, - allowing a powerful local attacker to fully recover the private - key.

-
- - - - https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-07 - - - 2020-07-01 - 2020-07-07 - - - - - Gitlab -- Multiple Vulnerabilities - - - gitlab-ce - 13.1.013.1.3 - 13.0.013.0.9 - 012.10.14 - - - - -

Gitlab reports:

-
-

Workhorse bypass allows files in /tmp to be read via Maven Repository APIs

-
- - - - https://about.gitlab.com/releases/2020/07/06/critical-security-release-gitlab-13-1-3-released/ - CVE-2020-15525 - - - 2020-07-06 - 2020-07-07 - - - - - Python -- multiple vulnerabilities - - - python37 - 3.7.8 - - - - -

Python reports:

-
-

The AbstractBasicAuthHandler class of the urllib.request module uses an inefficient - regular expression which can be exploited by an attacker to cause a denial of service. - Fix the regex to prevent the catastrophic backtracking. Vulnerability reported by Ben - Caller and Matt Schwager.

-

Disallow control characters in hostnames in http.client, addressing CVE-2019-18348. - Such potentially malicious header injection URLs now cause a InvalidURL to be raised.

-

Disallow CR or LF in email.headerregistry.Address arguments to guard against header - injection attacks.

-
- - - - https://docs.python.org/3.7/whatsnew/changelog.html#changelog - CVE-2019-18348 - CVE-2020-8492 - - - 2019-10-24 - 2020-07-06 - - - - - samba -- Multiple Vulnerabilities - - - samba410 - 4.10.17 - - - samba411 - 4.11.11 - - - samba412 - 4.12.4 - - - - -

The Samba Team reports:

-
-

Four vulnerabilities were fixed in samba:

-
    -
  • CVE-2020-10730: NULL pointer de-reference and use-after-free in Samba AD DC LDAP Server with ASQ, VLV and paged_results
    • -
  • CVE-2020-10745: Parsing and packing of NBT and DNS packets can consume excessive CPU in the AD DC (only)
    • -
  • CVE-2020-10760: LDAP Use-after-free in Samba AD DC Global Catalog with paged_results and VLV
    • -
  • CVE-2020-14303: Empty UDP packet DoS in Samba AD DC nbtd
    • -
-
- - - - https://www.samba.org/samba/security/CVE-2020-10730.html - https://www.samba.org/samba/security/CVE-2020-10745.html - https://www.samba.org/samba/security/CVE-2020-10760.html - https://www.samba.org/samba/security/CVE-2020-14303.html - CVE-2020-10730 - CVE-2020-10745 - CVE-2020-10760 - CVE-2020-14303 - - - 2020-07-02 - 2020-07-02 - - - - - Anydesk -- Multiple Vulnerabilities - - - anydesk - 5.5.5 - - - - -

Anydesk reports:

-
-

AnyDesk before 5.5.3 on Linux and FreeBSD has a format string - vulnerability that can be exploited for remote code execution.

-
- - - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13160 - CVE-2020-13160 - - - 2020-06-10 - 2020-07-04 - - - - - py-matrix-synapse -- multiple vulnerabilities - - - py36-matrix-synapse - py37-matrix-synapse - py38-matrix-synapse - 1.15.2 - - - - -

Matrix developers report:

-
-

Due to the two security issues highlighted below, server administrators are encouraged to update Synapse. We are not aware of these vulnerabilities being exploited in the wild.

-
    -
  • A malicious homeserver could force Synapse to reset the state in a room to a small subset of the correct state. This affects all Synapse deployments which federate with untrusted servers.
    • -
  • HTML pages served via Synapse were vulnerable to clickjacking attacks. This predominantly affects homeservers with single-sign-on enabled, but all server administrators are encouraged to upgrade.
    • -
-
- - - - https://github.com/matrix-org/synapse/releases/tag/v1.15.2 - - - 2020-07-02 - 2020-07-03 - - - - - dbus file descriptor leak - - - dbus - 1.12.18 - - - - -

GitHub Security Lab reports:

-
-

D-Bus has a file descriptor leak, which can lead to denial of service when the dbus-daemon runs out of file descriptors. - An unprivileged local attacker can use this to attack the system dbus-daemon, leading to denial of service for all users of the machine.

-
- - - - https://gitlab.freedesktop.org/dbus/dbus/-/issues/294 - https://www.openwall.com/lists/oss-security/2020/06/04/3 - CVE-2020-12049 - - - 2020-04-09 - 2020-07-03 - - - - - Gitlab -- Multiple Vulnerabilities - - - gitlab-ce - 13.1.013.1.2 - 13.0.013.0.8 - 012.10.13 - - - - -

Gitlab reports:

-
-

Missing Permission Check on Time Tracking

-

Cross-Site Scripting in PyPi Files API

-

Insecure Authorization Check on Private Project Security Dashboard

-

Cross-Site Scripting in References

-

Cross-Site Scripting in Group Names

-

Cross-Site Scripting in Blob Viewer

-

Cross-Site Scripting in Error Tracking

-

Insecure Authorisation Check on Creation and Deletion of Deploy Tokens

-

User Name Format Restiction Bypass

-

Denial of Service in Issue Comments

-

Cross-Site Scripting in Wiki Pages

-

Private Merge Request Updates Leaked via Todos

-

Private User Activity Leaked via API

-

Cross-Site Scripting in Bitbucket Import Feature

-

Github Project Restriction Bypass

-

Update PCRE Dependency

-

Update Kaminari Gem

-

Cross-Site Scripting in User Profile

-

Update Xterm.js

-
- - - - https://about.gitlab.com/releases/2020/07/01/security-release-13-1-2-release/ - CVE-2020-14155 - CVE-2020-11082 - CVE-2019-0542 - - - 2020-07-01 - 2020-07-02 - - - - - coturn -- information leakage - - - coturn - 4.5.1.3 - - - - -

Felix Dörre reports:

-
-

The issue is that STUN/TURN response buffer is not initialized properly. (CWE 665) - This is a leak of information between different client connections. One client (an attacker) - could use their connection to intelligently query coturn to get interesting bytes in the - padding bytes from the connection of another client.

-
- - - - https://github.com/coturn/coturn/commit/fdf7065d0f8e676feaf6734e86370f6dadfb8eec - CVE-2020-4067 - - - 2020-06-30 - 2020-07-02 - - - - - powerdns-recursor -- access restriction bypass - - - powerdns-recursor - 4.3.04.3.2 - 4.2.04.2.3 - 4.1.04.1.17 - - - - -

PowerDNS Team reports:

-
-

CVE-2020-14196: An issue has been found in PowerDNS Recursor where the ACL applied to the internal - web server via webserver-allow-from is not properly enforced, allowing a remote attacker to send - HTTP queries to the internal web server, bypassing the restriction. - - In the default configuration the API webserver is not enabled. Only installations using a - non-default value for webserver and webserver-address are affected.

-
- - - - https://doc.powerdns.com/recursor/security-advisories/index.html - CVE-2020-14196 - - - 2020-07-01 - 2020-07-02 - - - - - drupal -- Multiple Vulnerabilities - - - drupal7 - 7.72 - - - - -

Drupal Security Team reports:

-
-

The Drupal core Form API does not properly handle certain form input - from cross-site requests, which can lead to other vulnerabilities.

-
- - - - https://www.drupal.org/sa-core-2020-004 - - - 2020-06-17 - 2020-07-01 - - - - - xrdp -- Local users can perform a buffer overflow attack against the xrdp-sesman service and then inpersonate it - - - xrdp - 0.9.13.1,1 - - - - -

Ashley Newson reports:

-
-

The xrdp-sesman service can be crashed by connecting over port 3350 and supplying a malicious payload. Once the xrdp-sesman process is dead, an unprivileged attacker on the server could then proceed to start their own imposter sesman service listening on port 3350.

-
- - - - https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-j9fv-6fwf-p3g4 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-4044 - CVE-2020-4044 - - - 2020-06-02 - 2020-06-30 - - - - - MongoDB -- Ensure RoleGraph can serialize authentication restrictions to BSON - - - mongodb36 - 3.6.18 - - - mongodb40 - 4.0.15 - - - mongodb42 - 4.2.3 - - - - -

reports:

-
-

Improper serialization of MongoDB Server's internal authorization state permits a user with valid credentials to bypass IP source address protection mechanisms following administrative action.

-

Credit
-Discovered by Tony Yesudas.

-
- - - - CVE-2020-7921 - - - 2020-01-10 - 2020-06-29 - - - - - libvorbis -- two vulnerabilities - - - libvorbis - 1.3.6_1,3 - - - - -

Two vulnerabilities were fixed in the upstream repository:

-
    -
  • The bark_noise_hybridmp function allows remote attackers - to cause a denial of service (out-of-bounds access and - application crash) or possibly have unspecified other - impact via a crafted file.
    • -
  • mapping0_forward does not validate the number of - channels, which allows remote attackers to cause a denial - of service (heap-based buffer overflow or over-read) or - possibly have unspecified other impact via a crafted - file.
    • -
- - - - https://www.openwall.com/lists/oss-security/2017/09/21/2 - CVE-2017-14160 - https://gitlab.xiph.org/xiph/vorbis/-/issues/2335 - CVE-2018-10392 - - - 2017-09-21 - 2020-06-28 - - - - - PuTTY -- Release 0.74 fixes two security vulnerabilities - - - putty - 0.74 - - - putty-gtk2 - 0.74 - - - putty-nogtk - 0.74 - - - - -

Simon Tatham reports:

-
-

[Release 0.74] fixes the following security issues:

-
  • New configuration option to disable PuTTY's default policy of - changing its host key algorithm preferences to prefer keys it - already knows. (There is a theoretical information leak in this - policy.) [CVE-2020-14002]
    • -
  • In some situations an SSH server could cause PuTTY to access freed - mdmory by pretending to accept an SSH key and then refusing the - actual signature. It can only happen if you're using an SSH agent.
    • -
-
- - - - https://lists.tartarus.org/pipermail/putty-announce/2020/000030.html - https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-dynamic-hostkey-info-leak.html - https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2020-2-ausnutzung-eines-informationslecks-fuer-gezielte-mitm-angriffe-auf-ssh-clients/ - CVE-2020-14002 - https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-agent-keylist-used-after-free.html - - - 2020-06-27 - 2020-06-28 - - - - - chromium -- multiple vulnerabilities - - - chromium - 83.0.4103.116 - - - - -

Chrome Releases reports:

-
-

This update includes 2 security fixes, including:

-
    -
  • [1092308] High CVE-2020-6509: Use after free in extensions. - Reported by Anonymous on 2020-06-08
    • -
-
- - - - CVE-2020-6509 - https://chromereleases.googleblog.com/2020/06/stable-channel-update-for-desktop_22.html - - - 2020-06-22 - 2020-06-24 - - - - - Machine-in-the-middle response injection attack when using STARTTLS with IMAP, POP3, and SMTP - - - mutt - 1.14.3 - - - - -

mutt 1.14.4 updates:

-
-

CVE-2020-14954 - Machine-in-the-middle response injection attack when using STARTTLS with IMAP, POP3, and SMTP

-
- - - - CVE-2020-14954 - https://gitlab.com/muttmua/mutt/-/commit/c547433cdf2e79191b15c6932c57f1472bfb5ff4 - - - 2020-06-16 - 2020-06-24 - - - - - IMAP fcc/postpone machine-in-the-middle attack - - - mutt - 1.14.2 - - - - -

mutt 1.14.3 updates:

-
-

CVE-2020-14093 - IMAP fcc/postpone man-in-the-middle attack via a PREAUTH response.

-
- - - - https://github.com/muttmua/mutt/commit/3e88866dc60b5fa6aaba6fd7c1710c12c1c3cd01 - CVE-2020-14093 - - - 2020-06-14 - 2020-06-24 - - - - - curl -- multiple vulnerabilities - - - curl - 7.20.07.71.0 - - - - -

curl security problems:

-
-

CVE-2020-8169: Partial password leak over DNS on HTTP redirect

-

libcurl can be tricked to prepend a part of the password to the - host name before it resolves it, potentially leaking the partial - password over the network and to the DNS server(s).

-

libcurl can be given a username and password for HTTP - authentication when requesting an HTTP resource - used for HTTP - Authentication such as Basic, Digest, NTLM and similar. The - credentials are set, either together with CURLOPT_USERPWD or - separately with CURLOPT_USERNAME and CURLOPT_PASSWORD. Important - detail: these strings are given to libcurl as plain C strings and - they are not supposed to be URL encoded.

-

In addition, libcurl also allows the credentials to be set in the - URL, using the standard RFC 3986 format: - http://user:password@host/path. In this case, the name and password - are URL encoded as that's how they appear in URLs.

-

If the options are set, they override the credentials set in the - URL.

-

Internally, this is handled by storing the credentials in the "URL - object" so that there is only a single set of credentials stored - associated with this single URL.

-

When libcurl handles a relative redirect (as opposed to an - absolute URL redirect) for an HTTP transfer, the server is only - sending a new path to the client and that path is applied on to the - existing URL. That "applying" of the relative path on top of an - absolute URL is done by libcurl first generating a full absolute - URL out of all the components it has, then it applies the redirect - and finally it deconstructs the URL again into its separate - components.

-

This security vulnerability originates in the fact that curl did - not correctly URL encode the credential data when set using one of - the curl_easy_setopt options described above. This made curl - generate a badly formatted full URL when it would do a redirect and - the final re-parsing of the URL would then go bad and wrongly - consider a part of the password field to belong to the host name.

-

The wrong host name would then be used in a name resolve lookup, - potentially leaking the host name + partial password in clear text - over the network (if plain DNS was used) and in particular to the - used DNS server(s).

-

CVE-2020-8177: curl overwrite local file with -J

-

curl can be tricked by a malicious server to overwrite a local - file when using -J (--remote-header-name) and -i (--include) in the - same command line.

-

The command line tool offers the -J option that saves a remote - file using the file name present in the Content-Disposition: - response header. curl then refuses to overwrite an existing local - file using the same name, if one already exists in the current - directory.

-

The -J flag is designed to save a response body, and so it doesn't - work together with -i and there's logic that forbids it. However, - the check is flawed and doesn't properly check for when the options - are used in the reversed order: first using -J and then -i were - mistakenly accepted.

-

The result of this mistake was that incoming HTTP headers could - overwrite a local file if one existed, as the check to avoid the - local file was done first when body data was received, and due to - the mistake mentioned above, it could already have received and - saved headers by that time.

-

The saved file would only get response headers added to it, as it - would abort the saving when the first body byte arrives. A - malicious server could however still be made to send back virtually - anything as headers and curl would save them like this, until the - first CRLF-CRLF sequence appears.

-

(Also note that -J needs to be used in combination with -O to have - any effect.)

-
- - - - https://curl.haxx.se/docs/security.html - https://curl.haxx.se/docs/CVE-2020-8169.html - https://curl.haxx.se/docs/CVE-2020-8177.html - CVE-2020-8169 - CVE-2020-8177 - - - 2020-06-24 - 2020-06-24 - - - - - CUPS -- memory corruption - - - cups - 2.3.3_1 - - - - -

Apple reports:

-
-
    -
  • CVE-2019-8842: The ippReadIO function may under-read an - extension.
    • -
  • CVE-2020-3898: The ppdOpen function did not handle invalid UI - constraint. ppdcSource::get_resolution function did not handle - invalid resolution strings. An application may be able to gain - elevated privileges.
    • -
-
- - - - https://github.com/apple/cups/releases/tag/v2.3.3 - https://support.apple.com/en-us/HT211100 - CVE-2019-8842 - CVE-2020-3898 - - - 2020-04-28 - 2020-06-24 - - - - - Rails -- permission vulnerability - - - rubygem-actionpack60 - 6.0.3.2 - - - - -

Ruby on Rails blog:

-
-

Rails 6.0.3.2 has been released! This version of Rails contains an - important security patch, and you should upgrade! The release contains - only one patch that addresses CVE-2020-8185.

-
- - - - https://weblog.rubyonrails.org/2020/6/17/Rails-6-0-3-2-has-been-released/ - https://github.com/rails/rails/blob/6-0-stable/actionpack/CHANGELOG.md - https://groups.google.com/forum/#!topic/rubyonrails-security/pAe9EV8gbM0 - CVE-2020-8185 - - - 2020-06-17 - 2020-06-22 - - - - - vlc heap-based buffer overflow - - - vlc - 3.0.11,4 - - - - -

Thomas Guillem reports:

-
-

A heap-based buffer overflow in the hxxx_AnnexB_to_xVC function in modules/packetizer/hxxx_nal.c in VideoLAN VLC media player before 3.0.11 - allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a crafted H.264 Annex-B video (.avi for example) file.

-
- - - - https://nvd.nist.gov/vuln/detail/CVE-2020-13428 - CVE-2020-13428 - - - 2020-05-27 - 2020-06-17 - - - - - Several issues in Lynis - - - lynis - 2.0.02.7.5 - - - - -

lynis update:

-

This release resolves two security issues

-
    -
  • CVE-2020-13882 - Discovered by Sander Bos, code submission by Katarina Durechova
    • -
  • CVE-2019-13033 - Discovered by Sander Bos
    • -
- - - - https://github.com/CISOfy/lynis/blob/master/CHANGELOG.md#security-issues - - - 2020-06-18 - 2020-06-18 - - - - - BIND -- Remote Denial of Service vulnerability - - - bind911 - 9.11.149.11.20 - - - bind916 - 9.16.09.16.4 - - - - -

ISC reports:

-
-

The asterisk character ("*") is allowed in DNS zone files, where - it is most commonly present as a wildcard at a terminal node of - the Domain Name System graph. However, the RFCs do not require - and BIND does not enforce that an asterisk character be present - only at a terminal node.

-

A problem can occur when an asterisk is present in an empty - non-terminal location within the DNS graph. If such a node exists, - after a series of queries, named can reach an inconsistent state - that results in the failure of an assertion check in rbtdb.c, - followed by the program exiting due to the assertion failure.

-
- - - - CVE-2020-8619 - https://kb.isc.org/docs/cve-2020-8619 - - - 2020-06-17 - 2020-06-18 - - - - - BIND -- Remote Denial of Service vulnerability - - - bind916 - 9.16.09.16.4 - - - - -

ISC reports:

-
-

An assertion check in BIND (that is meant to prevent going beyond - the end of a buffer when processing incoming data) can be - incorrectly triggered by a large response during zone transfer.

-
- - - - CVE-2020-8618 - https://kb.isc.org/docs/cve-2020-8618 - - - 2020-06-17 - 2020-06-18 - - - - - LibreOffice Security Advisory - - - libreoffice - 6.4.4 - - - - -

LibreOffice reports:

-
-

Two flaws were found in LibreOffice:

-
    -
  • CVE-2020-12802: remote graphics contained in docx format retrieved in 'stealth mode'
    • -
  • CVE-2020-12803: XForms submissions could overwrite local files
    • -
-
- - - - https://www.libreoffice.org/about-us/security/advisories/CVE-2020-12802 - https://www.libreoffice.org/about-us/security/advisories/cve-2020-12803 - CVE-2020-12802 - CVE-2020-12803 - - - 2020-06-08 - 2020-06-12 - - - - - several security issues in sqlite3 - - - sqlite3 - 3.32.2,1 - - - FreeBSD - 12.112.1_8 - 11.411.4_2 - 11.311.3_12 - - - - -

sqlite3 update:

-

Various security issues could be used by an attacker to cause SQLite to crash, resulting in a denial of service, or possibly execute arbitrary code.

-
    -
  • CVE-2020-11655: SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's initialization is mishandled.
    • -
  • CVE-2020-13434: SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c.
    • -
  • CVE-2020-13435: SQLite through 3.32.0 has a segmentation fault in sqlite3ExprCodeTarget in expr.c.
    • -
  • CVE-2020-13630: ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature.
    • -
  • CVE-2020-13631: SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c.
    • -
  • CVE-2020-13632: ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query.
    • -
- - - - https://nvd.nist.gov/vuln/detail/CVE-2020-11655 - CVE-2020-11655 - https://nvd.nist.gov/vuln/detail/CVE-2020-13434 - CVE-2020-13434 - https://nvd.nist.gov/vuln/detail/CVE-2020-13435 - CVE-2020-13435 - https://nvd.nist.gov/vuln/detail/CVE-2020-13630 - CVE-2020-13630 - https://nvd.nist.gov/vuln/detail/CVE-2020-13631 - CVE-2020-13631 - https://nvd.nist.gov/vuln/detail/CVE-2020-13632 - CVE-2020-13632 - SA-20:22.sqlite - - - 2020-05-25 - 2020-06-10 - 2020-08-06 - - - - - Node.js -- June 2020 Security Releases - - - node - 14.4.0 - - - node12 - 12.18.0 - - - node10 - 10.21.0 - - - - -

Node.js reports:

-
-

Updates are now available for all supported Node.js release lines for the following issues.

-

TLS session reuse can lead to host certificate verification bypass (High) (CVE-2020-8172)

-

The 'session' event could be emitted before the 'secureConnect' event. It should not be, because the - connection may fail to be authorized. If it was saved an authorized connection could be established - later with the session ticket. Note that the https agent caches sessions, so is vulnerable to this.

-

The 'session' event will now only be emitted after the 'secureConnect' event, and only for authorized - connections.

-

HTTP/2 Large Settings Frame DoS (Low) (CVE-2020-11080)

-

Receiving unreasonably large HTTP/2 SETTINGS frames can consume 100% CPU to process all the settings, - blocking all other activities until complete.

-

The HTTP/2 session frame is limited to 32 settings by default. This can be configured if necessary - using the maxSettings option.

-

napi_get_value_string_*() allows various kinds of memory corruption (High) (CVE-2020-8174)

-

Calling napi_get_value_string_latin1(), napi_get_value_string_utf8(), or napi_get_value_string_utf16() - with a non-NULL buf, and a bufsize of 0 will cause the entire string value to be written to buf, - probably overrunning the length of the buffer.

-

A exploit has not been reported and it may be difficult but the following is suggested:

-
    -
  • All users of LTS Node.js versions should update to the versions announced in this security post. - This will address the issue for any non pre-built add-on.
    • -
  • Maintainers who support EOL Node.js versions and/or build against a version of Node.js that did not - support N-API internally should update to use the new versions of node-addon-api 1.x and 2.x that - will be released soon after this announcement.
    • -
-

ICU-20958 Prevent SEGV_MAPERR in append (High) (CVE-2020-10531)

-

An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An - integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() - function in common/unistr.cpp.

-

Fix was applied to 10.x in an abundance of caution, even though there is no known way to trigger the - overflow in 10.x.

-
- - - - https://nodejs.org/en/blog/vulnerability/june-2020-security-releases/ - CVE-2020-8174 - CVE-2020-8172 - CVE-2020-10531 - CVE-2020-11080 - - - 2020-06-02 - 2020-06-12 - - - - - tcpreplay -- Multiple vulnerabilities - - - tcpreplay - 4.3.2 - - - - -

fklassen on Github reports:

-
-

This release fixes the following security issues:

-
    -
  • memory access in do_checksum()
    • -
  • NULL pointer dereference get_layer4_v6()
    • -
  • NULL pointer dereference get_ipv6_l4proto()
    • -
-
- - - - https://github.com/appneta/tcpreplay/releases/tag/v4.3.2 - CVE-2019-8381 - CVE-2019-8376 - CVE-2019-8377 - - - 2019-03-12 - 2020-06-11 - - - - - znc -- Authenticated users can trigger an application crash - - - znc - 1.8.01.8.1 - - - - -

Mitre reports:

-
-

ZNC 1.8.0 up to 1.8.1-rc1 allows attackers to trigger an application - crash (with a NULL pointer dereference) if echo-message is not enabled - and there is no network.

-
- - - - CVE-2020-13775 - https://wiki.znc.in/ChangeLog/1.8.1 - - - 2020-06-02 - 2020-06-10 - - - - - NPM -- Multiple vulnerabilities - - - npm - 6.13.4 - - - - -

NPM reports:

-
-

Global node_modules Binary Overwrite

-

Symlink reference outside of node_modules

-

Arbitrary File Write

-
- - - - https://nodejs.org/en/blog/vulnerability/december-2019-security-releases/ - CVE-2019-16775 - CVE-2019-16776 - CVE-2019-16777 - - - 2019-12-18 - 2020-06-10 - - - - - libadplug -- Various vulnerabilities - - - libadplug - 2.3.3 - - - - -

Malvineous on Github reports:

-
-

This release fixes the following security issues:

-
    -
  • buffer overflow in .bmf
    • -
  • buffer overflow in .dtm
    • -
  • buffer overflow in .mkj
    • -
  • buffer overflow in .a2m
    • -
  • buffer overflow in .rad
    • -
  • buffer overflow in .mtk
    • -
  • double free and OOB reads in .u6m
    • -
-
- - - - https://github.com/adplug/adplug/releases/tag/adplug-2.3.3 - CVE-2019-14690 - CVE-2019-14691 - CVE-2019-14692 - CVE-2019-14732 - CVE-2019-14733 - CVE-2019-14734 - CVE-2019-15151 - - - 2020-06-08 - 2020-06-10 - - - - - zeek -- Various vulnerabilities - - - zeek - 3.0.7 - - - - -

Jon Siwek of Corelight reports:

-
-

This release fixes the following security issues:

-
    -
  • - Fix potential stack overflow in NVT analyzer
    • -
  • - Fix NVT analyzer memory leak from multiple telnet authn name options
    • -
  • - Fix multiple content-transfer-encoding headers causing a memory leak
    • -
  • - Fix potential leak of Analyzers added to tree during Analyzer::Done
    • -
  • - Prevent IP fragment reassembly on packets without minimal IP header
    • -
-
- - - - https://raw.githubusercontent.com/zeek/zeek/v3.0.7/NEWS - - - 2020-05-04 - 2020-06-10 - - - - - Flash Player -- arbitrary code execution - - - linux-flashplayer - 32.0.0.387 - - - - -

Adobe reports:

-
-
    -
  • This update resolves a use-after-free vulnerability that - could lead to arbitrary code execution (CVE-2020-9633).
    • -
-
- - - - CVE-2020-9633 - https://helpx.adobe.com/security/products/flash-player/apsb20-30.html - - - 2020-06-09 - 2020-06-09 - - - - - FreeBSD -- USB HID descriptor parsing error - - - FreeBSD-kernel - 12.112.1_6 - 11.311.3_10 - - - - -

Problem Description:

-

If the push/pop level of the USB HID state is not restored within - the processing of the same HID item, an invalid memory location may be - used for subsequent HID item processing.

-

Impact:

-

An attacker with physical access to a USB port may be able to use a - specially crafted USB device to gain kernel or user-space code execution.

- - - - CVE-2020-7456 - SA-20:17.usb - - - 2020-06-03 - 2020-06-09 - - - - - FreeRDP -- multiple vulnerabilities - - - freerdp - 2.1.1 - - - - -

The FreeRDP changelog reports 14 CVEs addressed after 2.0.0-rc4

- - - - https://github.com/FreeRDP/FreeRDP/blob/2.1.1/ChangeLog - CVE-2020-11521 - CVE-2020-11522 - CVE-2020-11523 - CVE-2020-11524 - CVE-2020-11525 - CVE-2020-11526 - CVE-2020-11039 - CVE-2020-11038 - CVE-2020-11043 - CVE-2020-11040 - CVE-2020-11041 - CVE-2020-11019 - CVE-2020-11017 - CVE-2020-11018 - - - 2020-04-10 - 2020-05-28 - - - - - chromium -- multiple vulnerabilities - - - chromium - 83.0.4103.97 - - - - -

Chrome Releases reports:

-
-

This update includes 5 security fixes. Below, we highlight fixes - that were contributed by external researchers.

-
    -
  • [1082105] High CVE-2020-6493: Use after free in - WebAuthentication. Reported by Anonymous on 2020-05-13
    • -
  • [1083972] High CVE-2020-6494: Incorrect security UI in payments. - Reported by Juho Nurminen on 2020-05-18
    • -
  • [1072116] High CVE-2020-6495: Insufficient policy enforcement in - developer tools. Reported by David Erceg on 2020-04-18
    • -
  • [1085990] High CVE-2020-6496: Use after free in payments. - Reported by Khalil Zhani on 2020-05-24
    • -
-
- - - - CVE-2020-6493 - CVE-2020-6494 - CVE-2020-6495 - CVE-2020-6496 - https://chromereleases.googleblog.com/2020/06/stable-channel-update-for-desktop.html - - - 2020-06-03 - 2020-06-05 - - - - - Gitlab -- Multiple Vulnerabilities - - - gitlab-ce - 13.0.013.0.4 - 12.10.012.10.9 - 10.6.012.9.9 - - - - -

Gitlab reports:

-
-

CI Token Access Control

-
- - - - https://about.gitlab.com/releases/2020/06/03/critical-security-release-13-0-4-released/ - - - 2020-06-03 - 2020-06-04 - - - - - Django -- multiple vulnerabilities - - - py36-django22 - py37-django22 - py38-django22 - 2.2.13 - - - py36-django30 - py37-django30 - py38-django30 - 3.0.7 - - - - -

Django security release reports:

-
-

CVE-2020-13254: Potential data leakage via malformed memcached keys

-

In cases where a memcached backend does not perform key validation, passing - malformed cache keys could result in a key collision, and potential data leakage. - In order to avoid this vulnerability, key validation is added to the memcached - cache backends.

-

CVE-2020-13596: Possible XSS via admin ForeignKeyRawIdWidget

-

Query parameters for the admin ForeignKeyRawIdWidget were not properly URL - encoded, posing an XSS attack vector. ForeignKeyRawIdWidget now ensures query - parameters are correctly URL encoded.

-
- - - - https://www.djangoproject.com/weblog/2020/jun/03/security-releases/ - CVE-2020-13254 - CVE-2020-13596 - - - 2020-06-01 - 2020-06-04 - - - - - malicious URLs may present credentials to wrong server - - - git - 2.26.02.26.1 - 2.25.02.25.3 - 2.24.02.24.2 - 2.23.02.23.2 - 2.22.02.22.3 - 2.21.02.21.2 - 2.20.02.20.3 - 2.19.02.19.4 - 2.18.02.18.3 - 02.17.4 - - - git-lite - 2.26.02.26.1 - 2.25.02.25.3 - 2.24.02.24.2 - 2.23.02.23.2 - 2.22.02.22.3 - 2.21.02.21.2 - 2.20.02.20.3 - 2.19.02.19.4 - 2.18.02.18.3 - 02.17.4 - - - git-gui - 2.26.02.26.1 - 2.25.02.25.3 - 2.24.02.24.2 - 2.23.02.23.2 - 2.22.02.22.3 - 2.21.02.21.2 - 2.20.02.20.3 - 2.19.02.19.4 - 2.18.02.18.3 - 02.17.4 - - - - -

git security advisory reports:

-
-

Git uses external "credential helper" programs to store and retrieve passwords or - other credentials from secure storage provided by the operating system. - Specially-crafted URLs that contain an encoded newline can inject unintended values - into the credential helper protocol stream, causing the credential helper to retrieve - the password for one server for an HTTP request being made to another - server, resulting in credentials for the former being sent to the - latter.

-
- - - - https://github.com/git/git/security/advisories/GHSA-qm7j-c969-7j4q - CVE-2020-5260 - - - 2020-04-14 - 2020-04-22 - - - - - malicious URLs can cause git to send a stored credential to wrong server - - - git - 2.26.02.26.2 - 2.25.02.25.4 - 2.24.02.24.3 - 2.23.02.23.3 - 2.22.02.22.4 - 2.21.02.21.3 - 2.20.02.20.4 - 2.19.02.19.5 - 2.18.02.18.4 - 02.17.5 - - - git-lite - 2.26.02.26.2 - 2.25.02.25.4 - 2.24.02.24.3 - 2.23.02.23.3 - 2.22.02.22.4 - 2.21.02.21.3 - 2.20.02.20.4 - 2.19.02.19.5 - 2.18.02.18.4 - 02.17.5 - - - git-gui - 2.26.02.26.2 - 2.25.02.25.4 - 2.24.02.24.3 - 2.23.02.23.3 - 2.22.02.22.4 - 2.21.02.21.3 - 2.20.02.20.4 - 2.19.02.19.5 - 2.18.02.18.4 - 02.17.5 - - - - -

git security advisory reports:

-
-

Git uses external "credential helper" programs to store and retrieve passwords or - other credentials from secure storage provided by the operating system. Specially-crafted - URLs that are considered illegal as of the recently published Git versions can cause Git - to send a "blank" pattern to helpers, missing hostname and protocol fields. Many helpers - will interpret this as matching any URL, and will return some unspecified stored password, - leaking the password to an attacker's server.

-
- - - - https://github.com/git/git/security/advisories/GHSA-hjc9-x69f-jqj7 - CVE-2020-11008 - - - 2020-04-20 - 2020-04-22 - - - - - GnuTLS -- flaw in TLS session ticket key construction - - - gnutls - 3.6.14 - - - - -

The GnuTLS project reports:

-
-

It was found that GnuTLS 3.6.4 introduced a regression in the TLS - protocol implementation. This caused the TLS server to not securely - construct a session ticket encryption key considering the - application supplied secret, allowing a MitM attacker to bypass - authentication in TLS 1.3 and recover previous conversations in TLS - 1.2.

-
- - - - https://gnutls.org/security-new.html#GNUTLS-SA-2020-06-03 - CVE-2020-13777 - - - 2020-06-03 - 2020-06-04 - - - - - websocket-extensions -- ReDoS vulnerability - - - rubygem-websocket-extensions - 0.1.5 - - - - -

Changelog:

-
-

Remove a ReDoS vulnerability in the header parser (CVE-2020-7663)

-
- - - - https://github.com/faye/websocket-extensions-ruby/blob/master/CHANGELOG.md - https://github.com/faye/websocket-extensions-ruby/commit/aa156a439da681361ed6f53f1a8131892418838b - CVE-2020-7663 - - - 2020-06-02 - 2020-06-03 - - - - - nghttp2 -- DoS vulnerability - - - nghttp2 - libnghttp2 - 1.41.0 - - - - -

nghttp2 security advisories:

-
-

The overly large HTTP/2 SETTINGS frame payload causes denial of service.

-

The proof of concept attack involves a malicious client constructing a - SETTINGS frame with a length of 14,400 bytes (2400 individual settings - entries) over and over again. The attack causes the CPU to spike at 100%.

-
- - - - https://github.com/nghttp2/nghttp2/security/advisories/GHSA-q5wr-xfw9-q7xr - CVE-2020-11080 - - - 2020-06-02 - 2020-06-03 - - - - - gitea -- multiple vulnerabilities - - - gitea - 1.11.6 - - - - -

The Gitea Team reports for release 1.11.6:

-
-
    -
  • Fix missing authorization check on pull for public repos of private/limited org (#11656) (#11683)
    • -
  • Use session for retrieving org teams (#11438) (#11439)
    • -
-
- - - - https://github.com/go-gitea/gitea/releases/tag/v1.11.6 - ports/246892 - - - 2020-03-01 - 2020-05-31 - - - - - kaminari -- potential XSS vulnerability - - - rubygem-kaminari-core - 1.2.1 - - - - -

Kaminari Security Advisories:

-
-

There was a vulnerability in versions of Kaminari that would allow an - attacker to inject arbitrary code into pages with pagination links.

-

The 1.2.1 gem including the patch has already been released.

-

All past released versions are affected by this vulnerability.

-
- - - - https://github.com/kaminari/kaminari/security/advisories/GHSA-r5jw-62xg-j433 - https://github.com/kaminari/kaminari/blob/master/CHANGELOG.md#121 - https://github.com/kaminari/kaminari/pull/1020 - CVE-2020-11082 - - - 2020-04-22 - 2020-05-28 - - - - - Sane -- Multiple Vulnerabilities - - - sane-backends - 1.0.30 - - - - -

The Sane Project reports:

-
-

epson2: fixes CVE-2020-12867 (GHSL-2020-075) and several memory management issues found while addressing that CVE

-

epsonds: addresses out-of-bound memory access issues to fix CVE-2020-12862 (GHSL-2020-082) and CVE-2020-12863 (GHSL-2020-083), addresses a buffer overflow fixing CVE-2020-12865 (GHSL-2020-084) and disables network autodiscovery to mitigate CVE-2020-12866 (GHSL-2020-079), CVE-2020-12861 (GHSL-2020-080) and CVE-2020-12864 (GHSL-2020-081). Note that this backend does not support network scanners to begin with.

-

magicolor: fixes a floating point exception and uninitialized data read

-

fixes an overflow in sanei_tcp_read()

-
- - - - https://gitlab.com/sane-project/backends/-/releases/1.0.30 - CVE-2020-12861 - CVE-2020-12862 - CVE-2020-12863 - CVE-2020-12864 - CVE-2020-12865 - CVE-2020-12866 - CVE-2020-12867 - - - 2020-05-17 - 2020-05-28 - - - - - Gitlab -- Multiple Vulnerabilities - - - gitlab-ce - 13.0.013.0.1 - 12.10.012.10.7 - 12.9.012.9.8 - - - - -

Gitlab reports:

-
-

User Email Verification Bypass

-

OAuth Flow Missing Email Verification Checks

-

Notification Email Verification Bypass

-

Undisclosed Vulnerability on a Third-Party Rendering Engine

-

Group Sign-Up Restriction Bypass

-

Mirror Project Owner Impersonation

-

Missing Permission Check on Fork Relation Creation

-

Cross-Site Scripting in Repository Files API

-

Kubernetes Cluster Token Disclosure

-

Object Storage File Enumeration

-

Insecure Authorization Check on Project Deploy Keys

-

Cross-Site Scripting on Metrics Dashboard

-

Denial of Service on Custom Dashboards

-

Client-Side Code Injection through Mermaid Markup

-

Cross-Site Scripting on Static Site Editor

-

Disclosure of Amazon EKS Credentials

-

Denial of Service on Workhorse

-
- - - - https://about.gitlab.com/releases/2020/05/27/security-release-13-0-1-released/ - - - 2020-05-27 - 2020-05-28 - - - - - sympa -- Denial of service caused by malformed CSRF token - - - sympa - 6.2.54 - - - - -

Javier Moreno discovered a vulnerability in Sympa web - interface that can cause denial of service (DoS) attack.

-

By submitting requests with malformed parameters, this - flaw allows to create junk files in Sympa's directory - for temporary files. And particularly by tampering token - to prevent CSRF, it allows to originate exessive - notification messages to listmasters.

- - - - CVE-2020-9369 - https://sympa-community.github.io/security/2020-001.html - - - 2020-02-24 - 2020-05-22 - - - - - sympa - Security flaws in setuid wrappers - - - sympa - 6.2.56 - - - - -

A vulnerability has been discovered in Sympa web interface - by which attacker can execute arbitrary code with root privileges. - Sympa uses two sorts of setuid wrappers:

-
    -
  • FastCGI wrappers
    • -
  • newaliases wrapper
    • -
-

The FastCGI wrappers wwsympa-wrapper.fcgi and - sympa_soap_server-wrapper.fcgi were used to make the web - interface running under privileges of a dedicated user.

-

The newaliases wrapper (sympa_newaliases-wrapper) allows - Sympa to update the alias database with root privileges.

-

Since these setuid wrappers did not clear environment variables, - if environment variables like PERL5LIB were injected, - forged code might be loaded and executed under privileges of setuid-ed - users.

- - - - https://sympa-community.github.io/security/2020-002.html - - - 2020-05-24 - 2020-05-26 - - - - - powerdns-recursor -- multiple vulnerabilities - - - powerdns-recursor - 4.3.04.3.1 - 4.2.04.2.2 - 4.1.04.1.16 - - - - -

PowerDNS Team reports:

-
-

CVE-2020-10995: An issue in the DNS protocol has been found that allow malicious parties to use - recursive DNS services to attack third party authoritative name servers. The attack uses a crafted - reply by an authoritative name server to amplify the resulting traffic between the recursive and - other authoritative name servers. Both types of service can suffer degraded performance as an effect.

-

CVE-2020-12244: An issue has been found in PowerDNS Recursor 4.1.0 through 4.3.0 where records in - the answer section of a NXDOMAIN response lacking an SOA were not properly validated in - SyncRes::processAnswer. This would allow an attacker in position of man-in-the-middle to send a - NXDOMAIN answer for a name that does exist, bypassing DNSSEC validation.

-

CVE-2020-10030: An issue has been found in PowerDNS Authoritative Server allowing an attacker - with enough privileges to change the system's hostname to cause disclosure of uninitialized memory - content via a stack-based out-of-bounds read. It only occurs on systems where gethostname() does - not null-terminate the returned string if the hostname is larger than the supplied buffer. Linux - systems are not affected because the buffer is always large enough. OpenBSD systems are not affected - because the returned hostname is always null-terminated. Under some conditions this issue can lead - to the writing of one null-byte out-of-bounds on the stack, causing a denial of service or possibly - arbitrary code execution.

-
- - - - https://doc.powerdns.com/recursor/security-advisories/index.html - CVE-2020-10995 - CVE-2020-12244 - CVE-2020-10030 - - - 2020-05-19 - 2020-05-26 - 2020-05-29 - - - - - chromium -- multiple vulnerabilities - - - chromium - 83.0.4103.61 - - - - -

Google Chrome Releases reports:

-
-

This release includes 38 security fixes, including CVEs - CVE-2020-6465 through CVE-2020-6491.

-
- - - - CVE-2020-6465 - CVE-2020-6466 - CVE-2020-6467 - CVE-2020-6468 - CVE-2020-6469 - CVE-2020-6470 - CVE-2020-6471 - CVE-2020-6472 - CVE-2020-6473 - CVE-2020-6474 - CVE-2020-6475 - CVE-2020-6476 - CVE-2020-6477 - CVE-2020-6478 - CVE-2020-6479 - CVE-2020-6480 - CVE-2020-6481 - CVE-2020-6482 - CVE-2020-6483 - CVE-2020-6484 - CVE-2020-6485 - CVE-2020-6486 - CVE-2020-6487 - CVE-2020-6488 - CVE-2020-6489 - CVE-2020-6490 - CVE-2020-6491 - https://chromereleases.googleblog.com/2020/05/stable-channel-update-for-desktop_19.html - - - 2020-05-19 - 2020-05-24 - - - - - piwigo -- Multible Vulnerabilities - - - piwigo - 2.10.2 - - - - -

Piwigo reports:

-
-

Piwigo 2.10.1 is affected by stored XSS - via the Group Name Field to the group_list page.

-
- - - - http://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-8089 - CVE-2020-8089 - - - 2020-02-07 - 2020-05-23 - - - - - Apache Tomcat Remote Code Execution via session persistence - - - tomcat7 - 7.0.104 - - - tomcat85 - 8.5.55 - - - tomcat9 - 9.0.35 - - - tomcat-devel - 10.0.0.M5 - - - - -

The Apache Software Foundation reports:

-

Under certain circumstances an attacker will be able to trigger remote code execution via deserialization of the file under their control

- - - - http://tomcat.apache.org/security-7.html - http://tomcat.apache.org/security-8.html - http://tomcat.apache.org/security-9.html - http://tomcat.apache.org/security-10.html - CVE-2020-9484 - - - 2020-05-12 - 2020-05-22 - - - - - unbound -- mutliple vulnerabilities - - - unbound - 1.10.1 - - - FreeBSD - 12.112.1_7 - 11.411.4_1 - 11.311.3_11 - - - - -

NLNetLabs reports:

-
-

This release fixes CVE-2020-12662 and CVE-2020-12663.

-

Bug Fixes:

-
    -
  • CVE-2020-12662 Unbound can be tricked into - amplifying an incoming query into a large - number of queries directed to a target.
    • -
  • CVE-2020-12663 Malformed answers from - upstream name servers can be used to make - Unbound unresponsive.
    • -
-
- - - - https://lists.nlnetlabs.nl/pipermail/unbound-users/2020-May/006833.html - CVE-2020-12662 - CVE-2020-12663 - SA-20:19.unbound - - - 2020-05-19 - 2020-05-22 - 2020-07-10 - - - - - drupal -- Multiple Vulnerabilities - - - drupal7 - 7.70 - - - drupal8 - 8.8.6 - - - - -

Drupal Security Team reports:

-
-

The jQuery project released version 3.5.0, and as part of that, - disclosed two security vulnerabilities that affect all prior versions. - As mentioned in the jQuery blog, both are: ... Security issues in - jQuerys DOM manipulation methods, as in .html(), .append(), and the others. - Security advisories for both of these issues have been published on GitHub.

-

Drupal 7 has an Open Redirect vulnerability. - For example, a user could be tricked into visiting a specially crafted link - which would redirect them to an arbitrary external URL. The vulnerability is - caused by insufficient validation of the destination query parameter in the - drupal_goto() function.

-
- - - - https://www.drupal.org/sa-core-2020-002 - https://www.drupal.org/sa-core-2020-003 - - - 2020-05-20 - 2020-05-22 - - - - - Zabbix -- Remote code execution - - - zabbix3-server - zabbix3-proxy - 3.0.31 - - - - -

Zabbix reports:

-
-

Fixed security vulnerability cve-2020-11800 (remote code execution). - (ZBX-17600)

-
- - - - CVE-2020-11800 - https://www.zabbix.com/rn/rn3.0.31 - https://support.zabbix.com/browse/ZBX-17600 - - - 2020-04-15 - 2020-05-20 - - - - - Rails -- multiple vulnerabilities - - - rubygem-actionpack52 - rubygem-actionview52 - rubygem-activestorage52 - rubygem-activesupport52 - 5.2.4.3 - - - rubygem-actionpack60 - rubygem-actionview60 - rubygem-activestorage60 - rubygem-activesupport60 - 6.0.3.1 - - - - -

Ruby on Rails blog:

-
-

Hi everyone! Rails 5.2.4.3 and 6.0.3.1 have been released! These releases contain important security fixes, so please upgrade when you can.

-

Both releases contain the following fixes:

-

CVE-2020-8162: Circumvention of file size limits in ActiveStorage

-

CVE-2020-8164: Possible Strong Parameters Bypass in ActionPack

-

CVE-2020-8165: Potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore

-

CVE-2020-8166: Ability to forge per-form CSRF tokens given a global CSRF token

-

CVE-2020-8167: CSRF Vulnerability in rails-ujs

-
- - - - https://weblog.rubyonrails.org/2020/5/18/Rails-5-2-4-3-and-6-0-3-1-have-been-released/ - https://groups.google.com/forum/#!topic/rubyonrails-security/PjU3946mreQ - https://groups.google.com/forum/#!topic/rubyonrails-security/f6ioe4sdpbY - https://groups.google.com/forum/#!topic/rubyonrails-security/bv6fW4S0Y1c - https://groups.google.com/forum/#!topic/rubyonrails-security/NOjKiGeXUgw - https://groups.google.com/forum/#!topic/rubyonrails-security/x9DixQDG9a0 - CVE-2020-8162 - CVE-2020-8164 - CVE-2020-8165 - CVE-2020-8166 - CVE-2020-8167 - - - 2020-05-18 - 2020-05-19 - - - - - Dovecot -- Multiple vulnerabilities - - - dovecot - 2.3.10.1 - - - - -

Aki Tuomi reports:

-
-

Vulnerability Details: - Sending malformed NOOP command causes crash in submission, submission-login or - lmtp service. - -Risk: - Remote attacker can keep submission-login service down, causing denial of - service attack. For lmtp the risk is neglible, as lmtp is usually behind a - trusted MTA. - -Steps to reproduce: - Send ``NOOP EE"FY`` to submission port, or similarly malformed command.

-

Vulnerability Details: - - Sending command followed by sufficient number of newlines triggers a - use-after-free bug that might crash submission-login, submission or - lmtp service. - -Risk: - - Remote attacker can keep submission-login service down, causing denial - of service attack. For lmtp the risk is neglible, as lmtp is usually - behind a trusted MTA. - -Steps to reproduce: - - This can be currently reproduced with ASAN or Valgrind. Reliable way to - crash has not yet been discovered. -

-

Vulnerability Details: - Sending mail with empty quoted localpart causes submission or lmtp component - to crash. - -Risk: - Malicious actor can cause denial of service to mail delivery by repeatedly - sending mails with bad sender or recipient address. - -Steps to reproduce: - Send mail with envelope sender or recipient as <""@example.org>. - -Workaround: - For submission there is no workaround, but triggering the bug requires valid - credentials. - For lmtp, one can implement sufficient filtering on MTA level to prevent mails - with such addresses from ending up in LMTP delivery.

-
- - - - https://dovecot.org/pipermail/dovecot-news/2020-May/000438.html - CVE-2020-10957 - CVE-2020-10958 - CVE-2020-10967 - - - 2020-04-02 - 2020-05-18 - - - - - clamav -- multiple vulnerabilities - - - clamav - 0.102.3,1 - - - - -

Micah Snyder reports:

-
-

CVE-2020-3327: Fixed a vulnerability in the ARJ archive-parsing module - in ClamAV 0.102.2 that could cause a denial-of-service condition. - Improper bounds checking of an unsigned variable results in an - out-of-bounds read which causes a crash. Special thanks to Daehui Chang - and Fady Othman for helping identify the ARJ parsing vulnerability. -

-

CVE-2020-3341: Fixed a vulnerability in the PDF-parsing module in ClamAV - 0.101 - 0.102.2 that could cause a denial-of-service condition. Improper - size checking of a buffer used to initialize AES decryption routines - results in an out-of-bounds read, which may cause a crash. OSS-Fuzz - discovered this vulnerability. -

-
- - - - https://blog.clamav.net/2020/05/clamav-01023-security-patch-released.html - CVE-2020-3327 - CVE-2020-3341 - - - 2020-05-12 - 2020-05-14 - - - - - Rails -- remote code execution vulnerability - - - rubygem-actionview4 - 4.2.11.2 - - - - -

Ruby on Rails blog:

-
-

Due to an unfortunate oversight, Rails 4.2.11.2 has a missing constant - error. To address this Rails 4.2.11.3 has been released.

-

The original announcement for CVE-2020-8163 has a follow-up message - with an updated patch if you’re unable to use the gems.

-
- - - - https://weblog.rubyonrails.org/2020/5/16/rails-4-2-11-3-has-been-released/ - https://groups.google.com/forum/#!topic/rubyonrails-security/hWuKcHyoKh0 - CVE-2020-8163 - - - 2020-05-15 - 2020-05-16 - - - - - salt -- multiple vulnerabilities in salt-master process - - - py27-salt - py32-salt - py33-salt - py34-salt - py35-salt - py36-salt - py37-salt - py38-salt - 2019.2.4 - 30003000.2 - - - - -

F-Secure reports:

-
-

CVE-2020-11651 - Authentication bypass vulnerabilities

-

The ClearFuncs class processes unauthenticated requests and - unintentionally exposes the _send_pub() method, which can be used to - queue messages directly on the master publish server. Such messages - can be used to trigger minions to run arbitrary commands as root.

-

The ClearFuncs class also exposes the method _prep_auth_info(), - which returns the "root key" used to authenticate commands from the - local root user on the master server. This "root key" can then be - used to remotely call administrative commands on the master server. - This unintentional exposure provides a remote un-authenticated - attacker with root-equivalent access to the salt master.

-

-

CVE-2020-11652 - Directory traversal vulnerabilities

-

The wheel module contains commands used to read and write files - under specific directory paths. The inputs to these functions are - concatenated with the target directory and the resulting path is not - canonicalized, leading to an escape of the intended path restriction.

-

The get_token() method of the salt.tokens.localfs class (which is - exposed to unauthenticated requests by the ClearFuncs class) fails - to sanitize the token input parameter which is then used as a - filename, allowing insertion of ".." path elements and thus reading - of files outside of the intended directory. The only restriction is - that the file has to be deserializable by salt.payload.Serial.loads().

-
- - - - CVE-2020-11651 - CVE-2020-11652 - https://nvd.nist.gov/vuln/detail/CVE-2020-11651 - https://nvd.nist.gov/vuln/detail/CVE-2020-11652 - https://docs.saltstack.com/en/latest/topics/releases/2019.2.4.html - https://labs.f-secure.com/advisories/saltstack-authorization-bypass - https://blog.f-secure.com/new-vulnerabilities-make-exposed-salt-hosts-easy-targets/ - https://www.tenable.com/blog/cve-2020-11651-cve-2020-11652-critical-salt-framework-vulnerabilities-exploited-in-the-wild - - - 2020-04-30 - 2020-05-16 - - - - - json-c -- integer overflow and out-of-bounds write via a large JSON file - - - json-c - 0.14 - - - - -

Tobias Stöckmann reports:

-
-

- I have discovered a way to trigger an out of boundary write while - parsing a huge json file through a malicious input source. It can be - triggered if an attacker has control over the input stream or if a - huge load during filesystem operations can be triggered. -

-
- - - - https://github.com/json-c/json-c/pull/592 - https://github.com/json-c/json-c/pull/599 - CVE-2020-12762 - - - 2020-05-02 - 2020-05-14 - 2020-05-17 - - - - - typo3 -- multiple vulnerabilities - - - typo3-9-php72 - typo3-9-php73 - typo3-9-php74 - 9.5.17 - - - typo3-10-php72 - typo3-10-php73 - typo3-10-php74 - 10.4.2 - - - - -

Typo3 News:

-
-

CVE-2020-11063: TYPO3-CORE-SA-2020-001: Information Disclosure in - Password Reset

-

It has been discovered that time-based attacks can be used with the - password reset functionality for backend users. This allows an attacker - to verify whether a backend user account with a given email address - exists or not.

-

-

CVE-2020-11064: TYPO3-CORE-SA-2020-002: Cross-Site Scripting in Form - Engine

-

It has been discovered that HTML placeholder attributes containing - data of other database records are vulnerable to cross-site scripting. A - valid backend user account is needed to exploit this vulnerability.

-

-

CVE-2020-11065: TYPO3-CORE-SA-2020-003: Cross-Site Scripting in Link - Handling

-

It has been discovered that link tags generated by typolink - functionality are vulnerable to cross-site scripting - properties being - assigned as HTML attributes have not been parsed correctly.

-

-

CVE-2020-11066: TYPO3-CORE-SA-2020-004: Class destructors causing - side-effects when being unserialized

-

Calling unserialize() on malicious user-submitted content can result - in the following scenarios:

-

- trigger deletion of arbitrary directory in file system (if writable - for web server)

-

- trigger message submission via email using identity of web site - (mail relay)

-

Another insecure deserialization vulnerability is required to actually - exploit mentioned aspects.

-

-

CVE-2020-11067: TYPO3-CORE-SA-2020-005: Insecure Deserialization in - Backend User Settings

-

It has been discovered that backend user settings (in $BE_USER->uc) are - vulnerable to insecure deserialization. In combination with - vulnerabilities of 3rd party components this can lead to remote code - execution. A valid backend user account is needed to exploit this - vulnerability.

-

-

CVE-2020-11069: TYPO3-CORE-SA-2020-006: Same-Site Request Forgery to - Backend User Interface

-

It has been discovered that the backend user interface and install tool - are vulnerable to same-site request forgery. A backend user can be - tricked into interacting with a malicious resource an attacker - previously managed to upload to the web server - scripts are then - executed with the privileges of the victims’ user session.

-

In a worst case scenario new admin users can be created which can - directly be used by an attacker. The vulnerability is basically a - cross-site request forgery (CSRF) triggered by a cross-site scripting - vulnerability (XSS) - but happens on the same target host - thus, it’ - actually a same-site request forgery (SSRF).

-

Malicious payload such as HTML containing JavaScript might be provided - by either an authenticated backend user or by a non-authenticated user - using a 3rd party extension - e.g. file upload in a contact form with - knowing the target location.

-

The attacked victim requires an active and valid backend or install - tool user session at the time of the attack to be successful.

-
- - - - https://typo3.org/article/typo3-1042-and-9517-security-releases-published - https://get.typo3.org/release-notes/9.5.17 - https://get.typo3.org/release-notes/10.4.2 - https://typo3.org/security/advisory/typo3-core-sa-2020-001 - https://typo3.org/security/advisory/typo3-core-sa-2020-002 - https://typo3.org/security/advisory/typo3-core-sa-2020-003 - https://typo3.org/security/advisory/typo3-core-sa-2020-004 - https://typo3.org/security/advisory/typo3-core-sa-2020-005 - https://typo3.org/security/advisory/typo3-core-sa-2020-006 - CVE-2020-11063 - CVE-2020-11064 - CVE-2020-11065 - CVE-2020-11066 - CVE-2020-11067 - CVE-2020-11069 - - - 2020-05-12 - 2020-05-13 - - - - - FreeBSD -- Insufficient cryptodev MAC key length check - - - FreeBSD-kernel - 12.112.1_5 - - - - -

Problem Description:

-

Requests to create cryptography sessions using a MAC did not validate the - user-supplied MAC key length. The cryptodev module allocates a buffer whose - size is this user-suppled length.

-

Impact:

-

An unprivileged process can trigger a kernel panic.

- - - - CVE-2019-15879 - SA-20:15.cryptodev - - - 2020-01-20 - 2020-05-12 - - - - - FreeBSD -- Use after free in cryptodev module - - - FreeBSD-kernel - 12.112.1_5 - 11.311.3_9 - - - - -

Problem Description:

-

A race condition permitted a data structure in the kernel to be used - after it was freed by the cryptodev module.

-

Impact:

-

An unprivileged process can overwrite arbitrary kernel memory.

- - - - CVE-2019-15879 - SA-20:15.cryptodev - - - 2020-01-20 - 2020-05-12 - - - - - FreeBSD -- Improper checking in SCTP-AUTH shared key update - - - FreeBSD-kernel - 11.311.3_9 - - - - -

Problem Description:

-

The SCTP layer does improper checking when an application tries to update - a shared key. Therefore an unprivileged local user can trigger a use-after- - free situation, for example by specific sequences of updating shared keys and - closing the SCTP association.

-

Impact:

-

Triggering the use-after-free situation may result in unintended kernel - behaviour including a kernel panic.

- - - - CVE-2019-15878 - SA-20:14.sctp - - - 2019-09-19 - 2020-05-12 - - - - - FreeBSD -- Memory disclosure vulnerability in libalias - - - FreeBSD-kernel - 12.112.1_5 - 11.411.4_1 - 11.311.3_9 - - - - -

Problem Description:

-

The FTP packet handler in libalias incorrectly calculates some packet - lengths. This may result in disclosing small amounts of memory from the - kernel (for the in-kernel NAT implementation) or from the process space for - natd (for the userspace implementation).

-

Impact:

-

A malicious attacker could send specially constructed packets that exploit the - erroneous calculation allowing the attacker to disclose small amount of memory - either from the kernel (for the in-kernel NAT implementation) or from the - process space for natd (for the userspace implementation).

- - - - CVE-2020-7455 - SA-20:13.libalias - - - 2020-05-12 - 2020-05-12 - - - - - FreeBSD -- Insufficient packet length validation in libalias - - - FreeBSD-kernel - 12.112.1_5 - 11.411.4_1 - 11.311.3_9 - - - - -

Problem Description:

-

libalias(3) packet handlers do not properly validate the packet length before - accessing the protocol headers. As a result, if a libalias(3) module does - not properly validate the packet length before accessing the protocol header, - it is possible for an out of bound read or write condition to occur.

-

Impact:

-

A malicious attacker could send specially constructed packets that exploit - the lack of validation allowing the attacker to read or write memory either - from the kernel (for the in-kernel NAT implementation) or from the process - space for natd (for the userspace implementation).

- - - - CVE-2020-7454 - SA-20:12.libalias - - - 2020-05-12 - 2020-05-12 - - - - - qutebrowser -- Reloading page with certificate errors shows a green URL - - - qutebrowser - 1.11.1 - - - - -

Qutebrowser developers report:

-
-

After a certificate error was overridden by the user, - qutebrowser displays the URL as yellow (colors.statusbar.url.warn.fg). - However, when the affected website was subsequently loaded again, - the URL was mistakenly displayed as green (colors.statusbar.url.success_https). - While the user already has seen a certificate error prompt at this point - (or set content.ssl_strict to false which is not recommended), - this could still provide a false sense of security.

-
- - - - https://github.com/qutebrowser/qutebrowser/security/advisories/GHSA-4rcq-jv2f-898j - https://github.com/qutebrowser/qutebrowser/issues/5403 - CVE-2020-11054 - - - 2020-05-02 - 2020-05-09 - - - - - Python -- CRLF injection via the host part of the url passed to urlopen() - - - python27 - 2.7.18 - - - python38 - 3.8.3 - - - python37 - 3.7.7 - - - python36 - 3.6.10 - - - python35 - 3.5.9_4 - - - - -

Python reports:

-
-

An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x - through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as - demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in - the host component of a URL) followed by an HTTP header.

-
- - - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18348 - https://bugs.python.org/issue38576 - CVE-2019-18348 - - - 2019-10-24 - 2020-05-09 - 2020-06-13 - - - - - glpi -- stored XSS - - - glpi - 9.4.3 - - - - -

MITRE Corporation reports:

-
-

inc/user.class.php in GLPI before 9.4.3 allows XSS via a user picture.

-
- - - - https://github.com/glpi-project/glpi/commit/c2aa7a7cd6af28be3809acc7e7842d2d2008c0fb - https://www.synacktiv.com/ressources/advisories/GLPI_9.4.0_stored_XSS.pdf - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13239 - CVE-2019-13239 - - - 2019-02-25 - 2020-05-09 - - - - - zeek -- Various vulnerabilities - - - zeek - 3.0.6 - - - - -

Jon Siwek of Corelight reports:

-
-

This release fixes the following security issues:

-
    -
  • - Fix buffer over-read in Ident analyzer
    • -
  • - Fix SSL scripting error leading to uninitialized field - access and memory leak
    • -
  • - Fix POP3 analyzer global buffer over-read
    • -
  • - Fix potential stack overflows due to use of - Variable-Length-Arrays
    • -
-
- - - - https://raw.githubusercontent.com/zeek/zeek/v3.0.6/NEWS - - - 2020-05-06 - 2020-05-06 - - - - - Wagtail -- potential timing attack vulnerability - - - py35-wagtail - py36-wagtail - py37-wagtail - py38-wagtail - 2.7.3 - 2.82.8.2 - - - - -

Wagtail release notes:

-
-

CVE-2020-11037: Potential timing attack on password-protected private pages

-

This release addresses a potential timing attack on pages or documents - that have been protected with a shared password through Wagtail's - "Privacy" controls. This password check is performed through a - character-by-character string comparison, and so an attacker who is - able to measure the time taken by this check to a high degree of - accuracy could potentially use timing differences to gain knowledge of - the password. (This is understood to be feasible on a local network, but - not on the public internet.)

-
- - - - https://docs.wagtail.io/en/latest/releases/2.8.2.html - https://github.com/wagtail/wagtail/security/advisories/GHSA-jjjr-3jcw-f8v6 - CVE-2020-11037 - - - 2020-05-04 - 2020-05-05 - - - - - mailman -- arbitrary content injection vulnerability via options or private archive login pages - - - mailman - 2.1.30_4 - 2.1.312.1.33 - - - mailman-with-htdig - 2.1.30_4 - 2.1.312.1.33 - - - - -

Mark Sapiro reports:

-
-

A content injection vulnerability via the options login page has - been discovered and reported by Vishal Singh. -

-
-
-

- An issue similar to CVE-2018-13796 exists at different endpoint & param. It can lead to a phishing attack. -

-
-
-

- (added 2020-05-07) This is essentially the same as - https://bugs.launchpad.net/mailman/+bug/1873722 except the vector is - the private archive login page and the attack only succeeds if the - list's roster visibility (private_roster) setting is 'Anyone'. -

-
- - - - https://bazaar.launchpad.net/~mailman-coders/mailman/2.1/view/1845/NEWS#L8 - https://bugs.launchpad.net/mailman/+bug/1873722 - https://bugs.launchpad.net/mailman/+bug/1877379 - https://mail.python.org/archives/list/mailman-developers@python.org/thread/SYBIZ3MNSQZLKN6PVKO7ZKR7QMOBMS45/ - CVE-2018-13796 - - - 2020-04-20 - 2020-05-07 - - - - - cacti -- XSS exposure - - - cacti - 1.2.12 - - - - -

Cacti developer reports:

-
-

Lack of escaping of color items can lead to XSS exposure.

-
- - - - https://sourceforge.net/p/cacti/mailman/message/37000502/ - https://github.com/Cacti/cacti/blob/release/1.2.12/CHANGELOG - CVE-2020-7106 - ports/246164 - - - 2020-04-16 - 2020-05-04 - - - - - Squid -- multiple vulnerabilities - - - squid - 4.10 - - - - -

The Squid developers reports:

-
-

Improper Input Validation issues in HTTP Request - processing (CVE-2020-8449, CVE-2020-8450).

-

Information Disclosure issue in FTP Gateway - (CVE-2019-12528).

-

Buffer Overflow issue in ext_lm_group_acl helper - (CVE-2020-8517).

-
- - - - http://lists.squid-cache.org/pipermail/squid-announce/2020-February/000107.html - https://nvd.nist.gov/vuln/detail/CVE-2020-8449 - https://nvd.nist.gov/vuln/detail/CVE-2020-8450 - https://nvd.nist.gov/vuln/detail/CVE-2019-12528 - https://nvd.nist.gov/vuln/detail/CVE-2020-8517 - CVE-2020-8449 - CVE-2020-8450 - CVE-2019-12528 - CVE-2020-8517 - ports/244026 - - - 2020-02-10 - 2020-04-07 - - - - - taglib -- heap-based buffer over-read via a crafted audio file - - - taglib - 1.12.b.1 - - - - -

Webin security lab - dbapp security Ltd reports:

-
-

The TagLib::Ogg::FLAC::File::scan function in oggflacfile.cpp in TagLib 1.11.1 allows remote attackers to cause information disclosure (heap-based buffer over-read) via a crafted audio file.

-
- - - - https://seclists.org/fulldisclosure/2018/May/49 - CVE-2018-11439 - - - 2018-05-28 - 2020-05-03 - - - - - Gitlab -- Multiple Vulnerabilities - - - gitlab-ce - 12.10.012.10.2 - 12.9.012.9.5 - 8.4.012.8.10 - - - - -

Gitlab reports:

-
-

Path Traversal in NuGet Package Registry

-

Workhorse Bypass Leads to File Disclosure

-

OAuth Application Client Secrets Revealed

-

Code Owners Approval Rules Are Not Updated for Existing Merge Requests When Source Branch Changes

-

Code Owners Protection Not Enforced from Web UI

-

Repository Mirror Passwords Exposed To Maintainers

-

Admin Audit Log Page Denial of Service

-

Private Project ID Revealed Through Group API

-

Elasticsearch Credentials Logged to ELK

-

GitHub Personal Access Token Exposed on Integrations Page

-

Update Nokogiri dependency

-

Update OpenSSL Dependency

-

Update git

-
- - - - https://about.gitlab.com/releases/2020/04/30/security-release-12-10-2-released/ - CVE-2020-12448 - CVE-2020-10187 - CVE-2020-7595 - CVE-2020-1967 - CVE-2020-11008 - - - 2020-04-30 - 2020-05-01 - - - - - vlc -- Multiple vulnerabilities fixed in VLC media player - - - vlc - 3.0.10,4 - - - - -

VideoLAN reports:

-
-

Details

-

A remote user could:

-
    -
  • Create a specifically crafted image file that could trigger an out of bounds read
    • -
  • Send a specifically crafter request to the microdns service discovery, potentially triggering various memory management issues
    • -
-

Impact

-

-If successful, a malicious third party could trigger either a crash of VLC or an arbitratry code execution with the privileges of the target user. -

- While these issues in themselves are most likely to just crash the player, we can't exclude that they could be combined to leak user informations or remotely execute code. ASLR and DEP help reduce the likelyness of code execution, but may be bypassed.

-

- We have not seen exploits performing code execution through these vulnerabilities

-

CVE-2019-19721 affects VLC 3.0.8 and earlier, and only reads 1 byte out of bound

-
- - - - https://www.videolan.org/security/sb-vlc309.html - - - 2020-04-01 - 2020-04-29 - - - - - samba -- multiple vulnerabilities - - - samba410 - 4.10.15 - - - samba411 - 4.11.8 - - - samba412 - 4.12.2 - - - - -

The Samba Team reports:

-
-

CVE-2020-10700

-

A client combining the 'ASQ' and 'Paged Results' LDAP controls can cause a - use-after-free in Samba's AD DC LDAP server.

-

CVE-2020-10704

-

A deeply nested filter in an un-authenticated LDAP search can exhaust the - LDAP server's stack memory causing a SIGSEGV.

-
- - - - https://www.samba.org/samba/history/samba-4.12.2.html - CVE-2020-10700 - CVE-2020-10704 - - - 2020-04-29 - 2020-04-29 - - - - - ceph14 -- multiple security issues - - - ceph14 - 14.1.114.2.9 - - - - -

RedHat reports:

-
-

ceph: secure mode of msgr2 breaks both confidentiality and integrity aspects for long-lived sessions.

-
-
-

ceph: header-splitting in RGW GetObject has a possible XSS.

-
- - - - CVE-2020-1759 - https://www.openwall.com/lists/oss-security/2020/04/07/2 - CVE-2020-1760 - https://www.openwall.com/lists/oss-security/2020/04/07/1 - - - 2020-04-07 - 2020-04-14 - - - - - nested filters leads to stack overflow - - - openldap24-server - 2.4.50 - - - - -

Howard Chu reports:

-
-

nested filters leads to stack overflow

-
- - - - https://bugs.openldap.org/show_bug.cgi?id=9202 - CVE-2020-12243 - - - 2020-04-28 - 2020-04-28 - - - - - py-yaml -- FullLoader (still) exploitable for arbitrary command execution - - - py27-yaml - py35-yaml - py36-yaml - py37-yaml - py38-yaml - 5.3.1 - - - - -

Riccardo Schirone (https://github.com/ret2libc) reports:

-
-

In FullLoader python/object/new constructor, implemented by - construct_python_object_apply, has support for setting the - state of a deserialized instance through the set_python_instance_state - method. After setting the state, some operations are performed - on the instance to complete its initialization, however it is - possible for an attacker to set the instance' state in such a way - that arbitrary code is executed by the FullLoader.

-

This patch tries to block such attacks in FullLoader by - preventing set_python_instance_state from setting arbitrar - properties. It implements a blacklist that includes extend method - (called by construct_python_object_apply) and all special - methods (e.g. __set__, __setitem__, etc.).

-

Users who need special attributes being set in the state of a - deserialized object can still do it through the UnsafeLoader, which - however should not be used on untrusted input. Additionally, they can - subclass FullLoader and redefine state_blacklist_regexp to include the - additional attributes they need, passing the subclassed loader to - yaml.load.

-
- - - - https://bugzilla.redhat.com/show_bug.cgi?id=1807367 - https://github.com/yaml/pyyaml/pull/386 - CVE-2020-1747 - ports/245937 - - - 2020-03-02 - 2020-04-27 - 2020-04-29 - - - - - py-bleach -- regular expression denial-of-service - - - py27-bleach - py35-bleach - py36-bleach - py37-bleach - py38-bleach - 3.1.4 - - - - -

Bleach developers reports:

-
-

bleach.clean behavior parsing style attributes could result in a - regular expression denial of service (ReDoS).

-

Calls to bleach.clean with an allowed tag with an allowed style - attribute are vulnerable to ReDoS. For example, bleach.clean(..., - attributes={'a': ['style']}).

-
- - - - https://github.com/mozilla/bleach/security/advisories/GHSA-vqhp-cxgc-6wmm - https://bugzilla.mozilla.org/show_bug.cgi?id=1623633 - CVE-2020-6817 - ports/245943 - - - 2019-03-09 - 2020-04-26 - - - - - MySQL Server -- Multiple vulerabilities - - - mariadb101-server - 10.1.45 - - - mariadb102-server - 10.2.32 - - - mariadb103-server - 10.3.23 - - - mariadb104-server - 10.4.13 - - - mysql56-server - 5.6.48 - - - mysql57-server - 5.7.30 - - - mysql80-server - 8.0.20 - - - percona55-server - 5.5.68 - - - percona56-server - 5.6.48 - - - percona57-server - 5.7.30 - - - - -

Oracle reports:

-
-

This Critical Patch Update contains 45 new security patches for - Oracle MySQL. 9 of these vulnerabilities may be remotely exploitable - without authentication, i.e., may be exploited over a network without - requiring user credentials.

-

MariaDB reports 4 of these vulnerabilities exist in their software

-
- - - - https://www.oracle.com/security-alerts/cpujan2020.html - CVE-2019-5482 - CVE-2019-15601 - CVE-2020-2780 - CVE-2020-2790 - CVE-2020-2768 - CVE-2020-2804 - CVE-2020-2760 - CVE-2020-2806 - CVE-2020-2762 - CVE-2020-2814 - CVE-2020-2893 - CVE-2020-2895 - CVE-2020-2898 - CVE-2020-2903 - CVE-2020-2896 - CVE-2020-2770 - CVE-2020-2765 - CVE-2020-2892 - CVE-2020-2897 - CVE-2020-2923 - CVE-2020-2924 - CVE-2020-2901 - CVE-2020-2928 - CVE-2020-2904 - CVE-2020-2925 - CVE-2020-2759 - CVE-2020-2763 - CVE-2020-2761 - CVE-2020-2774 - CVE-2020-2853 - CVE-2020-2779 - CVE-2020-2812 - CVE-2019-1547 - CVE-2020-2926 - CVE-2020-2921 - CVE-2020-2930 - - - 2020-04-14 - 2020-04-23 - 2020-05-16 - - - - - MySQL Client -- Multiple vulerabilities - - - mysql56-client - 5.6.48 - - - mysql57-client - 5.7.30 - - - mysql80-client - 8.0.20 - - - mysql-connector-c - 8.0.20 - - - mysql-connector-c++ - 8.0.20 - - - mysql-connector-java - 8.0.20 - - - percona55-client - 5.5.68 - - - percona56-client - 5.6.48 - - - percona57-client - 5.7.30 - - - - -

Oracle reports:

-
-

This Critical Patch Update contains 45 new security patches for - Oracle MySQL. 9 of these vulnerabilities may be remotely exploitable - without authentication, i.e., may be exploited over a network without - requiring user credentials.

-
- - - - https://www.oracle.com/security-alerts/cpujan2020.html - CVE-2020-2752 - CVE-2020-2934 - CVE-2020-2875 - CVE-2020-2922 - CVE-2020-2933 - - - 2020-04-14 - 2020-04-23 - - - - - Nextcloud -- multiple vulnerabilities - - - nextcloud - 18.0.4 - - - - -

Nextcloud reports:

-
-

XSS in Files PDF viewer (NC-SA-2020-019)

-

Missing ownership check on remote wipe endpoint (NC-SA-2020-018)

-
- - - - https://nextcloud.com/security/advisories/ - https://nextcloud.com/security/advisory/?id=NC-SA-2020-018 - https://nextcloud.com/security/advisory/?id=NC-SA-2020-019 - - - 2020-03-18 - 2020-04-23 - - - - - Python -- Regular Expression DoS attack against client - - - python38 - 3.8.3 - - - python37 - 3.7.7 - - - python36 - 3.6.10 - - - python35 - 3.5.9_4 - - - python27 - 2.7.18 - - - - -

Ben Caller and Matt Schwager reports:

-
-

Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 - through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct - Regular Expression Denial of Service (ReDoS) attacks against a client - because of urllib.request.AbstractBasicAuthHandler catastrophic - backtracking.

-
- - - - https://python-security.readthedocs.io/vuln/urllib-basic-auth-regex.html - https://bugs.python.org/issue39503 - CVE-2020-8492 - ports/245819 - - - 2019-11-17 - 2020-04-23 - 2020-06-13 - - - - - Wagtail -- XSS vulnerability - - - py35-wagtail - py36-wagtail - py37-wagtail - py38-wagtail - 2.7.2 - - - - -

Wagtail release notes:

-
-

CVE-2020-11001: Possible XSS attack via page revision comparison view

-

This release addresses a cross-site scripting (XSS) vulnerability on - the page revision comparison view within the Wagtail admin interface. A - user with a limited-permission editor account for the Wagtail admin - could potentially craft a page revision history that, when viewed by a - user with higher privileges, could perform actions with that user - credentials. The vulnerability is not exploitable by an ordinary site - visitor without access to the Wagtail admin.

-
- - - - https://docs.wagtail.io/en/latest/releases/2.7.2.html - https://github.com/advisories/GHSA-v2wc-pfq2-5cm6 - CVE-2020-11001 - - - 2020-04-03 - 2020-04-22 - - - - - libntlm -- buffer overflow vulnerability - - - libntlm - 1.6 - - - - -

NVD reports:

-
-

Libntlm through 1.5 relies on a fixed buffer size for - tSmbNtlmAuthRequest, tSmbNtlmAuthChallenge, and tSmbNtlmAuthResponse - read and write operations, as demonstrated by a stack-based buffer - over-read in buildSmbNtlmAuthRequest in smbutil.c for a crafted NTLM - request.

-
- - - - https://gitlab.com/jas/libntlm/-/issues/2 - https://nvd.nist.gov/vuln/detail/CVE-2019-17455 - CVE-2019-17455 - - - 2019-10-08 - 2020-04-21 - - - - - OpenSSL remote denial of service vulnerability - - - FreeBSD - 12.112.1_4 - - - openssl - 1.1.1,11.1.1g,1 - - - - -

Problem Description:

-

Server or client applications that call the SSL_check_chain() - function during or after a TLS 1.3 handshake may crash due to a NULL - pointer dereference as a result of incorrect handling of the - "signature_algorithms_cert" TLS extension. The crash occurs if an - invalid or unrecognized signature algorithm is received from the - peer.

-

Impact:

-

A malicious peer could exploit the NULL pointer dereference crash, - causing a denial of service attack.

- - - - CVE-2020-1967 - SA-20:11.openssl - https://www.openssl.org/news/secadv/20200421.txt - - - 2020-04-21 - 2020-04-21 - 2020-04-22 - - - - - FreeBSD -- ipfw invalid mbuf handling - - - FreeBSD-kernel - 12.112.1_4 - 11.311.3_8 - - - - -

Problem Description:

-

Incomplete packet data validation may result in accessing - out-of-bounds memory (CVE-2019-5614) or may access memory after it has - been freed (CVE-2019-15874).

-

Impact:

-

Access to out of bounds or freed mbuf data can lead to a kernel panic or - other unpredictable results.

- - - - CVE-2019-5614 - CVE-2019-15874 - SA-20:10.ipfw - - - 2020-04-21 - 2020-04-21 - - - - - py-twisted -- multiple vulnerabilities - - - py27-twisted - py35-twisted - py36-twisted - py37-twisted - py38-twisted - 20.3.0 - - - - -

Twisted developers reports:

-
-

All HTTP clients in twisted.web.client now raise a ValueError when - called with a method and/or URL that contain invalid characters. This - mitigates CVE-2019-12387. Thanks to Alex Brasetvik for reporting this - vulnerability.

-

The HTTP/2 server implementation now enforces TCP flow control on - control frame messages and times out clients that send invalid data - without reading responses. This closes CVE-2019-9512 (Ping Flood), - CVE-2019-9514 (Reset Flood), and CVE-2019-9515 (Settings Flood). Thanks - to Jonathan Looney and Piotr Sikora.

-

twisted.web.http was subject to several request smuggling attacks. - Requests with multiple Content-Length headers were allowed - (CVE-2020-10108, thanks to Jake Miller from Bishop Fox and ZeddYu Lu - for reporting this) and now fail with a 400; requests with a - Content-Length header and a Transfer-Encoding header honored the first - header (CVE-2020-10109, thanks to Jake Miller from Bishop Fox for - reporting this) and now fail with a 400; requests whose - Transfer-Encoding header had a value other than "chunked" and - "identity" (thanks to ZeddYu Lu) were allowed and now fail with a 400.

-
- - - - https://github.com/twisted/twisted/blob/twisted-20.3.0/NEWS.rst - CVE-2019-12387 - CVE-2019-9512 - CVE-2019-9514 - CVE-2019-9515 - CVE-2020-10108 - CVE-2020-10109 - ports/245252 - - - 2019-03-01 - 2020-04-21 - - - - - Client/server denial of service when handling AES-CTR ciphers - - - libssh - 0.8.00.8.9 - 0.9.00.9.4 - - - - -

The libssh team reports (originally reported by Yasheng Yang from - Google):

-
-

A malicious client or server could crash the counterpart implemented - with libssh AES-CTR ciphers are used and don't get fully initialized. It - will crash when it tries to cleanup the AES-CTR ciphers when closing the - connection.

-
- - - - https://www.libssh.org/security/advisories/CVE-2020-1730.txt" - CVE-2020-1730 - - - 2020-01-25 - 2020-04-19 - - - - - webkit2-gtk3 -- Denial of service - - - webkit2-gtk3 - 2.28.1 - - - - -

The WebKitGTK project reports the following vulnerability.

-
-

Processing maliciously crafted web content may lead to arbitrary code execution or application crash (denial of service). Description: A memory corruption issue (use-after-free) was addressed with improved memory handling.

-
- - - - https://webkitgtk.org/security/WSA-2020-0004.html - CVE-2020-11793 - - - 2020-04-16 - 2020-04-18 - - - - - drupal -- Drupal Core - Moderately critical - Third-party library - - - drupal8 - 8.8.4 - - - - -

Drupal Security Team reports:

-
-

The Drupal project uses the third-party library CKEditor, which has - released a security improvement that is needed to protect some - Drupal configurations.

-

Vulnerabilities are possible if Drupal is configured to use the - WYSIWYG CKEditor for your site's users. An attacker that can createor - edit content may be able to exploit this Cross Site Scripting (XSS) - vulnerability to target users with access to the WYSIWYG CKEditor, - and this may include site admins with privileged access.

-

The latest versions of Drupal update CKEditor to 4.14 to mitigate - the vulnerabilities.

-
- - - - https://www.drupal.org/sa-core-2020-001 - - - 2020-03-18 - 2020-04-17 - - - - - ansible - Vault password leak from temporary file - - - ansible - 2.8.9 - - - ansible27 - 2.7.17 - - - ansible26 - 2.7.17 - - - ansible25 - 2.7.17 - - - ansible24 - 2.7.17 - - - ansible23 - 2.7.17 - - - - -

Borja Tarraso reports:

-
-

A flaw was found in Ansible Engine when using Ansible Vault for editing - encrypted files. When a user executes "ansible-vault edit", another user - on the same computer can read the old and new secret, as it is created in - a temporary file with mkstemp and the returned file descriptor is closed - and the method write_data is called to write the existing secret in the - file. This method will delete the file before recreating it insecurely. - All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.

-
- - - - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1740 - https://github.com/ansible/ansible/issues/67798 - CVE-2020-1740 - - - 2020-02-12 - 2020-04-17 - - - - - ansible - subversion password leak from PID - - - ansible - 2.8.9 - - - ansible27 - 2.7.17 - - - ansible26 - 2.7.17 - - - ansible25 - 2.7.17 - - - ansible24 - 2.7.17 - - - ansible23 - 2.7.17 - - - - -

Borja Tarraso reports:

-
-

A flaw was found in Ansible 2.7.16 and prior, 2.8.8 and prior, and 2.9.5 - and prior when a password is set with the argument "password" of svn module, - it is used on svn command line, disclosing to other users within the same - node. An attacker could take advantage by reading the cmdline file from that - particular PID on the procfs.

-
- - - - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1739 - https://github.com/ansible/ansible/issues/67797 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FWDK3QUVBULS3Q3PQTGEKUQYPSNOU5M3/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QT27K5ZRGDPCH7GT3DRI3LO4IVDVQUB7/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U3IMV3XEIUXL6S4KPLYYM4TVJQ2VNEP2/ - CVE-2020-1739 - - - 2020-02-12 - 2020-04-17 - - - - - ansible - win_unzip path normalization - - - ansible - 2.8.9 - - - ansible27 - 2.7.17 - - - ansible26 - 2.7.17 - - - ansible25 - 2.7.17 - - - ansible24 - 2.7.17 - - - ansible23 - 2.7.17 - - - - -

Borja Tarraso reports:

-
-

A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and - prior when using the Extract-Zip function from the win_unzip module as the - extracted file(s) are not checked if they belong to the destination folder. An - attacker could take advantage of this flaw by crafting an archive anywhere in - the file system, using a path traversal. This issue is fixed in 2.10.

-
- - - - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1737 - https://github.com/ansible/ansible/issues/67795 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FWDK3QUVBULS3Q3PQTGEKUQYPSNOU5M3/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QT27K5ZRGDPCH7GT3DRI3LO4IVDVQUB7/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U3IMV3XEIUXL6S4KPLYYM4TVJQ2VNEP2/ - CVE-2020-1737 - - - 2020-02-12 - 2020-04-17 - - - - - chromium -- use after free - - - chromium - 81.0.4044.113 - - - - -

Google Chrome Releases reports:

-
-

[1067851] Critical CVE-2020-6457: Use after free in speech - recognizer. Reported by Leecraso and Guang Gong of Alpha Lab, Qihoo - 360 on 2020-04-04

-
- - - - https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_15.html - CVE-2020-6457 - - - 2020-04-15 - 2020-04-16 - - - - - openvpn -- illegal client float can break VPN session for other users - - - openvpn - 2.4.8_3 - - - openvpn-mbedtls - 2.4.8_3 - - - openvpn-devel - 202016 - - - - -

Lev Stipakov and Gert Doering report:

-
-

There is a time frame between allocating peer-id and initializing data - channel key (which is performed on receiving push request or on async - push-reply) in which the existing peer-id float checks do not work right.

-

If a "rogue" data channel packet arrives during that time frame from - another address and with same peer-id, this would cause client to float - to that new address.

-

The net effect of this behaviour is that the VPN session for the - "victim client" is broken. Since the "attacker client" does not have - suitable keys, it can not inject or steal VPN traffic from the other - session. The time window is small and it can not be used to attack - a specific client's session, unless some other way is found to make it - disconnect and reconnect first.

-
- - - - https://github.com/OpenVPN/openvpn/commit/f7b318f811bb43c0d3aa7f337ec6242ed2c33881 - https://sourceforge.net/p/openvpn/openvpn/ci/f7b318f811bb43c0d3aa7f337ec6242ed2c33881/ - https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg19720.html - https://community.openvpn.net/openvpn/ticket/1272 - https://patchwork.openvpn.net/patch/1077/ - CVE-2020-11810 - - - 2020-04-13 - 2020-04-16 - - - - - Mbed TLS -- Side channel attack on ECDSA - - - mbedtls - 2.16.6 - - - - -

Manuel Pégourié-Gonnard reports:

-
-

An attacker with access to precise enough timing and memory access - information (typically an untrusted operating system attacking a - secure enclave such as SGX or the TrustZone secure world) can fully - recover an ECDSA private key after observing a number of signature - operations.

-
- - - - https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-04 - CVE-2020-10932 - - - 2020-04-14 - 2020-04-15 - - - - - Gitlab -- Multiple Vulnerabilities - - - gitlab-ce - 12.9.012.9.3 - 12.8.012.8.9 - 012.7.9 - - - - -

Gitlab reports:

-
-

NuGet Package and File Disclosure through GitLab Workhorse

-

Job Artifact Uploads and File Disclosure through GitLab Workhorse

-

Incorrect membership following group removal

-

Logging of Praefect tokens

-

Update Rack dependency

-

Update OpenSSL dependency

-
- - - - https://about.gitlab.com/releases/2020/04/14/critical-security-release-gitlab-12-dot-9-dot-3-released/ - CVE-2020-11505 - CVE-2020-11506 - CVE-2020-11649 - CVE-2020-16782 - - - 2020-04-14 - 2020-04-15 - - - - - zeek -- Remote crash vulnerability - - - zeek - 3.0.4 - - - - -

Jon Siwek of Corelight reports:

-
-

This release fixes the following security issue:

-
    -
  • - An attacker can crash Zeek remotely via crafted packet - sequence.
    • -
-
- - - - https://raw.githubusercontent.com/zeek/zeek/e059d4ec2e689b3c8942f4aa08b272f24ed3f612/NEWS - - - 2020-04-14 - 2020-04-14 - - - - - chromium -- multiple vulnerabilities - - - chromium - 81.0.4044.92 - - - - -

Google Chrome Releases reports:

-
-

This updates includes 32 security fixes, including:

-
    -
  • [1019161] High CVE-2020-6454: Use after free in extensions. - Reported by Leecraso and Guang Gong of Alpha Lab, Qihoo 360 on - 2019-10-29
    • -
  • [1043446] High CVE-2020-6423: Use after free in audio. - Reported by Anonymous on 2020-01-18
    • -
  • [1059669] High CVE-2020-6455: Out of bounds read in WebSQL. - Reported by Nan Wang(@eternalsakura13) and Guang Gong of Alpha Lab, - Qihoo 360 on 2020-03-09
    • -
  • [1031479] Medium CVE-2020-6430: Type Confusion in V8. - Reported by Avihay Cohen @ SeraphicAlgorithms on 2019-12-06
    • -
  • [1040755] Medium CVE-2020-6456: Insufficient validation of - untrusted input in clipboard. Reported by Michał Bentkowski of - Securitum on 2020-01-10
    • -
  • [852645] Medium CVE-2020-6431: Insufficient policy - enforcement in full screen. Reported by Luan Herrera (@lbherrera_) - on 2018-06-14
    • -
  • [965611] Medium CVE-2020-6432: Insufficient policy - enforcement in navigations. Reported by David Erceg on - 2019-05-21
    • -
  • [1043965] Medium CVE-2020-6433: Insufficient policy - enforcement in extensions. Reported by David Erceg on - 2020-01-21
    • -
  • [1048555] Medium CVE-2020-6434: Use after free in devtools. - Reported by HyungSeok Han (DaramG) of Theori on 2020-02-04
    • -
  • [1032158] Medium CVE-2020-6435: Insufficient policy - enforcement in extensions. Reported by Sergei Glazunov of Google - Project Zero on 2019-12-09
    • -
  • [1034519] Medium CVE-2020-6436: Use after free in window - management. Reported by Igor Bukanov from Vivaldi on 2019-12-16
    • -
  • [639173] Low CVE-2020-6437: Inappropriate implementation in - WebView. Reported by Jann Horn on 2016-08-19
    • -
  • [714617] Low CVE-2020-6438: Insufficient policy enforcement in - extensions. Reported by Ng Yik Phang on 2017-04-24
    • -
  • [868145] Low CVE-2020-6439: Insufficient policy enforcement in - navigations. Reported by remkoboonstra on 2018-07-26
    • -
  • [894477] Low CVE-2020-6440: Inappropriate implementation in - extensions. Reported by David Erceg on 2018-10-11
    • -
  • [959571] Low CVE-2020-6441: Insufficient policy enforcement in - omnibox. Reported by David Erceg on 2019-05-04
    • -
  • [1013906] Low CVE-2020-6442: Inappropriate implementation in - cache. Reported by B@rMey on 2019-10-12
    • -
  • [1040080] Low CVE-2020-6443: Insufficient data validation in - developer tools. Reported by @lovasoa (Ophir LOJKINE) on - 2020-01-08
    • -
  • [922882] Low CVE-2020-6444: Uninitialized Use in WebRTC. - Reported by mlfbrown on 2019-01-17
    • -
  • [933171] Low CVE-2020-6445: Insufficient policy enforcement in - trusted types. Reported by Jun Kokatsu, Microsoft Browser - Vulnerability Research on 2019-02-18
    • -
  • [933172] Low CVE-2020-6446: Insufficient policy enforcement in - trusted types. Reported by Jun Kokatsu, Microsoft Browser - Vulnerability Research on 2019-02-18
    • -
  • [991217] Low CVE-2020-6447: Inappropriate implementation in - developer tools. Reported by David Erceg on 2019-08-06
    • -
  • [1037872] Low CVE-2020-6448: Use after free in V8. Reported by - Guang Gong of Alpha Lab, Qihoo 360 on 2019-12-26
    • -
-
- - - - CVE-2020-6423 - CVE-2020-6430 - CVE-2020-6431 - CVE-2020-6432 - CVE-2020-6433 - CVE-2020-6434 - CVE-2020-6435 - CVE-2020-6436 - CVE-2020-6437 - CVE-2020-6438 - CVE-2020-6439 - CVE-2020-6440 - CVE-2020-6441 - CVE-2020-6442 - CVE-2020-6443 - CVE-2020-6444 - CVE-2020-6445 - CVE-2020-6446 - CVE-2020-6447 - CVE-2020-6448 - CVE-2020-6454 - CVE-2020-6455 - CVE-2020-6456 - https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_7.html - - - 2020-04-07 - 2020-04-12 - - - - - chromium -- multiple vulnerabilities - - - chromium - 80.0.3987.162 - - - - -

Google Chrome Releases reports:

-
-

This update contains 8 security fixes.

-
    -
  • [1062247] High CVE-2020-6450: Use after free in WebAudio. - Reported by Man Yue Mo of Semmle Security Research Team on - 2020-03-17
    • -
  • [1061018] High CVE-2020-6451: Use after free in WebAudio. - Reported by Man Yue Mo of Semmle Security Research Team on - 2020-03-12
    • -
  • [1059764] High CVE-2020-6452: Heap buffer overflow in media - Reported by asnine on 2020-03-09
    • -
  • [1066247] Various fixes from internal audits, fuzzing and other - initiatives.
    • -
-
- - - - https://chromereleases.googleblog.com/2020/03/stable-channel-update-for-desktop_31.html - CVE-2020-6450 - CVE-2020-6451 - CVE-2020-6452 - - - 2020-03-31 - 2020-04-02 - - - - - HAproxy -- serious vulnerability affecting the HPACK decoder used for HTTP/2 - - - haproxy - 2.0.02.0.14 - - - haproxy18 - 1.8.01.8.25 - - - haproxy19 - 1.9.01.9.15 - - - haproxy21 - 2.1.02.1.4 - - - - -

The HAproxy Project reports:

-
-

The main driver for this release is that it contains a fix for a serious - vulnerability that was responsibly reported last week by Felix Wilhelm - from Google Project Zero, affecting the HPACK decoder used for HTTP/2. - CVE-2020-11100 was assigned to this issue.

-
- - - - CVE-2020-11100 - https://www.mail-archive.com/haproxy@formilux.org/msg36876.html - https://www.mail-archive.com/haproxy@formilux.org/msg36877.html - https://www.mail-archive.com/haproxy@formilux.org/msg36878.html - https://www.mail-archive.com/haproxy@formilux.org/msg36879.html - - - 2020-04-02 - 2020-04-02 - - - - - Apache -- Multiple vulnerabilities - - - apache24 - 2.4.43 - - - - -

Apache Team reports:

-
-

SECURITY: CVE-2020-1934

-

mod_proxy_ftp: Use of uninitialized value with malicious backend FTP - server.

-

SECURITY: CVE-2020-1927

-

rewrite, core: Set PCRE_DOTALL flag by default to avoid unpredictable - matches and substitutions with encoded line break characters. - The fix for CVE-2019-10098 was not effective.

-
- - - - https://downloads.apache.org/httpd/CHANGES_2.4.43 - CVE-2020-1934 - CVE-2020-1927 - - - 2020-04-01 - 2020-04-02 - - - - - cacti -- multiple vulnerabilities - - - cacti - 1.2.10 - - - - -

The Cacti developers reports:

-
-

When guest users have access to realtime graphs, remote code - could be executed (CVE-2020-8813).

-

Lack of escaping on some pages can lead to XSS exposure - (CVE-2020-7106).

-

Remote Code Execution due to input validation failure in - Performance Boost Debug Log (CVE-2020-7237).

-
- - - - https://github.com/Cacti/cacti/releases/tag/release%2F1.2.10 - https://nvd.nist.gov/vuln/detail/CVE-2020-8813 - https://nvd.nist.gov/vuln/detail/CVE-2020-7106 - https://nvd.nist.gov/vuln/detail/CVE-2020-7237 - CVE-2020-8813 - CVE-2020-7106 - CVE-2020-7237 - ports/245198 - - - 2020-02-04 - 2020-04-02 - - - - - GnuTLS -- flaw in DTLS protocol implementation - - - gnutls - 3.6.13 - - - - -

The GnuTLS project reports:

-
-

It was found that GnuTLS 3.6.3 introduced a regression in the DTLS - protocol implementation. This caused the DTLS client to not - contribute any randomness to the DTLS negotiation breaking the - security guarantees of the DTLS protocol.

-
- - - - https://gnutls.org/security-new.html#GNUTLS-SA-2020-03-31 - CVE-2020-11501 - - - 2020-03-31 - 2020-03-31 - - - - - PostgresSQL -- ALTER ... DEPENDS ON EXTENSION is missing authorization checks - - - postgresql12-server - 12.2 - - - postgresql11-server - 11.7 - - - postgresql10-server - 10.12 - - - postgresql96-server - 9.6.17 - - - - -

The PostgreSQL project reports:

-
-

- Versions Affected: 9.6 - 12 -

-

- The ALTER ... DEPENDS ON EXTENSION sub-commands do not perform - authorization checks, which can allow an unprivileged user to drop - any function, procedure, materialized view, index, or trigger under - certain conditions. This attack is possible if an administrator has - installed an extension and an unprivileged user can CREATE, or an - extension owner either executes DROP EXTENSION predictably or can be - convinced to execute DROP EXTENSION. -

-
- - - - https://www.postgresql.org/about/news/1960/ - CVE-2020-1720 - - - 2020-02-13 - 2020-03-29 - - - - - mediawiki -- multiple vulnerabilities - - - mediawiki131 - 1.31.7 - - - mediawiki133 - 1.33.3 - - - mediawiki134 - 1.34.1 - - - - -

Mediawiki reports:

-
-

Security fixes: - T246602:jquery.makeCollapsible allows applying event handler to any CSS - selector.

-
- - - - https://lists.wikimedia.org/pipermail/mediawiki-announce/2020-March/000247.html - - - 2020-03-02 - 2020-03-27 - - - - - Gitlab -- Multiple Vulnerabilities - - - gitlab-ce - 12.9.012.9.1 - 12.8.012.8.8 - 012.7.8 - - - - -

Gitlab reports:

-
-

Arbitrary File Read when Moving an Issue

-

Path Traversal in NPM Package Registry

-

SSRF on Project Import

-

External Users Can Create Personal Snippet

-

Triggers Decription Can be Updated by Other Maintainers in Project

-

Information Disclosure on Confidential Issues Moved to Private Programs

-

Potential DoS in Repository Archive Download

-

Blocked Users Can Still Pull/Push Docker Images

-

Repository Mirroring not Disabled when Feature not Activated

-

Vulnerability Feedback Page Was Leaking Information on Vulnerabilities

-

Stored XSS Vulnerability in Admin Feature

-

Upload Feature Allowed a User to Read Unauthorized Exported Files

-

Unauthorized Users Are Able to See CI Metrics

-

Last Pipeline Status of a Merge Request Leaked

-

Blind SSRF on FogBugz

-

Update Nokogiri dependency

-
- - - - https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/ - CVE-2020-10953 - CVE-2020-10956 - CVE-2020-10954 - CVE-2020-10952 - CVE-2020-10955 - CVE-2020-9795 - - - 2020-03-26 - 2020-03-26 - - - - - rubygem-json -- Unsafe Objection Creation Vulnerability in JSON (Additional fix) - - - rubygem-json - 2.3.0 - - - - -
-

When parsing certain JSON documents, the json gem (including the - one bundled with Ruby) can be coerced into creating arbitrary objects - in the target system.

-

This is the same issue as CVE-2013-0269. The previous fix was incomplete, - which addressed JSON.parse(user_input), but didn’t address some other - styles of JSON parsing including JSON(user_input) and - JSON.parse(user_input, nil).

-

See CVE-2013-0269 in detail. Note that the issue was exploitable to - cause a Denial of Service by creating many garbage-uncollectable - Symbol objects, but this kind of attack is no longer valid because - Symbol objects are now garbage-collectable. However, creating arbitrary - bjects may cause severe security consequences depending upon the - application code.

-

Please update the json gem to version 2.3.0 or later. You can use - gem update json to update it. If you are using bundler, please add - gem "json", ">= 2.3.0" to your Gemfile.

-
- - - - https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663/ - CVE-2020-10663 - - - 2020-03-19 - 2020-03-26 - 2020-04-02 - - - - - jenkins -- multiple vulnerabilities - - - jenkins - 2.227 - - - jenkins-lts - 2.204.5 - - - - -

Jenkins Security Advisory:

-
-

Description

-
(High) SECURITY-1774 / CVE-2020-2160
-

CSRF protection for any URL could be bypassed

-
(Medium) SECURITY-1781 / CVE-2020-2161
-

Stored XSS vulnerability in label expression validation

-
(Medium) SECURITY-1793 / CVE-2020-2162
-

Stored XSS vulnerability in file parameters

-
(Medium) SECURITY-1796 / CVE-2020-2163
-

Stored XSS vulnerability in list view column headers

-
- - - - CVE-2020-2160 - CVE-2020-2161 - CVE-2020-2162 - CVE-2020-2163 - https://jenkins.io/security/advisory/2020-03-25/ - - - 2020-03-25 - 2020-03-25 - - - - - phpMyAdmin -- SQL injection - - - phpMyAdmin - phpMyAdmin-php72 - phpMyAdmin-php73 - phpMyAdmin-php74 - phpMyAdmin5 - phpMyAdmin5-php72 - phpMyAdmin5-php73 - phpMyAdmin5-php74 - 4.9.5 - 5.05.0.2 - - - - -

phpMyAdmin Team reports:

-
-

PMASA-2020-2 SQL injection vulnerability in the user accounts page, particularly when changing a password

-

PMASA-2020-3 SQL injection vulnerability relating to the search feature

-

PMASA-2020-4 SQL injection and XSS having to do with displaying results

-

Removing of the "options" field for the external transformation

-
- - - - https://www.phpmyadmin.net/news/2020/3/21/phpmyadmin-495-and-502-are-released/ - - - 2020-03-21 - 2020-03-25 - - - - - puppetserver and puppetdb -- Puppet Server and PuppetDB may leak sensitive information via metrics API - - - puppetdb5 - 5.2.13 - - - puppetdb6 - 6.9.1 - - - puppetserver5 - 5.3.12 - - - puppetserver6 - 6.9.2 - - - - -

Puppetlabs reports:

-
-

Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints. For PuppetDB this may contain things like hostnames. Puppet Server reports resource names and titles for defined types (which may contain sensitive information) as well as function names and class names. Previously, these endpoints were open to the local network.

-

PE 2018.1.13 & 2019.4.0, Puppet Server 6.9.1 & 5.3.12, and PuppetDB 6.9.1 & 5.2.13 disable trapperkeeper-metrics /v1 metrics API and only allows /v2 access on localhost by default.

-
- - - - CVE-2020-7943 - https://puppet.com/security/cve/CVE-2020-7943/ - - - 2020-03-10 - 2020-03-23 - - - - - puppet6 -- Arbitrary Catalog Retrieval - - - puppet6 - 6.13.0 - - - - -

Puppetlabs reports:

-
-

Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a compromised certificate allowed access to everything in the infrastructure. When a node's catalog falls back to the `default` node, the catalog can be retrieved for a different node by modifying facts for the Puppet run. This issue can be mitigated by setting `strict_hostname_checking = true` in `puppet.conf` on your Puppet master.

-

Puppet 6.13.0 changes the default behavior for strict_hostname_checking from false to true. It is recommended that Puppet Open Source and Puppet Enterprise users that are not upgrading still set strict_hostname_checking to true to ensure secure behavior.

-
- - - - CVE-2020-7942 - https://puppet.com/security/cve/CVE-2020-7942/ - - - 2020-02-18 - 2020-03-23 - - - - - FreeBSD -- Kernel memory disclosure with nested jails - - - FreeBSD-kernel - 12.112.1_3 - 11.311.3_7 - - - - -

Problem Description:

-

A missing NUL-termination check for the jail_set(2) configration - option "osrelease" may return more bytes when reading the jail - configuration back with jail_get(2) than were originally set.

-

Impact:

-

For jails with a non-default setting of children.max > 0 ("nested - jails") a superuser inside a jail can create a jail and may be able to - read and take advantage of exposed kernel memory.

- - - - CVE-2020-7453 - SA-20:08.jail - - - 2020-03-19 - 2020-03-19 - - - - - FreeBSD -- Incorrect user-controlled pointer use in epair - - - FreeBSD-kernel - 12.112.1_3 - 11.311.3_7 - - - - -

Problem Description:

-

Incorrect use of a potentially user-controlled pointer in the kernel - allowed vnet jailed users to panic the system and potentially execute - aribitrary code in the kernel.

-

Impact:

-

Users with root level access (or the PRIV_NET_IFCREATE privilege) - can panic the system, or potentially escape the jail or execute - arbitrary code with kernel priviliges.

- - - - CVE-2020-7452 - SA-20:07.epair - - - 2020-03-19 - 2020-03-19 - - - - - FreeBSD -- Insufficient ixl(4) ioctl(2) privilege checking - - - FreeBSD-kernel - 12.112.1_3 - - - - -

Problem Description:

-

The driver-specific ioctl(2) command handlers in ixl(4) failed to - check whether the caller has sufficient privileges to perform the - corresponding operation.

-

Impact:

-

The ixl(4) handler permits unprivileged users to trigger updates to - the device's non-volatile memory (NVM).

- - - - CVE-2019-15877 - SA-20:06.if_ixl_ioctl - - - 2020-03-19 - 2020-03-19 - - - - - FreeBSD -- Insufficient oce(4) ioctl(2) privilege checking - - - FreeBSD-kernel - 12.112.1_3 - 11.311.3_7 - - - - -

Problem Description:

-

The driver-specific ioctl(2) command handlers in oce(4) failed to - check whether the caller has sufficient privileges to perform the - corresponding operation.

-

Impact:

-

The oce(4) handler permits unprivileged users to send passthrough - commands to device firmware.

- - - - CVE-2019-15876 - SA-20:05.if_oce_ioctl - - - 2020-03-19 - 2020-03-19 - - - - - FreeBSD -- TCP IPv6 SYN cache kernel information disclosure - - - FreeBSD-kernel - 12.112.1_3 - 11.311.3_7 - - - - -

Problem Description:

-

When a TCP server transmits or retransmits a TCP SYN-ACK segment - over IPv6, the Traffic Class field is not initialized. This also - applies to challenge ACK segments, which are sent in response to - received RST segments during the TCP connection setup phase.

-

Impact:

-

For each TCP SYN-ACK (or challenge TCP-ACK) segment sent over IPv6, - one byte of kernel memory is transmitted over the network.

- - - - CVE-2020-7451 - SA-20:04.tcp - - - 2020-03-19 - 2020-03-19 - - - - - www/py-bleach -- multiple vulnerabilities - - - py27-bleach - py35-bleach - py36-bleach - py37-bleach - py38-bleach - 3.1.2 - - - - -
-

* ``bleach.clean`` behavior parsing embedded MathML and SVG content - with RCDATA tags did not match browser behavior and could result in - a mutation XSS. -

-

Calls to ``bleach.clean`` with ``strip=False`` and ``math`` or - ``svg`` tags and one or more of the RCDATA tags ``script``, - ``noscript``, ``style``, ``noframes``, ``iframe``, ``noembed``, or - ``xmp`` in the allowed tags whitelist were vulnerable to a mutation - XSS. -

-

* ``bleach.clean`` behavior parsing ``noscript`` tags did not match - browser behavior. -

-

Calls to ``bleach.clean`` allowing ``noscript`` and one or more of - the raw text tags (``title``, ``textarea``, ``script``, ``style``, - ``noembed``, ``noframes``, ``iframe``, and ``xmp``) were vulnerable - to a mutation XSS. -

-
- - - - https://bugzilla.mozilla.org/show_bug.cgi?id=1615315 - https://bugzilla.mozilla.org/show_bug.cgi?id=1621692 - - - 2020-02-13 - 2020-03-18 - - - - - zeek -- potential denial of service issues - - - zeek - 3.0.3 - - - - -

Jon Siwek of Corelight reports:

-
-

This release addresses the following security issues:

-
    -
  • - Potential Denial of Service due to memory leak in DNS - TSIG message parsing.
    • -
  • - Potential Denial of Service due to memory leak (or assertion - when compiling with assertions enabled) when receiving a - second SSH KEX message after a first.
    • -
  • - Potential Denial of Service due to buffer read overflow - and/or memory leaks in Kerberos analyzer. The buffer - read overflow could occur when the Kerberos message - indicates it contains an IPv6 address, but does not send - enough data to parse out a full IPv6 address. A memory - leak could occur when processing KRB_KDC_REQ KRB_KDC_REP - messages for message types that do not match a known/expected - type.
    • -
  • - Potential Denial of Service when sending many zero-length - SSL/TLS certificate data. Such messages underwent the - full Zeek file analysis treatment which is expensive (and - meaninguless here) compared to how cheaply one can "create" - or otherwise indicate many zero-length contained in an - SSL message.
    • -
  • - Potential Denial of Service due to buffer read overflow - in SMB transaction data string handling. The length of - strings being parsed from SMB messages was trusted to be - whatever the message claimed instead of the actual length - of data found in the message.
    • -
  • - Potential Denial of Service due to null pointer dereference - in FTP ADAT Base64 decoding.
    • -
  • - Potential Denial of Service due buffer read overflow in - FTP analyzer word/whitespace handling. This typically - won't be a problem in most default deployments of Zeek - since the FTP analyzer receives data from a ContentLine - (NVT) support analyzer which first null-terminates the - buffer used for further FTP parsing.
    • -
-
- - - - https://github.com/zeek/zeek/blob/9dda3602a760f00d9532c6314ea79108106033fa/NEWS - - - 2020-02-25 - 2020-03-15 - - - - - Okular -- Local binary execution via action links - - - okular - 19.12.3_3 - - - - -

Albert Astals Cid:

-
-

Okular can be tricked into executing local binaries via specially crafted - PDF files.

-

This binary execution can require almost no user interaction.

-

No parameters can be passed to those local binaries.

-

We have not been able to identify any binary that will cause actual damage, - be it in the hardware or software level, when run without parameters.

- -

We remain relatively confident that for this issue to do any actual damage, -it has to run a binary specially crafted. That binary must have been deployed -to the user system via another method, be it the user downloading it directly -as an email attachment, webpage download, etc. or by the system being already -compromised.

-
- - - - https://kde.org/info/security/advisory-20200312-1.txt - - - 2020-03-12 - 2020-03-13 - - - - - Gitlab -- Vulnerability - - - gitlab-ce - 12.8.012.8.6 - - - - -

Gitlab reports:

-
-

Email Confirmation not Required on Sign-up

-
- - - - https://about.gitlab.com/releases/2020/03/11/critical-security-release-gitlab-12-dot-8-dot-6-released/ - - - 2020-03-11 - 2020-03-12 - - - - - Django -- potential SQL injection vulnerability - - - py27-django111 - py35-django111 - py36-django111 - py37-django111 - py38-django111 - 1.11.29 - - - py35-django22 - py36-django22 - py37-django22 - py38-django22 - 2.2.11 - - - py36-django30 - py37-django30 - py38-django30 - 3.0.4 - - - - -

MITRE CVE reports:

-
-

Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 - allows SQL Injection if untrusted data is used as a tolerance parameter - in GIS functions and aggregates on Oracle. By passing a suitably crafted - tolerance to GIS functions and aggregates on Oracle, it was possible to - break escaping and inject malicious SQL.

-
- - - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9402 - https://www.djangoproject.com/weblog/2020/mar/04/security-releases/ - CVE-2020-9402 - - - 2020-02-25 - 2020-03-12 - - - - - py-matrix-synapse -- users of single-sign-on are vulnerable to phishing - - - py35-matrix-synapse - py36-matrix-synapse - py37-matrix-synapse - 1.11.1 - - - - -

Matrix developers report:

-
-

[The 1.11.1] release includes a security fix impacting installations using Single Sign-On (i.e. SAML2 or CAS) for authentication. Administrators of such installations are encouraged to upgrade as soon as possible.

-
- - - - https://github.com/matrix-org/synapse/releases/tag/v1.11.1 - - - 2020-03-03 - 2020-03-11 - - - - - Node.js -- multiple vulnerabilities - - - node - 13.8.0 - - - node12 - 12.15.0 - - - node10 - 10.19.0 - - - - -

Node.js reports:

-
-

Updates are now available for all active Node.js release lines for the following issues.

-

HTTP request smuggling using malformed Transfer-Encoding header (Critical) (CVE-2019-15605)HTTP request smuggling using malformed Transfer-Encoding header (Critical) (CVE-2019-15605)

-

Affected Node.js versions can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system.

-

HTTP header values do not have trailing OWS trimmed (High) (CVE-2019-15606)

-

Optional whitespace should be trimmed from HTTP header values. Its presence may allow attackers to bypass security checks based on HTTP header values.

-

Remotely trigger an assertion on a TLS server with a malformed certificate string (High) (CVE-2019-15604)

-

Connecting to a NodeJS TLS server with a client certificate that has a type 19 string in its subjectAltName will crash the TLS server if it tries to read the peer certificate.

-

Strict HTTP header parsing (None)

-

Increase the strictness of HTTP header parsing. There are no known vulnerabilities addressed, but lax HTTP parsing has historically been a source of problems. Some commonly used sites are known to generate invalid HTTP headers, a --insecure-http-parser CLI option or insecureHTTPParser http option can be used if necessary for interoperability, but is not recommended.

-
- - - - https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/ - CVE-2019-15605 - CVE-2019-15606 - CVE-2019-15604 - - - 2020-02-06 - 2020-03-09 - - - - - gitea -- multiple vulnerabilities - - - gitea - 1.11.2 - - - - -

The Gitea Team reports for release 1.11.0:

-
-
    -
  • Never allow an empty password to validate (#9682) (#9683)
    • -
  • Prevent redirect to Host (#9678) (#9679)
    • -
  • Swagger hide search field (#9554)
    • -
  • Add "search" to reserved usernames (#9063)
    • -
  • Switch to fomantic-ui (#9374)
    • -
  • Only serve attachments when linked to issue/release and if accessible by user (#9340)
    • -
-
-

The Gitea Team reports for release 1.11.2:

-
-
    -
  • Ensure only own addresses are updated (#10397) (#10399)
    • -
  • Logout POST action (#10582) (#10585)
    • -
  • Org action fixes and form cleanup (#10512) (#10514)
    • -
  • Change action GETs to POST (#10462) (#10464)
    • -
  • Fix admin notices (#10480) (#10483)
    • -
  • Change admin dashboard to POST (#10465) (#10466)
    • -
  • Update markbates/goth (#10444) (#10445)
    • -
  • Update crypto vendors (#10385) (#10398)
    • -
-
- - - - https://blog.gitea.io/2020/02/gitea-1.11.0-is-released/ - https://blog.gitea.io/2020/03/gitea-1.11.2-is-released/ - ports/244025 - - - 2019-11-18 - 2020-03-07 - - - - - salt -- salt-api vulnerability - - - py27-salt - py32-salt - py33-salt - py34-salt - py35-salt - py36-salt - py37-salt - py38-salt - 2019.2.3 - - - - -

SaltStack reports:

-
-

With the Salt NetAPI enabled in addition to having a SSH roster - defined, unauthenticated access is possible when specifying the - client as SSH.

-

Additionally, when the raw_shell option is specified any arbitrary - command may be run on the Salt master when specifying SSH options.

-
- - - - CVE-2019-17361 - https://docs.saltstack.com/en/latest/topics/releases/2019.2.3.html - https://nvd.nist.gov/vuln/detail/CVE-2019-17361 - - - 2020-01-15 - 2020-03-07 - - - - - Gitlab -- Multiple Vulnerabilities - - - gitlab-ce - 12.8.012.8.2 - 12.7.012.7.7 - 012.6.8 - - - - -

Gitlab reports:

-
-

Directory Traversal to Arbitrary File Read

-

Account Takeover Through Expired Link

-

Server Side Request Forgery Through Deprecated Service

-

Group Two-Factor Authentication Requirement Bypass

-

Stored XSS in Merge Request Pages

-

Stored XSS in Merge Request Submission Form

-

Stored XSS in File View

-

Stored XSS in Grafana Integration

-

Contribution Analytics Exposed to Non-members

-

Incorrect Access Control in Docker Registry via Deploy Tokens

-

Denial of Service via Permission Checks

-

Denial of Service in Design For Public Issue

-

Incorrect Access Control via LFS Import

-

Unescaped HTML in Header

-

Private Merge Request Titles Leaked via Widget

-

Project Namespace Exposed via Vulnerability Feedback Endpoint

-

Denial of Service Through Recursive Requests

-

Project Authorization Not Being Updated

-

Incorrect Permission Level For Group Invites

-

Disclosure of Private Group Epic Information

-

User IP Address Exposed via Badge images

-
- - - - https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/ - CVE-2020-8113 - - - 2020-03-04 - 2020-03-06 - - - - - ntp -- Multiple vulnerabilities - - - FreeBSD - 11.311.3_7 - 12.112.1_3 - - - ntp - 4.2.8p14 - - - ntp-devel - 4.3.99_6 - - - - -

nwtime.org reports:

-
-

Three ntp vulnerabilities, Depending on configuration, may have - little impact up to termination of the ntpd process.

-

NTP Bug 3610: Process_control() should exit earlier on short - packets. On systems that override the default and enable ntpdc - (mode 7) fuzz testing detected that a short packet will cause - ntpd to read uninitialized data.

-

NTP Bug 3596: An unauthenticated unmonitored ntpd is vulnerable - to attack on IPv4 with highly predictable transmit timestamps. An - off-path attacker who can query time from the victim's ntp which - receives time from an unauthenticated time source must be able to - send from a spoofed IPv4 address of upstream ntp server and and - the victim must be able to process a large number of packets with - the spoofed IPv4 address of the upstream server. After eight or - more successful attacks in a row the attacker can either modify - the victim's clock by a small amount or cause ntpd to terminate. - The attack is especially effective when unusually short poll - intervals have been configured.

-

NTP Bug 3592: The fix for https://bugs.ntp.org/3445 introduced - a bug such that a ntp can be prevented from initiating a time - volley to its peer resulting in a DoS.

-

All three NTP bugs may result in DoS or terimation of the ntp - daemon.

-
- - - - SA-20:09.ntp - - - 2019-05-30 - 2020-03-03 - - - - - librsvg2 -- multiple vulnabilities - - - librsvg2 - 2.40.21 - - - librsvg2-rust - 2.41.02.46.3 - - - - -

Librsvg2 developers reports:

-
-

Backport the following fixes from 2.46.x:

-

Librsvg now has limits on the number of loaded XML elements, - and the number of referenced elements within an SVG document. This - is to mitigate malicious SVGs which try to consume all memory, and - those which try to consume an exponential amount of CPU time.

-

Fix stack exhaustion with circular references in <use> elements.

-

Fix a denial-of-service condition from exponential explosion - of rendered elements, through nested use of SVG <use> elements in - malicious SVGs. This is similar to the XML "billion laughs attack" - but for SVG instancing.

-
- - - - https://mail.gnome.org/archives/ftp-release-list/2020-February/msg00133.html - CVE-2019-20446 - - - 2020-02-26 - 2020-03-02 - - - - - TiMidity++ -- Multiple vulnerabilities - - - timidity++ - 2.15.0 - - - timidity++-emacs - 2.15.0 - - - timidity++-gtk - 2.15.0 - - - timidity++-motif - 2.15.0 - - - timidity++-slang - 2.15.0 - - - timidity++-tcltk - 2.15.0 - - - timidity++-xaw - 2.15.0 - - - timidity++-xskin - 2.15.0 - - - - -

qflb.wu of DBAPPSecurity reports:

-
-

Ihe insert_note_steps function in readmidi.c in TiMidity++ 2.14.0 - can cause a denial of service(divide-by-zero error and application - crash) via a crafted mid file.

-

The resample_gauss function in resample.c in TiMidity++ 2.14.0 - can cause a denial of service(heap-buffer-overflow) via a crafted - mid file.

-

The play_midi function in playmidi.c in TiMidity++ 2.14.0 can - cause a denial of service(large loop and CPU consumption) via - a crafted mid file.

-
- - - - https://seclists.org/fulldisclosure/2017/Jul/83 - CVE-2017-11546 - CVE-2017-11547 - CVE-2017-11549 - - - 2017-07-31 - 2020-03-02 - - - - - Solr -- multiple vulnerabilities - - - apache-solr - 8.3.1 - - - - -

Community reports:

-
-

8.1.1 and 8.2.0 users check ENABLE_REMOTE_JMX_OPTS setting

-

Apache Solr RCE vulnerability due to bad config default

-

Apache Solr RCE through VelocityResponseWriter

-
- - - - https://lucene.apache.org/solr/security.html - CVE-2019-17558 - - - 2019-12-30 - 2020-02-29 - - - - - OpenSMTPd -- LPE and RCE in OpenSMTPD's default install - - - opensmtpd - 6.6.4,1 - - - - -

OpenSMTPD developers reports:

-
-

An out of bounds read in smtpd allows an attacker to inject arbitrary - commands into the envelope file which are then executed as root. - Separately, missing privilege revocation in smtpctl allows arbitrary - commands to be run with the _smtpq group.

-

An unprivileged local attacker can read the first line of an arbitrary - file (for example, root's password hash in /etc/master.passwd) or the - entire contents of another user's file (if this file and - /var/spool/smtpd/ are on the same filesystem).

-
- - - - CVE-2020-8793 - https://www.openwall.com/lists/oss-security/2020/02/24/4 - CVE-2020-8794 - https://www.openwall.com/lists/oss-security/2020/02/24/5 - - - 2020-02-22 - 2020-02-24 - 2020-02-27 - - - - - Mbed TLS -- Cache attack against RSA key import in SGX - - - mbedtls - 2.16.5 - - - - -

Janos Follath reports:

-
-

If Mbed TLS is running in an SGX enclave and the adversary has - control of the main operating system, they can launch a side - channel attack to recover the RSA private key when it is being - imported.

-

The attack only requires access to fine grained measurements to - cache usage. Therefore the attack might be applicable to a scenario - where Mbed TLS is running in TrustZone secure world and the - attacker controls the normal world or possibly when Mbed TLS is - part of a hypervisor and the adversary has full control of a guest - OS.

-
- - - - https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-02 - - - 2020-02-18 - 2020-02-24 - - - - - Mbed TLS -- Side channel attack on ECDSA - - - mbedtls - 2.16.4 - - - - -

Janos Follath reports:

-
-

Our bignum implementation is not constant time/constant trace, so - side channel attacks can retrieve the blinded value, factor it (as - it is smaller than RSA keys and not guaranteed to have only large - prime factors), and then, by brute force, recover the key.

-
- - - - https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2019-12 - CVE-2019-18222 - - - 2019-10-25 - 2020-02-24 - - - - - WeeChat -- Multiple vulnerabilities - - - weechat - 2.7.1 - - - - -

The WeeChat project reports:

-
-

Buffer overflow when receiving a malformed IRC message 324 (channel - mode). (CVE-2020-8955)

-

Buffer overflow when a new IRC message 005 is received with longer - nick prefixes.

-

Crash when receiving a malformed IRC message 352 (WHO).

-
- - - - https://weechat.org/doc/security/ - CVE-2020-8955 - - - 2020-02-20 - 2020-02-21 - - - - - webkit-gtk3 -- Multiple vulnerabilities - - - webkit2-gtk3 - 2.26.4 - - - - -

The WebKitGTK project reports multiple vulnerabilities.

- - - - https://webkitgtk.org/security/WSA-2020-0002.html - CVE-2020-3862 - CVE-2020-3864 - CVE-2020-3865 - CVE-2020-3867 - CVE-2020-3868 - - - 2020-02-14 - 2020-02-19 - - - - - FreeBSD -- kernel stack data disclosure - - - FreeBSD-kernel - 12.112.1_2 - 12.012.0_13 - 11.311.3_6 - - - - -

Problem Description:

-

Due to incorrect initialization of a stack data structure, up to 20 - bytes of kernel data stored previously stored on the stack will be - exposed to a crashing user process.

-

Impact:

-

Sensitive kernel data may be disclosed.

- - - - CVE-2019-15875 - SA-20:03.thrmisc - - - 2020-01-28 - 2020-01-29 - - - - - FreeBSD -- Missing IPsec anti-replay window check - - - FreeBSD-kernel - 12.012.0_13 - - - - -

Problem Description:

-

A missing check means that an attacker can reinject an old packet and - it will be accepted and processed by the IPsec endpoint.

-

Impact:

-

The impact depends on the higher-level protocols in use over IPsec. - For example, an attacker who can capture and inject packets could - cause an action that was intentionally performed once to be repeated.

- - - - CVE-2019-5613 - SA-20:02.ipsec - - - 2020-01-28 - 2020-01-29 - - - - - FreeBSD -- libfetch buffer overflow - - - FreeBSD - 12.112.1_2 - 12.012.0_13 - 11.311.3_6 - - - - -

Problem Description:

-

A programming error allows an attacker who can specify a URL with a - username and/or password components to overflow libfetch(3) buffers.

-

Impact:

-

An attacker in control of the URL to be fetched (possibly via HTTP - redirect) may cause a heap buffer overflow, resulting in program - misbehavior or malicious code execution.

- - - - CVE-2020-7450 - SA-20:01.libfetch - - - 2020-01-28 - 2020-01-29 - - - - - Gitlab -- Vulnerability - - - gitlab-ce - 12.7.012.7.6 - 12.6.012.6.7 - 12.5.012.5.10 - - - - -

Gitlab reports:

-
-

Incorrect membership handling of group sharing feature

-
- - - - https://about.gitlab.com/releases/2020/02/13/critical-security-release-gitlab-12-dot-7-dot-6-released/ - CVE-2020-8795 - - - 2020-02-13 - 2020-02-13 - - - - - dovecot -- multiple vulnerabilities - - - dovecot - 2.3.9.3 - - - - -

Aki Tuomi reports:

-
-

lib-smtp doesn't handle truncated command parameters properly, resulting -in infinite loop taking 100% CPU for the process. This happens for LMTP -(where it doesn't matter so much) and also for submission-login where -unauthenticated users can trigger it.

-
-

Aki also reports:

-
-

Snippet generation crashes if: - - message is large enough that message-parser returns multiple body -blocks - The first block(s) don't contain the full snippet (e.g. full of -whitespace) - input ends with '>' -

-
- - - - https://dovecot.org/pipermail/dovecot-news/2020-February/000430.html - https://dovecot.org/pipermail/dovecot-news/2020-February/000431.html - CVE-2020-7046 - CVE-2020-7967 - - - 2020-01-14 - 2020-02-13 - - - - - grub2-bhyve -- multiple privilege escalations - - - grub2-bhyve - 0.40_8 - - - - -

Reno Robert reports:

- -
-

FreeBSD uses a two-process model for running a VM. For booting non-FreeBSD - guests, a modified grub-emu is used (grub-bhyve). Grub-bhyve executes command - from guest grub.cfg file. This is a security problem because grub was never - written to handle inputs from OS as untrusted. In the current design, grub - and guest OS works across trust boundaries. This exposes a grub to untrusted - inputs from guest. -

-

grub-bhyve (emu) is built without SDL graphics support which reduces lot of - gfx attack surface, however font loading code is still accessible. Guest can - provide arbitrary font file, which is parsed by grub-bhyve running as root. -

-

In grub-core/font/font.c, read_section_as_string() allocates - section->length + 1 bytes of memory. However, untrusted - section->length is an unsigned 32-bit number, and the result can - overflow to malloc(0). This can result in a controlled buffer - overflow via the 'loadfont' command in a guest VM grub2.cfg, eventually leading - to privilege escalation from guest to host. -

-
-

Reno Robert also reports:

- -
-

GRUB supports commands to read and write addresses of choice. In - grub-bhyve, these commands provide a way to write to arbitrary virtual - addresses within the grub-bhyve process. This is another way for a guest - grub2.cfg, run by the host, to eventually escalate privileges. -

-
-

These vulnerabilities are mitigated by disabling the 'loadfont', 'write_dword', - 'read_dword', 'inl', 'outl', and other width variants of the same functionality in - grub2-bhyve. -

-

There is also work in progress to sandbox the grub-bhyve utility such that - an escaped guest ends up with nobody:nobody in a Capsium sandbox. It is not - included in 0.40_8. -

- - - - - https://www.voidsecurity.in/ - - - - 2019-12-09 - 2020-02-12 - - - - - libexif -- privilege escalation - - - libexif - 0.6.21_5 - - - - -

Mitre reports:

-
-

In libexif, there is a possible out of bounds write due to an integer overflow. - This could lead to remote escalation of privilege in the media content provider - with no additional execution privileges needed. User interaction is needed for - exploitation.

-
- - - - CVE-2019-9278 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9278 - https://security-tracker.debian.org/tracker/CVE-2019-9278 - https://seclists.org/bugtraq/2020/Feb/9 - https://github.com/libexif/libexif/issues/26 - - - 2019-02-06 - 2020-02-11 - - - - - Flash Player -- arbitrary code execution - - - linux-flashplayer - 32.0.0.330 - - - - -

Adobe reports:

-
-
    -
  • This update resolves a type confusion vulnerability that - could lead to arbitrary code execution (CVE-2020-3757).
    • -
-
- - - - CVE-2020-3757 - https://helpx.adobe.com/security/products/flash-player/apsb20-06.html - - - 2020-02-11 - 2020-02-11 - - - - - NGINX -- HTTP request smuggling - - - nginx - 1.16.1_11,2 - - - nginx-devel - 1.17.7 - - - - -

NGINX Team reports:

-
-

NGINX before 1.17.7, with certain error_page configurations, allows HTTP - request smuggling, as demonstrated by the ability of an attacker to read - unauthorized web pages in environments where NGINX is being fronted by a - load balancer.

-
- - - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20372 - CVE-2019-20372 - - - 2019-12-10 - 2020-02-09 - - - - - ksh93 -- certain environment variables interpreted as arithmetic expressions on startup, leading to code injection - - - ksh93 - 2020.0.02020.0.1_1,1 - - - ksh93-devel - 2020.02.07 - - - - -

Upstream ksh93 maintainer Siteshwar Vashisht reports:

-
-

A flaw was found in the way ksh evaluates certain environment - variables. An attacker could use this flaw to override or bypass - environment restrictions to execute shell commands. Services and - applications that allow remote unauthenticated attackers to - provide one of those environment variables could allow them to - exploit this issue remotely.

-
- - - - https://bugzilla.redhat.com/show_bug.cgi?id=1757324 - https://access.redhat.com/security/cve/CVE-2019-14868 - https://access.redhat.com/errata/RHSA-2020:0431 - - - 2019-10-01 - 2020-02-07 - - - - - clamav -- Denial-of-Service (DoS) vulnerability - - - clamav - 0.102.2,1 - - - - -

Micah Snyder reports:

-
-

A denial-of-service (DoS) condition may occur when using the optional - credit card data-loss-prevention (DLP) feature. Improper bounds checking of - an unsigned variable resulted in an out-of-bounds read, which causes a crash. -

-
- - - - https://blog.clamav.net/2020/02/clamav-01022-security-patch-released.html - CVE-2020-3123 - - - 2020-02-05 - 2020-02-05 - - - - - Django -- potential SQL injection vulnerability - - - py27-django111 - py35-django111 - py36-django111 - py37-django111 - py38-django111 - 1.11.28 - - - py35-django22 - py36-django22 - py37-django22 - py38-django22 - 2.2.10 - - - py36-django30 - py37-django30 - py38-django30 - 3.0.3 - - - - -

MITRE CVE reports:

-
-

Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 - allows SQL Injection if untrusted data is used as a StringAgg delimiter - (e.g., in Django applications that offer downloads of data as a series - of rows with a user-specified column delimiter). By passing a suitably - crafted delimiter to a contrib.postgres.aggregates.StringAgg instance, - it was possible to break escaping and inject malicious SQL.

-
- - - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7471 - https://docs.djangoproject.com/en/1.11/releases/1.11.28/ - https://docs.djangoproject.com/en/2.2/releases/2.2.10/ - https://docs.djangoproject.com/en/3.0/releases/3.0.3/ - CVE-2020-7471 - - - 2020-02-03 - 2020-02-04 - - - - - MariaDB -- Vulnerability in C API - - - mariadb55-client - 5.5.67 - - - mariadb55-server - 5.5.67 - - - mariadb101-client - 10.1.44 - - - mariadb101-server - 10.1.44 - - - mariadb102-client - 10.2.31 - - - mariadb102-server - 10.2.31 - - - mariadb103-client - 10.3.22 - - - mariadb103-server - 10.3.22 - - - mariadb104-client - 10.4.12 - - - mariadb104-server - 10.4.12 - - - mariadb-connector-c - 3.1.7 - - - - -

MariaDB reports:

-
-

Difficult to exploit vulnerability allows unauthenticated attacker - with network access via multiple protocols to compromise MySQL Client. -

-
- - - - https://mariadb.com/kb/en/security/ - https://mariadb.com/kb/en/mdb-5567-rn/ - https://mariadb.com/kb/en/mdb-10412-rn/ - https://mariadb.com/kb/en/mdb-10322-rn/ - https://mariadb.com/kb/en/mdb-10231-rn/ - https://mariadb.com/kb/en/mdb-10144-rn/ - https://mariadb.com/kb/en/mariadb-connector-c-317-release-notes/ - CVE-2020-2574 - - - 2020-01-28 - 2020-02-02 - - - - - libssh -- Unsanitized location in scp could lead to unwanted command execution - - - libssh - 0.4.00.8.8 - 0.9.00.9.3 - - - - -

The libssh team reports:

-
-

In an environment where a user is only allowed to copy files and - not to execute applications, it would be possible to pass a location - which contains commands to be executed in additon.

-

When the libssh SCP client connects to a server, the scp - command, which includes a user-provided path, is executed - on the server-side. In case the library is used in a way - where users can influence the third parameter of - ssh_scp_new(), it would become possible for an attacker to - inject arbitrary commands, leading to a compromise of the - remote target.

-
- - - - https://www.libssh.org/security/advisories/CVE-2019-14889.txt - https://nvd.nist.gov/vuln/detail/CVE-2019-14889 - CVE-2019-14889 - - - 2019-11-14 - 2020-02-02 - - - - - spamassassin -- Nefarious rule configuration files can run system commands - - - spamassassin - 3.4.4 - - - - -

The Apache SpamAssassin project reports:

-
-

A nefarious rule configuration (.cf) files can be configured to - run system commands. This issue is less stealthy and attempts to - exploit the issue will throw warnings.

-

Thanks to Damian Lukowski at credativ for reporting the issue - ethically. With this bug unpatched, exploits can be injected in a - number of scenarios though doing so remotely is difficult. In - addition to upgrading to SA 3.4.4, we again recommend that users - should only use update channels or 3rd party .cf files from trusted - places.

-
- - - - https://mail-archives.apache.org/mod_mbox/spamassassin-announce/202001.mbox/%3c0a91e67a-3190-36e5-41e9-d3553743bcd2@apache.org%3e - https://mail-archives.apache.org/mod_mbox/spamassassin-announce/202001.mbox/%3ccdae17ce-acde-6060-148a-6dc5f45ee728@apache.org%3e - CVE-2020-1930 - CVE-2020-1931 - - - 2020-01-28 - 2020-01-31 - - - - - sudo -- Potential bypass of Runas user restrictions - - - sudo - 1.8.31 - - - - -

Todd C. Miller reports:

-
-

Sudo's pwfeedback option can be used to provide visual feedback - when the user is inputting their password. For each key press, - an asterisk is printed. This option was added in response to - user confusion over how the standard Password: prompt disables - the echoing of key presses. While pwfeedback is not enabled by - default in the upstream version of sudo, some systems, such as - Linux Mint and Elementary OS, do enable it in their default - sudoers files.

-

Due to a bug, when the pwfeedback option is enabled in the - sudoers file, a user may be able to trigger a stack-based buffer - overflow. This bug can be triggered even by users not listed in - the sudoers file. There is no impact unless pwfeedback has been - enabled.

-
- - - - https://www.sudo.ws/alerts/pwfeedback.html - CVE-2019-18634 - - - 2020-01-30 - 2020-01-30 - - - - - Gitlab -- Multiple Vulnerabilities - - - gitlab-ce - 12.7.012.7.4 - 12.6.012.6.6 - 5.312.5.9 - - - - -

Gitlab reports:

-
-

Path Traversal to Arbitrary File Read

-

User Permissions Not Validated in ProjectExportWorker

-

XSS Vulnerability in File API

-

Package and File Disclosure through GitLab Workhorse

-

XSS Vulnerability in Create Groups

-

Issue and Merge Request Activity Counts Exposed

-

Email Confirmation Bypass Using AP

-

Disclosure of Forked Private Project Source Code

-

Private Project Names Exposed in GraphQL queries

-

Disclosure of Issues and Merge Requests via Todos

-

Denial of Service via AsciiDoc

-

Last Pipeline Status Exposed

-

Arbitrary Change of Pipeline Status

-

Grafana Token Displayed in Plaintext

-

Update excon gem

-

Update rdoc gem

-

Update rack-cors gem

-

Update rubyzip gem

-
- - - - https://about.gitlab.com/releases/2020/01/30/security-release-gitlab-12-7-4-released/ - CVE-2020-7966 - CVE-2020-8114 - CVE-2020-7973 - CVE-2020-6833 - CVE-2020-7971 - CVE-2020-7967 - CVE-2020-7972 - CVE-2020-7968 - CVE-2020-7979 - CVE-2020-7969 - CVE-2020-7978 - CVE-2020-7974 - CVE-2020-7977 - CVE-2020-7976 - CVE-2019-16779 - CVE-2019-18978 - CVE-2019-16892 - - - 2020-01-30 - 2020-01-31 - - - - - OpenSMTPd -- critical LPE / RCE vulnerability - - - opensmtpd - 6.4.0,16.6.2,1 - - - - -

OpenSMTPD developers report:

-
-

An incorrect check allows an attacker to trick mbox delivery - into executing arbitrary commands as root and lmtp delivery - into executing arbitrary commands as an unprivileged user

-
- - - - CVE-2020-7247 - https://www.openwall.com/lists/oss-security/2020/01/28/3 - - - 2020-01-28 - 2020-01-29 - - - - - jenkins -- multiple vulnerabilities - - - jenkins - 2.219 - - - jenkins-lts - 2.204.2 - - - - -

Jenkins Security Advisory:

-
-

Description

-
(High) SECURITY-1682 / CVE-2020-2099
-

Inbound TCP Agent Protocol/3 authentication bypass

-
(Medium) SECURITY-1641 / CVE-2020-2100
-

Jenkins vulnerable to UDP amplification reflection attack

-
(Medium) SECURITY-1659 / CVE-2020-2101
-

Non-constant time comparison of inbound TCP agent connection secret

-
(Medium) SECURITY-1660 / CVE-2020-2102
-

Non-constant time HMAC comparison

-
(Medium) SECURITY-1695 / CVE-2020-2103
-

Diagnostic page exposed session cookies

-
(Medium) SECURITY-1650 / CVE-2020-2104
-

Memory usage graphs accessible to anyone with Overall/Read

-
(Low) SECURITY-1704 / CVE-2020-2105
-

Jenkins REST APIs vulnerable to clickjacking

-
(Medium) SECURITY-1680 / CVE-2020-2106
-

Stored XSS vulnerability in Code Coverage API Plugin

-
(Medium) SECURITY-1565 / CVE-2020-2107
-

Fortify Plugin stored credentials in plain text

-
(High) SECURITY-1719 / CVE-2020-2108
-

XXE vulnerability in WebSphere Deployer Plugin

-
- - - - CVE-2020-2099 - CVE-2020-2100 - CVE-2020-2101 - CVE-2020-2102 - CVE-2020-2103 - CVE-2020-2104 - CVE-2020-2105 - CVE-2020-2106 - CVE-2020-2107 - CVE-2020-2108 - https://jenkins.io/security/advisory/2020-01-29/ - - - 2020-01-29 - 2020-01-29 - - - - - pkg -- vulnerability in libfetch - - - pkg - 1.12.0_1 - - - pkg-devel - 1.12.99_1 - - - - -

A programming error allows an attacker who can specify a URL with a username - and/or password components to overflow libfetch(3) buffers.

- - - - SA-20:01.libfetch - CVE-2020-7450 - - - 2020-01-28 - 2020-01-29 - - - - - samba -- multiple vulnerabilities - - - samba410 - 4.10.12 - - - samba411 - 4.11.4 - - - - -

The Samba Team reports:

-
-

CVE-2019-14902

-

The implementation of ACL inheritance in the Samba AD DC was not complete, - and so absent a 'full-sync' replication, ACLs could get out of sync between - domain controllers.

-

CVE-2019-14907

-

When processing untrusted string input Samba can read past the end of the - allocated buffer when printing a "Conversion error" message to the logs.

-

CVE-2019-19344

-

During DNS zone scavenging (of expired dynamic entries) there is a read of - memory after it has been freed.

-
- - - - https://www.samba.org/samba/history/samba-4.10.12.html - CVE-2019-14902 - CVE-2019-14907 - CVE-2019-19344 - - - 2020-01-14 - 2020-01-27 - - - - - webkit-gtk3 -- Multiple vulnerabilities - - - webkit2-gtk3 - 2.26.3 - - - - -

The WebKitGTK project reports multiple vulnerabilities.

- - - - https://webkitgtk.org/security/WSA-2020-0001.html - CVE-2019-8835 - CVE-2019-8844 - CVE-2019-8846 - - - 2020-01-23 - 2020-01-26 - - - - - Pillow -- Multiple vulnerabilities - - - py27-pillow - py35-pillow - py36-pillow - py37-pillow - py38-pillow - 6.2.2 - - - - -

Pillow developers report:

-
-

- This release addresses several security problems, as well as - addressing CVE-2019-19911. -

- CVE-2019-19911 is regarding FPX images. If an image reports that it - has a large number of bands, a large amount of resources will be - used when trying to process the image. This is fixed by limiting the - number of bands to those usable by Pillow. -

- Buffer overruns were found when processing an SGI, PCX or FLI image. - Checks have been added to prevent this. -

- Overflow checks have been added when calculating the size of a - memory block to be reallocated in the processing of a TIFF image. -

-
- - - - https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html - CVE-2019-19911 - CVE-2020-5310 - CVE-2020-5311 - CVE-2020-5312 - CVE-2020-5313 - ports/243336 - - - 2019-12-19 - 2020-01-24 - - - - - gitea -- multiple vulnerabilities - - - gitea - 1.10.3 - - - - -

The Gitea Team reports:

-
-
    -
  • Hide credentials when submitting migration
    • -
  • Never allow an empty password to validate
    • -
  • Prevent redirect to Host
    • -
  • Hide public repos owned by private orgs
    • -
-
- - - - https://github.com/go-gitea/gitea/releases/tag/v1.10.3 - ports/243437 - - - 2019-11-22 - 2020-01-18 - - - - - MySQL -- Multiple vulerabilities - - - mysql56-server - 5.6.47 - - - mysql57-server - 5.7.29 - - - mysql80-server - 8.0.19 - - - percona55-server - 5.5.67 - - - percona56-server - 5.6.47 - - - percona57-server - 5.7.29 - - - - -

Oracle reports:

-
-

This Critical Patch Update contains 17 new security fixes for - Oracle MySQL. 5 of these vulnerabilities may be remotely exploitable - without authentication, i.e., may be exploited over a network without - requiring user credentials.

-
- - - - https://www.oracle.com/security-alerts/cpujan2020.html - CVE-2019-1547 - CVE-2020-2579 - CVE-2020-2686 - CVE-2020-2627 - CVE-2020-2570 - CVE-2020-2573 - CVE-2020-2574 - CVE-2020-2577 - CVE-2020-2589 - CVE-2020-2580 - CVE-2020-2588 - CVE-2020-2660 - CVE-2020-2679 - CVE-2020-2584 - CVE-2020-2694 - CVE-2020-2572 - CVE-2019-8457 - - - 2020-01-14 - 2020-01-15 - 2020-02-02 - - - - - drm graphics drivers -- potential information disclusure via local access - - - drm-fbsd11.2-kmod - 4.11.g20200115 - - - drm-fbsd12.0-kmod - 4.16.g20200115 - - - drm-current-kmod - 4.16.g20200115 - - - drm-devel-kmod - 5.0.g20200115 - - - - -

Intel reports:

-
-

.A potential security vulnerability in Intel(R) Processor Graphics - may allow information disclosure. Intel is releasing software - updates to mitigate this potential vulnerability.

-

Description: Insufficient control flow in certain data - structures for some Intel(R) Processors with Intel(R) Processor - Graphics may allow an unauthenticated user to potentially enable - information disclosure via local access.

-

This patch provides mitigation for Gen9 hardware only. Patches - for Gen7 and Gen7.5 will be provided later. Note that Gen8 is not - impacted due to a previously implemented workaround. The mitigation - involves using an existing hardware feature to forcibly clear down - all EU state at each context switch.

-
- - - - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00314.html - CVE-2019-14615 - - - 2020-01-14 - 2020-01-15 - - - - - Template::Toolkit -- Directory traversal on write - - - p5-Template-Toolkit - 3.004 - - - - -

Art Manion and Will Dormann report:

-
-

- By using an older and less-secure form of open(), it is - possible for untrusted template files to cause reads/writes - outside of the template directories. This vulnerability is - a component of the recent Citrix exploit. -

-
- - - - https://www.kb.cert.org/vuls/id/619785/ - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19781 - CVE-2019-19781 - - - 2019-12-13 - 2020-01-14 - - - - - Gitlab -- Private objects exposed through project import - - - gitlab-ce - 12.6.012.6.4 - 12.5.012.5.7 - 8.9.012.4.8 - - - - -

Gitlab reports:

-
-

Private objects exposed through project importi

-
- - - - https://about.gitlab.com/releases/2020/01/13/critical-security-release-gitlab-12-dot-6-dot-4-released/ - CVE-2020-6832 - - - 2020-01-13 - 2020-01-14 - - - - - e2fsprogs -- rehash.c/pass 3a mutate_name() code execution vulnerability - - - e2fsprogs - 1.45.5 - - - - -

Lilith of Cisco Talos reports:

-
-

- A code execution vulnerability exists in the directory rehashing - functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 - directory can cause an out-of-bounds write on the stack, resulting - in code execution. An attacker can corrupt a partition to trigger - this vulnerability. -

-
-

Theodore Y. Ts'o reports:

-
-

- E2fsprogs 1.45.5 [...:] Fix a potential out of bounds write when - checking a maliciously corrupted file system. This is probably not - exploitable on 64-bit platforms, but may be exploitable on 32-bit - binaries depending on how the compiler lays out the stack variables. - (Addresses CVE-2019-5188) -

-
- - - - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0973 - http://e2fsprogs.sourceforge.net/e2fsprogs-release.html#1.45.5 - CVE-2019-5188 - - - 2019-12-18 - 2020-01-08 - - - - - phpMyAdmin -- SQL injection - - - phpMyAdmin - phpMyAdmin-php72 - phpMyAdmin-php73 - phpMyAdmin-php74 - phpMyAdmin5 - phpMyAdmin5-php72 - phpMyAdmin5-php73 - phpMyAdmin5-php74 - 4.9.4 - 5.0.05.0.1 - - - - -

The phpMyAdmin development team reports:

-
-

A SQL injection flaw has been discovered in the user accounts page

-
- - - - https://www.phpmyadmin.net/security/PMASA-2020-1/ - CVE-2020-5504 - - - 2020-01-05 - 2020-01-11 - - - - - cacti -- multiple vulnerabilities - - - cacti - 1.2.8 - - - - -

The cacti developers reports:

-
-

- When viewing graphs, some input variables are not properly checked - (SQL injection possible). -

-

- Multiple instances of lib/functions.php are affected by unsafe - deserialization of user-controlled data to populate arrays. An - authenticated attacker could use this to influence object data - values and control actions taken by Cacti or potentially cause - memory corruption in the PHP module. -

-
- - - - https://github.com/Cacti/cacti/releases/tag/release%2F1.2.8 - CVE-2019-17357 - CVE-2019-17358 - ports/242834 - - - 2019-10-12 - 2020-01-06 - - - - - Gitlab -- Multiple Vulnerabilities - - - gitlab-ce - 12.6.012.6.2 - 12.5.012.5.6 - 5.1.012.4.7 - - - - -

SO-AND-SO reports:

-
-

Group Maintainers Can Update/Delete Group Runners Using API

-

GraphQL Queries Can Hang the Application

-

Unauthorized Users Have Access to Milestones of Releases

-

Private Group Name Revealed Through Protected Tags API

-

Users Can Publish Reviews on Locked Merge Requests

-

DoS in the Issue and Commit Comments Pages

-

Project Name Disclosed Through Unsubscribe Link

-

Private Project Name Disclosed Through Notification Settings

-
- - - - https://about.gitlab.com/blog/2020/01/02/security-release-gitlab-12-6-2-released/ - CVE-2019-20144 - CVE-2019-20146 - CVE-2019-20143 - CVE-2019-20147 - CVE-2019-20145 - CVE-2019-20142 - CVE-2019-20148 - CVE-2020-5197 - - - 2020-01-02 - 2020-01-03 - - - - - rack -- information leak / session hijack vulnerability - - - rubygem-rack - 2.0.02.0.8,3 - - - rubygem-rack16 - 1.6.01.6.12 - - - - -

National Vulnerability Database:

-
-

There's a possible information leak / session hijack vulnerability in - Rack (RubyGem rack). This vulnerability is patched in versions 1.6.12 - and 2.0.8. Attackers may be able to find and hijack sessions by using - timing attacks targeting the session id. Session ids are usually stored - and indexed in a database that uses some kind of scheme for speeding up - lookups of that session id. By carefully measuring the amount of time - it takes to look up a session, an attacker may be able to find a valid - session id and hijack the session. The session id itself may be - generated randomly, but the way the session is indexed by the backing - store does not use a secure comparison.

-
- - - - https://nvd.nist.gov/vuln/detail/CVE-2019-16782 - https://github.com/rack/rack/blob/master/CHANGELOG.md - CVE-2019-16782 - - - 2019-12-08 - 2019-12-29 - - - - - OpenEXR -- heap buffer overflow, and out-of-memory bugs - - - ilmbase - 2.3.0_4 - - - openexr - 2.3.0_3 - - - - -

Cary Phillips reports:

-
-

OpenEXR (IlmBase) v2.4.0 fixes the following security vulnerabilities:

-
    -
  • CVE-2018-18444 Issue #351 Out of Memory
    • -
  • CVE-2018-18443 Issue #350 heap-buffer-overflow
    • -
-

The relevant patches have been backported to the FreeBSD ports.

-
- - - - https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.4.0 - https://github.com/AcademySoftwareFoundation/openexr/issues/350 - https://github.com/AcademySoftwareFoundation/openexr/issues/351 - CVE-2018-18443 - CVE-2018-18444 - - - 2018-10-17 - 2019-12-29 - - - - - wordpress -- multiple issues - - - wordpress - fr-wordpress - 5.3.1,1 - - - de-wordpress - zh_CN-wordpress - zh_TW-wordpress - ja-wordpress - ru-wordpress - 5.3.1 - - - - -

wordpress developers reports:

-
-

Four security issues affect WordPress versions 5.3 and earlier; version 5.3.1 fixes them, so youll want to upgrade. - If you havent yet updated to 5.3, there are also updated versions of 5.2 and earlier that fix the security issues. - -Props to Daniel Bachhuber for finding an issue where an unprivileged user could make a post sticky via the REST API. - -Props to Simon Scannell of RIPS Technologies for finding and disclosing an issue where cross-site scripting (XSS) - could be stored in well-crafted links. - -Props to the WordPress.org Security Team for hardening wp_kses_bad_protocol() to ensure that it is aware of the named - colon attribute. - -Props to Nguyen The Duc for discovering a stored XSS vulnerability using block editor content.

-
- - - - https://wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance-release/ - - - 2019-12-13 - 2019-12-26 - - - - - typo3 -- multiple vulnerabilities - - - typo3-8 - 8.7.30 - - - typo3-9 - 9.5.13 - - - - -

Typo3 core team reports:

-
-

It has been discovered that the output of field validation errors in the Form Framework is vulnerable - to cross-site scripting.

-

It has been discovered that t3:// URL handling and typolink functionality are vulnerable to cross-site - scripting. Not only regular backend forms are affected but also frontend extensions which use the rendering - with typolink.

-

It has been discovered that the output table listing in the Files backend module is vulnerable to cross-site - scripting when a file extension contains malicious sequences. Access to the file system of the server - either - directly or through synchronization - is required to exploit the vulnerability.

-

It has been discovered that the extraction of manually uploaded ZIP archives in Extension Manager is vulnerable - to directory traversal. Admin privileges are required in order to exploit this vulnerability. Since TYPO3 v9 LTS, - System Maintainer privileges are required as well.

-

Failing to properly escape user submitted content, class QueryGenerator is vulnerable to SQL injection. - Having system extension ext:lowlevel installed and a valid backend user having administrator privileges are - required to exploit this vulnerability.

-

It has been discovered that classes QueryGenerator and QueryView are vulnerable to insecure deserialization. - Requirements for successfully exploiting this vulnerability (one of the following): - - having system extension ext:lowlevel (Backend Module: DB Check) installed and valid backend user having - administrator privileges - - having system extension ext:sys_action installed and valid backend user having limited privileges

-

TYPO3 allows to upload files either in the backend user interface as well as in custom developed extensions. - To reduce the possibility to upload potential malicious code TYPO3 uses the fileDenyPattern to deny e.g. user - submitted PHP scripts from being persisted. Besides that it is possible for any editor to upload file assets - using the file module (fileadmin) or changing their avatar image shown in the TYPO3 backend. - - Per default TYPO3 allows to upload and store HTML and SVG files as well using the mentioned functionalities. - Custom extension implementations probably would also accept those files when only the fileDenyPattern is evaluated. - - Since HTML and SVG files - which might contain executable JavaScript code per W3C standard - could be directly - displayed in web clients, the whole web application is exposed to be vulnerable concerning Cross-Site Scripting. - Currently the following scenarios are known - given an authenticated regular editor is able to upload files using - the TYPO3 backend: - - directly target a potential victim to a known public resource in a URL, e.g. /fileadmin/malicious.svg or - /fileadmin/malicious.html - - using the TypoScript content object “SVG” (implemented in class ScalableVectorGraphicsContentObject) - having renderMode set to inline for SVG files (available since TYPO3 v9.0) - - custom implementations that directly output and render markup of HTML and SVG files - - SVG files that are embedded using an img src=”malicious.svg” tag are not vulnerable since potential - scripts are not executed in these scenarios (see https://www.w3.org/wiki/SVG_Security). The icon API of TYPO3 - is not scope of this announcement since SVG icons need to be registered using an individual implementation, - which is not considered as user submitted content.

-

It has been discovered that request handling in Extbase can be vulnerable to insecure deserialization. - User submitted payload has to be signed with a corresponding HMAC-SHA1 using the sensitive TYPO3 encryptionKey - as secret - invalid or unsigned payload is not deserialized. - - However, since sensitive information could have been leaked by accident (e.g. in repositories or in commonly - known and unprotected backup files), there is the possibility that attackers know the private encryptionKey - and are able to calculate the required HMAC-SHA1 to allow a malicious payload to be deserialized. - - Requirements for successfully exploiting this vulnerability (all of the following): - - rendering at least one Extbase plugin in the frontend - - encryptionKey has been leaked (from LocalConfiguration.php or corresponding .env file).

-
- - - - https://typo3.org/security/advisory/typo3-core-sa-2019-021/ - https://typo3.org/security/advisory/typo3-core-sa-2019-022/ - https://typo3.org/security/advisory/typo3-core-sa-2019-023/ - https://typo3.org/security/advisory/typo3-core-sa-2019-024/ - https://typo3.org/security/advisory/typo3-core-sa-2019-025/ - https://typo3.org/security/advisory/typo3-core-sa-2019-026/ - https://typo3.org/security/advisory/typo3-psa-2019-010/ - https://typo3.org/security/advisory/typo3-psa-2019-011/ - - - 2019-12-17 - 2019-12-25 - - - - - e2fsprogs -- maliciously corrupted file systems can trigger buffer overruns in the quota code used by e2fsck - - - e2fsprogs - 1.45.4 - - - - -

Ted Y. Ts'o reports:

-
-

A maliciously corrupted file systems can trigger buffer overruns in the quota code used by e2fsck.

-
- - - - http://e2fsprogs.sourceforge.net/e2fsprogs-release.html#1.45.4 - CVE-2019-5094 - - - 2019-09-23 - 2019-12-21 - - - - - drupal -- Drupal Core - Multiple Vulnerabilities - - - drupal7 - 7.69 - - - drupal8 - 8.8.1 - - - - -

Drupal Security Team reports:

-
-

A visit to install.php can cause cached data to become corrupted. - This could cause a site to be impaired until caches are rebuilt.

-
-
-

Drupal 8 core's file_save_upload() function does not strip the - leading and trailing dot ('.') from filenames, like Drupal 7 did. - Users with the ability to upload files with any extension in - conjunction with contributed modules may be able to use this to - upload system files such as .htaccess in order to bypass protections - afforded by Drupal's default .htaccess file. After this fix, - file_save_upload() now trims leading and trailing dots from filenames. -

-
-
-

The Media Library module has a security vulnerability whereby it - doesn't sufficiently restrict access to media items in certain - configurations. -

-
-
-

The Drupal project uses the third-party library Archive_Tar, which - has released a security-related feature that impacts some Drupal - configurations. Multiple vulnerabilities are possible if Drupal is - configured to allow .tar, .tar.gz, .bz2 or .tlz file uploads and - processes them. The latest versions of Drupal update Archive_Tar to - 1.4.9 to mitigate the file processing vulnerabilities. -

-
- - - - https://www.drupal.org/sa-core-2019-009 - https://www.drupal.org/sa-core-2019-010 - https://www.drupal.org/sa-core-2019-011 - https://www.drupal.org/sa-core-2019-012 - - - 2019-12-18 - 2019-12-21 - - - - - py-matrix-synapse -- multiple vulnerabilities - - - py35-matrix-synapse - py36-matrix-synapse - py37-matrix-synapse - 1.7.1 - - - - -

Matrix developers report:

-
-

The [synapse 1.7.1] release includes several security fixes as well - as a fix to a bug exposed by the security fixes. All previous releases - of Synapse are affected. Administrators are encouraged to upgrade as - soon as possible.

-
    -
  • Fix a bug which could cause room events to be incorrectly authorized - using events from a different room.
    • -
  • Fix a bug causing responses to the /context client endpoint to not - use the pruned version of the event.
    • -
  • Fix a cause of state resets in room versions 2 onwards.
    • -
-
- - - - https://github.com/matrix-org/synapse/releases/tag/v1.7.1 - - - 2019-12-18 - 2019-12-18 - - - - - OpenSSL -- Overflow vulnerability - - - openssl - 1.0.2u,1 - - - - -

The OpenSSL project reports:

-
-

rsaz_512_sqr overflow bug on x86_64 (CVE-2019-1551) (Low)
- There is an overflow bug in the x64_64 Montgomery squaring procedure - used in exponentiation with 512-bit moduli. No EC algorithms are - affected. Analysis suggests that attacks against 2-prime RSA1024, - 3-prime RSA1536, and DSA1024 as a result of this defect would be very - difficult to perform and are not believed likely. Attacks against - DH512 are considered just feasible. However, for an attack the target - would have to re-use the DH512 private key, which is not recommended - anyway. Also applications directly using the low level API BN_mod_exp - may be affected if they use BN_FLG_CONSTTIME.

-
- - - - https://www.openssl.org/news/secadv/20191206.txt - CVE-2019-1551 - - - 2019-12-06 - 2019-12-20 - - - - - spamassassin -- multiple vulnerabilities - - - spamassassin - 3.4.3 - - - - -

the Apache Spamassassin project reports:

-
-

An input validation error of user-supplied input parsing - multipart emails. Specially crafted emails can consume all - resources on the system.

-

A local user is able to execute arbitrary shell commands - through specially crafted nefarious CF files.

-
- - - - https://www.cybersecurity-help.cz/vdb/SB2019121311 - CVE-2019-12420 - CVE-2018-11805 - - - 2019-12-11 - 2019-12-13 - - - - - samba -- multiple vulnerabilities - - - samba48 - 4.8.0 - - - samba410 - 4.10.11 - - - samba411 - 4.11.3 - - - - -

The Samba Team reports:

-
-

CVE-2019-14861:

-

An authenticated user can crash the DCE/RPC DNS management server by creating records with matching the zone name.

-

CVE-2019-14870:

-

The DelegationNotAllowed Kerberos feature restriction was not being applied when processing protocol transition requests (S4U2Self), in the AD DC KDC.

-
- - - - https://www.samba.org/samba/history/samba-4.10.11.html - CVE-2019-14861 - CVE-2019-14870 - - - 2019-12-10 - 2019-12-12 - - - - - dovecot -- null pointer deref in notify with empty headers - - - dovecot - 2.3.92.3.9.2 - - - - -

Aki Tuomi reports

-
-

Mail with group address as sender will cause a signal 11 crash in push - notification drivers. Group address as recipient can cause crash in some - drivers.

-
- - - - https://dovecot.org/pipermail/dovecot/2019-December/117894.html - CVE-2019-19722 - - - 2019-12-10 - 2019-12-13 - - - - - Gitlab -- Multiple Vulnerabilities - - - gitlab-ce - 12.5.012.5.4 - 12.4.012.4.6 - 10.5.012.3.9 - - - - -

Gitlab reports:

-
-

Path traversal with potential remote code execution

-

Disclosure of private code via Elasticsearch integration

-

Update Git dependency

-
- - - - https://about.gitlab.com/blog/2019/12/10/critical-security-release-gitlab-12-5-4-released/ - CVE-2019-19628 - CVE-2019-19629 - CVE-2019-19604 - - - 2019-12-10 - 2019-12-10 - - - - - Ghostscript -- Security bypass vulnerabilities - - - ghostscript9-agpl-base - ghostscript9-agpl-x11 - 9.50 - - - - -

Cedric Buissart (Red Hat) reports:

-
-

A flaw was found in, ghostscript versions prior to 9.50, in the - .pdf_hook_DSC_Creator procedure where it did not properly secure - its privileged calls, enabling scripts to bypass `-dSAFER` - restrictions. A specially crafted PostScript file could disable - security protection and then have access to the file system, or - execute arbitrary commands.

-
-
-

A flaw was found in all ghostscript versions 9.x before 9.50, in - the .setuserparams2 procedure where it did not properly secure its - privileged calls, enabling scripts to bypass `-dSAFER` - restrictions. A specially crafted PostScript file could disable - security protection and then have access to the file system, or - execute arbitrary commands.

-
-
-

A flaw was found in ghostscript, versions 9.x before 9.50, in the - setsystemparams procedure where it did not properly secure its - privileged calls, enabling scripts to bypass `-dSAFER` - restrictions. A specially crafted PostScript file could disable - security protection and then have access to the file system, or - execute arbitrary commands.

-
-
-

A flaw was found in, ghostscript versions prior to 9.50, in the - .pdfexectoken and other procedures where it did not properly secure - its privileged calls, enabling scripts to bypass `-dSAFER` - restrictions. A specially crafted PostScript file could disable - security protection and then have access to the file system, or - execute arbitrary commands.

-
- - - - CVE-2019-14811 - CVE-2019-14812 - CVE-2019-14813 - CVE-2019-14817 - - - 2019-08-20 - 2019-12-09 - - - - - phpmyadmin -- multiple vulnerabilities - - - phpmyadmin - 4.9.2 - - - - -

the phpmyadmin team reports:

-
-

This security fix is part of an ongoing effort to improve the security of the Designer feature - and is designated PMASA-2019-5. There is also an improvement for how we sanitize git version - information shown on the home page.

-
- - - - https://www.phpmyadmin.net/news/2019/11/22/phpmyadmin-492-released/ - - - 2019-11-22 - 2019-12-06 - - - - - Django -- multiple vulnerabilities - - - py35-django21 - py36-django21 - py37-django21 - py38-django21 - 2.1.15 - - - py35-django22 - py36-django22 - py37-django22 - py38-django22 - 2.2.8 - - - - -

Django release reports:

-
-

CVE-2019-19118: Privilege escalation in the Django admin.

-

Since Django 2.1, a Django model admin displaying a parent model with related - model inlines, where the user has view-only permissions to a parent model but - edit permissions to the inline model, would display a read-only view of the parent - model but editable forms for the inline.

-

Submitting these forms would not allow direct edits to the parent model, but would - trigger the parent model's save() method, and cause pre and post-save signal handlers - to be invoked. This is a privilege escalation as a user who lacks permission to edit - a model should not be able to trigger its save-related signals.

-
- - - - https://www.djangoproject.com/weblog/2019/dec/02/security-releases/ - CVE-2019-19118 - - - 2019-11-25 - 2019-12-03 - - - - - py-matrix-synapse -- incomplete cleanup of 3rd-party-IDs on user deactivation - - - py35-matrix-synapse - py36-matrix-synapse - py37-matrix-synapse - 1.6.1 - - - - -

Matrix developers report:

-
-

Clean up local threepids from user on account deactivation.

-
- - - - https://github.com/matrix-org/synapse/releases/tag/v1.6.1 - https://github.com/matrix-org/synapse/pull/6426 - - - 2019-11-28 - 2019-11-28 - - - - - py-matrix-synapse -- missing signature checks on some federation APIs - - - py35-matrix-synapse - py36-matrix-synapse - py37-matrix-synapse - 1.5.0 - - - - -

Matrix developers report:

-
-

Make sure that [...] events sent over /send_join, /send_leave, and - /invite, are correctly signed and come from the expected servers.

-
- - - - https://github.com/matrix-org/synapse/pull/6262 - https://github.com/matrix-org/synapse/releases/tag/v1.5.0 - - - 2019-10-29 - 2019-10-29 - - - - - Gitlab -- Multiple Vulnerabilities - - - gitlab-ce - 12.5.012.5.2 - 12.4.012.4.5 - 11.9.012.3.8 - - - - -

Gitlab reports:

-
-

Unauthorized access to grafana metrics

-

Update Mattermost dependency

-
- - - - https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-2-released/ - CVE-2019-19262 - - - 2019-11-27 - 2019-11-28 - - - - - Gitlab -- Multiple Vulnerabilities - - - gitlab-ce - 12.5.012.5.1 - 12.4.012.4.4 - 12.3.7 - - - - -

Gitlab reports:

-
-

Path traversal with potential remote code execution

-

Private objects exposed through project import

-

Disclosure of notes via Elasticsearch integration

-

Disclosure of comments via Elasticsearch integration

-

DNS Rebind SSRF in various chat notifications

-

Disclosure of vulnerability status in dependency list

-

Disclosure of commit count in Cycle Analytics

-

Exposure of related branch names

-

Tags pushes from blocked users

-

Branches and Commits exposed to Guest members via integration

-

IDOR when adding users to protected environments

-

Former project members able to access repository information

-

Unauthorized access to grafana metrics

-

Todos created for former project members

-

Update Mattermost dependency

-

Disclosure of AWS secret keys on certain Admin pages

-

Stored XSS in Group and User profile fields

-

Forked project information disclosed via Project API

-

Denial of Service in the issue and commit comment pages

-

Tokens stored in plaintext

-
- - - - https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released/ - CVE-2019-19088 - CVE-2019-19309 - CVE-2019-19086 - CVE-2019-19087 - CVE-2019-19261 - CVE-2019-19256 - CVE-2019-19254 - CVE-2019-19257 - CVE-2019-19263 - CVE-2019-19258 - CVE-2019-19259 - CVE-2019-19260 - CVE-2019-19262 - CVE-2019-19255 - CVE-2019-19310 - CVE-2019-19311 - CVE-2019-19312 - CVE-2019-19313 - CVE-2019-19314 - - - 2019-11-27 - 2019-11-27 - - - - - webkit2-gtk3 -- Multiple vulnerabilities - - - webkit2-gtk3 - 2.26.2 - - - - -

The WebKitGTK project reports multiple vulnerabilities.

- - - - https://webkitgtk.org/security/WSA-2019-0006.html - CVE-2019-8710 - CVE-2019-8743 - CVE-2019-8764 - CVE-2019-8765 - CVE-2019-8766 - CVE-2019-8782 - CVE-2019-8783 - CVE-2019-8808 - CVE-2019-8811 - CVE-2019-8812 - CVE-2019-8813 - CVE-2019-8814 - CVE-2019-8815 - CVE-2019-8816 - CVE-2019-8819 - CVE-2019-8820 - CVE-2019-8821 - CVE-2019-8822 - CVE-2019-8823 - - - 2019-11-08 - 2019-11-27 - - - - - urllib3 -- multiple vulnerabilities - - - py27-urllib3 - py35-urllib3 - py36-urllib3 - py37-urllib3 - py38-urllib3 - 1.24.3,1 - - - - -

NIST reports: (by search in the range 2018/01/01 - 2019/11/10):

-
-

urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext.

-

In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.

-

The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the ssl_context, ca_certs, or ca_certs_dir argument.

-
- - - - https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&query=urllib3&search_type=all&pub_start_date=01%2F01%2F2018&pub_end_date=11%2F10%2F2019 - CVE-2018-20060 - CVE-2019-11236 - CVE-2019-11324 - ports/229322 - - - 2018-12-11 - 2019-11-26 - - - - - FreeBSD -- Intel CPU Microcode Update - - - FreeBSD-kernel - 12.112.1_1 - 12.012.0_12 - 11.311.3_5 - - - - -

Starting with version 1.26, the devcpu-data port/package includes - updates and mitigations for the following technical and security - advisories (depending on CPU model).

-

Intel TSX Updates (TAA) CVE-2019-11135 Voltage Modulation - Vulnerability CVE-2019-11139 MD_CLEAR Operations - CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2018-11091 - TA Indirect Sharing CVE-2017-5715 EGETKEY CVE-2018-12126 - CVE-2018-12127 CVE-2018-12130 CVE-2018-11091 JCC SKX102 - Erratum

-

Updated microcode includes mitigations for - CPU issues, but may also cause a performance regression due - to the JCC erratum mitigation. Please visit - http://www.intel.com/benchmarks for further information. -

-

Please visit http://www.intel.com/security for - detailed information on these advisories as well as a list of - CPUs that are affected.

-

Operating a CPU without the latest microcode may result in erratic or - unpredictable behavior, including system crashes and lock ups. - Certain issues listed in this advisory may result in the leakage of - privileged system information to unprivileged users. Please refer to - the security advisories listed above for detailed information.

- - - - CVE-2019-11135 - CVE-2019-11139 - CVE-2018-12126 - CVE-2018-12127 - CVE-2018-12130 - CVE-2018-11091 - CVE-2017-5715 - SA-19:26.mcu - - - 2019-11-14 - 2019-11-25 - - - - - FreeBSD -- Machine Check Exception on Page Size Change - - - FreeBSD-kernel - 12.112.1_1 - 12.012.0_12 - 11.311.3_5 - - - - -

Intel discovered a previously published erratum on some Intel - platforms can be exploited by malicious software to potentially cause - a denial of service by triggering a machine check that will crash or - hang the system.

-

Malicious guest operating systems may be able to crash the host.

- - - - CVE-2018-12207 - SA-19:25.mcepsc - - - 2019-11-14 - 2019-11-25 - - - - - clamav -- Denial-of-Service (DoS) vulnerability - - - clamav - 0.102.1,1 - - - - -

Micah Snyder reports:

-
-

A Denial-of-Service (DoS) vulnerability may occur when scanning a specially crafted email - file as a result of excessively long scan times. The issue is resolved by implementing - several maximums in parsing MIME messages and by optimizing use of memory allocation.

-
- - - - https://blog.clamav.net/2019/11/clamav-01021-and-01015-patches-have.html - CVE-2019-15961 - - - 2019-09-06 - 2019-11-25 - - - - - unbound -- parsing vulnerability - - - unbound - 1.9.5 - - - - -

Unbound Security Advisories:

-
-

Recent versions of Unbound contain a vulnerability that can cause shell - code execution after receiving a specially crafted answer. This issue - can only be triggered if unbound was compiled with --enable-ipsecmod - support, and ipsecmod is enabled and used in the configuration.

-
- - - - https://nlnetlabs.nl/projects/unbound/security-advisories/#vulnerability-in-ipsec-module - CVE-2019-18934 - - - 2019-11-19 - 2019-11-23 - - - - - gitea -- multiple vulnerabilities - - - gitea - 1.9.10 - - - - -

The Gitea Team reports:

-
-

This release contains five security fixes, so we recommend updating:

-
    -
  • Fix issue with user.fullname
    • -
  • Ignore mentions for users with no access
    • -
  • Be more strict with git arguments
    • -
  • Extract the username and password from the mirror url
    • -
  • Reserve .well-known username
    • -
-
- - - - https://blog.gitea.io/2019/11/gitea-1.10.0-is-released/ - ports/241981 - - - 2019-11-17 - 2019-11-22 - - - - - asterisk -- Re-invite with T.38 and malformed SDP causes crash - - - asterisk13 - 13.29.2 - - - - -

The Asterisk project reports:

-
-

If Asterisk receives a re-invite initiating T.38 faxing - and has a port of 0 and no c line in the SDP, a crash - will occur.

-
- - - - https://downloads.asterisk.org/pub/security/AST-2019-008.html - CVE-2019-18976 - - - 2019-11-07 - 2019-11-22 - - - - - asterisk -- AMI user could execute system commands - - - asterisk13 - 13.29.2 - - - asterisk16 - 16.6.2 - - - - -

The Asterisk project reports:

-
-

A remote authenticated Asterisk Manager Interface (AMI) - user without system authorization could use a specially - crafted Originate AMI request to execute arbitrary system - commands.

-
- - - - https://downloads.asterisk.org/pub/security/AST-2019-007.html - CVE-2019-18610 - - - 2019-10-10 - 2019-11-22 - - - - - asterisk -- SIP request can change address of a SIP peer - - - asterisk13 - 13.29.2 - - - asterisk16 - 16.6.2 - - - - -

The Asterisk project reports:

-
-

A SIP request can be sent to Asterisk that can change - a SIP peers IP address. A REGISTER does not need to occur, - and calls can be hijacked as a result. The only thing - that needs to be known is the peers name; authentication - details such as passwords do not need to be known. This - vulnerability is only exploitable when the nat option is - set to the default, or auto_force_rport.

-
- - - - https://downloads.asterisk.org/pub/security/AST-2019-006.html - CVE-2019-18790 - - - 2019-10-17 - 2019-11-22 - - - - - drm graphics drivers -- Local privilege escalation and denial of service - - - drm-current-kmod - 4.16.g20191120 - - - drm-devel-kmod - 5.0.g20191120 - - - drm-fbsd12.0-kmod - 4.16.g20191120 - - - drm-fbsd11.2-kmod - 4.11.g20191204 - - - - -

Intel reports:

-
-

As part of IPU 2019.2, INTEL-SA-00242 advises that insufficient - access control may allow an authenticated user to potentially - enable escalation of privilege via local access.

-

INTEL-SA-00260 advises that insufficient access control may - allow an authenticated user to potentially enable denial of - service via local access.

-
- - - - https://blogs.intel.com/technology/2019/11/ipas-november-2019-intel-platform-update-ipu - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00242.html - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00260.html - CVE-2019-0154 - CVE-2019-11112 - - - 2019-11-12 - 2019-11-20 - 2019-12-04 - - - - - squid -- Vulnerable to HTTP Digest Authentication - - - squid - 4.9 - - - - -

Squid Team reports:

-
-

Problem Description: Due to incorrect data management Squid is - vulnerable to a information disclosure when processing HTTP Digest - Authentication.

-

Severity: Nonce tokens contain the raw byte value of a pointer which sits - within heap memory allocation. This information reduces ASLR protections - and may aid attackers isolating memory areas to target for remote code - execution attacks.

-
- - - - http://www.squid-cache.org/Advisories/SQUID-2019_11.txt - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18679 - CVE-2019-18679 - - - 2019-11-05 - 2019-11-19 - - - - - libidn2 -- roundtrip check vulnerability - - - libidn2 - 2.2.0 - - - - -

CVE list:

-
-

GNU libidn2 before 2.2.0 fails to perform the roundtrip checks - specified in RFC3490 Section 4.2 when converting A-labels to U-labels. - This makes it possible in some circumstances for one domain to - impersonate another. By creating a malicious domain that matches a - target domain except for the inclusion of certain punycoded Unicode - characters (that would be discarded when converted first to a Unicode - label and then back to an ASCII label), arbitrary domains can be - impersonated.

-
- - - - https://gitlab.com/libidn/libidn2/blob/master/NEWS - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12290 - CVE-2019-12290 - - - 2019-11-14 - 2019-11-18 - 2020-06-24 - - - - - GNU cpio -- multiple vulnerabilities - - - gcpio - 2.13 - - - - -

Sergey Poznyakoff reports:

-
-

This stable release fixes several potential vulnerabilities

-

CVE-2015-1197: cpio, when using the --no-absolute-filenames - option, allows local users to write to arbitrary files - via a symlink attack on a file in an archive.

-

CVE-2016-2037: The cpio_safer_name_suffix function in - util.c allows remote attackers to cause a denial of service - (out-of-bounds write) via a crafted cpio file.

-

CVE-2019-14866: Improper input validation when writing - tar header fields leads to unexpected tar generation.

-
- - - - https://lists.gnu.org/archive/html/bug-cpio/2019-11/msg00000.html - CVE-2015-1197 - CVE-2016-2037 - CVE-2019-14866 - - - 2019-11-06 - 2019-11-15 - - - - - libmad -- multiple vulnerabilities - - - libmad - 0.15.1b_7 - - - - -

National Vulnerability Database:

-
-

CVE-2017-8372: The mad_layer_III function in layer3.c in Underbit MAD - libmad 0.15.1b, if NDEBUG is omitted, allows remote attackers to cause a - denial of service (assertion failure and application exit) via a crafted - audio file.

-
-
-

CVE-2017-8373: The mad_layer_III function in layer3.c in Underbit MAD - libmad 0.15.1b allows remote attackers to cause a denial of service - (heap-based buffer overflow and application crash) or possibly have - unspecified other impact via a crafted audio file.

-
-
-

CVE-2017-8374: The mad_bit_skip function in bit.c in Underbit MAD - libmad 0.15.1b allows remote attackers to cause a denial of service - (heap-based buffer over-read and application crash) via a crafted audio - file.

-
- - - - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=508133#15 - https://nvd.nist.gov/vuln/detail/CVE-2017-8372 - https://nvd.nist.gov/vuln/detail/CVE-2017-8373 - https://nvd.nist.gov/vuln/detail/CVE-2017-8374 - https://blogs.gentoo.org/ago/2017/04/30/libmad-assertion-failure-in-layer3-c/ - https://blogs.gentoo.org/ago/2017/04/30/libmad-heap-based-buffer-overflow-in-mad_layer_iii-layer3-c/ - https://blogs.gentoo.org/ago/2017/04/30/libmad-heap-based-buffer-overflow-in-mad_bit_skip-bit-c/ - CVE-2017-8372 - CVE-2017-8373 - CVE-2017-8374 - - - 2017-04-30 - 2019-11-13 - - - - - chromium -- multiple vulnerabilities - - - chromium - 78.0.3904.97 - - - - -

Google Chrome Releases reports:

-
-

Four security issues were fixed, including:

-
    -
  • [1021723] Various fixes from internal audits, fuzzing and other - initiatives
    • -
-
- - - - https://chromereleases.googleblog.com/2019/11/stable-channel-update-for-desktop.html - - - 2019-11-06 - 2019-11-12 - - - - - wordpress -- multiple issues - - - wordpress - fr-wordpress - 5.2.4,1 - - - de-wordpress - zh_CN-wordpress - zh_TW-wordpress - ja-wordpress - ru-wordpress - 5.2.4 - - - - -

wordpress developers reports:

-
-

Props to Evan Ricafort for finding an issue where stored XSS (cross-site scripting) - could be added via the Customizer.

-

rops to J.D. Grimes who found and disclosed a method of viewing unauthenticated posts.

-

Props to Weston Ruter for finding a way to create a stored XSS to inject Javascript - into style tags.

-

rops to David Newman for highlighting a method to poison the cache of JSON GET requests - via the Vary: Origin header.

-

Props to Eugene Kolodenker who found a server-side request forgery in the way that URLs - are validated.

-

Props to Ben Bidner of the WordPress Security Team who discovered issues related to - referrer validation in the admin.

-
- - - - https://wordpress.org/news/2019/10/wordpress-5-2-4-security-release/ - - - 2019-10-14 - 2019-11-12 - - - - - nexus2-oss -- Multiple vulerabilities - - - nexus2-oss - 2.14.15 - - - - -

Sonatype reports:

-
-

Several RCE vulnerabilities have been found and corrected in 2.14.15:

-

CVE-2019-16530: An attacker with elevated privileges can upload a - specially crafted file. That file can contain commands that will - be executed on the system, with the same privileges as the user - running the server.

-

CVE-2019-15893: A Remote Code Execution vulnerability has been - discovered in Nexus Repository Manager requiring immediate - action. The vulnerability allows for an attacker with - administrative access to NXRM to create repostories that can - grant access to read/execute system data outside the scope of - NXRM.

-

CVE-2019-5475: A vulnerability has been found that can allow - user's with administrative privileges to run processes on the - target server, that the nxrm os user has access to.

-
- - - - CVE-2019-16530 - CVE-2019-15893 - CVE-2019-5475 - - - 2019-09-19 - 2019-11-07 - - - - - php -- env_path_info underflow in fpm_main.c can lead to RCE - - - php71 - 7.1.33 - - - php72 - 7.2.24 - - - php73 - 7.3.11 - - - php74 - 7.4.0.rc5 - - - - -

The PHP project reports:

-
-

The PHP development team announces the immediate availability of PHP 7.3.11. This is a security release which also contains several bug fixes.

-
-
-

The PHP development team announces the immediate availability of PHP 7.2.24. This is a security release which also contains several bug fixes.

-
-
-

The PHP development team announces the immediate availability of PHP 7.1.33. This is a security release which also contains several bug fixes.

-
- - - - CVE-2019-11043 - https://www.php.net/archive/2019.php#2019-10-24-1 - https://www.php.net/archive/2019.php#2019-10-24-2 - https://www.php.net/archive/2019.php#2019-10-24-3 - - - 2019-10-24 - 2019-11-06 - - - - - mediawiki -- multiple vulnerabilities - - - mediawiki131 - 1.31.5 - - - mediawiki132 - 1.32.5 - - - mediawiki133 - 1.33.1 - - - - -

Mediawiki reports:

-
-

Security fixes: - T230402, CVE-2019-16738 SECURITY: Add permission check for suppressed account - to Special:Redirect.

-
- - - - CVE-2019-16738 - https://lists.wikimedia.org/pipermail/mediawiki-announce/2019-October/000236.html - - - 2019-08-13 - 2019-11-03 - - - - - MySQL -- Multiple vulerabilities - - - mariadb55-server - 5.5.66 - - - mariadb101-server - 10.1.42 - - - mariadb102-server - 10.2.28 - - - mariadb103-server - 10.3.19 - - - mariadb104-server - 10.4.9 - - - mysql56-server - 5.6.46 - - - mysql57-server - 5.7.28 - - - mysql80-server - 8.0.18 - - - percona55-server - 5.5.66 - - - percona56-server - 5.6.46 - - - percona57-server - 5.7.28 - - - - -

Oracle reports:

-
-

This Critical Patch Update contains 31 new security fixes for - Oracle MySQL. 6 of these vulnerabilities may be remotely exploitable - without authentication, i.e., may be exploited over a network without - requiring user credentials. -

-
- - - - https://www.oracle.com/security-alerts/cpuoct2019.html - CVE-2019-5443 - CVE-2019-1543 - CVE-2019-3011 - CVE-2019-2966 - CVE-2019-2967 - CVE-2019-2974 - CVE-2019-2946 - CVE-2019-3004 - CVE-2019-2914 - CVE-2019-2969 - CVE-2019-2991 - CVE-2019-2920 - CVE-2019-2993 - CVE-2019-2922 - CVE-2019-2923 - CVE-2019-2924 - CVE-2019-2963 - CVE-2019-2968 - CVE-2019-3003 - CVE-2019-2997 - CVE-2019-2948 - CVE-2019-2950 - CVE-2019-2982 - CVE-2019-2998 - CVE-2019-2960 - CVE-2019-2957 - CVE-2019-2938 - CVE-2019-3018 - CVE-2019-3009 - CVE-2019-2910 - CVE-2019-2911 - - - 2019-10-15 - 2019-11-02 - - - - - file -- Heap buffer overflow possible - - - file - 5.37 - - - - -

mitre reports

-
-

cdf_read_property_info in cdf.c in file through 5.37 does not - restrict the number of CDF_VECTOR elements, which allows a heap-based - buffer overflow (4-byte out-of-bounds write).

-
- - - - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16780 - https://github.com/file/file/commit/46a8443f76cec4b41ec736eca396984c74664f84 - - - 2019-08-26 - 2019-11-02 - - - - - webkit2-gtk3 -- Multiple vulnerabilities - - - webkit2-gtk3 - 2.26.1 - - - - -

The WebKitGTK project reports multiple vulnerabilities.

- - - - https://webkitgtk.org/security/WSA-2019-0005.html - CVE-2019-8625 - CVE-2019-8674 - CVE-2019-8707 - CVE-2019-8719 - CVE-2019-8720 - CVE-2019-8726 - CVE-2019-8733 - CVE-2019-8735 - CVE-2019-8763 - CVE-2019-8768 - CVE-2019-8769 - CVE-2019-8771 - - - 2019-10-29 - 2019-10-31 - - - - - gitea -- information disclosure - - - gitea - 1.9.5 - - - - -

The Gitea Team reports:

-
-

When a comment in an issue or PR mentions a user using - @username, the mentioned user receives a mail notification even if - they don't have permission to see the originating repository.

-
- - - - https://github.com/go-gitea/gitea/releases/tag/v1.9.5 - https://blog.gitea.io/2019/10/gitea-1.9.5-is-released/ - - - 2019-09-27 - 2019-10-30 - - - - - samba -- multiple vulnerabilities - - - samba48 - 4.8.12 - - - samba410 - 4.10.10 - - - samba411 - 4.11.2 - - - - -

The samba project reports:

-
-

Malicious servers can cause Samba client code to return filenames containing - path separators to calling code.

-
-
-

When the password contains multi-byte (non-ASCII) characters, the check - password script does not receive the full password string.

-
-
-

Users with the "get changes" extended access right can crash the AD DC LDAP - server by requesting an attribute using the range= syntax.

-
- - - - https://www.samba.org/samba/security/CVE-2019-10218.html - CVE-2019-10218 - https://www.samba.org/samba/security/CVE-2019-14833.html - CVE-2019-14833 - https://www.samba.org/samba/security/CVE-2019-14847.html - CVE-2019-14847 - - - 2019-09-29 - 2019-10-29 - - - - - Gitlab -- Disclosure Vulnerabilities - - - gitlab-ce - 12.4.012.4.1 - 12.3.012.3.6 - 012.2.9 - - - - -

Gitlab reports:

-
-

Source branch of a MR could be removed by an unauthorised user

-

Private group members could be listed

-

Disclosure of System Notes via Elasticsearch integration

-

Disclosure of Private Comments via Elasticsearch integration

-

Confirm existence of private repositories

-

Private group membership could be disclosed

-

Disclosure of Project Labels

-

Disclosure of Private Project Path and Labels

-

Uncontrolled Resource Consumption due to Nested GraphQL Queries

-

Improper access control on comments

-

Sentry Token Access Control

-

Authorisation check for Project Transfer option

-

XSS in Wiki Pages Using RDoc

-

Untrusted Input could be used for Internal Redirect

-

Access control for protected environments

-

Private Sub Group path Disclosure

-

Disclosure of Group Packages List

-

Private Repository Name Disclosure

-
- - - - https://about.gitlab.com/blog/2019/10/30/security-release-gitlab-12-dot-4-dot-1-released/ - CVE-2019-18446 - CVE-2019-18447 - CVE-2019-18460 - CVE-2019-18456 - CVE-2019-18448 - CVE-2019-18449 - CVE-2019-18450 - CVE-2019-18452 - CVE-2019-18455 - CVE-2019-18453 - CVE-2019-18457 - CVE-2019-18458 - CVE-2019-18454 - CVE-2019-18451 - CVE-2019-18459 - CVE-2019-18461 - CVE-2019-18463 - CVE-2019-18462 - - - 2019-10-30 - 2019-10-30 - - - - - FreeBSD -- Reference count overflow in mqueue filesystem 32-bit compat - - - FreeBSD-kernel - 12.012.0_10 - 11.311.3_3 - 11.211.2_14 - - - - -

Problem Description:

-

System calls operating on file descriptors obtain a - reference to relevant struct file which due to a programming - error was not always put back, which in turn could be used - to overflow the counter of affected struct file.

-

Impact:

-

A local user can use this flaw to obtain access to files, - directories, sockets, etc., opened by processes owned by - other users. If obtained struct file represents a directory - from outside of user's jail, it can be used to access files - outside of the jail. If the user in question is a jailed - root they can obtain root privileges on the host system.

- - - - CVE-2019-5603 - SA-19:24.mqueuefs - - - 2019-08-20 - 2019-10-24 - - - - - FreeBSD -- kernel memory disclosure from /dev/midistat - - - FreeBSD-kernel - 12.012.0_10 - 11.311.3_3 - 11.211.2_14 - - - - -

Problem Description:

-

The kernel driver for /dev/midistat implements a handler - for read(2). This handler is not thread-safe, and a - multi-threaded program can exploit races in the handler to - cause it to copy out kernel memory outside the boundaries - of midistat's data buffer.

-

Impact:

-

The races allow a program to read kernel memory within - a 4GB window centered at midistat's data buffer. The buffer - is allocated each time the device is opened, so an attacker - is not limited to a static 4GB region of memory.

-

On 32-bit platforms, an attempt to trigger the race may - cause a page fault in kernel mode, leading to a panic.

- - - - CVE-2019-5612 - SA-19:23.midi - - - 2019-08-20 - 2019-10-24 - - - - - FreeBSD -- IPv6 remote Denial-of-Service - - - FreeBSD-kernel - 12.012.0_10 - 11.311.3_3 - 11.211.2_14 - - - - -

Problem Description:

-

Due do a missing check in the code of m_pulldown(9) data - returned may not be contiguous as requested by the caller.

-

Impact:

-

Extra checks in the IPv6 code catch the error condition - and trigger a kernel panic leading to a remote DoS - (denial-of-service) attack with certain Ethernet interfaces. - At this point it is unknown if any other than the IPv6 code - paths can trigger a similar condition.

- - - - CVE-2019-5611 - SA-19:22.mbuf - - - 2019-08-20 - 2019-10-24 - - - - - FreeBSD -- Insufficient validation of guest-supplied data (e1000 device) - - - FreeBSD-kernel - 12.012.0_9 - 11.311.3_2 - 11.211.2_13 - - - - -

Problem Description:

-

The e1000 network adapters permit a variety of modifications - to an Ethernet packet when it is being transmitted. These - include the insertion of IP and TCP checksums, insertion - of an Ethernet VLAN header, and TCP segmentation offload - ("TSO"). The e1000 device model uses an on-stack buffer to - generate the modified packet header when simulating these - modifications on transmitted packets.

-

When TCP segmentation offload is requested for a transmitted - packet, the e1000 device model used a guest-provided value - to determine the size of the on-stack buffer without - validation. The subsequent header generation could overflow - an incorrectly sized buffer or indirect a pointer composed - of stack garbage.

-

Impact:

-

A misbehaving bhyve guest could overwrite memory in the - bhyve process on the host.

- - - - CVE-2019-5609 - SA-19:21.bhyve - - - 2019-08-06 - 2019-10-24 - - - - - FreeBSD -- Insufficient message length validation in bsnmp library - - - FreeBSD - 12.012.0_9 - 11.311.3_2 - 11.211.2_13 - - - - -

Problem Description:

-

A function extracting the length from type-length-value - encoding is not properly validating the submitted length.

-

Impact:

-

A remote user could cause, for example, an out-of-bounds - read, decoding of unrelated data, or trigger a crash of the - software such as bsnmpd resulting in a denial of service.

- - - - CVE-2019-5610 - SA-19:20.bsnmp - - - 2019-08-06 - 2019-10-24 - - - - - FreeBSD -- ICMPv6 / MLDv2 out-of-bounds memory access - - - FreeBSD-kernel - 12.012.0_9 - 11.311.3_2 - 11.211.2_13 - - - - -

Problem Description:

-

The ICMPv6 input path incorrectly handles cases where - an MLDv2 listener query packet is internally fragmented - across multiple mbufs.

-

Impact:

-

A remote attacker may be able to cause an out-of-bounds - read or write that may cause the kernel to attempt to access - an unmapped page and subsequently panic.

- - - - CVE-2019-5608 - SA-19:19.mldv2 - - - 2019-08-06 - 2019-10-24 - - - - - FreeBSD -- Multiple vulnerabilities in bzip2 - - - FreeBSD - 12.012.0_9 - 11.311.3_2 - 11.211.2_13 - - - - -

Problem Description:

-

The decompressor used in bzip2 contains a bug which can - lead to an out-of-bounds write when processing a specially - crafted bzip2(1) file.

-

bzip2recover contains a heap use-after-free bug which - can be triggered when processing a specially crafted bzip2(1) - file.

-

Impact:

-

An attacker who can cause maliciously crafted input to - be processed may trigger either of these bugs. The bzip2recover - bug may cause a crash, permitting a denial-of-service. The - bzip2 decompressor bug could potentially be exploited to - execute arbitrary code.

-

Note that some utilities, including the tar(1) archiver - and the bspatch(1) binary patching utility (used in portsnap(8) - and freebsd-update(8)) decompress bzip2(1)-compressed data - internally; system administrators should assume that their - systems will at some point decompress bzip2(1)-compressed - data even if they never explicitly invoke the bunzip2(1) - utility.

- - - - CVE-2016-3189 - CVE-2019-1290 - SA-19:18.bzip2 - - - 2019-08-06 - 2019-10-24 - - - - - varnish -- Information Disclosure Vulnerability - - - varnish6 - 6.3.1 - - - - -

Varnish Software reports:

-
-

A bug has been discovered in Varnish Cache where we fail to - clear a pointer between the handling of one client requests and the next - on the same connection. This can under specific circumstances lead to - information being leaked from the connection workspace.

-
- - - - https://varnish-cache.org/security/VSV00004.html#vsv00004 - - - 2019-10-21 - 2019-10-24 - - - - - sudo -- Potential bypass of Runas user restrictions - - - sudo - 1.8.28 - - - - -

Todd C. Miller reports:

-
-

When sudo is configured to allow a user to run commands as an - arbitrary user via the ALL keyword in a Runas specification, it - is possible to run commands as root by specifying the user ID -1 - or 4294967295.

-

This can be used by a user with sufficient sudo privileges to - run commands as root even if the Runas specification explicitly - disallows root access as long as the ALL keyword is listed first - in the Runas specification.

-

Log entries for commands run this way will list the target user - as 4294967295 instead of root. In addition, PAM session modules - will not be run for the command.

-
- - - - https://www.sudo.ws/alerts/minus_1_uid.html - CVE-2019-14287 - - - 2019-10-15 - 2019-10-24 - - - - - Loofah -- XSS vulnerability - - - rubygem-loofah - 2.3.1 - - - - -

GitHub issue:

-
-

This issue has been created for public disclosure of an XSS - vulnerability that was responsibly reported by - https://hackerone.com/vxhex

-

In the Loofah gem, through v2.3.0, unsanitized JavaScript may occur in - sanitized output when a crafted SVG element is republished.

-
- - - - https://github.com/flavorjones/loofah/releases - https://github.com/flavorjones/loofah/issues/171 - CVE-2019-15587 - - - 2019-10-22 - 2019-10-23 - - - - - python 3.7 -- multiple vulnerabilities - - - python37 - 3.7.5 - - - - -

Python changelog:

-
-

bpo-38243: Escape the server title of xmlrpc.server.DocXMLRPCServer when rendering - the document page as HTML.

-

bpo-38174: Update vendorized expat library version to 2.2.8, which resolves - CVE-2019-15903.

-

bpo-37764: Fixes email._header_value_parser.get_unstructured going into an infinite - loop for a specific case in which the email header does not have trailing whitespace, - and the case in which it contains an invalid encoded word.

-

bpo-37461: Fix an infinite loop when parsing specially crafted email headers.

-

bpo-34155: Fix parsing of invalid email addresses with more than one @ - (e.g. a@b@c.com.) to not return the part before 2nd @ as valid email address.

-
- - - - https://docs.python.org/3.7/whatsnew/changelog.html#python-3-7-5-final - CVE-2019-15903 - - - 2019-09-14 - 2019-10-19 - - - - - Pillow -- Allocation of resources without limits or throttling - - - py27-pillow - py35-pillow - py36-pillow - py37-pillow - 6.2.0 - - - - -

Mitre reports:

-
-

An issue was discovered in Pillow before 6.2.0. When reading specially - crafted invalid image files, the library can either allocate very large - amounts of memory or take an extremely long period of time to process - the image.

-
- - - - https://github.com/python-pillow/Pillow/issues/4123 - CVE-2019-16865 - ports/241268 - - - 2019-09-24 - 2019-10-15 - - - - - mongodb -- Bump Windows package dependencies - - - mongodb34 - 3.4.22 - - - mongodb36 - 3.6.14 - - - mongodb40 - 4.0.11 - - - - -

Rich Mirch reports:

-
-

An unprivileged user or program on Microsoft Windows which can create OpenSSL configuration files in a fixed location may cause utility programs shipped with MongoDB server versions less than 4.0.11, 3.6.14, and 3.4.22 to run attacker defined code as the user running the utility.

-
- - - - CVE-2019-2390 - https://jira.mongodb.org/browse/SERVER-42233 - - - 2019-08-06 - 2019-09-30 - - - - - mongodb -- Our init scripts check /proc/[pid]/stat should validate that `(${procname})` is the process' command name. - - - mongodb34 - 3.4.22 - - - mongodb36 - 3.6.14 - - - mongodb40 - 4.0.11 - - - - -

Sicheng Liu of Beijing DBSEC Technology Co., Ltd reports:

-
-

Incorrect scoping of kill operations in MongoDB Server's packaged SysV init scripts allow users with write access to the PID file to insert arbitrary PIDs to be killed when the root user stops the MongoDB process via SysV init.

-
- - - - CVE-2019-2389 - https://jira.mongodb.org/browse/SERVER-40563 - - - 2019-08-06 - 2019-09-30 - - - - - mongodb -- Attach IDs to users - - - mongodb34 - 3.4.22 - - - mongodb36 - 3.6.13 - - - mongodb40 - 4.0.9 - - - - -

Mitch Wasson of Cisco's Advanced Malware Protection Group reports:

-
-

After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's session to persist and become conflated with new accounts, if those accounts reuse the names of deleted ones.

-
- - - - CVE-2019-2386 - https://jira.mongodb.org/browse/SERVER-38984 - - - 2019-08-06 - 2019-09-28 - - - - - mod_perl2 -- execute arbitrary Perl code - - - ap24-mod_perl2 - 2.0.11,3 - - - - -

mod_perl2 2.0.11 fixes Arbitrary Perl code execution in the context - of the user account via a user-owned .htaccess.

-
-

mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary - Perl code by placing it in a user-owned .htaccess file, because - (contrary to the documentation) there is no configuration option - that permits Perl code for the administrator's control of HTTP - request processing without also permitting unprivileged users - to run Perl code in the context of the user account that runs - Apache HTTP Server processes.

-
- - - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2767 - https://www.securityfocus.com/bid/105195 - https://access.redhat.com/errata/RHSA-2018:2826 - https://bugs.debian.org/644169 - https://usn.ubuntu.com/3825-2/ - - - 2011-07-19 - 2019-10-09 - - - - - Xpdf -- Multiple Vulnerabilities - - - xpdf - 4.02,1 - - - xpdf4 - 4.02,1 - - - xpdf3 - 3.04_11 - - - - -

Xpdf 4.02 fixes two vulnerabilities. Both fixes have been - backported to 3.04.

-
-

An invalid memory access vulnerability in TextPage::findGaps() - in Xpdf 4.01 through a crafted PDF document can cause a - segfault.

-
-
-

An out of bounds write exists in TextPage::findGaps() of - Xpdf 4.01.01

-
- - - - https://nvd.nist.gov/vuln/detail/CVE-2019-9877 - https://nvd.nist.gov/vuln/detail/CVE-2019-16927 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9877 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1692 - - - 2019-10-01 - 2019-10-06 - - - - - unbound -- parsing vulnerability - - - unbound - 1.7.11.9.4 - - - - -

Unbound Security Advisories:

-
-

Due to an error in parsing NOTIFY queries, it is possible for Unbound - to continue processing malformed queries and may ultimately result in a - pointer dereference in uninitialized memory. This results in a crash of - the Unbound daemon.

-
- - - - https://www.nlnetlabs.nl/projects/unbound/security-advisories/#vulnerability-in-parsing-notify-queries - CVE-2019-16866 - - - 2019-10-03 - 2019-10-03 - - - - - ruby -- multiple vulnerabilities - - - ruby - 2.4.0,12.4.9,1 - 2.5.0,12.5.7,1 - 2.6.0,12.6.5,1 - - - - -

Ruby news:

-
-

This release includes security fixes. Please check the topics below for - details.

-

CVE-2019-15845: A NUL injection vulnerability of File.fnmatch and - File.fnmatch?

-

A NUL injection vulnerability of Ruby built-in methods (File.fnmatch - and File.fnmatch?) was found. An attacker who has the control of the - path pattern parameter could exploit this vulnerability to make path - matching pass despite the intention of the program author.

-

CVE-2019-16201: Regular Expression Denial of Service vulnerability of - WEBrick's Digest access authentication

-

Regular expression denial of service vulnerability of WEBrick's Digest - authentication module was found. An attacker can exploit this - vulnerability to cause an effective denial of service against a WEBrick - service.

-

CVE-2019-16254: HTTP response splitting in WEBrick (Additional fix)

-

There is an HTTP response splitting vulnerability in WEBrick bundled - with Ruby.

-

CVE-2019-16255: A code injection vulnerability of Shell#[] and - Shell#test

-

A code injection vulnerability of Shell#[] and Shell#test in a standard - library (lib/shell.rb) was found.

-
- - - - https://www.ruby-lang.org/en/news/2019/10/01/ruby-2-6-5-released/ - https://www.ruby-lang.org/en/news/2019/10/01/ruby-2-5-7-released/ - https://www.ruby-lang.org/en/news/2019/10/01/ruby-2-4-8-released/ - https://www.ruby-lang.org/en/news/2019/10/02/ruby-2-4-9-released/ - https://www.ruby-lang.org/en/news/2019/10/01/nul-injection-file-fnmatch-cve-2019-15845/ - https://www.ruby-lang.org/en/news/2019/10/01/webrick-regexp-digestauth-dos-cve-2019-16201/ - https://www.ruby-lang.org/en/news/2019/10/01/http-response-splitting-in-webrick-cve-2019-16254/ - https://www.ruby-lang.org/en/news/2019/10/01/code-injection-shell-test-cve-2019-16255/ - CVE-2019-15845 - CVE-2019-16201 - CVE-2019-16254 - CVE-2019-16255 - - - 2019-10-01 - 2019-10-02 - - - - - Gitlab -- Disclosure Vulnerabilities - - - gitlab-ce - 12.3.012.3.3 - 12.2.012.2.7 - 8.17.012.1.13 - - - - -

Gitlab reports:

-
-

Disclosure of Private Code, Merge Requests and Commits via Elasticsearch integration

-
- - - - https://about.gitlab.com/2019/10/02/security-release-gitlab-12-dot-3-dot-3-released/ - - - 2019-10-02 - 2019-10-02 - - - - - Gitlab -- Multiple Vulnerabilities - - - gitlab-ce - 12.3.012.3.2 - 12.2.012.2.6 - 7.12.012.1.12 - - - - -

SO-AND-SO reports:

-
-

XSS in Markdown Preview Using Mermaid

-

Bypass Email Verification using Salesforce Authentication

-

Account Takeover using SAML

-

Uncontrolled Resource Consumption in Markdown using Mermaid

-

Disclosure of Private Project Path and Labels

-

Disclosure of Assignees via Milestones

-

Disclosure of Project Path via Unsubscribe Link

-

Disclosure of Project Milestones via Groups

-

Disclosure of Private System Notes via GraphQL

-

GIT Command Injection via API

-

Bypass User Blocking via CI/CD token

-

IDOR Adding Groups to Protected Environments

-

Disclosure of Group Membership via Merge Request Approval Rules

-

Disclosure of Head Pipeline via Blocking Merge Request Feature

-

Grafana update

-
- - - - https://about.gitlab.com/2019/09/30/security-release-gitlab-12-dot-3-dot-2-released/ - CVE-2019-19039 - - - 2019-09-30 - 2019-10-02 - - - - - cacti -- Authenticated users may bypass authorization checks - - - cacti - 1.2.7 - - - - -

The cacti developers reports:

-
-

In Cacti through 1.2.6, authenticated users may bypass authorization checks - (for viewing a graph) via a direct graph_json.php request with a modified - local_graph_id parameter.

-
- - - - CVE-2019-16723 - https://github.com/Cacti/cacti/releases/tag/release%2F1.2.7 - - - 2019-09-23 - 2019-10-02 - - - - - Exim -- heap-based buffer overflow in string_vformat leading to RCE - - - exim - 4.924.92.3 - - - - -

Exim developers team report:

-
-

There is a heap overflow in string_vformat().Using a EHLO message, remote code -execution seems to be possible.

-
- - - - https://www.openwall.com/lists/oss-security/2019/09/28/1 - - - 2019-09-28 - 2019-09-29 - - - - - go -- invalid headers are normalized, allowing request smuggling - - - go - 1.13.1,1 - - - go-devel - g20190925 - - - - -

The Go project reports:

-
-

net/http (through net/textproto) used to accept and normalize invalid - HTTP/1.1 headers with a space before the colon, in violation of RFC 7230. - If a Go server is used behind a reverse proxy that accepts and forwards - but doesn't normalize such invalid headers, the reverse proxy and the - server can interpret the headers differently. This can lead to filter - bypasses or request smuggling, the latter if requests from separate clients - are multiplexed onto the same connection by the proxy. Such invalid headers - are now rejected by Go servers, and passed without normalization to Go - client applications.

-
- - - - CVE-2019-16276 - https://github.com/golang/go/issues/34540 - - - 2019-09-25 - 2019-09-26 - - - - - mantis -- multiple vulnerabilities - - - mantis-php71 - mantis-php72 - mantis-php73 - mantis-php74 - 2.22.1,1 - - - - -

The Mantis developers report:

-
-

CVE-2019-15715: [Admin Required - Post Authentication] Command Execution / Injection Vulnerability

-

CVE-2019-8331: In Bootstrap before 3.4.1, XSS is possible in the tooltip or popover data-template attribute

-

Missing integrity hashes for CSS resources from CDNs

-
- - - - https://mantisbt.org/bugs/changelog_page.php?project=mantisbt&version=2.22.1 - CVE-2019-15715 - CVE-2019-8331 - - - 2019-08-28 - 2019-09-27 - - - - - jenkins -- multiple vulnerabilities - - - jenkins - 2.196 - - - jenkins-lts - 2.176.3 - - - - -

Jenkins Security Advisory:

-
-

Description

-
(Medium) SECURITY-1498 / CVE-2019-10401
-

Stored XSS vulnerability in expandable textbox form control

-
(Medium) SECURITY-1525 / CVE-2019-10402
-

XSS vulnerability in combobox form control

-
(Medium) SECURITY-1537 (1) / CVE-2019-10403
-

Stored XSS vulnerability in SCM tag action tooltip

-
(Medium) SECURITY-1537 (2) / CVE-2019-10404
-

Stored XSS vulnerability in queue item tooltip

-
(Medium) SECURITY-1505 / CVE-2019-10405
-

Diagnostic web page exposed Cookie HTTP header

-
(Medium) SECURITY-1471 / CVE-2019-10406
-

XSS vulnerability in Jenkins URL setting

-
- - - - CVE-2019-10401 - CVE-2019-10402 - CVE-2019-10403 - CVE-2019-10404 - CVE-2019-10405 - CVE-2019-10406 - https://jenkins.io/security/advisory/2019-09-25/ - - - 2019-09-25 - 2019-09-25 - - - - - ISC KEA -- Multiple vulnerabilities - - - kea - 1.6.0 - - - - -

Internet Systems Consortium, Inc. reports:

-
-

A packet containing a malformed DUID can cause the kea-dhcp6 server to terminate (CVE-2019-6472) [Medium]

-

An invalid hostname option can cause the kea-dhcp4 server to terminate (CVE-2019-6473) [Medium]

-

An oversight when validating incoming client requests can lead to a situation where the Kea server
- will exit when trying to restart (CVE-2019-6474) [Medium]

-
- - - - https://gitlab.isc.org/isc-projects/kea/issues - CVE-2019-6472 - CVE-2019-6473 - CVE-2019-6474 - - - 2019-08-28 - 2019-09-20 - - - - - expat2 -- Fix extraction of namespace prefixes from XML names - - - expat - 2.2.8 - - - - -

expat project reports:

-
-

- Fix heap overflow triggered by - XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber), - and deny internal entities closing the doctype -

-
- - - - https://github.com/libexpat/libexpat/blob/R_2_2_8/expat/Changes - - - 2019-09-13 - 2019-09-17 - - - - - Gitlab -- Multiple Vulnerabilities - - - gitlab-ce - 12.2.012.2.5 - 12.1.012.1.9 - 11.6.012.0.9 - - - - -

Gitlab reports:

-
-

Project Template Functionality Could Be Used to Access Restricted Project Data

-

Security Enhancements in GitLab Pages

-
- - - - https://about.gitlab.com/2019/09/10/critical-security-release-gitlab-12-dot-2-dot-5-released/ - CVE-2019-16170 - - - 2019-09-10 - 2019-09-12 - - - - - Mbed TLS -- Side channel attack on deterministic ECDSA - - - mbedtls - 2.16.3 - - - - -

Janos Follath reports:

-
-

Mbed TLS does not have a constant-time/constant-trace arithmetic - library and uses blinding to protect against side channel - attacks.

-

In the ECDSA signature routine previous Mbed TLS versions used the - same RNG object for generating the ephemeral key pair and for - generating the blinding values. The deterministic ECDSA function - reused this by passing the RNG object created from the private key - and the message to be signed as prescribed by RFC 6979. This meant - that the same RNG object was used whenever the same message was - signed, rendering the blinding ineffective.

-

If the victim can be tricked to sign the same message repeatedly, - the private key may be recoverable through side channels.

-
- - - - https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2019-10 - - - 2019-09-06 - 2019-09-19 - - - - - bro -- invalid memory access or heap buffer over-read - - - bro - 2.6.4 - - - - -

Jon Siwek of Corelight reports:

-
-

This is a security patch release to address a potential - Denial of Service vulnerability:

-
    -
  • - The NTLM analyzer did not properly handle AV Pair sequences - that were either empty or unterminated, resulting in - invalid memory access or heap buffer over-read. The NTLM - analyzer is enabled by default and used in the analysis - of SMB, DCE/RPC, and GSSAPI protocols.
    • -
-
- - - - https://raw.githubusercontent.com/zeek/zeek/3b5a9f88ece1d274edee897837e280ef751bde94/NEWS - - - 2019-08-28 - 2019-09-17 - - - - - expat2 -- Fix extraction of namespace prefixes from XML names - - - expat - 2.2.7 - - - - -

expat project reports:

-
-

- XML names with multiple colons could end up in the - wrong namespace, and take a high amount of RAM and CPU - resources while processing, opening the door to - use for denial-of-service attacks -

-
- - - - https://github.com/libexpat/libexpat/blob/R_2_2_7/expat/Changes - - - 2019-06-19 - 2019-09-16 - - - - - curl -- multiple vulnerabilities - - - curl - 7.19.47.66.0 - - - - -

curl security problems:

-
-

CVE-2019-5481: FTP-KRB double-free

-

libcurl can be told to use kerberos over FTP to a server, as set with - the CURLOPT_KRBLEVEL option.

-

During such kerberos FTP data transfer, the server sends data to curl - in blocks with the 32 bit size of each block first and then that amount - of data immediately following.

-

A malicious or just broken server can claim to send a very large block - and if by doing that it makes curl's subsequent call to realloc() to - fail, curl would then misbehave in the exit path and double-free the - memory.

-

In practical terms, an up to 4 GB memory area may very well be fine to - allocate on a modern 64 bit system but on 32 bit systems it will fail.

-

Kerberos FTP is a rarely used protocol with curl. Also, Kerberos - authentication is usually only attempted and used with servers that the - client has a previous association with.

-

CVE-2019-5482: TFTP small blocksize heap buffer overflow

-

libcurl contains a heap buffer overflow in the function - (tftp_receive_packet()) that receives data from a TFTP server. It can - call recvfrom() with the default size for the buffer rather than with - the size that was used to allocate it. Thus, the content that might - overwrite the heap memory is controlled by the server.

-

This flaw is only triggered if the TFTP server sends an OACK without - the BLKSIZE option, when a BLKSIZE smaller than 512 bytes was requested - by the TFTP client. OACK is a TFTP extension and is not used by all - TFTP servers.

-

Users choosing a smaller block size than default should be rare as the - primary use case for changing the size is to make it larger.

-

It is rare for users to use TFTP across the Internet. It is most - commonly used within local networks. TFTP as a protocol is always - inherently insecure.

-

This issue was introduced by the add of the TFTP BLKSIZE option - handling. It was previously incompletely fixed by an almost identical - issue called CVE-2019-5436.

-
- - - - https://curl.haxx.se/docs/security.html - https://curl.haxx.se/docs/CVE-2019-5481.html - https://curl.haxx.se/docs/CVE-2019-5482.html - CVE-2019-5481 - CVE-2019-5482 - - - 2019-09-11 - 2019-09-14 - - - - - OpenSSL -- Multiple vulnerabilities - - - openssl - 1.0.2t,1 - - - openssl111 - 1.1.1d - - - - -

The OpenSSL project reports:

-
-

ECDSA remote timing attack (CVE-2019-1547) [Low]

-

Fork Protection (CVE-2019-1549) [Low]
- (OpenSSL 1.1.1 only)

-
- - - - https://www.openssl.org/news/secadv/20190910.txt - CVE-2019-1547 - CVE-2019-1549 - - - 2019-09-10 - 2019-09-11 - - - - - Flash Player -- multiple vulnerabilities - - - linux-flashplayer - 32.0.0.255 - - - - -

Adobe reports:

-
-
    -
  • This update resolves a same origin method execution - vulnerability that could lead to arbitrary code execution - (CVE-2019-8069).
    • -
  • This update resolves a use-after-free vulnerability that - could lead to arbitrary code execution (CVE-2019-8070).
    • -
-
- - - - CVE-2019-8069 - CVE-2019-8070 - https://helpx.adobe.com/security/products/flash-player/apsb19-46.html - - - 2019-09-10 - 2019-09-10 - - - - - oniguruma -- multiple vulnerabilities - - - oniguruma - 6.9.3 - - - - -
-

- A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that gets handled by onig_new_deluxe(). -

-
-
-

A NULL Pointer Dereference in match_at() in regexec.c in Oniguruma 6.9.2 allows attackers to potentially cause denial of service by providing a crafted regular expression.

-

Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust.

-
- - - - CVE-2019-13224 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13224 - https://github.com/kkos/oniguruma/commit/0f7f61ed1b7b697e283e37bd2d731d0bd57adb55 - CVE-2019-13225 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13225 - https://github.com/kkos/oniguruma/commit/c509265c5f6ae7264f7b8a8aae1cfa5fc59d108c - - - 2019-07-03 - 2019-09-07 - - - - - xymon-server -- multiple vulnerabilities - - - xymon-server - 4.3.29 - - - - -

Japheth Cleaver reports:

-
-

Several buffer overflows were reported by University of - Cambridge Computer Security Incident Response Team.

-
- - - - https://lists.xymon.com/archive/2019-July/046570.html - CVE-2019-13451 - CVE-2019-13452 - CVE-2019-13455 - CVE-2019-13273 - CVE-2019-13274 - CVE-2019-13484 - CVE-2019-13485 - CVE-2019-13486 - - - 2019-07-23 - 2019-09-07 - - - - - wordpress -- multiple issues - - - wordpress - fr-wordpress - 5.2.3,1 - - - de-wordpress - zh_CN-wordpress - zh_TW-wordpress - ja-wordpress - ru-wordpress - 5.2.3 - - - - -

wordpress developers reports:

-
-

Props to Simon Scannell of RIPS Technologies for finding and disclosing two issues. - The first, a cross-site scripting (XSS) vulnerability found in post previews by contributors. - The second was a cross-site scripting vulnerability in stored comments.

-

Props to Tim Coen for disclosing an issue where validation and sanitization - of a URL could lead to an open redirect.

-

Props to Anshul Jain for disclosing reflected cross-site scripting during media uploads.

-

Props to Zhouyuan Yang of Fortinets FortiGuard Labs who disclosed a vulnerability - for cross-site scripting (XSS) in shortcode previews.

-

Props to Ian Dunn of the Core Security Team for finding and disclosing a case where - reflected cross-site scripting could be found in the dashboard.

-

Props to Soroush Dalilifrom NCC Group for disclosing an issue with URL - sanitization that can lead to cross-site scripting (XSS) attacks.

-

In addition to the above changes, we are also updating jQuery on older versions of WordPress. - This change was added in 5.2.1 and is now being brought to older versions.

-
- - - - https://wordpress.org/news/2019/09/wordpress-5-2-3-security-and-maintenance-release/ - - - 2019-09-05 - 2019-09-06 - - - - - Exim -- RCE with root privileges in TLS SNI handler - - - exim - 4.92.2 - - - - -

Exim developers report:

-
-

If your Exim server accepts TLS connections, it is vulnerable. This does - not depend on the TLS libray, so both, GnuTLS and OpenSSL are affected.

-

The vulnerability is exploitable by sending a SNI ending in a -backslash-null sequence during the initial TLS handshake. The exploit -exists as a POC. For more details see the document qualys.mbx

-
- - - - https://git.exim.org/exim.git/blob_plain/2600301ba6dbac5c9d640c87007a07ee6dcea1f4:/doc/doc-txt/cve-2019-15846/cve.txt - - - 2019-09-02 - 2019-09-06 - - - - - asterisk -- Remote Crash Vulnerability in audio transcoding - - - asterisk13 - 13.28.1 - - - asterisk16 - 16.5.1 - - - - -

The Asterisk project reports:

-
-

When audio frames are given to the audio transcoding - support in Asterisk the number of samples are examined - and as part of this a message is output to indicate that - no samples are present. A change was done to suppress - this message for a particular scenario in which the message - was not relevant. This change assumed that information - about the origin of a frame will always exist when in - reality it may not.

-

This issue presented itself when an RTP packet containing - no audio (and thus no samples) was received. In a particular - transcoding scenario this audio frame would get turned - into a frame with no origin information. If this new frame - was then given to the audio transcoding support a crash - would occur as no samples and no origin information would - be present. The transcoding scenario requires the genericplc - option to be set to enabled (the default) and a transcoding - path from the source format into signed linear and then - from signed linear into another format.

-

Note that there may be other scenarios that have not - been found which can cause an audio frame with no origin - to be given to the audio transcoding support and thus - cause a crash.

-
- - - - https://downloads.asterisk.org/pub/security/AST-2019-005.html - CVE-2019-15639 - - - 2019-08-07 - 2019-09-06 - - - - - asterisk -- Crash when negotiating for T.38 with a declined stream - - - asterisk15 - 15.7.4 - - - asterisk16 - 16.5.1 - - - - -

The Asterisk project reports:

-
-

When Asterisk sends a re-invite initiating T.38 faxing, - and the endpoint responds with a declined media stream a - crash will then occur in Asterisk.

-
- - - - https://downloads.asterisk.org/pub/security/AST-2019-004.html - CVE-2019-15297 - - - 2019-08-05 - 2019-09-06 - - - - - samba -- combination of parameters and permissions can allow user to escape from the share path definition - - - samba410 - 4.10.8 - - - - -

The samba project reports:

-
-

On a Samba SMB server for all versions of Samba from 4.9.0 clients are - able to escape outside the share root directory if certain - configuration parameters set in the smb.conf file.

-
- - - - CVE-2019-10197 - https://www.samba.org/samba/security/CVE-2019-10197.html - - - 2019-09-01 - 2019-09-03 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 69.0,1 - - - waterfox - 56.2.14 - - - seamonkey - linux-seamonkey - 2.53.0 - - - firefox-esr - 61.0,168.1.0,1 - 60.9.0,1 - - - linux-firefox - 61.0,268.1.0,2 - 60.9.0,2 - - - libxul - thunderbird - linux-thunderbird - 61.068.1.0 - 60.9.0 - - - - -

Mozilla Foundation reports:

-
-

CVE-2019-11751: Malicious code execution through command line parameters

-

CVE-2019-11746: Use-after-free while manipulating video

-

CVE-2019-11744: XSS by breaking out of title and textarea elements using innerHTML

-

CVE-2019-11742: Same-origin policy violation with SVG filters and canvas to steal cross-origin images

-

CVE-2019-11736: File manipulation and privilege escalation in Mozilla Maintenance Service

-

CVE-2019-11753: Privilege escalation with Mozilla Maintenance Service in custom Firefox installation location

-

CVE-2019-11752: Use-after-free while extracting a key value in IndexedDB

-

CVE-2019-9812: Sandbox escape through Firefox Sync

-

CVE-2019-11741: Isolate addons.mozilla.org and accounts.firefox.com

-

CVE-2019-11743: Cross-origin access to unload event attributes

-

CVE-2019-11748: Persistence of WebRTC permissions in a third party context

-

CVE-2019-11749: Camera information available without prompting using getUserMedia

-

CVE-2019-5849: Out-of-bounds read in Skia

-

CVE-2019-11750: Type confusion in Spidermonkey

-

CVE-2019-11737: Content security policy directives ignore port and path if host is a wildcard

-

CVE-2019-11738: Content security policy bypass through hash-based sources in directives

-

CVE-2019-11747: 'Forget about this site' removes sites from pre-loaded HSTS list

-

CVE-2019-11734: Memory safety bugs fixed in Firefox 69

-

CVE-2019-11735: Memory safety bugs fixed in Firefox 69 and Firefox ESR 68.1

-

CVE-2019-11740: Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9

-
- - - - CVE-2019-11734 - CVE-2019-11735 - CVE-2019-11736 - CVE-2019-11737 - CVE-2019-11738 - CVE-2019-11740 - CVE-2019-11741 - CVE-2019-11742 - CVE-2019-11743 - CVE-2019-11744 - CVE-2019-11746 - CVE-2019-11747 - CVE-2019-11748 - CVE-2019-11749 - CVE-2019-11750 - CVE-2019-11751 - CVE-2019-11752 - CVE-2019-11753 - CVE-2019-5849 - CVE-2019-9812 - https://www.mozilla.org/security/advisories/mfsa2019-25/ - https://www.mozilla.org/security/advisories/mfsa2019-26/ - https://www.mozilla.org/security/advisories/mfsa2019-27/ - - - 2019-09-03 - 2019-09-03 - - - - - www/varnish6 -- Denial of Service - - - varnish6 - 6.2.1 - - - - -

The Varnish Team reports:

-
-

A failure in HTTP/1 parsing can allow a remote attacker to trigger - an assertion in varnish, restarting the daemon and clearing the cache.

-
- - - - https://varnish-cache.org/security/VSV00003.html - - - 2019-09-02 - 2019-09-03 - - - - - libgcrypt -- ECDSA timing attack - - - libgcrypt - 1.8.5 - - - - -

GnuPG reports:

-
-

Mitigate an ECDSA timing attack.

-
- - - - CVE-2019-13627 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13627 - - - 2019-08-29 - 2019-09-02 - - - - - webkit2-gtk3 -- Multiple vulnerabilities - - - webkit2-gtk3 - 2.24.4 - - - - -

The WebKitGTK project reports many vulnerabilities, - including several arbitrary code execution vulnerabilities.

- - - - https://webkitgtk.org/security/WSA-2019-0004.html - CVE-2019-8644 - CVE-2019-8649 - CVE-2019-8658 - CVE-2019-8666 - CVE-2019-8669 - CVE-2019-8671 - CVE-2019-8672 - CVE-2019-8673 - CVE-2019-8676 - CVE-2019-8677 - CVE-2019-8678 - CVE-2019-8679 - CVE-2019-8680 - CVE-2019-8681 - CVE-2019-8683 - CVE-2019-8684 - CVE-2019-8686 - CVE-2019-8687 - CVE-2019-8688 - CVE-2019-8689 - CVE-2019-8690 - - - 2019-08-29 - 2019-08-30 - - - - - Gitlab -- Multiple Vulnerabilities - - - gitlab-ce - 12.2.012.2.3 - 12.1.012.1.8 - 0.0.012.0.8 - - - - -

Gitlab reports:

-
-

Kubernetes Integration Server-Side Request Forgery

-

Server-Side Request Forgery in Jira Integration

-

Improved Protection Against Credential Stuffing Attacks

-

Markdown Clientside Resource Exhaustion

-

Pipeline Status Disclosure

-

Group Runner Authorization Issue

-

CI Metrics Disclosure

-

User IP Disclosed by Embedded Image and Media

-

Label Description HTML Injection

-

IDOR in Epic Notes API

-

Push Rule Bypass

-

Project Visibility Restriction Bypass

-

Merge Request Discussion Restriction Bypass

-

Disclosure of Merge Request IDs

-

Weak Authentication In Certain Account Actions

-

Disclosure of Commit Title and Comments

-

Stored XSS via Markdown

-

EXIF Geolocation Data Exposure

-

Multiple SSRF Regressions on Gitaly

-

Default Branch Name Exposure

-

Potential Denial of Service via CI Pipelines

-

Privilege Escalation via Logrotate

-
- - - - https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/ - CVE-2019-15728 - CVE-2019-15730 - CVE-2019-15722 - CVE-2019-15729 - CVE-2019-15721 - CVE-2019-15727 - CVE-2019-15726 - CVE-2019-15724 - CVE-2019-15725 - CVE-2019-15723 - CVE-2019-15732 - CVE-2019-15731 - CVE-2019-15738 - CVE-2019-15737 - CVE-2019-15734 - CVE-2019-15739 - CVE-2019-15740 - CVE-2019-15733 - CVE-2019-15736 - CVE-2019-15741 - - - 2019-08-29 - 2019-08-30 - - - - - RDoc -- multiple jQuery vulnerabilities - - - ruby - 2.4.0,12.4.7,1 - 2.5.0,12.5.6,1 - 2.6.0,12.6.3,1 - - - rubygem-rdoc - 6.1.2 - - - - -

Ruby news:

-
-

There are multiple vulnerabilities about Cross-Site Scripting (XSS) in - jQuery shipped with RDoc which bundled in Ruby. All Ruby users are - recommended to update Ruby to the latest release which includes the - fixed version of RDoc.

-

The following vulnerabilities have been reported.

-

CVE-2012-6708

-

CVE-2015-9251

-
- - - - https://www.ruby-lang.org/en/news/2019/08/28/multiple-jquery-vulnerabilities-in-rdoc/ - CVE-2012-6708 - CVE-2015-9251 - - - 2019-08-28 - 2019-08-29 - 2019-08-31 - - - - - Dovecot -- improper input validation - - - dovecot - 2.3.7.2 - - - dovecot-pigeonhole - 0.5.7.2 - - - - -

Aki Tuomi reports:

-
-

Vulnerability Details: - -IMAP and ManageSieve protocol parsers do not properly handle NUL byte -when scanning data in quoted strings, leading to out of bounds heap -memory writes. - -Risk: - -This vulnerability allows for out-of-bounds writes to objects stored on -the heap up to 8096 bytes in pre-login phase, and 65536 bytes post-login -phase, allowing sufficiently skilled attacker to perform complicated -attacks that can lead to leaking private information or remote code -execution. Abuse of this bug is very difficult to observe, as it does -not necessarily cause a crash. Attempts to abuse this bug are not -directly evident from logs. -

-
- - - - https://dovecot.org/pipermail/dovecot/2019-August/116874.html - CVE-2019-11500 - - - 2019-04-13 - 2019-08-28 - - - - - jenkins -- multiple vulnerabilities - - - jenkins - 2.191 - - - jenkins-lts - 2.176.2 - - - - -

Jenkins Security Advisory:

-
-

Description

-
(Medium) SECURITY-1453 / CVE-2019-10383
-

Stored XSS vulnerability in update center

-
(High) SECURITY-1491 / CVE-2019-10384
-

CSRF protection tokens for anonymous users did not expire in some circumstances

-
- - - - CVE-2019-10383 - CVE-2019-10384 - https://jenkins.io/security/advisory/2019-08-28/ - - - 2019-08-28 - 2019-08-28 - - - - - Mozilla -- Stored passwords in 'Saved Logins' can be copied without master password entry - - - cliqz - 1.28.2 - - - firefox - 68.0.2,1 - - - - -

Mozilla Foundation reports:

-
-

CVE-2019-11733: Stored passwords in 'Saved Logins' can - be copied without master password entry

-

When a master password is set, it is required to be - entered again before stored passwords can be accessed in the 'Saved - Logins' dialog. It was found that locally stored passwords can be - copied to the clipboard thorough the 'copy password' context menu item - without re-entering the master password if the master password had - been previously entered in the same session, allowing for potential - theft of stored passwords.

-
- - - - https://www.mozilla.org/security/advisories/mfsa2019-24/ - CVE-2019-11733 - - - 2019-08-14 - 2019-08-28 - - - - - h2o -- multiple HTTP/2 vulnerabilities - - - h2o-devel - 2.3.0.b2 - - - - -

Jonathon Loomey of Netflix reports:

-
-

HTTP/2 implementations do not robustly handle abnormal traffic and resource exhaustion

-

Recently, a series of DoS attack vulnerabilities have been reported on a broad range of HTTP/2 stacks. Among the vulnerabilities, H2O is exposed to the following:

-
    -
  • CVE-2019-9512 "Ping Flood": The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service.
    • -
  • CVE-2019-9514 "Reset Flood": The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both, potentially leading to a denial of service.
    • -
  • CVE-2019-9515 "Settings Flood": The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service.
    • -
-
- - - - https://github.com/h2o/h2o/issues/2090 - https://www.kb.cert.org/vuls/id/605641/ - CVE-2019-9512 - CVE-2019-9514 - CVE-2019-9515 - - - 2019-08-13 - 2019-08-25 - - - - - h2o -- multiple HTTP/2 vulnerabilities - - - h2o - 2.2.6 - - - - -

Jonathon Loomey of Netflix reports:

-
-

HTTP/2 implementations do not robustly handle abnormal traffic and resource exhaustion

-

Recently, a series of DoS attack vulnerabilities have been reported on a broad range of HTTP/2 stacks. Among the vulnerabilities, H2O is exposed to the following:

-
    -
  • CVE-2019-9512 "Ping Flood": The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service.
    • -
  • CVE-2019-9514 "Reset Flood": The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both, potentially leading to a denial of service.
    • -
  • CVE-2019-9515 "Settings Flood": The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service.
    • -
-
- - - - https://github.com/h2o/h2o/issues/2090 - https://www.kb.cert.org/vuls/id/605641/ - CVE-2019-9512 - CVE-2019-9514 - CVE-2019-9515 - - - 2019-08-13 - 2019-08-25 - - - - - gitea -- multiple vulnerabilities - - - gitea - 1.9.2 - - - - -

The Gitea Team reports:

-
-

This release contains two security fixes, so we highly recommend updating.

-
- - - - https://github.com/go-gitea/gitea/releases/tag/v1.9.2 - https://blog.gitea.io/2019/08/gitea-1.9.2-is-released/ - - - 2019-08-22 - 2019-08-22 - - - - - clamav -- multiple vulnerabilities - - - clamav - 0.101.4,1 - - - clamav-milter - 0.101.4,1 - - - - -

Micah Snyder reports:

-
-
    -
  • An out of bounds write was possible within ClamAV&s NSIS bzip2 library when attempting decompression in cases where the number of selectors exceeded the max limit set by the library (CVE-2019-12900). The issue has been resolved by respecting that limit.
    • -
  • The zip bomb vulnerability mitigated in 0.101.3 has been assigned the CVE identifier CVE-2019-12625. Unfortunately, a workaround for the zip-bomb mitigation was immediately identified. To remediate the zip-bomb scan time issue, a scan time limit has been introduced in 0.101.4. This limit now resolves ClamAV's vulnerability to CVE-2019-12625.
    • -
-
- - - - https://blog.clamav.net/2019/08/clamav-01014-security-patch-release-has.html - CVE-2019-12625 - CVE-2019-12900 - - - 2019-08-21 - 2019-08-21 - - - - - Node.js -- multiple vulnerabilities - - - node - 12.8.1 - - - node10 - 10.16.3 - - - node8 - 8.16.1 - - - - -

Node.js reports:

-
-

Node.js, as well as many other implementations of HTTP/2, have been found vulnerable to Denial of Service attacks. See https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md for more information.

-

Updates are now available for all active Node.js release lines, including Linux ARMv6 builds for Node.js 8.x (which had been delayed).

-

We recommend that all Node.js users upgrade to a version listed below as soon as possible.

-

Vulnerabilities Fixed

-

Impact: All versions of Node.js 8 (LTS "Carbon"), Node.js 10 (LTS "Dubnium"), and Node.js 12 (Current) are vulnerable to the following:

-
    -
  • CVE-2019-9511 "Data Dribble": The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service.
    • -
  • CVE-2019-9512 "Ping Flood": The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service.
    • -
  • CVE-2019-9513 "Resource Loop": The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU, potentially leading to a denial of service.
    • -
  • CVE-2019-9514 "Reset Flood": The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both, potentially leading to a denial of service.
    • -
  • CVE-2019-9515 "Settings Flood": The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service.
    • -
  • CVE-2019-9516 "0-Length Headers Leak": The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory, potentially leading to a denial of service.
    • -
  • CVE-2019-9517 "Internal Data Buffering": The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer cannot actually write (many of) the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the servers queue the responses, this can consume excess memory, CPU, or both, potentially leading to a denial of service.
    • -
  • CVE-2019-9518 "Empty Frames Flood": The attacker sends a stream of frames with an empty payload and without the end-of-stream flag. These frames can be DATA, HEADERS, CONTINUATION and/or PUSH_PROMISE. The peer spends time processing each frame disproportionate to attack bandwidth. This can consume excess CPU, potentially leading to a denial of service. (Discovered by Piotr Sikora of Google)
    • -
-
- - - - https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/ - CVE-2019-9511 - CVE-2019-9512 - CVE-2019-9513 - CVE-2019-9514 - CVE-2019-9515 - CVE-2019-9516 - CVE-2019-9517 - CVE-2019-9518 - - - 2019-08-16 - 2019-08-21 - - - - - vlc -- multiple vulnerabilities - - - vlc - 3.0.8,4 - - - - -

The VLC project reports:

-
-

Security: - * Fix a buffer overflow in the MKV demuxer (CVE-2019-14970) - * Fix a read buffer overflow in the avcodec decoder (CVE-2019-13962) - * Fix a read buffer overflow in the FAAD decoder - * Fix a read buffer overflow in the OGG demuxer (CVE-2019-14437, CVE-2019-14438) - * Fix a read buffer overflow in the ASF demuxer (CVE-2019-14776) - * Fix a use after free in the MKV demuxer (CVE-2019-14777, CVE-2019-14778) - * Fix a use after free in the ASF demuxer (CVE-2019-14533) - * Fix a couple of integer underflows in the MP4 demuxer (CVE-2019-13602) - * Fix a null dereference in the dvdnav demuxer - * Fix a null dereference in the ASF demuxer (CVE-2019-14534) - * Fix a null dereference in the AVI demuxer - * Fix a division by zero in the CAF demuxer (CVE-2019-14498) - * Fix a division by zero in the ASF demuxer (CVE-2019-14535)

-
- - - - https://www.videolan.org/developers/vlc-branch/NEWS - CVE-2019-13602 - CVE-2019-13962 - CVE-2019-14437 - CVE-2019-14438 - CVE-2019-14498 - CVE-2019-14533 - CVE-2019-14534 - CVE-2019-14535 - CVE-2019-14776 - CVE-2019-14777 - CVE-2019-14778 - CVE-2019-14970 - - - 2019-07-14 - 2019-08-20 - - - - - nsd -- Stack-based Buffer Overflow - - - nsd - 4.2.2 - - - - -

SO-AND-SO reports:

-
-

nsd-checkzone in NLnet Labs NSD 4.2.0 has a Stack-based Buffer - Overflow in the dname_concatenate() function in dname.c.

-
- - - - https://nvd.nist.gov/vuln/detail/CVE-2019-13207 - https://github.com/NLnetLabs/nsd/issues/20 - CVE-2019-13207 - - - 2019-07-28 - 2019-08-19 - - - - - webmin -- unauthenticated remote code execution - - - webmin - 1.930 - - - usermin - 1.780 - - - - -

Joe Cooper reports:

-
-

I've rolled out Webmin version 1.930 and Usermin version 1.780 - for all repositories. This release includes several security - fixes, including one potentially serious one caused by malicious - code inserted into Webmin and Usermin at some point on our build - infrastructure. We're still investigating how and when, but the - exploitable code has never existed in our github repositories, so - we've rebuilt from git source on new infrastructure (and checked - to be sure the result does not contain the malicious code).

- -

I don't have a changelog for these releases yet, but I wanted - to announce them immediately due to the severity of this issue. - To exploit the malicious code, your Webmin installation must have - Webmin -> Webmin Configuration -> Authentication -> Password - expiry policy set to Prompt users with expired passwords to enter - a new one. This option is not set by default, but if it is set, - it allows remote code execution.

- -

This release addresses CVE-2019-15107, which was disclosed - earlier today. It also addresses a handful of XSS issues that we - were notified about, and a bounty was awarded to the researcher - (a different one) who found them.

-
- - - - https://virtualmin.com/node/66890 - CVE-2019-15107 - - - 2019-08-17 - 2019-08-17 - - - - - gitea -- multiple vulnerabilities - - - gitea - 1.9.1 - - - - -

The Gitea Team reports:

-
-

This release contains two security fixes, so we highly recommend updating.

-
- - - - https://blog.gitea.io/2019/08/gitea-1.9.1-is-released/ - https://github.com/go-gitea/gitea/releases/tag/v1.9.1 - - - 2019-07-31 - 2019-07-31 - - - - - xdm -- remote denial of service - - - xdm - 1.1.12 - - - - -

nvd.nist.gov reports

-
-

X.Org xdm 1.1.10, 1.1.11, and possibly other versions, - when performing authentication using certain implementations of - the crypt API function that can return NULL, allows remote - attackers to cause a denial of service (NULL pointer dereference - and crash) by attempting to log into an account whose password - field contains invalid characters, as demonstrated using the crypt - function from glibc 2.17 and later with (1) the "!" character in - the salt portion of a password field or (2) a password that has - been encrypted using DES or MD5 in FIPS-140 mode.

-
- - - - https://nvd.nist.gov/vuln/detail/CVE-2013-2179 - CVE-2013-2179 - - - 2013-06-07 - 2019-08-18 - - - - - Libgit2 -- multiple vulnerabilities - - - libgit2 - 0.28.3 - - - - -

The Git community reports:

-
-

A carefully constructed commit object with a very large number -of parents may lead to potential out-of-bounds writes or -potential denial of service.

-

The ProgramData configuration file is always read for compatibility -with Git for Windows and Portable Git installations. The ProgramData -location is not necessarily writable only by administrators, so we -now ensure that the configuration file is owned by the administrator -or the current user.

-
- - - - https://github.com/libgit2/libgit2/releases/tag/v0.28.3 - - - 2019-08-13 - 2019-08-18 - - - - - Apache -- Multiple vulnerabilities - - - apache24 - 2.4.41 - - - - -

SO-AND-SO reports:

-
-

SECURITY: CVE-2019-10081

-

mod_http2: HTTP/2 very early pushes, for example configured with "H2PushResource", - could lead to an overwrite of memory in the pushing request's pool, - leading to crashes. The memory copied is that of the configured push - link header values, not data supplied by the client.

-

SECURITY: CVE-2019-9517

-

mod_http2: a malicious client could perform a DoS attack by flooding - a connection with requests and basically never reading responses - on the TCP connection. Depending on h2 worker dimensioning, it was - possible to block those with relatively few connections.

-

SECURITY: CVE-2019-10098

-

rewrite, core: Set PCRE_DOTALL flag by default to avoid unpredictable - matches and substitutions with encoded line break characters.

-

SECURITY: CVE-2019-10092

-

Remove HTML-escaped URLs from canned error responses to prevent misleading - text/links being displayed via crafted links.

-

SECURITY: CVE-2019-10097

-

mod_remoteip: Fix stack buffer overflow and NULL pointer deference - when reading the PROXY protocol header.

-

CVE-2019-10082

-

mod_http2: Using fuzzed network input, the http/2 session - handling could be made to read memory after being freed, - during connection shutdown.

-
- - - - http://www.apache.org/dist/httpd/CHANGES_2.4 - CVE-2019-10081 - CVE-2019-9517 - CVE-2019-10098 - CVE-2019-10092 - CVE-2019-10082 - - - 2019-08-14 - 2019-08-17 - - - - - nghttp2 -- multiple vulnerabilities - - - libnghttp2 - nghttp2 - 1.39.2 - - - - -

nghttp2 GitHub releases:

-
-

This release fixes CVE-2019-9511 "Data Dribble" and CVE-2019-9513 - "Resource Loop" vulnerability in nghttpx and nghttpd. Specially crafted - HTTP/2 frames cause Denial of Service by consuming CPU time. Check out - https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md - for details. For nghttpx, additionally limiting inbound traffic by - --read-rate and --read-burst options is quite effective against this - kind of attack.

-

CVE-2019-9511 "Data Dribble": The attacker requests a large amount of - data from a specified resource over multiple streams. They manipulate - window size and stream priority to force the server to queue the data in - 1-byte chunks. Depending on how efficiently this data is queued, this - can consume excess CPU, memory, or both, potentially leading to a - denial of service.

-

CVE-2019-9513 "Ping Flood": The attacker sends continual pings to an - HTTP/2 peer, causing the peer to build an internal queue of responses. - Depending on how efficiently this data is queued, this can consume - excess CPU, memory, or both, potentially leading to a denial of service.

-
- - - - https://github.com/nghttp2/nghttp2/releases - https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md - CVE-2019-9511 - CVE-2019-9513 - - - 2019-08-13 - 2019-08-16 - - - - - CUPS -- multiple vulnerabilities - - - cups - 2.2.12 - - - - -

Apple reports:

-
-
    -
  • CVE-2019-8696 and CVE-2019-8675: SNMP buffer overflows.
    • -
  • IPP buffer overflow.
    • -
  • Memory disclosure in the scheduler.
    • -
  • DoS issues in the scheduler.
    • -
-
- - - - https://github.com/apple/cups/releases/tag/v2.2.12 - CVE-2019-8675 - CVE-2019-8696 - - - 2019-08-15 - 2019-08-16 - - - - - traefik -- Denial of service in HTTP/2 - - - traefik - 1.7.14 - - - - -

The traefik project reports:

-
-

Update of dependency to go go1.12.8 resolves potential HTTP/2 - denial of service in traefik.

-
- - - - https://github.com/containous/traefik/releases/tag/v1.7.14 - CVE-2019-9512 - CVE-2019-9514 - - - 2019-08-13 - 2019-08-15 - - - - - NGINX -- Multiple vulnerabilities - - - nginx - 1.16.1,2 - - - nginx-devel - 1.17.3 - - - - -

NGINX Team reports:

-
-

Several security issues were identified in nginx HTTP/2 - implementation which might cause excessive memory consumption - and CPU usage (CVE-2019-9511, CVE-2019-9513, CVE-2019-9516). - The issues affect nginx compiled with the ngx_http_v2_module (not - compiled by default) if the http2 option of the listen directive - is used in a configuration file.

-
- - - - http://nginx.org/en/security_advisories.html - CVE-2019-9511 - CVE-2019-9513 - CVE-2019-9516 - - - 2019-08-13 - 2019-08-14 - 2019-08-14 - - - - - Nokogiri -- injection vulnerability - - - rubygem-nokogiri - 1.10.4 - - - - -

Nokogiri GitHub release:

-
-

A command injection vulnerability in Nokogiri v1.10.3 and earlier - allows commands to be executed in a subprocess by Ruby's Kernel.open - method. Processes are vulnerable only if the undocumented method - Nokogiri::CSS::Tokenizer#load_file is being passed untrusted user input.

-

This vulnerability appears in code generated by the Rexical gem - versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate - lexical scanner code for parsing CSS queries. The underlying - vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to - this version of Rexical in Nokogiri v1.10.4.

-
- - - - https://github.com/sparklemotion/nokogiri/releases - https://github.com/sparklemotion/nokogiri/issues/1915 - CVE-2019-5477 - - - 2019-08-11 - 2019-08-13 - - - - - Gitlab -- Multiple Vulnerabilities - - - gitlab-ce - 12.1.012.1.6 - 12.0.012.0.6 - 10.0.011.11.8 - - - - -

Gitlab reports:

-
-

Insecure Authentication Methods Disabled for Grafana By Default

-

Multiple Command-Line Flag Injection Vulnerabilities

-

Insecure Cookie Handling on GitLab Pages

-
- - - - https://about.gitlab.com/2019/08/12/critical-security-release-gitlab-12-dot-1-dot-6-released/ - CVE-2019-14943 - CVE-2019-14944 - CVE-2019-14942 - - - 2019-08-12 - 2019-08-13 - - - - - KDE Frameworks -- malicious .desktop files execute code - - - kf5-kconfig - 5.60.0_2 - - - - -

The KDE Community has released a security announcement:

-
-

The syntax Key[$e]=$(shell command) in *.desktop files, .directory files, and configuration files -(typically found in ~/.config) was an intentional feature of KConfig, to allow flexible configuration. -This could however be abused by malicious people to make the users install such files and get code -executed even without intentional action by the user.

-
- - - - CVE-2019-14744 - https://kde.org/info/security/advisory-20190807-1.txt - - - 2019-08-07 - 2019-08-09 - - - - - doas -- Prevent passing of environment variables - - - doas - 6.1 - - - - -

Jesse Smith (upstream author of the doas program) reported:

-
-

Previous versions of "doas" transferred most environment variables, such - as USER, HOME, and PATH from the original user to the target user. - - Passing these variables could cause files in the wrong path or - home directory to be read (or written to), which resulted in potential - security problems.

-

Many thanks to Sander Bos for reporting this issue and explaining - how it can be exploited.

-
- - - - https://marc.info/?l=openbsd-tech&m=156105665713340&w=2 - https://github.com/slicer69/doas/releases/tag/6.1 - - - 2019-08-03 - 2019-08-09 - 2019-08-15 - - - - - bro -- Null pointer dereference and Signed integer overflow - - - bro - 2.6.3 - - - - -

Jon Siwek of Corelight reports:

-
-

This is a security patch release to address potential - Denial of Service vulnerabilities:

-
    -
  • - Null pointer dereference in the RPC analysis code. RPC - analyzers (e.g. MOUNT or NFS) are not enabled in the - default configuration.
    • - -
  • - Signed integer overflow in BinPAC-generated parser code. - The result of this is Undefined Behavior with respect to - the array bounds checking conditions that BinPAC generates, - so it's unpredictable what an optimizing compiler may - actually do under the assumption that signed integer - overlows should never happen. The specific symptom which - lead to finding this issue was with the PE analyzer causing - out-of-memory crashes due to large allocations that were - otherwise prevented when the array bounds checking logic - was changed to prevent any possible signed integer overlow.
    • -
-
- - - - https://raw.githubusercontent.com/zeek/zeek/1d874e5548a58b3b8fd2a342fe4aa0944e779809/NEWS - - - 2019-06-22 - 2019-08-09 - - - - - PostgresSQL -- TYPE in pg_temp execute arbitrary SQL during `SECURITY DEFINER` execution - - - postgresql11-server - 11.5 - - - postgresql10-server - 10.10 - - - postgresql96-server - 9.6.15 - - - postgresql95-server - 9.5.19 - - - postgresql94-server - 9.4.24 - - - - -

The PostgreSQL project reports:

-
-

- Versions Affected: 9.4 - 11 -

-

- Given a suitable `SECURITY DEFINER` function, an attacker can execute arbitrary - SQL under the identity of the function owner. An attack requires `EXECUTE` - permission on the function, which must itself contain a function call having - inexact argument type match. For example, `length('foo'::varchar)` and - `length('foo')` are inexact, while `length('foo'::text)` is exact. - As part of exploiting this vulnerability, the attacker uses `CREATE DOMAIN` - to create a type in a `pg_temp` schema. The attack pattern and fix are similar - to that for CVE-2007-2138. -

-

- Writing `SECURITY DEFINER` functions continues to require following - the considerations noted in the documentation: -

-

- https://www.postgresql.org/docs/devel/sql-createfunction.html#SQL-CREATEFUNCTION-SECURITY -

-
-
-

- Versions Affected: 11 -

-

- In a database containing hypothetical, user-defined hash equality operators, - an attacker could read arbitrary bytes of server memory. For an attack to - become possible, a superuser would need to create unusual operators. - It is possible for operators not purpose-crafted for attack to have - the properties that enable an attack, but we are not aware of specific examples. -

-
- - - - https://www.postgresql.org/about/news/1960/ - CVE-2019-10208 - CVE-2019-10209 - - - 2019-08-08 - 2019-08-08 - - - - - Django -- multiple vulnerabilities - - - py27-django111 - py35-django111 - py36-django111 - py37-django111 - 1.11.23 - - - py27-django21 - py35-django21 - py36-django21 - py37-django21 - 2.1.11 - - - py27-django22 - py35-django22 - py36-django22 - py37-django22 - 2.2.4 - - - - -

Django release notes:

-
-

CVE-2019-14232: Denial-of-service possibility in - django.utils.text.Truncator

-

If django.utils.text.Truncator's chars() and words() methods were - passed the html=True argument, they were extremely slow to evaluate - certain inputs due to a catastrophic backtracking vulnerability in a - regular expression. The chars() and words() methods are used to - implement the truncatechars_html and truncatewords_html template - filters, which were thus vulnerable

-

The regular expressions used by Truncator have been simplified in - order to avoid potential backtracking issues. As a consequence, trailing - punctuation may now at times be included in the truncated output.

-

CVE-2019-14233: Denial-of-service possibility in strip_tags()

-

Due to the behavior of the underlying HTMLParser, - django.utils.html.strip_tags() would be extremely slow to evaluate - certain inputs containing large sequences of nested incomplete HTML - entities. The strip_tags() method is used to implement the corresponding - striptags template filter, which was thus also vulnerable.

-

strip_tags() now avoids recursive calls to HTMLParser when progress - removing tags, but necessarily incomplete HTML entities, stops being - made.

-

Remember that absolutely NO guarantee is provided about the results of - strip_tags() being HTML safe. So NEVER mark safe the result of a - strip_tags() call without escaping it first, for example with - django.utils.html.escape().

-

CVE-2019-14234: SQL injection possibility in key and index lookups for - JSONField/HStoreField

-

Key and index lookups for JSONField and key lookups for HStoreField - were subject to SQL injection, using a suitably crafted dictionary, - with dictionary expansion, as the **kwargs passed to QuerySet.filter().

-

CVE-2019-14235: Potential memory exhaustion in - django.utils.encoding.uri_to_iri()

-

If passed certain inputs, django.utils.encoding.uri_to_iri() could lead - to significant memory usage due to excessive recursion when - re-percent-encoding invalid UTF-8 octet sequences.

-

uri_to_iri() now avoids recursion when re-percent-encoding invalid - UTF-8 octet sequences.

-
- - - - https://docs.djangoproject.com/en/1.11/releases/1.11.23/ - https://docs.djangoproject.com/en/2.1/releases/2.1.11/ - https://docs.djangoproject.com/en/2.2/releases/2.2.4/ - CVE-2019-14232 - CVE-2019-14233 - CVE-2019-14234 - CVE-2019-14235 - - - 2019-08-01 - 2019-08-03 - - - - - gitea -- multiple vulnerabilities - - - gitea - 1.9.0 - - - - -

The Gitea Team reports:

-
-

This version of Gitea contains security fixes that could not be - backported to 1.8. For this reason, we strongly recommend updating.

-
- - - - https://blog.gitea.io/2019/07/gitea-1.9.0-is-released/ - https://github.com/go-gitea/gitea/releases/tag/v1.9.0 - - - 2019-07-31 - 2019-07-31 - - - - - FreeBSD -- File description reference count leak - - - FreeBSD-kernel - 12.012.0_8 - 11.211.2_12 - 11.311.3_1 - - - - -

Problem Description:

-

If a process attempts to transmit rights over a UNIX-domain - socket and an error causes the attempt to fail, references - acquired on the rights are not released and are leaked. - This bug can be used to cause the reference counter to wrap - around and free the corresponding file structure.

-

Impact:

-

A local user can exploit the bug to gain root privileges - or escape from a jail.

- - - - CVE-2019-5607 - SA-19:17.fd - - - 2019-07-24 - 2019-07-30 - - - - - FreeBSD -- Bhyve out-of-bounds read in XHCI device - - - FreeBSD-kernel - 12.012.0_8 - 11.211.2_12 - 11.311.3_1 - - - - -

Problem Description:

-

The pci_xhci_device_doorbell() function does not validate - the 'epid' and 'streamid' provided by the guest, leading - to an out-of-bounds read.

-

Impact:

-

A misbehaving bhyve guest could crash the system or - access memory that it should not be able to.

- - - - CVE-2019-5604 - SA-19:16.bhyve - - - 2019-07-24 - 2019-07-30 - - - - - FreeBSD -- Reference count overflow in mqueue filesystem - - - FreeBSD-kernel - 12.012.0_8 - 11.211.2_12 - 11.311.3_1 - - - - -

Problem Description:

-

System calls operating on file descriptors obtain a - reference to relevant struct file which due to a programming - error was not always put back, which in turn could be used - to overflow the counter of affected struct file.

-

Impact:

-

A local user can use this flaw to obtain access to files, - directories, sockets etc. opened by processes owned by other - users. If obtained struct file represents a directory from - outside of user's jail, it can be used to access files - outside of the jail. If the user in question is a jailed - root they can obtain root privileges on the host system.

- - - - CVE-2019-5603 - SA-19:15.mqueuefs - - - 2019-07-24 - 2019-07-30 - - - - - FreeBSD -- Kernel memory disclosure in freebsd32_ioctl - - - FreeBSD-kernel - 11.211.2_12 - 11.311.3_1 - - - - -

Problem Description:

-

Due to insufficient initialization of memory copied to - userland in the components listed above small amounts of - kernel memory may be disclosed to userland processes.

-

Impact:

-

A user who can invoke 32-bit FreeBSD ioctls may be able - to read the contents of small portions of kernel memory.

-

Such memory might contain sensitive information, such - as portions of the file cache or terminal buffers. This - information might be directly useful, or it might be leveraged - to obtain elevated privileges in some way; for example, a - terminal buffer might include a user-entered password.

- - - - CVE-2019-5605 - SA-19:14.freebsd32 - - - 2019-07-24 - 2019-07-30 - - - - - FreeBSD -- pts(4) write-after-free - - - FreeBSD-kernel - 12.012.0_8 - 11.211.2_12 - 11.311.3_1 - - - - -

Problem Description:

-

The code which handles a close(2) of a descriptor created - by posix_openpt(2) fails to undo the configuration which - causes SIGIO to be raised. This bug can lead to a - write-after-free of kernel memory.

-

Impact:

-

The bug permits malicious code to trigger a write-after-free, - which may be used to gain root privileges or escape a - jail.

- - - - CVE-2019-5606 - SA-19:13.pts - - - 2019-07-24 - 2019-07-30 - - - - - FreeBSD -- telnet(1) client multiple vulnerabilities - - - FreeBSD - 12.012.0_8 - 11.211.2_12 - 11.311.3_1 - - - - -

Problem Description:

-

Insufficient validation of environment variables in the - telnet client supplied in FreeBSD can lead to stack-based - buffer overflows. A stack- based overflow is present in the - handling of environment variables when connecting via the - telnet client to remote telnet servers.

-

This issue only affects the telnet client. Inbound telnet - sessions to telnetd(8) are not affected by this issue.

-

Impact:

-

These buffer overflows may be triggered when connecting - to a malicious server, or by an active attacker in the - network path between the client and server. Specially crafted - TELNET command sequences may cause the execution of arbitrary - code with the privileges of the user invoking telnet(1).

- - - - CVE-2019-0053 - SA-19:12.telnet - - - 2019-07-24 - 2019-07-30 - - - - - FreeBSD -- Privilege escalation in cd(4) driver - - - FreeBSD-kernel - 12.012.0_7 - 11.211.2_11 - - - - -

Problem Description:

-

To implement one particular ioctl, the Linux emulation - code used a special interface present in the cd(4) driver - which allows it to copy subchannel information directly to - a kernel address. This interface was erroneously made - accessible to userland, allowing users with read access to - a cd(4) device to arbitrarily overwrite kernel memory when - some media is present in the device.

-

Impact:

-

A user in the operator group can make use of this interface - to gain root privileges on a system with a cd(4) device - when some media is present in the device.

- - - - CVE-2019-5602 - SA-19:11.cd_ioctl - - - 2019-07-02 - 2019-07-30 - - - - - FreeBSD -- Kernel stack disclosure in UFS/FFS - - - FreeBSD-kernel - 12.012.0_7 - 11.211.2_11 - - - - -

Problem Description:

-

A bug causes up to three bytes of kernel stack memory - to be written to disk as uninitialized directory entry - padding. This data can be viewed by any user with read - access to the directory. Additionally, a malicious user - with write access to a directory can cause up to 254 bytes - of kernel stack memory to be exposed.

-

Impact:

-

Some amount of the kernel stack is disclosed and written - out to the filesystem.

- - - - CVE-2019-5601 - SA-19:10.ufs - - - 2019-07-02 - 2019-07-30 - - - - - FreeBSD -- iconv buffer overflow - - - FreeBSD - 12.012.0_7 - 11.211.2_11 - - - - -

Problem Description:

-

With certain inputs, iconv may write beyond the end of - the output buffer.

-

Impact:

-

Depending on the way in which iconv is used, an attacker - may be able to create a denial of service, provoke incorrect - program behavior, or induce a remote code execution. iconv - is a libc library function and the nature of possible attacks - will depend on the way in which iconv is used by applications - or daemons.

- - - - CVE-2019-5600 - SA-19:09.iconv - - - 2019-07-02 - 2019-07-30 - - - - - FreeBSD -- Resource exhaustion in non-default RACK TCP stack - - - FreeBSD-kernel - 12.012.0_6 - - - - -

Problem Description:

-

While processing acknowledgements, the RACK code uses - several linked lists to maintain state entries. A malicious - attacker can cause the lists to grow unbounded. This can - cause an expensive list traversal on every packet being - processed, leading to resource exhaustion and a denial of - service.

-

Impact:

-

An attacker with the ability to send specially crafted - TCP traffic to a victim system can degrade network performance - and/or consume excessive CPU by exploiting the inefficiency - of traversing the potentially very large RACK linked lists - with relatively small bandwidth cost.

- - - - CVE-2019-5599 - SA-19:08.rack - - - 2019-06-19 - 2019-07-30 - - - - - FreeBSD -- Microarchitectural Data Sampling (MDS) - - - FreeBSD-kernel - 12.012.0_5 - 11.211.2_10 - - - - -

Problem Description:

-

On some Intel processors utilizing speculative execution - a local process may be able to infer stale information from - microarchitectural buffers to obtain a memory disclosure.

-

Impact:

-

An attacker may be able to read secret data from the - kernel or from a process when executing untrusted code (for - example, in a web browser).

- - - - CVE-2018-1212 - CVE-2018-1213 - CVE-2019-1109 - SA-19:07.mds - - - 2019-05-14 - 2019-07-30 - - - - - FreeBSD -- ICMP/ICMP6 packet filter bypass in pf - - - FreeBSD-kernel - 12.012.0_4 - 11.211.2_10 - - - - -

Problem Description:

-

States in pf(4) let ICMP and ICMP6 packets pass if they - have a packet in their payload matching an existing condition. - pf(4) does not check if the outer ICMP or ICMP6 packet has - the same destination IP as the source IP of the inner - protocol packet.

-

Impact:

-

A maliciously crafted ICMP/ICMP6 packet could bypass the - packet filter rules and be passed to a host that would - otherwise be unavailable.

- - - - CVE-2019-5598 - SA-19:06.pf - - - 2019-05-14 - 2019-07-30 - - - - - FreeBSD -- IPv6 fragment reassembly panic in pf(4) - - - FreeBSD-kernel - 12.012.0_4 - 11.211.2_10 - - - - -

Problem Description:

-

A bug in the pf(4) IPv6 fragment reassembly logic - incorrectly uses the last extension header offset from the - last received packet instead of from the first packet.

-

Impact:

-

Malicious IPv6 packets with different IPv6 extensions - could cause a kernel panic or potentially a filtering rule - bypass.

- - - - CVE-2019-5597 - SA-19:05.pf - - - 2019-05-14 - 2019-07-30 - - - - - Gitlab -- Multiple Vulnerabilities - - - gitlab-ce - 12.1.012.1.2 - 12.0.012.0.4 - 8.9.011.11.7 - - - - -

Gitlab reports:

-
-

GitHub Integration SSRF

-

Trigger Token Impersonation

-

Build Status Disclosure

-

SSRF Mitigation Bypass

-

Information Disclosure New Issue ID

-

IDOR Label Name Enumeration

-

Persistent XSS Wiki Pages

-

User Revokation Bypass with Mattermost Integration

-

Arbitrary File Upload via Import Project Archive

-

Information Disclosure Vulnerability Feedback

-

Persistent XSS via Email

-

Denial Of Service Epic Comments

-

Email Verification Bypass

-

Override Merge Request Approval Rules

-
- - - - https://about.gitlab.com/2019/07/29/security-release-gitlab-12-dot-1-dot-2-released/ - - - 2019-07-29 - 2019-07-30 - - - - - py-matrix-synapse -- multiple vulnerabilities - - - py27-matrix-synapse - py35-matrix-synapse - py36-matrix-synapse - py37-matrix-synapse - 1.2.1 - - - - -

Matrix developers report:

-
-

The matrix team releases Synapse 1.2.1 as a critical security update. It contains patches relating to redactions and event federation:

-
    -
  • Prevent an attack where a federated server could send redactions for arbitrary events in v1 and v2 rooms.
    • -
  • Prevent a denial-of-service attack where cycles of redaction events would make Synapse spin infinitely.
    • -
  • Prevent an attack where users could be joined or parted from public rooms without their consent.
    • -
  • Fix a vulnerability where a federated server could spoof read-receipts from users on other servers.
    • -
  • It was possible for a room moderator to send a redaction for an m.room.create event, which would downgrade the room to version 1.
    • -
-
- - - - https://matrix.org/blog/2019/07/26/critical-security-update-synapse-1-2-1-released - https://github.com/matrix-org/synapse/releases/tag/v1.2.1 - - - 2019-07-26 - 2019-07-28 - - - - - Exim -- RCE in ${sort} expansion - - - exim - 4.854.92.1 - - - - -

Exim team report:

-
-

- A local or remote attacker can execute programs with root privileges - if you've an unusual configuration. -

-

- If your configuration uses the ${sort } expansion for items that can be controlled by an attacker (e.g. $local_part, $domain). The default config, as shipped by the Exim developers, does not contain ${sort }. -

-

- The vulnerability is exploitable either remotely or locally and could -be used to execute other programs with root privilege. The ${sort } -expansion re-evaluates its items. -

-

- Exim 4.92.1 is not vulnerable. -

-
- - - - CVE-2019-13917 - https://www.exim.org/static/doc/security/CVE-2019-13917.txt - - - 2019-07-18 - 2019-07-25 - 2019-07-26 - - - - - MySQL -- Multiple vulerabilities - - - mariadb55-server - 5.5.65 - - - mariadb101-server - 10.1.41 - - - mariadb102-server - 10.2.26 - - - mariadb103-server - 10.3.17 - - - mariadb104-server - 10.4.7 - - - mysql56-server - 5.6.45 - - - mysql57-server - 5.7.27 - - - mysql80-server - 8.0.17 - - - percona55-server - 5.5.65 - - - percona56-server - 5.6.45 - - - percona57-server - 5.7.27 - - - - -

Oracle reports:

-
-

This Critical Patch Update contains 45 new security fixes for - Oracle MySQL. 4 of these vulnerabilities may be remotely exploitable - without authentication, i.e., may be exploited over a network without - requiring user credentials. -

-
- - - - https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - CVE-2019-2730 - CVE-2019-2731 - CVE-2019-2737 - CVE-2019-2738 - CVE-2019-2739 - CVE-2019-2740 - CVE-2019-2741 - CVE-2019-2743 - CVE-2019-2746 - CVE-2019-2747 - CVE-2019-2752 - CVE-2019-2755 - CVE-2019-2757 - CVE-2019-2758 - CVE-2019-2774 - CVE-2019-2778 - CVE-2019-2780 - CVE-2019-2784 - CVE-2019-2785 - CVE-2019-2789 - CVE-2019-2791 - CVE-2019-2795 - CVE-2019-2796 - CVE-2019-2797 - CVE-2019-2798 - CVE-2019-2800 - CVE-2019-2801 - CVE-2019-2802 - CVE-2019-2803 - CVE-2019-2805 - CVE-2019-2808 - CVE-2019-2810 - CVE-2019-2811 - CVE-2019-2812 - CVE-2019-2814 - CVE-2019-2815 - CVE-2019-2819 - CVE-2019-2822 - CVE-2019-2826 - CVE-2019-2830 - CVE-2019-2834 - CVE-2019-2879 - CVE-2019-3822 - - - 2019-07-16 - 2019-07-22 - - - - - drupal -- Drupal core - Access bypass - - - drupal8 - 8.7.5 - - - - -

Drupal Security Team reports:

-
-

In Drupal 8.7.4, when the experimental Workspaces module is enabled, - an access bypass condition is created.

-

This can be mitigated by disabling the Workspaces module. It does - not affect any release other than Drupal 8.7.4.

-
- - - - https://www.drupal.org/SA-CORE-2019-008 - - - 2019-07-17 - 2019-07-21 - - - - - PuTTY 0.72 -- buffer overflow in SSH-1 and integer overflow in SSH client - - - putty 0.72 - - putty-gtk2 0.72 - - putty-nogtk 0.72 - - - - -

Simon Tatham reports:

-
-

Vulnerabilities fixed in this release include:

-
    -
  • A malicious SSH-1 server could trigger a buffer overrun by sending - extremely short RSA keys, or certain bad packet length fields. - Either of these could happen before host key verification, so even - if you trust the server you *intended* to connect to, you would - still be at risk. -
    - (However, the SSH-1 protocol is obsolete, and recent versions of - PuTTY do not try it by default, so you are only at risk if you work - with old servers and have explicitly configured SSH-1.)
    • -
  • If a malicious process found a way to impersonate Pageant, then it - could cause an integer overflow in any of the SSH client tools - (PuTTY, Plink, PSCP, PSFTP) which accessed the malicious Pageant.
    • -
-

Other security-related bug fixes include:

-
    -
  • The 'trust sigil' system introduced in PuTTY 0.71 to protect - against server spoofing attacks had multiple bugs. Trust sigils - were not turned off after login in the SSH-1 and Rlogin protocols, - and not turned back on if you used the Restart Session command. - Both are now fixed.
    • -
-
- - - - https://lists.tartarus.org/pipermail/putty-announce/2019/000028.html - - - 2019-07-14 - 2019-07-20 - - - - - jenkins -- multiple vulnerabilities - - - jenkins - 2.186 - - - jenkins-lts - 2.176.2 - - - - -

Jenkins Security Advisory:

-
-

Description

-
(Medium) SECURITY-1424 / CVE-2019-10352
-

Arbitrary file write vulnerability using file parameter definitions

-
(High) SECURITY-626 / CVE-2019-10353
-

CSRF protection tokens did not expire

-
(Medium) SECURITY-534 / CVE-2019-10354
-

Unauthorized view fragment access

-
- - - - CVE-2019-10352 - CVE-2019-10353 - CVE-2019-10354 - https://jenkins.io/security/advisory/2019-07-17/ - - - 2019-07-17 - 2019-07-17 - - - - - libxslt -- security framework bypass - - - libxslt - 1.1.33 - - - - -

Mitre report:

-
-

libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded.

-
- - - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11068 - - - 2019-04-10 - 2019-07-16 - - - - - asterisk -- Remote crash vulnerability with MESSAGE messages - - - asterisk13 - 13.27.1 - - - asterisk15 - 15.7.3 - - - asterisk16 - 16.4.1 - - - - -

The Asterisk project reports:

-
-

A specially crafted SIP in-dialog MESSAGE message can cause Asterisk to crash.

-
- - - - https://downloads.asterisk.org/pub/security/AST-2019-002.html - CVE-2019-12827 - - - 2019-06-13 - 2019-07-12 - - - - - asterisk -- Remote Crash Vulnerability in chan_sip channel driver - - - asterisk13 - 13.27.1 - - - asterisk15 - 15.7.3 - - - asterisk16 - 16.4.1 - - - - -

The Asterisk project reports:

-
-

When T.38 faxing is done in Asterisk a T.38 reinvite - may be sent to an endpoint to switch it to T.38. If the - endpoint responds with an improperly formatted SDP answer - including both a T.38 UDPTL stream and an audio or video - stream containing only codecs not allowed on the SIP peer - or user a crash will occur. The code incorrectly assumes - that there will be at least one common codec when T.38 - is also in the SDP answer.

-
- - - - https://downloads.asterisk.org/pub/security/AST-2019-003.html - CVE-2019-13161 - - - 2019-06-28 - 2019-07-12 - - - - - python 3.7 -- multiple vulnerabilities - - - python37 - 3.7.4 - - - - -

Python changelog:

-
-

bpo-37463: ssl.match_hostname() no longer accepts IPv4 addresses with additional text - after the address and only quad-dotted notation without trailing whitespaces. Some - inet_aton() implementations ignore whitespace and all data after whitespace, e.g.'127.0.0.1 - whatever'.

-

bpo-35907: CVE-2019-9948: Avoid file reading by disallowing local-file:// and - local_file:// URL schemes in URLopener().open() and URLopener().retrieve() of - urllib.request.

-

bpo-36742: Fixes mishandling of pre-normalization characters in urlsplit().

-

bpo-30458: Address CVE-2019-9740 by disallowing URL paths with embedded whitespace - or control characters through into the underlying http client request. Such potentially - malicious header injection URLs now cause an http.client.InvalidURL exception to be - raised.

-

bpo-33529: Prevent fold function used in email header encoding from entering infinite - loop when there are too many non-ASCII characters in a header.

-

bpo-35755: shutil.which() now uses os.confstr("CS_PATH") if available and if the PATH - environment variable is not set. Remove also the current directory from posixpath.defpath. - On Unix, shutil.which() and the subprocess module no longer search the executable in the - current directory if the PATH environment variable is not set.

-
- - - - https://docs.python.org/3.7/whatsnew/changelog.html#python-3-7-4-final - CVE-2019-9740 - CVE-2019-9948 - - - 2019-03-13 - 2019-07-12 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 68.0_4,1 - - - waterfox - 56.2.12 - - - seamonkey - linux-seamonkey - 2.53.0 - - - firefox-esr - 60.8.0,1 - - - linux-firefox - 60.8.0,2 - - - libxul - thunderbird - linux-thunderbird - 60.8.0 - - - - -

Mozilla Foundation reports:

-
-

CVE-2019-9811: Sandbox escape via installation of malicious language pack

-

CVE-2019-11711: Script injection within domain through inner window reuse

-

CVE-2019-11712: Cross-origin POST requests can be made with NPAPI plugins by following 308 redirects

-

CVE-2019-11713: Use-after-free with HTTP/2 cached stream

-

CVE-2019-11714: NeckoChild can trigger crash when accessed off of main thread

-

CVE-2019-11729: Empty or malformed p256-ECDH public keys may trigger a segmentation fault

-

CVE-2019-11715: HTML parsing error can contribute to content XSS

-

CVE-2019-11716: globalThis not enumerable until accessed

-

CVE-2019-11717: Caret character improperly escaped in origins

-

CVE-2019-11718: Activity Stream writes unsanitized content to innerHTML

-

CVE-2019-11719: Out-of-bounds read when importing curve25519 private key

-

CVE-2019-11720: Character encoding XSS vulnerability

-

CVE-2019-11721: Domain spoofing through unicode latin 'kra' character

-

CVE-2019-11730: Same-origin policy treats all files in a directory as having the same-origin

-

CVE-2019-11723: Cookie leakage during add-on fetching across private browsing boundaries

-

CVE-2019-11724: Retired site input.mozilla.org has remote troubleshooting permissions

-

CVE-2019-11725: Websocket resources bypass safebrowsing protections

-

CVE-2019-11727: PKCS#1 v1.5 signatures can be used for TLS 1.3

-

CVE-2019-11728: Port scanning through Alt-Svc header

-

CVE-2019-11710: Memory safety bugs fixed in Firefox 68

-

CVE-2019-11709: Memory safety bugs fixed in Firefox 68 and Firefox ESR 60.8

-
- - - - CVE-2019-11709 - CVE-2019-11710 - CVE-2019-11711 - CVE-2019-11712 - CVE-2019-11713 - CVE-2019-11714 - CVE-2019-11715 - CVE-2019-11716 - CVE-2019-11717 - CVE-2019-11718 - CVE-2019-11719 - CVE-2019-11720 - CVE-2019-11721 - CVE-2019-11723 - CVE-2019-11724 - CVE-2019-11725 - CVE-2019-11727 - CVE-2019-11728 - CVE-2019-11729 - CVE-2019-11730 - CVE-2019-9811 - https://www.mozilla.org/security/advisories/mfsa2019-21/ - https://www.mozilla.org/security/advisories/mfsa2019-22/ - - - 2019-07-09 - 2019-07-09 - 2019-07-23 - - - - - GnuPG -- denial of service - - - gnupg - 2.2.17 - - - - -

From the GnuPG 2.2.17 changelog:

-
-

gpg: Ignore all key-signatures received from keyservers. This - change is required to mitigate a DoS due to keys flooded with - faked key-signatures.

-
- - - - https://dev.gnupg.org/T4606 - https://dev.gnupg.org/T4607 - - - 2019-07-03 - 2019-07-09 - - - - - python 3.6 -- multiple vulnerabilities - - - python36 - 3.6.9 - - - - -

Python changelog:

-
-

bpo-35907: CVE-2019-9948: Avoid file reading by disallowing local-file:// - and local_file:// URL schemes in URLopener().open() and URLopener().retrieve() - of urllib.request.

-

bpo-36742: Fixes mishandling of pre-normalization characters in urlsplit().

-

bpo-30458: Address CVE-2019-9740 by disallowing URL paths with embedded - whitespace or control characters through into the underlying http client - request. Such potentially malicious header injection URLs now cause an - http.client.InvalidURL exception to be raised.

-

bpo-36216: Changes urlsplit() to raise ValueError when the URL contains - characters that decompose under IDNA encoding (NFKC-normalization) into - characters that affect how the URL is parsed.

-

bpo-33529: Prevent fold function used in email header encoding from - entering infinite loop when there are too many non-ASCII characters in - a header.

-

bpo-35121: Don't send cookies of domain A without Domain attribute to - domain B when domain A is a suffix match of domain B while using a cookiejar - with http.cookiejar.DefaultCookiePolicy policy. Patch by Karthikeyan - Singaravelan.

-
- - - - https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-9-final - CVE-2019-9948 - CVE-2019-9740 - - - 2019-03-13 - 2019-07-08 - - - - - webkit2-gtk3 -- Multiple vulnerabilities - - - webkit2-gtk3 - 2.24.2 - - - - -

The WebKitGTK project reports many vulnerabilities, - including several arbitrary code execution vulnerabilities.

- - - - https://webkitgtk.org/security/WSA-2019-0002.html - CVE-2019-6201 - CVE-2019-6251 - CVE-2019-7285 - CVE-2019-7292 - CVE-2019-8503 - CVE-2019-8506 - CVE-2019-8515 - CVE-2019-8518 - CVE-2019-8523 - CVE-2019-8524 - CVE-2019-8535 - CVE-2019-8536 - CVE-2019-8544 - CVE-2019-8551 - CVE-2019-8558 - CVE-2019-8559 - CVE-2019-8563 - CVE-2019-11070 - https://webkitgtk.org/security/WSA-2019-0003.html - CVE-2019-6237 - CVE-2019-8571 - CVE-2019-8583 - CVE-2019-8584 - CVE-2019-8586 - CVE-2019-8587 - CVE-2019-8594 - CVE-2019-8595 - CVE-2019-8596 - CVE-2019-8597 - CVE-2019-8601 - CVE-2019-8607 - CVE-2019-8608 - CVE-2019-8609 - CVE-2019-8610 - CVE-2019-8615 - CVE-2019-8611 - CVE-2019-8619 - CVE-2019-8622 - CVE-2019-8623 - - - 2019-04-10 - 2019-07-06 - - - - - mediawiki -- multiple vulnerabilities - - - mediawiki131 - 1.31.3 - - - mediawiki132 - 1.32.3 - - - - -

Mediawiki reports:

-
-

Security fixes: - T197279, CVE-2019-12468: Directly POSTing to Special:ChangeEmail would allow - for bypassing reauthentication, allowing for potential account takeover. - T204729, CVE-2019-12473: Passing invalid titles to the API could cause a DoS - by querying the entire `watchlist` table. - T207603, CVE-2019-12471: Loading user JavaScript from a non-existent account - allows anyone to create the account, and XSS the users' loading that script. - T208881: blacklist CSS var(). - T199540, CVE-2019-12472: It is possible to bypass the limits on IP range - blocks (`$wgBlockCIDRLimit`) by using the API. - T212118, CVE-2019-12474: Privileged API responses that include whether a - recent change has been patrolled may be cached publicly. - T209794, CVE-2019-12467: A spammer can use Special:ChangeEmail to send out - spam with no rate limiting or ability to block them. - T25227, CVE-2019-12466: An account can be logged out without using a token(CRRF) - T222036, CVE-2019-12469: Exposed suppressed username or log in Special:EditTags. - T222038, CVE-2019-12470: Exposed suppressed log in RevisionDelete page. - T221739, CVE-2019-11358: Fix potential XSS in jQuery.

-
- - - - CVE-2019-11358 - CVE-2019-12466 - CVE-2019-12467 - CVE-2019-12468 - CVE-2019-12469 - CVE-2019-12470 - CVE-2019-12471 - CVE-2019-12472 - CVE-2019-12473 - CVE-2019-12474 - https://lists.wikimedia.org/pipermail/mediawiki-announce/2019-June/000230.html - - - 2019-04-23 - 2019-07-05 - - - - - ettercap -- out-of-bound read vulnerability - - - ettercap - 0.8.3,1 - - - - -

Ettercap GitHub issue:

-
-

Etterfilter results in an invalid read of 8 bytes when parsing a crafted file.

-
- - - - https://github.com/Ettercap/ettercap/issues/782 - https://nvd.nist.gov/vuln/detail/CVE-2017-6430 - CVE-2017-6430 - - - 2019-07-01 - 2019-07-03 - - - - - Gitlab -- Multiple Vulnerabilities - - - gitlab-ce - 12.0.012.0.3 - 11.11.011.11.5 - 8.3.011.10.8 - - - - -

Gitlab reports:

-
-

Ability to Write a Note to a Private Snippet

-

Recent Pipeline Information Disclosed to Unauthorised Users

-

Resource Exhaustion Attack

-

Error Caused by Encoded Characters in Comments

-

Authorization Issues in GraphQL

-

Number of Merge Requests was Accessible

-

Enabling One of the Service Templates Could Cause Resource Depletion

-

Broken Access Control for the Content of Personal Snippets

-

Decoding Color Codes Caused Resource Depletion

-

Merge Request Template Name Disclosure

-

SSRF Vulnerability in Project GitHub Integration

-
- - - - https://about.gitlab.com/2019/07/03/security-release-gitlab-12-dot-0-dot-3-released/ - CVE-2019-13001 - CVE-2019-13002 - CVE-2019-13003 - CVE-2019-13004 - CVE-2019-13005 - CVE-2019-13006 - CVE-2019-13007 - CVE-2019-13009 - CVE-2019-13010 - CVE-2019-13011 - CVE-2019-13121 - - - 2019-07-03 - 2019-07-03 - - - - - SDL2_image -- multiple vulnerabilities - - - sdl2_image - 2.0.5 - - - - -

SDL_image developers report:

-
-

Fixed a number of security issues:

-
    -
  • TALOS-2019-0820
    • -
  • TALOS-2019-0821
    • -
  • TALOS-2019-0841
    • -
  • TALOS-2019-0842
    • -
  • TALOS-2019-0843
    • -
  • TALOS-2019-0844
    • -
-
- - - - https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0820 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0821 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0841 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0842 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0843 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0844 - CVE-2019-5051 - CVE-2019-5052 - CVE-2019-5057 - CVE-2019-5058 - CVE-2019-5059 - CVE-2019-5060 - - - 2019-07-02 - 2019-07-03 - - - - - irssi -- Use after free when sending SASL login to the server - - - irssi - 1.2.1,1 - - - - -

Irssi reports:

-
-

Use after free when sending SASL login to the server found by ilbelkyr. (CWE-416, CWE-825)

-
- - - - https://irssi.org/security/irssi_sa_2019_06.txt - CVE-2019-13045 - - - 2019-06-29 - 2019-07-01 - - - - - Django -- Incorrect HTTP detection with reverse-proxy connecting via HTTPS - - - py27-django111 - py35-django111 - py36-django111 - py37-django111 - 1.11.22 - - - py35-django21 - py36-django21 - py37-django21 - 2.1.10 - - - py35-django22 - py36-django22 - py37-django22 - 2.2.3 - - - - -

Django security releases issued:

-
-

When deployed behind a reverse-proxy connecting to Django via HTTPS, - django.http.HttpRequest.scheme would incorrectly detect client requests - made via HTTP as using HTTPS. This entails incorrect results for is_secure(), - and build_absolute_uri(), and that HTTP requests would not be redirected to - HTTPS in accordance with SECURE_SSL_REDIRECT.

-
- - - - CVE-2019-12781 - https://www.djangoproject.com/weblog/2019/jul/01/security-releases/ - - - 2019-07-01 - 2019-07-01 - - - - - bzip2 -- multiple issues - - - bzip2 - 1.0.7 - - - - -

bzip2 developers reports:

-
-

CVE-2016-3189 - Fix use-after-free in bzip2recover (Jakub Martisko)

-

CVE-2019-12900 - Detect out-of-range nSelectors in corrupted files (Albert Astals Cid). Found through fuzzing karchive.

-
- - - - https://gitlab.com/federicomenaquintero/bzip2/blob/master/NEWS - https://bugzilla.redhat.com/show_bug.cgi?id=1319648 - CVE-2016-3189 - CVE-2019-12900 - - - 2019-06-23 - 2019-06-30 - - - - - powerdns -- multiple vulnerabilities - - - powerdns - 4.1.10 - - - - -

PowerDNS Team reports:

-
-

CVE-2019-10162: An issue has been found in PowerDNS Authoritative Server allowing an authorized user to - cause the server to exit by inserting a crafted record in a MASTER type zone under their control. The - issue is due to the fact that the Authoritative Server will exit when it runs into a parsing error while - looking up the NS/A/AAAA records it is about to use for an outgoing notify.

-

CVE-2019-10163: An issue has been found in PowerDNS Authoritative Server allowing a remote, authorized - master server to cause a high CPU load or even prevent any further updates to any slave zone by sending - a large number of NOTIFY messages. Note that only servers configured as slaves are affected by this issue.

-
- - - - https://doc.powerdns.com/authoritative/changelog/4.1.html#change-4.1.10 - CVE-2019-10162 - CVE-2019-10163 - - - 2019-06-21 - 2019-06-21 - - - - - TYPO3 -- multiple vulnerabilities - - - typo3-8-php71 - typo3-8-php72 - typo3-8-php73 - 8.7.27 - - - typo3-9-php71 - typo3-9-php72 - typo3-9-php73 - 9.5.8 - - - - -

TYPO3 news:

-
-

Please read the corresponding Security Advisories for details.

-
- - - - https://typo3.org/article/typo3-958-and-8727-security-releases-published/ - https://get.typo3.org/release-notes/8.7.27 - https://get.typo3.org/release-notes/9.5.8 - CVE-2019-10912 - CVE-2019-12747 - CVE-2019-12748 - - - 2019-06-28 - 2019-06-28 - - - - - PostgreSQL -- Stack-based buffer overflow via setting a password - - - postgresql11-server - 11.4 - - - postgresql10-server - 10.9 - - - - -

The PostgreSQL project reports:

-
-

- An authenticated user could create a stack-based buffer overflow - by changing their own password to a purpose-crafted value. In addition - to the ability to crash the PostgreSQL server, this could be further - exploited to execute arbitrary code as the PostgreSQL operating system account. -

-

- Additionally, a rogue server could send a specifically crafted - message during the SCRAM authentication process and cause a libpq-enabled client - to either crash or execute arbitrary code as the client's operating system account. -

-

- This issue is fixed by upgrading and restarting your PostgreSQL - server as well as your libpq installations. All users running - PostgreSQL 10, 11, and 12 beta are encouraged to upgrade as soon as possible. -

-
- - - - https://www.postgresql.org/about/news/1949/ - CVE-2019-10164 - - - 2019-06-20 - 2019-06-27 - - - - - znc -- privilege escalation - - - znc - 1.7.4 - - - - -

Mitre reports:

-
-

Modules.cpp in ZNC before 1.7.4-rc1 allows remote authenticated - non-admin users to escalate privileges and execute arbitrary - code by loading a module with a crafted name.

-
- - - - CVE-2019-12816 - https://wiki.znc.in/ChangeLog/1.7.4 - - - 2019-06-13 - 2019-06-22 - - - - - Mozilla -- multiple vulnerabilities - - - thunderbird - thunderbird-60.7.2 - - - - -

Mozilla Foundation reports:

-
-

CVE-2019-11707: Type confusion in Array.pop

-

A type confusion vulnerability can occur when manipulating - JavaScript objects due to issues in Array.pop. This can allow - for an exploitable crash. We are aware of targeted attacks in - the wild abusing this flaw.

-

CVE-2019-11708: sandbox escape using Prompt:Open

-

Insufficient vetting of parameters passed with the - Prompt:Open IPC message between child and parent processes can - result in the non-sandboxed parent process opening web content - chosen by a compromised child process. When combined with - additional vulnerabilities this could result in executing - arbitrary code on the user's computer.

-
- - - - https://www.mozilla.org/en-US/security/advisories/mfsa2019-20/ - CVE-2019-11707 - CVE-2019-11708 - - - 2019-06-20 - 2019-06-21 - - - - - Mozilla -- multiple vulnerabilities - - - firefox - 67.0.4,1 - - - waterfox - 56.2.12 - - - firefox-esr - 60.7.2,1 - - - - -

Mozilla Foundation reports:

-
-

CVE-2019-11708: sandbox escape using Prompt:Open

-

Insufficient vetting of parameters passed with the - Prompt:Open IPC message between child and parent processes - can result in the non-sandboxed parent process opening web - content chosen by a compromised child process. When combined - with additional vulnerabilities this could result in executing - arbitrary code on the user's computer.

-
- - - - https://www.mozilla.org/en-US/security/advisories/mfsa2019-19/ - CVE-2019-11708 - - - 2019-06-20 - 2019-06-21 - 2019-07-09 - - - - - Mozilla -- multiple vulnerabilities - - - thunderbird - 60.7.1 - - - - -

Mozilla Foundation reports:

-
-

CVE-2019-11703: Heap buffer overflow in icalparser.c

-

A flaw in Thunderbird's implementation of iCal causes a heap - buffer overflow in parser_get_next_char when processing certain - email messages, resulting in a potentially exploitable crash.

-

CVE-2019-11704: Heap buffer overflow in icalvalue.c

-

A flaw in Thunderbird's implementation of iCal causes a heap - buffer overflow in icalmemory_strdup_and_dequote when processing - certain email messages, resulting in a potentially exploitable - crash.

-

CVE-2019-11705: Stack buffer overflow in icalrecur.c

-

A flaw in Thunderbird's implementation of iCal causes a stack - buffer overflow in icalrecur_add_bydayrules when processing - certain email messages, resulting in a potentially exploitable - crash.

-

CVE-2019-11706: Type confusion in icalproperty.c

-

A flaw in Thunderbird's implementation of iCal causes a type - confusion in icaltimezone_get_vtimezone_properties when - processing certain email messages, resulting in a crash.

-
- - - - https://www.mozilla.org/en-US/security/advisories/mfsa2019-17/ - CVE-2019-11703 - CVE-2019-11704 - CVE-2019-11705 - CVE-2019-11706 - - - 2019-06-13 - 2019-06-21 - - - - - vlc -- Double free in Matroska demuxer - - - vlc - 3.0.7.1,4 - - - - -

The VLC project reports:

-
-

mkv: Fix potential double free

-
- - - - CVE-2019-12874 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12874 - http://git.videolan.org/?p=vlc.git;a=commit;h=81023659c7de5ac2637b4a879195efef50846102 - - - 2019-05-20 - 2019-06-20 - - - - - vlc -- Buffer overflow vulnerability - - - vlc - 3.0.7,4 - - - - -

zhangyang reports:

-
-

The ReadFrame function in the avi.c file uses a variable i_width_bytes, - which is obtained directly from the file. It is a signed integer. - It does not do a strict check before the memory operation(memmove, memcpy), - which may cause a buffer overflow.

-
- - - - CVE-2019-5439 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5439 - https://hackerone.com/reports/484398 - - - 2019-01-23 - 2019-06-20 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 67.0.3,1 - - - waterfox - 56.2.11 - - - firefox-esr - 60.7.1,1 - - - - -

Mozilla Foundation reports:

-
-

CVE-2019-11707: Type confusion in Array.pop

-

A type confusion vulnerability can occur when - manipulating JavaScript objects due to issues in - Array.pop. This can allow for an exploitable crash. We are - aware of targeted attacks in the wild abusing this flaw.

-
- - - - CVE-2019-11707 - https://www.mozilla.org/security/advisories/mfsa2019-18/ - - - 2019-06-18 - 2019-06-19 - 2019-06-20 - - - - - netatalk3 -- remote code execution vulnerability - - - netatalk3 - 3.1.12,1 - - - - -

NIST reports:

-
-

Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c. This is due to lack of bounds checking on attacker controlled data. A remote unauthenticated attacker can leverage this vulnerability to achieve arbitrary code execution.

-
- - - - https://nvd.nist.gov/vuln/detail/CVE-2018-1160 - https://medium.com/tenable-techblog/exploiting-an-18-year-old-bug-b47afe54172 - - - 2018-11-10 - 2019-06-16 - - - - - GraphicsMagick -- multiple vulnerabilities - - - GraphicsMagick - 1.3.32,1 - - - - -

GraphicsMagick News:

-
-

Read "Security Fixes:" section for details.

-
- - - - http://www.graphicsmagick.org/NEWS.html - - - 2019-06-15 - 2019-06-16 - - - - - chromium -- use after free - - - chromium - 75.0.3770.90 - - - - -

Google Chrome Releases reports:

-
-

[961413] High CVE-2019-5842: Use-after-free in Blink. Reported by BUGFENSE Anonymous Bug Bounties https://bugfense.io on 2019-05-09

-
- - - - https://chromereleases.googleblog.com/2019/06/stable-channel-update-for-desktop_13.html - CVE-2019-5842 - - - 2019-05-09 - 2019-06-15 - - - - - phpMyAdmin -- CSRF vulnerability in login form - - - phpMyAdmin - phpMyAdmin-php56 - phpMyAdmin-php70 - phpMyAdmin-php71 - phpMyAdmin-php72 - 4.9.0 - - - - -

The phpMyAdmin development team reports:

-
-

Summary

-

CSRF vulnerability in login form

- -

Description

-

A vulnerability was found that allows an attacker to - trigger a CSRF attack against a phpMyAdmin user. The - attacker can trick the user, for instance through a broken - <img> tag pointing at the victim's - phpMyAdmin database, and the attacker can potentially - deliver a payload (such as a specific INSERT or DELETE - statement) through the victim.

- -

Severity

-

We consider this vulnerability to be severe.

- - -

Mitigation factor

Only the 'cookie' - auth_type is affected; users can temporary use - phpMyAdmin's http authentication as a workaround.

- -
- - - - https://www.phpmyadmin.net/security/PMASA-2019-4/ - CVE-2019-12616 - - - 2019-06-04 - 2019-06-13 - - - - - Vim/NeoVim -- Security vulnerability - - - vim - vim-console - vim-tiny - 8.1.1365 - - - neovim - 0.3.6 - - - - -

Security releases for Vim/NeoVim:

-
-

Sandbox escape allows for arbitrary code execution.

-
- - - - https://nvd.nist.gov/vuln/detail/CVE-2019-12735 - - - 2019-05-22 - 2019-06-13 - - - - - mybb -- vulnerabilities - - - mybb - 1.8.21 - - - - -

mybb Team reports:

-
-

High risk: Theme import stylesheet name RCE

-

High risk: Nested video MyCode persistent XSS

-

Medium risk: Find Orphaned Attachments reflected XSS

-

Medium risk: Post edit reflected XSS

-

Medium risk: Private Messaging folders SQL injection

-

Low risk: Potential phar deserialization through Upload Path

-
- - - - https://blog.mybb.com/2019/06/10/mybb-1-8-21-released-security-maintenance-release/ - - - 2019-06-10 - 2019-06-12 - - - - - Flash Player -- arbitrary code execution - - - linux-flashplayer - 32.0.0.207 - - - - -

Adobe reports:

-
-
    -
  • This update resolves a use-after-free vulnerability that - could lead to arbitrary code execution (CVE-2019-7845).
    • -
-
- - - - CVE-2019-7845 - https://helpx.adobe.com/security/products/flash-player/apsb19-30.html - - - 2019-06-11 - 2019-06-11 - - - - - drupal -- Drupal core - Moderately critical - - - drupal7 - 7.67 - - - drupal8 - 8.7.1 - - - - -

Drupal Security Team reports:

-
-

CVE-2019-11831: By-passing protection of Phar Stream Wrapper Interceptor.

-

In order to intercept file invocations like file_exists or stat on compromised Phar archives - the base name has to be determined and checked before allowing to be handled by PHP - Phar stream handling. - The current implementation is vulnerable to path traversal leading to scenarios where the - Phar archive to be assessed is not the actual (compromised) file.

-
- - - - https://www.drupal.org/SA-CORE-2019-007 - - - 2019-05-08 - 2019-06-08 - - - - - Exim -- RCE in deliver_message() function - - - exim - 4.874.92 - - - - -

Exim team and Qualys report:

-
-

- We received a report of a possible remote exploit. Currently there is no evidence of an active use of this exploit. -

-

- A patch exists already, is being tested, and backported to all - versions we released since (and including) 4.87. -

-

- The severity depends on your configuration. It depends on how close to - the standard configuration your Exim runtime configuration is. The - closer the better. -

-

- Exim 4.92 is not vulnerable. -

-
- - - - CVE-2019-10149 - https://www.exim.org/static/doc/security/CVE-2019-10149.txt - - - 2019-05-27 - 2019-06-06 - - - - - Django -- AdminURLFieldWidget XSS - - - py27-django111 - py35-django111 - py36-django111 - py37-django111 - 1.11.21 - - - py35-django21 - py36-django21 - py37-django21 - 2.1.9 - - - py35-django22 - py36-django22 - py37-django22 - 2.2.2 - - - - -

Django security releases issued:

-
-

The clickable "Current URL" link generated by AdminURLFieldWidget displayed the - provided value without validating it as a safe URL. Thus, an unvalidated value stored - in the database, or a value provided as a URL query parameter payload, could result - in an clickable JavaScript link..

-

jQuery before 3.4.0, mishandles jQuery.extend(true, {}, ...) because of Object.prototype - pollution. If an unsanitized source object contained an enumerable __proto__ property, - it could extend the native Object.prototype.

-
- - - - CVE-2019-12308 - CVE-2019-11358 - https://www.djangoproject.com/weblog/2019/jun/03/security-releases/ - - - 2019-06-03 - 2019-06-06 - - - - - Gitlab -- Multiple Vulnerabilities - - - gitlab-ce - 11.11.011.11.1 - 11.10.011.10.5 - 6.8.011.9.12 - - - - -

Gitlab reports:

-
-

Remote Command Execution Vulnerability on Repository Download Feature

-

Confidential Issue Titles Revealed to Restricted Users on Unsubscribe

-

Disclosure of Milestone Metadata through the Search API

-

Private Project Discovery via Comment Links

-

Metadata of Confidential Issues Disclosed to Restricted Users

-

Mandatory External Authentication Provider Sign-In Restrictions Bypass

-

Internal Projects Allowed to Be Created on in Private Groups

-

Server-Side Request Forgery Through DNS Rebinding

-

Stored Cross-Site Scripting on Wiki Pages

-

Stored Cross-Site Scripting on Notes

-

Repository Password Disclosed on Import Error Page

-

Protected Branches Restriction Rules Bypass

-

Stored Cross-Site Scripting Vulnerability on Child Epics

-
- - - - https://about.gitlab.com/2019/06/03/security-release-gitlab-11-dot-11-dot-1-released/ - CVE-2019-12430 - CVE-2019-12432 - CVE-2019-12431 - CVE-2019-12434 - CVE-2019-12429 - CVE-2019-12428 - CVE-2019-12433 - CVE-2019-12443 - CVE-2019-12444 - CVE-2019-12445 - CVE-2019-12446 - CVE-2019-12441 - CVE-2019-12442 - - - 2019-06-03 - 2019-06-03 - - - - - buildbot -- OAuth Authentication Vulnerability - - - py27-buildbot - py35-buildbot - py36-buildbot - py37-buildbot - 2.3.1 - - - - -
-

Buildbot accepted user-submitted authorization token from OAuth and used - it to authenticate user.

-

The vulnerability can lead to malicious attackers to authenticate as legitimate users - of a Buildbot instance without knowledge of the victim's login credentials on certain - scenarios.

-

If an attacker has an application authorized to access data of another user at the - same Identity Provider as the used by the Buildbot instance, then he can acquire a token - to access the data of that user, supply the token to the Buildbot instance and successfully - login as the victim.

-
- - - - https://github.com/buildbot/buildbot/wiki/OAuth-vulnerability-in-using-submitted-authorization-token-for-authentication - https://github.com/buildbot/buildbot/pull/4763 - CVE-2019-12300 - - - 2019-05-07 - 2019-06-01 - - - - - bro -- Unsafe integer conversions can cause unintentional code paths to be executed - - - bro - 2.6.2 - - - - -

Jon Siwek of Corelight reports:

-
-

The following Denial of Service vulnerabilities are addressed:

-
    -
  • Integer type mismatches in BinPAC-generated parser code - and Bro analyzer code may allow for crafted packet data - to cause unintentional code paths in the analysis logic - to be taken due to unsafe integer conversions causing the - parser and analysis logic to each expect different fields - to have been parsed. One such example, reported by Maksim - Shudrak, causes the Kerberos analyzer to dereference a - null pointer. CVE-2019-12175 was assigned for this issue.
    • - -
  • The Kerberos parser allows for several fields to be left - uninitialized, but they were not marked with an &optional - attribute and several usages lacked existence checks. - Crafted packet data could potentially cause an attempt - to access such uninitialized fields, generate a runtime - error/exception, and leak memory. Existence checks and - &optional attributes have been added to the relevent - Kerberos fields.
    • - -
  • BinPAC-generated protocol parsers commonly contain fields - whose length is derived from other packet input, and for - those that allow for incremental parsing, BinPAC did not - impose a limit on how large such a field could grow, - allowing for remotely-controlled packet data to cause - growth of BinPAC's flowbuffer bounded only by the numeric - limit of an unsigned 64-bit integer, leading to memory - exhaustion. There is now a generalized limit for how - large flowbuffers are allowed to grow, tunable by setting - "BinPAC::flowbuffer_capacity_max".
    • -
-
- - - - CVE-2017-12175 - - - 2019-05-29 - 2019-05-31 - - - - - ImageMagick -- multiple vulnerabilities - - - ImageMagick7 - 7.0.8.47 - - - ImageMagick7-nox11 - 7.0.8.47 - - - ImageMagick6 - 6.9.10.47,1 - - - ImageMagick6-nox11 - 6.9.10.47,1 - - - - -

cvedetails.com reports:

-
-

CVE-2019-7175: In ImageMagick before 7.0.8-25, some memory leaks exist in DecodeImage in coders/pcd.c.

-

CVE-2019-7395: In ImageMagick before 7.0.8-25, a memory leak exists in WritePSDChannel in coders/psd.c.

-

CVE-2019-7396: In ImageMagick before 7.0.8-25, a memory leak exists in ReadSIXELImage in coders/sixel.c.

-

CVE-2019-7397: In ImageMagick before 7.0.8-25 and GraphicsMagick through 1.3.31, several memory leaks exist in WritePDFImage in coders/pdf.c.

-

CVE-2019-7398: In ImageMagick before 7.0.8-25, a memory leak exists in WriteDIBImage in coders/dib.c.

-

CVE-2019-9956: In ImageMagick 7.0.8-35 Q16, there is a stack-based buffer overflow in the function PopHexPixel of coders/ps.c, which allows an attacker to cause a denial of service or code execution via a crafted image file.

-

CVE-2019-10131: An off-by-one read vulnerability was discovered in ImageMagick before version 7.0.7-28 in the formatIPTCfromBuffer function in coders/meta.c. A local attacker may use this flaw to read beyond the end of the buffer or to crash the program.

-

CVE-2019-10649: In ImageMagick 7.0.8-36 Q16, there is a memory leak in the function SVGKeyValuePairs of coders/svg.c, which allows an attacker to cause a denial of service via a crafted image file.

-

CVE-2019-10650: In ImageMagick 7.0.8-36 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of coders/tiff.c, which allows an attacker to cause a denial of service or information disclosure via a crafted image file.

-

CVE-2019-10714: LocaleLowercase in MagickCore/locale.c in ImageMagick before 7.0.8-32 allows out-of-bounds access, leading to a SIGSEGV.

-

CVE-2019-11470: The cineon parsing component in ImageMagick 7.0.8-26 Q16 allows attackers to cause a denial-of-service (uncontrolled resource consumption) by crafting a Cineon image with an incorrect claimed image size. This occurs because ReadCINImage in coders/cin.c lacks a check for insufficient image data in a file.

-

CVE-2019-11472: ReadXWDImage in coders/xwd.c in the XWD image parsing component of ImageMagick 7.0.8-41 Q16 allows attackers to cause a denial-of-service (divide-by-zero error) by crafting an XWD image file in which the header indicates neither LSB first nor MSB first.

-

CVE-2019-11597: In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of coders/tiff.c, which allows an attacker to cause a denial of service or possibly information disclosure via a crafted image file.

-

CVE-2019-11598: In ImageMagick 7.0.8-40 Q16, there is a heap-based buffer over-read in the function WritePNMImage of coders/pnm.c, which allows an attacker to cause a denial of service or possibly information disclosure via a crafted image file. This is related to SetGrayscaleImage in MagickCore/quantize.c.

-
- - - - https://www.cvedetails.com/vulnerability-list/vendor_id-1749/Imagemagick.html - CVE-2019-7175 - CVE-2019-7395 - CVE-2019-7396 - CVE-2019-7397 - CVE-2019-7398 - CVE-2019-9956 - CVE-2019-10131 - CVE-2019-10649 - CVE-2019-10650 - CVE-2019-10714 - CVE-2019-11470 - CVE-2019-11472 - CVE-2019-11597 - CVE-2019-11598 - - - 2019-03-07 - 2019-05-30 - 2019-06-17 - - - - - cyrus-imapd -- buffer overrun in httpd - - - cyrus-imapd30 - 3.0.03.0.10 - - - cyrus-imapd25 - 2.5.02.5.13 - - - - -

Cyrus IMAP 3.0.10 Release Notes states:

-
-

Fixed CVE-2019-11356: buffer overrun in httpd

-
- - - - CVE-2019-11356 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11356 - - - 2019-04-19 - 2019-05-27 - - - - - serendipity -- XSS - - - serendipity - 2.1.5 - - - - -

MITRE:

-
-

Serendipity before 2.1.5 has XSS via EXIF data that is mishandled in the templates/2k11/admin/media_choose.tpl Editor Preview feature or the templates/2k11/admin/media_items.tpl Media Library feature.

-
- - - - https://blog.s9y.org/archives/282-Serendipity-2.1.5-released.html - CVE-2019-11870 - - - 2019-05-01 - 2019-05-26 - - - - - sqlite3 -- use after free - - - sqlite3 - 3.26.0 - - - - -

MITRE reports:

-
-

An exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0. A specially crafted SQL command can cause a use after free vulnerability, potentially resulting in remote code execution. An attacker can send a malicious SQL command to trigger this vulnerability.

-
- - - - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0777 - CVE-2019-5018 - - - 2019-05-09 - 2019-05-26 - - - - - suricata -- buffer over-read - - - suricata - 4.1.4 - - - - -

Mitre reports:

-
-

An issue was discovered in Suricata 4.1.x before 4.1.4. If the input of the function SSHParseBanner is composed only of a \n character, then the program runs into a heap-based buffer over-read. This occurs because the erroneous search for \r results in an integer underflow.

-
- - - - https://suricata-ids.org/2019/04/30/suricata-4-1-4-released/ - CVE-2019-10053 - - - 2019-03-15 - 2019-05-26 - 2019-05-26 - - - - - curl -- multiple vulnerabilities - - - curl - 7.19.47.65.0 - - - - -

curl security problems:

-
-

CVE-2019-5435: Integer overflows in curl_url_set()

-

libcurl contains two integer overflows in the curl_url_set() - function that if triggered, can lead to a too small buffer - allocation and a subsequent heap buffer overflow.

-

The flaws only exist on 32 bit architectures and require - excessive string input lengths.

-

CVE-2019-5436: TFTP receive buffer overflow

-

libcurl contains a heap buffer overflow in the function - (tftp_receive_packet()) that recevives data from a TFTP server. It - calls recvfrom() with the default size for the buffer rather than - with the size that was used to allocate it. Thus, the content that - might overwrite the heap memory is entirely controlled by the server.

-

The flaw exists if the user selects to use a "blksize" of 504 or - smaller (default is 512). The smaller size that is used, the larger - the possible overflow becomes.

-

Users chosing a smaller size than default should be rare as the - primary use case for changing the size is to make it larger.

-

It is rare for users to use TFTP across the Internet. It is most - commonly used within local networks.

-
- - - - https://curl.haxx.se/docs/security.html - https://curl.haxx.se/docs/CVE-2019-5435.html - https://curl.haxx.se/docs/CVE-2019-5436.html - CVE-2019-5435 - CVE-2019-5436 - - - 2019-05-22 - 2019-05-25 - 2019-05-26 - - - - - OCaml -- Multiple Security Vulnerabilities - - - ocaml - 4.03.0 - - - - -

MITRE reports:

-
-

OCaml before 4.03.0 does not properly handle sign extensions, which allows remote attackers to conduct buffer overflow attacks or obtain sensitive information as demonstrated by a long string to the String.copy function.

-
- - - - https://nvd.nist.gov/vuln/detail/CVE-2015-8869 - https://github.com/ocaml/ocaml/commit/659615c7b100a89eafe6253e7a5b9d84d0e8df74#diff-a97df53e3ebc59bb457191b496c90762 - CVE-2015-8869 - - - 2016-06-13 - 2019-05-23 - 2019-05-26 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 67.0,1 - - - waterfox - 56.2.10 - - - seamonkey - linux-seamonkey - 2.53.0 - - - firefox-esr - 60.7.0,1 - - - linux-firefox - 60.7.0,2 - - - libxul - thunderbird - linux-thunderbird - 60.7.0 - - - - -

Mozilla Foundation reports:

-
-

CVE-2019-9815: Disable hyperthreading on content JavaScript threads on macOS

-

CVE-2019-9816: Type confusion with object groups and UnboxedObjects

-

CVE-2019-9817: Stealing of cross-domain images using canvas

-

CVE-2019-9818: Use-after-free in crash generation server

-

CVE-2019-9819: Compartment mismatch with fetch API

-

CVE-2019-9820: Use-after-free of ChromeEventHandler by DocShell

-

CVE-2019-9821: Use-after-free in AssertWorkerThread

-

CVE-2019-11691: Use-after-free in XMLHttpRequest

-

CVE-2019-11692: Use-after-free removing listeners in the event listener manager

-

CVE-2019-11693: Buffer overflow in WebGL bufferdata on Linux

-

CVE-2019-7317: Use-after-free in png_image_free of libpng library

-

CVE-2019-11694: Uninitialized memory memory leakage in Windows sandbox

-

CVE-2019-11695: Custom cursor can render over user interface outside of web content

-

CVE-2019-11696: Java web start .JNLP files are not recognized as executable files for download prompts

-

CVE-2019-11697: Pressing key combinations can bypass installation prompt delays and install extensions

-

CVE-2019-11698: Theft of user history data through drag and drop of hyperlinks to and from bookmarks

-

CVE-2019-11700: res: protocol can be used to open known local files

-

CVE-2019-11699: Incorrect domain name highlighting during page navigation

-

CVE-2019-11701: webcal: protocol default handler loads vulnerable web page

-

CVE-2019-9814: Memory safety bugs fixed in Firefox 67

-

CVE-2019-9800: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7

-
- - - - CVE-2019-9815 - CVE-2019-9816 - CVE-2019-9817 - CVE-2019-9818 - CVE-2019-9819 - CVE-2019-9820 - CVE-2019-9821 - CVE-2019-11691 - CVE-2019-11692 - CVE-2019-11693 - CVE-2019-7317 - CVE-2019-11694 - CVE-2019-11695 - CVE-2019-11696 - CVE-2019-11697 - CVE-2019-11698 - CVE-2019-11700 - CVE-2019-11699 - CVE-2019-11701 - CVE-2019-9814 - CVE-2019-9800 - https://www.mozilla.org/security/advisories/mfsa2019-13/ - https://www.mozilla.org/security/advisories/mfsa2019-14/ - https://www.mozilla.org/security/advisories/mfsa2019-15/ - - - 2019-05-21 - 2019-05-22 - 2019-07-23 - - - - - samba -- multiple vulnerabilities - - - samba46 - 4.6.16 - - - samba47 - 4.7.12 - - - samba48 - 4.8.12 - - - samba49 - 4.9.8 - - - samba410 - 4.10.3 - - - - -

The samba project reports:

-
-

The checksum validation in the S4U2Self handler in the embedded Heimdal KDC - did not first confirm that the checksum was keyed, allowing replacement of the - requested target (client) principal

-
-
-

Authenticated users with write permission can trigger a symlink traversal to write - or detect files outside the Samba share.

-
- - - - https://www.samba.org/samba/security/CVE-2018-16860.html - CVE-2018-16860 - https://www.samba.org/samba/security/CVE-2019-3880.html - CVE-2019-3880 - - - 2019-05-14 - 2019-05-14 - - - - - Rust -- violation of Rust's safety guarantees - - - rust - 1.34.01.34.2 - - - - -

Sean McArthur reports:

-
-

- The Rust Programming Language Standard Library 1.34.x - before 1.34.2 contains a stabilized method which, if - overridden, can violate Rust's safety guarantees and - cause memory unsafety. If the Error::type_id method - is overridden then any type can be safely cast to any - other type, causing memory safety vulnerabilities in - safe code (e.g., out-of-bounds write or read). Code - that does not manually implement Error::type_id is - unaffected. -

-
- - - - https://blog.rust-lang.org/2019/05/13/Security-advisory.html - CVE-2019-12083 - - - 2019-05-09 - 2019-05-15 - - - - - Flash Player -- arbitrary code execution - - - linux-flashplayer - 32.0.0.192 - - - - -

Adobe reports:

-
-
    -
  • This update resolves a use-after-free vulnerability that - could lead to arbitrary code execution (CVE-2019-7837).
    • -
-
- - - - CVE-2019-7837 - https://helpx.adobe.com/security/products/flash-player/apsb19-26.html - - - 2019-05-14 - 2019-05-14 - - - - - PHP -- Multiple vulnerabilities in EXIF module - - - php71-exif - 7.1.28 - - - php72-exif - 7.2.17 - - - php73-exif - 7.3.4 - - - - - -

The PHP project reports:

-
-

Heap-buffer-overflow in php_ifd_get32s (CVE-2019-11034)

-

Heap-buffer-overflow in exif_iif_add_value (CVE-2019-11035)

-
- - - - https://www.php.net/ChangeLog-7.php - CVE-2019-11034 - CVE-2019-11035 - - - 2019-04-04 - 2019-05-11 - - - - - PostgreSQL -- Selectivity estimators bypass row security policies - - - postgresql11-server - 11.3 - - - postgresql10-server - 10.8 - - - postgresql96-server - 9.6.13 - - - postgresql95-server - 9.5.17 - - - - -

The PostgreSQL project reports:

-
-

- PostgreSQL maintains statistics for tables by sampling - data available in columns; this data is consulted during - the query planning process. Prior to this release, a user - able to execute SQL queries with permissions to read a - given column could craft a leaky operator that could - read whatever data had been sampled from that column. - If this happened to include values from rows that the user - is forbidden to see by a row security policy, the user - could effectively bypass the policy. This is fixed by only - allowing a non-leakproof operator to use this data if - there are no relevant row security policies for the table. -

-
- - - - https://www.postgresql.org/about/news/1939/ - CVE-2019-10130 - - - 2019-05-09 - 2019-05-09 - - - - - PostgreSQL -- Memory disclosure in partition routing - - - postgresql11-server - 11.3 - - - - -

The PostgreSQL project reports:

-
-

- Prior to this release, a user running PostgreSQL 11 can read - arbitrary bytes of server memory by executing a purpose-crafted - INSERT statement to a partitioned table. -

-
- - - - https://www.postgresql.org/about/news/1939/ - CVE-2019-10129 - - - 2019-05-09 - 2019-05-09 - - - - - gitea -- multiple vulnerabilities - - - gitea - 1.8.0 - - - - -

Gitea Team reports:

-
-

This release contains two new security fixes which cannot be backported - to the 1.7.0 branch, so it is recommended to update to this version.

-
- - - - https://blog.gitea.io/2019/04/gitea-1.8.0-is-released/ - - - 2019-04-21 - 2019-05-06 - - - - - comms/hylafax -- Malformed fax sender remote code execution in JPEG support - - - hylafax - 6.0.7 - - - - -
-

A malicious sender that sets both JPEG and MH,MR,MMR or JBIG in - the same DCS signal or sends a large JPEG page could lead to remote code execution. -

-
- - - - CVE-2018-17141 - ftp://ftp.hylafax.org/security/CVE-2018-17141.html - https://www.x41-dsec.de/lab/advisories/x41-2018-008-hylafax/ - http://bugs.hylafax.org/show_bug.cgi?id=974 - http://git.hylafax.org/HylaFAX?a=commit;h=c6cac8d8cd0dbe313689ba77023e12bc5b3027be - - - 2018-08-24 - 2019-05-05 - - - - - Gitlab -- Information Disclosure - - - gitlab-ce - 11.10.011.10.3 - 11.9.011.9.11 - 11.8.011.8.10 - - - - -

Gitlab reports:

-
-

Information Disclosure with Limited Scope Token

-
- - - - https://about.gitlab.com/2019/04/30/security-release-gitlab-11-dot-10-dot-3-released/ - CVE-2019-11605 - - - 2019-04-30 - 2019-05-01 - - - - - Dovecot -- Multiple vulnerabilities - - - dovecot - 2.3.02.3.6 - - - - -

Aki Tuomi reports:

-
-

Submission-login crashes with signal 11 due to null pointer access when authentication is aborted by disconnecting. This can lead to denial-of-service attack by persistent attacker(s).

-
-

Aki Tuomi reports:

-
-

Submission-login crashes when authentication is started over TLS secured channel and invalid authentication message is sent. This can lead to denial-of-service attack by persistent attacker(s).

-
- - - - https://dovecot.org/list/dovecot-news/2019-April/000409.html - CVE-2019-11494 - https://dovecot.org/list/dovecot-news/2019-April/000410.html - CVE-2019-11499 - - - 2019-03-11 - 2019-04-30 - - - - - Gitlab -- Multiple vulnerabilities - - - gitlab-ce - 11.10.011.10.2 - 11.9.011.9.10 - 6.0.011.8.9 - - - - -

Gitlab reports:

-
-

Moving an Issue to Private Repo Leaks Project Namespace

-

Notification Emails Sent to Restricted Users

-

Unauthorized Comments on Confidential Issues

-

Merge Request Approval Count Inflation

-

Unsanitized Branch Names on New Merge Request Notification Emails

-

Improper Sanitation of Credentials in Gitaly

-
- - - - https://about.gitlab.com/2019/04/29/security-release-gitlab-11-dot-10-dot-2-released/ - CVE-2019-11545 - CVE-2019-11544 - CVE-2019-11548 - CVE-2019-11546 - CVE-2019-11547 - CVE-2019-11549 - - - 2019-04-29 - 2019-04-29 - - - - - buildbot -- CRLF injection in Buildbot login and logout redirect code - - - py27-buildbot - py35-buildbot - py36-buildbot - py37-buildbot - 1.8.0 - - - - -
-

A CRLF can be injected in Location header of /auth/login and /auth/logout - This is due to lack of input validation in the buildbot redirection code. -

-

It was not found a way to impact Buildbot product own security through - this vulnerability, but it could be used to compromise other sites - hosted on the same domain as Buildbot. - - - cookie injection a master domain (ie if your buildbot is on - buildbot.buildbot.net, one can inject a cookie on *.buildbot.net, - which could impact another website hosted in your domain) - - - HTTP response splitting and cache poisoning (browser or proxy) are - also typical impact of this vulnerability class, but might be impractical - to exploit. -

-
- - - - https://github.com/buildbot/buildbot/wiki/CRLF-injection-in-Buildbot-login-and-logout-redirect-code - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7313 - CVE-2019-7313 - - - 2019-01-29 - 2019-04-26 - - - - - drupal -- Drupal core - Moderately critical - - - drupal7 - 7.66 - - - drupal8 - 8.6.15 - - - - -

Drupal Security Team reports:

-
-

CVE-2019-10909: Escape validation messages in the PHP templating engine.

-

CVE-2019-10910: Check service IDs are valid.

-

CVE-2019-10911: Add a separator in the remember me cookie hash.

-
-
-

jQuery 3.4.0 includes a fix for some unintended behavior when using - jQuery.extend(true, {}, ...). If an unsanitized source object contained - an enumerable __proto__ property, it could extend the native Object.prototype. - This fix is included in jQuery 3.4.0, but patch diffs exist to patch previous - jQuery versions.

- -

It's possible that this vulnerability is exploitable with some Drupal modules. - As a precaution, this Drupal security release backports the fix to jQuery.extend(), - without making any other changes to the jQuery version that is included in - Drupal core (3.2.1 for Drupal 8 and 1.4.4 for Drupal 7) or running on the site - via some other module such as jQuery Update.

-
- - - - https://www.drupal.org/SA-CORE-2019-005 - https://www.drupal.org/SA-CORE-2019-006 - - - 2019-04-17 - 2019-04-25 - - - - - py-yaml -- arbitrary code execution - - - py27-yaml - py35-yaml - py36-yaml - py37-yaml - 4.1 - - - - -

pyyaml reports:

-
-

the PyYAML.load function could be easily exploited to call any Python - function. That means it could call any system command using os.system()

-
- - - - CVE-2017-18342 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18342 - https://github.com/yaml/pyyaml/pull/74 - - - 2018-06-27 - 2019-04-23 - - - - - FreeBSD -- EAP-pwd message reassembly issue with unexpected fragment - - - FreeBSD - 12.012.0_3 - 11.211.2_9 - - - wpa_supplicant - 2.8 - - - hostapd - 2.8 - - - - -

Problem Description:

-

EAP-pwd implementation in hostapd (EAP server) and wpa_supplicant - (EAP peer) does not to validate fragmentation reassembly state - properly for a case where an unexpected fragment could be received. - This could result in process termination due to NULL pointer - dereference.

-

See - https://w1.fi/security/2019-5/eap-pwd-message-reassembly-issue-with-unexpected-fragment.txt - for a detailed description of the bug.

-

Impact:

-

All wpa_supplicant and hostapd versions with EAP-pwd support could - suffer a denial of service attack through process termination.

- - - - https://w1.fi/security/2019-5/eap-pwd-message-reassembly-issue-with-unexpected-fragment.txt - - - 2019-04-18 - 2019-04-23 - - - - - FreeBSD -- EAP-pwd missing commit validation - - - FreeBSD - 12.012.0_3 - 11.211.2_9 - - - wpa_supplicant - 2.8 - - - hostapd - 2.8 - - - - -

Problem Description:

-

EAP-pwd implementation in hostapd (EAP server) and wpa_supplicant - (EAP peer) does not to validate the received scalar and element values - in EAP-pwd-Commit messages properly. This could result in attacks that - would be able to complete EAP-pwd authentication exchange without the - attacker having to know the used password.

-

See - https://w1.fi/security/2019-4/eap-pwd-missing-commit-validation.txt - for a detailed description of the bug.

-

Impact:

-

All wpa_supplicant and hostapd versions with EAP-pwd support.

- - - - CVE-2019-9497 - CVE-2019-9498 - CVE-2019-9499 - SA-19:03.wpa - - - 2019-04-10 - 2019-04-23 - 2019-07-30 - - - - - FreeBSD -- SAE confirm missing state validation - - - FreeBSD - 12.012.0_3 - 11.211.2_9 - - - wpa_supplicant - 2.8 - - - hostapd - 2.8 - - - - -

Problem Description:

-

When hostapd is used to operate an access point with SAE - (Simultaneous Authentication of Equals; also known as WPA3-Personal), - an invalid authentication sequence could result in the hostapd process - terminating due to a NULL pointer dereference when processing SAE - confirm message. This was caused by missing state validation steps - when processing the SAE confirm message in hostapd/AP mode.

-

See - https://w1.fi/security/2019-3/sae-confirm-missing-state-validation.txt - for a detailed description of the bug.

-

Impact:

-

All hostapd versions with SAE support (CONFIG_SAE=y in the build - configuration and SAE being enabled in the runtime configuration).

- - - - CVE-2019-9496 - - - 2019-04-10 - 2019-04-23 - - - - - FreeBSD -- EAP-pwd side-channel attack - - - FreeBSD - 12.012.0_3 - 11.211.2_9 - - - wpa_supplicant - 2.8 - - - hostapd - 2.8 - - - - -

Problem Description:

-

Potential side channel attacks in the SAE implementations used - by both hostapd and wpa_supplicant (see CVE-2019-9494 and VU#871675). - EAP-pwd uses a similar design for deriving PWE from the password and - while a specific attack against EAP-pwd is not yet known to be tested, - there is no reason to believe that the EAP-pwd implementation would - be immune against the type of cache attack that was identified for the - SAE implementation. Since the EAP-pwd implementation in hostapd (EAP - server) and wpa_supplicant (EAP peer) does not support MODP groups, - the timing attack described against SAE is not applicable for the - EAP-pwd implementation.

-

See - https://w1.fi/security/2019-2/eap-pwd-side-channel-attack.txt - for a detailed description of the bug.

-

Impact:

-

All wpa_supplicant and hostapd versions with EAP-pwd support - (CONFIG_EAP_PWD=y in the build configuration and EAP-pwd being enabled - in the runtime configuration).

- - - - CVE-2019-9495 - - - 2019-04-10 - 2019-04-23 - - - - - FreeBSD -- SAE side-channel attacks - - - FreeBSD - 12.012.0_3 - 11.211.2_9 - - - wpa_supplicant - 2.8 - - - hostapd - 2.8 - - - - -

Problem Description:

-

Side channel attacks in the SAE implementations used by both - hostapd (AP) and wpa_supplicant (infrastructure BSS station/mesh - station). SAE (Simultaneous Authentication of Equals) is also known - as WPA3-Personal. The discovered side channel attacks may be able to - leak information about the used password based on observable timing - differences and cache access patterns. This might result in full - password recovery when combined with an offline dictionary attack and - if the password is not strong enough to protect against dictionary - attacks.

-

See - https://w1.fi/security/2019-1/sae-side-channel-attacks.txt - for a detailed description of the bug.

-

Impact:

-

All wpa_supplicant and hostapd versions with SAE support - (CONFIG_SAE=y in the build configuration and SAE being enabled in - the runtime configuration).

- - - - CVE-2019-9494 - - - 2019-04-10 - 2019-04-23 - - - - - Istio -- Security vulnerabilities - - - istio - 1.1.2 - - - - -

Istio reports:

-
-

Two security vulnerabilities have recently been identified in the Envoy proxy. - The vulnerabilities are centered on the fact that Envoy did not normalize - HTTP URI paths and did not fully validate HTTP/1.1 header values. These - vulnerabilities impact Istio features that rely on Envoy to enforce any of - authorization, routing, or rate limiting.

-
- - - - CVE-2019-9900 - CVE-2019-9901 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9900 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9901 - https://github.com/envoyproxy/envoy/issues/6434 - https://github.com/envoyproxy/envoy/issues/6435 - - - 2019-03-29 - 2019-04-22 - - - - - Ghostscript -- Security bypass vulnerability - - - ghostscript9-agpl-base - ghostscript9-agpl-x11 - 9.27 - - - - -

Cedric Buissart (Red Hat) reports:

-
-

It was found that the superexec operator was available in the - internal dictionary in ghostscript before 9.27. A specially crafted - PostScript file could use this flaw in order to, for example, have - access to the file system outside of the constrains imposed by - -dSAFER.

-
-
-

It was found that the forceput operator could be extracted from - the DefineResource method in ghostscript before 9.27. A specially - crafted PostScript file could use this flaw in order to, for - example, have access to the file system outside of the constrains - imposed by -dSAFER.

-
- - - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3835 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3838 - CVE-2019-3835 - CVE-2019-3838 - - - 2019-03-21 - 2019-04-21 - - - - - GnuTLS -- double free, invalid pointer access - - - gnutls - 3.6.7 - - - - -

The GnuTLS project reports:

-
-
    -
  • Tavis Ormandy from Google Project Zero found a memory - corruption (double free) vulnerability in the certificate - verification API. Any client or server application that verifies - X.509 certificates with GnuTLS 3.5.8 or later is affected.
    • -
  • It was found using the TLS fuzzer tools that decoding a - malformed TLS1.3 asynchronous message can cause a server crash - via an invalid pointer access. The issue affects GnuTLS server - applications since 3.6.4.
    • -
-
- - - - https://www.gnutls.org/security-new.html#GNUTLS-SA-2019-03-27 - CVE-2019-3829 - CVE-2019-3836 - - - 2019-03-27 - 2019-04-19 - - - - - dovecot -- json encoder crash - - - dovecot - 2.3.02.3.5.2 - - - dovecot2 - 2.3.02.3.5.2 - - - - -

Aki Tuomi reports:

-
-

* CVE-2019-10691: Trying to login with 8bit username containing - invalid UTF8 input causes auth process to crash if auth policy is - enabled. This could be used rather easily to cause a DoS. Similar - crash also happens during mail delivery when using invalid UTF8 in - From or Subject header when OX push notification driver is used.

-
- - - - https://dovecot.org/pipermail/dovecot-news/2019-April/000407.html - CVE-2019-10691 - - - 2019-04-09 - 2019-04-18 - 2019-05-26 - - - - - libssh2 -- multiple issues - - - libssh2 - 1.8.1,3 - - - linux-c6-libssh2 - 1.4.2_7 - - - linux-c7-libssh2 - 1.4.3_3 - - - - -

libssh2 developers report:

-
-
    -
  • Defend against possible integer overflows in comp_method_zlib_decomp.
    • -
  • Defend against writing beyond the end of the payload in _libssh2_transport_read().
    • -
  • Sanitize padding_length - _libssh2_transport_read().
    • -
  • This prevents an underflow resulting in a potential out-of-bounds read if a server sends a too-large padding_length, possibly with malicious intent.
    • -
  • Prevent zero-byte allocation in sftp_packet_read() which could lead to an out-of-bounds read.
    • -
  • Check the length of data passed to sftp_packet_add() to prevent out-of-bounds reads.
    • -
  • Add a required_size parameter to sftp_packet_require et. al. to require callers of these functions to handle packets that are too short.
    • -
  • Additional length checks to prevent out-of-bounds reads and writes in _libssh2_packet_add().
    • -
-
- - - - https://github.com/libssh2/libssh2/releases/tag/libssh2-1.8.1 - https://libssh2.org/CVE-2019-3855.html - https://libssh2.org/CVE-2019-3856.html - https://libssh2.org/CVE-2019-3857.html - https://libssh2.org/CVE-2019-3858.html - https://libssh2.org/CVE-2019-3859.html - https://libssh2.org/CVE-2019-3860.html - https://libssh2.org/CVE-2019-3861.html - https://libssh2.org/CVE-2019-3862.html - https://libssh2.org/CVE-2019-3863.html - CVE-2019-3855 - CVE-2019-3856 - CVE-2019-3857 - CVE-2019-3858 - CVE-2019-3859 - CVE-2019-3860 - CVE-2019-3861 - CVE-2019-3862 - CVE-2019-3863 - - - 2019-03-14 - 2019-04-18 - 2019-07-07 - - - - - gitea -- remote code execution - - - gitea - 1.7.5 - - - - -

The Gitea team reports:

-
-

Prevent remote code execution vulnerability with mirror repo URL settings.

-
- - - - https://blog.gitea.io/2019/04/gitea-1.7.6-is-released/ - - - 2019-04-13 - 2019-04-17 - - - - - MySQL -- multiple vulnerabilities - - - mariadb55-server - 5.5.64 - - - mariadb101-server - 10.1.39 - - - mariadb102-server - 10.2.23 - - - mariadb103-server - 10.3.14 - - - mysql56-server - 5.6.44 - - - mysql57-server - 5.7.26 - - - mysql80-server - 8.0.15 - - - percona55-server - 5.5.64 - - - percona56-server - 5.6.44 - - - percona57-server - 5.7.26 - - - - -

Oracle reports:

-
-

Critical Patch Update Oracle MySQL Executive Summary

-

This Critical Patch Update contains 44 new security fixes for - Oracle MySQL. 3 of these vulnerabilities may be remotely exploitable - without authentication, i.e., may be exploited over a network without - requiring user credentials.

-

The Oracle MySQL products and versions affected by vulnerabilities - that are fixed in this Critical Patch Update are: MySQL Server, versions - 5.6.43 and prior, 5.7.25 and prior, 8.0.15 and prior

-

Further details will be published by Oracle on 2019-04-16

-
- - - - https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html - - - 2019-04-13 - 2019-04-13 - - - - - wget -- security flaw in caching credentials passed as a part of the URL - - - wget - 1.191.20.1 - - - - -

Gynvael Coldwind reports:

-
-

- set_file_metadata in xattr.c in GNU Wget before 1.20.1 stores a - file's origin URL in the user.xdg.origin.url metadata attribute - of the extended attributes of the downloaded file, which allows - local users to obtain sensitive information (e.g., credentials - contained in the URL) by reading this attribute, as demonstrated - by getfattr. This also applies to Referer information in the - user.xdg.referrer.url metadata attribute. -

-
- - - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20483 - CVE-2018-20483 - - - 2018-12-25 - 2019-04-12 - - - - - Gitlab -- Group Runner Registration Token Exposure - - - gitlab-ce - 11.9.011.9.7 - 11.8.011.8.7 - 10.4.011.7.11 - - - - -

Gitlab reports:

-
-

Group Runner Registration Token Exposure

-
- - - - https://about.gitlab.com/2019/04/10/critical-security-release-gitlab-11-dot-9-dot-7-released/ - CVE-2019-11000 - - - 2019-04-10 - 2019-04-11 - - - - - jenkins -- multiple vulnerabilities - - - jenkins - 2.172 - - - jenkins-lts - 2.164.2 - - - - -

Jenkins Security Advisory:

-
-

Description

-
(Medium) SECURITY-1289
-

Jenkins accepted cached legacy CLI authentication

-
(Medium) SECURITY-1327
-

XSS vulnerability in form validation button

-
- - - - https://jenkins.io/security/advisory/2019-04-10/ - - - 2019-04-10 - 2019-04-10 - - - - - Flash Player -- multiple vulnerabilities - - - linux-flashplayer - 32.0.0.171 - - - - -

Adobe reports:

-
-
    -
  • This update resolves a use-after-free vulnerability that - could lead to arbitrary code execution (CVE-2019-7096).
    • -
  • This update resolves an out-of-bounds read vulnerability that - could lead to information disclosure (CVE-2019-7108).
    • -
-
- - - - CVE-2019-7096 - CVE-2019-7108 - https://helpx.adobe.com/security/products/flash-player/apsb19-19.html - - - 2019-04-09 - 2019-04-10 - - - - - clamav -- multiple vulnerabilities - - - clamav - 0.101.2,1 - - - - -

Clamav reports:

-
-

An out-of-bounds heap read condition may occur when scanning PDF documents

-

An out-of-bounds heap read condition may occur when scanning PE files

-

An out-of-bounds heap write condition may occur when scanning OLE2 files

-

An out-of-bounds heap read condition may occur when scanning malformed PDF documents

-

A path-traversal write condition may occur as a result of improper input validation when scanning RAR archives

-

A use-after-free condition may occur as a result of improper error handling when scanning nested RAR archives

-
- - - - https://blog.clamav.net/2019/03/clamav-01012-and-01003-patches-have.html - CVE-2019-1787 - CVE-2019-1789 - CVE-2019-1788 - CVE-2019-1786 - CVE-2019-1785 - CVE-2019-1798 - - - 2019-03-29 - 2019-04-05 - - - - - Gitlab -- Multiple vulnerabilities - - - gitlab-ce - 11.9.011.9.4 - 11.8.011.8.6 - 11.7.10 - - - - -

Gitlab reports:

-
-

DoS potential for regex in CI/CD refs

-

Related branches visible in issues for guests

-

Persistent XSS at merge request resolve conflicts

-

Improper authorization control "move issue"

-

Guest users of private projects have access to releases

-

DoS potential on project languages page

-

Recurity assessment: information exposure through timing discrepancy

-

Recurity assessment: loginState HMAC issues

-

Recurity assessment: open redirect

-

PDF.js vulnerable to CVE-2018-5158

-

IDOR labels of private projects/groups

-

EXIF geolocation data not stripped from uploaded images

-
- - - - https://about.gitlab.com/2019/04/01/security-release-gitlab-11-dot-9-dot-4-released/ - CVE-2019-10640 - CVE-2019-10116 - CVE-2019-10111 - CVE-2019-10110 - CVE-2019-10115 - CVE-2019-10113 - CVE-2019-10114 - CVE-2019-10112 - CVE-2019-10117 - CVE-2018-5158 - CVE-2019-10108 - CVE-2019-10109 - - - 2019-04-01 - 2019-04-02 - - - - - Apache -- Multiple vulnerabilities - - - apache24 - 2.4.39 - - - - -

The Apache httpd Project reports:

-
-

Apache HTTP Server privilege escalation from modules' scripts - (CVE-2019-0211) (important)

-

mod_auth_digest access control bypass (CVE-2019-0217) - (important)

-

mod_ssl access control bypass (CVE-2019-0215) (important)

-

mod_http2, possible crash on late upgrade (CVE-2019-0197) (low)

-

mod_http2, read-after-free on a string compare (CVE-2019-0196) - (low)

-

Apache httpd URL normalization inconsistincy (CVE-2019-0220) - (low)

-
- - - - https://www.apache.org/dist/httpd/CHANGES_2.4.39 - https://httpd.apache.org/security/vulnerabilities_24.html - CVE-2019-0211 - CVE-2019-0217 - CVE-2019-0215 - CVE-2019-0196 - CVE-2019-0220 - - - 2019-04-01 - 2019-04-02 - - - - - Kubectl -- Potential directory traversal - - - kubectl - 1.11.9 - 1.12.01.12.7 - 1.13.01.13.5 - - - - -

Kubernetes.io reports:

-
-

A security issue was discovered with the Kubernetes kubectl cp - command that could enable a directory traversal replacing or - deleting files on a user’s workstation.

-
- - - - CVE-2019-1002101 - https://nvd.nist.gov/vuln/detail/CVE-2019-1002101 - - - 2019-03-28 - 2019-04-01 - - - - - znc -- Denial of Service - - - znc - 1.7.3 - - - - -

Mitre reports:

-
-

ZNC before 1.7.3-rc1 allows an existing remote user to cause a Denial - of Service (crash) via invalid encoding.

-
- - - - CVE-2019-9917 - https://wiki.znc.in/ChangeLog/1.7.3 - - - 2019-03-21 - 2019-03-31 - - - - - Jupyter notebook -- open redirect vulnerability - - - py27-notebook - py35-notebook - py36-notebook - py37-notebook - 5.7.8 - - - - -

Jupyter blog:

-
-

Login pages tend to take a parameter for redirecting back to a page - after successful login, e.g. /login?next=/notebooks/mynotebook.ipynb, so - that you aren't disrupted too much if you try to visit a page, but have - to authenticate first. An Open Redirect Vulnerability is when a - malicious person crafts a link pointing to the login page of a trusted - site, but setting the "redirect after successful login" parameter to - send the user to their own site, instead of a page on the authenticated - site (the notebook or JupyterHub server), e.g. - /login?next=http://badwebsite.biz. This doesn't necessarily compromise - anything immediately, but it enables phishing if users don't notice - that the domain has changed, e.g. by showing a fake "re-enter your - password" page. Servers generally have to validate the redirect URL to - avoid this. Both JupyterHub and Notebook already do this, but the - validation didn't take into account all possible ways to redirect to - other sites, so some malicious URLs could still be crafted to redirect - away from the server (the above example does not work in any recent - version of either package). Only certain browsers (Chrome and Firefox, - not Safari) could be redirected from the JupyterHub login page, but all - browsers could be redirected away from a standalone notebook server.

-
- - - - https://blog.jupyter.org/open-redirect-vulnerability-in-jupyter-jupyterhub-adf43583f1e4 - https://github.com/jupyter/notebook/blob/master/docs/source/changelog.rst - CVE-2019-10255 - - - 2019-03-28 - 2019-03-29 - 2019-04-06 - - - - - dovecot -- Buffer overflow reading extension header - - - dovecot - 2.3.5.1 - - - - -

Aki Tuomi reports:

-
-

Vulnerability Details: -When reading FTS or POP3-UIDL header from dovecot index, the input -buffer size is not bound, and data is copied to target structure causing -stack overflow. - -Risk: -This can be used for local root privilege escalation or executing -arbitrary code in dovecot process context. This requires ability to -directly modify dovecot indexes. -Steps to reproduce: -Produce dovecot.index.log entry that creates an FTS header which has -more than 12 bytes of data. -Trigger dovecot indexer-worker or run doveadm index. -Dovecot will crash. - -Mitigations: -Since 2.3.0 dovecot has been compiled with stack smash protection, ASLR, -read-only GOT tables and other techniques that make exploiting this bug -much harder.

-
- - - - http://cve.mitre.org/cgi-bin/cvename.cgi?name=2019-7524 - https://dovecot.org/list/dovecot-news/2019-March/000401.html - CVE-2019-7524 - - - 2019-02-05 - 2019-03-28 - - - - - drupal -- Drupal core - Moderately critical - Cross Site Scripting - - - drupal7 - 7.65 - - - drupal8 - 8.6.13 - - - - -

Drupal Security Team reports:

-
-

Under certain circumstances the File module/subsystem allows a malicious - user to upload a file that can trigger a cross-site scripting (XSS) vulnerability.

-
- - - - https://www.drupal.org/project/drupal/releases/8.6.13 - https://www.drupal.org/project/drupal/releases/7.65 - https://www.drupal.org/SA-CORE-2019-004 - CVE-2019-6341 - - - 2019-03-20 - 2019-03-27 - 2019-03-28 - - - - - Python -- NULL pointer dereference vulnerability - - - python27 - 2.7.16 - - - python35 - 3.5.7 - - - python36 - 3.6.8_1 - - - python37 - 3.7.3 - - - - -

Python Changelog:

-
-

bpo-35746: [CVE-2019-5010] Fix a NULL pointer deref in ssl module. The - cert parser did not handle CRL distribution points with empty DP or URI - correctly. A malicious or buggy certificate can result into segfault. - Vulnerability (TALOS-2018-0758) reported by Colin Read and Nicolas Edet - of Cisco.

-
- - - - https://docs.python.org/3.7/whatsnew/changelog.html - https://bugs.python.org/issue35746 - CVE-2019-5010 - - - 2019-01-15 - 2019-03-26 - 2019-03-27 - - - - - wordpress -- multiple issues - - - wordpress - fr-wordpress - 5.1.1,1 - - - de-wordpress - zh_CN-wordpress - zh_TW-wordpress - ja-wordpress - ru-wordpress - 5.1.1 - - - - -

wordpress developers reports:

-
-

Hosts can now offer a button for their users to update PHP.

-

The recommended PHP version used by the Update PHP notice can now be filtered.

-
- - - - https://wordpress.org/news/2019/03/wordpress-5-1-1-security-and-maintenance-release/ - - - 2019-03-12 - 2019-03-21 - - - - - Gitlab -- Vulnerability - - - gitlab-ce - 11.8.011.8.3 - 11.7.7 - - - - -

Gitlab reports:

-
-

Project Runner Token Exposed Through Issues Quick Actions

-
- - - - https://about.gitlab.com/2019/03/20/critical-security-release-gitlab-11-dot-8-dot-3-released/ - CVE-2019-9866 - - - 2019-03-20 - 2019-03-21 - - - - - libXdmcp -- insufficient entropy generating session keys - - - libXdmcp - 1.1.3 - - - - -

The freedesktop and x.org project reports:

-
-

It was discovered that libXdmcp before 1.1.3 used weak - entropy to generate session keys on platforms without - arc4random_buf() but with getentropy(). On a multi-user system using - xdmcp, a local attacker could potentially use information available - from the process list to brute force the key, allowing them to - hijack other users' sessions.

-

Please note, that since FreeBSD provides arc4random_buf(), it is - unknown if FreeBSD is affected by this vulnerability

-
- - - - https://nvd.nist.gov/vuln/detail/CVE-2017-2625 - https://lists.x.org/archives/xorg-announce/2019-March/002974.html - CVE-2017-2625 - - - 2017-04-04 - 2019-03-21 - 2019-03-22 - - - - - Gitlab -- Vulnerability - - - gitlab-ce - 11.8.2 - - - - -

Gitlab reports:

-
-

Public project in a private group makes the group page publicly accessible

-
- - - - https://about.gitlab.com/2019/03/14/gitlab-11-8-2-released/ - CVE-2019-9732 - - - 2019-03-14 - 2019-03-20 - - - - - gitea -- XSS vulnerability - - - gitea - 1.7.4 - - - - -

Gitea Team reports:

-
-

Fix potential XSS vulnerability in repository description.

-
- - - - https://blog.gitea.io/2019/03/gitea-1.7.4-is-released/ - - - 2019-03-12 - 2019-03-20 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 66.0_3,1 - - - waterfox - 56.2.9 - - - seamonkey - linux-seamonkey - 2.53.0 - - - firefox-esr - 60.6.0,1 - - - linux-firefox - 60.6.0,2 - - - libxul - thunderbird - linux-thunderbird - 60.6.0 - - - - -

Mozilla Foundation reports:

-
-

CVE-2019-9790: Use-after-free when removing in-use DOM elements

-

CVE-2019-9791: Type inference is incorrect for constructors entered through on-stack replacement with IonMonkey

-

CVE-2019-9792: IonMonkey leaks JS_OPTIMIZED_OUT magic value to script

-

CVE-2019-9793: Improper bounds checks when Spectre mitigations are disabled

-

CVE-2019-9794: Command line arguments not discarded during execution

-

CVE-2019-9795: Type-confusion in IonMonkey JIT compiler

-

CVE-2019-9796: Use-after-free with SMIL animation controller

-

CVE-2019-9797: Cross-origin theft of images with createImageBitmap

-

CVE-2019-9798: Library is loaded from world writable APITRACE_LIB location

-

CVE-2019-9799: Information disclosure via IPC channel messages

-

CVE-2019-9801: Windows programs that are not 'URL Handlers' are exposed to web content

-

CVE-2019-9802: Chrome process information leak

-

CVE-2019-9803: Upgrade-Insecure-Requests incorrectly enforced for same-origin navigation

-

CVE-2019-9804: Code execution through 'Copy as cURL' in Firefox Developer Tools on macOS

-

CVE-2019-9805: Potential use of uninitialized memory in Prio

-

CVE-2019-9806: Denial of service through successive FTP authorization prompts

-

CVE-2019-9807: Text sent through FTP connection can be incorporated into alert messages

-

CVE-2019-9809: Denial of service through FTP modal alert error messages

-

CVE-2019-9808: WebRTC permissions can display incorrect origin with data: and blob: URLs

-

CVE-2019-9789: Memory safety bugs fixed in Firefox 66

-

CVE-2019-9788: Memory safety bugs fixed in Firefox 66 and Firefox ESR 60.6

-
- - - - CVE-2019-9788 - CVE-2019-9789 - CVE-2019-9790 - CVE-2019-9791 - CVE-2019-9792 - CVE-2019-9793 - CVE-2019-9794 - CVE-2019-9795 - CVE-2019-9796 - CVE-2019-9797 - CVE-2019-9798 - CVE-2019-9799 - CVE-2019-9801 - CVE-2019-9802 - CVE-2019-9803 - CVE-2019-9804 - CVE-2019-9805 - CVE-2019-9806 - CVE-2019-9807 - CVE-2019-9808 - CVE-2019-9809 - https://www.mozilla.org/security/advisories/mfsa2019-07/ - https://www.mozilla.org/security/advisories/mfsa2019-08/ - - - 2019-03-19 - 2019-03-19 - 2019-07-23 - - - - - PowerDNS -- Insufficient validation in the HTTP remote backend - - - powerdns - 4.1.7 - - - - -

PowerDNS developers report:

-
-

An issue has been found in PowerDNS Authoritative Server when the HTTP remote backend is used in RESTful mode (without post=1 set), allowing a remote user to cause the HTTP backend to connect to an attacker-specified host instead of the configured one, via a crafted DNS query. This can be used to cause a denial of service by preventing the remote backend from getting a response, content spoofing if the attacker can time its own query so that subsequent queries will use an attacker-controlled HTTP server instead of the configured one, and possibly information disclosure if the Authoritative Server has access to internal servers.

-
- - - - https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2019-03.html - CVE-2019-3871 - - - 2019-03-18 - 2019-03-19 - - - - - Rails -- Action View vulnerabilities - - - rubygem-actionview4 - 4.2.11.1 - - - rubygem-actionview50 - 5.0.7.2 - - - rubygem-actionview5 - 5.1.6.2 - - - - -

Ruby on Rails blog:

-
-

Rails 4.2.11.1, 5.0.7.2, 5.1.6.2, 5.2.2.1, and 6.0.0.beta3 have been released! These contain the following important security fixes. It is recommended that users upgrade as soon as possible:

-

CVE-2019-5418 File Content Disclosure in Action View

-

CVE-2019-5419 Denial of Service Vulnerability in Action View

-
- - - - https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/ - CVE-2019-5418 - CVE-2019-5419 - - - 2019-03-13 - 2019-03-18 - - - - - PuTTY -- security fixes in new release - - - putty - 0.71 - - - putty-gtk2 - 0.71 - - - putty-nogtk - 0.71 - - - - -

The PuTTY team reports:

-
-

New in 0.71:

-
    -
  • Security fixes found by an EU-funded bug bounty programme:
    • -
  • + a remotely triggerable memory overwrite in RSA key exchange, which can occur before host key verification
    • -
  • + potential recycling of random numbers used in cryptography
    • -
  • + on Unix, remotely triggerable buffer overflow in any kind of server-to-client forwarding
    • -
  • + multiple denial-of-service attacks that can be triggered by writing to the terminal
    • -
  • Other security enhancements: major rewrite of the crypto code to remove cache and timing side channels.
    • -
  • User interface changes to protect against fake authentication prompts from a malicious server.
    • -
-
- - - - https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html - - - 2019-03-16 - 2019-03-17 - - - - - Jupyter notebook -- cross-site inclusion (XSSI) vulnerability - - - py27-notebook - py35-notebook - py36-notebook - py37-notebook - 5.7.6 - - - - -

Jupyter notebook Changelog:

-
-

5.7.6 contains a security fix for a cross-site inclusion (XSSI) - vulnerability, where files at a known URL could be included in a page - from an unauthorized website if the user is logged into a Jupyter - server. The fix involves setting the X-Content-Type-Options: nosniff - header, and applying CSRF checks previously on all non-GET API requests - to GET requests to API endpoints and the /files/ endpoint.

-

The attacking page is able to access some contents of files when using - Internet Explorer through script errors, but this has not been - demonstrated with other browsers. A CVE has been requested for this - vulnerability.

-
- - - - https://github.com/jupyter/notebook/blob/master/docs/source/changelog.rst - https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-auth-prompt-spoofing.html - https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-fd-set-overflow.html - https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-rng-reuse.html - https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-rsa-kex-integer-overflow.html - https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-terminal-dos-combining-chars.html - https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-terminal-dos-combining-chars-double-width-gtk.html - https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-terminal-dos-one-column-cjk.html - https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/pscp-unsanitised-server-output.html - https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/side-channels.html - - - 2019-03-10 - 2019-03-16 - - - - - RubyGems -- multiple vulnerabilities - - - ruby23-gems - ruby24-gems - ruby25-gems - 3.0.2 - - - - -

RubyGems Security Advisories:

-
-

CVE-2019-8320: Delete directory using symlink when decompressing tar

-

CVE-2019-8321: Escape sequence injection vulnerability in 'verbose'

-

CVE-2019-8322: Escape sequence injection vulnerability in 'gem owner'

-

CVE-2019-8323: Escape sequence injection vulnerability in API response handling

-

CVE-2019-8324: Installing a malicious gem may lead to arbitrary code execution

-

CVE-2019-8325: Escape sequence injection vulnerability in errors

-
- - - - https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html - https://github.com/rubygems/rubygems/blob/master/History.txt - CVE-2019-8320 - CVE-2019-8321 - CVE-2019-8322 - CVE-2019-8323 - CVE-2019-8324 - CVE-2019-8325 - - - 2019-03-05 - 2019-03-15 - - - - - OpenSSL -- ChaCha20-Poly1305 nonce vulnerability - - - openssl111 - 1.1.1b_1 - - - - -

The OpenSSL project reports:

-
-

Low: ChaCha20-Poly1305 with long nonces (CVE-2019-1543)

-

ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce - input for every encryption operation. RFC 7539 specifies that the nonce - value (IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce - length and front pads the nonce with 0 bytes if it is less than 12 bytes. - However it also incorrectly allows a nonce to be set of up to 16 bytes. - In this case only the last 12 bytes are significant and any additional - leading bytes are ignored.

-
- - - - https://www.openssl.org/news/secadv/20190306.txt - CVE-2019-1543 - - - 2019-03-06 - 2019-03-07 - - - - - ntp -- Crafted null dereference attack from a trusted source with an authenticated mode 6 packet - - - ntp - 4.2.8p13 - - - FreeBSD - 12.012.0_2 - 11.211.2_8 - - - - -

Network Time Foundation reports:

-
-

A crafted malicious authenticated mode 6 (ntpq) packet from a - permitted network address can trigger a NULL pointer dereference, - crashing ntpd.

-

Note that for this attack to work, the sending - system must be on an address that the target's ntpd accepts mode 6 - packets from, and must use a private key that is specifically - listed as being used for mode 6 authorization.

-

Impact: The ntpd daemon can crash due to the NULL pointer - dereference, causing a denial of service.

-

Mitigation:

-
    -
  • Use restrict noquery to limit addresses that can send mode 6 - queries.
    • -
  • Limit access to the private controlkey in ntp.keys.
    • -
  • Upgrade to 4.2.8p13, or later.
    • -
-
- - - - http://bugs.ntp.org/3565 - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-8936 - https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?vector=(AV:N/AC:H/Au:M/C:N/I:N/A:C) - https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H - CVE-2019-8936 - SA-19:04.ntp - - - 2019-01-15 - 2019-03-07 - 2019-07-30 - - - - - rssh - multiple vulnerabilities - - - rssh - 2.3.4_2 - - - - -

NVD reports:

-
-

rssh version 2.3.4 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in allowscp permission that can result in Local command execution. This attack appear to be exploitable via An authorized SSH user with the allowscp permission.

-

Insufficient sanitization of arguments passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users to perform only rsync operations, resulting in the execution of arbitrary shell commands.

-
- - - - https://nvd.nist.gov/vuln/search/results?form_type=Advanced&cves=on&cpe_version=cpe%3a%2fa%3apizzashack%3arssh%3a2.3.4 - CVE-2019-1000018 - CVE-2019-3463 - CVE-2019-3464 - - - 2019-02-04 - 2019-03-06 - - - - - rt -- XSS via jQuery - - - rt42 - 4.2.04.2.16 - - - rt44 - 4.4.04.4.4 - - - - -

BestPractical reports:

-
- -

The version of jQuery used in RT 4.2 and 4.4 has a - Cross-site Scripting (XSS) vulnerability when using - cross-domain Ajax requests. This vulnerability is assigned - CVE-2015-9251. RT - does not use this jQuery feature so it is not directly - vulnerable. jQuery version 1.12 no longer receives official - updates, however a fix was posted with recommendations for - applications to patch locally, so RT will follow this - recommendation and ship with a patched version.

-
- - - - https://docs.bestpractical.com/release-notes/rt/4.4.4 - https://docs.bestpractical.com/release-notes/rt/4.2.16 - CVE-2015-9251 - - - 2019-03-05 - 2019-03-06 - - - - - slixmpp -- improper access control - - - py35-slixmpp - py36-slixmpp - py37-slixmpp - 1.4.2 - - - - -

NVD reports:

-
-

slixmpp version before commit 7cd73b594e8122dddf847953fcfc85ab4d316416 - contains an incorrect Access Control vulnerability in XEP-0223 plugin - (Persistent Storage of Private Data via PubSub) options profile, used - for the configuration of default access model that can result in - all of the contacts of the victim can see private data having been - published to a PEP node. This attack appears to be exploitable - if the user of this library publishes any private data on PEP, - the node isn't configured to be private. This vulnerability appears - to have been fixed in commit 7cd73b594e8122dddf847953fcfc85ab4d316416 - which is included in slixmpp 1.4.2.

-
- - - - https://nvd.nist.gov/vuln/detail/CVE-2019-1000021 - CVE-2019-1000021 - - - 2019-02-04 - 2019-03-05 - - - - - Gitlab -- Multiple vulnerabilities - - - gitlab-ce - 11.8.011.8.1 - 11.7.011.7.6 - 2.9.011.6.10 - - - - -

Gitlab reports:

-
-

Arbitrary file read via MergeRequestDiff

-

CSRF add Kubernetes cluster integration

-

Blind SSRF in prometheus integration

-

Merge request information disclosure

-

IDOR milestone name information disclosure

-

Burndown chart information disclosure

-

Private merge request titles in public project information disclosure

-

Private namespace disclosure in email notification when issue is moved

-

Milestone name disclosure

-

Issue board name disclosure

-

NPM automatic package referencer

-

Path traversal snippet mover

-

Information disclosure repo existence

-

Issue DoS via Mermaid

-

Privilege escalation impersonate user

-
- - - - https://about.gitlab.com/2019/03/04/security-release-gitlab-11-dot-8-dot-1-released/ - CVE-2019-9221 - CVE-2019-9176 - CVE-2019-9174 - CVE-2019-9172 - CVE-2019-9170 - CVE-2019-9175 - CVE-2019-9178 - CVE-2019-9179 - CVE-2019-9171 - CVE-2019-9224 - CVE-2019-9225 - CVE-2019-9219 - CVE-2019-9217 - CVE-2019-9222 - CVE-2019-9223 - CVE-2019-9220 - CVE-2019-9485 - - - 2019-03-04 - 2019-03-05 - - - - - py-gunicorn -- CWE-113 vulnerability - - - py27-gunicorn - py35-gunicorn - py36-gunicorn - py37-gunicorn - 19.5.0 - - - - -

Everardo reports:

-
-

gunicorn version 19.4.5 contains a CWE-113: Improper - Neutralization of CRLF Sequences in HTTP Headers vulnerability - in process_headers function in gunicorn/http/wsgi.py - that can result in an attacker causing the server to - return arbitrary HTTP headers.

-
- - - - CVE-2018-1000164 - https://epadillas.github.io/2018/04/02/http-header-splitting-in-gunicorn-19.4.5 - - - 2018-04-02 - 2019-03-05 - - - - - Node.js -- multiple vulnerabilities - - - node - 11.10.1 - - - node10 - 10.15.2 - - - node8 - 8.15.1 - - - node6 - 6.17.0 - - - - -

Node.js reports:

-
-

Updates are now available for all active Node.js release lines. In addition to fixes for security flaws in Node.js, they also include upgrades of Node.js 6 and 8 to OpenSSL 1.0.2r which contains a fix for a moderate severity security vulnerability.

-

For these releases, we have decided to withhold the fix for the Misinterpretation of Input (CWE-115) flaw mentioned in the original announcement. This flaw is very low severity and we are not satisfied that we had a complete and stable fix ready for release. We will be seeking to address this flaw via alternate mechanisms in the near future. In addition, we have introduced an additional CVE for a change in Node.js 6 that we have decided to classify as a Denial of Service (CWE-400) flaw.

-

We recommend that all Node.js users upgrade to a version listed below as soon as possible.

-

OpenSSL: 0-byte record padding oracle (CVE-2019-1559)

-

OpenSSL 1.0.2r contains a fix for CVE-2019-1559 and is included in the releases for Node.js versions 6 and 8 only. Node.js 10 and 11 are not impacted by this vulnerability as they use newer versions of OpenSSL which do not contain the flaw.

-

Under certain circumstances, a TLS server can be forced to respond differently to a client if a zero-byte record is received with an invalid padding compared to a zero-byte record with an invalid MAC. This can be used as the basis of a padding oracle attack to decrypt data.

-

Only TLS connections using certain ciphersuites executing under certain conditions are exploitable. We are currently unable to determine whether the use of OpenSSL in Node.js exposes this vulnerability. We are taking a cautionary approach and recommend the same for users. For more information, see the advisory and a detailed write-up by the reporters of the vulnerability.

-
- - - - https://nodejs.org/en/blog/vulnerability/february-2019-security-releases/ - CVE-2019-5737 - CVE-2019-5739 - CVE-2019-1559 - - - 2019-02-28 - 2019-03-03 - - - - - mybb -- vulnerabilities - - - mybb - 1.8.20_1 - - - - -

mybb Team reports:

-
-

Medium risk: Reset Password reflected XSS

-

Medium risk: ModCP Profile Editor username reflected XSS

-

Low risk: Predictable CSRF token for guest users

-

Low risk: ACP Stylesheet Properties XSS

-

Low risk: Reset Password username enumeration via email

-
- - - - https://blog.mybb.com/2019/02/27/mybb-1-8-20-released-security-maintenance-release/ - - - 2019-02-27 - 2019-03-02 - 2019-03-04 - - - - - asterisk -- Remote crash vulnerability with SDP protocol violation - - - asterisk15 - 15.7.2 - - - asterisk16 - 16.2.1 - - - - -

The Asterisk project reports:

-
-

When Asterisk makes an outgoing call, a very specific - SDP protocol violation by the remote party can cause - Asterisk to crash.

-
- - - - https://downloads.asterisk.org/pub/security/AST-2019-001.html - CVE-2019-7251 - - - 2019-01-24 - 2019-03-01 - - - - - webkit-gtk -- Multiple vulnabilities - - - webkit2-gtk3 - 2.22.6 - - - webkit-gtk2 - webkit-gtk3 - 0 - - - - -

The Webkitgtk project reports:

-
-

CVE-2019-6212 - Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.

-

CVE-2019-6215 - Processing maliciously crafted web content may lead to arbitrary code execution. A type confusion issue was addressed with improved memory handling.

-

CVE-2019-6216 - Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.

-

CVE-2019-6217 - Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.

-

CVE-2019-6226 - Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.

-

CVE-2019-6227 - Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.

-

CVE-2019-6229 - Processing maliciously crafted web content may lead to universal cross site scripting. A logic issue was addressed with improved validation.

-

CVE-2019-6233 - Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.

-

CVE-2019-6234 - Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.

-
- - - - https://webkitgtk.org/security/WSA-2019-0001.html - CVE-2019-6212 - CVE-2019-6215 - CVE-2019-6216 - CVE-2019-6217 - CVE-2019-6226 - CVE-2019-6227 - CVE-2019-6229 - CVE-2019-6233 - CVE-2019-6234 - - - 2019-02-08 - 2019-02-24 - - - - - rdesktop - critical - Remote Code Execution - - - rdesktop - 1.8.4 - - - - -
-
    -
  • Fix memory corruption in process_bitmap_data - CVE-2018-8794 -
    • -
  • Fix remote code execution in process_bitmap_data - CVE-2018-8795 -
    • -
  • Fix remote code execution in process_plane - CVE-2018-8797 -
    • -
  • Fix Denial of Service in mcs_recv_connect_response - CVE-2018-20175 -
    • -
  • Fix Denial of Service in mcs_parse_domain_params - CVE-2018-20175 -
    • -
  • Fix Denial of Service in sec_parse_crypt_info - CVE-2018-20176 -
    • -
  • Fix Denial of Service in sec_recv - CVE-2018-20176 -
    • -
  • Fix minor information leak in rdpdr_process - CVE-2018-8791 -
    • -
  • Fix Denial of Service in cssp_read_tsrequest - CVE-2018-8792 -
    • -
  • Fix remote code execution in cssp_read_tsrequest - CVE-2018-8793 -
    • -
  • Fix Denial of Service in process_bitmap_data - CVE-2018-8796 -
    • -
  • Fix minor information leak in rdpsnd_process_ping - CVE-2018-8798 -
    • -
  • Fix Denial of Service in process_secondary_order - CVE-2018-8799 -
    • -
  • Fix remote code execution in in ui_clip_handle_data - CVE-2018-8800 -
    • -
  • Fix major information leak in ui_clip_handle_data - CVE-2018-20174 -
    • -
  • Fix memory corruption in rdp_in_unistr - CVE-2018-20177 -
    • -
  • Fix Denial of Service in process_demand_active - CVE-2018-20178 -
    • -
  • Fix remote code execution in lspci_process - CVE-2018-20179 -
    • -
  • Fix remote code execution in rdpsnddbg_process - CVE-2018-20180 -
    • -
  • Fix remote code execution in seamless_process - CVE-2018-20181 -
    • -
  • Fix remote code execution in seamless_process_line - CVE-2018-20182 -
    • -
-
- - - - https://github.com/rdesktop/rdesktop/releases/tag/v1.8.4 - CVE-2018-20175 - CVE-2018-20176 - CVE-2018-8791 - CVE-2018-8792 - CVE-2018-8793 - CVE-2018-8794 - CVE-2018-8795 - CVE-2018-8796 - CVE-2018-8797 - CVE-2018-8798 - CVE-2018-8799 - CVE-2018-8800 - CVE-2018-20174 - CVE-2018-20177 - CVE-2018-20178 - CVE-2018-20179 - CVE-2018-20180 - CVE-2018-20181 - CVE-2018-20182 - - - 2019-01-02 - 2019-02-22 - - - - - drupal -- Drupal core - Highly critical - Remote Code Execution - - - drupal8 - 8.6.10 - - - - -

Drupal Security Team

-
-

Some field types do not properly sanitize data from non-form sources. - This can lead to arbitrary PHP code execution in some cases..

-
- - - - https://www.drupal.org/sa-core-2019-002 - CVE-2019-6340 - - - 2019-02-20 - 2019-02-21 - - - - - OpenSSL -- Padding oracle vulnerability - - - openssl - 1.0.2r,1 - - - linux-c6-openssl - 1.0.1e_16 - - - - -

The OpenSSL project reports:

-
-

0-byte record padding oracle (CVE-2019-1559) (Moderate)
- If an application encounters a fatal protocol error and then calls - SSL_shutdown() twice (once to send a close_notify, and once to receive - one) then OpenSSL can respond differently to the calling application if - a 0 byte record is received with invalid padding compared to if a 0 byte - record is received with an invalid MAC. If the application then behaves - differently based on that in a way that is detectable to the remote peer, - then this amounts to a padding oracle that could be used to decrypt data. -

-
- - - - https://www.openssl.org/news/secadv/20190226.txt - CVE-2019-1559 - - - 2019-02-19 - 2019-02-20 - 2019-03-07 - - - - - msmtp -- certificate-verification issue - - - msmtp - 1.8.11.8.3 - - - - -

msmtp developers report:

-
-

In msmtp 1.8.2, when tls_trust_file has its default configuration, - certificate-verification results are not properly checked.

-
- - - - https://marlam.de/msmtp/news/msmtp-1-8-3/ - CVE-2019-8337 - - - 2019-02-11 - 2019-02-15 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 65.0.1,1 - - - firefox-esr - 60.5.1,1 - - - thunderbird - 60.5.1 - - - - -

Mozilla Foundation reports:

-
-

CVE-2018-18356: Use-after-free in Skia

-

CVE-2019-5785: Integer overflow in Skia

-

CVE-2018-18511: Cross-origin theft of images with ImageBitmapRenderingContext

-
- - - - CVE-2018-18511 - CVE-2018-18356 - CVE-2019-5785 - https://www.mozilla.org/en-US/security/advisories/mfsa2019-04/ - https://www.mozilla.org/en-US/security/advisories/mfsa2019-05/ - - - 2019-02-13 - 2019-02-13 - - - - - Flash Player -- information disclosure - - - linux-flashplayer - 32.0.0.142 - - - - -

Adobe reports:

-
-
    -
  • This update resolves an out-of-bounds vulnerability that - could lead to information disclosure (CVE-2019-7090).
    • -
-
- - - - CVE-2019-7090 - https://helpx.adobe.com/security/products/flash-player/apsb19-06.html - - - 2019-02-12 - 2019-02-12 - - - - - OpenJPEG -- integer overflow - - - openjpeg - 2.3.0_4 - - - - -

NVD reports:

-
-

In OpenJPEG 2.3.0, there is an integer overflow vulnerability in the - opj_t1_encode_cblks function (openjp2/t1.c). Remote attackers could - leverage this vulnerability to cause a denial of service via a crafted - bmp file.

-
- - - - https://nvd.nist.gov/vuln/detail/CVE-2018-5727 - https://github.com/uclouvain/openjpeg/issues/1053 - CVE-2018-5727 - - - 2017-12-08 - 2019-02-11 - 2019-03-29 - - - - - FreeBSD -- File description reference count leak - - - FreeBSD-kernel - 12.012.0_3 - - - - -

Problem Description:

-

FreeBSD 12.0 attempts to handle the case where the - receiving process does not provide a sufficiently large - buffer for an incoming control message containing rights. - In particular, to avoid leaking the corresponding descriptors - into the receiving process' descriptor table, the kernel - handles the truncation case by closing descriptors referenced - by the discarded message.

-

The code which performs this operation failed to release - a reference obtained on the file corresponding to a received - right. This bug can be used to cause the reference counter - to wrap around and free the file structure.

-

Impact:

-

A local user can exploit the bug to gain root privileges - or escape from a jail.

- - - - CVE-2019-5596 - SA-19:02.fd - - - 2019-02-05 - 2019-02-11 - - - - - FreeBSD -- System call kernel data register leak - - - FreeBSD-kernel - 12.012.0_3 - 11.211.2_9 - - - - -

Problem Description:

-

The callee-save registers are used by kernel and for - some of them (%r8, %r10, and for non-PTI configurations, - %r9) the content is not sanitized before return from syscalls, - potentially leaking sensitive information.

-

Impact:

-

Typically an address of some kernel data structure used - in the syscall implementation, is exposed.

- - - - CVE-2019-5595 - SA-19:01.syscall - - - 2019-02-05 - 2019-02-11 - - - - - kf5-kauth -- Insecure handling of arguments in helpers - - - kf5-kauth - 5.54.0_2 - - - - -

Albert Astals Cid reports:

-
-

KAuth allows to pass parameters with arbitrary types to helpers running as root over DBus.

-

Certain types can cause crashes and trigger decoding arbitrary images with dynamically loaded plugin

-
- - - - https://www.kde.org/info/security/advisory-20190209-1.txt - CVE-2019-7443 - - - 2019-02-09 - 2019-02-10 - - - - - unit -- heap memory buffer overflow - - - unit - 0.3.01.7.1 - - - - -

unit security problems:

-
-

CVE-2019-7401: a head memory buffer overflow might have

-

been caused in the router process by a specially crafted

-

request, potentially resulting in a segmentation fault

-

or other unspecified behavior.

-
- - - - http://mailman.nginx.org/pipermail/unit/2019-February/000112.html - CVE-2019-7401 - - - 2019-02-07 - 2019-02-08 - - - - - curl -- multiple vulnerabilities - - - curl - 7.64.0 - - - - -

curl security problems:

-
-

CVE-2018-16890: NTLM type-2 out-of-bounds buffer read

-

libcurl contains a heap buffer out-of-bounds read flaw.

-

The function handling incoming NTLM type-2 messages - (lib/vauth/ntlm.c:ntlm_decode_type2_target) does not validate incoming - data correctly and is subject to an integer overflow vulnerability.

-

Using that overflow, a malicious or broken NTLM server could trick - libcurl to accept a bad length + offset combination that would lead to a - buffer read out-of-bounds.

-

CVE-2019-3822: NTLMv2 type-3 header stack buffer overflow

-

libcurl contains a stack based buffer overflow vulnerability.

-

The function creating an outgoing NTLM type-3 header - (lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()), generates the - request HTTP header contents based on previously received data. The - check that exists to prevent the local buffer from getting overflowed is - implemented wrongly (using unsigned math) and as such it does not - prevent the overflow from happening.

-

This output data can grow larger than the local buffer if very large - "nt response" data is extracted from a previous NTLMv2 header provided - by the malicious or broken HTTP server.

-

Such a "large value" needs to be around 1000 bytes or more. The actual - payload data copied to the target buffer comes from the NTLMv2 type-2 - response header.

-

CVE-2019-3823: SMTP end-of-response out-of-bounds read

-

libcurl contains a heap out-of-bounds read in the code handling the - end-of-response for SMTP.

-

If the buffer passed to smtp_endofresp() isn't NUL terminated and - contains no character ending the parsed number, and len is set to 5, - then the strtol() call reads beyond the allocated buffer. The read - contents will not be returned to the caller.

-
- - - - https://curl.haxx.se/docs/security.html - https://curl.haxx.se/docs/CVE-2018-16890.html - https://curl.haxx.se/docs/CVE-2019-3822.html - https://curl.haxx.se/docs/CVE-2019-3823.html - CVE-2018-16890 - CVE-2019-3822 - CVE-2019-3823 - - - 2019-02-07 - 2019-02-07 - - - - - Gitlab -- Multiple vulnerabilities - - - gitlab-ce - 11.7.011.7.4 - 11.6.011.6.9 - - - - -

Gitlab reports:

-
-

Leak of Confidential Issue and Merge Request Titles

-

Persistent XSS in User Status

-
- - - - https://about.gitlab.com/2019/02/05/critical-security-release-gitlab-11-dot-7-dot-4-released/ - CVE-2019-7353 - CVE-2019-6796 - - - 2019-02-05 - 2019-02-06 - - - - - mail/dovecot -- Suitable client certificate can be used to login as other user - - - dovecot - 2.3.4.1 - - - - -

Aki Tuomi (Open-Xchange Oy) reports:

-
-

Normally Dovecot is configured to authenticate -imap/pop3/managesieve/submission clients using regular username/password -combination. Some installations have also required clients to present a -trusted SSL certificate on top of that. It's also possible to configure -Dovecot to take the username from the certificate instead of from the -user provided authentication. It's also possible to avoid having a -password at all, only trusting the SSL certificate. - -If the provided trusted SSL certificate is missing the username field, -Dovecot should be failing the authentication. However, the earlier -versions will take the username from the user provided authentication -fields (e.g. LOGIN command). If there is no additional password -verification, this allows the attacker to login as anyone else in the -system. - -This affects only installations using: - -auth_ssl_require_client_cert = yes -auth_ssl_username_from_cert = yes - -Attacker must also have access to a valid trusted certificate without -the ssl_cert_username_field in it. The default is commonName, which -almost certainly exists in all certificates. This could happen for -example if ssl_cert_username_field is a field that normally doesn't -exist, and attacker has access to a web server's certificate (and key), -which is signed with the same CA. - -Attack can be migitated by having the certificates with proper Extended -Key Usage, such as 'TLS Web Server' and 'TLS Web Server Client'. - -Also, ssl_cert_username_field setting was ignored with external SMTP -AUTH, because none of the MTAs (Postfix, Exim) currently send the -cert_username field. This may have allowed users with trusted -certificate to specify any username in the authentication. This does not -apply to Dovecot Submission service.

-
- - - - https://www.mail-archive.com/dovecot@dovecot.org/msg76117.html - CVE-2019-3814 - - - 2019-01-16 - 2019-02-05 - - - - - typo3 -- multiple vulnerabilities - - - typo3-8-php71 - typo3-8-php72 - typo3-8-php73 - 8.7.24 - - - typo3-9-php71 - typo3-9-php72 - typo3-9-php73 - 9.5.4 - - - - -

Typo3 news:

-
-

Please read the corresponding Security Advisories for details.

-
- - - - https://typo3.org/article/typo3-954-and-8723-security-releases-published/ - https://typo3.org/article/typo3-v8724-lts-released/ - - - 2019-01-22 - 2019-02-02 - - - - - gitea -- multiple vulnerabilities - - - gitea - 1.7.1 - - - - -

Gitea Team reports:

-
-

Disable redirect for i18n

-

Only allow local login if password is non-empty

-

Fix go-get URL generation

-
- - - - https://github.com/go-gitea/gitea/releases/tag/v1.7.1 - - - 2019-01-31 - 2019-02-01 - - - - - p5-Email-Address-List -- DDoS related vulnerability - - - p5-Email-Address-List - 0.06 - - - - -

Best PRactical Solutions reports:

-
- 
- 0.06 2019-01-02
-
- - Changes to address CVE-2018-18898 which could allow DDoS-type attacks.
-   Thanks to Lukas Kramer for reporting the issue and Alex Vandiver for
-   contributing fixes.
-   - Fix pathological backtracking for unkown regex
-   - Fix pathological backtracking in obs-phrase(i.e. obs-display-name)
-   - Fix pathological backtracking in cfws, quoted strings
-
-
- - - - https://metacpan.org/source/BPS/Email-Address-List-0.06/Changes - CVE-2018-18898 - - - 2019-01-02 - 2019-01-31 - - - - - Gitlab -- Multiple vulnerabilities - - - gitlab-ce - 11.7.011.7.3 - 11.6.011.6.8 - 0.0.011.5.10 - - - - -

Gitlab reports:

-
-

Remote Command Execution via GitLab Pages

-

Covert Redirect to Steal GitHub/Bitbucket Tokens

-

Remote Mirror Branches Leaked by Git Transfer Refs

-

Denial of Service with Markdown

-

Guests Can View List of Group Merge Requests

-

Guest Can View Merge Request Titles via System Notes

-

Persistent XSS via KaTeX

-

Emails Sent to Unauthorized Users

-

Hyperlink Injection in Notification Emails

-

Unauthorized Access to LFS Objects

-

Trigger Token Exposure

-

Upgrade Rails to 5.0.7.1 and 4.2.11

-

Contributed Project Information Visible in Private Profile

-

Imported Project Retains Prior Visibility Setting

-

Error disclosure on Project Import

-

Persistent XSS in User Status

-

Last Commit Status Leaked to Guest Users

-

Mitigations for IDN Homograph and RTLO Attacks

-

Access to Internal Wiki When External Wiki Enabled

-

User Can Comment on Locked Project Issues

-

Unauthorized Reaction Emojis by Guest Users

-

User Retains Project Role After Removal from Private Group

-

GitHub Token Leaked to Maintainers

-

Unauthenticated Blind SSRF in Jira Integration

-

Unauthorized Access to Group Membership

-

Validate SAML Response in Group SAML SSO

-
- - - - https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/ - CVE-2019-6783 - CVE-2019-6788 - CVE-2019-6785 - CVE-2019-6790 - CVE-2019-6997 - CVE-2019-6784 - CVE-2019-6789 - CVE-2019-6781 - CVE-2019-6786 - CVE-2019-6787 - CVE-2018-16476 - CVE-2019-6782 - CVE-2019-6791 - CVE-2019-6792 - CVE-2019-6796 - CVE-2019-6794 - CVE-2019-6795 - CVE-2019-6960 - CVE-2019-6995 - CVE-2019-7176 - CVE-2019-7155 - CVE-2019-6797 - CVE-2019-6793 - CVE-2019-6996 - - - 2019-01-31 - 2019-01-31 - - - - - turnserver -- multiple vulnerabilities - - - turnserver - 4.5.1.0 - - - - -

Mihály Mészáros reports:

-
-

We made 4.5.1.0 release public today that fixes many vulnerabilities.

-

It fix the following vulnerabilities:

-
    -
  • CVE-2018-4056
    • -
  • CVE-2018-4058
    • -
  • CVE-2018-4059
    • -
-

They will be exposed very soon..

-
- - - - https://github.com/coturn/coturn/blob/4.5.1.0/ChangeLog - https://groups.google.com/d/msg/turn-server-project-rfc5766-turn-server/0RuCzcQa0ew/ebZfNEDqBwAJ - CVE-2018-4056 - CVE-2018-4058 - CVE-2018-4059 - - - 2019-01-28 - 2019-01-30 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 65.0_1,1 - - - waterfox - 56.2.7 - - - seamonkey - linux-seamonkey - 2.53.0 - - - firefox-esr - 60.5.0_1,1 - - - linux-firefox - 60.5.0,2 - - - libxul - thunderbird - linux-thunderbird - 60.5.0 - - - - -

Mozilla Foundation reports:

-
-

CVE-2018-18500: Use-after-free parsing HTML5 stream

-

CVE-2018-18503: Memory corruption with Audio Buffer

-

CVE-2018-18504: Memory corruption and out-of-bounds read of texture client buffer

-

CVE-2018-18505: Privilege escalation through IPC channel messages

-

CVE-2018-18506: Proxy Auto-Configuration file can define localhost access to be proxied

-

CVE-2018-18502: Memory safety bugs fixed in Firefox 65

-

CVE-2018-18501: Memory safety bugs fixed in Firefox 65 and Firefox ESR 60.5

-
- - - - CVE-2018-18500 - CVE-2018-18501 - CVE-2018-18502 - CVE-2018-18503 - CVE-2018-18504 - CVE-2018-18505 - CVE-2018-18506 - https://www.mozilla.org/en-US/security/advisories/mfsa2019-01/ - https://www.mozilla.org/en-US/security/advisories/mfsa2019-02/ - - - 2019-01-29 - 2019-01-29 - 2019-07-23 - - - - - powerdns-recursor -- multiple vulnerabilities - - - powerdns-recursor - 4.1.9 - - - - -

PowerDNS Team reports:

-
-

CVE-2019-3806: An issue has been found in PowerDNS Recursor where Lua hooks are - not properly applied to queries received over TCP in some specific combination of - settings, possibly bypassing security policies enforced using Lua. - - When the recursor is configured to run with more than one thread (threads=X) and to - do the distribution of incoming queries to the worker threads itself - (pdns-distributes-queries=yes), the Lua script is not properly loaded in the thread - handling incoming TCP queries, causing the Lua hooks to not be properly applied.

-

CVE-2019-3807: An issue has been found in PowerDNS Recursor where records in the - answer section of responses received from authoritative servers with the AA flag not - set were not properly validated, allowing an attacker to bypass DNSSEC validation.

-
- - - - https://doc.powerdns.com/recursor/changelog/4.1.html - CVE-2019-3806 - CVE-2019-3807 - - - 2019-01-21 - 2019-01-22 - - - - - MySQL -- multiple vulnerabilities - - - mariadb55-server - 5.5.63 - - - mariadb100-server - 10.0.38 - - - mariadb101-server - 10.1.38 - - - mariadb102-server - 10.2.22 - - - mariadb103-server - 10.3.13 - - - mysql55-server - 5.5.63 - - - mysql56-server - 5.6.43 - - - mysql57-server - 5.7.25 - - - mysql80-server - 8.0.14 - - - percona55-server - 5.5.63 - - - percona56-server - 5.6.43 - - - percona57-server - 5.7.25 - - - - -

Oracle reports:

-
-

Please reference CVE/URL list for details

-

Not all listed CVE's are present in all versions/flavors

-
- - - - https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html#AppendixMSQL - CVE-2019-2534 - CVE-2019-2533 - CVE-2019-2529 - CVE-2019-2482 - CVE-2019-2434 - CVE-2019-2455 - CVE-2019-2503 - CVE-2019-2436 - CVE-2019-2536 - CVE-2019-2502 - CVE-2019-2510 - CVE-2019-2539 - CVE-2019-2494 - CVE-2019-2495 - CVE-2019-2537 - CVE-2019-2420 - CVE-2019-2481 - CVE-2019-2507 - CVE-2019-2530 - CVE-2019-2528 - CVE-2019-2531 - CVE-2019-2486 - CVE-2019-2532 - CVE-2019-2535 - CVE-2019-2513 - - - 2019-01-15 - 2019-01-27 - - - - - botan2 -- Side channel during ECC key generation - - - botan2 - 2.9.0 - - - - -

botan2 developers reports:

-
-

A timing side channel during ECC key generation could leak information about the - high bits of the secret scalar. Such information allows an attacker to perform a - brute force attack on the key somewhat more efficiently than they would otherwise. - Found by Ján Jančár using ECTester.

-

Bug introduced in 1.11.20, fixed in 2.9.0

-
- - - - https://botan.randombit.net/security.html#id1 - CVE-2018-20187 - - - 2018-12-17 - 2019-01-27 - - - - - phpMyAdmin -- File disclosure and SQL injection - - - phpMyAdmin - phpMyAdmin-php56 - phpMyAdmin-php70 - phpMyAdmin-php71 - phpMyAdmin-php72 - 4.8.5 - - - - -

The phpMyAdmin development team reports:

-
-

Summary

-

Arbitrary file read vulnerability

-

Description

-

When AllowArbitraryServer configuration set - to true, with the use of a rogue MySQL server, - an attacker can read any file on the server that the web - server's user can access.

-

phpMyadmin attempts to block the use of LOAD DATA - INFILE, but due to a bug in PHP, - this check is not honored. Additionally, when using the - 'mysql' extension, mysql.allow_local_infile - is enabled by default. Both of these conditions allow the - attack to occur.

-

Severity

-

We consider this vulnerability to be critical.

-

Mitigation factor

-

This attack can be mitigated by setting the - `AllowArbitraryServer` configuration directive to false - (which is the default value).

-

Affected Versions

-

phpMyAdmin versions from at least 4.0 through 4.8.4 are - affected

-
-
-

Summary

-

SQL injection in Designer feature

-

Description

-

A vulnerability was reported where a specially crafted - username can be used to trigger an SQL injection attack - through the designer feature.

-

Severity

-

We consider this vulnerability to be serious.

-

Affected Versions

-

phpMyAdmin versions from 4.5.0 through 4.8.4 are affected

-
- - - - https://www.phpmyadmin.net/security/PMASA-2019-1/ - https://www.phpmyadmin.net/security/PMASA-2019-2/ - - - 2019-01-21 - 2019-01-27 - - - - - gitea -- multiple vulnerabilities - - - gitea - 1.7.0 - - - - -

Gitea Team reports:

-
-

Do not display the raw OpenID error in the UI

-

When redirecting clean the path to avoid redirecting to external site

-

Prevent DeleteFilePost doing arbitrary deletion

-
- - - - https://github.com/go-gitea/gitea/releases/tag/v1.7.0 - - - 2019-01-22 - 2019-01-26 - - - - - libzmq4 -- Remote Code Execution Vulnerability - - - libzmq4 - 4.2.04.3.1 - - - - -
-

A vulnerability has been found that would allow attackers to direct a peer to - jump to and execute from an address indicated by the attacker. - This issue has been present since v4.2.0. Older releases are not affected. - - NOTE: The attacker needs to know in advance valid addresses in the peer's - memory to jump to, so measures like ASLR are effective mitigations. - - NOTE: this attack can only take place after authentication, so peers behind - CURVE/GSSAPI are not vulnerable to unauthenticated attackers.

-
- - - - CVE-2019-6250 - https://github.com/zeromq/libzmq/issues/3351 - https://github.com/zeromq/libzmq/pull/3353 - https://nvd.nist.gov/vuln/detail/CVE-2019-6250 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6250 - - - 2019-01-08 - 2019-01-26 - - - - - Apache -- vulnerability - - - apache24 - 2.4.38 - - - - -

The Apache httpd Project reports:

-
-

SECURITY: CVE-2018-17199 - mod_session: mod_session_cookie does not respect expiry time allowing - sessions to be reused.

-

SECURITY: CVE-2019-0190 - mod_ssl: Fix infinite loop triggered by a client-initiated - renegotiation in TLSv1.2 (or earlier) with OpenSSL 1.1.1 and - later. PR 63052.

-

SECURITY: CVE-2018-17189 - mod_http2: fixes a DoS attack vector. By sending slow request bodies - to resources not consuming them, httpd cleanup code occupies a server - thread unnecessarily. This was changed to an immediate stream reset - which discards all stream state and incoming data.

-
- - - - http://www.apache.org/dist/httpd/CHANGES_2.4.38 - http://httpd.apache.org/security/vulnerabilities_24.html - CVE-2018-17199 - CVE-2018-17189 - CVE-2019-0190 - - - 2019-01-22 - 2019-01-23 - - - - - www/mod_dav_svn -- Malicious SVN clients can crash mod_dav_svn. - - - mod_dav_svn - 1.10.01.10.3 - 1.11.0 - - - - -

Subversion project reports:

-
-

Malicious SVN clients can trigger a crash in mod_dav_svn by omitting - the root path from a recursive directory listing request.

-
- - - - http://subversion.apache.org/security/CVE-2018-11803-advisory.txt - - - 2019-01-23 - 2019-01-23 - - - - - www/py-requests -- Information disclosure vulnerability - - - py27-requests - py35-requests - py36-requests - py37-requests - 2.20.0 - - - - -
-

The Requests package before 2.20.0 for Python sends an HTTP Authorization header - to an http URI upon receiving a same-hostname https-to-http redirect, which makes - it easier for remote attackers to discover credentials by sniffing the network.

-
- - - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-18074 - https://nvd.nist.gov/vuln/detail/CVE-2018-18074 - https://github.com/requests/requests/issues/4716 - https://github.com/requests/requests/pull/4718 - https://github.com/requests/requests/commit/c45d7c49ea75133e52ab22a8e9e13173938e36ff - - - 2018-06-27 - 2019-01-22 - 2019-01-27 - - - - - joomla3 -- vulnerabilitiesw - - - joomla3 - 3.9.2 - - - - -

JSST reports:

-
-

Inadequate escaping in mod_banners leads to a stored XSS vulnerability.

-
-
-

Inadequate escaping in com_contact leads to a stored XSS vulnerability

-
-
-

Inadequate checks at the Global Configuration Text Filter settings allowed a stored XSS.

-
-
-

Inadequate checks at the Global Configuration helpurl settings allowed a stored XSS.

-
- - - - https://developer.joomla.org/security-centre/760-00190101-core-stored-xss-in-mod-banners.html - CVE-2019-6264 - https://developer.joomla.org/security-centre/761-20190102-core-stored-xss-in-com-contact.html - CVE-2019-6261 - https://developer.joomla.org/security-centre/762-20190103-core-stored-xss-issue-in-the-global-configuration-textfilter-settings.html - CVE-2019-6263 - https://developer.joomla.org/security-centre/763-20190104-core-stored-xss-issue-in-the-global-configuration-help-url.html - CVE-2019-6262 - - - 2018-12-01 - 2019-01-20 - - - - - drupal -- Drupal core - Arbitrary PHP code execution - - - drupal7 - 7.63 - - - drupal8 - 8.6.7 - - - - -

Drupal Security Team reports:

-
-

A remote code execution vulnerability exists in PHP's built-in - phar stream wrapper when performing file operations on an untrusted phar:// URI.

-

Some Drupal code (core, contrib, and custom) may be performing file operations on - insufficiently validated user input, thereby being exposed to this vulnerability.

-

This vulnerability is mitigated by the fact that such code paths typically require - access to an administrative permission or an atypical configuration.

-
- - - - https://www.drupal.org/SA-CORE-2018-006 - - - 2019-01-16 - 2019-01-19 - - - - - Helm -- client unpacking chart that contains malicious content - - - helm - 2.0.02.12.2 - - - - -

Helm security notice

-
-

A specially crafted chart may be able to unpack content into locations on - the filesystem outside of the chart's path, potentially - overwriting existing files.

-
- - - - https://helm.sh/blog/helm-security-notice-2019/index.html - - - 2019-01-14 - 2019-01-18 - - - - - Gitlab -- Arbitrary repo read in Gitlab project import - - - gitlab-ce - 11.6.011.6.4 - 11.5.011.5.7 - 8.9.011.4.14 - - - - -

Gitlab reports:

-
-

Arbitrary repo read in Gitlab project import

-
- - - - https://about.gitlab.com/2019/01/16/critical-security-release-gitlab-11-dot-6-dot-4-released/ - CVE-2019-6240 - - - 2019-01-16 - 2019-01-17 - - - - - jenkins -- multiple vulnerabilities - - - jenkins - 2.160 - - - jenkins-lts - 2.150.2 - - - - -

Jenkins Security Advisory:

-
-

Description

-
(High) SECURITY-868
-

Administrators could persist access to Jenkins using crafted 'Remember me' cookie

-
(Medium) SECURITY-901
-

Deleting a user in an external security realm did not invalidate their session or 'Remember me' cookie

-
- - - - https://jenkins.io/security/advisory/2019-01-16/ - - - 2019-01-16 - 2019-01-16 - - - - - py-matrix-synapse -- undisclosed vulnerability - - - py27-matrix-synapse - py35-matrix-synapse - py36-matrix-synapse - py37-matrix-synapse - 0.34.1.1 - - - - -

Matrix developers report:

-
-

The matrix team announces the availablility of synapse security releases 0.34.0.1 and 0.34.1.1, fixing CVE-2019-5885.

-
- - - - CVE-2019-5885 - https://matrix.org/blog/2019/01/10/critical-security-update-synapse-0-34-0-1-synapse-0-34-1-1/ - - - 2019-01-10 - 2019-01-15 - - - - - irssi -- Use after free - - - irssi - 1.1.0,11.1.2,1 - - - - -

Irssi reports:

-
-

Use after free when hidden lines were expired from the scroll - buffer. It may affect the stability of Irssi. (CWE-417, CWE-825)

-
- - - - https://irssi.org/security/irssi_sa_2019_01.txt - CVE-2019-5882 - ports/234798 - - - 2019-01-09 - 2019-01-10 - - - - - uriparser -- Out-of-bounds read - - - uriparser - 0.9.1 - - - - -

Upstream project reports:

-
-

Out-of-bounds read in uriParse*Ex* for incomplete URIs with IPv6 - addresses with embedded IPv4 address, e.g. "//[::44.1"; - mitigated if passed parameter afterLast points to readable memory - containing a '\0' byte.

-
- - - - https://github.com/uriparser/uriparser/blob/uriparser-0.9.1/ChangeLog - - - 2019-01-02 - 2019-01-06 - - - - - gitea -- insufficient privilege check - - - gitea - 1.6.3 - - - - -

The Gitea project reports:

-
-

Security

-
    -
  • Prevent DeleteFilePost doing arbitrary deletion
    • -
-
- - - - https://github.com/go-gitea/gitea/issues/5631 - - - 2019-01-04 - 2019-01-06 - - - - - chromium -- Use after free in PDFium - - - chromium - 71.0.3578.98 - - - - -

Google Chrome Releases reports:

-
-

1 security fix contributed by external researches:

-
    -
  • High CVE-2018-17481: Use after free in PDFium
    • -
-
- - - - CVE-2018-17481 - https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop_12.html - - - 2018-12-12 - 2019-01-05 - - - - - chromium -- multiple vulnerabilities - - - chromium - 71.0.3578.80 - - - - -

Google Chrome Releases reports:

-
-

43 security fixes in this release, including:

-
    -
  • High CVE-2018-17480: Out of bounds write in V8
    • -
  • High CVE-2018-17481: Use after free in PDFium
    • -
  • High CVE-2018-18335: Heap buffer overflow in Skia
    • -
  • High CVE-2018-18336: Use after free in PDFium
    • -
  • High CVE-2018-18337: Use after free in Blink
    • -
  • High CVE-2018-18338: Heap buffer overflow in Canvas
    • -
  • High CVE-2018-18339: Use after free in WebAudio
    • -
  • High CVE-2018-18340: Use after free in MediaRecorder
    • -
  • High CVE-2018-18341: Heap buffer overflow in Blink
    • -
  • High CVE-2018-18342: Out of bounds write in V8
    • -
  • High CVE-2018-18343: Use after free in Skia
    • -
  • High CVE-2018-18344: Inappropriate implementation in Extensions
    • -
  • High To be allocated: Multiple issues in SQLite via WebSQL
    • -
  • Medium CVE-2018-18345: Inappropriate implementation in Site Isolation
    • -
  • Medium CVE-2018-18346: Incorrect security UI in Blink
    • -
  • Medium CVE-2018-18347: Inappropriate implementation in Navigation
    • -
  • Medium CVE-2018-18348: Inappropriate implementation in Omnibox
    • -
  • Medium CVE-2018-18349: Insufficient policy enforcement in Blink
    • -
  • Medium CVE-2018-18350: Insufficient policy enforcement in Blink
    • -
  • Medium CVE-2018-18351: Insufficient policy enforcement in Navigation
    • -
  • Medium CVE-2018-18352: Inappropriate implementation in Media
    • -
  • Medium CVE-2018-18353: Inappropriate implementation in Network Authentication
    • -
  • Medium CVE-2018-18354: Insufficient data validation in Shell Integration
    • -
  • Medium CVE-2018-18355: Insufficient policy enforcement in URL Formatter
    • -
  • Medium CVE-2018-18356: Use after free in Skia
    • -
  • Medium CVE-2018-18357: Insufficient policy enforcement in URL Formatter
    • -
  • Medium CVE-2018-18358: Insufficient policy enforcement in Proxy
    • -
  • Medium CVE-2018-18359: Out of bounds read in V8
    • -
  • Low To be allocated: Inappropriate implementation in PDFium
    • -
  • Low To be allocated: Use after free in Extensions
    • -
  • Low To be allocated: Inappropriate implementation in Navigation
    • -
  • Low To be allocated: Inappropriate implementation in Navigation
    • -
  • Low To be allocated: Insufficient policy enforcement in Navigation
    • -
  • Low To be allocated: Insufficient policy enforcement in URL Formatter
    • -
  • Medium To be allocated: Insufficient policy enforcement in Payments
    • -
  • Various fixes from internal audits, fuzzing and other initiatives
    • -
-
- - - - CVE-2018-17480 - CVE-2018-17481 - CVE-2018-18335 - CVE-2018-18336 - CVE-2018-18337 - CVE-2018-18338 - CVE-2018-18339 - CVE-2018-18340 - CVE-2018-18341 - CVE-2018-18342 - CVE-2018-18343 - CVE-2018-18344 - CVE-2018-18345 - CVE-2018-18346 - CVE-2018-18347 - CVE-2018-18348 - CVE-2018-18349 - CVE-2018-18350 - CVE-2018-18351 - CVE-2018-18352 - CVE-2018-18353 - CVE-2018-18354 - CVE-2018-18355 - CVE-2018-18356 - CVE-2018-18357 - CVE-2018-18358 - CVE-2018-18359 - https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html - - - 2018-12-04 - 2019-01-05 - - - - - Django -- Content spoofing possibility in the default 404 page - - - py27-django111 - py35-django111 - py36-django111 - py37-django111 - 1.11.18 - - - py35-django20 - py36-django20 - py37-django20 - 2.0.10 - - - py35-django21 - py36-django21 - py37-django21 - 2.1.5 - - - - -

Django security releases issued reports:

-
-

An attacker could craft a malicious URL that could make spoofed content - appear on the default page generated by the django.views.defaults.page_not_found() - view.

-
- - - - CVE-2019-3498 - https://www.djangoproject.com/weblog/2019/jan/04/security-releases/ - - - 2019-01-03 - 2019-01-05 - - - - - Gitlab -- Multiple vulnerabilities - - - gitlab-ce - 11.6.011.6.1 - 11.5.011.5.6 - 8.0.011.4.13 - - - - -

Gitlab reports:

-
-

Source code disclosure merge request diff

-

Todos improper access control

-

URL rel attribute not set

-

Persistent XSS Autocompletion

-

SSRF repository mirroring

-

CI job token LFS error message disclosure

-

Secret CI variable exposure

-

Guest user CI job disclosure

-

Persistent XSS label reference

-

Persistent XSS wiki in IE browser

-

SSRF in project imports with LFS

-

Improper access control CI/CD settings

-

Missing authorization control merge requests

-

Improper access control branches and tags

-

Missing authentication for Prometheus alert endpoint

-
- - - - https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/ - CVE-2018-20493 - CVE-2018-20492 - CVE-2018-20489 - CVE-2018-20490 - CVE-2018-20497 - CVE-2018-20495 - CVE-2018-20488 - CVE-2018-20494 - CVE-2018-20496 - CVE-2018-20491 - CVE-2018-20499 - CVE-2018-20500 - CVE-2018-20501 - CVE-2018-20498 - CVE-2018-20507 - - - 2018-12-31 - 2019-01-02 - - - - - gitea -- privilege escalation, XSS - - - gitea - 1.6.2 - - - - -

The Gitea project reports:

-
-

Security

-
    -
  • Sanitize uploaded file names
    • -
  • HTMLEncode user added text
    • -
-
- - - - https://github.com/go-gitea/gitea/issues/5569 - https://github.com/go-gitea/gitea/issues/5565 - - - 2018-12-19 - 2018-12-21 - - - - - rpm4 -- regression in -setperms, -setugids and -restore - - - rpm4 - 4.14.2.1 - - - - -

rpm4 reports:

-
-

Regression in -setperms, -setugids and -restore

-

Note that this update can not automatically fix possible damage - done by using -setperms, -setugids or -restore with rpm 4.14.2, it - merely fixes the functionlity itself. Any damage needs to be - investigated and fixed manually, such as using -verify and -restore - or reinstalling packages.

-
- - - - http://rpm.org/wiki/Releases/4.14.2.1 - - - 2018-10-22 - 2018-12-26 - - - - - Gitlab -- Arbitrary File read in Gitlab project import - - - gitlab-ce - 11.5.011.5.5 - 11.4.011.4.12 - 8.9.011.3.14 - - - - -

Gitlab reports:

-
-

Arbitrary File read in Gitlab project import

-
- - - - https://about.gitlab.com/2018/12/20/critical-security-release-gitlab-11-dot-5-dot-5-released/ - CVE-2018-20229 - - - 2018-12-20 - 2018-12-22 - - - - - shibboleth-sp -- crashes on malformed date/time content - - - shibboleth-sp - 3.0.03.0.3 - - - - -

The Shibboleth Consortium reports:

-
-

SAML messages, assertions, and metadata all commonly contain - date/time information in a standard XML format.

-

Invalid formatted data in such fields cause an exception of a type - that was not handled properly in the V3 software and causes a crash - (usually to the shibd daemon process, but possibly to Apache in rare - cases). Note that the crash occurs prior to evaluation of a message's - authenticity, so can be exploited by an untrusted attacker.

-

The problem is believed to be specific to the V3 software and would - not cause a crash in the older, now unsupported, V2 software.

-
- - - - https://shibboleth.net/community/advisories/secadv_20181219a.txt - - - 2018-12-19 - 2018-12-20 - - - - - couchdb -- administrator privilege escalation - - - couchdb - 2.3.0,2 - - - couchdb2 - 2.3.0 - - - - -

Apache CouchDB PMC reports:

-
-

Database Administrator could achieve privilege escalation to - the account that CouchDB runs under, by abusing insufficient validation - in the HTTP API, escaping security controls implemented in previous - releases.

-
- - - - http://docs.couchdb.org/en/stable/cve/2018-17188.html - CVE-2018-17188 - - - 2018-12-01 - 2018-12-13 - - - - - bro -- "Magellan" remote code execution vulnerability in bundled sqlite - - - bro - 2.6.1 - - - - -

Bro Network security Monitor reports:

-
-

Bro 2.6.1 updates the embedded SQLite to version 3.26.0 - to address the "Magellan" remote code execution vulnerability. - The stock Bro configuration/scripts don't use SQLite by - default, but custom user scripts/packages may.

-
- - - - https://www.bro.org/download/NEWS.bro.html - - - 2018-12-01 - 2018-12-20 - - - - - FreeBSD -- bootpd buffer overflow - - - FreeBSD - 12.012.0_1 - 11.211.2_7 - - - - -

Problem Description:

-

Due to insufficient validation of network-provided data - it may be possible for a malicious attacker to craft a bootp - packet which could cause a stack buffer overflow.

-

Impact:

-

It is possible that the buffer overflow could lead to a - Denial of Service or remote code execution.

- - - - CVE-2018-1716 - SA-18:15.bootpd - - - 2018-12-19 - 2018-12-19 - - - - - wordpress -- multiple issues - - - wordpress - fr-wordpress - 5.0.1,1 - - - de-wordpress - zh_CN-wordpress - zh_TW-wordpress - ja-wordpress - ru-wordpress - 5.0.1 - - - - -

wordpress developers reports:

-
-

WordPress versions 5.0 and earlier are affected by the following bugs, which are - fixed in version 5.0.1. Updated versions of WordPress 4.9 and older releases are - also available, for users who have not yet updated to 5.0.

-

Karim El Ouerghemmi discovered that authors could alter meta data to delete files - that they weren’t authorized to.

-

Simon Scannell of RIPS Technologies discovered that authors could create posts of - unauthorized post types with specially crafted input.

-

Sam Thomas discovered that contributors could craft meta data in a way that resulted - in PHP object injection.

-

Tim Coen discovered that contributors could edit new comments from higher-privileged - users, potentially leading to a cross-site scripting vulnerability.

-

Tim Coen also discovered that specially crafted URL inputs could lead to a cross-site - scripting vulnerability in some circumstances. WordPress itself was not affected, - but plugins could be in some situations.

-

Team Yoast discovered that the user activation screen could be indexed by search - engines in some uncommon configurations, leading to exposure of email addresses, - and in some rare cases, default generated passwords.

-

Tim Coen and Slavco discovered that authors on Apache-hosted sites could upload - specifically crafted files that bypass MIME verification, leading to a cross-site - scripting vulnerability.

-
- - - - https://wordpress.org/news/2018/12/wordpress-5-0-1-security-release/ - - - 2018-12-13 - 2018-12-15 - - - - - Mbed TLS -- Local timing attack on RSA decryption - - - mbedtls - 2.14.1 - - - - -

Janos Follath reports:

-
-

An attacker who can run code on the same machine that is - performing an RSA decryption can potentially recover the plaintext - through a Bleichenbacher-like oracle.

-
- - - - https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-03 - CVE-2018-19608 - - - 2018-11-28 - 2018-12-14 - - - - - typo3 -- multiple vulnerabilities - - - typo3-8 - 8.7.21 - - - typo3-9 - 9.5.2 - - - - -

Typo3 core team reports:

-
-

CKEditor 4.11 fixes an XSS vulnerability in the HTML parser reported by maxarr. - The vulnerability stemmed from the fact that it was possible to execute XSS inside - the CKEditor source area after persuading the victim to: (i) switch CKEditor to - source mode, then (ii) paste a specially crafted HTML code, prepared by the attacker, - into the opened CKEditor source area, and (iii) switch back to WYSIWYG mode. - Although this is an unlikely scenario, we recommend to upgrade to the latest editor version.

-

Failing to properly encode user input, online media asset rendering - (*.youtube and *.vimeo files) is vulnerable to cross-site scripting. A valid backend user - account or write access on the server system (e.g. SFTP) is needed in order to exploit this - vulnerability.

-

Failing to properly encode user input, notifications shown in modal windows in the TYPO3 - backend are vulnerable to cross-site scripting. A valid backend user account is needed in - order to exploit this vulnerability.

-

Failing to properly encode user input, login status display is vulnerable to cross-site - scripting in the website frontend. A valid user account is needed in order to exploit this - vulnerability - either a backend user or a frontend user having the possibility to modify - their user profile.

-

Template patterns that are affected are:

-
    -
  • ###FEUSER_[fieldName]### using system extension felogin
    • -
  • <!--###USERNAME###--> for regular frontend rendering - (pattern can be defined individually using TypoScript setting - config.USERNAME_substToken)
    • -
-

It has been discovered that cookies created in the Install Tool are not hardened to be - submitted only via HTTP. In combination with other vulnerabilities such as cross-site - scripting it can lead to hijacking an active and valid session in the Install Tool.

-

The Install Tool exposes the current TYPO3 version number to non-authenticated users.

-

Online Media Asset Handling (*.youtube and *.vimeo files) in the TYPO3 backend is vulnerable - to denial of service. Putting large files with according file extensions results in high - consumption of system resources. This can lead to exceeding limits of the current PHP process - which results in a dysfunctional backend component. A valid backend user account or write - access on the server system (e.g. SFTP) is needed in order to exploit this vulnerability.

-

TYPO3’s built-in record registration functionality (aka “basic shopping cart”) using recs - URL parameters is vulnerable to denial of service. Failing to properly ensure that anonymous - user sessions are valid, attackers can use this vulnerability in order to create an arbitrary - amount of individual session-data records in the database.

-
- - - - https://typo3.org/article/typo3-952-8721-and-7632-security-releases-published/ - - - 2018-12-11 - 2018-12-14 - - - - - Gitlab -- Arbitrary File read in GitLab project import with Git LFS - - - gitlab-ce - 11.5.011.5.4 - 11.4.011.4.11 - 11.0.011.4.0 - - - - -

Gitlab reports:

-
-

Arbitrary File read in GitLab project import with Git LFS

-
- - - - https://about.gitlab.com/2018/12/13/critical-security-release-gitlab-11-dot-5-dot-4-released/ - CVE-2018-20144 - - - 2018-12-13 - 2018-12-14 - - - - - phpMyAdmin -- multiple vulnerabilities - - - phpMyAdmin - phpMyAdmin-php56 - phpMyAdmin-php70 - phpMyAdmin-php71 - phpMyAdmin-php72 - 4.8.4 - - - - -

The phpMyAdmin development team reports:

-
-

Summary

-

Local file inclusion through transformation feature

-

Description

-

A flaw has been found where an attacker can exploit - phpMyAdmin to leak the contents of a local file. The - attacker must have access to the phpMyAdmin Configuration - Storage tables, although these can easily be created in any - database to which the attacker has access. An attacker must - have valid credentials to log in to phpMyAdmin; this - vulnerability does not allow an attacker to circumvent the - login system.

-

Severity

-

We consider this vulnerability to be severe.

-
-
-

Summary

-

XSRF/CSRF vulnerability in phpMyAdmin

-

Description

-

By deceiving a user to click on a crafted URL, it is - possible to perform harmful SQL operations such as renaming - databases, creating new tables/routines, deleting designer - pages, adding/deleting users, updating user passwords, - killing SQL processes, etc.

-

Severity

-

We consider this vulnerability to be of moderate severity.

-
-
-

Summary

-

XSS vulnerability in navigation tree

-

Description

-

A Cross-Site Scripting vulnerability was found in the - navigation tree, where an attacker can deliver a payload to - a user through a specially-crafted database/table name.

-

Severity

-

We consider this attack to be of moderate severity.

-

Mitigation factor

-

The stored XSS vulnerabilities can be triggered only by - someone who logged in to phpMyAdmin, as the usual token - protection prevents non-logged-in users from accessing the - required forms.

-
- - - - https://www.phpmyadmin.net/security/PMASA-2018-6/ - https://www.phpmyadmin.net/security/PMASA-2018-7/ - https://www.phpmyadmin.net/security/PMASA-2018-8/ - - - 2018-12-11 - 2018-12-12 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 64.0_3,1 - - - waterfox - 56.2.6 - - - seamonkey - linux-seamonkey - 2.53.0 - - - firefox-esr - 60.4.0,1 - - - linux-firefox - 60.4.0,2 - - - libxul - thunderbird - linux-thunderbird - 60.4.0 - - - - -

Mozilla Foundation reports:

-
-

CVE-2018-12407: Buffer overflow with ANGLE library when using VertexBuffer11 module

-

CVE-2018-17466: Buffer overflow and out-of-bounds read in ANGLE library with TextureStorage11

-

CVE-2018-18492: Use-after-free with select element

-

CVE-2018-18493: Buffer overflow in accelerated 2D canvas with Skia

-

CVE-2018-18494: Same-origin policy violation using location attribute and performance.getEntries to steal cross-origin URLs

-

CVE-2018-18495: WebExtension content scripts can be loaded in about: pages

-

CVE-2018-18496: Embedded feed preview page can be abused for clickjacking

-

CVE-2018-18497: WebExtensions can load arbitrary URLs through pipe separators

-

CVE-2018-18498: Integer overflow when calculating buffer sizes for images

-

CVE-2018-12406: Memory safety bugs fixed in Firefox 64

-

CVE-2018-12405: Memory safety bugs fixed in Firefox 64 and Firefox ESR 60.4

-
- - - - CVE-2018-12405 - CVE-2018-12406 - CVE-2018-12407 - CVE-2018-17466 - CVE-2018-18492 - CVE-2018-18493 - CVE-2018-18494 - CVE-2018-18495 - CVE-2018-18496 - CVE-2018-18497 - CVE-2018-18498 - https://www.mozilla.org/en-US/security/advisories/mfsa2018-29/ - https://www.mozilla.org/en-US/security/advisories/mfsa2018-30/ - - - 2018-12-11 - 2018-12-11 - 2019-07-23 - - - - - FreeBSD -- Insufficient bounds checking in bhyve(8) device model - - - FreeBSD - 11.211.2_6 - - - - -

Problem Description:

-

Insufficient bounds checking in one of the device models - provided by bhyve(8) can permit a guest operating system - to overwrite memory in the bhyve(8) processing possibly - permitting arbitary code execution.

-

Impact:

-

A guest OS using a firmware image can cause the bhyve - process to crash, or possibly execute arbitrary code on the - host as root.

- - - - CVE-2018-1716 - SA-18:14.bhyve - - - 2018-12-04 - 2018-12-10 - - - - - FreeBSD -- Multiple vulnerabilities in NFS server code - - - FreeBSD - 11.211.2_5 - - - - -

Problem Description:

-

Insufficient and improper checking in the NFS server - code could cause a denial of service or possibly remote - code execution via a specially crafted network packet.

-

Impact:

-

A remote attacker could cause the NFS server to crash, - resulting in a denial of service, or possibly execute - arbitrary code on the server.

- - - - CVE-2018-1715 - SA-18:13.nfs - - - 2018-11-27 - 2018-12-10 - - - - - node.js -- multiple vulnerabilities - - - node6 - 6.15.0 - - - node8 - 8.14.0 - - - node10 - 10.14.0 - - - node - 11.3.0 - - - - -

Node.js reports:

-
-

Updates are now available for all active Node.js release lines. These include fixes for the vulnerabilities identified in the initial announcement. They also include upgrades of Node.js 6 and 8 to OpenSSL 1.0.2q, and upgrades of Node.js 10 and 11 to OpenSSL 1.1.0j.

-

We recommend that all Node.js users upgrade to a version listed below as soon as possible.

-

Debugger port 5858 listens on any interface by default (CVE-2018-12120)

-

All versions of Node.js 6 are vulnerable and the severity is HIGH. When the debugger is enabled with node --debug or node debug, it listens to port 5858 on all interfaces by default. This may allow remote computers to attach to the debug port and evaluate arbitrary JavaScript. The default interface is now localhost. It has always been possible to start the debugger on a specific interface, such as node --debug=localhost. The debugger was removed in Node.js 8 and replaced with the inspector, so no versions from 8 and later are vulnerable.

-

Denial of Service with large HTTP headers (CVE-2018-12121)

-

All versions of 6 and later are vulnerable and the severity is HIGH. By using a combination of many requests with maximum sized headers (almost 80 KB per connection), and carefully timed completion of the headers, it is possible to cause the HTTP server to abort from heap allocation failure. Attack potential is mitigated by the use of a load balancer or other proxy layer.

-

The total size of HTTP headers received by Node.js now must not exceed 8192 bytes.

-

"Slowloris" HTTP Denial of Service (CVE-2018-12122)

-

All versions of Node.js 6 and later are vulnerable and the severity is LOW. An attacker can cause a Denial of Service (DoS) by sending headers very slowly keeping HTTP or HTTPS connections and associated resources alive for a long period of time. Attack potential is mitigated by the use of a load balancer or other proxy layer.

-

A timeout of 40 seconds now applies to servers receiving HTTP headers. This value can be adjusted with server.headersTimeout. Where headers are not completely received within this period, the socket is destroyed on the next received chunk. In conjunction with server.setTimeout(), this aids in protecting against excessive resource retention and possible Denial of Service.

-

Hostname spoofing in URL parser for javascript protocol (CVE-2018-12123)

-

All versions of Node.js 6 and later are vulnerable and the severity is LOW. If a Node.js application is using url.parse() to determine the URL hostname, that hostname can be spoofed by using a mixed case "javascript:" (e.g. "javAscript:") protocol (other protocols are not affected). If security decisions are made about the URL based on the hostname, they may be incorrect.

-

HTTP request splitting (CVE-2018-12116)

-

Node.js 6 and 8 are vulnerable and the severity is MEDIUM. If Node.js can be convinced to use unsanitized user-provided Unicode data for the path option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server.

-

OpenSSL Timing vulnerability in ECDSA signature generation (CVE-2018-0735)

-

The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side-channel attack. An attacker could use variations in the signing algorithm to recover the private key.

-

OpenSSL Timing vulnerability in DSA signature generation (CVE-2018-0734)

-

The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side-channel attack. An attacker could use variations in the signing algorithm to recover the private key.

-

OpenSSL Microarchitecture timing vulnerability in ECC scalar multiplication (CVE-2018-5407)

-

OpenSSL ECC scalar multiplication, used in e.g. ECDSA and ECDH, has been shown to be vulnerable to a microarchitecture timing side-channel attack. An attacker with sufficient access to mount local timing attacks during ECDSA signature generation could recover the private key.

-
- - - - https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/ - CVE-2018-12120 - CVE-2018-12121 - CVE-2018-12122 - CVE-2018-12123 - CVE-2018-12116 - CVE-2018-0735 - CVE-2018-0734 - CVE-2018-5407 - - - 2018-11-27 - 2018-12-10 - - - - - powerdns-recursor -- Crafted query can cause a denial of service - - - powerdns-recursor - 4.1.8 - - - - -

powerdns Team reports:

-
-

CVE-2018-16855: An issue has been found in PowerDNS Recursor where a remote attacker sending a DNS query can trigger an out-of-bounds memory read while computing the hash of the query for a packet cache lookup, possibly leading to a crash. When the PowerDNS Recursor is run inside a supervisor like supervisord or systemd, a crash will lead to an automatic restart, limiting the impact to a somewhat degraded service.

-
- - - - https://doc.powerdns.com/recursor/changelog/4.1.html - CVE-2018-16855 - - - 2018-11-26 - 2018-12-09 - - - - - py-asyncssh -- Allows bypass of authentication - - - py-asyncssh - 1.12.1 - - - - -

mitre.org Reports:

-
-

The SSH server implementation of AsyncSSH before 1.12.1 does not properly check - whether authentication is completed before processing other requests - A customized SSH client can simply skip the authentication step.

-
- - - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7749 - - - 2018-03-07 - 2018-12-08 - - - - - Gitlab -- Multiple vulnerabilities - - - gitlab-ce - 11.5.011.5.3 - 11.4.011.4.10 - 8.11.011.3.12 - - - - -

Gitlab reports:

-
-

Directory Traversal in Templates API

-
- - - - https://about.gitlab.com/2018/12/06/critical-security-release-gitlab-11-dot-5-dot-3-released/ - CVE-2018-19856 - - - 2018-12-06 - 2018-12-06 - - - - - Flash Player -- multiple vulnerabilities - - - linux-flashplayer - 32.0.0.101 - - - - -

Adobe reports:

-
-
    -
  • This update resolves a use-after-free vulnerability that - could lead to arbitrary code execution (CVE-2018-15982).
    • -
  • This update resolves an insecure library loading vulnerability that - could lead to privilege escalation (CVE-2018-15983).
    • -
-
- - - - CVE-2018-15982 - CVE-2018-15983 - https://helpx.adobe.com/security/products/flash-player/apsb18-42.html - - - 2018-12-05 - 2018-12-06 - - - - - jenkins -- multiple vulnerabilities - - - jenkins - 2.154 - - - jenkins-lts - 2.138.3 - - - - -

Jenkins Security Advisory:

-
-

Description

-
(Critical) SECURITY-595
-

Code execution through crafted URLs

-
(Medium) SECURITY-904
-

Forced migration of user records

-
(Medium) SECURITY-1072
-

Workspace browser allowed accessing files outside the workspace

-
(Medium) SECURITY-1193
-

Potential denial of service through cron expression form validation

-
- - - - https://jenkins.io/security/advisory/2018-12-05/ - - - 2018-12-05 - 2018-12-05 - - - - - moodle -- Login CSRF vulnerability - - - moodle31 - 3.1.15 - - - moodle33 - 3.3.9 - - - moodle34 - 3.4.6 - - - moodle35 - 3.5.3 - - - - -

moodle reports:

-
-

The login form is not protected by a token to prevent login cross-site - request forgery.

-
- - - - CVE-2018-16854 - https://moodle.org/mod/forum/discuss.php?d=378731 - - - 2018-11-06 - 2018-12-03 - - - - - Rails -- Active Job vulnerability - - - rubygem-activejob4 - 4.2.11 - - - rubygem-activejob5 - 5.1.6.1 - - - rubygem-activejob50 - 5.0.7.1 - - - - -

Ruby on Rails blog:

-
-

Rails 4.2.11, 5.0.7.1, 5.1.6.1 and 5.2.1.1 have been released! These - contain the following important security fixes, and it is recommended - that users upgrade as soon as possible

-

CVE-2018-16476 Broken Access Control vulnerability in Active Job: - Carefully crafted user input can cause Active Job to deserialize it - using GlobalId and allow an attacker to have access to information that - they should not have.

-
- - - - https://weblog.rubyonrails.org/2018/11/27/Rails-4-2-5-0-5-1-5-2-have-been-released/ - CVE-2018-16476 - - - 2018-11-27 - 2018-12-02 - - - - - uriparser -- Multiple vulnerabilities - - - uriparser - 0.9.0 - - - - -

The upstream project reports:

-
-

* Fixed: Out-of-bounds write in uriComposeQuery* and uriComposeQueryEx* - Commit 864f5d4c127def386dd5cc926ad96934b297f04e - Thanks to Google Autofuzz team for the report!

-

* Fixed: Detect integer overflow in uriComposeQuery* and uriComposeQueryEx* - Commit f76275d4a91b28d687250525d3a0c5509bbd666f - Thanks to Google Autofuzz team for the report!

-

* Fixed: Protect uriResetUri* against acting on NULL input - Commit f58c25069cf4a986fe17a80c5b38687e31feb539

-
- - - - CVE-2018-19198 - CVE-2018-19199 - CVE-2018-19200 - https://github.com/uriparser/uriparser/blob/uriparser-0.9.0/ChangeLog - - - 2018-10-27 - 2018-12-02 - - - - - messagelib -- HTML email can open browser window automatically - - - messagelib - 18.08.3_2 - - - - -

Albert Astals Cid reports:

-
-

messagelib is the library used by KMail to display emails.

-

messagelib by default displays emails as plain text, but gives the user - an option to "Prefer HTML to plain text" in the settings and if that option - is not enabled there is way to enable HTML display when an email contains HTML.

-

Some HTML emails can trick messagelib into opening a new browser window when - displaying said email as HTML.

-

This happens even if the option to allow the HTML emails to access - remote servers is disabled in KMail settings.

-

This means that the owners of the servers referred in the email can see - in their access logs your IP address.

-
- - - - CVE-2018-19516 - https://www.kde.org/info/security/advisory-20181128-1.txt - - - 2018-11-28 - 2018-11-28 - - - - - payara -- Default typing issue in Jackson Databind - - - payara - 4.1.2.181.3 - 4.1.2.182 - 5.181.3 - 5.182 - - - - -
-

FasterXML jackson-databind before 2.8.11.1 and 2.9.x before - 2.9.5 allows unauthenticated remote code execution because of - an incomplete fix for the CVE-2017-7525 deserialization flaw. - This is exploitable by sending maliciously crafted JSON input - to the readValue method of the ObjectMapper, bypassing a - blacklist that is ineffective if the c3p0 libraries are - available in the classpath.

-
- - - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7489 - CVE-2018-7489 - - - 2018-02-26 - 2018-11-28 - - - - - payara -- Code execution via crafted PUT requests to JSPs - - - payara - 4.1.2.174 - - - - -
-

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP - PUTs enabled (e.g. via setting the readonly initialisation - parameter of the Default to false) it was possible to upload a - JSP file to the server via a specially crafted request. This - JSP could then be requested and any code it contained would be - executed by the server.

-
- - - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12615 - CVE-2017-12615 - - - 2017-08-07 - 2018-11-28 - - - - - payara -- Multiple vulnerabilities - - - payara - 4.1.2.173 - - - - -
-

Apache Commons FileUpload before 1.3.3 - DiskFileItem File Manipulation Remote Code Execution.

-
-
-

Vulnerability in the Oracle GlassFish Server component of - Oracle Fusion Middleware (subcomponent: Administration). - Supported versions that are affected are 3.0.1 and 3.1.2. - Easily exploitable vulnerability allows low privileged attacker - with logon to the infrastructure where Oracle GlassFish Server - executes to compromise Oracle GlassFish Server. Successful - attacks of this vulnerability can result in unauthorized read - access to a subset of Oracle GlassFish Server accessible data. - CVSS v3.0 Base Score 3.3 (Confidentiality impacts).

-
-
-

Vulnerability in the Oracle GlassFish Server component of Oracle - Fusion Middleware (subcomponent: Core). Supported versions that - are affected are 2.1.1, 3.0.1 and 3.1.2. Easily exploitable - vulnerability allows unauthenticated attacker with network access - via SMTP to compromise Oracle GlassFish Server. Successful - attacks require human interaction from a person other than the - attacker. Successful attacks of this vulnerability can result in - unauthorized update, insert or delete access to some of Oracle - GlassFish Server accessible data. CVSS v3.0 Base Score 4.3 - (Integrity impacts).

-
-
-

Vulnerability in the Oracle GlassFish Server component of - Oracle Fusion Middleware (subcomponent: Security). Supported - versions that are affected are 2.1.1, 3.0.1 and 3.1.2. - Easily exploitable vulnerability allows unauthenticated attacker - with network access via LDAP to compromise Oracle GlassFish Server. - Successful attacks of this vulnerability can result in unauthorized - update, insert or delete access to some of Oracle GlassFish Server - accessible data as well as unauthorized read access to a subset of - Oracle GlassFish Server accessible data and unauthorized ability - to cause a partial denial of service (partial DOS) of Oracle - GlassFish Server. CVSS v3.0 Base Score 7.3 (Confidentiality, - Integrity and Availability impacts).

-
-
-

Vulnerability in the Oracle GlassFish Server component of Oracle - Fusion Middleware (subcomponent: Security). Supported versions that - are affected are 2.1.1, 3.0.1 and 3.1.2. Easily exploitable - vulnerability allows unauthenticated attacker with network access - via HTTP to compromise Oracle GlassFish Server. Successful attacks - of this vulnerability can result in unauthorized update, insert or - delete access to some of Oracle GlassFish Server accessible data as - well as unauthorized read access to a subset of Oracle GlassFish - Server accessible data and unauthorized ability to cause a partial - denial of service (partial DOS) of Oracle GlassFish Server. - CVSS v3.0 Base Score 7.3 (Confidentiality, Integrity and - Availability impacts).

-
-
-

Vulnerability in the Oracle GlassFish Server component of Oracle - Fusion Middleware (subcomponent: Security). Supported versions that - are affected are 2.1.1, 3.0.1 and 3.1.2. Difficult to exploit - vulnerability allows unauthenticated attacker with network access - via multiple protocols to compromise Oracle GlassFish Server. While - the vulnerability is in Oracle GlassFish Server, attacks may - significantly impact additional products. Successful attacks of this - vulnerability can result in takeover of Oracle GlassFish Server. - CVSS v3.0 Base Score 9.0 (Confidentiality, Integrity and - Availability impacts).

-
- - - - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000031 - CVE-2016-1000031 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3239 - CVE-2017-3239 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3247 - CVE-2017-3247 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3249 - CVE-2017-3249 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3250 - CVE-2017-3250 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5528 - CVE-2016-5528 - - - 2016-06-16 - 2018-11-28 - - - - - Gitlab -- Multiple vulnerabilities - - - gitlab-ce - 11.5.011.5.1 - 11.4.011.4.8 - 011.3.11 - - - - -

Gitlab reports:

-
-

View Names of Private Groups

-

Persistent XSS in Environments

-

SSRF in Prometheus integration

-

Unauthorized Promotion of Milestones

-

Exposure of Confidential Issue Title

-

Persisent XSS in Markdown Fields via Mermaid Script

-

Persistent XSS in Markdown Fields via Unrecognized HTML Tags

-

Symlink Race Condition in Pages

-

Unauthorized Changes by Guest User in Issues

-

Unauthorized Comments on Locked Issues

-

Improper Enforcement of Token Scope

-

CRLF Injection in Project Mirroring

-

XSS in OAuth Authorization

-

SSRF in Webhooks

-

Send Email on Email Address Change

-

Workhorse Logs Contained Tokens

-

Unauthorized Publishing of Draft Comments

-

Guest Can Set Weight of a New Issue

-

Disclosure of Private Group's Members and Milestones

-

Persisent XSS in Operations

-

Reporter Can View Operations Page

-
- - - - https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/ - CVE-2018-19494 - CVE-2018-19493 - CVE-2018-19495 - CVE-2018-19496 - CVE-2018-19577 - CVE-2018-19573 - CVE-2018-19570 - CVE-2018-19572 - CVE-2018-19576 - CVE-2018-19575 - CVE-2018-19569 - CVE-2018-19585 - CVE-2018-19574 - CVE-2018-19571 - CVE-2018-19580 - CVE-2018-19583 - CVE-2018-19582 - CVE-2018-19581 - CVE-2018-19584 - CVE-2018-19579 - CVE-2018-19578 - - - 2018-11-28 - 2018-11-28 - - - - - samba -- multiple vulnerabilities - - - samba46 - 4.6.16 - - - samba47 - 4.7.12 - - - samba48 - 4.8.7 - - - samba49 - 4.9.3 - - - - -

The samba project reports:

-
-

All versions of Samba from 4.0.0 onwards are vulnerable to infinite - query recursion caused by CNAME loops. Any dns record can be added via - ldap by an unprivileged user using the ldbadd tool, so this is a - security issue.

-
-
-

When configured to accept smart-card authentication, Samba's KDC will call - talloc_free() twice on the same memory if the principal in a validly signed - certificate does not match the principal in the AS-REQ.

-
-
-

During the processing of an LDAP search before Samba's AD DC returns - the LDAP entries to the client, the entries are cached in a single - memory object with a maximum size of 256MB. When this size is - reached, the Samba process providing the LDAP service will follow the - NULL pointer, terminating the process.

-
-
-

During the processing of an DNS zone in the DNS management DCE/RPC server, - the internal DNS server or the Samba DLZ plugin for BIND9, if the - DSPROPERTY_ZONE_MASTER_SERVERS property or DSPROPERTY_ZONE_SCAVENGING_SERVERS - property is set, the server will follow a NULL pointer and terminate

-
-
-

A user in a Samba AD domain can crash the KDC when Samba is built in the - non-default MIT Kerberos configuration.

-
-
-

AD DC Configurations watching for bad passwords (to restrict brute forcing - of passwords) in a window of more than 3 minutes may not watch for bad - passwords at all.

-
- - - - https://www.samba.org/samba/security/CVE-2018-14629.html - CVE-2018-14629 - https://www.samba.org/samba/security/CVE-2018-16841.html - CVE-2018-16841 - https://www.samba.org/samba/security/CVE-2018-16851.html - CVE-2018-16851 - https://www.samba.org/samba/security/CVE-2018-16852.html - CVE-2018-16852 - https://www.samba.org/samba/security/CVE-2018-16853.html - CVE-2018-16853 - https://www.samba.org/samba/security/CVE-2018-16857.html - CVE-2018-16857 - - - 2018-08-14 - 2018-08-14 - - - - - php-imap -- imap_open allows to run arbitrary shell commands via mailbox parameter - - - php56-imap - 5.6.38_1 - - - php70-imap - * - - - php71-imap - * - - - php72-imap - * - - - php73-imap - * - - - - -

The PHP team reports:

-
-

imap_open allows to run arbitrary shell commands via mailbox parameter.

-
- - - - https://bugs.php.net/bug.php?id=77153 - - - 2018-10-23 - 2018-11-22 - 2018-11-22 - - - - - phpmailer -- Multiple vulnerability - - - phpmailer - 5.2.27 - - - phpmailer6 - 6.0.6 - - - - -

SO-AND-SO reports:

-
-

CVE-2018-19296:Fix potential object injection vulnerability.

-
- - - - https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.27 - https://github.com/PHPMailer/PHPMailer/releases/tag/v6.0.6 - CVE-2018-19296 - - - 2018-11-16 - 2018-11-21 - 2018-11-23 - - - - - Flash Player -- arbitrary code execution - - - linux-flashplayer - 31.0.0.153 - - - - -

Adobe reports:

-
-
    -
  • This update resolves a type confusion vulnerability that - could lead to arbitrary code execution (CVE-2018-15981).
    • -
-
- - - - CVE-2018-15981 - https://helpx.adobe.com/security/products/flash-player/apsb18-44.html - - - 2018-11-20 - 2018-11-20 - - - - - Gitlab -- Multiple vulnerabilities - - - gitlab-ce - 11.4.011.4.6 - 8.9.011.3.10 - - - - -

Gitlab reports:

-
-

Persistent XSS Autocompletion

-

Unauthorized service template creation

-
- - - - https://about.gitlab.com/2018/11/19/critical-security-release-gitlab-11-dot-4-dot-6-released/ - CVE-2018-18643 - CVE-2018-19359 - - - 2018-11-19 - 2018-11-20 - - - - - powerdns -- Multiple vulnerabilities - - - powerdns - 4.1.5 - - - - -

PowerDNS Team reports:

-
-

CVE-2018-10851: An issue has been found in PowerDNS Authoritative Server allowing - an authorized user to cause a memory leak by inserting a specially crafted record - in a zone under their control, then sending a DNS query for that record. The issue - is due to the fact that some memory is allocated before the parsing and is not - always properly released if the record is malformed. When the PowerDNS - Authoritative Server is run inside the guardian (--guardian), or inside a - supervisor like supervisord or systemd, an out-of-memory crash will lead to an - automatic restart, limiting the impact to a somewhat degraded service.

-

CVE-2018-14626: An issue has been found in PowerDNS Authoritative Server allowing - a remote user to craft a DNS query that will cause an answer without DNSSEC - records to be inserted into the packet cache and be returned to clients asking for - DNSSEC records, thus hiding the presence of DNSSEC signatures for a specific qname - and qtype. For a DNSSEC-signed domain, this means that DNSSEC validating clients - will consider the answer to be bogus until it expires from the packet cache, - leading to a denial of service.

-
- - - - https://doc.powerdns.com/authoritative/changelog/4.1.html - CVE-2018-10851 - CVE-2018-14626 - - - 2018-11-06 - 2018-11-19 - - - - - powerdns-recursor -- Multiple vulnerabilities - - - powerdns-recursor - 4.1.7 - - - powerdns-recursor40 - 4.0.9 - - - - -

powerdns Team reports:

-
-

CVE-2018-10851: An issue has been found in PowerDNS Recursor allowing - a malicious authoritative server to cause a memory leak by sending specially - crafted records. The issue is due to the fact that some memory is allocated - before the parsing and is not always properly released if the record is malformed. - When the PowerDNS Recursor is run inside a supervisor like supervisord or systemd, - an out-of-memory crash will lead to an automatic restart, limiting the impact to - a somewhat degraded service.

-

CVE-2018-14626: An issue has been found in PowerDNS Recursor allowing a remote - user to craft a DNS query that will cause an answer without DNSSEC records to be - inserted into the packet cache and be returned to clients asking for DNSSEC - records, thus hiding the presence of DNSSEC signatures for a specific qname and - qtype. For a DNSSEC-signed domain, this means that clients performing DNSSEC - validation by themselves might consider the answer to be bogus until it expires - from the packet cache, leading to a denial of service.

-

CVE-2018-14644: An issue has been found in PowerDNS Recursor where a remote attacker - sending a DNS query for a meta-type like OPT can lead to a zone being wrongly cached - as failing DNSSEC validation. It only arises if the parent zone is signed, and all - the authoritative servers for that parent zone answer with FORMERR to a query for at - least one of the meta-types. As a result, subsequent queries from clients requesting - DNSSEC validation will be answered with a ServFail.

-
- - - - https://doc.powerdns.com/recursor/changelog/4.1.html - CVE-2018-10851 - CVE-2018-14626 - CVE-2018-14644 - - - 2018-11-06 - 2018-11-17 - 2018-11-19 - - - - - asterisk -- Remote crash vulnerability DNS SRV and NAPTR lookups - - - asterisk15 - 15.6.1 - - - asterisk16 - 16.0.1 - - - - -

The Asterisk project reports:

-
-

There is a buffer overflow vulnerability in dns_srv - and dns_naptr functions of Asterisk that allows an attacker - to crash Asterisk via a specially crafted DNS SRV or NAPTR - response. The attackers request causes Asterisk to segfault - and crash.

-
- - - - https://downloads.asterisk.org/pub/security/AST-2018-010.html - - - 2018-10-23 - 2018-11-14 - - - - - Flash Player -- information disclosure - - - linux-flashplayer - 31.0.0.148 - - - - -

Adobe reports:

-
-
    -
  • This update resolves a out-of-bounds vulnerability that - could lead to information disclosure (CVE-2018-15978).
    • -
-
- - - - CVE-2018-15978 - https://helpx.adobe.com/security/products/flash-player/apsb18-39.html - - - 2018-11-13 - 2018-11-13 - - - - - OpenSSL -- timing vulnerability - - - openssl - 1.0.2p_2 - - - - -

The OpenSSL project reports:

-
-

Microarchitecture timing vulnerability in ECC scalar - multiplication. Severity: Low
- OpenSSL ECC scalar multiplication, used in e.g. ECDSA and ECDH, has - been shown to be vulnerable to a microarchitecture timing side channel - attack. An attacker with sufficient access to mount local timing - attacks during ECDSA signature generation could recover the private - key.

-
- - - - https://www.openssl.org/news/secadv/20181112.txt - CVE-2018-5407 - - - 2018-11-12 - 2018-11-12 - - - - - kio-extras -- HTML Thumbnailer automatic remote file access - - - kio-extras - 18.08.3_2 - - - - -

Albert Astals Cid reports:

-
-

Various KDE applications share a plugin system to create thumbnails - of various file types for displaying in file managers, file dialogs, etc. - kio-extras contains a thumbnailer plugin for HTML files. -

-

- The HTML thumbnailer was incorrectly accessing some content of - remote URLs listed in HTML files. This meant that the owners of the servers - referred in HTML files in your system could have seen in their access logs - your IP address every time the thumbnailer tried to create the thumbnail. -

-

- The HTML thumbnailer has been removed in upcoming KDE Applications 18.12.0 - because it was actually not creating thumbnails for files at all. -

-
- - - - CVE-2018-19120 - https://www.kde.org/info/security/advisory-20181012-1.txt - - - 2018-11-12 - 2018-11-12 - - - - - patch -- multiple vulnerabilities - - - patch - 2.7.6_1 - - - - -

NVD reports:

-
-

An issue was discovered in GNU patch through 2.7.6. There is a segmentation fault, associated with a NULL pointer dereference, leading to a denial of service in the intuit_diff_type function in pch.c, aka a "mangled rename" issue.

-
-
-

A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6.

-
-
-

GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITOR_PROGRAM invocation (using ed) can result in code execution. This attack appear to be exploitable via a patch file processed via the patch utility. This is similar to FreeBSD's CVE-2015-1418 however although they share a common ancestry the code bases have diverged over time.

-
- - - - CVE-2018-6951 - CVE-2018-6952 - CVE-2018-1000156 - https://savannah.gnu.org/bugs/?53132 - https://savannah.gnu.org/bugs/?53133 - https://savannah.gnu.org/bugs/?53566 - - - 2018-04-16 - 2018-11-11 - 2018-11-11 - - - - - lighttpd - use-after-free vulnerabilities - - - lighttpd - 1.4.51 - - - - -

Lighttpd Project reports:

-
-

Security fixes for Lighttpd:

-
    -

  • security: process headers after combining folded headers

    • -
-
- - - - https://www.lighttpd.net/2018/10/14/1.4.51/ - ports/232278 - - - 2018-08-26 - 2018-11-09 - - - - - PostgreSQL -- SQL injection in pg_upgrade and pg_dump - - - postgresql10-server - 10.6 - - - postgresql96-server - 9.6.11 - - - postgresql95-server - 9.5.15 - - - postgresql94-server - 9.4.20 - - - postgresql93-server - 9.3.25 - - - - -

The PostgreSQL project reports:

-
-

CVE-2018-16850: SQL injection in pg_upgrade and pg_dump, - via CREATE TRIGGER ... REFERENCING.

-

Using a purpose-crafted trigger definition, an attacker can run - arbitrary SQL statements with superuser privileges when a superuser - runs pg_upgrade on the database or during a pg_dump dump/restore - cycle. This attack requires a CREATE privilege on some non-temporary - schema or a TRIGGER privilege on a table. This is exploitable in the - default PostgreSQL configuration, where all users have CREATE - privilege on public schema.

-
- - - - https://www.postgresql.org/about/news/1905/ - CVE-2018-16850 - - - 2018-11-08 - 2018-11-08 - - - - - NGINX -- Multiple vulnerabilities - - - nginx - 1.14.1 - - - nginx-devel - 1.15.6 - - - - -

NGINX Team reports:

-
-

Two security issues were identified in nginx HTTP/2 implementation, - which might cause excessive memory consumption (CVE-2018-16843) - and CPU usage (CVE-2018-16844).

-

The issues affect nginx compiled with the ngx_http_v2_module (not - compiled by default) if the "http2" option of the "listen" directive is - used in a configuration file.

-

A security issue was identified in the ngx_http_mp4_module, which might - allow an attacker to cause infinite loop in a worker process, cause a - worker process crash, or might result in worker process memory - isclosure by using a specially crafted mp4 file (CVE-2018-16845).

-

The issue only affects nginx if it is built with the ngx_http_mp4_module - (the module is not built by default) and the "mp4" directive is used in - the configuration file. Further, the attack is only possible if an - attacker is able to trigger processing of a specially crafted mp4 file - with the ngx_http_mp4_module.

-
- - - - http://nginx.org/en/security_advisories.html - CVE-2018-16843 - CVE-2018-16844 - CVE-2018-16845 - - - 2018-11-06 - 2018-11-06 - - - - - gitea -- remote code exeution - - - gitea - 1.5.3 - - - - -

The Gitea project reports:

-
-

[This release] contains crit[i]cal security fix for vulnerability - that could potentially allow for authorized users to do remote code - ex[e]cution.

-
- - - - https://github.com/go-gitea/gitea/pull/5177 - https://github.com/go-gitea/gitea/pull/5196 - https://github.com/go-macaron/session/commit/084f1e5c1071f585902a7552b483cee04bc00a14 - - - 2018-10-25 - 2018-11-01 - - - - - curl -- multiple vulnerabilities - - - curl - 7.14.17.60.0 - - - - -

curl security problems:

-
-

CVE-2018-16839: SASL password overflow via integer overflow

-

libcurl contains a buffer overrun in the SASL authentication code.

-

The internal function Curl_auth_create_plain_message fails to - correctly verify that the passed in lengths for name and password - aren't too long, then calculates a buffer size to allocate.

-

On systems with a 32 bit size_t, the math to calculate the buffer size - triggers an integer overflow when the user name length exceeds 2GB - (2^31 bytes). This integer overflow usually causes a very small buffer - to actually get allocated instead of the intended very huge one, making - the use of that buffer end up in a heap buffer overflow.

-

This bug is very similar to CVE-2017-14618.

-

It affects curl 7.33.0 to 7.61.1.

-

CVE-2018-16840: use-after-free in handle close

-

libcurl contains a heap use-after-free flaw in code related to closing - an easy handle.

-

When closing and cleaning up an "easy" handle in the Curl_close() - function, the library code first frees a struct (without nulling the - pointer) and might then subsequently erroneously write to a struct - field within that already freed struct.

-

It affects curl 7.59.0 to 7.61.1.

-

CVE-2018-16842: warning message out-of-buffer read

-

curl contains a heap out of buffer read vulnerability.

-

The command line tool has a generic function for displaying warning - and informational messages to stderr for various situations. For - example if an unknown command line argument is used, or passed to it in - a "config" file.

-

This display function formats the output to wrap at 80 columns. The - wrap logic is however flawed, so if a single word in the message is - itself longer than 80 bytes the buffer arithmetic calculates the - remainder wrong and will end up reading behind the end of the buffer. - This could lead to information disclosure or crash.

-

This vulnerability could lead to a security issue if used in this or - similar situations:

-

1. a server somewhere uses the curl command line to run something

-

2. if it fails, it shows stderr to the user

-

3. the server takes user input for parts of its command line input

-

4. user provides something overly long that triggers this crash

-

5. the stderr output may now contain user memory contents that wasn't - meant to be available

-

It affects curl 7.14.1 to 7.61.1.

-
- - - - https://curl.haxx.se/docs/security.html - https://curl.haxx.se/docs/CVE-2018-16839.html - https://curl.haxx.se/docs/CVE-2018-16840.html - https://curl.haxx.se/docs/CVE-2018-16842.html - CVE-2018-16839 - CVE-2018-16840 - CVE-2018-16842 - - - 2018-10-31 - 2018-11-01 - - - - - Gitlab -- SSRF in Kubernetes integration - - - gitlab-ce - 11.4.011.4.4 - 11.3.011.3.9 - 11.0.011.2.8 - - - - -

SO-AND-SO reports:

-
-

SSRF in Kubernetes integration

-
- - - - https://about.gitlab.com/2018/11/01/critical-security-release-gitlab-11-dot-4-dot-4-released/ - CVE-2018-18843 - - - 2018-11-01 - 2018-11-01 - - - - - Loofah -- XSS vulnerability - - - rubygem-loofah - 2.2.3 - - - - -

GitHub issue:

-
-

This issue has been created for public disclosure of an XSS - vulnerability that was responsibly reported (independently) by Shubham - Pathak and @yasinS (Yasin Soliman).

-

In the Loofah gem, through v2.2.2, unsanitized JavaScript may occur in - sanitized output when a crafted SVG element is republished.

-
- - - - https://github.com/flavorjones/loofah/releases - https://github.com/flavorjones/loofah/issues/154 - CVE-2018-16468 - - - 2018-10-30 - 2018-11-01 - - - - - Gitlab -- multiple vulnerabilities - - - gitlab-ce - 11.4.011.4.3 - 11.3.011.3.8 - 5.3.011.2.7 - - - - -

Gitlab reports:

-
-

RCE in Gitlab Wiki API

-

SSRF in Hipchat integration

-

Cleartext storage of personal access tokens

-

Information exposure through stack trace error message

-

Persistent XSS autocomplete

-

Information exposure in stored browser history

-

Information exposure when replying to issues through email

-

Persistent XSS in License Management and Security Reports

-

Metrics information disclosure in Prometheus integration

-

Unauthorized changes to a protected branch's access levels

-
- - - - https://about.gitlab.com/2018/10/29/security-release-gitlab-11-dot-4-dot-3-released/ - CVE-2018-18649 - CVE-2018-18646 - CVE-2018-18641 - CVE-2018-18648 - CVE-2018-18643 - CVE-2018-18640 - CVE-2018-18645 - CVE-2018-18642 - CVE-2018-18644 - CVE-2018-18647 - - - 2018-10-29 - 2018-10-29 - - - - - OpenSSL -- Multiple vulnerabilities in 1.1 branch - - - openssl-devel - 1.1.0i_1 - - - openssl111 - 1.1.1_2 - - - libressl - 2.8.02.8.3 - - - libressl-devel - 2.8.02.8.3 - - - - -

The OpenSSL project reports:

-
-

Timing vulnerability in ECDSA signature generation - (CVE-2018-0735): The OpenSSL ECDSA signature algorithm has been - shown to be vulnerable to a timing side channel attack. An - attacker could use variations in the signing algorithm to - recover the private key (Low).

-

Timing vulnerability in DSA signature generation (CVE-2018-0734): - Avoid a timing attack that leaks information via a side channel - that triggers when a BN is resized. Increasing the size of the - BNs prior to doing anything with them suppresses the attack (Low). -

-
- - - - https://www.openssl.org/news/secadv/20181029.txt - https://github.com/openssl/openssl/commit/8abfe72e - CVE-2018-0735 - CVE-2018-0734 - - - 2018-10-29 - 2018-10-29 - 2018-11-10 - - - - - liveMedia -- potential remote code execution - - - liveMedia - 2018.10.17,2 - - - - -

Talos reports:

-
-

An exploitable code execution vulnerability exists in the HTTP packet-parsing functionality - of the LIVE555 RTSP server library. A specially crafted packet can cause a stack-based buffer - overflow, resulting in code execution. An attacker can send a packet to trigger this vulnerability.

-
- - - - CVE-2018-4013 - https://talosintelligence.com/vulnerability_reports/TALOS-2018-0684 - http://lists.live555.com/pipermail/live-devel/2018-October/021071.html - - - 2018-10-18 - 2018-10-28 - - - - - mini_httpd -- disclose arbitrary files is some circumstances - - - mini_httpd - 1.30 - - - - -

Jef Poskanzer reports:

-
-

Prior versions allowed remote users to read arbitrary files in some circumstances.

-
- - - - http://acme.com/updates/archive/211.html - - - 2018-10-26 - 2018-10-26 - - - - - salt -- multiple vulnerabilities - - - py27-salt - py32-salt - py33-salt - py34-salt - py35-salt - py36-salt - py37-salt - 2017.7.8 - 2018.3.02018.3.3 - - - - -

SaltStack reports:

-
-

Remote command execution and incorrect access control when using - salt-api.

-

Directory traversal vulnerability when using salt-api. Allows an - attacker to determine what files exist on a server when querying - /run or /events.

-
- - - - CVE-2018-15751 - CVE-2018-15750 - https://docs.saltstack.com/en/latest/topics/releases/2018.3.3.html - https://docs.saltstack.com/en/2017.7/topics/releases/2017.7.8.html - - - 2018-10-24 - 2018-10-27 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 63.0_1,1 - - - waterfox - 56.2.5 - - - seamonkey - linux-seamonkey - 2.53.0 - - - firefox-esr - 60.3.0,1 - - - linux-firefox - 60.3.0,2 - - - libxul - thunderbird - linux-thunderbird - 60.3.0 - - - - -

Mozilla Foundation reports:

-
-

CVE-2018-12391: HTTP Live Stream audio data is accessible cross-origin

-

CVE-2018-12392: Crash with nested event loops

-

CVE-2018-12393: Integer overflow during Unicode conversion while loading JavaScript

-

CVE-2018-12395: WebExtension bypass of domain restrictions through header rewriting

-

CVE-2018-12396: WebExtension content scripts can execute in disallowed contexts

-

CVE-2018-12397:

-

CVE-2018-12398: CSP bypass through stylesheet injection in resource URIs

-

CVE-2018-12399: Spoofing of protocol registration notification bar

-

CVE-2018-12400: Favicons are cached in private browsing mode on Firefox for Android

-

CVE-2018-12401: DOS attack through special resource URI parsing

-

CVE-2018-12402: SameSite cookies leak when pages are explicitly saved

-

CVE-2018-12403: Mixed content warning is not displayed when HTTPS page loads a favicon over HTTP

-

CVE-2018-12388: Memory safety bugs fixed in Firefox 63

-

CVE-2018-12390: Memory safety bugs fixed in Firefox 63 and Firefox ESR 60.3

-
- - - - CVE-2018-12388 - CVE-2018-12390 - CVE-2018-12391 - CVE-2018-12392 - CVE-2018-12393 - CVE-2018-12395 - CVE-2018-12396 - CVE-2018-12397 - CVE-2018-12398 - CVE-2018-12399 - CVE-2018-12400 - CVE-2018-12401 - CVE-2018-12402 - CVE-2018-12403 - https://www.mozilla.org/en-US/security/advisories/mfsa2018-26/ - https://www.mozilla.org/en-US/security/advisories/mfsa2018-27/ - - - 2018-10-23 - 2018-10-23 - 2019-07-23 - - - - - drupal -- Drupal Core - Multiple Vulnerabilities - - - drupal7 - 7.60 - - - drupal8 - 8.6.2 - - - - -

Drupal Security Team reports:

-
-

he path module allows users with the 'administer paths' to create pretty URLs - for content. In certain circumstances the user can enter a particular path that - triggers an open redirect to a malicious url.The issue is mitigated by the fact - that the user needs the administer paths permission to exploit.

-

When sending email some variables were not being sanitized for shell arguments, - which could lead to remote code execution.

-
- - - - https://www.drupal.org/SA-CORE-2018-006 - - - 2018-10-17 - 2018-10-22 - 2018-11-04 - - - - - ruby -- multiple vulnerabilities - - - ruby - 2.3.0,12.3.8,1 - 2.4.0,12.4.5,1 - 2.5.0,12.5.2,1 - - - - -

Ruby news:

-
-

CVE-2018-16395: OpenSSL::X509::Name equality check does not work - correctly

-

An instance of OpenSSL::X509::Name contains entities such as CN, C and - so on. Some two instances of OpenSSL::X509::Name are equal only when - all entities are exactly equal. However, there is a bug that the - equality check is not correct if the value of an entity of the - argument (right-hand side) starts with the value of the receiver - (left-hand side). So, if a malicious X.509 certificate is passed to - compare with an existing certificate, there is a possibility to be - judged incorrectly that they are equal.

-

CVE-2018-16396: Tainted flags are not propagated in Array#pack and - String#unpack with some directives

-

Array#pack method converts the receiver's contents into a string with - specified format. If the receiver contains some tainted objects, the - returned string also should be tainted. String#unpack method which - converts the receiver into an array also should propagate its tainted - flag to the objects contained in the returned array. But, with B, b, H - and h directives, the tainted flags are not propagated. So, if a script - processes unreliable inputs by Array#pack and/or String#unpack with - these directives and checks the reliability with tainted flags, the - check might be wrong.

-
- - - - https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-5-2-released/ - https://www.ruby-lang.org/en/news/2018/10/17/openssl-x509-name-equality-check-does-not-work-correctly-cve-2018-16395/ - https://www.ruby-lang.org/en/news/2018/10/17/not-propagated-taint-flag-in-some-formats-of-pack-cve-2018-16396/ - CVE-2018-16395 - CVE-2018-16396 - - - 2018-10-17 - 2018-10-20 - - - - - MySQL -- multiple vulnerabilities - - - mariadb55-server - 5.5.62 - - - mariadb100-server - 10.0.37 - - - mariadb101-server - 10.1.37 - - - mariadb102-server - 10.2.19 - - - mariadb103-server - 10.3.11 - - - mysql55-server - 5.5.62 - - - mysql56-server - 5.6.42 - - - mysql57-server - 5.7.24 - - - mysql80-server - 8.0.13 - - - percona55-server - 5.5.62 - - - percona56-server - 5.6.42 - - - percona57-server - 5.7.24 - - - - -

Oracle reports:

-
-

Please reference CVE/URL list for details

-
- - - - https://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html#AppendixMSQL - CVE-2016-9843 - CVE-2018-3155 - CVE-2018-3143 - CVE-2018-3156 - CVE-2018-3251 - CVE-2018-3182 - CVE-2018-3137 - CVE-2018-3203 - CVE-2018-3133 - CVE-2018-3145 - CVE-2018-3144 - CVE-2018-3185 - CVE-2018-3195 - CVE-2018-3247 - CVE-2018-3187 - CVE-2018-3174 - CVE-2018-3171 - CVE-2018-3277 - CVE-2018-3162 - CVE-2018-3173 - CVE-2018-3200 - CVE-2018-3170 - CVE-2018-3212 - CVE-2018-3280 - CVE-2018-3186 - CVE-2018-3161 - CVE-2018-3278 - CVE-2018-3279 - CVE-2018-3282 - CVE-2018-3284 - CVE-2018-3283 - CVE-2018-3286 - - - 2018-10-16 - 2018-10-20 - 2018-11-08 - - - - - matomo -- XSS vulnerability - - - matomo - 3.6.1 - - - - -

Matomo reports:

-
-

Several XSS issues have been fixed thanks to the great work of security - researchers who responsible disclosed issues to us.

-
- - - - https://matomo.org/changelog/matomo-3-6-1/ - - - 2018-10-18 - 2018-10-19 - - - - - libssh -- authentication bypass vulnerability - - - libssh - 0.60.7.6 - 0.80.8.4 - - - - -

gladiac reports:

-
-

libssh versions 0.6 and above have an authentication bypass - vulnerability in the server code. By presenting the server an - SSH2_MSG_USERAUTH_SUCCESS message in place of the - SSH2_MSG_USERAUTH_REQUEST message which the server would expect to - initiate authentication, the attacker could successfully authentciate - without any credentials.

-
- - - - https://www.libssh.org/2018/10/16/libssh-0-8-4-and-0-7-6-security-and-bugfix-release/ - CVE-2018-10933 - - - 2018-10-16 - 2018-10-17 - - - - - Libgit2 -- multiple vulnerabilities - - - libgit2 - 0.27.5 - - - - -

The Git community reports:

-
-

Multiple vulnerabilities.

-
- - - - https://github.com/libgit2/libgit2/releases/tag/v0.27.5 - CVE-2018-17456 - - - 2018-10-05 - 2018-10-15 - - - - - Memory leak bug in Toxcore - - - toxcore - 0.2.8,1 - - - - -

The Tox project blog reports:

-
-

A memory leak bug was discovered in Toxcore that can be triggered remotely to -exhaust one’s system memory, resulting in a denial of service attack. -The bug is present in the TCP Server module of Toxcore and therefore it -affects mostly bootstrap nodes. Regular Tox clients generally have the -TCP Server functionality disabled by default, leaving them unaffected.

-
- - - - https://blog.tox.chat/2018/10/memory-leak-bug-and-new-toxcore-release-fixing-it/ - - - 2018-09-29 - 2018-10-11 - - - - - gitea -- multiple vulnerabilities - - - gitea - 1.5.2 - - - - -

Gitea project reports:

-
-

CSRF Vulnerability on API.

-

Enforce token on api routes.

-
- - - - https://github.com/go-gitea/gitea/issues/4357 - ttps://github.com/go-gitea/gitea/pull/4840 - - - 2018-10-01 - 2018-10-11 - - - - - jenkins -- multiple vulnerabilities - - - jenkins - 2.146 - - - jenkins-lts - 2.138.2 - - - - -

Jenkins Security Advisory:

-
-

Description

-
(Low) SECURITY-867
-

Path traversal vulnerability in Stapler allowed accessing internal data

-
(Medium) SECURITY-1074
-

Arbitrary file write vulnerability using file parameter definitions

-
(Medium) SECURITY-1129
-

Reflected XSS vulnerability

-
(Medium) SECURITY-1162
-

Ephemeral user record was created on some invalid authentication attempts

-
(Medium) SECURITY-1128
-

Ephemeral user record creation

-
(Medium) SECURITY-1158
-

Session fixation vulnerability on user signup

-
(Medium) SECURITY-765
-

Failures to process form submission data could result in secrets being displayed or written to logs

-
- - - - https://jenkins.io/security/advisory/2018-10-10/ - - - 2018-10-10 - 2018-10-11 - - - - - tinc -- Buffer overflow - - - tinc - 1.0.35 - - - tinc-devel - 1.1pre17 - - - - -

tinc-vpn.org reports:

-
-

The authentication protocol allows an oracle attack that could -potentially be exploited.

-

If a man-in-the-middle has intercepted the TCP connection it -might be able to force plaintext UDP packets between two nodes for up to -a PingInterval period.

-
- - - - https://www.tinc-vpn.org/git/browse?p=tinc;a=commit;h=d3297fbd3b8c8c8a4661f5bbf89aca5cacba8b5a - https://www.tinc-vpn.org/git/browse?p=tinc;a=commit;h=e97943b7cc9c851ae36f5a41e2b6102faa74193f - CVE-2018-16737 - CVE-2018-16738 - CVE-2018-16758 - - - 2018-10-08 - 2018-10-09 - - - - - Gitlab -- multiple vulnerabilities - - - gitlab-ce - 11.3.011.3.4 - 11.2.011.2.5 - 10.2.011.1.8 - - - - -

Gitlab reports:

-
-

Merge request information disclosure

-

Private project namespace information disclosure

-

Gitlab Flavored Markdown API information disclosure

-
- - - - https://about.gitlab.com/2018/10/05/critical-security-release-11-3-4/ - CVE-2018-17939 - CVE-2018-17976 - CVE-2018-17975 - - - 2018-10-05 - 2018-10-05 - - - - - clamav -- multiple vulnerabilities - - - clamav - 0.100.2 - - - - -

Joel Esler reports:

-
-
    -
  • CVE-2018-15378: -
      -
    • Vulnerability in ClamAV's MEW unpacking feature that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.
      • -
    • Reported by Secunia Research at Flexera.
      • -
    -
    • -
  • Fix for a 2-byte buffer over-read bug in ClamAV&s PDF parsing code. -
      -
    • Reported by Alex Gaynor.
      • -
    -
    • -
  • CVE-2018-14680: -
      -
    • An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. It does not reject blank CHM filenames.
      • -
    -
    • -
  • CVE-2018-14681: -
      -
    • An issue was discovered in kwajd_read_headers in mspack/kwajd.c in libmspack before 0.7alpha. Bad KWAJ file header extensions could cause a one or two byte overwrite.
      • -
    -
    • -
  • CVE-2018-14682: -
      -
    • An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the TOLOWER() macro for CHM decompression. Additionally, 0.100.2 reverted 0.100.1's patch for CVE-2018-14679, and applied libmspack's version of the fix in its place.
      • -
    -
    • -
-
- - - - https://blog.clamav.net/2018/10/clamav-01002-has-been-released.html - CVE-2018-15378 - CVE-2018-14680 - CVE-2018-14681 - CVE-2018-14682 - - - 2018-10-03 - 2018-10-03 - 2020-06-24 - - - - - Django -- password hash disclosure - - - py34-django21 - py35-django21 - py36-django21 - py37-django21 - 2.1.2 - - - - -

Django release notes:

-
-

CVE-2018-16984: Password hash disclosure to "view only" admin users

-

If an admin user has the change permission to the user model, only part - of the password hash is displayed in the change form. Admin users with the - view (but not change) permission to the user model were displayed the entire - hash. While it's typically infeasible to reverse a strong password hash, if - your site uses weaker password hashing algorithms such as MD5 or SHA1, it - could be a problem.

-
- - - - https://docs.djangoproject.com/en/2.1/releases/2.1.2/ - CVE-2018-16984 - - - 2018-10-02 - 2018-10-03 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 62.0.3,1 - - - waterfox - 56.2.4 - - - seamonkey - linux-seamonkey - 2.53.0 - - - firefox-esr - 60.2.2,1 - - - linux-firefox - 60.2.2,2 - - - libxul - thunderbird - linux-thunderbird - 60.2.2 - - - - -

Mozilla Foundation reports:

-
-

CVE-2018-12386: Type confusion in JavaScript

-

A vulnerability in register allocation in JavaScript can - lead to type confusion, allowing for an arbitrary read and - write. This leads to remote code execution inside the - sandboxed content process when triggered.

-

CVE-2018-12387:

-

A vulnerability where the JavaScript JIT compiler inlines - Array.prototype.push with multiple arguments that results - in the stack pointer being off by 8 bytes after a - bailout. This leaks a memory address to the calling - function which can be used as part of an exploit inside - the sandboxed content process.

-
- - - - CVE-2018-12386 - CVE-2018-12387 - https://www.mozilla.org/en-US/security/advisories/mfsa2018-24/ - - - 2018-10-02 - 2018-10-02 - 2019-07-23 - - - - - Gitlab -- multiple vulnerabilities - - - gitlab-ce - 11.3.011.3.1 - 11.2.011.2.4 - 7.6.011.1.7 - - - - -

Gitlab reports:

-
-

SSRF GCP access token disclosure

-

Persistent XSS on issue details

-

Diff formatter DoS in Sidekiq jobs

-

Confidential information disclosure in events API endpoint

-

validate_localhost function in url_blocker.rb could be bypassed

-

Slack integration CSRF Oauth2

-

GRPC::Unknown logging token disclosure

-

IDOR merge request approvals

-

Persistent XSS package.json

-

Persistent XSS merge request project import

-
- - - - https://about.gitlab.com/2018/10/01/security-release-gitlab-11-dot-3-dot-1-released/ - CVE-2018-17450 - CVE-2018-17454 - CVE-2018-15472 - CVE-2018-17449 - CVE-2018-17452 - CVE-2018-17451 - CVE-2018-17453 - CVE-2018-17455 - CVE-2018-17537 - CVE-2018-17536 - - - 2018-10-01 - 2018-10-01 - - - - - pango -- remote DoS vulnerability - - - pango - 1.42.4 - - - - -
-

libpango in Pango 1.40.8 through 1.42.3, as used in hexchat and other products, allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted text with invalid Unicode sequences.

-
- - - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15120 - https://www.exploit-db.com/exploits/45263/ - https://mail.gnome.org/archives/distributor-list/2018-August/msg00001.html - https://github.com/GNOME/pango/commit/71aaeaf020340412b8d012fe23a556c0420eda5f - CVE-2018-15120 - - - 2018-08-06 - 2018-10-01 - - - - - Serendipity -- multiple vulnerabilities - - - serendipity - 2.1.4 - - - - -

Serendipity reports:

-
-

Security: Fix XSS for pagination, when multi-category selection is used.

-
- - - - https://blog.s9y.org/archives/280-Serendipity-2.1.4-and-2.2.1-alpha1-released.html - - - 2018-09-20 - 2018-09-30 - - - - - bitcoin -- Denial of Service and Possible Mining Inflation - - - bitcoin - bitcoin-daemon - 0.16.3 - - - - -

Bitcoin Core reports:

-
-

CVE-2018-17144, a fix for which was released on September 18th in Bitcoin Core versions 0.16.3 and 0.17.0rc4, includes both a Denial of Service component and a critical inflation vulnerability. It was originally reported to several developers working on Bitcoin Core, as well as projects supporting other cryptocurrencies, including ABC and Unlimited on September 17th as a Denial of Service bug only, however we quickly determined that the issue was also an inflation vulnerability with the same root cause and fix.

-
- - - - https://bitcoincore.org/en/2018/09/20/notice/ - CVE-2018-17144 - - - 2018-09-17 - 2018-09-29 - - - - - spamassassin -- multiple vulnerabilities - - - spamassassin - 3.4.2 - - - - -

the Apache Spamassassin project reports:

-
-

In Apache SpamAssassin, using HTML::Parser, we setup an object and - hook into the begin and end tag event handlers In both cases, the - "open" event is immediately followed by a "close" event - even if - the tag *does not* close in the HTML being parsed.

-

Because of this, we are missing the "text" event to deal with - the object normally. This can cause carefully crafted emails that - might take more scan time than expected leading to a Denial of - Service.

-

Fix a reliance on "." in @INC in one configuration script. Whether - this can be exploited in any way is uncertain.

-

Fix a potential Remote Code Execution bug with the PDFInfo plugin. - Thanks to cPanel Security Team for their report of this issue.

-

Fourth, this release fixes a local user code injection in the - meta rule syntax. Thanks again to cPanel Security Team for their - report of this issue.

-
- - - - https://seclists.org/oss-sec/2018/q3/242 - CVE-2017-15705 - CVE-2016-1238 - CVE-2018-11780 - CVE-2018-11781 - - - 2018-09-16 - 2018-09-26 - - - - - wesnoth -- Code Injection vulnerability - - - wesnoth - 1.7.01.14.4,1 - - - - -

shadowm reports:

-
-

A severe bug was found in the game client which could allow a malicious user to execute arbitrary code through the Lua engine by using specially-crafted code in add-ons, saves, replays, or networked games. This issue affects all platforms and all existing releases since Wesnoth version 1.7.0. - Users of all previous version should upgrade immediately.

-
- - - - CVE-2018-1999023 - https://gist.github.com/shikadiqueen/45951ddc981cf8e0d9a74e4b30400380 - - - 2018-07-14 - 2018-09-26 - - - - - Apache -- Denial of service vulnerability in HTTP/2 - - - apache24 - 2.4.35 - - - - -

The Apache httpd project reports:

-
-

low: DoS for HTTP/2 connections by continuous SETTINGS

-

By sending continous SETTINGS frames of maximum size an ongoing - HTTP/2 connection could be kept busy and would never time out. This - can be abused for a DoS on the server. This only affect a server - that has enabled the h2 protocol.

-
- - - - http://httpd.apache.org/security/vulnerabilities_24.html - CVE-2018-11763 - - - 2018-09-25 - 2018-09-26 - - - - - mantis -- XSS vulnerability - - - mantis-php56 - mantis-php70 - mantis-php71 - mantis-php72 - 2.17.1,1 - - - - -

Brian Carpenter reports:

-
-

Reflected XSS in view_filters_page.php via core/filter_form_api.php

-
- - - - CVE-2018-16514 - - - 2018-09-03 - 2018-09-25 - - - - - smart_proxy_dynflow -- authentication bypass vulnerability - - - rubygem-smart_proxy_dynflow - 0.2.1 - - - - -

MITRE reports:

-
-

An authentication bypass flaw was found in the smart_proxy_dynflow - component used by Foreman. A malicious attacker can use this flaw to - remotely execute arbitrary commands on machines managed by vulnerable - Foreman instances, in a highly privileged context.

-
- - - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-14643 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14643 - CVE-2018-14643 - - - 2018-09-20 - 2018-09-22 - - - - - mediawiki -- multiple vulnerabilities - - - mediawiki127 - 1.27.5 - - - mediawiki129 - 1.29.3 - - - mediawiki130 - 1.30.1 - - - mediawiki131 - 1.31.1 - - - - -

Mediawiki reports:

-
-

Security fixes:

-

T169545: $wgRateLimits entry for 'user' overrides 'newbie'.

-

T194605: BotPasswords can bypass CentralAuth's account lock.

-

T187638: When a log event is (partially) hidden Special:Redirect/logid - can link to the incorrect log and reveal hidden

-

T193237: Special:BotPasswords should require reauthenticate.

-
- - - - CVE-2018-0503 - CVE-2018-0505 - CVE-2018-0504 - https://lists.wikimedia.org/pipermail/mediawiki-announce/2018-September/000223.html - - - 2018-08-29 - 2018-09-22 - - - - - firefox -- Crash in TransportSecurityInfo due to cached data - - - firefox - 62.0.2,1 - - - firefox-esr - 60.2.1,1 - - - - -

The Mozilla Foundation reports:

-
-

A potentially exploitable crash in TransportSecurityInfo used for SSL can be triggered by data stored in the local cache in the user profile directory. This issue is only exploitable in combination with another vulnerability allowing an attacker to write data into the local cache or from locally installed malware. This issue also triggers a non-exploitable startup crash for users switching between the Nightly and Release versions of Firefox if the same profile is used.

-
- - - - CVE-2018-12385 - https://www.mozilla.org/security/advisories/mfsa2018-22/ - - - 2018-09-21 - 2018-09-21 - - - - - asterisk -- Remote crash vulnerability in HTTP websocket upgrade - - - asterisk13 - 13.23.1 - - - asterisk15 - 15.6.1 - - - - -

The Asterisk project reports:

-
-

There is a stack overflow vulnerability in the - res_http_websocket.so module of Asterisk that allows an - attacker to crash Asterisk via a specially crafted HTTP - request to upgrade the connection to a websocket. The - attackers request causes Asterisk to run out of stack - space and crash.

-

As a workaround disable HTTP websocket access by not - loading the res_http_websocket.so module.

-
- - - - https://downloads.asterisk.org/pub/security/AST-2018-009.html - CVE-2018-17281 - - - 2018-08-16 - 2018-09-21 - - - - - moodle -- multiple vulnerabilities - - - moodle31 - 3.1.14 - - - moodle33 - 3.3.8 - - - moodle34 - 3.4.5 - - - moodle35 - 3.5.2 - - - - -

moodle reports:

-
-

Moodle XML import of ddwtos could lead to intentional remote code - execution

-

QuickForm library remote code vulnerability (upstream)

-

Boost theme - blog search GET parameter insufficiently filtered

-
- - - - CVE-2018-14630 - CVE-2018-1999022 - CVE-2018-14631 - https://moodle.org/mod/forum/discuss.php?d=376023 - - - 2018-09-05 - 2018-09-18 - - - - - joomla3 -- vulnerabilitiesw - - - joomla3 - 3.8.12 - - - - -

JSST reports: Multiple low-priority Vulnerabilities

-
-

Inadequate checks in the InputFilter class could allow specifically prepared PHAR files to pass the upload filter.

-
-
-

Inadequate output filtering on the user profile page could lead to a stored XSS attack.

-
-
-

Inadequate checks regarding disabled fields can lead to an ACL violation.

-
- - - - CVE-2018-15860 - CVE-2018-15881 - CVE-2018-15882 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15880 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15881 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15882 - https://developer.joomla.org/security-centre/743-20180801-core-hardening-the-inputfilter-for-phar-stubs.html - https://developer.joomla.org/security-centre/744-20180802-core-stored-xss-vulnerability-in-the-frontend-profile.html - https://developer.joomla.org/security-centre/745-20180803-core-acl-violation-in-custom-fields.html - - - 2018-08-23 - 2018-09-15 - - - - - mybb -- vulnerabilities - - - mybb - 1.8.19 - - - - -

mybb Team reports:

-
-

High risk: Email field SQL Injection.

-

Medium risk: Video MyCode Persistent XSS in Visual Editor.

-

Low risk: Insufficient permission check in User CP’s attachment management.

-

Low risk: Insufficient email address verification.

-
- - - - https://blog.mybb.com/2018/09/11/mybb-1-8-19-released-security-maintenance-release/ - - - 2018-09-11 - 2018-09-13 - - - - - FreeBSD -- Improper ELF header parsing - - - FreeBSD-kernel - 11.211.2_3 - 11.111.1_14 - 10.410.4_12 - - - - -

Problem Description:

-

Insufficient validation was performed in the ELF header - parser, and malformed or otherwise invalid ELF binaries - were not rejected as they should be.

-

Impact:

-

Execution of a malicious ELF binary may result in a - kernel crash or may disclose kernel memory.

- - - - CVE-2018-6924 - SA-18:12.elf - - - 2018-09-12 - 2018-09-12 - - - - - Containous Traefik -- exposes the configuration and secret - - - traefik - 1.6.6 - - - - -

MITRE reports:

-
-

Containous Traefik 1.6.x before 1.6.6, when --api is used, exposes the - configuration and secret if authentication is missing and the API's port - is publicly reachable.

-
- - - - CVE-2018-15598 - https://github.com/containous/traefik/pull/3790 - https://github.com/containous/traefik/releases/tag/v1.6.6 - - - 2018-08-20 - 2018-09-11 - - - - - Flash Player -- information disclosure - - - linux-flashplayer - 31.0.0.108 - - - - -

Adobe reports:

-
-
    -
  • This update resolves a privilege escalation vulnerability that - could lead to information disclosure (CVE-2018-15967).
    • -
-
- - - - CVE-2018-15967 - https://helpx.adobe.com/security/products/flash-player/apsb18-31.html - - - 2018-09-11 - 2018-09-11 - - - - - Plex Media Server -- Information Disclosure Vulnerability - - - plexmediaserver - plexmediaserver-plexpass - 1.13.5.5332 - - - - -

Chris reports:

-
-

The XML parsing engine for Plex Media Server's SSDP/UPNP - functionality is vulnerable to an XML External Entity - Processing (XXE) attack. Unauthenticated attackers on the same LAN can - use this vulnerability to:

-
    -
  • Access arbitrary files from the filesystem with the same permission as - the user account running Plex.
    • -
  • Initiate SMB connections to capture NetNTLM challenge/response and - crack to clear-text password.
    • -
  • Initiate SMB connections to relay NetNTLM challenge/response and - achieve Remote Command Execution in Windows domains.
    • -
-
- - - - https://seclists.org/fulldisclosure/2018/Aug/1 - CVE-2018-13415 - - - 2018-08-01 - 2018-09-11 - - - - - X11 Session -- SDDM allows unauthorised unlocking - - - sddm - 0.17.0_1 - - - - -

MITRE reports:

-
-

An issue was discovered in SDDM through 0.17.0. If configured with ReuseSession=true, the password is not checked for users with an already existing session. Any user with access to the system D-Bus can therefore unlock any graphical session.

-
-

The default configuration of SDDM on FreeBSD is not affected, since it has ReuseSession=false.

- - - - https://www.suse.com/security/cve/CVE-2018-14345/ - CVE-2018-14345 - - - 2018-08-13 - 2018-09-11 - - - - - mybb -- vulnerabilities - - - mybb - 1.8.18 - - - - -

mybb Team reports:

-
-

High risk: Image MyCode “alt” attribute persistent XSS.

-

Medium risk: RSS Atom 1.0 item title persistent XSS.

-
- - - - https://blog.mybb.com/2018/08/22/mybb-1-8-18-released-security-maintenance-release/ - - - 2018-08-22 - 2018-09-11 - - - - - Information disclosure - Gitea leaks email addresses - - - gitea - 1.5.1 - - - - -

The Gitea project reports:

-
-

[Privacy] Gitea leaks hidden email addresses #4417

-

A fix has been implemented in Gitea 1.5.1.

-
- - - - https://github.com/go-gitea/gitea/issues/4417 - https://github.com/go-gitea/gitea/pull/4784 - - - 2018-07-10 - 2018-09-05 - - - - - links -- denial of service - - - links - 2.16,1 - - - - -

NIST reports:

-
-

The put_chars function in html_r.c in Twibright Links 2.14 allows - remote attackers to cause a denial of service (buffer over-read) - via a crafted HTML file.

-
- - - - https://nvd.nist.gov/vuln/detail/CVE-2017-11114 - CVE-2017-11114 - - - 2017-07-31 - 2018-08-23 - - - - - curl -- password overflow vulnerability - - - curl - 7.15.47.61.1 - - - linux-c7-curl - 7.29.0_6 - - - - -

curl security problems:

-
-

CVE-2018-14618: NTLM password overflow via integer overflow

-

The internal function Curl_ntlm_core_mk_nt_hash multiplies the length - of the password by two (SUM) to figure out how large temporary storage - area to allocate from the heap.

-

The length value is then subsequently used to iterate over the - password and generate output into the allocated storage buffer. On - systems with a 32 bit size_t, the math to calculate SUM triggers an - integer overflow when the password length exceeds 2GB (2^31 bytes). - This integer overflow usually causes a very small buffer to actually - get allocated instead of the intended very huge one, making the use of - that buffer end up in a heap buffer overflow.

-

This bug is almost identical to CVE-2017-8816.

-
- - - - https://curl.haxx.se/docs/security.html - https://curl.haxx.se/docs/CVE-2018-14618.html - CVE-2018-14618 - - - 2018-09-05 - 2018-09-05 - 2019-08-03 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 62.0_1,1 - - - waterfox - 56.2.3 - - - seamonkey - linux-seamonkey - 2.49.5 - - - firefox-esr - 60.2.0_1,1 - - - linux-firefox - 60.2.0,2 - - - libxul - thunderbird - linux-thunderbird - 60.2 - - - - -

Mozilla Foundation reports:

-
-

CVE-2018-12377: Use-after-free in refresh driver timers

-

CVE-2018-12378: Use-after-free in IndexedDB

-

CVE-2018-12379: Out-of-bounds write with malicious MAR file

-

CVE-2017-16541: Proxy bypass using automount and autofs

-

CVE-2018-12381: Dragging and dropping Outlook email message results in page navigation

-

CVE-2018-12382: Addressbar spoofing with javascript URI on Firefox for Android

-

CVE-2018-12383: Setting a master password post-Firefox 58 does not delete unencrypted previously stored passwords

-

CVE-2018-12375: Memory safety bugs fixed in Firefox 62

-

CVE-2018-12376: Memory safety bugs fixed in Firefox 62 and Firefox ESR 60.2

-
- - - - CVE-2017-16541 - CVE-2018-12375 - CVE-2018-12376 - CVE-2018-12377 - CVE-2018-12378 - CVE-2018-12379 - CVE-2018-12381 - CVE-2018-12382 - CVE-2018-12383 - https://www.mozilla.org/en-US/security/advisories/mfsa2018-20/ - https://www.mozilla.org/en-US/security/advisories/mfsa2018-21/ - - - 2018-09-05 - 2018-09-05 - 2018-09-15 - - - - - Ghostscript -- arbitrary code execution - - - ghostscript9-agpl-base - ghostscript9-agpl-x11 - 9.24 - - - - -

CERT reports:

-
-

Ghostscript contains an optional -dSAFER option, which is supposed - to prevent unsafe PostScript operations. Multiple PostScript - operations bypass the protections provided by -dSAFER, which can - allow an attacker to execute arbitrary commands with arbitrary - arguments. This vulnerability can also be exploited in applications - that leverage Ghostscript, such as ImageMagick, GraphicsMagick, - evince, Okular, Nautilus, and others.

-

Exploit code for this vulnerability is publicly available.

-
- - - - https://www.kb.cert.org/vuls/id/332928 - CVE-2018-15908 - CVE-2018-15909 - CVE-2018-15910 - CVE-2018-15911 - - - 2018-08-21 - 2018-09-04 - - - - - grafana -- LDAP and OAuth login vulnerability - - - grafana5 - 5.0.05.2.3 - - - grafana4 - 4.0.04.6.4 - - - grafana3 - 3.0.0 - - - grafana2 - 2.0.0 - - - - -

Grafana Labs reports:

-
-

On the 20th of August at 1800 CEST we were contacted about a - potential security issue with the “remember me” cookie Grafana - sets upon login. The issue targeted users without a local Grafana - password (LDAP & OAuth users) and enabled a potential attacker - to generate a valid cookie knowing only a username.

-

All installations which use the Grafana LDAP or OAuth - authentication features must be upgraded as soon as possible. If - you cannot upgrade, you should switch authentication mechanisms - or put additional protections in front of Grafana such as a - reverse proxy.

-
- - - - https://community.grafana.com/t/grafana-5-2-3-and-4-6-4-security-update/10050 - CVE-2018-558213 - - - 2018-08-20 - 2018-08-31 - - - - - Gitlab -- multiple vulnerabilities - - - gitlab-ce - 11.2.011.2.3 - 11.1.011.1.6 - 2.7.011.0.6 - - - - -

Gitlab reports:

-
-

Persistent XSS in Pipeline Tooltip

-

GitLab.com GCP Endpoints Exposure

-

Persistent XSS in Merge Request Changes View

-

Sensitive Data Disclosure in Sidekiq Logs

-

Missing CSRF in System Hooks

-

Orphaned Upload Files Exposure

-

Missing Authorization Control API Repository Storage

-
- - - - https://about.gitlab.com/2018/08/28/security-release-gitlab-11-dot-2-dot-2-released/ - - - 2018-08-28 - 2018-08-30 - - - - - bro -- array bounds and potential DOS issues - - - bro - 2.5.5 - - - - -

Corelight reports:

-
-

Bro 2.5.5 primarily addresses security issues:

-
    -
  • Fix array bounds checking in BinPAC: for arrays - that are fields within a record, the bounds check - was based on a pointer to the start of the record - rather than the start of the array field, potentially - resulting in a buffer over-read.
    • -
  • Fix SMTP command string comparisons: the number - of bytes compared was based on the user-supplied - string length and can lead to incorrect matches. - e.g. giving a command of "X" incorrectly matched - "X-ANONYMOUSTLS" (and an empty commands match - anything).
    • -
-

Address potential vectors for Denial of Service:

-
    -
  • "Weird" events are now generally suppressed/sampled - by default according to some tunable parameters.
    • -
  • Improved handling of empty lines in several text - protocol analyzers that can cause performance issues - when seen in long sequences.
    • -
  • Add `smtp_excessive_pending_cmds' weird which - serves as a notification for when the "pending - command" queue has reached an upper limit and been - cleared to prevent one from attempting to slowly - exhaust memory.
    • -
-
- - - - https://www.bro.org/download/NEWS.bro.html - - - 2018-08-28 - 2018-08-29 - - - - - node.js -- multiple vulnerabilities - - - node - 10.9.0 - - - node8 - 8.11.4 - - - node6 - 6.14.4 - - - - -

Node.js reports:

-
-

OpenSSL: Client DoS due to large DH parameter

-

This fixes a potential denial of service (DoS) attack - against client connections by a malicious server. During a TLS - communication handshake, where both client and server agree to - use a cipher-suite using DH or DHE (Diffie-Hellman, in both - ephemeral and non-ephemeral modes), a malicious server can - send a very large prime value to the client. Because this has - been unbounded in OpenSSL, the client can be forced to spend - an unreasonably long period of time to generate a key, - potentially causing a denial of service.

-

OpenSSL: ECDSA key extraction via local side-channel

-

Attackers with access to observe cache-timing may be able - to extract DSA or ECDSA private keys by causing the victim to - create several signatures and watching responses. This flaw - does not have a CVE due to OpenSSL policy to not assign itself - CVEs for local-only vulnerabilities that are more academic - than practical. This vulnerability was discovered by Keegan - Ryan at NCC Group and impacts many cryptographic libraries - including OpenSSL.

-

Unintentional exposure of uninitialized memory

-

Only Node.js 10 is impacted by this flaw.

-

Node.js TSC member Nikita Skovoroda discovered an argument - processing flaw that causes Buffer.alloc() to return - uninitialized memory. This method is intended to be safe and - only return initialized, or cleared, memory. The third - argument specifying encoding can be passed as a number, this - is misinterpreted by Buffer's internal "fill" method as the - start to a fill operation. This flaw may be abused where - Buffer.alloc() arguments are derived from user input to return - uncleared memory blocks that may contain sensitive - information.

-

Out of bounds (OOB) write

-

Node.js TSC member Nikita Skovoroda discovered an OOB write - in Buffer that can be used to write to memory outside of a - Buffer's memory space. This can corrupt unrelated Buffer - objects or cause the Node.js process to crash.

-

When used with UCS-2 encoding (recognized by Node.js under - the names 'ucs2', 'ucs-2', 'utf16le' and 'utf-16le'), - Buffer#write() can be abused to write outside of the bounds of - a single Buffer. Writes that start from the second-to-last - position of a buffer cause a miscalculation of the maximum - length of the input bytes to be written.

-
- - - - https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/ - CVE-2018-0732 - CVE-2018-7166 - CVE-2018-12115 - - - 2018-08-16 - 2018-08-25 - - - - - FreeBSD -- Unauthenticated EAPOL-Key Decryption Vulnerability - - - FreeBSD - 11.211.2_2 - 11.111.1_13 - 10.410.4_11 - - - - -

Problem Description:

-

When using WPA2, EAPOL-Key frames with the Encrypted - flag and without the MIC flag set, the data field was - decrypted first without verifying the MIC. When the dta - field was encrypted using RC4, for example, when negotiating - TKIP as a pairwise cipher, the unauthenticated but decrypted - data was subsequently processed. This opened wpa_supplicant(8) - to abuse by decryption and recovery of sensitive information - contained in EAPOL-Key messages.

-

See - https://w1.fi/security/2018-1/unauthenticated-eapol-key-decryption.txt - for a detailed description of the bug.

-

Impact:

-

All users of the WPA2 TKIP pairwise cipher are vulnerable - to information, for example, the group key.

- - - - CVE-2018-1452 - SA-18:11.hostapd - - - 2018-08-14 - 2018-08-22 - - - - - FreeBSD -- Resource exhaustion in IP fragment reassembly - - - FreeBSD-kernel - 11.211.2_2 - 11.111.1_13 - - - - -

Problem Description:

-

A researcher has notified us of a DoS attack applicable - to another operating system. While FreeBSD may not be - vulnerable to that exact attack, we have identified several - places where inadequate DoS protection could allow an - attacker to consume system resources.

-

It is not necessary that the attacker be able to establish - two-way communication to carry out these attacks. These - attacks impact both IPv4 and IPv6 fragment reassembly.

-

Impact:

-

In the worst case, an attacker could send a stream of - crafted fragments with a low packet rate which would consume - a substantial amount of CPU.

-

Other attack vectors allow an attacker to send a stream - of crafted fragments which could consume a large amount of - CPU or all available mbuf clusters on the system.

-

These attacks could temporarily render a system unreachable - through network interfaces or temporarily render a system - unresponsive. The effects of the attack should clear within - 60 seconds after the attack stops.

- - - - CVE-2018-6923 - SA-18:10.ip - - - 2018-08-14 - 2018-08-22 - - - - - FreeBSD -- L1 Terminal Fault (L1TF) Kernel Information Disclosure - - - FreeBSD-kernel - 11.211.2_2 - 11.111.1_13 - - - - -

Problem Description:

-

On certain Intel 64-bit x86 systems there is a period - of time during terminal fault handling where the CPU may - use speculative execution to try to load data. The CPU may - speculatively access the level 1 data cache (L1D). Data - which would otherwise be protected may then be determined - by using side channel methods.

-

This issue affects bhyve on FreeBSD/amd64 systems.

-

Impact:

-

An attacker executing user code, or kernel code inside - of a virtual machine, may be able to read secret data from - the kernel or from another virtual machine.

- - - - CVE-2018-3620 - CVE-2018-3646 - SA-18:09.l1tf - - - 2018-08-14 - 2018-08-22 - - - - - gogs -- open redirect vulnerability - - - gogs - 0.11.53_1 - - - - -

bluecatli (Tencent's Xuanwu Lab) reports:

-
-

The function isValidRedirect in gogs/routes/user/auth.go is used in login action to validate if url is on the same site.

-

If the Location header startswith /\, it will be transformed to // by browsers.

-
- - - - https://github.com/gogs/gogs/issues/5364 - https://github.com/gogs/gogs/pull/5365 - https://github.com/gogs/gogs/commit/1f247cf8139cb483276cd8dd06385a800ce9d4b2 - - - 2018-08-06 - 2018-08-22 - - - - - phpmyadmin -- XSS in the import dialog - - - phpMyAdmin - phpMyAdmin-php56 - phpMyAdmin-php70 - phpMyAdmin-php71 - phpMyAdmin-php72 - 4.8.3 - - - - -

The phpMyAdmin development team reports:

-
-

Description

-

A Cross-Site Scripting vulnerability was found in the - file import feature, where an attacker can deliver a payload - to a user through importing a specially-crafted file.

-

Severity

-

We consider this attack to be of moderate severity.

-
- - - - https://www.phpmyadmin.net/security/PMASA-2018-5/ - CVE-2018-15605 - - - 2018-08-21 - 2018-08-22 - - - - - libX11 -- Multiple vulnerabilities - - - libX11 - 1.6.6,1 - - - - -

The freedesktop.org project reports:

-
-

The functions XGetFontPath, XListExtensions, and XListFonts are - vulnerable to an off-by-one override on malicious server responses. - The server replies consist of chunks consisting of a length byte - followed by actual string, which is not NUL-terminated. - While parsing the response, the length byte is overridden with '\0', - thus the memory area can be used as storage of C strings later on. - To be able to NUL-terminate the last string, the buffer is reserved - with an additional byte of space. For a boundary check, the variable - chend (end of ch) was introduced, pointing at the end of the buffer - which ch initially points to. Unfortunately there is a difference - in handling "the end of ch". While chend points at the first byte - that must not be written to, the for-loop uses chend as the last - byte that can be written to. Therefore, an off-by-one can occur.

-

The length value is interpreted as signed char on many systems - (depending on default signedness of char), which can lead to an out - of boundary write up to 128 bytes in front of the allocated storage, - but limited to NUL byte(s).

-

If the server sends a reply in which even the first string would - overflow the transmitted bytes, list[0] (or flist[0]) will be set to - NULL and a count of 0 is returned. If the resulting list is freed - with XFreeExtensionList or XFreeFontPath later on, the first Xfree - call is turned into Xfree (NULL-1) which will most likely trigger a - segmentation fault. Casting the length value to unsigned char fixes - the problem and allows string values with up to 255 characters.

-
- - - - https://lists.x.org/archives/xorg-announce/2018-August/002915.html - CVE-2018-14598 - CVE-2018-14599 - CVE-2018-14600 - - - 2018-08-21 - 2018-08-22 - - - - - couchdb -- administrator privilege escalation - - - couchdb - 2.2.0,2 - - - - -

Apache CouchDB PMC reports:

-
-

Database Administrator could achieve privilege escalation to - the account that CouchDB runs under, by abusing insufficient validation - in the HTTP API, escaping security controls implemented in previous - releases.

-
- - - - http://docs.couchdb.org/en/stable/cve/2018-11769.html - CVE-2018-11769 - - - 2018-06-05 - 2018-08-08 - - - - - botan2 -- ECDSA side channel - - - botan2 - 2.5.02.7.0 - - - - -

botan2 developers report:

-
-

A side channel in the ECDSA signature operation could allow a local attacker to recover the secret key. Found by Keegan Ryan of NCC Group.

-

Bug introduced in 2.5.0, fixed in 2.7.0. The 1.10 branch is not affected.

-
- - - - https://botan.randombit.net/security.html#id1 - https://github.com/randombit/botan/pull/1604 - CVE-2018-12435 - - - 2018-06-13 - 2018-08-17 - - - - - jenkins -- multiple vulnerabilities - - - jenkins - 2.138 - - - jenkins-lts - 2.121.3 - - - - -

Jenkins Security Advisory:

-
-

Description

-
(Low) SECURITY-637
-

Jenkins allowed deserialization of URL objects with host components

-
(Medium) SECURITY-672
-

Ephemeral user record was created on some invalid authentication attempts

-
(Medium) SECURITY-790
-

Cron expression form validation could enter infinite loop, potentially resulting in denial of service

-
(Low) SECURITY-996
-

"Remember me" cookie was evaluated even if that feature is disabled

-
(Medium) SECURITY-1071
-

Unauthorized users could access agent logs

-
(Low) SECURITY-1076
-

Unauthorized users could cancel scheduled restarts initiated from the update center

-
- - - - https://jenkins.io/security/advisory/2018-08-15/ - - - 2018-08-15 - 2018-08-15 - - - - - Flash Player -- multiple vulnerabilities - - - linux-flashplayer - 30.0.0.154 - - - - -

Adobe reports:

-
-
    -
  • This update resolves out-of-bounds read vulnerabilities that - could lead to information disclosure (CVE-2018-12824, - CVE-2018-12826, CVE-2018-12827).
    • -
  • This update resolves a security bypass vulnerability that - could lead to security mitigation bypass (CVE-2018-12825).
    • -
  • This update resolves a component vulnerability that - could lead to privilege escalation (CVE-2018-12828).
    • -
-
- - - - CVE-2018-12824 - CVE-2018-12825 - CVE-2018-12826 - CVE-2018-12827 - CVE-2018-12828 - https://helpx.adobe.com/security/products/flash-player/apsb18-25.html - - - 2018-08-14 - 2018-08-14 - - - - - samba -- multiple vulnerabilities - - - samba46 - 4.6.16 - - - samba47 - 4.7.9 - - - samba48 - 4.8.4 - - - - -

The samba project reports:

-
-

Samba releases 4.7.0 to 4.8.3 (inclusive) contain an error which - allows authentication using NTLMv1 over an SMB1 transport (either - directory or via NETLOGON SamLogon calls from a member server), even - when NTLMv1 is explicitly disabled on the server.

-
-
-

Missing input sanitization checks on some of the input parameters to - LDB database layer cause the LDAP server and DNS server to crash when - following a NULL pointer.

-
-
-

Samba releases 3.2.0 to 4.8.3 (inclusive) contain an error in - libsmbclient that could allow a malicious server to overwrite - client heap memory by returning an extra long filename in a directory - listing.

-
-
-

Missing database output checks on the returned directory attributes - from the LDB database layer cause the DsCrackNames call in the DRSUAPI - server to crash when following a NULL pointer.

-
-
-

All versions of the Samba Active Directory LDAP server from 4.0.0 - onwards are vulnerable to the disclosure of confidential attribute - values, both of attributes where the schema SEARCH_FLAG_CONFIDENTIAL - (0x80) searchFlags bit and where an explicit Access Control Entry has - been specified on the ntSecurityDescriptor.

-
- - - - https://www.samba.org/samba/security/CVE-2018-1139.html - CVE-2018-1139 - https://www.samba.org/samba/security/CVE-2018-1140.html - CVE-2018-1140 - https://www.samba.org/samba/security/CVE-2018-10858.html - CVE-2018-10858 - https://www.samba.org/samba/security/CVE-2018-10918.html - CVE-2018-10918 - https://www.samba.org/samba/security/CVE-2018-10919.html - CVE-2018-10919 - - - 2018-08-14 - 2018-08-14 - - - - - GraphicsMagick -- SVG/Rendering vulnerability - - - GraphicsMagick - 1.3.30,1 - - - - -

GraphicsMagick News:

-
-

Fix heap write overflow of PrimitiveInfo and PointInfo arrays. This is - another manefestation of CVE-2016-2317, which should finally be fixed - correctly due to active detection/correction of pending overflow rather - than using estimation.

-
- - - - http://www.graphicsmagick.org/NEWS.html - CVE-2016-2317 - - - 2018-06-23 - 2018-08-11 - - - - - chicken -- multiple vulnerabilities - - - chicken - 4.13.0,1 - - - - -

CHICKEN reports:

-
-
    -
  • CVE-2017-6949: Unchecked malloc() call in SRFI-4 - constructors when allocating in non-GC memory, resulting - in potential 1-word buffer overrun and/or segfault
    • -
  • CVE-2017-9334: "length" crashes on improper lists
    • -
  • CVE-2017-11343: The randomization factor of the symbol - table was set before the random seed was set, causing it - to have a fixed value on many platforms
    • -
-
- - - - https://code.call-cc.org/releases/4.13.0/NEWS - CVE-2017-6949 - CVE-2017-9334 - CVE-2017-11343 - - - 2017-03-16 - 2018-08-12 - - - - - gitea -- TOTP passcode reuse - - - gitea - 1.5.0 - - - - -

The Gitea project reports:

-
-

TOTP passcodes can be reused.

-
- - - - https://github.com/go-gitea/gitea/pull/3878 - - - 2018-05-01 - 2018-08-12 - - - - - mbed TLS -- plaintext recovery vulnerabilities - - - mbedtls - 2.12 - - - - -

Simon Butcher reports:

-
-
    -
  • When using a CBC based ciphersuite, a remote attacker can - partially recover the plaintext.
    • -
  • When using a CBC based ciphersuite, an attacker with the - ability to execute arbitrary code on the machine under attack - can partially recover the plaintext by use of cache based - side-channels.
    • -
-
- - - - https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-02 - CVE-2018-0497 - CVE-2018-0498 - - - 2018-07-24 - 2018-08-10 - - - - - PostgreSQL -- two vulnerabilities - - - postgresql10-server - 10.5 - - - postgresql96-server - 9.6.10 - - - postgresql95-server - 9.5.14 - - - postgresql94-server - 9.4.19 - - - postgresql93-server - 9.3.24 - - - - -

The PostgreSQL project reports:

-
-

CVE-2018-10915: Certain host connection parameters defeat - client-side security defenses

-

libpq, the client connection API for PostgreSQL that is also used - by other connection libraries, had an internal issue where it did not - reset all of its connection state variables when attempting to - reconnect. In particular, the state variable that determined whether - or not a password is needed for a connection would not be reset, which - could allow users of features requiring libpq, such as the "dblink" or - "postgres_fdw" extensions, to login to servers they should not be able - to access.

-

CVE-2018-10925: Memory disclosure and missing authorization in - `INSERT ... ON CONFLICT DO UPDATE`

-

An attacker able to issue CREATE TABLE can read arbitrary bytes of - server memory using an upsert (`INSERT ... ON CONFLICT DO UPDATE`) - query. By default, any user can exploit that. A user that has - specific INSERT privileges and an UPDATE privilege on at least one - column in a given table can also update other columns using a view and - an upsert query.

-
- - - - https://www.postgresql.org/about/news/1878/ - CVE-2018-10915 - CVE-2018-10925 - - - 2018-08-09 - 2018-08-10 - - - - - MySQL -- multiple vulnerabilities - - - mariadb55-server - 5.5.61 - - - mariadb100-server - 10.0.36 - - - mariadb101-server - 10.1.35 - - - mariadb102-server - 10.2.17 - - - mariadb103-server - 10.3.9 - - - mysql55-server - 5.5.61 - - - mysql56-server - 5.6.41 - - - mysql57-server - 5.7.23 - - - mysql80-server - 8.0.12 - - - percona55-server - 5.5.61 - - - percona56-server - 5.6.41 - - - percona57-server - 5.7.23 - - - - -

Oracle reports:

-
-

Multiple vulnerabilities have been disclosed by Oracle without - further detail. CVSS scores 7.1 - 2.7

-
- - - - http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html - CVE-2018-3064 - CVE-2018-0739 - CVE-2018-3070 - CVE-2018-3060 - CVE-2018-3065 - CVE-2018-3073 - CVE-2018-3074 - CVE-2018-3081 - CVE-2018-3071 - CVE-2018-3079 - CVE-2018-3054 - CVE-2018-3077 - CVE-2018-3078 - CVE-2018-3080 - CVE-2018-3061 - CVE-2018-3067 - CVE-2018-3063 - CVE-2018-3075 - CVE-2018-3058 - CVE-2018-3056 - CVE-2018-3066 - CVE-2018-2767 - CVE-2018-3084 - CVE-2018-3082 - - - 2018-07-17 - 2018-08-08 - - - - - xml-security-c -- crashes on malformed KeyInfo content - - - apache-xml-security-c - 2.0.1 - - - - -

The shibboleth project reports:

-
-

- SAML messages, assertions, and metadata all commonly make use of the - XML Signature KeyInfo construct, which expresses information about - keys and certificates used in signing or encrypting XML. -

-

- The Apache Santuario XML Security for C++ library contained code - paths at risk of dereferencing null pointers when processing various - kinds of malformed KeyInfo hints typically found in signed or - encrypted XML. The usual effect is a crash, and in the case of the - Shibboleth SP software, a crash in the shibd daemon, which prevents - access to protected resources until the daemon is restarted. -

-
- - - - https://shibboleth.net/community/advisories/secadv_20180803.txt - - - 2018-08-03 - 2018-08-07 - - - - - FreeBSD -- Resource exhaustion in TCP reassembly - - - FreeBSD-kernel - 11.211.2_1 - 11.111.1_12 - 10.410.4_10 - - - - -

Problem Description:

-

One of the data structures that holds TCP segments uses - an inefficient algorithm to reassemble the data. This causes - the CPU time spent on segment processing to grow linearly - with the number of segments in the reassembly queue.

-

Impact:

-

An attacker who has the ability to send TCP traffic to - a victim system can degrade the victim system's network - performance and/or consume excessive CPU by exploiting the - inefficiency of TCP reassembly handling, with relatively - small bandwidth cost.

- - - - CVE-2018-6922 - SA-18:08.tcp - - - 2018-08-06 - 2018-08-06 - - - - - py-cryptography -- tag forgery vulnerability - - - py27-cryptography - py34-cryptography - py35-cryptography - py36-cryptography - py37-cryptography - 2.3 - - - - -

The Python Cryptographic Authority (PyCA) project reports:

-
-

finalize_with_tag() allowed tag truncation by default which can allow tag forgery in some cases. The method now enforces the min_tag_length provided to the GCM constructor

-
- - - - CVE-2018-10903 - - - 2018-07-17 - 2018-08-06 - - - - - cgit -- directory traversal vulnerability - - - cgit - 1.2.1 - - - - -

Jann Horn reports:

-
-

cgit_clone_objects in CGit before 1.2.1 has a directory traversal vulnerability when `enable-http-clone=1` is not turned off, as demonstrated by a cgit/cgit.cgi/git/objects/?path=../ request.

-
- - - - https://lists.zx2c4.com/pipermail/cgit/2018-August/004176.html - CVE-2018-14912 - - - 2018-08-03 - 2018-08-04 - - - - - rubygem-doorkeeper -- token revocation vulnerability - - - rubygem-doorkeeper - rubygem-doorkeeper43 - rubygem-doorkeeper-rails5 - rubygem-doorkeeper-rails50 - 4.4.0 - - - - -

NVD reports:

-
-

Doorkeeper version 4.2.0 and later contains a Incorrect Access Control - vulnerability in Token revocation API's authorized method that can - result in Access tokens are not revoked for public OAuth apps, leaking - access until expiry.

-
- - - - https://nvd.nist.gov/vuln/detail/CVE-2018-1000211 - https://github.com/doorkeeper-gem/doorkeeper/pull/1120 - CVE-2018-1000211 - - - 2018-07-13 - 2018-07-31 - 2018-08-03 - - - - - sinatra -- XSS vulnerability - - - rubygem-sinatra - 2.0.02.0.2 - - - - -

Sinatra blog:

-
-

Sinatra had a critical vulnerability since v2.0.0. The purpose of this - release is to fix CVE-2018-11627.

-

The vulnerability is that XSS can be executed by using illegal parameters.

-
- - - - http://sinatrarb.com/2018/06/09/sinatra-2.0.2-and-2.0.3.html - https://github.com/sinatra/sinatra/blob/master/CHANGELOG.md - CVE-2018-11627 - - - 2018-06-09 - 2018-07-31 - - - - - mailman -- content spoofing with invalid list names in web UI - - mailman 2.1.28 - mailman-with-htdig2.1.28 - ja-mailman 2.1.14.j7_6,1 - - - -

Mark Sapiro reports:

-
-

A URL with a very long text listname such as

- 
http://www.example.com/mailman/listinfo/This_is_a_long_string_with_some_phishing_text
-

will echo the text in the "No such list" error response. This can be used to make a potential victim think the phishing text comes from a trusted site.

-

This issue was discovered by Hammad Qureshi.

-
- - - - https://bugs.launchpad.net/mailman/+bug/1780874 - https://mail.python.org/pipermail/mailman-announce/2018-July/000241.html - CVE-2018-13796 - - - 2018-07-09 - 2018-07-31 - - - - - mantis -- multiple vulnerabilities - - - mantis - 2.15.0,1 - - - - -

mantis reports:

-
-

Teun Beijers reported a cross-site scripting (XSS) vulnerability in - the Edit Filter page which allows execution of arbitrary code - (if CSP settings permit it) when displaying a filter with a crafted - name. Prevent the attack by sanitizing the filter name before display.

-

Ömer Cıtak, Security Researcher at Netsparker, reported this - vulnerability, allowing remote attackers to inject arbitrary code - (if CSP settings permit it) through a crafted PATH_INFO on - view_filters_page.php. Prevent the attack by sanitizing the output - of $_SERVER['PHP_SELF'] before display.

-
- - - - https://github.com/mantisbt/mantisbt/commit/8b5fa243dbf04344a55fe880135ec149fc1f439f - https://github.com/mantisbt/mantisbt/commit/4efac90ed89a5c009108b641e2e95683791a165a - CVE-2018-14504 - CVE-2018-13066 - - - 2018-07-13 - 2018-07-29 - 2018-08-24 - - - - - py-bleach -- unsanitized character entities - - - py27-bleach - py36-bleach - 2.1.02.1.3 - - - - -

bleach developer reports:

-
-

Attributes that have URI values weren't properly sanitized if the - values contained character entities. Using character entities, it - was possible to construct a URI value with a scheme that was not - allowed that would slide through unsanitized.

-

This security issue was introduced in Bleach 2.1. Anyone using - Bleach 2.1 is highly encouraged to upgrade.

-
- - - - https://github.com/mozilla/bleach/blob/v2.1.3/CHANGES - - - 2018-03-05 - 2018-07-27 - - - - - lshell -- Shell autocomplete reveals forbidden directories - - - lshell - 0.9.18 - - - - -

lshell reports:

-
-

The autocomplete feature allows users to list directories, while they do not have access to those paths (issue #109).

-
- - - - https://github.com/ghantoos/lshell/issues/109 - - - 2015-07-25 - 2018-07-27 - - - - - lshell -- Multiple security issues - - - lshell - 0.9.18 - - - - -

lshell reports:

-
-

It is possible to escape lshell if an allowed command can execute an arbitrary non allowed one (issue #122).

-

Inappropriate parsing of commands can lead to arbitrary command execution (issue #147, #149, #151).

-
- - - - https://github.com/ghantoos/lshell/issues/122 - https://github.com/ghantoos/lshell/issues/147 - https://github.com/ghantoos/lshell/issues/149 - https://github.com/ghantoos/lshell/issues/151 - - - 2016-02-04 - 2018-07-27 - - - - - OpenJPEG -- multiple vulnerabilities - - - openjpeg - 2.3.0_3 - - - - -

OpenJPEG reports:

-
-

Multiple vulnerabilities have been found in OpenJPEG, the - opensource JPEG 2000 codec. Please consult the CVE list for further - details.

-

CVE-2017-17479 and CVE-2017-17480 were fixed in r477112.

-

CVE-2018-5785 was fixed in r480624.

-

CVE-2018-6616 was fixed in r489415.

-
- - - - https://nvd.nist.gov/vuln/detail/CVE-2017-17479 - https://nvd.nist.gov/vuln/detail/CVE-2017-17480 - https://nvd.nist.gov/vuln/detail/CVE-2018-5785 - https://nvd.nist.gov/vuln/detail/CVE-2018-6616 - CVE-2017-17479 - CVE-2017-17480 - CVE-2018-5785 - CVE-2018-6616 - - - 2017-12-08 - 2018-07-27 - 2019-02-11 - - - - - ffmpeg -- multiple vulnerabilities - - - ffmpeg - 3.3.5_1,1 - 3.4,13.4.1_4,1 - - - - -

MITRE reports:

-
-

Multiple vulnerabilities have been found in FFmpeg. Please refer - to CVE list for details.

-

Note: CVE-2017-15186 and CVE-2017-15672 affect only the 3.3 branch - before 3.3.5, CVE-2017-16840 and CVE-2017-17081 have been fixed - in 3.4.1. They're listed here for completeness of the record.

-
- - - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15186 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15672 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16840 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17081 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6392 - http://ffmpeg.org/security.html - CVE-2017-15186 - CVE-2017-15672 - CVE-2017-16840 - CVE-2017-17081 - CVE-2018-6392 - - - 2017-10-09 - 2018-07-27 - - - - - GIMP - Heap Buffer Overflow Vulnerability - - - gimp - 2.8.22,2 - - - - -

GNOME reports:

-
-

CVE-2017-17786 Out of bounds read / heap overflow in tga importer / function bgr2rgb.part.1

-
- - - - https://bugzilla.gnome.org/show_bug.cgi?id=739134 - CVE-2017-17786 - - - 2017-12-21 - 2018-07-27 - - - - - chromium -- multiple vulnerabilities - - - chromium - 68.0.3440.75 - - - - -

Google Chrome Releases reports:

-
-

42 security fixes in this release, including:

-
    -
  • [850350] High CVE-2018-6153: Stack buffer overflow in Skia. Reported by Zhen Zhou of NSFOCUS Security Team on 2018-06-07
    • -
  • [848914] High CVE-2018-6154: Heap buffer overflow in WebGL. Reported by Omair on 2018-06-01
    • -
  • [842265] High CVE-2018-6155: Use after free in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2018-05-11
    • -
  • [841962] High CVE-2018-6156: Heap buffer overflow in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2018-05-10
    • -
  • [840536] High CVE-2018-6157: Type confusion in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2018-05-07
    • -
  • [812667] Medium CVE-2018-6150: Cross origin information disclosure in Service Workers. Reported by Rob Wu on 2018-02-15
    • -
  • [805905] Medium CVE-2018-6151: Bad cast in DevTools. Reported by Rob Wu on 2018-01-25
    • -
  • [805445] Medium CVE-2018-6152: Local file write in DevTools. Reported by Rob Wu on 2018-01-24
    • -
  • [841280] Medium CVE-2018-6158: Use after free in Blink. Reported by Zhe Jin, Luyao Liu from Chengdu Security Response Center of Qihoo 360 Technology Co. Ltd on 2018-05-09
    • -
  • [837275] Medium CVE-2018-6159: Same origin policy bypass in ServiceWorker. Reported by Jun Kokatsu (@shhnjk) on 2018-04-26
    • -
  • [839822] Medium CVE-2018-6160: URL spoof in Chrome on iOS. Reported by evi1m0 of Bilibili Security Team on 2018-05-04
    • -
  • [826552] Medium CVE-2018-6161: Same origin policy bypass in WebAudio. Reported by Jun Kokatsu (@shhnjk) on 2018-03-27
    • -
  • [804123] Medium CVE-2018-6162: Heap buffer overflow in WebGL. Reported by Omair on 2018-01-21
    • -
  • [849398] Medium CVE-2018-6163: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-06-04
    • -
  • [848786] Medium CVE-2018-6164: Same origin policy bypass in ServiceWorker. Reported by Jun Kokatsu (@shhnjk) on 2018-06-01
    • -
  • [847718] Medium CVE-2018-6165: URL spoof in Omnibox. Reported by evi1m0 of Bilibili Security Team on 2018-05-30
    • -
  • [835554] Medium CVE-2018-6166: URL spoof in Omnibox. Reported by Lnyas Zhang on 2018-04-21
    • -
  • [833143] Medium CVE-2018-6167: URL spoof in Omnibox. Reported by Lnyas Zhang on 2018-04-15
    • -
  • [828265] Medium CVE-2018-6168: CORS bypass in Blink. Reported by Gunes Acar and Danny Y. Huang of Princeton University, Frank Li of UC Berkeley on 2018-04-03
    • -
  • [394518] Medium CVE-2018-6169: Permissions bypass in extension installation. Reported by Sam P on 2014-07-16
    • -
  • [862059] Medium CVE-2018-6170: Type confusion in PDFium. Reported by Anonymous on 2018-07-10
    • -
  • [851799] Medium CVE-2018-6171: Use after free in WebBluetooth. Reported by amazon@mimetics.ca on 2018-06-12
    • -
  • [847242] Medium CVE-2018-6172: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-05-28
    • -
  • [836885] Medium CVE-2018-6173: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-04-25
    • -
  • [835299] Medium CVE-2018-6174: Integer overflow in SwiftShader. Reported by Mark Brand of Google Project Zero on 2018-04-20
    • -
  • [826019] Medium CVE-2018-6175: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-03-26
    • -
  • [666824] Medium CVE-2018-6176: Local user privilege escalation in Extensions. Reported by Jann Horn of Google Project Zero on 2016-11-18
    • -
  • [826187] Low CVE-2018-6177: Cross origin information leak in Blink. Reported by Ron Masas (Imperva) on 2018-03-27
    • -
  • [823194] Low CVE-2018-6178: UI spoof in Extensions. Reported by Khalil Zhani on 2018-03-19
    • -
  • [816685] Low CVE-2018-6179: Local file information leak in Extensions. Reported by Anonymous on 2018-02-26
    • -
  • [797461] Low CVE-2018-6044: Request privilege escalation in Extensions. Reported by Wob Wu on 2017-12-23
    • -
  • [791324] Low CVE-2018-4117: Cross origin information leak in Blink. Reported by AhsanEjaz - @AhsanEjazA on 2017-12-03
    • -
  • [866821] Various fixes from internal audits, fuzzing and other initiatives
    • -
-
- - - - CVE-2018-4117 - CVE-2018-6044 - CVE-2018-6150 - CVE-2018-6151 - CVE-2018-6152 - CVE-2018-6153 - CVE-2018-6154 - CVE-2018-6155 - CVE-2018-6156 - CVE-2018-6157 - CVE-2018-6158 - CVE-2018-6159 - CVE-2018-6160 - CVE-2018-6161 - CVE-2018-6162 - CVE-2018-6163 - CVE-2018-6164 - CVE-2018-6165 - CVE-2018-6166 - CVE-2018-6167 - CVE-2018-6168 - CVE-2018-6169 - CVE-2018-6170 - CVE-2018-6171 - CVE-2018-6172 - CVE-2018-6173 - CVE-2018-6174 - CVE-2018-6175 - CVE-2018-6176 - CVE-2018-6177 - CVE-2018-6178 - CVE-2018-6179 - https://chromereleases.googleblog.com/2018/07/stable-channel-update-for-desktop.html - - - 2018-07-24 - 2018-07-27 - - - - - curl -- SMTP send heap buffer overflow - - - curl - 7.54.17.61.0 - - - - -

Peter Wu reports:

-
-

curl might overflow a heap based memory buffer when sending data over SMTP and using a reduced read buffer.

-
- - - - https://curl.haxx.se/docs/adv_2018-70a2.html - CVE-2018-0500 - - - 2018-07-11 - 2018-07-27 - 2018-07-28 - - - - - Gitlab -- multiple vulnerabilities - - - gitlab-ce - 11.1.011.1.2 - 11.0.011.0.5 - 2.7.010.8.7 - - - - -

Gitlab reports:

-
-

Markdown DoS

-

Information Disclosure Prometheus Metrics

-

CSRF in System Hooks

-

Persistent XSS Pipeline Tooltip

-

Persistent XSS in Branch Name via Web IDE

-

Persistent XSS in Branch Name via Web IDE

-
- - - - CVE-2018-14601 - CVE-2018-14602 - CVE-2018-14603 - CVE-2018-14604 - CVE-2018-14605 - CVE-2018-14606 - https://about.gitlab.com/2018/07/26/security-release-gitlab-11-dot-1-dot-2-released/ - - - 2018-07-26 - 2018-07-27 - - - - - Fix a buffer overflow in the tiff reader - - - vips - 8.6.5 - - - - -

libvips reports:

-
-

A buffer overflow was found and fixed in the libvips code

-
- - - - https://github.com/jcupitt/libvips/releases/tag/v8.6.5 - - - 2018-07-22 - 2018-07-26 - - - - - Memory leak in different components - - - libsixel - 1.8.2,1 - - - - -

MITRE reports:

-
-

bsixel 1.8.1 has a memory leak in sixel_decoder_decode in - decoder.c, image_buffer_resize in fromsixel.c, sixel_decode_raw in - fromsixel.c and sixel_allocator_new in allocator.c

-
- - - - CVE-2018-14072 - CVE-2018-14073 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14072 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14073 - - - 2018-07-15 - 2018-07-24 - - - - - vlc -- Use after free vulnerability - - - vlc - 2.2.8_6,4 - - - vlc-qt4 - 2.2.8_6,4 - - - - -

Mitre reports:

-
-

VideoLAN VLC media player 2.2.x is prone to a use after free - vulnerability which an attacker can leverage to execute arbitrary - code via crafted MKV files. Failed exploit attempts will likely - result in denial of service conditions.

-
- - - - CVE-2018-11529 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11529 - http://seclists.org/fulldisclosure/2018/Jul/28 - https://github.com/rapid7/metasploit-framework/pull/10335 - https://github.com/videolan/vlc-3.0/commit/c472668ff873cfe29281822b4548715fb7bb0368 - https://github.com/videolan/vlc-3.0/commit/d2dadb37e7acc25ae08df71e563855d6e17b5b42 - - - 2018-06-06 - 2018-07-21 - - - - - mutt -- remote code injection and path traversal vulnerability - - - mutt - 1.10.1 - - - - -

Kevin J. McCarthy reports:

-
-

Fixes a remote code injection vulnerability when "subscribing" - to an IMAP mailbox, either via $imap_check_subscribed, or via the - <subscribe> function in the browser menu. Mutt was generating a - "mailboxes" command and sending that along to the muttrc parser. - However, it was not escaping "`", which executes code and inserts - the result. This would allow a malicious IMAP server to execute - arbitrary code (for $imap_check_subscribed).

-

Fixes POP body caching path traversal vulnerability.

-

Fixes IMAP header caching path traversal vulnerability.

-

CVE-2018-14349 - NO Response Heap Overflow

-

CVE-2018-14350 - INTERNALDATE Stack Overflow

-

CVE-2018-14351 - STATUS Literal Length relative write

-

CVE-2018-14352 - imap_quote_string off-by-one stack overflow

-

CVE-2018-14353 - imap_quote_string int underflow

-

CVE-2018-14354 - imap_subscribe Remote Code Execution

-

CVE-2018-14355 - STATUS mailbox header cache directory traversal

-

CVE-2018-14356 - POP empty UID NULL deref

-

CVE-2018-14357 - LSUB Remote Code Execution

-

CVE-2018-14358 - RFC822.SIZE Stack Overflow

-

CVE-2018-14359 - base64 decode Stack Overflow

-

CVE-2018-14362 - POP Message Cache Directory Traversal

-
- - - - CVE-2018-14349 - CVE-2018-14350 - CVE-2018-14351 - CVE-2018-14352 - CVE-2018-14353 - CVE-2018-14354 - CVE-2018-14355 - CVE-2018-14356 - CVE-2018-14357 - CVE-2018-14358 - CVE-2018-14359 - CVE-2018-14362 - http://lists.mutt.org/pipermail/mutt-announce/Week-of-Mon-20180716/000004.html - - - 2018-07-15 - 2018-07-17 - - - - - mutt/neomutt -- multiple vulnerabilities - - - neomutt - 20180716 - - - mutt - 1.10.1 - - - mutt14 - * - - - - -

NeoMutt report:

-
-

Description

-
CVE-2018-14349

NO Response Heap Overflow

-
CVE-2018-14350

INTERNALDATE Stack Overflow

-
CVE-2018-14351

STATUS Literal Length relative write

-
CVE-2018-14352

imap_quote_string off-by-one stack overflow

-
CVE-2018-14353

imap_quote_string int underflow

-
CVE-2018-14354

imap_subscribe Remote Code Execution

-
CVE-2018-14355

STATUS mailbox header cache directory traversal

-
CVE-2018-14356

POP empty UID NULL deref

-
CVE-2018-14357

LSUB Remote Code Execution

-
CVE-2018-14358

RFC822.SIZE Stack Overflow

-
CVE-2018-14359

base64 decode Stack Overflow

-
CVE-2018-14360

NNTP Group Stack Overflow

-
CVE-2018-14361

NNTP Write 1 where via GROUP response

-
CVE-2018-14362

POP Message Cache Directory Traversal

-
CVE-2018-14363

NNTP Header Cache Directory Traversal

-
- - - - CVE-2018-14349 - CVE-2018-14350 - CVE-2018-14351 - CVE-2018-14352 - CVE-2018-14353 - CVE-2018-14354 - CVE-2018-14355 - CVE-2018-14356 - CVE-2018-14357 - CVE-2018-14358 - CVE-2018-14359 - CVE-2018-14360 - CVE-2018-14361 - CVE-2018-14362 - CVE-2018-14363 - https://github.com/neomutt/neomutt/releases/tag/neomutt-20180716 - - - 2018-07-10 - 2018-07-19 - - - - - jenkins -- multiple vulnerabilities - - - jenkins - 2.133 - - - jenkins-lts - 2.121.2 - - - - -

Jenkins Security Advisory:

-
-

Description

-
(High) SECURITY-897 / CVE-2018-1999001
-

Users without Overall/Read permission can have Jenkins reset parts of global configuration on the next restart

-
(High) SECURITY-914 / CVE-2018-1999002
-

Arbitrary file read vulnerability

-
(Medium) SECURITY-891 / CVE-2018-1999003
-

Unauthorized users could cancel queued builds

-
(Medium) SECURITY-892 / CVE-2018-1999004
-

Unauthorized users could initiate and abort agent launches

-
(Medium) SECURITY-944 / CVE-2018-1999005
-

Stored XSS vulnerability

-
(Medium) SECURITY-925 / CVE-2018-1999006
-

Unauthorized users are able to determine when a plugin was extracted from its JPI package

-
(Medium) SECURITY-390 / CVE-2018-1999007
-

XSS vulnerability in Stapler debug mode

-
- - - - CVE-2018-1999001 - CVE-2018-1999002 - CVE-2018-1999003 - CVE-2018-1999004 - CVE-2018-1999005 - CVE-2018-1999006 - CVE-2018-1999007 - https://jenkins.io/security/advisory/2018-07-18/ - - - 2018-07-18 - 2018-07-18 - - - - - znc -- multiple vulnerabilities - - - znc - 1.7.1 - - - - -

Mitre reports:

-
-

ZNC before 1.7.1-rc1 does not properly validate untrusted lines - coming from the network, allowing a non-admin user to escalate his - privilege and inject rogue values into znc.conf.

-
-
-

ZNC before 1.7.1-rc1 is prone to a path traversal flaw via ../ in - a web skin name to access files outside of the intended skins - directories.

-
- - - - CVE-2018-14055 - CVE-2018-14056 - https://wiki.znc.in/ChangeLog/1.7.1 - - - 2018-07-14 - 2018-07-18 - - - - - Apache httpd -- multiple vulnerabilities - - - apache24 - 2.4.34 - - - - -

The Apache project reports:

-
-
    -
  • DoS for HTTP/2 connections by crafted requests - (CVE-2018-1333). By specially crafting HTTP/2 requests, workers - would be allocated 60 seconds longer than necessary, leading to - worker exhaustion and a denial of service. (low)
    • -
  • mod_md, DoS via Coredumps on specially crafted requests - (CVE-2018-8011). By specially crafting HTTP requests, the mod_md - challenge handler would dereference a NULL pointer and cause the - child process to segfault. This could be used to DoS the server. - (moderate)
    • -
-
- - - - http://httpd.apache.org/security/vulnerabilities_24.html - CVE-2018-1333 - CVE-2018-8011 - - - 2018-07-18 - 2018-07-18 - - - - - Gitlab -- Remote Code Execution Vulnerability in GitLab Projects Import - - - gitlab-ce - gitlab - 11.0.011.0.4 - 10.8.010.8.6 - 8.9.010.7.7 - - - - -

Gitlab reports:

-
-

Remote Code Execution Vulnerability in GitLab Projects Import

-
- - - - CVE-2018-14364 - https://about.gitlab.com/2018/07/17/critical-security-release-gitlab-11-dot-0-dot-4-released/ - - - 2018-07-17 - 2018-07-18 - - - - - typo3 -- multiple vulnerabilities - - - typo3-7 - 7.6.30 - - - typo3-8 - 8.7.17 - - - - -

Typo3 core team reports:

-
-

It has been discovered that TYPO3’s Salted Password system extension (which is a mandatory system component) - is vulnerable to Authentication Bypass when using hashing methods which are related by PHP class inheritance. - In standard TYPO3 core distributions stored passwords using the blowfish hashing algorithm can be overridden - when using MD5 as the default hashing algorithm by just knowing a valid username. - Per default the Portable PHP hashing algorithm (PHPass) is used which is not vulnerable.

-

Phar files (formerly known as "PHP archives") can act als self extracting archives which leads to the fact - that source code is executed when Phar files are invoked. The Phar file format is not limited to be stored - with a dedicated file extension - "bundle.phar" would be valid as well as "bundle.txt" would be. This way, - Phar files can be obfuscated as image or text file which would not be denied from being uploaded and persisted - to a TYPO3 installation. Due to a missing sanitization of user input, those Phar files can be invoked by - manipulated URLs in TYPO3 backend forms. A valid backend user account is needed to exploit this vulnerability. - In theory the attack vector would be possible in the TYPO3 frontend as well, however no functional exploit - has been identified so far.

-

Failing to properly dissociate system related configuration from user generated configuration, - the Form Framework (system extension "form") is vulnerable to SQL injection and Privilege Escalation. - Basically instructions can be persisted to a form definition file that were not configured to be modified - - this applies to definitions managed using the form editor module as well as direct file upload using the regular - file list module. A valid backend user account as well as having system extension form activated are needed - in order to exploit this vulnerability.

-

It has been discovered that the Form Framework (system extension "form") is vulnerable to Insecure Deserialization - when being used with the additional PHP PECL package “yaml”, which is capable of unserializing YAML contents - to PHP objects. A valid backend user account as well as having PHP setting "yaml.decode_php" enabled is needed - to exploit this vulnerability.

-
- - - - https://typo3.org/security/advisory/typo3-core-sa-2018-001/ - https://typo3.org/security/advisory/typo3-core-sa-2018-002/ - https://typo3.org/security/advisory/typo3-core-sa-2018-003/ - https://typo3.org/security/advisory/typo3-core-sa-2018-004/ - - - 2018-07-12 - 2018-07-17 - - - - - Several Security Defects in the Bouncy Castle Crypto APIs - - - bouncycastle15 - 1.60 - - - puppetserver - 0 - - - puppetserver5 - 5.3.8 - - - puppetserver6 - 6.2.1 - - - - -

The Legion of the Bouncy Castle reports:

-
-

Release 1.60 is now available for download.

-

CVE-2018-1000180: issue around primality tests for RSA key pair - generation if done using only the low-level API.

-

CVE-2018-1000613: lack of class checking in deserialization - of XMSS/XMSS^MT private keys with BDS state information.

-
- - - - CVE-2018-1000180 - CVE-2018-1000613 - https://www.bouncycastle.org/latest_releases.html - - - 2018-06-30 - 2018-07-15 - - - - - qutebrowser -- Remote code execution due to CSRF - - - qutebrowser - 1.4.01.4.1 - 1.0.01.3.3_1 - - - - -

qutebrowser team reports:

-
-

Due to a CSRF vulnerability affecting the qute://settings page, - it was possible for websites to modify qutebrowser settings. - Via settings like editor.command, this possibly allowed websites - to execute arbitrary code.

-
- - - - http://seclists.org/oss-sec/2018/q3/29 - CVE-2018-10895 - - - 2018-07-11 - 2018-07-14 - - - - - Flash Player -- multiple vulnerabilities - - - linux-flashplayer - 30.0.0.134 - - - - -

Adobe reports:

-
-
    -
  • This update resolves an out-of-bounds read vulnerability that - could lead to information disclosure (CVE-2018-5008).
    • -
  • This update resolves a type confusion vulnerability that - could lead to arbitrary code execution (CVE-2018-5007).
    • -
-
- - - - CVE-2018-5007 - CVE-2018-5008 - https://helpx.adobe.com/security/products/flash-player/apsb18-24.html - - - 2018-07-10 - 2018-07-11 - - - - - couchdb -- multiple vulnerabilities - - - couchdb - 1.7.2,2 - - - - -

Apache CouchDB PMC reports:

-
-

Database Administrator could achieve privilege escalation to - the account that CouchDB runs under, by abusing insufficient validation - in the HTTP API, escaping security controls implemented in previous - releases.

-
- - - - https://blog.couchdb.org/2018/07/10/cve-2018-8007/ - CVE-2018-8007 - https://blog.couchdb.org/2017/11/14/apache-couchdb-cve-2017-12635-and-cve-2017-12636/ - CVE-2017-12636 - CVE-2017-12635 - https://lists.apache.org/thread.html/6fa798e96686b7b0013ec2088140d00aeb7d34487d3f5ad032af6934@%3Cdev.couchdb.apache.org%3E - - - 2017-11-14 - 2018-07-10 - - - - - Libgit2 -- multiple vulnerabilities - - - libgit2 - 0.27.3 - - - - -

The Git community reports:

-
-

Out-of-bounds reads when reading objects from a packfile

-
- - - - https://github.com/libgit2/libgit2/releases/tag/v0.27.3 - CVE-2018-10887 - CVE-2018-10888 - - - 2018-07-09 - 2018-07-11 - - - - - clamav -- multiple vulnerabilities - - - clamav - 0.100.1 - - - - -

Joel Esler reports:

-
-

3 security fixes in this release:

-
    -
  • CVE-2017-16932: Vulnerability in libxml2 dependency (affects ClamAV on Windows only).
    • -
  • CVE-2018-0360: HWP integer overflow, infinite loop vulnerability. Reported by Secunia Research at Flexera.
    • -
  • CVE-2018-0361: ClamAV PDF object length check, unreasonably long time to parse relatively small file. Report -ed by aCaB.
    • -
-
- - - - https://blog.clamav.net/2018/07/clamav-01001-has-been-released.html - CVE-2017-16932 - CVE-2018-0360 - CVE-2018-0361 - - - 2018-07-09 - 2018-07-09 - - - - - zziplib - multiple vulnerabilities - - - zziplib - 0.13.68 - - - - -

NIST reports (by search in the range 2017/01/01 - 2018/07/06):

-
-

17 security fixes in this release:

-
    -
  • Heap-based buffer overflow in the __zzip_get32 function in fetch.c.
    • -
  • Heap-based buffer overflow in the __zzip_get64 function in fetch.c.
    • -
  • Heap-based buffer overflow in the zzip_mem_entry_extra_block function - in memdisk.c.
    • -
  • The zzip_mem_entry_new function in memdisk.c allows remote attackers - to cause a denial of service (out-of-bounds read and crash) via a - crafted ZIP file.
    • -
  • The prescan_entry function in fseeko.c allows remote attackers to cause - a denial of service (NULL pointer dereference and crash) via crafted - ZIP file.
    • -
  • The zzip_mem_entry_new function in memdisk.c cause a NULL pointer - dereference and crash via a crafted ZIP file.
    • -
  • seeko.c cause a denial of service (assertion failure and crash) via a - crafted ZIP file.
    • -
  • A segmentation fault caused by invalid memory access in the - zzip_disk_fread function because the size variable is not validated - against the amount of file->stored data.
    • -
  • A memory alignment error and bus error in the __zzip_fetch_disk_trailer - function of zzip/zip.c.
    • -
  • A bus error caused by loading of a misaligned address in the - zzip_disk_findfirst function.
    • -
  • An uncontrolled memory allocation and a crash in the __zzip_parse_root_directory - function.
    • -
  • An invalid memory address dereference was discovered in zzip_disk_fread - in mmapped.c.
    • -
  • A memory leak triggered in the function zzip_mem_disk_new in - memdisk.c.
    • -
-
- - - - CVE-2017-5974 - CVE-2017-5975 - CVE-2017-5976 - CVE-2017-5977 - CVE-2017-5978 - CVE-2017-5979 - CVE-2017-5980 - CVE-2017-5981 - CVE-2018-6381 - CVE-2018-6484 - CVE-2018-6540 - CVE-2018-6541 - CVE-2018-6542 - CVE-2018-6869 - CVE-2018-7725 - CVE-2018-7726 - CVE-2018-7727 - https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&query=zziplib&search_type=all&pub_start_date=01%2F01%2F2017&pub_end_date=07%2F06%2F2018" - - - 2017-03-01 - 2018-07-06 - - - - - wordpress -- multiple issues - - - wordpress - fr-wordpress - 4.9.7,1 - - - de-wordpress - zh_CN-wordpress - zh_TW-wordpress - ja-wordpress - ru-wordpress - 4.9.7 - - - - -

wordpressdevelopers reports:

-
-

Taxonomy: Improve cache handling for term queries.

-

Posts, Post Types: Clear post password cookie when logging out.

-

Widgets: Allow basic HTML tags in sidebar descriptions on Widgets admin screen.

-

Community Events Dashboard: Always show the nearest WordCamp if one is coming up, even if there are multiple Meetups happening first.

-

Privacy: Make sure default privacy policy content does not cause a fatal error when flushing rewrite rules outside of the admin context.

-
- - - - https://wordpress.org/news/2018/07/wordpress-4-9-7-security-and-maintenance-release/ - - - 2018-07-05 - 2018-07-08 - - - - - mybb -- vulnerabilities - - - mybb - 1.8.16 - - - - -

mybb Team reports:

-
-

High risk: Image and URL MyCode Persistent XSS

-

Medium risk: Multipage Reflected XSS

-

Low risk: ACP logs XSS

-

Low risk: Arbitrary file deletion via ACP’s Settings

-

Low risk: Login CSRF

-

Low risk: Non-video content embedding via Video MyCode

-
- - - - https://blog.mybb.com/2018/07/04/mybb-1-8-16-released-security-maintenance-release/ - - - 2018-07-04 - 2018-07-07 - - - - - expat -- multiple vulnerabilities - - - expat - 2.2.1 - - - libwww - 5.4.2 - - - - -

Mitre reports:

-
-

An integer overflow during the parsing of XML using the Expat library.

-
-
-

XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat - XML Parser Library) allows attackers to put the parser in an infinite - loop using a malformed external entity definition from an external DTD.

-
- - - - CVE-2016-9063 - CVE-2017-9233 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9063 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9233 - https://libexpat.github.io/doc/cve-2017-9233/ - - - 2016-10-27 - 2018-07-05 - - - - - h2o -- heap buffer overflow during logging - - - h2o - 2.2.5 - - - - -

Marlies Ruck reports:

-
-

Fix heap buffer overflow while trying to emit access log - - see references for full details.

-

CVE-2018-0608: Buffer overflow in H2O version 2.2.4 and - earlier allows remote attackers to execute arbitrary code or - cause a denial of service (DoS) via unspecified vectors.

-
- - - - CVE-2018-0608 - https://github.com/h2o/h2o/issues/1775 - https://github.com/h2o/h2o/releases/tag/v2.2.5 - - - 2018-06-01 - 2018-07-03 - - - - - SQLite -- Corrupt DB can cause a NULL pointer dereference - - - upp - 11540 - - - - -

MITRE reports:

-
-

SQLite databases whose schema is corrupted using a CREATE TABLE AS - statement could cause a NULL pointer dereference, related to build.c - and prepare.c.

-
- - - - CVE-2018-8740 - http://openwall.com/lists/oss-security/2018/03/17/1 - - - 2018-03-16 - 2018-07-01 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 61.0_1,1 - - - waterfox - 56.2.1.19_2 - - - seamonkey - linux-seamonkey - 2.49.4 - - - firefox-esr - 60.0,160.1.0_1,1 - 52.9.0_1,1 - - - linux-firefox - 52.9.0,2 - - - libxul - thunderbird - linux-thunderbird - 52.9.0 - - - - -

Mozilla Foundation reports:

-
-

CVE-2018-12359: Buffer overflow using computed size of canvas element

-

CVE-2018-12360: Use-after-free when using focus()

-

CVE-2018-12361: Integer overflow in SwizzleData

-

CVE-2018-12358: Same-origin bypass using service worker and redirection

-

CVE-2018-12362: Integer overflow in SSSE3 scaler

-

CVE-2018-5156: Media recorder segmentation fault when track type is changed during capture

-

CVE-2018-12363: Use-after-free when appending DOM nodes

-

CVE-2018-12364: CSRF attacks through 307 redirects and NPAPI plugins

-

CVE-2018-12365: Compromised IPC child process can list local filenames

-

CVE-2018-12371: Integer overflow in Skia library during edge builder allocation

-

CVE-2018-12366: Invalid data handling during QCMS transformations

-

CVE-2018-12367: Timing attack mitigation of PerformanceNavigationTiming

-

CVE-2018-12368: No warning when opening executable SettingContent-ms files

-

CVE-2018-12369: WebExtension security permission checks bypassed by embedded experiments

-

CVE-2018-12370: SameSite cookie protections bypassed when exiting Reader View

-

CVE-2018-5186: Memory safety bugs fixed in Firefox 61

-

CVE-2018-5187: Memory safety bugs fixed in Firefox 60 and Firefox ESR 60.1

-

CVE-2018-5188: Memory safety bugs fixed in Firefox 60, Firefox ESR 60.1, and Firefox ESR 52.9

-
- - - - CVE-2018-5156 - CVE-2018-5186 - CVE-2018-5187 - CVE-2018-5188 - CVE-2018-12358 - CVE-2018-12359 - CVE-2018-12360 - CVE-2018-12361 - CVE-2018-12362 - CVE-2018-12363 - CVE-2018-12364 - CVE-2018-12365 - CVE-2018-12366 - CVE-2018-12367 - CVE-2018-12368 - CVE-2018-12369 - CVE-2018-12370 - CVE-2018-12371 - https://www.mozilla.org/en-US/security/advisories/mfsa2018-15/ - https://www.mozilla.org/en-US/security/advisories/mfsa2018-16/ - https://www.mozilla.org/en-US/security/advisories/mfsa2018-17/ - - - 2018-06-26 - 2018-06-26 - 2018-07-07 - - - - - mailman -- hardening against malicious listowners injecting evil HTML scripts - - mailman 2.1.27 - mailman-with-htdig 2.1.27 - ja-mailman 2.1.14.j7_5,1 - - - -

Mark Sapiro reports:

-
-

Existing protections against malicious listowners injecting evil - scripts into listinfo pages have had a few more checks added. -

-

A few more error messages have had their values HTML escaped.

-

The hash generated when SUBSCRIBE_FORM_SECRET is set could have been - the same as one generated at the same time for a different list and - IP address.

-
- - - - https://bazaar.launchpad.net/~mailman-coders/mailman/2.1/view/head:/NEWS#L8 - https://www.mail-archive.com/mailman-users@python.org/ - CVE-2018-0618 - - - 2018-03-09 - 2018-06-25 - - - - - Gitlab -- multiple vulnerabilities - - - gitlab - 11.0.011.0.1 - 10.8.010.8.5 - 4.110.7.6 - - - - -

Gitlab reports:

-
-

Wiki XSS

-

Sanitize gem updates

-

XSS in url_for(params)

-

Content injection via username

-

Activity feed publicly displaying internal project names

-

Persistent XSS in charts

-
- - - - CVE-2018-12606 - CVE-2018-3740 - CVE-2018-12605 - CVE-2018-12607 - https://about.gitlab.com/2018/06/25/security-release-gitlab-11-dot-0-dot-1-released/ - - - 2018-06-25 - 2018-06-25 - - - - - phpmyadmin -- remote code inclusion and XSS scripting - - - phpmyadmin - 4.8.2 - - - - -

The phpMyAdmin development team reports:

-
-

Summary

-

XSS in Designer feature

-

Description

-

A Cross-Site Scripting vulnerability was found in the - Designer feature, where an attacker can deliver a - payload to a user through a specially-crafted database - name.

-

Severity

-

We consider this attack to be of moderate severity.

-
-
-

Summary

-

File inclusion and remote code execution attack

-

Description

-

A flaw has been discovered where an attacker can include - (view and potentially execute) files on the server.

-

The vulnerability comes from a portion of code where - pages are redirected and loaded within phpMyAdmin, and an - improper test for whitelisted pages.

-

An attacker must be authenticated, except in these - situations:

-
    -
  • $cfg['AllowArbitraryServer'] = true: attacker can - specify any host he/she is already in control of, and - execute arbitrary code on phpMyAdmin
    • -
  • $cfg['ServerDefault'] = 0: this bypasses the login and - runs the vulnerable code without any authentication
    • -
-

Severity

-

We consider this to be severe.

Mitigation - factor

Configuring PHP with a restrictive - `open_basedir` can greatly restrict an attacker's ability to - view files on the server. Vulnerable systems should not be - run with the phpMyAdmin directives - $cfg['AllowArbitraryServer'] = true or $cfg['ServerDefault'] - = 0

-
- - - - https://www.phpmyadmin.net/security/PMASA-2018-3/ - https://www.phpmyadmin.net/security/PMASA-2018-4/ - CVE-2018-12581 - CVE-2018-12613 - - - 2018-06-21 - 2018-06-22 - - - - - FreeBSD -- Lazy FPU State Restore Information Disclosure - - - FreeBSD-kernel - 11.111.1_11 - - - - -

Problem Description:

-

A subset of Intel processors can allow a local thread - to infer data from another thread through a speculative - execution side channel when Lazy FPU state restore is - used.

-

Impact:

-

Any local thread can potentially read FPU state information - from other threads running on the host. This could include - cryptographic keys when the AES-NI CPU feature is present.

- - - - CVE-2018-3665 - SA-18:07.lazyfpu - - - 2018-06-21 - 2018-06-21 - - - - - GraphicsMagick -- multiple vulnerabilities - - - GraphicsMagick - 1.3.26,1 - - - - -

GraphicsMagick reports:

-
-

Multiple vulnerabilities have been found in GraphicsMagick 1.3.26 - or earlier. Please refer to the CVE list for details.

-
- - - - http://www.graphicsmagick.org/NEWS.html - CVE-2016-7800 - CVE-2016-7996 - CVE-2016-7997 - CVE-2016-9830 - CVE-2017-6335 - CVE-2017-8350 - CVE-2017-10794 - CVE-2017-10799 - CVE-2017-10800 - - - 2017-07-04 - 2018-06-18 - - - - - slurm -- insecure handling of user_name and gid fields - - - slurm-wlm - 17.02.11 - - - - -

SchedMD reports:

-
-

Insecure handling of user_name and gid fields (CVE-2018-10995)

-

While fixes are only available for the supported 17.02 and 17.11 - releases, it is believed that similar vulnerabilities do affect past - versions as well. The only resolution is to upgrade Slurm to a fixed - release.

-
- - - - https://lists.schedmd.com/pipermail/slurm-announce/2018/000008.html - - - 2018-05-30 - 2018-06-16 - - - - - node.js -- multiple vulnerabilities - - - node6 - 6.14.3 - - - node8 - 8.11.3 - - - node - 10.4.1 - - - - -

Node.js reports:

-
-

Denial of Service Vulnerability in HTTP/2 (CVE-2018-7161)

-

All versions of 8.x and later are vulnerable and the severity is - HIGH. An attacker can cause a denial of service (DoS) by causing a - node server providing an http2 server to crash. This can be - accomplished by interacting with the http2 server in a manner that - triggers a cleanup bug where objects are used in native code after - they are no longer available. This has been addressed by updating - the http2 implementation. Thanks to Jordan Zebor at F5 Networks for - reporting this issue.

-

Denial of Service, nghttp2 dependency (CVE-2018-1000168)

-

All versions of 9.x and later are vulnerable and the severity is - HIGH. Under certain conditions, a malicious client can trigger an - uninitialized read (and a subsequent segfault) by sending a - malformed ALTSVC frame. This has been addressed through an by - updating nghttp2.

-

Denial of Service Vulnerability in TLS (CVE-2018-7162)

-

All versions of 9.x and later are vulnerable and the severity is - HIGH. An attacker can cause a denial of service (DoS) by causing a - node process which provides an http server supporting TLS server to - crash. This can be accomplished by sending duplicate/unexpected - messages during the handshake. This vulnerability has been addressed - by updating the TLS implementation. Thanks to Jordan Zebor at F5 - Networks all of his help investigating this issue with the Node.js - team.

-

Memory exhaustion DoS on v9.x (CVE-2018-7164)

-

Versions 9.7.0 and later are vulnerable and the severity is MEDIUM. - A bug introduced in 9.7.0 increases the memory consumed when reading - from the network into JavaScript using the net.Socket object - directly as a stream. An attacker could use this cause a denial of - service by sending tiny chunks of data in short succession. This - vulnerability was restored by reverting to the prior behaviour.

-

Calls to Buffer.fill() and/or Buffer.alloc() may hang (CVE-2018-7167)

-

Calling Buffer.fill() or Buffer.alloc() with some parameters can - lead to a hang which could result in a Denial of Service. In order - to address this vulnerability, the implementations of Buffer.alloc() - and Buffer.fill() were updated so that they zero fill instead of - hanging in these cases.

-
- - - - https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/ - https://nghttp2.org/blog/2018/04/12/nghttp2-v1-31-1/ - CVE-2018-7161 - CVE-2018-7162 - CVE-2018-7164 - CVE-2018-7167 - CVE-2018-1000168 - - - 2018-06-12 - 2018-06-15 - - - - - password-store -- GPG parsing vulnerabilities - - - password-store - 1.7.2 - - - - -

Jason A. Donenfeld reports:

-
-

Markus Brinkmann discovered that [the] parsing of gpg command line - output with regexes isn't anchored to the beginning of the line, - which means an attacker can generate a malicious key that simply has - the verification string as part of its username.

-

This has a number of nasty consequences:

-
    -
  • an attacker who manages to write into your ~/.password-store - and also inject a malicious key into your keyring can replace - your .gpg-id key and have your passwords encrypted under - additional keys;
    • -
  • if you have extensions enabled (disabled by default), an - attacker who manages to write into your ~/.password-store and - also inject a malicious key into your keyring can replace your - extensions and hence execute code.
    • -
-
- - - - https://lists.zx2c4.com/pipermail/password-store/2018-June/003308.html - CVE-2018-12356 - - - 2018-06-14 - 2018-06-14 - - - - - libgcrypt -- side-channel attack vulnerability - - - libgcrypt - 1.8.3 - - - - -

GnuPG reports:

-
-

Mitigate a local side-channel attack on ECDSA signature as described in the white paper "Return on the Hidden Number Problem".

-
- - - - CVE-2018-0495 - https://www.nccgroup.trust/us/our-research/technical-advisory-return-of-the-hidden-number-problem/ - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0495 - https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.7.4-relnotes.txt - - - 2018-06-13 - 2018-06-13 - 2018-06-14 - - - - - OpenSSL -- Client DoS due to large DH parameter - - - libressl - libressl-devel - 2.6.5 - 2.7.02.7.4 - - - openssl - 1.0.2o_4,1 - - - openssl-devel - 1.1.0h_2 - - - - -

The OpenSSL project reports:

-
-

During key agreement in a TLS handshake using a DH(E) based - ciphersuite a malicious server can send a very large prime value - to the client. This will cause the client to spend an unreasonably - long period of time generating a key for this prime resulting in a - hang until the client has finished. This could be exploited in a - Denial Of Service attack.

-
- - - - https://www.openssl.org/news/secadv/20180612.txt - CVE-2018-0732 - - - 2018-06-12 - 2018-06-12 - 2018-07-24 - - - - - asterisk -- PJSIP endpoint presence disclosure when using ACL - - - asterisk13 - 13.21.1 - - - asterisk15 - 15.4.1 - - - - -

The Asterisk project reports:

-
-

When endpoint specific ACL rules block a SIP request - they respond with a 403 forbidden. However, if an endpoint - is not identified then a 401 unauthorized response is - sent. This vulnerability just discloses which requests - hit a defined endpoint. The ACL rules cannot be bypassed - to gain access to the disclosed endpoints.

-
- - - - https://downloads.asterisk.org/pub/security/AST-2018-008.html - - - 2018-06-11 - 2018-06-11 - - - - - asterisk -- Infinite loop when reading iostreams - - - asterisk15 - 15.4.1 - - - - -

The Asterisk project reports:

-
-

When connected to Asterisk via TCP/TLS if the client - abruptly disconnects, or sends a specially crafted message - then Asterisk gets caught in an infinite loop while trying - to read the data stream. Thus rendering the system as - unusable.

-
- - - - https://downloads.asterisk.org/pub/security/AST-2018-007.html - - - 2018-06-11 - 2018-06-11 - - - - - chromium -- Incorrect handling of CSP header - - - chromium - 67.0.3396.79 - - - - -

Google Chrome Releases reports:

-
-

1 security fix contributed by external researchers:

-
    -
  • [845961] High CVE-2018-6148: Incorrect handling of CSP header. Reported by Michal Bentkowski on 2018-05-23
    • -
-
- - - - CVE-2018-6148 - https://chromereleases.googleblog.com/2018/06/stable-channel-update-for-desktop.html - - - 2018-06-06 - 2018-06-10 - - - - - gnupg -- unsanitized output (CVE-2018-12020) - - - gnupg - 2.2.8 - - - gnupg1 - 1.4.23 - - - - -

GnuPG reports:

-
-

GnuPG did not sanitize input file names, which may then be output to - the terminal. This could allow terminal control sequences or fake - status messages to be injected into the output.

-
- - - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12020 - CVE-2018-12020 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7526 - CVE-2017-7526 - - - 2018-06-07 - 2018-06-08 - - - - - firefox -- Heap buffer overflow rasterizing paths in SVG with Skia - - - firefox - 60.0.2,1 - - - waterfox - 56.2.0.13_5 - - - firefox-esr - 52.8.1,1 - - - seamonkey - linux-seamonkey - 2.49.4 - - - - -

The Mozilla Foundation reports:

-
-

A heap buffer overflow can occur in the Skia library when - rasterizing paths using a maliciously crafted SVG file - with anti-aliasing turned off. This results in a - potentially exploitable crash.

-
- - - - https://www.mozilla.org/security/advisories/mfsa2018-14/ - - - 2018-06-06 - 2018-06-08 - - - - - Flash Player -- multiple vulnerabilities - - - linux-flashplayer - 30.0.0.113 - - - - -

Adobe reports:

-
-
    -
  • This update resolves a type confusion vulnerability that - could lead to arbitrary code execution (CVE-2018-4945).
    • -
  • This update resolves an integer overflow vulnerability that - could lead to information disclosure (CVE-2018-5000).
    • -
  • This update resolves an out-of-bounds read vulnerability that - could lead to information disclosure (CVE-2018-5001).
    • -
  • This update resolves a stack-based buffer overflow vulnerability that - could lead to arbitrary code execution (CVE-2018-5002).
    • -
-
- - - - CVE-2018-4945 - CVE-2018-5000 - CVE-2018-5001 - CVE-2018-5002 - https://helpx.adobe.com/security/products/flash-player/apsb18-19.html - - - 2018-06-07 - 2018-06-07 - 2018-07-11 - - - - - bro -- multiple memory allocation issues - - - bro - 2.5.4 - - - - -

Corelight reports:

-
-

Bro 2.5.4 primarily fixes security issues

-

Multiple fixes and improvements to BinPAC generated code related to array parsing, with potential impact to all Bro's BinPAC-generated analyzers in the form of buffer over-reads or other invalid memory accesses depending on whether a particular analyzer incorrectly assumed that the evaulated-array-length expression is actually the number of elements that were parsed out from the input.

-

The NCP analyzer (not enabled by default and also updated to actually work with newer Bro APIs in the release) performed a memory allocation based directly on a field in the input packet and using signed integer storage. This could result in a signed integer overflow and memory allocations of negative or very large size, leading to a crash or memory exhaustion. The new NCP::max_frame_size tuning option now limits the maximum amount of memory that can be allocated.

-
- - - - https://www.bro.org/download/NEWS.bro.html - - - 2018-05-29 - 2018-06-06 - - - - - Libgit2 -- Fixing insufficient validation of submodule names - - - libgit2 - py-pygit2 - 0.27.1 - - - - -

The Git community reports:

-
-

Insufficient validation of submodule names

-
- - - - https://github.com/libgit2/libgit2/releases/tag/v0.27.1 - CVE-2018-11235 - - - 2018-05-29 - 2018-06-05 - - - - - Git -- Fix memory out-of-bounds and remote code execution vulnerabilities (CVE-2018-11233 and CVE-2018-11235) - - - git - git-lite - 2.13.7 - 2.142.14.4 - 2.152.15.2 - 2.162.16.4 - 2.172.17.1 - - - - -

The Git community reports:

-
-
  • In affected versions of Git, code to sanity-check pathnames on - NTFS can result in reading out-of-bounds memory.
    • -
  • In affected versions of Git, remote code execution can - occur. With a crafted .gitmodules file, a malicious project can - execute an arbitrary script on a machine that runs "git clone - --recurse-submodules" because submodule "names" are obtained from - this file, and then appended to $GIT_DIR/modules, leading to - directory traversal with "../" in a name. Finally, post-checkout - hooks from a submodule are executed, bypassing the intended design - in which hooks are not obtained from a remote server.
    • -
-
- - - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11233 - CVE-2018-11233 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11235 - CVE-2018-11235 - - - 2018-05-29 - 2018-06-02 - - - - - Gitlab -- multiple vulnerabilities - - - gitlab - 10.8.010.8.2 - 10.7.010.7.5 - 1.010.6.6 - - - - -

GitLab reports:

-
-

Removing public deploy keys regression

-

Users can update their password without entering current password

-

Persistent XSS - Selecting users as allowed merge request approvers

-

Persistent XSS - Multiple locations of user selection drop downs

-

include directive in .gitlab-ci.yml allows SSRF requests

-

Permissions issue in Merge Requests Create Service

-

Arbitrary assignment of project fields using "Import project"

-
- - - - https://about.gitlab.com/2018/05/29/security-release-gitlab-10-dot-8-dot-2-released/ - - - 2018-05-29 - 2018-05-31 - - - - - strongswan -- Fix Denial-of-Service Vulnerability strongSwan (CVE-2018-10811, CVE-2018-5388) - - - strongswan - 5.6.3 - - - - -

strongSwan security team reports:

-
-
  • A denial-of-service vulnerability in the IKEv2 key derivation was fixed - if the openssl plugin is used in FIPS mode and HMAC-MD5 is negotiated as - PRF (which is not FIPS-compliant). So this should only affect very specific setups, - but in such configurations all strongSwan versions since 5.0.1 may be affected.
    • -
  • A denial-of-service vulnerability in the stroke plugin was fixed. - When reading a message from the socket the plugin did not check the received length. - Unless a group is configured, root privileges are required to access that socket, - so in the default configuration this shouldn't be an issue, but all strongSwan versions may be affected. -
    • -
-
- - - - https://www.strongswan.org/blog/2018/05/28/strongswan-vulnerability-(cve-2018-10811).html - CVE-2018-10811 - https://www.strongswan.org/blog/2018/05/28/strongswan-vulnerability-(cve-2018-5388).html - CVE-2018-5388 - - - 2018-05-16 - 2018-05-31 - - - - - chromium -- multiple vulnerabilities - - - chromium - 67.0.3396.62 - - - - -

Google Chrome Releases reports:

-
-

34 security fixes in this release, including:

-
    -
  • [835639] High CVE-2018-6123: Use after free in Blink. Reported by Looben Yang on 2018-04-22
    • -
  • [840320] High CVE-2018-6124: Type confusion in Blink. Reported by Guang Gong of Alpha Team, Qihoo 360 on 2018-05-07
    • -
  • [818592] High CVE-2018-6125: Overly permissive policy in WebUSB. Reported by Yubico, Inc on 2018-03-05
    • -
  • [844457] High CVE-2018-6126: Heap buffer overflow in Skia. Reported by Ivan Fratric of Google Project Zero on 2018-05-18
    • -
  • [842990] High CVE-2018-6127: Use after free in indexedDB. Reported by Looben Yang on 2018-05-15
    • -
  • [841105] High CVE-2018-6128: uXSS in Chrome on iOS. Reported by Tomasz Bojarski on 2018-05-09
    • -
  • [838672] High CVE-2018-6129: Out of bounds memory access in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2018-05-01
    • -
  • [838402] High CVE-2018-6130: Out of bounds memory access in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2018-04-30
    • -
  • [826434] High CVE-2018-6131: Incorrect mutability protection in WebAssembly. Reported by Natalie Silvanovich of Google Project Zero on 2018-03-27
    • -
  • [839960] Medium CVE-2018-6132: Use of uninitialized memory in WebRTC. Reported by Ronald E. Crane on 2018-05-04
    • -
  • [817247] Medium CVE-2018-6133: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-02-28
    • -
  • [797465] Medium CVE-2018-6134: Referrer Policy bypass in Blink. Reported by Jun Kokatsu (@shhnjk) on 2017-12-23
    • -
  • [823353] Medium CVE-2018-6135: UI spoofing in Blink. Reported by Jasper Rebane on 2018-03-19
    • -
  • [831943] Medium CVE-2018-6136: Out of bounds memory access in V8. Reported by Peter Wong on 2018-04-12
    • -
  • [835589] Medium CVE-2018-6137: Leak of visited status of page in Blink. Reported by Michael Smith (spinda.net) on 2018-04-21
    • -
  • [810220] Medium CVE-2018-6138: Overly permissive policy in Extensions. Reported by Francois Lajeunesse-Robert on 2018-02-08
    • -
  • [805224] Medium CVE-2018-6139: Restrictions bypass in the debugger extension API. Reported by Rob Wu on 2018-01-24
    • -
  • [798222] Medium CVE-2018-6140: Restrictions bypass in the debugger extension API. Reported by Rob Wu on 2018-01-01
    • -
  • [796107] Medium CVE-2018-6141: Heap buffer overflow in Skia. Reported by Yangkang (@dnpushme) and Wanglu of Qihoo360 Qex Team on 2017-12-19
    • -
  • [837939] Medium CVE-2018-6142: Out of bounds memory access in V8. Reported by Choongwoo Han of Naver Corporation on 2018-04-28
    • -
  • [843022] Medium CVE-2018-6143: Out of bounds memory access in V8. Reported by Guang Gong of Alpha Team, Qihoo 360 on 2018-05-15
    • -
  • [828049] Low CVE-2018-6144: Out of bounds memory access in PDFium. Reported by pdknsk on 2018-04-02
    • -
  • [805924] Low CVE-2018-6145: Incorrect escaping of MathML in Blink. Reported by Masato Kinugawa on 2018-01-25
    • -
  • [818133] Low CVE-2018-6147: Password fields not taking advantage of OS protections in Views. Reported by Michail Pishchagin (Yandex) on 2018-03-02
    • -
  • [847542] Various fixes from internal audits, fuzzing and other initiatives
    • -
-
- - - - CVE-2018-6123 - CVE-2018-6124 - CVE-2018-6125 - CVE-2018-6126 - CVE-2018-6127 - CVE-2018-6128 - CVE-2018-6129 - CVE-2018-6130 - CVE-2018-6131 - CVE-2018-6132 - CVE-2018-6133 - CVE-2018-6134 - CVE-2018-6135 - CVE-2018-6136 - CVE-2018-6137 - CVE-2018-6138 - CVE-2018-6139 - CVE-2018-6140 - CVE-2018-6141 - CVE-2018-6142 - CVE-2018-6143 - CVE-2018-6144 - CVE-2018-6145 - CVE-2018-6147 - https://chromereleases.googleblog.com/2018/05/stable-channel-update-for-desktop_58.html - - - 2018-05-29 - 2018-05-30 - - - - - BIND -- multiple vulnerabilities - - - bind912 - 9.12.1P2 - - - - -

ISC reports:

-
-

An error in zone database reference counting can - lead to an assertion failure if a server which is - running an affected version of BIND attempts - several transfers of a slave zone in quick - succession.

-
-
-

A problem with the implementation of the new - serve-stale feature in BIND 9.12 can lead to - an assertion failure in rbtdb.c, even when - stale-answer-enable is off. Additionally, - problematic interaction between the serve-stale - feature and NSEC aggressive negative caching can - in some cases cause undesirable behavior from named, - such as a recursion loop or excessive logging.

-
- - - - CVE-2018-5736 - CVE-2018-5737 - https://kb.isc.org/article/AA-01602 - https://kb.isc.org/article/AA-01606 - - - 2018-05-18 - 2018-05-21 - - - - - cURL -- multiple vulnerabilities - - - curl - 7.60.0 - - - - -

cURL security problems:

-
-

CVE-2018-1000300: FTP shutdown response buffer overflow

-

curl might overflow a heap based memory buffer when closing down an - FTP connection with very long server command replies.

-

When doing FTP transfers, curl keeps a spare "closure handle" around - internally that will be used when an FTP connection gets shut down - since the original curl easy handle is then already removed.

-

FTP server response data that gets cached from the original transfer - might then be larger than the default buffer size (16 KB) allocated in - the "closure handle", which can lead to a buffer overwrite. The - contents and size of that overwrite is controllable by the server.

-

This situation was detected by an assert() in the code, but that was - of course only preventing bad stuff in debug builds. This bug is very - unlikely to trigger with non-malicious servers.

-

We are not aware of any exploit of this flaw.

-

CVE-2018-1000301: RTSP bad headers buffer over-read

-

curl can be tricked into reading data beyond the end of a heap based - buffer used to store downloaded content.

-

When servers send RTSP responses back to curl, the data starts out - with a set of headers. curl parses that data to separate it into a - number of headers to deal with those appropriately and to find the end - of the headers that signal the start of the "body" part.

-

The function that splits up the response into headers is called - Curl_http_readwrite_headers() and in situations where it can't find a - single header in the buffer, it might end up leaving a pointer pointing - into the buffer instead of to the start of the buffer which then later - on may lead to an out of buffer read when code assumes that pointer - points to a full buffer size worth of memory to use.

-

This could potentially lead to information leakage but most likely a - crash/denial of service for applications if a server triggers this flaw.

-

We are not aware of any exploit of this flaw.

-
- - - - https://curl.haxx.se/docs/security.html - https://curl.haxx.se/docs/adv_2018-82c2.html - https://curl.haxx.se/docs/adv_2018-b138.html - CVE-2018-1000300 - CVE-2018-1000301 - - - 2018-05-16 - 2018-05-16 - - - - - wavpack -- multiple vulnerabilities - - - wavpack - 5.1.0_1 - - - - -

Sebastian Ramacher reports:

-
-

A stack-based buffer over-read in the ParseRiffHeaderConfig function of cli/riff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service attack or possibly have unspecified other impact via a maliciously crafted RF64 file.

-
-
-

The ParseDsdiffHeaderConfig function of the cli/dsdiff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service (heap-based buffer over-read) or possibly overwrite the heap via a maliciously crafted DSDIFF file.

-
-
-

The ParseCaffHeaderConfig function of the cli/caff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service (global buffer over-read), or possibly trigger a buffer overflow or incorrect memory allocation, via a maliciously crafted CAF file.

-
-

Thuan Pham reports:

-
-

An issue was discovered in WavPack 5.1.0 and earlier. The WAV parser component contains a vulnerability that allows writing to memory because ParseRiffHeaderConfig in riff.c does not reject multiple format chunks.

-
-
-

An issue was discovered in WavPack 5.1.0 and earlier. The W64 parser component contains a vulnerability that allows writing to memory because ParseWave64HeaderConfig in wave64.c does not reject multiple format chunks.

-
-
-

An issue was discovered in WavPack 5.1.0 and earlier for WAV input. Out-of-bounds writes can occur because ParseRiffHeaderConfig in riff.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call, leading to insufficient memory allocation.

-
-
-

An issue was discovered in WavPack 5.1.0 and earlier for DSDiff input. Out-of-bounds writes can occur because ParseDsdiffHeaderConfig in dsdiff.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call, leading to insufficient memory allocation.

-
-
-

An issue was discovered in WavPack 5.1.0 and earlier for W64 input. Out-of-bounds writes can occur because ParseWave64HeaderConfig in wave64.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call, leading to insufficient memory allocation.

-
- - - - CVE-2018-6767 - CVE-2018-7253 - CVE-2018-7254 - CVE-2018-10536 - CVE-2018-10537 - CVE-2018-10538 - CVE-2018-10539 - CVE-2018-10540 - https://www.debian.org/security/2018/dsa-4125 - https://www.debian.org/security/2018/dsa-4197 - 228141 - - - 2018-05-09 - 2018-05-11 - - - - - chromium -- multiple vulnerabilities - - - chromium - 66.0.3359.170 - - - - -

Google Chrome Releases reports:

-
-

4 security fixes in this release:

-
    -
  • [835887] Critical: Chain leading to sandbox escape. - Reported by Anonymous on 2018-04-23
    • -
  • [836858] High CVE-2018-6121: Privilege Escalation in extensions
    • -
  • [836141] High CVE-2018-6122: Type confusion in V8
    • -
  • [833721] High CVE-2018-6120: Heap buffer overflow in PDFium. - Reported by Zhou Aiting(@zhouat1) of Qihoo 360 Vulcan Team on 2018-04-17
    • -
  • [841841] Various fixes from internal audits, fuzzing and other initiatives
    • -
-
- - - - CVE-2018-6120 - CVE-2018-6121 - CVE-2018-6122 - https://chromereleases.googleblog.com/2018/05/stable-channel-update-for-desktop.html - - - 2018-04-14 - 2018-05-11 - - - - - jenkins -- multiple vulnerabilities - - - jenkins - 2.120 - - - jenkins-lts - 2.107.2 - - - - -

Jenkins developers report:

-
-

The agent to master security subsystem ensures that the Jenkins - master is protected from maliciously configured agents. A path - traversal vulnerability allowed agents to escape whitelisted - directories to read and write to files they should not be able to - access.

-

Black Duck Hub Plugin's API endpoint was affected by an XML - External Entity (XXE) processing vulnerability. This allowed an - attacker with Overall/Read access to have Jenkins parse a maliciously - crafted file that uses external entities for extraction of secrets - from the Jenkins master, server-side request forgery, or - denial-of-service attacks.

-

Several other lower severity issues were reported, see reference - url for details.

-
- - - - https://jenkins.io/security/advisory/2018-05-09/ - - - 2018-05-09 - 2018-05-10 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 60.0,1 - - - waterfox - 56.1.0_18 - - - seamonkey - linux-seamonkey - 2.49.4 - - - firefox-esr - 52.8.0,1 - - - linux-firefox - 52.8.0,2 - - - libxul - thunderbird - linux-thunderbird - 52.8.0 - - - - -

Mozilla Foundation reports:

-
-

CVE-2018-5183: Backport critical security fixes in Skia

-

CVE-2018-5154: Use-after-free with SVG animations and clip paths

-

CVE-2018-5155: Use-after-free with SVG animations and text paths

-

CVE-2018-5157: Same-origin bypass of PDF Viewer to view protected PDF files

-

CVE-2018-5158: Malicious PDF can inject JavaScript into PDF Viewer

-

CVE-2018-5159: Integer overflow and out-of-bounds write in Skia

-

CVE-2018-5160: Uninitialized memory use by WebRTC encoder

-

CVE-2018-5152: WebExtensions information leak through webRequest API

-

CVE-2018-5153: Out-of-bounds read in mixed content websocket messages

-

CVE-2018-5163: Replacing cached data in JavaScript Start-up Bytecode Cache

-

CVE-2018-5164: CSP not applied to all multipart content sent with multipart/x-mixed-replace

-

CVE-2018-5166: WebExtension host permission bypass through filterReponseData

-

CVE-2018-5167: Improper linkification of chrome: and javascript: content in web console and JavaScript debugger

-

CVE-2018-5168: Lightweight themes can be installed without user interaction

-

CVE-2018-5169: Dragging and dropping link text onto home button can set home page to include chrome pages

-

CVE-2018-5172: Pasted script from clipboard can run in the Live Bookmarks page or PDF viewer

-

CVE-2018-5173: File name spoofing of Downloads panel with Unicode characters

-

CVE-2018-5174: Windows Defender SmartScreen UI runs with less secure behavior for downloaded files in Windows 10 April 2018 Update

-

CVE-2018-5175: Universal CSP bypass on sites using strict-dynamic in their policies

-

CVE-2018-5176: JSON Viewer script injection

-

CVE-2018-5177: Buffer overflow in XSLT during number formatting

-

CVE-2018-5165: Checkbox for enabling Flash protected mode is inverted in 32-bit Firefox

-

CVE-2018-5178: Buffer overflow during UTF-8 to Unicode string conversion through legacy extension

-

CVE-2018-5180: heap-use-after-free in mozilla::WebGLContext::DrawElementsInstanced

-

CVE-2018-5181: Local file can be displayed in noopener tab through drag and drop of hyperlink

-

CVE-2018-5182: Local file can be displayed from hyperlink dragged and dropped on addressbar

-

CVE-2018-5151: Memory safety bugs fixed in Firefox 60

-

CVE-2018-5150: Memory safety bugs fixed in Firefox 60 and Firefox ESR 52.8

-
- - - - CVE-2018-5150 - CVE-2018-5151 - CVE-2018-5152 - CVE-2018-5153 - CVE-2018-5154 - CVE-2018-5155 - CVE-2018-5157 - CVE-2018-5158 - CVE-2018-5159 - CVE-2018-5160 - CVE-2018-5163 - CVE-2018-5164 - CVE-2018-5165 - CVE-2018-5166 - CVE-2018-5167 - CVE-2018-5168 - CVE-2018-5169 - CVE-2018-5172 - CVE-2018-5173 - CVE-2018-5174 - CVE-2018-5175 - CVE-2018-5176 - CVE-2018-5177 - CVE-2018-5178 - CVE-2018-5180 - CVE-2018-5181 - CVE-2018-5182 - CVE-2018-5183 - https://www.mozilla.org/security/advisories/mfsa2018-11/ - https://www.mozilla.org/security/advisories/mfsa2018-12/ - - - 2018-05-09 - 2018-05-09 - - - - - kamailio - buffer overflow - - - kamailio - 5.1.2 - - - - -

A specially crafted REGISTER message with a malformed branch or - From tag triggers an off-by-one heap-based buffer overflow in the - tmx_check_pretran function in modules/tmx/tmx_pretran.c

- - - - CVE-2018-8828 - https://www.kamailio.org/w/2018/03/kamailio-security-announcement-tmx-lcr/ - https://github.com/EnableSecurity/advisories/tree/master/ES2018-05-kamailio-heap-overflow - - - 2018-02-10 - 2018-05-06 - - - - - wget -- cookie injection vulnerability - - - wget - 1.19.5 - - - - -

Harry Sintonen of F-Secure Corporation reports:

-
-

GNU Wget is susceptible to a malicious web server injecting arbitrary cookies to the cookie jar file.

-
- - - - https://sintonen.fi/advisories/gnu-wget-cookie-injection.txt - CVE-2018-0494 - ports/228071 - - - 2018-04-26 - 2018-05-08 - - - - - Flash Player -- arbitrary code execution - - - linux-flashplayer - 29.0.0.171 - - - - -

Adobe reports:

-
-
    -
  • This update resolves a type confusion vulnerability that - could lead to arbitrary code execution (CVE-2018-4944).
    • -
-
- - - - CVE-2018-4944 - https://helpx.adobe.com/security/products/flash-player/apsb18-16.html - - - 2018-05-08 - 2018-05-09 - - - - - FreeBSD -- Mishandling of x86 debug exceptions - - - FreeBSD-kernel - 11.111.1_10 - 10.410.4_9 - - - - -

Problem Description:

-

The MOV SS and POP SS instructions inhibit debug exceptions - until the instruction boundary following the next instruction. - If that instruction is a system call or similar instruction - that transfers control to the operating system, the debug - exception will be handled in the kernel context instead of - the user context.

-

Impact:

-

An authenticated local attacker may be able to read - sensitive data in kernel memory, control low-level operating - system functions, or may panic the system.

- - - - CVE-2018-8897 - SA-18:06.debugreg - - - 2018-05-08 - 2018-05-08 - - - - - python 2.7 -- multiple vulnerabilities - - - python27 - 2.7.15 - - - - -

python release notes:

-
-

Multiple vulnerabilities has been fixed in this release. Please refer to the CVE list for details.

-
- - - - https://github.com/python/cpython/blob/2.7/Misc/NEWS.d/2.7.15rc1.rst - https://github.com/python/cpython/blob/2.7/Misc/NEWS.d/2.7.15.rst - CVE-2012-0876 - CVE-2016-0718 - CVE-2016-4472 - CVE-2016-9063 - CVE-2017-9233 - CVE-2018-1060 - CVE-2018-1061 - - - 2018-05-01 - 2018-05-05 - - - - - KWallet-PAM -- Access to privileged files - - - plasma5-kwallet-pam - 5.12.5_1 - - - - -

The KDE Community reports:

-
-

- kwallet-pam was doing file writing and permission changing - as root that with correct timing and use of carefully - crafted symbolic links could allow a non privileged user - to become the owner of any file on the system. -

-
- - - - https://www.kde.org/info/security/advisory-20180503-1.txt - - - 2018-05-04 - 2018-05-04 - - - - - drupal -- Drupal Core - Multiple Vulnerabilities - - - drupal7 - 7.58 - - - drupal8 - 8.5.2 - - - - -

Drupal Security Team reports:

-
-

A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. - This potentially allows attackers to exploit multiple attack vectors on a Drupal site, - which could result in the site being compromised. This vulnerability is related to - Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. - Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.

-
- - - - https://www.drupal.org/SA-CORE-2018-004 - - - 2018-04-25 - 2018-05-03 - - - - - Gitlab -- multiple vulnerabilities - - - gitlab - 10.7.010.7.2 - 10.6.010.6.5 - 9.5.010.5.8 - - - - -

GitLab reports:

-
-

Persistent XSS in Move Issue using project namespace

-

Download Archive allowing unauthorized private repo access

-

Mattermost Updates

-
- - - - CVE-2018-10379 - https://about.gitlab.com/2018/04/30/security-release-gitlab-10-dot-7-dot-2-released - - - 2018-04-30 - 2018-05-01 - - - - - chromium -- vulnerability - - - chromium - 66.0.3359.139 - - - - -

Google Chrome Releases reports:

-
-

3 security fixes in this release:

-
    -
  • [831963] Critical CVE-2018-6118: Use after free in Media Cache. Reported by Ned Williamson on 2018-04-12
    • -
  • [837635] Various fixes from internal audits, fuzzing and other initiatives
    • -
-
- - - - CVE-2018-6118 - https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop_26.html - - - 2018-04-12 - 2018-04-30 - - - - - quassel -- multiple vulnerabilities - - - quassel - 0.12.5 - - - quassel-core - 0.12.5 - - - - -

Gentoo reports:

-
-

quasselcore: corruption of heap metadata caused by qdatastream - leading to preauth remote code execution.

-
    -
  • Severity: high, by default the server port is publicly open - and the address can be requested using the /WHOIS command of IRC - protocol.
    • -
  • Description: In Qdatastream protocol each object is prepended - with 4 bytes for the object size, this can be used to trigger - allocation errors.
    • -
-

quasselcore DDOS

-
    -
  • Severity: low, only impacts unconfigured quasselcore - instances.
    • -
  • Description: A login attempt causes a NULL pointer dereference - when the database is not initialized.
    • -
-
- - - - https://bugs.gentoo.org/653834 - https://github.com/quassel/quassel/commit/08bace4e9ecf08273f094c0c6aa8b3363d38ac3e - https://github.com/quassel/quassel/commit/18389a713a6810f57ab237b945e8ee03df857b8b - - - 2018-04-24 - 2018-04-26 - - - - - chromium -- vulnerability - - - chromium - 66.0.3359.117 - - - - -

Google Chrome Releases reports:

-
-

62 security fixes in this release:

-
    -
  • [826626] Critical CVE-2018-6085: Use after free in Disk Cache. Reported by Ned Williamson on 2018-03-28
    • -
  • [827492] Critical CVE-2018-6086: Use after free in Disk Cache. Reported by Ned Williamson on 2018-03-30
    • -
  • [813876] High CVE-2018-6087: Use after free in WebAssembly. Reported by Anonymous on 2018-02-20
    • -
  • [822091] High CVE-2018-6088: Use after free in PDFium. Reported by Anonymous on 2018-03-15
    • -
  • [808838] High CVE-2018-6089: Same origin policy bypass in Service Worker. Reported by Rob Wu on 2018-02-04
    • -
  • [820913] High CVE-2018-6090: Heap buffer overflow in Skia. Reported by ZhanJia Song on 2018-03-12
    • -
  • [771933] High CVE-2018-6091: Incorrect handling of plug-ins by Service Worker. Reported by Jun Kokatsu (@shhnjk) on 2017-10-05
    • -
  • [819869] High CVE-2018-6092: Integer overflow in WebAssembly. Reported by Natalie Silvanovich of Google Project Zero on 2018-03-08
    • -
  • [780435] Medium CVE-2018-6093: Same origin bypass in Service Worker. Reported by Jun Kokatsu (@shhnjk) on 2017-11-01
    • -
  • [633030] Medium CVE-2018-6094: Exploit hardening regression in Oilpan. Reported by Chris Rohlf on 2016-08-01
    • -
  • [637098] Medium CVE-2018-6095: Lack of meaningful user interaction requirement before file upload. Reported by Abdulrahman Alqabandi (@qab) on 2016-08-11
    • -
  • [776418] Medium CVE-2018-6096: Fullscreen UI spoof. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-10-19
    • -
  • [806162] Medium CVE-2018-6097: Fullscreen UI spoof. Reported by xisigr of Tencent's Xuanwu Lab on 2018-01-26
    • -
  • [798892] Medium CVE-2018-6098: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-01-03
    • -
  • [808825] Medium CVE-2018-6099: CORS bypass in ServiceWorker. Reported by Jun Kokatsu (@shhnjk) on 2018-02-03
    • -
  • [811117] Medium CVE-2018-6100: URL spoof in Omnibox. Reported by Lnyas Zhang on 2018-02-11
    • -
  • [813540] Medium CVE-2018-6101: Insufficient protection of remote debugging prototol in DevTools . Reported by Rob Wu on 2018-02-19
    • -
  • [813814] Medium CVE-2018-6102: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-02-20
    • -
  • [816033] Medium CVE-2018-6103: UI spoof in Permissions. Reported by Khalil Zhani on 2018-02-24
    • -
  • [820068] Medium CVE-2018-6104: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-03-08
    • -
  • [803571] Medium CVE-2018-6105: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-01-18
    • -
  • [805729] Medium CVE-2018-6106: Incorrect handling of promises in V8. Reported by lokihardt of Google Project Zero on 2018-01-25
    • -
  • [808316] Medium CVE-2018-6107: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-02-02
    • -
  • [816769] Medium CVE-2018-6108: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-02-27
    • -
  • [710190] Low CVE-2018-6109: Incorrect handling of files by FileAPI. Reported by Dominik Weber (@DoWeb_) on 2017-04-10
    • -
  • [777737] Low CVE-2018-6110: Incorrect handling of plaintext files via file:// . Reported by Wenxiang Qian (aka blastxiang) on 2017-10-24
    • -
  • [780694] Low CVE-2018-6111: Heap-use-after-free in DevTools. Reported by Khalil Zhani on 2017-11-02
    • -
  • [798096] Low CVE-2018-6112: Incorrect URL handling in DevTools. Reported by Rob Wu on 2017-12-29
    • -
  • [805900] Low CVE-2018-6113: URL spoof in Navigation. Reported by Khalil Zhani on 2018-01-25
    • -
  • [811691] Low CVE-2018-6114: CSP bypass. Reported by Lnyas Zhang on 2018-02-13
    • -
  • [819809] Low CVE-2018-6115: SmartScreen bypass in downloads. Reported by James Feher on 2018-03-07
    • -
  • [822266] Low CVE-2018-6116: Incorrect low memory handling in WebAssembly. Reported by Jin from Chengdu Security Response Center of Qihoo 360 Technology Co. Ltd. on 2018-03-15
    • -
  • [822465] Low CVE-2018-6117: Confusing autofill settings. Reported by Spencer Dailey on 2018-03-15
    • -
  • [822424] Low CVE-2018-6084: Incorrect use of Distributed Objects in Google Software Updater on MacOS. Reported by Ian Beer of Google Project Zero on 2018-03-15
    • -
-
- - - - https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop.html - CVE-2018-6085 - CVE-2018-6086 - CVE-2018-6087 - CVE-2018-6088 - CVE-2018-6089 - CVE-2018-6090 - CVE-2018-6091 - CVE-2018-6092 - CVE-2018-6093 - CVE-2018-6094 - CVE-2018-6095 - CVE-2018-6096 - CVE-2018-6097 - CVE-2018-6098 - CVE-2018-6099 - CVE-2018-6100 - CVE-2018-6101 - CVE-2018-6102 - CVE-2018-6103 - CVE-2018-6104 - CVE-2018-6105 - CVE-2018-6106 - CVE-2018-6107 - CVE-2018-6108 - CVE-2018-6109 - CVE-2018-6110 - CVE-2018-6111 - CVE-2018-6112 - CVE-2018-6113 - CVE-2018-6114 - CVE-2018-6115 - CVE-2018-6116 - CVE-2018-6117 - CVE-2018-6084 - - - 2017-04-10 - 2018-04-24 - - - - - mbed TLS (PolarSSL) -- multiple vulnerabilities - - - mbedtls - 2.7.2 - - - polarssl13 - * - - - - -

Simon Butcher reports:

-
-
    -
  • Defend against Bellcore glitch attacks by verifying the results - of RSA private key operations.
    • -
  • Fix implementation of the truncated HMAC extension. The - previous implementation allowed an offline 2^80 brute force - attack on the HMAC key of a single, uninterrupted connection - (with no resumption of the session).
    • -
  • Reject CRLs containing unsupported critical extensions. Found - by Falko Strenzke and Evangelos Karatsiolis.
    • -
  • Fix a buffer overread in ssl_parse_server_key_exchange() that - could cause a crash on invalid input.
    • -
  • Fix a buffer overread in ssl_parse_server_psk_hint() that could - cause a crash on invalid input.
    • -
-
- - - - https://tls.mbed.org/tech-updates/releases/mbedtls-2.8.0-2.7.2-and-2.1.11-released - - - 2018-03-21 - 2018-04-23 - - - - - MySQL -- multiple vulnerabilities - - - mariadb55-server - 5.5.60 - - - mariadb100-server - 10.0.35 - - - mariadb101-server - 10.1.33 - - - mariadb102-server - 10.2.15 - - - mysql55-server - 5.5.60 - - - mysql56-server - 5.6.40 - - - mysql57-server - 5.7.22 - - - percona55-server - 5.5.60 - - - percona56-server - 5.6.40 - - - percona57-server - 5.7.22 - - - - -

Oracle reports:

-
-

MySQL Multiple Flaws Let Remote Authenticated Users Access and - Modify Data, Remote and Local Users Deny Service, and Local Users - Access Data and Gain Elevated Privileges

-
    -
  • A local user can exploit a flaw in the Replication component - to gain elevated privileges [CVE-2018-2755].
    • -
  • A remote authenticated user can exploit a flaw in the GIS - Extension component to cause denial of service conditions - [CVE-2018-2805].
    • -
  • A remote authenticated user can exploit a flaw in the InnoDB - component to cause denial of service conditions [CVE-2018-2782, - CVE-2018-2784, CVE-2018-2819].
    • -
  • A remote authenticated user can exploit a flaw in the Security - Privileges component to cause denial of service conditions - [CVE-2018-2758, CVE-2018-2818].
    • -
  • A remote authenticated user can exploit a flaw in the DDL - component to cause denial of service conditions - [CVE-2018-2817].
    • -
  • A remote authenticated user can exploit a flaw in the Optimizer - component to cause denial of service conditions [CVE-2018-2775, - CVE-2018-2778, CVE-2018-2779, CVE-2018-2780, CVE-2018-2781, - CVE-2018-2816].
    • -
  • A remote user can exploit a flaw in the Client programs - component to cause denial of service conditions [CVE-2018-2761, - CVE-2018-2773].
    • -
  • A remote authenticated user can exploit a flaw in the InnoDB - component to partially modify data and cause denial of service - conditions [CVE-2018-2786, CVE-2018-2787].
    • -
  • A remote authenticated user can exploit a flaw in the Optimizer - component to partially modify data and cause denial of service - conditions [CVE-2018-2812].
    • -
  • A local user can exploit a flaw in the Cluster ndbcluster/plugin - component to cause denial of service conditions [CVE-2018-2877]. -
    • -
  • A remote authenticated user can exploit a flaw in the InnoDB - component to cause denial of service conditions [CVE-2018-2759, - CVE-2018-2766, CVE-2018-2777, CVE-2018-2810].
    • -
  • A remote authenticated user can exploit a flaw in the DML - component to cause denial of service conditions [CVE-2018-2839]. -
    • -
  • A remote authenticated user can exploit a flaw in the - Performance Schema component to cause denial of service conditions - [CVE-2018-2846].
    • -
  • A remote authenticated user can exploit a flaw in the Pluggable - Auth component to cause denial of service conditions - [CVE-2018-2769].
    • -
  • A remote authenticated user can exploit a flaw in the Group - Replication GCS component to cause denial of service conditions - [CVE-2018-2776].
    • -
  • A local user can exploit a flaw in the Connection component to - cause denial of service conditions [CVE-2018-2762].
    • -
  • A remote authenticated user can exploit a flaw in the Locking - component to cause denial of service conditions [CVE-2018-2771]. -
    • -
  • A remote authenticated user can exploit a flaw in the DDL - component to partially access data [CVE-2018-2813].
    • -
-
- - - - http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html - CVE-2018-2755 - CVE-2018-2805 - CVE-2018-2782 - CVE-2018-2784 - CVE-2018-2819 - CVE-2018-2758 - CVE-2018-2817 - CVE-2018-2775 - CVE-2018-2780 - CVE-2018-2761 - CVE-2018-2786 - CVE-2018-2787 - CVE-2018-2812 - CVE-2018-2877 - CVE-2018-2759 - CVE-2018-2766 - CVE-2018-2777 - CVE-2018-2810 - CVE-2018-2818 - CVE-2018-2839 - CVE-2018-2778 - CVE-2018-2779 - CVE-2018-2781 - CVE-2018-2816 - CVE-2018-2846 - CVE-2018-2769 - CVE-2018-2776 - CVE-2018-2762 - CVE-2018-2771 - CVE-2018-2813 - CVE-2018-2773 - - - 2018-04-17 - 2018-04-21 - - - - - wordpress -- multiple issues - - - wordpress - fr-wordpress - 4.9.5,1 - - - de-wordpress - zh_CN-wordpress - zh_TW-wordpress - ja-wordpress - 4.9.5 - - - - -

wordpress developers reports:

-
-

Don't treat localhost as same host by default.

-

Use safe redirects when redirecting the login page if SSL is forced.

-

Make sure the version string is correctly escaped for use in generator tags.

-
- - - - https://wordpress.org/news/2018/04/wordpress-4-9-5-security-and-maintenance-release/ - - - 2018-04-03 - 2018-04-20 - - - - - phpmyadmin -- CSRF vulnerability allowing arbitrary SQL execution - - - phpmyadmin - 4.8.04.8.0.1 - - - - -

The phpMyAdmin development team reports:

-
-

Summary

-

CSRF vulnerability allowing arbitrary SQL execution

-

Description

-

By deceiving a user to click on a crafted URL, it is - possible for an attacker to execute arbitrary SQL - commands.

-

Severity

-

We consider this vulnerability to be critical.

-
- - - - https://www.phpmyadmin.net/security/PMASA-2018-2/ - - - 2018-04-17 - 2018-04-19 - - - - - drupal -- Drupal core - Moderately critical - - - drupal8 - 8.5.2 - - - - -

The Drupal security team reports:

-
-

CKEditor, a third-party JavaScript library included in Drupal - core, has fixed a cross-site scripting (XSS) vulnerability. The - vulnerability stemmed from the fact that it was possible to execute - XSS inside CKEditor when using the image2 plugin (which Drupal 8 - core also uses).

-
- - - - https://www.drupal.org/sa-core-2018-003 - - - 2018-04-18 - 2018-04-19 - - - - - OpenSSL -- Cache timing vulnerability - - - openssl - 1.0.2o_2,1 - - - openssl-devel - 1.1.0h_1 - - - - -

The OpenSSL project reports:

-
-

The OpenSSL RSA Key generation algorithm has been shown to be - vulnerable to a cache timing side channel attack. An attacker - with sufficient access to mount cache timing attacks during the - RSA key generation process could recover the private key.

-
- - - - https://www.openssl.org/news/secadv/20180416.txt - CVE-2018-0737 - - - 2018-04-16 - 2018-04-16 - - - - - drupal -- Drupal Core - Multiple Vulnerabilities - - - drupal7 - 7.57 - - - - -

Drupal Security Team reports:

-
-

CVE-2018-7600: Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, - and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because - of an issue affecting multiple subsystems with default or common module configurations.

-
- - - - CVE-2018-7600 - - - 2018-03-13 - 2018-04-16 - - - - - perl -- multiple vulnerabilities - - - perl5 - 5.24.05.24.4 - 5.26.05.26.2 - - - - -

perldelta:

-
-

CVE-2018-6797: heap-buffer-overflow (WRITE of size 1) in S_regatom - (regcomp.c)

-

A crafted regular expression could cause a heap buffer write overflow, - with control over the bytes written. [perl #132227]

-

CVE-2018-6798: Heap-buffer-overflow in Perl__byte_dump_string (utf8.c)

-

Matching a crafted locale dependent regular expression could cause a - heap buffer read overflow and potentially information disclosure. [perl - #132063]

-

CVE-2018-6913: heap-buffer-overflow in S_pack_rec

-

pack() could cause a heap buffer write overflow with a large item - count. [perl #131844]

-
- - - - https://metacpan.org/changes/release/SHAY/perl-5.26.2 - https://metacpan.org/changes/release/SHAY/perl-5.24.4 - CVE-2018-6797 - CVE-2018-6798 - CVE-2018-6913 - - - 2018-04-14 - 2018-04-15 - - - - - ipsec-tools -- remotely exploitable computational-complexity attack - - - ipsec-tools - 0.8.2_3 - - - - -

Robert Foggia via NetBSD GNATS reports:

-
-

The ipsec-tools racoon daemon contains a remotely exploitable computational - complexity attack when parsing and storing isakmp fragments. The implementation - permits a remote attacker to exhaust computational resources on the remote endpoint - by repeatedly sending isakmp fragment packets in a particular order such that - the worst-case computational complexity is realized in the algorithm utilized - to determine if reassembly of the fragments can take place.

-
- - - - https://gnats.netbsd.org/cgi-bin/query-pr-single.pl?number=51682 - CVE-2016-10396 - - - 2016-12-02 - 2018-04-14 - - - - - nghttp2 -- Denial of service due to NULL pointer dereference - - - libnghttp2 - nghttp2 - 1.10.01.31.1 - - - - -

nghttp2 blog:

-
-

If ALTSVC frame is received by libnghttp2 and it is larger than it can - accept, the pointer field which points to ALTSVC frame payload is left - NULL. Later libnghttp2 attempts to access another field through the - pointer, and gets segmentation fault.

-

ALTSVC frame is defined by RFC 7838.

-

The largest frame size libnghttp2 accept is by default 16384 bytes.

-

Receiving ALTSVC frame is disabled by default. Application has to - enable it explicitly by calling - nghttp2_option_set_builtin_recv_extension_type(opt, NGHTTP2_ALTSVC).

-

Transmission of ALTSVC is always enabled, and it does not cause this - vulnerability.

-

ALTSVC frame is expected to be sent by server, and received by client - as defined in RFC 7838.

-

Client and server are both affected by this vulnerability if the - reception of ALTSVC frame is enabled. As written earlier, it is useless - to enable reception of ALTSVC frame on server side. So, server is - generally safe unless application accidentally enabled the reception of - ALTSVC frame.

-
- - - - https://nghttp2.org/blog/2018/04/12/nghttp2-v1-31-1/ - CVE-2018-1000168 - - - 2018-04-04 - 2018-04-13 - - - - - roundcube -- IMAP command injection vulnerability - - - roundcube - 1.3.5,1 - - - - -

Upstream reports:

-
-

This update primarily fixes a recently discovered IMAP-cmd-injection - vulnerability caused by insufficient input validation within - the archive plugin. - Details about the vulnerability are published under CVE-2018-9846.

-
- - - - CVE-2018-9846 - https://roundcube.net/news/2018/04/11/security-update-1.3.6 - - - 2018-04-11 - 2018-04-13 - - - - - jenkins -- multiple vulnerabilities - - - jenkins - 2.115 - - - jenkins-lts - 2.107.1 - - - - -

Jenkins developers report:

-
-

The Jenkins CLI sent different error responses for commands with - view and agent arguments depending on the existence of the specified - views or agents to unauthorized users. This allowed attackers to - determine whether views or agents with specified names exist.

-

The Jenkins CLI now returns the same error messages to unauthorized - users independent of the existence of specified view or agent - names

-

Some JavaScript confirmation dialogs included the item name in an - unsafe manner, resulting in a possible cross-site scripting - vulnerability exploitable by users with permission to create or - configure items.

-

JavaScript confirmation dialogs that include the item name now - properly escape it, so it can be safely displayed.

-
- - - - https://jenkins.io/security/advisory/2018-04-11/ - - - 2018-04-11 - 2018-04-12 - - - - - Flash Player -- multiple vulnerabilities - - - linux-flashplayer - 29.0.0.140 - - - - -

Adobe reports:

-
-
    -
  • This update resolves a use-after-free vulnerability that - could lead to remote code execution (CVE-2018-4932).
    • -
  • This update resolves out-of-bounds read vulnerabilities that - could lead to information disclosure (CVE-2018-4933, - CVE-2018-4934).
    • -
  • This update resolves out-of-bounds write vulnerabilities that - could lead to remote code execution (CVE-2018-4935, - CVE-2018-4937).
    • -
  • This update resolves a heap overflow vulnerability that - could lead to information disclosure (CVE-2018-4936).
    • -
-
- - - - CVE-2018-4932 - CVE-2018-4933 - CVE-2018-4934 - CVE-2018-4935 - CVE-2018-4936 - CVE-2018-4937 - https://helpx.adobe.com/security/products/flash-player/apsb18-08.html - - - 2018-04-10 - 2018-04-10 - 2018-07-11 - - - - - Gitlab -- multiple vulnerabilities - - - gitlab - 10.6.010.6.3 - 10.5.010.5.7 - 8.610.4.7 - - - - -

GitLab reports:

-
-

Confidential issue comments in Slack, Mattermost, and webhook integrations.

-

Persistent XSS in milestones data-milestone-id.

-

Persistent XSS in filename of merge request.

-
- - - - https://about.gitlab.com/2018/04/04/security-release-gitlab-10-dot-6-dot-3-released/ - - - 2018-04-04 - 2018-04-05 - - - - - FreeBSD -- ipsec crash or denial of service - - - FreeBSD-kernel - 11.111.1_9 - 10.410.4_8 - 10.310.3_29 - - - - -

Problem Description:

-

The length field of the option header does not count the - size of the option header itself. This causes a problem - when the length is zero, the count is then incremented by - zero, which causes an infinite loop.

-

In addition there are pointer/offset mistakes in the - handling of IPv4 options.

-

Impact:

-

A remote attacker who is able to send an arbitrary packet, - could cause the remote target machine to crash.

- - - - CVE-2018-6918 - SA-18:05.ipsec - - - 2018-04-04 - 2018-04-05 - - - - - FreeBSD -- vt console memory disclosure - - - FreeBSD-kernel - 11.111.1_9 - 10.410.4_8 - 10.310.3_29 - - - - -

Problem Description:

-

Insufficient validation of user-provided font parameters - can result in an integer overflow, leading to the use of - arbitrary kernel memory as glyph data. Characters that - reference this data can be displayed on the screen, effectively - disclosing kernel memory.

-

Impact:

-

Unprivileged users may be able to access privileged - kernel data.

-

Such memory might contain sensitive information, such - as portions of the file cache or terminal buffers. This - information might be directly useful, or it might be leveraged - to obtain elevated privileges in some way; for example, a - terminal buffer might include a user-entered password.

- - - - CVE-2018-6917 - SA-18:04.vt - - - 2018-04-04 - 2018-04-05 - - - - - moodle -- multiple vulnerabilities - - - moodle31 - 3.1.11 - - - moodle32 - 3.2.8 - - - moodle33 - 3.3.5 - - - moodle34 - 3.4.2 - - - - -

moodle reports:

-
-

Unauthenticated users can trigger custom messages to admin via - paypal enrol script.

-

Suspended users with OAuth 2 authentication method can still log in to - the site.

-
- - - - CVE-2018-1081 - CVE-2018-1082 - https://moodle.org/mod/forum/discuss.php?d=367938 - - - 2018-03-14 - 2018-03-31 - - - - - ruby -- multiple vulnerabilities - - - ruby - 2.3.0,12.3.7,1 - 2.4.0,12.4.4,1 - 2.5.0,12.5.1,1 - - - - -

Ruby news:

-
-

CVE-2017-17742: HTTP response splitting in WEBrick

-

If a script accepts an external input and outputs it without - modification as a part of HTTP responses, an attacker can use newline - characters to deceive the clients that the HTTP response header is - stopped at there, and can inject fake HTTP responses after the newline - characters to show malicious contents to the clients.

-

CVE-2018-6914: Unintentional file and directory creation with - directory traversal in tempfile and tmpdir

-

Dir.mktmpdir method introduced by tmpdir library accepts the prefix - and the suffix of the directory which is created as the first parameter. - The prefix can contain relative directory specifiers "../", so this - method can be used to target any directory. So, if a script accepts an - external input as the prefix, and the targeted directory has - inappropriate permissions or the ruby process has inappropriate - privileges, the attacker can create a directory or a file at any - directory.

-

CVE-2018-8777: DoS by large request in WEBrick

-

If an attacker sends a large request which contains huge HTTP headers, - WEBrick try to process it on memory, so the request causes the - out-of-memory DoS attack.

-

CVE-2018-8778: Buffer under-read in String#unpack

-

String#unpack receives format specifiers as its parameter, and can - be specified the position of parsing the data by the specifier @. If a - big number is passed with @, the number is treated as the negative - value, and out-of-buffer read is occurred. So, if a script accepts an - external input as the argument of String#unpack, the attacker can read - data on heaps.

-

CVE-2018-8779: Unintentional socket creation by poisoned NUL byte in - UNIXServer and UNIXSocket

-

UNIXServer.open accepts the path of the socket to be created at the - first parameter. If the path contains NUL (\0) bytes, this method - recognize that the path is completed before the NUL bytes. So, if a - script accepts an external input as the argument of this method, the - attacker can make the socket file in the unintentional path. And, - UNIXSocket.open also accepts the path of the socket to be created at - the first parameter without checking NUL bytes like UNIXServer.open. - So, if a script accepts an external input as the argument of this - method, the attacker can accepts the socket file in the unintentional - path.

-

CVE-2018-8780: Unintentional directory traversal by poisoned NUL byte - in Dir

-

Dir.open, Dir.new, Dir.entries and Dir.empty? accept the path of the - target directory as their parameter. If the parameter contains NUL (\0) - bytes, these methods recognize that the path is completed before the - NUL bytes. So, if a script accepts an external input as the argument of - these methods, the attacker can make the unintentional directory - traversal.

-
- - - - https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-5-1-released/ - https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-4-4-released/ - https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-3-7-released/ - https://www.ruby-lang.org/en/news/2018/03/28/http-response-splitting-in-webrick-cve-2017-17742/ - https://www.ruby-lang.org/en/news/2018/03/28/unintentional-file-and-directory-creation-with-directory-traversal-cve-2018-6914/ - https://www.ruby-lang.org/en/news/2018/03/28/large-request-dos-in-webrick-cve-2018-8777/ - https://www.ruby-lang.org/en/news/2018/03/28/buffer-under-read-unpack-cve-2018-8778/ - https://www.ruby-lang.org/en/news/2018/03/28/poisoned-nul-byte-unixsocket-cve-2018-8779/ - https://www.ruby-lang.org/en/news/2018/03/28/poisoned-nul-byte-dir-cve-2018-8780/ - CVE-2017-17742 - CVE-2018-6914 - CVE-2018-8777 - CVE-2018-8778 - CVE-2018-8779 - CVE-2018-8780 - - - 2018-03-28 - 2018-03-29 - - - - - node.js -- multiple vulnerabilities - - - node4 - 4.9.0 - - - node6 - 6.14.0 - - - node8 - 8.11.0 - - - node - 9.10.0 - - - - -

Node.js reports:

-
-

Node.js Inspector DNS rebinding vulnerability (CVE-2018-7160)

-

Node.js 6.x and later include a debugger protocol (also known as "inspector") that can be activated by the --inspect and related command line flags. This debugger service was vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution.

-

'path' module regular expression denial of service (CVE-2018-7158)

-

The 'path' module in the Node.js 4.x release line contains a potential regular expression denial of service (ReDoS) vector. The code in question was replaced in Node.js 6.x and later so this vulnerability only impacts all versions of Node.js 4.x.

-

Spaces in HTTP Content-Length header values are ignored (CVE-2018-7159)

-

The HTTP parser in all current versions of Node.js ignores spaces in the Content-Length header, allowing input such as Content-Length: 1 2 to be interpreted as having a value of 12. The HTTP specification does not allow for spaces in the Content-Length value and the Node.js HTTP parser has been brought into line on this particular difference.

-
- - - - https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/ - CVE-2018-7158 - CVE-2018-7159 - CVE-2018-7160 - - - 2018-03-21 - 2018-03-28 - 2018-03-28 - - - - - webkit2-gtk3 -- multiple vulnerabilities - - - webkit2-gtk3 - 2.16.62.20.0 - - - - -

The WebKit team reports many vulnerabilities.

-

Please reference the CVE/URL list for details.

- - - - https://webkitgtk.org/security/WSA-2017-0008.html - https://webkitgtk.org/security/WSA-2017-0009.html - https://webkitgtk.org/security/WSA-2017-0010.html - https://webkitgtk.org/security/WSA-2018-0001.html - https://webkitgtk.org/security/WSA-2018-0002.html - CVE-2017-7087 - CVE-2017-7089 - CVE-2017-7090 - CVE-2017-7091 - CVE-2017-7092 - CVE-2017-7092 - CVE-2017-7093 - CVE-2017-7095 - CVE-2017-7096 - CVE-2017-7098 - CVE-2017-7100 - CVE-2017-7102 - CVE-2017-7104 - CVE-2017-7107 - CVE-2017-7109 - CVE-2017-7111 - CVE-2017-7117 - CVE-2017-7120 - CVE-2017-13783 - CVE-2017-13784 - CVE-2017-13785 - CVE-2017-13788 - CVE-2017-13791 - CVE-2017-13792 - CVE-2017-13794 - CVE-2017-13795 - CVE-2017-13796 - CVE-2017-13798 - CVE-2017-13802 - CVE-2017-13803 - CVE-2017-7156 - CVE-2017-7157 - CVE-2017-13856 - CVE-2017-13866 - CVE-2017-13870 - CVE-2017-5753 - CVE-2017-5715 - CVE-2018-4088 - CVE-2018-4089 - CVE-2018-4096 - CVE-2017-7153 - CVE-2017-7160 - CVE-2017-7161 - CVE-2017-7165 - CVE-2017-13884 - CVE-2017-13885 - - - 2017-10-18 - 2018-03-28 - 2018-03-28 - - - - - chromium -- vulnerability - - - chromium - 65.0.3325.181 - - - - -

Google Chrome Releases reports:

-
-

1 security fix in this release, including:

-
    -
  • [823553] Various fixes from internal audits, fuzzing and other initiatives
    • -
-
- - - - https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop_20.html - - - 2018-03-20 - 2018-03-27 - - - - - OpenSSL -- multiple vulnerabilities - - - openssl - 1.0.2o,1 - - - openssl-devel - 1.1.0h - - - - -

The OpenSSL project reports:

-
-
  • Constructed ASN.1 types with a recursive definition could - exceed the stack (CVE-2018-0739)
    - Constructed ASN.1 types with a recursive definition (such as can be - found in PKCS7) could eventually exceed the stack given malicious input - with excessive recursion. This could result in a Denial Of Service - attack. There are no such structures used within SSL/TLS that come from - untrusted sources so this is considered safe.
    • -
  • rsaz_1024_mul_avx2 overflow bug on x86_64 (CVE-2017-3738)
    - There is an overflow bug in the AVX2 Montgomery multiplication - procedure used in exponentiation with 1024-bit moduli. This only - affects processors that support the AVX2 but not ADX extensions - like Intel Haswell (4th generation).
    • -
-
- - - - https://www.openssl.org/news/secadv/20180327.txt - CVE-2018-0739 - CVE-2017-3738 - - - 2018-03-27 - 2018-03-27 - - - - - Gitlab -- multiple vulnerabilities - - - gitlab - 10.5.010.5.6 - 10.4.010.4.6 - 8.310.3.9 - - - - -

GitLab reports:

-
-

SSRF in services and web hooks

-

There were multiple server-side request forgery issues in the Services feature. - An attacker could make requests to servers within the same network of the GitLab - instance. This could lead to information disclosure, authentication bypass, or - potentially code execution. This issue has been assigned - CVE-2018-8801.

-

Gitlab Auth0 integration issue

-

There was an issue with the GitLab omniauth-auth0 configuration - which resulted in the Auth0 integration signing in the wrong users.

-
- - - - CVE-2018-8801 - https://about.gitlab.com/2018/03/20/critical-security-release-gitlab-10-dot-5-dot-6-released/ - - - 2018-03-20 - 2018-03-27 - 2018-04-07 - - - - - mozilla -- use-after-free in compositor - - - firefox - 59.0.2,1 - - - waterfox - 56.0.4.36_3 - - - seamonkey - linux-seamonkey - 2.49.3 - - - firefox-esr - 52.7.3,1 - - - linux-firefox - 52.7.3,2 - - - libxul - 52.7.3 - - - linux-thunderbird - 52.7.1 - - - thunderbird - 52.7.0_1 - - - - -

The Mozilla Foundation reports:

-
-

CVE-2018-5148: Use-after-free in compositor

-

A use-after-free vulnerability can occur in the - compositor during certain graphics operations when a raw - pointer is used instead of a reference counted one. This - results in a potentially exploitable crash.

-
- - - - CVE-2018-5148 - https://www.mozilla.org/security/advisories/mfsa2018-10/ - - - 2018-03-26 - 2018-03-27 - 2018-03-31 - - - - - rails-html-sanitizer -- possible XSS vulnerability - - - rubygem-rails-html-sanitizer - 1.0.4 - - - - -

OSS-Security list:

-
-

There is a possible XSS vulnerability in rails-html-sanitizer. The gem - allows non-whitelisted attributes to be present in sanitized output - when input with specially-crafted HTML fragments, and these attributes - can lead to an XSS attack on target applications.

-

This issue is similar to CVE-2018-8048 in Loofah.

-
- - - - http://www.openwall.com/lists/oss-security/2018/03/22/4 - CVE-2018-3741 - - - 2018-03-22 - 2018-03-24 - - - - - apache -- multiple vulnerabilities - - - apache24 - 2.4.30 - - - apache22 - 2.2.34_5 - - - - -

The Apache httpd reports:

-
-

Out of bound write in mod_authnz_ldap with AuthLDAPCharsetConfig - enabled (CVE-2017-15710)

-

mod_session: CGI-like applications that intend to read from - mod_session's 'SessionEnv ON' could be fooled into reading - user-supplied data instead. (CVE-2018-1283)

-

mod_cache_socache: Fix request headers parsing to avoid a possible - crash with specially crafted input data. (CVE-2018-1303)

-

core: Possible crash with excessively long HTTP request headers. - Impractical to exploit with a production build and production - LogLevel. (CVE-2018-1301)

-

core: Configure the regular expression engine to match '$' to the - end of the input string only, excluding matching the end of any - embedded newline characters. Behavior can be changed with new - directive 'RegexDefaultOptions'. (CVE-2017-15715)

-

mod_auth_digest: Fix generation of nonce values to prevent replay - attacks across servers using a common Digest domain. This change - may cause problems if used with round robin load balancers. - (CVE-2018-1312)

-

mod_http2: Potential crash w/ mod_http2. (CVE-2018-1302)

-
- - - - https://www.apache.org/dist/httpd/CHANGES_2.4.33 - CVE-2017-15710 - CVE-2018-1283 - CVE-2018-1303 - CVE-2018-1301 - CVE-2017-15715 - CVE-2018-1312 - CVE-2018-1302 - - - 2018-03-23 - 2018-03-24 - 2018-03-27 - - - - - mybb -- multiple vulnerabilities - - - mybb - 1.8.15 - - - - -

mybb Team reports:

-
-

Medium risk: Tasks Local File Inclusion

-

Medium risk: Forum Password Check Bypass

-

Low risk: Admin Permissions Group Title XSS

-

Low risk: Attachment types file extension XSS

-

Low risk: Moderator Tools XSS

-

Low risk: Security Questions XSS

-

Low risk: Settings Management XSS

-

Low risk: Templates Set Name XSS

-

Low risk: Usergroup Promotions XSS

-

Low risk: Warning Types XSS

-
- - - - https://blog.mybb.com/2018/03/15/mybb-1-8-15-released-security-maintenance-release/ - - - 2018-03-15 - 2018-03-24 - - - - - SQLite -- Corrupt DB can cause a NULL pointer dereference - - - sqlite3 - 3.22.0_1 - - - - -

MITRE reports:

-
-

SQLite databases whose schema is corrupted using a CREATE TABLE AS - statement could cause a NULL pointer dereference, related to build.c - and prepare.c.

-
- - - - CVE-2018-8740 - http://openwall.com/lists/oss-security/2018/03/17/1 - - - 2018-03-16 - 2018-03-22 - - - - - Sanitize -- XSS vulnerability - - - rubygem-sanitize - 2.6.3 - - - - -

Sanitize release:

-
-

Fixed an HTML injection vulnerability that could allow XSS.

-

When Sanitize <= 4.6.2 is used in combination with libxml2 >= 2.9.2, - a specially crafted HTML fragment can cause libxml2 to generate - improperly escaped output, allowing non-whitelisted attributes to be - used on whitelisted elements.

-

Sanitize now performs additional escaping on affected attributes to - prevent this.

-
- - - - https://github.com/rgrove/sanitize/releases - https://github.com/rgrove/sanitize/issues/176 - CVE-2018-3740 - - - 2018-03-19 - 2018-03-21 - - - - - Loofah -- XSS vulnerability - - - rubygem-loofah - 2.2.1 - - - - -

GitHub issue:

-
-

This issue has been created for public disclosure of an XSS / code - injection vulnerability that was responsibly reported by the Shopify - Application Security Team.

-

Loofah allows non-whitelisted attributes to be present in sanitized - output when input with specially-crafted HTML fragments.

-
- - - - https://github.com/flavorjones/loofah/releases - https://github.com/flavorjones/loofah/issues/144 - CVE-2018-8048 - - - 2018-03-15 - 2018-03-20 - - - - - Jupyter Notebook -- vulnerability - - - py27-notebook - py34-notebook - py35-notebook - py36-notebook - 5.4.1 - - - - -

MITRE reports:

-
-

In Jupyter Notebook before 5.4.1, a maliciously forged notebook file - can bypass sanitization to execute JavaScript in the notebook context. - Specifically, invalid HTML is 'fixed' by jQuery after sanitization, - making it dangerous.

-
- - - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8768 - CVE-2018-8768 - - - 2018-03-18 - 2018-03-19 - - - - - SquirrelMail -- post-authentication access privileges - - - squirrelmail - 20170705 - - - - -

Florian Grunow reports:

-
-

An attacker able to exploit this vulnerability can extract files - of the server the application is running on. This may include - configuration files, log files and additionally all files that are - readable for all users on the system. This issue is - post-authentication. That means an attacker would need valid - credentials for the application to log in or needs to exploit an - additional vulnerability of which we are not aware of at this point - of time.

-

An attacker would also be able to delete files on the system, if - the user running the application has the rights to do so.

-

Does this issue affect me?

-

Likely yes, if you are using Squirrelmail. We checked the latest - development version, which is 1.5.2-svn and the latest version - available for download at this point of time, 1.4.22. Both contain - the vulnerable code.

-
- - - - http://www.openwall.com/lists/oss-security/2018/03/17/2 - https://nvd.nist.gov/vuln/detail/CVE-2018-8741 - CVE-2018-8741 - - - 2017-05-21 - 2018-03-17 - - - - - slurm-wlm -- SQL Injection attacks against SlurmDBD - - - slurm-wlm - 17.02.10 - - - - -

SchedMD reports:

-
-

Several issues were discovered with incomplete sanitization of - user-provided text strings, which could potentially lead to SQL - injection attacks against SlurmDBD itself. Such exploits could lead to a - loss of accounting data, or escalation of user privileges on the cluster.

-
- - - - CVE-2018-7033 - https://nvd.nist.gov/vuln/detail/CVE-2018-7033 - - - 2018-03-15 - 2018-03-17 - - - - - libvorbis -- multiple vulnerabilities - - - libvorbis - 1.3.6,3 - - - - -

NVD reports:

-
-

Xiph.Org libvorbis 1.3.5 allows Remote Code Execution - upon freeing uninitialized memory in the function - vorbis_analysis_headerout() in info.c when - vi->channels<=0, a similar issue to Mozilla bug - 550184.

-
-
-

In Xiph.Org libvorbis 1.3.5, an out-of-bounds array read - vulnerability exists in the function mapping0_forward() in - mapping0.c, which may lead to DoS when operating on a - crafted audio file with vorbis_analysis().

-
- - - - CVE-2017-14632 - CVE-2017-14633 - - - 2018-03-16 - 2018-03-16 - - - - - mozilla -- multiple vulnerabilities - - - libvorbis - 1.3.6,3 - - - libtremor - 1.2.1.s20180316 - - - firefox - 59.0.1,1 - - - waterfox - 56.0.4.36_3 - - - seamonkey - linux-seamonkey - 2.49.3 - - - firefox-esr - 52.7.2,1 - - - linux-firefox - 52.7.2,2 - - - libxul - 52.7.3 - - - thunderbird - linux-thunderbird - 52.7.0 - - - - -

The Mozilla Foundation reports:

-
-

CVE-2018-5146: Out of bounds memory write in libvorbis

-

An out of bounds memory write while processing Vorbis - audio data was reported through the Pwn2Own contest.

-

CVE-2018-5147: Out of bounds memory write in libtremor

-

The libtremor library has the same flaw as - CVE-2018-5146. This library is used by Firefox in place of - libvorbis on Android and ARM platforms.

-
- - - - CVE-2018-5146 - CVE-2018-5147 - https://www.mozilla.org/security/advisories/mfsa2018-08/ - https://www.mozilla.org/security/advisories/mfsa2018-09/ - - - 2018-03-16 - 2018-03-16 - 2018-03-31 - - - - - e2fsprogs -- potential buffer overrun bugs in the blkid library and in the fsck program - - - e2fsprogs - 1.44.0 - - - e2fsprogs-libblkid - 1.44.0 - - - - -

Theodore Y. Ts'o reports:

-
-

Fixed some potential buffer overrun bugs in the blkid library and in the fsck program.

-
- - - - http://e2fsprogs.sourceforge.net/e2fsprogs-release.html#1.44.0 - - - 2018-03-07 - 2018-03-14 - - - - - FreeBSD -- Speculative Execution Vulnerabilities - - - FreeBSD-kernel - 11.111.1_8 - - - - -

Problem Description:

-

A number of issues relating to speculative execution - were found last year and publicly announced January 3rd. - Two of these, known as Meltdown and Spectre V2, are addressed - here.

-

CVE-2017-5754 (Meltdown) - ------------------------

-

This issue relies on an affected CPU speculatively - executing instructions beyond a faulting instruction. When - this happens, changes to architectural state are not - committed, but observable changes may be left in micro- - architectural state (for example, cache). This may be used - to infer privileged data.

-

CVE-2017-5715 (Spectre V2) - --------------------------

-

Spectre V2 uses branch target injection to speculatively - execute kernel code at an address under the control of an - attacker.

-

Impact:

-

An attacker may be able to read secret data from the - kernel or from a process when executing untrusted code (for - example, in a web browser).

- - - - CVE-2017-5715 - CVE-2017-5754 - SA-18:03.speculative_execution - - - 2018-03-14 - 2018-03-14 - - - - - FreeBSD -- ipsec validation and use-after-free - - - FreeBSD-kernel - 11.111.1_7 - 10.410.4_7 - 10.310.3_28 - - - - -

Problem Description:

-

Due to a lack of strict checking, an attacker from a - trusted host can send a specially constructed IP packet - that may lead to a system crash.

-

Additionally, a use-after-free vulnerability in the AH - handling code could cause unpredictable results.

-

Impact:

-

Access to out of bounds or freed mbuf data can lead to - a kernel panic or other unpredictable results.

- - - - CVE-2018-6916 - SA-18:01.ipsec - - - 2018-03-07 - 2018-03-14 - - - - - Flash Player -- multiple vulnerabilities - - - linux-flashplayer - 29.0.0.113 - - - - -

Adobe reports:

-
-
    -
  • This update resolves a use-after-free vulnerability that - could lead to remote code execution (CVE-2018-4919).
    • -
  • This update resolves a type confusion vulnerability that - could lead to remote code execution (CVE-2018-4920).
    • -
-
- - - - CVE-2018-4919 - CVE-2018-4920 - https://helpx.adobe.com/security/products/flash-player/apsb18-05.html - - - 2018-03-13 - 2018-03-13 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 59.0_1,1 - - - waterfox - 56.0.4.36_3 - - - seamonkey - linux-seamonkey - 2.49.3 - - - firefox-esr - 52.7.0,1 - - - linux-firefox - 52.7.0,2 - - - libxul - thunderbird - linux-thunderbird - 52.7.0 - - - - -

Mozilla Foundation reports:

-
-

CVE-2018-5127: Buffer overflow manipulating SVG animatedPathSegList

-

CVE-2018-5128: Use-after-free manipulating editor selection ranges

-

CVE-2018-5129: Out-of-bounds write with malformed IPC messages

-

CVE-2018-5130: Mismatched RTP payload type can trigger memory corruption

-

CVE-2018-5131: Fetch API improperly returns cached copies of no-store/no-cache resources

-

CVE-2018-5132: WebExtension Find API can search privileged pages

-

CVE-2018-5133: Value of the app.support.baseURL preference is not properly sanitized

-

CVE-2018-5134: WebExtensions may use view-source: URLs to bypass content restrictions

-

CVE-2018-5135: WebExtension browserAction can inject scripts into unintended contexts

-

CVE-2018-5136: Same-origin policy violation with data: URL shared workers

-

CVE-2018-5137: Script content can access legacy extension non-contentaccessible resources

-

CVE-2018-5138: Android Custom Tab address spoofing through long domain names

-

CVE-2018-5140: Moz-icon images accessible to web content through moz-icon: protocol

-

CVE-2018-5141: DOS attack through notifications Push API

-

CVE-2018-5142: Media Capture and Streams API permissions display incorrect origin with data: and blob: URLs

-

CVE-2018-5143: Self-XSS pasting javascript: URL with embedded tab into addressbar

-

CVE-2018-5126: Memory safety bugs fixed in Firefox 59

-

CVE-2018-5125: Memory safety bugs fixed in Firefox 59 and Firefox ESR 52.7

-
- - - - CVE-2018-5125 - CVE-2018-5126 - CVE-2018-5127 - CVE-2018-5128 - CVE-2018-5129 - CVE-2018-5130 - CVE-2018-5131 - CVE-2018-5132 - CVE-2018-5133 - CVE-2018-5134 - CVE-2018-5135 - CVE-2018-5136 - CVE-2018-5137 - CVE-2018-5138 - CVE-2018-5140 - CVE-2018-5141 - CVE-2018-5142 - CVE-2018-5143 - https://www.mozilla.org/security/advisories/mfsa2018-06/ - https://www.mozilla.org/security/advisories/mfsa2018-07/ - - - 2018-03-13 - 2018-03-13 - 2018-03-16 - - - - - samba -- multiple vulnerabilities - - - samba44 - 4.4.17 - - - samba45 - 4.5.16 - - - samba46 - 4.6.14 - - - samba47 - 4.7.6 - - - - -

The samba project reports:

-
-

Missing null pointer checks may crash the external - print server process.

-
-
-

On a Samba 4 AD DC any authenticated user can change - other user's passwords over LDAP, including the - passwords of administrative users and service accounts.

-
- - - - https://www.samba.org/samba/security/CVE-2018-1050.html - CVE-2018-1050 - https://www.samba.org/samba/security/CVE-2018-1057.html - CVE-2018-1057 - - - 2018-01-03 - 2018-03-13 - - - - - mbed TLS (PolarSSL) -- remote code execution - - - mbedtls - 2.7.0 - - - polarssl13 - 1.3.22 - - - - -

Simon Butcher reports:

-
-
    -
  • When the truncated HMAC extension is enabled and CBC is used, - sending a malicious application packet can be used to selectively - corrupt 6 bytes on the peer's heap, potentially leading to a - crash or remote code execution. This can be triggered remotely - from either side in both TLS and DTLS.
    • -
  • When RSASSA-PSS signature verification is enabled, sending a - maliciously constructed certificate chain can be used to cause a - buffer overflow on the peer's stack, potentially leading to crash - or remote code execution. This can be triggered remotely from - either side in both TLS and DTLS.
    • -
-
- - - - https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-01 - CVE-2018-0487 - CVE-2018-0488 - - - 2018-02-05 - 2018-03-10 - - - - -chromium -- vulnerability - - - chromium - 65.0.3325.146 - - - - -

Google Chrome Releases reports:

-
-

45 security fixes in this release:

-
    -
  • [758848] High CVE-2017-11215: Use after free in Flash. Reported by JieZeng of Tencent Zhanlu Lab on 2017-08-25
    • -
  • [758863] High CVE-2017-11225: Use after free in Flash. Reported by JieZeng of Tencent Zhanlu Lab on 2017-08-25
    • -
  • [780919] High CVE-2018-6060: Use after free in Blink. Reported by Omair on 2017-11-02
    • -
  • [794091] High CVE-2018-6061: Race condition in V8. Reported by Guang Gong of Alpha Team, Qihoo 360 on 2017-12-12
    • -
  • [780104] High CVE-2018-6062: Heap buffer overflow in Skia. Reported by Anonymous on 2017-10-31
    • -
  • [789959] High CVE-2018-6057: Incorrect permissions on shared memory. Reported by Gal Beniamini of Google Project Zero on 2017-11-30
    • -
  • [792900] High CVE-2018-6063: Incorrect permissions on shared memory. Reported by Gal Beniamini of Google Project Zero on 2017-12-07
    • -
  • [798644] High CVE-2018-6064: Type confusion in V8. Reported by lokihardt of Google Project Zero on 2018-01-03
    • -
  • [808192] High CVE-2018-6065: Integer overflow in V8. Reported by Mark Brand of Google Project Zero on 2018-02-01
    • -
  • [799477] Medium CVE-2018-6066: Same Origin Bypass via canvas. Reported by Masato Kinugawa on 2018-01-05
    • -
  • [779428] Medium CVE-2018-6067: Buffer overflow in Skia. Reported by Ned Williamson on 2017-10-30
    • -
  • [779428] Medium CVE-2018-6067: Buffer overflow in Skia. Reported by Ned Williamson on 2017-10-30
    • -
  • [799918] Medium CVE-2018-6069: Stack buffer overflow in Skia. Reported by Wanglu and Yangkang(@dnpushme) of Qihoo360 Qex Team on 2018-01-08
    • -
  • [668645] Medium CVE-2018-6070: CSP bypass through extensions. Reported by Rob Wu on 2016-11-25
    • -
  • [777318] Medium CVE-2018-6071: Heap bufffer overflow in Skia. Reported by Anonymous on 2017-10-23
    • -
  • [791048] Medium CVE-2018-6072: Integer overflow in PDFium. Reported by Atte Kettunen of OUSPG on 2017-12-01
    • -
  • [804118] Medium CVE-2018-6073: Heap bufffer overflow in WebGL. Reported by Omair on 2018-01-20
    • -
  • [809759] Medium CVE-2018-6074: Mark-of-the-Web bypass. Reported by Abdulrahman Alqabandi (@qab) on 2018-02-06
    • -
  • [608669] Medium CVE-2018-6075: Overly permissive cross origin downloads. Reported by Inti De Ceukelaire (intigriti.com) on 2016-05-03
    • -
  • [758523] Medium CVE-2018-6076: Incorrect handling of URL fragment identifiers in Blink. Reported by Mateusz Krzeszowiec on 2017-08-24
    • -
  • [778506] Medium CVE-2018-6077: Timing attack using SVG filters. Reported by Khalil Zhani on 2017-10-26
    • -
  • [793628] Medium CVE-2018-6078: URL Spoof in OmniBox. Reported by Khalil Zhani on 2017-12-10
    • -
  • [788448] Medium CVE-2018-6079: Information disclosure via texture data in WebGL. Reported by Ivars Atteka on 2017-11-24
    • -
  • [792028] Medium CVE-2018-6080: Information disclosure in IPC call. Reported by Gal Beniamini of Google Project Zero on 2017-12-05
    • -
  • [797525] Low CVE-2018-6081: XSS in interstitials. Reported by Rob Wu on 2017-12-24
    • -
  • [767354] Low CVE-2018-6082: Circumvention of port blocking. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-09-21
    • -
  • [771709] Low CVE-2018-6083: Incorrect processing of AppManifests. Reported by Jun Kokatsu (@shhnjk) on 2017-10-04
    • -
-
- - - - CVE-2017-11215 - CVE-2017-11225 - CVE-2018-6060 - CVE-2018-6061 - CVE-2018-6060 - CVE-2018-6061 - CVE-2018-6062 - CVE-2018-6057 - CVE-2018-6063 - CVE-2018-6064 - CVE-2018-6065 - CVE-2018-6066 - CVE-2018-6067 - CVE-2018-6069 - CVE-2018-6070 - CVE-2018-6071 - CVE-2018-6072 - CVE-2018-6073 - CVE-2018-6074 - CVE-2018-6075 - CVE-2018-6076 - CVE-2018-6077 - CVE-2018-6078 - CVE-2018-6079 - CVE-2018-6080 - CVE-2018-6081 - CVE-2018-6082 - CVE-2018-6083 - https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html - - - 2016-05-03 - 2018-03-08 - - - - - wireshark -- multiple security issues - - - wireshark - 2.2.02.2.13 - 2.4.02.4.5 - - - wireshark-lite - 2.2.02.2.13 - 2.4.02.4.5 - - - wireshark-qt5 - 2.2.02.2.13 - 2.4.02.4.5 - - - tshark - 2.2.02.2.13 - 2.4.02.4.5 - - - tshark-lite - 2.2.02.2.13 - 2.4.02.4.5 - - - - -

wireshark developers reports:

-
-

wnpa-sec-2018-05. IEEE 802.11 dissector crash. (CVE-2018-7335)

-

wnpa-sec-2018-06. Large or infinite loops in multiple dissectors. (CVE-2018-7321 through CVE-2018-7333)

-

wnpa-sec-2018-07. UMTS MAC dissector crash. (CVE-2018-7334)

-

wnpa-sec-2018-08. DOCSIS dissector crash. (CVE-2018-7337)

-

wnpa-sec-2018-09. FCP dissector crash. (CVE-2018-7336)

-

wnpa-sec-2018-10. SIGCOMP dissector crash. (CVE-2018-7320)

-

wnpa-sec-2018-11. Pcapng file parser crash.

-

wnpa-sec-2018-12. IPMI dissector crash.

-

wnpa-sec-2018-13. SIGCOMP dissector crash.

-

wnpa-sec-2018-14. NBAP dissector crash.

-
- - - - https://www.wireshark.org/security/ - https://www.wireshark.org/security/wnpa-sec-2018-05.html - https://www.wireshark.org/security/wnpa-sec-2018-06.html - https://www.wireshark.org/security/wnpa-sec-2018-07.html - https://www.wireshark.org/security/wnpa-sec-2018-08.html - https://www.wireshark.org/security/wnpa-sec-2018-09.html - https://www.wireshark.org/security/wnpa-sec-2018-10.html - https://www.wireshark.org/security/wnpa-sec-2018-11.html - https://www.wireshark.org/security/wnpa-sec-2018-12.html - https://www.wireshark.org/security/wnpa-sec-2018-13.html - https://www.wireshark.org/security/wnpa-sec-2018-14.html - CVE-2018-7320 - CVE-2018-7321 - CVE-2018-7322 - CVE-2018-7323 - CVE-2018-7324 - CVE-2018-7325 - CVE-2018-7326 - CVE-2018-7327 - CVE-2018-7328 - CVE-2018-7329 - CVE-2018-7330 - CVE-2018-7331 - CVE-2018-7332 - CVE-2018-7333 - CVE-2018-7334 - CVE-2018-7335 - CVE-2018-7336 - CVE-2018-7337 - CVE-2018-7417 - - - 2018-02-23 - 2018-03-04 - - - - - isc-dhcp -- Multiple vulnerabilities - - - isc-dhcp44-server - 4.4.1 - - - isc-dhcp44-client - 4.4.1 - - - isc-dhcp43-server - 4.3.6 - - - isc-dhcp43-client - 4.3.6 - - - - -

ISC reports:

-
-

Failure to properly bounds check a buffer used for processing - DHCP options allows a malicious server (or an entity - masquerading as a server) to cause a buffer overflow (and - resulting crash) in dhclient by sending a response containing a - specially constructed options section.

-
-
-

A malicious client which is allowed to send very large amounts - of traffic (billions of packets) to a DHCP server can eventually - overflow a 32-bit reference counter, potentially causing dhcpd - to crash.

-
- - - - CVE-2018-5732 - CVE-2018-5733 - https://kb.isc.org/article/AA-01565 - https://kb.isc.org/article/AA-01567 - - - 2018-02-21 - 2018-03-02 - - - - - libsndfile -- out-of-bounds reads - - - libsndfile - linux-c6-libsndfile - linux-c7-libsndfile - 1.0.28_2 - - - - -

Xin-Jiang on Github reports:

-
-

CVE-2017-14245 (Medium): An out of bounds read in the function - d2alaw_array() in alaw.c of libsndfile 1.0.28 may lead to a remote - DoS attack or information disclosure, related to mishandling of - the NAN and INFINITY floating-point values.

-

CVE-2017-14246 (Medium): An out of bounds read in the function - d2ulaw_array() in ulaw.c of libsndfile 1.0.28 may lead to a remote - DoS attack or information disclosure, related to mishandling of the - NAN and INFINITY floating-point values.

-
-

my123px on Github reports:

-
-

CVE-2017-17456 (Medium): The function d2alaw_array() in alaw.c of - libsndfile 1.0.29pre1 may lead to a remote DoS attack (SEGV on unknown - address 0x000000000000), a different vulnerability than CVE-2017-14245.

-

CVE-2017-17457 (Medium): The function d2ulaw_array() in ulaw.c of - libsndfile 1.0.29pre1 may lead to a remote DoS attack (SEGV on unknown - address 0x000000000000), a different vulnerability than CVE-2017-14246.

-
- - - - CVE-2017-14245 - CVE-2017-14246 - https://github.com/erikd/libsndfile/issues/317 - CVE-2017-17456 - CVE-2017-17457 - https://github.com/erikd/libsndfile/issues/344 - - - 2017-09-11 - 2018-03-01 - - - - - libsndfile -- multiple vulnerabilities - - - libsndfile - linux-c6-libsndfile - linux-c7-libsndfile - 1.0.28_2 - - - - -

Agostino Sarubbo, Gentoo reports:

-
-

CVE-2017-8361 (Medium): The flac_buffer_copy function in flac.c in - libsndfile 1.0.28 allows remote attackers to cause a denial of service - (buffer overflow and application crash) or possibly have unspecified - other impact via a crafted audio file.

-
-
-

CVE-2017-8362 (Medium): The flac_buffer_copy function in flac.c in - libsndfile 1.0.28 allows remote attackers to cause a denial of service - (invalid read and application crash) via a crafted audio file.

-
-
-

CVE-2017-8363 (Medium): The flac_buffer_copy function in flac.c in - libsndfile 1.0.28 allows remote attackers to cause a denial of service - (heap-based buffer over-read and application crash) via a crafted audio - file.

-
-
-

CVE-2017-8365 (Medium): The i2les_array function in pcm.c in libsndfile - 1.0.28 allows remote attackers to cause a denial of service (buffer - over-read and application crash) via a crafted audio file.

-
-

manxorist on Github reports:

-
-

CVE-2017-12562 (High): Heap-based Buffer Overflow in the - psf_binheader_writef function in common.c in libsndfile through - 1.0.28 allows remote attackers to cause a denial of service - (application crash) or possibly have unspecified other impact.

-
-

Xin-Jiang on Github reports:

-
-

CVE-2017-14634 (Medium): In libsndfile 1.0.28, a divide-by-zero - error exists in the function double64_init() in double64.c, which - may lead to DoS when playing a crafted audio file.

-
- - - - CVE-2017-8361 - https://blogs.gentoo.org/ago/2017/04/29/libsndfile-global-buffer-overflow-in-flac_buffer_copy-flac-c/ - https://github.com/erikd/libsndfile/issues/232 - https://github.com/erikd/libsndfile/commit/fd0484aba8e51d16af1e3a880f9b8b857b385eb3 - CVE-2017-8362 - https://blogs.gentoo.org/ago/2017/04/29/libsndfile-invalid-memory-read-in-flac_buffer_copy-flac-c/ - https://github.com/erikd/libsndfile/issues/231 - https://github.com/erikd/libsndfile/commit/ef1dbb2df1c0e741486646de40bd638a9c4cd808 - CVE-2017-8363 - https://blogs.gentoo.org/ago/2017/04/29/libsndfile-heap-based-buffer-overflow-in-flac_buffer_copy-flac-c/ - https://github.com/erikd/libsndfile/issues/233 - https://github.com/erikd/libsndfile/commit/fd0484aba8e51d16af1e3a880f9b8b857b385eb3 - https://github.com/erikd/libsndfile/commit/cd7da8dbf6ee4310d21d9e44b385d6797160d9e8 - CVE-2017-8365 - https://blogs.gentoo.org/ago/2017/04/29/libsndfile-global-buffer-overflow-in-i2les_array-pcm-c/ - https://github.com/erikd/libsndfile/issues/230 - https://github.com/erikd/libsndfile/commit/fd0484aba8e51d16af1e3a880f9b8b857b385eb3 - CVE-2017-12562 - https://github.com/erikd/libsndfile/issues/292/ - https://github.com/erikd/libsndfile/commit/cf7a8182c2642c50f1cf90dddea9ce96a8bad2e8 - CVE-2017-14634 - https://github.com/erikd/libsndfile/issues/318 - https://github.com/erikd/libsndfile/commit/85c877d5072866aadbe8ed0c3e0590fbb5e16788 - - - 2017-04-12 - 2018-03-01 - - - - - PostgreSQL vulnerabilities - - - postgresql93-server - 9.3.09.3.22 - - - postgresql94-server - 9.4.09.4.17 - - - postgresql95-server - 9.5.09.5.12 - - - postgresql96-server - 9.6.09.6.8 - - - postgresql10-server - 10.010.3 - - - - -

The PostgreSQL project reports:

-
-
    -
  • CVE-2018-1058: Uncontrolled search path element in pg_dump and other client applications
    • -
-
- - - - https://wiki.postgresql.org/wiki/A_Guide_to_CVE-2018-1058:_Protect_Your_Search_Path - CVE-2018-1058 - - - 2018-03-01 - 2018-03-01 - - - - - strongswan - Insufficient input validation in RSASSA-PSS signature parser - - - strongswan - 5.6.1 - - - - -

Strongswan Release Notes reports:

-
-

Fixed a DoS vulnerability in the parser for PKCS#1 RSASSA-PSS signatures that - was caused by insufficient input validation. One of the configurable - parameters in algorithm identifier structures for RSASSA-PSS signatures is the - mask generation function (MGF). Only MGF1 is currently specified for this - purpose. However, this in turn takes itself a parameter that specifies the - underlying hash function. strongSwan's parser did not correctly handle the - case of this parameter being absent, causing an undefined data read. - his vulnerability has been registered as CVE-2018-6459.

-
- - - - CVE-2018-6459 - https://github.com/strongswan/strongswan/commit/40da179f28b768ffcf6ff7e2f68675eb44806668 - - - 2018-01-31 - 2018-02-19 - - - - - libsndfile -- out-of-bounds read memory access - - - libsndfile - linux-c6-libsndfile - linux-c7-libsndfile - 1.0.28_2 - - - - -

Laurent Delosieres, Secunia Research at Flexera Software reports:

-
-

Secunia Research has discovered a vulnerability in libsndfile, which can be - exploited by malicious people to disclose potentially sensitive information. - The vulnerability is caused due to an error in the "aiff_read_chanmap()" function - (src/aiff.c), which can be exploited to cause an out-of-bounds read memory access - via a specially crafted AIFF file. The vulnerability is confirmed in version 1.0.28. - Other versions may also be affected.

-
- - - - CVE-2017-6892 - https://nvd.nist.gov/vuln/detail/CVE-2017-6892 - https://secuniaresearch.flexerasoftware.com/secunia_research/2017-13/ - https://github.com/erikd/libsndfile/commit/f833c53cb596e9e1792949f762e0b33661822748 - - - 2017-05-23 - 2018-03-01 - - - - - ntp -- multiple vulnerabilities - - - FreeBSD - 11.111.1_7 - 10.410.4_6 - 10.310.3_27 - - - ntp - 4.2.8p11 - - - ntp-devel - 0 - - - - -

Network Time Foundation reports:

-
-

The NTP Project at Network Time Foundation is releasing ntp-4.2.8p11.

-

This release addresses five security issues in ntpd:

-
    -
  • LOW/MEDIUM: Sec 3012 / CVE-2016-1549 / VU#961909: Sybil - vulnerability: ephemeral association attack
    • -
  • INFO/MEDIUM: Sec 3412 / CVE-2018-7182 / VU#961909: - ctl_getitem(): buffer read overrun leads to undefined - behavior and information leak
    • -
  • LOW: Sec 3415 / CVE-2018-7170 / VU#961909: Multiple - authenticated ephemeral associations
    • -
  • LOW: Sec 3453 / CVE-2018-7184 / VU#961909: Interleaved - symmetric mode cannot recover from bad state
    • -
  • LOW/MEDIUM: Sec 3454 / CVE-2018-7185 / VU#961909: - Unauthenticated packet can reset authenticated interleaved - association
    • -
-

one security issue in ntpq:

-
    -
  • MEDIUM: Sec 3414 / CVE-2018-7183 / VU#961909: - ntpq:decodearr() can write beyond its buffer limit
    • -
-

and provides over 33 bugfixes and 32 other improvements.

-
- - - - CVE-2016-1549 - CVE-2018-7182 - CVE-2018-7170 - CVE-2018-7184 - CVE-2018-7185 - CVE-2018-7183 - SA-18:02.ntp - http://support.ntp.org/bin/view/Main/SecurityNotice#February_2018_ntp_4_2_8p11_NTP_S - - - 2018-02-27 - 2018-02-28 - 2018-03-14 - - - - - chromium -- vulnerability - - - chromium - 64.0.3282.167 - - - - -

Google Chrome Releases reports:

-
-

1 security fix in this release:

-
    -
  • [806388] High CVE-2018-6056: Incorrect derived class instantiation in V8. Reported by lokihardt of Google Project Zero on 2018-01-26
    • -
-
- - - - CVE-2018-6056 - https://chromereleases.googleblog.com/2018/02/stable-channel-update-for-desktop_13.html - - - 2018-01-26 - 2018-02-27 - - - - - chromium -- multiple vulnerabilities - - - chromium - 64.0.3282.119 - - - - -

Google Chrome Releases reports:

-
-

Several security fixes in this release, including:

-
    -
  • [780450] High CVE-2018-6031: Use after free in PDFium. Reported by Anonymous on 2017-11-01
    • -
  • [787103] High CVE-2018-6032: Same origin bypass in Shared Worker. Reported by Jun Kokatsu (@shhnjk) on 2017-11-20
    • -
  • [793620] High CVE-2018-6033: Race when opening downloaded files. Reported by Juho Nurminen on 2017-12-09
    • -
  • [784183] Medium CVE-2018-6034: Integer overflow in Blink. Reported by Tobias Klein (www.trapkit.de) on 2017-11-12
    • -
  • [797500] Medium CVE-2018-6035: Insufficient isolation of devtools from extensions. Reported by Rob Wu on 2017-12-23
    • -
  • [797500] Medium CVE-2018-6035: Insufficient isolation of devtools from extensions. Reported by Rob Wu on 2017-12-23
    • -
  • [753645] Medium CVE-2018-6037: Insufficient user gesture requirements in autofill. Reported by Paul Stone of Context Information Security on - 2017-08-09
    • -
  • [774174] Medium CVE-2018-6038: Heap buffer overflow in WebGL. Reported by cloudfuzzer on 2017-10-12
    • -
  • [775527] Medium CVE-2018-6039: XSS in DevTools. Reported by Juho Nurminen on 2017-10-17
    • -
  • [778658] Medium CVE-2018-6040: Content security policy bypass. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-10-26
    • -
  • [760342] Medium CVE-2018-6041: URL spoof in Navigation. Reported by Luan Herrera on 2017-08-29
    • -
  • [773930] Medium CVE-2018-6042: URL spoof in OmniBox. Reported by Khalil Zhani on 2017-10-12
    • -
  • [785809] Medium CVE-2018-6043: Insufficient escaping with external URL handlers. Reported by 0x09AL on 2017-11-16
    • -
  • [797497] Medium CVE-2018-6045: Insufficient isolation of devtools from extensions. Reported by Rob Wu on 2017-12-23
    • -
  • [798163] Medium CVE-2018-6046: Insufficient isolation of devtools from extensions. Reported by Rob Wu on 2017-12-31
    • -
  • [799847] Medium CVE-2018-6047: Cross origin URL leak in WebGL. Reported by Masato Kinugawa on 2018-01-08
    • -
  • [763194] Low CVE-2018-6048: Referrer policy bypass in Blink. Reported by Jun Kokatsu (@shhnjk) on 2017-09-08
    • -
  • [771848] Low CVE-2017-15420: URL spoofing in Omnibox. Reported by Drew Springall (@_aaspring_) on 2017-10-05
    • -
  • [774438] Low CVE-2018-6049: UI spoof in Permissions. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-10-13
    • -
  • [774842] Low CVE-2018-6050: URL spoof in OmniBox. Reported by Jonathan Kew on 2017-10-15
    • -
  • [441275] Low CVE-2018-6051: Referrer leak in XSS Auditor. Reported by Antonio Sanso (@asanso) on 2014-12-11
    • -
  • [615608] Low CVE-2018-6052: Incomplete no-referrer policy implementation. Reported by Tanner Emek on 2016-05-28
    • -
  • [758169] Low CVE-2018-6053: Leak of page thumbnails in New Tab Page. Reported by Asset Kabdenov on 2017-08-23
    • -
  • [797511] Low CVE-2018-6054: Use after free in WebUI. Reported by Rob Wu on 2017-12-24
    • -
-
- - - - CVE-2018-6031 - CVE-2018-6032 - CVE-2018-6033 - CVE-2018-6034 - CVE-2018-6035 - CVE-2018-6036 - CVE-2018-6037 - CVE-2018-6038 - CVE-2018-6039 - CVE-2018-6040 - CVE-2018-6041 - CVE-2018-6042 - CVE-2018-6043 - CVE-2018-6045 - CVE-2018-6046 - CVE-2018-6047 - CVE-2018-6048 - CVE-2017-15420 - CVE-2018-6049 - CVE-2018-6050 - CVE-2018-6051 - CVE-2018-6052 - CVE-2018-6053 - CVE-2018-6054 - https://chromereleases.googleblog.com/2018/01/stable-channel-update-for-desktop_24.html - - - 2017-08-09 - 2018-02-27 - - - - - tomcat -- Security constraints ignored or applied too late - - - tomcat - 7.0.07.0.84 - 8.0.08.0.49 - 8.5.08.5.27 - 9.0.09.0.4 - - - - -

The Apache Software Foundation reports:

-
-

Security constraints defined by annotations of Servlets were only - applied once a Servlet had been loaded. Because security constraints - defined in this way apply to the URL pattern and any URLs below that - point, it was possible - depending on the order Servlets were loaded - - for some security constraints not to be applied. This could have exposed - resources to users who were not authorised to access them.

-
-
-

The URL pattern of "" (the empty string) which exactly maps to the - context root was not correctly handled when used as part of a security - constraint definition. This caused the constraint to be ignored. It was, - therefore, possible for unauthorised users to gain access to web - application resources that should have been protected. Only security - constraints with a URL pattern of the empty string were affected.

-
- - - - http://tomcat.apache.org/security-9.html - http://tomcat.apache.org/security-8.html - http://tomcat.apache.org/security-7.html - CVE-2018-1304 - CVE-2018-1305 - - - 2018-02-23 - 2018-02-23 - - - - - shibboleth-sp -- vulnerable to forged user attribute data - - - xmltooling - 1.6.4 - - - xerces-c3 - 3.1.4 - - - - -

Shibboleth consortium reports:

-
-

- Shibboleth SP software vulnerable to additional data forgery flaws -

-

- The XML processing performed by the Service Provider software has - been found to be vulnerable to new flaws similar in nature to the - one addressed in an advisory last month. -

-

- These bugs involve the use of other XML constructs rather than - entity references, and therefore required additional mitigation once - discovered. As with the previous issue, this flaw allows for - changes to an XML document that do not break a digital signature but - can alter the user data passed through to applications behind the SP - and result in impersonation attacks and exposure of protected - information. -

-

- As before, the use of XML Encryption is a significant mitigation, - but we have not dismissed the possibility that attacks on the - Response "envelope" may be possible, in both the original and this - new case. No actual attacks of this nature are known, so deployers - should prioritize patching systems that expect to handle unencrypted - SAML assertions. -

-

- An updated version of XMLTooling-C (V1.6.4) is available that - protects against these new attacks, and should help prevent similar - vulnerabilities in the future. -

-

- Unlike the previous case, these bugs are NOT prevented by any - existing Xerces-C parser version on any platform and cannot be - addressed by any means other than the updated XMLTooling-C library. -

-

- The Service Provider software relies on a generic XML parser to - process SAML responses and there are limitations in older versions - of the parser that make it impossible to fully disable Document Type - Definition (DTD) processing. -

-

- Through addition/manipulation of a DTD, it's possible to make - changes to an XML document that do not break a digital signature but - are mishandled by the SP and its libraries. These manipulations can - alter the user data passed through to applications behind the SP and - result in impersonation attacks and exposure of protected - information. -

-

- While newer versions of the xerces-c3 parser are configured by the - SP into disallowing the use of a DTD via an environment variable, - this feature is not present in the xerces-c3 parser before version - 3.1.4, so an additional fix is being provided now that an actual DTD - exploit has been identified. Xerces-c3-3.1.4 was committed to the - ports tree already on 2016-07-26. -

-
- - - - https://shibboleth.net/community/advisories/secadv_20180227.txt - CVE-2018-0489 - - - 2018-02-27 - 2018-02-27 - - - - - drupal -- Drupal Core - Multiple Vulnerabilities - - - drupal7 - 7.56 - - - drupal8 - 8.4.4 - - - - -

Drupal Security Team reports:

-
-

CVE-2017-6926: Comment reply form allows access to restricted content

-

CVE-2017-6927: JavaScript cross-site scripting prevention is incomplete

-

CVE-2017-6928: Private file access bypass - Moderately Critical

-

CVE-2017-6929: jQuery vulnerability with untrusted domains - Moderately Critical

-

CVE-2017-6930: Language fallback can be incorrect on multilingual sites with node access restrictions

-

CVE-2017-6931: Settings Tray access bypass

-

CVE-2017-6932: External link injection on 404 pages when linking to the current page

-
- - - - CVE-2017-6926 - CVE-2017-6927 - CVE-2017-6928 - CVE-2017-6929 - CVE-2017-6930 - CVE-2017-6931 - CVE-2017-6932 - - - 2018-02-21 - 2018-02-25 - - - - - cvs -- Remote code execution via ssh command injection - - - cvs - 1.20120905_5 - - - - -

Hank Leininger reports:

-
-

Bugs in Git, Subversion, and Mercurial were just announced and patched - which allowed arbitrary local command execution if a malicious name was - used for the remote server, such as starting with - to pass options to - the ssh client: - git clone ssh://-oProxyCommand=some-command... - CVS has a similar problem with the -d option:

-

Tested vanilla CVS 1.12.13, and Gentoo CVS 1.12.12-r11.

-
- - - - http://lists.nongnu.org/archive/html/bug-cvs/2017-08/msg00000.html - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=871810#10 - CVE-2017-12836 - ports/226088 - - - 2017-08-10 - 2018-02-24 - - - - - LibreOffice -- Remote arbitrary file disclosure vulnerability via WEBSERVICE formula - - - libreoffice - 5.4.5 - 6.0.06.0.1 - - - - -

LibreOffice reports:

-
-

LibreOffice Calc supports a WEBSERVICE function to obtain data by URL. - Vulnerable versions of LibreOffice allow WEBSERVICE to take a local file - URL (e.g file://) which can be used to inject local files into the - spreadsheet without warning the user. Subsequent formulas can operate on - that inserted data and construct a remote URL whose path leaks the local - data to a remote attacker.

-

In later versions of LibreOffice without this flaw, WEBSERVICE has now - been limited to accessing http and https URLs along with bringing - WEBSERVICE URLs under LibreOffice Calc's link management infrastructure.

-

Note: This vulnerability has been identified upstream - as CVE-2018-1055, but NVD/Mitre are advising it's a reservation - duplicate of CVE-2018-6871 which should be used instead.

-
- - - - https://www.libreoffice.org/about-us/security/advisories/cve-2018-1055/ - https://github.com/jollheef/libreoffice-remote-arbitrary-file-disclosure - CVE-2018-6871 - ports/225797 - - - 2018-02-09 - 2018-02-23 - - - - - squid -- Vulnerable to Denial of Service attack - - - squid - 3.5.27_3 - - - squid-devel - 4.0.23 - - - - -

Louis Dion-Marcil reports:

-
-

Due to incorrect pointer handling Squid is vulnerable to denial - of service attack when processing ESI responses.

-

This problem allows a remote server delivering certain ESI - response syntax to trigger a denial of service for all clients - accessing the Squid service.

-

Due to unrelated changes Squid-3.5 has become vulnerable to some - regular ESI server responses also triggering this issue.

-

This problem is limited to the Squid custom ESI parser. - Squid built to use libxml2 or libexpat XML parsers do not have - this problem.

-
-
-

Due to incorrect pointer handling Squid is vulnerable to denial - of service attack when processing ESI responses or downloading - intermediate CA certificates.

-

This problem allows a remote client delivering certain HTTP - requests in conjunction with certain trusted server responses to - trigger a denial of service for all clients accessing the Squid - service.

-
- - - - http://www.squid-cache.org/Advisories/SQUID-2018_1.txt - http://www.squid-cache.org/Advisories/SQUID-2018_2.txt - CVE-2018-1000024 - CVE-2018-1000027 - https://www.debian.org/security/2018/dsa-4122 - ports/226138 - - - 2017-12-13 - 2018-02-23 - - - - - asterisk -- multiple vulnerabilities - - - asterisk13 - 13.19.2 - - - - -

The Asterisk project reports:

-
-

AST-2018-004 - When processing a SUBSCRIBE request the - res_pjsip_pubsub module stores the accepted formats present - in the Accept headers of the request. This code did not - limit the number of headers it processed despite having - a fixed limit of 32. If more than 32 Accept headers were - present the code would write outside of its memory and - cause a crash.

-

AST-2018-005 - A crash occurs when a number of - authenticated INVITE messages are sent over TCP or TLS - and then the connection is suddenly closed. This issue - leads to a segmentation fault.

-
- - - - https://downloads.asterisk.org/pub/security/AST-2018-004.html - CVE-2018-7284 - https://downloads.asterisk.org/pub/security/AST-2018-005.html - CVE-2018-7286 - - - 2018-02-21 - 2018-02-22 - 2018-06-12 - - - - - asterisk and pjsip -- multiple vulnerabilities - - - asterisk13 - 13.19.2 - - - pjsip - 2.7.2 - - - pjsip-extsrtp - 2.7.2 - - - - -

The Asterisk project reports:

-
-

AST-2018-002 - By crafting an SDP message with an - invalid media format description Asterisk crashes when - using the pjsip channel driver because pjproject's sdp - parsing algorithm fails to catch the invalid media format - description.

-

AST-2018-003 - By crafting an SDP message body with - an invalid fmtp attribute Asterisk crashes when using the - pjsip channel driver because pjproject's fmtp retrieval - function fails to check if fmtp value is empty (set empty - if previously parsed as invalid).

-
- - - - https://downloads.asterisk.org/pub/security/AST-2018-002.html - https://downloads.asterisk.org/pub/security/AST-2018-003.html - - - 2018-02-21 - 2018-02-22 - - - - - phpMyAdmin -- self XSS in central columns feature - - - phpMyAdmin - 4.7.04.7.8 - - - - -

The phpMyAdmin team reports:

-
-

Summary

-

Self XSS in central columns feature

-

Description

-

A self-cross site scripting (XSS) vulnerability has been - reported relating to the central columns feature.

-

Severity

-

We consider this vulnerability to be of moderate severity.

-

Mitigation factor

-

A valid token must be used in the attack

-
- - - - https://www.phpmyadmin.net/security/PMASA-2018-1/ - CVE-2018-7260 - - - 2018-02-21 - 2018-02-22 - - - - - GitLab -- multiple vulnerabilities - - - gitlab - 6.1.010.2.7 - 10.3.010.3.6 - 10.4.010.4.2 - - - - -

GitLab reports:

-
-

SnippetFinder information disclosure

-

The GitLab SnippetFinder component contained an information disclosure - which allowed access to snippets restricted to Only team members or - configured as disabled. The issue is now resolved in the latest version.

-

LDAP API authorization issue

-

An LDAP API endpoint contained an authorization vulnerability which - unintentionally disclosed bulk LDAP groups data. This issue is now fixed in - the latest release.

-

Persistent XSS mermaid markdown

-

The mermaid markdown feature contained a persistent XSS issue that is now - resolved in the latest release.

-

Insecure direct object reference Todo API

-

The Todo API was vulnerable to an insecure direct object reference issue - which resulted in an information disclosure of confidential data.

-

GitHub import access control issue

-

An improper access control weakness issue was discovered in the GitHub - import feature. The issue allowed an attacker to create projects under other - accounts which they shouldn't have access to. The issue is now resolved in - the latest version.

-

Protected variables information disclosure

-

The CI jobs protected tag feature contained a vulnerability which - resulted in an information disclosure of protected variables. The issue is - now resolved in the latest release.

-
- - - - https://about.gitlab.com/2018/02/07/gitlab-security-10-4-3-plus-10-3-7-plus-10-2-8-blog/ - - - 2018-02-07 - 2018-02-21 - - - - - irssi -- multiple vulnerabilities - - - irssi - 1.1.1,1 - - - - -

Irssi reports:

-
-

Use after free when server is disconnected during netsplits. - Found by Joseph Bisch.

-

Use after free when SASL messages are received in unexpected order. - Found by Joseph Bisch.

-

Null pointer dereference when an “empty” nick has been observed by - Irssi. Found by Joseph Bisch.

-

When the number of windows exceed the available space, Irssi would - crash due to Null pointer dereference. Found by Joseph Bisch.

-

Certain nick names could result in out of bounds access when printing - theme strings. Found by Oss-Fuzz.

-
- - - - https://irssi.org/security/irssi_sa_2018_02.txt - CVE-2018-7054 - CVE-2018-7053 - CVE-2018-7052 - CVE-2018-7051 - CVE-2018-7050 - ports/226001 - - - 2018-02-15 - 2018-02-19 - 2018-02-22 - - - - - p5-Mojolicious -- cookie-handling vulnerability - - - p5-Mojolicious - 7.66 - - - - -

Upstream commit:

-
-

Vulnerabilities existed in cookie handling.

-
- - - - https://github.com/kraih/mojo/issues/1185 - - - 2018-01-31 - 2018-02-17 - - - - - Bugzilla security issues - - - bugzilla44 - 4.4.13 - - - bugzilla50 - 5.0.4 - - - - -

Bugzilla Security Advisory

-
-

A CSRF vulnerability in report.cgi would allow a third-party site - to extract confidential information from a bug the victim had access to.

-
- - - - CVE-2018-5123 - https://bugzilla.mozilla.org/show_bug.cgi?id=1433400 - - - 2018-02-16 - 2018-02-16 - - - - - bro -- integer overflow allows remote DOS - - - bro - 2.5.3 - - - - -

Philippe Antoine of Catena cyber:

-
-

This is a security release that fixes an integer overflow in code generated by binpac. This issue can be used by remote attackers to crash Bro (i.e. a DoS attack). There also is a possibility this can be exploited in other ways. (CVE pending.)

-
- - - - http://blog.bro.org/2018/02/bro-253-released-security-update.html - - - 2018-02-14 - 2018-02-16 - - - - - consul -- vulnerability in embedded DNS library - - - consul - 1.0.5 - - - - -

Consul developers report:

-
-

A flaw was found in the embedded DNS library used in consul which - may allow a denial of service attack. Consul was updated to include - the fixed version.

-
- - - - https://github.com/hashicorp/consul/issues/3859 - https://github.com/hashicorp/consul/blob/master/CHANGELOG.md#105-february-7-2018 - https://github.com/miekg/dns/pull/631 - https://github.com/miekg/dns/issues/627 - CVE-2017-15133 - - - 2018-01-17 - 2018-02-16 - - - - - bro -- out of bounds write allows remote DOS - - - bro - 2.5.2 - - - - -

Frank Meier:

-
-

Bro before Bro v2.5.2 is vulnerable to an out of bounds write in the ContentLine analyzer allowing remote attackers to cause a denial of service (crash) and possibly other exploitation.

-
- - - - http://blog.bro.org/2017/10/bro-252-242-release-security-update.html - - - 2017-10-16 - 2018-02-16 - - - - - quagga -- several security issues - - - quagga - 1.2.3 - - - - -

Quagga reports:

-
-

The Quagga BGP daemon, bgpd, does not properly bounds - check the data sent with a NOTIFY to a peer, if an attribute - length is invalid. Arbitrary data from the bgpd process - may be sent over the network to a peer and/or it may crash.

-
-
-

The Quagga BGP daemon, bgpd, can double-free memory - when processing certain forms of UPDATE message, containing - cluster-list and/or unknown attributes.

-
-
-

The Quagga BGP daemon, bgpd, can overrun internal BGP - code-to-string conversion tables used for debug by 1 - pointer value, based on input.

-
-
-

The Quagga BGP daemon, bgpd, can enter an infinite - loop if sent an invalid OPEN message by a configured peer.

-
- - - - https://www.quagga.net/security/Quagga-2018-0543.txt - https://www.quagga.net/security/Quagga-2018-1114.txt - https://www.quagga.net/security/Quagga-2018-1550.txt - https://www.quagga.net/security/Quagga-2018-1975.txt - CVE-2018-5378 - CVE-2018-5379 - CVE-2018-5380 - CVE-2018-5381 - - - 2018-01-31 - 2018-02-15 - - - - - libraw -- multiple DoS vulnerabilities - - - libraw - 0.18.7 - - - - -

Secunia Research reports:

-
-

CVE-2018-5800: An off-by-one error within the "LibRaw::kodak_ycbcr_load_raw()" - function (internal/dcraw_common.cpp) can be exploited to cause a heap-based - buffer overflow and subsequently cause a crash.

-

CVE-2017-5801: An error within the "LibRaw::unpack()" function - (src/libraw_cxx.cpp) can be exploited to trigger a NULL pointer dereference.

-

CVE-2017-5802: An error within the "kodak_radc_load_raw()" function - (internal/dcraw_common.cpp) related to the "buf" variable can be exploited - to cause an out-of-bounds read memory access and subsequently cause a crash.

-
- - - - https://www.securityfocus.com/archive/1/541732 - CVE-2018-5800 - CVE-2018-5801 - CVE-2018-5802 - - - 2018-01-16 - 2018-02-15 - - - - - libraw -- multiple DoS vulnerabilities - - - libraw - 0.18.6 - - - - -

Secunia Research reports:

-
-

CVE-2017-16909: An error related to the "LibRaw::panasonic_load_raw()" - function (dcraw_common.cpp) can be exploited to cause a heap-based buffer - overflow and subsequently cause a crash via a specially crafted TIFF image.

-

CVE-2017-16910: An error within the "LibRaw::xtrans_interpolate()" function - (internal/dcraw_common.cpp) can be exploited to cause an invalid read - memory access.

-
- - - - https://www.securityfocus.com/archive/1/541583 - CVE-2017-16909 - CVE-2017-16910 - - - 2017-12-04 - 2018-02-15 - - - - - bitmessage -- remote code execution vulnerability - - - bitmessage - 0.6.2 - - - - -

Bitmessage developers report:

-
-

A remote code execution vulnerability has been spotted in use - against some users running PyBitmessage v0.6.2. The cause was - identified and a fix has been added and released as 0.6.3.2. (Will be - updated if/when CVE will be available.)

-
- - - - https://github.com/Bitmessage/PyBitmessage/releases/tag/v0.6.3 - https://bitmessage.org/wiki/Main_Page - - - 2018-02-13 - 2018-02-14 - - - - - jenkins -- Path traversal vulnerability allows access to files outside plugin resources - - - jenkins - 2.106 - - - jenkins-lts - 2.89.3 - - - - -

Jenkins developers report:

-
-

Jenkins did not properly prevent specifying relative paths that - escape a base directory for URLs accessing plugin resource files. This - allowed users with Overall/Read permission to download files from the - Jenkins master they should not have access to.

-
- - - - https://jenkins.io/security/advisory/2018-02-14/ - https://jenkins.io/blog/2018/02/14/security-updates/ - CVE-2018-6356 - - - 2018-02-14 - 2018-02-14 - - - - - bchunk -- access violation near NULL on destination operand and crash - - - bchunk - 1.2.01.2.1 - - - - -

Mitre reports:

-
-

bchunk 1.2.0 and 1.2.1 is vulnerable to an "Access violation near - NULL on destination operand" and crash when processing a malformed CUE - (.cue) file.

-
- - - - CVE-2017-15955 - https://nvd.nist.gov/vuln/detail/CVE-2017-15955 - - - 2017-10-28 - 2018-02-13 - - - - - bchunk -- heap-based buffer overflow (with invalid free) and crash - - - bchunk - 1.2.01.2.1 - - - - -

Mitre reports:

-
-

bchunk 1.2.0 and 1.2.1 is vulnerable to a heap-based buffer - overflow (with a resultant invalid free) and crash when processing a - malformed CUE (.cue) file.

-
- - - - CVE-2017-15954 - https://nvd.nist.gov/vuln/detail/CVE-2017-15954 - - - 2017-10-28 - 2018-02-13 - - - - - bchunk -- heap-based buffer overflow and crash - - - bchunk - 1.2.01.2.1 - - - - -

Mitre reports:

-
-

bchunk 1.2.0 and 1.2.1 vulnerable to a heap-based buffer overflow - and crash when processing a malformed CUE (.cue) file.

-
- - - - CVE-2017-15953 - https://nvd.nist.gov/vuln/detail/CVE-2017-15953 - - - 2017-10-28 - 2018-02-13 - - - - - uwsgi -- a stack-based buffer overflow - - - uwsgi - 2.0.16 - - - - -

Uwsgi developers report:

-
-

It was discovered that the uwsgi_expand_path function in utils.c in - Unbit uWSGI, an application container server, has a stack-based buffer - overflow via a large directory length that can cause a - denial-of-service (application crash) or stack corruption.

-
- - - - http://lists.unbit.it/pipermail/uwsgi/2018-February/008835.html - https://lists.debian.org/debian-lts-announce/2018/02/msg00010.html - CVE-2018-6758 - - - 2018-02-06 - 2018-02-13 - - - - - python -- possible integer overflow vulnerability - - - python34 - 3.4.8 - - - python35 - 3.5.5 - - - - -

Python issue:

-
-

There is a possible integer overflow in PyString_DecodeEscape - function of the file stringobject.c, which can be abused to gain - a heap overflow, possibly leading to arbitrary code execution.

-
- - - - https://bugs.python.org/issue30657 - https://docs.python.org/3.4/whatsnew/changelog.html - https://docs.python.org/3.5/whatsnew/changelog.html - CVE-2017-1000158 - - - 2017-06-03 - 2018-02-11 - - - - - electrum -- JSONRPC vulnerability - - - electrum-py36 - 2.63.0.5 - - - electrum2 - 2.63.0.5 - - - - -

MITRE reports:

-
-

JSONRPC vulnerability

-
- - - - CVE-2018-6353 - https://github.com/spesmilo/electrum-docs/blob/master/cve.rst - https://bitcointalk.org/index.php?topic=2702103.0 - - - 2018-01-27 - 2018-02-11 - - - - - libtorrent -- remote DoS - - - libtorrent - 0.13.6_5 - - - - -

X-cela reports:

-
-

Calls into build_benocde that use %zu could crash on 64 bit - machines due to the size change of size_t. Someone can force - READ_ENC_IA to fail allowing an internal_error to be thrown - and bring down the client.

-
- - - - https://github.com/rakshasa/libtorrent/pull/99 - ports/224664 - - - 2015-12-01 - 2018-02-10 - - - - - exim -- a buffer overflow vulnerability, remote code execution - - - exim - 4.90.1 - - - - -

Exim developers report:

-
-

There is a buffer overflow in base64d(), if some pre-conditions are met. -Using a handcrafted message, remote code execution seems to be possible.

-
- - - - https://exim.org/static/doc/security/CVE-2018-6789.txt - - - 2018-02-05 - 2018-02-10 - - - - - p7zip-codec-rar -- insufficient error handling - - - p7zip-codec-rar - 16.02_1 - - - - -

MITRE reports:

-
-

Insufficient exception handling in the method - NCompress::NRar3::CDecoder::Code of 7-Zip before 18.00 and p7zip - can lead to multiple memory corruptions within the PPMd code, - alows remote attackers to cause a denial of service (segmentation - fault) or execute arbitrary code via a crafted RAR archive.

-
- - - - CVE-2018-5996 - https://landave.io/2018/01/7-zip-multiple-memory-corruptions-via-rar-and-zip/ - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5996 - https://nvd.nist.gov/vuln/detail/CVE-2018-5996 - - - 2018-01-23 - 2018-02-10 - - - - - p7zip -- heap-based buffer overflow - - - p7zip - 16.02_1 - - - - -

MITRE reports:

-
-

Heap-based buffer overflow in the - NCompress::NShrink::CDecoder::CodeReal method in 7-Zip before - 18.00 and p7zip allows remote attackers to cause a denial of - service (out-of-bounds write) or potentially execute arbitrary - code via a crafted ZIP archive.

-
- - - - CVE-2017-17969 - https://landave.io/2018/01/7-zip-multiple-memory-corruptions-via-rar-and-zip/ - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17969 - https://nvd.nist.gov/vuln/detail/CVE-2017-17969 - https://marc.info/?l=bugtraq&=151782582216805&=2 - - - 2018-01-23 - 2018-02-10 - - - - - mpv -- arbitrary code execution via crafted website - - - mpv - 0.27.1 - - - - -

mpv developers report:

-
-

mpv through 0.28.0 allows remote attackers to execute arbitrary code - via a crafted web site, because it reads HTML documents containing - VIDEO elements, and accepts arbitrary URLs in a src attribute without - a protocol whitelist in player/lua/ytdl_hook.lua. For example, an - av://lavfi:ladspa=file= URL signifies that the product should call - dlopen on a shared object file located at an arbitrary local pathname. - The issue exists because the product does not consider that youtube-dl - can provide a potentially unsafe URL.

-
- - - - https://github.com/mpv-player/mpv/issues/5456 - CVE-2018-6360 - - - 2018-01-28 - 2018-02-09 - 2018-02-11 - - - - - Mailman -- Cross-site scripting (XSS) vulnerability in the web UI - - - mailman - 2.1.26 - - - mailman-with-htdig - 2.1.26 - - - ja-mailman - 2.1.14.j7_3,1 - - - - -

Mark Sapiro reports:

-
-

An XSS vulnerability in the user options CGI could allow a crafted URL - to execute arbitrary javascript in a user's browser. A related issue - could expose information on a user's options page without requiring - login.

-
- - - - https://www.mail-archive.com/mailman-users@python.org/msg70478.html - CVE-2018-5950 - - - 2018-01-20 - 2018-02-08 - - - - - PostgreSQL vulnerabilities - - - postgresql93-server - 9.3.09.3.21 - - - postgresql94-server - 9.4.09.4.16 - - - postgresql95-server - 9.5.09.5.11 - - - postgresql96-server - 9.6.09.6.7 - - - postgresql10-server - 10.010.2 - - - - -

The PostgreSQL project reports:

-
-
    -
  • CVE-2018-1052: Fix the processing of partition keys containing multiple expressions (only for PostgreSQL-10.x)
    • -
  • CVE-2018-1053: Ensure that all temporary files made with "pg_upgrade" are non-world-readable
    • -
-
- - - - CVE-2018-1052 - CVE-2018-1053 - - - 2018-02-05 - 2018-02-08 - - - - - tiff -- multiple vulnerabilities - - - tiff - 4.0.9 - - - - -

Debian Security Advisory reports:

-
-

Multiple vulnerabilities have been discovered in the libtiff library and the included tools, which may result in denial of service or the execution of arbitrary code.

-
- - - - CVE-2017-9935 - http://bugzilla.maptools.org/show_bug.cgi?id=2704 - CVE-2017-18013 - http://bugzilla.maptools.org/show_bug.cgi?id=2770 - 225544 - - - 2017-06-22 - 2018-01-29 - - - - - Flash Player -- multiple vulnerabilities - - - linux-flashplayer - 28.0.0.161 - - - - -

Adobe reports:

-
-
    -
  • This update resolves use-after-free vulnerabilities that - could lead to remote code execution (CVE-2018-4877, - CVE-2018-4878).
    • -
-
- - - - CVE-2018-4877 - CVE-2018-4878 - https://helpx.adobe.com/security/products/flash-player/apsa18-01.html - https://helpx.adobe.com/security/products/flash-player/apsb18-03.html - - - 2018-01-31 - 2018-02-06 - - - - - mini_httpd,thttpd -- Buffer overflow in htpasswd - - - mini_httpd - 1.28 - - - thttpd - 2.28 - - - - -

Alessio Santoru reports:

-
-

Buffer overflow in htpasswd.

-
- - - - http://acme.com/updates/archive/199.html - - - 2017-12-13 - 2018-02-06 - - - - - shadowsocks-libev -- command injection via shell metacharacters - - - shadowsocks-libev - 3.1.03.1.1 - - - - -

MITRE reports:

-
-

Improper parsing allows command injection via shell metacharacters in - a JSON configuration request received via 127.0.0.1 UDP traffic.

-
- - - - https://nvd.nist.gov/vuln/detail/CVE-2017-15924 - - - 2017-10-27 - 2018-02-05 - - - - - palemoon -- multiple vulnerabilities - - - palemoon - 27.7.2 - - - - -

Pale Moon reports:

-
-

CVE-2018-5102: Use-after-free in HTML media elements

-

CVE-2018-5122: Potential integer overflow in DoCrypt

-
- - - - CVE-2018-5102 - CVE-2018-5122 - - - 2018-01-23 - 2018-02-03 - - - - - Django -- information leakage - - - py27-django111 - py34-django111 - py35-django111 - py36-django111 - 1.11.10 - - - py27-django20 - py34-django20 - py35-django20 - py36-django20 - 2.0.2 - - - - -

Django release notes:

-
-

CVE-2018-6188: Information leakage in AuthenticationForm

-

A regression in Django 1.11.8 made AuthenticationForm run its - confirm_login_allowed() method even if an incorrect password is entered. - This can leak information about a user, depending on what messages - confirm_login_allowed() raises. If confirm_login_allowed() isn't - overridden, an attacker enter an arbitrary username and see if that user - has been set to is_active=False. If confirm_login_allowed() is - overridden, more sensitive details could be leaked.

-

This issue is fixed with the caveat that AuthenticationForm can no - longer raise the "This account is inactive." error if the authentication - backend rejects inactive users (the default authentication backend, - ModelBackend, has done that since Django 1.10). This issue will be - revisited for Django 2.1 as a fix to address the caveat will likely be too - invasive for inclusion in older versions.

-
- - - - https://docs.djangoproject.com/en/1.11/releases/1.11.10/ - https://docs.djangoproject.com/en/2.0/releases/2.0.2/ - CVE-2018-6188 - - - 2018-02-01 - 2018-02-02 - - - - - w3m - multiple vulnerabilities - - - w3m - w3m-img - ja-w3m - ja-w3m-img - 0.5.3.20180125 - - - - -

Tatsuya Kinoshita reports:

-
-

CVE-2018-6196 * table.c: Prevent negative indent value in feed_table_block_tag().

-

CVE-2018-6197 * form.c: Prevent invalid columnPos() call in formUpdateBuffer().

-

CVE-2018-6198 * config.h.dist, config.h.in, configure, configure.ac, main.c, rc.c: Make temporary directory safely when ~/.w3m is unwritable.

-
- - - - https://github.com/tats/w3m/commit/e773a0e089276f82c546447c0fd1e6c0f9156628 - CVE-2018-6196 - CVE-2018-6197 - CVE-2018-6198 - - - 2018-01-25 - 2018-02-01 - 2018-02-03 - - - - - firefox -- Arbitrary code execution through unsanitized browser UI - - - firefox - 58.0.1,1 - - - waterfox - 56.0.3.65 - - - - -

The Mozilla Foundation reports:

-
-

Mozilla developer Johann Hofmann reported that - unsanitized output in the browser UI can lead to arbitrary - code execution.

-
- - - - https://bugzilla.mozilla.org/show_bug.cgi?id=1432966 - - - 2018-01-29 - 2018-01-29 - 2018-01-31 - - - - - gcab -- stack overflow - - - gcab - 0.8 - - - - -

Upstream reports:

-
-

A stack-based buffer overflow within GNOME gcab through - 0.7.4 can be exploited by malicious attackers to cause a - crash or, potentially, execute arbitrary code via a - crafted .cab file.

-
- - - - https://nvd.nist.gov/vuln/detail/CVE-2018-5345 - https://mail.gnome.org/archives/ftp-release-list/2018-January/msg00066.html - CVE-2018-5345 - - - 2018-01-23 - 2018-01-27 - - - - - dovecot -- abort of SASL authentication results in a memory leak - - - dovecot - 2.02.2.33.2_3 - 2.32.3.0 - - - - -

Pedro Sampaio reports:

-
-

A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0. A abort of - SASL authentication results in a memory leak in Dovecot auth client - used by login processes. The leak has impact in high performance - configuration where same login processes are reused and can cause the - process to crash due to memory exhaustion.

-
- - - - CVE-2017-15132 - https://bugzilla.redhat.com/show_bug.cgi?id=1532768 - https://github.com/dovecot/core/commit/1a29ed2f96da1be22fa5a4d96c7583aa81b8b060.patch - - - 2018-01-09 - 2018-01-26 - 2018-02-01 - - - - - cURL -- Multiple vulnerabilities - - - curl - 7.58.0 - - - - -

The cURL project reports:

-
-

libcurl 7.1 through 7.57.0 might accidentally leak authentication - data to third parties. When asked to send custom headers in its HTTP - requests, libcurl will send that set of headers first to the host in - the initial URL but also, if asked to follow redirects and a 30X HTTP - response code is returned, to the host mentioned in URL in the - `Location:` response header value. Sending the same set of headers to - subsequest hosts is in particular a problem for applications that pass - on custom `Authorization:` headers, as this header often contains - privacy sensitive information or data that could allow others to - impersonate the libcurl-using client's request.

-
- - - - https://curl.haxx.se/docs/adv_2018-b3bf.html - CVE-2018-1000007 - - - 2018-01-24 - 2018-01-26 - - - - - clamav -- multiple vulnerabilities - - - clamav - 0.99.3 - - - - -

ClamAV project reports:

-
-

Join us as we welcome ClamAV 0.99.3 to the family!.

-

This release is a security release and is recommended for - all ClamAV users.

-

CVE-2017-12374 ClamAV UAF (use-after-free) Vulnerabilities

-

CVE-2017-12375 ClamAV Buffer Overflow Vulnerability

-

CVE-2017-12376 ClamAV Buffer Overflow in handle_pdfname - Vulnerability

-

CVE-2017-12377 ClamAV Mew Packet Heap Overflow Vulnerability

-

CVE-2017-12378 ClamAV Buffer Over Read Vulnerability

-

CVE-2017-12379 ClamAV Buffer Overflow in messageAddArgument - Vulnerability

-

CVE-2017-12380 ClamAV Null Dereference Vulnerability

-
- - - - http://blog.clamav.net/2018/01/clamav-0993-has-been-released.html - CVE-2017-12374 - CVE-2017-12375 - CVE-2017-12376 - CVE-2017-12377 - CVE-2017-12378 - CVE-2017-12379 - CVE-2017-12380 - - - 2018-01-25 - 2018-01-26 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 58.0_1,1 - - - waterfox - 56.0.3.63 - - - seamonkey - linux-seamonkey - 2.49.2 - - - firefox-esr - 52.6.0_1,1 - - - linux-firefox - 52.6.0,2 - - - libxul - thunderbird - linux-thunderbird - 52.6.0 - - - - -

Mozilla Foundation reports:

-
-

CVE-2018-5091: Use-after-free with DTMF timers

-

CVE-2018-5092: Use-after-free in Web Workers

-

CVE-2018-5093: Buffer overflow in WebAssembly during Memory/Table resizing

-

CVE-2018-5094: Buffer overflow in WebAssembly with garbage collection on uninitialized memory

-

CVE-2018-5095: Integer overflow in Skia library during edge builder allocation

-

CVE-2018-5097: Use-after-free when source document is manipulated during XSLT

-

CVE-2018-5098: Use-after-free while manipulating form input elements

-

CVE-2018-5099: Use-after-free with widget listener

-

CVE-2018-5100: Use-after-free when IsPotentiallyScrollable arguments are freed from memory

-

CVE-2018-5101: Use-after-free with floating first-letter style elements

-

CVE-2018-5102: Use-after-free in HTML media elements

-

CVE-2018-5103: Use-after-free during mouse event handling

-

CVE-2018-5104: Use-after-free during font face manipulation

-

CVE-2018-5105: WebExtensions can save and execute files on local file system without user prompts

-

CVE-2018-5106: Developer Tools can expose style editor information cross-origin through service worker

-

CVE-2018-5107: Printing process will follow symlinks for local file access

-

CVE-2018-5108: Manually entered blob URL can be accessed by subsequent private browsing tabs

-

CVE-2018-5109: Audio capture prompts and starts with incorrect origin attribution

-

CVE-2018-5110: Cursor can be made invisible on OS X

-

CVE-2018-5111: URL spoofing in addressbar through drag and drop

-

CVE-2018-5112: Extension development tools panel can open a non-relative URL in the panel

-

CVE-2018-5113: WebExtensions can load non-HTTPS pages with browser.identity.launchWebAuthFlow

-

CVE-2018-5114: The old value of a cookie changed to HttpOnly remains accessible to scripts

-

CVE-2018-5115: Background network requests can open HTTP authentication in unrelated foreground tabs

-

CVE-2018-5116: WebExtension ActiveTab permission allows cross-origin frame content access

-

CVE-2018-5117: URL spoofing with right-to-left text aligned left-to-right

-

CVE-2018-5118: Activity Stream images can attempt to load local content through file:

-

CVE-2018-5119: Reader view will load cross-origin content in violation of CORS headers

-

CVE-2018-5121: OS X Tibetan characters render incompletely in the addressbar

-

CVE-2018-5122: Potential integer overflow in DoCrypt

-

CVE-2018-5090: Memory safety bugs fixed in Firefox 58

-

CVE-2018-5089: Memory safety bugs fixed in Firefox 58 and Firefox ESR 52.6

-
- - - - CVE-2018-5089 - CVE-2018-5090 - CVE-2018-5091 - CVE-2018-5092 - CVE-2018-5093 - CVE-2018-5094 - CVE-2018-5095 - CVE-2018-5097 - CVE-2018-5098 - CVE-2018-5099 - CVE-2018-5100 - CVE-2018-5101 - CVE-2018-5102 - CVE-2018-5103 - CVE-2018-5104 - CVE-2018-5105 - CVE-2018-5106 - CVE-2018-5107 - CVE-2018-5108 - CVE-2018-5109 - CVE-2018-5110 - CVE-2018-5111 - CVE-2018-5112 - CVE-2018-5113 - CVE-2018-5114 - CVE-2018-5115 - CVE-2018-5116 - CVE-2018-5117 - CVE-2018-5118 - CVE-2018-5119 - CVE-2018-5121 - CVE-2018-5122 - https://www.mozilla.org/security/advisories/mfsa2018-02/ - https://www.mozilla.org/security/advisories/mfsa2018-03/ - - - 2018-01-23 - 2018-01-23 - 2018-01-29 - - - - - powerdns-recursor -- insufficient validation of DNSSEC signatures - - - powerdns-recursor - 4.1.1 - - - - -

PowerDNS Security Advisory reports:

-
-

An issue has been found in the DNSSEC validation component of - PowerDNS Recursor, allowing an ancestor delegation NSEC or NSEC3 - record to be used to wrongfully prove the non-existence of a RR - below the owner name of that record. This would allow an attacker in - position of man-in-the-middle to send a NXDOMAIN answer for a name - that does exist.

-
- - - - CVE-2018-1000003 - https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-01.html - - - 2018-01-22 - 2018-01-23 - - - - - chromium -- multiple vulnerabilities - - - chromium - 63.0.3239.108 - - - - -

Google Chrome Releases reports:

-
-

2 security fixes in this release, including:

-
    -
  • [788453] High CVE-2017-15429: UXSS in V8. Reported by - Anonymous on 2017-11-24
    • -
  • [794792] Various fixes from internal audits, fuzzing and other initiatives
    • -
-
- - - - CVE-2017-15429 - https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop_14.html - - - 2017-12-14 - 2018-01-23 - - - - - chromium -- multiple vulnerabilities - - - chromium - 63.0.3239.84 - - - - -

Google Chrome Releases reports:

-
-

37 security fixes in this release, including:

-
    -
  • [778505] Critical CVE-2017-15407: Out of bounds write in QUIC. Reported by - Ned Williamson on 2017-10-26
    • -
  • [762374] High CVE-2017-15408: Heap buffer overflow in PDFium. Reported by - Ke Liu of Tencent's Xuanwu LAB on 2017-09-06
    • -
  • [763972] High CVE-2017-15409: Out of bounds write in Skia. Reported by - Anonymous on 2017-09-11
    • -
  • [765921] High CVE-2017-15410: Use after free in PDFium. Reported by - Luat Nguyen of KeenLab, Tencent on 2017-09-16
    • -
  • [770148] High CVE-2017-15411: Use after free in PDFium. Reported by - Luat Nguyen of KeenLab, Tencent on 2017-09-29
    • -
  • [727039] High CVE-2017-15412: Use after free in libXML. Reported by - Nick Wellnhofer on 2017-05-27
    • -
  • [766666] High CVE-2017-15413: Type confusion in WebAssembly. Reported by - Gaurav Dewan of Adobe Systems India Pvt. Ltd. on 2017-09-19
    • -
  • [765512] Medium CVE-2017-15415: Pointer information disclosure in IPC call. - Reported by Viktor Brange of Microsoft Offensive Security Research Team on 2017-09-15
    • -
  • [779314] Medium CVE-2017-15416: Out of bounds read in Blink. Reported by - Ned Williamson on 2017-10-28
    • -
  • [699028] Medium CVE-2017-15417: Cross origin information disclosure in Skia. - Reported by Max May on 2017-03-07
    • -
  • [765858] Medium CVE-2017-15418: Use of uninitialized value in Skia. Reported by - Kushal Arvind Shah of Fortinet's FortiGuard Labs on 2017-09-15
    • -
  • [780312] Medium CVE-2017-15419: Cross origin leak of redirect URL in Blink. - Reported by Jun Kokatsu on 2017-10-31
    • -
  • [777419] Medium CVE-2017-15420: URL spoofing in Omnibox. Reported by - WenXu Wu of Tencent's Xuanwu Lab on 2017-10-23
    • -
  • [774382] Medium CVE-2017-15422: Integer overflow in ICU. Reported by - Yuan Deng of Ant-financial Light-Year Security Lab on 2017-10-13
    • -
  • [780484] Medium CVE-2017-15430: Unsafe navigation in Chromecast Plugin. - Reported by jinmo123 on 2017-01-11
    • -
  • [778101] Low CVE-2017-15423: Issue with SPAKE implementation in BoringSSL. - Reported by Greg Hudson on 2017-10-25
    • -
  • [756226] Low CVE-2017-15424: URL Spoof in Omnibox. Reported by - Khalil Zhani on 2017-08-16
    • -
  • [756456] Low CVE-2017-15425: URL Spoof in Omnibox. Reported by - xisigr of Tencent's Xuanwu Lab on 2017-08-17
    • -
  • [757735] Low CVE-2017-15426: URL Spoof in Omnibox. Reported by - WenXu Wu of Tencent's Xuanwu Lab on 2017-08-18
    • -
  • [768910] Low CVE-2017-15427: Insufficient blocking of Javascript in Omnibox. - Reported by Junaid Farhan on 2017-09-26
    • -
  • [792099] Various fixes from internal audits, fuzzing and other initiatives
    • -
-
- - - - CVE-2017-15407 - CVE-2017-15408 - CVE-2017-15409 - CVE-2017-15410 - CVE-2017-15411 - CVE-2017-15412 - CVE-2017-15413 - CVE-2017-15415 - CVE-2017-15416 - CVE-2017-15417 - CVE-2017-15418 - CVE-2017-15419 - CVE-2017-15420 - CVE-2017-15422 - CVE-2017-15430 - CVE-2017-15423 - CVE-2017-15424 - CVE-2017-15425 - CVE-2017-15426 - CVE-2017-15427 - https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html - - - 2017-12-06 - 2018-01-23 - - - - - chromium -- out of bounds read - - - chromium - 62.0.3202.94 - - - - -

Google Chrome Releases reports:

-
-

1 security fix in this release, including:

-
    -
  • [782145] High CVE-2017-15428: Out of bounds read in V8. Reported by - Zhao Qixun of Qihoo 360 Vulcan Team on 2017-11-07
    • -
-
- - - - CVE-2017-15428 - https://chromereleases.googleblog.com/2017/11/stable-channel-update-for-desktop_13.html - - - 2017-11-13 - 2018-01-23 - - - - - unbound -- vulnerability in the processing of wildcard synthesized NSEC records - - - unbound - 1.6.8 - - - - -

Unbound reports:

-
-

We discovered a vulnerability in the processing of wildcard synthesized - NSEC records. While synthesis of NSEC records is allowed by RFC4592, - these synthesized owner names should not be used in the NSEC processing. - This does, however, happen in Unbound 1.6.7 and earlier versions.

-
- - - - https://unbound.net/downloads/CVE-2017-15105.txt - CVE-2017-15105 - ports/225313 - - - 2017-10-08 - 2018-01-19 - - - - - phpbb3 -- multiple issues - - - phpbb3 - 3.2.2 - - - - -

phpbb developers reports:

-
-

Password updater working with PostgreSQL - The cron for updating legacy password hashes was running invalid queries on PostgreSQL.

-

Deleting orphaned attachments w/ large number of orphaned attachments - Orphaned attachment deletion was improved to be able to delete them when a large number of orphaned attachments exist.

-

Multiple bugfixes for retrieving image size - Multiple issues with retrieving the image size of JPEGs and temporary files were resolved.

-

Issues with updating from phpBB 3.0.6 - Inconsistencies in the way parent modules were treated caused issues with updating from older phpBB 3.0 versions.

-

Forum / topic icon blurriness - Fixed issues with forum and topic icons looking blurry on some browsers.

-
- - - - https://wiki.phpbb.com/Release_Highlights/3.2.2 - - - 2018-01-07 - 2018-01-19 - - - - - MySQL -- multiple vulnerabilities - - - mariadb55-server - 5.5.59 - - - mariadb100-server - 10.0.34 - - - mariadb101-server - 10.1.31 - - - mariadb102-server - 10.2.13 - - - mysql55-server - 5.5.59 - - - mysql56-server - 5.6.39 - - - mysql57-server - 5.7.21 - - - percona55-server - 5.5.59 - - - percona56-server - 5.6.39 - - - percona57-server - 5.7.21 - - - - -

Oracle reports:

-
-

Not all vulnerabilities are relevant for all flavors/versions of the - servers and clients

-
    -
  • Vulnerability allows low privileged attacker with network access - via multiple protocols to compromise MySQL Server. Successful attacks - of this vulnerability can result in unauthorized ability to cause a - hang or frequently repeatable crash (complete DOS) of MySQL Server. - GIS: CVE-2018-2573, DDL CVE-2018-2622, Optimizer: CVE-2018-2640, - CVE-2018-2665, CVE-2018-2668, Security:Privileges: CVE-2018-2703, - Partition: CVE-2018-2562.
    • -
  • Vulnerability allows high privileged attacker with network access - via multiple protocols to compromise MySQL Server. Successful attacks - of this vulnerability can result in unauthorized ability to cause a - hang or frequently repeatable crash (complete DOS) of MySQL Server. - InnoDB: CVE-2018-2565, CVE-2018-2612 DML: CVE-2018-2576, - CVE-2018-2646, Stored Procedure: CVE-2018-2583, Performance Schema: - CVE-2018-2590, Partition: CVE-2018-2591, Optimizer: CVE-2018-2600, - CVE-2018-2667, Security:Privileges: CVE-2018-2696, Replication: - CVE-2018-2647.
    • -
  • Vulnerability allows a low or high privileged attacker with network - access via multiple protocols to compromise MySQL Server with - unauthorized creation, deletion, modification or access to data/ - critical data. InnoDB: CVE-2018-2612, Performance Schema: - CVE-2018-2645, Replication: CVE-2018-2647, Partition: CVE-2018-2562. -
    • -
-
- - - - http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html#AppendixMSQL - https://mariadb.com/kb/en/library/mariadb-5559-release-notes/ - CVE-2018-2562 - CVE-2018-2565 - CVE-2018-2573 - CVE-2018-2576 - CVE-2018-2583 - CVE-2018-2586 - CVE-2018-2590 - CVE-2018-2591 - CVE-2018-2600 - CVE-2018-2612 - CVE-2018-2622 - CVE-2018-2640 - CVE-2018-2645 - CVE-2018-2646 - CVE-2018-2647 - CVE-2018-2665 - CVE-2018-2667 - CVE-2018-2668 - CVE-2018-2696 - CVE-2018-2703 - - - 2017-01-18 - 2018-01-19 - - - - - wordpress -- multiple issues - - - wordpress - fr-wordpress - 4.9.2,1 - - - de-wordpress - ja-wordpress - ru-wordpress - zh-wordpress-zh_CN - zh-wordpress-zh_TW - 4.9.2 - - - - -

wordpress developers reports:

-
-

JavaScript errors that prevented saving posts in Firefox have been fixed.

-

The previous taxonomy-agnostic behavior of get_category_link() and category_description() was restored.

-

Switching themes will now attempt to restore previous widget assignments, even when there are no sidebars to map.

-
- - - - https://wordpress.org/news/2018/01/wordpress-4-9-2-security-and-maintenance-release/ - - - 2018-01-16 - 2018-01-19 - - - - - gitlab -- Remote code execution on project import - - - gitlab - 10.1.6 - - - - -

GitLab developers report:

-
-

Today we are releasing versions 10.3.4, 10.2.6, and 10.1.6 for - GitLab Community Edition (CE) and Enterprise Edition (EE).

-

These versions contain a number of important security fixes, - including two that prevent remote code execution, and we strongly - recommend that all GitLab installations be upgraded to one of these - versions immediately.

-
- - - - https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/ - CVE-2017-0915 - CVE-2018-3710 - - - 2018-01-16 - 2018-01-17 - - - - - transmission-daemon -- vulnerable to dns rebinding attacks - - - transmission-daemon - 2.92_3 - - - - -

Google Project Zero reports:

-
-

The transmission bittorrent client uses a client/server - architecture, the user interface is the client which communicates - to the worker daemon using JSON RPC requests.

-

As with all HTTP RPC schemes like this, any website can send - requests to the daemon listening on localhost with XMLHttpRequest(), - but the theory is they will be ignored because clients must prove - they can read and set a specific header, X-Transmission-Session-Id. - Unfortunately, this design doesn't work because of an attack called - "DNS rebinding". Any website can simply create a dns name that they - are authorized to communicate with, and then make it resolve to - localhost.

-

Exploitation is simple, you could set script-torrent-done-enabled - and run any command, or set download-dir to /home/user/ and then - upload a torrent for .bashrc.

-
- - - - https://bugs.chromium.org/p/project-zero/issues/detail?id=1447 - https://github.com/transmission/transmission/pull/468 - - - 2017-11-30 - 2018-01-14 - - - - - shibboleth-sp -- vulnerable to forged user attribute data - - - xmltooling - 1.6.3 - - - xerces-c3 - 3.1.4 - - - - -

Shibboleth consortium reports:

-
-

- Shibboleth SP software vulnerable to forged user attribute data -

-

- The Service Provider software relies on a generic XML parser to - process SAML responses and there are limitations in older versions - of the parser that make it impossible to fully disable Document Type - Definition (DTD) processing. -

-

- Through addition/manipulation of a DTD, it's possible to make - changes to an XML document that do not break a digital signature but - are mishandled by the SP and its libraries. These manipulations can - alter the user data passed through to applications behind the SP and - result in impersonation attacks and exposure of protected - information. -

-

- While newer versions of the xerces-c3 parser are configured by the - SP into disallowing the use of a DTD via an environment variable, - this feature is not present in the xerces-c3 parser before version - 3.1.4, so an additional fix is being provided now that an actual DTD - exploit has been identified. Xerces-c3-3.1.4 was committed to the - ports tree already on 2016-07-26. -

-
- - - - https://shibboleth.net/community/advisories/secadv_20180112.txt - CVE-2018-0486 - - - 2018-01-12 - 2018-01-12 - - - - - Flash Player -- information disclosure - - - linux-flashplayer - 28.0.0.137 - - - - -

Adobe reports:

-
-
    -
  • This update resolves an out-of-bounds read vulnerability that - could lead to information disclosure (CVE-2018-4871).
    • -
-
- - - - CVE-2018-4871 - https://helpx.adobe.com/security/products/flash-player/apsb18-01.html - - - 2018-01-09 - 2018-01-09 - - - - - awstats -- remote code execution - - - awstats - 7.7,1 - - - - -

Mitre reports:

-
-

Awstats version 7.6 and earlier is vulnerable to a path traversal - flaw in the handling of the "config" and "migrate" parameters resulting - in unauthenticated remote code execution.

-
- - - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000501 - CVE-2017-1000501 - ports/225007 - - - 2018-01-03 - 2018-01-08 - - - - - irssi -- multiple vulnerabilities - - - irssi - 1.0.6,1 - - - - -

Irssi reports:

-
-

When the channel topic is set without specifying a sender, Irssi - may dereference NULL pointer. Found by Joseph Bisch.

-

When using incomplete escape codes, Irssi may access data beyond - the end of the string. Found by Joseph Bisch.

-

A calculation error in the completion code could cause a heap - buffer overflow when completing certain strings. - Found by Joseph Bisch.

-

When using an incomplete variable argument, Irssi may access data - beyond the end of the string. Found by Joseph Bisch.

-
- - - - https://irssi.org/security/irssi_sa_2018_01.txt - CVE-2018-5205 - CVE-2018-5206 - CVE-2018-5207 - CVE-2018-5208 - ports/224954 - - - 2018-01-03 - 2018-01-06 - - - - - mozilla -- Speculative execution side-channel attack - - - firefox - 57.0.4,1 - - - waterfox - 56.0.2 - - - - -

Mozilla Foundation reports:

-
-

Jann Horn of Google Project Zero - Security reported that speculative execution performed - by modern CPUs could leak information through a timing - side-channel attack. Microsoft Vulnerability Research - extended this attack to browser JavaScript engines and - demonstrated that code on a malicious web page could - read data from other web sites (violating the - same-origin policy) or private data from the browser - itself.

-

Since this new class of attacks involves measuring - precise time intervals, as a parti al, short-term, - mitigation we are disabling or reducing the precision of - several time sources in Firefox. The precision of - performance.now() has been reduced from 5μs - to 20μs, and the SharedArrayBuffer feature - has been disabled because it can be used to construct a - high-resolution timer.

-
- - - - https://www.mozilla.org/security/advisories/mfsa2018-01/ - - - 2018-01-04 - 2018-01-05 - - - - - OTRS -- Multiple vulnerabilities - - - otrs - 5.0.26 - - - - -

OTRS reports:

-
-

An attacker who is logged into OTRS as an agent can request special URLs - from OTRS which can lead to the execution of shell commands with the - permissions of the web server user.

-
-
-

An attacker who is logged into OTRS as a customer can use the ticket search - form to disclose internal article information of their customer tickets.

-
-
-

An attacker who is logged into OTRS as an agent can manipulate form - parameters and execute arbitrary shell commands with the permissions of the - OTRS or web server user.

-
-
-

An attacker can send a specially prepared email to an OTRS system. If this - system has cookie support disabled, and a logged in agent clicks a link in this - email, the session information could be leaked to external systems, allowing the - attacker to take over the agent’s session.

-
- - - - CVE-2017-16664 - CVE-2017-16854 - CVE-2017-16921 - ports/224729 - https://www.otrs.com/security-advisory-2017-07-security-update-otrs-framework/ - https://www.otrs.com/security-advisory-2017-08-security-update-otrs-framework/ - https://www.otrs.com/security-advisory-2017-09-security-update-otrs-framework/ - https://www.otrs.com/security-advisory-2017-10-security-update-otrs-framework/ - - - 2017-11-21 - 2017-12-30 - - - - - The Bouncy Castle Crypto APIs: CVE-2017-13098 ("ROBOT") - - - bouncycastle15 - 1.59 - - - - -

The Legion of the Bouncy Castle reports:

-
-

Release: 1.59

-

CVE-2017-13098 ("ROBOT"), a Bleichenbacher oracle in TLS - when RSA key exchange is negotiated. This potentially affected - BCJSSE servers and any other TLS servers configured to use JCE - for the underlying crypto - note the two TLS implementations - using the BC lightweight APIs are not affected by this.

-
- - - - CVE-2017-13098 - https://www.bouncycastle.org/releasenotes.html - - - 2017-12-12 - 2017-12-29 - - - - - mozilla -- multiple vulnerabilities - - - thunderbird - linux-thunderbird - 52.5.2 - - - - -

Mozilla Foundation reports:

-
-

CVE-2017-7845: Buffer overflow when drawing and validating elements with ANGLE library using Direct 3D 9

-

CVE-2017-7846: JavaScript Execution via RSS in mailbox:// origin

-

CVE-2017-7847: Local path string can be leaked from RSS feed

-

CVE-2017-7848: RSS Feed vulnerable to new line Injection

-

CVE-2017-7829: Mailsploit part 1: From address with encoded null character is cut off in message header display

-
- - - - CVE-2017-7829 - CVE-2017-7845 - CVE-2017-7846 - CVE-2017-7847 - CVE-2017-7848 - https://www.mozilla.org/security/advisories/mfsa2017-30/ - - - 2017-12-22 - 2017-12-25 - - - - - phpMyAdmin -- XSRF/CSRF vulnerability - - - phpMyAdmin - 4.7.04.7.7 - - - - -

The phpMyAdmin team reports:

-
-

Description

-

By deceiving a user to click on a crafted URL, it is - possible to perform harmful database operations such as - deleting records, dropping/truncating tables etc.

-

Severity

-

We consider this vulnerability to be critical.

-
- - - - https://www.phpmyadmin.net/security/PMASA-2017-9/ - - - 2017-12-23 - 2017-12-23 - - - - - asterisk -- Crash in PJSIP resource when missing a contact header - - - asterisk13 - 13.18.5 - - - - -

The Asterisk project reports:

-
-

A select set of SIP messages create a dialog in Asterisk. - Those SIP messages must contain a contact header. For - those messages, if the header was not present and using - the PJSIP channel driver, it would cause Asterisk to - crash. The severity of this vulnerability is somewhat - mitigated if authentication is enabled. If authentication - is enabled a user would have to first be authorized before - reaching the crash point.

-
- - - - https://downloads.asterisk.org/pub/security/AST-2017-014.html - CVE-2017-17850 - - - 2017-12-12 - 2017-12-23 - - - - - MariaDB -- unspecified vulnerability - - - mariadb101-client - 10.1.30 - - - mariadb102-client - 10.2.10 - - - - -

The MariaDB project reports:

-
-

Fixes for the following security vulnerabilities: - CVE-2017-15365

-
- - - - https://mariadb.com/kb/en/library/mariadb-10130-release-notes/ - CVE-2017-15365 - - - 2017-12-23 - 2017-12-23 - - - - - rsync -- multiple vulnerabilities - - - rsync - 3.1.23.1.2_7 - - - - -

Jeriko One reports:

-
-

The receive_xattr function in xattrs.c in rsync 3.1.2 and 3.1.3-development does not check for a trailing '\0' character in an xattr name, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact by sending crafted data to the daemon.

-
-
-

The recv_files function in receiver.c in the daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, proceeds with certain file metadata updates before checking for a filename in the daemon_filter_list data structure, which allows remote attackers to bypass intended access restrictions.

-
-
-

The daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, does not check for fnamecmp filenames in the daemon_filter_list data structure (in the recv_files function in receiver.c) and also does not apply the sanitize_paths protection mechanism to pathnames found in "xname follows" strings (in the read_ndx_and_attrs function in rsync.c), which allows remote attackers to bypass intended access restrictions.

-
- - - - https://www.debian.org/security/2017/dsa-4068 - CVE-2017-16548 - CVE-2017-17433 - CVE-2017-17434 - ports/224477 - - - 2017-12-17 - 2017-12-20 - 2017-12-31 - - - - - ruby -- Command injection vulnerability in Net::FTP - - - ruby - 2.2.0,12.2.9,1 - 2.3.0,12.3.6,1 - 2.4.0,12.4.3,1 - - - - -

Etienne Stalmans from the Heroku product security team reports:

-
-

There is a command injection vulnerability in Net::FTP bundled with Ruby.

-

Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernel#open to open a local file. If the localfile argument starts with the pipe character "|", the command following the pipe character is executed. The default value of localfile is File.basename(remotefile), so malicious FTP servers could cause arbitrary command execution.

-
- - - - https://www.ruby-lang.org/en/news/2017/12/14/net-ftp-command-injection-cve-2017-17405/ - CVE-2017-17405 - - - 2017-12-14 - 2017-12-14 - - - - - rubygem-passenger -- arbitrary file read vulnerability - - - rubygem-passenger - 5.0.105.1.11 - - - - -

Phusion reports:

-
-

The cPanel Security Team discovered a vulnerability in Passenger - that allows users to list the contents of arbitrary files on the - system. CVE-2017-16355 has been assigned to this issue.

-
- - - - https://blog.phusion.nl/2017/10/13/passenger-security-advisory-5-1-11/ - CVE-2017-16355 - - - 2017-10-13 - 2017-12-18 - - - - - libXfont -- permission bypass when opening files through symlinks - - - libXfont - 1.5.4 - - - libXfont2 - 2.0.3 - - - - -

the freedesktop.org project reports:

-
-

A non-privileged X client can instruct X server running under root - to open any file by creating own directory with "fonts.dir", - "fonts.alias" or any font file being a symbolic link to any other - file in the system. X server will then open it. This can be issue - with special files such as /dev/watchdog.

-
- - - - https://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=7b377456f95d2ec3ead40f4fb74ea620191f88c8 - CVE-2017-16611 - - - 2017-11-25 - 2017-12-17 - - - - - libXfont -- multiple memory leaks - - - libXfont - 1.5.3 - - - libXfont2 - 2.0.2 - - - - -

The freedesktop.org project reports:

-
-

If a pattern contains '?' character, any character in the string - is skipped, even if it is '\0'. The rest of the matching then reads - invalid memory.

-
-
-

Without the checks a malformed PCF file can cause the library to - make atom from random heap memory that was behind the `strings` - buffer. This may crash the process or leak information.

-
- - - - https://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=d1e670a4a8704b8708e493ab6155589bcd570608 - https://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=672bb944311392e2415b39c0d63b1e1902905bcd - CVE-2017-13720 - CVE-2017-13722 - - - 2017-10-04 - 2017-12-17 - - - - - libXcursor -- integer overflow that can lead to heap buffer overflow - - - libXcursor - 1.1.15 - - - - -

The freedesktop.org project reports:

-
-

It is possible to trigger heap overflows due to an integer - overflow while parsing images and a signedness issue while - parsing comments.

-

The integer overflow occurs because the chosen limit 0x10000 - for dimensions is too large for 32 bit systems, because each pixel - takes 4 bytes. Properly chosen values allow an overflow which in - turn will lead to less allocated memory than needed for subsequent - reads.

-

The signedness bug is triggered by reading the length of a comment - as unsigned int, but casting it to int when calling the function - XcursorCommentCreate. Turning length into a negative value allows - the check against XCURSOR_COMMENT_MAX_LEN to pass, and the following - addition of sizeof (XcursorComment) + 1 makes it possible to - allocate less memory than needed for subsequent reads.

-
- - - - http://seclists.org/oss-sec/2017/q4/339 - https://cgit.freedesktop.org/xorg/lib/libXcursor/commit/?id=4794b5dd34688158fb51a2943032569d3780c4b8 - CVE-2017-16612 - - - 2017-11-28 - 2017-12-17 - - - - - global -- gozilla vulnerability - - - global - 4.8.66.6.1 - - - - -

MITRE reports:

-
-

gozilla.c in GNU GLOBAL 4.8.6 does not validate strings before launching - the program specified by the BROWSER environment variable, which might - allow remote attackers to conduct argument-injection attacks via a crafted - URL.

-
- - - - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17531 - http://lists.gnu.org/archive/html/info-global/2017-12/msg00001.html - CVE-2017-17531 - - - 2017-12-11 - 2017-12-16 - - - - - jenkins -- Two startup race conditions - - - jenkins - 2.95 - - - jenkins-lts - 2.89.2 - - - - -

The Jenkins project reports:

-
-

A race condition during Jenkins startup could result in the wrong - order of execution of commands during initialization.

-

On Jenkins 2.81 and newer, including LTS 2.89.1, this could in - rare cases (we estimate less than 20% of new instances) result in - failure to initialize the setup wizard on the first startup.

-

There is a very short window of time after startup during which - Jenkins may no longer show the "Please wait while Jenkins is - getting ready to work" message, but Cross-Site Request Forgery - (CSRF) protection may not yet be effective.

-
- - - - https://jenkins.io/security/advisory/2017-12-14/ - - - 2017-12-14 - 2017-12-15 - - - - - node.js -- Data Confidentiality/Integrity Vulnerability, December 2017 - - - node4 - 4.8.7 - - - node6 - 6.12.2 - - - node8 - 8.9.3 - - - node - 9.2.1 - - - - -

Node.js reports:

-
-

Data Confidentiality/Integrity Vulnerability - CVE-2017-15896

-

Node.js was affected by OpenSSL vulnerability CVE-2017-3737 in regards to the use of SSL_read() due to TLS handshake failure. The result was that an active network attacker could send application data to Node.js using the TLS or HTTP2 modules in a way that bypassed TLS authentication and encryption.

-

Uninitialized buffer vulnerability - CVE-2017-15897

-

Node.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the encoding for the fill value did not match the encoding specified. For example, 'Buffer.alloc(0x100, "This is not correctly encoded", "hex");' The buffer implementation was updated such that the buffer will be initialized to all zeros in these cases.

-

Also included in OpenSSL update - CVE 2017-3738

-

Note that CVE 2017-3738 of OpenSSL-1.0.2 affected Node but it was low severity.

-
- - - - https://nodejs.org/en/blog/vulnerability/december-2017-security-releases/ - CVE-2017-15896 - CVE-2017-15897 - CVE-2017-3738 - - - 2017-12-08 - 2017-12-14 - - - - - GitLab -- multiple vulnerabilities - - - gitlab - 4.2.010.0.6 - 10.1.010.1.4 - 10.2.010.2.3 - - - - -

GitLab reports:

-
-

User without access to private Wiki can see it on the project page

-

Matthias Burtscher reported that it was possible for a user to see a - private Wiki on the project page without having the corresponding - permission.

-

E-mail address disclosure through member search fields

-

Hugo Geoffroy reported via HackerOne that it was possible to find out the - full e-mail address of any user by brute-forcing the member search - field.

-

Groups API leaks private projects

-

An internal code review discovered that users were able to list private - projects they had no access to by using the Groups API.

-

Cross-Site Scripting (XSS) possible by editing a comment

-

Sylvain Heiniger reported via HackerOne that it was possible for - arbitrary JavaScript code to be executed when editing a comment.

-

Issue API allows any user to create a new issue even when issues are - restricted or disabled

-

Mohammad Hasbini reported that any user could create a new issues in a - project even when issues were disabled or restricted to team members in the - project settings.

-
- - - - https://about.gitlab.com/2017/12/08/gitlab-10-dot-2-dot-4-security-release/ - - - 2017-12-08 - 2017-12-14 - - - - - tor -- Use-after-free in onion service v2 - - - tor - 0.3.1.9 - - - - -

The Torproject.org reports:

-
-
    -
  • TROVE-2017-009: Replay-cache ineffective for v2 onion services
    • -
  • TROVE-2017-010: Remote DoS attack against directory authorities
    • -
  • TROVE-2017-011: An attacker can make Tor ask for a password
    • -
  • TROVE-2017-012: Relays can pick themselves in a circuit path
    • -
  • TROVE-2017-013: Use-after-free in onion service v2
    • -
-
- - - - https://blog.torproject.org/new-stable-tor-releases-security-fixes-0319-03013-02914-02817-02516 - CVE-2017-8819 - - - 2017-12-01 - 2017-12-14 - - - - - asterisk -- Remote Crash Vulnerability in RTCP Stack - - - asterisk13 - 13.18.4 - - - - -

The Asterisk project reports:

-
-

If a compound RTCP packet is received containing more - than one report (for example a Receiver Report and a - Sender Report) the RTCP stack will incorrectly store - report information outside of allocated memory potentially - causing a crash.

-
- - - - https://downloads.asterisk.org/pub/security/AST-2017-012.html - - - 2017-12-12 - 2017-12-13 - - - - - libxml2 -- Multiple Issues - - - libxml2 - 2.9.4 - - - - -

libxml2 developers report:

-

The htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4 allows attackers to cause a denial of service (buffer over-read) or information disclosure.

-

A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. The variable len is assigned strlen(buf). If the content->type is XML_ELEMENT_CONTENT_ELEMENT, then (i) the content->prefix is appended to buf (if it actually fits) whereupon (ii) content->name is written to the buffer. However, the check for whether the content->name actually fits also uses 'len' rather than the updated buffer length strlen(buf). This allows us to write about "size" many bytes beyond the allocated memory. This vulnerability causes programs that use libxml2, such as PHP, to crash.

-

libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. At the end of the routine, the function may strcat two more characters without checking whether the current strlen(buf) + 2 < size. This vulnerability causes programs that use libxml2, such as PHP, to crash.

-

libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for libxml2 Bug 759398.

-

libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839.

- - - - https://bugzilla.gnome.org/show_bug.cgi?id=775200 - http://www.openwall.com/lists/oss-security/2017/05/15/1 - http://www.securityfocus.com/bid/98599 - http://www.openwall.com/lists/oss-security/2017/05/15/1 - http://www.securityfocus.com/bid/98556 - http://www.openwall.com/lists/oss-security/2017/05/15/1 - http://www.securityfocus.com/bid/98601 - http://www.openwall.com/lists/oss-security/2017/05/15/1 - http://www.securityfocus.com/bid/98568 - CVE-2017-8872 - CVE-2017-9047 - CVE-2017-9048 - CVE-2017-9049 - CVE-2017-9050 - - - 2017-05-10 - 2017-12-13 - - - - - FreeBSD -- OpenSSL multiple vulnerabilities - - - FreeBSD - 11.111.1_6 - 10.410.4_5 - 10.310.3_26 - - - - -

Problem Description:

-

Invoking SSL_read()/SSL_write() while in an error state - causes data to be passed without being decrypted/encrypted - directly from the SSL/TLS record layer.

-

In order to exploit this issue an application bug would - have to be present that resulted in a call to - SSL_read()/SSL_write() being issued after having already - received a fatal error. [CVE-2017-3737]

-

There is an overflow bug in the x86_64 Montgomery - multiplication procedure used in exponentiation with 1024-bit - moduli. This only affects processors that support the AVX2 - but not ADX extensions like Intel Haswell (4th generation). - [CVE-2017-3738] This bug only affects FreeBSD 11.x.

-

Impact:

-

Applications with incorrect error handling may inappropriately - pass unencrypted data. [CVE-2017-3737]

-

Mishandling of carry propagation will produce incorrect - output, and make it easier for a remote attacker to obtain - sensitive private-key information. No EC algorithms are - affected and analysis suggests that attacks against RSA and - DSA as a result of this defect would be very difficult to - perform and are not believed likely.

-

Attacks against DH1024 are considered just feasible - (although very difficult) because most of the work necessary - to deduce information about a private key may be performed - offline. The amount of resources required for such an attack - would be very significant and likely only accessible to a - limited number of attackers. However, for an attack on TLS - to be meaningful, the server would have to share the DH1024 - private key among multiple clients, which is no longer an - option since CVE-2016-0701. [CVE-2017-3738]

- - - - CVE-2016-0701 - CVE-2017-3737 - CVE-2017-3738 - SA-17:12.openssl - - - 2017-12-09 - 2017-12-10 - - - - - wireshark -- multiple security issues - - - wireshark - 2.2.02.2.10 - 2.4.02.4.2 - - - wireshark-lite - 2.2.02.2.10 - 2.4.02.4.2 - - - wireshark-qt5 - 2.2.02.2.10 - 2.4.02.4.2 - - - tshark - 2.2.02.2.10 - 2.4.02.4.2 - - - tshark-lite - 2.2.02.2.10 - 2.4.02.4.2 - - - - -

wireshark developers reports:

-
-

wnpa-sec-2017-47: The IWARP_MPA dissector could crash. (CVE-2017-17084)

-

wnpa-sec-2017-48: The NetBIOS dissector could crash. Discovered by Kamil Frankowicz. (CVE-2017-17083)

-

wnpa-sec-2017-49: The CIP Safety dissector could crash. (CVE-2017-17085)

-
- - - - https://www.wireshark.org/security/ - https://www.wireshark.org/security/wnpa-sec-2017-47.html - https://www.wireshark.org/security/wnpa-sec-2017-48.html - https://www.wireshark.org/security/wnpa-sec-2017-49.html - CVE-2017-17083 - CVE-2017-17084 - CVE-2017-17085 - - - 2017-11-30 - 2017-12-10 - - - - - OpenSSL -- multiple vulnerabilities - - - openssl - 1.0.21.0.2n - - - - -

The OpenSSL project reports:

-
-
  • Read/write after SSL object in error state (CVE-2017-3737)
    - OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an "error - state" mechanism. The intent was that if a fatal error occurred - during a handshake then OpenSSL would move into the error state and - would immediately fail if you attempted to continue the handshake. - This works as designed for the explicit handshake functions - (SSL_do_handshake(), SSL_accept() and SSL_connect()), however due to - a bug it does not work correctly if SSL_read() or SSL_write() is - called directly. In that scenario, if the handshake fails then a - fatal error will be returned in the initial function call. If - SSL_read()/SSL_write() is subsequently called by the application for - the same SSL object then it will succeed and the data is passed - without being decrypted/encrypted directly from the SSL/TLS record - layer.
    • -
  • rsaz_1024_mul_avx2 overflow bug on x86_64 (CVE-2017-3738)
    - There is an overflow bug in the AVX2 Montgomery multiplication - procedure used in exponentiation with 1024-bit moduli. No EC - algorithms are affected. Analysis suggests that attacks against - RSA and DSA as a result of this defect would be very difficult to - perform and are not believed likely. Attacks against DH1024 are - considered just feasible, because most of the work necessary to - deduce information about a private key may be performed offline. - The amount of resources required for such an attack would be - significant. However, for an attack on TLS to be meaningful, the - server would have to share the DH1024 private key among multiple - clients, which is no longer an option since CVE-2016-0701.
    • -
-
- - - - https://www.openssl.org/news/secadv/20171207.txt - CVE-2017-3737 - CVE-2017-3738 - - - 2017-12-07 - 2017-12-07 - - - - - FreeBSD -- OpenSSL multiple vulnerabilities - - - FreeBSD - 11.111.1_5 - 11.011.0_16 - 10.410.4_4 - 10.310.3_25 - - - - -

Problem Description:

-

If an X.509 certificate has a malformed IPAddressFamily - extension, OpenSSL could do a one-byte buffer overread. - [CVE-2017-3735]

-

There is a carry propagating bug in the x86_64 Montgomery - squaring procedure. This only affects processors that support - the BMI1, BMI2 and ADX extensions like Intel Broadwell (5th - generation) and later or AMD Ryzen. [CVE-2017-3736] This - bug only affects FreeBSD 11.x.

-

Impact:

-

Application using OpenSSL may display erroneous certificate - in text format. [CVE-2017-3735]

-

Mishandling of carry propagation will produce incorrect - output, and make it easier for a remote attacker to obtain - sensitive private-key information. No EC algorithms are - affected, analysis suggests that attacks against RSA and - DSA as a result of this defect would be very difficult to - perform and are not believed likely.

-

Attacks against DH are considered just feasible (although - very difficult) because most of the work necessary to deduce - information about a private key may be performed offline. - The amount of resources required for such an attack would - be very significant and likely only accessible to a limited - number of attackers. An attacker would additionally need - online access to an unpatched system using the target private - key in a scenario with persistent DH parameters and a private - key that is shared between multiple clients. [CVE-2017-3736]

- - - - CVE-2017-3735 - CVE-2017-3736 - SA-17:11.openssl - - - 2017-11-29 - 2017-12-06 - - - - - FreeBSD -- Information leak in kldstat(2) - - - FreeBSD-kernel - 11.111.1_4 - 11.011.0_15 - 10.410.4_3 - 10.310.3_24 - - - - -

Problem Description:

-

The kernel does not properly clear the memory of the - kld_file_stat structure before filling the data. Since the - structure filled by the kernel is allocated on the kernel - stack and copied to userspace, a leak of information from - the kernel stack is possible.

-

Impact:

-

Some bytes from the kernel stack can be observed in - userspace.

- - - - CVE-2017-1088 - SA-17:10.kldstat - - - 2017-11-15 - 2017-12-06 - - - - - FreeBSD -- POSIX shm allows jails to access global namespace - - - FreeBSD-kernel - 10.410.4_3 - 10.310.3_24 - - - - -

Problem Description:

-

Named paths are globally scoped, meaning a process located - in one jail can read and modify the content of POSIX shared - memory objects created by a process in another jail or the - host system.

-

Impact:

-

A malicious user that has access to a jailed system is - able to abuse shared memory by injecting malicious content - in the shared memory region. This memory region might be - executed by applications trusting the shared memory, like - Squid.

-

This issue could lead to a Denial of Service or local - privilege escalation.

- - - - CVE-2017-1087 - SA-17:09.shm - - - 2017-11-15 - 2017-12-06 - - - - - FreeBSD -- Kernel data leak via ptrace(PT_LWPINFO) - - - FreeBSD-kernel - 11.111.1_4 - 11.011.0_15 - 10.410.4_3 - 10.310.3_24 - - - - -

Problem Description:

-

Not all information in the struct ptrace_lwpinfo is - relevant for the state of any thread, and the kernel does - not fill the irrelevant bytes or short strings. Since the - structure filled by the kernel is allocated on the kernel - stack and copied to userspace, a leak of information of the - kernel stack of the thread is possible from the debugger.

-

Impact:

-

Some bytes from the kernel stack of the thread using - ptrace(PT_LWPINFO) call can be observed in userspace.

- - - - CVE-2017-1086 - SA-17:08.ptrace - - - 2017-11-15 - 2017-12-06 - - - - - FreeBSD -- WPA2 protocol vulnerability - - - FreeBSD - 11.111.1_2 - 11.011.0_13 - 10.410.4_1 - 10.310.3_22 - - - - -

Problem Description:

-

A vulnerability was found in how a number of implementations - can be triggered to reconfigure WPA/WPA2/RSN keys (TK, GTK, - or IGTK) by replaying a specific frame that is used to - manage the keys.

-

Impact:

-

Such reinstallation of the encryption key can result in - two different types of vulnerabilities: disabling replay - protection and significantly reducing the security of - encryption to the point of allowing frames to be decrypted - or some parts of the keys to be determined by an attacker - depending on which cipher is used.

- - - - CVE-2017-1307 - CVE-2017-1308 - SA-17:07.wpa - - - 2017-10-16 - 2017-12-06 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 57.0,157.0.1,1 - 56.0.2_11,1 - - - waterfox - 56.0.s20171130 - - - seamonkey - linux-seamonkey - 2.49.2 - - - firefox-esr - 52.5.1,1 - - - linux-firefox - 52.5.1,2 - - - - -

Mozilla Foundation reports:

-
-

CVE-2017-7843: Web worker in Private Browsing mode can write IndexedDB data

-

CVE-2017-7844: Visited history information leak through SVG image

-
- - - - CVE-2017-7843 - CVE-2017-7844 - https://www.mozilla.org/security/advisories/mfsa2017-27/ - - - 2017-11-29 - 2017-12-05 - - - - - varnish -- information disclosure vulnerability - - - varnish4 - 4.1.9 - - - varnish5 - 5.2.1 - - - - -

Varnish reports:

-
-

A wrong if statement in the varnishd source code means that - synthetic objects in stevedores which over-allocate, may leak up to page - size of data from a malloc(3) memory allocation.

-
- - - - https://varnish-cache.org/security/VSV00002.html - CVE-2017-8807 - - - 2017-11-15 - 2017-12-02 - - - - - mybb -- multiple vulnerabilities - - - mybb - 1.8.14 - - - - -

mybb Team reports:

-
-

High risk: Language file headers RCE

-

Low risk: Language Pack Properties XSS

-
- - - - https://blog.mybb.com/2017/11/28/mybb-1-8-14-released-security-maintenance-release/ - - - 2017-11-27 - 2017-12-02 - - - - - wordpress -- multiple issues - - - wordpress - fr-wordpress - 4.9.1,1 - - - de-wordpress - ja-wordpress - ru-wordpress - zh-wordpress-zh_CN - zh-wordpress-zh_TW - 4.9.1 - - - - -

wordpress developers reports:

-
-

Use a properly generated hash for the newbloguser key instead of a determinate substring.

-

Add escaping to the language attributes used on html elements.

-

Ensure the attributes of enclosures are correctly escaped in RSS and Atom feeds.

-

Remove the ability to upload JavaScript files for users who do not have the unfiltered_html capability.

-
- - - - https://wordpress.org/news/2017/11/wordpress-4-9-1-security-and-maintenance-release/ - - - 2017-11-29 - 2017-12-01 - - - - - asterisk -- DOS Vulnerability in Asterisk chan_skinny - - - asterisk13 - 13.18.3 - - - - -

The Asterisk project reports:

-
-

If the chan_skinny (AKA SCCP protocol) channel driver - is flooded with certain requests it can cause the asterisk - process to use excessive amounts of virtual memory - eventually causing asterisk to stop processing requests - of any kind.

-
- - - - https://downloads.asterisk.org/pub/security/AST-2017-013.html - CVE-2017-17090 - - - 2017-11-30 - 2017-12-01 - 2017-12-13 - - - - - exim -- remote DoS attack in BDAT processing - - - exim - 4.884.89.1 - - - - -

Exim developers team reports:

-
-

The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service (infinite loop and stack exhaustion) via vectors involving BDAT commands and an improper check for a '.' character signifying the end of the content, related to the bdat_getc function.

-
- - - - https://bugs.exim.org/show_bug.cgi?id=2199 - CVE-2017-16944 - - - 2017-11-23 - 2017-11-30 - - - - - xrdp -- local user can cause a denial of service - - - xrdp-devel - 0.9.3,1 - 0.9.3_1,10.9.4,1 - - - - -

xrdp reports:

-
-

The scp_v0s_accept function in the session manager uses an untrusted integer as a write length, - which allows local users to cause a denial of service (buffer overflow and application crash) - or possibly have unspecified other impact via a crafted input stream.

-
- - - - CVE-2017-16927 - - - 2017-11-23 - 2017-11-29 - - - - - cURL -- Multiple vulnerabilities - - - curl - 7.21.07.57.0 - - - linux-c7-curl - 7.21.07.29.0_4 - - - - -

The cURL project reports:

-
-
  • NTLM buffer overflow via integer overflow - (CVE-2017-8816)
    libcurl contains a buffer overrun flaw - in the NTLM authentication code. - The internal function Curl_ntlm_core_mk_ntlmv2_hash sums up - the lengths of the user name + password (= SUM) and multiplies - the sum by two (= SIZE) to figure out how large storage to - allocate from the heap.
    • -
  • FTP wildcard out of bounds read (CVE-2017-8817)
    - libcurl contains a read out of bounds flaw in the FTP wildcard - function. - libcurl's FTP wildcard matching feature, which is enabled with - the CURLOPT_WILDCARDMATCH option can use a built-in wildcard - function or a user provided one. The built-in wildcard function - has a flaw that makes it not detect the end of the pattern - string if it ends with an open bracket ([) but instead it will - continue reading the heap beyond the end of the URL buffer that - holds the wildcard.
    • -
  • SSL out of buffer access (CVE-2017-8818)
    - libcurl contains an out boundary access flaw in SSL related code. - When allocating memory for a connection (the internal struct - called connectdata), a certain amount of memory is allocated at - the end of the struct to be used for SSL related structs. Those - structs are used by the particular SSL library libcurl is built - to use. The application can also tell libcurl which specific SSL - library to use if it was built to support more than one. -
-
- - - - https://curl.haxx.se/changes.html - CVE-2017-8816 - CVE-2017-8817 - CVE-2017-8818 - - - 2017-11-29 - 2017-11-29 - 2017-12-11 - - - - - borgbackup -- remote users can override repository restrictions - - - py34-borgbackup - py35-borgbackup - py36-borgbackup - 1.1.01.1.3 - - - - -

BorgBackup reports:

-
-

Incorrect implementation of access controls allows remote users to - override repository restrictions in Borg servers. A user able to - access a remote Borg SSH server is able to circumvent access controls - post-authentication. Affected releases: 1.1.0, 1.1.1, 1.1.2. Releases - 1.0.x are NOT affected.

-
- - - - CVE-2017-15914 - https://github.com/borgbackup/borg/blob/1.1.3/docs/changes.rst#version-113-2017-11-27 - - - 2017-11-27 - 2017-11-29 - - - - - palemoon -- multiple vulnerabilities - - - palemoon - 27.6.2 - - - - -

Pale Moon reports:

-
-

CVE-2017-7832: Domain spoofing through use of dotless 'i' character followed by accent markers

-

CVE-2017-7835: Mixed content blocking incorrectly applies with redirects

-

CVE-2017-7840: Exported bookmarks do not strip script elements from user-supplied tags

-
- - - - CVE-2017-7832 - CVE-2017-7835 - CVE-2017-7840 - - - 2017-11-14 - 2017-11-28 - - - - - exim -- remote code execution, deny of service in BDAT - - - exim - 4.884.89_2 - - - - -

Exim team reports:

-
-

The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via vectors involving BDAT commands.

-
- - - - https://bugs.exim.org/show_bug.cgi?id=2199 - - - 2017-11-23 - 2017-11-27 - - - - - mybb -- multiple vulnerabilities - - - mybb - 1.8.13 - - - - -

myBB Team reports:

-
-

High risk: Installer RCE on configuration file write

-

High risk: Language file headers RCE

-

Medium risk: Installer XSS

-

Medium risk: Mod CP Edit Profile XSS

-

Low risk: Insufficient moderator permission check in delayed moderation tools

-

Low risk: Announcements HTML filter bypass

-

Low risk: Language Pack Properties XSS.

-
- - - - https://blog.mybb.com/2017/11/07/mybb-1-8-13-released-security-maintenance-release/ - - - 2017-11-07 - 2017-11-24 - - - - - salt -- multiple vulnerabilities - - - py27-salt - py32-salt - py33-salt - py34-salt - py35-salt - py36-salt - 2016.11.8 - 2017.7.02017.7.2 - - - - -

SaltStack reports:

-
-

Directory traversal vulnerability in minion id validation in SaltStack. - Allows remote minions with incorrect credentials to authenticate to a - master via a crafted minion ID. Credit for discovering the security flaw - goes to: Julian Brost (julian@0x4a42.net). NOTE: this vulnerability exists - because of an incomplete fix for CVE-2017-12791.

-

Remote Denial of Service with a specially crafted authentication request. - Credit for discovering the security flaw goes to: Julian Brost - (julian@0x4a42.net)

-
- - - - CVE-2017-14695 - CVE-2017-14696 - https://docs.saltstack.com/en/latest/topics/releases/2017.7.2.html - https://docs.saltstack.com/en/2016.11/topics/releases/2016.11.8.html - https://github.com/saltstack/salt/commit/80d90307b07b3703428ecbb7c8bb468e28a9ae6d - https://github.com/saltstack/salt/commit/5f8b5e1a0f23fe0f2be5b3c3e04199b57a53db5b - - - 2017-10-09 - 2017-11-23 - - - - - codeigniter -- input validation bypass - - - codeigniter - 3.1.6 - - - - -

The CodeIgniter changelog reports:

-
-

Security: Fixed a potential object injection in Cache Library 'apc' - driver when save() is used with $raw = TRUE.

-
- - - - https://www.codeigniter.com/user_guide/changelog.html - - - 2017-09-25 - 2017-11-23 - - - - - procmail -- Heap-based buffer overflow - - - procmail - 3.22_10 - - - - -

MITRE reports:

-
-

A remote attacker could use a flaw to cause formail to crash, - resulting in a denial of service or data loss.

-
- - - - CVE-2017-16844 - https://www.debian.org/security/2017/dsa-4041 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=876511 - - - 2017-11-16 - 2017-11-21 - 2017-12-08 - - - - - frr -- BGP Mishandled attribute length on Error - - - frr - 3.0.2 - - - - -

FRR reports:

-
-

BGP Mishandled attribute length on Error

-

A vulnerability exists in the BGP daemon of FRR where a malformed BGP UPDATE - packet can leak information from the BGP daemon and cause a denial of - service by crashing the daemon.

-
- - - - CVE-2017-15865 - https://frrouting.org/community/security/cve-2017-15865.html - - - 2017-11-08 - 2017-11-21 - - - - - cacti -- multiple vulnerabilities - - - cacti - 1.1.28 - - - - -

cacti reports:

-
-

Changelog

-

issue#1057: CVE-2017-16641 - Potential vulnerability in RRDtool functions

-

issue#1066: CVE-2017-16660 in remote_agent.php logging function

-

issue#1066: CVE-2017-16661 in view log file

-

issue#1071: CVE-2017-16785 in global_session.php Reflection XSS

-
- - - - CVE-2017-16641 - CVE-2017-16660 - CVE-2017-16661 - CVE-2017-16785 - https://sourceforge.net/p/cacti/mailman/message/36122745/ - - - 2017-11-01 - 2017-11-20 - - - - - mediawiki -- multiple vulnerabilities - - - mediawiki127 - 1.27.3 - - - mediawiki128 - 1.28.2 - - - mediawiki129 - 1.29.1 - - - - -

mediawiki reports:

-
-

security fixes:

-

T128209: Reflected File Download from api.php. Reported by Abdullah Hussam.

-

T165846: BotPasswords doesn't throttle login attempts.

-

T134100: On private wikis, login form shouldn't distinguish between login failure due to bad username and bad password.

-

T178451: XSS when $wgShowExceptionDetails = false and browser sends non-standard url escaping.

-

T176247: It's possible to mangle HTML via raw message parameter expansion.

-

T125163: id attribute on headlines allow raw.

-

T124404: language converter can be tricked into replacing text inside tags by adding a lot of junk after the rule definition.

-

T119158: Language converter: unsafe attribute injection via glossary rules.

-

T180488: api.log contains passwords in plaintext wasn't correctly fixed.

-

T180231: composer.json has require-dev versions of PHPUnit with known security issues. Reported by Tom Hutchison.

-
- - - - CVE-2017-8808 - CVE-2017-8809 - CVE-2017-8810 - CVE-2017-8811 - CVE-2017-8812 - CVE-2017-8814 - CVE-2017-8815 - CVE-2017-0361 - CVE-2017-9841 - https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-November/000216.html - - - 2017-11-14 - 2017-11-19 - - - - - Flash Player -- multiple vulnerabilities - - - linux-flashplayer - 27.0.0.187 - - - - -

Adobe reports:

-
-
    -
  • These updates resolve out-of-bounds read vulnerabilities that - could lead to remote code execution (CVE-2017-3112, - CVE-2017-3114, CVE-2017-11213).
    • -
  • These updates resolve use after free vulnerabilities that - could lead to remote code execution (CVE-2017-11215, - CVE-2017-11225).
    • -
-
- - - - CVE-2017-3112 - CVE-2017-3114 - CVE-2017-11213 - CVE-2017-11215 - CVE-2017-11225 - https://helpx.adobe.com/security/products/flash-player/apsb17-33.html - - - 2017-11-14 - 2017-11-16 - - - - - shibboleth2-sp -- "Dynamic" metadata provider plugin issue - - - shibboleth2-sp - 2.6.1 - - - - -

The Internet2 community reports:

-
-

- The Shibboleth Service Provider software includes a MetadataProvider - plugin with the plugin type "Dynamic" to obtain metadata on demand - from a query server, in place of the more typical mode of - downloading aggregates separately containing all of the metadata to - load. -

- All the plugin types rely on MetadataFilter plugins to perform - critical security checks such as signature verification, enforcement - of validity periods, and other checks specific to deployments. -

- Due to a coding error, the "Dynamic" plugin fails to configure - itself with the filters provided to it and thus omits whatever - checks they are intended to perform, which will typically leave - deployments vulnerable to active attacks involving the substitution - of metadata if the network path to the query service is - compromised. -

-
- - - - http://shibboleth.internet2.edu/secadv/secadv_20171115.txt - - - 2017-11-15 - 2017-11-15 - - - - - mozilla -- multiple vulnerabilities - - - firefox - - 56.0.2_10,1 - - - seamonkey - linux-seamonkey - 2.49.2 - - - firefox-esr - 52.5.0,1 - - - linux-firefox - 52.5.0,2 - - - libxul - thunderbird - linux-thunderbird - 52.5.0 - - - - -

Mozilla Foundation reports:

-
-

CVE-2017-7828: Use-after-free of PressShell while restyling layout

-

CVE-2017-7830: Cross-origin URL information leak through Resource Timing API

-

CVE-2017-7831: Information disclosure of exposed properties on JavaScript proxy objects

-

CVE-2017-7832: Domain spoofing through use of dotless 'i' character followed by accent markers

-

CVE-2017-7833: Domain spoofing with Arabic and Indic vowel marker characters

-

CVE-2017-7834: data: URLs opened in new tabs bypass CSP protections

-

CVE-2017-7835: Mixed content blocking incorrectly applies with redirects

-

CVE-2017-7836: Pingsender dynamically loads libcurl on Linux and OS X

-

CVE-2017-7837: SVG loaded as <img> can use meta tags to set cookies

-

CVE-2017-7838: Failure of individual decoding of labels in international domain names triggers punycode display of entire IDN

-

CVE-2017-7839: Control characters before javascript: URLs defeats self-XSS prevention mechanism

-

CVE-2017-7840: Exported bookmarks do not strip script elements from user-supplied tags

-

CVE-2017-7842: Referrer Policy is not always respected for <link> elements

-

CVE-2017-7827: Memory safety bugs fixed in Firefox 57

-

CVE-2017-7826: Memory safety bugs fixed in Firefox 57 and Firefox ESR 52.5

-
- - - - CVE-2017-7826 - CVE-2017-7827 - CVE-2017-7828 - CVE-2017-7830 - CVE-2017-7831 - CVE-2017-7832 - CVE-2017-7833 - CVE-2017-7834 - CVE-2017-7835 - CVE-2017-7836 - CVE-2017-7837 - CVE-2017-7838 - CVE-2017-7839 - CVE-2017-7840 - CVE-2017-7842 - https://www.mozilla.org/security/advisories/mfsa2017-24/ - https://www.mozilla.org/security/advisories/mfsa2017-25/ - - - 2017-11-14 - 2017-11-14 - - - - - rubygem-geminabox -- XSS vulnerabilities - - - rubygem-geminabox - 0.13.10 - - - - -

NVD reports:

-
-

Stored cross-site scripting (XSS) vulnerability in "geminabox" - (Gem in a Box) before 0.13.10 allows attackers to inject arbitrary - web script via the "homepage" value of a ".gemspec" file, related - to views/gem.erb and views/index.erb.

-
- - - - https://nvd.nist.gov/vuln/detail/CVE-2017-16792 - CVE-2017-16792 - - - 2017-11-13 - 2017-11-13 - - - - - konversation -- crash in IRC message parsing - - - konversation - 1.7.3 - - - - -

KDE reports:

-
-

Konversation has support for colors in IRC messages. Any malicious user connected to the same IRC network can send a carefully crafted message that will crash the Konversation user client.

-
- - - - CVE-2017-15923 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15923 - https://www.kde.org/info/security/advisory-20171112-1.txt - - - 2017-10-27 - 2017-11-12 - - - - - roundcube -- file disclosure vulnerability - - - roundcube - 1.3.3,1 - - - - -

MITRE reports:

-
-

Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before - 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, - including configuration files, as exploited in the wild in November 2017. - The attacker must be able to authenticate at the target system with a valid - username/password as the attack requires an active session.

-
- - - - https://github.com/roundcube/roundcubemail/issues/6026 - https://roundcube.net/news/2017/11/08/security-updates-1.3.3-1.2.7-and-1.1.10 - CVE-2017-16651 - ports/223557 - - - 2017-11-06 - 2017-11-11 - 2017-12-31 - - - - - chromium -- multiple vulnerabilities - - - chromium - 62.0.3202.89 - - - - -

Google Chrome Releases reports:

-
-

2 security fixes in this release, including:

-
    -
  • [777728] Critical CVE-2017-15398: Stack buffer overflow in QUIC. - Reported by Ned Williamson on 2017-10-24
    • -
  • [776677] High CVE-2017-15399: Use after free in V8. Reported by - Zhao Qixun of Qihoo 360 Vulcan Team on 2017-10-20
    • -
-
- - - - CVE-2017-15398 - CVE-2017-15399 - https://chromereleases.googleblog.com/2017/11/stable-channel-update-for-desktop.html - - - 2017-11-06 - 2017-11-10 - - - - - PostgreSQL vulnerabilities - - - postgresql92-server - 9.2.09.2.24 - - - postgresql93-server - 9.3.09.3.20 - - - postgresql94-server - 9.4.09.4.15 - - - postgresql95-server - 9.5.09.5.10 - - - postgresql96-server - 9.6.09.6.6 - - - postgresql10-server - 10.010.1 - - - - -

The PostgreSQL project reports:

-
-
    -
  • CVE-2017-15098: Memory disclosure in JSON functions
    • -
  • CVE-2017-15099: INSERT ... ON CONFLICT DO UPDATE fails to - enforce SELECT privileges
    • -
-
- - - - CVE-2017-15099 - CVE-2017-15098 - - - 2017-10-10 - 2017-11-09 - - - - - jenkins -- multiple issues - - - jenkins - 2.89 - - - jenkins-lts - 2.73.3 - - - - -

Jenkins developers report:

-
-

Jenkins stores metadata related to people, which encompasses actual user accounts, as well as users appearing in SCM, in directories corresponding to the user ID on disk. These directories used the user ID for their name without additional escaping. This potentially resulted in a number of problems.

-

Autocompletion suggestions for text fields were not escaped, resulting in a persisted cross-site scripting vulnerability if the source for the suggestions allowed specifying text that includes HTML metacharacters like less-than and greater-than characters.

-
- - - - https://jenkins.io/security/advisory/2017-11-08/ - - - 2017-11-08 - 2017-11-09 - - - - - asterisk -- Memory/File Descriptor/RTP leak in pjsip session resource - - - asterisk13 - 13.5.013.18.1 - - - - -

The Asterisk project reports:

-
-

A memory leak occurs when an Asterisk pjsip session - object is created and that call gets rejected before the - session itself is fully established. When this happens - the session object never gets destroyed. This then leads - to file descriptors and RTP ports being leaked as well.

-
- - - - https://downloads.asterisk.org/pub/security/AST-2017-011.html - CVE-2017-16672 - - - 2017-10-15 - 2017-11-09 - 2017-12-13 - - - - - asterisk -- Buffer overflow in CDR's set user - - - asterisk13 - 13.18.1 - - - - -

The Asterisk project reports:

-
-

No size checking is done when setting the user field - for Party B on a CDR. Thus, it is possible for someone - to use an arbitrarily large string and write past the end - of the user field storage buffer. The earlier AST-2017-001 - advisory for the CDR user field overflow was for the Party - A buffer.

-
- - - - https://downloads.asterisk.org/pub/security/AST-2017-010.html - CVE-2017-16671 - - - 2017-10-09 - 2017-11-09 - 2017-12-13 - - - - - asterisk -- Buffer overflow in pjproject header parsing can cause crash in Asterisk - - - asterisk13 - 13.18.1 - - - pjsip - 2.7.1 - - - pjsip-extsrtp - 2.7.1 - - - - -

The Asterisk project reports:

-
-

By carefully crafting invalid values in the Cseq and - the Via header port, pjprojects packet parsing code can - create strings larger than the buffer allocated to hold - them. This will usually cause Asterisk to crash immediately. - The packets do not have to be authenticated.

-
- - - - https://downloads.asterisk.org/pub/security/AST-2017-009.html - - - 2017-10-05 - 2017-11-09 - 2017-11-15 - - - - - OpenSSL -- Multiple vulnerabilities - - - openssl - 1.0.2m,1 - - - openssl-devel - 1.1.0g - - - - -

The OpenSSL project reports:

-
-

bn_sqrx8x_internal carry bug on x86_64 (CVE-2017-3736)
- Severity: Moderate
- There is a carry propagating bug in the x86_64 Montgomery squaring - procedure. No EC algorithms are affected. Analysis suggests that - attacks against RSA and DSA as a result of this defect would be - very difficult to perform and are not believed likely. Attacks - against DH are considered just feasible (although very difficult) - because most of the work necessary to deduce information about a - private key may be performed offline.

-

Malformed X.509 IPAddressFamily could cause OOB read (CVE-2017-3735)
- Severity: Low
- This issue was previously announced in security advisory - https://www.openssl.org/news/secadv/20170828.txt, but the fix has - not previously been included in a release due to its low severity.

-
- - - - https://www.openssl.org/news/secadv/20171102.txt - CVE-2017-3735 - CVE-2017-3736 - - - 2017-11-02 - 2017-11-02 - - - - - wordpress -- multiple issues - - - wordpress - 4.8.3,1 - - - - -

wordpress developers reports:

-
-

WordPress versions 4.8.2 and earlier are affected by an issue - where $wpdb->prepare() can create unexpected and unsafe queries - leading to potential SQL injection (SQLi). WordPress core is not - directly vulnerable to this issue, but we've added hardening to - prevent plugins and themes from accidentally causing a vulnerability.

-
- - - - https://wordpress.org/news/2017/10/wordpress-4-8-3-security-release/ - - - 2017-10-31 - 2017-11-01 - - - - - wireshark -- multiple security issues - - - wireshark - 2.2.02.2.9 - 2.4.02.4.1 - - - - -

wireshark developers reports:

-
-

In Wireshark 2.4.0 to 2.4.1, the DOCSIS dissector could go into an infinite loop. This was addressed in plugins/docsis/packet-docsis.c by adding decrements.

-

In Wireshark 2.4.0 to 2.4.1, the RTSP dissector could crash. This was addressed in epan/dissectors/packet-rtsp.c by correcting the scope of a variable.

-

In Wireshark 2.4.0 to 2.4.1, 2.2.0 to 2.2.9, and 2.0.0 to 2.0.15, the DMP dissector could crash. This was addressed in epan/dissectors/packet-dmp.c by validating a string length.

-

In Wireshark 2.4.0 to 2.4.1 and 2.2.0 to 2.2.9, the BT ATT dissector could crash. This was addressed in epan/dissectors/packet-btatt.c by considering a case where not all of the BTATT packets have the same encapsulation level.

-

In Wireshark 2.4.0 to 2.4.1 and 2.2.0 to 2.2.9, the MBIM dissector could crash or exhaust system memory. This was addressed in epan/dissectors/packet-mbim.c by changing the memory-allocation approach.

-
- - - - http://www.securityfocus.com/bid/101227 - http://www.securityfocus.com/bid/101228 - http://www.securityfocus.com/bid/101229 - http://www.securityfocus.com/bid/101235 - http://www.securityfocus.com/bid/101240 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14049 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14056 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14068 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14077 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14080 - https://code.wireshark.org/review/23470 - https://code.wireshark.org/review/23537 - https://code.wireshark.org/review/23591 - https://code.wireshark.org/review/23635 - https://code.wireshark.org/review/23663 - https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=3689dc1db36037436b1616715f9a3f888fc9a0f6 - https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=625bab309d9dd21db2d8ae2aa3511810d32842a8 - https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=8dbb21dfde14221dab09b6b9c7719b9067c1f06e - https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=afb9ff7982971aba6e42472de0db4c1bedfc641b - https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=e27870eaa6efa1c2dac08aa41a67fe9f0839e6e0 - https://www.wireshark.org/security/wnpa-sec-2017-42.html - https://www.wireshark.org/security/wnpa-sec-2017-43.html - https://www.wireshark.org/security/wnpa-sec-2017-44.html - https://www.wireshark.org/security/wnpa-sec-2017-45.html - https://www.wireshark.org/security/wnpa-sec-2017-46.html - CVE-2017-15189 - CVE-2017-15190 - CVE-2017-15191 - CVE-2017-15192 - CVE-2017-15193 - - - 2017-10-10 - 2017-10-30 - - - - - PHP -- denial of service attack - - - php56 - 5.6.32 - - - php70 - 7.0.25 - - - php71 - 7.1.11 - - - - -

The PHP project reports:

-
-

The PHP development team announces the immediate availability of PHP - 5.6.32. This is a security release. Several security bugs were fixed in this - release. All PHP 5.6 users are encouraged to upgrade to this version.

-
-
-

The PHP development team announces the immediate availability of PHP - 7.0.25. This is a security release. Several security bugs were fixed in this - release. All PHP 7.0 users are encouraged to upgrade to this version.

-
-
-

The PHP development team announces the immediate availability of PHP - 7.1.11. This is a bugfix release, with several bug fixes included. All PHP - 7.1 users are encouraged to upgrade to this version.

-
- - - - http://php.net/archive/2017.php#id2017-10-26-3 - http://php.net/archive/2017.php#id2017-10-26-1 - http://php.net/archive/2017.php#id2017-10-27-1 - CVE-2016-1283 - - - 2017-10-26 - 2017-10-30 - 2017-11-14 - - - - - chromium -- Stack overflow in V8 - - - chromium - 62.0.3202.75 - - - - -

Google Chrome Releases reports:

-
-

2 security fixes in this release, including:

-
    -
  • [770452] High CVE-2017-15396: Stack overflow in V8. Reported by - Yuan Deng of Ant-financial Light-Year Security Lab on 2017-09-30
    • -
  • [770450] Medium CVE-2017-15406: Stack overflow in V8. Reported by - Yuan Deng of Ant-financial Light-Year Security Lab on 2017-09-30
    • -
-
- - - - CVE-2017-15396 - CVE-2017-15406 - https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop_26.html - - - 2017-10-26 - 2017-10-28 - 2018-01-23 - - - - - wget -- Heap overflow in HTTP protocol handling - - - wget - 1.19.2 - - - - -

Antti Levomäki, Christian Jalio, Joonas Pihlaja:

-
-

Wget contains two vulnerabilities, a stack overflow and a heap - overflow, in the handling of HTTP chunked encoding. By convincing - a user to download a specific link over HTTP, an attacker may be - able to execute arbitrary code with the privileges of the user. -

-
- - - - http://git.savannah.gnu.org/cgit/wget.git/commit/?id=ba6b44f6745b14dce414761a8e4b35d31b176bba - CVE-2017-13090 - - - 2017-10-20 - 2017-10-27 - - - - - wget -- Stack overflow in HTTP protocol handling - - - wget - 1.19.2 - - - - -

Antti Levomäki, Christian Jalio, Joonas Pihlaja:

-
-

Wget contains two vulnerabilities, a stack overflow and a heap - overflow, in the handling of HTTP chunked encoding. By convincing - a user to download a specific link over HTTP, an attacker may be - able to execute arbitrary code with the privileges of the user. -

-
- - - - http://git.savannah.gnu.org/cgit/wget.git/commit/?id=d892291fb8ace4c3b734ea5125770989c215df3f - CVE-2017-13089 - - - 2017-10-20 - 2017-10-27 - - - - - Node.js -- remote DOS security vulnerability - - - node - 8.8.0 - - - node6 - 6.10.26.11.5 - - - node4 - 4.8.24.8.5 - - - - -

Node.js reports:

-
-

Node.js was susceptible to a remote DoS attack due to a change that came in as part of zlib v1.2.9. In zlib v1.2.9 8 became an invalid value for the windowBits parameter and Node's zlib module will crash or throw an exception (depending on the version)

-
- - - - https://nodejs.org/en/blog/vulnerability/oct-2017-dos/ - CVE-2017-14919 - - - 2017-10-17 - 2017-10-25 - - - - - GitLab -- multiple vulnerabilities - - - gitlab - 2.8.09.4.6 - 9.5.09.5.8 - 10.0.010.0.3 - - - - -

GitLab reports:

-
-

Cross-Site Scripting (XSS) vulnerability in the Markdown sanitization - filter

-

Yasin Soliman via HackerOne reported a Cross-Site Scripting (XSS) - vulnerability in the GitLab markdown sanitization filter. The sanitization - filter was not properly stripping invalid characters from URL schemes and - was therefore vulnerable to persistent XSS attacks anywhere Markdown was - supported.

-

Cross-Site Scripting (XSS) vulnerability in search bar

-

Josh Unger reported a Cross-Site Scripting (XSS) vulnerability in the - issue search bar. Usernames were not being properly HTML escaped inside the - author filter would could allow arbitrary script execution.

-

Open redirect in repository git redirects

-

Eric Rafaloff via HackerOne reported that GitLab was vulnerable to an - open redirect vulnerability when redirecting requests for repository names - that include the git extension. GitLab was not properly removing dangerous - parameters from the params field before redirecting which could allow an - attacker to redirect users to arbitrary hosts.

-

Username changes could leave repositories behind

-

An internal code review discovered that a bug in the code that moves - repositories during a username change could potentially leave behind - projects, allowing an attacker who knows the previous username to - potentially steal the contents of repositories on instances that are not - configured with hashed namespaces.

-
- - - - https://about.gitlab.com/2017/10/17/gitlab-10-dot-0-dot-4-security-release/ - - - 2017-10-17 - 2017-10-25 - - - - - Apache OpenOffice -- multiple vulnerabilities - - - apache-openoffice - 4.1.4 - - - apache-openoffice-devel - 4.2.1810071_1,4 - - - - -

The Apache Openofffice project reports:

-
-

CVE-2017-3157: Arbitrary file disclosure in Calc and Writer

-

By exploiting the way OpenOffice renders embedded objects, an attacker could craft a document that allows reading in a file from the user's filesystem. Information could be retrieved by the attacker by, e.g., using hidden sections to store the information, tricking the user into saving the document and convincing the user to sent the document back to the attacker.

-

The vulnerability is mitigated by the need for the attacker to know the precise file path in the target system, and the need to trick the user into saving the document and sending it back.

-
-
-

CVE-2017-9806: Out-of-Bounds Write in Writer's WW8Fonts Constructor

-

A vulnerability in the OpenOffice Writer DOC file parser, and specifically in the WW8Fonts Constructor, allows attackers to craft malicious documents that cause denial of service (memory corruption and application crash) potentially resulting in arbitrary code execution.

-
-
-

CVE-2017-12607: Out-of-Bounds Write in Impress' PPT Filter

-

A vulnerability in OpenOffice's PPT file parser, and specifically in PPTStyleSheet, allows attackers to craft malicious documents that cause denial of service (memory corruption and application crash) potentially resulting in arbitrary code execution.

-
-
-

CVE-2017-12608: Out-of-Bounds Write in Writer's ImportOldFormatStyles

-

A vulnerability in OpenOffice Writer DOC file parser, and specifically in ImportOldFormatStyles, allows attackers to craft malicious documents that cause denial of service (memory corruption and application crash) potentially resulting in arbitrary code execution.

-
- - - - https://www.openoffice.org/security/cves/CVE-2017-3157.html - https://www.openoffice.org/security/cves/CVE-2017-9806.html - https://www.openoffice.org/security/cves/CVE-2017-12607.html - https://www.openoffice.org/security/cves/CVE-2017-12608.html - CVE-2017-3157 - CVE-2017-9806 - CVE-2017-12607 - CVE-2017-12608 - - - 2016-09-11 - 2017-10-24 - 2017-10-26 - - - - - cURL -- out of bounds read - - - curl - 7.207.56.1 - - - - -

The cURL project reports:

-
-

libcurl contains a buffer overrun flaw in the IMAP handler.
- An IMAP FETCH response line indicates the size of the returned data, - in number of bytes. When that response says the data is zero bytes, - libcurl would pass on that (non-existing) data with a pointer and - the size (zero) to the deliver-data function.
- libcurl's deliver-data function treats zero as a magic number and - invokes strlen() on the data to figure out the length. The strlen() - is called on a heap based buffer that might not be zero terminated - so libcurl might read beyond the end of it into whatever memory lies - after (or just crash) and then deliver that to the application as if - it was actually downloaded.

-
- - - - https://curl.haxx.se/docs/adv_20171023.html - CVE-2017-1000257 - - - 2017-10-23 - 2017-10-23 - - - - - h2o -- DoS in workers - - - h2o - 2.2.3 - - - - -

Frederik Deweerdt reports:

-
-

Multiple Denial-of-Service vulnerabilities exist in h2o workers - - see references for full details.

-

CVE-2017-10868: Worker processes may crash when receiving a request with invalid framing.

-

CVE-2017-10869: The stack may overflow when proxying huge requests.

-
- - - - CVE-2017-10868 - CVE-2017-10869 - https://github.com/h2o/h2o/issues/1459 - https://github.com/h2o/h2o/issues/1460 - https://github.com/h2o/h2o/releases/tag/v2.2.3 - - - 2017-07-19 - 2017-10-17 - - - - - irssi -- multiple vulnerabilities - - - irssi - 1.0.5,1 - - - - -

Irssi reports:

-
-

When installing themes with unterminated colour formatting - sequences, Irssi may access data beyond the end of the string.

-

While waiting for the channel synchronisation, Irssi may - incorrectly fail to remove destroyed channels from the query list, - resulting in use after free conditions when updating the state later - on.

-

Certain incorrectly formatted DCC CTCP messages could cause NULL - pointer dereference.

-

Overlong nicks or targets may result in a NULL pointer dereference - while splitting the message.

-

In certain cases Irssi may fail to verify that a Safe channel ID - is long enough, causing reads beyond the end of the string.

-
- - - - https://irssi.org/security/irssi_sa_2017_10.txt - CVE-2017-15721 - CVE-2017-15722 - CVE-2017-15723 - CVE-2017-15227 - CVE-2017-15228 - ports/223169 - - - 2017-10-10 - 2017-10-22 - 2017-12-31 - - - - - chromium -- multiple vulnerabilities - - - chromium - 62.0.3202.62 - - - - -

Google Chrome Releases reports:

-
-

35 security fixes in this release, including:

-
    -
  • [762930] High CVE-2017-5124: UXSS with MHTML. Reported by - Anonymous on 2017-09-07
    • -
  • [749147] High CVE-2017-5125: Heap overflow in Skia. Reported by - Anonymous on 2017-07-26
    • -
  • [760455] High CVE-2017-5126: Use after free in PDFium. Reported by - Luat Nguyen on KeenLab, Tencent on 2017-08-30
    • -
  • [765384] High CVE-2017-5127: Use after free in PDFium. Reported by - Luat Nguyen on KeenLab, Tencent on 2017-09-14
    • -
  • [765469] High CVE-2017-5128: Heap overflow in WebGL. Reported by - Omair on 2017-09-14
    • -
  • [765495] High CVE-2017-5129: Use after free in WebAudio. Reported by - Omair on 2017-09-15
    • -
  • [718858] High CVE-2017-5132: Incorrect stack manipulation in WebAssembly. Reported by - Gaurav Dewan of Adobe Systems India Pvt. Ltd. on 2017-05-05
    • -
  • [722079] High CVE-2017-5130: Heap overflow in libxml2. Reported by - Pranjal Jumde on 2017-05-14
    • -
  • [744109] Medium CVE-2017-5131: Out of bounds write in Skia. Reported by - Anonymous on 2017-07-16
    • -
  • [762106] Medium CVE-2017-5133: Out of bounds write in Skia. Reported by - Aleksandar Nikolic of Cisco Talos on 2017-09-05
    • -
  • [752003] Medium CVE-2017-15386: UI spoofing in Blink. Reported by - WenXu Wu of Tencent's Xuanwu Lab on 2017-08-03
    • -
  • [756040] Medium CVE-2017-15387: Content security bypass. Reported by - Jun Kokatsu on 2017-08-16
    • -
  • [756563] Medium CVE-2017-15388: Out of bounds read in Skia. Reported by - Kushal Arvind Shah of Fortinet's FortiGuard Labs on 2017-08-17
    • -
  • [739621] Medium CVE-2017-15389: URL spoofing in Omnibox. Reported by - xisigr of Tencent's Xuanwu Lab on 2017-07-06
    • -
  • [750239] Medium CVE-2017-15390: URL spoofing in Omnibox. Reported by - Haosheng Wang on 2017-07-28
    • -
  • [598265] Low CVE-2017-15391: Extension limitation bypass in Extensions. Reported by - Joao Lucas Melo Brasio on 2016-03-28
    • -
  • [714401] Low CVE-2017-15392: Incorrect registry key handling in PlatformIntegration. - Reported by Xiaoyin Liu on 2017-04-22
    • -
  • [732751] Low CVE-2017-15393: Referrer leak in Devtools. Reported by - Svyat Mitin on 2017-06-13
    • -
  • [745580] Low CVE-2017-15394: URL spoofing in extensions UI. Reported by - Sam on 2017-07-18
    • -
  • [759457] Low CVE-2017-15395: Null pointer dereference in ImageCapture. Reported by - Johannes Bergman on 2017-08-28
    • -
  • [775550] Various fixes from internal audits, fuzzing and other initiatives
    • -
-
- - - - CVE-2017-5124 - CVE-2017-5125 - CVE-2017-5126 - CVE-2017-5127 - CVE-2017-5128 - CVE-2017-5129 - CVE-2017-5132 - CVE-2017-5130 - CVE-2017-5131 - CVE-2017-5133 - CVE-2017-15386 - CVE-2017-15387 - CVE-2017-15388 - CVE-2017-15389 - CVE-2017-15390 - CVE-2017-15391 - CVE-2017-15392 - CVE-2017-15393 - CVE-2017-15394 - CVE-2017-15395 - https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html - - - 2017-10-17 - 2017-10-21 - - - - - cacti -- Cross Site Scripting issue - - - cacti - 1.1.26 - - - - -

cacti developers report:

-
-

The file include/global_session.php in Cacti 1.1.25 has XSS related to (1) the URI or (2) the refresh page.

-
- - - - http://www.securitytracker.com/id/1039569 - https://github.com/Cacti/cacti/commit/93f661d8adcfa6618b11522cdab30e97bada33fd - https://github.com/Cacti/cacti/issues/1010 - CVE-2017-15194 - - - 2017-10-10 - 2017-10-19 - - - - - arj -- multiple vulnerabilities - - - arj - 3.10.22_5 - - - - -

Several vulnerabilities: symlink directory traversal, absolute path directory - traversal and buffer overflow were discovered in the arj archiver.

- - - - CVE-2015-0556 - CVE-2015-0557 - CVE-2015-2782 - - - 2015-04-08 - 2017-10-19 - - - - - krb5 -- Multiple vulnerabilities - - - krb5 - 1.14.6 - 1.151.15.2 - - - krb5-devel - 1.14.6 - 1.151.15.2 - - - krb5-115 - 1.15.2 - - - krb5-114 - 1.14.6 - - - krb5-113 - 1.14.6 - - - - -

MIT reports:

-
-

CVE-2017-11368:

-

In MIT krb5 1.7 and later, an authenticated attacker can cause an - assertion failure in krb5kdc by sending an invalid S4U2Self or - S4U2Proxy request.

-
-
-

CVE-2017-11462:

-

RFC 2744 permits a GSS-API implementation to delete an existing - security context on a second or subsequent call to gss_init_sec_context() - or gss_accept_sec_context() if the call results in an error. - This API behavior has been found to be dangerous, leading to the - possibility of memory errors in some callers. For safety, GSS-API - implementations should instead preserve existing security contexts - on error until the caller deletes them.

-

All versions of MIT krb5 prior to this change may delete acceptor - contexts on error. Versions 1.13.4 through 1.13.7, 1.14.1 through - 1.14.5, and 1.15 through 1.15.1 may also delete initiator contexts - on error.

-
- - - - https://nvd.nist.gov/vuln/detail/CVE-2017-11368 - https://krbdev.mit.edu/rt/Ticket/Display.html?id=8599 - https://github.com/krb5/krb5/commit/ffb35baac6981f9e8914f8f3bffd37f284b85970 - https://nvd.nist.gov/vuln/detail/CVE-2017-11462 - https://krbdev.mit.edu/rt/Ticket/Display.html?id=8598 - https://github.com/krb5/krb5/commit/56f7b1bc95a2a3eeb420e069e7655fb181ade5cf - CVE-2017-11368 - CVE-2017-11462 - - - 2017-07-14 - 2017-10-18 - - - - - MySQL -- multiple vulnerabilities - - - mariadb55-server - 5.5.58 - - - mariadb100-server - 10.0.33 - - - mariadb101-server - 10.1.29 - - - mariadb102-server - 10.2.10 - - - mysql55-server - 5.5.58 - - - mysql56-server - 5.6.38 - - - mysql57-server - 5.7.20 - - - percona55-server - 5.5.58 - - - percona56-server - 5.6.38 - - - percona57-server - 5.7.20 - - - - -

Oracle reports:

-
-

Please reference CVE/URL list for details

-
- - - - http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html#AppendixMSQL - CVE-2017-10155 - CVE-2017-10379 - CVE-2017-10384 - CVE-2017-10276 - CVE-2017-10167 - CVE-2017-10378 - CVE-2017-10277 - CVE-2017-10203 - CVE-2017-10283 - CVE-2017-10313 - CVE-2017-10296 - CVE-2017-10311 - CVE-2017-10320 - CVE-2017-10314 - CVE-2017-10227 - CVE-2017-10279 - CVE-2017-10294 - CVE-2017-10165 - CVE-2017-10284 - CVE-2017-10286 - CVE-2017-10268 - CVE-2017-10365 - - - 2017-10-18 - 2017-10-18 - 2017-12-23 - - - - - xorg-server -- Multiple Issues - - - xorg-server - 1.18.4_6,1 - 1.19.0,11.19.3,1 - - - - -

xorg-server developers reports:

-
-

In the X.Org X server before 2017-06-19, a user authenticated to - an X Session could crash or execute code in the context of the X - Server by exploiting a stack overflow in the endianness conversion - of X Events.

-

Uninitialized data in endianness conversion in the XEvent handling - of the X.Org X Server before 2017-06-19 allowed authenticated - malicious users to access potentially privileged data from the X - server.

-
- - - - http://www.securityfocus.com/bid/99546 - https://bugzilla.suse.com/show_bug.cgi?id=1035283 - https://cgit.freedesktop.org/xorg/xserver/commit/?id=215f894965df5fb0bb45b107d84524e700d2073c - https://cgit.freedesktop.org/xorg/xserver/commit/?id=8caed4df36b1f802b4992edcfd282cbeeec35d9d - https://cgit.freedesktop.org/xorg/xserver/commit/?id=ba336b24052122b136486961c82deac76bbde455 - http://www.securityfocus.com/bid/99543 - https://bugzilla.suse.com/show_bug.cgi?id=1035283 - https://cgit.freedesktop.org/xorg/xserver/commit/?id=05442de962d3dc624f79fc1a00eca3ffc5489ced - CVE-2017-10971 - CVE-2017-10972 - - - 2017-07-06 - 2017-10-17 - 2018-05-20 - - - - - Flash Player -- Remote code execution - - - linux-flashplayer - 27.0.0.170 - - - - -

Adobe reports:

-
-
    -
  • This update resolves a type confusion vulnerability that - could lead to remote code execution (CVE-2017-11292).
    • -
-
- - - - CVE-2017-11292 - https://helpx.adobe.com/security/products/flash-player/apsb17-32.html - - - 2017-10-16 - 2017-10-17 - - - - - WPA packet number reuse with replayed messages and key reinstallation - - - wpa_supplicant - 2.6_1 - - - hostapd - 2.6 - - - - -

wpa_supplicant developers report:

-
-

A vulnerability was found in how a number of implementations can be - triggered to reconfigure WPA/WPA2/RSN keys (TK, GTK, or IGTK) by - replaying a specific frame that is used to manage the keys.

-
- - - - http://w1.fi/security/2017-1/wpa-packet-number-reuse-with-replayed-messages.txt - https://www.kb.cert.org/vuls/id/228519 - CVE-2017-13077 - CVE-2017-13078 - CVE-2017-13079 - CVE-2017-13080 - CVE-2017-13081 - CVE-2017-13082 - CVE-2017-13084 - CVE-2017-13086 - CVE-2017-13087 - CVE-2017-13088 - - - 2017-10-16 - 2017-10-16 - - - - - mercurial -- multiple issues - - - mercurial - 4.3 - - - - -

mercurial developers reports:

-
-

Mercurial prior to version 4.3 is vulnerable to a missing symlink check that can malicious repositories to modify files outside the repository

-

Mercurial prior to 4.3 did not adequately sanitize hostnames passed to ssh, leading to possible shell-injection attacks.

-
- - - - http://www.securityfocus.com/bid/100290 - https://security.gentoo.org/glsa/201709-18 - https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.3_.2F_4.3.1_.282017-08-10.29 - http://www.securityfocus.com/bid/100290 - https://security.gentoo.org/glsa/201709-18 - https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.3_.2F_4.3.1_.282017-08-10.29 - CVE-2017-1000115 - CVE-2017-1000116 - - - 2017-10-05 - 2017-10-16 - - - - - Multiple exploitable heap-based buffer overflow vulnerabilities exists in FreeXL 1.0.3 - - - freexl - 1.0.4 - - - - -

Cisco TALOS reports:

-
-

An exploitable heap based buffer overflow vulnerability exists in the read_biff_next_record function of FreeXL 1.0.3. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability.

-
-
-

An exploitable heap-based buffer overflow vulnerability exists in the read_legacy_biff function of FreeXL 1.0.3. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability.

-
- - - - https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0430 - CVE-2017-2923 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0431 - CVE-2017-2924 - - - 2017-09-11 - 2017-10-13 - - - - - FFmpeg -- multiple vulnerabilities - - - ffmpeg - 3.3.4 - - - mythtv - mythtv-frontend - - 29.1,1 - - - - -

FFmpeg security reports:

-
-

Multiple vulnerabilities have been fixed in FFmpeg 3.3.4. Please refer to the CVE list for details.

-
- - - - https://www.ffmpeg.org/security.html - CVE-2017-14054 - CVE-2017-14055 - CVE-2017-14056 - CVE-2017-14057 - CVE-2017-14058 - CVE-2017-14059 - CVE-2017-14169 - CVE-2017-14170 - CVE-2017-14171 - CVE-2017-14222 - CVE-2017-14223 - CVE-2017-14225 - CVE-2017-14767 - - - 2017-09-11 - 2017-10-12 - 2018-03-25 - - - - - xorg-server -- multiple vulnabilities - - - xephyr - 1.18.4_5,1 - - - xorg-dmx - 1.18.4_5,1 - - - xorg-nestserver - 1.19.1_2,2 - - - xorg-server - 1.18.4_5,1 - - - xorg-vfbserver - 1.19.1_2,1 - - - xwayland - 1.19.1_2 - - - - -

Adam Jackson reports:

-
-

One regression fix since 1.19.4 (mea culpa), and fixes for - CVEs 2017-12176 through 2017-12187.

-
- - - - https://lists.x.org/archives/xorg-announce/2017-October/002814.html - CVE-2017-12176 - CVE-2017-12177 - CVE-2017-12178 - CVE-2017-12179 - CVE-2017-12180 - CVE-2017-12181 - CVE-2017-12182 - CVE-2017-12183 - CVE-2017-12184 - CVE-2017-12185 - CVE-2017-12186 - CVE-2017-12187 - - - 2017-10-12 - 2017-10-13 - - - - - solr -- Code execution via entity expansion - - - apache-solr - 5.16.6.1 - 7.0.07.1 - - - - -

Solr developers report:

-
-

Lucene XML parser does not explicitly prohibit doctype declaration and expansion of external entities which leads to arbitrary HTTP requests to the local SOLR instance and to bypass all firewall restrictions.

-

Solr "RunExecutableListener" class can be used to execute arbitrary commands on specific events, for example after each update query. The problem is that such listener can be enabled with any parameters just by using Config API with add-listener command.

-
- - - - http://lucene.472066.n3.nabble.com/Re-Several-critical-vulnerabilities-discovered-in-Apache-Solr-XXE-amp-RCE-td4358308.html - https://marc.info/?l=apache-announce&m=150786685013286 - CVE-2017-12629 - - - 2017-10-13 - 2017-10-13 - 2017-10-16 - - - - - jenkins -- multiple issues - - - jenkins - 2.83 - - - jenkins-lts - 2.73.1 - - - - -

jenkins developers report:

-
-

A total of 11 issues are reported, please see reference URL for details.

-
- - - - https://jenkins.io/security/advisory/2017-10-11/ - - - 2017-10-11 - 2017-10-13 - - - - - xen-kernel -- multiple vulnerabilities - - - xen-kernel - 4.7.2_6 - - - - -

The Xen project reports multiple vulnerabilities.

- - - - http://xenbits.xen.org/xsa/advisory-237.html - http://xenbits.xen.org/xsa/advisory-238.html - http://xenbits.xen.org/xsa/advisory-239.html - http://xenbits.xen.org/xsa/advisory-240.html - http://xenbits.xen.org/xsa/advisory-241.html - http://xenbits.xen.org/xsa/advisory-242.html - http://xenbits.xen.org/xsa/advisory-243.html - http://xenbits.xen.org/xsa/advisory-244.html - - - 2017-10-12 - 2017-10-12 - - - - - nss -- Use-after-free in TLS 1.2 generating handshake hashes - - - nss - 3.323.32.1 - 3.283.28.6 - - - linux-c6-nss - 3.283.28.4_2 - - - linux-c7-nss - 3.283.28.4_2 - - - - -

Mozilla reports:

-
-

During TLS 1.2 exchanges, handshake hashes are generated which - point to a message buffer. This saved data is used for later - messages but in some cases, the handshake transcript can - exceed the space available in the current buffer, causing the - allocation of a new buffer. This leaves a pointer pointing to - the old, freed buffer, resulting in a use-after-free when - handshake hashes are then calculated afterwards. This can - result in a potentially exploitable crash.

-
- - - - https://www.mozilla.org/en-US/security/advisories/mfsa2017-21/#CVE-2017-7805 - https://hg.mozilla.org/projects/nss/rev/2d7b65b72290 - https://hg.mozilla.org/projects/nss/rev/d3865e2957d0 - CVE-2017-7805 - - - 2017-08-04 - 2017-10-12 - 2018-01-29 - - - - - osip -- Improper Restriction of Operations within the Bounds of a Memory Buffer - - - libosip2 - 5.0.0 - - - - -

osip developers reports:

-
-

In libosip2 in GNU oSIP 4.1.0 and 5.0.0, a malformed SIP message can lead to a heap buffer overflow in the msg_osip_body_parse() function defined in osipparser2/osip_message_parse.c, resulting in a remote DoS.

-
- - - - http://www.securityfocus.com/bid/97644 - https://savannah.gnu.org/support/index.php?109265 - CVE-2017-7853 - - - 2017-04-13 - 2017-10-11 - - - - - ncurses -- multiple issues - - - ncurses - 6.0 - - - - -

ncurses developers reports:

-
-

There are multiple illegal address access issues and an infinite loop issue. Please refer to the CVE list for details.

-
- - - - https://bugzilla.redhat.com/show_bug.cgi?id=1484274 - https://bugzilla.redhat.com/show_bug.cgi?id=1484276 - https://bugzilla.redhat.com/show_bug.cgi?id=1484284 - https://bugzilla.redhat.com/show_bug.cgi?id=1484285 - https://bugzilla.redhat.com/show_bug.cgi?id=1484287 - https://bugzilla.redhat.com/show_bug.cgi?id=1484290 - https://bugzilla.redhat.com/show_bug.cgi?id=1484291 - CVE-2017-13728 - CVE-2017-13729 - CVE-2017-13730 - CVE-2017-13731 - CVE-2017-13732 - CVE-2017-13733 - CVE-2017-13734 - - - 2017-08-29 - 2017-10-11 - - - - - Python 2.7 -- multiple vulnerabilities - - - python27 - 2.7.14 - - - - -

Python reports:

-
-

Multiple vulnerabilities have been fixed in Python 2.7.14. Please refer to the CVE list for details.

-
- - - - https://raw.githubusercontent.com/python/cpython/84471935ed2f62b8c5758fd544c7d37076fe0fa5/Misc/NEWS - CVE-2012-0876 - CVE-2016-0718 - CVE-2016-4472 - CVE-2016-5300 - CVE-2016-9063 - CVE-2017-9233 - - - 2017-08-26 - 2017-10-11 - - - - - node -- access to unintended files - - - node - 8.5.08.6.0 - - - - -

node developers report:

-
-

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the pathname validation used by unspecified community modules.

-
- - - - http://www.securityfocus.com/bid/101056 - CVE-2017-14849 - - - 2017-09-27 - 2017-10-10 - - - - - zookeeper -- Denial Of Service - - - zookeeper - 3.4.10 - - - - -

zookeeper developers report:

-
-

Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads to the server unable to serve legitimate client requests. Apache ZooKeeper thru version 3.4.9 and 3.5.2 suffer from this issue, fixed in 3.4.10, 3.5.3, and later.

-
- - - - https://lists.apache.org/thread.html/58170aeb7a681d462b7fa31cae81110cbb749d2dc83c5736a0bb8370@%3Cdev.zookeeper.apache.org%3E - CVE-2017-5637 - - - 2017-10-09 - 2017-10-10 - - - - - libtiff -- Improper Input Validation - - - libtiff - 4.0.8 - - - - -

libtiff developers report:

-
-

There is a reachable assertion abort in the function TIFFWriteDirectoryTagSubifd() in LibTIFF 4.0.8, related to tif_dirwrite.c and a SubIFD tag. A crafted input will lead to a remote denial of service attack.

-

There is a reachable assertion abort in the function TIFFWriteDirectorySec() in LibTIFF 4.0.8, related to tif_dirwrite.c and a SubIFD tag. A crafted input will lead to a remote denial of service attack.

-
- - - - http://bugzilla.maptools.org/show_bug.cgi?id=2727 - http://bugzilla.maptools.org/show_bug.cgi?id=2728 - http://www.securityfocus.com/bid/100524 - CVE-2017-13726 - CVE-2017-13727 - - - 2017-08-29 - 2017-10-10 - - - - - rubygems -- deserialization vulnerability - - - ruby22-gems - ruby23-gems - ruby24-gems - 2.6.14 - - - - -

oss-security mailing list:

-
-

There is a possible unsafe object desrialization vulnerability in - RubyGems. It is possible for YAML deserialization of gem specifications - to bypass class white lists. Specially crafted serialized objects can - possibly be used to escalate to remote code execution.

-
- - - - http://www.openwall.com/lists/oss-security/2017/10/10/2 - http://blog.rubygems.org/2017/10/09/2.6.14-released.html - CVE-2017-0903 - - - 2017-10-09 - 2017-10-10 - - - - - xorg-server -- multiple vulnabilities - - - xephyr - 1.18.4_4,1 - - - xorg-dmx - 1.18.4_4,1 - - - xorg-nestserver - 1.19.1_1,2 - - - xorg-server - 1.18.4_4,1 - - - xorg-vfbserver - 1.19.1_1,1 - - - xwayland - 1.19.1_1 - - - - -

Alan Coopersmith reports:

-
-

X.Org thanks Michal Srb of SuSE for finding these issues - and bringing them to our attention, Julien Cristau of - Debian for getting the fixes integrated, and Adam Jackson - of Red Hat for publishing the release.

-
- - - - https://lists.x.org/archives/xorg-announce/2017-October/002809.html - CVE-2017-13721 - CVE-2017-13723 - - - 2017-10-04 - 2017-10-09 - - - - - tomcat -- Remote Code Execution - - - tomcat - 7.0.07.0.81 - 8.0.08.0.46 - 8.5.08.5.22 - 9.0.09.0.1 - - - - -

tomcat developers reports:

-
-

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

-
- - - - http://www.securityfocus.com/bid/100954 - https://lists.apache.org/thread.html/3fd341a604c4e9eab39e7eaabbbac39c30101a022acc11dd09d7ebcb@%3Cannounce.tomcat.apache.org%3E - CVE-2017-12617 - - - 2017-10-04 - 2017-10-06 - - - - - cURL -- out of bounds read - - - curl - 7.56.0 - - - - -

The cURL project reports:

-
-

FTP PWD response parser out of bounds read

-

libcurl may read outside of a heap allocated buffer when doing FTP.

-

When libcurl connects to an FTP server and successfully logs in - (anonymous or not), it asks the server for the current directory with - the PWD command. The server then responds with a 257 response containing - the path, inside double quotes. The returned path name is then kept by - libcurl for subsequent uses.

-

Due to a flaw in the string parser for this directory name, a directory - name passed like this but without a closing double quote would lead to - libcurl not adding a trailing NUL byte to the buffer holding the name. - When libcurl would then later access the string, it could read beyond - the allocated heap buffer and crash or wrongly access data beyond the - buffer, thinking it was part of the path.

-

A malicious server could abuse this fact and effectively prevent - libcurl-based clients to work with it - the PWD command is always issued - on new FTP connections and the mistake has a high chance of causing a - segfault.

-
- - - - https://curl.haxx.se/docs/adv_20171004.html - CVE-2017-1000254 - - - 2017-10-04 - 2017-10-04 - - - - - FreeBSD -- OpenSSH Denial of Service vulnerability - - - FreeBSD - 11.111.1_1 - 11.011.0_12 - 10.310.3_21 - - - - -

Problem Description:

-

There is no limit on the password length.

-

Impact:

-

A remote attacker may be able to cause an affected SSH - server to use excessive amount of CPU by sending very long - passwords, when PasswordAuthentication is enabled by the - system administrator.

- - - - CVE-2016-6515 - SA-17:06.openssh - - - 2017-08-10 - 2017-10-03 - - - - - FreeBSD -- heimdal KDC-REP service name validation vulnerability - - - FreeBSD - 11.011.0_11 - 10.310.3_20 - - - - -

Problem Description:

-

There is a programming error in the Heimdal implementation - that used an unauthenticated, plain-text version of the - KDC-REP service name found in a ticket.

-

Impact:

-

An attacker who has control of the network between a - client and the service it talks to will be able to impersonate - the service, allowing a successful man-in-the-middle (MITM) - attack that circumvents the mutual authentication.

- - - - CVE-2017-1110 - SA-17:05.heimdal - - - 2017-07-12 - 2017-10-03 - - - - - dnsmasq -- multiple vulnerabilities - - - dnsmasq - 2.78,1 - - - dnsmasq-devel - 2.78 - - - - -

Google Project Zero reports:

-
-
    -
  • CVE-2017-14491: Heap based overflow (2 bytes). Before 2.76 and this - commit overflow was unrestricted.
    • -
  • CVE-2017-14492: Heap based overflow.
    • -
  • CVE-2017-14493: Stack Based overflow.
    • -
  • CVE-2017-14494: Information Leak
    • -
  • CVE-2017-14495: Lack of free()
    • -
  • CVE-2017-14496: Invalid boundary checks. Integer underflow leading - to a huge memcpy.
    • -
  • CVE-2017-13704: Crash on large DNS query
    • -
-
- - - - https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html - CVE-2017-14491 - CVE-2017-14492 - CVE-2017-14493 - CVE-2017-14494 - CVE-2017-14495 - CVE-2017-14496 - CVE-2017-13704 - - - 2017-10-02 - 2017-10-02 - - - - - phpmyfaq -- multiple issues - - - phpmyfaq - 2.9.8 - - - - -

phpmyfaq developers report:

-
-

Cross-site scripting (XSS) vulnerability in inc/PMF/Faq.php in phpMyFAQ through 2.9.8 allows remote attackers to inject arbitrary web script or HTML via the Questions field in an "Add New FAQ" action.

-

Cross-site scripting (XSS) vulnerability in phpMyFAQ through 2.9.8 allows remote attackers to inject arbitrary web script or HTML via the "Title of your FAQ" field in the Configuration Module.

-
- - - - https://www.exploit-db.com/exploits/42761/ - https://github.com/thorsten/phpMyFAQ/commit/30b0025e19bd95ba28f4eff4d259671e7bb6bb86 - CVE-2017-14618 - CVE-2017-14619 - - - 2017-09-20 - 2017-09-29 - - - - - wordpress -- multiple issues - - - wordpress - 4.8.2 - - - - -

wordpress developers report:

-
-

Before version 4.8.2, WordPress was susceptible to a Cross-Site Scripting attack in the link modal via a javascript: or data: URL.

-

Before version 4.8.2, WordPress allowed a Cross-Site scripting attack in the template list view via a crafted template name.

-

Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive and PclZip components.

-

Before version 4.8.2, WordPress allowed Cross-Site scripting in the plugin editor via a crafted plugin name.

-

Before version 4.8.2, WordPress allowed a Directory Traversal attack in the Customizer component via a crafted theme filename.

-

Before version 4.8.2, WordPress was vulnerable to cross-site scripting in oEmbed discovery.

-

Before version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in the TinyMCE visual editor.

-
- - - - http://www.securityfocus.com/bid/100912 - https://wordpress.org/news/2017/09/wordpress-4-8-2-security-and-maintenance-release/ - https://core.trac.wordpress.org/changeset/41393 - https://core.trac.wordpress.org/changeset/41395 - https://core.trac.wordpress.org/changeset/41397 - https://core.trac.wordpress.org/changeset/41412 - https://core.trac.wordpress.org/changeset/41448 - https://core.trac.wordpress.org/changeset/41457 - https://wpvulndb.com/vulnerabilities/8911 - https://wpvulndb.com/vulnerabilities/8912 - https://wpvulndb.com/vulnerabilities/8913 - https://wpvulndb.com/vulnerabilities/8914 - CVE-2017-14718 - CVE-2017-14719 - CVE-2017-14720 - CVE-2017-14721 - CVE-2017-14722 - CVE-2017-14724 - CVE-2017-14726 - - - 2017-09-23 - 2017-09-29 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 56.0,1 - - - seamonkey - linux-seamonkey - 2.49.1 - - - firefox-esr - 52.4.0,1 - - - linux-firefox - 52.4.0,2 - - - libxul - thunderbird - linux-thunderbird - 52.4.0 - - - - -

Mozilla Foundation reports:

-
-

CVE-2017-7793: Use-after-free with Fetch API

-

CVE-2017-7817: Firefox for Android address bar spoofing through fullscreen mode

-

CVE-2017-7818: Use-after-free during ARIA array manipulation

-

CVE-2017-7819: Use-after-free while resizing images in design mode

-

CVE-2017-7824: Buffer overflow when drawing and validating elements with ANGLE

-

CVE-2017-7805: Use-after-free in TLS 1.2 generating handshake hashes

-

CVE-2017-7812: Drag and drop of malicious page content to the tab bar can open locally stored files

-

CVE-2017-7814: Blob and data URLs bypass phishing and malware protection warnings

-

CVE-2017-7813: Integer truncation in the JavaScript parser

-

CVE-2017-7825: OS X fonts render some Tibetan and Arabic unicode characters as spaces

-

CVE-2017-7815: Spoofing attack with modal dialogs on non-e10s installations

-

CVE-2017-7816: WebExtensions can load about: URLs in extension UI

-

CVE-2017-7821: WebExtensions can download and open non-executable files without user interaction

-

CVE-2017-7823: CSP sandbox directive did not create a unique origin

-

CVE-2017-7822: WebCrypto allows AES-GCM with 0-length IV

-

CVE-2017-7820: Xray wrapper bypass with new tab and web console

-

CVE-2017-7811: Memory safety bugs fixed in Firefox 56

-

CVE-2017-7810: Memory safety bugs fixed in Firefox 56 and Firefox ESR 52.4

-
- - - - CVE-2017-7793 - CVE-2017-7805 - CVE-2017-7810 - CVE-2017-7811 - CVE-2017-7812 - CVE-2017-7813 - CVE-2017-7814 - CVE-2017-7815 - CVE-2017-7816 - CVE-2017-7817 - CVE-2017-7818 - CVE-2017-7819 - CVE-2017-7820 - CVE-2017-7821 - CVE-2017-7822 - CVE-2017-7823 - CVE-2017-7824 - CVE-2017-7825 - https://www.mozilla.org/en-US/security/advisories/mfsa2017-21/ - https://www.mozilla.org/en-US/security/advisories/mfsa2017-22/ - - - 2017-09-28 - 2017-09-29 - 2017-10-03 - - - - - sam2p -- multiple issues - - - sam2p - 0.49.3,1 - - - - -

sam2p developers report:

-
-

In sam2p 0.49.3, a heap-based buffer overflow exists in the pcxLoadImage24 function of the file in_pcx.cpp.

-

In sam2p 0.49.3, the in_xpm_reader function in in_xpm.cpp has an integer signedness error, leading to a crash when writing to an out-of-bounds array element.

-

In sam2p 0.49.3, an integer overflow exists in the pcxLoadImage24 function of the file in_pcx.cpp, leading to an invalid write operation.

-

In sam2p 0.49.3, the pcxLoadRaster function in in_pcx.cpp has an integer signedness error leading to a heap-based buffer overflow.

-

Because of an integer overflow in sam2p 0.49.3, a loop executes 0xffffffff times, ending with an invalid read of size 1 in the Image::Indexed::sortPal function in image.cpp. However, this also causes memory corruption because of an attempted write to the invalid d[0xfffffffe] array element.

-

In sam2p 0.49.3, there is an invalid read of size 2 in the parse_rgb function in in_xpm.cpp. However, this can also cause a write to an illegal address.

-
- - - - https://github.com/pts/sam2p/issues/14 - CVE-2017-14628 - CVE-2017-14629 - CVE-2017-14630 - CVE-2017-14631 - CVE-2017-14636 - CVE-2017-14637 - - - 2017-09-21 - 2017-09-28 - - - - - libraw -- Out-of-bounds Read - - - libraw - 0.18.4 - - - - -

libraw developers report:

-
-

In LibRaw through 0.18.4, an out of bounds read flaw related to kodak_65000_load_raw has been reported in dcraw/dcraw.c and internal/dcraw_common.cpp. An attacker could possibly exploit this flaw to disclose potentially sensitive memory or cause an application crash.

-
- - - - https://github.com/LibRaw/LibRaw/commit/d13e8f6d1e987b7491182040a188c16a395f1d21 - https://github.com/LibRaw/LibRaw/issues/101 - CVE-2017-14608 - - - 2017-09-20 - 2017-09-28 - - - - - OpenVPN -- out-of-bounds write in legacy key-method 1 - - - openvpn-polarssl - 2.3.18 - - - openvpn-mbedtls - 2.4.02.4.4 - - - openvpn - 2.4.02.4.4 - 2.3.18 - - - - -

Steffan Karger reports:

-
-

The bounds check in read_key() was performed after using the value, - instead of before. If 'key-method 1' is used, this allowed an - attacker to send a malformed packet to trigger a stack buffer - overflow. [...]

-

Note that 'key-method 1' has been replaced by 'key method 2' as the - default in OpenVPN 2.0 (released on 2005-04-17), and explicitly - deprecated in 2.4 and marked for removal in 2.5. This should limit - the amount of users impacted by this issue.

-
- - - - https://community.openvpn.net/openvpn/wiki/CVE-2017-12166 - https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg15492.html - CVE-2017-12166 - - - 2017-09-21 - 2017-09-27 - - - - - ImageMagick -- denial of service via a crafted font file - - - ImageMagick7 - 7.0.7.4 - - - ImageMagick7-nox11 - 7.0.7.4 - - - ImageMagick - 6.9.8.9_1 - - - ImageMagick-nox11 - 6.9.8.9_1 - - - - -

MITRE reports:

-
-

The ReadCAPTIONImage function in coders/caption.c in ImageMagick allows remote attackers to cause a denial of service (infinite loop) via a crafted font file.

-
- - - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14741 - https://github.com/ImageMagick/ImageMagick/issues/771 - https://github.com/ImageMagick/ImageMagick/commit/7d8e14899c562157c7760a77fc91625a27cb596f - https://github.com/ImageMagick/ImageMagick/commit/bb11d07139efe0f5e4ce0e4afda32abdbe82fa9d - CVE-2017-14741 - - - 2017-09-21 - 2017-09-26 - - - - - libofx -- exploitable buffer overflow - - - libofx - 0.9.11_1 - - - - -

Talos developers report:

-
-

An exploitable buffer overflow vulnerability exists in the tag parsing functionality of LibOFX 0.9.11. A specially crafted OFX file can cause a write out of bounds resulting in a buffer overflow on the stack. An attacker can construct a malicious OFX file to trigger this vulnerability.

-
- - - - http://www.securityfocus.com/bid/100828 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0317 - CVE-2017-2816 - - - 2017-09-13 - 2017-09-27 - - - - - sugarcrm -- multiple vulnerabilities - - - sugarcrm - 6.5.26 - - - - -

sugarcrm developers report:

-
-

An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). Several areas have been identified in the Documents and Emails module that could allow an authenticated user to perform SQL injection, as demonstrated by a backslash character at the end of a bean_id to modules/Emails/DetailView.php. An attacker could exploit these vulnerabilities by sending a crafted SQL request to the affected areas. An exploit could allow the attacker to modify the SQL database. Proper SQL escaping has been added to prevent such exploits.

-

An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). A remote file inclusion has been identified in the Connectors module allowing authenticated users to include remotely accessible system files via a query string. Proper input validation has been added to mitigate this issue.

-

An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). The WebToLeadCapture functionality is found vulnerable to unauthenticated cross-site scripting (XSS) attacks. This attack vector is mitigated by proper validating the redirect URL values being passed along.

-
- - - - https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/ - https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2017-006/ - https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/ - https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2017-007/ - https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/ - https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2017-008/ - CVE-2017-14508 - CVE-2017-14509 - CVE-2017-14510 - - - 2017-09-17 - 2017-09-26 - - - - - libzip -- denial of service - - - libzip - 1.1.13_1 - - - - -

libzip developers report:

-
-

The _zip_read_eocd64 function in zip_open.c in libzip before 1.3.0 mishandles EOCD records, which allows remote attackers to cause a denial of service (memory allocation failure in _zip_cdir_grow in zip_dirent.c) via a crafted ZIP archive.

-
- - - - https://blogs.gentoo.org/ago/2017/09/01/libzip-memory-allocation-failure-in-_zip_cdir_grow-zip_dirent-c/ - https://github.com/nih-at/libzip/commit/9b46957ec98d85a572e9ef98301247f39338a3b5 - CVE-2017-14107 - - - 2017-09-01 - 2017-09-27 - - - - - libbson -- Denial of Service - - - libbson - 1.8.0 - - - - -

mongodb developers report:

-
-

In MongoDB libbson 1.7.0, the bson_iter_codewscope function in bson-iter.c miscalculates a bson_utf8_validate length argument, which allows remote attackers to cause a denial of service (heap-based buffer over-read in the bson_utf8_validate function in bson-utf8.c), as demonstrated by bson-to-json.c.

-
- - - - http://www.securityfocus.com/bid/100825 - https://bugzilla.redhat.com/show_bug.cgi?id=1489355 - https://bugzilla.redhat.com/show_bug.cgi?id=1489356 - https://bugzilla.redhat.com/show_bug.cgi?id=1489362 - CVE-2017-14227 - - - 2017-09-09 - 2017-09-26 - - - - - tcpdump -- multiple vulnerabilities - - - tcpdump - 4.9.2 - - - - -

tcpdump developers report:

-
-

Too many issues to detail, see CVE references for details.

-
- - - - CVE-2017-11541 - CVE-2017-11542 - CVE-2017-11543 - CVE-2017-12893 - CVE-2017-12894 - CVE-2017-12895 - CVE-2017-12896 - CVE-2017-12897 - CVE-2017-12898 - CVE-2017-12899 - CVE-2017-12900 - CVE-2017-12901 - CVE-2017-12902 - CVE-2017-12985 - CVE-2017-12986 - CVE-2017-12987 - CVE-2017-12988 - CVE-2017-12989 - CVE-2017-12990 - CVE-2017-12991 - CVE-2017-12992 - CVE-2017-12993 - CVE-2017-12994 - CVE-2017-12995 - CVE-2017-12996 - CVE-2017-12997 - CVE-2017-12998 - CVE-2017-12999 - CVE-2017-13000 - CVE-2017-13001 - CVE-2017-13002 - CVE-2017-13003 - CVE-2017-13004 - CVE-2017-13005 - CVE-2017-13006 - CVE-2017-13007 - CVE-2017-13008 - CVE-2017-13009 - CVE-2017-13010 - CVE-2017-13011 - CVE-2017-13012 - CVE-2017-13013 - CVE-2017-13014 - CVE-2017-13015 - CVE-2017-13016 - CVE-2017-13017 - CVE-2017-13018 - CVE-2017-13019 - CVE-2017-13020 - CVE-2017-13021 - CVE-2017-13022 - CVE-2017-13023 - CVE-2017-13024 - CVE-2017-13025 - CVE-2017-13026 - CVE-2017-13027 - CVE-2017-13028 - CVE-2017-13029 - CVE-2017-13030 - CVE-2017-13031 - CVE-2017-13032 - CVE-2017-13033 - CVE-2017-13034 - CVE-2017-13035 - CVE-2017-13036 - CVE-2017-13037 - CVE-2017-13038 - CVE-2017-13039 - CVE-2017-13040 - CVE-2017-13041 - CVE-2017-13042 - CVE-2017-13043 - CVE-2017-13044 - CVE-2017-13045 - CVE-2017-13046 - CVE-2017-13047 - CVE-2017-13048 - CVE-2017-13049 - CVE-2017-13050 - CVE-2017-13051 - CVE-2017-13052 - CVE-2017-13053 - CVE-2017-13054 - CVE-2017-13055 - CVE-2017-13687 - CVE-2017-13688 - CVE-2017-13689 - CVE-2017-13690 - CVE-2017-13725 - - - 2017-07-22 - 2017-09-26 - - - - - libraw -- buffer overflow - - - libraw - 0.18.4 - - - - -

libraw developers report:

-
-

LibRaw before 0.18.4 has a heap-based Buffer Overflow in the processCanonCameraInfo function via a crafted file.

-
- - - - http://www.securityfocus.com/bid/100866 - https://github.com/LibRaw/LibRaw/issues/100 - CVE-2017-14348 - - - 2017-09-12 - 2017-09-26 - - - - - libraw -- denial of service and remote code execution - - - libraw - 0.18.3 - - - - -

libraw developers report:

-
-

A Stack-based Buffer Overflow was discovered in xtrans_interpolate in internal/dcraw_common.cpp in LibRaw before 0.18.3. It could allow a remote denial of service or code execution attack.

-
- - - - https://github.com/LibRaw/LibRaw/issues/99 - CVE-2017-14265 - - - 2017-09-11 - 2017-09-26 - - - - - libgd -- Denial of servica via double free - - - libgd - 2.2.5 - - - - -

libgd developers report:

-
-

Double free vulnerability in the gdImagePngPtr function in libgd2 before 2.2.5 allows remote attackers to cause a denial of service via vectors related to a palette with no colors.

-
- - - - http://www.debian.org/security/2017/dsa-3961 - https://github.com/libgd/libgd/issues/381 - https://github.com/libgd/libgd/releases/tag/gd-2.2.5 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N2BLXX7KNRE7ZVQAKGTHHWS33CUCXVUP/ - CVE-2017-6362 - - - 2017-09-07 - 2017-09-26 - - - - - php-gd and gd -- Buffer over-read into uninitialized memory - - - libgd - 2.2.5 - - - php70-gd - 7.0.21 - - - php71-gd - 7.1.7 - - - - -

PHP developers report:

-
-

The GIF decoding function gdImageCreateFromGifCtx in gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.31 and 7.x before 7.1.7, does not zero colorMap arrays before use. A specially crafted GIF image could use the uninitialized tables to read ~700 bytes from the top of the stack, potentially disclosing sensitive information.

-
- - - - https://bugs.php.net/bug.php?id=74435 - CVE-2017-7890 - - - 2017-08-02 - 2017-09-26 - - - - - ledger -- multiple vulnerabilities - - - ledger - 3.1.1 - - - - -

Talos reports:

-
-

An exploitable buffer overflow vulnerability exists in the tag parsing functionality of Ledger-CLI 3.1.1. A specially crafted journal file can cause an integer underflow resulting in code execution. An attacker can construct a malicious journal file to trigger this vulnerability.

-

An exploitable use-after-free vulnerability exists in the account parsing component of the Ledger-CLI 3.1.1. A specially crafted ledger file can cause a use-after-free vulnerability resulting in arbitrary code execution. An attacker can convince a user to load a journal file to trigger this vulnerability.

-
- - - - http://www.securityfocus.com/bid/100543 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0303 - http://www.securityfocus.com/bid/100546 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0304 - CVE-2017-2808 - CVE-2017-2807 - - - 2017-09-05 - 2017-09-26 - - - - - aacplusenc -- denial of service - - - aacplusenc - 0.17.5_2 - - - - -

Gentoo developers report:

-
-

DeleteBitBuffer in libbitbuf/bitbuffer.c in mp4tools aacplusenc 0.17.5 allows remote attackers to cause a denial of service (invalid memory write, SEGV on unknown address 0x000000000030, and application crash) or possibly have unspecified other impact via a crafted .wav file, aka a NULL pointer dereference.

-
- - - - https://blogs.gentoo.org/ago/2017/09/07/aacplusenc-null-pointer-dereference-in-deletebitbuffer-bitbuffer-c/ - https://github.com/teknoraver/aacplusenc/issues/1 - CVE-2017-14181 - - - 2017-09-07 - 2017-09-25 - - - - - ansible -- information disclosure flaw - - - ansible - 2.2.3 - - - - -

ansible developers report:

-
-

Ansible versions 2.2.3 and earlier are vulnerable to an information disclosure flaw due to the interaction of call back plugins and the no_log directive where the information may not be sanitized properly.

-
- - - - https://github.com/ansible/ansible/issues/22505 - CVE-2017-7473 - - - 2017-07-21 - 2017-09-25 - - - - - weechat -- crash in logger plugin - - - weechat - 1.9.1 - - - - -

WeeChat reports:

-
-

security problem: a crash can happen in logger plugin when - converting date/time specifiers in file mask.

-
- - - - https://weechat.org/news/98/20170923-Version-1.9.1-security-release/ - CVE-2017-14727 - - - 2017-09-23 - 2017-09-25 - - - - - perl -- multiple vulnerabilities - - - perl5 - 5.24.05.24.3 - 5.26.05.26.1 - - - - -

SO-AND-SO reports:

-
-

CVE-2017-12814: $ENV{$key} stack buffer overflow on Windows

-

A possible stack buffer overflow in the %ENV code on Windows has been - fixed by removing the buffer completely since it was superfluous anyway.

-

CVE-2017-12837: Heap buffer overflow in regular expression compiler

-

Compiling certain regular expression patterns with the case-insensitive - modifier could cause a heap buffer overflow and crash perl. This has now - been fixed.

-

CVE-2017-12883: Buffer over-read in regular expression parser

-

For certain types of syntax error in a regular expression pattern, the - error message could either contain the contents of a random, possibly - large, chunk of memory, or could crash perl. This has now been fixed.

-
- - - - https://metacpan.org/changes/release/SHAY/perl-5.24.3 - https://metacpan.org/changes/release/SHAY/perl-5.26.1 - CVE-2017-12814 - CVE-2017-12837 - CVE-2017-12883 - - - 2017-09-19 - 2017-09-24 - - - - - chromium -- multiple vulnerabilities - - - chromium - 61.0.3163.100 - - - - -

Google Chrome releases reports:

-
-

3 security fixes in this release, including:

-
    -
  • [765433] High CVE-2017-5121: Out-of-bounds access in V8. Reported by - Jordan Rabet, Microsoft Offensive Security Research and Microsoft - ChakraCore team on 2017-09-14
    • -
  • [752423] High CVE-2017-5122: Out-of-bounds access in V8. Reported by - Choongwoo Han of Naver Corporation on 2017-08-04
    • -
  • [767508] Various fixes from internal audits, fuzzing and other initiatives
    • -
-
- - - - CVE-2017-5121 - CVE-2017-5122 - https://chromereleases.googleblog.com/2017/09/stable-channel-update-for-desktop_21.html - - - 2017-09-21 - 2017-09-22 - - - - - asterisk -- RTP/RTCP information leak - - - asterisk11 - 11.25.3 - - - asterisk13 - 13.17.2 - - - - -

The Asterisk project reports:

-
-

This is a follow up advisory to AST-2017-005.

-

Insufficient RTCP packet validation could allow reading - stale buffer contents and when combined with the "nat" - and "symmetric_rtp" options allow redirecting where - Asterisk sends the next RTCP report.

-

The RTP stream qualification to learn the source address - of media always accepted the first RTP packet as the new - source and allowed what AST-2017-005 was mitigating. The - intent was to qualify a series of packets before accepting - the new source address.

-

The RTP/RTCP stack will now validate RTCP packets before processing them.

-
- - - - https://downloads.asterisk.org/pub/security/AST-2017-008.html - CVE-2017-14099 - - - 2017-09-01 - 2017-09-19 - - - - - ruby -- multiple vulnerabilities - - - ruby - 2.2.02.2.8 - 2.3.02.3.5 - 2.4.02.4.2 - - - - -

Ruby blog:

-
-

CVE-2017-0898: Buffer underrun vulnerability in Kernel.sprintf

-

If a malicious format string which contains a precious specifier (*) - is passed and a huge minus value is also passed to the specifier, - buffer underrun may be caused. In such situation, the result may - contains heap, or the Ruby interpreter may crash.

-

CVE-2017-10784: Escape sequence injection vulnerability in the Basic - authentication of WEBrick

-

When using the Basic authentication of WEBrick, clients can pass an - arbitrary string as the user name. WEBrick outputs the passed user name - intact to its log, then an attacker can inject malicious escape - sequences to the log and dangerous control characters may be executed - on a victim’s terminal emulator.

-

This vulnerability is similar to a vulnerability already fixed, but - it had not been fixed in the Basic authentication.

-

CVE-2017-14033: Buffer underrun vulnerability in OpenSSL ASN1 decode

-

If a malicious string is passed to the decode method of OpenSSL::ASN1, - buffer underrun may be caused and the Ruby interpreter may crash.

-

CVE-2017-14064: Heap exposure vulnerability in generating JSON

-

The generate method of JSON module optionally accepts an instance of - JSON::Ext::Generator::State class. If a malicious instance is passed, - the result may include contents of heap.

-
- - - - https://www.ruby-lang.org/en/security/ - https://www.ruby-lang.org/en/news/2017/09/14/sprintf-buffer-underrun-cve-2017-0898/ - https://www.ruby-lang.org/en/news/2017/09/14/webrick-basic-auth-escape-sequence-injection-cve-2017-10784/ - https://www.ruby-lang.org/en/news/2017/09/14/openssl-asn1-buffer-underrun-cve-2017-14033/ - https://www.ruby-lang.org/en/news/2017/09/14/json-heap-exposure-cve-2017-14064/ - CVE-2017-0898 - CVE-2017-10784 - CVE-2017-14033 - CVE-2017-14064 - - - 2017-09-14 - 2017-09-19 - - - - - rubygem-geminabox -- XSS & CSRF vulnerabilities - - - rubygem-geminabox - 0.13.8 - - - - -

Gem in a box XSS vulenrability - CVE-2017-14506:

-
-

Malicious attacker create GEM file with crafted homepage value - (gem.homepage in .gemspec file) includes XSS payload.

-

The attacker access geminabox system and uploads the gem file - (or uses CSRF/SSRF attack to do so).

-

From now on, any user access Geminabox web server, executes the - malicious XSS payload, that will delete any gems on the server, - and won't let users use the geminabox anymore. (make victim's - browser crash or redirect them to other hosts).

-
- - - - https://baraktawily.blogspot.com/2017/09/gem-in-box-xss-vulenrability-cve-2017.html - CVE-2017-14506 - CVE-2017-14683 - - - 2017-09-18 - 2017-09-19 - 2017-09-27 - - - - - Apache -- HTTP OPTIONS method can leak server memory - - - apache24 - 2.4.27_1 - - - apache22 - 2.2.34_1 - - - - -

The Fuzzing Project reports:

-
-

Apache httpd allows remote attackers to read secret data from - process memory if the Limit directive can be set in a user's - .htaccess file, or if httpd.conf has certain misconfigurations, - aka Optionsbleed. This affects the Apache HTTP Server through - 2.2.34 and 2.4.x through 2.4.27. The attacker sends an - unauthenticated OPTIONS HTTP request when attempting to read - secret data. This is a use-after-free issue and thus secret data - is not always sent, and the specific data depends on many factors - including configuration. Exploitation with .htaccess can be - blocked with a patch to the ap_limit_section function in - server/core.c.

-
- - - - https://nvd.nist.gov/vuln/detail/CVE-2017-9798 - CVE-2017-9798 - - - 2017-09-18 - 2017-09-19 - - - - - GitLab -- multiple vulnerabilities - - - gitlab - 1.0.09.3.10 - 9.4.09.4.5 - 9.5.09.5.3 - - - - -

GitLab reports:

-
-

Please reference CVE/URL list for details

-
- - - - https://about.gitlab.com/2017/09/07/gitlab-9-dot-5-dot-4-security-release/ - CVE-2017-5029 - CVE-2016-4738 - - - 2017-09-07 - 2017-09-14 - - - - - Flash Player -- multiple vulnerabilities - - - linux-flashplayer - 27.0.0.130 - - - - -

Adobe reports:

-
-
    -
  • These updates resolve memory corruption vulnerabilities that - could lead to remote code execution (CVE-2017-11281, - CVE-2017-11282).
    • -
-
- - - - CVE-2017-11281 - CVE-2017-11282 - https://helpx.adobe.com/security/products/flash-player/apsb17-28.html - - - 2017-09-12 - 2017-09-12 - - - - - emacs -- enriched text remote code execution vulnerability - - - emacs25 - emacs-nox11 - 25.3,3 - - - emacs-devel - 26.0.50.20170912,2 - - - - -

Paul Eggert reports:

-
-

Charles A. Roelli has found a security flaw in the enriched mode in GNU Emacs.

-

When Emacs renders MIME text/enriched data (Internet RFC 1896), it - is vulnerable to arbitrary code execution. Since Emacs-based mail - clients decode "Content-Type: text/enriched", this code is exploitable - remotely. This bug affects GNU Emacs versions 19.29 through 25.2.

-
- - - - http://seclists.org/oss-sec/2017/q3/422 - https://bugs.gnu.org/28350 - - - 2017-09-04 - 2017-09-12 - 2017-09-13 - - - - - cyrus-imapd -- broken "other users" behaviour - - - cyrus-imapd30 - 3.0.03.0.4 - - - - -

Cyrus IMAP 3.0.4 Release Notes states:

-
-

Fixed Issue #2132: Broken "Other Users" behaviour

-
- - - - CVE-2017-14230 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14230 - - - 2017-09-07 - 2017-09-10 - - - - - Django -- possible XSS in traceback section of technical 500 debug page - - - py27-django110 - py34-django110 - py35-django110 - py36-django110 - 1.10.8 - - - py27-django111 - py34-django111 - py35-django111 - py36-django111 - 1.11.5 - - - - -

Django blog:

-
-

In older versions, HTML autoescaping was disabled in a portion of the template - for the technical 500 debug page. Given the right circumstances, this allowed a - cross-site scripting attack. This vulnerability shouldn't affect most production - sites since you shouldn't run with DEBUG = True (which makes this page accessible) - in your production settings.

-
- - - - CVE-2017-12794 - https://www.djangoproject.com/weblog/2017/sep/05/security-releases/ - - - 2017-09-05 - 2017-09-06 - - - - - chromium -- multiple vulnerabilities - - - chromium - 61.0.3163.79 - - - - -

Google Chrome releases reports:

-
-

22 security fixes in this release, including:

-
    -
  • [737023] High CVE-2017-5111: Use after free in PDFium. Reported by - Luat Nguyen on KeenLab, Tencent on 2017-06-27
    • -
  • [740603] High CVE-2017-5112: Heap buffer overflow in WebGL. Reported by - Tobias Klein on 2017-07-10
    • -
  • [747043] High CVE-2017-5113: Heap buffer overflow in Skia. Reported by - Anonymous on 2017-07-20
    • -
  • [752829] High CVE-2017-5114: Memory lifecycle issue in PDFium. Reported by - Ke Liu of Tencent's Xuanwu LAB on 2017-08-07
    • -
  • [744584] High CVE-2017-5115: Type confusion in V8. Reported by - Marco Giovannini on 2017-07-17
    • -
  • [759624] High CVE-2017-5116: Type confusion in V8. Reported by - Anonymous on 2017-08-28
    • -
  • [739190] Medium CVE-2017-5117: Use of uninitialized value in Skia. Reported by - Tobias Klein on 2017-07-04
    • -
  • [747847] Medium CVE-2017-5118: Bypass of Content Security Policy in Blink. Reported by - WenXu Wu of Tencent's Xuanwu Lab on 2017-07-24
    • -
  • [725127] Medium CVE-2017-5119: Use of uninitialized value in Skia. Reported by - Anonymous on 2017-05-22
    • -
  • [718676] Low CVE-2017-5120: Potential HTTPS downgrade during redirect navigation. Reported by - Xiaoyin Liu on 2017-05-05
    • -
  • [762099] Various fixes from internal audits, fuzzing and other initiatives
    • -
-
- - - - CVE-2017-5111 - CVE-2017-5112 - CVE-2017-5113 - CVE-2017-5114 - CVE-2017-5115 - CVE-2017-5116 - CVE-2017-5117 - CVE-2017-5118 - CVE-2017-5119 - CVE-2017-5120 - https://chromereleases.googleblog.com/2017/09/stable-channel-update-for-desktop.html - - - 2017-09-05 - 2017-09-06 - - - - - - - - - gdk-pixbuf -- multiple vulnerabilities - - - gtk-pixbuf2 - 2.36.7 - - - - -

TALOS reports:

-
-
    -

  • An exploitable integer overflow vulnerability exists in - the tiff_image_parse functionality.

    • -

  • An exploitable heap-overflow vulnerability exists in - the gdk_pixbuf__jpeg_image_load_increment functionality.

    • -
-
- - - - http://blog.talosintelligence.com/2017/08/vuln-spotlight-multiple-gdk.html - CVE-2017-2862 - CVE-2017-2870 - - - 2017-08-30 - 2017-09-01 - - - - - asterisk -- Remote Crash Vulerability in res_pjsip - - - asterisk13 - 13.17.1 - - - - -

The Asterisk project reports:

-
-

A carefully crafted URI in a From, To or Contact header could cause Asterisk to crash.

-
- - - - https://downloads.asterisk.org/pub/security/AST-2017-007.html - CVE-2017-14098 - - - 2017-08-31 - 2017-09-01 - - - - - asterisk -- Unauthorized data disclosure and shell access command injection in app_minivm - - - asterisk11 - 11.25.2 - - - asterisk13 - 13.17.1 - - - - -

The Asterisk project reports:

-
-

AST-2017-005 - A change was made to the strict RTP - support in the RTP stack to better tolerate late media - when a reinvite occurs. When combined with the symmetric - RTP support this introduced an avenue where media could - be hijacked. Instead of only learning a new address when - expected the new code allowed a new source address to be - learned at all times.

-

AST-2017-006 - The app_minivm module has an "externnotify" - program configuration option that is executed by the - MinivmNotify dialplan application. The application uses - the caller-id name and number as part of a built string - passed to the OS shell for interpretation and execution. - Since the caller-id name and number can come from an - untrusted source, a crafted caller-id name or number - allows an arbitrary shell command injection.

-
- - - - https://downloads.asterisk.org/pub/security/AST-2017-005.html - CVE-2017-14099 - https://downloads.asterisk.org/pub/security/AST-2017-006.html - CVE-2017-14100 - - - 2017-08-31 - 2017-09-01 - - - - - libgcrypt -- side-channel attack vulnerability - - - libgcrypt - 1.8.1 - - - - -

GnuPG reports:

-
-

Mitigate a local side-channel attack on Curve25519 dubbed "May the Fourth Be With You".

-
- - - - CVE-2017-0379 - https://eprint.iacr.org/2017/806 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0379 - - - 2017-08-27 - 2017-08-30 - - - - - rubygems -- multiple vulnerabilities - - - ruby22-gems - ruby23-gems - ruby24-gems - 2.6.13 - - - - -

Official blog of RubyGems reports:

-
-

The following vulnerabilities have been reported: a DNS request - hijacking vulnerability, an ANSI escape sequence vulnerability, a DoS - vulnerability in the query command, and a vulnerability in the gem - installer that allowed a malicious gem to overwrite arbitrary - files.

-
- - - - https://www.ruby-lang.org/en/news/2017/08/29/multiple-vulnerabilities-in-rubygems/ - - - 2017-08-29 - 2017-08-29 - - - - - kanboard -- multiple privilege escalation vulnerabilities - - - kanboard - 1.0.46 - - - - -

chbi reports:

-
-

an authenticated standard user could reset the password of another - user (including admin) by altering form data.

-
- - - - https://kanboard.net/news/version-1.0.46 - CVE-2017-12850 - CVE-2017-12851 - - - 2017-08-15 - 2017-08-26 - - - - - poppler -- multiple denial of service issues - - - poppler - 0.56.0 - - - - -

Poppler developers report:

-
-

Poppler is prone to a stack-based buffer-overflow - vulnerability.

-

Successful exploits may allow attackers to crash the affected - application, resulting in denial-of-service condition. Due to the - nature of this issue, arbitrary code execution may be possible but - this has not been confirmed.

-
- - - - http://www.securityfocus.com/bid/99241/discuss - CVE-2017-9865 - CVE-2017-9775 - - - 2017-06-21 - 2017-08-24 - - - - - phpmailer -- XSS in code example and default exeception handler - - - phpmailer - 5.2.24 - - - - -

PHPMailer reports:

-
-

Fix XSS vulnerability in one of the code examples, CVE-2017-11503. The - code_generator.phps example did not filter user input prior to output. This - file is distributed with a .phps extension, so it it not normally executable - unless it is explicitly renamed, so it is safe by default. There was also an - undisclosed potential XSS vulnerability in the default exception handler - (unused by default). Patches for both issues kindly provided by Patrick - Monnerat of the Fedora Project.

-
- - - - https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.24 - CVE-2017-11503 - - - 2017-07-27 - 2017-08-23 - - - - - salt -- Maliciously crafted minion IDs can cause unwanted directory traversals on the Salt-master - - - py27-salt - py32-salt - py33-salt - py34-salt - py35-salt - py36-salt - 2016.11.7 - 2017.7.02017.7.1 - - - - -

SaltStack reports:

-
-

Correct a flaw in minion id validation which could allow certain - minions to authenticate to a master despite not having the correct - credentials. To exploit the vulnerability, an attacker must create a - salt-minion with an ID containing characters that will cause a - directory traversal. - Credit for discovering the security flaw goes to: Vernhk@qq.com

-
- - - - CVE-2017-12791 - https://docs.saltstack.com/en/latest/topics/releases/2017.7.1.html - https://docs.saltstack.com/en/latest/topics/releases/2016.11.7.html - - - 2017-08-16 - 2017-08-22 - - - - - dnsdist -- multiple vulnerabilities - - - dnsdist - 1.2.0 - - - - -

PowerDNS Security Advisory reports:

-
-

The first issue can lead to a denial of service on 32-bit if a backend - sends crafted answers, and the second to an alteration of dnsdist's ACL - if the API is enabled, writable and an authenticated user is tricked - into visiting a crafted website.

-
- - - - CVE-2016-7069 - CVE-2017-7557 - https://dnsdist.org/security-advisories/index.html - - - 2017-08-21 - 2017-08-22 - - - - - evince and atril -- command injection vulnerability in CBT handler - - - evince - 3.24.0 - - - evince-lite - 3.24.0 - - - atril - 1.18.1 - 1.19.01.19.1 - - - atril-lite - 1.18.1 - 1.19.01.19.1 - - - - -

GNOME reports:

-
-

The comic book backend in evince 3.24.0 (and earlier) is vulnerable to a command injection bug that can be used to execute arbitrary commands when a CBT file is opened.

-

The same vulnerability affects atril, the Evince fork.

-
- - - - https://bugzilla.gnome.org/show_bug.cgi?id=784630 - https://github.com/mate-desktop/atril/issues/257 - CVE-2017-1000083 - - - 2017-07-06 - 2017-07-13 - - - - - SquirrelMail -- post-authentication remote code execution - - - squirrelmail - 20170705 - - - - -

SquirrelMail developers report:

-
-

SquirrelMail 1.4.22 (and other versions before 20170427_0200-SVN) - allows post-authentication remote code execution via a sendmail.cf - file that is mishandled in a popen call. It's possible to exploit this - vulnerability to execute arbitrary shell commands on the remote - server.

-
- - - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7692 - - - 2017-04-19 - 2017-08-22 - - - - - pspp -- multiple vulnerabilities - - - pspp - 1.0.1 - - - - -

CVE Details reports:

-
-
    -
  • There is an Integer overflow in the hash_int function of the libpspp library - in GNU PSPP 0.10.5-pre2 (CVE-2017-10791).
    • -
  • There is a NULL Pointer Dereference in the function ll_insert() of the libpspp - library in GNU PSPP 0.10.5-pre2 (CVE-2017-10792).
    • -
  • There is an illegal address access in the function output_hex() in data/data-out.c - of the libpspp library in GNU PSPP 0.11.0 that will lead to remote denial of service (CVE-2017-12958).
    • -
  • There is a reachable assertion abort in the function dict_add_mrset() in data/dictionary.c - of the libpspp library in GNU PSPP 0.11.0 that will lead to a remote denial of service attack (CVE-2017-12959).
    • -
  • There is a reachable assertion abort in the function dict_rename_var() in data/dictionary.c - of the libpspp library in GNU PSPP 0.11.0 that will lead to remote denial of service (CVE-2017-12960).
    • -
  • There is an assertion abort in the function parse_attributes() in data/sys-file-reader.c - of the libpspp library in GNU PSPP 0.11.0 that will lead to remote denial of service (CVE-2017-12961).
    • -
-
- - - - CVE-2017-10791 - CVE-2017-10792 - CVE-2017-12958 - CVE-2017-12959 - CVE-2017-12960 - CVE-2017-12961 - https://www.cvedetails.com/vulnerability-list/vendor_id-72/product_id-38732/year-2017/GNU-Pspp.html - - - 2017-08-18 - 2017-08-22 - 2017-08-30 - - - - - drupal -- Drupal Core - Multiple Vulnerabilities - - - drupal8 - 8.3.7 - - - - -

Drupal Security Team:

-
-

CVE-2017-6923: Views - Access Bypass - Moderately Critical

-

CVE-2017-6924: REST API can bypass comment approval - Access Bypass - Moderately Critica

-

CVE-2017-6925: Entity access bypass for entities that do not have UUIDs or have protected revisions - Access Bypass - Critical

-
- - - - CVE-2017-6923 - CVE-2017-6924 - CVE-2017-6925 - - - 2017-08-16 - 2017-08-19 - - - - - libsoup -- stack based buffer overflow - - - libsoup - 2.52.2_1 - - - - -

Tobias Mueller reports:

-
-

libsoup is susceptible to a stack based buffer overflow - attack when using chunked encoding. Regardless of libsoup - being used as a server or client.

-
- - - - http://seclists.org/oss-sec/2017/q3/304 - CVE-2017-2885 - - - 2017-08-17 - 2017-08-17 - 2017-08-20 - - - - - Zabbix -- Remote code execution - - - zabbix2-server - zabbix2-proxy - 2.0.20 - - - zabbix22-server - zabbix22-proxy - 2.2.19 - - - zabbix3-server - zabbix3-proxy - 3.0.10 - - - zabbix32-server - zabbix32-proxy - 3.2.7 - - - - -

mitre reports:

-
-

An exploitable code execution vulnerability exists in the trapper command - functionality of Zabbix Server 2.4.X. A specially crafted set of packets - can cause a command injection resulting in remote code execution. An attacker - can make requests from an active Zabbix Proxy to trigger this vulnerability.

-
- - - - CVE-2017-2824 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2824 - https://support.zabbix.com/browse/ZBX-12349 - - - 2017-07-05 - 2017-08-16 - - - - - Supervisord -- An authenticated client can run arbitrary shell commands via malicious XML-RPC requests - - - py27-supervisor - 3.3.3,1 - - - - -

mnaberez reports:

-
-

supervisord can be configured to run an HTTP server on a TCP socket and/or a Unix domain socket. - The HTTP server is how supervisorctl communicates with supervisord. If an HTTP server has been - enabled, it will always serve both HTML pages and an XML-RPC interface. A vulnerability has been - found where an authenticated client can send a malicious XML-RPC request to supervisord that - will run arbitrary shell commands on the server. The commands will be run as the same user as - supervisord. Depending on how supervisord has been configured, this may be root.

-

This vulnerability can only be exploited by an authenticated client or if supervisord has been - configured to run an HTTP server without authentication. If authentication has not been enabled, - supervisord will log a message at the critical level every time it starts.

-
- - - - http://supervisord.org/changes.html - https://github.com/Supervisor/supervisor/issues/964#issuecomment-317551606 - CVE-2017-11610 - - - 2017-07-24 - 2017-08-15 - - - - - FreeRadius -- Multiple vulnerabilities - - - freeradius3 - 3.0.15 - - - - -

Guido Vranken reports:

-
-

Multiple vulnerabilities found via fuzzing: - FR-GV-201 (v2,v3) Read / write overflow in make_secret() - FR-GV-202 (v2) Write overflow in rad_coalesce() - FR-GV-203 (v2) DHCP - Memory leak in decode_tlv() - FR-GV-204 (v2) DHCP - Memory leak in fr_dhcp_decode() - FR-GV-205 (v2) DHCP - Buffer over-read in fr_dhcp_decode_options() - FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63 - FR-GV-207 (v2) Zero-length malloc in data2vp() - FR-GV-301 (v3) Write overflow in data2vp_wimax() - FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes - FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp() - FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions() - FR-GV-305 (v3) Decode 'signed' attributes correctly - FR-AD-001 (v2,v3) Use strncmp() instead of memcmp() for string data - FR-AD-002 (v3) String lifetime issues in rlm_python - FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare

-
- - - - http://freeradius.org/security/fuzzer-2017.html - - - 2017-06-17 - 2017-08-14 - - - - - Mercurial -- multiple vulnerabilities - - - mercurial - 4.3 - - - - -

Mercurial Release Notes:

-
-

CVE-2017-1000115

-

Mercurial's symlink auditing was incomplete prior to 4.3, and could be - abused to write to files outside the repository.

-

CVE-2017-1000116

-

Mercurial was not sanitizing hostnames passed to ssh, allowing shell - injection attacks on clients by specifying a hostname starting with - -oProxyCommand. This is also present in Git (CVE-2017-1000117) and - Subversion (CVE-2017-9800), so please patch those tools as well if you - have them installed.

-
- - - - https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.3_.2F_4.3.1_.282017-08-10.29 - CVE-2017-1000115 - CVE-2017-1000116 - - - 2017-08-10 - 2017-08-12 - - - - - subversion -- Arbitrary code execution vulnerability - - - subversion - 1.9.01.9.6 - - - subversion18 - 1.0.01.8.18 - - - subversion-static - 1.0.01.8.18 - 1.9.01.9.6 - - - - -

subversion team reports:

-
-

A Subversion client sometimes connects to URLs provided by the repository. - This happens in two primary cases: during 'checkout', 'export', 'update', and - 'switch', when the tree being downloaded contains svn:externals properties; - and when using 'svnsync sync' with one URL argument.

-

A maliciously constructed svn+ssh:// URL would cause Subversion clients to - run an arbitrary shell command. Such a URL could be generated by a malicious - server, by a malicious user committing to a honest server (to attack another - user of that server's repositories), or by a proxy server.

-

The vulnerability affects all clients, including those that use file://, - http://, and plain (untunneled) svn://.

-

An exploit has been tested.

-
- - - - http://subversion.apache.org/security/CVE-2017-9800-advisory.txt - - - 2017-08-10 - 2017-08-11 - - - - - GitLab -- two vulnerabilities - - - gitlab - 7.9.08.17.8 - 9.0.09.0.12 - 9.1.09.1.9 - 9.2.09.2.9 - 9.3.09.3.9 - 9.4.09.4.3 - - - - -

GitLab reports:

-
-

Remote Command Execution in git client

-

An external code review performed by Recurity-Labs identified a remote - command execution vulnerability in git that could be exploited via the "Repo - by URL" import option in GitLab. The command line git client was not - properly escaping command line arguments in URLs using the SSH protocol - before invoking the SSH client. A specially crafted URL could be used to - execute arbitrary shell commands on the GitLab server.
- To fully patch this vulnerability two fixes were needed. The Omnibus - versions of GitLab contain a patched git client. For source users who may - still be running an older version of git, GitLab now also blocks import URLs - containing invalid host and usernames.
- This issue has been assigned CVE-2017-12426.

-

Improper sanitization of GitLab export files on import

-

GitLab versions 8.13.3, 8.12.8, 8.11.10, 8.10.13, and 8.9.12 contained a - patch for a critical directory traversal vulnerability in the GitLab export - feature that could be exploited by including symlinks in the export file and - then re-importing it to a GitLab instance. This vulnerability was patched by - checking for and removing symlinks in these files on import.
- Recurity-Labs also determined that this fix did not properly remove symlinks for - hidden files. Though not as dangerous as the original vulnerability hidden file - symlinks could still be used to steal copies of git repositories belonging to - other users if the path to the git repository was known by the attacker. An - updated fix has been included in these releases that properly removes all - symlinks.
- This import option was not made available to non-admin users until GitLab - 8.13.0.

-
- - - - https://about.gitlab.com/2017/08/10/gitlab-9-dot-4-dot-4-released/ - CVE-2017-12426 - - - 2017-08-10 - 2017-08-11 - - - - - PostgreSQL vulnerabilities - - - postgresql92-server - 9.2.09.2.22 - - - postgresql93-server - 9.3.09.3.18 - - - postgresql94-server - 9.4.09.4.13 - - - postgresql95-server - 9.5.09.5.8 - - - postgresql96-server - 9.6.09.6.4 - - - - -

The PostgreSQL project reports:

-
-
    -
  • CVE-2017-7546: Empty password accepted in some authentication - methods
    • -
  • CVE-2017-7547: The "pg_user_mappings" catalog view discloses passwords - to users lacking server privileges
    • -
  • CVE-2017-7548: lo_put() function ignores ACLs
    • -
-
- - - - CVE-2017-7546 - CVE-2017-7547 - CVE-2017-7548 - - - 2017-08-10 - 2017-08-10 - - - - - Flash Player -- multiple vulnerabilities - - - linux-flashplayer - 26.0.0.151 - - - - -

Adobe reports:

-
-
    -
  • These updates resolve security bypass vulnerability that - could lead to information disclosure (CVE-2017-3085).
    • -
  • These updates resolve type confusion vulnerability that - could lead to remote code execution (CVE-2017-3106).
    • -
-
- - - - CVE-2017-3085 - CVE-2017-3106 - https://helpx.adobe.com/security/products/flash-player/apsb17-23.html - - - 2017-08-08 - 2017-08-10 - - - - - cURL -- multiple vulnerabilities - - - curl - 7.55.0 - - - - -

The cURL project reports:

-
-
    -
  • FILE buffer read out of bounds
    • -
  • TFTP sends more than buffer size
    • -
  • URL globbing out of bounds read
    • -
-
- - - - https://curl.haxx.se/docs/security.html - CVE-2017-1000099 - CVE-2017-1000100 - CVE-2017-1000101 - - - 2017-08-09 - 2017-08-09 - - - - - Axis2 -- Security vulnerability on dependency Apache Commons FileUpload - - - axis2 - 1.7.6 - - - - -

Apache Axis2 reports:

-
-

The commons-fileupload dependency has been updated to a version that fixes - CVE-2016-1000031 (AXIS2-5853).

-
- - - - http://axis.apache.org/axis2/java/core/release-notes/1.7.6.html - https://issues.apache.org/jira/browse/AXIS2-5853 - https://issues.apache.org/jira/browse/FILEUPLOAD-279 - CVE-2016-1000031 - - - 2016-11-14 - 2017-08-09 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 55.0,1 - - - seamonkey - linux-seamonkey - 2.49.1 - - - firefox-esr - 52.3.0,1 - - - linux-firefox - 52.3.0,2 - - - libxul - thunderbird - linux-thunderbird - 52.3.0 - - - - -

Mozilla Foundation reports:

-
-

Please reference CVE/URL list for details

-
- - - - CVE-2017-7753 - CVE-2017-7779 - CVE-2017-7780 - CVE-2017-7781 - CVE-2017-7782 - CVE-2017-7783 - CVE-2017-7784 - CVE-2017-7785 - CVE-2017-7786 - CVE-2017-7787 - CVE-2017-7788 - CVE-2017-7789 - CVE-2017-7790 - CVE-2017-7791 - CVE-2017-7792 - CVE-2017-7794 - CVE-2017-7796 - CVE-2017-7797 - CVE-2017-7798 - CVE-2017-7799 - CVE-2017-7800 - CVE-2017-7801 - CVE-2017-7802 - CVE-2017-7803 - CVE-2017-7804 - CVE-2017-7806 - CVE-2017-7807 - CVE-2017-7808 - https://www.mozilla.org/en-US/security/advisories/mfsa2017-18/ - - - 2017-08-08 - 2017-08-08 - - - - - sqlite3 -- heap-buffer overflow - - - sqlite3 - 3.20.0 - - - - -

Google reports:

-
-

A heap-buffer overflow (sometimes a crash) can arise when - running a SQL request on malformed sqlite3 databases.

-
- - - - https://bugs.launchpad.net/ubuntu/+source/sqlite3/+bug/1700937 - CVE-2017-10989 - - - 2017-08-08 - 2017-08-08 - 2017-09-19 - - - - - Varnish -- Denial of service vulnerability - - - varnish4 - 4.0.14.0.5 - 4.1.04.1.8 - - - varnish5 - 5.0.1 - 5.1.05.1.3 - - - - -

phk reports:

-
-

A wrong if statement in the varnishd source code means that - particular invalid requests from the client can trigger an assert.

-
- - - - https://varnish-cache.org/security/VSV00001.html - - - 2017-08-02 - 2017-08-02 - - - - - chromium -- multiple vulnerabilities - - - chromium - chromium-pulse - 60.0.3112.78 - - - - -

Google Chrome releases reports:

-
-

40 security fixes in this release

-

Please reference CVE/URL list for details

-
- - - - CVE-2017-5091 - CVE-2017-5092 - CVE-2017-5093 - CVE-2017-5094 - CVE-2017-5095 - CVE-2017-5096 - CVE-2017-5097 - CVE-2017-5098 - CVE-2017-5099 - CVE-2017-5100 - CVE-2017-5101 - CVE-2017-5102 - CVE-2017-5103 - CVE-2017-5104 - CVE-2017-7000 - CVE-2017-5105 - CVE-2017-5106 - CVE-2017-5107 - CVE-2017-5108 - CVE-2017-5109 - CVE-2017-5110 - https://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html - - - 2017-07-25 - 2017-08-01 - - - - - Cacti -- Cross-site scripting (XSS) vulnerability in auth_profile.php - - - cacti - 1.1.13 - - - - -

kimiizhang reports:

-
-

Cross-site scripting (XSS) vulnerability in auth_profile.php in Cacti - 1.1.13 allows remote authenticated users to inject arbitrary web script - or HTML via specially crafted HTTP Referer headers.

-
- - - - https://github.com/Cacti/cacti/issues/867 - https://www.cacti.net/release_notes.php?version=1.1.14 - CVE-2017-11691 - - - 2017-07-20 - 2017-07-29 - - - - - proftpd -- user chroot escape vulnerability - - - proftpd - 1.3.5e - - - - -

NVD reports:

-
-

ProFTPD ... controls whether the home directory of a user could - contain a symbolic link through the AllowChrootSymlinks - configuration option, but checks only the last path component when - enforcing AllowChrootSymlinks. Attackers with local access could - bypass the AllowChrootSymlinks control by replacing a path - component (other than the last one) with a symbolic link.

-
- - - - http://bugs.proftpd.org/show_bug.cgi?id=4295 - CVE-2017-7418 - - - 2017-03-06 - 2017-07-27 - - - - - jabberd -- authentication bypass vulnerability - - - jabberd - 2.6.1 - - - - -

SecurityFocus reports:

-
-

JabberD is prone to an authentication-bypass vulnerability. - An attacker can exploit this issue to bypass the authentication - mechanism and perform unauthorized actions. This may lead to - further attacks.

-
- - - - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=867032 - http://www.securityfocus.com/bid/99511 - CVE-2017-10807 - - - 2017-07-03 - 2017-07-26 - - - - - webkit2-gtk3 -- multiple vulnerabilities - - - webkit2-gtk3 - 2.16.6 - - - - -

The Webkit gtk team reports:

-
-

Please reference CVE/URL list for details

-
- - - - https://webkitgtk.org/security/WSA-2017-0006.html - CVE-2017-7006 - CVE-2017-7011 - CVE-2017-7012 - CVE-2017-7018 - CVE-2017-7019 - CVE-2017-7020 - CVE-2017-7030 - CVE-2017-7034 - CVE-2017-7037 - CVE-2017-7038 - CVE-2017-7039 - CVE-2017-7040 - CVE-2017-7041 - CVE-2017-7042 - CVE-2017-7043 - CVE-2017-7046 - CVE-2017-7048 - CVE-2017-7049 - CVE-2017-7052 - CVE-2017-7055 - CVE-2017-7056 - CVE-2017-7059 - CVE-2017-7061 - CVE-2017-7064 - - - 2017-07-24 - 2017-07-25 - 2018-03-28 - - - - - gsoap -- remote code execution via via overflow - - - gsoap - 2.8.47 - - - - -

Senrio reports:

-
-

Genivia gSOAP is prone to a stack-based buffer-overflow - vulnerability because it fails to properly bounds check user-supplied - data before copying it into an insufficiently sized buffer.

-

A remote attacker may exploit this issue to execute arbitrary code - in the context of the affected device. Failed attempts will likely - cause a denial-of-service condition.

-
- - - - http://www.securityfocus.com/bid/99868/discuss - http://blog.senr.io/blog/devils-ivy-flaw-in-widely-used-third-party-code-impacts-millions - http://blog.senr.io/devilsivy.html - https://www.genivia.com/advisory.html#Security_advisory:_CVE-2017-9765_bug_in_certain_versions_of_gSOAP_2.7_up_to_2.8.47_%28June_21,_2017%29 - https://www.genivia.com/changelog.html#Version_2.8.48_upd_%2806/21/2017%29 - CVE-2017-9765 - - - 2017-07-18 - 2017-07-25 - - - - - GitLab -- Various security issues - - - gitlab - 8.0.08.17.6 - 9.0.09.0.10 - 9.1.09.1.7 - 9.2.09.2.7 - 9.3.09.3.7 - - - - -

GitLab reports:

-
-

Please reference CVE/URL list for details

-
- - - - https://about.gitlab.com/2017/07/19/gitlab-9-dot-3-dot-8-released/ - CVE-2017-11438 - - - 2017-07-20 - 2017-07-20 - 2017-08-15 - - - - - MySQL -- multiple vulnerabilities - - - mariadb55-server - 5.5.57 - - - mariadb100-server - 10.0.32 - - - mariadb101-server - 10.1.26 - - - mariadb102-server - 10.2.6 - - - mysql55-server - 5.5.57 - - - mysql56-server - 5.6.37 - - - mysql57-server - 5.7.19 - - - percona55-server - 5.5.57 - - - percona56-server - 5.6.37 - - - percona57-server - 5.7.19 - - - - -

Oracle reports:

-
-

Please reference CVE/URL list for details

-
- - - - http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html#AppendixMSQL - CVE-2017-3529 - CVE-2017-3633 - CVE-2017-3634 - CVE-2017-3635 - CVE-2017-3636 - CVE-2017-3637 - CVE-2017-3638 - CVE-2017-3639 - CVE-2017-3640 - CVE-2017-3641 - CVE-2017-3642 - CVE-2017-3643 - CVE-2017-3644 - CVE-2017-3645 - CVE-2017-3646 - CVE-2017-3647 - CVE-2017-3648 - CVE-2017-3649 - CVE-2017-3650 - CVE-2017-3651 - CVE-2017-3652 - CVE-2017-3653 - - - 2017-07-19 - 2017-07-19 - 2017-08-12 - - - - - collectd5 -- Denial of service by sending a signed network packet to a server which is not set up to check signatures - - - collectd5 - 5.7.2 - - - - -

marcinguy reports:

-
-

After sending this payload, collectd seems to be entering endless while() - loop in packet_parse consuming high CPU resources, possibly crash/gets killed after a while.

-
- - - - https://github.com/collectd/collectd/issues/2174 - CVE-2017-7401 - - - 2017-02-13 - 2017-07-19 - - - - - strongswan -- multiple vulnerabilities - - - strongswan - 4.4.05.5.2 - - - - -

strongSwan security team reports:

-
-
    -
  • RSA public keys passed to the gmp plugin aren't validated sufficiently - before attempting signature verification, so that invalid input might - lead to a floating point exception. [CVE-2017-9022]
    • -
  • ASN.1 CHOICE types are not correctly handled by the ASN.1 parser when - parsing X.509 certificates with extensions that use such types. This - could lead to infinite looping of the thread parsing a specifically crafted certificate.
    • -
-
- - - - https://www.strongswan.org/blog/2017/05/30/strongswan-vulnerability-(cve-2017-9022).html - CVE-2017-9022 - https://www.strongswan.org/blog/2017/05/30/strongswan-vulnerability-(cve-2017-9023).html - CVE-2017-9023 - - - 2017-05-30 - 2017-07-19 - - - - - - - - - Cacti -- Cross-site scripting (XSS) vulnerability in link.php - - - cacti - 1.0.01.1.13 - - - - -

kimiizhang reports:

-
-

Cross-site scripting (XSS) vulnerability in link.php in Cacti
- 1.1.12 allows remote anonymous users to inject arbitrary web
- script or HTML via the id parameter.

-
- - - - https://github.com/Cacti/cacti/issues/838 - https://www.cacti.net/release_notes.php?version=1.1.13 - CVE-2017-10970 - - - 2017-07-05 - 2017-07-17 - - - - - Apache httpd -- multiple vulnerabilities - - - apache24 - 2.4.27 - - - - -

The Apache httpd project reports:

-
-

important: Read after free in mod_http2 (CVE-2017-9789)
- When under stress, closing many connections, the HTTP/2 handling - code would sometimes access memory after it has been freed, - resulting in potentially erratic behaviour.

-

important: Uninitialized memory reflection in mod_auth_digest - (CVE-2017-9788)
The value placeholder in [Proxy-]Authorization - headers of type 'Digest' was not initialized or reset before or - between successive key=value assignments. by mod_auth_digest.
- Providing an initial key with no '=' assignment could reflect - the stale value of uninitialized pool memory used by the prior - request, leading to leakage of potentially confidential - information, and a segfault.

-
- - - - https://httpd.apache.org/security/vulnerabilities_24.html - CVE-2017-9789 - CVE-2017-9788 - - - 2017-07-11 - 2017-07-13 - - - - - Flash Player -- multiple vulnerabilities - - - linux-flashplayer - 26.0.0.137 - - - - -

Adobe reports:

-
-
    -
  • These updates resolve security bypass vulnerability that - could lead to information disclosure (CVE-2017-3080).
    • -
  • These updates resolve memory corruption vulnerability that - could lead to remote code execution (CVE-2017-3099).
    • -
  • These updates resolve memory corruption vulnerability that - could lead to memory address disclosure (CVE-2017-3100).
    • -
-
- - - - CVE-2017-3080 - CVE-2017-3099 - CVE-2017-3100 - https://helpx.adobe.com/security/products/flash-player/apsb17-21.html - - - 2017-07-11 - 2017-07-13 - - - - - samba -- Orpheus Lyre mutual authentication validation bypass - - - samba42 - 4.2.15 - - - samba43 - 4.3.14 - - - samba44 - 4.4.15 - - - samba45 - 4.5.12 - - - samba46 - 4.6.6 - - - - -

The samba project reports:

-
-

A MITM attacker may impersonate a trusted server and thus gain elevated access to the domain by - returning malicious replication or authorization data.

-
- - - - https://www.samba.org/samba/security/CVE-2017-11103.html - CVE-2017-11103 - - - 2017-07-12 - 2017-07-12 - - - - - node.js -- multiple vulnerabilities - - - node - 8.1.4 - - - node4 - 4.8.4 - - - node6 - 6.11.1 - - - - -

Updates are now available for all active Node.js release lines as - well as the 7.x line. These include the fix for the high severity - vulnerability identified in the initial announcement, one additional - lower priority Node.js vulnerability in the 4.x release line, as well - as some lower priority fixes for Node.js dependencies across the - current release lines.

-
-

Constant Hashtable Seeds (CVE pending)

-

Node.js was susceptible to hash flooding remote DoS attacks as the - HashTable seed was constant across a given released version of - Node.js. This was a result of building with V8 snapshots enabled by - default which caused the initially randomized seed to be overwritten - on startup. Thanks to Jann Horn of Google Project Zero for reporting - this vulnerability.

-

This is a high severity vulnerability and applies to all active - release lines (4.x, 6.x, 8.x) as well as the 7.x line.

-

http.get with numeric authorization options creates uninitialized - buffers

-

Application code that allows the auth field of the options object - used with http.get() to be set to a number can result in an - uninitialized buffer being created/used as the authentication - string.

-

This is a low severity defect and only applies to the 4.x release - line.

-
- - - - https://nodejs.org/en/blog/vulnerability/july-2017-security-releases/ - - - 2017-06-27 - 2017-07-12 - - - - - nginx -- a specially crafted request might result in an integer overflow - - - nginx - 0.5.61.12.1,2 - - - nginx-devel - 0.5.61.13.3 - - - - -

Maxim Dounin reports:

-
-

A security issue was identified in nginx range filter. A specially - crafted request might result in an integer overflow and incorrect - processing of ranges, potentially resulting in sensitive information - leak (CVE-2017-7529).

-
- - - - http://mailman.nginx.org/pipermail/nginx-announce/2017/000200.html - CVE-2017-7529 - - - 2017-07-11 - 2017-07-11 - - - - - codeigniter -- input validation bypass - - - codeigniter - 3.1.5 - - - - -

The CodeIgniter changelog reports:

-
-

Form Validation Library rule valid_email could be bypassed if - idn_to_ascii() is available.

-
- - - - https://www.codeigniter.com/user_guide/changelog.html - - - 2017-06-19 - 2017-07-08 - - - - - irssi -- multiple vulnerabilities - - - irssi - 1.0.4,1 - - - - -

irssi reports:

-
-

When receiving messages with invalid time stamps, Irssi - would try to dereference a NULL pointer.

-

While updating the internal nick list, Irssi may - incorrectly use the GHashTable interface and free the nick while - updating it. This will then result in use-after-free conditions on each - access of the hash table.

-
- - - - https://irssi.org/security/irssi_sa_2017_07.txt - CVE-2017-10965 - CVE-2017-10966 - ports/220544 - - - 2017-07-05 - 2017-07-08 - - - - - oniguruma -- multiple vulnerabilities - - - libevhtp - 1.2.14 - - - oniguruma4 - 4.7.2 - - - oniguruma5 - 5.9.7 - - - oniguruma6 - 6.4.0 - - - php56-mbstring - 5.6.31 - - - php70-mbstring - 7.0.21 - - - php71-mbstring - 7.1.7 - - - - -

the PHP project reports:

-
-
    -
  • A stack out-of-bounds read occurs in match_at() during regular - expression searching. A logical error involving order of validation - and access in match_at() could result in an out-of-bounds read from - a stack buffer (CVE-2017-9224).
    • -
  • A heap out-of-bounds write or read occurs in next_state_val() - during regular expression compilation. Octal numbers larger than 0xff - are not handled correctly in fetch_token() and fetch_token_in_cc(). - A malformed regular expression containing an octal number in the form - of '\700' would produce an invalid code point value larger than 0xff - in next_state_val(), resulting in an out-of-bounds write memory - corruption (CVE-2017-9226).
    • -
  • A stack out-of-bounds read occurs in mbc_enc_len() during regular - expression searching. Invalid handling of reg->dmin in - forward_search_range() could result in an invalid pointer dereference, - as an out-of-bounds read from a stack buffer (CVE-2017-9227).
    • -
  • A heap out-of-bounds write occurs in bitset_set_range() during - regular expression compilation due to an uninitialized variable from - an incorrect state transition. An incorrect state transition in - parse_char_class() could create an execution path that leaves a - critical local variable uninitialized until it's used as an index, - resulting in an out-of-bounds write memory corruption (CVE-2017-9228).
    • -
  • A SIGSEGV occurs in left_adjust_char_head() during regular expression - compilation. Invalid handling of reg->dmax in forward_search_range() could - result in an invalid pointer dereference, normally as an immediate - denial-of-service condition (CVE-2017-9228).
    • -
-
- - - - http://php.net/ChangeLog-7.php - CVE-2017-9224 - CVE-2017-9226 - CVE-2017-9227 - CVE-2017-9228 - CVE-2017-9228 - - - 2017-07-06 - 2017-07-07 - 2018-01-04 - - - - - drupal -- Drupal Core - Multiple Vulnerabilities - - - drupal7 - 7.56 - - - drupal8 - 8.3.4 - - - - -

Drupal Security Team Reports:

-
-

CVE-2017-6920: PECL YAML parser unsafe object handling.

-

CVE-2017-6921: File REST resource does not properly validate

-

CVE-2017-6922: Files uploaded by anonymous users into a private - file system can be accessed by other anonymous users.

-
- - - - CVE-2017-6920 - CVE-2017-6921 - CVE-2017-6922 - - - 2017-06-21 - 2017-07-06 - - - - - Dropbear -- two vulnerabilities - - - dropbear - 2017.75 - - - - -

Matt Johnston reports:

-
-

Fix double-free in server TCP listener cleanup A double-free in - the server could be triggered by an authenticated user if dropbear - is running with -a (Allow connections to forwarded ports from any - host) This could potentially allow arbitrary code execution as root - by an authenticated user.

-

Fix information disclosure with ~/.ssh/authorized_keys symlink. - Dropbear parsed authorized_keys as root, even if it were a symlink. - The fix is to switch to user permissions when opening authorized_keys. -

-
- - - - https://matt.ucc.asn.au/dropbear/CHANGES - CVE-2017-9078 - CVE-2017-9079 - - - 2017-05-18 - 2017-07-03 - - - - - smarty3 -- shell injection in math - - - smarty3 - 3.1.30 - - - - -

The smarty project reports:

-
-

bugfix {math} shell injection vulnerability

-
- - - - https://github.com/smarty-php/smarty/blob/v3.1.30/change_log.txt - - - 2016-07-19 - 2017-07-03 - - - - - libgcrypt -- side-channel attack on RSA secret keys - - - libgcrypt - 1.7.8 - - - - -

GnuPG reports:

-
-

Mitigate a flush+reload side-channel attack on RSA secret keys dubbed "Sliding right into disaster".

-
- - - - CVE-2017-7526 - https://lists.gnupg.org/pipermail/gnupg-announce/2017q2/000408.html - - - 2017-06-29 - 2017-06-30 - - - - - GitLab -- Various security issues - - - gitlab - 4.0.09.0.9 - 9.1.09.1.6 - 9.2.09.2.4 - - - - -

GitLab reports:

-
-

Please reference CVE/URL list for details

-
- - - - https://about.gitlab.com/2017/06/07/gitlab-9-dot-2-dot-5-security-release/ - - - 2017-06-07 - 2017-06-30 - - - - - tor -- security regression - - - tor - 0.3.0.9 - - - tor-devel - 0.3.1.4.a - - - - -

The Tor Project reports:

-
-

Tor 0.3.0.9 fixes a path selection bug that would allow a client - to use a guard that was in the same network family as a chosen exit - relay. This is a security regression; all clients running earlier - versions of 0.3.0.x or 0.3.1.x should upgrade to 0.3.0.9 or - 0.3.1.4-alpha.

-
- - - - https://blog.torproject.org/blog/tor-0309-released-security-update-clients - https://blog.torproject.org/blog/tor-0314-alpha-released-security-update-clients - https://lists.torproject.org/pipermail/tor-announce/2017-June/000133.html - CVE-2017-0377 - - - 2017-06-29 - 2017-06-30 - - - - - exim -- Privilege escalation via multiple memory leaks - - - exim - 4.89_1 - - - - -

Qualsys reports:

-
-

- Exim supports the use of multiple "-p" command line arguments which are malloc()'ed and never free()'ed, used in conjunction with other issues allows attackers to cause arbitrary code execution. This affects exim version 4.89 and earlier. Please note that at this time upstream has released a patch (commit 65e061b76867a9ea7aeeb535341b790b90ae6c21), but it is not known if a new point release is available that addresses this issue at this time. -

-
- - - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000369 - - - 2017-06-19 - 2017-06-21 - - - - - pear-Horde_Image -- DoS vulnerability - - - pear-Horde_Image - 2.3.02.5.0 - - - - -

Michael J Rubinsky reports:

-
-

The second vulnerability (CVE-2017-9773) is a DOS vulnerability. -This only affects Horde installations that do not have a configured image -handling backend, and thus use the "Null" image driver. It is exploitable by -a logged in user clicking on a maliciously crafted URL.

-
- - - - https://lists.horde.org/archives/announce/2017/001234.html - CVE-2017-9773 - - - 2017-06-21 - 2017-06-21 - - - - - pear-Horde_Image -- remote code execution vulnerability - - - pear-Horde_Image - 2.0.02.5.0 - - - - -

Michael J Rubinsky reports:

-
-

The fist vulnerability (CVE-2017-9774) is a Remote Code Execution -vulnerability and is exploitable by a logged in user sending a -maliciously crafted GET request to the Horde server.

-
- - - - https://lists.horde.org/archives/announce/2017/001234.html - CVE-2017-9774 - - - 2017-06-21 - 2017-06-21 - - - - - OpenVPN -- several vulnerabilities - - - openvpn - 2.3.17 - 2.4.02.4.3 - - - openvpn-mbedtls - 2.4.3 - - - openvpn-polarssl - 2.3.17 - - - - -

Samuli Seppänen reports:

-
-

In May/June 2017 Guido Vranken threw a fuzzer at OpenVPN 2.4.2. In - the process he found several vulnerabilities and reported them to - the OpenVPN project. [...] The first releases to have these fixes are OpenVPN 2.4.3 and 2.3.17.

-

This is a list of fixed important vulnerabilities:

-
    -
  • Remotely-triggerable ASSERT() on malformed IPv6 packet
    • -
  • Pre-authentication remote crash/information disclosure for clients
    • -
  • Potential double-free in --x509-alt-username
    • -
  • Remote-triggerable memory leaks
    • -
  • Post-authentication remote DoS when using the --x509-track option
    • -
  • Null-pointer dereference in establish_http_proxy_passthru()
    • -
-
- - - - https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243 - CVE-2017-7508 - CVE-2017-7512 - CVE-2017-7520 - CVE-2017-7521 - CVE-2017-7522 - - - 2017-05-19 - 2017-06-21 - - - - - Apache httpd -- several vulnerabilities - - - apache22 - 2.2.33 - - - apache24 - 2.4.26 - - - - -

The Apache httpd project reports:

-
-
    -
  • ap_get_basic_auth_pw() Authentication Bypass (CVE-2017-3167):
    - Use of the ap_get_basic_auth_pw() by third-party modules outside - of the authentication phase may lead to authentication requirements - being bypassed.
    • -
  • mod_ssl Null Pointer Dereference (CVE-2017-3169):
    mod_ssl may - dereference a NULL pointer when third-party modules - call ap_hook_process_connection() during an HTTP request to an HTTPS - port.
    • -
  • mod_http2 Null Pointer Dereference (CVE-2017-7659):
    A maliciously - constructed HTTP/2 request could cause mod_http2 to dereference a NULL - pointer and crash the server process.
    • -
  • ap_find_token() Buffer Overread (CVE-2017-7668):
    The HTTP strict - parsing changes added in 2.2.32 and 2.4.24 introduced a bug in token - list parsing, which allows ap_find_token() to search past the end of its - input string. By maliciously crafting a sequence of request headers, an - attacker may be able to cause a segmentation fault, or to force - ap_find_token() to return an incorrect value.
    • -
  • mod_mime Buffer Overread (CVE-2017-7679):
    mod_mime can read one - byte past the end of a buffer when sending a malicious Content-Type - response header.
    • -
-
- - - - https://httpd.apache.org/security/vulnerabilities_24.html - https://httpd.apache.org/security/vulnerabilities_22.html - CVE-2017-3167 - CVE-2017-3169 - CVE-2017-7659 - CVE-2017-7668 - CVE-2017-7679 - - - 2017-06-20 - 2017-06-20 - - - - - chromium -- multiple vulnerabilities - - - chromium - chromium-pulse - 59.0.3071.104 - - - - -

Google Chrome releases reports:

-
-

5 security fixes in this release, including:

-
    -
  • [725032] High CVE-2017-5087: Sandbox Escape in IndexedDB. Reported by - Ned Williamson on 2017-05-22
    • -
  • [729991] High CVE-2017-5088: Out of bounds read in V8. Reported by - Xiling Gong of Tencent Security Platform Department on 2017-06-06
    • -
  • [714196] Medium CVE-2017-5089: Domain spoofing in Omnibox. Reported by - Michal Bentkowski on 2017-04-21
    • -
  • [732498] Various fixes from internal audits, fuzzing and other initiatives
    • -
-
- - - - CVE-2017-5087 - CVE-2017-5088 - CVE-2017-5089 - https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop_15.html - - - 2017-06-15 - 2017-06-16 - - - - - cURL -- URL file scheme drive letter buffer overflow - - - curl - 7.53.07.54.1 - - - - -

cURL security advisory:

-
-

When libcurl is given either

-

1. a file: URL that doesn't use two slashes following the colon, or

-

2. is told that file is the default scheme to use for URLs without scheme

-

... and the given path starts with a drive letter and libcurl is built for - Windows or DOS, then libcurl would copy the path with a wrong offset, so that - the end of the given path would write beyond the malloc buffer. Up to seven - bytes too much.

-

We are not aware of any exploit of this flaw.

-
- - - - CVE-2017-9502 - https://curl.haxx.se/docs/adv_20170614.html - - - 2017-06-14 - 2017-06-15 - - - - - rt and dependent modules -- multiple security vulnerabilities - - - rt42 - 4.2.04.2.13_1 - - - rt44 - 4.4.04.4.1_1 - - - p5-RT-Authen-ExternalAuth - 0.90.27 - - - - -

BestPractical reports:

-
-

Please reference CVE/URL list for details

-
- - - - http://lists.bestpractical.com/pipermail/rt-announce/2017-June/000297.html - CVE-2015-7686 - CVE-2016-6127 - CVE-2017-5361 - CVE-2017-5943 - CVE-2017-5944 - - - 2017-06-15 - 2017-06-15 - - - - - Flash Player -- multiple vulnerabilities - - - linux-flashplayer - 26.0.0.126 - - - - -

Adobe reports:

-
-
    -
  • These updates resolve use-after-free vulnerabilities that - could lead to code execution (CVE-2017-3075, CVE-2017-3081, - CVE-2017-3083, CVE-2017-3084).
    • -
  • These updates resolve memory corruption vulnerabilities that - could lead to code execution (CVE-2017-3076, CVE-2017-3077, - CVE-2017-3078, CVE-2017-3079, CVE-2017-3082).
    • -
-
- - - - CVE-2017-3075 - CVE-2017-3076 - CVE-2017-3077 - CVE-2017-3078 - CVE-2017-3079 - CVE-2017-3081 - CVE-2017-3082 - CVE-2017-3083 - CVE-2017-3084 - https://helpx.adobe.com/security/products/flash-player/apsb17-17.html - - - 2017-06-13 - 2017-06-15 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 54.0,1 - - - seamonkey - linux-seamonkey - 2.49.1 - - - firefox-esr - 52.2.0,1 - - - linux-firefox - 52.2.0,2 - - - libxul - thunderbird - linux-thunderbird - 52.2.0 - - - - -

Mozilla Foundation reports:

-
-

Please reference CVE/URL list for details

-
- - - - CVE-2017-5470 - CVE-2017-5471 - CVE-2017-5472 - CVE-2017-7749 - CVE-2017-7750 - CVE-2017-7751 - CVE-2017-7752 - CVE-2017-7754 - CVE-2017-7755 - CVE-2017-7756 - CVE-2017-7757 - CVE-2017-7758 - CVE-2017-7759 - CVE-2017-7760 - CVE-2017-7761 - CVE-2017-7762 - CVE-2017-7763 - CVE-2017-7764 - CVE-2017-7765 - CVE-2017-7766 - CVE-2017-7767 - CVE-2017-7768 - CVE-2017-7778 - https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/ - https://www.mozilla.org/en-US/security/advisories/mfsa2017-16/ - - - 2017-06-13 - 2017-06-13 - 2017-09-19 - - - - - roundcube -- arbitrary password resets - - - roundcube - 1.2.5,1 - - - - -

Roundcube reports:

-
-

Roundcube Webmail allows arbitrary password resets by - authenticated users. The problem is caused by an improperly restricted - exec call in the virtualmin and sasl drivers of the password plugin.

-
- - - - https://roundcube.net/news/2017/04/28/security-updates-1.2.5-1.1.9-and-1.0.11 - CVE-2017-8114 - - - 2017-04-28 - 2017-06-09 - - - - - GnuTLS -- Denial of service vulnerability - - - gnutls - 3.5.13 - - - - -

The GnuTLS project reports:

-
-

It was found using the TLS fuzzer tools that decoding a status - response TLS extension with valid contents could lead to a crash - due to a null pointer dereference. The issue affects GnuTLS server - applications.

-
- - - - https://gnutls.org/security.html#GNUTLS-SA-2017-4 - - - 2017-06-07 - 2017-06-08 - - - - - irssi -- remote DoS - - - irssi - 1.0.3 - - - - -

Joseph Bisch reports:

-
-

When receiving a DCC message without source nick/host, Irssi would - attempt to dereference a NULL pointer.

-

When receiving certain incorrectly quoted DCC files, Irssi would - try to find the terminating quote one byte before the allocated - memory.

-
- - - - CVE-2017-9468 - CVE-2017-9469 - https://irssi.org/security/irssi_sa_2017_06.txt - - - 2017-06-06 - 2017-06-08 - - - - - chromium -- multiple vulnerabilities - - - chromium - chromium-pulse - 59.0.3071.86 - - - - -

Google Chrome releases reports:

-
-

30 security fixes in this release

-

Please reference CVE/URL list for details

-
- - - - CVE-2017-5070 - CVE-2017-5071 - CVE-2017-5072 - CVE-2017-5073 - CVE-2017-5074 - CVE-2017-5075 - CVE-2017-5086 - CVE-2017-5076 - CVE-2017-5077 - CVE-2017-5078 - CVE-2017-5079 - CVE-2017-5080 - CVE-2017-5081 - CVE-2017-5082 - CVE-2017-5083 - CVE-2017-5085 - https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop.html - - - 2017-06-05 - 2017-06-06 - - - - - ansible -- Input validation flaw in jinja2 templating system - - - ansible - 2.3.1 - - - - -

RedHat security team reports:

-
-

An input validation flaw was found in Ansible, where it fails to - properly mark lookup-plugin results as unsafe. If an attacker could - control the results of lookup() calls, they could inject Unicode - strings to be parsed by the jinja2 templating system, result in - code execution.

-
- - - - https://access.redhat.com/security/cve/cve-2017-7481 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7481 - - - 2017-05-09 - 2017-06-02 - - - - - duo -- Two-factor authentication bypass - - - duo - 1.9.21 - - - - -

The duo security team reports:

-
-

An untrusted user may be able to set the http_proxy variable to - an invalid address. If this happens, this will trigger the - configured 'failmode' behavior, which defaults to safe. Safe - mode causes the authentication to report a success.

-
- - - - https://duo.com/labs/psa/duo-psa-2017-002 - - - 2017-05-19 - 2017-06-01 - - - - - FreeRADIUS -- TLS resumption authentication bypass - - - freeradius - freeradius2 - freeradius3 - 3.0.14 - - - - -

Stefan Winter reports:

-
-

The TLS session cache in FreeRADIUS before 3.0.14 fails to - reliably prevent resumption of an unauthenticated session, which - allows remote attackers (such as malicious 802.1X supplicants) to - bypass authentication via PEAP or TTLS.

-
- - - - CVE-2017-9148 - http://freeradius.org/security.html - http://seclists.org/oss-sec/2017/q2/342 - http://www.securityfocus.com/bid/98734 - - - 2017-02-03 - 2017-06-01 - - - - - heimdal -- bypass of capath policy - - - heimdal - 7.1.0_3 - - - - -

Viktor Dukhovni reports:

-
-

Commit f469fc6 (2010-10-02) inadvertently caused the - previous hop realm to not be added to the transit path of issued - tickets. This may, in some cases, enable bypass of capath policy in - Heimdal versions 1.5 through 7.2. Note, this may break sites that rely - on the bug. With the bug some incomplete [capaths] worked, that should - not have. These may now break authentication in some cross-realm - configurations. (CVE-2017-6594)

-
- - - - CVE-2017-6594 - ports/219657 - - - 2017-04-13 - 2017-05-31 - - - - - FreeBSD -- ipfilter(4) fragment handling panic - - - FreeBSD-kernel - 11.011.0_10 - 10.310.3_19 - - - - -

Problem Description:

-

ipfilter(4), capable of stateful packet inspection, using - the "keep state" or "keep frags" rule options, will not - only maintain the state of connections, such as TCP streams - or UDP communication, it also maintains the state of - fragmented packets. When a packet fragments are received - they are cached in a hash table (and linked list). When a - fragment is received it is compared with fragments already - cached in the hash table for a match. If it does not match - the new entry is used to create a new entry in the hash - table. If on the other hand it does match, unfortunately - the wrong entry is freed, the entry in the hash table. This - results in use after free panic (and for a brief moment - prior to the panic a memory leak due to the wrong entry - being freed).

-

Impact:

-

Carefully feeding fragments that are allowed to pass by - an ipfilter(4) firewall can be used to cause a panic followed - by reboot loop denial of service attack.

- - - - CVE-2017-1081 - SA-17:04.ipfilter - - - 2017-04-27 - 2017-05-26 - - - - - FreeBSD -- Multiple vulnerabilities of ntp - - - FreeBSD - 11.011.0_9 - 10.310.3_18 - - - - -

Problem Description:

-

A vulnerability was discovered in the NTP server's parsing - of configuration directives. [CVE-2017-6464]

-

A vulnerability was found in NTP, in the parsing of - packets from the DPTS Clock. [CVE-2017-6462]

-

A vulnerability was discovered in the NTP server's parsing - of configuration directives. [CVE-2017-6463]

-

A vulnerability was found in NTP, affecting the origin - timestamp check function. [CVE-2016-9042]

-

Impact:

-

A remote, authenticated attacker could cause ntpd to - crash by sending a crafted message. [CVE-2017-6463, - CVE-2017-6464]

-

A malicious device could send crafted messages, causing - ntpd to crash. [CVE-2017-6462]

-

An attacker able to spoof messages from all of the - configured peers could send crafted packets to ntpd, causing - later replies from those peers to be discarded, resulting - in denial of service. [CVE-2016-9042]

- - - - CVE-2016-9042 - CVE-2017-6462 - CVE-2017-6463 - CVE-2017-6464 - SA-17:03.ntp - - - 2017-04-12 - 2017-05-26 - - - - - vlc -- remote code execution via crafted subtitles - - - vlc - 2.2.6,4 - - - vlc-qt4 - 2.2.6,4 - - - - -

Check Point research team reports:

-
-

Remote code execution via crafted subtitles

-
- - - - http://blog.checkpoint.com/2017/05/23/hacked-in-translation/ - - - 2017-05-23 - 2017-05-26 - - - - - OpenEXR -- multiple remote code execution and denial of service vulnerabilities - - - OpenEXR - 2.2.1 - - - - -

Brandon Perry reports:

-
-

[There] is a zip file of EXR images that cause segmentation faults in the OpenEXR library (tested against 2.2.0).

-
    -
  • CVE-2017-9110 - In OpenEXR 2.2.0, an invalid read of size 2 in the hufDecode function in ImfHuf.cpp could cause the application to crash.
    • -
  • CVE-2017-9111 - In OpenEXR 2.2.0, an invalid write of size 8 in the storeSSE function in ImfOptimizedPixelReading.h could cause the application to crash or execute arbitrary code.
    • -
  • CVE-2017-9112 - In OpenEXR 2.2.0, an invalid read of size 1 in the getBits function in ImfHuf.cpp could cause the application to crash.
    • -
  • CVE-2017-9113 - In OpenEXR 2.2.0, an invalid write of size 1 in the bufferedReadPixels function in ImfInputFile.cpp could cause the application to crash or execute arbitrary code.
    • -
  • CVE-2017-9114 - In OpenEXR 2.2.0, an invalid read of size 1 in the refill function in ImfFastHuf.cpp could cause the application to crash.
    • -
  • CVE-2017-9115 - In OpenEXR 2.2.0, an invalid write of size 2 in the = operator function in half.h could cause the application to crash or execute arbitrary code.
    • -
  • CVE-2017-9116 - In OpenEXR 2.2.0, an invalid read of size 1 in the uncompress function in ImfZip.cpp could cause the application to crash.
    • -
-
- - - - http://www.openwall.com/lists/oss-security/2017/05/12/5 - CVE-2017-9110 - CVE-2017-9111 - CVE-2017-9112 - CVE-2017-9113 - CVE-2017-9114 - CVE-2017-9115 - CVE-2017-9116 - https://github.com/openexr/openexr/issues/232 - - - 2017-01-12 - 2017-05-25 - - - - - ImageMagick -- multiple vulnerabilities - - - ImageMagick - ImageMagick-nox11 - 6.9.6.4_2,1 - 6.9.7.0,16.9.8.8,1 - - - ImageMagick7 - ImageMagick7-nox11 - 7.0.5.9 - - - - -
-

Please reference CVE/URL list for details

-
- - - - https://nvd.nist.gov/vuln/search/results?query=ImageMagick - CVE-2017-5506 - CVE-2017-5507 - CVE-2017-5508 - CVE-2017-5509 - CVE-2017-5510 - CVE-2017-5511 - CVE-2017-6497 - CVE-2017-6498 - CVE-2017-6499 - CVE-2017-6500 - CVE-2017-6501 - CVE-2017-6502 - CVE-2017-7275 - CVE-2017-7606 - CVE-2017-7619 - CVE-2017-7941 - CVE-2017-7942 - CVE-2017-7943 - CVE-2017-8343 - CVE-2017-8344 - CVE-2017-8345 - CVE-2017-8346 - CVE-2017-8347 - CVE-2017-8348 - CVE-2017-8349 - CVE-2017-8350 - CVE-2017-8351 - CVE-2017-8352 - CVE-2017-8353 - CVE-2017-8354 - CVE-2017-8355 - CVE-2017-8356 - CVE-2017-8357 - CVE-2017-8765 - CVE-2017-8830 - CVE-2017-9141 - CVE-2017-9142 - CVE-2017-9143 - CVE-2017-9144 - - - 2017-03-05 - 2017-05-25 - 2017-05-29 - - - - - samba -- remote code execution vulnerability - - - samba42 - 4.2.15 - - - samba43 - 4.3.14 - - - samba44 - 4.4.14 - - - samba45 - 4.5.10 - - - samba46 - 4.6.4 - - - - -

The samba project reports:

-
-

Remote code execution from a writable share.

-

All versions of Samba from 3.5.0 onwards are vulnerable to a remote - code execution vulnerability, allowing a malicious client to upload - a shared library to a writable share, and then cause the server to - load and execute it.

-
- - - - https://www.samba.org/samba/security/CVE-2017-7494.html - CVE-2017-7494 - - - 2017-05-24 - 2017-05-24 - - - - - NVIDIA UNIX driver -- multiple vulnerabilities in the kernel mode layer handler - - - nvidia-driver - 375.66 - - - - -

NVIDIA Unix security team reports:

-
-

NVIDIA GPU Display Driver contains vulnerabilities in the - kernel mode layer handler where not correctly validated user - input, NULL pointer dereference, and incorrect access control - may lead to denial of service or potential escalation of - privileges.

-
- - - - CVE-2017-0350 - CVE-2017-0351 - CVE-2017-0352 - http://nvidia.custhelp.com/app/answers/detail/a_id/4462 - - - 2017-05-15 - 2017-05-23 - - - - - miniupnpc -- integer signedness error - - - miniupnpc - 2.0.20170509 - - - - -

Tintinweb reports:

-
-

An integer signedness error was found in miniupnp's miniwget - allowing an unauthenticated remote entity typically located on the - local network segment to trigger a heap corruption or an access - violation in miniupnp's http response parser when processing a - specially crafted chunked-encoded response to a request for the - xml root description url.

-
- - - - CVE-2017-8798 - https://github.com/tintinweb/pub/tree/master/pocs/cve-2017-8798 - - - 2017-05-09 - 2017-05-22 - - - - - Wordpress -- multiple vulnerabilities - - - wordpress - fr-wordpress - 4.7.5,1 - - - de-wordpress - ja-wordpress - ru-wordpress - zh-wordpress-zh_CN - zh-wordpress-zh_TW - 4.7.5 - - - - -
-

WordPress versions 4.7.4 and earlier are affected by six security issues

-
    -
  • Insufficient redirect validation in the HTTP class.
    • -
  • Improper handling of post meta data values in the XML-RPC API.
    • -
  • Lack of capability checks for post meta data in the XML-RPC API.
    • -
  • A Cross Site Request Forgery (CRSF) vulnerability was discovered in the filesystem credentials dialog.
    • -
  • A cross-site scripting (XSS) vulnerability was discovered related to the Customizer.
    • -
-
- - - - https://wordpress.org/news/2017/05/wordpress-4-7-5/ - - - 2017-05-16 - 2017-05-21 - - - - - asterisk -- Memory exhaustion on short SCCP packets - - - asterisk13 - 13.15.1 - - - - -

The Asterisk project reports:

-
-

A remote memory exhaustion can be triggered by sending - an SCCP packet to Asterisk system with "chan_skinny" - enabled that is larger than the length of the SCCP header - but smaller than the packet length specified in the header. - The loop that reads the rest of the packet doesn't detect - that the call to read() returned end-of-file before the - expected number of bytes and continues infinitely. The - "partial data" message logging in that tight loop causes - Asterisk to exhaust all available memory.

-
- - - - http://downloads.asterisk.org/pub/security/AST-2017-004.html - - - 2017-04-13 - 2017-05-19 - - - - - asterisk -- Buffer Overrun in PJSIP transaction layer - - - asterisk13 - 13.15.1 - - - pjsip - 2.6_1 - - - pjsip-extsrtp - 2.6_1 - - - - -

The Asterisk project reports:

-
-

A remote crash can be triggered by sending a SIP packet - to Asterisk with a specially crafted CSeq header and a - Via header with no branch parameter. The issue is that - the PJSIP RFC 2543 transaction key generation algorithm - does not allocate a large enough buffer. By overrunning - the buffer, the memory allocation table becomes corrupted, - leading to an eventual crash.

-

The multi-part body parser in PJSIP contains a logical - error that can make certain multi-part body parts attempt - to read memory from outside the allowed boundaries. A - specially-crafted packet can trigger these invalid reads - and potentially induce a crash.

-

This issues is in PJSIP, and so the issue can be fixed - without performing an upgrade of Asterisk at all. However, - we are releasing a new version of Asterisk with the bundled - PJProject updated to include the fix.

-

If you are running Asterisk with chan_sip, this issue - does not affect you.

-
- - - - http://downloads.asterisk.org/pub/security/AST-2017-002.html - http://downloads.asterisk.org/pub/security/AST-2017-003.html - - - 2017-04-12 - 2017-05-19 - - - - - Joomla3 -- SQL Injection - - - joomla3 - 3.7.0 - - - - -

JSST reports:

-
-

Inadequate filtering of request data leads to a SQL Injection vulnerability.

-
- - - - CVE-2017-8917 - https://developer.joomla.org/security-centre/692-20170501-core-sql-injection.html - - - 2017-05-11 - 2017-05-18 - - - - - gitlab -- Various security issues - - - gitlab - 6.6.08.17.5 - 9.0.09.0.6 - 9.1.09.1.2 - - - - -

GitLab reports:

-
-

Please reference CVE/URL list for details

-
- - - - https://about.gitlab.com/2017/05/08/gitlab-9-dot-1-dot-3-security-release/ - - - 2017-05-08 - 2017-05-18 - 2017-05-30 - - - - - gitlab -- Various security issues - - - gitlab - 8.7.08.15.7 - 8.16.08.16.7 - 8.17.08.17.3 - - - - -

GitLab reports:

-
-

Information Disclosure in Issue and Merge Request Trackers

-

During an internal code review a critical vulnerability in the GitLab - Issue and Merge Request trackers was discovered. This vulnerability could - allow a user with access to assign ownership of an issue or merge request to - another user to disclose that user's private token, email token, email - address, and encrypted OTP secret. Reporter-level access to a GitLab project - is required to exploit this flaw.

-

SSRF when importing a project from a Repo by URL

-

GitLab instances that have enabled project imports using "Repo by URL" - were vulnerable to Server-Side Request Forgery attacks. By specifying a - project import URL of localhost an attacker could target services that are - bound to the local interface of the server. These services often do not - require authentication. Depending on the service an attacker might be able - craft an attack using the project import request URL.

-

Links in Environments tab vulnerable to tabnabbing

-

edio via HackerOne reported that user-configured Environment links - include target=_blank but do not also include rel: noopener - noreferrer. Anyone clicking on these links may therefore be subjected to - tabnabbing attacks where a link back to the requesting page is maintained - and can be manipulated by the target server.

-

Accounts with email set to "Do not show on profile" have addresses - exposed in public atom feed

-

Several GitLab users reported that even with "Do not show on profile" - configured for their email addresses those addresses were still being leaked - in Atom feeds if they commented on a public project.

-
- - - - CVE-2017-0882 - https://about.gitlab.com/2017/03/20/gitlab-8-dot-17-dot-4-security-release/ - - - 2017-03-20 - 2017-05-18 - 2017-05-30 - - - - - freetype2 -- buffer overflows - - - freetype2 - 2.8 - - - - -

Werner Lemberg reports:

-
-

CVE-2017-8105, CVE-2017-8287: Older FreeType versions have - out-of-bounds writes caused by heap-based buffer overflows - related to Type 1 fonts.

-
- - - - http://lists.nongnu.org/archive/html/freetype-announce/2017-05/msg00000.html - CVE-2017-8105 - CVE-2017-8287 - - - 2017-05-17 - 2017-05-17 - - - - - OpenVPN -- two remote denial-of-service vulnerabilities - - - openvpn - 2.3.15 - 2.4.02.4.2 - - - openvpn23 - 2.3.15 - - - openvpn-mbedtls - 2.4.02.4.2 - - - openvpn-polarssl - 2.3.15 - - - openvpn23-polarssl - 2.3.15 - - - - -

Samuli Seppänen reports:

-
-

OpenVPN v2.4.0 was audited for security vulnerabilities independently by - Quarkslabs (funded by OSTIF) and Cryptography Engineering (funded by - Private Internet Access) between December 2016 and April 2017. The - primary findings were two remote denial-of-service vulnerabilities. - Fixes to them have been backported to v2.3.15.

-

An authenticated client can do the 'three way handshake' - (P_HARD_RESET, P_HARD_RESET, P_CONTROL), where the P_CONTROL packet - is the first that is allowed to carry payload. If that payload is - too big, the OpenVPN server process will stop running due to an - ASSERT() exception. That is also the reason why servers using - tls-auth/tls-crypt are protected against this attack - the P_CONTROL - packet is only accepted if it contains the session ID we specified, - with a valid HMAC (challenge-response). (CVE-2017-7478)

-

An authenticated client can cause the server's the packet-id - counter to roll over, which would lead the server process to hit an - ASSERT() and stop running. To make the server hit the ASSERT(), the - client must first cause the server to send it 2^32 packets (at least - 196 GB).

-
- - - - https://openvpn.net/index.php/open-source/downloads.html - CVE-2017-7478 - CVE-2017-7479 - https://community.openvpn.net/openvpn/wiki/QuarkslabAndCryptographyEngineerAudits - https://ostif.org/?p=870&preview=true - https://www.privateinternetaccess.com/blog/2017/05/openvpn-2-4-2-fixes-critical-issues-discovered-openvpn-audit-reports/ - - - 2017-05-10 - 2017-05-11 - - - - - PostgreSQL vulnerabilities - - - postgresql92-client - 9.2.09.2.20 - - - postgresql93-client - 9.3.09.3.16 - - - postgresql94-client - 9.4.09.4.11 - - - postgresql95-client - 9.5.09.5.6 - - - postgresql96-client - 9.6.09.6.2 - - - postgresql92-server - 9.2.09.2.20 - - - postgresql93-server - 9.3.09.3.16 - - - postgresql94-server - 9.4.09.4.11 - - - postgresql95-server - 9.5.09.5.6 - - - postgresql96-server - 9.6.09.6.2 - - - - -

The PostgreSQL project reports:

-
-

- Security Fixes nested CASE expressions + - database and role names with embedded special characters -

-
    -
  • CVE-2017-7484: selectivity estimators bypass SELECT privilege - checks. -
    • -
  • CVE-2017-7485: libpq ignores PGREQUIRESSL environment variable -
    • -
  • CVE-2017-7486: pg_user_mappings view discloses foreign server - passwords. This applies to new databases, see the release notes for - the procedure to apply the fix to an existing database. -
    • -
-
- - - - CVE-2016-5423 - CVE-2016-5424 - - - 2017-05-11 - 2017-05-11 - - - - - kauth: Local privilege escalation - - - kdelibs - 4.14.30_4 - - - kf5-kauth - 5.33.0_1 - - - - -

Albert Astals Cid reports:

-
-

KAuth contains a logic flaw in which the service invoking dbus - is not properly checked. - This allows spoofing the identity of the caller and with some - carefully crafted calls can lead to gaining root from an - unprivileged account. -

-
- - - - CVE-2017-8422 - http://www.openwall.com/lists/oss-security/2017/05/10/3 - https://www.kde.org/info/security/advisory-20170510-1.txt - - - 2017-05-10 - 2017-05-10 - - - - - libetpan -- null dereference vulnerability in MIME parsing component - - - libetpan - 1.8 - - - - -

rwhitworth reports:

-
-

I was using American Fuzzy Lop (afl-fuzz) to fuzz input to the - mime-parse test program. Is fixing these crashes something you're - interested in? The input files can be found here: - https://github.com/rwhitworth/libetpan-fuzz/. - - The files can be executed as ./mime-parse id_filename to cause - seg faults.

-
- - - - CVE-2017-8825 - http://cve.circl.lu/cve/CVE-2017-8825 - - - 2017-04-29 - 2017-05-09 - - - - - chromium -- race condition vulnerability - - - chromium - 58.0.3029.96 - - - - -

Google Chrome Releases reports:

-
-

1 security fix in this release:

-
-
    -
  • [679306] High CVE-2017-5068: Race condition in WebRTC. Credit to - Philipp Hancke
    • -
- - - - CVE-2017-5068 - https://chromereleases.googleblog.com/2017/05/stable-channel-update-for-desktop.html - - - 2017-05-02 - 2017-05-03 - - - - - dovecot -- Dovecot DoS when passdb dict was used for authentication - - - dovecot - dovecot2 - 2.2.25_62.2.29 - - - - -

Timo Sirainen reports:

-
-

passdb/userdb dict: Don't double-expand %variables in keys. If dict - was used as the authentication passdb, using specially crafted - %variables in the username could be used to cause DoS.

-
- - - - CVE-2017-2669 - https://dovecot.org/list/dovecot-news/2017-April/000341.html - https://dovecot.org/list/dovecot-news/2017-April/000342.html - - - 2016-12-01 - 2017-04-30 - - - - - LibreSSL -- TLS verification vulnerability - - - libressl - 2.5.12.5.3_1 - - - libressl-devel - 2.5.12.5.3_1 - - - - -

Jakub Jirutka reports:

-
-

LibreSSL 2.5.1 to 2.5.3 lacks TLS certificate verification if - SSL_get_verify_result is relied upon for a later check of a - verification result, in a use case where a user-provided verification - callback returns 1, as demonstrated by acceptance of invalid - certificates by nginx. -

-
- - - - http://seclists.org/oss-sec/2017/q2/145 - https://github.com/libressl-portable/portable/issues/307 - CVE-2017-8301 - - - 2017-04-27 - 2017-04-28 - - - - - jenkins -- multiple vulnerabilities - - - jenkins - 2.57 - - - jenkins-lts - 2.46.2 - - - - -

Jenkins Security Advisory:

-
-

Description

-
SECURITY-412 through SECURITY-420 / CVE-2017-1000356
-

CSRF: Multiple vulnerabilities

-
SECURITY-429 / CVE-2017-1000353
-

CLI: Unauthenticated remote code execution

-
SECURITY-466 / CVE-2017-1000354
-

CLI: Login command allowed impersonating any Jenkins user

-
SECURITY-503 / CVE-2017-1000355
-

XStream: Java crash when trying to instantiate void/Void

-
- - - - CVE-2017-1000356 - CVE-2017-1000353 - CVE-2017-1000354 - CVE-2017-1000355 - https://jenkins.io/security/advisory/2017-04-26/ - - - 2017-04-26 - 2017-04-27 - - - - - codeigniter -- multiple vulnerabilities - - - codeigniter - 3.1.4 - - - - -

The CodeIgniter changelog reports:

-
-

Fixed a header injection vulnerability in common function - set_status_header() under Apache (thanks to Guillermo Caminer from - Flowgate).

-

Fixed byte-safety issues in Encrypt Library (DEPRECATED) when - mbstring.func_overload is enabled.

-

Fixed byte-safety issues in Encryption Library when - mbstring.func_overload is enabled.

-

Fixed byte-safety issues in compatibility functions - password_hash(), hash_pbkdf2() when mbstring.func_overload is - enabled.

-

Updated Encrypt Library (DEPRECATED) to call mcrypt_create_iv() - with MCRYPT_DEV_URANDOM.

-
- - - - https://www.codeigniter.com/user_guide/changelog.html - - - 2017-03-23 - 2017-04-25 - - - - - weechat -- multiple vulnerabilities - - - weechat - 1.7.1 - - - - -

Common Vulnerabilities and Exposures:

-
-

WeeChat before 1.7.1 allows a remote crash by sending a filename via DCC to - the IRC plugin. This occurs in the irc_ctcp_dcc_filename_without_quotes - function during quote removal, with a buffer overflow.

-
- - - - https://weechat.org/download/security/ - CVE-2017-8073 - - - 2017-04-23 - 2017-04-24 - - - - - drupal8 -- Drupal Core - Critical - Access Bypass - - - drupal8 - 8.3.1 - - - - -

Drupal Security Team Reports:

-
-

CVE-2017-6919: Access bypass

-
- - - - CVE-2017-6919 - - - 2017-04-19 - 2017-04-21 - - - - - chromium -- multiple vulnerabilities - - - chromium - chromium-pulse - 58.0.3029.81 - - - - -

Google Chrome Releases reports:

-
-

29 security fixes in this release, including:

-
    -
  • [695826] High CVE-2017-5057: Type confusion in PDFium. Credit to - Guang Gong of Alpha Team, Qihoo 360
    • -
  • [694382] High CVE-2017-5058: Heap use after free in Print Preview. - Credit to Khalil Zhani
    • -
  • [684684] High CVE-2017-5059: Type confusion in Blink. Credit to - SkyLined working with Trend Micro's Zero Day Initiative
    • -
  • [683314] Medium CVE-2017-5060: URL spoofing in Omnibox. Credit to - Xudong Zheng
    • -
  • [672847] Medium CVE-2017-5061: URL spoofing in Omnibox. Credit to - Haosheng Wang (@gnehsoah)
    • -
  • [702896] Medium CVE-2017-5062: Use after free in Chrome Apps. - Credit to anonymous
    • -
  • [700836] Medium CVE-2017-5063: Heap overflow in Skia. Credit to - Sweetchip
    • -
  • [693974] Medium CVE-2017-5064: Use after free in Blink. Credit to - Wadih Matar
    • -
  • [704560] Medium CVE-2017-5065: Incorrect UI in Blink. Credit to - Khalil Zhani
    • -
  • [690821] Medium CVE-2017-5066: Incorrect signature handing in Networking. - Credit to Prof. Zhenhua Duan, Prof. Cong Tian, and Ph.D candidate Chu Chen - (ICTT, Xidian University)
    • -
  • [648117] Medium CVE-2017-5067: URL spoofing in Omnibox. Credit to - Khalil Zhani
    • -
  • [691726] Low CVE-2017-5069: Cross-origin bypass in Blink. Credit to - Michael Reizelman
    • -
  • [713205] Various fixes from internal audits, fuzzing and other initiatives
    • -
-
- - - - CVE-2017-5057 - CVE-2017-5058 - CVE-2017-5059 - CVE-2017-5060 - CVE-2017-5061 - CVE-2017-5062 - CVE-2017-5063 - CVE-2017-5064 - CVE-2017-5065 - CVE-2017-5066 - CVE-2017-5067 - CVE-2017-5069 - https://chromereleases.googleblog.com/2017/04/stable-channel-update-for-desktop.html - - - 2017-04-19 - 2017-04-21 - - - - - icu -- multiple vulnerabilities - - - icu - 58.2_2,1 - - - linux-c6-icu - linux-c7-icu - 59.0 - - - - -

NVD reports:

-
-

International Components for Unicode (ICU) for C/C++ - before 2017-02-13 has an out-of-bounds write caused by a - heap-based buffer overflow related to the utf8TextAccess - function in common/utext.cpp and the utext_setNativeIndex* - function.

-
-
-

International Components for Unicode (ICU) for C/C++ - before 2017-02-13 has an out-of-bounds write caused by a - heap-based buffer overflow related to the utf8TextAccess - function in common/utext.cpp and the utext_moveIndex32* - function.

-
- - - - CVE-2017-7867 - CVE-2017-7868 - http://bugs.icu-project.org/trac/changeset/39671 - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=437 - - - 2017-01-21 - 2017-04-20 - 2017-05-04 - - - - - tiff -- multiple vulnerabilities - - - tiff - linux-f8-tiff - linux-f10-tiff - linux-c6-tiff - linux-c7-tiff - 4.0.8 - - - - -

NVD reports:

-
-

Please reference CVE/URL list for details

-
- - - - CVE-2017-5225 - CVE-2017-7592 - CVE-2017-7593 - CVE-2017-7594 - CVE-2017-7595 - CVE-2017-7596 - CVE-2017-7597 - CVE-2017-7598 - CVE-2017-7599 - CVE-2017-7600 - CVE-2017-7601 - CVE-2017-7602 - https://github.com/vadz/libtiff/commit/5c080298d59e - https://github.com/vadz/libtiff/commit/48780b4fcc42 - https://github.com/vadz/libtiff/commit/d60332057b95 - https://github.com/vadz/libtiff/commit/2ea32f7372b6 - https://github.com/vadz/libtiff/commit/8283e4d1b7e5 - https://github.com/vadz/libtiff/commit/47f2fb61a3a6 - https://github.com/vadz/libtiff/commit/3cfd62d77c2a - https://github.com/vadz/libtiff/commit/3144e57770c1 - https://github.com/vadz/libtiff/commit/0a76a8c765c7 - https://github.com/vadz/libtiff/commit/66e7bd595209 - - - 2017-04-01 - 2017-04-20 - - - - - libsamplerate -- multiple vulnerabilities - - - libsamplerate - linux-c6-libsamplerate - linux-c7-libsamplerate - 0.1.9 - - - - -

NVD reports:

-
-

In libsamplerate before 0.1.9, a buffer over-read - occurs in the calc_output_single function in src_sinc.c - via a crafted audio file.

-
- - - - CVE-2017-7697 - https://github.com/erikd/libsamplerate/commit/c3b66186656d - - - 2017-04-11 - 2017-04-20 - - - - - libsndfile -- multiple vulnerabilities - - - libsndfile - linux-c6-libsndfile - linux-c7-libsndfile - 1.0.28_2 - - - - -

NVD reports:

-
-

In libsndfile before 1.0.28, an error in the - "flac_buffer_copy()" function (flac.c) can be exploited to - cause a stack-based buffer overflow via a specially crafted - FLAC file.

-
-
-

In libsndfile before 1.0.28, an error in the - "header_read()" function (common.c) when handling ID3 tags - can be exploited to cause a stack-based buffer overflow - via a specially crafted FLAC file.

-
-
-

In libsndfile before 1.0.28, an error in the - "flac_buffer_copy()" function (flac.c) can be exploited to - cause a segmentation violation (with write memory access) - via a specially crafted FLAC file during a resample - attempt, a similar issue to CVE-2017-7585.

-
-
-

In libsndfile before 1.0.28, an error in the - "flac_buffer_copy()" function (flac.c) can be exploited to - cause a segmentation violation (with read memory access) - via a specially crafted FLAC file during a resample - attempt, a similar issue to CVE-2017-7585.

-
- - - - CVE-2017-7585 - CVE-2017-7586 - CVE-2017-7741 - CVE-2017-7742 - https://github.com/erikd/libsndfile/commit/60b234301adf - https://github.com/erikd/libsndfile/commit/708e996c87c5 - https://github.com/erikd/libsndfile/commit/f457b7b5ecfe - https://github.com/erikd/libsndfile/commit/60b234301adf - - - 2017-04-07 - 2017-04-20 - - - - - cURL -- TLS session resumption client cert bypass (again) - - - curl - 7.52.07.54.0 - - - - -

cURL security advisory:

-
-

libcurl would attempt to resume a TLS session even if the client - certificate had changed. That is unacceptable since a server by - specification is allowed to skip the client certificate check on - resume, and may instead use the old identity which was established - by the previous certificate (or no certificate).

-

libcurl supports by default the use of TLS session id/ticket to - resume previous TLS sessions to speed up subsequent TLS handshakes. - They are used when for any reason an existing TLS connection - couldn't be kept alive to make the next handshake faster.

-

This flaw is a regression and identical to CVE-2016-5419 reported - on August 3rd 2016, but affecting a different version range.

-
- - - - CVE-2017-7468 - https://curl.haxx.se/docs/adv_20170419.html - - - 2017-04-19 - 2017-04-20 - - - - - graphite2 -- out-of-bounds write with malicious font - - - graphite2 - 1.3.9_1 - - - linux-c7-graphite2 - 1.3.10 - - - - -

Mozilla Foundation reports:

-
-

An out-of-bounds write in the Graphite 2 library - triggered with a maliciously crafted Graphite font. This - results in a potentially exploitable crash. This issue was - fixed in the Graphite 2 library as well as Mozilla - products.

-
- - - - CVE-2017-5436 - https://github.com/silnrsi/graphite/commit/1ce331d5548b - - - 2017-04-19 - 2017-04-19 - 2017-04-20 - - - - - libevent -- multiple vulnerabilities - - - libevent - libevent2 - linux-c6-libevent2 - linux-c7-libevent - 2.1.6 - - - - -

Debian Security reports:

-
-

CVE-2016-10195: The name_parse function in evdns.c in - libevent before 2.1.6-beta allows remote attackers to have - unspecified impact via vectors involving the label_len - variable, which triggers an out-of-bounds stack read.

-

CVE-2016-10196: Stack-based buffer overflow in the - evutil_parse_sockaddr_port function in evutil.c in libevent - before 2.1.6-beta allows attackers to cause a denial of - service (segmentation fault) via vectors involving a long - string in brackets in the ip_as_string argument.

-

CVE-2016-10197: The search_make_new function in evdns.c - in libevent before 2.1.6-beta allows attackers to cause a - denial of service (out-of-bounds read) via an empty - hostname.

-
- - - - CVE-2016-10195 - CVE-2016-10196 - CVE-2016-10197 - http://www.openwall.com/lists/oss-security/2017/01/31/17 - https://github.com/libevent/libevent/issues/317 - https://github.com/libevent/libevent/issues/318 - https://github.com/libevent/libevent/issues/332 - https://github.com/libevent/libevent/issues/335 - - - 2017-01-31 - 2017-04-19 - - - - - NSS -- multiple vulnerabilities - - - nss - linux-f10-nss - linux-c6-nss - linux-c7-nss - 3.303.30.1 - 3.293.29.5 - 3.223.28.4 - 3.21.4 - - - - -

Mozilla Foundation reports:

-
-

An out-of-bounds write during Base64 decoding operation - in the Network Security Services (NSS) library due to - insufficient memory being allocated to the buffer. This - results in a potentially exploitable crash. The NSS library - has been updated to fix this issue to address this issue and - Firefox 53 has been updated with NSS version 3.29.5.

-
-
-

A flaw in DRBG number generation within the Network - Security Services (NSS) library where the internal state V - does not correctly carry bits over. The NSS library has been - updated to fix this issue to address this issue and Firefox - 53 has been updated with NSS version 3.29.5.

-
- - - - CVE-2017-5461 - CVE-2017-5462 - https://hg.mozilla.org/projects/nss/rev/99a86619eac9 - https://hg.mozilla.org/projects/nss/rev/e126381a3c29 - - - 2017-03-17 - 2017-04-19 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 53.0_2,1 - - - seamonkey - linux-seamonkey - 2.49.1 - - - firefox-esr - 46.0,152.1.0_2,1 - 45.9.0,1 - - - linux-firefox - 46.0,252.1.0,2 - 45.9.0,2 - - - libxul - 46.052.1.0 - 45.9.0 - - - thunderbird - linux-thunderbird - 46.052.1.0 - 45.9.0 - - - - -

Mozilla Foundation reports:

-
-

Please reference CVE/URL list for details

-
- - - - CVE-2017-5433 - CVE-2017-5435 - CVE-2017-5436 - CVE-2017-5461 - CVE-2017-5459 - CVE-2017-5466 - CVE-2017-5434 - CVE-2017-5432 - CVE-2017-5460 - CVE-2017-5438 - CVE-2017-5439 - CVE-2017-5440 - CVE-2017-5441 - CVE-2017-5442 - CVE-2017-5464 - CVE-2017-5443 - CVE-2017-5444 - CVE-2017-5446 - CVE-2017-5447 - CVE-2017-5465 - CVE-2017-5448 - CVE-2017-5437 - CVE-2017-5454 - CVE-2017-5455 - CVE-2017-5456 - CVE-2017-5469 - CVE-2017-5445 - CVE-2017-5449 - CVE-2017-5450 - CVE-2017-5451 - CVE-2017-5462 - CVE-2017-5463 - CVE-2017-5467 - CVE-2017-5452 - CVE-2017-5453 - CVE-2017-5458 - CVE-2017-5468 - CVE-2017-5430 - CVE-2017-5429 - https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/ - https://www.mozilla.org/en-US/security/advisories/mfsa2017-11/ - https://www.mozilla.org/en-US/security/advisories/mfsa2017-12/ - - - 2017-04-19 - 2017-04-19 - 2017-09-19 - - - - - MySQL -- multiple vulnerabilities - - - mariadb55-server - 5.5.55 - - - mariadb100-server - 10.0.31 - - - mariadb101-server - 10.1.23 - - - mysql55-server - 5.5.55 - - - mysql56-server - 5.6.36 - - - mysql57-server - 5.7.18 - - - - -

Oracle reports:

-
-

This Critical Patch Update contains 39 new security fixes for - Oracle MySQL. 11 of these vulnerabilities may be remotely - exploitable without authentication, i.e., may be exploited over a - network without requiring user credentials.

-
- - - - http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html - CVE-2017-3308 - CVE-2017-3309 - CVE-2017-3450 - CVE-2017-3599 - CVE-2017-3329 - CVE-2017-3600 - CVE-2017-3331 - CVE-2017-3453 - CVE-2017-3452 - CVE-2017-3454 - CVE-2017-3455 - CVE-2017-3305 - CVE-2017-3460 - CVE-2017-3456 - CVE-2017-3458 - CVE-2017-3457 - CVE-2017-3459 - CVE-2017-3463 - CVE-2017-3462 - CVE-2017-3461 - CVE-2017-3464 - CVE-2017-3465 - CVE-2017-3467 - CVE-2017-3468 - - - 2017-04-19 - 2017-04-19 - - - - - BIND -- multiple vulnerabilities - - - bind99 - 9.9.9P8 - - - bind910 - 9.10.4P8 - - - bind911 - 9.11.0P5 - - - bind9-devel - 9.12.0.a.2017.03.25 - - - - -

ISC reports:

-
-

A query with a specific set of characteristics could - cause a server using DNS64 to encounter an assertion - failure and terminate.

-

An attacker could deliberately construct a query, - enabling denial-of-service against a server if it - was configured to use the DNS64 feature and other - preconditions were met.

-
-
-

Mistaken assumptions about the ordering of records in - the answer section of a response containing CNAME or - DNAME resource records could lead to a situation in - which named would exit with an assertion failure when - processing a response in which records occurred in an - unusual order.

-
-
-

named contains a feature which allows operators to - issue commands to a running server by communicating - with the server process over a control channel, - using a utility program such as rndc.

-

A regression introduced in a recent feature change - has created a situation under which some versions of - named can be caused to exit with a REQUIRE assertion - failure if they are sent a null command string.

-
- - - - CVE-2017-3136 - CVE-2017-3137 - CVE-2017-3138 - https://kb.isc.org/article/AA-01465/0 - https://kb.isc.org/article/AA-01466/0 - https://kb.isc.org/article/AA-01471/0 - - - 2017-04-12 - 2017-04-13 - 2017-04-13 - - - - - id Tech 3 -- remote code execution vulnerability - - - ioquake3 - 1.36_16 - - - ioquake3-devel - g2930 - - - iourbanterror - 4.3.2,1 - - - openarena - 0.8.8.s1910_3,1 - - - - -

The content auto-download of id Tech 3 can be used to deliver - maliciously crafted content, that triggers downloading of - further content and loading and executing it as native code - with user credentials. This affects ioquake3, ioUrbanTerror, - OpenArena, the original Quake 3 Arena and other forks.

- - - - CVE-2017-6903 - https://ioquake3.org/2017/03/13/important-security-update-please-update-ioquake3-immediately/ - - - 2017-03-14 - 2017-04-07 - - - - - xen-kernel -- broken check in memory_exchange() permits PV guest breakout - - - xen-kernel - 4.7.2_1 - - - - -

The Xen Project reports:

-
-

The XSA-29 fix introduced an insufficient check on XENMEM_exchange - input, allowing the caller to drive hypervisor memory accesses - outside of the guest provided input/output arrays.

-

A malicious or buggy 64-bit PV guest may be able to access all of - system memory, allowing for all of privilege escalation, host - crashes, and information leaks.

-
- - - - CVE-2017-7228 - https://xenbits.xen.org/xsa/advisory-212.html - - - 2017-04-04 - 2017-04-06 - - - - - cURL -- potential memory disclosure - - - curl - 6.57.53.1_1 - - - - -

The cURL project reports:

-
-

There were two bugs in curl's parser for the command line option - --write-out (or -w for short) that would skip the end of string - zero byte if the string ended in a % (percent) or \ (backslash), - and it would read beyond that buffer in the heap memory and it - could then potentially output pieces of that memory to the - terminal or the target file etc..

-

This flaw only exists in the command line tool.

-

We are not aware of any exploit of this flaw.

-
- - - - https://curl.haxx.se/docs/adv_20170403.html - CVE-2017-7407 - - - 2017-04-03 - 2017-04-05 - 2017-04-06 - - - - - django -- multiple vulnerabilities - - - py27-django - py33-django - py34-django - py35-django - py36-django - 1.8.18 - - - py27-django18 - py33-django18 - py34-django18 - py35-django18 - py36-django18 - 1.8.18 - - - py27-django19 - py33-django19 - py34-django19 - py35-django19 - py36-django19 - 1.9.13 - - - py27-django110 - py33-django110 - py34-django110 - py35-django110 - py36-django110 - 1.10.7 - - - - -

Django team reports:

-
-

These release addresses two security issues detailed below. We - encourage all users of Django to upgrade as soon as possible.

-
    -
  • Open redirect and possible XSS attack via user-supplied numeric - redirect URLs
    • -
  • Open redirect vulnerability in django.views.static.serve()
    • -
-
- - - - https://www.djangoproject.com/weblog/2017/apr/04/security-releases/ - CVE-2017-7233 - CVE-2017-7234 - - - 2017-04-04 - 2017-04-04 - - - - - asterisk -- Buffer overflow in CDR's set user - - - asterisk13 - 13.14.1 - - - - -

The Asterisk project reports:

-
-

No size checking is done when setting the user field - on a CDR. Thus, it is possible for someone to use an - arbitrarily large string and write past the end of the - user field storage buffer. This allows the possibility - of remote code injection.

-
- - - - http://downloads.asterisk.org/pub/security/AST-2017-001.html - https://issues.asterisk.org/jira/browse/ASTERISK-26897 - - - 2017-03-27 - 2017-04-04 - - - - - NVIDIA UNIX driver -- multiple vulnerabilities in the kernel mode layer handler - - - nvidia-driver - 375.39 - - - nvidia-driver-340 - 340.102 - - - nvidia-driver-304 - 304.135 - - - - -

NVIDIA Unix security team reports:

-
-

NVIDIA GPU Display Driver contains vulnerabilities in the - kernel mode layer handler where multiple integer overflows, - improper access control, and improper validation of a user - input may cause a denial of service or potential escalation - of privileges.

-
- - - - CVE-2017-0309 - CVE-2017-0310 - CVE-2017-0311 - CVE-2017-0318 - CVE-2017-0321 - http://nvidia.custhelp.com/app/answers/detail/a_id/4398 - - - 2017-02-14 - 2017-04-04 - - - - - chromium -- multiple vulnerabilities - - - chromium - chromium-npapi - chromium-pulse - 57.0.2987.133 - - - - -

Google Chrome Releases reports:

-
-

5 security fixes in this release, including:

-
    -
  • [698622] Critical CVE-2017-5055: Use after free in printing. Credit to - Wadih Matar
    • -
  • [699166] High CVE-2017-5054: Heap buffer overflow in V8. Credit to - Nicolas Trippar of Zimperium zLabs
    • -
  • [662767] High CVE-2017-5052: Bad cast in Blink. Credit to - JeongHoon Shin
    • -
  • [705445] High CVE-2017-5056: Use after free in Blink. Credit to - anonymous
    • -
  • [702058] High CVE-2017-5053: Out of bounds memory access in V8. Credit to - Team Sniper (Keen Lab and PC Mgr) reported through ZDI (ZDI-CAN-4587)
    • -
-
- - - - CVE-2017-5055 - CVE-2017-5054 - CVE-2017-5052 - CVE-2017-5056 - CVE-2017-5053 - https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop_29.html - - - 2017-03-29 - 2017-03-30 - - - - - xen-tools -- xenstore denial of service via repeated update - - - xen-tools - 4.7.2_1 - - - - -

The Xen Project reports:

-
-

Unprivileged guests may be able to stall progress of the control - domain or driver domain, possibly leading to a Denial of Service - (DoS) of the entire host.

-
- - - - http://xenbits.xen.org/xsa/advisory-206.html - - - 2017-03-28 - 2017-03-30 - - - - - phpMyAdmin -- bypass 'no password' restriction - - - phpMyAdmin - 4.7.0 - - - - -

The phpMyAdmin team reports:

-
-

Summary

-

Bypass $cfg['Servers'][$i]['AllowNoPassword']

-

Description

-

A vulnerability was discovered where the restrictions - caused by $cfg['Servers'][$i]['AllowNoPassword'] = false are - bypassed under certain PHP versions. This can allow the - login of users who have no password set even if the - administrator has set $cfg['Servers'][$i]['AllowNoPassword'] - to false (which is also the default).

-

This behavior depends on the PHP version used (it seems - PHP 5 is affected, while PHP 7.0 is not).

-

Severity

-

We consider this vulnerability to be of moderate severity.

-

Mitigation factor

-

Set a password for all users.

-
- - - - https://www.phpmyadmin.net/security/PMASA-2017-8/ - - - 2017-03-28 - 2017-03-29 - - - - - - - - - samba -- symlink race allows access outside share definition - - - samba36 - 3.6.03.6.25_4 - - - samba4 - 4.0.04.0.26 - - - samba41 - 4.1.04.1.23 - - - samba42 - 4.2.04.2.14 - - - samba43 - 4.3.04.3.13 - - - samba44 - 4.4.04.4.12 - - - samba45 - 4.5.04.5.7 - - - samba46 - 4.6.04.6.1 - - - - -

Samba team reports:

-
-

A time-of-check, time-of-use race condition - can allow clients to access non-exported parts - of the file system via symlinks.

-
- - - - https://www.samba.org/samba/security/CVE-2017-2619.html - CVE-2017-2619 - - - 2017-03-23 - 2017-03-24 - - - - - xen-tools -- Cirrus VGA Heap overflow via display refresh - - - xen-tools - 4.7.2 - - - - -

The Xen Project reports:

-
-

A privileged user within the guest VM can cause a heap overflow in - the device model process, potentially escalating their privileges to - that of the device model process.

-
- - - - CVE-2016-9603 - http://xenbits.xen.org/xsa/advisory-211.html - - - 2017-03-14 - 2017-03-23 - - - - - irssi -- use-after-free potential code execution - - - irssi - 0.8.21,11.0.2,1 - - - - -

The irssi project reports:

-
-

Use after free while producing list of netjoins (CWE-416). - This issue was found and reported to us by APic. - This issue usually leads to segmentation faults. - Targeted code execution should be difficult.

-
- - - - https://irssi.org/security/irssi_sa_2017_03.txt - CVE-2017-7191 - - - 2017-03-11 - 2017-03-18 - - - - - mysql -- denial of service vulnerability - - - mariadb55-client - 5.5.54 - - - mariadb100-client - 10.0.30 - - - mariadb101-client - 10.1.22 - - - mysql55-client - 5.5.54 - - - mysql56-client - 5.6.21 - - - mysql57-client - 5.7.5 - - - - -

Openwall reports:

-
-

C client library for MySQL (libmysqlclient.so) has - use-after-free defect which can cause crash of applications - using that MySQL client.

-
- - - - http://www.openwall.com/lists/oss-security/2017/02/11/11 - CVE-2017-3302 - - - 2017-01-27 - 2017-03-18 - - - - - firefox -- integer overflow in createImageBitmap() - - - firefox - 52.0.1,1 - - - - -

The Mozilla Foundation reports:

-
-

An integer overflow in createImageBitmap() was reported - through the Pwn2Own contest. The fix for this vulnerability - disables the experimental extensions to the - createImageBitmap API. This function runs in the content - sandbox, requiring a second vulnerability to compromise a - user's computer.

-
- - - - CVE-2017-5428 - https://www.mozilla.org/security/advisories/mfsa2017-08/ - - - 2017-03-17 - 2017-03-18 - - - - - moodle -- multiple vulnerabilities - - - moodle29 - 2.9.9 - - - moodle30 - 3.0.9 - - - moodle31 - 3.1.5 - - - moodle32 - 3.2.2 - - - - -

Marina Glancy reports:

-
-

In addition to a number of bug fixes and small improvements, - security vulnerabilities have been discovered and fixed. We highly - recommend that you upgrade your sites as soon as possible. - Upgrading should be very straightforward. As per our usual policy, - admins of all registered Moodle sites will be notified of security - issue details directly via email and we'll publish details more - widely in a week.

-
- - - - https://moodle.org/news/#p1408104 - - - 2017-03-13 - 2017-03-18 - - - - - moodle -- multiple vulnerabilities - - - moodle29 - 2.9.9 - - - moodle30 - 3.0.8 - - - moodle31 - 3.1.4 - - - moodle32 - 3.2.1 - - - - -

Marina Glancy reports:

-
-
    -

  • MSA-17-0001: System file inclusion when adding own preset - file in Boost theme

    • -

  • MSA-17-0002: Incorrect sanitation of attributes in forums -

    • -

  • MSA-17-0003: PHPMailer vulnerability in no-reply address -

    • -

  • MSA-17-0004: XSS in assignment submission page

    • -
-
- - - - CVE-2017-2576 - CVE-2017-2578 - CVE-2016-10045 - https://moodle.org/security/ - - - 2017-01-17 - 2017-03-18 - 2020-06-24 - - - - - drupal8 -- multiple vulnerabilities - - - drupal8 - 8.2.7 - - - - -

Drupal Security Team reports:

-
-

CVE-2017-6377: Editor module incorrectly checks access to inline private files

-

CVE-2017-6379: Some admin paths were not protected with a CSRF token

-

CVE-2017-6381: Remote code execution

-
- - - - CVE-2017-6377 - CVE-2017-6379 - CVE-2017-6381 - https://www.drupal.org/SA-2017-001 - - - 2017-03-15 - 2017-03-17 - - - - - PuTTY -- integer overflow permits memory overwrite by forwarded ssh-agent connections - - - putty - 0.68 - - - - -

Simon G. Tatham reports:

-
-

Many versions of PuTTY prior to 0.68 have a heap-corrupting integer - overflow bug in the ssh_agent_channel_data function which processes - messages sent by remote SSH clients to a forwarded agent connection. [...]

-

This bug is only exploitable at all if you have enabled SSH - agent forwarding, which is turned off by default. Moreover, an - attacker able to exploit this bug would have to have already be able - to connect to the Unix-domain socket representing the forwarded - agent connection. Since any attacker with that capability would - necessarily already be able to generate signatures with your agent's - stored private keys, you should in normal circumstances be defended - against this vulnerability by the same precautions you and your - operating system were already taking to prevent untrusted people - from accessing your SSH agent.

-
- - - - http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-agent-fwd-overflow.html - CVE-2017-6542 - - - 2017-01-29 - 2017-03-16 - - - - - Flash Player -- multiple vulnerabilities - - - linux-flashplayer - 25.0.0.127 - - - - -

Adobe reports:

-
-
    -
  • These updates resolve a buffer overflow vulnerability that - could lead to code execution (CVE-2017-2997).
    • -
  • These updates resolve memory corruption vulnerabilities that - could lead to code execution (CVE-2017-2998, CVE-2017-2999).
    • -
  • These updates resolve a random number generator vulnerability - used for constant blinding that could lead to information - disclosure (CVE-2017-3000).
    • -
  • These updates resolve use-after-free vulnerabilities that - could lead to code execution (CVE-2017-3001, CVE-2017-3002, - CVE-2017-3003).
    • -
-
- - - - CVE-2017-2997 - CVE-2017-2998 - CVE-2017-2999 - CVE-2017-3000 - CVE-2017-3001 - CVE-2017-3002 - CVE-2017-3003 - https://helpx.adobe.com/security/products/flash-player/apsb17-07.html - - - 2017-03-14 - 2017-03-16 - - - - - mbed TLS (PolarSSL) -- multiple vulnerabilities - - - mbedtls - 2.4.2 - - - polarssl13 - 1.3.19 - - - - -

Janos Follath reports:

-
-
    -
  • If a malicious peer supplies a certificate with a specially - crafted secp224k1 public key, then an attacker can cause the - server or client to attempt to free block of memory held on - stack. Depending on the platform, this could result in a Denial - of Service (client crash) or potentially could be exploited to - allow remote code execution with the same privileges as the host - application.
    • -
  • If the client and the server both support MD5 and the client - can be tricked to authenticate to a malicious server, then the - malicious server can impersonate the client. To launch this man - in the middle attack, the adversary has to compute a - chosen-prefix MD5 collision in real time. This is very expensive - computationally, but can be practical. Depending on the - platform, this could result in a Denial of Service (client crash) - or potentially could be exploited to allow remote code execution - with the same privileges as the host application.
    • -
  • A bug in the logic of the parsing of a PEM encoded Certificate - Revocation List in mbedtls_x509_crl_parse() can result in an - infinite loop. In versions before 1.3.10 the same bug results in - an infinite recursion stack overflow that usually crashes the - application. Methods and means of acquiring the CRLs is not part - of the TLS handshake and in the strict TLS setting this - vulnerability cannot be triggered remotely. The vulnerability - cannot be triggered unless the application explicitly calls - mbedtls_x509_crl_parse() or mbedtls_x509_crl_parse_file()on a PEM - formatted CRL of untrusted origin. In which case the - vulnerability can be exploited to launch a denial of service - attack against the application.
    • -
-
- - - - https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2017-01 - - - 2017-03-11 - 2017-03-12 - - - - - chromium -- multiple vulnerabilities - - - chromium - chromium-npapi - chromium-pulse - 57.0.2987.98 - - - - -

Google Chrome Releases reports:

-
-

36 security fixes in this release

-

Please reference CVE/URL list for details

-
- - - - CVE-2017-5030 - CVE-2017-5031 - CVE-2017-5032 - CVE-2017-5029 - CVE-2017-5034 - CVE-2017-5035 - CVE-2017-5036 - CVE-2017-5037 - CVE-2017-5039 - CVE-2017-5040 - CVE-2017-5041 - CVE-2017-5033 - CVE-2017-5042 - CVE-2017-5038 - CVE-2017-5043 - CVE-2017-5044 - CVE-2017-5045 - CVE-2017-5046 - https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html - - - 2017-03-09 - 2017-03-12 - - - - - Several Security Defects in the Bouncy Castle Crypto APIs - - - bouncycastle15 - 1.511.56 - - - - -

The Legion of the Bouncy Castle reports:

-
-

Release: 1.56

-

2.1.4 Security Related Changes and CVE's Addressed by this Release: (multiple)

-
- - - - ports/215507 - https://www.bouncycastle.org/releasenotes.html - - - 2016-12-23 - 2017-03-12 - - - - - kde-runtime -- kdesu: displayed command truncated by unicode string terminator - - - kde-runtime - 4.14.3_5 - - - - -

Albert Aastals Cid reports:

-
-

A maliciously crafted command line for kdesu can result in the - user only seeing part of the commands that will actually get executed - as super user.

-
- - - - CVE-2016-7787 - http://www.openwall.com/lists/oss-security/2016/09/29/7 - https://www.kde.org/info/security/advisory-20160930-1.txt - - - 2016-09-30 - 2017-03-11 - - - - - kdepimlibs -- directory traversal on KTNEF - - - kdepimlibs - 4.14.10_7 - - - - -

Albert Aastals Cid reports:

-
-

A directory traversal issue was found in KTNEF which can be - exploited by tricking a user into opening a malicious winmail.dat - file. The issue allows to write files with the permission of the user - opening the winmail.dat file during extraction.

-
- - - - https://www.kde.org/info/security/advisory-20170227-1.txt - - - 2017-02-27 - 2017-03-11 - - - - - kio: Information Leak when accessing https when using a malicious PAC file - - - kdelibs - 4.14.29_10 - - - kf5-kio - 5.31.0_1 - - - - -

Albert Astals Cid reports:

-
-

Using a malicious PAC file, and then using exfiltration methods in the PAC - function FindProxyForURL() enables the attacker to expose full https URLs.

-

This is a security issue since https URLs may contain sensitive - information in the URL authentication part (user:password@host), and in the - path and the query (e.g. access tokens).

-

This attack can be carried out remotely (over the LAN) since proxy settings - allow "Detect Proxy Configuration Automatically". - This setting uses WPAD to retrieve the PAC file, and an attacker who has access - to the victim's LAN can interfere with the WPAD protocols (DHCP/DNS+HTTP) - and inject his/her own malicious PAC instead of the legitimate one.

-
- - - - https://www.kde.org/info/security/advisory-20170228-1.txt - - - 2017-02-28 - 2017-03-11 - - - - - wordpress -- multiple vulnerabilities - - - wordpress - 4.7.3,1 - - - de-wordpress - ja-wordpress - ru-wordpress - zh-wordpress-zh_CN - zh-wordpress-zh_TW - 4.7.3 - - - - -
-

WordPress versions 4.7.2 and earlier are affected by six security issues.

-
    -
  • Cross-site scripting (XSS) via media file metadata.
    • -
  • Control characters can trick redirect URL validation.
    • -
  • Unintended files can be deleted by administrators using the - plugin deletion functionality.
    • -
  • Cross-site scripting (XSS) via video URL in YouTube embeds.
    • -
  • Cross-site scripting (XSS) via taxonomy term names.
    • -
  • Cross-site request forgery (CSRF) in Press This leading to - excessive use of server resources.
    • -
-
- - - - http://www.openwall.com/lists/oss-security/2017/03/07/3 - https://wordpress.org/news/2017/03/wordpress-4-7-3-security-and-maintenance-release/ - - - 2017-03-07 - 2017-03-07 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 52.0_1,1 - - - seamonkey - linux-seamonkey - 2.49 - - - firefox-esr - 46.0,152.0,1 - 45.8.0_1,1 - - - linux-firefox - 46.0,252.0,2 - 45.8.0_1,2 - - - libxul - 46.052.0 - 45.8.0_1 - - - thunderbird - linux-thunderbird - 46.052.0 - 45.8.0 - - - - -

Mozilla Foundation reports:

-
-

Please reference CVE/URL list for details

-
- - - - CVE-2017-5400 - CVE-2017-5401 - CVE-2017-5402 - CVE-2017-5403 - CVE-2017-5404 - CVE-2017-5406 - CVE-2017-5407 - CVE-2017-5410 - CVE-2017-5411 - CVE-2017-5409 - CVE-2017-5408 - CVE-2017-5412 - CVE-2017-5413 - CVE-2017-5414 - CVE-2017-5415 - CVE-2017-5416 - CVE-2017-5417 - CVE-2017-5425 - CVE-2017-5426 - CVE-2017-5427 - CVE-2017-5418 - CVE-2017-5419 - CVE-2017-5420 - CVE-2017-5405 - CVE-2017-5421 - CVE-2017-5422 - CVE-2017-5399 - CVE-2017-5398 - https://www.mozilla.org/security/advisories/mfsa2017-05/ - https://www.mozilla.org/security/advisories/mfsa2017-06/ - - - 2017-03-07 - 2017-03-07 - - - - - codeigniter -- multiple vulnerabilities - - - codeigniter - 3.1.3 - - - - -

The CodeIgniter changelog reports:

-
-

Fixed an XSS vulnerability in Security Library method xss_clean(). -

-

Fixed a possible file inclusion vulnerability in Loader Library - method vars().

-

Fixed a possible remote code execution vulnerability in the Email - Library when ‘mail’ or ‘sendmail’ are used (thanks to Paul Buonopane - from NamePros).

-

Added protection against timing side-channel attacks in Security - Library method csrf_verify().

-

Added protection against BREACH attacks targeting the CSRF token - field generated by Form Helper function form_open().

-
- - - - https://www.codeigniter.com/user_guide/changelog.html - - - 2017-01-09 - 2017-03-05 - - - - - ikiwiki -- authentication bypass vulnerability - - - ikiwiki - 3.20170111 - - - - -

ikiwiki reports:

-
-

The ikiwiki maintainers discovered further flaws similar to - CVE-2016-9646 in the passwordauth plugin's use of - CGI::FormBuilder, with a more serious impact:

-

An attacker who can log in to a site with a password can log in as - a different and potentially more privileged user.

-

An attacker who can create a new account can set arbitrary fields - in the user database for that account

-
- - - - CVE-2017-0356 - https://ikiwiki.info/security/#index48h2 - - - 2017-01-11 - 2017-03-05 - - - - - ikiwiki -- multiple vulnerabilities - - - ikiwiki - 3.20161229 - - - - -

Mitre reports:

-
-

ikiwiki 3.20161219 does not properly check if a revision changes - the access permissions for a page on sites with the git and - recentchanges plugins and the CGI interface enabled, which allows - remote attackers to revert certain changes by leveraging permissions - to change the page before the revision was made.

-
-
-

When CGI::FormBuilder->field("foo") is called in list context - (and in particular in the arguments to a subroutine that takes named - arguments), it can return zero or more values for foo from the CGI - request, rather than the expected single value. This breaks the - usual Perl parsing convention for named arguments, similar to - CVE-2014-1572 in Bugzilla (which was caused by a similar API design - issue in CGI.pm).

-
- - - - CVE-2016-10026 - CVE-2016-9645 - CVE-2016-9646 - https://ikiwiki.info/security/#index46h2 - https://ikiwiki.info/security/#index47h2 - - - 2016-12-19 - 2017-03-05 - - - - - potrace -- multiple memory failure - - - potrace - 1.13 - - - - -

potrace reports:

-
-

CVE-2016-8685: invalid memory access in findnext

-

CVE-2016-8686: memory allocation failure

-
- - - - https://sourceforge.net/p/potrace/news/2017/02/potrace-114-released/ - CVE-2016-8685 - CVE-2016-8686 - - - 2016-10-15 - 2017-02-28 - - - - - MPD -- buffer overflows in http output - - - musicpd - 0.20.5 - - - - -

The MPD project reports:

-
-

httpd: fix two buffer overflows in IcyMetaData length calculation

-
- - - - http://git.musicpd.org/cgit/master/mpd.git/plain/NEWS?h=v0.20.5 - - - 2017-02-18 - 2017-02-26 - - - - - cURL -- ocsp status validation error - - - curl - 7.52.07.53.0 - - - - -

The cURL project reports:

-
-

SSL_VERIFYSTATUS ignored
- curl and libcurl support "OCSP stapling", also known as the TLS - Certificate Status Request extension (using the - CURLOPT_SSL_VERIFYSTATUS option). When telling curl to use this - feature, it uses that TLS extension to ask for a fresh proof of - the server's certificate's validity. If the server doesn't support - the extension, or fails to provide said proof, curl is expected to - return an error.
- Due to a coding mistake, the code that checks for a test success or - failure, ends up always thinking there's valid proof, even when - there is none or if the server doesn't support the TLS extension in - question. Contrary to how it used to function and contrary to how - this feature is documented to work.
- This could lead to users not detecting when a server's certificate - goes invalid or otherwise be mislead that the server is in a better - shape than it is in reality.

-
- - - - https://curl.haxx.se/docs/adv_20170222.html - CVE-2017-2629 - - - 2017-02-22 - 2017-02-22 - - - - - xen-tools -- cirrus_bitblt_cputovideo does not check if memory region is safe - - - xen-tools - 4.7.1_4 - - - - -

The Xen Project reports:

-
-

In CIRRUS_BLTMODE_MEMSYSSRC mode the bitblit copy routine - cirrus_bitblt_cputovideo fails to check whether the specified - memory region is safe. A malicious guest administrator can cause - an out of bounds memory write, very likely exploitable as a - privilege escalation.

-
- - - - CVE-2017-2620 - http://xenbits.xen.org/xsa/advisory-209.html - - - 2017-02-21 - 2017-02-22 - - - - - fbsdmon -- information disclosure vulnerability - - - fbsdmon - 0 - - - - -

Alan Somers reports:

-
-

The web site used by this port, http://fbsdmon.org, has been taken over by cybersquatters. That means that users are sending their system info to an unknown party.

-
- - - - https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=217099 - - - 2017-02-14 - 2017-02-21 - - - - - wavpack -- multiple invalid memory reads - - - wavpack - 5.1.0 - - - - -

David Bryant reports:

-
-

global buffer overread in read_code / read_words.c

-

heap out of bounds read in WriteCaffHeader / caff.c

-

heap out of bounds read in unreorder_channels / wvunpack.c

-

heap oob read in read_new_config_info / open_utils.c

-
- - - - http://www.openwall.com/lists/oss-security/2017/01/23/4 - CVE-2016-10169 - CVE-2016-10170 - CVE-2016-10171 - CVE-2016-10172 - https://github.com/dbry/WavPack/commit/4bc05fc490b66ef2d45b1de26abf1455b486b0dc - - - 2017-01-21 - 2017-02-18 - - - - - optipng -- multiple vulnerabilities - - - optipng - 0.7.6 - - - - -
-

ifread.c in gif2png, as used in OptiPNG before 0.7.6, allows remote attackers to cause a denial of service (uninitialized memory read) via a crafted GIF file.

-
-
-

The bmp_read_rows function in pngxtern/pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (invalid memory write and crash) via a series of delta escapes in a crafted BMP image.

-
-
-

Heap-based buffer overflow in the bmp_read_rows function in pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (out-of-bounds read or write access and crash) or possibly execute arbitrary code via a crafted image file.

-
-
-

Off-by-one error in the bmp_rle4_fread function in pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (out-of-bounds read or write access and crash) or possibly execute arbitrary code via a crafted image file, which triggers a heap-based buffer overflow.

-
- - - - CVE-2015-7802 - CVE-2016-2191 - CVE-2016-3981 - CVE-2016-3982 - - - 2015-10-09 - 2017-02-16 - - - - - openssl -- crash on handshake - - - openssl-devel - 1.1.0e - - - - -

The OpenSSL project reports:

-
-

Severity: High
- During a renegotiation handshake if the Encrypt-Then-Mac - extension is negotiated where it was not in the original - handshake (or vice-versa) then this can cause OpenSSL to - crash (dependent on ciphersuite). Both clients and servers - are affected.
- This issue does not affect OpenSSL version 1.0.2. -

-
- - - - https://www.openssl.org/news/secadv/20170216.txt - CVE-2017-3733 - - - 2017-02-16 - 2017-02-16 - - - - - diffoscope -- arbitrary file write - - - py34-diffoscope - py35-diffoscope - py36-diffoscope - 6776 - - - - -

Ximin Luo reports:

-
-

[v67] introduced a security hole where diffoscope may write to - arbitrary locations on disk depending on the contents of an - untrusted archive.

-
- - - - CVE-2017-0359 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=854723 - - - 2017-02-09 - 2017-02-14 - 2017-02-16 - - - - - ffmpeg -- heap overflow in lavf/mov.c - - - ffmpeg - 3.2.4,1 - - - mythtv - mythtv-frontend - - 29.1,1 - - - - -

FFmpeg security reports:

-
-

FFmpeg 3.2.4 fixes the following vulnerabilities: - CVE-2017-5024, CVE-2017-5025

-
- - - - CVE-2017-5024 - https://www.ffmpeg.org/security.html - https://chromereleases.googleblog.com/2017/01/stable-channel-update-for-desktop.html - CVE-2017-5025 - https://www.ffmpeg.org/security.html - https://chromereleases.googleblog.com/2017/01/stable-channel-update-for-desktop.html - - - 2017-01-25 - 2017-02-12 - 2018-03-25 - - - - - gtk-vnc -- bounds checking vulnerabilities - - - gtk-vnc - 0.7.0 - - - - -

Daniel P. Berrange reports:

-
-

CVE-2017-5884 - fix bounds checking for RRE, hextile and - copyrect encodings

-

CVE-2017-5885 - fix color map index bounds checking.

-
- - - - https://mail.gnome.org/archives/ftp-release-list/2017-February/msg00015.html - CVE-2017-5884 - CVE-2017-5885 - - - 2017-02-09 - 2017-02-11 - - - - - xen-tools -- oob access in cirrus bitblt copy - - - xen-tools - 4.7.1_2 - - - - -

The Xen Project reports:

-
-

When doing bitblt copy backwards, qemu should negate the blit - width. This avoids an oob access before the start of video - memory.

-

A malicious guest administrator can cause an out of bounds memory - access, possibly leading to information disclosure or privilege - escalation.

-
- - - - CVE-2017-2615 - http://xenbits.xen.org/xsa/advisory-208.html - - - 2017-02-10 - 2017-02-11 - - - - - tiff -- multiple vulnerabilities - - - tiff - 4.0.7 - - - linux-c6-libtiff - linux-c6-tiff - 3.9.4_5 - - - linux-c7-libtiff - linux-c7-tiff - 4.0.3_3 - - - - -

libtiff project reports:

-
-

Multiple flaws have been discovered in libtiff library and - utilities.

-
- - - - http://simplesystems.org/libtiff/v4.0.7.html - CVE-2016-9533 - CVE-2016-9534 - CVE-2016-9535 - CVE-2015-8870 - CVE-2016-5652 - CVE-2016-9540 - CVE-2016-9537 - CVE-2016-9536 - - - 2016-11-19 - 2017-02-06 - - - - - mantis -- XSS vulnerability - - - mantis - 1.2.19 - - - - -

wdollman reports:

-
-

The value of the view_type parameter on the - view_all_bug_page.php page is not encoded before being displayed on the - page.

-
- - - - https://mantisbt.org/bugs/view.php?id=21611 - CVE-2016-6837 - ports/216662 - - - 2016-08-15 - 2017-02-04 - - - - - guile2 -- multiple vulnerabilities - - - guile2 - 2.0.13 - - - - -

Ludovic Courtès reports:

-
-

The REPL server is vulnerable to - the HTTP inter-protocol attack

-

The ‘mkdir’ procedure of GNU Guile, an implementation of - the Scheme programming language, temporarily changed the process’ umask - to zero. During that time window, in a multithreaded application, other - threads could end up creating files with insecure permissions.

-
- - - - http://www.openwall.com/lists/oss-security/2016/10/11/1 - http://www.openwall.com/lists/oss-security/2016/10/12/2 - CVE-2016-8605 - CVE-2016-8606 - ports/216663 - - - 2016-10-12 - 2017-02-04 - - - - - chicken -- multiple vulnerabilities - - - chicken - 4.12,1 - - - - -

Peter Bex reports:

-
-

A buffer overflow error was found in the POSIX unit's procedures - process-execute and process-spawn.

-

Additionally, a memory leak existed in this code, which would be - triggered when an error is raised during argument and environment - processing.

-
-
-

Irregex versions before 0.9.6 contain a resource exhaustion - vulnerability: when compiling deeply nested regexes containing the - "+" operator due to exponential expansion behaviour.

-
- - - - http://lists.nongnu.org/archive/html/chicken-announce/2016-08/msg00001.html - CVE-2016-6830 - CVE-2016-6831 - CVE-2016-9954 - ports/216661 - - - 2016-08-12 - 2017-02-04 - 2017-03-05 - - - - - libebml -- multiple vulnerabilities - - - libebml - 1.3.3 - - - - -

Mortiz Bunkus reports:

-
-

Multiple invalid memory accesses vulnerabilities.

-
- - - - https://lists.matroska.org/pipermail/matroska-users/2015-October/006985.html - CVE-2015-8789 - CVE-2015-8790 - CVE-2015-8791 - ports/216659 - - - 2015-10-20 - 2017-02-04 - - - - - freeimage -- code execution vulnerability - - - freeimage - 3.16.0_4 - - - - -

TALOS reports:

-
-

An exploitable out-of-bounds write vulnerability exists in - the XMP image handling functionality of the FreeImage library.

-
- - - - http://www.talosintelligence.com/reports/TALOS-2016-0189/ - CVE-2016-5684 - ports/216657 - - - 2016-10-03 - 2017-02-04 - 2018-04-14 - - - - - shotwell -- failure to encrypt authentication - - - shotwell - 0.24.5 - - - - -

Jens Georg reports:

-
-

I have just released Shotwell 0.24.5 and 0.25.4 which turn - on HTTPS encryption all over the publishing plugins.

-

Users using Tumblr and Yandex.Fotki publishing are strongly - advised to change their passwords and reauthenticate Shotwell - to those services after upgrade.

-

Users of Picasa and Youtube publishing are strongly advised - to reauthenticate (Log out and back in) Shotwell to those - services after upgrade.

-
- - - - https://mail.gnome.org/archives/shotwell-list/2017-January/msg00048.html - - - 2017-01-31 - 2017-02-01 - - - - - jenkins -- multiple vulnerabilities - - - jenkins - 2.44 - - - jenkins-lts - 2.32.2 - - - - -

Jenkins Security Advisory:

-
-

Please reference CVE/URL list for details

-
- - - - CVE-2017-2598 - CVE-2017-2599 - CVE-2017-2600 - CVE-2011-4969 - CVE-2017-2601 - CVE-2015-0886 - CVE-2017-2602 - CVE-2017-2603 - CVE-2017-2604 - CVE-2017-2605 - CVE-2017-2606 - CVE-2017-2607 - CVE-2017-2608 - CVE-2017-2609 - CVE-2017-2610 - CVE-2017-2611 - CVE-2017-2612 - CVE-2017-2613 - https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2017-02-01 - - - 2017-02-01 - 2017-02-01 - - - - - wordpress -- multiple vulnerabilities - - - wordpress - 4.7.2,1 - - - de-wordpress - ja-wordpress - ru-wordpress - zh-wordpress-zh_CN - zh-wordpress-zh_TW - 4.7.2 - - - - -

Aaron D. Campbell reports:

-
-

WordPress versions 4.7.1 and earlier are affected by three security - issues:

-
    -
  • The user interface for assigning taxonomy terms in Press This is - shown to users who do not have permissions to use it.
    • -
  • WP_Query is vulnerable to a SQL injection (SQLi) when passing - unsafe data. WordPress core is not directly vulnerable to this - issue, but we’ve added hardening to prevent plugins and - themes from accidentally causing a vulnerability.
    • -
  • A cross-site scripting (XSS) vulnerability was discovered in the - posts list table.
    • -
  • An unauthenticated privilege escalation vulnerability was - discovered in a REST API endpoint.
    • -
-
- - - - CVE-2017-5610 - CVE-2017-5611 - CVE-2017-5612 - http://www.openwall.com/lists/oss-security/2017/01/28/5 - https://wordpress.org/news/2017/01/wordpress-4-7-2-security-release/ - https://make.wordpress.org/core/2017/02/01/disclosure-of-additional-security-fix-in-wordpress-4-7-2/ - - - 2017-01-26 - 2017-01-29 - - - - - nfsen -- remote command execution - - - nfsen - 1.3.7 - - - - -

Peter Haag reports:

-
-

A remote attacker with access to the web interface to - execute arbitrary commands on the host operating system.

-
- - - - https://sourceforge.net/p/nfsen/mailman/message/35623845/ - - - 2017-01-24 - 2017-01-27 - - - - - chromium -- multiple vulnerabilities - - - chromium - chromium-npapi - chromium-pulse - 56.0.2924.76 - - - - -

Google Chrome Releases reports:

-
-

51 security fixes in this release

-

Please reference CVE/URL list for details

-
- - - - CVE-2017-5007 - CVE-2017-5006 - CVE-2017-5008 - CVE-2017-5010 - CVE-2017-5011 - CVE-2017-5009 - CVE-2017-5012 - CVE-2017-5013 - CVE-2017-5014 - CVE-2017-5015 - CVE-2017-5019 - CVE-2017-5016 - CVE-2017-5017 - CVE-2017-5018 - CVE-2017-2020 - CVE-2017-2021 - CVE-2017-2022 - CVE-2017-2023 - CVE-2017-2024 - CVE-2017-2025 - CVE-2017-2026 - https://chromereleases.googleblog.com/2017/01/stable-channel-update-for-desktop.html - - - 2017-01-25 - 2017-01-26 - - - - - OpenSSL -- multiple vulnerabilities - - - openssl - 1.0.2k,1 - - - openssl-devel - 1.1.0d - - - linux-c6-openssl - 1.0.1e_13 - - - linux-c7-openssl-libs - 1.0.1e_3 - - - FreeBSD - 11.011.0_8 - 10.310.3_17 - - - - -

The OpenSSL project reports:

-
-
    -
  • Truncated packet could crash via OOB read (CVE-2017-3731)
    • -
  • Bad (EC)DHE parameters cause a client crash (CVE-2017-3730)
    • -
  • BN_mod_exp may produce incorrect results on x86_64 (CVE-2017-3732)
    • -
  • Montgomery multiplication may produce incorrect results (CVE-2016-7055)
    • -
-
- - - - https://www.openssl.org/news/secadv/20170126.txt - CVE-2016-7055 - CVE-2017-3730 - CVE-2017-3731 - CVE-2017-3732 - SA-17:02.openssl - - - 2017-01-26 - 2017-01-26 - 2017-05-26 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 51.0_1,1 - - - seamonkey - linux-seamonkey - 2.48 - - - firefox-esr - 45.7.0,1 - - - linux-firefox - 45.7.0,2 - - - libxul - thunderbird - linux-thunderbird - 45.7.0 - - - - -

Mozilla Foundation reports:

-
-

Please reference CVE/URL list for details

-
- - - - CVE-2017-5373 - CVE-2017-5374 - CVE-2017-5375 - CVE-2017-5376 - CVE-2017-5377 - CVE-2017-5378 - CVE-2017-5379 - CVE-2017-5380 - CVE-2017-5381 - CVE-2017-5382 - CVE-2017-5383 - CVE-2017-5384 - CVE-2017-5385 - CVE-2017-5386 - CVE-2017-5387 - CVE-2017-5388 - CVE-2017-5389 - CVE-2017-5390 - CVE-2017-5391 - CVE-2017-5392 - CVE-2017-5393 - CVE-2017-5394 - CVE-2017-5395 - CVE-2017-5396 - https://www.mozilla.org/security/advisories/mfsa2017-01/ - https://www.mozilla.org/security/advisories/mfsa2017-02/ - - - 2017-01-24 - 2017-01-24 - - - - - phpMyAdmin -- Multiple vulnerabilities - - - phpMyAdmin - 4.6.04.6.6 - - - - -

The phpMyAdmin development team reports:

-
-

Open redirect

-
-
-

php-gettext code execution

-
-
-

DOS vulnerability in table editing

-
-
-

CSS injection in themes

-
-
-

Cookie attribute injection attack

-
-
-

SSRF in replication

-
-
-

DOS in replication status

-
- - - - https://www.phpmyadmin.net/security/PMASA-2017-1 - https://www.phpmyadmin.net/security/PMASA-2017-2 - https://www.phpmyadmin.net/security/PMASA-2017-3 - https://www.phpmyadmin.net/security/PMASA-2017-4 - https://www.phpmyadmin.net/security/PMASA-2017-5 - https://www.phpmyadmin.net/security/PMASA-2017-6 - https://www.phpmyadmin.net/security/PMASA-2017-7 - CVE-2015-8980 - - - 2017-01-24 - 2017-01-24 - - - - - Intel(R) NVMUpdate -- Intel(R) Ethernet Controller X710/XL710 NVM Security Vulnerability - - - intel-nvmupdate - 5.05 - - - - -

Intel Corporation reports:

-
-

A security vulnerability in the Intel(R) Ethernet Controller X710 - and Intel(R) Ethernet Controller XL710 family of products - (Fortville) has been found in the Non-Volatile Flash Memory (NVM) - image.

-
- - - - https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00063&languageid=en-fr - CVE-2016-8106 - - - 2017-01-09 - 2017-01-23 - - - - - PHP -- undisclosed vulnerabilities - - - php56 - 5.6.30 - - - php70 - 7.0.15 - - - - -

The PHP project reports:

-
-

The PHP development team announces the immediate availability of - PHP 7.0.15. This is a security release. Several security bugs were - fixed in this release.

-
-
-

The PHP development team announces the immediate availability of - PHP 5.6.30. This is a security release. Several security bugs were - fixed in this release.

-
- - - - http://php.net/archive/2017.php#id2017-01-19-2 - http://php.net/archive/2017.php#id2017-01-19-3 - - - 2017-01-19 - 2017-01-19 - 2017-01-20 - - - - - icoutils -- check_offset overflow on 64-bit systems - - - icoutils - 0.31.1 - - - - -

Choongwoo Han reports:

-
-

An exploitable crash exists in the wrestool utility on 64-bit systems - where the result of subtracting two pointers exceeds the size of int.

-
- - - - CVE-2017-5208 - CVE-2017-5331 - CVE-2017-5332 - CVE-2017-5333 - http://seclists.org/oss-sec/2017/q1/38 - - - 2017-01-03 - 2017-01-19 - - - - - mysql -- multiple vulnerabilities - - - mariadb55-server - 5.5.54 - - - mariadb100-server - 10.0.30 - - - mariadb101-server - 10.1.22 - - - mysql55-server - 5.5.54 - - - mysql56-server - 5.6.35 - - - mysql57-server - 5.7.17 - - - - -

Oracle reports:

-
-

No further details have been provided in the Critical Patch Update

-
- - - - http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html#AppendixMSQL - CVE-2016-8318 - CVE-2017-3312 - CVE-2017-3258 - CVE-2017-3273 - CVE-2017-3244 - CVE-2017-3257 - CVE-2017-3238 - CVE-2017-3256 - CVE-2017-3291 - CVE-2017-3265 - CVE-2017-3251 - CVE-2017-3313 - CVE-2017-3243 - CVE-2016-8327 - CVE-2017-3317 - CVE-2017-3318 - CVE-2017-3319 - CVE-2017-3320 - - - 2017-01-18 - 2017-01-18 - 2017-03-14 - - - - - powerdns -- multiple vulnerabilities - - - powerdns - 3.4.11 - 4.0.04.0.2 - - - powerdns-recursor - 3.7.4 - 4.0.04.0.4 - - - - -

PowerDNS reports:

-
-

2016-02: Crafted queries can cause abnormal CPU usage

-
-
-

2016-03: Denial of service via the web server

-
-
-

2016-04: Insufficient validation of TSIG signatures

-
-
-

2016-05: Crafted zone record can cause a denial of service

-
- - - - CVE-2016-7068 - CVE-2016-7072 - CVE-2016-7073 - CVE-2016-7074 - CVE-2016-2120 - ports/216135 - ports/216136 - https://doc.powerdns.com/md/security/powerdns-advisory-2016-02/ - https://doc.powerdns.com/md/security/powerdns-advisory-2016-03/ - https://doc.powerdns.com/md/security/powerdns-advisory-2016-04/ - https://doc.powerdns.com/md/security/powerdns-advisory-2016-05/ - https://blog.powerdns.com/2017/01/13/powerdns-authoritative-server-4-0-2-released/ - https://blog.powerdns.com/2017/01/13/powerdns-recursor-4-0-4-released/ - - - 2016-12-15 - 2017-01-18 - - - - - groovy -- remote execution of untrusted code/DoS vulnerability - - - groovy - 1.7.02.4.8 - - - - -

The Apache Groovy project reports:

-
-

When an application with Groovy on classpath uses standard Java - serialization mechanisms, e.g. to communicate between servers or to - store local data, it is possible for an attacker to bake a special - serialized object that will execute code directly when deserialized. - All applications which rely on serialization and do not isolate the - code which deserializes objects are subject to this vulnerability. - This is similar to CVE-2015-3253 but this exploit involves extra - wrapping of objects and catching of exceptions which are now safe - guarded against.

-
- - - - CVE-2016-6814 - http://groovy-lang.org/security.html - - - 2016-09-20 - 2017-01-15 - - - - - RabbitMQ -- Authentication vulnerability - - - rabbitmq - 3.0.03.5.8 - 3.6.03.6.6 - - - - -

Pivotal.io reports:

-
-

MQTT (MQ Telemetry Transport) connection authentication with a - username/password pair succeeds if an existing username is - provided but the password is omitted from the connection - request. Connections that use TLS with a client-provided - certificate are not affected.

-
- - - - CVE-2016-9877 - https://pivotal.io/security/cve-2016-9877 - https://github.com/rabbitmq/rabbitmq-server/releases/tag/rabbitmq_v3_6_6 - - - 2016-12-06 - 2017-01-15 - - - - - wordpress -- multiple vulnerabilities - - - wordpress - 4.7.1,1 - - - de-wordpress - ja-wordpress - ru-wordpress - zh-wordpress-zh_CN - zh-wordpress-zh_TW - 4.7.1 - - - - -

Aaron D. Campbell reports:

-
-

WordPress versions 4.7 and earlier are affected by eight security - issues...

-
- - - - CVE-2017-5487 - CVE-2017-5488 - CVE-2017-5489 - CVE-2017-5490 - CVE-2017-5491 - CVE-2017-5492 - CVE-2017-5493 - http://www.openwall.com/lists/oss-security/2017/01/14/6 - https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/ - - - 2017-01-11 - 2017-01-15 - - - - - mysql -- multiple vulnerabilities - - - mysql57-client - mysql57-server - 5.7.15 - - - - -

Oracle reports:

-
-

Local security vulnerability in 'Server: Packaging' sub component.

-
- - - - 93617 - CVE-2016-5625 - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html - - - 2016-10-18 - 2017-01-14 - 2017-01-15 - - - - - MySQL -- multiple vulnerabilities - - - mariadb55-client - mariadb55-server - 5.5.52 - - - mariadb100-client - mariadb100-server - 10.0.28 - - - mariadb101-client - mariadb101-server - 10.1.18 - - - mysql55-client - mysql55-server - 5.5.52 - - - mysql56-client - mysql56-server - 5.6.33 - - - mysql57-client - mysql57-server - 5.7.15 - - - percona55-client - percona55-server - 5.5.51.38.2 - - - percona56-client - percona56-server - 5.6.32.78.1 - - - - -

The MySQL project reports:

-
-
    -
  • CVE-2016-3492: Remote security vulnerability in 'Server: Optimizer' - sub component.
    • -
  • CVE-2016-5616, CVE-2016-6663: Race condition allows local users with - certain permissions to gain privileges by leveraging use of my_copystat - by REPAIR TABLE to repair a MyISAM table.
    • -
  • CVE-2016-5617, CVE-2016-6664: mysqld_safe, when using file-based - logging, allows local users with access to the mysql account to gain - root privileges via a symlink attack on error logs and possibly other - files.
    • -
  • CVE-2016-5624: Remote security vulnerability in 'Server: DML' sub - component.
    • -
  • CVE-2016-5626: Remote security vulnerability in 'Server: GIS' sub - component.
    • -
  • CVE-2016-5629: Remote security vulnerability in 'Server: Federated' - sub component.
    • -
  • CVE-2016-8283: Remote security vulnerability in 'Server: Types' sub - component.
    • -
-
- - - - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html#AppendixMSQL - https://mariadb.com/kb/en/mariadb/mariadb-10028-release-notes/ - https://mariadb.com/kb/en/mariadb/mariadb-5552-release-notes/ - https://mariadb.com/kb/en/mariadb/mariadb-10118-release-notes/ - CVE-2016-3492 - CVE-2016-5616 - CVE-2016-5617 - CVE-2016-5624 - CVE-2016-5626 - CVE-2016-5629 - CVE-2016-6663 - CVE-2016-6664 - CVE-2016-8283 - - - 2016-09-13 - 2017-01-14 - - - - - Ansible -- Command execution on Ansible controller from host - - - ansible - 1.9.6_12.2.0.0_2 - - - - -

Computest reports:

-
-

Computest found and exploited several issues - that allow a compromised host to execute commands - on the Ansible controller and thus gain access - to other hosts controlled by that controller.

-
- - - - CVE-2016-9587 - https://www.computest.nl/advisories/CT-2017-0109_Ansible.txt - https://lwn.net/Articles/711357/ - - - 2017-01-09 - 2017-01-12 - - - - - phpmailer -- Remote Code Execution - - - phpmailer - 5.2.22 - - - tt-rss - 2017.01.16 - - - - -

SecurityFocus reports:

-
-

PHPMailer is prone to an local information-disclosure vulnerability. - Attackers can exploit this issue to obtain sensitive information - that may aid in launching further attacks.

-
- - - - http://www.securityfocus.com/bid/95328/discuss - CVE-2017-5223 - - - 2017-01-10 - 2017-01-12 - - - - - BIND -- multiple vulnerabilities - - - bind99 - 9.9.9P5 - - - bind910 - 9.10.4P5 - - - bind911 - 9.11.0P2 - - - bind9-devel - 9.12.0.a.2016.12.28 - - - FreeBSD - 9.310.0 - - - - -

ISC reports:

-
-

A malformed query response received by a recursive - server in response to a query of RTYPE ANY could - trigger an assertion failure while named is attempting - to add the RRs in the query response to the cache.

-
-
-

Depending on the type of query and the EDNS options - in the query they receive, DNSSEC-enabled authoritative - servers are expected to include RRSIG and other RRsets - in their responses to recursive servers. - DNSSEC-validating servers will also make specific queries - for DS and other RRsets. - Whether DNSSEC-validating or not, an error in processing - malformed query responses that contain DNSSEC-related - RRsets that are inconsistent with other RRsets in the - same query response can trigger an assertion failure. - Although the combination of properties which triggers - the assertion should not occur in normal traffic, it - is potentially possible for the assertion to be triggered - deliberately by an attacker sending a specially-constructed - answer.

-
-
-

An unusually-formed answer containing a DS resource - record could trigger an assertion failure. While the - combination of properties which triggers the assertion - should not occur in normal traffic, it is potentially - possible for the assertion to be triggered deliberately - by an attacker sending a specially-constructed answer - having the required properties.

-
-
-

An error in handling certain queries can cause an - assertion failure when a server is using the - nxdomain-redirect feature to cover a zone for which - it is also providing authoritative service. - A vulnerable server could be intentionally stopped - by an attacker if it was using a configuration that - met the criteria for the vulnerability and if the - attacker could cause it to accept a query that - possessed the required attributes.

-
- - - - CVE-2016-9131 - CVE-2016-9147 - CVE-2016-9444 - CVE-2016-9778 - https://kb.isc.org/article/AA-01439/0 - https://kb.isc.org/article/AA-01440/0 - https://kb.isc.org/article/AA-01441/0 - https://kb.isc.org/article/AA-01442/0 - - - 2017-01-11 - 2017-01-12 - - - - - FreeBSD -- OpenSSH multiple vulnerabilities - - - openssh-portable - 7.3.p1_5,1 - - - FreeBSD - 11.011.0_7 - 10.310.3_16 - - - - -

Problem Description:

-

The ssh-agent(1) agent supports loading a PKCS#11 module - from outside a trusted whitelist. An attacker can request - loading of a PKCS#11 module across forwarded agent-socket. - [CVE-2016-10009]

-

When privilege separation is disabled, forwarded Unix - domain sockets would be created by sshd(8) with the privileges - of 'root' instead of the authenticated user. [CVE-2016-10010]

-

Impact:

-

A remote attacker who have control of a forwarded - agent-socket on a remote system and have the ability to - write files on the system running ssh-agent(1) agent can - run arbitrary code under the same user credential. Because - the attacker must already have some control on both systems, - it is relatively hard to exploit this vulnerability in a - practical attack. [CVE-2016-10009]

-

When privilege separation is disabled (on FreeBSD, - privilege separation is enabled by default and has to be - explicitly disabled), an authenticated attacker can potentially - gain root privileges on systems running OpenSSH server. - [CVE-2016-10010]

- - - - CVE-2016-10009 - CVE-2016-10010 - SA-17:01.openssh - - - 2017-01-11 - 2017-01-11 - 2017-01-13 - - - - - openssl -- timing attack vulnerability - - - openssl - 1.0.2 - - - libressl - 2.4.4_1 - - - libressl-devel - 2.5.0_1 - - - - -

Cesar Pereida Garcia reports:

-
-

The signing function in crypto/ecdsa/ecdsa_ossl.c in certain OpenSSL - versions and forks is vulnerable to timing attacks when signing with the - standardized elliptic curve P-256 despite featuring constant-time curve - operations and modular inversion. A software defect omits setting the - BN_FLG_CONSTTIME flag for nonces, failing to take a secure code path in - the BN_mod_inverse method and therefore resulting in a cache-timing attack - vulnerability.
- A malicious user with local access can recover ECDSA P-256 private keys.

-
- - - - http://seclists.org/oss-sec/2017/q1/52 - CVE-2016-7056 - - - 2017-01-10 - 2017-01-11 - 2017-01-11 - - - - - flash -- multiple vulnerabilities - - - linux-flashplayer - 24.0.0.194 - - - - -

Adobe reports:

-
-

These updates resolve a security bypass vulnerability that could - lead to information disclosure (CVE-2017-2938).

-

These updates resolve use-after-free vulnerabilities that could - lead to code execution (CVE-2017-2932, CVE-2017-2936, - CVE-2017-2937).

-

These updates resolve heap buffer overflow vulnerabilities that - could lead to code execution (CVE-2017-2927, CVE-2017-2933, - CVE-2017-2934, CVE-2017-2935).

-

These updates resolve memory corruption vulnerabilities that could - lead to code execution (CVE-2017-2925, CVE-2017-2926, CVE-2017-2928, - CVE-2017-2930, CVE-2017-2931).

-
- - - - CVE-2017-2925 - CVE-2017-2926 - CVE-2017-2927 - CVE-2017-2928 - CVE-2017-2930 - CVE-2017-2931 - CVE-2017-2932 - CVE-2017-2933 - CVE-2017-2934 - CVE-2017-2935 - CVE-2017-2936 - CVE-2017-2937 - CVE-2017-2938 - https://helpx.adobe.com/security/products/flash-player/apsb17-02.html - - - 2017-01-10 - 2017-01-11 - - - - - moinmoin -- XSS vulnerabilities - - - moinmoin - 1.9.9 - - - - -

Thomas Waldmann reports:

-
-
    -

  • fix XSS in AttachFile view (multifile related) CVE-2016-7148

    • -

  • fix XSS in GUI editor's attachment dialogue CVE-2016-7146

    • -

  • fix XSS in GUI editor's link dialogue CVE-2016-9119

    • -
-
- - - - http://hg.moinmo.in/moin/1.9/file/1.9.9/docs/CHANGES - CVE-2016-7148 - CVE-2016-7146 - CVE-2016-9119 - ports/214937 - - - 2016-10-31 - 2017-01-09 - - - - - libvncserver -- multiple buffer overflows - - - libvncserver - 0.9.11 - - - - -

libvnc server reports:

-
-

Two unrelated buffer overflows can be used by a malicious server to overwrite parts of the heap and crash the client (or possibly execute arbitrary code).

-
- - - - https://github.com/LibVNC/libvncserver/pull/137 - CVE-2016-9941 - CVE-2016-9942 - ports/215805 - - - 2016-11-24 - 2017-01-09 - - - - - libdwarf -- multiple vulnerabilities - - - libdwarf - 20161124 - - - - -

Christian Rebischke reports:

-
-

libdwarf is vulnerable to multiple issues including - arbitrary code execution, information disclosure and denial of - service.

-
- - - - https://lwn.net/Articles/708092/ - CVE-2016-5027 - CVE-2016-5028 - CVE-2016-5029 - CVE-2016-5030 - CVE-2016-5031 - CVE-2016-5032 - CVE-2016-5033 - CVE-2016-5035 - CVE-2016-5037 - CVE-2016-5040 - CVE-2016-5041 - CVE-2016-5043 - CVE-2016-5044 - CVE-2016-7510 - CVE-2016-7511 - CVE-2016-8679 - CVE-2016-8680 - CVE-2016-8681 - CVE-2016-9275 - CVE-2016-9276 - CVE-2016-9480 - CVE-2016-9558 - - - 2016-12-04 - 2017-01-09 - - - - - lynx -- multiple vulnerabilities - - - lynx - 2.8.8.2_5,1 - - - - -

Oracle reports:

-
-

Lynx is vulnerable to POODLE by still supporting vulnerable - version of SSL. Lynx is also vulnerable to URL attacks by incorrectly - parsing hostnames ending with an '?'.

-
- - - - https://hg.java.net/hg/solaris-userland~gate/file/bc5351dcb9ac/components/lynx/patches/02-init-openssl.patch - https://hg.java.net/hg/solaris-userland~gate/file/0a979060f73b/components/lynx/patches/05-fix-CVE-2016-9179.patch - CVE-2014-3566 - CVE-2016-9179 - ports/215464 - - - 2016-10-26 - 2017-01-09 - - - - - hdf5 -- multiple vulnerabilities - - - hdf5 - 1.10.0 - - - hdf5-18 - 1.8.18 - - - - -

Talos Security reports:

-
-
    -

  • CVE-2016-4330 (TALOS-2016-0176) - HDF5 Group libhdf5 H5T_ARRAY Code Execution Vulnerability

    • -

  • CVE-2016-4331 (TALOS-2016-0177) - HDF5 Group libhdf5 H5Z_NBIT Code Execution Vulnerability

    • -

  • CVE-2016-4332 (TALOS-2016-0178) - HDF5 Group libhdf5 Shareable Message Type Code Execution Vulnerability

    • -

  • CVE-2016-4333 (TALOS-2016-0179) - HDF5 Group libhdf5 H5T_COMPOUND Code Execution Vulnerability

    • -
-
- - - - http://blog.talosintel.com/2016/11/hdf5-vulns.html - CVE-2016-4330 - CVE-2016-4331 - CVE-2016-4332 - CVE-2016-4333 - - - 2016-11-17 - 2017-01-09 - - - - - End of Life Ports - - - py27-django16 - py33-django16 - py34-django16 - py35-django16 - 0 - - - drupal6 - 0 - - - - -

These packages have reached End of Life status and/or have - been removed from the Ports Tree. They may contain undocumented - security issues. Please take caution and find alternative - software as soon as possible.

- - - - ports/211975 - - - 2017-01-06 - 2017-01-06 - - - - - Use-After-Free Vulnerability in pcsc-lite - - - pcsc-lite - 1.6.01.8.20 - - - - -

Peter Wu on Openwall mailing-list reports:

-
-

The issue allows a local attacker to cause a Denial of Service, - but can potentially result in Privilege Escalation since - the daemon is running as root. while any local user can - connect to the Unix socket. - Fixed by patch which is released with hpcsc-lite 1.8.20.

-
- - - - CVE-2016-10109 - http://www.openwall.com/lists/oss-security/2017/01/03/2 - - - 2017-01-03 - 2017-01-06 - 2017-01-10 - - - - - GnuTLS -- Memory corruption vulnerabilities - - - gnutls - 3.5.8 - - - - -

The GnuTLS project reports:

-
-
    -
  • It was found using the OSS-FUZZ fuzzer infrastructure that - decoding a specially crafted OpenPGP certificate could lead - to heap and stack overflows. (GNUTLS-SA-2017-2)
    • -
  • It was found using the OSS-FUZZ fuzzer infrastructure that - decoding a specially crafted X.509 certificate with Proxy - Certificate Information extension present could lead to a - double free. (GNUTLS-SA-2017-1)
    • -
-
- - - - http://www.gnutls.org/news.html#2017-01-09 - http://www.gnutls.org/security.html#GNUTLS-SA-2017-2 - http://www.gnutls.org/security.html#GNUTLS-SA-2017-1 - - - 2017-01-09 - 2017-01-09 - - - - - tomcat -- information disclosure vulnerability - - - tomcat - 6.0.49 - - - tomcat7 - 7.0.74 - - - tomcat8 - 8.0.40 - - - - -

The Apache Software Foundation reports:

-
-

Important: Information Disclosure CVE-2016-8745

-
- - - - CVE-2016-8745 - ports/215865 - http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.49 - http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.74 - http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.40 - - - 2017-01-05 - 2017-01-07 - 2017-03-18 - - - - - tomcat -- multiple vulnerabilities - - - tomcat - 6.0.48 - - - tomcat7 - 7.0.73 - - - tomcat8 - 8.0.39 - - - - -

The Apache Software Foundation reports:

-
-

Important: Remote Code Execution CVE-2016-8735

-

Important: Information Disclosure CVE-2016-6816

-
- - - - CVE-2016-8735 - CVE-2016-6816 - ports/214599 - http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.48 - http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.73 - http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.39 - - - 2016-11-22 - 2017-01-07 - 2017-03-18 - - - - - tomcat -- multiple vulnerabilities - - - tomcat - 6.0.47 - - - tomcat7 - 7.0.72 - - - tomcat8 - 8.0.37 - - - - -

The Apache Software Foundation reports:

-
-

Low: Unrestricted Access to Global Resources CVE-2016-6797

-

Low: Security Manager Bypass CVE-2016-6796

-

Low: System Property Disclosure CVE-2016-6794

-

Low: Security Manager Bypass CVE-2016-5018

-

Low: Timing Attack CVE-2016-0762

-
- - - - CVE-2016-6797 - CVE-2016-6796 - CVE-2016-6794 - CVE-2016-5018 - CVE-2016-0762 - http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.47 - http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.72 - http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.5_and_8.0.37 - - - 2016-10-27 - 2017-01-07 - 2017-03-18 - - - - - Irssi -- multiple vulnerabilities - - - irssi - 0.8.21 - - - - -

Irssi reports:

-
-

Five vulnerabilities have been located in Irssi

-
    -
  • A NULL pointer dereference in the nickcmp function found by - Joseph Bisch. (CWE-690)
    • -
  • Use after free when receiving invalid nick message (Issue #466, - CWE-146)
    • -
  • Out of bounds read in certain incomplete control codes found - by Joseph Bisch. (CWE-126)
    • -
  • Out of bounds read in certain incomplete character sequences - found by Hanno Böck and independently by J. Bisch. (CWE-126)
    • -
  • Out of bounds read when Printing the value '%['. Found by - Hanno Böck. (CWE-126)
    • -
-

These issues may result in denial of service (remote crash).

-
- - - - CVE-2017-5193 - CVE-2017-5194 - CVE-2017-5195 - CVE-2017-5196 - CVE-2017-5356 - ports/215800 - https://irssi.org/security/irssi_sa_2017_01.txt - - - 2017-01-03 - 2017-01-05 - 2017-01-15 - - - - - codeigniter -- multiple vulnerabilities - - - codeigniter - 3.1.2 - - - - -

The CodeIgniter changelog reports:

-
-

Fixed a number of new vulnerabilities in Security Library method - xss_clean().

-
- - - - https://www.codeigniter.com/user_guide/changelog.html - - - 2016-10-28 - 2017-01-06 - - - - - codeigniter -- multiple vulnerabilities - - - codeigniter - 3.1.0 - - - - -

The CodeIgniter changelog reports:

-
-

Fixed an SQL injection in the ‘odbc’ database driver.

-

Updated set_realpath() Path Helper function to filter-out php:// - wrapper inputs.

-
- - - - https://www.codeigniter.com/user_guide/changelog.html - - - 2016-07-26 - 2017-01-06 - - - - - w3m -- multiple vulnerabilities - - - w3m - w3m-img - ja-w3m - ja-w3m-img - 0.5.3.20170102 - - - - -

Multiple remote code execution and denial of service conditions present.

- - - - http://seclists.org/oss-sec/2016/q4/452 - http://seclists.org/oss-sec/2016/q4/516 - CVE-2016-9422 - CVE-2016-9423 - CVE-2016-9424 - CVE-2016-9425 - CVE-2016-9426 - CVE-2016-9428 - CVE-2016-9429 - CVE-2016-9430 - CVE-2016-9431 - CVE-2016-9432 - CVE-2016-9433 - CVE-2016-9434 - CVE-2016-9435 - CVE-2016-9436 - CVE-2016-9437 - CVE-2016-9438 - CVE-2016-9439 - CVE-2016-9440 - CVE-2016-9441 - CVE-2016-9442 - CVE-2016-9443 - CVE-2016-9622 - CVE-2016-9623 - CVE-2016-9624 - CVE-2016-9625 - CVE-2016-9626 - CVE-2016-9627 - CVE-2016-9628 - CVE-2016-9629 - CVE-2016-9630 - CVE-2016-9631 - CVE-2016-9632 - CVE-2016-9633 - - - 2016-11-03 - 2017-01-01 - 2017-01-09 - - - - - h2o -- Use-after-free vulnerability - - - h2o - 2.0.4_2 - - - - -

Kazuho Oku reports:

-
-

A use-after-free vulnerability exists in H2O up to and including - version 2.0.4 / 2.1.0-beta3 that can be used by a remote attacker to - mount DoS attacks and / or information theft.

-
- - - - https://github.com/h2o/h2o/releases/tag/v2.0.5 - https://github.com/h2o/h2o/issues/1144 - - - 2016-09-09 - 2016-12-29 - - - - - PHP -- multiple vulnerabilities - - - php70 - 7.0.14 - - - - -

Check Point reports:

-
-

... discovered 3 fresh and previously unknown vulnerabilities - (CVE-2016-7479, CVE-2016-7480, CVE-2016-7478) in the PHP 7 - unserialize mechanism.

-

The first two vulnerabilities allow attackers to take full control - over servers, allowing them to do anything they want with the - website, from spreading malware to defacing it or stealing customer - data.

-

The last vulnerability generates a Denial of Service attack which - basically hangs the website, exhausts its memory consumption, and - shuts it down.

-

The PHP security team issued fixes for two of the vulnerabilities - on the 13th of October and 1st of December.

-
- - - - http://blog.checkpoint.com/2016/12/27/check-point-discovers-three-zero-day-vulnerabilities-web-programming-language-php-7/ - CVE-2016-7478 - CVE-2016-7479 - CVE-2016-7480 - - - 2016-12-27 - 2016-12-29 - 2017-01-04 - - - - - PHP -- multiple vulnerabilities - - - php70 - 7.0.14 - - - - -

The PHP project reports:

-
-
    -
  • Use After Free Vulnerability in unserialize() (CVE-2016-9936)
    • -
  • Invalid read when wddx decodes empty boolean element - (CVE-2016-9935)
    • -
-
- - - - http://php.net/ChangeLog-7.php#7.0.14 - CVE-2016-9935 - CVE-2016-9936 - - - 2016-12-08 - 2016-12-29 - - - - - phpmailer -- Remote Code Execution - - - phpmailer - 5.2.20 - - - tt-rss - 29.12.2016.04.37 - - - - -

Legal Hackers reports:

-
-

An independent research uncovered a critical vulnerability in - PHPMailer that could potentially be used by (unauthenticated) - remote attackers to achieve remote arbitrary code execution in - the context of the web server user and remotely compromise the - target web application.

-

To exploit the vulnerability an attacker could target common - website components such as contact/feedback forms, registration - forms, password email resets and others that send out emails with - the help of a vulnerable version of the PHPMailer class.

-

The first patch of the vulnerability CVE-2016-10033 was incomplete. - This advisory demonstrates the bypass of the patch. The bypass allows - to carry out Remote Code Execution on all current versions (including - 5.2.19).

-
- - - - https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10045-Vuln-Patch-Bypass.html - CVE-2016-10045 - - - 2016-12-28 - 2016-12-28 - - - - - samba -- multiple vulnerabilities - - - samba36 - 3.6.03.6.25_4 - - - samba4 - 4.0.04.0.26 - - - samba41 - 4.1.04.1.23 - - - samba42 - 4.2.04.2.14 - - - samba43 - 4.3.04.3.13 - - - samba44 - 4.4.04.4.8 - - - samba45 - 4.5.04.5.3 - - - - -

Samba team reports:

-
-

[CVE-2016-2123] Authenticated users can supply malicious dnsRecord attributes - on DNS objects and trigger a controlled memory corruption.

-

[CVE-2016-2125] Samba client code always requests a forwardable ticket - when using Kerberos authentication. This means the target server, which must be in the current or trusted - domain/realm, is given a valid general purpose Kerberos "Ticket Granting Ticket" (TGT), which can be used to - fully impersonate the authenticated user or service.

-

[CVE-2016-2126] A remote, authenticated, attacker can cause the winbindd process - to crash using a legitimate Kerberos ticket due to incorrect handling of the PAC checksum. - A local service with access to the winbindd privileged pipe can cause winbindd to cache elevated access permissions.

-
- - - - CVE-2016-2123 - https://www.samba.org/samba/security/CVE-2016-2123.html - CVE-2016-2125 - https://www.samba.org/samba/security/CVE-2016-2125.html - CVE-2016-2126 - https://www.samba.org/samba/security/CVE-2016-2126.html - - - 2016-12-19 - 2016-12-26 - 2016-12-26 - - - - - upnp -- multiple vulnerabilities - - - upnp - 1.6.21 - - - - -

Matthew Garett reports:

-
-

Reported this to upstream 8 months ago without response, - so: libupnp's default behaviour allows anyone to write to your - filesystem. Seriously. Find a device running a libupnp based server - (Shodan says there's rather a lot), and POST a file to /testfile. - Then GET /testfile ... and yeah if the server is running as root - (it is) and is using / as the web root (probably not, but maybe) - this gives full host fs access.

-
-

Scott Tenaglia reports:

-
-

There is a heap buffer overflow vulnerability in the - create_url_list function in upnp/src/gena/gena_device.c.

-
- - - - https://twitter.com/mjg59/status/755062278513319936 - https://sourceforge.net/p/pupnp/bugs/133/ - CVE-2016-6255 - CVE-2016-8863 - - - 2016-02-23 - 2016-12-27 - - - - - phpmailer -- Remote Code Execution - - - phpmailer - 5.2.18 - - - tt-rss - 26.12.2016.07.29 - - - - -

Legal Hackers reports:

-
-

An independent research uncovered a critical vulnerability in - PHPMailer that could potentially be used by (unauthenticated) - remote attackers to achieve remote arbitrary code execution in - the context of the web server user and remotely compromise the - target web application.

-

To exploit the vulnerability an attacker could target common - website components such as contact/feedback forms, registration - forms, password email resets and others that send out emails with - the help of a vulnerable version of the PHPMailer class.

-
- - - - http://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html - https://github.com/PHPMailer/PHPMailer/blob/master/SECURITY.md - CVE-2016-10033 - - - 2016-12-26 - 2016-12-26 - - - - - exim -- DKIM private key leak - - - exim - 4.694.87.1 - - - - -

The Exim project reports:

-
-

Exim leaks the private DKIM signing key to the log files. - Additionally, if the build option EXPERIMENTAL_DSN_INFO=yes is used, - the key material is included in the bounce message.

-
- - - - https://exim.org/static/doc/CVE-2016-9963.txt - CVE-2016-9963 - - - 2016-12-15 - 2016-12-25 - - - - - - - - - cURL -- uninitialized random vulnerability - - - curl - 7.52.07.52.1 - - - - -

Project curl Security Advisory:

-
-

libcurl's (new) internal function that returns a good 32bit - random value was implemented poorly and overwrote the pointer - instead of writing the value into the buffer the pointer - pointed to.

-

This random value is used to generate nonces for Digest and - NTLM authentication, for generating boundary strings in HTTP - formposts and more. Having a weak or virtually non-existent - random there makes these operations vulnerable.

-

This function is brand new in 7.52.0 and is the result of an - overhaul to make sure libcurl uses strong random as much as - possible - provided by the backend TLS crypto libraries when - present. The faulty function was introduced in this commit.

-

We are not aware of any exploit of this flaw.

-
- - - - https://curl.haxx.se/docs/adv_20161223.html - CVE-2016-9594 - - - 2016-12-23 - 2016-12-24 - - - - - squid -- multiple vulnerabilities - - - squid - 3.13.5.23 - - - squid-devel - 4.04.0.17 - - - - -

Squid security advisory 2016:10 reports:

-
-

Due to incorrect comparison of request headers Squid can deliver - responses containing private data to clients it should not have - reached.

-

This problem allows a remote attacker to discover private and - sensitive information about another clients browsing session. - Potentially including credentials which allow access to further - sensitive resources. This problem only affects Squid configured - to use the Collapsed Forwarding feature. It is of particular - importance for HTTPS reverse-proxy sites with Collapsed - Forwarding.

-
-

Squid security advisory 2016:11 reports:

-
-

Due to incorrect HTTP conditional request handling Squid can - deliver responses containing private data to clients it should not - have reached.

-

This problem allows a remote attacker to discover private and - sensitive information about another clients browsing session. - Potentially including credentials which allow access to further - sensitive resources..

-
- - - - CVE-2016-10002 - CVE-2016-10003 - ports/215416 - ports/215418 - http://www.squid-cache.org/Advisories/SQUID-2016_10.txt - http://www.squid-cache.org/Advisories/SQUID-2016_11.txt - - - 2016-12-16 - 2016-12-23 - - - - - vim -- arbitrary command execution - - - vim - vim-console - vim-lite - 8.0.0056 - - - neovim - 0.1.7 - - - - -

Mitre reports:

-
-

vim before patch 8.0.0056 does not properly validate values for the - 'filetype', 'syntax' and 'keymap' options, which may result in the - execution of arbitrary code if a file with a specially crafted - modeline is opened.

-
- - - - CVE-2016-1248 - 94478 - https://github.com/vim/vim/commit/d0b5138ba4bccff8a744c99836041ef6322ed39a - https://github.com/neovim/neovim/commit/4fad66fbe637818b6b3d6bc5d21923ba72795040 - - - 2016-11-22 - 2016-12-23 - - - - - Pligg CMS -- XSS Vulnerability - - - pligg - 2.0.2,1 - - - - -

Netsparker reports:

-
-

Proof of Concept URL for XSS in Pligg CMS:

-

Page: groups.php

-

Parameter Name: keyword

-

Parameter Type: GET

-

Attack Pattern: http://example.com/pligg-cms-2.0.2/groups.php?view=search&keyword='+alert(0x000D82)+'

-

For more information on cross-site scripting vulnerabilities read the article Cross-site Scripting (XSS).

-
- - - - https://www.netsparker.com/web-applications-advisories/ns-15-011-xss-vulnerability-identified-in-pligg-cms/ - - - 2015-05-13 - 2016-12-22 - - - - - FreeBSD -- Multiple vulnerabilities of ntp - - - FreeBSD - 11.011.0_6 - 10.310.3_15 - 10.210.2_28 - 10.110.1_45 - 9.39.3_53 - - - - -

Problem Description:

-

Multiple vulnerabilities have been discovered in the NTP - suite:

-

CVE-2016-9311: Trap crash, Reported by Matthew Van Gundy - of Cisco ASIG.

-

CVE-2016-9310: Mode 6 unauthenticated trap information - disclosure and DDoS vector. Reported by Matthew Van Gundy - of Cisco ASIG.

-

CVE-2016-7427: Broadcast Mode Replay Prevention DoS. - Reported by Matthew Van Gundy of Cisco ASIG.

-

CVE-2016-7428: Broadcast Mode Poll Interval Enforcement - DoS. Reported by Matthew Van Gundy of Cisco ASIG.

-

CVE-2016-7431: Regression: 010-origin: Zero Origin - Timestamp Bypass. Reported by Sharon Goldberg and Aanchal - Malhotra of Boston University.

-

CVE-2016-7434: Null pointer dereference in - _IO_str_init_static_internal(). Reported by Magnus Stubman.

-

CVE-2016-7426: Client rate limiting and server responses. - Reported by Miroslav Lichvar of Red Hat.

-

CVE-2016-7433: Reboot sync calculation problem. Reported - independently by Brian Utterback of Oracle, and by Sharon - Goldberg and Aanchal Malhotra of Boston University.

-

Impact:

-

A remote attacker who can send a specially crafted packet - to cause a NULL pointer dereference that will crash ntpd, - resulting in a Denial of Service. [CVE-2016-9311]

-

An exploitable configuration modification vulnerability - exists in the control mode (mode 6) functionality of ntpd. - If, against long-standing BCP recommendations, "restrict - default noquery ..." is not specified, a specially crafted - control mode packet can set ntpd traps, providing information - disclosure and DDoS amplification, and unset ntpd traps, - disabling legitimate monitoring by an attacker from remote. - [CVE-2016-9310]

-

An attacker with access to the NTP broadcast domain can - periodically inject specially crafted broadcast mode NTP - packets into the broadcast domain which, while being logged - by ntpd, can cause ntpd to reject broadcast mode packets - from legitimate NTP broadcast servers. [CVE-2016-7427]

-

An attacker with access to the NTP broadcast domain can - send specially crafted broadcast mode NTP packets to the - broadcast domain which, while being logged by ntpd, will - cause ntpd to reject broadcast mode packets from legitimate - NTP broadcast servers. [CVE-2016-7428]

-

Origin timestamp problems were fixed in ntp 4.2.8p6. - However, subsequent timestamp validation checks introduced - a regression in the handling of some Zero origin timestamp - checks. [CVE-2016-7431]

-

If ntpd is configured to allow mrulist query requests - from a server that sends a crafted malicious packet, ntpd - will crash on receipt of that crafted malicious mrulist - query packet. [CVE-2016-7434]

-

An attacker who knows the sources (e.g., from an IPv4 - refid in server response) and knows the system is (mis)configured - in this way can periodically send packets with spoofed - source address to keep the rate limiting activated and - prevent ntpd from accepting valid responses from its sources. - [CVE-2016-7426]

-

Ntp Bug 2085 described a condition where the root delay - was included twice, causing the jitter value to be higher - than expected. Due to a misinterpretation of a small-print - variable in The Book, the fix for this problem was incorrect, - resulting in a root distance that did not include the peer - dispersion. The calculations and formulas have been reviewed - and reconciled, and the code has been updated accordingly. - [CVE-2016-7433]

- - - - CVE-2016-7426 - CVE-2016-7427 - CVE-2016-7428 - CVE-2016-7431 - CVE-2016-7433 - CVE-2016-7434 - CVE-2016-9310 - CVE-2016-9311 - SA-16:39.ntp - - - 2016-12-22 - 2016-12-22 - - - - - cURL -- buffer overflow - - - curl - 7.17.52 - - - - -

The cURL project reports:

-
-

printf floating point buffer overflow

-

libcurl's implementation of the printf() functions triggers a - buffer overflow when doing a large floating point output. The bug - occurs when the conversion outputs more than 255 bytes.

-
- - - - https://curl.haxx.se/docs/vuln-7.51.0.html - CVE-2016-9586 - - - 2016-12-21 - 2016-12-22 - - - - - Joomla! -- multiple vulnerabilities - - - joomla3 - 1.6.03.6.5 - - - - -

The JSST and the Joomla! Security Center report:

-
-

[20161201] - Core - Elevated Privileges

-

Incorrect use of unfiltered data stored to the session on a form - validation failure allows for existing user accounts to be modified; - to include resetting their username, password, and user group - assignments.

-
-
-

[20161202] - Core - Shell Upload

-

Inadequate filesystem checks allowed files with alternative PHP - file extensions to be uploaded.

-
-
-

[20161203] - Core - Information Disclosure

-

Inadequate ACL checks in the Beez3 com_content article layout - override enables a user to view restricted content.

-
- - - - CVE-2016-9836 - CVE-2016-9837 - CVE-2016-9838 - https://developer.joomla.org/security-centre/664-20161201-core-elevated-privileges.html - https://developer.joomla.org/security-centre/665-20161202-core-shell-upload.html - https://developer.joomla.org/security-centre/666-20161203-core-information-disclosure.html - https://www.joomla.org/announcements/release-news/5693-joomla-3-6-5-released.html - - - 2016-12-06 - 2016-12-22 - - - - - Joomla! -- multiple vulnerabilities - - - joomla3 - 3.4.43.6.4 - - - - -

The JSST and the Joomla! Security Center report:

-
-

[20161001] - Core - Account Creation

-

Inadequate checks allows for users to register on a site when - registration has been disabled.

-
-
-

[20161002] - Core - Elevated Privilege

-

Incorrect use of unfiltered data allows for users to register on a - site with elevated privileges.

-
-
-

[20161003] - Core - Account Modifications

-

Incorrect use of unfiltered data allows for existing user accounts - to be modified; to include resetting their username, password, and - user group assignments.

-
- - - - CVE-2016-8869 - CVE-2016-8870 - CVE-2016-9081 - https://developer.joomla.org/security-centre/659-20161001-core-account-creation.html - https://developer.joomla.org/security-centre/660-20161002-core-elevated-privileges.html - https://developer.joomla.org/security-centre/661-20161003-core-account-modifications.html - https://www.joomla.org/announcements/release-news/5678-joomla-3-6-4-released.html - - - 2016-10-25 - 2016-12-22 - - - - - Joomla! -- multiple vulnerabilities - - - joomla3 - 1.6.03.6.1 - - - - -

The JSST and the Joomla! Security Center report:

-
-

[20160801] - Core - ACL Violation

-

Inadequate ACL checks in com_content provide potential read access - to data which should be access restricted to users with edit_own - level.

-
-
-

[20160802] - Core - XSS Vulnerability

-

Inadequate escaping leads to XSS vulnerability in mail component. -

-
-
-

[20160803] - Core - CSRF

-

Add additional CSRF hardening in com_joomlaupdate.

-
- - - - https://developer.joomla.org/security-centre/652-20160801-core-core-acl-violations.html - https://developer.joomla.org/security-centre/653-20160802-core-xss-vulnerability.html - https://developer.joomla.org/security-centre/654-20160803-core-csrf.html - https://www.joomla.org/announcements/release-news/5665-joomla-3-6-1-released.html - - - 2016-08-03 - 2016-12-22 - - - - - Joomla! -- multiple vulnerabilities - - - joomla3 - 1.5.03.4.7 - - - - -

The JSST and the Joomla! Security Center report:

-
-

[20151206] - Core - Session Hardening

-

The Joomla Security Strike team has been following up on the - critical security vulnerability patched last week. Since the recent - update it has become clear that the root cause is a bug in PHP - itself. This was fixed by PHP in September of 2015 with the releases - of PHP 5.4.45, 5.5.29, 5.6.13 (Note that this is fixed in all - versions of PHP 7 and has been back-ported in some specific Linux - LTS versions of PHP 5.3). This fixes the bug across all supported - PHP versions.

-
-
-

[20151207] - Core - SQL Injection

-

Inadequate filtering of request data leads to a SQL Injection - vulnerability.

-
- - - - https://developer.joomla.org/security-centre/639-20151206-core-session-hardening.html - https://developer.joomla.org/security-centre/640-20151207-core-sql-injection.html - https://www.joomla.org/announcements/release-news/5643-joomla-3-4-7.html - - - 2015-12-21 - 2016-12-22 - - - - - xen-kernel -- x86 PV guests may be able to mask interrupts - - - xen-kernel - 4.7.1_3 - - - - -

The Xen Project reports:

-
-

Certain PV guest kernel operations (page table writes in - particular) need emulation, and use Xen's general x86 instruction - emulator. This allows a malicious guest kernel which asynchronously - modifies its instruction stream to effect the clearing of EFLAGS.IF - from the state used to return to guest context.

-

A malicious guest kernel administrator can cause a host hang or - crash, resulting in a Denial of Service.

-
- - - - CVE-2016-10024 - https://xenbits.xen.org/xsa/advisory-202.html - - - 2016-12-21 - 2016-12-22 - - - - - Apache httpd -- several vulnerabilities - - - apache24 - 2.4.25 - - - - -

Apache Software Foundation reports:

-
-

Please reference CVE/URL list for details

-
- - - - http://httpd.apache.org/security/vulnerabilities_24.html - CVE-2016-8743 - CVE-2016-2161 - CVE-2016-0736 - CVE-2016-8740 - CVE-2016-5387 - - - 2016-12-20 - 2016-12-21 - 2016-12-22 - - - - - xen-kernel -- x86: Mishandling of SYSCALL singlestep during emulation - - - xen-kernel - 4.7.1_2 - - - - -

The Xen Project reports:

-
-

The typical behaviour of singlestepping exceptions is determined at - the start of the instruction, with a #DB trap being raised at the - end of the instruction. SYSCALL (and SYSRET, although we don't - implement it) behave differently because the typical behaviour - allows userspace to escalate its privilege. (This difference in - behaviour seems to be undocumented.) Xen wrongly raised the - exception based on the flags at the start of the instruction.

-

Guest userspace which can invoke the instruction emulator can use - this flaw to escalate its privilege to that of the guest kernel.

-
- - - - CVE-2016-10013 - http://xenbits.xen.org/xsa/advisory-204.html - - - 2016-12-19 - 2016-12-20 - - - - - atheme-services -- multiple vulnerabilities - - - atheme-services - 7.2.7 - - - - -

Mitre reports:

-
-

modules/chanserv/flags.c in Atheme before 7.2.7 allows remote - attackers to modify the Anope FLAGS behavior by registering and - dropping the (1) LIST, (2) CLEAR, or (3) MODIFY keyword nicks.

-
-
-

Buffer overflow in the xmlrpc_char_encode function in - modules/transport/xmlrpc/xmlrpclib.c in Atheme before 7.2.7 allows - remote attackers to cause a denial of service via vectors related - to XMLRPC response encoding.

-
- - - - ports/209217 - CVE-2014-9773 - CVE-2016-4478 - https://github.com/atheme/atheme/commit/87580d767868360d2fed503980129504da84b63e - https://github.com/atheme/atheme/commit/c597156adc60a45b5f827793cd420945f47bc03b - - - 2016-01-09 - 2016-12-16 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 50.1.0_1,1 - - - seamonkey - linux-seamonkey - 2.47 - - - firefox-esr - 45.6.0,1 - - - linux-firefox - 45.6.0,2 - - - libxul - thunderbird - linux-thunderbird - 45.6.0 - - - - -

Mozilla Foundation reports:

-
-

CVE-2016-9894: Buffer overflow in SkiaGL

-

CVE-2016-9899: Use-after-free while manipulating DOM events and audio elements

-

CVE-2016-9895: CSP bypass using marquee tag

-

CVE-2016-9896: Use-after-free with WebVR

-

CVE-2016-9897: Memory corruption in libGLES

-

CVE-2016-9898: Use-after-free in Editor while manipulating DOM subtrees

-

CVE-2016-9900: Restricted external resources can be loaded by SVG images through data URLs

-

CVE-2016-9904: Cross-origin information leak in shared atoms

-

CVE-2016-9901: Data from Pocket server improperly sanitized before execution

-

CVE-2016-9902: Pocket extension does not validate the origin of events

-

CVE-2016-9903: XSS injection vulnerability in add-ons SDK

-

CVE-2016-9080: Memory safety bugs fixed in Firefox 50.1

-

CVE-2016-9893: Memory safety bugs fixed in Firefox 50.1 and Firefox ESR 45.6

-
- - - - CVE-2016-9894 - CVE-2016-9899 - CVE-2016-9895 - CVE-2016-9896 - CVE-2016-9897 - CVE-2016-9898 - CVE-2016-9900 - CVE-2016-9904 - CVE-2016-9901 - CVE-2016-9902 - CVE-2016-9903 - CVE-2016-9080 - CVE-2016-9893 - https://www.mozilla.org/security/advisories/mfsa2016-94/ - https://www.mozilla.org/security/advisories/mfsa2016-95/ - - - 2016-12-13 - 2016-12-14 - - - - - wordpress -- multiple vulnerabilities - - - wordpress - 4.6.1,1 - - - de-wordpress - ja-wordpress - ru-wordpress - zh-wordpress-zh_CN - zh-wordpress-zh_TW - 4.6.1 - - - - -

Jeremy Felt reports:

-
-

WordPress versions 4.6 and earlier are affected by two security - issues: a cross-site scripting vulnerability via image filename, - reported by SumOfPwn researcher Cengiz Han Sahin; and a path - traversal vulnerability in the upgrade package uploader, reported - by Dominik Schilling from the WordPress security team.

-
- - - - https://wordpress.org/news/2016/09/wordpress-4-6-1-security-and-maintenance-release/ - - - 2016-09-07 - 2016-12-14 - - - - - xen-kernel -- x86 CMPXCHG8B emulation fails to ignore operand size override - - - xen-kernel - 4.7.1_1 - - - - -

The Xen Project reports:

-
-

The x86 instruction CMPXCHG8B is supposed to ignore legacy operand - size overrides; it only honors the REX.W override (making it - CMPXCHG16B). So, the operand size is always 8 or 16. When support - for CMPXCHG16B emulation was added to the instruction emulator, - this restriction on the set of possible operand sizes was relied on - in some parts of the emulation; but a wrong, fully general, operand - size value was used for other parts of the emulation. As a result, - if a guest uses a supposedly-ignored operand size prefix, a small - amount of hypervisor stack data is leaked to the guests: a 96 bit - leak to guests running in 64-bit mode; or, a 32 bit leak to other - guests.

-

A malicious unprivileged guest may be able to obtain sensitive - information from the host.

-
- - - - CVE-2016-9932 - http://xenbits.xen.org/xsa/advisory-200.html - - - 2016-12-13 - 2016-12-14 - - - - - PHP -- Multiple vulnerabilities - - - php56 - 5.6.29 - - - php70 - 7.0.14 - - - - -

The PHP project reports:

-
-

This is a security release. Several security bugs were fixed in - this release.

-
- - - - http://php.net/archive/2016.php#id2016-12-08-1 - http://php.net/archive/2016.php#id2016-12-08-2 - - - 2016-12-12 - 2016-12-12 - - - - - asterisk -- Authentication Bypass - - - asterisk11 - 11.25.1 - - - asterisk13 - 13.13.1 - - - - -

The Asterisk project reports:

-
-

The chan_sip channel driver has a liberal definition - for whitespace when attempting to strip the content between - a SIP header name and a colon character. Rather than - following RFC 3261 and stripping only spaces and horizontal - tabs, Asterisk treats any non-printable ASCII character - as if it were whitespace.

-

This mostly does not pose a problem until Asterisk is - placed in tandem with an authenticating SIP proxy. In - such a case, a crafty combination of valid and invalid - To headers can cause a proxy to allow an INVITE request - into Asterisk without authentication since it believes - the request is an in-dialog request. However, because of - the bug described above, the request will look like an - out-of-dialog request to Asterisk. Asterisk will then - process the request as a new call. The result is that - Asterisk can process calls from unvetted sources without - any authentication.

-

If you do not use a proxy for authentication, then - this issue does not affect you.

-

If your proxy is dialog-aware (meaning that the proxy - keeps track of what dialogs are currently valid), then - this issue does not affect you.

-

If you use chan_pjsip instead of chan_sip, then this - issue does not affect you.

-
- - - - http://downloads.digium.com/pub/security/ASTERISK-2016-009.html - - - 2016-11-28 - 2016-12-09 - - - - - asterisk -- Crash on SDP offer or answer from endpoint using Opus - - - asterisk13 - 13.12.013.13.1 - - - - -

The Asterisk project reports:

-
-

If an SDP offer or answer is received with the Opus - codec and with the format parameters separated using a - space the code responsible for parsing will recursively - call itself until it crashes. This occurs as the code - does not properly handle spaces separating the parameters. - This does NOT require the endpoint to have Opus configured - in Asterisk. This also does not require the endpoint to - be authenticated. If guest is enabled for chan_sip or - anonymous in chan_pjsip an SDP offer or answer is still - processed and the crash occurs.

-
- - - - http://downloads.asterisk.org/pub/security/AST-2016-008.html - - - 2016-11-11 - 2016-12-09 - - - - - cryptopp -- multiple vulnerabilities - - - cryptopp - 5.6.5 - - - - -

Multiple sources report:

-
-

CVE-2015-2141: The InvertibleRWFunction::CalculateInverse function - in rw.cpp in libcrypt++ 5.6.2 does not properly blind private key - operations for the Rabin-Williams digital signature algorithm, which - allows remote attackers to obtain private keys via a timing attack. - Fixed in 5.6.3.

-
-
-

CVE-2016-3995: Incorrect implementation of Rijndael timing attack - countermeasure. Fixed in 5.6.4.

-
-
-

CVE-2016-7420: Library built without -DNDEBUG could egress sensitive - information to the filesystem via a core dump if an assert was triggered. - Fixed in 5.6.5.

-
- - - - https://eprint.iacr.org/2015/368 - https://github.com/weidai11/cryptopp/issues/146 - https://github.com/weidai11/cryptopp/issues/277 - CVE-2015-2141 - CVE-2016-3995 - CVE-2016-7420 - - - 2015-02-27 - 2016-12-06 - - - - - FreeBSD -- bhyve(8) virtual machine escape - - - FreeBSD - 11.011.0_4 - 10.310.3_13 - 10.210.2_26 - 10.110.1_43 - - - - -

Problem Description:

-

The bounds checking of accesses to guest memory greater - than 4GB by device emulations is subject to integer - overflow.

-

Impact:

-

For a bhyve virtual machine with more than 3GB of guest - memory configured, a malicious guest could craft device - descriptors that could give it access to the heap of the - bhyve process. Since the bhyve process is running as root, - this may allow guests to obtain full control of the hosts - they're running on.

- - - - CVE-2016-1889 - SA-16:38.bhyve - - - 2016-12-06 - 2016-12-06 - - - - - FreeBSD -- link_ntoa(3) buffer overflow - - - FreeBSD - 11.011.0_5 - 10.310.3_14 - 10.210.2_27 - 10.110.1_44 - 9.39.3_52 - - - - -

Problem Description:

-

A specially crafted argument can trigger a static buffer - overflow in the library, with possibility to rewrite following - static buffers that belong to other library functions.

-

Impact:

-

Due to very limited use of the function in the existing - applications, and limited length of the overflow, exploitation - of the vulnerability does not seem feasible. None of the - utilities and daemons in the base system are known to be - vulnerable. However, careful review of third party software - that may use the function was not performed.

- - - - CVE-2016-6559 - SA-16:37.libc - - - 2016-12-06 - 2016-12-06 - 2016-12-08 - - - - - FreeBSD -- Possible login(1) argument injection in telnetd(8) - - - FreeBSD - 11.011.0_4 - 10.310.3_13 - 10.210.2_26 - 10.110.1_43 - 9.39.3_51 - - - - -

Problem Description:

-

An unexpected sequence of memory allocation failures - combined with insufficient error checking could result in - the construction and execution of an argument sequence that - was not intended.

-

Impact:

-

An attacker who controls the sequence of memory allocation - failures and success may cause login(1) to run without - authentication and may be able to cause misbehavior of - login(1) replacements.

-

No practical way of controlling these memory allocation - failures is known at this time.

- - - - CVE-2016-1888 - SA-16:36.telnetd - - - 2016-12-06 - 2016-12-06 - - - - - Apache httpd -- denial of service in HTTP/2 - - - apache24 - 2.4.172.4.23_1 - - - mod_http2-devel - 1.8.3 - - - - -

mod_http2 reports:

-
-

The Apache HTTPD web server (from 2.4.17-2.4.23) did not apply - limitations on request headers correctly when experimental module - for the HTTP/2 protocol is used to access a resource.

-

The net result is that a the server allocates too much memory - instead of denying the request. This can lead to memory exhaustion - of the server by a properly crafted request.

-
- - - - http://mail-archives.apache.org/mod_mbox/httpd-announce/201612.mbox/%3C1A097A43-7CCB-4BA1-861F-E0C7EEE83A4B%40apache.org%3E - https://github.com/icing/mod_h2/releases/tag/v1.8.3 - CVE-2016-8740 - - - 2016-12-06 - 2016-12-06 - - - - - chromium -- multiple vulnerabilities - - - chromium - chromium-npapi - chromium-pulse - 55.0.2883.75 - - - - -

Google Chrome Releases reports:

-
-

36 security fixes in this release

-

Please reference CVE/URL list for details

-
- - - - CVE-2016-9651 - CVE-2016-5208 - CVE-2016-5207 - CVE-2016-5206 - CVE-2016-5205 - CVE-2016-5204 - CVE-2016-5209 - CVE-2016-5203 - CVE-2016-5210 - CVE-2016-5212 - CVE-2016-5211 - CVE-2016-5213 - CVE-2016-5214 - CVE-2016-5216 - CVE-2016-5215 - CVE-2016-5217 - CVE-2016-5218 - CVE-2016-5219 - CVE-2016-5221 - CVE-2016-5220 - CVE-2016-5222 - CVE-2016-9650 - CVE-2016-5223 - CVE-2016-5226 - CVE-2016-5225 - CVE-2016-5224 - CVE-2016-9652 - https://googlechromereleases.blogspot.nl/2016/12/stable-channel-update-for-desktop.html - - - 2016-12-01 - 2016-12-05 - - - - - ImageMagick7 -- multiple vulnerabilities - - - ImageMagick7 - ImageMagick7-nox11 - 7.0.3.6 - - - - -

Multiple sources report:

-
-

CVE-2016-9298: heap overflow in WaveletDenoiseImage(), fixed in ImageMagick7-7.0.3.6, discovered 2016-10-31

-
-
-

CVE-2016-8866: memory allocation failure in AcquireMagickMemory (incomplete previous fix for CVE-2016-8862), not fixed yet with the release of this announcement, re-discovered 2016-10-13.

-
-
-

CVE-2016-8862: memory allocation failure in AcquireMagickMemory, initially partially fixed in ImageMagick7-7.0.3.3, discovered 2016-09-14.

-
- - - - https://github.com/ImageMagick/ImageMagick/issues/296 - https://blogs.gentoo.org/ago/2016/10/20/imagemagick-memory-allocation-failure-in-acquiremagickmemory-memory-c-incomplete-fix-for-cve-2016-8862/ - https://blogs.gentoo.org/ago/2016/10/17/imagemagick-memory-allocation-failure-in-acquiremagickmemory-memory-c/ - CVE-2016-9298 - CVE-2016-8866 - CVE-2016-8862 - ports/214514 - - - 2016-09-14 - 2016-12-04 - - - - - Pillow -- multiple vulnerabilities - - - py27-pillow - py33-pillow - py34-pillow - py35-pillow - 3.3.2 - - - - -

Pillow reports:

-
-

Pillow prior to 3.3.2 may experience integer overflow - errors in map.c when reading specially crafted image files. This may - lead to memory disclosure or corruption.

-

Pillow prior to 3.3.2 and PIL 1.1.7 (at least) do not check - for negative image sizes in ImagingNew in Storage.c. A negative image - size can lead to a smaller allocation than expected, leading to arbi - trary writes.

-
- - - - http://pillow.readthedocs.io/en/3.4.x/releasenotes/3.3.2.html - https://github.com/python-pillow/Pillow/issues/2105 - CVE-2016-9189 - CVE-2016-9190 - ports/214410 - - - 2016-09-06 - 2016-12-04 - - - - - ImageMagick -- heap overflow vulnerability - - - ImageMagick - ImageMagick-nox11 - 6.9.6.4,1 - - - ImageMagick7 - ImageMagick7-nox11 - 7.0.3.7 - - - - -

Bastien Roucaries reports:

-
-

Imagemagick before 3cbfb163cff9e5b8cdeace8312e9bfee810ed02b - suffer from a heap overflow in WaveletDenoiseImage(). This problem is - easily trigerrable from a Perl script.

-
- - - - http://seclists.org/oss-sec/2016/q4/413 - https://github.com/ImageMagick/ImageMagick/issues/296 - CVE-2016-9298 - ports/214517 - ports/214511 - ports/214520 - - - 2016-11-13 - 2016-12-04 - - - - - py-cryptography -- vulnerable HKDF key generation - - - py27-cryptography - py33-cryptography - py34-cryptography - py35-cryptography - 1.5.3 - - - - -

Alex Gaynor reports:

-
-

Fixed a bug where ``HKDF`` would return an empty - byte-string if used with a ``length`` less than - ``algorithm.digest_size``.

-
- - - - https://github.com/pyca/cryptography/commit/b94cacf2ae6e75e4007a79709bbf5360435b512d - CVE-2016-9243 - ports/214915 - - - 2016-11-05 - 2016-12-04 - 2016-12-06 - - - - - qemu -- denial of service vulnerability - - - qemu - qemu-devel - qemu-sbruno - 2.3.0 - - - - -

Daniel P. Berrange reports:

-
-

The VNC server websockets decoder will read and buffer data - from websockets clients until it sees the end of the HTTP headers, - as indicated by \r\n\r\n. In theory this allows a malicious to - trick QEMU into consuming an arbitrary amount of RAM.

-
- - - - https://lists.gnu.org/archive/html/qemu-devel/2015-03/msg04895.html - CVE-2015-1779 - ports/206725 - - - 2015-03-23 - 2016-12-04 - 2016-12-06 - - - - - xen-tools -- delimiter injection vulnerabilities in pygrub - - - xen-tools - 4.7.1 - - - - -

The Xen Project reports:

-
-

pygrub, the boot loader emulator, fails to quote (or sanity check) - its results when reporting them to its caller.

-

A malicious guest administrator can obtain the contents of - sensitive host files (an information leak). Additionally, a - malicious guest administrator can cause files on the host to be - removed, causing a denial of service. In some unusual host - configurations, ability to remove certain files may be usable for - privilege escalation.

-
- - - - CVE-2016-9379 - CVE-2016-9380 - ports/214936 - https://xenbits.xen.org/xsa/advisory-198.html - - - 2016-11-22 - 2016-12-04 - - - - - xen-tools -- qemu incautious about shared ring processing - - - xen-tools - 4.7.1 - - - - -

The Xen Project reports:

-
-

The compiler can emit optimizations in qemu which can lead to - double fetch vulnerabilities. Specifically data on the rings shared - between qemu and the hypervisor (which the guest under control can - obtain mappings of) can be fetched twice (during which time the - guest can alter the contents) possibly leading to arbitrary code - execution in qemu.

-

Malicious administrators can exploit this vulnerability to take - over the qemu process, elevating its privilege to that of the qemu - process.

-

In a system not using a device model stub domain (or other - techniques for deprivileging qemu), malicious guest administrators - can thus elevate their privilege to that of the host.

-
- - - - CVE-2016-9381 - ports/214936 - https://xenbits.xen.org/xsa/advisory-197.html - - - 2016-11-22 - 2016-12-04 - - - - - xen-kernel -- x86 64-bit bit test instruction emulation broken - - - xen-kernel - 4.7.1 - - - - -

The Xen Project reports:

-
-

The x86 instructions BT, BTC, BTR, and BTS, when used with a - destination memory operand and a source register rather than an - immediate operand, access a memory location offset from that - specified by the memory operand as specified by the high bits of - the register source.

-

A malicious guest can modify arbitrary memory, allowing for - arbitrary code execution (and therefore privilege escalation - affecting the whole host), a crash of the host (leading to a DoS), - or information leaks. The vulnerability is sometimes exploitable - by unprivileged guest user processes.

-
- - - - CVE-2016-9383 - ports/214936 - https://xenbits.xen.org/xsa/advisory-195.html - - - 2016-11-22 - 2016-12-04 - - - - - xen-kernel -- guest 32-bit ELF symbol table load leaking host data - - - xen-kernel - 4.74.7.1 - - - - -

The Xen Project reports:

-
-

Along with their main kernel binary, unprivileged guests may - arrange to have their Xen environment load (kernel) symbol tables - for their use. The ELF image metadata created for this purpose has a - few unused bytes when the symbol table binary is in 32-bit ELF - format. These unused bytes were not properly cleared during symbol - table loading.

-

A malicious unprivileged guest may be able to obtain sensitive - information from the host.

-

The information leak is small and not under the control of the - guest, so effectively exploiting this vulnerability is probably - difficult.

-
- - - - CVE-2016-9384 - ports/214936 - https://xenbits.xen.org/xsa/advisory-194.html - - - 2016-11-22 - 2016-12-04 - - - - - xen-kernel -- x86 segment base write emulation lacking canonical address checks - - - xen-kernel - 4.44.7.1 - - - - -

The Xen Project reports:

-
-

Both writes to the FS and GS register base MSRs as well as the - WRFSBASE and WRGSBASE instructions require their input values to be - canonical, or a #GP fault will be raised. When the use of those - instructions by the hypervisor was enabled, the previous guard - against #GP faults (having recovery code attached) was accidentally - removed.

-

A malicious guest administrator can crash the host, leading to a - DoS.

-
- - - - CVE-2016-9385 - ports/214936 - https://xenbits.xen.org/xsa/advisory-193.html - - - 2016-11-22 - 2016-12-04 - - - - - xen-kernel -- x86 task switch to VM86 mode mis-handled - - - xen-kernel - 4.7.1 - - - - -

The Xen Project reports:

-
-

LDTR, just like TR, is purely a protected mode facility. Hence even - when switching to a VM86 mode task, LDTR loading needs to follow - protected mode semantics. This was violated by the code.

-

On SVM (AMD hardware): a malicious unprivileged guest process can - escalate its privilege to that of the guest operating system.

-

On both SVM and VMX (Intel hardware): a malicious unprivileged - guest process can crash the guest.

-
- - - - CVE-2016-9382 - ports/214936 - https://xenbits.xen.org/xsa/advisory-192.html - - - 2016-11-22 - 2016-12-04 - - - - - xen-kernel -- x86 null segments not always treated as unusable - - - xen-kernel - 4.7.1 - - - - -

The Xen Project reports:

-
-

The Xen x86 emulator erroneously failed to consider the unusability - of segments when performing memory accesses.

-

The intended behaviour is as follows: The user data segment (%ds, - %es, %fs and %gs) selectors may be NULL in 32-bit to prevent access. - In 64-bit, NULL has a special meaning for user segments, and there - is no way of preventing access. However, in both 32-bit and 64-bit, - a NULL LDT system segment is intended to prevent access.

-

On Intel hardware, loading a NULL selector zeros the base as well - as most attributes, but sets the limit field to its largest possible - value. On AMD hardware, loading a NULL selector zeros the attributes, - leaving the stale base and limit intact.

-

Xen may erroneously permit the access using unexpected base/limit - values.

-

Ability to exploit this vulnerability on Intel is easy, but on AMD - depends in a complicated way on how the guest kernel manages LDTs. -

-

An unprivileged guest user program may be able to elevate its - privilege to that of the guest operating system.

-
- - - - CVE-2016-9386 - ports/214936 - https://xenbits.xen.org/xsa/advisory-191.html - - - 2016-11-22 - 2016-12-04 - - - - - xen-kernel -- CR0.TS and CR0.EM not always honored for x86 HVM guests - - - xen-kernel - 4.7.1 - - - - -

The Xen Project reports:

-
-

Instructions touching FPU, MMX, or XMM registers are required to - raise a Device Not Available Exception (#NM) when either CR0.EM or - CR0.TS are set. (Their AVX or AVX-512 extensions would consider only - CR0.TS.) While during normal operation this is ensured by the - hardware, if a guest modifies instructions while the hypervisor is - preparing to emulate them, the #NM delivery could be missed.

-

Guest code in one task may thus (unintentionally or maliciously) - read or modify register state belonging to another task in the same - VM.

-

A malicious unprivileged guest user may be able to obtain or - corrupt sensitive information (including cryptographic material) in - other programs in the same guest.

-
- - - - CVE-2016-7777 - ports/214936 - https://xenbits.xen.org/xsa/advisory-190.html - - - 2016-10-04 - 2016-12-04 - - - - - xen-kernel -- use after free in FIFO event channel code - - - xen-kernel - 4.44.5 - - - - -

The Xen Project reports:

-
-

When the EVTCHNOP_init_control operation is called with a bad guest - frame number, it takes an error path which frees a control structure - without also clearing the corresponding pointer. Certain subsequent - operations (EVTCHNOP_expand_array or another EVTCHNOP_init_control), - upon finding the non-NULL pointer, continue operation assuming it - points to allocated memory.

-

A malicious guest administrator can crash the host, leading to a - DoS. Arbitrary code execution (and therefore privilege escalation), - and information leaks, cannot be excluded.

-
- - - - CVE-2016-7154 - ports/214936 - https://xenbits.xen.org/xsa/advisory-188.html - - - 2016-09-08 - 2016-12-04 - - - - - xen-kernel -- x86 HVM: Overflow of sh_ctxt->seg_reg[] - - - xen-kernel - 4.7.1 - - - - -

The Xen Project reports:

-
-

x86 HVM guests running with shadow paging use a subset of the x86 - emulator to handle the guest writing to its own pagetables. There - are situations a guest can provoke which result in exceeding the - space allocated for internal state.

-

A malicious HVM guest administrator can cause Xen to fail a bug - check, causing a denial of service to the host.

-
- - - - CVE-2016-7094 - ports/214936 - https://xenbits.xen.org/xsa/advisory-187.html - - - 2016-09-08 - 2016-12-04 - - - - - xen-kernel -- x86: Mishandling of instruction pointer truncation during emulation - - - xen-kernel - 4.5.3 - 4.6.3 - 4.7.04.7.1 - - - - -

The Xen Project reports:

-
-

When emulating HVM instructions, Xen uses a small i-cache for - fetches from guest memory. The code that handles cache misses does - not check if the address from which it fetched lies within the cache - before blindly writing to it. As such it is possible for the guest - to overwrite hypervisor memory.

-

It is currently believed that the only way to trigger this bug is - to use the way that Xen currently incorrectly wraps CS:IP in 16 bit - modes. The included patch prevents such wrapping.

-

A malicious HVM guest administrator can escalate their privilege to - that of the host.

-
- - - - CVE-2016-7093 - ports/214936 - https://xenbits.xen.org/xsa/advisory-186.html - - - 2016-09-08 - 2016-12-04 - - - - - xen-kernel -- x86: Disallow L3 recursive pagetable for 32-bit PV guests - - - xen-kernel - 4.7.1 - - - - -

The Xen Project reports:

-
-

On real hardware, a 32-bit PAE guest must leave the USER and RW bit - clear in L3 pagetable entries, but the pagetable walk behaves as if - they were set. (The L3 entries are cached in processor registers, - and don't actually form part of the pagewalk.)

-

When running a 32-bit PV guest on a 64-bit Xen, Xen must always OR - in the USER and RW bits for L3 updates for the guest to observe - architectural behaviour. This is unsafe in combination with - recursive pagetables.

-

As there is no way to construct an L3 recursive pagetable in native - 32-bit PAE mode, disallow this option in 32-bit PV guests.

-

A malicious 32-bit PV guest administrator can escalate their - privilege to that of the host.

-
- - - - CVE-2016-7092 - ports/214936 - https://xenbits.xen.org/xsa/advisory-185.html - - - 2016-09-08 - 2016-12-04 - - - - - wireshark -- multiple vulnerabilities - - - tshark - 2.2.2 - - - tshark-lite - 2.2.2 - - - wireshark - 2.2.2 - - - wireshark-lite - 2.2.2 - - - wireshark-qt5 - 2.2.2 - - - - -

Wireshark project reports:

-
-

Wireshark project is releasing Wireshark 2.2.2, which addresses:

-
    -
  • wnpa-sec-2016-58: Profinet I/O long loop - CVE-2016-9372
    • -
  • wnpa-sec-2016-59: AllJoyn crash - CVE-2016-9374
    • -
  • wnpa-sec-2016-60: OpenFlow crash - CVE-2016-9376
    • -
  • wnpa-sec-2016-61: DCERPC crash - CVE-2016-9373
    • -
  • wnpa-sec-2016-62: DTN infinite loop - CVE-2016-9375
    • -
-
- - - - https://www.wireshark.org/docs/relnotes/wireshark-2.2.2.html - CVE-2016-9372 - CVE-2016-9373 - CVE-2016-9374 - CVE-2016-9375 - CVE-2016-9376 - - - 2016-11-16 - 2016-12-01 - - - - - Mozilla -- SVG Animation Remote Code Execution - - - firefox - 50.0.2,1 - - - firefox-esr - 45.5.1,1 - - - linux-firefox - 45.5.1,2 - - - seamonkey - 2.46 - - - linux-seamonkey - 2.46 - - - libxul - 45.5.1 - - - thunderbird - 45.5.1 - - - linux-thunderbird - 45.5.1 - - - - -

The Mozilla Foundation reports:

-
-

A use-after-free vulnerability in SVG Animation has been - discovered. An exploit built on this vulnerability has been - discovered in the wild targeting Firefox and Tor Browser - users on Windows.

-
- - - - CVE-2016-9079 - https://www.mozilla.org/en-US/security/advisories/mfsa2016-92/ - - - 2016-11-30 - 2016-12-01 - 2016-12-16 - - - - - wget -- Access List Bypass / Race Condition - - - wget - 1.17 - - - - -

Dawid Golunski reports:

-
-

GNU wget in version 1.17 and earlier, when used in - mirroring/recursive mode, is affected by a Race Condition - vulnerability that might allow remote attackers to bypass intended - wget access list restrictions specified with -A parameter. -

-
- - - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7098 - CVE-2016-7098 - - - 2016-11-24 - 2016-11-30 - - - - - p7zip -- Null pointer dereference - - - p7zip - 15.14_2 - - - - -

MITRE reports:

-
-

A null pointer dereference bug affects the 16.02 and many old - versions of p7zip. A lack of null pointer check for the variable - folders.PackPositions in function - CInArchive::ReadAndDecodePackedStreams, as used in - the 7z.so library and in 7z applications, will cause a crash and a - denial of service when decoding malformed 7z files.

-
- - - - CVE-2016-9296 - https://sourceforge.net/p/p7zip/discussion/383043/thread/648d34db/ - https://sourceforge.net/p/p7zip/bugs/185/ - https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-9296 - - - 2016-07-17 - 2016-11-30 - - - - - subversion -- Unrestricted XML entity expansion in mod_dontdothat and Subversionclients using http(s) - - - subversion18 - 1.8.17 - - - subversion - 1.9.5 - - - - -

The Apache Software Foundation reports:

-
-

The mod_dontdothat module of subversion and subversion clients using - http(s):// are vulnerable to a denial-of-service attack, caused by - exponential XML entity expansion. The attack targets XML parsers - causing targeted process to consume excessive amounts of resources. - The attack is also known as the "billions of laughs attack."

-
- - - - http://subversion.apache.org/security/CVE-2016-8734-advisory.txt - CVE-2016-8734 - - - 2016-11-29 - 2016-11-29 - - - - - libwww -- multiple vulnerabilities - - - libwww - 5.4.0_6 - - - - -

Mitre reports:

-
-

The HTBoundary_put_block function in HTBound.c for W3C libwww - (w3c-libwww) allows remote servers to cause a denial of service - (segmentation fault) via a crafted multipart/byteranges MIME message - that triggers an out-of-bounds read.

-
-
-

The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, - as used in the XML-Twig module for Perl, allows context-dependent - attackers to cause a denial of service (application crash) via an XML - document with malformed UTF-8 sequences that trigger a buffer - over-read, related to the doProlog function in lib/xmlparse.c, a - different vulnerability than CVE-2009-2625 and CVE-2009-3720.

-
-
-

The updatePosition function in lib/xmltok_impl.c in libexpat in - Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other - software, allows context-dependent attackers to cause a denial of - service (application crash) via an XML document with crafted UTF-8 - sequences that trigger a buffer over-read, a different vulnerability - than CVE-2009-2625.

-
- - - - 15035 - CVE-2005-3183 - CVE-2009-3560 - CVE-2009-3720 - ports/214546 - https://bugzilla.redhat.com/show_bug.cgi?id=170518 - - - 2005-10-12 - 2016-11-29 - - - - - mozilla -- data: URL can inherit wrong origin after an HTTP redirect - - - firefox - 50.0.1,1 - - - - -

The Mozilla Foundation reports:

-
-

Redirection from an HTTP connection to a data: URL - assigns the referring site's origin to the data: URL in some - circumstances. This can result in same-origin violations - against a domain if it loads resources from malicious - sites. Cross-origin setting of cookies has been demonstrated - without the ability to read them.

-
- - - - CVE-2016-9078 - https://www.mozilla.org/security/advisories/mfsa2016-91/ - - - 2016-11-28 - 2016-11-29 - - - - - Roundcube -- arbitrary command execution - - - roundcube - 1.2.3,1 - - - - -

The Roundcube project reports

-
-

steps/mail/sendmail.inc in Roundcube before 1.1.7 and 1.2.x before - 1.2.3, when no SMTP server is configured and the sendmail program is - enabled, does not properly restrict the use of custom envelope-from - addresses on the sendmail command line, which allows remote - authenticated users to execute arbitrary code via a modified HTTP - request that sends a crafted e-mail message.

-
- - - - CVE-2016-9920 - 94858 - http://www.openwall.com/lists/oss-security/2016/12/08/17 - https://github.com/roundcube/roundcubemail/wiki/Changelog#release-123 - - - 2016-11-29 - 2016-11-29 - 2016-12-14 - - - - - Drupal Code -- Multiple Vulnerabilities - - - drupal7 - 7.07.52 - - - drupal8 - 8.0.08.2.3 - - - - -

The Drupal development team reports:

-
-

Inconsistent name for term access query (Less critical - Drupal - 7 and Drupal 8)

-

Drupal provides a mechanism to alter database SELECT queries before - they are executed. Contributed and custom modules may use this - mechanism to restrict access to certain entities by implementing - hook_query_alter() or hook_query_TAG_alter() in order to add - additional conditions. Queries can be distinguished by means of - query tags. As the documentation on EntityFieldQuery::addTag() - suggests, access-tags on entity queries normally follow the form - ENTITY_TYPE_access (e.g. node_access). However, the taxonomy - module's access query tag predated this system and used term_access - as the query tag instead of taxonomy_term_access.

-

As a result, before this security release modules wishing to - restrict access to taxonomy terms may have implemented an - unsupported tag, or needed to look for both tags (term_access and - taxonomy_term_access) in order to be compatible with queries - generated both by Drupal core as well as those generated by - contributed modules like Entity Reference. Otherwise information - on taxonomy terms might have been disclosed to unprivileged users. -

-

Incorrect cache context on password reset page (Less critical - - Drupal 8)

-

The user password reset form does not specify a proper cache - context, which can lead to cache poisoning and unwanted content on - the page.

-

Confirmation forms allow external URLs to be injected (Moderately - critical - Drupal 7)

-

Under certain circumstances, malicious users could construct a URL - to a confirmation form that would trick users into being redirected - to a 3rd party website after interacting with the form, thereby - exposing the users to potential social engineering attacks.

-

Denial of service via transliterate mechanism (Moderately critical - - Drupal 8)

-

A specially crafted URL can cause a denial of service via the - transliterate mechanism.

-
- - - - CVE-2016-9449 - CVE-2016-9450 - CVE-2016-9451 - CVE-2016-9452 - - - 2016-11-16 - 2016-11-25 - 2016-11-27 - - - - - phpMyAdmin -- multiple vulnerabilities - - - phpMyAdmin - 4.6.04.6.5 - - - - -

Please reference CVE/URL list for details

- - - - https://www.phpmyadmin.net/security/PMASA-2016-57/ - https://www.phpmyadmin.net/security/PMASA-2016-58/ - https://www.phpmyadmin.net/security/PMASA-2016-59/ - https://www.phpmyadmin.net/security/PMASA-2016-60/ - https://www.phpmyadmin.net/security/PMASA-2016-61/ - https://www.phpmyadmin.net/security/PMASA-2016-62/ - https://www.phpmyadmin.net/security/PMASA-2016-63/ - https://www.phpmyadmin.net/security/PMASA-2016-64/ - https://www.phpmyadmin.net/security/PMASA-2016-65/ - https://www.phpmyadmin.net/security/PMASA-2016-66/ - https://www.phpmyadmin.net/security/PMASA-2016-67/ - https://www.phpmyadmin.net/security/PMASA-2016-68/ - https://www.phpmyadmin.net/security/PMASA-2016-69/ - https://www.phpmyadmin.net/security/PMASA-2016-70/ - https://www.phpmyadmin.net/security/PMASA-2016-71/ - CVE-2016-6632 - CVE-2016-6633 - CVE-2016-4412 - - - 2016-11-25 - 2016-11-25 - - - - - Remote-Code-Execution vulnerability in mysql and its variants CVE 2016-6662 - - - mysql57-client - mysql57-server - 5.7.15 - - - mysql56-client - mysql56-server - 5.6.33 - - - mysql55-client - mysql55-server - 5.5.52 - - - - -

LegalHackers' reports:

-
-

RCE Bugs discovered in MySQL and its variants like MariaDB. - It works by manipulating my.cnf files and using --malloc-lib. - The bug seems fixed in MySQL 5.7.15 by Oracle

-
- - - - http://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.html - https://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-15.html - - - 2016-09-12 - 2016-11-24 - 2016-11-24 - - - - - ntp -- multiple vulnerabilities - - - ntp - 4.2.8p9 - - - ntp-devel - 0 - - - - -

Network Time Foundation reports:

-
-

NTF's NTP Project is releasing ntp-4.2.8p9, which addresses:

-
    -
  • 1 HIGH severity vulnerability that only affects Windows
    • -
  • 2 MEDIUM severity vulnerabilities
    • -
  • 2 MEDIUM/LOW severity vulnerabilities
    • -
  • 5 LOW severity vulnerabilities
    • -
  • 28 other non-security fixes and improvements
    • -
-

All of the security issues in this release are listed in - VU#633847.

-
- - - - CVE-2016-7426 - CVE-2016-7427 - CVE-2016-7428 - CVE-2016-7429 - CVE-2016-7431 - CVE-2016-7433 - CVE-2016-7434 - CVE-2016-9310 - CVE-2016-9311 - CVE-2016-9312 - http://support.ntp.org/bin/view/Main/SecurityNotice#November_2016_ntp_4_2_8p9_NTP_Se - http://www.kb.cert.org/vuls/id/633847 - - - 2016-11-21 - 2016-11-22 - - - - - teeworlds -- Remote code execution - - - teeworlds - 0.6.4 - - - - -

Teeworlds project reports:

-
-

Attacker controlled memory-writes and possibly arbitrary code - execution on the client, abusable by any server the client joins

-
- - - - https://www.teeworlds.com/?page=news&id=12086 - - - 2016-11-13 - 2016-11-21 - - - - - jenkins -- Remote code execution vulnerability in remoting module - - - jenkins - 2.31 - - - jenkins-lts - 2.19.2 - - - - -

Jenkins Security Advisory:

-
-

An unauthenticated remote code execution vulnerability allowed - attackers to transfer a serialized Java object to the Jenkins CLI, - making Jenkins connect to an attacker-controlled LDAP server, which - in turn can send a serialized payload leading to code execution, - bypassing existing protection mechanisms.

-
- - - - CVE-2016-9299 - https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-11-16 - - - 2016-11-11 - 2016-11-16 - - - - - moodle -- multiple vulnerabilities - - - moodle29 - 2.9.9 - - - moodle30 - 3.0.7 - - - moodle31 - 3.1.3 - - - - -

Marina Glancy reports:

-
-
    -

  • MSA-16-0023: Question engine allows access to files that - should not be available

    • -

  • MSA-16-0024: Non-admin site managers may accidentally edit - admins via web services

    • -

  • MSA-16-0025: Capability to view course notes is checked in - the wrong context

    • -

  • MSA-16-0026: When debugging is enabled, error exceptions - returned from webservices could contain private data

    • -
-
- - - - CVE-2016-8642 - CVE-2016-8643 - CVE-2016-8644 - https://moodle.org/security/ - - - 2016-11-14 - 2016-11-16 - 2016-11-27 - - - - - moodle -- multiple vulnerabilities - - - moodle29 - 2.9.8 - - - moodle30 - 3.0.6 - - - moodle31 - 3.1.2 - - - - -

Marina Glancy reports:

-
-
    -

  • MSA-16-0022: Web service tokens should be invalidated when - the user password is changed or forced to be changed.

    • -
-
- - - - CVE-2016-7038 - https://moodle.org/security/ - - - 2016-09-12 - 2016-11-16 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 50.0_1,1 - - - seamonkey - linux-seamonkey - 2.47 - - - firefox-esr - 45.5.0,1 - - - linux-firefox - 45.5.0,2 - - - libxul - thunderbird - linux-thunderbird - 45.5.0 - - - - -

Mozilla Foundation reports:

-
-

Please reference CVE/URL list for details

-
- - - - CVE-2016-5289 - CVE-2016-5290 - CVE-2016-5291 - CVE-2016-5292 - CVE-2016-5293 - CVE-2016-5294 - CVE-2016-5295 - CVE-2016-5296 - CVE-2016-5297 - CVE-2016-5298 - CVE-2016-5299 - CVE-2016-9061 - CVE-2016-9062 - CVE-2016-9063 - CVE-2016-9064 - CVE-2016-9065 - CVE-2016-9066 - CVE-2016-9067 - CVE-2016-9068 - CVE-2016-9070 - CVE-2016-9071 - CVE-2016-9072 - CVE-2016-9073 - CVE-2016-9074 - CVE-2016-9075 - CVE-2016-9076 - CVE-2016-9077 - https://www.mozilla.org/security/advisories/mfsa2016-89/ - https://www.mozilla.org/security/advisories/mfsa2016-90/ - - - 2016-11-15 - 2016-11-16 - - - - - lives -- insecure files permissions - - - lives - 2.8.1 - - - - -

Debian reports:

-
-

smogrify script creates insecure temporary files.

-
-
-

lives creates and uses world-writable directory.

-
- - - - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=756565 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=798043 - - - 2016-07-30 - 2016-11-12 - - - - - openssl -- multiple vulnerabilities - - - openssl-devel - 1.1.0c - - - - -

OpenSSL reports:

-
-
    -
  • ChaCha20/Poly1305 heap-buffer-overflow (CVE-2016-7054)
    - Severity: High
    - TLS connections using *-CHACHA20-POLY1305 ciphersuites are susceptible to a DoS - attack by corrupting larger payloads. This can result in an OpenSSL crash. This - issue is not considered to be exploitable beyond a DoS.
    • -
  • CMS Null dereference (CVE-2016-7053)
    - Severity: Medium
    - Applications parsing invalid CMS structures can crash with a NULL pointer - dereference. This is caused by a bug in the handling of the ASN.1 CHOICE type - in OpenSSL 1.1.0 which can result in a NULL value being passed to the structure - callback if an attempt is made to free certain invalid encodings. Only CHOICE - structures using a callback which do not handle NULL value are affected.
    • -
  • Montgomery multiplication may produce incorrect results (CVE-2016-7055)i
    - Severity: Low
    - There is a carry propagating bug in the Broadwell-specific Montgomery - multiplication procedure that handles input lengths divisible by, but - longer than 256 bits.
    • -
-
- - - - https://www.openssl.org/news/secadv/20161110.txt - CVE-2016-7054 - CVE-2016-7053 - CVE-2016-7055 - - - 2016-11-10 - 2016-11-10 - 2016-11-11 - - - - - chromium -- multiple vulnerabilities - - - chromium - chromium-npapi - chromium-pulse - 54.0.2840.100 - - - - -

Google Chrome Releases reports:

-
-

4 security fixes in this release, including:

-
    -
  • [643948] High CVE-2016-5199: Heap corruption in FFmpeg. Credit to - Paul Mehta
    • -
  • [658114] High CVE-2016-5200: Out of bounds memory access in V8. Credit to - Choongwoo Han
    • -
  • [660678] Medium CVE-2016-5201: Info leak in extensions. Credit to - Rob Wu
    • -
  • [662843] CVE-2016-5202: Various fixes from internal audits, - fuzzing and other initiatives
    • -
-
- - - - CVE-2016-5199 - CVE-2016-5200 - CVE-2016-5201 - CVE-2016-5202 - https://googlechromereleases.blogspot.nl/2016/11/stable-channel-update-for-desktop_9.html - - - 2016-11-09 - 2016-11-10 - - - - - flash -- multiple vulnerabilities - - - linux-c6-flashplugin - linux-c7-flashplugin - linux-f10-flashplugin - 11.2r202.644 - - - - -

Adobe reports:

-
-
    -
  • These updates resolve type confusion vulnerabilities that - could lead to code execution (CVE-2016-7860, CVE-2016-7861, - CVE-2016-7865).
    • -
  • These updates resolve use-after-free vulnerabilities that - could lead to code execution (CVE-2016-7857, CVE-2016-7858, - CVE-2016-7859, CVE-2016-7862, CVE-2016-7863, CVE-2016-7864).
    • -
-
- - - - https://helpx.adobe.com/security/products/flash-player/apsb16-37.html - CVE-2016-7857 - CVE-2016-7858 - CVE-2016-7859 - CVE-2016-7860 - CVE-2016-7861 - CVE-2016-7862 - CVE-2016-7863 - CVE-2016-7864 - CVE-2016-7865 - - - 2016-11-08 - 2016-11-10 - - - - - gitlab -- Directory traversal via "import/export" feature - - - gitlab - 8.10.08.10.12 - 8.11.08.11.9 - 8.12.08.12.7 - 8.13.08.13.2 - - - - -

GitLab reports:

-
-

The import/export feature did not properly check for symbolic links - in user-provided archives and therefore it was possible for an - authenticated user to retrieve the contents of any file - accessible to the GitLab service account. This included - sensitive files such as those that contain secret tokens used - by the GitLab service to authenticate users.

-
- - - - https://about.gitlab.com/2016/11/02/cve-2016-9086-patches/ - CVE-2016-9086 - ports/214360 - - - 2016-11-02 - 2016-11-09 - 2017-05-18 - - - - - chromium -- out-of-bounds memory access - - - chromium - chromium-npapi - chromium-pulse - 54.0.2840.90 - - - - -

Google Chrome Releases reports:

-
-

[659475] High CVE-2016-5198: Out of bounds memory access in V8. - Credit to Tencent Keen Security Lab, working with Trend Micro's - Zero Day Initiative.

-
- - - - CVE-2016-5198 - https://googlechromereleases.blogspot.nl/2016/11/stable-channel-update-for-desktop.html - - - 2016-11-01 - 2016-11-03 - - - - - FreeBSD -- OpenSSL Remote DoS vulnerability - - - FreeBSD - 10.310.3_12 - 10.210.2_25 - 10.110.1_42 - 9.39.3_50 - - - openssl - 1.0.2i,1 - - - openssl-devel - 1.1.0a - - - linux-c6-openssl - 1.0.1e_13 - - - linux-c7-openssl-libs - 1.0.1e_3 - - - - -

Problem Description:

-

Due to improper handling of alert packets, OpenSSL would - consume an excessive amount of CPU time processing undefined - alert messages.

-

Impact:

-

A remote attacker who can initiate handshakes with an - OpenSSL based server can cause the server to consume a lot - of computation power with very little bandwidth usage, and - may be able to use this technique in a leveraged Denial of - Service attack.

- - - - CVE-2016-8610 - SA-16:35.openssl - http://seclists.org/oss-sec/2016/q4/224 - - - 2016-11-02 - 2016-11-02 - 2017-02-22 - - - - - django -- multiple vulnerabilities - - - py27-django - py33-django - py34-django - py35-django - 1.8.16 - - - py27-django18 - py33-django18 - py34-django18 - py35-django18 - 1.8.16 - - - py27-django19 - py33-django19 - py34-django19 - py35-django19 - 1.9.11 - - - py27-django110 - py33-django110 - py34-django110 - py35-django110 - 1.10.3 - - - - -

The Django project reports:

-
-

Today the Django team released Django 1.10.3, Django 1.9.11, - and 1.8.16. These releases addresses two security issues - detailed below. We encourage all users of Django to upgrade - as soon as possible.

-
    -
  • User with hardcoded password created when running tests on Oracle
    • -
  • DNS rebinding vulnerability when DEBUG=True
    • -
-
- - - - https://www.djangoproject.com/weblog/2016/nov/01/security-releases/ - CVE-2016-9013 - CVE-2016-9014 - - - 2016-11-01 - 2016-11-02 - - - - - cURL -- multiple vulnerabilities - - - curl - 7.17.51.0 - - - - -

The cURL project reports

-
-
    -
  • cookie injection for other servers
    • -
  • case insensitive password comparison
    • -
  • OOB write via unchecked multiplication
    • -
  • double-free in curl_maprintf
    • -
  • double-free in krb5 code
    • -
  • glob parser write/read out of bounds
    • -
  • curl_getdate read out of bounds
    • -
  • URL unescape heap overflow via integer truncation
    • -
  • Use-after-free via shared cookies
    • -
  • invalid URL parsing with '#'
    • -
  • IDNA 2003 makes curl use wrong host
    • -
-
- - - - https://curl.haxx.se/docs/security.html - CVE-2016-8615 - CVE-2016-8616 - CVE-2016-8617 - CVE-2016-8618 - CVE-2016-8619 - CVE-2016-8620 - CVE-2016-8621 - CVE-2016-8622 - CVE-2016-8623 - CVE-2016-8624 - CVE-2016-8625 - - - 2016-11-02 - 2016-11-02 - - - - - BIND -- Remote Denial of Service vulnerability - - - bind99 - 9.9.9P4 - - - bind910 - 9.10.4P4 - - - bind911 - 9.11.0P1 - - - bind9-devel - 9.12.0.a.2016.10.21 - - - FreeBSD - 9.39.3_50 - - - - -

ISC reports:

-
-

A defect in BIND's handling of responses containing - a DNAME answer can cause a resolver to exit after - encountering an assertion failure in db.c or - resolver.c

-
- - - - CVE-2016-8864 - SA-16:34.bind - https://kb.isc.org/article/AA-01434/ - - - 2016-11-01 - 2016-11-02 - - - - - memcached -- multiple vulnerabilities - - - memcached - 1.4.33 - - - - -

Cisco Talos reports:

-
-

Multiple integer overflow vulnerabilities exist within Memcached - that could be exploited to achieve remote code execution on the - targeted system. These vulnerabilities manifest in various Memcached - functions that are used in inserting, appending, prepending, or - modifying key-value data pairs. Systems which also have Memcached - compiled with support for SASL authentication are also vulnerable to - a third flaw due to how Memcached handles SASL authentication - commands.

-

An attacker could exploit these vulnerabilities by sending a - specifically crafted Memcached command to the targeted server. - Additionally, these vulnerabilities could also be exploited to leak - sensitive process information which an attacker could use to bypass - common exploitation mitigations, such as ASLR, and can be triggered - multiple times. This enables reliable exploitation which makes these - vulnerabilities severe.

-
- - - - http://blog.talosintel.com/2016/10/memcached-vulnerabilities.html - CVE-2016-8704 - CVE-2016-8705 - CVE-2016-8706 - - - 2016-10-31 - 2016-11-02 - - - - - MySQL -- multiple vulnerabilities - - - mariadb55-server - mysql55-server - 5.5.53 - - - mysql56-server - 5.6.34 - - - mysql57-server - 5.7.15 - - - - -

The MariaDB project reports:

-
-

Fixes for the following security vulnerabilities:

-
    -
  • CVE-2016-7440
    • -
  • CVE-2016-5584
    • -
-
- - - - https://mariadb.com/kb/en/mariadb/mariadb-5553-release-notes/ - CVE-2016-7440 - CVE-2016-5584 - - - 2016-10-17 - 2016-11-01 - - - - - chromium -- multiple vulnerabilities - - - chromium - chromium-npapi - chromium-pulse - 54.0.2840.59 - - - - -

Google Chrome Releases reports:

-
-

21 security fixes in this release, including:

-
    -
  • [645211] High CVE-2016-5181: Universal XSS in Blink. Credit to - Anonymous
    • -
  • [638615] High CVE-2016-5182: Heap overflow in Blink. Credit to - Giwan Go of STEALIEN
    • -
  • [645122] High CVE-2016-5183: Use after free in PDFium. Credit - to Anonymous
    • -
  • [630654] High CVE-2016-5184: Use after free in PDFium. Credit - to Anonymous
    • -
  • [621360] High CVE-2016-5185: Use after free in Blink. Credit to - cloudfuzzer
    • -
  • [639702] High CVE-2016-5187: URL spoofing. Credit to Luan - Herrera
    • -
  • [565760] Medium CVE-2016-5188: UI spoofing. Credit to Luan - Herrera
    • -
  • [633885] Medium CVE-2016-5192: Cross-origin bypass in Blink. - Credit to haojunhou@gmail.com
    • -
  • [646278] Medium CVE-2016-5189: URL spoofing. Credit to xisigr - of Tencent's Xuanwu Lab
    • -
  • [644963] Medium CVE-2016-5186: Out of bounds read in DevTools. - Credit to Abdulrahman Alqabandi (@qab)
    • -
  • [639126] Medium CVE-2016-5191: Universal XSS in Bookmarks. - Credit to Gareth Hughes
    • -
  • [642067] Medium CVE-2016-5190: Use after free in Internals. - Credit to Atte Kettunen of OUSPG
    • -
  • [639658] Low CVE-2016-5193: Scheme bypass. Credit to Yuyang - ZHOU (martinzhou96)
    • -
  • [654782] CVE-2016-5194: Various fixes from internal audits, - fuzzing and other initiatives
    • -
-
- - - - CVE-2016-5181 - CVE-2016-5182 - CVE-2016-5183 - CVE-2016-5184 - CVE-2016-5185 - CVE-2016-5186 - CVE-2016-5187 - CVE-2016-5188 - CVE-2016-5189 - CVE-2016-5190 - CVE-2016-5191 - CVE-2016-5192 - CVE-2016-5193 - CVE-2016-5194 - https://googlechromereleases.blogspot.nl/2016/10/stable-channel-update-for-desktop.html - - - 2016-10-12 - 2016-10-31 - - - - - chromium -- multiple vulnerabilities - - - chromium - chromium-npapi - chromium-pulse - 53.0.2785.143 - - - - -

Google Chrome Releases reports:

-
-

3 security fixes in this release, including:

-
    -
  • [642496] High CVE-2016-5177: Use after free in V8. Credit to - Anonymous
    • -
  • [651092] CVE-2016-5178: Various fixes from internal audits, -fuzzing and other initiatives.
    • -
-
- - - - CVE-2016-5177 - CVE-2016-5178 - https://googlechromereleases.blogspot.nl/2016/09/stable-channel-update-for-desktop_29.html - - - 2016-09-29 - 2016-10-31 - - - - - FreeBSD -- OpenSSH Remote Denial of Service vulnerability - - - openssh-portable - 7.3p1_1 - - - FreeBSD - 11.011.0_3 - 10.310.3_12 - - - - -

Problem Description:

-

When processing the SSH_MSG_KEXINIT message, the server - could allocate up to a few hundreds of megabytes of memory - per each connection, before any authentication take place.

-

Impact:

-

A remote attacker may be able to cause a SSH server to - allocate an excessive amount of memory. Note that the default - MaxStartups setting on FreeBSD will limit the effectiveness - of this attack.

- - - - http://seclists.org/oss-sec/2016/q4/191 - CVE-2016-8858 - SA-16:33.openssh - - - 2016-10-19 - 2016-10-29 - 2016-11-02 - - - - - sudo -- Potential bypass of sudo_noexec.so via wordexp() - - - sudo - 1.6.81.8.18p1 - - - - -

Todd C. Miller reports:

-
-

A flaw exists in sudo's noexec functionality that may allow - a user with sudo privileges to run additional commands even when the - NOEXEC tag has been applied to a command that uses the wordexp() - function.

-
- - - - https://www.sudo.ws/alerts/noexec_wordexp.html - CVE-2016-7076 - - - 2016-10-28 - 2016-10-28 - - - - - Axis2 -- Security vulnerabilities on dependency Apache HttpClient - - - axis2 - 1.7.4 - - - - -

Apache Axis2 reports:

-
-

Apache Axis2 1.7.4 is a maintenance release that includes fixes for - several issues, including the following security issues: - Session fixation (AXIS2-4739) and XSS (AXIS2-5683) vulnerabilities - affecting the admin console. - A dependency on an Apache HttpClient version affected by known security - vulnerabilities (CVE-2012-6153 and CVE-2014-3577); see AXIS2-5757.

-
- - - - http://axis.apache.org/axis2/java/core/release-notes/1.7.4.html - https://issues.apache.org/jira/browse/AXIS2-4739 - https://issues.apache.org/jira/browse/AXIS2-5683 - https://issues.apache.org/jira/browse/AXIS2-5757 - CVE-2012-6153 - CVE-2014-3577 - - - 2012-12-06 - 2016-10-28 - - - - - node.js -- ares_create_query single byte out of buffer write - - - node010 - 0.10.48 - - - node012 - 0.12.17 - - - node4 - 4.6.1 - - - - -

Node.js has released new versions containing the following security fix:

-
-

The following releases all contain fixes for CVE-2016-5180 "ares_create_query single - byte out of buffer write": Node.js v0.10.48 (Maintenance), Node.js v0.12.17 (Maintenance), - Node.js v4.6.1 (LTS "Argon") -

-

While this is not a critical update, all users of these release lines should upgrade at - their earliest convenience. -

-
- - - - https://nodejs.org/en/blog/vulnerability/october-2016-security-releases/ - CVE-2016-5180 - ports/213800 - - - 2016-10-18 - 2016-10-26 - - - - - node.js -- multiple vulnerabilities - - - node - 6.0.06.9.0 - - - - -

Node.js v6.9.0 LTS contains the following security fixes, specific to v6.x:

-
-

Disable auto-loading of openssl.cnf: Don't automatically attempt to load an OpenSSL - configuration file, from the OPENSSL_CONF environment variable or from the default - location for the current platform. Always triggering a configuration file load attempt - may allow an attacker to load compromised OpenSSL configuration into a Node.js process - if they are able to place a file in a default location. -

-

Patched V8 arbitrary memory read (CVE-2016-5172): The V8 parser mishandled scopes, - potentially allowing an attacker to obtain sensitive information from arbitrary memory - locations via crafted JavaScript code. This vulnerability would require an attacker to - be able to execute arbitrary JavaScript code in a Node.js process. -

-

Create a unique v8_inspector WebSocket address: Generate a UUID for each execution of - the inspector. This provides additional security to prevent unauthorized clients from - connecting to the Node.js process via the v8_inspector port when running with --inspect. - Since the debugging protocol allows extensive access to the internals of a running process, - and the execution of arbitrary code, it is important to limit connections to authorized - tools only. Note that the v8_inspector protocol in Node.js is still considered an - experimental feature. Vulnerability originally reported by Jann Horn. -

-

All of these vulnerabilities are considered low-severity for Node.js users, however, - users of Node.js v6.x should upgrade at their earliest convenience.

-
- - - - https://nodejs.org/en/blog/vulnerability/october-2016-security-releases/ - CVE-2016-5172 - - - 2016-10-18 - 2016-10-28 - - - - - urllib3 -- certificate verification failure - - - py-urllib3 - 1.18 - - - - -

urllib3 reports:

-
-

CVE-2016-9015: Certification verification failure

-
- - - - CVE-2016-9015 - https://github.com/shazow/urllib3/blob/1.18.1/CHANGES.rst - - - 2016-10-27 - 2016-10-28 - - - - - flash -- remote code execution - - - linux-f10-flashplugin - linux-c6-flashplugin - linux-c7-flashplugin - 11.2r202.643 - - - - -

Adobe reports:

-
-

Adobe has released security updates for Adobe Flash Player for - Windows, Macintosh, Linux and Chrome OS. These updates address a - critical vulnerability that could potentially allow an attacker to - take control of the affected system.

-

Adobe is aware of a report that an exploit for CVE-2016-7855 - exists in the wild, and is being used in limited, targeted attacks - against users running Windows versions 7, 8.1 and 10.

-
- - - - CVE-2016-7855 - https://helpx.adobe.com/security/products/flash-player/apsb16-36.html - - - 2016-10-26 - 2016-10-27 - - - - - FreeBSD -- bhyve - privilege escalation vulnerability - - - FreeBSD-kernel - 11.011.0_2 - - - - -

Problem Description:

-

An unchecked array reference in the VGA device emulation - code could potentially allow guests access to the heap of - the bhyve process. Since the bhyve process is running as - root, this may allow guests to obtain full control of the - hosts they are running on.

-

Impact:

-

For bhyve virtual machines with the "fbuf" framebuffer - device configured, if exploited, a malicious guest could - obtain full access to not just the host system, but to other - virtual machines running on the system.

- - - - SA-16:32.bhyve - - - 2016-10-25 - 2016-10-25 - 2016-10-25 - - - - - flash -- multiple vulnerabilities - - - linux-c6-flashplugin - linux-c6_64-flashplugin - linux-c7-flashplugin - linux-f10-flashplugin - 11.2r202.637 - - - - -

Adobe reports:

-
-

Adobe has released security updates for Adobe Flash Player for - Windows, Macintosh, Linux and ChromeOS. These updates address - critical vulnerabilities that could potentially allow an attacker - to take control of the affected system.

-

These updates resolve a type confusion vulnerability that could - lead to code execution (CVE-2016-6992).

-

These updates resolve use-after-free vulnerabilities that could - lead to code execution (CVE-2016-6981, CVE-2016-6987).

-

These updates resolve a security bypass vulnerability - (CVE-2016-4286).

-

These updates resolve memory corruption vulnerabilities that could - lead to code execution (CVE-2016-4273, CVE-2016-6982, - CVE-2016-6983, CVE-2016-6984, CVE-2016-6985, CVE-2016-6986, - CVE-2016-6989, CVE-2016-6990).

-
- - - - CVE-2016-4273 - CVE-2016-4286 - CVE-2016-6981 - CVE-2016-6982 - CVE-2016-6983 - CVE-2016-6984 - CVE-2016-6985 - CVE-2016-6986 - CVE-2016-6987 - CVE-2016-6989 - CVE-2016-6990 - CVE-2016-6992 - https://helpx.adobe.com/security/products/flash-player/apsb16-32.html - - - 2016-10-11 - 2016-10-24 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 49.0.2,1 - - - - -

Mozilla Foundation reports:

-
-

CVE-2016-5287: Crash in nsTArray_base<T>::SwapArrayElements

-

CVE-2016-5288: Web content can read cache entries

-
- - - - CVE-2016-5287 - CVE-2016-5288 - https://www.mozilla.org/security/advisories/mfsa2016-87/ - - - 2016-10-20 - 2016-10-21 - - - - - Axis2 -- Cross-site scripting (XSS) vulnerability - - - axis2 - 1.7.3 - - - - -

Apache Axis2 reports:

-
-

Apache Axis2 1.7.3 is a security release that contains a fix - for CVE-2010-3981. That security vulnerability affects the admin console - that is part of the Axis2 Web application and was originally reported - for SAP BusinessObjects (which includes a version of Axis2). That report - didn’t mention Axis2 at all and the Axis2 project only recently became - aware (thanks to Devesh Bhatt and Nishant Agarwala) that the issue - affects Apache Axis2 as well.

-
- - - - http://axis.apache.org/axis2/java/core/release-notes/1.7.3.html - CVE-2010-3981 - ports/213546 - - - 2010-10-18 - 2016-10-18 - - - - - Tor -- remote denial of service - - - tor - 0.2.8.9 - - - tor-devel - 0.2.9.4-alpha - - - - -

The Tor Blog reports:

-
-

Prevent a class of security bugs caused by treating the contents - of a buffer chunk as if they were a NUL-terminated string. At least - one such bug seems to be present in all currently used versions of - Tor, and would allow an attacker to remotely crash most Tor - instances, especially those compiled with extra compiler hardening. - With this defense in place, such bugs can't crash Tor, though we - should still fix them as they occur. Closes ticket 20384 - (TROVE-2016-10-001).

-
- - - - https://blog.torproject.org/blog/tor-0289-released-important-fixes - - - 2016-10-17 - 2016-10-18 - - - - - Rails 4 -- Possible XSS Vulnerability in Action View - - - rubygem-actionview - 3.0.04.2.7.1 - - - - -

Ruby Security team reports:

-
-

There is a possible XSS vulnerability in Action View. Text declared as "HTML -safe" will not have quotes escaped when used as attribute values in tag -helpers. This vulnerability has been assigned the CVE identifier -CVE-2016-6316.

-
- - - - https://groups.google.com/forum/#!topic/ruby-security-ann/8B2iV2tPRSE - CVE-2016-6316 - - - 2016-08-11 - 2016-08-18 - - - - - Rails 4 -- Unsafe Query Generation Risk in Active Record - - - rubygem-activerecord4 - 4.2.04.2.7.1 - - - - -

Ruby Security team reports:

-
-

There is a vulnerability when Active Record is used in conjunction with JSON -parameter parsing. This vulnerability has been assigned the CVE identifier -CVE-2016-6317. This vulnerability is similar to CVE-2012-2660, CVE-2012-2694 -and CVE-2013-0155.

-
- - - - https://groups.google.com/forum/#!topic/ruby-security-ann/WccgKSKiPZA - CVE-2016-6317 - - - 2016-08-11 - 2016-08-18 - - - - - PHP -- multiple vulnerabilities - - - php70 - 7.0.11 - - - - -

PHP reports:

-
-
    -

  • Fixed bug #73007 (add locale length check)

    • -

  • Fixed bug #72293 (Heap overflow in mysqlnd related to BIT fields)

    • -

  • Fixed bug #72928 (Out of bound when verify signature of zip phar in phar_parse_zipfile)

    • -

  • Fixed bug #73029 (Missing type check when unserializing SplArray)

    • -

  • Fixed bug #73052 (Memory Corruption in During Deserialized-object Destruction)

    • -

  • Fixed bug #72860 (wddx_deserialize use-after-free)

    • -

  • Fixed bug #73065 (Out-Of-Bounds Read in php_wddx_push_element)

    • -
-
- - - - http://php.net/ChangeLog-7.php#7.0.11 - CVE-2016-7416 - CVE-2016-7412 - CVE-2016-7414 - CVE-2016-7417 - CVE-2016-7413 - CVE-2016-7418 - - - 2016-09-15 - 2016-09-30 - - - - - PHP -- multiple vulnerabilities - - - php56 - 5.6.26 - - - - -

PHP reports:

-
-
    -

  • Fixed bug #73007 (add locale length check)

    • -

  • Fixed bug #72293 (Heap overflow in mysqlnd related to BIT fields)

    • -

  • Fixed bug #72928 (Out of bound when verify signature of zip phar in phar_parse_zipfile)

    • -

  • Fixed bug #73029 (Missing type check when unserializing SplArray)

    • -

  • Fixed bug #73052 (Memory Corruption in During Deserialized-object Destruction)

    • -

  • Fixed bug #72860 (wddx_deserialize use-after-free)

    • -

  • Fixed bug #73065 (Out-Of-Bounds Read in php_wddx_push_element)

    • -
-
- - - - http://php.net/ChangeLog-5.php#5.6.26 - CVE-2016-7416 - CVE-2016-7412 - CVE-2016-7414 - CVE-2016-7417 - CVE-2016-7411 - CVE-2016-7413 - CVE-2016-7418 - - - 2016-09-16 - 2016-09-30 - - - - - file-roller -- path traversal vulnerability - - - file-roller - 3.5.4,13.20.2,1 - - - - -

reports:

-
-

File Roller 3.5.4 through 3.20.2 was affected by a path - traversal bug that could result in deleted files if a user - were tricked into opening a malicious archive.

-
- - - - http://www.openwall.com/lists/oss-security/2016/09/08/4 - CVE-2016-7162 - ports/213199 - - - 2016-09-08 - 2016-10-12 - 2016-10-18 - - - - - VirtualBox -- undisclosed vulnerabilities - - - virtualbox-ose - 5.05.0.8 - 4.34.3.32 - 4.24.2.34 - 4.14.1.42 - 4.04.0.34 - - - - -

Oracle reports reports:

-
-

Unspecified vulnerability in the Oracle VM VirtualBox - component in Oracle Virtualization VirtualBox prior to 4.0.34, 4.1.42, - 4.2.34, 4.3.32, and 5.0.8, when using a Windows guest, allows local - users to affect availability via unknown vectors related to Core.

-

Unspecified vulnerability in the Oracle VM VirtualBox - component in Oracle Virtualization VirtualBox before 4.0.34, 4.1.42, - 4.2.34, 4.3.32, and 5.0.8, when a VM has the Remote Display feature - (RDP) enabled, allows remote attackers to affect availability via - unknown vectors related to Core.

-
- - - - http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html - CVE-2015-4813 - CVE-2015-4896 - ports/204406 - - - 2015-10-01 - 2016-10-12 - 2016-10-18 - - - - - ImageMagick -- multiple vulnerabilities - - - ImageMagick - ImageMagick-nox11 - 6.9.5.10,1 - - - - -

Debian reports:

-
-

Various memory handling problems and cases of missing or - incomplete input sanitizing may result in denial of service or the - execution of arbitrary code if malformed SIXEL, PDB, MAP, SGI, TIFF and - CALS files are processed.

-
- - - - https://www.debian.org/security/2016/dsa-3675 - ports/213032 - - - 2016-09-23 - 2016-10-12 - 2016-10-18 - - - - - libgd -- integer overflow which could lead to heap buffer overflow - - - gd - 2.2.3 - - - php70-gd - 7.0.11 - - - php56-gd - 5.6.26 - - - - -

LibGD reports:

-
-

An integer overflow issue was found in function gdImageWebpCtx of file gd_webp.c which could lead to heap buffer overflow.

-
- - - - https://github.com/libgd/libgd/issues/308 - https://bugs.php.net/bug.php?id=73003 - ports/213023 - - - 2016-09-02 - 2016-10-11 - 2016-10-18 - - - - - libvncserver -- multiple security vulnerabilities - - - libvncserver - 0.9.10 - - - - -

Nicolas Ruff reports:

-
-

Integer overflow in MallocFrameBuffer() on client side.

-

Lack of malloc() return value checking on client side.

-

Server crash on a very large ClientCutText message.

-

Server crash when scaling factor is set to zero.

-

Multiple stack overflows in File Transfer feature.

-
- - - - http://seclists.org/oss-sec/2014/q3/639 - CVE-2014-6051 - CVE-2014-6052 - CVE-2014-6053 - CVE-2014-6054 - CVE-2014-6055 - ports/212380 - - - 2014-09-23 - 2016-10-11 - 2016-10-18 - - - - - openoffice -- information disclosure vulnerability - - - apache-openoffice - apache-openoffice-devel - 4.1.1 - - - - -

Apache reports:

-
-

The exposure exploits the way OLE previews are generated to - embed arbitrary file data into a specially crafted document when it is - opened. Data exposure is possible if the updated document is distributed - to other parties.

-
- - - - http://www.openoffice.org/security/cves/CVE-2014-3575.html - CVE-2014-3575 - ports/212379 - - - 2014-08-21 - 2016-10-12 - 2016-10-18 - - - - - mupdf -- multiple vulnerabilities - - - mupdf - 1.9a_1,1 - - - llpp - 22_2 - - - zathura-pdf-mupdf - 0.3.0_2 - - - - -

Tobias Kortkamp reports:

-
-

Heap-based buffer overflow in the pdf_load_mesh_params - function in pdf/pdf-shade.c in MuPDF allows remote attackers to cause a - denial of service (crash) or execute arbitrary code via a large decode - array.

-

Use-after-free vulnerability in the pdf_load_xref function in - pdf/pdf-xref.c in MuPDF allows remote attackers to cause a denial of - service (crash) via a crafted PDF file.

-
- - - - http://openbsd-archive.7691.n7.nabble.com/mupdf-CVE-2016-6525-amp-CVE-2016-6265-td302904.html - http://bugs.ghostscript.com/show_bug.cgi?id=696941 - http://bugs.ghostscript.com/show_bug.cgi?id=696954 - CVE-2016-6525 - CVE-2016-6265 - ports/212207 - - - 2016-08-27 - 2016-10-12 - 2016-10-18 - - - - - openjpeg -- multiple vulnerabilities - - - openjpeg - 2.1.1_1 - - - - -

Tencent's Xuanwu LAB reports:

-
-

A Heap Buffer Overflow (Out-of-Bounds Write) issue was found in - function opj_dwt_interleave_v of dwt.c. This vulnerability allows - remote attackers to execute arbitrary code on vulnerable installations - of OpenJPEG.

-

An integer overflow issue exists in function opj_pi_create_decode of - pi.c. It can lead to Out-Of-Bounds Read and Out-Of-Bounds Write in - function opj_pi_next_cprl of pi.c (function opj_pi_next_lrcp, - opj_pi_next_rlcp, opj_pi_next_rpcl, opj_pi_next_pcrl may also be - vulnerable). This vulnerability allows remote attackers to execute - arbitrary code on vulnerable installations of OpenJPEG.

-
- - - - "http://www.openwall.com/lists/oss-security/2016/09/08/2" - "http://www.openwall.com/lists/oss-security/2016/09/08/3" - CVE-2016-5157 - CVE-2016-7163 - - - 2016-09-08 - 2016-10-11 - - - - - redis -- sensitive information leak through command history file - - - redis - redis-devel - 3.2.3 - - - - -

Redis team reports:

-
-

The redis-cli history file (in linenoise) is created with the - default OS umask value which makes it world readable in most systems - and could potentially expose authentication credentials to other - users.

-
- - - - https://github.com/antirez/redis/pull/1418 - https://github.com/antirez/redis/issues/3284 - CVE-2013-7458 - - - 2013-11-30 - 2016-10-11 - - - - - FreeBSD -- Multiple libarchive vulnerabilities - - - FreeBSD - 11.011.0_1 - 10.310.3_10 - 10.210.2_23 - 10.110.1_40 - - - - -

Problem Description:

-

Flaws in libarchive's handling of symlinks and hard links - allow overwriting files outside the extraction directory, - or permission changes to a directory outside the extraction - directory.

-

Impact:

-

An attacker who can control freebsd-update's or portsnap's - input to tar(1) can change file content or permissions on - files outside of the update tool's working sandbox.

- - - - SA-16:31.libarchive - - - 2016-10-05 - 2016-10-10 - - - - - FreeBSD -- Multiple portsnap vulnerabilities - - - FreeBSD - 11.011.0_1 - 10.310.3_10 - 10.210.2_23 - 10.110.1_40 - 9.39.3_48 - - - - -

Problem Description:

-

Flaws in portsnap's verification of downloaded tar files - allows additional files to be included without causing the - verification to fail. Portsnap may then use or execute these - files.

-

Impact:

-

An attacker who can conduct man in the middle attack on - the network at the time when portsnap is run can cause - portsnap to execute arbitrary commands under the credentials - of the user who runs portsnap, typically root.

- - - - SA-16:30.portsnap - - - 2016-10-10 - 2016-10-10 - - - - - FreeBSD -- Heap overflow vulnerability in bspatch - - - FreeBSD - 11.011.0_1 - 10.310.3_10 - 10.210.2_23 - 10.110.1_40 - 9.39.3_48 - - - - -

Problem Description:

-

The implementation of bspatch is susceptible to integer - overflows with carefully crafted input, potentially allowing - an attacker who can control the patch file to write at - arbitrary locations in the heap. This issue was partially - addressed in FreeBSD-SA-16:25.bspatch, but some possible - integer overflows remained.

-

Impact:

-

An attacker who can control the patch file can cause a - crash or run arbitrary code under the credentials of the - user who runs bspatch, in many cases, root.

- - - - SA-16:29.bspatch - - - 2016-10-10 - 2016-10-10 - - - - - mkvtoolnix -- code execution via specially crafted files - - - mkvtoolnix - 9.4.1 - - - - -

Moritz Bunkus reports:

-
-

most of the bugs fixed on 2016-09-06 and 2016-09-07 for - issue #1780 are potentially exploitable. The scenario is arbitrary - code execution with specially-crafted files.

-
- - - - https://mkvtoolnix.download/doc/ChangeLog - - - 2016-09-07 - 2016-10-09 - - - - - X.org libraries -- multiple vulnerabilities - - - libX11 - 1.6.4,1 - - - libXfixes - 5.0.3 - - - libXi - 1.7.7,1 - - - libXrandr - 1.5.1 - - - libXrender - 0.9.10 - - - libXtst - 1.2.3 - - - libXv - 1.0.11,1 - - - libXvMC - 1.0.10 - - - - -

Matthieu Herrb reports:

-
-

Tobias Stoeckmann from the OpenBSD project has discovered a - number of issues in the way various X client libraries handle - the responses they receive from servers, and has worked with - X.Org's security team to analyze, confirm, and fix these issues. - These issue come in addition to the ones discovered by Ilja van - Sprundel in 2013.

- -

Most of these issues stem from the client libraries trusting - the server to send correct protocol data, and not verifying - that the values will not overflow or cause other damage. Most - of the time X clients and servers are run by the same user, with - the server more privileged than the clients, so this is not a - problem, but there are scenarios in which a privileged client - can be connected to an unprivileged server, for instance, - connecting a setuid X client (such as a screen lock program) - to a virtual X server (such as Xvfb or Xephyr) which the user - has modified to return invalid data, potentially allowing the - user to escalate their privileges.

-
- - - - https://lists.x.org/archives/xorg-announce/2016-October/002720.html - CVE-2016-5407 - - - 2016-10-04 - 2016-10-07 - 2016-10-10 - - - - - BIND -- Remote Denial of Service vulnerability - - - bind99 - 9.9.9P3 - - - bind910 - 9.10.4P3 - - - bind911 - 9.11.0.rc3 - - - bind9-devel - 9.12.0.a.2016.09.10 - - - FreeBSD - 9.39.3_48 - - - - -

ISC reports:

-
-

Testing by ISC has uncovered a critical error condition - which can occur when a nameserver is constructing a - response. A defect in the rendering of messages into - packets can cause named to exit with an assertion - failure in buffer.c while constructing a response - to a query that meets certain criteria.

-
- - - - CVE-2016-2776 - SA-16:28.bind - https://kb.isc.org/article/AA-01419 - - - 2016-09-27 - 2016-09-28 - 2016-10-10 - - - - - django -- CSRF protection bypass on a site with Google Analytics - - - py-django19 - 1.9.10 - - - py-django18 - 1.8.15 - - - py-django - 1.8.15 - - - - -

Django Software Foundation reports:

-
-

An interaction between Google Analytics and Django's cookie parsing could allow an attacker to set arbitrary cookies leading to a bypass of CSRF protection.

-
- - - - https://www.djangoproject.com/weblog/2016/sep/26/security-releases/ - CVE-2016-7401 - - - 2016-09-26 - 2016-09-27 - - - - - OpenSSL -- multiple vulnerabilities - - - openssl - 1.0.2j,1 - - - openssl-devel - 1.1.0b - - - libressl - 2.4.3 - - - libressl-devel - 2.4.3 - - - FreeBSD - 11.011.0_1 - - - - -

OpenSSL reports:

-
-

Critical vulnerability in OpenSSL 1.1.0a
- Fix Use After Free for large message sizes (CVE-2016-6309)

-

Moderate vulnerability in OpenSSL 1.0.2i
- Missing CRL sanity check (CVE-2016-7052)

-
- - - - https://www.openssl.org/news/secadv/20160926.txt - CVE-2016-6309 - CVE-2016-7052 - SA-16:27.openssl - - - 2016-09-26 - 2016-09-26 - 2016-10-10 - - - - - OpenSSL -- multiple vulnerabilities - - - openssl-devel - 1.1.01.1.0_1 - - - openssl - 1.0.2i,1 - - - linux-c6-openssl - 1.0.1e_11 - - - FreeBSD - 10.310.3_8 - 10.210.2_21 - 10.110.1_38 - 9.39.3_46 - - - - -

OpenSSL reports:

-
-

High: OCSP Status Request extension unbounded memory growth

-

SSL_peek() hang on empty record

-

SWEET32 Mitigation

-

OOB write in MDC2_Update()

-

Malformed SHA512 ticket DoS

-

OOB write in BN_bn2dec()

-

OOB read in TS_OBJ_print_bio()

-

Pointer arithmetic undefined behaviour

-

Constant time flag not preserved in DSA signing

-

DTLS buffered message DoS

-

DTLS replay protection DoS

-

Certificate message OOB reads

-

Excessive allocation of memory in tls_get_message_header()

-

Excessive allocation of memory in dtls1_preprocess_fragment()

-

NB: LibreSSL is only affected by CVE-2016-6304

-
- - - - https://www.openssl.org/news/secadv/20160922.txt - CVE-2016-6304 - CVE-2016-6305 - CVE-2016-2183 - CVE-2016-6303 - CVE-2016-6302 - CVE-2016-2182 - CVE-2016-2180 - CVE-2016-2177 - CVE-2016-2178 - CVE-2016-2179 - CVE-2016-2181 - CVE-2016-6306 - CVE-2016-6307 - CVE-2016-6308 - SA-16:26.openssl - - - 2016-09-22 - 2016-09-22 - 2016-10-11 - - - - - irssi -- heap corruption and missing boundary checks - - - irssi - zh-irssi - 0.8.170.8.20 - - - - -

Irssi reports:

-
-

Remote crash and heap corruption. Remote code execution seems - difficult since only Nuls are written.

-
- - - - https://irssi.org/security/irssi_sa_2016.txt - CVE-2016-7044 - CVE-2016-7045 - - - 2016-09-21 - 2016-09-21 - 2016-09-22 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 49.0,1 - - - seamonkey - linux-seamonkey - 2.46 - - - firefox-esr - 45.4.0,1 - - - linux-firefox - 45.4.0,2 - - - libxul - thunderbird - linux-thunderbird - 45.4.0 - - - - -

Mozilla Foundation reports:

-
-

CVE-2016-2827 - Out-of-bounds read in mozilla::net::IsValidReferrerPolicy [low]

-

CVE-2016-5256 - Memory safety bugs fixed in Firefox 49 [critical]

-

CVE-2016-5257 - Memory safety bugs fixed in Firefox 49 and Firefox ESR 45.4 [critical]

-

CVE-2016-5270 - Heap-buffer-overflow in nsCaseTransformTextRunFactory::TransformString [high]

-

CVE-2016-5271 - Out-of-bounds read in PropertyProvider::GetSpacingInternal [low]

-

CVE-2016-5272 - Bad cast in nsImageGeometryMixin [high]

-

CVE-2016-5273 - crash in mozilla::a11y::HyperTextAccessible::GetChildOffset [high]

-

CVE-2016-5274 - use-after-free in nsFrameManager::CaptureFrameState [high]

-

CVE-2016-5275 - global-buffer-overflow in mozilla::gfx::FilterSupport::ComputeSourceNeededRegions [critical]

-

CVE-2016-5276 - Heap-use-after-free in mozilla::a11y::DocAccessible::ProcessInvalidationList [high]

-

CVE-2016-5277 - Heap-use-after-free in nsRefreshDriver::Tick [high]

-

CVE-2016-5278 - Heap-buffer-overflow in nsBMPEncoder::AddImageFrame [critical]

-

CVE-2016-5279 - Full local path of files is available to web pages after drag and drop [moderate]

-

CVE-2016-5280 - Use-after-free in mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap [high]

-

CVE-2016-5281 - use-after-free in DOMSVGLength [high]

-

CVE-2016-5282 - Don't allow content to request favicons from non-whitelisted schemes [moderate]

-

CVE-2016-5283 - <iframe src> fragment timing attack can reveal cross-origin data [high]

-

CVE-2016-5284 - Add-on update site certificate pin expiration [high]

-
- - - - CVE-2016-2827 - CVE-2016-5256 - CVE-2016-5257 - CVE-2016-5270 - CVE-2016-5271 - CVE-2016-5272 - CVE-2016-5273 - CVE-2016-5274 - CVE-2016-5275 - CVE-2016-5276 - CVE-2016-5277 - CVE-2016-5278 - CVE-2016-5279 - CVE-2016-5280 - CVE-2016-5281 - CVE-2016-5282 - CVE-2016-5283 - CVE-2016-5284 - https://www.mozilla.org/security/advisories/mfsa2016-85/ - https://www.mozilla.org/security/advisories/mfsa2016-86/ - https://www.mozilla.org/security/advisories/mfsa2016-88/ - - - 2016-09-13 - 2016-09-20 - 2016-10-21 - - - - - chromium -- multiple vulnerabilities - - - chromium - chromium-npapi - chromium-pulse - 53.0.2785.113 - - - - -

Google Chrome Releases reports:

-
-

Several security fixes in this release, including:

-
    -
  • [641101] High CVE-2016-5170: Use after free in Blink.Credit to - Anonymous
    • -
  • [643357] High CVE-2016-5171: Use after free in Blink. Credit to - Anonymous
    • -
  • [616386] Medium CVE-2016-5172: Arbitrary Memory Read in v8. - Credit to Choongwoo Han
    • -
  • [468931] Medium CVE-2016-5173: Extension resource access. - Credit to Anonymous
    • -
  • [579934] Medium CVE-2016-5174: Popup not correctly suppressed. - Credit to Andrey Kovalev (@L1kvID) Yandex Security Team
    • -
  • [646394] CVE-2016-5175: Various fixes from internal audits, - fuzzing and other initiatives.
    • -
-
- - - - CVE-2016-5170 - CVE-2016-5171 - CVE-2016-5172 - CVE-2016-5173 - CVE-2016-5174 - CVE-2016-5175 - https://googlechromereleases.blogspot.nl/2016/09/stable-channel-update-for-desktop_13.html - - - 2016-09-13 - 2016-09-16 - - - - - Remote-Code-Execution vulnerability in mysql and its variants CVE 2016-6662 - - - mysql57-client - mysql57-server - 5.7.15 - - - - -

LegalHackers' reports:

-
-

RCE Bugs discovered in MySQL and its variants like MariaDB. - It works by manipulating my.cnf files and using --malloc-lib. - The bug seems fixed in MySQL 5.7.15 by Oracle

-
- - - - CVE-2016-6662 - http://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.html - https://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-15.html - - - 2016-09-12 - 2016-09-14 - - - - - dropbear -- multiple vulnerabilities - - - dropbear - 2016.74 - - - - -

Matt Johnston reports:

-
-

If specific usernames including "%" symbols can be created on a system - (validated by getpwnam()) then an attacker could run arbitrary code as root - when connecting to Dropbear server. - - A dbclient user who can control username or host arguments could potentially - run arbitrary code as the dbclient user. This could be a problem if scripts - or webpages pass untrusted input to the dbclient program.

-

dropbearconvert import of OpenSSH keys could run arbitrary code as - the local dropbearconvert user when parsing malicious key files.

-

dbclient could run arbitrary code as the local dbclient user if - particular -m or -c arguments are provided. This could be an issue where - dbclient is used in scripts.

-

dbclient or dropbear server could expose process memory to the - running user if compiled with DEBUG_TRACE and running with -v

-
- - - - "http://www.openwall.com/lists/oss-security/2016/09/15/2" - CVE-2016-7406 - CVE-2016-7407 - CVE-2016-7408 - CVE-2016-7409 - - - 2016-07-12 - 2016-09-15 - - - - - h2o -- fix DoS attack vector - - - h2o - - 2.0.4 - - - - - -

Frederik Deweerdt reported a denial-of-service attack vector - due to an unhandled error condition during socket connection.

- - - - https://github.com/h2o/h2o/issues/1077 - CVE-2016-4864 - - - 2016-06-09 - 2016-09-14 - - - - - cURL -- Escape and unescape integer overflows - - - curl - 7.11.17.50.3 - - - - -

The cURL project reports

-
-

The four libcurl functions curl_escape(), curl_easy_escape(), - curl_unescape and curl_easy_unescape perform string URL percent - escaping and unescaping. They accept custom string length inputs - in signed integer arguments.

-

The provided string length arguments were not properly checked - and due to arithmetic in the functions, passing in the length - 0xffffffff (2^32-1 or UINT_MAX or even just -1) would end up - causing an allocation of zero bytes of heap memory that curl - would attempt to write gigabytes of data into.

-
- - - - https://curl.haxx.se/docs/adv_20160914.html - CVE-2016-7167 - - - 2016-09-14 - 2016-09-14 - - - - - chromium -- multiple vulnerabilities - - - chromium - chromium-npapi - chromium-pulse - 53.0.2785.92 - - - - -

Google Chrome Releases reports:

-
-

33 security fixes in this release

-

Please reference CVE/URL list for details

-
- - - - CVE-2016-5147 - CVE-2016-5148 - CVE-2016-5149 - CVE-2016-5150 - CVE-2016-5151 - CVE-2016-5152 - CVE-2016-5153 - CVE-2016-5154 - CVE-2016-5155 - CVE-2016-5156 - CVE-2016-5157 - CVE-2016-5158 - CVE-2016-5159 - CVE-2016-5160 - CVE-2016-5161 - CVE-2016-5162 - CVE-2016-5163 - CVE-2016-5164 - CVE-2016-5165 - CVE-2016-5166 - CVE-2016-5167 - https://googlechromereleases.blogspot.nl/2016/08/stable-channel-update-for-desktop_31.html - - - 2016-08-31 - 2016-09-13 - - - - - chromium -- multiple vulnerabilities - - - chromium - chromium-npapi - chromium-pulse - 52.0.2743.116 - - - - -

Google Chrome Releases reports:

-
-

10 security fixes in this release, including:

-
    -
  • [629542] High CVE-2016-5141 Address bar spoofing. Credit to - anonymous
    • -
  • [626948] High CVE-2016-5142 Use-after-free in Blink. Credit to - anonymous
    • -
  • [625541] High CVE-2016-5139 Heap overflow in pdfium. Credit to - GiWan Go of Stealien
    • -
  • [619405] High CVE-2016-5140 Heap overflow in pdfium. Credit to - Ke Liu of Tencent's Xuanwu LAB
    • -
  • [623406] Medium CVE-2016-5145 Same origin bypass for images in - Blink. Credit to anonymous
    • -
  • [619414] Medium CVE-2016-5143 Parameter sanitization failure in - DevTools. Credit to Gregory Panakkal
    • -
  • [618333] Medium CVE-2016-5144 Parameter sanitization failure in - DevTools. Credit to Gregory Panakkal
    • -
  • [633486] CVE-2016-5146: Various fixes from internal audits, - fuzzing and other initiatives.
    • -
-
- - - - CVE-2016-5139 - CVE-2016-5140 - CVE-2016-5141 - CVE-2016-5142 - CVE-2016-5143 - CVE-2016-5144 - CVE-2016-5145 - CVE-2016-5146 - https://googlechromereleases.blogspot.nl/2016/08/stable-channel-update-for-desktop.html - - - 2016-08-03 - 2016-09-13 - - - - - mysql -- Remote Root Code Execution - - - mariadb55-server - 5.5.51 - - - mariadb100-server - 10.0.27 - - - mariadb101-server - 10.1.17 - - - mysql55-server - 5.5.52 - - - mysql56-server - 5.6.33 - - - mysql57-server - 5.7.15 - - - percona55-server - 5.5.51.38.1 - - - percona56-server - 5.6.32.78.0 - - - percona57-server - 5.7.14.7 - - - - -

Dawid Golunski reports:

-
-

An independent research has revealed multiple severe MySQL - vulnerabilities. This advisory focuses on a critical - vulnerability with a CVEID of CVE-2016-6662 which can allow - attackers to (remotely) inject malicious settings into MySQL - configuration files (my.cnf) leading to critical - consequences.

-
- - - - CVE-2016-6662 - http://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.txt - https://jira.mariadb.org/browse/MDEV-10465 - https://www.percona.com/blog/2016/09/12/percona-server-critical-update-cve-2016-6662/ - https://www.percona.com/blog/2016/09/12/database-affected-cve-2016-6662/ - https://www.psce.com/blog/2016/09/12/how-to-quickly-patch-mysql-server-against-cve-2016-6662/ - - - 2016-09-12 - 2016-09-13 - - - - - wolfssl -- leakage of private key information - - - wolfssl - 3.6.8 - - - - -

Florian Weimer of Redhat discovered that an optimization in - RSA signature validation can result in disclosure of the - server's private key under certain fault conditions.

- - - - https://www.wolfssl.com/wolfSSL/Blog/Entries/2015/9/17_Two_Vulnerabilities_Recently_Found%2C_An_Attack_on_RSA_using_CRT_and_DoS_Vulnerability_With_DTLS.html - https://securityblog.redhat.com/2015/09/02/factoring-rsa-keys-with-tls-perfect-forward-secrecy/ - CVE-2015-7744 - - - 2015-09-17 - 2016-01-05 - - - - - wolfssl -- DDoS amplification in DTLS - - - wolfssl - 3.6.8 - - - - -

Sebastian Ramacher identified an error in wolfSSL's implementation - of the server side of the DTLS handshake, which could be abused - for DDoS amplification or a DoS on the DTLS server itself.

- - - - https://www.wolfssl.com/wolfSSL/Blog/Entries/2015/9/17_Two_Vulnerabilities_Recently_Found%2C_An_Attack_on_RSA_using_CRT_and_DoS_Vulnerability_With_DTLS.html - https://github.com/IAIK/wolfSSL-DoS - CVE-2015-6925 - - - 2015-09-18 - 2016-01-05 - - - - - gnutls -- OCSP validation issue - - - gnutls - 3.4.15 - - - - -

gnutls.org reports:

-
-

Stefan Bühler discovered an issue that affects validation - of certificates using OCSP responses, which can falsely report a - certificate as valid under certain circumstances.

-
- - - - https://gnutls.org/security.html#GNUTLS-SA-2016-3 - - - 2016-09-08 - 2016-09-09 - - - - - Mozilla -- multiple vulnerabilities - - - firefox - 48.0,1 - - - seamonkey - linux-seamonkey - 2.45 - - - firefox-esr - 45.3.0,1 - - - linux-firefox - 45.3.0,2 - - - libxul - thunderbird - linux-thunderbird - 45.3.0 - - - - -

Mozilla Foundation reports:

-
-

Please reference CVE/URL list for details

-
- - - - CVE-2016-0718 - CVE-2016-2830 - CVE-2016-2835 - CVE-2016-2836 - CVE-2016-2837 - CVE-2016-2838 - CVE-2016-2839 - CVE-2016-5250 - CVE-2016-5251 - CVE-2016-5252 - CVE-2016-5253 - CVE-2016-5254 - CVE-2016-5255 - CVE-2016-5258 - CVE-2016-5259 - CVE-2016-5260 - CVE-2016-5261 - CVE-2016-5262 - CVE-2016-5263 - CVE-2016-5264 - CVE-2016-5265 - CVE-2016-5266 - CVE-2016-5267 - CVE-2016-5268 - https://www.mozilla.org/en-US/security/advisories/mfsa2016-62/ - https://www.mozilla.org/en-US/security/advisories/mfsa2016-63/ - https://www.mozilla.org/en-US/security/advisories/mfsa2016-64/ - https://www.mozilla.org/en-US/security/advisories/mfsa2016-65/ - https://www.mozilla.org/en-US/security/advisories/mfsa2016-66/ - https://www.mozilla.org/en-US/security/advisories/mfsa2016-67/ - https://www.mozilla.org/en-US/security/advisories/mfsa2016-68/ - https://www.mozilla.org/en-US/security/advisories/mfsa2016-69/ - https://www.mozilla.org/en-US/security/advisories/mfsa2016-70/ - https://www.mozilla.org/en-US/security/advisories/mfsa2016-71/ - https://www.mozilla.org/en-US/security/advisories/mfsa2016-72/ - https://www.mozilla.org/en-US/security/advisories/mfsa2016-73/ - https://www.mozilla.org/en-US/security/advisories/mfsa2016-74/ - https://www.mozilla.org/en-US/security/advisories/mfsa2016-75/ - https://www.mozilla.org/en-US/security/advisories/mfsa2016-76/ - https://www.mozilla.org/en-US/security/advisories/mfsa2016-77/ - https://www.mozilla.org/en-US/security/advisories/mfsa2016-78/ - https://www.mozilla.org/en-US/security/advisories/mfsa2016-79/ - https://www.mozilla.org/en-US/security/advisories/mfsa2016-80/ - https://www.mozilla.org/en-US/security/advisories/mfsa2016-81/ - https://www.mozilla.org/en-US/security/advisories/mfsa2016-82/ - https://www.mozilla.org/en-US/security/advisories/mfsa2016-83/ - https://www.mozilla.org/en-US/security/advisories/mfsa2016-84/ - - - 2016-08-02 - 2016-09-07 - 2016-09-20 - - - - - asterisk -- RTP Resource Exhaustion - - - asterisk11 - 11.23.1 - - - asterisk13 - 13.11.1 - - - - -

The Asterisk project reports:

-
-

The overlap dialing feature in chan_sip allows chan_sip - to report to a device that the number that has been dialed - is incomplete and more digits are required. If this - functionality is used with a device that has performed - username/password authentication RTP resources are leaked. - This occurs because the code fails to release the old RTP - resources before allocating new ones in this scenario. - If all resources are used then RTP port exhaustion will - occur and no RTP sessions are able to be set up.

-

If overlap dialing support is not needed the "allowoverlap" - option can be set to no. This will stop any usage of the - scenario which causes the resource exhaustion.

-
- - - - http://downloads.asterisk.org/pub/security/AST-2016-007.html - - - 2016-08-05 - 2016-09-08 - - - - - asterisk -- Crash on ACK from unknown endpoint - - - asterisk13 - 13.10.013.11.1 - - - - -

The Asterisk project reports:

-
-

Asterisk can be crashed remotely by sending an ACK to - it from an endpoint username that Asterisk does not - recognize. Most SIP request types result in an "artificial" - endpoint being looked up, but ACKs bypass this lookup. - The resulting NULL pointer results in a crash when - attempting to determine if ACLs should be applied.

-

This issue was introduced in the Asterisk 13.10 release - and only affects that release.

-

This issue only affects users using the PJSIP stack - with Asterisk. Those users that use chan_sip are - unaffected.

-
- - - - http://downloads.asterisk.org/pub/security/AST-2016-006.html - - - 2016-08-03 - 2016-09-08 - - - - - inspircd -- authentication bypass vulnerability - - - inspircd - 2.0.23 - - - - -

Adam reports:

-
-

A serious vulnerability exists in when using m_sasl in - combination with any services that support SASL EXTERNAL. - To be vulnerable you must have m_sasl loaded, and have services which - support SASL EXTERNAL authentication.

-
- - - - http://www.inspircd.org/2016/09/03/v2023-released.html - - - 2016-09-03 - 2016-09-06 - - - - - mailman -- CSRF hardening in parts of the web interface - - - mailman - 2.1.15 - - - - -

The late Tokio Kikuchi reported:

-
-

We may have to set lifetime for input forms because of recent - activities on cross-site request forgery (CSRF). The form lifetime - is successfully deployed in frameworks like web.py or plone etc. - Proposed branch lp:~tkikuchi/mailman/form-lifetime implement - lifetime in admin, admindb, options and edithtml interfaces. - [...]

-
-
-

The web admin interface has been hardened against CSRF attacks by - adding a hidden, encrypted token with a time stamp to form submissions - and not accepting authentication by cookie if the token is missing, - invalid or older than the new mm_cfg.py setting FORM_LIFETIME which - defaults to one hour. Posthumous thanks go to Tokio Kikuchi for this implementation [...].

-
- - - - https://bugs.launchpad.net/mailman/+bug/775294 - https://launchpad.net/mailman/2.1/2.1.15 - CVE-2016-7123 - - - 2011-05-02 - 2016-09-06 - - - - - openssh -- sshd -- remote valid user discovery and PAM /bin/login attack - - - openssh-portable - 7.3.p1,1 - - - - -

The OpenSSH project reports:

-
-

* sshd(8): Mitigate timing differences in password authentication - that could be used to discern valid from invalid account names - when long passwords were sent and particular password hashing - algorithms are in use on the server. CVE-2016-6210, reported by - EddieEzra.Harari at verint.com -

-

* sshd(8): (portable only) Ignore PAM environment vars when - UseLogin=yes. If PAM is configured to read user-specified - environment variables and UseLogin=yes in sshd_config, then a - hostile local user may attack /bin/login via LD_PRELOAD or - similar environment variables set via PAM. CVE-2015-8325, - found by Shayan Sadigh. -

-
- - - - http://www.openssh.com/txt/release-7.3 - CVE-2016-6210 - CVE-2015-8325 - - - 2016-08-01 - 2016-09-01 - - - - - mailman -- CSRF protection enhancements - - - mailman - 2.1.23 - - - - -

Mark Sapiro reports:

-
-

CSRF protection has been extended to the user options page. This - was actually fixed by Tokio Kikuchi as part of the fix for LP: - #775294 and intended for Mailman 2.1.15, but that fix wasn't - completely merged at the time. The full fix also addresses the - admindb, and edithtml pages as well as the user options page and the - previously fixed admin pages. Thanks to Nishant Agarwala for reporting the issue.

-
- - - - http://bazaar.launchpad.net/~mailman-coders/mailman/2.1/revision/1668 - https://mail.python.org/pipermail/mailman-announce/2016-August/000226.html - CVE-2016-6893 - - - 2016-08-19 - 2016-08-29 - - - - - libxml2 -- multiple vulnerabilities - - - libxml2 - 2.9.4 - - - - -

Daniel Veillard reports:

-
-

More format string warnings with possible format string - vulnerability (David Kilzer)

-

Avoid building recursive entities (Daniel Veillard)

-

Heap-based buffer overread in htmlCurrentChar (Pranjal Jumde)

-

Heap-based buffer-underreads due to xmlParseName (David Kilzer)

-

Heap use-after-free in xmlSAX2AttributeNs (Pranjal Jumde)

-

Heap use-after-free in htmlParsePubidLiteral and - htmlParseSystemiteral (Pranjal Jumde)

-

Fix some format string warnings with possible format string - vulnerability (David Kilzer)

-

Detect change of encoding when parsing HTML names (Hugh Davenport)

-

Fix inappropriate fetch of entities content (Daniel Veillard)

-

Bug 759398: Heap use-after-free in xmlDictComputeFastKey - (Pranjal Jumde)

-

Bug 758605: Heap-based buffer overread in xmlDictAddString - (Pranjal Jumde)

-

Bug 758588: Heap-based buffer overread in - xmlParserPrintFileContextInternal (David Kilzer)

-

Bug 757711: heap-buffer-overflow in xmlFAParsePosCharGroup - (Pranjal Jumde)

-

Add missing increments of recursion depth counter to XML parser. - (Peter Simons)

-

Fix NULL pointer deref in XPointer range-to

-
- - - - https://mail.gnome.org/archives/xml/2016-May/msg00023.html - https://bugzilla.gnome.org/show_bug.cgi?id=759398 - https://bugzilla.gnome.org/show_bug.cgi?id=758605 - https://bugzilla.gnome.org/show_bug.cgi?id=758588 - https://bugzilla.gnome.org/show_bug.cgi?id=757711 - https://git.gnome.org/browse/libxml2/patch/?id=d8083bf77955b7879c1290f0c0a24ab8cc70f7fb - CVE-2016-1762 - CVE-2016-1833 - CVE-2016-1834 - CVE-2016-1835 - CVE-2016-1836 - CVE-2016-1837 - CVE-2016-1838 - CVE-2016-1839 - CVE-2016-1840 - CVE-2016-3627 - CVE-2016-3705 - CVE-2016-4449 - CVE-2016-4483 - - - 2016-05-23 - 2016-08-28 - - - - - kdelibs -- directory traversal vulnerability - - - kdelibs - 4.14.10_7 - - - - -

David Faure reports:

-
-

A maliciously crafted archive (.zip or .tar.bz2) with "../" in the - file paths could be offered for download via the KNewStuff - framework (e.g. on www.kde-look.org), and upon extraction would - install files anywhere in the user's home directory.

-
- - - - CVE-2016-6232 - https://www.kde.org/info/security/advisory-20160724-1.txt - - - 2016-07-24 - 2016-08-27 - - - - - eog -- out-of-bounds write - - - eog - 3.18.3 - - - - -

Felix Riemann reports:

-
-

CVE-2016-6855 out-of-bounds write in eog 3.10.2.

-
- - - - https://mail.gnome.org/archives/ftp-release-list/2016-August/msg00123.html - CVE-2016-6855 - - - 2016-08-21 - 2016-08-22 - - - - - fontconfig -- insufficiently cache file validation - - - fontconfig - 1.12.1 - - - - -

Debian security team reports:

-
-

Tobias Stoeckmann discovered that cache files are insufficiently - validated in fontconfig, a generic font configuration library. An - attacker can trigger arbitrary free() calls, which in turn allows - double free attacks and therefore arbitrary code execution. In - combination with setuid binaries using crafted cache files, this - could allow privilege escalation.

-
- - - - https://packetstormsecurity.com/files/138236/Debian-Security-Advisory-3644-1.html - CVE-2016-5384 - - - 2016-08-05 - 2016-08-21 - - - - - End of Life Ports - - - python32 - python31 - python30 - python26 - python25 - python24 - python23 - python22 - python21 - python20 - python15 - 0 - - - php54 - php53 - php52 - php5 - php4 - 0 - - - perl5 - 5.18 - - - perl5.16 - perl5.14 - perl5.12 - perl - 0 - - - ruby - ruby_static - 2.1,1 - - - unifi2 - unifi3 - 0 - - - apache21 - apache20 - apache13 - 0 - - - tomcat55 - tomcat41 - 0 - - - mysql51-client - mysql51-server - mysql50-client - mysql50-server - mysql41-client - mysql41-server - mysql40-client - mysql40-server - 0 - - - postgresql90-client - postgresql90-server - postgresql84-client - postgresql84-server - postgresql83-client - postgresql83-server - postgresql82-client - postgresql82-server - postgresql81-client - postgresql81-server - postgresql80-client - postgresql80-server - postgresql74-client - postgresql74-server - postgresql73-client - postgresql73-server - postgresql72-client - postgresql72-server - postgresql71-client - postgresql71-server - postgresql7-client - postgresql7-server - 0 - - - - -

These packages have reached End of Life status and/or have - been removed from the Ports Tree. They may contain undocumented - security issues. Please take caution and find alternative - software as soon as possible.

- - - - ports/211975 - - - 2016-08-18 - 2016-08-18 - 2016-10-18 - - - - - gnupg -- attacker who obtains 4640 bits from the RNG can trivially predict the next 160 bits of output - - - gnupg1 - 1.4.21 - - - libgcrypt - 1.7.3 - - - linux-c6-libgcrypt - 1.4.5_4 - - - linux-c7-libgcrypt - 1.5.3_1 - - - - -

Werner Koch reports:

-
-

There was a bug in the mixing functions of Libgcrypt's random - number generator: An attacker who obtains 4640 bits from the RNG can - trivially predict the next 160 bits of output. This bug exists since - 1998 in all GnuPG and Libgcrypt versions.

-
- - - - https://lists.gnupg.org/pipermail/gnupg-announce/2016q3/000395.html - CVE-2016-6313 - - - 2016-08-17 - 2016-08-18 - 2016-11-30 - - - - - phpmyadmin -- multiple vulnerabilities - - - phpmyadmin - 4.6.04.6.4 - - - - -

The phpmyadmin development team reports:

-
-

Weakness with cookie encryption

-
-
-

Multiple XSS vulnerabilities

-
-
-

Multiple XSS vulnerabilities

-
-
-

PHP code injection

-
-
-

Full path disclosure

-
-
-

SQL injection attack

-
-
-

Local file exposure

-
-
-

Local file exposure through symlinks with - UploadDir

-
-
-

Path traversal with SaveDir and UploadDir

-
-
-

Multiple XSS vulnerabilities

-
-
-

SQL injection attack

-
-
-

SQL injection attack

-
-
-

Denial of service (DOS) attack in transformation - feature

-
-
-

SQL injection attack as control user

-
-
-

Unvalidated data passed to unserialize()

-
-
-

DOS attack with forced persistent connections

-
-
-

Denial of service (DOS) attack by for loops

-
-
-

IPv6 and proxy server IP-based authentication rule - circumvention

-
-
-

Detect if user is logged in

-
-
-

Bypass URL redirect protection

-
-
-

Referrer leak in url.php

-
-
-

Reflected File Download attack

-
-
-

ArbitraryServerRegexp bypass

-
-
-

Denial of service (DOS) attack by changing password to a - very long string

-
-
-

Remote code execution vulnerability when run as CGI

-
-
-

Summary

-

Denial of service (DOS) attack with dbase extension

-
-
-

Remote code execution vulnerability when PHP is running - with dbase extension

-
- - - - https://www.phpmyadmin.net/security/PMASA-2016-29/ - https://www.phpmyadmin.net/security/PMASA-2016-30/ - https://www.phpmyadmin.net/security/PMASA-2016-31/ - https://www.phpmyadmin.net/security/PMASA-2016-32/ - https://www.phpmyadmin.net/security/PMASA-2016-33/ - https://www.phpmyadmin.net/security/PMASA-2016-34/ - https://www.phpmyadmin.net/security/PMASA-2016-35/ - https://www.phpmyadmin.net/security/PMASA-2016-36/ - https://www.phpmyadmin.net/security/PMASA-2016-37/ - https://www.phpmyadmin.net/security/PMASA-2016-38/ - https://www.phpmyadmin.net/security/PMASA-2016-39/ - https://www.phpmyadmin.net/security/PMASA-2016-40/ - https://www.phpmyadmin.net/security/PMASA-2016-41/ - https://www.phpmyadmin.net/security/PMASA-2016-42/ - https://www.phpmyadmin.net/security/PMASA-2016-43/ - https://www.phpmyadmin.net/security/PMASA-2016-45/ - https://www.phpmyadmin.net/security/PMASA-2016-46/ - https://www.phpmyadmin.net/security/PMASA-2016-47/ - https://www.phpmyadmin.net/security/PMASA-2016-48/ - https://www.phpmyadmin.net/security/PMASA-2016-49/ - https://www.phpmyadmin.net/security/PMASA-2016-50/ - https://www.phpmyadmin.net/security/PMASA-2016-51/ - https://www.phpmyadmin.net/security/PMASA-2016-52/ - https://www.phpmyadmin.net/security/PMASA-2016-53/ - https://www.phpmyadmin.net/security/PMASA-2016-54/ - https://www.phpmyadmin.net/security/PMASA-2016-55/ - https://www.phpmyadmin.net/security/PMASA-2016-56/ - CVE-2016-6606 - CVE-2016-6607 - CVE-2016-6608 - CVE-2016-6609 - CVE-2016-6610 - CVE-2016-6611 - CVE-2016-6612 - CVE-2016-6613 - CVE-2016-6614 - CVE-2016-6615 - CVE-2016-6616 - CVE-2016-6617 - CVE-2016-6618 - CVE-2016-6619 - CVE-2016-6620 - CVE-2016-6622 - CVE-2016-6623 - CVE-2016-6624 - CVE-2016-6625 - CVE-2016-6626 - CVE-2016-6627 - CVE-2016-6628 - CVE-2016-6629 - CVE-2016-6630 - CVE-2016-6631 - CVE-2016-6632 - CVE-2016-6633 - - - 2016-08-17 - 2016-08-17 - - - - - TeamSpeak Server 3 -- Multiple vulnerabilities including Remote Code Execution - - - teamspeak3-server - 3.0.13_1,1 - - - - -

Hanz Jenson audit report:

-
-

I found 10 vulnerabilities. Some of these are critical and allow remote code - execution. For the average user, that means that these vulnerabilities can be - exploited by a malicious attacker in order to take over any Teamspeak server, - not only becoming serveradmin, but getting a shell on the affected machine.

-
- - - - http://seclists.org/fulldisclosure/2016/Aug/61 - - - 2016-08-12 - 2016-08-14 - - - - - puppet-agent MCollective plugin -- Remote Code Execution vulnerability - - - mcollective-puppet-agent - 1.11.1 - - - - -

Puppet reports:

-
-

Puppet Enterprise previously included a puppet-agent MCollective plugin that allowed you to pass the `--server` argument to MCollective. This insecure argument enabled remote code execution via connection to an untrusted host. The puppet-agent MCollective version included in PE 2016.2.1, this option is disabled by default.

-
- - - - https://puppet.com/security/cve/cve-2015-7331 - CVE-2015-7331 - - - 2016-08-09 - 2016-08-15 - - - - - FreeBSD -- Heap vulnerability in bspatch - - - FreeBSD - 10.310.3_6 - 10.210.2_20 - 10.110.1_37 - 9.39.3_45 - - - - -

Problem Description:

-

The implementation of bspatch does not check for a - negative value on numbers of bytes read from the diff and - extra streams, allowing an attacker who can control the - patch file to write at arbitrary locations in the heap.

-

This issue was first discovered by The Chromium Project - and reported independently by Lu Tung-Pin to the FreeBSD - project.

-

Impact:

-

An attacker who can control the patch file can cause a - crash or run arbitrary code under the credentials of the - user who runs bspatch, in many cases, root.

- - - - CVE-2014-9862 - SA-16:25.bspatch - - - 2016-07-25 - 2016-08-11 - - - - - FreeBSD -- Multiple ntp vulnerabilities - - - FreeBSD - 10.310.3_5 - 10.210.2_19 - 10.110.1_36 - 9.39.3_44 - - - - -

Problem Description:

-

Multiple vulnerabilities have been discovered in the NTP - suite:

-

The fix for Sec 3007 in ntp-4.2.8p7 contained a bug that - could cause ntpd to crash. [CVE-2016-4957, Reported by - Nicolas Edet of Cisco]

-

An attacker who knows the origin timestamp and can send - a spoofed packet containing a CRYPTO-NAK to an ephemeral - peer target before any other response is sent can demobilize - that association. [CVE-2016-4953, Reported by Miroslav - Lichvar of Red Hat]

-

An attacker who is able to spoof packets with correct - origin timestamps from enough servers before the expected - response packets arrive at the target machine can affect - some peer variables and, for example, cause a false leap - indication to be set. [CVE-2016-4954, Reported by Jakub - Prokes of Red Hat]

-

An attacker who is able to spoof a packet with a correct - origin timestamp before the expected response packet arrives - at the target machine can send a CRYPTO_NAK or a bad MAC - and cause the association's peer variables to be cleared. - If this can be done often enough, it will prevent that - association from working. [CVE-2016-4955, Reported by - Miroslav Lichvar of Red Hat]

-

The fix for NtpBug2978 does not cover broadcast associations, - so broadcast clients can be triggered to flip into interleave - mode. [CVE-2016-4956, Reported by Miroslav Lichvar of Red - Hat.]

-

Impact:

-

Malicious remote attackers may be able to break time - synchronization, or cause the ntpd(8) daemon to crash.

- - - - CVE-2016-4953 - CVE-2016-4954 - CVE-2016-4955 - CVE-2016-4956 - CVE-2016-4957 - SA-16:24.ntp - - - 2016-06-04 - 2016-08-11 - - - - - FreeBSD -- Kernel stack disclosure in 4.3BSD compatibility layer - - - FreeBSD-kernel - 10.310.3_4 - 10.210.2_18 - 10.110.1_35 - 9.39.3_43 - - - - -

Problem Description:

-

The implementation of historic stat(2) system call does - not clear the output struct before copying it out to - userland.

-

Impact:

-

An unprivileged user can read a portion of uninitialised - kernel stack data, which may contain sensitive information, - such as the stack guard, portions of the file cache or - terminal buffers, which an attacker might leverage to obtain - elevated privileges.

- - - - SA-16:21.43bsd - - - 2016-05-31 - 2016-08-11 - - - - - FreeBSD -- Kernel stack disclosure in Linux compatibility layer - - - FreeBSD-kernel - 10.310.3_4 - 10.210.2_18 - 10.110.1_35 - 9.39.3_43 - - - - -

Problem Description:

-

The implementation of the TIOCGSERIAL ioctl(2) does not - clear the output struct before copying it out to userland.

-

The implementation of the Linux sysinfo() system call - does not clear the output struct before copying it out to - userland.

-

Impact:

-

An unprivileged user can read a portion of uninitialised - kernel stack data, which may contain sensitive information, - such as the stack guard, portions of the file cache or - terminal buffers, which an attacker might leverage to obtain - elevated privileges.

- - - - SA-16:20.linux - - - 2016-05-31 - 2016-08-11 - - - - - FreeBSD -- Incorrect argument handling in sendmsg(2) - - - FreeBSD-kernel - 10.310.3_3 - 10.210.2_17 - 10.110.1_34 - - - - -

Problem Description:

-

Incorrect argument handling in the socket code allows - malicious local user to overwrite large portion of the - kernel memory.

-

Impact:

-

Malicious local user may crash kernel or execute arbitrary - code in the kernel, potentially gaining superuser privileges.

- - - - CVE-2016-1887 - SA-16:19.sendmsg - - - 2016-05-17 - 2016-08-11 - - - - - FreeBSD -- Buffer overflow in keyboard driver - - - FreeBSD-kernel - 10.310.3_3 - 10.210.2_17 - 10.110.1_34 - 9.39.3_42 - - - - -

Problem Description:

-

Incorrect signedness comparison in the ioctl(2) handler - allows a malicious local user to overwrite a portion of the - kernel memory.

-

Impact:

-

A local user may crash the kernel, read a portion of - kernel memory and execute arbitrary code in kernel context. - The result of executing an arbitrary kernel code is privilege - escalation.

- - - - CVE-2016-1886 - SA-16:18.atkbd - - - 2016-05-17 - 2016-08-11 - - - - - FreeBSD -- Incorrect argument validation in sysarch(2) - - - FreeBSD-kernel - 11.011.0_2 - 10.310.3_11 - 10.210.2_24 - 10.110.1_41 - 9.39.3_49 - - - - -

Problem Description:

-

A special combination of sysarch(2) arguments, specify - a request to uninstall a set of descriptors from the LDT. - The start descriptor is cleared and the number of descriptors - are provided. Due to lack of sufficient bounds checking - during argument validity verification, unbound zero'ing of - the process LDT and adjacent memory can be initiated from - usermode.

-

Impact:

-

This vulnerability could cause the kernel to panic. In - addition it is possible to perform a local Denial of Service - against the system by unprivileged processes.

- - - - CVE-2016-1885 - SA-16:15.sysarch - - - 2016-03-16 - 2016-08-11 - 2016-10-25 - - - - - FreeBSD -- Multiple OpenSSL vulnerabilities - - - FreeBSD - 10.210.2_13 - 10.110.1_30 - 9.39.3_38 - - - - -

Problem Description:

-

A cross-protocol attack was discovered that could lead - to decryption of TLS sessions by using a server supporting - SSLv2 and EXPORT cipher suites as a Bleichenbacher RSA - padding oracle. Note that traffic between clients and - non-vulnerable servers can be decrypted provided another - server supporting SSLv2 and EXPORT ciphers (even with a - different protocol such as SMTP, IMAP or POP3) shares the - RSA keys of the non-vulnerable server. This vulnerability - is known as DROWN. [CVE-2016-0800]

-

A double free bug was discovered when OpenSSL parses - malformed DSA private keys and could lead to a DoS attack - or memory corruption for applications that receive DSA - private keys from untrusted sources. This scenario is - considered rare. [CVE-2016-0705]

-

The SRP user database lookup method SRP_VBASE_get_by_user - had confusing memory management semantics; the returned - pointer was sometimes newly allocated, and sometimes owned - by the callee. The calling code has no way of distinguishing - these two cases. [CVE-2016-0798]

-

In the BN_hex2bn function, the number of hex digits is - calculated using an int value |i|. Later |bn_expand| is - called with a value of |i * 4|. For large values of |i| - this can result in |bn_expand| not allocating any memory - because |i * 4| is negative. This can leave the internal - BIGNUM data field as NULL leading to a subsequent NULL - pointer dereference. For very large values of |i|, the - calculation |i * 4| could be a positive value smaller than - |i|. In this case memory is allocated to the internal BIGNUM - data field, but it is insufficiently sized leading to heap - corruption. A similar issue exists in BN_dec2bn. This could - have security consequences if BN_hex2bn/BN_dec2bn is ever - called by user applications with very large untrusted hex/dec - data. This is anticipated to be a rare occurrence. - [CVE-2016-0797]

-

The internal |fmtstr| function used in processing a "%s" - formatted string in the BIO_*printf functions could overflow - while calculating the length of a string and cause an - out-of-bounds read when printing very long strings. - [CVE-2016-0799]

-

A side-channel attack was found which makes use of - cache-bank conflicts on the Intel Sandy-Bridge microarchitecture - which could lead to the recovery of RSA keys. [CVE-2016-0702]

-

s2_srvr.c did not enforce that clear-key-length is 0 for - non-export ciphers. If clear-key bytes are present for these - ciphers, they displace encrypted-key bytes. [CVE-2016-0703]

-

s2_srvr.c overwrites the wrong bytes in the master key - when applying Bleichenbacher protection for export cipher - suites. [CVE-2016-0704]

-

Impact:

-

Servers that have SSLv2 protocol enabled are vulnerable - to the "DROWN" attack which allows a remote attacker to - fast attack many recorded TLS connections made to the server, - even when the client did not make any SSLv2 connections - themselves.

-

An attacker who can supply malformed DSA private keys - to OpenSSL applications may be able to cause memory corruption - which would lead to a Denial of Service condition. - [CVE-2016-0705]

-

An attacker connecting with an invalid username can cause - memory leak, which could eventually lead to a Denial of - Service condition. [CVE-2016-0798]

-

An attacker who can inject malformed data into an - application may be able to cause memory corruption which - would lead to a Denial of Service condition. [CVE-2016-0797, - CVE-2016-0799]

-

A local attacker who has control of code in a thread - running on the same hyper-threaded core as the victim thread - which is performing decryptions could recover RSA keys. - [CVE-2016-0702]

-

An eavesdropper who can intercept SSLv2 handshake can - conduct an efficient divide-and-conquer key recovery attack - and use the server as an oracle to determine the SSLv2 - master-key, using only 16 connections to the server and - negligible computation. [CVE-2016-0703]

-

An attacker can use the Bleichenbacher oracle, which - enables more efficient variant of the DROWN attack. - [CVE-2016-0704]

- - - - CVE-2016-0702 - CVE-2016-0703 - CVE-2016-0704 - CVE-2016-0705 - CVE-2016-0797 - CVE-2016-0798 - CVE-2016-0799 - CVE-2016-0800 - SA-16:12.openssl - - - 2016-03-10 - 2016-08-11 - - - - - FreeBSD -- Linux compatibility layer issetugid(2) system call - - - FreeBSD-kernel - 10.210.2_11 - 10.110.1_28 - 9.39.3_35 - - - - -

Problem Description:

-

A programming error in the Linux compatibility layer - could cause the issetugid(2) system call to return incorrect - information.

-

Impact:

-

If an application relies on output of the issetugid(2) - system call and that information is incorrect, this could - lead to a privilege escalation.

- - - - CVE-2016-1883 - SA-16:10.linux - - - 2016-01-27 - 2016-08-11 - - - - - FreeBSD -- Insecure default snmpd.config permissions - - - FreeBSD - 10.210.2_9 - 10.110.1_26 - 9.39.3_33 - - - - -

Problem Description:

-

The SNMP protocol supports an authentication model called - USM, which relies on a shared secret. The default permission - of the snmpd configuration file, /etc/snmpd.config, is - weak and does not provide adequate protection against local - unprivileged users.

-

Impact:

-

A local user may be able to read the shared secret, if - configured and used by the system administrator.

- - - - CVE-2015-5677 - SA-16:06.bsnmpd - - - 2016-01-14 - 2016-08-11 - - - - - FreeBSD -- TCP MD5 signature denial of service - - - FreeBSD-kernel - 10.210.2_9 - 10.110.1_26 - 9.39.3_33 - - - - -

Problem Description:

-

A programming error in processing a TCP connection with - both TCP_MD5SIG and TCP_NOOPT socket options may lead to - kernel crash.

-

Impact:

-

A local attacker can crash the kernel, resulting in a - denial-of-service.

-

A remote attack is theoretically possible, if server has - a listening socket with TCP_NOOPT set, and server is either - out of SYN cache entries, or SYN cache is disabled by - configuration.

- - - - CVE-2016-1882 - SA-16:05.tcp - - - 2016-01-14 - 2016-08-11 - - - - - FreeBSD -- Linux compatibility layer setgroups(2) system call - - - FreeBSD-kernel - 10.210.2_9 - 10.110.1_26 - 9.39.3_33 - - - - -

Problem Description:

-

A programming error in the Linux compatibility layer - setgroups(2) system call can lead to an unexpected results, - such as overwriting random kernel memory contents.

-

Impact:

-

It is possible for a local attacker to overwrite portions - of kernel memory, which may result in a privilege escalation - or cause a system panic.

- - - - CVE-2016-1881 - SA-16:04.linux - - - 2016-01-14 - 2016-08-11 - - - - - FreeBSD -- Linux compatibility layer incorrect futex handling - - - FreeBSD-kernel - 10.210.2_9 - 10.110.1_26 - 9.39.3_33 - - - - -

Problem Description:

-

A programming error in the handling of Linux futex robust - lists may result in incorrect memory locations being - accessed.

-

Impact:

-

It is possible for a local attacker to read portions of - kernel memory, which may result in a privilege escalation.

- - - - CVE-2016-1880 - SA-16:03.linux - - - 2016-01-14 - 2016-08-11 - - - - - FreeBSD -- SCTP ICMPv6 error message vulnerability - - - FreeBSD-kernel - 10.210.2_9 - 10.110.1_26 - 9.39.3_33 - - - - -

Problem Description:

-

A lack of proper input checks in the ICMPv6 processing - in the SCTP stack can lead to either a failed kernel assertion - or to a NULL pointer dereference. In either case, a kernel - panic will follow.

-

Impact:

-

A remote, unauthenticated attacker can reliably trigger - a kernel panic in a vulnerable system running IPv6. Any - kernel compiled with both IPv6 and SCTP support is vulnerable. - There is no requirement to have an SCTP socket open.

-

IPv4 ICMP processing is not impacted by this vulnerability.

- - - - CVE-2016-1879 - SA-16:01.sctp - - - 2016-01-14 - 2016-08-11 - - - - - FreeBSD -- rpcbind(8) remote denial of service [REVISED] - - - FreeBSD - 10.210.2_5 - 10.110.1_22 - 9.39.3_28 - - - - -

Problem Description:

-

In rpcbind(8), netbuf structures are copied directly, - which would result in two netbuf structures that reference - to one shared address buffer. When one of the two netbuf - structures is freed, access to the other netbuf structure - would result in an undefined result that may crash the - rpcbind(8) daemon.

-

Impact:

-

A remote attacker who can send specifically crafted - packets to the rpcbind(8) daemon can cause it to crash, - resulting in a denial of service condition.

- - - - CVE-2015-7236 - SA-15:24.rpcbind - - - 2015-09-29 - 2016-08-11 - - - - - FreeBSD -- Local privilege escalation in IRET handler - - - FreeBSD-kernel - 10.110.1_19 - 9.39.3_24 - - - - -

Problem Description:

-

If the kernel-mode IRET instruction generates an #SS or - #NP exception, but the exception handler does not properly - ensure that the right GS register base for kernel is reloaded, - the userland GS segment may be used in the context of the - kernel exception handler.

-

Impact:

-

By causing an IRET with #SS or #NP exceptions, a local - attacker can cause the kernel to use an arbitrary GS base, - which may allow escalated privileges or panic the system.

- - - - CVE-2015-5675 - SA-15:21.amd64 - - - 2015-08-25 - 2016-08-11 - - - - - FreeBSD -- Multiple integer overflows in expat (libbsdxml) XML parser - - - FreeBSD - 10.110.1_18 - 10.210.2_1 - 9.39.3_23 - - - - -

Problem Description:

-

Multiple integer overflows have been discovered in the - XML_GetBuffer() function in the expat library.

-

Impact:

-

The integer overflows may be exploited by using specifically - crafted XML data and lead to infinite loop, or a heap buffer - overflow, which results in a Denial of Service condition, - or enables remote attackers to execute arbitrary code.

- - - - CVE-2015-1283 - SA-15:20.expat - - - 2015-08-18 - 2016-08-11 - - - - - FreeBSD -- routed(8) remote denial of service vulnerability - - - FreeBSD - 10.110.1_17 - 9.39.3_22 - - - - -

Problem Description:

-

The input path in routed(8) will accept queries from any - source and attempt to answer them. However, the output path - assumes that the destination address for the response is - on a directly connected network.

-

Impact:

-

Upon receipt of a query from a source which is not on a - directly connected network, routed(8) will trigger an - assertion and terminate. The affected system's routing table - will no longer be updated. If the affected system is a - router, its routes will eventually expire from other routers' - routing tables, and its networks will no longer be reachable - unless they are also connected to another router.

- - - - CVE-2015-5674 - SA-15:19.routed - - - 2015-08-05 - 2016-08-11 - - - - - FreeBSD -- shell injection vulnerability in patch(1) - - - FreeBSD - 10.110.1_17 - - - - -

Problem Description:

-

Due to insufficient sanitization of the input patch - stream, it is possible for a patch file to cause patch(1) - to pass certain ed(1) scripts to the ed(1) editor, which - would run commands.

-

Impact:

-

This issue could be exploited to execute arbitrary - commands as the user invoking patch(1) against a specially - crafted patch file, which could be leveraged to obtain - elevated privileges.

- - - - CVE-2015-1418 - SA-15:18.bsdpatch - - - 2015-08-05 - 2016-08-11 - - - - - FreeBSD -- Resource exhaustion in TCP reassembly - - - FreeBSD-kernel - 10.110.1_16 - 9.39.3_21 - 8.48.4_35 - - - - -

Problem Description:

-

There is a mistake with the introduction of VNET, which - converted the global limit on the number of segments that - could belong to reassembly queues into a per-VNET limit. - Because mbufs are allocated from a global pool, in the - presence of a sufficient number of VNETs, the total number - of mbufs attached to reassembly queues can grow to the total - number of mbufs in the system, at which point all network - traffic would cease.

-

Impact:

-

An attacker who can establish concurrent TCP connections - across a sufficient number of VNETs and manipulate the - inbound packet streams such that the maximum number of mbufs - are enqueued on each reassembly queue can cause mbuf cluster - exhaustion on the target system, resulting in a Denial of - Service condition.

-

As the default per-VNET limit on the number of segments - that can belong to reassembly queues is 1/16 of the total - number of mbuf clusters in the system, only systems that - have 16 or more VNET instances are vulnerable.

- - - - CVE-2015-1417 - SA-15:15.tcp - - - 2015-07-28 - 2016-08-11 - - - - - FreeBSD -- shell injection vulnerability in patch(1) - - - FreeBSD - 10.110.1_16 - - - - -

Problem Description:

-

Due to insufficient sanitization of the input patch - stream, it is possible for a patch file to cause patch(1) - to run commands in addition to the desired SCCS or RCS - commands.

-

Impact:

-

This issue could be exploited to execute arbitrary - commands as the user invoking patch(1) against a specially - crafted patch file, which could be leveraged to obtain - elevated privileges.

- - - - CVE-2015-1416 - SA-15:14.bsdpatch - - - 2015-07-28 - 2016-08-11 - - - - - FreeBSD -- Resource exhaustion due to sessions stuck in LAST_ACK state - - - FreeBSD-kernel - 10.110.1_15 - 9.39.3_20 - 8.48.4_34 - - - - -

Problem Description:

-

TCP connections transitioning to the LAST_ACK state can - become permanently stuck due to mishandling of protocol - state in certain situations, which in turn can lead to - accumulated consumption and eventual exhaustion of system - resources, such as mbufs and sockets.

-

Impact:

-

An attacker who can repeatedly establish TCP connections - to a victim system (for instance, a Web server) could create - many TCP connections that are stuck in LAST_ACK state and - cause resource exhaustion, resulting in a denial of service - condition. This may also happen in normal operation where - no intentional attack is conducted, but an attacker who can - send specifically crafted packets can trigger this more - reliably.

- - - - CVE-2015-5358 - SA-15:13.tcp - - - 2015-07-21 - 2016-08-11 - - - - - FreeBSD -- Denial of Service with IPv6 Router Advertisements - - - FreeBSD-kernel - 10.110.1_9 - 9.39.3_13 - 8.48.4_27 - - - - -

Problem Description:

-

The Neighbor Discover Protocol allows a local router to - advertise a suggested Current Hop Limit value of a link, - which will replace Current Hop Limit on an interface connected - to the link on the FreeBSD system.

-

Impact:

-

When the Current Hop Limit (similar to IPv4's TTL) is - small, IPv6 packets may get dropped before they reached - their destinations.

-

By sending specifically crafted Router Advertisement - packets, an attacker on the local network can cause the - FreeBSD system to lose the ability to communicate with - another IPv6 node on a different network.

- - - - CVE-2015-2923 - SA-15:09.ipv6 - - - 2015-04-07 - 2016-08-11 - - - - - FreeBSD -- Insecure default GELI keyfile permissions - - - FreeBSD - 10.110.1_9 - - - - -

Problem Description:

-

The default permission set by bsdinstall(8) installer - when configuring full disk encrypted ZFS is too open.

-

Impact:

-

A local attacker may be able to get a copy of the geli(8) - provider's keyfile which is located at a fixed location.

- - - - CVE-2015-1415 - SA-15:08.bsdinstall - - - 2015-04-07 - 2016-08-11 - - - - - FreeBSD -- Integer overflow in IGMP protocol - - - FreeBSD-kernel - 10.110.1_9 - 9.39.3_13 - 8.48.4_27 - - - - -

Problem Description:

-

An integer overflow in computing the size of IGMPv3 data - buffer can result in a buffer which is too small for the - requested operation.

-

Impact:

-

An attacker who can send specifically crafted IGMP packets - could cause a denial of service situation by causing the - kernel to crash.

- - - - CVE-2015-1414 - SA-15:04.igmp - - - 2015-02-25 - 2016-08-11 - - - - - FreeBSD -- SCTP stream reset vulnerability - - - FreeBSD-kernel - 10.110.1_5 - 10.010.0_17 - 9.39.3_9 - 8.48.4_23 - - - - -

Problem Description:

-

The input validation of received SCTP RE_CONFIG chunks - is insufficient, and can result in a NULL pointer deference - later.

-

Impact:

-

A remote attacker who can send a malformed SCTP packet - to a FreeBSD system that serves SCTP can cause a kernel - panic, resulting in a Denial of Service.

- - - - CVE-2014-8613 - SA-15:03.sctp - - - 2015-01-27 - 2016-08-11 - - - - - FreeBSD -- SCTP SCTP_SS_VALUE kernel memory corruption and disclosure - - - FreeBSD-kernel - 10.110.1_5 - 10.010.0_17 - 9.39.3_9 - 8.48.4_23 - - - - -

Problem Description:

-

Due to insufficient validation of the SCTP stream ID, - which serves as an array index, a local unprivileged attacker - can read or write 16-bits of kernel memory.

-

Impact:

-

An unprivileged process can read or modify 16-bits of - memory which belongs to the kernel. This may lead to - exposure of sensitive information or allow privilege - escalation.

- - - - CVE-2014-8612 - SA-15:02.kmem - - - 2015-01-27 - 2016-08-11 - - - - - FreeBSD -- Buffer overflow in stdio - - - FreeBSD - 10.110.1_1 - - - - -

Problem Description:

-

A programming error in the standard I/O library's - __sflush() function could erroneously adjust the buffered - stream's internal state even when no write actually occurred - in the case when write(2) system call returns an error.

-

Impact:

-

The accounting mismatch would accumulate, if the caller - does not check for stream status and will eventually lead - to a heap buffer overflow.

-

Such overflows may lead to data corruption or the execution - of arbitrary code at the privilege level of the calling - program.

- - - - CVE-2014-8611 - SA-14:27.stdio - - - 2014-12-10 - 2016-08-11 - - - - - FreeBSD -- Remote command execution in ftp(1) - - - FreeBSD - 10.010.0_12 - 9.39.3_5 - 9.29.2_15 - 9.19.1_22 - 8.48.4_19 - - - - -

Problem Description:

-

A malicious HTTP server could cause ftp(1) to execute - arbitrary commands.

-

Impact:

-

When operating on HTTP URIs, the ftp(1) client follows - HTTP redirects, and uses the part of the path after the - last '/' from the last resource it accesses as the output - filename if '-o' is not specified.

-

If the output file name provided by the server begins - with a pipe ('|'), the output is passed to popen(3), which - might be used to execute arbitrary commands on the ftp(1) - client machine.

- - - - CVE-2014-8517 - SA-14:26.ftp - - - 2014-11-04 - 2016-08-11 - - - - - FreeBSD -- Kernel stack disclosure in setlogin(2) / getlogin(2) - - - FreeBSD-kernel - 10.010.0_12 - 9.39.3_5 - 9.29.2_15 - 9.19.1_22 - 8.48.4_19 - - - - -

Problem Description:

-

When setlogin(2) is called while setting up a new login - session, the login name is copied into an uninitialized - stack buffer, which is then copied into a buffer of the - same size in the session structure. The getlogin(2) system - call returns the entire buffer rather than just the portion - occupied by the login name associated with the session.

-

Impact:

-

An unprivileged user can access this memory by calling - getlogin(2) and reading beyond the terminating NUL character - of the resulting string. Up to 16 (FreeBSD 8) or 32 (FreeBSD - 9 and 10) bytes of kernel memory may be leaked in this - manner for each invocation of setlogin(2).

-

This memory may contain sensitive information, such as - portions of the file cache or terminal buffers, which an - attacker might leverage to obtain elevated privileges.

- - - - CVE-2014-8476 - SA-14:25.setlogin - - - 2014-11-04 - 2016-08-11 - - - - - FreeBSD -- Denial of service attack against sshd(8) - - - FreeBSD - 10.010.0_12 - 9.29.2_15 - 9.19.1_22 - - - - -

Problem Description:

-

Although OpenSSH is not multithreaded, when OpenSSH is - compiled with Kerberos support, the Heimdal libraries bring - in the POSIX thread library as a dependency. Due to incorrect - library ordering while linking sshd(8), symbols in the C - library which are shadowed by the POSIX thread library may - not be resolved correctly at run time.

-

Note that this problem is specific to the FreeBSD build - system and does not affect other operating systems or the - version of OpenSSH available from the FreeBSD ports tree.

-

Impact:

-

An incorrectly linked sshd(8) child process may deadlock - while handling an incoming connection. The connection may - then time out or be interrupted by the client, leaving the - deadlocked sshd(8) child process behind. Eventually, the - sshd(8) parent process stops accepting new connections.

-

An attacker may take advantage of this by repeatedly - connecting and then dropping the connection after having - begun, but not completed, the authentication process.

- - - - CVE-2014-8475 - SA-14:24.sshd - - - 2014-11-04 - 2016-08-11 - - - - - FreeBSD -- memory leak in sandboxed namei lookup - - - FreeBSD-kernel - 10.010.0_10 - 9.39.3_3 - 9.29.2_13 - 9.19.1_20 - - - - -

Problem Description:

-

The namei facility will leak a small amount of kernel - memory every time a sandboxed process looks up a nonexistent - path name.

-

Impact:

-

A remote attacker that can cause a sandboxed process - (for instance, a web server) to look up a large number of - nonexistent path names can cause memory exhaustion.

- - - - CVE-2014-3711 - SA-14:22.namei - - - 2014-10-21 - 2016-08-11 - - - - - FreeBSD -- routed(8) remote denial of service vulnerability - - - FreeBSD - 10.010.0_10 - 9.39.3_3 - 9.29.2_13 - 9.19.1_20 - 8.48.4_17 - - - - -

Problem Description:

-

The input path in routed(8) will accept queries from any - source and attempt to answer them. However, the output path - assumes that the destination address for the response is - on a directly connected network.

-

Impact:

-

Upon receipt of a query from a source which is not on a - directly connected network, routed(8) will trigger an - assertion and terminate. The affected system's routing table - will no longer be updated. If the affected system is a - router, its routes will eventually expire from other routers' - routing tables, and its networks will no longer be reachable - unless they are also connected to another router.

- - - - CVE-2014-3955 - SA-14:21.routed - - - 2014-10-21 - 2016-08-11 - - - - - FreeBSD -- rtsold(8) remote buffer overflow vulnerability - - - FreeBSD - 10.010.0_10 - 9.39.3_3 - 9.29.2_13 - 9.19.1_20 - - - - -

Problem Description:

-

Due to a missing length check in the code that handles - DNS parameters, a malformed router advertisement message - can result in a stack buffer overflow in rtsold(8).

-

Impact:

-

Receipt of a router advertisement message with a malformed - DNSSL option, for instance from a compromised host on the - same network, can cause rtsold(8) to crash.

-

While it is theoretically possible to inject code into - rtsold(8) through malformed router advertisement messages, - it is normally compiled with stack protection enabled, - rendering such an attack extremely difficult.

-

When rtsold(8) crashes, the existing DNS configuration - will remain in force, and the kernel will continue to receive - and process periodic router advertisements.

- - - - CVE-2014-3954 - SA-14:20.rtsold - - - 2014-10-21 - 2016-08-11 - - - - - FreeBSD -- Denial of Service in TCP packet processing - - - FreeBSD-kernel - 10.010.0_9 - 9.39.3_2 - 9.29.2_12 - 9.19.1_19 - 8.48.4_16 - - - - -

Problem Description:

-

When a segment with the SYN flag for an already existing - connection arrives, the TCP stack tears down the connection, - bypassing a check that the sequence number in the segment - is in the expected window.

-

Impact:

-

An attacker who has the ability to spoof IP traffic can - tear down a TCP connection by sending only 2 packets, if - they know both TCP port numbers. In case one of the two - port numbers is unknown, a successful attack requires less - than 2**17 packets spoofed, which can be generated within - less than a second on a decent connection to the Internet.

- - - - CVE-2004-0230 - SA-14:19.tcp - - - 2014-09-16 - 2016-08-11 - - - - - FreeBSD -- Kernel memory disclosure in control messages and SCTP - - - FreeBSD-kernel - 10.010.0_7 - 9.29.2_10 - 9.19.1_17 - 8.48.4_14 - - - - -

Problem Description:

-

Buffer between control message header and data may not - be completely initialized before being copied to userland. - [CVE-2014-3952]

-

Three SCTP cmsgs, SCTP_SNDRCV, SCTP_EXTRCV and SCTP_RCVINFO, - have implicit padding that may not be completely initialized - before being copied to userland. In addition, three SCTP - notifications, SCTP_PEER_ADDR_CHANGE, SCTP_REMOTE_ERROR and - SCTP_AUTHENTICATION_EVENT, have padding in the returning - data structure that may not be completely initialized before - being copied to userland. [CVE-2014-3953]

-

Impact:

-

An unprivileged local process may be able to retrieve - portion of kernel memory.

-

For the generic control message, the process may be able - to retrieve a maximum of 4 bytes of kernel memory.

-

For SCTP, the process may be able to retrieve 2 bytes - of kernel memory for all three control messages, plus 92 - bytes for SCTP_SNDRCV and 76 bytes for SCTP_EXTRCV. If the - local process is permitted to receive SCTP notification, a - maximum of 112 bytes of kernel memory may be returned to - userland.

-

This information might be directly useful, or it might - be leveraged to obtain elevated privileges in some way. For - example, a terminal buffer might include a user-entered - password.

- - - - CVE-2014-3952 - CVE-2014-3953 - SA-14:17.kmem - - - 2014-07-08 - 2016-08-11 - - - - - FreeBSD -- Multiple vulnerabilities in file(1) and libmagic(3) - - - FreeBSD - 10.010.0_6 - 9.29.2_9 - 9.19.1_16 - 8.48.4_13 - - - - -

Problem Description:

-

A specifically crafted Composite Document File (CDF) - file can trigger an out-of-bounds read or an invalid pointer - dereference. [CVE-2012-1571]

-

A flaw in regular expression in the awk script detector - makes use of multiple wildcards with unlimited repetitions. - [CVE-2013-7345]

-

A malicious input file could trigger infinite recursion - in libmagic(3). [CVE-2014-1943]

-

A specifically crafted Portable Executable (PE) can - trigger out-of-bounds read. [CVE-2014-2270]

-

Impact:

-

An attacker who can cause file(1) or any other applications - using the libmagic(3) library to be run on a maliciously - constructed input can the application to crash or consume - excessive CPU resources, resulting in a denial-of-service.

- - - - CVE-2012-1571 - CVE-2013-7345 - CVE-2014-1943 - CVE-2014-2270 - SA-14:16.file - - - 2014-06-24 - 2016-08-11 - - - - - FreeBSD -- iconv(3) NULL pointer dereference and out-of-bounds array access - - - FreeBSD - 10.010.0_6 - - - - -

Problem Description:

-

A NULL pointer dereference in the initialization code - of the HZ module and an out of bounds array access in the - initialization code of the VIQR module make iconv_open(3) - calls involving HZ or VIQR result in an application crash.

-

Impact:

-

Services where an attacker can control the arguments of - an iconv_open(3) call can be caused to crash resulting in - a denial-of-service. For example, an email encoded in HZ - may cause an email delivery service to crash if it converts - emails to a more generic encoding like UTF-8 before applying - filtering rules.

- - - - CVE-2014-3951 - SA-14:15.iconv - - - 2014-06-24 - 2016-08-11 - - - - - FreeBSD -- Incorrect error handling in PAM policy parser - - - FreeBSD - 9.29.2_7 - 10.010.0_4 - - - - -

Problem Description:

-

The OpenPAM library searches for policy definitions in - several locations. While doing so, the absence of a policy - file is a soft failure (handled by searching in the next - location) while the presence of an invalid file is a hard - failure (handled by returning an error to the caller).

-

The policy parser returns the same error code (ENOENT) - when a syntactically valid policy references a non-existent - module as when the requested policy file does not exist. - The search loop regards this as a soft failure and looks - for the next similarly-named policy, without discarding the - partially-loaded configuration.

-

A similar issue can arise if a policy contains an include - directive that refers to a non-existent policy.

-

Impact:

-

If a module is removed, or the name of a module is - misspelled in the policy file, the PAM library will proceed - with a partially loaded configuration. Depending on the - exact circumstances, this may result in a fail-open scenario - where users are allowed to log in without a password, or - with an incorrect password.

-

In particular, if a policy references a module installed - by a package or port, and that package or port is being - reinstalled or upgraded, there is a brief window of time - during which the module is absent and policies that use it - may fail open. This can be especially damaging to Internet-facing - SSH servers, which are regularly subjected to brute-force - scans.

- - - - CVE-2014-3879 - SA-14:13.pam - - - 2014-06-03 - 2016-08-11 - - - - - FreeBSD -- ktrace kernel memory disclosure - - - FreeBSD-kernel - 9.29.2_7 - 9.19.1_14 - 8.48.4_11 - - - - -

Problem Description:

-

Due to an overlooked merge to -STABLE branches, the size - for page fault kernel trace entries was set incorrectly.

-

Impact:

-

A user who can enable kernel process tracing could end - up reading the contents of kernel memory.

-

Such memory might contain sensitive information, such - as portions of the file cache or terminal buffers. This - information might be directly useful, or it might be leveraged - to obtain elevated privileges in some way; for example, a - terminal buffer might include a user-entered password.

- - - - CVE-2014-3873 - SA-14:12.ktrace - - - 2014-06-03 - 2016-08-11 - - - - - FreeBSD -- sendmail improper close-on-exec flag handling - - - FreeBSD - 10.010.0_4 - 9.29.2_7 - 9.19.1_14 - 8.48.4_11 - - - - -

Problem Description:

-

There is a programming error in sendmail(8) that prevented - open file descriptors have close-on-exec properly set. - Consequently a subprocess will be able to access all open - files that the parent process have open.

-

Impact:

-

A local user who can execute their own program for mail - delivery will be able to interfere with an open SMTP - connection.

- - - - SA-14:11.sendmail - - - 2014-06-03 - 2016-08-11 - - - - - FreeBSD -- TCP reassembly vulnerability - - - FreeBSD-kernel - 8.48.4_9 - 8.38.3_16 - 9.29.2_5 - 9.19.1_12 - 10.010.0_2 - - - - -

Problem Description:

-

FreeBSD may add a reassemble queue entry on the stack - into the segment list when the reassembly queue reaches its - limit. The memory from the stack is undefined after the - function returns. Subsequent iterations of the reassembly - function will attempt to access this entry.

-

Impact:

-

An attacker who can send a series of specifically crafted - packets with a connection could cause a denial of service - situation by causing the kernel to crash.

-

Additionally, because the undefined on stack memory may - be overwritten by other kernel threads, while extremely - difficult, it may be possible for an attacker to construct - a carefully crafted attack to obtain portion of kernel - memory via a connected socket. This may result in the - disclosure of sensitive information such as login credentials, - etc. before or even without crashing the system.

- - - - CVE-2014-3000 - SA-14:08.tcp - - - 2014-04-30 - 2016-08-11 - - - - - FreeBSD -- devfs rules not applied by default for jails - - - FreeBSD - 10.010.0_2 - - - - -

Problem Description:

-

The default devfs rulesets are not loaded on boot, even - when jails are used. Device nodes will be created in the - jail with their normal default access permissions, while - most of them should be hidden and inaccessible.

-

Impact:

-

Jailed processes can get access to restricted resources - on the host system. For jailed processes running with - superuser privileges this implies access to all devices on - the system. This level of access could lead to information - leakage and privilege escalation.

- - - - CVE-2014-3001 - SA-14:07.devfs - - - 2014-04-30 - 2016-08-11 - - - - - FreeBSD -- Deadlock in the NFS server - - - FreeBSD-kernel - 10.010.0_1 - 9.29.2_4 - 9.19.1_11 - 8.48.4_8 - 8.38.3_15 - - - - -

Problem Description:

-

The kernel holds a lock over the source directory vnode - while trying to convert the target directory file handle - to a vnode, which needs to be returned with the lock held, - too. This order may be in violation of normal lock order, - which in conjunction with other threads that grab locks in - the right order, constitutes a deadlock condition because - no thread can proceed.

-

Impact:

-

An attacker on a trusted client could cause the NFS - server become deadlocked, resulting in a denial of service.

- - - - CVE-2014-1453 - SA-14:05.nfsserver - - - 2014-04-08 - 2016-08-11 - - - - - FreeBSD -- bsnmpd remote denial of service vulnerability - - - FreeBSD - 9.29.2_3 - 9.19.1_10 - 8.48.4_7 - 8.38.3_14 - - - - -

Problem Description:

-

The bsnmpd(8) daemon is prone to a stack-based - buffer-overflow when it has received a specifically crafted - GETBULK PDU request.

-

Impact:

-

This issue could be exploited to execute arbitrary code in - the context of the service daemon, or crash the service daemon, causing - a denial-of-service.

- - - - CVE-2014-1452 - SA-14:01.bsnmpd - - - 2014-01-14 - 2016-08-11 - - - - - PostgreSQL -- Denial-of-Service and Code Injection Vulnerabilities - - - postgresql91-server - 9.1.09.1.23 - - - postgresql92-server - 9.2.09.2.18 - - - postgresql93-server - 9.3.09.3.11 - - - postgresql94-server - 9.4.09.4.9 - - - postgresql95-server - 9.5.09.5.4 - - - - -

PostgreSQL project reports:

-
-

- Security Fixes nested CASE expressions + - database and role names with embedded special characters -

-
    -
  • CVE-2016-5423: certain nested CASE expressions can cause the - server to crash. -
    • -
  • CVE-2016-5424: database and role names with embedded special - characters can allow code injection during administrative operations - like pg_dumpall. -
    • -
-
- - - - CVE-2016-5423 - CVE-2016-5424 - - - 2016-08-11 - 2016-08-11 - - - - - piwik -- XSS vulnerability - - - piwik - 2.16.2 - - - - -

Piwik reports:

-
-

We have identified and fixed several XSS security issues in this release.

-
- - - - We have identified and fixed several XSS security issues in this release. - - - 2016-08-03 - 2016-08-09 - - - - - BIND,Knot,NSD,PowerDNS -- denial over service via oversized zone transfers - - - bind99 - 9.9.9P2 - - - bind910 - 9.10.4P2 - - - bind911 - 9.11.0.b2 - - - bind9-devel - 9.12.0.a.2016.11.02 - - - knot - knot1 - 1.6.8 - - - knot2 - 2.3.0 - - - nsd - 4.1.11 - - - powerdns - 4.0.1 - - - - -

ISC reports:

-
-

DNS protocols were designed with the assumption that a certain - amount of trust could be presumed between the operators of primary - and secondary servers for a given zone. However, in current - practice some organizations have scenarios which require them to - accept zone data from sources that are not fully trusted (for - example: providers of secondary name service). A party who is - allowed to feed data into a zone (e.g. by AXFR, IXFR, or Dynamic DNS - updates) can overwhelm the server which is accepting data by - intentionally or accidentally exhausting that server's memory.

-
- - - - CVE-2016-6170 - CVE-2016-6171 - CVE-2016-6172 - CVE-2016-6173 - https://kb.isc.org/article/AA-01390 - http://www.openwall.com/lists/oss-security/2016/07/06/4 - - - 2016-07-06 - 2016-08-10 - 2017-04-24 - - - - - FreeBSD -- Kernel memory disclosure in sctp(4) - - - FreeBSD-kernel - 9.19.1_6 - 8.48.4_3 - 8.38.3_10 - - - - -

Problem Description:

-

When initializing the SCTP state cookie being sent in INIT-ACK chunks, - a buffer allocated from the kernel stack is not completely initialized.

-

Impact:

-

Fragments of kernel memory may be included in SCTP packets and - transmitted over the network. For each SCTP session, there are two - separate instances in which a 4-byte fragment may be transmitted.

-

This memory might contain sensitive information, such as portions of the - file cache or terminal buffers. This information might be directly - useful, or it might be leveraged to obtain elevated privileges in - some way. For example, a terminal buffer might include a user-entered - password.

- - - - SA-13:10.sctp - CVE-2013-5209 - - - 2013-08-22 - 2016-08-09 - - - - - FreeBSD -- integer overflow in IP_MSFILTER - - - FreeBSD-kernel - 9.19.1_6 - 8.48.4_3 - 8.38.3_10 - - - - -

Problem Description:

-

An integer overflow in computing the size of a temporary - buffer can result in a buffer which is too small for the requested - operation.

-

Impact:

-

An unprivileged process can read or write pages of memory - which belong to the kernel. These may lead to exposure of sensitive - information or allow privilege escalation.

- - - - CVE-2013-3077 - SA-13:09.ip_multicast - - - 2013-08-22 - 2016-08-09 - - - - - FreeBSD -- Incorrect privilege validation in the NFS server - - - FreeBSD-kernel - 9.19.1_5 - 8.38.3_9 - - - - -

Problem Description:

-

The kernel incorrectly uses client supplied credentials - instead of the one configured in exports(5) when filling out the - anonymous credential for a NFS export, when -network or -host - restrictions are used at the same time.

-

Impact:

-

The remote client may supply privileged credentials (e.g. the - root user) when accessing a file under the NFS share, which will bypass - the normal access checks.

- - - - CVE-2013-4851 - SA-13:08.nfsserver - - - 2013-07-06 - 2016-08-09 - - - - - collectd -- Network plugin heap overflow - - - collectd5 - 5.5.2 - - - - -

The collectd Project reports:

-
-

Emilien Gaspar has identified a heap overflow in collectd's - network plugin which can be triggered remotely and is potentially - exploitable.

-
- - - - CVE-2016-6254 - http://collectd.org/news.shtml#news98 - - - 2016-07-26 - 2016-08-05 - - - - - moodle -- multiple vulnerabilities - - - moodle28 - 2.8.12 - - - moodle29 - 2.9.7 - - - moodle30 - 3.0.5 - - - moodle31 - 3.1.1 - - - - -

Marina Glancy reports:

-
-
    -

  • MSA-16-0019: Glossary search displays entries without - checking user permissions to view them

    • -

  • MSA-16-0020: Text injection in email headers

    • -

  • MSA-16-0021: Unenrolled user still receives event monitor - notifications even though they can no longer access course

    • -
-
- - - - CVE-2016-5012 - CVE-2016-5013 - CVE-2016-5014 - https://moodle.org/security/ - - - 2016-07-19 - 2016-08-06 - - - - - bind -- denial of service vulnerability - - - bind99 - 9.9.9P2 - - - bind910 - 9.10.4P2 - - - bind911 - 9.11.0.b2 - - - bind9-devel - 9.12.0.a.2016.07.14 - - - - -

ISC reports:

-
-

A query name which is too long can cause a segmentation fault in - lwresd.

-
- - - - CVE-2016-2775 - https://kb.isc.org/article/AA-01393 - - - 2016-07-18 - 2016-08-06 - - - - - wireshark -- multiple vulnerabilities - - - wireshark - wireshark-lite - wireshark-qt5 - tshark - tshark-lite - 2.0.5 - - - - -

Wireshark development team reports:

-
-

The following vulnerabilities have been fixed:

-
    -

  • wnpa-sec-2016-41

    -

    PacketBB crash. (Bug 12577)

    • -

  • wnpa-sec-2016-42

    -

    WSP infinite loop. (Bug 12594)

    • -

  • wnpa-sec-2016-44

    -

    RLC long loop. (Bug 12660)

    • -

  • wnpa-sec-2016-45

    -

    LDSS dissector crash. (Bug 12662)

    • -

  • wnpa-sec-2016-46

    -

    RLC dissector crash. (Bug 12664)

    • -

  • wnpa-sec-2016-47

    -

    OpenFlow long loop. (Bug 12659)

    • -

  • wnpa-sec-2016-48

    -

    MMSE, WAP, WBXML, and WSP infinite loop. (Bug 12661)

    • -

  • wnpa-sec-2016-49

    -

    WBXML crash. (Bug 12663)

    • -
-
- - - - CVE-2016-6505 - CVE-2016-6506 - CVE-2016-6508 - CVE-2016-6509 - CVE-2016-6510 - CVE-2016-6511 - CVE-2016-6512 - CVE-2016-6513 - https://www.wireshark.org/docs/relnotes/wireshark-2.0.5.html - http://www.openwall.com/lists/oss-security/2016/08/01/4 - - - 2016-07-27 - 2016-08-06 - - - - - p5-XSLoader -- local arbitrary code execution - - - p5-XSLoader - 0.22 - - - perl5 - perl5.18 - perl5.20 - perl5.22 - perl5.24 - perl5-devel - 5.18.4_24 - 5.205.20.3_15 - 5.215.22.3.r2 - 5.235.24.1.r2 - 5.255.25.2.87 - - - perl - 0 - - - - -

Jakub Wilk reports:

-
-

XSLoader tries to load code from a subdirectory in the cwd when - called inside a string eval

-
- - - - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=829578 - CVE-2016-6185 - - - 2016-06-30 - 2016-08-04 - 2016-08-22 - - - - - perl -- local arbitrary code execution - - - perl5 - perl5.18 - perl5.20 - perl5.22 - perl5.24 - perl5-devel - 5.18.4_23 - 5.205.20.3_14 - 5.215.22.3.r2 - 5.235.24.1.r2 - 5.255.25.3.18 - - - perl - 0 - - - - -

Sawyer X reports:

-
-

Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do - not properly remove . (period) characters from the end of the includes - directory array, which might allow local users to gain privileges via a - Trojan horse module under the current working directory.

-
- - - - http://www.nntp.perl.org/group/perl.perl5.porters/2016/07/msg238271.html - CVE-2016-1238 - - - 2016-07-21 - 2016-08-04 - 2016-08-22 - - - - - gd -- multiple vulnerabilities - - - gd - 2.2.3,1 - - - - -

Pierre Joye reports:

-
-
    -

  • fix php bug 72339, Integer Overflow in _gd2GetHeader - (CVE-2016-5766)

    • -

  • gd: Buffer over-read issue when parsing crafted TGA - file (CVE-2016-6132)

    • -

  • Integer overflow error within _gdContributionsAlloc() - (CVE-2016-6207)

    • -

  • fix php bug 72494, invalid color index not handled, can - lead to crash ( CVE-2016-6128)

    • -
-
- - - - https://github.com/libgd/libgd/releases/tag/gd-2.2.3 - CVE-2016-5766 - CVE-2016-6132 - CVE-2016-6207 - CVE-2016-6128 - - - 2016-07-21 - 2016-08-04 - - - - - Vulnerabilities in Curl - - - curl - 7.32.07.50.1 - - - - -

Curl security team reports:

-
-

CVE-2016-5419 - TLS session resumption client cert bypass

-

CVE-2016-5420 - Re-using connections with wrong client cert

-

CVE-2016-5421 - use of connection struct after free

-
- - - - CVE-2016-5419 - CVE-2016-5420 - CVE-2016-5421 - https://curl.haxx.se/docs/adv_20160803A.html - https://curl.haxx.se/docs/adv_20160803B.html - https://curl.haxx.se/docs/adv_20160803C.html - - - 2016-08-03 - 2016-08-04 - - - - - lighttpd - multiple vulnerabilities - - - lighttpd - 1.4.41 - - - - -

Lighttpd Project reports:

-
-

Security fixes for Lighttpd:

-
    -

  • security: encode quoting chars in HTML and XML

    • -

  • security: ensure gid != 0 if server.username is set, but not server.groupname

    • -

  • security: disable stat_cache if server.follow-symlink = “disable”

    • -

  • security: httpoxy defense: do not emit HTTP_PROXY to CGI env

    • -
-
- - - - http://www.lighttpd.net/2016/7/31/1.4.41/ - ports/211495 - - - 2016-07-31 - 2016-08-03 - - - - - xen-tools -- virtio: unbounded memory allocation issue - - - xen-tools - 4.7.0_4 - - - - -

The Xen Project reports:

-
-

A guest can submit virtio requests without bothering to wait for - completion and is therefore not bound by virtqueue size...

-

A malicious guest administrator can cause unbounded memory - allocation in QEMU, which can cause an Out-of-Memory condition - in the domain running qemu. Thus, a malicious guest administrator - can cause a denial of service affecting the whole host.

-
- - - - CVE-2016-5403 - ports/211482 - http://xenbits.xen.org/xsa/advisory-184.html - - - 2016-07-27 - 2016-08-02 - - - - - xen-kernel -- x86: Missing SMAP whitelisting in 32-bit exception / event delivery - - - xen-kernel - 4.54.7.0_3 - - - - -

The Xen Project reports:

-
-

Supervisor Mode Access Prevention is a hardware feature designed - to make an Operating System more robust, by raising a pagefault - rather than accidentally following a pointer into userspace. - However, legitimate accesses into userspace require whitelisting, - and the exception delivery mechanism for 32bit PV guests wasn't - whitelisted.

-

A malicious 32-bit PV guest kernel can trigger a safety check, - crashing the hypervisor and causing a denial of service to other - VMs on the host.

-
- - - - CVE-2016-6259 - ports/211482 - http://xenbits.xen.org/xsa/advisory-183.html - - - 2016-07-26 - 2016-08-02 - - - - - xen-kernel -- x86: Privilege escalation in PV guests - - - xen-kernel - 4.7.0_3 - - - - -

The Xen Project reports:

-
-

The PV pagetable code has fast-paths for making updates to - pre-existing pagetable entries, to skip expensive re-validation - in safe cases (e.g. clearing only Access/Dirty bits). The bits - considered safe were too broad, and not actually safe.

-

A malicious PV guest administrator can escalate their privilege to - that of the host.

-
- - - - CVE-2016-6258 - ports/211482 - http://xenbits.xen.org/xsa/advisory-182.html - - - 2016-07-26 - 2016-08-02 - - - - - libidn -- multiple vulnerabilities - - - libidn - 1.33 - - - - -

Simon Josefsson reports:

-
-

libidn: Fix out-of-bounds stack read in idna_to_ascii_4i.

-

idn: Solve out-of-bounds-read when reading one zero byte as input. - Also replaced fgets with getline.

-

libidn: stringprep_utf8_nfkc_normalize reject invalid UTF-8. It was - always documented to only accept UTF-8 data, but now it doesn't - crash when presented with such data.

-
- - - - CVE-2016-6261 - CVE-2015-8948 - CVE-2016-6262 - CVE-2016-6263 - https://lists.gnu.org/archive/html/help-libidn/2016-07/msg00009.html - http://www.openwall.com/lists/oss-security/2016/07/21/4 - - - 2016-07-20 - 2016-07-31 - - - - - The GIMP -- Use after Free vulnerability - - - gimp-app - 2.8.18,1 - - - - -

The GIMP team reports:

-
-

A Use-after-free vulnerability was found in the xcf_load_image function.

-
- - - - https://mail.gnome.org/archives/gimp-developer-list/2016-July/msg00020.html - https://bugzilla.gnome.org/show_bug.cgi?id=767873 - CVE-2016-4994 - - - 2016-06-20 - 2016-07-19 - - - - - xercesi-c3 -- multiple vulnerabilities - - - xerces-c3 - 3.1.4 - - - - -

Apache reports:

-
-

The Xerces-C XML parser fails to successfully parse a - DTD that is deeply nested, and this causes a stack overflow, which - makes a denial of service attack against many applications possible - by an unauthenticated attacker.

-

Also, CVE-2016-2099: Use-after-free vulnerability in - validators/DTD/DTDScanner.cpp in Apache Xerces C++ 3.1.3 and earlier - allows context-dependent attackers to have unspecified impact via an - invalid character in an XML document.

-
- - - - https://xerces.apache.org/xerces-c/secadv/CVE-2016-4463.txt - http://www.openwall.com/lists/oss-security/2016/05/09/7 - CVE-2016-2099 - CVE-2016-4463 - - - 2016-05-09 - 2016-07-26 - - - - - php -- multiple vulnerabilities - - - php55 - 5.5.38 - - - php56 - 5.6.24 - - - php70 - 7.0.9 - - - php70-curl - 7.0.9 - - - php55-bz2 - 5.5.38 - - - php56-bz2 - 5.6.24 - - - php70-bz2 - 7.0.9 - - - php55-exif - 5.5.38 - - - php56-exif - 5.6.24 - - - php70-exif - 7.0.9 - - - php55-gd - 5.5.38 - - - php56-gd - 5.6.24 - - - php70-gd - 7.0.9 - - - php70-mcrypt - 7.0.9 - - - php55-odbc - 5.5.38 - - - php56-odbc - 5.6.24 - - - php70-odbc - 7.0.9 - - - php55-snmp - 5.5.38 - - - php56-snmp - 5.6.24 - - - php70-snmp - 7.0.9 - - - php55-xmlrpc - 5.5.38 - - - php56-xmlrpc - 5.6.24 - - - php70-xmlrpc - 7.0.9 - - - php55-zip - 5.5.38 - - - php56-zip - 5.6.24 - - - php70-zip - 7.0.9 - - - - -

PHP reports:

-
-
    -

  • Fixed bug #69975 (PHP segfaults when accessing nvarchar(max) defined columns)

    • -

  • Fixed bug #72479 (Use After Free Vulnerability in SNMP with GC and unserialize()).

    • -

  • Fixed bug #72512 (gdImageTrueColorToPaletteBody allows arbitrary write/read access).

    • -

  • Fixed bug #72519 (imagegif/output out-of-bounds access).

    • -

  • Fixed bug #72520 (Stack-based buffer overflow vulnerability in php_stream_zip_opener).

    • -

  • Fixed bug #72533 (locale_accept_from_http out-of-bounds access).

    • -

  • Fixed bug #72541 (size_t overflow lead to heap corruption).

    • -

  • Fixed bug #72551, bug #72552 (Incorrect casting from size_t to int lead to heap overflow in mdecrypt_generic).

    • -

  • Fixed bug #72558 (Integer overflow error within _gdContributionsAlloc()).

    • -

  • Fixed bug #72573 (HTTP_PROXY is improperly trusted by some PHP libraries and applications).

    • -

  • Fixed bug #72603 (Out of bound read in exif_process_IFD_in_MAKERNOTE).

    • -

  • Fixed bug #72606 (heap-buffer-overflow (write) simplestring_addn simplestring.c).

    • -

  • Fixed bug #72613 (Inadequate error handling in bzread()).

    • -

  • Fixed bug #72618 (NULL Pointer Dereference in exif_process_user_comment).

    • -
-
- - - - http://www.php.net/ChangeLog-5.php#5.5.38 - http://www.php.net/ChangeLog-5.php#5.6.24 - http://www.php.net/ChangeLog-7.php#7.0.8 - http://seclists.org/oss-sec/2016/q3/121 - CVE-2015-8879 - CVE-2016-5385 - CVE-2016-5399 - CVE-2016-6288 - CVE-2016-6289 - CVE-2016-6290 - CVE-2016-6291 - CVE-2016-6292 - CVE-2016-6294 - CVE-2016-6295 - CVE-2016-6296 - CVE-2016-6297 - - - 2016-07-21 - 2016-07-26 - - - - - chromium -- multiple vulnerabilities - - - chromium - chromium-npapi - chromium-pulse - 52.0.2743.82 - - - - -

Google Chrome Releases reports:

-
-

48 security fixes in this release, including:

-
    -
  • [610600] High CVE-2016-1706: Sandbox escape in PPAPI. Credit to - Pinkie Pie xisigr of Tencent's Xuanwu Lab
    • -
  • [613949] High CVE-2016-1708: Use-after-free in Extensions. - Credit to Adam Varsan
    • -
  • [614934] High CVE-2016-1709: Heap-buffer-overflow in sfntly. - Credit to ChenQin of Topsec Security Team
    • -
  • [616907] High CVE-2016-1710: Same-origin bypass in Blink. - Credit to Mariusz Mlynski
    • -
  • [617495] High CVE-2016-1711: Same-origin bypass in Blink. - Credit to Mariusz Mlynski
    • -
  • [618237] High CVE-2016-5127: Use-after-free in Blink. Credit - to cloudfuzzer
    • -
  • [619166] High CVE-2016-5128: Same-origin bypass in V8. Credit - to Anonymous
    • -
  • [620553] High CVE-2016-5129: Memory corruption in V8. Credit to - Jeonghoon Shin
    • -
  • [623319] High CVE-2016-5130: URL spoofing. Credit to Wadih - Matar
    • -
  • [623378] High CVE-2016-5131: Use-after-free in libxml. Credit - to Nick Wellnhofer
    • -
  • [607543] Medium CVE-2016-5132: Limited same-origin bypass in - Service Workers. Credit to Ben Kelly
    • -
  • [613626] Medium CVE-2016-5133: Origin confusion in proxy - authentication. Credit to Patch Eudor
    • -
  • [593759] Medium CVE-2016-5134: URL leakage via PAC script. - Credit to Paul Stone
    • -
  • [605451] Medium CVE-2016-5135: Content-Security-Policy bypass. - Credit to kingxwy
    • -
  • [625393] Medium CVE-2016-5136: Use after free in extensions. - Credit to Rob Wu
    • -
  • [625945] Medium CVE-2016-5137: History sniffing with HSTS and - CSP. Credit to Xiaoyin Liu
    • -
  • [629852] CVE-2016-1705: Various fixes from internal audits, - fuzzing and other initiatives.
    • -
-
- - - - CVE-2016-1705 - CVE-2016-1706 - CVE-2016-1708 - CVE-2016-1709 - CVE-2016-1710 - CVE-2016-1711 - CVE-2016-5127 - CVE-2016-5128 - CVE-2016-5129 - CVE-2016-5130 - CVE-2016-5131 - CVE-2016-5132 - CVE-2016-5133 - CVE-2016-5134 - CVE-2016-5135 - CVE-2016-5136 - CVE-2016-5137 - https://googlechromereleases.blogspot.nl/2016/07/stable-channel-update.html - - - 2016-07-20 - 2016-07-22 - - - - - krb5 -- KDC denial of service vulnerability - - - krb5-113 - 1.13.6 - - - krb5-114 - 1.14.3 - - - - -

Major changes in krb5 1.14.3 and krb5 1.13.6:

-
-

Fix a rare KDC denial of service vulnerability when anonymous - client principals are restricted to obtaining TGTs only - [CVE-2016-3120] .

-
- - - - CVE-2016-3120 - http://web.mit.edu/kerberos/krb5-1.14/ - - - 2016-07-20 - 2016-07-21 - 2016-07-26 - - - - - Apache OpenOffice 4.1.2 -- Memory Corruption Vulnerability (Impress Presentations) - - - apache-openoffice - 4.1.2_8 - - - apache-openoffice-devel - 4.2.1753426,4 - - - - -

The Apache OpenOffice Project reports:

-
-

An OpenDocument Presentation .ODP or Presentation Template - .OTP file can contain invalid presentation elements that lead - to memory corruption when the document is loaded in Apache - OpenOffice Impress. The defect may cause the document to appear - as corrupted and OpenOffice may crash in a recovery-stuck mode - requiring manual intervention. A crafted exploitation of the - defect can allow an attacker to cause denial of service - (memory corruption and application crash) and possible - execution of arbitrary code.

-
- - - - CVE-2016-1513 - http://www.openoffice.org/security/cves/CVE-2015-4551.html - - - 2016-07-17 - 2016-07-21 - - - - - MySQL -- Multiple vulnerabilities - - - mariadb55-server - 5.5.49 - - - mariadb100-server - 10.0.25 - - - mariadb101-server - 10.1.14 - - - mysql55-server - 5.5.49 - - - mysql56-server - 5.6.30 - - - mysql57-server - 5.7.12_1 - - - percona55-server - 5.5.49 - - - percona56-server - 5.6.30 - - - - -

Oracle reports:

-
-

The quarterly Critical Patch Update contains 22 new security fixes for - Oracle MySQL 5.5.49, 5.6.30, 5.7.13 and earlier

-
- - - - http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html#AppendixMSQL - CVE-2016-3477 - CVE-2016-3440 - CVE-2016-2105 - CVE-2016-3471 - CVE-2016-3486 - CVE-2016-3501 - CVE-2016-3518 - CVE-2016-3521 - CVE-2016-3588 - CVE-2016-3615 - CVE-2016-3614 - CVE-2016-5436 - CVE-2016-3459 - CVE-2016-5437 - CVE-2016-3424 - CVE-2016-5439 - CVE-2016-5440 - CVE-2016-5441 - CVE-2016-5442 - CVE-2016-5443 - CVE-2016-5444 - CVE-2016-3452 - - - 2016-07-20 - 2016-07-21 - 2016-08-08 - - - - - typo3 -- Missing access check in Extbase - - - typo3 - 7.6.8 - - - typo3-lts - 6.2.24 - - - - -

TYPO3 reports:

-
-

Extbase request handling fails to implement a proper access check for - requested controller/ action combinations, which makes it possible for an - attacker to execute arbitrary Extbase actions by crafting a special request. To - successfully exploit this vulnerability, an attacker must have access to at - least one Extbase plugin or module action in a TYPO3 installation. The missing - access check inevitably leads to information disclosure or remote code - execution, depending on the action that an attacker is able to execute.

-
- - - - CVE-2016-5091 - https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-013/ - https://wiki.typo3.org/TYPO3_CMS_7.6.8 - https://wiki.typo3.org/TYPO3_CMS_6.2.24 - - - 2016-05-24 - 2016-07-18 - - - - - - - - - atutor -- multiple vulnerabilities - - - atutor - 2.2.2 - - - - -

ATutor reports:

-
-

Security Fixes: Added a new layer of security over all php - superglobals, fixed several XSS, CSRF, and SQL injection - vulnerabilities.

-
- - - - https://github.com/atutor/ATutor/releases/tag/atutor_2_2_2 - - - 2016-07-01 - 2016-07-16 - - - - - atutor -- multiple vulnerabilities - - - atutor - 2.2.1 - - - - -

ATutor reports:

-
-

Security Fixes: A number of minor XSS vulnerabilities discovered in - the previous version of ATutor have been corrected.

-
- - - - https://github.com/atutor/ATutor/releases/tag/atutor_2_2_1 - - - 2016-01-30 - 2016-07-16 - - - - - flash -- multiple vulnerabilities - - - linux-c6-flashplugin - linux-c6_64-flashplugin - linux-f10-flashplugin - 11.2r202.632 - - - - -

Adobe reports:

-
-

These updates resolve a race condition vulnerability that could - lead to information disclosure (CVE-2016-4247).

-

These updates resolve type confusion vulnerabilities that could - lead to code execution (CVE-2016-4223, CVE-2016-4224, - CVE-2016-4225).

-

These updates resolve use-after-free vulnerabilities that could - lead to code execution (CVE-2016-4173, CVE-2016-4174, CVE-2016-4222, - CVE-2016-4226, CVE-2016-4227, CVE-2016-4228, CVE-2016-4229, - CVE-2016-4230, CVE-2016-4231, CVE-2016-4248).

-

These updates resolve a heap buffer overflow vulnerability that - could lead to code execution (CVE-2016-4249).

-

These updates resolve memory corruption vulnerabilities that could - lead to code execution (CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, - CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, - CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, - CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, - CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, - CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, - CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, - CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, - CVE-2016-4245, CVE-2016-4246).

-

These updates resolve a memory leak vulnerability (CVE-2016-4232). -

-

These updates resolve stack corruption vulnerabilities that could - lead to code execution (CVE-2016-4176, CVE-2016-4177).

-

These updates resolve a security bypass vulnerability that could - lead to information disclosure (CVE-2016-4178).

-
- - - - CVE-2016-4172 - CVE-2016-4173 - CVE-2016-4174 - CVE-2016-4175 - CVE-2016-4176 - CVE-2016-4177 - CVE-2016-4178 - CVE-2016-4179 - CVE-2016-4180 - CVE-2016-4181 - CVE-2016-4182 - CVE-2016-4183 - CVE-2016-4184 - CVE-2016-4185 - CVE-2016-4186 - CVE-2016-4187 - CVE-2016-4188 - CVE-2016-4189 - CVE-2016-4190 - CVE-2016-4217 - CVE-2016-4218 - CVE-2016-4219 - CVE-2016-4220 - CVE-2016-4221 - CVE-2016-4222 - CVE-2016-4223 - CVE-2016-4224 - CVE-2016-4225 - CVE-2016-4226 - CVE-2016-4227 - CVE-2016-4228 - CVE-2016-4229 - CVE-2016-4230 - CVE-2016-4231 - CVE-2016-4232 - CVE-2016-4233 - CVE-2016-4234 - CVE-2016-4235 - CVE-2016-4236 - CVE-2016-4237 - CVE-2016-4238 - CVE-2016-4239 - CVE-2016-4240 - CVE-2016-4241 - CVE-2016-4242 - CVE-2016-4243 - CVE-2016-4244 - CVE-2016-4245 - CVE-2016-4246 - CVE-2016-4247 - CVE-2016-4248 - CVE-2016-4249 - https://helpx.adobe.com/security/products/flash-player/apsb16-25.html - - - 2016-07-12 - 2016-07-16 - - - - - - - - - libreoffice -- use-after-free vulnerability - - - libreoffice - 5.1.4 - - - - -

Talos reports:

-
-

An exploitable Use After Free vulnerability exists in the - RTF parser LibreOffice. A specially crafted file can cause a use after - free resulting in a possible arbitrary code execution. To exploit the - vulnerability a malicious file needs to be opened by the user via - vulnerable application.

-
- - - - http://www.talosintelligence.com/reports/TALOS-2016-0126/ - http://www.libreoffice.org/about-us/security/advisories/cve-2016-4324/ - CVE-2016-4324 - - - 2016-06-27 - 2016-07-15 - - - - - - - - - tiff -- buffer overflow - - - tiff - 4.0.6_2 - - - linux-c6-tiff - 3.9.4_2 - - - linux-f10-tiff - * - - - - -

Mathias Svensson reports:

-
-

potential buffer write overrun in PixarLogDecode() on - corrupted/unexpected images

-
- - - - https://github.com/vadz/libtiff/commit/391e77fcd217e78b2c51342ac3ddb7100ecacdd2 - CVE-2016-5314 - CVE-2016-5320 - CVE-2016-5875 - - - 2016-06-28 - 2016-07-15 - 2016-09-06 - - - - - - - - - p7zip -- out-of-bounds read vulnerability - - - p7zip - 15.14_1 - - - - -

Cisco Talos reports:

-
-

An out-of-bounds read vulnerability exists in the way 7-Zip - handles Universal Disk Format (UDF) files.

-

Central to 7-Zip’s processing of UDF files is the - CInArchive::ReadFileItem method. Because volumes can have more than - one partition map, their objects are kept in an object vector. To - start looking for an item, this method tries to reference the proper - object using the partition map’s object vector and the "PartitionRef" - field from the Long Allocation Descriptor. Lack of checking whether - the "PartitionRef" field is bigger than the available amount of - partition map objects causes a read out-of-bounds and can lead, in - some circumstances, to arbitrary code execution.

-
- - - - CVE-2016-2335 - http://blog.talosintel.com/2016/05/multiple-7-zip-vulnerabilities.html - - - 2016-05-11 - 2016-07-15 - - - - - p7zip -- heap overflow vulnerability - - - p7zip - 15.14_1 - - - - -

Cisco Talos reports:

-
-

An exploitable heap overflow vulnerability exists in the - NArchive::NHfs::CHandler::ExtractZlibFile method functionality of - 7zip that can lead to arbitrary code execution.

-
- - - - CVE-2016-2334 - http://blog.talosintel.com/2016/05/multiple-7-zip-vulnerabilities.html - - - 2016-05-11 - 2016-07-15 - - - - - samba -- client side SMB2/3 required signing can be downgraded - - - samba4 - 4.0.04.0.26 - - - samba41 - 4.1.04.1.23 - - - samba42 - 4.2.04.2.14 - - - samba43 - 4.3.04.3.11 - - - samba44 - 4.4.04.4.5 - - - - -

Samba team reports:

-
-

A man in the middle attack can disable client signing over - SMB2/3, even if enforced by configuration parameters.

-
- - - - CVE-2016-2119 - https://www.samba.org/samba/security/CVE-2016-2119.html - - - 2016-07-07 - 2016-07-13 - - - - - ruby-saml -- XML signature wrapping attack - - - rubygem-ruby-saml - 1.3.0 - - - - -

RubySec reports:

-
-

ruby-saml prior to version 1.3.0 is vulnerable to an XML signature wrapping attack - in the specific scenario where there was a signature that referenced at the same - time 2 elements (but past the scheme validator process since 1 of the element was - inside the encrypted assertion).

-

ruby-saml users must update to 1.3.0, which implements 3 extra validations to - mitigate this kind of attack.

-
- - - - CVE-2016-5697 - http://rubysec.com/advisories/CVE-2016-5697/ - https://github.com/onelogin/ruby-saml/commit/a571f52171e6bfd87db59822d1d9e8c38fb3b995 - - - 2016-06-24 - 2016-07-08 - - - - - quassel -- remote denial of service - - - quassel - 0.12.4 - - - - -

Mitre reports:

-
-

The onReadyRead function in core/coreauthhandler.cpp in Quassel - before 0.12.4 allows remote attackers to cause a denial of service - (NULL pointer dereference and crash) via invalid handshake data.

-
- - - - CVE-2016-4414 - http://quassel-irc.org/node/129 - https://github.com/quassel/quassel/commit/e678873 - http://www.openwall.com/lists/oss-security/2016/04/30/2 - http://www.openwall.com/lists/oss-security/2016/04/30/4 - - - 2016-04-24 - 2016-07-07 - - - - - apache24 -- X509 Client certificate based authentication can be bypassed when HTTP/2 is used - - - apache24 - 2.4.182.4.23 - - - - -

Apache Software Foundation reports:

-
-

The Apache HTTPD web server (from 2.4.18-2.4.20) did not validate a X509 - client certificate correctly when experimental module for the HTTP/2 - protocol is used to access a resource.

-

The net result is that a resource that should require a valid client - certificate in order to get access can be accessed without that credential.

-
- - - - CVE-2016-4979 - http://mail-archives.apache.org/mod_mbox/httpd-announce/201607.mbox/CVE-2016-4979-68283 - - - 2016-07-01 - 2016-07-05 - - - - - xen-tools -- Unrestricted qemu logging - - - xen-tools - 4.7.0_2 - - - - -

The Xen Project reports:

-
-

When the libxl toolstack launches qemu for HVM guests, it pipes the - output of stderr to a file in /var/log/xen. This output is not - rate-limited in any way. The guest can easily cause qemu to print - messages to stderr, causing this file to become arbitrarily large. -

-

The disk containing the logfile can be exhausted, possibly causing a - denial-of-service (DoS).

-
- - - - CVE-2014-3672 - http://xenbits.xen.org/xsa/advisory-180.html - - - 2016-05-23 - 2016-07-04 - - - - - xen-tools -- QEMU: Banked access to VGA memory (VBE) uses inconsistent bounds checks - - - xen-tools - 4.7.0_2 - - - - -

The Xen Project reports:

-
-

Qemu VGA module allows banked access to video memory using the - window at 0xa00000 and it supports different access modes with - different address calculations.

-

Qemu VGA module allows guest to edit certain registers in 'vbe' - and 'vga' modes.

-

A privileged guest user could use CVE-2016-3710 to exceed the bank - address window and write beyond the said memory area, potentially - leading to arbitrary code execution with privileges of the Qemu - process. If the system is not using stubdomains, this will be in - domain 0.

-

A privileged guest user could use CVE-2016-3712 to cause potential - integer overflow or OOB read access issues in Qemu, resulting in a DoS - of the guest itself. More dangerous effect, such as data leakage or - code execution, are not known but cannot be ruled out.

-
- - - - CVE-2016-3710 - CVE-2016-3712 - http://xenbits.xen.org/xsa/advisory-179.html - - - 2016-05-09 - 2016-07-04 - - - - - xen-tools -- Unsanitised driver domain input in libxl device handling - - - xen-tools - 4.7.0_1 - - - - -

The Xen Project reports:

-
-

libxl's device-handling code freely uses and trusts information - from the backend directories in xenstore.

-

A malicious driver domain can deny service to management tools.

-
- - - - CVE-2016-4963 - http://xenbits.xen.org/xsa/advisory-178.html - - - 2016-06-02 - 2016-07-04 - - - - - xen-kernel -- x86 software guest page walk PS bit handling flaw - - - xen-kernel - 4.7.0 - - - - -

The Xen Project reports:

-
-

The Page Size (PS) page table entry bit exists at all page table - levels other than L1. Its meaning is reserved in L4, and - conditionally reserved in L3 and L2 (depending on hardware - capabilities). The software page table walker in the hypervisor, - however, so far ignored that bit in L4 and (on respective hardware) - L3 entries, resulting in pages to be treated as page tables which - the guest OS may not have designated as such. If the page in - question is writable by an unprivileged user, then that user will - be able to map arbitrary guest memory.

-

On vulnerable OSes, guest user mode code may be able to establish - mappings of arbitrary memory inside the guest, allowing it to - elevate its privileges inside the guest.

-
- - - - CVE-2016-4480 - http://xenbits.xen.org/xsa/advisory-176.html - - - 2016-05-17 - 2016-07-04 - - - - - xen-tools -- Unsanitised guest input in libxl device handling code - - - xen-tools - 4.7.0_1 - - - - -

The Xen Project reports:

-
-

Various parts of libxl device-handling code inappropriately use - information from (partially) guest controlled areas of xenstore.

-

A malicious guest administrator can cause denial of service by - resource exhaustion.

-

A malicious guest administrator can confuse and/or deny service to - management facilities.

-

A malicious guest administrator of a guest configured with channel - devices may be able to escalate their privilege to that of the - backend domain (i.e., normally, to that of the host).

-
- - - - CVE-2016-4962 - http://xenbits.xen.org/xsa/advisory-175.html - - - 2016-06-02 - 2016-07-04 - - - - - xen-kernel -- x86 shadow pagetables: address width overflow - - - xen-kernel - 3.44.7.0 - - - - -

The Xen Project reports:

-
-

In the x86 shadow pagetable code, the guest frame number of a - superpage mapping is stored in a 32-bit field. If a shadowed guest - can cause a superpage mapping of a guest-physical address at or - above 2^44 to be shadowed, the top bits of the address will be lost, - causing an assertion failure or NULL dereference later on, in code - that removes the shadow.

-

A HVM guest using shadow pagetables can cause the host to crash. -

-

A PV guest using shadow pagetables (i.e. being migrated) with PV - superpages enabled (which is not the default) can crash the host, or - corrupt hypervisor memory, and so a privilege escalation cannot be - ruled out.

-
- - - - CVE-2016-3960 - http://xenbits.xen.org/xsa/advisory-173.html - - - 2016-04-18 - 2016-07-04 - - - - - wireshark -- multiple vulnerabilities - - - wireshark - wireshark-lite - wireshark-qt5 - tshark - tshark-lite - 2.0.4 - - - - -

Wireshark development team reports:

-
-

The following vulnerabilities have been fixed:

-
    -

  • wnpa-sec-2016-29

    -

    The SPOOLS dissector could go into an infinite loop. Discovered - by the CESG.

    • -

  • wnpa-sec-2016-30

    -

    The IEEE 802.11 dissector could crash. (Bug 11585)

    • -

  • wnpa-sec-2016-31

    -

    The IEEE 802.11 dissector could crash. Discovered by Mateusz - Jurczyk. (Bug 12175)

    • -

  • wnpa-sec-2016-32

    -

    The UMTS FP dissector could crash. (Bug 12191)

    • -

  • wnpa-sec-2016-33

    -

    Some USB dissectors could crash. Discovered by Mateusz - Jurczyk. (Bug 12356)

    • -

  • wnpa-sec-2016-34

    -

    The Toshiba file parser could crash. Discovered by iDefense - Labs. (Bug 12394)

    • -

  • wnpa-sec-2016-35

    -

    The CoSine file parser could crash. Discovered by iDefense - Labs. (Bug 12395)

    • -

  • wnpa-sec-2016-36

    -

    The NetScreen file parser could crash. Discovered by iDefense - Labs. (Bug 12396)

    • -

  • wnpa-sec-2016-37

    -

    The Ethernet dissector could crash. (Bug 12440)

    • -
-
- - - - CVE-2016-5350 - CVE-2016-5351 - CVE-2016-5352 - CVE-2016-5353 - CVE-2016-5354 - CVE-2016-5355 - CVE-2016-5356 - CVE-2016-5357 - CVE-2016-5358 - https://www.wireshark.org/docs/relnotes/wireshark-2.0.4.html - http://www.openwall.com/lists/oss-security/2016/06/09/4 - - - 2016-06-07 - 2016-07-04 - - - - - moodle -- multiple vulnerabilities - - - moodle28 - 2.8.12 - - - moodle29 - 2.9.6 - - - moodle30 - 3.0.4 - - - - -

Marina Glancy reports:

-
-
    -

  • MSA-16-0013: Users are able to change profile fields that - were locked by the administrator.

    • -

  • MSA-16-0015: Information disclosure of hidden forum names - and sub-names.

    • -

  • MSA-16-0016: User can view badges of other users without - proper permissions.

    • -

  • MSA-16-0017: Course idnumber not protected from teacher - restore.

    • -

  • MSA-16-0018: CSRF in script marking forum posts as read.

    -
    • -
-
- - - - CVE-2016-3729 - CVE-2016-3731 - CVE-2016-3732 - CVE-2016-3733 - CVE-2016-3734 - https://moodle.org/security/ - - - 2016-05-18 - 2016-07-03 - - - - - icingaweb2 -- remote code execution - - - icingaweb2 - 2.3.4 - - - - -

Eric Lippmann reports:

-
-

Possibility of remote code execution via the remote command - transport.

-
- - - - https://www.icinga.org/2016/06/23/icinga-web-2-v2-3-4-v2-2-2-and-v2-1-4-releases/ - - - 2016-06-23 - 2016-07-03 - - - - - hive -- authorization logic vulnerability - - - hive - 2.0.0 - - - - -

Sushanth Sowmyan reports:

-
-

Some partition-level operations exist that do not explicitly also - authorize privileges of the parent table. This can lead to issues when - the parent table would have denied the operation, but no denial occurs - because the partition-level privilege is not checked by the - authorization framework, which defines authorization entities only - from the table level upwards.

-
- - - - CVE-2015-7521 - http://mail-archives.apache.org/mod_mbox/hive-user/201601.mbox/%3C20160128205008.2154F185EB%40minotaur.apache.org%3E - - - 2016-01-28 - 2016-07-03 - - - - - SQLite3 -- Tempdir Selection Vulnerability - - - sqlite3 - 3.13.0 - - - - -

KoreLogic security reports:

-
-

Affected versions of SQLite reject potential tempdir locations if - they are not readable, falling back to '.'. Thus, SQLite will favor - e.g. using cwd for tempfiles on such a system, even if cwd is an - unsafe location. Notably, SQLite also checks the permissions of - '.', but ignores the results of that check.

-
- - - - CVE-2016-6153 - ports/209827 - https://www.korelogic.com/Resources/Advisories/KL-001-2016-003.txt - http://openwall.com/lists/oss-security/2016/07/01/2 - http://www.sqlite.org/cgi/src/info/67985761aa93fb61 - http://www.sqlite.org/cgi/src/info/b38fe522cfc971b3 - http://www.sqlite.org/cgi/src/info/614bb709d34e1148 - - - 2016-07-01 - 2016-07-03 - - - - - Python -- smtplib StartTLS stripping vulnerability - - - python27 - 2.7.12 - - - python33 - 0 - - - python34 - 3.4.5 - - - python35 - 3.5.2 - - - - -

Red Hat reports:

-
-

A vulnerability in smtplib allowing MITM attacker to perform a - startTLS stripping attack. smtplib does not seem to raise an exception - when the remote end (smtp server) is capable of negotiating starttls but - fails to respond with 220 (ok) to an explicit call of SMTP.starttls(). - This may allow a malicious MITM to perform a startTLS stripping attack - if the client code does not explicitly check the response code for startTLS.

-
- - - - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-0772 - CVE-2016-0772 - - - 2016-06-14 - 2016-07-03 - - - - - phpMyAdmin -- multiple vulnerabilities - - - phpmyadmin - 4.6.04.6.3 - - - - -

Please reference CVE/URL list for details

- - - - https://www.phpmyadmin.net/security/PMASA-2016-17/ - https://www.phpmyadmin.net/security/PMASA-2016-18/ - https://www.phpmyadmin.net/security/PMASA-2016-19/ - https://www.phpmyadmin.net/security/PMASA-2016-20/ - https://www.phpmyadmin.net/security/PMASA-2016-21/ - https://www.phpmyadmin.net/security/PMASA-2016-22/ - https://www.phpmyadmin.net/security/PMASA-2016-23/ - https://www.phpmyadmin.net/security/PMASA-2016-24/ - https://www.phpmyadmin.net/security/PMASA-2016-25/ - https://www.phpmyadmin.net/security/PMASA-2016-26/ - https://www.phpmyadmin.net/security/PMASA-2016-27/ - https://www.phpmyadmin.net/security/PMASA-2016-28/ - CVE-2016-5701 - CVE-2016-5702 - CVE-2016-5703 - CVE-2016-5704 - CVE-2016-5705 - CVE-2016-5706 - CVE-2016-5730 - CVE-2016-5731 - CVE-2016-5732 - CVE-2016-5733 - CVE-2016-5734 - CVE-2016-5739 - - - 2016-06-23 - 2016-07-01 - - - - - haproxy -- denial of service - - - haproxy - 1.6.01.6.5_1 - - - - -

HAproxy reports:

-
-

HAproxy 1.6.x before 1.6.6, when a deny comes from a - reqdeny rule, allows remote attackers to cause a denial of service - (uninitialized memory access and crash) or possibly have unspecified - other impact via unknown vectors.

-
- - - - http://www.openwall.com/lists/oss-security/2016/06/09/5 - CVE-2016-5360 - - - 2016-06-09 - 2016-06-30 - - - - - libtorrent-rasterbar -- denial of service - - - libtorrent-rasterbar - 1.1.1 - - - - -

Brandon Perry reports:

-
-

The parse_chunk_header function in libtorrent before 1.1.1 - allows remote attackers to cause a denial of service (crash) via a - crafted (1) HTTP response or possibly a (2) UPnP broadcast.

-
- - - - https://github.com/arvidn/libtorrent/issues/780 - CVE-2016-5301 - - - 2016-06-03 - 2016-06-30 - - - - - expat2 -- denial of service - - - expat - 2.1.1_2 - - - - -

Adam Maris reports:

-
-

It was found that original patch for issues CVE-2015-1283 - and CVE-2015-2716 used overflow checks that could be optimized out by - some compilers applying certain optimization settings, which can cause - the vulnerability to remain even after applying the patch.

-
- - - - https://bugzilla.redhat.com/show_bug.cgi?id=1344251 - CVE-2016-4472 - - - 2016-06-09 - 2016-06-30 - 2016-11-30 - - - - - dnsmasq -- denial of service - - - dnsmasq - 2.76,1 - - - dnsmasq-devel - 2.76.0test1 - - - - -

reports:

-
-

Dnsmasq before 2.76 allows remote servers to cause a denial - of service (crash) via a reply with an empty DNS address that has an (1) - A or (2) AAAA record defined locally.

-
- - - - http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2016q2/010479.html - http://www.openwall.com/lists/oss-security/2016/06/03/7 - CVE-2015-8899 - - - 2016-04-18 - 2016-06-30 - 2016-06-30 - - - - - Python -- HTTP Header Injection in Python urllib - - - python27 - 2.7.10 - - - python33 - 0 - - - python34 - 3.4.4 - - - python35 - 3.5.0 - - - - -

Guido Vranken reports:

-
-

HTTP header injection in urrlib2/urllib/httplib/http.client with - newlines in header values, where newlines have a semantic consequence of - denoting the start of an additional header line.

-
- - - - https://bugs.python.org/issue22928 - http://blog.blindspotsecurity.com/2016/06/advisory-http-header-injection-in.html - http://www.openwall.com/lists/oss-security/2016/06/14/7 - CVE-2016-5699 - - - 2014-11-24 - 2016-06-30 - 2016-07-04 - - - - - openssl -- denial of service - - - openssl - 1.0.2_14 - - - - -

Mitre reports:

-
-

OpenSSL through 1.0.2h incorrectly uses pointer arithmetic - for heap-buffer boundary checks, which might allow remote attackers to - cause a denial of service (integer overflow and application crash) or - possibly have unspecified other impact by leveraging unexpected malloc - behavior, related to s3_srvr.c, ssl_sess.c, and t1_lib.c.

-
- - - - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2177 - ihttps://bugzilla.redhat.com/show_bug.cgi?id=1341705 - https://www.openssl.org/blog/blog/2016/06/27/undefined-pointer-arithmetic/ - CVE-2016-2177 - - - 2016-06-01 - 2016-06-30 - - - - - Apache Commons FileUpload -- denial of service (DoS) vulnerability - - - tomcat7 - 7.0.70 - - - tomcat8 - 8.0.36 - - - apache-struts - 2.5.2 - - - - -

Mark Thomas reports:

-
-

CVE-2016-3092 is a denial of service vulnerability that has been - corrected in the Apache Commons FileUpload component. It occurred - when the length of the multipart boundary was just below the size of - the buffer (4096 bytes) used to read the uploaded file. This caused - the file upload process to take several orders of magnitude longer - than if the boundary length was the typical tens of bytes.

-
- - - - CVE-2016-3092 - ports/209669 - http://tomcat.apache.org/security-7.html - http://tomcat.apache.org/security-8.html - http://mail-archives.apache.org/mod_mbox/tomcat-announce/201606.mbox/%3C6223ece6-2b41-ef4f-22f9-d3481e492832%40apache.org%3E - http://jvn.jp/en/jp/JVN89379547/index.html - - - 2016-06-20 - 2016-06-26 - 2017-08-10 - - - - - wordpress -- multiple vulnerabilities - - - wordpress - 4.5.3,1 - - - de-wordpress - ja-wordpress - ru-wordpress - zh-wordpress-zh_CN - zh-wordpress-zh_TW - 4.5.3 - - - - -

Adam Silverstein reports:

-
-

WordPress 4.5.3 is now available. This is a security release for - all previous versions and we strongly encourage you to update your - sites immediately.

-

WordPress versions 4.5.2 and earlier are affected by several - security issues: redirect bypass in the customizer, reported by - Yassine Aboukir; two different XSS problems via attachment names, - reported by Jouko Pynnönenand Divyesh Prajapati; revision history - information disclosure, reported independently by John Blackbourn - from the WordPress security team and by Dan Moen from the Wordfence - Research Team; oEmbed denial of service reported by Jennifer Dodd - from Automattic; unauthorized category removal from a post, reported - by David Herrera from Alley Interactive; password change via stolen - cookie, reported by Michael Adams from the WordPress security team; - and some less secure sanitize_file_name edge cases reported by Peter - Westwood of the WordPress security team.

-
- - - - CVE-2016-5832 - CVE-2016-5833 - CVE-2016-5834 - CVE-2016-5835 - CVE-2016-5836 - CVE-2016-5837 - CVE-2016-5838 - CVE-2016-5839 - ports/210480 - ports/210581 - https://wordpress.org/news/2016/06/wordpress-4-5-3/ - http://www.openwall.com/lists/oss-security/2016/06/23/9 - - - 2016-06-18 - 2016-06-25 - - - - - php -- multiple vulnerabilities - - - php55 - php55-gd - php55-mbstring - php55-wddx - php55-zip - 5.5.37 - - - php56 - php56-gd - php56-mbstring - php56-phar - php56-wddx - php56-zip - 5.6.23 - - - php70 - php70-gd - php70-mbstring - php70-phar - php70-wddx - php70-zip - 7.0.8 - - - - -

The PHP Group reports:

-
-

Please reference CVE/URL list for details

-
- - - - CVE-2015-8874 - CVE-2016-5766 - CVE-2016-5767 - CVE-2016-5768 - CVE-2016-5769 - CVE-2016-5770 - CVE-2016-5771 - CVE-2016-5772 - CVE-2016-5773 - ports/210491 - ports/210502 - http://php.net/ChangeLog-5.php#5.5.37 - http://php.net/ChangeLog-5.php#5.6.23 - http://php.net/ChangeLog-7.php#7.0.8 - - - 2016-06-23 - 2016-06-25 - - - - - libarchive -- multiple vulnerabilities - - - libarchive - 3.2.1,1 - - - - -

Hanno Bock and Cisco Talos report:

-
-
    -

  • Out of bounds heap read in RAR parser

    • -

  • Signed integer overflow in ISO parser

    • -

  • TALOS-2016-0152 [CVE-2016-4300]: 7-Zip - read_SubStreamsInfo Integer Overflow

    • -

  • TALOS-2016-0153 [CVE-2016-4301]: mtree parse_device Stack - Based Buffer Overflow

    • -

  • TALOS-2016-0154 [CVE-2016-4302]: Libarchive Rar RestartModel - Heap Overflow

    • -
-
- - - - http://openwall.com/lists/oss-security/2016/06/23/6 - https://github.com/libarchive/libarchive/issues/521 - https://github.com/libarchive/libarchive/issues/717#event-697151157 - http://blog.talosintel.com/2016/06/the-poisoned-archives.html - CVE-2015-8934 - CVE-2016-4300 - CVE-2016-4301 - CVE-2016-4302 - - - 2016-06-23 - 2016-06-23 - - - - - piwik -- XSS vulnerability - - - piwik - 2.16.1 - - - - -

Piwik reports:

-
-

The Piwik Security team is grateful for the responsible - disclosures by our security researchers: Egidio Romano (granted a - critical security bounty), James Kettle and Paweł Bartunek (XSS) and - Emanuel Bronshtein (limited XSS).

-
- - - - http://piwik.org/changelog/piwik-2-16-1/ - - - 2016-04-11 - 2016-06-23 - - - - - wget -- HTTP to FTP redirection file name confusion vulnerability - - - wget - 1.18 - - - - -

Giuseppe Scrivano reports:

-
-

On a server redirect from HTTP to a FTP resource, wget would trust the - HTTP server and uses the name in the redirected URL as the destination - filename.

-
- - - - http://lists.gnu.org/archive/html/info-gnu/2016-06/msg00004.html - CVE-2016-4971 - - - 2016-06-09 - 2016-06-21 - - - - - libxslt -- Denial of Service - - - libxslt - 1.1.29 - - - - -

Google reports:

-
-
    -
  • [583156] Medium CVE-2016-1683: Out-of-bounds access in libxslt. - Credit to Nicolas Gregoire.
    • -
  • [583171] Medium CVE-2016-1684: Integer overflow in libxslt. - Credit to Nicolas Gregoire.
    • -
-
- - - - http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html - CVE-2016-1683 - CVE-2016-1684 - - - 2016-05-25 - 2016-06-20 - - - - - flash -- multiple vulnerabilities - - - linux-c6-flashplugin - linux-c6_64-flashplugin - linux-f10-flashplugin - 11.2r202.626 - - - - -

Adobe reports:

-
-

These updates resolve type confusion vulnerabilities that could - lead to code execution (CVE-2016-4144, CVE-2016-4149).

-

These updates resolve use-after-free vulnerabilities that could - lead to code execution (CVE-2016-4142, CVE-2016-4143, CVE-2016-4145, - CVE-2016-4146, CVE-2016-4147, CVE-2016-4148).

-

These updates resolve heap buffer overflow vulnerabilities that - could lead to code execution (CVE-2016-4135, CVE-2016-4136, - CVE-2016-4138).

-

These updates resolve memory corruption vulnerabilities that could - lead to code execution (CVE-2016-4122, CVE-2016-4123, CVE-2016-4124, - CVE-2016-4125, CVE-2016-4127, CVE-2016-4128, CVE-2016-4129, - CVE-2016-4130, CVE-2016-4131, CVE-2016-4132, CVE-2016-4133, - CVE-2016-4134, CVE-2016-4137, CVE-2016-4141, CVE-2016-4150, - CVE-2016-4151, CVE-2016-4152, CVE-2016-4153, CVE-2016-4154, - CVE-2016-4155, CVE-2016-4156, CVE-2016-4166, CVE-2016-4171).

-

These updates resolve a vulnerability in the directory search path - used to find resources that could lead to code execution - (CVE-2016-4140).

-

These updates resolve a vulnerability that could be exploited to - bypass the same-origin-policy and lead to information disclosure - (CVE-2016-4139).

-
- - - - CVE-2016-4122 - CVE-2016-4123 - CVE-2016-4124 - CVE-2016-4125 - CVE-2016-4127 - CVE-2016-4128 - CVE-2016-4129 - CVE-2016-4130 - CVE-2016-4131 - CVE-2016-4132 - CVE-2016-4133 - CVE-2016-4134 - CVE-2016-4135 - CVE-2016-4136 - CVE-2016-4137 - CVE-2016-4138 - CVE-2016-4139 - CVE-2016-4140 - CVE-2016-4141 - CVE-2016-4142 - CVE-2016-4143 - CVE-2016-4144 - CVE-2016-4145 - CVE-2016-4146 - CVE-2016-4147 - CVE-2016-4148 - CVE-2016-4149 - CVE-2016-4150 - CVE-2016-4151 - CVE-2016-4152 - CVE-2016-4153 - CVE-2016-4154 - CVE-2016-4155 - CVE-2016-4156 - CVE-2016-4166 - CVE-2016-4171 - https://helpx.adobe.com/security/products/flash-player/apsb16-18.html - - - 2016-06-16 - 2016-06-19 - - - - - flash -- multiple vulnerabilities - - - linux-c6-flashplugin - linux-c6_64-flashplugin - linux-f10-flashplugin - 11.2r202.621 - - - - -

Adobe reports:

-
-

These updates resolve type confusion vulnerabilities that could - lead to code execution (CVE-2016-1105, CVE-2016-4117).

-

These updates resolve use-after-free vulnerabilities that could - lead to code execution (CVE-2016-1097, CVE-2016-1106, CVE-2016-1107, - CVE-2016-1108, CVE-2016-1109, CVE-2016-1110, CVE-2016-4108, - CVE-2016-4110, CVE-2016-4121).

-

These updates resolve a heap buffer overflow vulnerability that - could lead to code execution (CVE-2016-1101).

-

These updates resolve a buffer overflow vulnerability that could - lead to code execution (CVE-2016-1103).

-

These updates resolve memory corruption vulnerabilities that could - lead to code execution (CVE-2016-1096, CVE-2016-1098, CVE-2016-1099, - CVE-2016-1100, CVE-2016-1102, CVE-2016-1104, CVE-2016-4109, - CVE-2016-4111, CVE-2016-4112, CVE-2016-4113, CVE-2016-4114, - CVE-2016-4115, CVE-2016-4120, CVE-2016-4160, CVE-2016-4161, - CVE-2016-4162, CVE-2016-4163).

-

These updates resolve a vulnerability in the directory search path - used to find resources that could lead to code execution - (CVE-2016-4116).

-
- - - - CVE-2016-1096 - CVE-2016-1097 - CVE-2016-1098 - CVE-2016-1099 - CVE-2016-1100 - CVE-2016-1101 - CVE-2016-1102 - CVE-2016-1103 - CVE-2016-1104 - CVE-2016-1105 - CVE-2016-1106 - CVE-2016-1107 - CVE-2016-1108 - CVE-2016-1109 - CVE-2016-1110 - CVE-2016-4108 - CVE-2016-4109 - CVE-2016-4110 - CVE-2016-4111 - CVE-2016-4112 - CVE-2016-4113 - CVE-2016-4114 - CVE-2016-4115 - CVE-2016-4116 - CVE-2016-4117 - CVE-2016-4120 - CVE-2016-4121 - CVE-2016-4160 - CVE-2016-4161 - CVE-2016-4162 - CVE-2016-4163 - https://helpx.adobe.com/security/products/flash-player/apsb16-15.html - - - 2016-05-12 - 2016-06-19 - - - - - flash -- multiple vulnerabilities - - - linux-c6-flashplugin - linux-c6_64-flashplugin - linux-f10-flashplugin - 11.2r202.616 - - - - -

Adobe reports:

-
-

These updates harden a mitigation against JIT spraying attacks that - could be used to bypass memory layout randomization mitigations - (CVE-2016-1006).

-

These updates resolve type confusion vulnerabilities that could - lead to code execution (CVE-2016-1015, CVE-2016-1019).

-

These updates resolve use-after-free vulnerabilities that could - lead to code execution (CVE-2016-1011, CVE-2016-1013, CVE-2016-1016, - CVE-2016-1017, CVE-2016-1031).

-

These updates resolve memory corruption vulnerabilities that could - lead to code execution (CVE-2016-1012, CVE-2016-1020, CVE-2016-1021, - CVE-2016-1022, CVE-2016-1023, CVE-2016-1024, CVE-2016-1025, - CVE-2016-1026, CVE-2016-1027, CVE-2016-1028, CVE-2016-1029, - CVE-2016-1032, CVE-2016-1033).

-

These updates resolve a stack overflow vulnerability that could - lead to code execution (CVE-2016-1018).

-

These updates resolve a security bypass vulnerability - (CVE-2016-1030).

-

These updates resolve a vulnerability in the directory search path - used to find resources that could lead to code execution - (CVE-2016-1014).

-
- - - - CVE-2016-1006 - CVE-2016-1011 - CVE-2016-1012 - CVE-2016-1013 - CVE-2016-1014 - CVE-2016-1015 - CVE-2016-1016 - CVE-2016-1017 - CVE-2016-1018 - CVE-2016-1019 - CVE-2016-1020 - CVE-2016-1021 - CVE-2016-1022 - CVE-2016-1023 - CVE-2016-1024 - CVE-2016-1025 - CVE-2016-1026 - CVE-2016-1027 - CVE-2016-1028 - CVE-2016-1029 - CVE-2016-1030 - CVE-2016-1031 - CVE-2016-1032 - CVE-2016-1033 - https://helpx.adobe.com/security/products/flash-player/apsb16-10.html - - - 2016-04-07 - 2016-06-19 - - - - - chromium -- multiple vulnerabilities - - - chromium - chromium-npapi - chromium-pulse - 51.0.2704.103 - - - - -

Google Chrome Releases reports:

-
-

3 security fixes in this release, including:

-
    -
  • [620742] CVE-2016-1704: Various fixes from internal audits, - fuzzing and other initiatives.
    • -
-
- - - - CVE-2016-1704 - https://googlechromereleases.blogspot.nl/2016/06/stable-channel-update_16.html - - - 2016-06-16 - 2016-06-17 - - - - - Python -- Integer overflow in zipimport module - - - python35 - 3.5.1_3 - - - python34 - 3.4.4_3 - - - python33 - 3.3.6_5 - - - python27 - 2.7.11_3 - - - - -

Python reports:

-
-

Possible integer overflow and heap corruption in - zipimporter.get_data()

-
- - - - http://bugs.python.org/issue26171 - CVE-2016-5636 - - - 2016-01-21 - 2016-06-17 - - - - - drupal -- multiple vulnerabilities - - - drupal7 - 7.44 - - - drupal8 - 8.1.3 - - - - -

Drupal Security Team reports:

-
-
    -

  • Saving user accounts can sometimes grant the user all roles - (User module - Drupal 7 - Moderately Critical)

    • -

  • Views can allow unauthorized users to see Statistics - information (Views module - Drupal 8 - Less Critical)

    • -
-
- - - - CVE-2016-6211 - CVE-2016-6212 - https://www.drupal.org/SA-CORE-2016-002 - http://www.openwall.com/lists/oss-security/2016/07/13/7 - - - 2016-06-15 - 2016-06-17 - 2016-07-16 - - - - - botan -- multiple vulnerabilities - - - botan110 - 1.10.13 - - - - -

Jack Lloyd reports:

-
-

Botan 1.10.13 has been released backporting some side channel - protections for ECDSA signatures (CVE-2016-2849) and PKCS #1 RSA - decryption (CVE-2015-7827).

-
- - - - CVE-2016-2849 - CVE-2015-7827 - https://lists.randombit.net/pipermail/botan-devel/2016-April/002101.html - - - 2016-04-28 - 2016-06-14 - - - - - botan -- cryptographic vulnerability - - - botan110 - 1.10.8 - - - - -

MITRE reports:

-
-

The Miller-Rabin primality check in Botan before 1.10.8 and 1.11.x - before 1.11.9 improperly uses a single random base, which makes it - easier for remote attackers to defeat cryptographic protection - mechanisms via a DH group.

-
- - - - CVE-2014-9742 - - - 2014-04-11 - 2016-06-14 - - - - - VLC -- Possibly remote code execution via crafted file - - - vlc - 2.2.4,4 - - - vlc-qt4 - 2.2.4,4 - - - - -

The VLC project reports:

-
-

Fix out-of-bound write in adpcm QT IMA codec (CVE-2016-5108)

-
- - - - CVE-2016-5108 - - - 2016-05-25 - 2016-06-11 - - - - - roundcube -- XSS vulnerability - - - roundcube - 1.1.5_1,1 - - - - -

Roundcube reports:

-
-

Fix XSS issue in href attribute on area tag (#5240).

-
- - - - CVE-2016-5103 - ports/209841 - https://github.com/roundcube/roundcubemail/issues/5240 - http://seclists.org/oss-sec/2016/q2/414 - - - 2016-05-06 - 2016-06-10 - - - - - OpenSSL -- vulnerability in DSA signing - - - openssl - 1.0.2_13 - - - libressl - 2.2.9 - 2.3.02.3.6 - - - libressl-devel - 2.4.1 - - - - -

The OpenSSL team reports:

-
-

Operations in the DSA signing algorithm should run in constant time - in order to avoid side channel attacks. A flaw in the OpenSSL DSA - implementation means that a non-constant time codepath is followed for - certain operations. This has been demonstrated through a cache-timing - attack to be sufficient for an attacker to recover the private DSA key. -

-
- - - - https://git.openssl.org/?p=openssl.git;a=commit;h=399944622df7bd81af62e67ea967c470534090e2 - CVE-2016-2178 - - - 2016-06-09 - 2016-06-09 - 2016-12-20 - - - - - expat -- multiple vulnerabilities - - - expat - 2.1.1_1 - - - - -

Sebastian Pipping reports:

-
-

CVE-2012-6702 -- Resolve troublesome internal call to srand that - was introduced with Expat 2.1.0 when addressing CVE-2012-0876 - (issue #496)

-

CVE-2016-5300 -- Use more entropy for hash initialization than the - original fix to CVE-2012-0876.

-
- - - - CVE-2012-6702 - CVE-2016-5300 - ports/210155 - https://sourceforge.net/p/expat/code_git/ci/07cc2fcacf81b32b2e06aa918df51756525240c0/ - http://www.openwall.com/lists/oss-security/2016/03/18/3 - - - 2016-03-18 - 2016-06-09 - 2016-11-06 - - - - - iperf3 -- buffer overflow - - - iperf3 - 3.13.1.3 - 3.03.0.12 - - - - -

ESnet reports:

-
-

A malicious process can connect to an iperf3 server and, - by sending a malformed message on the control channel, - corrupt the server process's heap area. This can lead to a - crash (and a denial of service), or theoretically a remote - code execution as the user running the iperf3 server. A - malicious iperf3 server could potentially mount a similar - attack on an iperf3 client. -

-
- - - - CVE-2016-4303 - https://raw.githubusercontent.com/esnet/security/master/cve-2016-4303/esnet-secadv-2016-0001.txt.asc - - - 2016-06-08 - 2016-06-08 - - - - - gnutls -- file overwrite by setuid programs - - - gnutls - 3.4.123.4.13 - - - - -

gnutls.org reports:

-
-

Setuid programs using GnuTLS 3.4.12 could potentially allow an - attacker to overwrite and corrupt arbitrary files in the - filesystem.

-
- - - - https://gnutls.org/security.html#GNUTLS-SA-2016-1 - - - 2016-06-06 - 2016-06-07 - - - - - NSS -- multiple vulnerabilities - - - nss - 3.23 - - - linux-c6-nss - linux-c7-nss - 3.21.3 - - - linux-seamonkey - 2.44 - - - - -

Mozilla Foundation reports:

-
-

Mozilla has updated the version of Network Security - Services (NSS) library used in Firefox to NSS 3.23. This - addresses four moderate rated networking security issues - reported by Mozilla engineers Tyson Smith and Jed Davis.

-
- - - - CVE-2016-2834 - https://www.mozilla.org/security/advisories/mfsa2016-61/ - https://hg.mozilla.org/projects/nss/rev/1ba7cd83c672 - https://hg.mozilla.org/projects/nss/rev/8d78a5ae260a - https://hg.mozilla.org/projects/nss/rev/5fde729fdbff - https://hg.mozilla.org/projects/nss/rev/329932eb1700 - - - 2016-06-07 - 2016-06-07 - 2016-11-23 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 47.0,1 - - - seamonkey - linux-seamonkey - 2.44 - - - firefox-esr - 45.2.0,1 - - - linux-firefox - 45.2.0,2 - - - libxul - thunderbird - linux-thunderbird - 45.2.0 - - - - -

Mozilla Foundation reports:

-
-

MFSA 2016-49 Miscellaneous memory safety hazards (rv:47.0 / - rv:45.2)

-

MFSA 2016-50 Buffer overflow parsing HTML5 fragments

-

MFSA 2016-51 Use-after-free deleting tables from a - contenteditable document

-

MFSA 2016-52 Addressbar spoofing though the SELECT element

-

MFSA 2016-54 Partial same-origin-policy through setting - location.host through data URI

-

MFSA 2016-56 Use-after-free when textures are used in WebGL - operations after recycle pool destruction

-

MFSA 2016-57 Incorrect icon displayed on permissions - notifications

-

MFSA 2016-58 Entering fullscreen and persistent pointerlock - without user permission

-

MFSA 2016-59 Information disclosure of disabled plugins - through CSS pseudo-classes

-

MFSA 2016-60 Java applets bypass CSP protections

-
- - - - CVE-2016-2815 - CVE-2016-2818 - CVE-2016-2819 - CVE-2016-2821 - CVE-2016-2822 - CVE-2016-2825 - CVE-2016-2828 - CVE-2016-2829 - CVE-2016-2831 - CVE-2016-2832 - CVE-2016-2833 - https://www.mozilla.org/security/advisories/mfsa2016-49/ - https://www.mozilla.org/security/advisories/mfsa2016-50/ - https://www.mozilla.org/security/advisories/mfsa2016-51/ - https://www.mozilla.org/security/advisories/mfsa2016-52/ - https://www.mozilla.org/security/advisories/mfsa2016-54/ - https://www.mozilla.org/security/advisories/mfsa2016-56/ - https://www.mozilla.org/security/advisories/mfsa2016-57/ - https://www.mozilla.org/security/advisories/mfsa2016-58/ - https://www.mozilla.org/security/advisories/mfsa2016-59/ - https://www.mozilla.org/security/advisories/mfsa2016-60/ - - - 2016-06-07 - 2016-06-07 - - - - - chromium -- multiple vulnerabilities - - - chromium - chromium-npapi - chromium-pulse - 51.0.2704.79 - - - - -

Google Chrome Releases reports:

-
-

15 security fixes in this release, including:

-
    -
  • 601073] High CVE-2016-1696: Cross-origin bypass in Extension - bindings. Credit to anonymous.
    • -
  • [613266] High CVE-2016-1697: Cross-origin bypass in Blink. - Credit to Mariusz Mlynski.
    • -
  • [603725] Medium CVE-2016-1698: Information leak in Extension - bindings. Credit to Rob Wu.
    • -
  • [607939] Medium CVE-2016-1699: Parameter sanitization failure - in DevTools. Credit to Gregory Panakkal.
    • -
  • [608104] Medium CVE-2016-1700: Use-after-free in Extensions. - Credit to Rob Wu.
    • -
  • [608101] Medium CVE-2016-1701: Use-after-free in Autofill. - Credit to Rob Wu.
    • -
  • [609260] Medium CVE-2016-1702: Out-of-bounds read in Skia. - Credit to cloudfuzzer.
    • -
  • [616539] CVE-2016-1703: Various fixes from internal audits, - fuzzing and other initiatives.
    • -
-
- - - - CVE-2016-1695 - CVE-2016-1696 - CVE-2016-1697 - CVE-2016-1698 - CVE-2016-1699 - CVE-2016-1700 - CVE-2016-1701 - CVE-2016-1702 - CVE-2016-1703 - http://googlechromereleases.blogspot.nl/2016/06/stable-channel-update.html - - - 2016-06-01 - 2016-06-06 - - - - - openafs -- multiple vulnerabilities - - - openafs - 1.6.17 - - - - -

The OpenAFS development team reports:

-
-

Foreign users can bypass access controls to create groups as - system:administrators, including in the user namespace and the - system: namespace.

-
-
-

The contents of uninitialized memory are sent on the wire when - clients perform certain RPCs. Depending on the RPC, the information - leaked may come from kernel memory or userspace.

-
- - - - CVE-2016-2860 - CVE-2016-4536 - ports/209534 - http://www.openafs.org/pages/security/OPENAFS-SA-2016-001.txt - http://www.openafs.org/pages/security/OPENAFS-SA-2016-002.txt - - - 2016-03-16 - 2016-06-05 - - - - - openafs -- local DoS vulnerability - - - openafs - 1.6.16 - - - - -

The OpenAFS development team reports:

-
-

Avoid a potential denial of service issue, by fixing a bug in - pioctl logic that allowed a local user to overrun a kernel buffer - with a single NUL byte.

-
- - - - CVE-2015-8312 - https://www.openafs.org/dl/1.6.16/RELNOTES-1.6.16 - - - 2016-03-16 - 2016-06-05 - - - - - ikiwiki -- XSS vulnerability - - - ikiwiki - 3.20160509 - - - - -

Mitre reports:

-
-

Cross-site scripting (XSS) vulnerability in the cgierror function - in CGI.pm in ikiwiki before 3.20160506 might allow remote attackers - to inject arbitrary web script or HTML via unspecified vectors - involving an error message.

-
- - - - CVE-2016-4561 - ports/209593 - - - 2016-05-04 - 2016-06-05 - - - - - h2o -- use after free on premature connection close - - - h2o - 1.7.3 - - - - -

Tim Newsha reports:

-
-

When H2O tries to disconnect a premature HTTP/2 connection, it - calls free(3) to release memory allocated for the connection and - immediately after then touches the memory. No malloc-related - operation is performed by the same thread between the time it calls - free and the time the memory is touched. Fixed by Frederik - Deweerdt.

-
- - - - https://h2o.examp1e.net/vulnerabilities.html - - - 2016-05-17 - 2016-06-01 - - - - - nginx -- a specially crafted request might result in worker process crash - - - nginx - 1.4.01.8.1_3,2 - 1.10.0,21.10.1,2 - - - nginx-devel - 1.3.91.9.15_1 - 1.10.01.11.1 - - - - -

Maxim Dounin reports:

-
-

A problem was identified in nginx code responsible for saving - client request body to a temporary file. A specially crafted - request might result in worker process crash due to a NULL - pointer dereference while writing client request body to a - temporary file.

-
- - - - http://mailman.nginx.org/pipermail/nginx-announce/2016/000179.html - CVE-2016-4450 - - - 2016-05-31 - 2016-05-31 - 2016-06-05 - - - - - cacti -- multiple vulnerabilities - - - cacti - 0.8.8h - - - - -

The Cacti Group, Inc. reports:

-
-

Changelog

-
    -
  • bug:0002667: Cacti SQL Injection Vulnerability
    • -
  • bug:0002673: CVE-2016-3659 - Cacti graph_view.php SQL Injection - Vulnerability
    • -
  • bug:0002656: Authentication using web authentication as a user - not in the cacti database allows complete access (regression)
    • -
-
- - - - CVE-2016-3659 - http://www.cacti.net/release_notes_0_8_8h.php - http://bugs.cacti.net/view.php?id=2673 - http://seclists.org/fulldisclosure/2016/Apr/4 - http://packetstormsecurity.com/files/136547/Cacti-0.8.8g-SQL-Injection.html - - - 2016-04-04 - 2016-05-28 - - - - - openvswitch -- MPLS buffer overflow - - - openvswitch - 2.2.02.3.3 - 2.4.02.4.1 - - - - -

Open vSwitch reports:

-
-

Multiple versions of Open vSwitch are vulnerable to remote buffer - overflow attacks, in which crafted MPLS packets could overflow the - buffer reserved for MPLS labels in an OVS internal data structure. - The MPLS packets that trigger the vulnerability and the potential for - exploitation vary depending on version:

-

Open vSwitch 2.1.x and earlier are not vulnerable.

-

In Open vSwitch 2.2.x and 2.3.x, the MPLS buffer overflow can be - exploited for arbitrary remote code execution.

-

In Open vSwitch 2.4.x, the MPLS buffer overflow does not obviously lead - to a remote code execution exploit, but testing shows that it can allow a - remote denial of service. See the mitigation section for details.

-

Open vSwitch 2.5.x is not vulnerable.

-
- - - - CVE-2016-2074 - http://openvswitch.org/pipermail/announce/2016-March/000082.html - http://openvswitch.org/pipermail/announce/2016-March/000083.html - - - 2016-03-28 - 2016-05-29 - 2016-07-03 - - - - - chromium -- multiple vulnerabilities - - - chromium - chromium-npapi - chromium-pulse - 51.0.2704.63 - - - - -

Google Chrome Releases reports:

-
-

42 security fixes in this release

-

Please reference CVE/URL list for details

-
- - - - CVE-2016-1672 - CVE-2016-1673 - CVE-2016-1674 - CVE-2016-1675 - CVE-2016-1672 - CVE-2016-1677 - CVE-2016-1678 - CVE-2016-1679 - CVE-2016-1680 - CVE-2016-1681 - CVE-2016-1682 - CVE-2016-1685 - CVE-2016-1686 - CVE-2016-1687 - CVE-2016-1688 - CVE-2016-1689 - CVE-2016-1690 - CVE-2016-1691 - CVE-2016-1692 - CVE-2016-1693 - CVE-2016-1694 - CVE-2016-1695 - http://googlechromereleases.blogspot.nl/2016/05/stable-channel-update_25.html - - - 2016-05-25 - 2016-05-28 - 2016-06-20 - - - - - chromium -- multiple vulnerabilities - - - chromium - chromium-npapi - chromium-pulse - 50.0.2661.102 - - - - -

Google Chrome Releases reports:

-
-

5 security fixes in this release, including:

-
    -
  • [605766] High CVE-2016-1667: Same origin bypass in DOM. Credit - to Mariusz Mlynski.
    • -
  • [605910] High CVE-2016-1668: Same origin bypass in Blink V8 - bindings. Credit to Mariusz Mlynski.
    • -
  • [606115] High CVE-2016-1669: Buffer overflow in V8. Credit to - Choongwoo Han.
    • -
  • [578882] Medium CVE-2016-1670: Race condition in loader. Credit - to anonymous.
    • -
  • [586657] Medium CVE-2016-1671: Directory traversal using the - file scheme on Android. Credit to Jann Horn.
    • -
-
- - - - CVE-2016-1667 - CVE-2016-1668 - CVE-2016-1669 - CVE-2016-1670 - CVE-2016-1671 - http://googlechromereleases.blogspot.nl/2016/05/stable-channel-update.html - - - 2016-05-11 - 2016-05-28 - - - - - chromium -- multiple vulnerabilities - - - chromium - chromium-npapi - chromium-pulse - 50.0.2661.94 - - - - -

Google Chrome Releases reports:

-
-

9 security fixes in this release, including:

-
    -
  • [574802] High CVE-2016-1660: Out-of-bounds write in Blink. - Credit to Atte Kettunen of OUSPG.
    • -
  • [601629] High CVE-2016-1661: Memory corruption in cross-process - frames. Credit to Wadih Matar.
    • -
  • [603732] High CVE-2016-1662: Use-after-free in extensions. - Credit to Rob Wu.
    • -
  • [603987] High CVE-2016-1663: Use-after-free in Blink's V8 - bindings. Credit to anonymous.
    • -
  • [597322] Medium CVE-2016-1664: Address bar spoofing. Credit to - Wadih Matar.
    • -
  • [606181] Medium CVE-2016-1665: Information leak in V8. Credit - to HyungSeok Han.
    • -
  • [607652] CVE-2016-1666: Various fixes from internal audits, - fuzzing and other initiatives.
    • -
-
- - - - CVE-2016-1660 - CVE-2016-1661 - CVE-2016-1662 - CVE-2016-1663 - CVE-2016-1664 - CVE-2016-1665 - CVE-2016-1666 - http://googlechromereleases.blogspot.nl/2016/04/stable-channel-update_28.html - - - 2016-04-28 - 2016-05-28 - - - - - php -- multiple vulnerabilities - - - php70-gd - php70-intl - 7.0.7 - - - php56 - php56-gd - 5.6.22 - - - php55 - php55-gd - php55-phar - 5.5.36 - - - - -

The PHP Group reports:

-
-
  • Core: -
      -
    • Fixed bug #72114 (Integer underflow / arbitrary null write in - fread/gzread). (CVE-2016-5096) (PHP 5.5/5.6 only)
      • -
    • Fixed bug #72135 (Integer Overflow in php_html_entities). - (CVE-2016-5094) (PHP 5.5/5.6 only)
      • -
    • -
  • GD: -
      -
    • Fixed bug #72227 (imagescale out-of-bounds read). - (CVE-2013-7456)
      • -
    • -
  • Intl: -
      -
    • Fixed bug #72241 (get_icu_value_internal out-of-bounds read). - (CVE-2016-5093)
      • -
    • -
  • Phar: -
      -
    • Fixed bug #71331 (Uninitialized pointer in - phar_make_dirstream()). (CVE-2016-4343) (PHP 5.5 only)
      • -
    • -
-
- - - - CVE-2016-5096 - CVE-2016-5094 - CVE-2013-7456 - CVE-2016-5093 - CVE-2016-4343 - ports/209779 - http://php.net/ChangeLog-7.php#7.0.7 - http://php.net/ChangeLog-5.php#5.6.22 - http://php.net/ChangeLog-5.php#5.5.36 - - - 2016-05-26 - 2016-05-28 - - - - - phpmyadmin -- XSS and sensitive data leakage - - - phpmyadmin - 4.6.04.6.2 - - - - -

The phpmyadmin development team reports:

-
-

Description

-

Because user SQL queries are part of the URL, sensitive - information made as part of a user query can be exposed by - clicking on external links to attackers monitoring user GET - query parameters or included in the webserver logs.

-

Severity

-

We consider this to be non-critical.

-
-
-

Description

-

A specially crafted attack could allow for special HTML - characters to be passed as URL encoded values and displayed - back as special characters in the page.

-

Severity

-

We consider this to be non-critical.

-
- - - - https://www.phpmyadmin.net/security/PMASA-2016-14/ - https://www.phpmyadmin.net/security/PMASA-2016-16/ - CVE-2016-5097 - CVE-2016-5099 - - - 2016-05-25 - 2016-05-25 - 2016-05-26 - - - - - mediawiki -- multiple vulnerabilities - - - mediawiki123 - 1.23.14 - - - mediawiki124 - 1.24.6 - - - mediawiki125 - 1.25.6 - - - mediawiki126 - 1.26.3 - - - - -

Mediawiki reports:

-
-

Security fixes:

-

T122056: Old tokens are remaining valid within a new session

-

T127114: Login throttle can be tricked using non-canonicalized - usernames

-

T123653: Cross-domain policy regexp is too narrow

-

T123071: Incorrectly identifying http link in a's href - attributes, due to m modifier in regex

-

T129506: MediaWiki:Gadget-popups.js isn't renderable

-

T125283: Users occasionally logged in as different users after - SessionManager deployment

-

T103239: Patrol allows click catching and patrolling of any - page

-

T122807: [tracking] Check php crypto primatives

-

T98313: Graphs can leak tokens, leading to CSRF

-

T130947: Diff generation should use PoolCounter

-

T133507: Careless use of $wgExternalLinkTarget is insecure

-

T132874: API action=move is not rate limited

-
- - - - https://lists.wikimedia.org/pipermail/mediawiki-announce/2016-May/000188.html - - - 2016-05-20 - 2016-05-24 - - - - - hostapd and wpa_supplicant -- psk configuration parameter update allowing arbitrary data to be written - - - wpa_supplicant - 2.5_2 - - - hostapd - 2.6 - - - - -

Jouni Malinen reports:

-
-

psk configuration parameter update allowing arbitrary data to be - written (2016-1 - CVE-2016-4476/CVE-2016-4477).

-
- - - - CVE-2016-4476 - CVE-2016-4477 - ports/209564 - http://w1.fi/security/2016-1/psk-parameter-config-update.txt - - - 2016-05-02 - 2016-05-20 - 2017-03-22 - - - - - expat -- denial of service vulnerability on malformed input - - - expat - 2.1.1 - - - linux-c6-expat - 2.0.1_3 - - - linux-c7-expat - 2.1.0_1 - - - - -

Gustavo Grieco reports:

-
-

The Expat XML parser mishandles certain kinds of malformed input - documents, resulting in buffer overflows during processing and error - reporting. The overflows can manifest as a segmentation fault or as - memory corruption during a parse operation. The bugs allow for a - denial of service attack in many applications by an unauthenticated - attacker, and could conceivably result in remote code execution.

-
- - - - CVE-2016-0718 - ports/209360 - http://www.openwall.com/lists/oss-security/2016/05/17/12 - - - 2016-05-17 - 2016-05-20 - 2016-11-30 - - - - - Bugzilla security issues - - - bugzilla44 - 4.4.12 - - - bugzilla50 - 5.0.3 - - - - -

Bugzilla Security Advisory

-
-

A specially crafted bug summary could trigger XSS in dependency graphs. - Due to an incorrect parsing of the image map generated by the dot script, - a specially crafted bug summary could trigger XSS in dependency graphs.

-
- - - - CVE-2016-2803 - https://bugzilla.mozilla.org/show_bug.cgi?id=1253263 - - - 2016-03-03 - 2016-05-17 - - - - - OpenVPN -- Buffer overflow in PAM authentication and DoS through port sharing - - - openvpn - 2.3.11 - - - openvpn-polarssl - 2.3.11 - - - - -

Samuli Seppänen reports:

-
-

OpenVPN 2.3.11 [...] fixes two vulnerabilities: a port-share bug - with DoS potential and a buffer overflow by user supplied data when - using pam authentication.[...]

-
- - - - https://sourceforge.net/p/openvpn/mailman/message/35076507/ - https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn23#OpenVPN2.3.11 - - - 2016-03-03 - 2016-05-14 - - - - - imagemagick -- buffer overflow - - - ImageMagick - ImageMagick-nox11 - 6.9.4.1,1 - - - ImageMagick7 - ImageMagick7-nox11 - 7.0.0.0.b201507157.0.1.3 - - - - -

ImageMagick reports:

-
-

Fix a buffer overflow in magick/drag.c/DrawStrokePolygon().

-
- - - - http://legacy.imagemagick.org/script/changelog.php - - - 2016-05-09 - 2016-05-13 - - - - - jenkins -- multiple vulnerabilities - - - jenkins - 2.2 - - - jenkins2 - 2.2 - - - jenkins-lts - 1.651.1 - - - - -

Jenkins Security Advisory:

-
-

Description

-
SECURITY-170 / CVE-2016-3721
-

Arbitrary build parameters are passed to build scripts as environment variables

-
SECURITY-243 / CVE-2016-3722
-

Malicious users with multiple user accounts can prevent other users from logging in

-
SECURITY-250 / CVE-2016-3723
-

Information on installed plugins exposed via API

-
SECURITY-266 / CVE-2016-3724
-

Encrypted secrets (e.g. passwords) were leaked to users with permission to read configuration

-
SECURITY-273 / CVE-2016-3725
-

Regular users can trigger download of update site metadata

-
SECURITY-276 / CVE-2016-3726
-

Open redirect to scheme-relative URLs

-
SECURITY-281 / CVE-2016-3727
-

Granting the permission to read node configurations allows access to overall system configuration

-
- - - - CVE-2016-3721 - CVE-2016-3722 - CVE-2016-3723 - CVE-2016-3724 - CVE-2016-3725 - CVE-2016-3726 - CVE-2016-3727 - https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-05-11 - - - 2016-05-11 - 2016-05-12 - - - - - perl5 -- taint mechanism bypass vulnerability - - - perl5 - 5.18.4_21 - 5.20.05.20.3_12 - 5.22.05.22.1_8 - - - perl5.18 - 5.18.05.18.4_21 - - - perl5.20 - 5.20.05.20.3_12 - - - perl5.22 - 5.22.05.22.1_8 - - - perl - 0 - - - - -

MITRE reports:

-
-

Perl might allow context-dependent attackers to bypass the taint - protection mechanism in a child process via duplicate environment - variables in envp.

-
- - - - CVE-2016-2381 - ports/208879 - - - 2016-04-08 - 2016-05-10 - 2016-08-22 - - - - - wordpress -- multiple vulnerabilities - - - wordpress - 4.5.2,1 - - - de-wordpress - ja-wordpress - ru-wordpress - zh-wordpress-zh_CN - zh-wordpress-zh_TW - 4.5.2 - - - - -

Helen Hou-Sandi reports:

-
-

WordPress 4.5.2 is now available. This is a security release for - all previous versions and we strongly encourage you to update your - sites immediately.

-

WordPress versions 4.5.1 and earlier are affected by a SOME - vulnerability through Plupload, the third-party library WordPress - uses for uploading files. WordPress versions 4.2 through 4.5.1 are - vulnerable to reflected XSS using specially crafted URIs through - MediaElement.js, the third-party library used for media players. - MediaElement.js and Plupload have also released updates fixing - these issues.

-
- - - - CVE-2016-4566 - CVE-2016-4567 - https://wordpress.org/news/2016/05/wordpress-4-5-2/ - http://www.openwall.com/lists/oss-security/2016/05/07/7 - - - 2016-05-06 - 2016-05-10 - - - - - libarchive -- RCE vulnerability - - - libarchive - 3.2.0,1 - - - - -

The libarchive project reports:

-
-

Heap-based buffer overflow in the zip_read_mac_metadata function - in archive_read_support_format_zip.c in libarchive before 3.2.0 - allows remote attackers to execute arbitrary code via crafted - entry-size values in a ZIP archive.

-
- - - - CVE-2016-1541 - https://github.com/libarchive/libarchive/commit/d0331e8e5b05b475f20b1f3101fe1ad772d7e7e7 - - - 2016-05-01 - 2016-05-09 - 2016-05-10 - - - - - squid -- multiple vulnerabilities - - - squid - 3.0.03.5.18 - - - squid-devel - 4.0.04.0.10 - - - - -

The squid development team reports:

-

Please reference CVE/URL list for details

- - - - CVE-2016-4553 - CVE-2016-4554 - CVE-2016-4555 - CVE-2016-4556 - http://www.squid-cache.org/Advisories/SQUID-2016_7.txt - http://www.squid-cache.org/Advisories/SQUID-2016_8.txt - http://www.squid-cache.org/Advisories/SQUID-2016_9.txt - - - 2016-05-06 - 2016-05-07 - 2016-05-09 - - - - - ImageMagick -- multiple vulnerabilities - - - ImageMagick - ImageMagick-nox11 - 6.9.3.9_1,1 - - - ImageMagick7 - ImageMagick7-nox11 - 7.0.0.0.b201507157.0.1.0_1 - - - - -

Openwall reports:

-
-

Insufficient filtering for filename passed to delegate's command - allows remote code execution during conversion of several file - formats. Any service which uses ImageMagick to process user - supplied images and uses default delegates.xml / policy.xml, - may be vulnerable to this issue.

-

It is possible to make ImageMagick perform a HTTP GET or FTP - request

-

It is possible to delete files by using ImageMagick's 'ephemeral' - pseudo protocol which deletes files after reading.

-

It is possible to move image files to file with any extension - in any folder by using ImageMagick's 'msl' pseudo protocol. - msl.txt and image.gif should exist in known location - /tmp/ - for PoC (in real life it may be web service written in PHP, - which allows to upload raw txt files and process images with - ImageMagick).

-

It is possible to get content of the files from the server - by using ImageMagick's 'label' pseudo protocol.

-
- - - - CVE-2016-3714 - CVE-2016-3715 - CVE-2016-3716 - CVE-2016-3717 - CVE-2016-3718 - http://www.openwall.com/lists/oss-security/2016/05/03/18 - https://imagetragick.com/ - - - 2016-05-03 - 2016-05-06 - 2016-05-07 - - - - - jansson -- local denial of service vulnerabilities - - - jansson - 2.7_2 - - - - -

QuickFuzz reports:

-
-

A crash caused by stack exhaustion parsing a JSON was found.

-
- - - - http://www.openwall.com/lists/oss-security/2016/05/01/5 - http://www.openwall.com/lists/oss-security/2016/05/02/1 - CVE-2016-4425 - - - 2016-05-01 - 2016-05-04 - - - - - OpenSSL -- multiple vulnerabilities - - - openssl - 1.0.2_11 - - - linux-c6-openssl - 1.0.1e_8 - - - libressl - 2.3.02.3.4 - 2.2.7 - - - libressl-devel - 2.3.4 - - - FreeBSD - 10.310.3_2 - 10.210.2_16 - 10.110.1_33 - 9.39.3_41 - - - - -

OpenSSL reports:

-
-

Memory corruption in the ASN.1 encoder

-

Padding oracle in AES-NI CBC MAC check

-

EVP_EncodeUpdate overflow

-

EVP_EncryptUpdate overflow

-

ASN.1 BIO excessive memory allocation

-

EBCDIC overread (OpenSSL only)

-
- - - - https://www.openssl.org/news/secadv/20160503.txt - https://marc.info/?l=openbsd-tech&m=146228598730414 - CVE-2016-2105 - CVE-2016-2106 - CVE-2016-2107 - CVE-2016-2108 - CVE-2016-2109 - CVE-2016-2176 - SA-16:17.openssl - - - 2016-05-03 - 2016-05-03 - 2016-08-09 - - - - - - - - - gitlab -- privilege escalation via "impersonate" feature - - - gitlab - 8.2.08.2.5 - 8.3.08.3.9 - 8.4.08.4.10 - 8.5.08.5.12 - 8.6.08.6.8 - 8.7.08.7.1 - - - - -

GitLab reports:

-
-

During an internal code review, we discovered a critical security - flaw in the "impersonate" feature of GitLab. Added in GitLab 8.2, - this feature was intended to allow an administrator to simulate - being logged in as any other user.

-

A part of this feature was not properly secured and it was possible - for any authenticated user, administrator or not, to "log in" as any - other user, including administrators. Please see the issue for more - details.

-
- - - - CVE-2016-4340 - ports/209225 - https://about.gitlab.com/2016/05/02/cve-2016-4340-patches/ - https://gitlab.com/gitlab-org/gitlab-ce/issues/15548 - - - 2016-05-02 - 2016-05-03 - - - - - php -- multiple vulnerabilities - - - php70 - php70-bcmath - php70-exif - php70-gd - php70-xml - 7.0.6 - - - php56 - php56-bcmath - php56-exif - php56-gd - php56-xml - 5.6.21 - - - php55 - php55-bcmath - php55-exif - php55-gd - php55-xml - 5.5.35 - - - - -

The PHP Group reports:

-
-
  • BCMath: -
      -
    • Fixed bug #72093 (bcpowmod accepts negative scale and corrupts - _one_ definition).
      • -
    • -
  • Exif: -
      -
    • Fixed bug #72094 (Out of bounds heap read access in exif header - processing).
      • -
    • -
  • GD: -
      -
    • Fixed bug #71912 (libgd: signedness vulnerability). - (CVE-2016-3074)
      • -
    • -
  • Intl: -
      -
    • Fixed bug #72061 (Out-of-bounds reads in zif_grapheme_stripos - with negative offset).
      • -
    • -
  • XML: -
      -
    • Fixed bug #72099 (xml_parse_into_struct segmentation fault). -
      • -
    • -
-
- - - - CVE-2016-3074 - ports/209145 - http://www.php.net/ChangeLog-7.php#7.0.6 - http://www.php.net/ChangeLog-5.php#5.6.21 - http://www.php.net/ChangeLog-5.php#5.5.35 - - - 2016-04-28 - 2016-05-03 - - - - - libksba -- local denial of service vulnerabilities - - - libksba - 1.3.3 - - - - -

Martin Prpic, Red Hat Product Security Team, reports:

-
-

Denial of Service due to stack overflow in src/ber-decoder.c.

-

Integer overflow in the BER decoder src/ber-decoder.c.

-

Integer overflow in the DN decoder src/dn.c.

-
- - - - CVE-2016-4353 - CVE-2016-4354 - CVE-2016-4355 - CVE-2016-4356 - http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libksba.git;a=commit;h=07116a314f4dcd4d96990bbd74db95a03a9f650a - http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libksba.git;a=commit;h=aea7b6032865740478ca4b706850a5217f1c3887 - http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libksba.git;a=commit;h=243d12fdec66a4360fbb3e307a046b39b5b4ffc3 - https://security.gentoo.org/glsa/201604-04 - http://www.openwall.com/lists/oss-security/2016/04/29/5 - - - 2015-04-08 - 2016-05-03 - - - - - wireshark -- multiple vulnerabilities - - - wireshark - wireshark-lite - wireshark-qt5 - tshark - tshark-lite - 2.0.3 - - - - -

Wireshark development team reports:

-
-

The following vulnerabilities have been fixed:

-
    -

  • wnpa-sec-2016-19

    -

    The NCP dissector could crash. (Bug 11591)

    • -

  • wnpa-sec-2016-20

    -

    TShark could crash due to a packet reassembly bug. (Bug 11799) -

    • -

  • wnpa-sec-2016-21

    -

    The IEEE 802.11 dissector could crash. (Bug 11824, Bug 12187) -

    • -

  • wnpa-sec-2016-22

    -

    The PKTC dissector could crash. (Bug 12206)

    • -

  • wnpa-sec-2016-23

    -

    The PKTC dissector could crash. (Bug 12242)

    • -

  • wnpa-sec-2016-24

    -

    The IAX2 dissector could go into an infinite loop. (Bug - 12260)

    • -

  • wnpa-sec-2016-25

    -

    Wireshark and TShark could exhaust the stack. (Bug 12268)

    -
    • -

  • wnpa-sec-2016-26

    -

    The GSM CBCH dissector could crash. (Bug 12278)

    • -

  • wnpa-sec-2016-27

    -

    MS-WSP dissector crash. (Bug 12341)

    • -
-
- - - - CVE-2016-4076 - CVE-2016-4077 - CVE-2016-4078 - CVE-2016-4079 - CVE-2016-4080 - CVE-2016-4081 - CVE-2016-4006 - CVE-2016-4082 - CVE-2016-4083 - CVE-2016-4084 - https://www.wireshark.org/docs/relnotes/wireshark-2.0.3.html - http://www.openwall.com/lists/oss-security/2016/04/25/2 - - - 2016-04-22 - 2016-05-02 - 2016-07-04 - - - - - mercurial -- arbitrary code execution vulnerability - - - mercurial - 3.8.1 - - - - -

Mercurial reports:

-
-

CVE-2016-3105: Arbitrary code execution when converting - Git repos

-
- - - - CVE-2016-3105 - https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_3.8_.2F_3.8.1_.282016-5-1.29 - - - 2016-05-01 - 2016-05-01 - - - - - MySQL -- multiple vulnerabilities - - - mariadb55-server - 5.5.49 - - - mariadb100-server - 10.0.25 - - - mariadb101-server - 10.1.12 - - - mysql55-server - 5.5.49 - - - mysql56-server - 5.6.30 - - - mysql57-server - 5.7.12 - - - percona55-server - 5.5.49 - - - percona-server - 5.6.30 - - - - -

Oracle reports reports:

-
-

Critical Patch Update contains 31 new security fixes for Oracle MySQL - 5.5.48, 5.6.29, 5.7.11 and earlier

-
- - - - http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html#AppendixMSQL - https://mariadb.com/kb/en/mariadb/mariadb-5549-release-notes/ - https://mariadb.com/kb/en/mariadb/mariadb-10025-release-notes/ - https://mariadb.com/kb/en/mariadb/mariadb-10112-release-notes/ - CVE-2016-0705 - CVE-2016-0639 - CVE-2015-3194 - CVE-2016-0640 - CVE-2016-0641 - CVE-2016-3461 - CVE-2016-2047 - CVE-2016-0642 - CVE-2016-0643 - CVE-2016-0644 - CVE-2016-0646 - CVE-2016-0647 - CVE-2016-0648 - CVE-2016-0649 - CVE-2016-0650 - CVE-2016-0652 - CVE-2016-0653 - CVE-2016-0654 - CVE-2016-0655 - CVE-2016-0656 - CVE-2016-0657 - CVE-2016-0658 - CVE-2016-0651 - CVE-2016-0659 - CVE-2016-0661 - CVE-2016-0662 - CVE-2016-0663 - CVE-2016-0665 - CVE-2016-0666 - CVE-2016-0667 - CVE-2016-0668 - - - 2016-04-19 - 2016-04-30 - - - - - logstash -- password disclosure vulnerability - - - logstash - 2.1.02.3.2 - - - - -

Logstash developers report:

-
-

Passwords Printed in Log Files under Some Conditions

-

It was discovered that, in Logstash 2.1.0+, log messages - generated by a stalled pipeline during shutdown will print - plaintext contents of password fields. While investigating - this issue we also discovered that debug logging has - included this data for quite some time. Our latest releases - fix both leaks. You will want to scrub old log files if this - is of particular concern to you. This was fixed in issue - #4965

-
- - - - https://www.elastic.co/blog/logstash-2.3.1-and-2.2.4-released#Passwords_Printed_in_Log_Files_under_Some_Conditions_18 - https://github.com/elastic/logstash/pull/4965 - - - 2016-04-01 - 2016-04-28 - - - - - subversion -- multiple vulnerabilities - - - subversion - 1.9.01.9.4 - 1.0.01.8.15 - - - subversion18 - 1.0.01.8.15 - - - - -

Subversion project reports:

-
-

svnserve, the svn:// protocol server, can optionally use the Cyrus - SASL library for authentication, integrity protection, and encryption. - Due to a programming oversight, authentication against Cyrus SASL - would permit the remote user to specify a realm string which is - a prefix of the expected realm string.

-
-
-

Subversion's httpd servers are vulnerable to a remotely triggerable crash - in the mod_authz_svn module. The crash can occur during an authorization - check for a COPY or MOVE request with a specially crafted header value.

-

This allows remote attackers to cause a denial of service.

-
- - - - CVE-2016-2167 - http://subversion.apache.org/security/CVE-2016-2167-advisory.txt - CVE-2016-2168 - http://subversion.apache.org/security/CVE-2016-2168-advisory.txt - - - 2016-04-21 - 2016-04-28 - - - - - ntp -- multiple vulnerabilities - - - ntp - 4.2.8p7 - - - ntp-devel - 4.3.92 - - - FreeBSD - 10.310.3_1 - 10.210.2_15 - 10.110.1_32 - 9.39.3_40 - - - - -

Network Time Foundation reports:

-
-

NTF's NTP Project has been notified of the following low- - and medium-severity vulnerabilities that are fixed in - ntp-4.2.8p7, released on Tuesday, 26 April 2016:

-
    -
  • Bug 3020 / CVE-2016-1551: Refclock impersonation - vulnerability, AKA: refclock-peering. Reported by - Matt Street and others of Cisco ASIG
    • -
  • Bug 3012 / CVE-2016-1549: Sybil vulnerability: - ephemeral association attack, AKA: ntp-sybil - - MITIGATION ONLY. Reported by Matthew Van Gundy - of Cisco ASIG
    • -
  • Bug 3011 / CVE-2016-2516: Duplicate IPs on - unconfig directives will cause an assertion botch. - Reported by Yihan Lian of the Cloud Security Team, - Qihoo 360
    • -
  • Bug 3010 / CVE-2016-2517: Remote configuration - trustedkey/requestkey values are not properly - validated. Reported by Yihan Lian of the Cloud - Security Team, Qihoo 360
    • -
  • Bug 3009 / CVE-2016-2518: Crafted addpeer with - hmode > 7 causes array wraparound with MATCH_ASSOC. - Reported by Yihan Lian of the Cloud Security Team, - Qihoo 360
    • -
  • Bug 3008 / CVE-2016-2519: ctl_getitem() return - value not always checked. Reported by Yihan Lian - of the Cloud Security Team, Qihoo 360
    • -
  • Bug 3007 / CVE-2016-1547: Validate crypto-NAKs, - AKA: nak-dos. Reported by Stephen Gray and - Matthew Van Gundy of Cisco ASIG
    • -
  • Bug 2978 / CVE-2016-1548: Interleave-pivot - - MITIGATION ONLY. Reported by Miroslav Lichvar of - RedHat and separately by Jonathan Gardner of - Cisco ASIG.
    • -
  • Bug 2952 / CVE-2015-7704: KoD fix: peer - associations were broken by the fix for - NtpBug2901, AKA: Symmetric active/passive mode - is broken. Reported by Michael Tatarinov, - NTP Project Developer Volunteer
    • -
  • Bug 2945 / Bug 2901 / CVE-2015-8138: Zero - Origin Timestamp Bypass, AKA: Additional KoD Checks. - Reported by Jonathan Gardner of Cisco ASIG
    • -
  • Bug 2879 / CVE-2016-1550: Improve NTP security - against buffer comparison timing attacks, - authdecrypt-timing, AKA: authdecrypt-timing. - Reported independently by Loganaden Velvindron, - and Matthew Van Gundy and Stephen Gray of - Cisco ASIG.
    • -
-
- - - - SA-16:16.ntp - CVE-2015-7704 - CVE-2015-8138 - CVE-2016-1547 - CVE-2016-1548 - CVE-2016-1549 - CVE-2016-1550 - CVE-2016-1551 - CVE-2016-2516 - CVE-2016-2517 - CVE-2016-2518 - CVE-2016-2519 - http://support.ntp.org/bin/view/Main/SecurityNotice#April_2016_NTP_4_2_8p7_Security - - - 2016-04-26 - 2016-04-27 - 2016-08-09 - - - - - mozilla -- multiple vulnerabilities - - - firefox - linux-firefox - 46.0,1 - - - seamonkey - linux-seamonkey - 2.43 - - - firefox-esr - 39.0,145.1.0,1 - 38.8.0,1 - - - libxul - thunderbird - linux-thunderbird - 39.045.1.0 - 38.8.0 - - - - -

Mozilla Foundation reports:

-
-

MFSA 2016-39 Miscellaneous memory safety hazards (rv:46.0 / - rv:45.1 / rv:38.8)

-

MFSA 2016-42 Use-after-free and buffer overflow - in Service Workers

-

MFSA 2016-44 Buffer overflow in libstagefright with - CENC offsets

-

MFSA 2016-45 CSP not applied to pages sent with - multipart/x-mixed-replace

-

MFSA 2016-46 Elevation of privilege with - chrome.tabs.update API in web extensions

-

MFSA 2016-47 Write to invalid HashMap entry through - JavaScript.watch()

-

MFSA 2016-48 Firefox Health Reports could accept events - from untrusted domains

-
- - - - CVE-2016-2804 - CVE-2016-2805 - CVE-2016-2806 - CVE-2016-2807 - CVE-2016-2808 - CVE-2016-2811 - CVE-2016-2812 - CVE-2016-2814 - CVE-2016-2816 - CVE-2016-2817 - CVE-2016-2820 - https://www.mozilla.org/security/advisories/mfsa2016-39/ - https://www.mozilla.org/security/advisories/mfsa2016-42/ - https://www.mozilla.org/security/advisories/mfsa2016-44/ - https://www.mozilla.org/security/advisories/mfsa2016-45/ - https://www.mozilla.org/security/advisories/mfsa2016-46/ - https://www.mozilla.org/security/advisories/mfsa2016-47/ - https://www.mozilla.org/security/advisories/mfsa2016-48/ - - - 2016-04-26 - 2016-04-26 - - - - - phpmyfaq -- cross-site request forgery vulnerability - - - phpmyfaq - 2.8.27 - - - - -

The phpMyFAQ team reports:

-
-

The vulnerability exists due to application does not properly - verify origin of HTTP requests in "Interface Translation" - functionality.: A remote unauthenticated attacker can create - a specially crafted malicious web page with CSRF exploit, trick - a logged-in administrator to visit the page, spoof the HTTP - request, as if it was coming from the legitimate user, inject - and execute arbitrary PHP code on the target system with privileges - of the webserver.

-
- - - - http://www.phpmyfaq.de/security/advisory-2016-04-11 - https://www.htbridge.com/advisory/HTB23300 - - - 2016-04-11 - 2016-04-23 - - - - - libtasn1 -- denial of service parsing malicious DER certificates - - - libtasn1 - 4.8 - - - - -

GNU Libtasn1 NEWS reports:

-
-

Fixes to avoid an infinite recursion when decoding without the - ASN1_DECODE_FLAG_STRICT_DER flag. Reported by Pascal Cuoq.

-
- - - - CVE-2016-4008 - http://www.openwall.com/lists/oss-security/2016/04/13/3 - http://git.savannah.gnu.org/gitweb/?p=libtasn1.git;a=blob_plain;f=NEWS;hb=e9bcdc86b920d72c9cffc2570d14eea2f6365b37 - - - 2016-04-11 - 2016-04-21 - - - - - squid -- multiple vulnerabilities - - - squid - 3.5.17 - - - - -

Squid security advisory 2016:5 reports:

-
-

Due to incorrect buffer management Squid cachemgr.cgi tool is - vulnerable to a buffer overflow when processing remotely supplied - inputs relayed to it from Squid.

-

This problem allows any client to seed the Squid manager reports - with data that will cause a buffer overflow when processed by the - cachemgr.cgi tool. However, this does require manual administrator - actions to take place. Which greatly reduces the impact and - possible uses.

-
-

Squid security advisory 2016:6 reports:

-
-

Due to buffer overflow issues Squid is vulnerable to a denial of - service attack when processing ESI responses. Due to incorrect input - validation Squid is vulnerable to public information disclosure of - the server stack layout when processing ESI responses. Due to - incorrect input validation and buffer overflow Squid is vulnerable - to remote code execution when processing ESI responses.

-

These problems allow ESI components to be used to perform a denial - of service attack on the Squid service and all other services on the - same machine. Under certain build conditions these problems allow - remote clients to view large sections of the server memory. However, - the bugs are exploitable only if you have built and configured the - ESI features to be used by a reverse-proxy and if the ESI components - being processed by Squid can be controlled by an attacker.

-
- - - - CVE-2016-4051 - CVE-2016-4052 - CVE-2016-4053 - CVE-2016-4054 - ports/208939 - http://www.squid-cache.org/Advisories/SQUID-2016_5.txt - http://www.squid-cache.org/Advisories/SQUID-2016_6.txt - - - 2016-04-20 - 2016-04-21 - - - - - ansible -- use of predictable paths in lxc_container - - - ansible - 2.0.0.02.0.2.0 - - - ansible1 - 1.9.6 - - - - -

Ansible developers report:

-
-

CVE-2016-3096: do not use predictable paths in lxc_container

- -
    -
  • do not use a predictable filename for the LXC attach - script
    • -
  • don't use predictable filenames for LXC attach script - logging
    • -
  • don't set a predictable archive_path
    • -
- -

this should prevent symlink attacks which could result - in

- -
    -
  • data corruption
    • -
  • data leakage
    • -
  • privilege escalation
    • -
-
- - - - CVE-2016-3096 - https://github.com/ansible/ansible-modules-extras/pull/1941/commits/8c6fe646ee79f5e55361b885b7efed5bec72d4a4 - https://bugzilla.redhat.com/show_bug.cgi?id=1322925 - - - 2016-04-02 - 2016-04-20 - - - - - proftpd -- vulnerability in mod_tls - - - proftpd - 1.3.5b - 1.3.6.r1 - - - - -

MITRE reports:

-
-

The mod_tls module in ProFTPD before 1.3.5b and 1.3.6 before - 1.3.6rc2 does not properly handle the TLSDHParamFile directive, which - might cause a weaker than intended Diffie-Hellman (DH) key to be used - and consequently allow attackers to have unspecified impact via - unknown vectors.

-
- - - - CVE-2016-3125 - - - 2016-03-08 - 2016-04-20 - - - - - chromium -- multiple vulnerabilities - - - chromium - chromium-npapi - chromium-pulse - 50.0.2661.75 - - - - -

Google Chrome Releases reports:

-
-

20 security fixes in this release, including:

-
    -
  • [590275] High CVE-2016-1652: Universal XSS in extension - bindings. Credit to anonymous.
    • -
  • [589792] High CVE-2016-1653: Out-of-bounds write in V8. Credit - to Choongwoo Han.
    • -
  • [591785] Medium CVE-2016-1651: Out-of-bounds read in Pdfium - JPEG2000 decoding. Credit to kdot working with HP's Zero Day - Initiative.
    • -
  • [589512] Medium CVE-2016-1654: Uninitialized memory read in - media. Credit to Atte Kettunen of OUSPG.
    • -
  • [582008] Medium CVE-2016-1655: Use-after-free related to - extensions. Credit to Rob Wu.
    • -
  • [570750] Medium CVE-2016-1656: Android downloaded file path - restriction bypass. Credit to Dzmitry Lukyanenko.
    • -
  • [567445] Medium CVE-2016-1657: Address bar spoofing. Credit to - Luan Herrera.
    • -
  • [573317] Low CVE-2016-1658: Potential leak of sensitive - information to malicious extensions. Credit to Antonio Sanso - (@asanso) of Adobe.
    • -
  • [602697] CVE-2016-1659: Various fixes from internal audits, - fuzzing and other initiatives.
    • -
-
- - - - CVE-2016-1651 - CVE-2016-1652 - CVE-2016-1653 - CVE-2016-1654 - CVE-2016-1655 - CVE-2016-1656 - CVE-2016-1657 - CVE-2016-1658 - CVE-2016-1659 - http://googlechromereleases.blogspot.nl/2016/04/stable-channel-update_13.html - - - 2016-04-13 - 2016-04-19 - - - - - hostapd and wpa_supplicant -- multiple vulnerabilities - - - wpa_supplicant - 2.5_1 - - - hostapd - 2.6 - - - - -

Jouni Malinen reports:

-
-

wpa_supplicant unauthorized WNM Sleep Mode GTK control. (2015-6 - - CVE-2015-5310)

-
-
-

EAP-pwd missing last fragment length validation. (2015-7 - - CVE-2015-5315)

-
-
-

EAP-pwd peer error path failure on unexpected Confirm message. - (2015-8 - CVE-2015-5316)

-
- - - - CVE-2015-5310 - CVE-2015-5315 - CVE-2015-5316 - ports/208482 - http://w1.fi/security/2015-6/wpa_supplicant-unauthorized-wnm-sleep-mode-gtk-control.txt - http://w1.fi/security/2015-7/eap-pwd-missing-last-fragment-length-validation.txt - http://w1.fi/security/2015-8/eap-pwd-unexpected-confirm.txt - - - 2015-11-10 - 2016-04-19 - 2017-03-22 - - - - - dhcpcd -- remote code execution/denial of service - - - dhcpcd - 6.9.1 - - - - -

MITRE reports:

-
-

The get_option function in dhcp.c in dhcpcd before 6.2.0, as used - in dhcpcd 5.x in Android before 5.1 and other products, does not - validate the relationship between length fields and the amount of - data, which allows remote DHCP servers to execute arbitrary code or - cause a denial of service (memory corruption) via a large length - value of an option in a DHCPACK message.

-
- - - - CVE-2014-7912 - http://roy.marples.name/projects/dhcpcd/info/d71cfd8aa203bffe - - - 2015-06-19 - 2016-04-17 - - - - - dhcpcd -- remote code execution/denial of service - - - dhcpcd - 6.10.2 - - - - -

MITRE reports:

-
-

The print_option function in dhcp-common.c in dhcpcd through 6.9.1, - as used in dhcp.c in dhcpcd 5.x in Android before 5.1 and other - products, misinterprets the return value of the snprintf function, - which allows remote DHCP servers to execute arbitrary code or cause - a denial of service (memory corruption) via a crafted message.

-
- - - - CVE-2014-7913 - ports/208702 - http://roy.marples.name/projects/dhcpcd/info/528541c4c619520e - - - 2016-01-22 - 2016-04-17 - - - - - PJSIP -- TCP denial of service in PJProject - - - pjsip - 2.4.5 - - - pjsip-extsrtp - 2.4.5 - - - - -

The Asterisk project reports:

-
-

PJProject has a limit on the number of TCP connections - that it can accept. Furthermore, PJProject does not close - TCP connections it accepts. By default, this value is - approximately 60.

-

An attacker can deplete the number of allowed TCP - connections by opening TCP connections and sending no - data to Asterisk.

-

If PJProject has been compiled in debug mode, then - once the number of allowed TCP connections has been - depleted, the next attempted TCP connection to Asterisk - will crash due to an assertion in PJProject.

-

If PJProject has not been compiled in debug mode, then - any further TCP connection attempts will be rejected. - This makes Asterisk unable to process TCP SIP traffic.

-

Note that this only affects TCP/TLS, since UDP is - connectionless.

-
- - - - http://downloads.asterisk.org/pub/security/AST-2016-005.html - - - 2016-02-15 - 2016-04-15 - - - - - asterisk -- Long Contact URIs in REGISTER requests can crash Asterisk - - - asterisk13 - 13.8.1 - - - - -

The Asterisk project reports:

-
-

Asterisk may crash when processing an incoming REGISTER - request if that REGISTER contains a Contact header with - a lengthy URI.

-

This crash will only happen for requests that pass - authentication. Unauthenticated REGISTER requests will - not result in a crash occurring.

-

This vulnerability only affects Asterisk when using - PJSIP as its SIP stack. The chan_sip module does not have - this problem.

-
- - - - http://downloads.asterisk.org/pub/security/AST-2016-004.html - - - 2016-01-19 - 2016-04-15 - - - - - go -- remote denial of service - - - go - 1.6.1,1 - - - - -

Jason Buberel reports:

-
-

Go has an infinite loop in several big integer routines that makes - Go programs vulnerable to remote denial of service attacks. Programs - using HTTPS client authentication or the Go ssh server libraries are - both exposed to this vulnerability.

-
- - - - CVE-2016-3959 - http://www.openwall.com/lists/oss-security/2016/04/05/2 - https://golang.org/cl/21533 - - - 2016-04-05 - 2016-04-14 - - - - - samba -- multiple vulnerabilities - - - samba36 - 3.6.03.6.25_3 - - - samba4 - 4.0.04.0.26 - - - samba41 - 4.1.04.1.23 - - - samba42 - 4.2.04.2.11 - - - samba43 - 4.3.04.3.8 - - - samba44 - 4.4.04.4.2 - - - - -

Samba team reports:

-
-

[CVE-2015-5370] Errors in Samba DCE-RPC code can lead to denial of service - (crashes and high cpu consumption) and man in the middle attacks.

-

[CVE-2016-2110] The feature negotiation of NTLMSSP is not downgrade protected. - A man in the middle is able to clear even required flags, especially - NTLMSSP_NEGOTIATE_SIGN and NTLMSSP_NEGOTIATE_SEAL.

-

[CVE-2016-2111] When Samba is configured as Domain Controller it allows remote - attackers to spoof the computer name of a secure channel's endpoints, and obtain - sensitive session information, by running a crafted application and leveraging - the ability to sniff network traffic.

-

[CVE-2016-2112] A man in the middle is able to downgrade LDAP connections - to no integrity protection.

-

[CVE-2016-2113] Man in the middle attacks are possible for client triggered LDAP - connections (with ldaps://) and ncacn_http connections (with https://).

-

[CVE-2016-2114] Due to a bug Samba doesn't enforce required smb signing, even if explicitly configured.

-

[CVE-2016-2115] The protection of DCERPC communication over ncacn_np (which is - the default for most the file server related protocols) is inherited from the underlying SMB connection.

-

[CVE-2016-2118] a.k.a. BADLOCK. A man in the middle can intercept any DCERPC traffic - between a client and a server in order to impersonate the client and get the same privileges - as the authenticated user account. This is most problematic against active directory domain controllers.

-
- - - - CVE-2015-5370 - https://www.samba.org/samba/security/CVE-2015-5370.html - CVE-2016-2110 - https://www.samba.org/samba/security/CVE-2016-2110.html - CVE-2016-2111 - https://www.samba.org/samba/security/CVE-2016-2111.html - CVE-2016-2112 - https://www.samba.org/samba/security/CVE-2016-2112.html - CVE-2016-2113 - https://www.samba.org/samba/security/CVE-2016-2113.html - CVE-2016-2114 - https://www.samba.org/samba/security/CVE-2016-2114.html - CVE-2016-2115 - https://www.samba.org/samba/security/CVE-2016-2115.html - CVE-2016-2118 - https://www.samba.org/samba/security/CVE-2016-2118.html - - - 2016-04-12 - 2016-04-12 - 2016-04-12 - - - - - php -- multiple vulnerabilities - - - php70 - php70-fileinfo - php70-mbstring - php70-phar - php70-snmp - 7.0.5 - - - php56 - php56-fileinfo - php56-mbstring - php56-phar - php56-snmp - 5.6.20 - - - php55 - php55-fileinfo - php55-mbstring - php55-phar - php55-snmp - 5.5.34 - - - - -

The PHP Group reports:

-
-
  • Fileinfo: -
      -
    • Fixed bug #71527 (Buffer over-write in finfo_open with - malformed magic file).
      • -
    • -
  • mbstring: -
      -
    • Fixed bug #71906 (AddressSanitizer: negative-size-param (-1) - in mbfl_strcut).
      • -
    • -
  • Phar: -
      -
    • Fixed bug #71860 (Invalid memory write in phar on filename with - \0 in name).
      • -
    • -
  • SNMP: -
      -
    • Fixed bug #71704 (php_snmp_error() Format String Vulnerability). -
      • -
    • -
  • Standard: -
      -
    • Fixed bug #71798 (Integer Overflow in php_raw_url_encode).
      • -
    • -
-
- - - - ports/208465 - http://php.net/ChangeLog-7.php#7.0.5 - http://php.net/ChangeLog-5.php#5.6.20 - http://php.net/ChangeLog-5.php#5.5.34 - - - 2016-03-31 - 2016-04-03 - - - - - pcre -- heap overflow vulnerability - - - pcre - 8.38_1 - - - - -

Mitre reports:

-
-

The pcre_compile2 function in pcre_compile.c in PCRE 8.38 - mishandles the /((?:F?+(?:^(?(R)a+\"){99}-))(?J)(?'R'(?'R'<((?'RR'(?'R'\){97)?J)?J)(?'R'(?'R'\){99|(:(?|(?'R')(\k'R')|((?'R')))H'R'R)(H'R))))))/ - pattern and related patterns with named subgroups, which allows - remote attackers to cause a denial of service (heap-based buffer - overflow) or possibly have unspecified other impact via a crafted - regular expression, as demonstrated by a JavaScript RegExp object - encountered by Konqueror.

-
- - - - CVE-2016-1283 - ports/208260 - https://bugs.exim.org/show_bug.cgi?id=1767 - - - 2016-02-27 - 2016-04-03 - - - - - py-djblets -- Self-XSS vulnerability - - - py27-djblets - py32-djblets - py33-djblets - py34-djblets - py35-djblets - 0.9.2 - - - - -

Djblets Release Notes reports:

-
-

A recently-discovered vulnerability in the datagrid templates allows an - attacker to generate a URL to any datagrid page containing malicious code - in a column sorting value. If the user visits that URL and then clicks - that column, the code will execute.

-

The cause of the vulnerability was due to a template not escaping - user-provided values.

-
- - - - https://www.reviewboard.org/docs/releasenotes/djblets/0.9.2/ - - - 2016-03-01 - 2016-04-03 - - - - - moodle -- multiple vulnerabilities - - - moodle28 - 2.8.11 - - - moodle29 - 2.9.5 - - - moodle30 - 3.0.3 - - - - -

Marina Glancy reports:

-
-
    -

  • MSA-16-0003: Incorrect capability check when displaying - users emails in Participants list

    • -

  • MSA-16-0004: XSS from profile fields from external db

    -
    • -

  • MSA-16-0005: Reflected XSS in mod_data advanced search

    -
    • -

  • MSA-16-0006: Hidden courses are shown to students in Event - Monitor

    • -

  • MSA-16-0007: Non-Editing Instructor role can edit exclude - checkbox in Single View

    • -

  • MSA-16-0008: External function get_calendar_events return - events that pertains to hidden activities

    • -

  • MSA-16-0009: CSRF in Assignment plugin management page

    -
    • -

  • MSA-16-0010: Enumeration of category details possible without - authentication

    • -

  • MSA-16-0011: Add no referrer to links with _blank target - attribute

    • -

  • MSA-16-0012: External function mod_assign_save_submission - does not check due dates

    • -
-
- - - - CVE-2016-2151 - CVE-2016-2152 - CVE-2016-2153 - CVE-2016-2154 - CVE-2016-2155 - CVE-2016-2156 - CVE-2016-2157 - CVE-2016-2158 - CVE-2016-2190 - CVE-2016-2159 - https://moodle.org/security/ - - - 2016-03-21 - 2016-04-03 - - - - - squid -- multiple vulnerabilities - - - squid - 3.5.16 - - - - -

Squid security advisory 2016:3 reports:

-
-

Due to a buffer overrun Squid pinger binary is vulnerable to - denial of service or information leak attack when processing - ICMPv6 packets.

-

This bug also permits the server response to manipulate other - ICMP and ICMPv6 queries processing to cause information leak.

-

This bug allows any remote server to perform a denial of service - attack on the Squid service by crashing the pinger. This may - affect Squid HTTP routing decisions. In some configurations, - sub-optimal routing decisions may result in serious service - degradation or even transaction failures.

-

If the system does not contain buffer-overrun protection leading - to that crash this bug will instead allow attackers to leak - arbitrary amounts of information from the heap into Squid log - files. This is of higher importance than usual because the pinger - process operates with root priviliges.

-
-

Squid security advisory 2016:4 reports:

-
-

Due to incorrect bounds checking Squid is vulnerable to a denial - of service attack when processing HTTP responses.

-

This problem allows a malicious client script and remote server - delivering certain unusual HTTP response syntax to trigger a - denial of service for all clients accessing the Squid service.

-
- - - - CVE-2016-3947 - CVE-2016-3948 - ports/208463 - http://www.squid-cache.org/Advisories/SQUID-2016_3.txt - http://www.squid-cache.org/Advisories/SQUID-2016_4.txt - - - 2016-03-28 - 2016-04-02 - - - - - PostgreSQL -- minor security problems. - - - postgresql95-server - postgresql95-contrib - 9.5.09.5.2 - - - - -

PostgreSQL project reports:

-
-

Security Fixes for RLS, BRIN

-

- This release closes security hole CVE-2016-2193 - (https://access.redhat.com/security/cve/CVE-2016-2193), where a query - plan might get reused for more than one ROLE in the same session. - This could cause the wrong set of Row Level Security (RLS) policies to - be used for the query.

-

- The update also fixes CVE-2016-3065 - (https://access.redhat.com/security/cve/CVE-2016-3065), a server crash - bug triggered by using `pageinspect` with BRIN index pages. Since an - attacker might be able to expose a few bytes of server memory, this - crash is being treated as a security issue.

-
- - - - CVE-2016-2193 - CVE-2016-3065 - - - 2016-03-01 - 2016-03-31 - - - - - flash -- multiple vulnerabilities - - - linux-c6-flashplugin - linux-f10-flashplugin - linux-c6_64-flashplugin - 11.2r202.577 - - - - -

Adobe reports:

-
-

These updates resolve integer overflow vulnerabilities that - could lead to code execution (CVE-2016-0963, CVE-2016-0993, - CVE-2016-1010).

-

These updates resolve use-after-free vulnerabilities that could - lead to code execution (CVE-2016-0987, CVE-2016-0988, - CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, - CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, - CVE-2016-1000).

-

These updates resolve a heap overflow vulnerability that could - lead to code execution (CVE-2016-1001).

-

These updates resolve memory corruption vulnerabilities that - could lead to code execution (CVE-2016-0960, CVE-2016-0961, - CVE-2016-0962, CVE-2016-0986, CVE-2016-0989, CVE-2016-0992, - CVE-2016-1002, CVE-2016-1005).

-
- - - - CVE-2016-0960 - CVE-2016-0961 - CVE-2016-0962 - CVE-2016-0963 - CVE-2016-0986 - CVE-2016-0987 - CVE-2016-0988 - CVE-2016-0989 - CVE-2016-0990 - CVE-2016-0991 - CVE-2016-0992 - CVE-2016-0993 - CVE-2016-0994 - CVE-2016-0995 - CVE-2016-0996 - CVE-2016-0997 - CVE-2016-0998 - CVE-2016-0999 - CVE-2016-1000 - CVE-2016-1001 - CVE-2016-1002 - CVE-2016-1005 - CVE-2016-1010 - https://helpx.adobe.com/security/products/flash-player/apsb16-08.html - - - 2016-03-10 - 2016-03-31 - - - - - Multiple vulnerabilities in Botan - - - botan110 - 1.10.11 - - - - -

The botan developers reports:

-
-

Infinite loop in modular square root algorithm - The ressol function implements the Tonelli-Shanks algorithm for finding square roots could be sent into a nearly infinite loop due to a misplaced conditional check. This could occur if a composite modulus is provided, as this algorithm is only defined for primes. This function is exposed to attacker controlled input via the OS2ECP function during ECC point decompression.

-

Heap overflow on invalid ECC point - The PointGFp constructor did not check that the affine coordinate arguments were less than the prime, but then in curve multiplication assumed that both arguments if multiplied would fit into an integer twice the size of the prime.

-

The bigint_mul and bigint_sqr functions received the size of the output buffer, but only used it to dispatch to a faster algorithm in cases where there was sufficient output space to call an unrolled multiplication function.

-

The result is a heap overflow accessible via ECC point decoding, which accepted untrusted inputs. This is likely exploitable for remote code execution.

-

On systems which use the mlock pool allocator, it would allow an attacker to overwrite memory held in secure_vector objects. After this point the write will hit the guard page at the end of the mmapped region so it probably could not be used for code execution directly, but would allow overwriting adjacent key material.

-
- - - - http://botan.randombit.net/security.html - CVE-2016-2194 - CVE-2016-2195 - - - 2016-02-01 - 2016-03-31 - - - - - Botan BER Decoder vulnerabilities - - - botan110 - 1.10.10 - - - - -

The botan developers reports:

-
-

Excess memory allocation in BER decoder - The BER decoder would allocate a fairly arbitrary amount of memory in a length field, even if there was no chance the read request would succeed. This might cause the process to run out of memory or invoke the OOM killer.

-

Crash in BER decoder - The BER decoder would crash due to reading from offset 0 of an empty vector if it encountered a BIT STRING which did not contain any data at all. This can be used to easily crash applications reading untrusted ASN.1 data, but does not seem exploitable for code execution.

-
- - - - http://botan.randombit.net/security.html - CVE-2015-5726 - CVE-2015-5727 - - - 2015-08-03 - 2016-03-31 - - - - - mercurial -- multiple vulnerabilities - - - mercurial - 2.7.3 - - - - -

Mercurial reports:

-
-

CVE-2016-3630: Remote code execution in binary delta decoding

-

CVE-2016-3068: Arbitrary code execution with Git subrepos

-

CVE-2016-3069: Arbitrary code execution when converting - Git repos

-
- - - - CVE-2016-3630 - CVE-2016-3068 - CVE-2016-3069 - https://www.mercurial-scm.org/pipermail/mercurial/2016-March/049452.html - - - 2016-03-29 - 2016-03-29 - - - - - chromium -- multiple vulnerabilities - - - chromium - chromium-npapi - chromium-pulse - 49.0.2623.108 - - - - -

Google Chrome Releases reports:

-
-

[594574] High CVE-2016-1646: Out-of-bounds read in V8.

-

[590284] High CVE-2016-1647: Use-after-free in Navigation.

-

[590455] High CVE-2016-1648: Use-after-free in Extensions.

-

[597518] CVE-2016-1650: Various fixes from internal audits, - fuzzing and other initiatives.

-

Multiple vulnerabilities in V8 fixed at the tip of the - 4.9 branch

-
- - - - CVE-2016-1646 - CVE-2016-1647 - CVE-2016-1648 - CVE-2016-1649 - CVE-2016-1650 - http://googlechromereleases.blogspot.de/2016/03/stable-channel-update_24.html - - - 2016-03-24 - 2016-03-29 - - - - - chromium -- multiple vulnerabilities - - - chromium - chromium-npapi - chromium-pulse - 49.0.2623.87 - - - - -

Google Chrome Releases reports:

-
-

[589838] High CVE-2016-1643: Type confusion in Blink.

-

[590620] High CVE-2016-1644: Use-after-free in Blink.

-

[587227] High CVE-2016-1645: Out-of-bounds write in PDFium.

-
- - - - CVE-2016-1643 - CVE-2016-1644 - CVE-2016-1645 - http://googlechromereleases.blogspot.de/2016/03/stable-channel-update_8.html - - - 2016-03-08 - 2016-03-29 - - - - - bind -- denial of service vulnerability - - - bind910 - 9.10.09.10.3P4 - - - bind9-devel - 9.11.0.a20160309 - - - - -

ISC reports:

-
-

A response containing multiple DNS cookies causes servers with - cookie support enabled to exit with an assertion failure.

-
- - - - CVE-2016-2088 - https://kb.isc.org/article/AA-01351 - - - 2016-03-09 - 2016-03-28 - - - - - bind -- denial of service vulnerability - - - bind98 - 9.8.8 - - - bind99 - 9.9.09.9.8P4 - - - bind910 - 9.10.09.10.3P4 - - - bind9-devel - 9.11.0.a20160309 - - - FreeBSD - 9.39.3_38 - - - - -

ISC reports:

-
-

A problem parsing resource record signatures for DNAME resource - records can lead to an assertion failure in resolver.c or db.c

-
- - - - CVE-2016-1286 - SA-16:13.bind - https://kb.isc.org/article/AA-01353 - - - 2016-03-09 - 2016-03-28 - 2016-08-09 - - - - - bind -- denial of service vulnerability - - - bind98 - 9.8.8 - - - bind99 - 9.9.09.9.8P4 - - - bind910 - 9.10.09.10.3P4 - - - bind9-devel - 9.11.0.a20160309 - - - FreeBSD - 9.39.3_38 - - - - -

ISC reports:

-
-

An error parsing input received by the rndc control channel can - cause an assertion failure in sexpr.c or alist.c.

-
- - - - CVE-2016-1285 - SA-16:13.bind - https://kb.isc.org/article/AA-01352 - - - 2016-03-09 - 2016-03-28 - 2016-08-09 - - - - - salt -- Insecure configuration of PAM external authentication service - - - py27-salt - py32-salt - py33-salt - py34-salt - py35-salt - 2015.5.10 - 2015.8.02015.8.8 - - - - -

SaltStack reports:

-
-

This issue affects all Salt versions prior to 2015.8.8/2015.5.10 - when PAM external authentication is enabled. This issue involves - passing an alternative PAM authentication service with a command - that is sent to LocalClient, enabling the attacker to bypass the - configured authentication service.

-
- - - - CVE-2016-3176 - https://docs.saltstack.com/en/latest/topics/releases/2015.8.8.html - - - 2016-03-17 - 2016-03-27 - - - - - activemq -- Unsafe deserialization - - - activemq - 5.13.0 - - - - -

Alvaro Muatoz, Matthias Kaiser and Christian Schneider reports:

-
-

JMS Object messages depends on Java Serialization for - marshaling/unmashaling of the message payload. There are a couple of places - inside the broker where deserialization can occur, like web console or stomp - object message transformation. As deserialization of untrusted data can lead to - security flaws as demonstrated in various reports, this leaves the broker - vulnerable to this attack vector. Additionally, applications that consume - ObjectMessage type of messages can be vulnerable as they deserialize objects on - ObjectMessage.getObject() calls.

-
- - - - http://activemq.apache.org/security-advisories.data/CVE-2015-5254-announcement.txt - CVE-2015-5254 - - - 2016-01-08 - 2016-03-25 - - - - - activemq -- Web Console Clickjacking - - - activemq - 5.13.2 - - - - -

Michael Furman reports:

-
-

The web based administration console does not set the - X-Frame-Options header in HTTP responses. This allows the console to be embedded - in a frame or iframe which could then be used to cause a user to perform an - unintended action in the console.

-
- - - - http://activemq.apache.org/security-advisories.data/CVE-2016-0734-announcement.txt - CVE-2016-0734 - - - 2016-03-10 - 2016-03-25 - - - - - activemq -- Web Console Cross-Site Scripting - - - activemq - 5.13.1 - - - - -

Vladimir Ivanov (Positive Technologies) reports:

-
-

Several instances of cross-site scripting vulnerabilities were - identified to be present in the web based administration console as well as the - ability to trigger a Java memory dump into an arbitrary folder. The root cause - of these issues are improper user data output validation and incorrect - permissions configured on Jolokia.

-
- - - - http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt - CVE-2016-0782 - - - 2016-03-10 - 2016-03-25 - - - - - pcre -- stack buffer overflow - - - pcre - 8.38 - - - pcre2 - 10.20_1 - - - - -

Philip Hazel reports:

-
-

PCRE does not validate that handling the (*ACCEPT) verb - will occur within the bounds of the cworkspace stack buffer, leading to - a stack buffer overflow.

-
- - - - https://bugs.exim.org/show_bug.cgi?id=1791 - CVE-2016-3191 - - - 2016-02-09 - 2016-03-21 - 2016-03-21 - - - - - kamailio -- SEAS Module Heap overflow - - - kamailio - 4.3.5 - - - - -

Stelios Tsampas reports:

-
-

A (remotely exploitable) heap overflow vulnerability was found in - Kamailio v4.3.4.

-
- - - - CVE-2016-2385 - https://github.com/kamailio/kamailio/commit/f50c9c853e7809810099c970780c30b0765b0643 - https://census-labs.com/news/2016/03/30/kamailio-seas-heap-overflow/ - http://seclists.org/oss-sec/2016/q1/338 - - - 2016-02-15 - 2016-03-19 - 2016-04-03 - - - - - hadoop2 -- unauthorized disclosure of data vulnerability - - - hadoop2 - 2.62.7 - - - - -

Arun Suresh reports:

-
-

RPC traffic from clients, potentially including authentication - credentials, may be intercepted by a malicious user with access to - run tasks or containers on a cluster.

-
- - - - CVE-2015-1776 - http://mail-archives.apache.org/mod_mbox/hadoop-general/201602.mbox/browser - - - 2016-02-15 - 2016-03-19 - - - - - git -- integer overflow - - - git - 2.4.11 - 2.5.02.5.5 - 2.6.02.6.6 - 2.7.02.7.4 - - - git-gui - 2.4.11 - 2.5.02.5.5 - 2.6.02.6.6 - 2.7.02.7.4 - - - git-lite - 2.4.11 - 2.5.02.5.5 - 2.6.02.6.6 - 2.7.02.7.4 - - - git-subversion - 2.4.11 - 2.5.02.5.5 - 2.6.02.6.6 - 2.7.02.7.4 - - - - -

Debian reports:

-
-

integer overflow due to a loop which adds more to "len".

-
- - - - CVE-2016-2324 - https://security-tracker.debian.org/tracker/CVE-2016-2324 - https://github.com/git/git/commit/9831e92bfa833ee9c0ce464bbc2f941ae6c2698d - - - 2016-02-24 - 2016-03-18 - - - - - git -- potential code execution - - - git - 2.7.0 - - - - -

Debian reports:

-
-

"int" is the wrong data type for ... nlen assignment.

-
- - - - CVE-2016-2315 - http://www.openwall.com/lists/oss-security/2016/03/15/6 - https://marc.info/?l=oss-security&m=145809217306686&w=2 - https://github.com/git/git/commit/34fa79a6cde56d6d428ab0d3160cb094ebad3305 - https://security-tracker.debian.org/tracker/CVE-2016-2315 - - - 2015-09-24 - 2016-03-17 - - - - - node -- multiple vulnerabilities - - - node - 5.7.1 - - - - -

Jeremiah Senkpiel reports:

-
-
    -

  • Fix a double-free defect in parsing malformed DSA keys - that may potentially be used for DoS or memory corruption attacks.

    • -

  • Fix a defect that can cause memory corruption in - certain very rare cases

    • -

  • Fix a defect that makes the CacheBleed Attack possible

    • -
-
- - - - https://github.com/nodejs/node/commit/805f054cc7791c447dbb960fbf3b179ea05294ac - CVE-2016-0702 - CVE-2016-0705 - CVE-2016-0797 - - - 2016-03-02 - 2016-03-14 - - - - - dropbear -- authorized_keys command= bypass - - - dropbear - 2016.72 - - - - -

Matt Johnson reports:

-
-

Validate X11 forwarding input. Could allow bypass of - authorized_keys command= restrictions

-
- - - - https://matt.ucc.asn.au/dropbear/CHANGES - CVE-2016-3116 - - - 2016-03-11 - 2016-03-14 - - - - - jpgraph2 -- XSS vulnerability - - - jpgraph2 - 3.0.7_1 - - - - -

Martin Barbella reports:

-
-

JpGraph is an object oriented library for PHP that can be used to create - various types of graphs which also contains support for client side - image maps. - - The GetURLArguments function for the JpGraph's Graph class does not - properly sanitize the names of get and post variables, leading to a - cross site scripting vulnerability.

-
- - - - http://www.securityfocus.com/archive/1/archive/1/508586/100/0/threaded - - - 2009-12-22 - 2016-03-13 - - - - - php7 -- multiple vulnerabilities - - - php70 - php70-soap - 7.0.4 - - - - -

The PHP Group reports:

-
-
  • Core: -
      -
    • Fixed bug #71637 (Multiple Heap Overflow due to integer - overflows in xml/filter_url/addcslashes).
      • -
    • -
  • SOAP: -
      -
    • Fixed bug #71610 (Type Confusion Vulnerability - SOAP / - make_http_soap_request()).
      • -
    • -
-
- - - - http://php.net/ChangeLog-7.php#7.0.4 - - - 2016-03-03 - 2016-03-13 - - - - - php5 -- multiple vulnerabilities - - - php55-phar - php55-wddx - 5.5.33 - - - php56-phar - php56-wddx - 5.6.19 - - - - -

The PHP Group reports:

-
-
  • Phar: -
      -
    • Fixed bug #71498 (Out-of-Bound Read in phar_parse_zipfile()). -
      • -
    • -
  • WDDX: -
      -
    • Fixed bug #71587 (Use-After-Free / Double-Free in WDDX - Deserialize).
      • -
    • -
-
- - - - http://php.net/ChangeLog-5.php#5.6.19 - http://php.net/ChangeLog-5.php#5.5.33 - - - 2016-03-03 - 2016-03-13 - - - - - openssh -- command injection when X11Forwarding is enabled - - - openssh-portable - 7.2.p2,1 - - - FreeBSD - 10.210.2_14 - 10.110.1_31 - 9.39.3_39 - - - - -

The OpenSSH project reports:

-
-

Missing sanitisation of untrusted input allows an - authenticated user who is able to request X11 forwarding - to inject commands to xauth(1). -

-

Injection of xauth commands grants the ability to read - arbitrary files under the authenticated user's privilege, - Other xauth commands allow limited information leakage, - file overwrite, port probing and generally expose xauth(1), - which was not written with a hostile user in mind, as an - attack surface. -

-

Mitigation:

-

Set X11Forwarding=no in sshd_config. This is the default.

-

For authorized_keys that specify a "command" restriction, - also set the "restrict" (available in OpenSSH >=7.2) or - "no-x11-forwarding" restrictions. -

-
- - - - http://www.openssh.com/txt/x11fwd.adv - CVE-2016-3115 - SA-16:14.openssh - - - 2016-03-11 - 2016-03-11 - 2016-08-09 - - - - - quagga -- stack based buffer overflow vulnerability - - - quagga - 1.0.20160309 - - - - -

Donald Sharp reports:

-
-

A malicious BGP peer may execute arbitrary code in - particularly configured remote bgpd hosts.

-
- - - - https://www.kb.cert.org/vuls/id/270232 - http://savannah.nongnu.org/forum/forum.php?forum_id=8476 - CVE-2016-2342 - - - 2016-01-27 - 2016-03-10 - - - - - ricochet -- information disclosure - - - ricochet - 1.1.2 - - - - -

special reports:

-
-

By sending a nickname with some HTML tags in a contact - request, an attacker could cause Ricochet to make network requests - without Tor after the request is accepted, which would reveal the user's - IP address.

-
- - - - https://github.com/ricochet-im/ricochet/releases/tag/v1.1.2 - - - 2016-02-15 - 2016-03-10 - - - - - pidgin-otr -- use after free - - - pidgin-otr - 4.0.2 - - - - -

Hanno Bock reports:

-
-

The pidgin-otr plugin version 4.0.2 fixes a heap use after - free error. - The bug is triggered when a user tries to authenticate a buddy and - happens in the function create_smp_dialog.

-
- - - - http://seclists.org/oss-sec/2016/q1/572 - https://bugs.otr.im/issues/88 - https://bugs.otr.im/issues/128 - CVE-2015-8833 - - - 2015-04-04 - 2016-03-10 - - - - - libotr -- integer overflow - - - libotr - 4.1.1 - - - libotr3 - 0 - - - - -

X41 D-Sec reports:

-
-

A remote attacker may crash or execute arbitrary code in - libotr by sending large OTR messages.

-
- - - - https://www.x41-dsec.de/lab/advisories/x41-2016-001-libotr/ - CVE-2016-2851 - - - 2016-02-17 - 2016-03-09 - 2016-03-09 - - - - - brotli -- buffer overflow - - - brotli - 0.3.00.3.0_1 - 0.2.0_2 - - - libbrotli - 0.3.0_3 - - - chromium - chromium-npapi - chromium-pulse - 48.0.2564.109 - - - firefox - linux-firefox - 45.0,1 - - - seamonkey - linux-seamonkey - 2.42 - - - firefox-esr - 38.7.0,1 - - - libxul - thunderbird - linux-thunderbird - 38.7.0 - - - - -

Google Chrome Releases reports:

-
-

[583607] High CVE-2016-1624: Buffer overflow in Brotli. Credit to lukezli.

-
-

Mozilla Foundation reports:

-
-

Security researcher Luke Li reported a pointer underflow - bug in the Brotli library's decompression that leads to a - buffer overflow. This results in a potentially exploitable - crash when triggered.

-
- - - - CVE-2016-1624 - CVE-2016-1968 - https://github.com/google/brotli/commit/37a320dd81db8d546cd24a45b4c61d87b45dcade - https://chromium.googlesource.com/chromium/src/+/7716418a27d561ee295a99f11fd3865580748de2%5E!/ - https://www.mozilla.org/security/advisories/mfsa2016-30/ - https://hg.mozilla.org/releases/mozilla-release/rev/4a5d8ade4e3e - - - 2016-02-08 - 2016-03-08 - 2016-03-08 - - - - - mozilla -- multiple vulnerabilities - - - firefox - linux-firefox - 45.0,1 - - - seamonkey - linux-seamonkey - 2.42 - - - firefox-esr - 38.7.0,1 - - - libxul - thunderbird - linux-thunderbird - 38.7.0 - - - - -

Mozilla Foundation reports:

-
-

MFSA 2016-16 Miscellaneous memory safety hazards (rv:45.0 - / rv:38.7)

-

MFSA 2016-17 Local file overwriting and potential - privilege escalation through CSP reports

-

MFSA 2016-18 CSP reports fail to strip location - information for embedded iframe pages

-

MFSA 2016-19 Linux video memory DOS with Intel - drivers

-

MFSA 2016-20 Memory leak in libstagefright when deleting - an array during MP4 processing

-

MFSA 2016-21 Displayed page address can be overridden

-

MFSA 2016-22 Service Worker Manager out-of-bounds read in - Service Worker Manager

-

MFSA 2016-23 Use-after-free in HTML5 string parser

-

MFSA 2016-24 Use-after-free in SetBody

-

MFSA 2016-25 Use-after-free when using multiple WebRTC - data channels

-

MFSA 2016-26 Memory corruption when modifying a file - being read by FileReader

-

MFSA 2016-27 Use-after-free during XML - transformations

-

MFSA 2016-28 Addressbar spoofing though history - navigation and Location protocol property

-

MFSA 2016-29 Same-origin policy violation using - perfomance.getEntries and history navigation with session - restore

-

MFSA 2016-31 Memory corruption with malicious NPAPI - plugin

-

MFSA 2016-32 WebRTC and LibVPX vulnerabilities found - through code inspection

-

MFSA 2016-33 Use-after-free in GetStaticInstance in - WebRTC

-

MFSA 2016-34 Out-of-bounds read in HTML parser following - a failed allocation

-
- - - - CVE-2016-1952 - CVE-2016-1953 - CVE-2016-1954 - CVE-2016-1955 - CVE-2016-1956 - CVE-2016-1957 - CVE-2016-1958 - CVE-2016-1959 - CVE-2016-1960 - CVE-2016-1961 - CVE-2016-1962 - CVE-2016-1963 - CVE-2016-1964 - CVE-2016-1965 - CVE-2016-1966 - CVE-2016-1967 - CVE-2016-1970 - CVE-2016-1971 - CVE-2016-1972 - CVE-2016-1973 - CVE-2016-1974 - CVE-2016-1975 - CVE-2016-1976 - https://www.mozilla.org/security/advisories/mfsa2016-16/ - https://www.mozilla.org/security/advisories/mfsa2016-17/ - https://www.mozilla.org/security/advisories/mfsa2016-18/ - https://www.mozilla.org/security/advisories/mfsa2016-19/ - https://www.mozilla.org/security/advisories/mfsa2016-20/ - https://www.mozilla.org/security/advisories/mfsa2016-21/ - https://www.mozilla.org/security/advisories/mfsa2016-22/ - https://www.mozilla.org/security/advisories/mfsa2016-23/ - https://www.mozilla.org/security/advisories/mfsa2016-24/ - https://www.mozilla.org/security/advisories/mfsa2016-25/ - https://www.mozilla.org/security/advisories/mfsa2016-26/ - https://www.mozilla.org/security/advisories/mfsa2016-27/ - https://www.mozilla.org/security/advisories/mfsa2016-28/ - https://www.mozilla.org/security/advisories/mfsa2016-29/ - https://www.mozilla.org/security/advisories/mfsa2016-31/ - https://www.mozilla.org/security/advisories/mfsa2016-32/ - https://www.mozilla.org/security/advisories/mfsa2016-33/ - https://www.mozilla.org/security/advisories/mfsa2016-34/ - - - 2016-03-08 - 2016-03-08 - 2016-03-08 - - - - - graphite2 -- multiple vulnerabilities - - - graphite2 - 1.3.6 - - - linux-firefox - 45.0,1 - - - linux-thunderbird - 38.7.0 - - - linux-seamonkey - 2.42 - - - - -

Mozilla Foundation reports:

-
-

Security researcher Holger Fuhrmannek and Mozilla - security engineer Tyson Smith reported a number of security - vulnerabilities in the Graphite 2 library affecting version - 1.3.5. - - The issue reported by Holger Fuhrmannek is a mechanism to - induce stack corruption with a malicious graphite font. This - leads to a potentially exploitable crash when the font is - loaded. - - Tyson Smith used the Address Sanitizer tool in concert with - a custom software fuzzer to find a series of uninitialized - memory, out-of-bounds read, and out-of-bounds write errors - when working with fuzzed graphite fonts.

-
-
-

Security researcher James Clawson used the Address - Sanitizer tool to discover an out-of-bounds write in the - Graphite 2 library when loading a crafted Graphite font - file. This results in a potentially exploitable crash.

-
- - - - https://www.mozilla.org/security/advisories/mfsa2016-37/ - https://www.mozilla.org/security/advisories/mfsa2016-38/ - CVE-2016-1969 - CVE-2016-1977 - CVE-2016-2790 - CVE-2016-2791 - CVE-2016-2792 - CVE-2016-2793 - CVE-2016-2794 - CVE-2016-2795 - CVE-2016-2796 - CVE-2016-2797 - CVE-2016-2798 - CVE-2016-2799 - CVE-2016-2800 - CVE-2016-2801 - CVE-2016-2802 - - - 2016-03-08 - 2016-03-08 - 2016-03-14 - - - - - NSS -- multiple vulnerabilities - - - nss - 3.203.21.1 - 3.19.2.3 - - - linux-c6-nss - 3.203.21.0_1 - 3.19.2.3 - - - linux-firefox - 45.0,1 - - - linux-thunderbird - 38.7.0 - - - linux-seamonkey - 2.42 - - - - -

Mozilla Foundation reports:

-
-

Security researcher Francis Gabriel reported a heap-based - buffer overflow in the way the Network Security Services - (NSS) libraries parsed certain ASN.1 structures. An attacker - could create a specially-crafted certificate which, when - parsed by NSS, would cause it to crash or execute arbitrary - code with the permissions of the user.

-
-
-

Mozilla developer Tim Taubert used the Address Sanitizer - tool and software fuzzing to discover a use-after-free - vulnerability while processing DER encoded keys in the - Network Security Services (NSS) libraries. The vulnerability - overwrites the freed memory with zeroes.

-
- - - - CVE-2016-1950 - CVE-2016-1979 - https://www.mozilla.org/security/advisories/mfsa2016-35/ - https://www.mozilla.org/security/advisories/mfsa2016-36/ - https://hg.mozilla.org/projects/nss/rev/b9a31471759d - https://hg.mozilla.org/projects/nss/rev/7033b1193c94 - - - 2016-03-08 - 2016-03-08 - 2016-09-05 - - - - - NSS -- multiple vulnerabilities - - - nss - linux-c6-nss - 3.21 - - - linux-firefox - 44.0,1 - - - linux-seamonkey - 2.41 - - - - -

Mozilla Foundation reports:

-
-

Security researcher Hanno Böck reported that calculations - with mp_div and mp_exptmod in Network Security Services - (NSS) can produce wrong results in some circumstances. These - functions are used within NSS for a variety of cryptographic - division functions, leading to potential cryptographic - weaknesses.

-
-
-

Mozilla developer Eric Rescorla reported that a failed - allocation during DHE and ECDHE handshakes would lead to a - use-after-free vulnerability.

-
- - - - CVE-2016-1938 - CVE-2016-1978 - https://www.mozilla.org/security/advisories/mfsa2016-07/ - https://www.mozilla.org/security/advisories/mfsa2016-15/ - https://hg.mozilla.org/projects/nss/rev/a555bf0fc23a - https://hg.mozilla.org/projects/nss/rev/a245a4ccd354 - - - 2016-01-26 - 2016-03-08 - - - - - django -- multiple vulnerabilities - - - py27-django - py32-django - py33-django - py34-django - py35-django - 1.8.10 - - - py27-django18 - py32-django18 - py33-django18 - py34-django18 - py35-django18 - 1.8.10 - - - py27-django19 - py32-django19 - py33-django19 - py34-django19 - py35-django19 - 1.9.3 - - - py27-django-devel - py32-django-devel - py33-django-devel - py34-django-devel - py35-django-devel - 20150709,1 - - - - -

Tim Graham reports:

-
-

Malicious redirect and possible XSS attack via user-supplied - redirect URLs containing basic auth

-

User enumeration through timing difference on password hasher work - factor upgrade

-
- - - - CVE-2016-2512 - CVE-2016-2513 - https://www.djangoproject.com/weblog/2016/mar/01/security-releases/ - - - 2016-03-01 - 2016-03-08 - - - - - wordpress -- multiple vulnerabilities - - - wordpress - 4.4.2,1 - - - de-wordpress - ja-wordpress - ru-wordpress - zh-wordpress-zh_CN - zh-wordpress-zh_TW - 4.4.2 - - - - -

Samuel Sidler reports:

-
-

WordPress 4.4.2 is now available. This is a security release for - all previous versions and we strongly encourage you to update your - sites immediately.

-

WordPress versions 4.4.1 and earlier are affected by two security - issues: a possible SSRF for certain local URIs, reported by Ronni - Skansing; and an open redirection attack, reported by Shailesh - Suthar.

-
- - - - CVE-2016-2221 - CVE-2016-2222 - http://www.openwall.com/lists/oss-security/2016/02/04/6 - https://wordpress.org/news/2016/02/wordpress-4-4-2-security-and-maintenance-release/ - - - 2016-02-02 - 2016-03-08 - - - - - PuTTY - old-style scp downloads may allow remote code execution - - - putty - 0.67 - - - - -

Simon G. Tatham reports:

-
-

Many versions of PSCP prior to 0.67 have a stack corruption - vulnerability in their treatment of the 'sink' direction (i.e. - downloading from server to client) of the old-style SCP protocol. -

-

In order for this vulnerability to be exploited, the user must - connect to a malicious server and attempt to download any file.[...] - you can work around it in a vulnerable PSCP by using the -sftp - option to force the use of the newer SFTP protocol, provided your - server supports that protocol.

-
- - - - http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-pscp-sink-sscanf.html - CVE-2016-2563 - https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-2563 - - - 2016-02-26 - 2016-03-07 - - - - - websvn -- reflected cross-site scripting - - - websvn - 2.3.3_1 - - - - -

Sebastien Delafond reports:

-
-

Jakub Palaczynski discovered that websvn, a web viewer for - Subversion repositories, does not correctly sanitize user-supplied - input, which allows a remote user to run reflected cross-site - scripting attacks.

-
- - - - CVE-2016-2511 - https://lists.debian.org/debian-security-announce/2016/msg00060.html - http://seclists.org/fulldisclosure/2016/Feb/99 - - - 2016-02-22 - 2016-03-06 - - - - - websvn -- information disclosure - - - websvn - 2.3.3_1 - - - - -

Thijs Kinkhorst reports:

-
-

James Clawson reported:

-

"Arbitrary files with a known path can be accessed in websvn by - committing a symlink to a repository and then downloading the file - (using the download link).

-

An attacker must have write access to the repo, and the download - option must have been enabled in the websvn config file."

-
- - - - CVE-2013-6892 - https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-6892 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775682 - - - 2015-01-18 - 2016-03-06 - - - - - rails -- multiple vulnerabilities - - - rubygem-actionpack - 3.2.22.2 - - - rubygem-actionpack4 - 4.2.5.2 - - - rubygem-actionview - 4.2.5.2 - - - rubygem-rails - 3.2.22.2 - - - rubygem-rails4 - 4.2.5.2 - - - - -

Ruby on Rails blog:

-
-

Rails 4.2.5.2, 4.1.14.2, and 3.2.22.2 have been released! These - contain the following important security fixes, and it is - recommended that users upgrade as soon as possible.

-
- - - - CVE-2016-2097 - CVE-2016-2098 - https://groups.google.com/d/msg/rubyonrails-security/ddY6HgqB2z4/we0RasMZIAAJ - https://groups.google.com/d/msg/rubyonrails-security/ly-IH-fxr_Q/WLoOhcMZIAAJ - http://weblog.rubyonrails.org/2016/2/29/Rails-4-2-5-2-4-1-14-2-3-2-22-2-have-been-released/ - - - 2016-02-29 - 2016-03-06 - - - - - chromium -- multiple vulnerabilities - - - chromium - chromium-npapi - chromium-pulse - 49.0.2623.75 - - - - -

Google Chrome Releases reports:

-
-

[560011] High CVE-2016-1630: Same-origin bypass in Blink.

-

[569496] High CVE-2016-1631: Same-origin bypass in Pepper Plugin.

-

[549986] High CVE-2016-1632: Bad cast in Extensions.

-

[572537] High CVE-2016-1633: Use-after-free in Blink.

-

[559292] High CVE-2016-1634: Use-after-free in Blink.

-

[585268] High CVE-2016-1635: Use-after-free in Blink.

-

[584155] High CVE-2016-1636: SRI Validation Bypass.

-

[555544] Medium CVE-2016-1637: Information Leak in Skia.

-

[585282] Medium CVE-2016-1638: WebAPI Bypass.

-

[572224] Medium CVE-2016-1639: Use-after-free in WebRTC.

-

[550047] Medium CVE-2016-1640: Origin confusion in Extensions UI.

-

[583718] Medium CVE-2016-1641: Use-after-free in Favicon.

-

[591402] CVE-2016-1642: Various fixes from internal audits, fuzzing and other initiatives.

-

Multiple vulnerabilities in V8 fixed.

-
- - - - CVE-2016-1630 - CVE-2016-1631 - CVE-2016-1632 - CVE-2016-1633 - CVE-2016-1634 - CVE-2016-1635 - CVE-2016-1636 - CVE-2016-1637 - CVE-2016-1638 - CVE-2016-1639 - CVE-2016-1640 - CVE-2016-1641 - CVE-2016-1642 - http://googlechromereleases.blogspot.de/2016/03/stable-channel-update.html - - - 2016-03-02 - 2016-03-05 - - - - - libssh -- weak Diffie-Hellman secret generation - - - libssh - 0.7.3 - - - - -

Andreas Schneider reports:

-
-

libssh versions 0.1 and above have a bits/bytes confusion bug and - generate an abnormally short ephemeral secret for the - diffie-hellman-group1 and diffie-hellman-group14 key exchange - methods. The resulting secret is 128 bits long, instead of the - recommended sizes of 1024 and 2048 bits respectively. There are - practical algorithms (Baby steps/Giant steps, Pollard’s rho) that can - solve this problem in O(2^63) operations.

-

Both client and server are are vulnerable, pre-authentication. - This vulnerability could be exploited by an eavesdropper with enough - resources to decrypt or intercept SSH sessions. The bug was found - during an internal code review by Aris Adamantiadis of the libssh - team.

-
- - - - CVE-2016-0739 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-0739 - https://www.libssh.org/2016/02/23/libssh-0-7-3-security-and-bugfix-release/ - - - 2016-02-23 - 2016-03-05 - - - - - exim -- local privillege escalation - - - exim - 4.86.2 - 4.85.2 - 4.84.2 - - - - -

The Exim development team reports:

-
-

All installations having Exim set-uid root and using 'perl_startup' are - vulnerable to a local privilege escalation. Any user who can start an - instance of Exim (and this is normally any user) can gain root - privileges. If you do not use 'perl_startup' you should be safe.

-
- - - - CVE-2016-1531 - https://lists.exim.org/lurker/message/20160302.191005.a72d8433.en.html - - - 2016-02-26 - 2016-03-02 - - - - - cacti -- multiple vulnerabilities - - - cacti - 0.8.8g - - - - -

The Cacti Group, Inc. reports:

-
-

Changelog

-
    -
  • bug:0002652: CVE-2015-8604: SQL injection in graphs_new.php
    • -
  • bug:0002655: CVE-2015-8377: SQL injection vulnerability in the - host_new_graphs_save function in graphs_new.php
    • -
  • bug:0002656: Authentication using web authentication as a user - not in the cacti database allows complete access
    • -
-
- - - - CVE-2015-8377 - CVE-2015-8604 - CVE-2016-2313 - http://www.cacti.net/release_notes_0_8_8g.php - http://bugs.cacti.net/view.php?id=2652 - http://bugs.cacti.net/view.php?id=2655 - http://bugs.cacti.net/view.php?id=2656 - http://www.openwall.com/lists/oss-security/2016/02/09/3 - - - 2016-02-21 - 2016-03-02 - - - - - phpmyadmin -- multiple XSS and a man-in-the-middle vulnerability - - - phpmyadmin - 4.5.04.5.5.1 - - - - -

The phpMyAdmin development team reports:

-
-

XSS vulnerability in SQL parser.

-

Using a crafted SQL query, it is possible to trigger an XSS - attack through the SQL query page.

-

We consider this vulnerability to be non-critical.

-
-
-

Multiple XSS vulnerabilities.

-

By sending a specially crafted URL as part of the HOST - header, it is possible to trigger an XSS attack.

-

A weakness was found that allows an XSS attack with Internet - Explorer versions older than 8 and Safari on Windows using a - specially crafted URL.

-

Using a crafted SQL query, it is possible to trigger an XSS - attack through the SQL query page.

-

Using a crafted parameter value, it is possible to trigger - an XSS attack in user accounts page.

-

Using a crafted parameter value, it is possible to trigger - an XSS attack in zoom search page.

-

We consider this vulnerability to be non-critical.

-
-
-

Multiple XSS vulnerabilities.

-

With a crafted table/column name it is possible to trigger - an XSS attack in the database normalization page.

-

With a crafted parameter it is possible to trigger an XSS - attack in the database structure page.

-

With a crafted parameter it is possible to trigger an XSS - attack in central columns page.

-

We consider this vulnerability to be non-critical.

-
-
-

Vulnerability allowing man-in-the-middle attack on API - call to GitHub.

-

A vulnerability in the API call to GitHub can be exploited - to perform a man-in-the-middle attack.

-

We consider this vulnerability to be serious.

-
- - - - https://www.phpmyadmin.net/security/PMASA-2016-10/ - https://www.phpmyadmin.net/security/PMASA-2016-11/ - https://www.phpmyadmin.net/security/PMASA-2016-12/ - https://www.phpmyadmin.net/security/PMASA-2016-13/ - CVE-2016-2559 - CVE-2016-2560 - CVE-2016-2561 - CVE-2016-2562 - - - 2016-02-29 - 2016-03-01 - - - - - wireshark -- multiple vulnerabilities - - - wireshark - wireshark-lite - wireshark-qt5 - tshark - tshark-lite - 2.0.2 - - - - -

Wireshark development team reports:

-
-

The following vulnerabilities have been fixed:

-
    -

  • wnpa-sec-2016-02

    -

    ASN.1 BER dissector crash. (Bug 11828) CVE-2016-2522

    • -

  • wnpa-sec-2016-03

    -

    DNP dissector infinite loop. (Bug 11938) CVE-2016-2523

    • -

  • wnpa-sec-2016-04

    -

    X.509AF dissector crash. (Bug 12002) CVE-2016-2524

    • -

  • wnpa-sec-2016-05

    -

    HTTP/2 dissector crash. (Bug 12077) CVE-2016-2525

    • -

  • wnpa-sec-2016-06

    -

    HiQnet dissector crash. (Bug 11983) CVE-2016-2526

    • -

  • wnpa-sec-2016-07

    -

    3GPP TS 32.423 Trace file parser crash. (Bug 11982) -

    CVE-2016-2527
    • -

  • wnpa-sec-2016-08

    -

    LBMC dissector crash. (Bug 11984) CVE-2016-2528

    • -

  • wnpa-sec-2016-09

    -

    iSeries file parser crash. (Bug 11985) CVE-2016-2529

    • -

  • wnpa-sec-2016-10

    -

    RSL dissector crash. (Bug 11829) CVE-2016-2530 - CVE-2016-2531

    • -

  • wnpa-sec-2016-11

    -

    LLRP dissector crash. (Bug 12048) CVE-2016-2532

    • -

  • wnpa-sec-2016-12

    -

    Ixia IxVeriWave file parser crash. (Bug 11795)

    • -

  • wnpa-sec-2016-13

    -

    IEEE 802.11 dissector crash. (Bug 11818)

    • -

  • wnpa-sec-2016-14

    -

    GSM A-bis OML dissector crash. (Bug 11825)

    • -

  • wnpa-sec-2016-15

    -

    ASN.1 BER dissector crash. (Bug 12106)

    • -

  • wnpa-sec-2016-16

    -

    SPICE dissector large loop. (Bug 12151)

    • -

  • wnpa-sec-2016-17

    -

    NFS dissector crash.

    • -

  • wnpa-sec-2016-18

    -

    ASN.1 BER dissector crash. (Bug 11822)

    • -
-
- - - - CVE-2016-2522 - CVE-2016-2523 - CVE-2016-2524 - CVE-2016-2525 - CVE-2016-2526 - CVE-2016-2527 - CVE-2016-2528 - CVE-2016-2529 - CVE-2016-2530 - CVE-2016-2531 - CVE-2016-2532 - CVE-2016-4415 - CVE-2016-4416 - CVE-2016-4417 - CVE-2016-4418 - CVE-2016-4419 - CVE-2016-4420 - CVE-2016-4421 - https://www.wireshark.org/docs/relnotes/wireshark-2.0.2.html - http://www.openwall.com/lists/oss-security/2016/05/01/1 - - - 2016-02-26 - 2016-03-01 - 2016-07-04 - - - - - wireshark -- multiple vulnerabilities - - - wireshark - wireshark-lite - wireshark-qt5 - tshark - tshark-lite - 2.0.1 - - - - -

Wireshark development team reports:

-
-

The following vulnerabilities have been fixed:

-
    -

  • wnpa-sec-2015-31

    -

    NBAP dissector crashes. (Bug 11602, Bug 11835, Bug 11841)

    -
    • -

  • wnpa-sec-2015-37

    -

    NLM dissector crash.

    • -

  • wnpa-sec-2015-39

    -

    BER dissector crash.

    • -

  • wnpa-sec-2015-40

    -

    Zlib decompression crash. (Bug 11548)

    • -

  • wnpa-sec-2015-41

    -

    SCTP dissector crash. (Bug 11767)

    • -

  • wnpa-sec-2015-42

    -

    802.11 decryption crash. (Bug 11790, Bug 11826)

    • -

  • wnpa-sec-2015-43

    -

    DIAMETER dissector crash. (Bug 11792)

    • -

  • wnpa-sec-2015-44

    -

    VeriWave file parser crashes. (Bug 11789, Bug 11791)

    • -

  • wnpa-sec-2015-45

    -

    RSVP dissector crash. (Bug 11793)

    • -

  • wnpa-sec-2015-46

    -

    ANSI A and GSM A dissector crashes. (Bug 11797)

    • -

  • wnpa-sec-2015-47

    -

    Ascend file parser crash. (Bug 11794)

    • -

  • wnpa-sec-2015-48

    -

    NBAP dissector crash. (Bug 11815)

    • -

  • wnpa-sec-2015-49

    -

    RSL dissector crash. (Bug 11829)

    • -

  • wnpa-sec-2015-50

    -

    ZigBee ZCL dissector crash. (Bug 11830)

    • -

  • wnpa-sec-2015-51

    -

    Sniffer file parser crash. (Bug 11827)

    • -

  • wnpa-sec-2015-52

    -

    NWP dissector crash. (Bug 11726)

    • -

  • wnpa-sec-2015-53

    -

    BT ATT dissector crash. (Bug 11817)

    • -

  • wnpa-sec-2015-54

    -

    MP2T file parser crash. (Bug 11820)

    • -

  • wnpa-sec-2015-55

    -

    MP2T file parser crash. (Bug 11821)

    • -

  • wnpa-sec-2015-56

    -

    S7COMM dissector crash. (Bug 11823)

    • -

  • wnpa-sec-2015-57

    -

    IPMI dissector crash. (Bug 11831)

    • -

  • wnpa-sec-2015-58

    -

    TDS dissector crash. (Bug 11846)

    • -

  • wnpa-sec-2015-59

    -

    PPI dissector crash. (Bug 11876)

    • -

  • wnpa-sec-2015-60

    -

    MS-WSP dissector crash. (Bug 11931)

    • -
-
- - - - https://www.wireshark.org/docs/relnotes/wireshark-2.0.1.html - - - 2015-12-29 - 2016-03-01 - - - - - tomcat -- multiple vulnerabilities - - - tomcat7 - 7.0.68 - - - tomcat8 - 8.0.30 - - - - -

Mark Thomas reports:

-
-
    -

  • CVE-2015-5346 Apache Tomcat Session fixation

    • -

  • CVE-2015-5351 Apache Tomcat CSRF token leak

    • -

  • CVE-2016-0763 Apache Tomcat Security Manager Bypass

    • -
-
- - - - http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEF96.7070701@apache.org%3e - http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEF7B.1010901@apache.org%3e - http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEFB2.9030605@apache.org%3e - CVE-2015-5346 - CVE-2015-5351 - CVE-2016-0763 - - - 2016-02-22 - 2016-02-28 - - - - - tomcat -- multiple vulnerabilities - - - tomcat - 6.0.45 - - - tomcat7 - 7.0.68 - - - tomcat8 - 8.0.30 - - - - -

Mark Thomas reports:

-
-
    -

  • CVE-2015-5345 Apache Tomcat Directory disclosure

    • -

  • CVE-2016-0706 Apache Tomcat Security Manager bypass

    • -

  • CVE-2016-0714 Apache Tomcat Security Manager Bypass

    • -
-
- - - - http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEF96.7070701@apache.org%3e - http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEF6A.70703@apache.org%3e - http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEF4F.5090003@apache.org%3e - CVE-2015-5345 - CVE-2015-5346 - CVE-2016-0706 - CVE-2016-0714 - - - 2016-02-22 - 2016-02-28 - 2017-03-18 - - - - - xerces-c3 -- Parser Crashes on Malformed Input - - - xerces-c3 - 3.1.3 - - - - -

The Apache Software Foundation reports:

-
-

The Xerces-C XML parser mishandles certain kinds of malformed input - documents, resulting in buffer overflows during processing and error - reporting. The overflows can manifest as a segmentation fault or as - memory corruption during a parse operation. The bugs allow for a - denial of service attack in many applications by an unauthenticated - attacker, and could conceivably result in remote code execution.

-
- - - - CVE-2016-0729 - http://xerces.apache.org/xerces-c/secadv/CVE-2016-0729.txt - - - 2016-02-25 - 2016-02-28 - - - - - django -- regression in permissions model - - - py27-django19 - py33-django19 - py34-django19 - py35-django19 - 1.9.2 - - - py27-django-devel - py33-django-devel - py34-django-devel - py35-django-devel - 20150709,1 - - - - -

Tim Graham reports:

-
-

User with "change" but not "add" permission can create - objects for ModelAdmin’s with save_as=True

-
- - - - https://www.djangoproject.com/weblog/2016/feb/01/releases-192-and-189/ - CVE-2016-2048 - - - 2016-02-01 - 2016-02-28 - - - - - xen-kernel -- VMX: guest user mode may crash guest with non-canonical RIP - - - xen-kernel - 4.5.2_2 - - - - -

The Xen Project reports:

-
-

VMX refuses attempts to enter a guest with an instruction pointer - which doesn't satisfy certain requirements. In particular, the - instruction pointer needs to be canonical when entering a guest - currently in 64-bit mode. This is the case even if the VM entry - information specifies an exception to be injected immediately (in - which case the bad instruction pointer would possibly never get used - for other than pushing onto the exception handler's stack). - Provided the guest OS allows user mode to map the virtual memory - space immediately below the canonical/non-canonical address - boundary, a non-canonical instruction pointer can result even from - normal user mode execution. VM entry failure, however, is fatal to - the guest.

-

Malicious HVM guest user mode code may be able to crash the - guest.

-
- - - - CVE-2016-2271 - http://xenbits.xen.org/xsa/advisory-170.html - - - 2016-02-17 - 2016-02-28 - - - - - xen-kernel -- VMX: intercept issue with INVLPG on non-canonical address - - - xen-kernel - 3.34.5.2_2 - - - - -

The Xen Project reports:

-
-

While INVLPG does not cause a General Protection Fault when used on - a non-canonical address, INVVPID in its "individual address" - variant, which is used to back the intercepted INVLPG in certain - cases, fails in such cases. Failure of INVVPID results in a - hypervisor bug check.

-

A malicious guest can crash the host, leading to a Denial of - Service.

-
- - - - CVE-2016-1571 - http://xenbits.xen.org/xsa/advisory-168.html - - - 2016-01-20 - 2016-02-28 - - - - - xen-kernel -- PV superpage functionality missing sanity checks - - - xen-kernel - 3.4.0 - 3.4.1 - 4.14.5.2_2 - - - - -

The Xen Project reports:

-
-

The PV superpage functionality lacks certain validity checks on - data being passed to the hypervisor by guests. This is the case - for the page identifier (MFN) passed to MMUEXT_MARK_SUPER and - MMUEXT_UNMARK_SUPER sub-ops of the HYPERVISOR_mmuext_op hypercall as - well as for various forms of page table updates.

-

Use of the feature, which is disabled by default, may have unknown - effects, ranging from information leaks through Denial of Service to - privilege escalation.

-
- - - - CVE-2016-1570 - http://xenbits.xen.org/xsa/advisory-167.html - - - 2016-01-20 - 2016-02-28 - - - - - moodle -- multiple vulnerabilities - - - moodle28 - 2.8.10 - - - moodle29 - 2.9.4 - - - moodle30 - 3.0.2 - - - - -

Marina Glancy reports:

-
-
    -

  • MSA-16-0001: Two enrolment-related web services don't - check course visibility

    • -

  • MSA-16-0002: XSS Vulnerability in course management - search

    • -
-
- - - - https://moodle.org/security/ - CVE-2016-0724 - CVE-2016-0725 - - - 2016-01-18 - 2016-02-28 - - - - - pitivi -- code execution - - - pitivi - 0.95 - - - - -

Luke Farone reports:

-
-

Double-clicking a file in the user's media library with a - specially-crafted path or filename allows for arbitrary code execution - with the permissions of the user running Pitivi.

-
- - - - http://www.openwall.com/lists/oss-security/2015/12/23/8 - https://git.gnome.org/browse/pitivi/commit/?id=45a4c84edb3b4343f199bba1c65502e3f49f5bb2 - CVE-2015-0855 - - - 2015-09-13 - 2016-02-26 - - - - - giflib -- heap overflow - - - giflib - 5.1.2 - - - - -

Hans Jerry Illikainen reports:

-
-

A heap overflow may occur in the giffix utility included in - giflib-5.1.1 when processing records of the type - `IMAGE_DESC_RECORD_TYPE' due to the allocated size of `LineBuffer' - equaling the value of the logical screen width, `GifFileIn->SWidth', - while subsequently having `GifFileIn->Image.Width' bytes of data written - to it.

-
- - - - http://seclists.org/bugtraq/2015/Dec/114 - CVE-2015-7555 - - - 2015-12-21 - 2016-02-26 - - - - - drupal -- multiple vulnerabilities - - - drupal6 - 6.38 - - - drupal7 - 7.43 - - - drupal8 - 8.0.4 - - - - -

Drupal Security Team reports:

-
-
    -

  • File upload access bypass and denial of service (File - module - Drupal 7 and 8 - Moderately Critical)

    • -

  • Brute force amplification attacks via XML-RPC (XML-RPC - server - Drupal 6 and 7 - Moderately Critical)

    • -

  • Open redirect via path manipulation (Base system - - Drupal 6, 7 and 8 - Moderately Critical)

    • -

  • Form API ignores access restrictions on submit buttons - (Form API - Drupal 6 - Critical)

    • -

  • HTTP header injection using line breaks (Base system - - Drupal 6 - Moderately Critical)

    • -

  • Open redirect via double-encoded 'destination' - parameter (Base system - Drupal 6 - Moderately Critical)

    • -

  • Reflected file download vulnerability (System module - - Drupal 6 and 7 - Moderately Critical)

    • -

  • Saving user accounts can sometimes grant the user all - roles (User module - Drupal 6 and 7 - Less Critical)

    • -

  • Email address can be matched to an account (User module - - Drupal 7 and 8 - Less Critical)

    • -

  • Session data truncation can lead to unserialization of - user provided data (Base system - Drupal 6 - Less Critical)

    • -
-
- - - - https://www.drupal.org/SA-CORE-2016-001 - - - 2016-02-24 - 2016-02-25 - - - - - jenkins -- multiple vulnerabilities - - - jenkins - 1.650 - - - jenkins-lts - 1.642.2 - - - - -

Jenkins Security Advisory:

-
-

Description

-
SECURITY-232 / CVE-2016-0788(Remote code execution vulnerability in remoting module)
-

A vulnerability in the Jenkins remoting module allowed - unauthenticated remote attackers to open a JRMP listener on the - server hosting the Jenkins master process, which allowed arbitrary - code execution.

-
SECURITY-238 / CVE-2016-0789(HTTP response splitting vulnerability)
-

An HTTP response splitting vulnerability in the CLI command - documentation allowed attackers to craft Jenkins URLs that serve - malicious content.

-
SECURITY-241 / CVE-2016-0790(Non-constant time comparison of API token)
-

The verification of user-provided API tokens with the expected - value did not use a constant-time comparison algorithm, potentially - allowing attackers to use statistical methods to determine valid - API tokens using brute-force methods.

-
SECURITY-245 / CVE-2016-0791(Non-constant time comparison of CSRF crumbs)
-

The verification of user-provided CSRF crumbs with the expected - value did not use a constant-time comparison algorithm, potentially - allowing attackers to use statistical methods to determine valid - CSRF crumbs using brute-force methods.

-
SECURITY-247 / CVE-2016-0792(Remote code execution through remote API)
-

Jenkins has several API endpoints that allow low-privilege users - to POST XML files that then get deserialized by Jenkins. - Maliciously crafted XML files sent to these API endpoints could - result in arbitrary code execution.

-
- - - - https://wiki.jenkins-ci.org/display/SECURITY/Security+Advisory+2016-02-24 - - - 2016-02-24 - 2016-02-25 - - - - - squid -- remote DoS in HTTP response processing - - - squid - 3.5.15 - - - - -

Squid security advisory 2016:2 reports:

-
-

Due to incorrect bounds checking Squid is vulnerable to a denial - of service attack when processing HTTP responses.

-

These problems allow remote servers delivering certain unusual - HTTP response syntax to trigger a denial of service for all - clients accessing the Squid service.

-

HTTP responses containing malformed headers that trigger this - issue are becoming common. We are not certain at this time if - that is a sign of malware or just broken server scripting.

-
- - - - CVE-2016-2569 - CVE-2016-2570 - CVE-2016-2571 - ports/207454 - http://www.squid-cache.org/Advisories/SQUID-2016_2.txt - http://www.openwall.com/lists/oss-security/2016/02/24/12 - - - 2016-02-24 - 2016-02-24 - 2016-02-28 - - - - - bsh -- remote code execution vulnerability - - - bsh - 2.0.b6 - - - - -

Stian Soiland-Reyes reports:

-
-

This release fixes a remote code execution vulnerability that was - identified in BeanShell by Alvaro Muñoz and Christian Schneider. - The BeanShell team would like to thank them for their help and - contributions to this fix!

-

An application that includes BeanShell on the classpath may be - vulnerable if another part of the application uses Java - serialization or XStream to deserialize data from an untrusted - source.

-

A vulnerable application could be exploited for remote code - execution, including executing arbitrary shell commands.

-

This update fixes the vulnerability in BeanShell, but it is worth - noting that applications doing such deserialization might still be - insecure through other libraries. It is recommended that application - developers take further measures such as using a restricted class - loader when deserializing. See notes on Java serialization security - XStream security and How to secure deserialization from untrusted - input without using encryption or sealing.

-
- - - - CVE-2016-2510 - ports/207334 - https://github.com/beanshell/beanshell/releases/tag/2.0b6 - - - 2016-02-18 - 2016-02-21 - - - - - libsrtp -- DoS via crafted RTP header vulnerability - - - libsrtp - 1.5.3 - - - - -

libsrtp reports:

-
-

Prevent potential DoS attack due to lack of bounds checking on RTP - header CSRC count and extension header length. Credit goes to - Randell Jesup and the Firefox team for reporting this issue.

-
- - - - CVE-2015-6360 - ports/207003 - https://github.com/cisco/libsrtp/releases/tag/v1.5.3 - https://github.com/cisco/libsrtp/commit/704a31774db0dd941094fd2b47c21638b8dc3de2 - https://github.com/cisco/libsrtp/commit/be95365fbb4788b688cab7af61c65b7989055fb4 - https://github.com/cisco/libsrtp/commit/be06686c8e98cc7bd934e10abb6f5e971d03f8ee - https://github.com/cisco/libsrtp/commit/cdc69f2acde796a4152a250f869271298abc233f - - - 2015-11-02 - 2016-02-21 - - - - - jasper -- multiple vulnerabilities - - - jasper - 1.900.1_16 - - - - -

oCERT reports:

-
-

The library is affected by a double-free vulnerability in function - jas_iccattrval_destroy() - as well as a heap-based buffer overflow in function jp2_decode(). - A specially crafted jp2 file can be used to trigger the vulnerabilities.

-
-

oCERT reports:

-
-

The library is affected by an off-by-one error in a buffer boundary check - in jpc_dec_process_sot(), leading to a heap based buffer overflow, as well - as multiple unrestricted stack memory use issues in jpc_qmfb.c, leading to - stack overflow. - A specially crafted jp2 file can be used to trigger the vulnerabilities.

-
-

oCERT reports:

-
-

Multiple off-by-one flaws, leading to heap-based buffer overflows, were - found in the way JasPer decoded JPEG 2000 files. A specially crafted file - could cause an application using JasPer to crash or, - possibly, execute arbitrary code.

-
-

limingxing reports:

-
-

A vulnerability was found in the way the JasPer's jas_matrix_clip() - function parses certain JPEG 2000 image files. A specially crafted file - could cause an application using JasPer to crash.

-
- - - - http://www.ocert.org/advisories/ocert-2014-012.html - https://bugzilla.redhat.com/show_bug.cgi?id=1173157 - https://bugzilla.redhat.com/show_bug.cgi?id=1173162 - http://www.ocert.org/advisories/ocert-2015-001.html - https://bugzilla.redhat.com/show_bug.cgi?id=1179282 - http://www.ocert.org/advisories/ocert-2014-009.html - https://bugzilla.redhat.com/show_bug.cgi?id=1167537 - http://seclists.org/oss-sec/2016/q1/233 - https://bugzilla.redhat.com/show_bug.cgi?id=1302636 - CVE-2014-8137 - CVE-2014-8138 - CVE-2014-8157 - CVE-2014-8158 - CVE-2014-9029 - CVE-2016-2089 - - - 2014-12-10 - 2016-02-20 - 2016-02-24 - - - - - chromium -- same origin bypass - - - chromium - chromium-npapi - chromium-pulse - 48.0.2564.116 - - - - -

Google Chrome Releases reports:

-
-

[583431] Critical CVE-2016-1629: Same-origin bypass in Blink - and Sandbox escape in Chrome. Credit to anonymous.

-
- - - - CVE-2016-1629 - http://googlechromereleases.blogspot.nl/2016/02/stable-channel-update_18.html - - - 2016-02-18 - 2016-02-18 - - - - - glibc -- getaddrinfo stack-based buffer overflow - - - linux_base-c6 - linux_base-c6_64 - 6.7_1 - - - linux_base-f10 - 0 - - - - -

Fabio Olive Leite reports:

-
-

A stack-based buffer overflow was found in libresolv when invoked - from nss_dns, allowing specially crafted DNS responses to seize - control of EIP in the DNS client. The buffer overflow occurs in the - functions send_dg (send datagram) and send_vc (send TCP) for the - NSS module libnss_dns.so.2 when calling getaddrinfo with AF_UNSPEC - family, or in some cases AF_INET6 family. The use of AF_UNSPEC (or - AF_INET6 in some cases) triggers the low-level resolver code to - send out two parallel queries for A and AAAA. A mismanagement of - the buffers used for those queries could result in the response of - a query writing beyond the alloca allocated buffer created by - __res_nquery.

-
- - - - CVE-2015-7547 - ports/207272 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-7547 - https://blog.des.no/2016/02/freebsd-and-cve-2015-7547/ - https://googleonlinesecurity.blogspot.no/2016/02/cve-2015-7547-glibc-getaddrinfo-stack.html - https://sourceware.org/ml/libc-alpha/2016-02/msg00416.html - - - 2016-02-16 - 2016-02-18 - - - - - squid -- SSL/TLS processing remote DoS - - - squid - 3.5.133.5.14 - - - - -

Squid security advisory 2016:1 reports:

-
-

Due to incorrectly handling server errors Squid is vulnerable to a - denial of service attack when connecting to TLS or SSL servers.

-

This problem allows any trusted client to perform a denial of - service attack on the Squid service regardless of whether TLS or - SSL is configured for use in the proxy.

-

Misconfigured client or server software may trigger this issue - to perform a denial of service unintentionally.

-

However, the bug is exploitable only if Squid is built using the - --with-openssl option.

-
-

The FreeBSD port does not use SSL by default and is not vulnerable - in the default configuration.

- - - - CVE-2016-2390 - ports/207294 - http://www.squid-cache.org/Advisories/SQUID-2016_1.txt - - - 2016-02-16 - 2016-02-18 - - - - - adminer -- remote code execution - - - adminer - 4.2.4 - - - - -

Jakub Vrana reports:

-
-

Fix remote code execution in SQLite query

-
- - - - https://github.com/vrana/adminer/commit/e5352cc5acad21513bb02677e2021b80bf7e7b8b - - - 2016-02-06 - 2016-02-17 - - - - - adminer -- XSS vulnerability - - - adminer - 4.2.3 - - - - -

Jakub Vrana reports:

-
-

Fix XSS in indexes (non-MySQL only)

-
- - - - https://github.com/vrana/adminer/commit/4be0b6655e0bf415960659db2a6dd4e60eebbd66 - - - 2015-11-08 - 2016-02-17 - - - - - adminer -- XSS vulnerability - - - adminer - 4.2.2 - - - - -

Jakub Vrana reports:

-
-

Fix XSS in alter table

-
- - - - https://github.com/vrana/adminer/commit/596f8df373cd3efe5bcb6013858bd7a6bb5ecb2c - - - 2015-08-05 - 2016-02-17 - - - - - adminer -- XSS vulnerability - - - adminer - 4.2.0 - - - - -

Jakub Vrana reports:

-
-

Fix XSS in login form

-
- - - - https://github.com/vrana/adminer/commit/c990de3b3ee1816afb130bd0e1570577bf54a8e5 - https://sourceforge.net/p/adminer/bugs-and-features/436/ - - - 2015-01-30 - 2016-02-17 - - - - - libgcrypt -- side-channel attack on ECDH - - - libgcrypt - 1.6.5 - - - - -

GnuPG reports:

-
-

Mitigate side-channel attack on ECDH with Weierstrass curves.

-
- - - - CVE-2015-7511 - https://lists.gnupg.org/pipermail/gnupg-announce/2016q1/000384.html - - - 2016-02-09 - 2016-02-16 - - - - - xdelta3 -- buffer overflow vulnerability - - - xdelta3 - 3.0.9,1 - - - - -

Stepan Golosunov reports:

-
-

Buffer overflow was found and fixed in xdelta3 binary diff tool - that allows arbitrary code execution from input files at least on - some systems.

-
- - - - CVE-2014-9765 - http://www.openwall.com/lists/oss-security/2016/02/08/1 - https://github.com/jmacd/xdelta-devel/commit/ef93ff74203e030073b898c05e8b4860b5d09ef2 - - - 2014-10-08 - 2016-02-16 - - - - - firefox -- Same-origin-policy violation using Service Workers with plugins - - - firefox - 44.0.2,1 - - - linux-firefox - 44.0.2,1 - - - - -

The Mozilla Foundation reports:

-
-

MFSA 2016-13 Jason Pang of OneSignal reported that service workers intercept - responses to plugin network requests made through the browser. Plugins which - make security decisions based on the content of network requests can have these - decisions subverted if a service worker forges responses to those requests. For - example, a forged crossdomain.xml could allow a malicious site to violate the - same-origin policy using the Flash plugin.

-
- - - - CVE-2016-1949 - https://www.mozilla.org/en-US/security/advisories/mfsa2016-13/ - - - 2016-02-11 - 2016-02-15 - - - - - nghttp2 -- Out of memory in nghttpd, nghttp, and libnghttp2_asio - - - nghttp2 - 1.7.1 - - - - -

Nghttp2 reports:

-
-

Out of memory in nghttpd, nghttp, and libnghttp2_asio applications - due to unlimited incoming HTTP header fields.

-

nghttpd, nghttp, and libnghttp2_asio applications do not limit the memory usage - for the incoming HTTP header field. If peer sends specially crafted HTTP/2 - HEADERS frames and CONTINUATION frames, they will crash with out of memory - error.

-

Note that libnghttp2 itself is not affected by this vulnerability.

-
- - - - http://nghttp2.org/blog/2016/02/11/nghttp2-v1-7-1/ - CVE-2016-1544 - - - 2016-02-03 - 2016-02-13 - - - - - horde -- XSS vulnerabilities - - - horde - 5.2.9 - - - pear-Horde_Core - 2.22.6 - - - - -

The Horde Team reports:

-
-

Fixed XSS vulnerabilities in menu bar and form renderer.

-
- - - - CVE-2015-8807 - CVE-2016-2228 - https://github.com/horde/horde/commit/11d74fa5a22fe626c5e5a010b703cd46a136f253 - https://bugs.horde.org/ticket/14213 - https://github.com/horde/horde/commit/f03301cf6edcca57121a15e80014c4d0f29d99a0 - https://github.com/horde/horde/commit/ab07a1b447de34e13983b4d7ceb18b58c3a358d8 - http://www.openwall.com/lists/oss-security/2016/02/06/4 - http://lists.horde.org/archives/announce/2016/001149.html - - - 2016-02-02 - 2016-02-14 - - - - - PostgreSQL -- Security Fixes for Regular Expressions, PL/Java. - - - postgresql91-server - 9.1.09.1.20 - - - postgresql92-server - 9.2.09.2.15 - - - postgresql93-server - 9.3.09.3.11 - - - postgresql94-server - 9.4.09.4.6 - - - postgresql95-server - 9.5.09.5.1 - - - - -

PostgreSQL project reports:

-
-

- Security Fixes for Regular Expressions, PL/Java -

-
    -
  • CVE-2016-0773: This release closes security hole CVE-2016-0773, - an issue with regular expression (regex) parsing. Prior code allowed - users to pass in expressions which included out-of-range Unicode - characters, triggering a backend crash. This issue is critical for - PostgreSQL systems with untrusted users or which generate regexes - based on user input. -
    • -
  • CVE-2016-0766: The update also fixes CVE-2016-0766, a privilege - escalation issue for users of PL/Java. Certain custom configuration - settings (GUCS) for PL/Java will now be modifiable only by the - database superuser -
    • -
-
- - - - CVE-2016-0773 - CVE-2016-0766 - - - 2016-02-08 - 2016-02-12 - - - - - flash -- multiple vulnerabilities - - - linux-c6-flashplugin - linux-f10-flashplugin - linux-c6_64-flashplugin - 11.2r202.569 - - - - -

Adobe reports:

-
-

These updates resolve a type confusion vulnerability that - could lead to code execution (CVE-2016-0985).

-

These updates resolve use-after-free vulnerabilities that - could lead to code execution (CVE-2016-0973, CVE-2016-0974, - CVE-2016-0975, CVE-2016-0982, CVE-2016-0983, CVE-2016-0984).

-

These updates resolve a heap buffer overflow vulnerability - that could lead to code execution (CVE-2016-0971).

-

These updates resolve memory corruption vulnerabilities - that could lead to code execution (CVE-2016-0964, - CVE-2016-0965, CVE-2016-0966, CVE-2016-0967, CVE-2016-0968, - CVE-2016-0969, CVE-2016-0970, CVE-2016-0972, CVE-2016-0976, - CVE-2016-0977, CVE-2016-0978, CVE-2016-0979, CVE-2016-0980, - CVE-2016-0981).

-
- - - - CVE-2016-0964 - CVE-2016-0965 - CVE-2016-0966 - CVE-2016-0967 - CVE-2016-0968 - CVE-2016-0969 - CVE-2016-0970 - CVE-2016-0971 - CVE-2016-0972 - CVE-2016-0973 - CVE-2016-0974 - CVE-2016-0975 - CVE-2016-0976 - CVE-2016-0977 - CVE-2016-0978 - CVE-2016-0979 - CVE-2016-0980 - CVE-2016-0981 - CVE-2016-0982 - CVE-2016-0983 - CVE-2016-0984 - CVE-2016-0985 - https://helpx.adobe.com/security/products/flash-player/apsb16-04.html - - - 2016-02-09 - 2016-02-10 - - - - - dnscrypt-proxy -- code execution - - - dnscrypt-proxy - 1.1.01.6.1 - - - - -

Frank Denis reports:

-
-

Malformed packets could lead to denial of service or code - execution.

-
- - - - https://github.com/jedisct1/dnscrypt-proxy/blob/1d129f7d5f0d469308967cbe4eacb4a6919f1fa1/NEWS#L2-L8 - - - 2016-02-02 - 2016-02-10 - 2016-02-14 - - - - - chromium -- multiple vulnerabilities - - - chromium - chromium-npapi - chromium-pulse - 48.0.2564.109 - - - - -

Google Chrome Releases reports:

-
-

6 security fixes in this release, including:

-
    -
  • [546677] High CVE-2016-1622: Same-origin bypass in Extensions. - Credit to anonymous.
    • -
  • [577105] High CVE-2016-1623: Same-origin bypass in DOM. Credit - to Mariusz Mlynski.
    • -
  • [509313] Medium CVE-2016-1625: Navigation bypass in Chrome - Instant. Credit to Jann Horn.
    • -
  • [571480] Medium CVE-2016-1626: Out-of-bounds read in PDFium. - Credit to anonymous, working with HP's Zero Day Initiative.
    • -
  • [585517] CVE-2016-1627: Various fixes from internal audits, - fuzzing and other initiatives.
    • -
-
- - - - CVE-2016-1622 - CVE-2016-1623 - CVE-2016-1625 - CVE-2016-1626 - CVE-2016-1627 - http://googlechromereleases.blogspot.nl/2016/02/stable-channel-update_9.html - - - 2016-02-08 - 2016-02-09 - 2016-03-08 - - - - - graphite2 -- code execution vulnerability - - - graphite2 - 1.3.5 - - - silgraphite - 2.3.1_4 - - - linux-thunderbird - 38.6.0 - - - - -

Talos reports:

-
-
    -

  • An exploitable denial of service vulnerability exists - in the font handling of Libgraphite. A specially crafted font can cause - an out-of-bounds read potentially resulting in an information leak or - denial of service.

    • -

  • A specially crafted font can cause a buffer overflow - resulting in potential code execution.

    • -

  • An exploitable NULL pointer dereference exists in the - bidirectional font handling functionality of Libgraphite. A specially - crafted font can cause a NULL pointer dereference resulting in a - crash.

    • -
-
- - - - http://blog.talosintel.com/2016/02/vulnerability-spotlight-libgraphite.html - http://www.talosintel.com/reports/TALOS-2016-0061/ - https://www.mozilla.org/security/advisories/mfsa2016-14/ - CVE-2016-1521 - CVE-2016-1522 - CVE-2016-1523 - CVE-2016-1526 - - - 2016-02-05 - 2016-02-09 - 2016-03-08 - - - - - xymon-server -- multiple vulnerabilities - - - xymon-server - 4.3.25 - - - - -

J.C. Cleaver reports:

-
-
    -

  • CVE-2016-2054: Buffer overflow in xymond handling of - "config" command

    • -

  • CVE-2016-2055: Access to possibly confidential files - in the Xymon configuration directory

    • -

  • CVE-2016-2056: Shell command injection in the - "useradm" and "chpasswd" web applications

    • -

  • CVE-2016-2057: Incorrect permissions on IPC queues - used by the xymond daemon can bypass IP access filtering

    • -

  • CVE-2016-2058: Javascript injection in "detailed status - webpage" of monitoring items; XSS vulnerability via malformed - acknowledgment messages

    • -
-
- - - - http://lists.xymon.com/pipermail/xymon/2016-February/042986.html - CVE-2016-2054 - CVE-2016-2055 - CVE-2016-2056 - CVE-2016-2057 - CVE-2016-2058 - - - 2016-01-19 - 2016-02-09 - - - - - php -- multiple vulnerabilities - - - php55 - php55-phar - php55-wddx - 5.5.32 - - - php56 - php56-phar - php56-wddx - 5.6.18 - - - - -

PHP reports:

-
-
  • Core: -
      -
    • Fixed bug #71039 (exec functions ignore length but look for NULL - termination).
      • -
    • Fixed bug #71323 (Output of stream_get_meta_data can be - falsified by its input).
      • -
    • Fixed bug #71459 (Integer overflow in iptcembed()).
      • -
    • -
  • PCRE: -
      -
    • Upgraded bundled PCRE library to 8.38.(CVE-2015-8383, - CVE-2015-8386, CVE-2015-8387, CVE-2015-8389, CVE-2015-8390, - CVE-2015-8391, CVE-2015-8393, CVE-2015-8394)
      • -
    • -
  • Phar: -
      -
    • Fixed bug #71354 (Heap corruption in tar/zip/phar parser).
      • -
    • Fixed bug #71391 (NULL Pointer Dereference in - phar_tar_setupmetadata()).
      • -
    • Fixed bug #71488 (Stack overflow when decompressing tar - archives). (CVE-2016-2554)
      • -
    • -
  • WDDX: -
      -
    • Fixed bug #71335 (Type Confusion in WDDX Packet - Deserialization).
      • -
    • -
-
- - - - CVE-2015-8383 - CVE-2015-8386 - CVE-2015-8387 - CVE-2015-8389 - CVE-2015-8390 - CVE-2015-8391 - CVE-2015-8393 - CVE-2015-8394 - CVE-2016-2554 - http://php.net/ChangeLog-5.php#5.6.18 - http://php.net/ChangeLog-5.php#5.5.32 - - - 2016-02-04 - 2016-02-09 - 2016-03-13 - - - - - py-imaging, py-pillow -- Buffer overflow in PCD decoder - - - py27-pillow - py33-pillow - py34-pillow - py35-pillow - 2.9.0_1 - - - py27-imaging - 1.1.7_6 - - - - -

The Pillow maintainers report:

-
-

In all versions of Pillow, dating back at least to the last PIL - 1.1.7 release, PcdDecode.c has a buffer overflow error.

-

The state.buffer for PcdDecode.c is allocated based on a 3 bytes - per pixel sizing, where PcdDecode.c wrote into the buffer assuming - 4 bytes per pixel. This writes 768 bytes beyond the end of the - buffer into other Python object storage. In some cases, this causes - a segfault, in others an internal Python malloc error.

-
- - - - http://openwall.com/lists/oss-security/2016/02/02/5 - https://github.com/python-pillow/Pillow/commit/ae453aa18b66af54e7ff716f4ccb33adca60afd4 - https://github.com/python-pillow/Pillow/issues/568 - - - 2016-02-02 - 2016-02-09 - - - - - py-pillow -- Integer overflow in Resample.c - - - py27-pillow - py33-pillow - py34-pillow - py35-pillow - 2.9.0_1 - - - - -

The Pillow maintainers report:

-
-

If a large value was passed into the new size for an image, it is - possible to overflow an int32 value passed into malloc, leading the - malloc’d buffer to be undersized. These allocations are followed by - a loop that writes out of bounds. This can lead to corruption on - the heap of the Python process with attacker controlled float - data.

-

This issue was found by Ned Williamson.

-
- - - - https://github.com/python-pillow/Pillow/commit/41fae6d9e2da741d2c5464775c7f1a609ea03798 - https://github.com/python-pillow/Pillow/issues/1710 - - - 2016-02-05 - 2016-02-09 - - - - - py-imaging, py-pillow -- Buffer overflow in FLI decoding code - - - py27-pillow - py33-pillow - py34-pillow - py35-pillow - 2.9.0_1 - - - py27-imaging - 1.1.7_6 - - - - -

The Pillow maintainers report:

-
-

In all versions of Pillow, dating back at least to the last PIL - 1.1.7 release, FliDecode.c has a buffer overflow error.

-

There is a memcpy error where x is added to a target buffer - address. X is used in several internal temporary variable roles, - but can take a value up to the width of the image. Im->image[y] - is a set of row pointers to segments of memory that are the size of - the row. At the max y, this will write the contents of the line off - the end of the memory buffer, causing a segfault.

-

This issue was found by Alyssa Besseling at Atlassian.

-
- - - - CVE-2016-0775 - https://github.com/python-pillow/Pillow/commit/bcaaf97f4ff25b3b5b9e8efeda364e17e80858ec - - - 2016-02-05 - 2016-02-09 - - - - - py-pillow -- Buffer overflow in TIFF decoding code - - - py27-pillow - py33-pillow - py34-pillow - py35-pillow - 2.9.0_1 - - - - -

The Pillow maintainers report:

-
-

Pillow 3.1.0 and earlier when linked against libtiff >= 4.0.0 on - x64 may overflow a buffer when reading a specially crafted tiff - file.

-

Specifically, libtiff >= 4.0.0 changed the return type of - TIFFScanlineSize from int32 to machine dependent int32|64. If the - scanline is sized so that it overflows an int32, it may be - interpreted as a negative number, which will then pass the size check - in TiffDecode.c line 236. To do this, the logical scanline size has - to be > 2gb, and for the test file, the allocated buffer size is 64k - against a roughly 4gb scan line size. Any image data over 64k is - written over the heap, causing a segfault.

-

This issue was found by security researcher FourOne.

-
- - - - CVE-2016-0740 - https://github.com/python-pillow/Pillow/commit/6dcbf5bd96b717c58d7b642949da8d323099928e - - - 2016-02-04 - 2016-02-09 - - - - - ffmpeg -- remote denial of service in JPEG2000 decoder - - - ffmpeg - 2.8.6,1 - - - mplayer - mencoder - - 1.2.r20151219_3 - - - - - -

FFmpeg security reports:

-
-

FFmpeg 2.8.6 fixes the following vulnerabilities: - CVE-2016-2213

-
- - - - CVE-2016-2213 - https://www.ffmpeg.org/security.html - - - 2016-01-27 - 2016-02-06 - - - - - shotwell -- not verifying certificates - - - shotwell - 0.22.0.99 - - - - -

Michael Catanzaro reports:

-
-

Shotwell has a serious security issue ("Shotwell does not - verify TLS certificates"). Upstream is no longer active and - I do not expect any further upstream releases unless someone - from the community steps up to maintain it.

- -

What is the impact of the issue? If you ever used any of - the publish functionality (publish to Facebook, publish to - Flickr, etc.), your passwords may have been stolen; changing - them is not a bad idea.

- -

What is the risk of the update? Regressions. The easiest - way to validate TLS certificates was to upgrade WebKit; it - seems to work but I don't have accounts with the online - services it supports, so I don't know if photo publishing - still works properly on all the services.

-
- - - - https://mail.gnome.org/archives/distributor-list/2016-January/msg00000.html - - - 2016-01-06 - 2016-02-05 - - - - - webkit -- UI spoof - - - webkit-gtk2 - webkit-gtk3 - 2.4.9_1 - - - - -

webkit reports:

-
-

The ScrollView::paint function in platform/scroll/ScrollView.cpp - in Blink, as used in Google Chrome before 35.0.1916.114, allows - remote attackers to spoof the UI by extending scrollbar painting - into the parent frame.

-
- - - - CVE-2014-1748 - http://webkitgtk.org/security/WSA-2015-0002.html - - - 2015-12-28 - 2016-02-04 - - - - - py-rsa -- Bleichenbacher'06 signature forgery vulnerability - - - py27-rsa - py32-rsa - py33-rsa - py34-rsa - py35-rsa - 3.3 - - - - -

Filippo Valsorda reports:

-
-

- python-rsa is vulnerable to a straightforward variant of the - Bleichenbacher'06 attack against RSA signature verification - with low public exponent.

-
- - - - CVE-2016-1494 - https://blog.filippo.io/bleichenbacher-06-signature-forgery-in-python-rsa/ - https://bitbucket.org/sybren/python-rsa/pull-requests/14/security-fix-bb06-attack-in-verify-by - https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1494 - http://www.openwall.com/lists/oss-security/2016/01/05/3 - http://www.openwall.com/lists/oss-security/2016/01/05/1 - - - 2016-01-05 - 2016-02-04 - - - - - asterisk -- Multiple vulnerabilities - - - asterisk - 1.8.32.3_5 - - - asterisk11 - 11.21.1 - - - asterisk13 - 13.7.1 - - - - -

The Asterisk project reports:

-
-

AST-2016-001 - BEAST vulnerability in HTTP server

-

AST-2016-002 - File descriptor exhaustion in chan_sip

-

AST-2016-003 - Remote crash vulnerability when receiving UDPTL FAX data

-
- - - - http://downloads.asterisk.org/pub/security/AST-2016-001.html - CVE-2011-3389 - http://downloads.asterisk.org/pub/security/AST-2016-002.html - CVE-2016-2316 - http://downloads.asterisk.org/pub/security/AST-2016-003.html - CVE-2016-2232 - - - 2016-02-03 - 2016-02-04 - 2016-03-07 - - - - - salt -- code execution - - - py27-salt - py32-salt - py33-salt - py34-salt - py35-salt - 2015.8.02015.8.4 - - - - -

SaltStack reports:

-
-

Improper handling of clear messages on the minion, which - could result in executing commands not sent by the master.

-
- - - - https://docs.saltstack.com/en/latest/topics/releases/2015.8.4.html - https://github.com/saltstack/salt/pull/30613/files - CVE-2016-1866 - - - 2016-01-25 - 2016-02-03 - - - - - rails -- multiple vulnerabilities - - - rubygem-actionpack - 3.2.22.1 - - - rubygem-actionpack4 - 4.2.5.1 - - - rubygem-actionview - 4.2.5.1 - - - rubygem-activemodel4 - 4.2.5.1 - - - rubygem-activerecord - 3.2.22.1 - - - rubygem-activerecord4 - 4.2.5.1 - - - rubygem-rails - 3.2.22.1 - - - rubygem-rails-html-sanitizer - 1.0.3 - - - rubygem-rails4 - 4.2.5.1 - - - - -

Ruby on Rails blog:

-
-

Rails 5.0.0.beta1.1, 4.2.5.1, 4.1.14.1, and 3.2.22.1 have been - released! These contain important security fixes, and it is - recommended that users upgrade as soon as possible.

-
- - - - CVE-2015-7576 - CVE-2015-7577 - CVE-2015-7581 - CVE-2016-0751 - CVE-2016-0752 - CVE-2016-0753 - https://groups.google.com/d/msg/rubyonrails-security/ANv0HDHEC3k/mt7wNGxbFQAJ - https://groups.google.com/d/msg/rubyonrails-security/cawsWcQ6c8g/tegZtYdbFQAJ - https://groups.google.com/d/msg/rubyonrails-security/dthJ5wL69JE/YzPnFelbFQAJ - https://groups.google.com/d/msg/rubyonrails-security/9oLY_FCzvoc/w9oI9XxbFQAJ - https://groups.google.com/d/msg/rubyonrails-security/335P1DcLG00/OfB9_LhbFQAJ - https://groups.google.com/d/msg/rubyonrails-security/6jQVC1geukQ/8oYETcxbFQAJ - http://weblog.rubyonrails.org/2016/1/25/Rails-5-0-0-beta1-1-4-2-5-1-4-1-14-1-3-2-22-1-and-rails-html-sanitizer-1-0-3-have-been-released/ - - - 2016-01-25 - 2016-02-02 - - - - - socat -- diffie hellman parameter was not prime - - - socat - 1.7.2.51.7.3.1 - - - - -

socat reports:

-
-

In the OpenSSL address implementation the hard coded 1024 - bit DH p parameter was not prime. The effective cryptographic strength - of a key exchange using these parameters was weaker than the one one - could get by using a prime p. Moreover, since there is no indication of - how these parameters were chosen, the existence of a trapdoor that makes - possible for an eavesdropper to recover the shared secret from a key - exchange that uses them cannot be ruled out.

-
- - - - http://www.dest-unreach.org/socat/contrib/socat-secadv7.html - - - 2016-02-01 - 2016-02-01 - - - - - mozilla -- multiple vulnerabilities - - - firefox - linux-firefox - 44.0,1 - - - seamonkey - linux-seamonkey - 2.41 - - - firefox-esr - 38.6.0,1 - - - libxul - thunderbird - linux-thunderbird - 38.6.0 - - - - -

Mozilla Foundation reports:

-
-

MFSA 2016-01 Miscellaneous memory safety hazards (rv:44.0 - / rv:38.6)

-

MFSA 2016-02 Out of Memory crash when parsing GIF format - images

-

MFSA 2016-03 Buffer overflow in WebGL after out of memory - allocation

-

MFSA 2016-04 Firefox allows for control characters to be - set in cookie names

-

MFSA 2016-06 Missing delay following user click events in - protocol handler dialog

-

MFSA 2016-09 Addressbar spoofing attacks

-

MFSA 2016-10 Unsafe memory manipulation found through - code inspection

-

MFSA 2016-11 Application Reputation service disabled in - Firefox 43

-
- - - - CVE-2015-7208 - CVE-2016-1930 - CVE-2016-1931 - CVE-2016-1933 - CVE-2016-1935 - CVE-2016-1937 - CVE-2016-1939 - CVE-2016-1942 - CVE-2016-1943 - CVE-2016-1944 - CVE-2016-1945 - CVE-2016-1946 - CVE-2016-1947 - https://www.mozilla.org/security/advisories/mfsa2016-01/ - https://www.mozilla.org/security/advisories/mfsa2016-02/ - https://www.mozilla.org/security/advisories/mfsa2016-03/ - https://www.mozilla.org/security/advisories/mfsa2016-04/ - https://www.mozilla.org/security/advisories/mfsa2016-06/ - https://www.mozilla.org/security/advisories/mfsa2016-09/ - https://www.mozilla.org/security/advisories/mfsa2016-10/ - https://www.mozilla.org/security/advisories/mfsa2016-11/ - - - 2016-01-26 - 2016-02-01 - 2016-03-08 - - - - - gdcm -- multiple vulnerabilities - - - gdcm - 2.6.2 - - - - -

CENSUS S.A. reports:

-
-

GDCM versions 2.6.0 and 2.6.1 (and possibly previous versions) are - prone to an integer overflow vulnerability which leads to a buffer - overflow and potentially to remote code execution.

-
-
-

GDCM versions 2.6.0 and 2.6.1 (and possibly previous versions) are - prone to an out-of-bounds read vulnerability due to missing checks. -

-
- - - - CVE-2015-8396 - CVE-2015-8397 - http://census-labs.com/news/2016/01/11/gdcm-buffer-overflow-imageregionreaderreadintobuffer/ - http://census-labs.com/news/2016/01/11/gdcm-out-bounds-read-jpeglscodec-decodeextent/ - - - 2015-12-23 - 2016-02-01 - - - - - nginx -- multiple vulnerabilities - - - nginx - 1.8.1,2 - - - nginx-devel - 1.9.10 - - - - -

Maxim Dounin reports:

-
-

Several problems in nginx resolver were identified, which - might allow an attacker to cause worker process crash, or might have - potential other impact if the "resolver" directive - is used in a configuration file.

-
- - - - http://mailman.nginx.org/pipermail/nginx/2016-January/049700.html - CVE-2016-0742 - CVE-2016-0746 - CVE-2016-0747 - - - 2016-01-26 - 2016-01-30 - - - - - typo3 -- multiple vulnerabilities - - - typo3 - 7.6.1 - - - typo3-lts - 6.2.16 - - - - -

TYPO3 Security Team reports:

-
-

It has been discovered that TYPO3 CMS is susceptible to - Cross-Site Scripting and Cross-Site Flashing.

-
- - - - http://lists.typo3.org/pipermail/typo3-announce/2015/000351.html - https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-010/ - https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-011/ - https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-012/ - https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-013/ - https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-014/ - https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-015/ - - - 2015-12-15 - 2016-01-29 - - - - - nghttp2 -- use after free - - - nghttp2 - 1.6.0 - - - - -

nghttp2 reports:

-
-

This release fixes heap-use-after-free bug in idle stream - handling code. We strongly recommend to upgrade the older installation - to this latest version as soon as possible.

-
- - - - https://nghttp2.org/blog/2015/12/23/nghttp2-v1-6-0/ - CVE-2015-8659 - - - 2015-12-23 - 2016-01-29 - - - - - owncloud -- multiple vulnerabilities - - - owncloud - 8.2.2 - - - - -

Owncloud reports:

-
-
    -

  • Reflected XSS in OCS provider discovery - (oC-SA-2016-001)

    • -

  • Information Exposure Through Directory Listing in the - file scanner (oC-SA-2016-002)

    • -

  • Disclosure of files that begin with ".v" due to - unchecked return value (oC-SA-2016-003)

    • -
-
- - - - https://owncloud.org/blog/owncloud-8-2-2-8-1-5-8-0-10-and-7-0-12-here-with-sharing-ldap-fixes/ - https://owncloud.org/security/advisory/?id=oc-sa-2016-001 - https://owncloud.org/security/advisory/?id=oc-sa-2016-002 - https://owncloud.org/security/advisory/?id=oc-sa-2016-003 - CVE-2016-1498 - CVE-2016-1499 - CVE-2016-1500 - - - 2015-12-23 - 2016-01-29 - - - - - radicale -- multiple vulnerabilities - - - py27-radicale - py32-radicale - py33-radicale - py34-radicale - 1.1 - - - - -

Radicale reports:

-
-

The multifilesystem backend allows access to arbitrary - files on all platforms.

-

Prevent regex injection in rights management.

-
- - - - http://www.openwall.com/lists/oss-security/2016/01/06/4 - CVE-2015-8747 - CVE-2015-8748 - - - 2015-12-24 - 2016-01-29 - - - - - phpmyadmin -- XSS vulnerability in SQL editor - - - phpmyadmin - 4.5.04.5.4 - - - - -

The phpMyAdmin development team reports:

-
-

With a crafted SQL query, it is possible to trigger an - XSS attack in the SQL editor.

-

We consider this vulnerability to be non-critical.

-

This vulnerability can be triggered only by someone who is - logged in to phpMyAdmin, as the usual token protection - prevents non-logged-in users from accessing the required - pages.

-
- - - - https://www.phpmyadmin.net/security/PMASA-2016-9/ - CVE-2016-2045 - - - 2016-01-28 - 2016-01-28 - - - - - phpmyadmin -- Full path disclosure vulnerability in SQL parser - - - phpmyadmin - 4.5.04.5.4 - - - - -

The phpMyAdmin development team reports:

-
-

By calling a particular script that is part of phpMyAdmin - in an unexpected way, it is possible to trigger phpMyAdmin - to display a PHP error message which contains the full path - of the directory where phpMyAdmin is installed.

-

We consider this vulnerability to be non-critical.

-

This path disclosure is possible on servers where the - recommended setting of the PHP configuration directive - display_errors is set to on, which is against the - recommendations given in the PHP manual for a production - server.

-
- - - - https://www.phpmyadmin.net/security/PMASA-2016-8/ - CVE-2016-2044 - - - 2016-01-28 - 2016-01-28 - - - - - phpmyadmin -- XSS vulnerability in normalization page - - - phpmyadmin - 4.5.04.5.4 - - - - -

The phpMyAdmin development team reports:

-
-

With a crafted table name it is possible to trigger an - XSS attack in the database normalization page.

-

We consider this vulnerability to be non-critical.

-

This vulnerability can be triggered only by someone who is - logged in to phpMyAdmin, as the usual token protection - prevents non-logged-in users from accessing the required page.

-
- - - - https://www.phpmyadmin.net/security/PMASA-2016-7/ - CVE-2016-2043 - - - 2016-01-28 - 2016-01-28 - - - - - phpmyadmin -- Multiple full path disclosure vulnerabilities - - - phpmyadmin - 4.5.04.5.4 - - - - -

The phpMyAdmin development team reports:

-
-

By calling some scripts that are part of phpMyAdmin in an - unexpected way, it is possible to trigger phpMyAdmin to - display a PHP error message which contains the full path of - the directory where phpMyAdmin is installed.

-

We consider these vulnerabilities to be non-critical.

-

This path disclosure is possible on servers where the - recommended setting of the PHP configuration directive - display_errors is set to on, which is against the - recommendations given in the PHP manual for a production - server.

-
- - - - https://www.phpmyadmin.net/security/PMASA-2016-6/ - CVE-2016-2042 - - - 2016-01-28 - 2016-01-28 - - - - - phpmyadmin -- Unsafe comparison of XSRF/CSRF token - - - phpmyadmin - 4.5.04.5.4 - - - - -

The phpMyAdmin development team reports:

-
-

The comparison of the XSRF/CSRF token parameter with the - value saved in the session is vulnerable to timing - attacks. Moreover, the comparison could be bypassed if the - XSRF/CSRF token matches a particular pattern.

-

We consider this vulnerability to be serious.

-
- - - - https://www.phpmyadmin.net/security/PMASA-2016-5/ - CVE-2016-2041 - - - 2016-01-28 - 2016-01-28 - - - - - phpmyadmin -- Insecure password generation in JavaScript - - - phpmyadmin - 4.5.04.5.4 - - - - -

The phpMyAdmin development team reports:

-
-

Password suggestion functionality uses Math.random() - which does not provide cryptographically secure random - numbers.

-

We consider this vulnerability to be non-critical.

-
- - - - https://www.phpmyadmin.net/security/PMASA-2016-4/ - CVE-2016-1927 - - - 2016-01-28 - 2016-01-28 - - - - - phpmyadmin -- Multiple XSS vulnerabilities - - - phpmyadmin - 4.5.04.5.4 - - - - -

The phpMyAdmin development team reports:

-
-
    -
  • With a crafted table name it is possible to trigger - an XSS attack in the database search page.
    • -
  • With a crafted SET value or a crafted search query, it - is possible to trigger an XSS attacks in the zoom search - page.
    • -
  • With a crafted hostname header, it is possible to - trigger an XSS attacks in the home page.
    • -
-

We consider these vulnerabilities to be non-critical.

-

These vulnerabilities can be triggered only by someone - who is logged in to phpMyAdmin, as the usual token - protection prevents non-logged-in users from accessing the - required pages.

-
- - - - https://www.phpmyadmin.net/security/PMASA-2016-3/ - CVE-2016-2040 - - - 2016-01-28 - 2016-01-28 - - - - - phpmyadmin -- Unsafe generation of XSRF/CSRF token - - - phpmyadmin - 4.5.04.5.4 - - - - -

The phpMyAdmin development team reports:

-
-

The XSRF/CSRF token is generated with a weak algorithm - using functions that do not return cryptographically secure - values.

-

We consider this vulnerability to be non-critical.

-
- - - - https://www.phpmyadmin.net/security/PMASA-2016-2/ - CVE-2016-2039 - - - 2016-01-28 - 2016-01-28 - - - - - phpmyadmin -- Multiple full path disclosure vulnerabilities - - - phpmyadmin - 4.5.04.5.4 - - - - -

The phpMyAdmin development team reports:

-
-

By calling some scripts that are part of phpMyAdmin in an - unexpected way, it is possible to trigger phpMyAdmin to - display a PHP error message which contains the full path of - the directory where phpMyAdmin is installed.

-

We consider these vulnerabilities to be non-critical.

-

This path disclosure is possible on servers where the - recommended setting of the PHP configuration directive - display_errors is set to on, which is against the - recommendations given in the PHP manual for a production - server.

-
- - - - https://www.phpmyadmin.net/security/PMASA-2016-1/ - CVE-2016-2038 - - - 2016-01-28 - 2016-01-28 - - - - - prosody -- user impersonation vulnerability - - - prosody - 0.9.10 - - - - -

The Prosody team reports:

-
-

Adopt key generation algorithm from XEP-0185, to - prevent impersonation attacks (CVE-2016-0756)

-
- - - - ports/206707 - CVE-2016-0756 - https://prosody.im/security/advisory_20160127/ - - - 2016-01-27 - 2016-01-28 - - - - - openssl -- multiple vulnerabilities - - - openssl - 1.0.2_7 - - - mingw32-openssl - 1.0.11.0.2f - - - FreeBSD - 10.210.2_12 - 10.110.1_29 - 9.39.3_36 - - - - -

OpenSSL project reports:

-
-
    -
  1. Historically OpenSSL only ever generated DH parameters based on "safe" - primes. More recently (in version 1.0.2) support was provided for - generating X9.42 style parameter files such as those required for RFC 5114 - support. The primes used in such files may not be "safe". Where an - application is using DH configured with parameters based on primes that are - not "safe" then an attacker could use this fact to find a peer's private - DH exponent. This attack requires that the attacker complete multiple - handshakes in which the peer uses the same private DH exponent. For example - this could be used to discover a TLS server's private DH exponent if it's - reusing the private DH exponent or it's using a static DH ciphersuite. - OpenSSL provides the option SSL_OP_SINGLE_DH_USE for ephemeral DH (DHE) in - TLS. It is not on by default. If the option is not set then the server - reuses the same private DH exponent for the life of the server process and - would be vulnerable to this attack. It is believed that many popular - applications do set this option and would therefore not be at risk. - (CVE-2016-0701)
    2. -
  2. A malicious client can negotiate SSLv2 ciphers that have been disabled on - the server and complete SSLv2 handshakes even if all SSLv2 ciphers have - been disabled, provided that the SSLv2 protocol was not also disabled via - SSL_OP_NO_SSLv2. - (CVE-2015-3197)
    3. -
-
- - - - SA-16:11.openssl - CVE-2016-0701 - CVE-2015-3197 - https://www.openssl.org/news/secadv/20160128.txt - - - 2016-01-22 - 2016-01-28 - 2016-08-09 - - - - - curl -- Credentials not checked - - - curl - 7.10.07.47.0 - - - - -

The cURL project reports:

-
-

libcurl will reuse NTLM-authenticated proxy connections - without properly making sure that the connection was - authenticated with the same credentials as set for this - transfer.

-
- - - - http://curl.haxx.se/docs/adv_20160127A.html - CVE-2016-0755 - - - 2016-01-27 - 2016-01-27 - 2017-02-06 - - - - - wordpress -- XSS vulnerability - - - wordpress - 4.4.1,1 - - - de-wordpress - ja-wordpress - ru-wordpress - zh-wordpress-zh_CN - zh-wordpress-zh_TW - 4.4.1 - - - - -

Aaron Jorbin reports:

-
-

WordPress 4.4.1 is now available. This is a security release for - all previous versions and we strongly encourage you to update your - sites immediately.

-

WordPress versions 4.4 and earlier are affected by a cross-site - scripting vulnerability that could allow a site to be compromised. - This was reported by Crtc4L.

-
- - - - CVE-2016-1564 - http://www.openwall.com/lists/oss-security/2016/01/08/3 - https://wordpress.org/news/2016/01/wordpress-4-4-1-security-and-maintenance-release/ - - - 2016-01-06 - 2016-01-26 - 2016-03-08 - - - - - privoxy -- multiple vulnerabilities - - - privoxy - 3.0.24 - - - - -

Privoxy Developers reports:

-
-

Prevent invalid reads in case of corrupt chunk-encoded content. - CVE-2016-1982. Bug discovered with afl-fuzz and AddressSanitizer. -

-

Remove empty Host headers in client requests. Previously they - would result in invalid reads. CVE-2016-1983. Bug discovered with - afl-fuzz and AddressSanitizer.

-
- - - - CVE-2016-1982 - CVE-2016-1983 - ports/206504 - http://www.privoxy.org/3.0.24/user-manual/whatsnew.html - http://www.openwall.com/lists/oss-security/2016/01/21/4 - - - 2016-01-22 - 2016-01-26 - - - - - privoxy -- multiple vulnerabilities - - - privoxy - 3.0.23 - - - - -

Privoxy Developers reports:

-
-

Fixed a DoS issue in case of client requests with incorrect - chunk-encoded body. When compiled with assertions enabled (the - default) they could previously cause Privoxy to abort(). Reported - by Matthew Daley. CVE-2015-1380.

-

Fixed multiple segmentation faults and memory leaks in the pcrs - code. This fix also increases the chances that an invalid pcrs - command is rejected as such. Previously some invalid commands would - be loaded without error. Note that Privoxy's pcrs sources (action - and filter files) are considered trustworthy input and should not be - writable by untrusted third-parties. CVE-2015-1381.

-

Fixed an 'invalid read' bug which could at least theoretically - cause Privoxy to crash. So far, no crashes have been observed. - CVE-2015-1382.

-
- - - - CVE-2015-1380 - CVE-2015-1381 - CVE-2015-1382 - ports/197089 - http://www.privoxy.org/3.0.23/user-manual/whatsnew.html - http://www.openwall.com/lists/oss-security/2015/01/26/4 - - - 2015-01-26 - 2016-01-26 - - - - - privoxy -- multiple vulnerabilities - - - privoxy - 3.0.22 - - - - -

Privoxy Developers reports:

-
-

Fixed a memory leak when rejecting client connections due to the - socket limit being reached (CID 66382). This affected Privoxy 3.0.21 - when compiled with IPv6 support (on most platforms this is the - default).

-

Fixed an immediate-use-after-free bug (CID 66394) and two - additional unconfirmed use-after-free complaints made by Coverity - scan (CID 66391, CID 66376).

-
-

MITRE reports:

-
-

Privoxy before 3.0.22 allows remote attackers to cause a denial - of service (file descriptor consumption) via unspecified vectors. -

-
- - - - CVE-2015-1030 - CVE-2015-1031 - CVE-2015-1201 - ports/195468 - http://www.privoxy.org/3.0.22/user-manual/whatsnew.html - http://www.openwall.com/lists/oss-security/2015/01/11/1 - - - 2015-01-10 - 2016-01-26 - - - - - privoxy -- malicious server spoofing as proxy vulnerability - - - privoxy - 3.0.21 - - - - -

Privoxy Developers reports:

-
-

Proxy authentication headers are removed unless the new directive - enable-proxy-authentication-forwarding is used. Forwarding the - headers potentially allows malicious sites to trick the user into - providing them with login information. Reported by Chris John Riley. -

-
- - - - CVE-2013-2503 - ports/176813 - http://www.privoxy.org/3.0.21/user-manual/whatsnew.html - - - 2013-03-07 - 2016-01-26 - - - - - sudo -- potential privilege escalation via symlink misconfiguration - - - sudo - 1.8.15 - - - - -

MITRE reports:

-
-

sudoedit in Sudo before 1.8.15 allows local users to gain - privileges via a symlink attack on a file whose full path is defined - using multiple wildcards in /etc/sudoers, as demonstrated by - "/home/*/*/file.txt."

-
- - - - CVE-2015-5602 - ports/206590 - https://www.exploit-db.com/exploits/37710/ - https://bugzilla.sudo.ws/show_bug.cgi?id=707 - http://www.sudo.ws/stable.html#1.8.15 - - - 2015-11-17 - 2016-01-26 - - - - - imlib2 -- denial of service vulnerabilities - - - imlib2 - 1.4.7 - - - - -

Enlightenment reports:

-
-

GIF loader: Fix segv on images without colormap

-

Prevent division-by-zero crashes.

-

Fix segfault when opening input/queue/id:000007,src:000000,op:flip1,pos:51 with feh

-
- - - - https://git.enlightenment.org/legacy/imlib2.git/tree/ChangeLog - http://seclists.org/oss-sec/2016/q1/162 - CVE-2014-9762 - CVE-2014-9763 - CVE-2014-9764 - - - 2013-12-21 - 2016-01-22 - - - - - bind -- denial of service vulnerability - - - bind99 - 9.9.8P3 - - - bind910 - 9.10.3P3 - - - FreeBSD - 9.39.3_35 - - - - -

ISC reports:

-
-

Specific APL data could trigger an INSIST in apl_42.c

-
- - - - https://kb.isc.org/article/AA-01335 - CVE-2015-8704 - SA-16:08.bind - - - 2016-01-19 - 2016-01-22 - 2016-08-09 - - - - - chromium -- multiple vulnerabilities - - - chromium - chromium-npapi - chromium-pulse - 48.0.2564.82 - - - - -

Google Chrome Releases reports:

-
-

This update includes 37 security fixes, including:

-
    -
  • [497632] High CVE-2016-1612: Bad cast in V8.
    • -
  • [572871] High CVE-2016-1613: Use-after-free in PDFium.
    • -
  • [544691] Medium CVE-2016-1614: Information leak in Blink.
    • -
  • [468179] Medium CVE-2016-1615: Origin confusion in Omnibox.
    • -
  • [541415] Medium CVE-2016-1616: URL Spoofing.
    • -
  • [544765] Medium CVE-2016-1617: History sniffing with HSTS and - CSP.
    • -
  • [552749] Medium CVE-2016-1618: Weak random number generator in - Blink.
    • -
  • [557223] Medium CVE-2016-1619: Out-of-bounds read in - PDFium.
    • -
  • [579625] CVE-2016-1620: Various fixes from internal audits, - fuzzing and other initiatives.
    • -
  • Multiple vulnerabilities in V8 fixed at the tip of the 4.8 - branch.
    • -
-
- - - - CVE-2016-1612 - CVE-2016-1613 - CVE-2016-1614 - CVE-2016-1615 - CVE-2016-1616 - CVE-2016-1617 - CVE-2016-1618 - CVE-2016-1619 - CVE-2016-1620 - http://googlechromereleases.blogspot.de/2016/01/stable-channel-update_20.html - - - 2016-01-20 - 2016-01-21 - - - - - ntp -- multiple vulnerabilities - - - ntp - 4.2.8p6 - - - ntp-devel - 4.3.90 - - - FreeBSD - 10.210.2_11 - 10.110.1_28 - 9.39.3_35 - - - - -

Network Time Foundation reports:

-
-

NTF's NTP Project has been notified of the following low- - and medium-severity vulnerabilities that are fixed in - ntp-4.2.8p6, released on Tuesday, 19 January 2016:

-
    -
  • Bug 2948 / CVE-2015-8158: Potential Infinite Loop - in ntpq. Reported by Cisco ASIG.
    • -
  • Bug 2945 / CVE-2015-8138: origin: Zero Origin - Timestamp Bypass. Reported by Cisco ASIG.
    • -
  • Bug 2942 / CVE-2015-7979: Off-path Denial of - Service (DoS) attack on authenticated broadcast - mode. Reported by Cisco ASIG.
    • -
  • Bug 2940 / CVE-2015-7978: Stack exhaustion in - recursive traversal of restriction list. - Reported by Cisco ASIG.
    • -
  • Bug 2939 / CVE-2015-7977: reslist NULL pointer - dereference. Reported by Cisco ASIG.
    • -
  • Bug 2938 / CVE-2015-7976: ntpq saveconfig command - allows dangerous characters in filenames. - Reported by Cisco ASIG.
    • -
  • Bug 2937 / CVE-2015-7975: nextvar() missing length - check. Reported by Cisco ASIG.
    • -
  • Bug 2936 / CVE-2015-7974: Skeleton Key: Missing - key check allows impersonation between authenticated - peers. Reported by Cisco ASIG.
    • -
  • Bug 2935 / CVE-2015-7973: Deja Vu: Replay attack on - authenticated broadcast mode. Reported by Cisco ASIG.
    • -
-

Additionally, mitigations are published for the following - two issues:

-
    -
  • Bug 2947 / CVE-2015-8140: ntpq vulnerable to replay - attacks. Reported by Cisco ASIG.
    • -
  • Bug 2946 / CVE-2015-8139: Origin Leak: ntpq and ntpdc, - disclose origin. Reported by Cisco ASIG.
    • -
-
- - - - SA-16:09.ntp - CVE-2015-7973 - CVE-2015-7974 - CVE-2015-7975 - CVE-2015-7976 - CVE-2015-7977 - CVE-2015-7978 - CVE-2015-7979 - CVE-2015-8138 - CVE-2015-8139 - CVE-2015-8140 - CVE-2015-8158 - http://support.ntp.org/bin/view/Main/SecurityNotice#January_2016_NTP_4_2_8p6_Securit - - - 2016-01-20 - 2016-01-21 - 2016-08-09 - - - - - cgit -- multiple vulnerabilities - - - cgit - 0.12 - - - - -

Jason A. Donenfeld reports:

-
-

Reflected Cross Site Scripting and Header Injection in Mimetype - Query String.

-

Stored Cross Site Scripting and Header Injection in Filename - Parameter.

-

Integer Overflow resulting in Buffer Overflow.

-
- - - - CVE-2016-1899 - CVE-2016-1900 - CVE-2016-1901 - ports/206417 - http://lists.zx2c4.com/pipermail/cgit/2016-January/002817.html - http://www.openwall.com/lists/oss-security/2016/01/14/6 - - - 2016-01-14 - 2016-01-20 - - - - - bind -- denial of service vulnerability - - - bind910 - 9.10.3P3 - - - - -

ISC reports:

-
-

Problems converting OPT resource records and ECS options to - text format can cause BIND to terminate

-
- - - - https://kb.isc.org/article/AA-01336 - CVE-2015-8705 - - - 2016-01-19 - 2016-01-20 - 2016-01-22 - - - - - claws-mail -- no bounds checking on the output buffer in conv_jistoeuc, conv_euctojis, conv_sjistoeuc - - - claws-mail - 3.13.2 - - - - -

DrWhax reports:

-
-

So in codeconv.c there is a function for Japanese character set - conversion called conv_jistoeuc(). There is no bounds checking on - the output buffer, which is created on the stack with alloca() - Bug can be triggered by sending an email to TAILS_luser@riseup.net - or whatever. - - Since my C is completely rusty, you might be able to make a better - judgment on the severity of this issue. Marking critical for now.

-
- - - - CVE-2015-8614 - https://security-tracker.debian.org/tracker/CVE-2015-8614 - - - 2015-11-04 - 2016-01-19 - - - - - libarchive -- multiple vulnerabilities - - - libarchive - 3.1.2_5,1 - - - FreeBSD - 10.310.3_4 - 10.210.2_18 - 10.110.1_35 - 9.39.3_43 - - - - -

MITRE reports:

-
-

Integer signedness error in the archive_write_zip_data function in - archive_write_set_format_zip.c in libarchive 3.1.2 and earlier, when - running on 64-bit machines, allows context-dependent attackers to - cause a denial of service (crash) via unspecified vectors, which - triggers an improper conversion between unsigned and signed types, - leading to a buffer overflow.

-
-
-

Absolute path traversal vulnerability in bsdcpio in libarchive - 3.1.2 and earlier allows remote attackers to write to arbitrary - files via a full pathname in an archive.

-
-

Libarchive issue tracker reports:

-
-

Using a crafted tar file bsdtar can perform an out-of-bounds memory - read which will lead to a SEGFAULT. The issue exists when the - executable skips data in the archive. The amount of data to skip is - defined in byte offset [16-19] If ASLR is disabled, the issue can - lead to an infinite loop.

-
- - - - CVE-2013-0211 - CVE-2015-2304 - ports/200176 - SA-16:22.libarchive - SA-16:23.libarchive - https://github.com/libarchive/libarchive/pull/110 - https://github.com/libarchive/libarchive/commit/5935715 - https://github.com/libarchive/libarchive/commit/2253154 - https://github.com/libarchive/libarchive/issues/502 - https://github.com/libarchive/libarchive/commit/3865cf2 - https://github.com/libarchive/libarchive/commit/e6c9668 - https://github.com/libarchive/libarchive/commit/24f5de6 - - - 2012-12-06 - 2016-01-18 - 2016-08-09 - - - - - go -- information disclosure vulnerability - - - go - 1.5,11.5.3,1 - - - - -

Jason Buberel reports:

-
-

A security-related issue has been reported in Go's math/big - package. The issue was introduced in Go 1.5. We recommend that all - users upgrade to Go 1.5.3, which fixes the issue. Go programs must - be recompiled with Go 1.5.3 in order to receive the fix.

-

The Go team would like to thank Nick Craig-Wood for identifying the - issue.

-

This issue can affect RSA computations in crypto/rsa, which is used - by crypto/tls. TLS servers on 32-bit systems could plausibly leak - their RSA private key due to this issue. Other protocol - implementations that create many RSA signatures could also be - impacted in the same way.

-

Specifically, incorrect results in one part of the RSA Chinese - Remainder computation can cause the result to be incorrect in such a - way that it leaks one of the primes. While RSA blinding should - prevent an attacker from crafting specific inputs that trigger the - bug, on 32-bit systems the bug can be expected to occur at random - around one in 2^26 times. Thus collecting around 64 million - signatures (of known data) from an affected server should be enough - to extract the private key used.

-

On 64-bit systems, the frequency of the bug is so low (less than - one in 2^50) that it would be very difficult to exploit. - Nonetheless, everyone is strongly encouraged to upgrade.

-
- - - - CVE-2015-8618 - http://www.openwall.com/lists/oss-security/2016/01/13/7 - https://go-review.googlesource.com/#/c/17672/ - https://go-review.googlesource.com/#/c/18491/ - - - 2016-01-13 - 2016-01-18 - - - - - isc-dhcpd -- Denial of Service - - - isc-dhcp41-server - 4.1.e_10,2 - - - isc-dhcp41-client - 4.1.e_3,2 - - - isc-dhcp41-relay - 4.1.e_6,2 - - - isc-dhcp42-client - isc-dhcp42-server - isc-dhcp42-relay - 0 - - - isc-dhcp43-client - isc-dhcp43-server - isc-dhcp43-relay - 4.3.3.p1 - - - - -

ISC reports:

-
-

A badly formed packet with an invalid IPv4 UDP length field - can cause a DHCP server, client, or relay program to terminate - abnormally.

-
- - - - https://kb.isc.org/article/AA-01334 - CVE-2015-8605 - - - 2016-01-05 - 2016-01-12 - - - - - libproxy -- stack-based buffer overflow - - - - libproxy - 0.4.00.4.6_1 - - - libproxy-gnome - 0.4.00.4.6_2 - - - libproxy-kde - 0.4.00.4.6_6 - - - libproxy-perl - 0.4.00.4.6_3 - - - libproxy-webkit - 0.4.00.4.6_4 - - - - -

Tomas Hoger reports:

-
-

A buffer overflow flaw was discovered in the libproxy's - url::get_pac() used to download proxy.pac proxy auto-configuration - file. A malicious host hosting proxy.pac, or a man in the middle - attacker, could use this flaw to trigger a stack-based buffer - overflow in an application using libproxy, if proxy configuration - instructed it to download proxy.pac file from a remote HTTP - server.

-
- - - - CVE-2012-4504 - https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-4504 - http://www.openwall.com/lists/oss-security/2012/10/12/1 - https://github.com/libproxy/libproxy/commit/c440553c12836664afd24a24fb3a4d10a2facd2c - https://bugzilla.redhat.com/show_bug.cgi?id=864417 - https://groups.google.com/forum/?fromgroups=#!topic/libproxy/VxZ8No7mT0E - - - 2012-10-10 - 2016-01-17 - 2016-01-18 - - - - - ffmpeg -- remote attacker can access local files - - - ffmpeg - - 2.0,1 - 2.8.5,1 - - - - mplayer - mencoder - - 1.2.r20151219_2 - - - - - -

Arch Linux reports:

-
-

ffmpeg has a vulnerability in the current version that allows the - attacker to create a specially crafted video file, downloading which - will send files from a user PC to a remote attacker server. The - attack does not even require the user to open that file — for - example, KDE Dolphin thumbnail generation is enough.

-
- - - - CVE-2016-1897 - CVE-2016-1898 - ports/206282 - https://www.ffmpeg.org/security.html - - - 2016-01-13 - 2016-01-17 - - - - - h2o -- directory traversal vulnerability - - - h2o - 1.6.2 - - - - -

Yakuzo OKU reports:

-
-

When redirect directive is used, this flaw allows a remote - attacker to inject response headers into an HTTP redirect response.

-
- - - - CVE-2016-1133 - https://h2o.examp1e.net/vulnerabilities.html - - - 2016-01-13 - 2016-01-15 - - - - - openssh -- information disclosure - - - openssh-portable - - 5.4.p0,1 - 7.1.p2,1 - - - - FreeBSD - 10.210.2_10 - 10.110.1_27 - 9.39.3_34 - - - - -

OpenSSH reports:

-
-

OpenSSH clients between versions 5.4 and 7.1 are vulnerable to - information disclosure that may allow a malicious server to retrieve - information including under some circumstances, user's private keys.

-
- - - - http://www.openssh.com/security.html - CVE-2016-0777 - CVE-2016-0778 - SA-16:07 - - - 2016-01-14 - 2016-01-14 - 2016-08-09 - - - - - prosody -- multiple vulnerabilities - - - prosody - 0.9.9 - - - - -

The Prosody Team reports:

-
-

Fix path traversal vulnerability in mod_http_files - (CVE-2016-1231)

-

Fix use of weak PRNG in generation of dialback secrets - (CVE-2016-1232)

-
- - - - CVE-2016-1231 - CVE-2016-1232 - ports/206150 - http://blog.prosody.im/prosody-0-9-9-security-release/ - - - 2016-01-08 - 2016-01-14 - - - - - kibana4 -- XSS vulnerability - - - kibana4 - kibana41 - 4.1.4 - - - kibana42 - 4.2.2 - - - kibana43 - 4.3.1 - - - - -

Elastic reports:

-
-

Fixes XSS vulnerability (CVE pending) - Thanks to Vladimir Ivanov - for responsibly reporting.

-
- - - - ports/205961 - ports/205962 - ports/205963 - https://www.elastic.co/blog/kibana-4-3-1-and-4-2-2-and-4-1-4 - - - 2015-12-17 - 2016-01-13 - - - - - p5-PathTools -- File::Spec::canonpath loses taint - - - p5-PathTools - - 3.4000 - 3.6200 - - - - perl5 - perl5.20 - perl5.22 - perl5-devel - 5.19.95.20.2 - 5.21.05.22.2 - 5.23.05.23.7 - - - - -

Ricardo Signes reports:

-
-

Beginning in PathTools 3.47 and/or perl 5.20.0, the - File::Spec::canonpath() routine returned untained strings even if - passed tainted input. This defect undermines the guarantee of taint - propagation, which is sometimes used to ensure that unvalidated - user input does not reach sensitive code.

-

This defect was found and reported by David Golden of MongoDB.

-
- - - - CVE-2015-8607 - https://rt.perl.org/Public/Bug/Display.html?id=126862 - - - 2016-01-11 - 2016-01-12 - 2016-08-22 - - - - - php -- multiple vulnerabilities - - - php55 - php55-gd - php55-wddx - php55-xmlrpc - 5.5.31 - - - php56 - php56-gd - php56-soap - php56-wddx - php56-xmlrpc - 5.6.17 - - - - -

PHP reports:

-
-
  • Core: -
      -
    • Fixed bug #70755 (fpm_log.c memory leak and buffer overflow).
      • -
    • -
  • GD: -
      -
    • Fixed bug #70976 (Memory Read via gdImageRotateInterpolated Array - Index Out of Bounds).
      • -
    • -
  • SOAP: -
      -
    • Fixed bug #70900 (SoapClient systematic out of memory error).
      • -
    • -
  • Wddx -
      -
    • Fixed bug #70661 (Use After Free Vulnerability in WDDX Packet - Deserialization).
      • -
    • Fixed bug #70741 (Session WDDX Packet Deserialization Type - Confusion Vulnerability).
      • -
    • -
  • XMLRPC: -
      -
    • Fixed bug #70728 (Type Confusion Vulnerability in - PHP_to_XMLRPC_worker()).
      • -
    • -
-
- - - - http://www.php.net/ChangeLog-5.php#5.5.31 - http://www.php.net/ChangeLog-5.php#5.6.17 - - - 2016-01-07 - 2016-01-11 - - - - - pygments -- shell injection vulnerability - - - py27-pygments - py32-pygments - py33-pygments - py34-pygments - py35-pygments - 2.0.2_1 - - - - -

NVD reports:

-
-

The FontManager._get_nix_font_path function in formatters/img.py - in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute - arbitrary commands via shell metacharacters in a font name.

-
- - - - CVE-2015-8557 - http://seclists.org/fulldisclosure/2015/Oct/4 - https://bitbucket.org/birkenfeld/pygments-main/commits/0036ab1c99e256298094505e5e92fdacdfc5b0a8 - - - 2015-09-28 - 2016-01-09 - - - - - polkit -- multiple vulnerabilities - - - polkit - 0.113 - - - - -

Colin Walters reports:

-
-
    -

  • Integer overflow in the - authentication_agent_new_cookie function in PolicyKit (aka polkit) - before 0.113 allows local users to gain privileges by creating a large - number of connections, which triggers the issuance of a duplicate cookie - value.

    • -

  • The authentication_agent_new function in - polkitbackend/polkitbackendinteractiveauthority.c in PolicyKit (aka - polkit) before 0.113 allows local users to cause a denial of service - (NULL pointer dereference and polkitd daemon crash) by calling - RegisterAuthenticationAgent with an invalid object path.

    • -

  • The polkit_backend_action_pool_init function in - polkitbackend/polkitbackendactionpool.c in PolicyKit (aka polkit) before - 0.113 might allow local users to gain privileges via duplicate action - IDs in action descriptions.

    • -

  • PolicyKit (aka polkit) before 0.113 allows local - users to cause a denial of service (memory corruption and polkitd daemon - crash) and possibly gain privileges via unspecified vectors, related to - "javascript rule evaluation."

    • -
-
- - - - http://lists.freedesktop.org/archives/polkit-devel/2015-June/000425.html - CVE-2015-4625 - CVE-2015-3218 - CVE-2015-3255 - CVE-2015-3256 - - - 2015-06-03 - 2016-01-08 - - - - - librsync -- collision vulnerability - - - librsync - 1.0.0 - - - - -

Michael Samuel reports:

-
-

librsync before 1.0.0 uses a truncated MD4 checksum to - match blocks, which makes it easier for remote attackers to modify - transmitted data via a birthday attack.

-
- - - - http://www.openwall.com/lists/oss-security/2014/07/28/1 - CVE-2014-8242 - - - 2014-07-28 - 2016-01-08 - - - - - ntp -- denial of service vulnerability - - - ntp - 4.2.8p5 - - - ntp-devel - 4.3.78 - - - FreeBSD - 10.210.2_9 - 10.110.1_26 - 9.39.3_33 - - - - -

Network Time Foundation reports:

-
-

NTF's NTP Project has been notified of the following - 1 medium-severity vulnerability that is fixed in - ntp-4.2.8p5, released on Thursday, 7 January 2016:

-

NtpBug2956: Small-step/Big-step CVE-2015-5300

-
- - - - SA-16:02.ntp - CVE-2015-5300 - https://www.cs.bu.edu/~goldbe/NTPattack.html - http://support.ntp.org/bin/view/Main/NtpBug2956 - http://support.ntp.org/bin/view/Main/SecurityNotice#January_2016_NTP_4_2_8p5_Securit - - - 2015-10-21 - 2016-01-08 - 2016-08-09 - - - - - dhcpcd -- multiple vulnerabilities - - - dhcpcd - 6.10.0 - - - - -

Nico Golde reports:

-
-

heap overflow via malformed dhcp responses later in print_option - (via dhcp_envoption1) due to incorrect option length values. - Exploitation is non-trivial, but I'd love to be proven wrong.

-

invalid read/crash via malformed dhcp responses. not exploitable - beyond DoS as far as I can judge.

-
- - - - CVE-2016-1503 - CVE-2016-1504 - ports/206015 - http://roy.marples.name/projects/dhcpcd/info/76a1609352263bd9def1300d7ba990679571fa30 - http://roy.marples.name/projects/dhcpcd/info/595883e2a431f65d8fabf33059aa4689cca17403 - http://www.openwall.com/lists/oss-security/2016/01/07/3 - - - 2016-01-04 - 2016-01-08 - - - - - mbedTLS/PolarSSL -- SLOTH attack on TLS 1.2 server authentication - - - polarssl13 - 1.3.16 - - - mbedtls - 2.2.1 - - - - -

ARM Limited reports:

-
-

MD5 handshake signatures in TLS 1.2 are vulnerable to the SLOTH attack - on TLS 1.2 server authentication. They have been disabled by default. - Other attacks from the SLOTH paper do not apply to any version of mbed - TLS or PolarSSL.

-
- - - - https://tls.mbed.org/tech-updates/releases/mbedtls-2.2.1-2.1.4-1.3.16-and-polarssl.1.2.19-released - - - 2016-01-04 - 2016-01-07 - - - - - xen-kernel -- ioreq handling possibly susceptible to multiple read issue - - - xen-kernel - 4.5.2_1 - - - - -

The Xen Project reports:

-
-

Single memory accesses in source code can be translated to multiple - ones in machine code by the compiler, requiring special caution when - accessing shared memory. Such precaution was missing from the - hypervisor code inspecting the state of I/O requests sent to the - device model for assistance.

-

Due to the offending field being a bitfield, it is however believed - that there is no issue in practice, since compilers, at least when - optimizing (which is always the case for non-debug builds), should find - it more expensive to extract the bit field value twice than to keep the - calculated value in a register.

-

This vulnerability is exposed to malicious device models. In - conventional Xen systems this means the qemu which service an HVM - domain. On such systems this vulnerability can only be exploited if - the attacker has gained control of the device model qemu via another - vulnerability.

-

Privilege escalation, host crash (Denial of Service), and leaked - information all cannot be excluded.

-
- - - - ports/205841 - http://xenbits.xen.org/xsa/advisory-166.html - - - 2015-12-17 - 2016-01-06 - - - - - xen-kernel -- information leak in legacy x86 FPU/XMM initialization - - - xen-kernel - 4.5.2_1 - - - - -

The Xen Project reports:

-
-

When XSAVE/XRSTOR are not in use by Xen to manage guest extended - register state, the initial values in the FPU stack and XMM - registers seen by the guest upon first use are those left there by - the previous user of those registers.

-

A malicious domain may be able to leverage this to obtain sensitive - information such as cryptographic keys from another domain.

-
- - - - CVE-2015-8555 - ports/205841 - http://xenbits.xen.org/xsa/advisory-165.html - - - 2015-12-17 - 2016-01-06 - - - - - xen-tools -- libxl leak of pv kernel and initrd on error - - - xen-tools - 4.14.5.2_1 - - - - -

The Xen Project reports:

-
-

When constructing a guest which is configured to use a PV - bootloader which runs as a userspace process in the toolstack domain - (e.g. pygrub) libxl creates a mapping of the files to be used as - kernel and initial ramdisk when building the guest domain.

-

However if building the domain subsequently fails these mappings - would not be released leading to a leak of virtual address space in - the calling process, as well as preventing the recovery of the - temporary disk files containing the kernel and initial ramdisk.

-

For toolstacks which manage multiple domains within the same - process, an attacker who is able to repeatedly start a suitable - domain (or many such domains) can cause an out-of-memory condition in the - toolstack process, leading to a denial of service.

-

Under the same circumstances an attacker can also cause files to - accumulate on the toolstack domain filesystem (usually under /var in - dom0) used to temporarily store the kernel and initial ramdisk, - perhaps leading to a denial of service against arbitrary other - services using that filesystem.

-
- - - - CVE-2015-8341 - ports/205841 - http://xenbits.xen.org/xsa/advisory-160.html - - - 2015-12-08 - 2016-01-06 - - - - - xen-kernel -- XENMEM_exchange error handling issues - - - xen-kernel - 4.5.2_1 - - - - -

The Xen Project reports:

-
-

Error handling in the operation may involve handing back pages to - the domain. This operation may fail when in parallel the domain gets - torn down. So far this failure unconditionally resulted in the host - being brought down due to an internal error being assumed. This is - CVE-2015-8339.

-

Furthermore error handling so far wrongly included the release of a - lock. That lock, however, was either not acquired or already released - on all paths leading to the error handling sequence. This is - CVE-2015-8340.

-

A malicious guest administrator may be able to deny service by - crashing the host or causing a deadlock.

-
- - - - CVE-2015-8339 - CVE-2015-8340 - ports/205841 - http://xenbits.xen.org/xsa/advisory-159.html - - - 2015-12-08 - 2016-01-06 - - - - - tiff -- out-of-bounds read in CIE Lab image format - - - tiff - 4.0.6_1 - - - linux-c6-tiff - 3.9.4_2 - - - linux-f10-tiff - * - - - - -

zzf of Alibaba discovered an out-of-bounds vulnerability in the code - processing the LogLUV and CIE Lab image format files. An attacker - could create a specially-crafted TIFF file that could cause libtiff - to crash.

- - - - CVE-2015-8683 - http://www.openwall.com/lists/oss-security/2015/12/25/2 - - - 2015-12-25 - 2016-01-05 - 2016-09-06 - - - - - tiff -- out-of-bounds read in tif_getimage.c - - - tiff - 4.0.6_1 - - - linux-c6-tiff - 3.9.4_2 - - - linux-f10-tiff - * - - - - -

LMX of Qihoo 360 Codesafe Team discovered an out-of-bounds read in - tif_getimage.c. An attacker could create a specially-crafted TIFF - file that could cause libtiff to crash.

- - - - CVE-2015-8665 - http://www.openwall.com/lists/oss-security/2015/12/24/2 - - - 2015-12-24 - 2016-01-05 - 2016-09-06 - - - - - unzip -- multiple vulnerabilities - - - unzip - 6.0_7 - - - - -

Gustavo Grieco reports:

-
-

Two issues were found in unzip 6.0:

-

* A heap overflow triggered by unzipping a file with password - (e.g unzip -p -P x sigsegv.zip).

-

* A denegation of service with a file that never finishes unzipping - (e.g. unzip sigxcpu.zip).

-
- - - - http://www.openwall.com/lists/oss-security/2015/09/07/4 - ports/204413 - CVE-2015-7696 - CVE-2015-7697 - - - 2015-09-26 - 2016-01-04 - - - - - cacti -- SQL injection vulnerabilities - - - cacti - 0.8.8f_1 - - - - -

NVD reports:

-
-

SQL injection vulnerability in include/top_graph_header.php in - Cacti 0.8.8f and earlier allows remote attackers to execute arbitrary - SQL commands via the rra_id parameter in a properties action to - graph.php.

-
- - - - CVE-2015-8369 - http://bugs.cacti.net/view.php?id=2646 - http://svn.cacti.net/viewvc?view=rev&revision=7767 - http://seclists.org/fulldisclosure/2015/Dec/8 - - - 2015-12-05 - 2016-01-05 - - - - - kea -- unexpected termination while handling a malformed packet - - - kea - 0.9.21.0.0 - - - - -

ISC Support reports:

-
-

ISC Kea may terminate unexpectedly (crash) while handling - a malformed client packet. Related defects in the kea-dhcp4 - and kea-dhcp6 servers can cause the server to crash during - option processing if a client sends a malformed packet. - An attacker sending a crafted malformed packet can cause - an ISC Kea server providing DHCP services to IPv4 or IPv6 - clients to exit unexpectedly.

-
    -

  • The kea-dhcp4 server is vulnerable only in versions - 0.9.2 and 1.0.0-beta, and furthermore only when logging - at debug level 40 or higher. Servers running kea-dhcp4 - versions 0.9.1 or lower, and servers which are not - logging or are logging at debug level 39 or below are - not vulnerable.

    • -

  • The kea-dhcp6 server is vulnerable only in versions - 0.9.2 and 1.0.0-beta, and furthermore only when - logging at debug level 45 or higher. Servers running - kea-dhcp6 versions 0.9.1 or lower, and servers - which are not logging or are logging at debug level 44 - or below are not vulnerable.

    • -
-
- - - - CVE-2015-8373 - https://kb.isc.org/article/AA-01318/0/CVE-2015-8373-ISC-Kea%3A-unexpected-termination-while-handling-a-malformed-packet.html - - - 2015-12-15 - 2016-01-04 - 2016-01-05 - - - - - mini_httpd -- buffer overflow via snprintf - - - mini_httpd - 1.23 - - - - -

ACME Updates reports:

-
-

mini_httpd 1.21 and earlier allows remote attackers to obtain - sensitive information from process memory via an HTTP request with - a long protocol string, which triggers an incorrect response size - calculation and an out-of-bounds read.

-

(rene) ACME, the author, claims that the vulnerability is fixed - *after* version 1.22, released on 2015-12-28

-
- - - - CVE-2015-1548 - https://cxsecurity.com/cveshow/CVE-2015-1548 - http://acme.com/updates/archive/192.html - - - 2015-02-10 - 2016-01-03 - - - - - qemu -- denial of service vulnerability in Rocker switch emulation - - - qemu - qemu-devel - 2.5.50 - - - qemu-sbruno - qemu-user-static - 2.5.50.g20160213 - - - - -

Prasad J Pandit, Red Hat Product Security Team, reports:

-
-

Qemu emulator built with the Rocker switch emulation support is - vulnerable to an off-by-one error. It happens while processing - transmit(tx) descriptors in 'tx_consume' routine, if a descriptor - was to have more than allowed (ROCKER_TX_FRAGS_MAX=16) fragments. -

-

A privileged user inside guest could use this flaw to cause memory - leakage on the host or crash the Qemu process instance resulting in - DoS issue.

-
- - - - CVE-2015-8701 - ports/205813 - ports/205814 - http://www.openwall.com/lists/oss-security/2015/12/28/6 - https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg04629.html - http://git.qemu.org/?p=qemu.git;a=commit;h=007cd223de527b5f41278f2d886c1a4beb3e67aa - https://github.com/seanbruno/qemu-bsd-user/commit/007cd223de527b5f41278f2d886c1a4beb3e67aa - - - 2015-12-28 - 2016-01-03 - 2016-07-06 - - - - - qemu -- denial of service vulnerability in Q35 chipset emulation - - - qemu - qemu-devel - 2.5.50 - - - qemu-sbruno - qemu-user-static - 2.5.50.g20151224 - - - - -

Prasad J Pandit, Red Hat Product Security Team, reports:

-
-

Qemu emulator built with the Q35 chipset based pc system emulator - is vulnerable to a heap based buffer overflow. It occurs during VM - guest migration, as more(16 bytes) data is moved into allocated - (8 bytes) memory area.

-

A privileged guest user could use this issue to corrupt the VM - guest image, potentially leading to a DoS. This issue affects q35 - machine types.

-
- - - - CVE-2015-8666 - http://www.openwall.com/lists/oss-security/2015/12/24/1 - http://git.qemu.org/?p=qemu.git;a=commit;h=d9a3b33d2c9f996537b7f1d0246dee2d0120cefb - https://github.com/seanbruno/qemu-bsd-user/commit/d9a3b33d2c9f996537b7f1d0246dee2d0120cefb - - - 2015-11-19 - 2016-01-03 - 2016-07-06 - - - - - qemu -- denial of service vulnerability in Human Monitor Interface support - - - qemu - qemu-devel - 2.5.0 - - - qemu-sbruno - qemu-user-static - 2.5.50.g20160213 - - - - -

Prasad J Pandit, Red Hat Product Security Team, reports:

-
-

Qemu emulator built with the Human Monitor Interface(HMP) support - is vulnerable to an OOB write issue. It occurs while processing - 'sendkey' command in hmp_sendkey routine, if the command argument is - longer than the 'keyname_buf' buffer size.

-

A user/process could use this flaw to crash the Qemu process - instance resulting in DoS.

-
- - - - CVE-2015-8619 - ports/205813 - ports/205814 - http://www.openwall.com/lists/oss-security/2015/12/22/8 - https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg02930.html - http://git.qemu.org/?p=qemu.git;a=commit;h=64ffbe04eaafebf4045a3ace52a360c14959d196 - https://github.com/seanbruno/qemu-bsd-user/commit/64ffbe04eaafebf4045a3ace52a360c14959d196 - - - 2015-12-23 - 2016-01-03 - 2016-07-06 - - - - - qemu -- denial of service vulnerability in MegaRAID SAS HBA emulation - - - qemu - qemu-devel - 2.5.0 - - - qemu-sbruno - qemu-user-static - 2.5.50.g20160213 - - - - -

Prasad J Pandit, Red Hat Product Security Team, reports:

-
-

Qemu emulator built with the SCSI MegaRAID SAS HBA emulation - support is vulnerable to a stack buffer overflow issue. It occurs - while processing the SCSI controller's CTRL_GET_INFO command. A - privileged guest user could use this flaw to crash the Qemu process - instance resulting in DoS.

-
- - - - CVE-2015-8613 - ports/205813 - ports/205814 - http://www.openwall.com/lists/oss-security/2015/12/21/7 - https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg03737.html - http://git.qemu.org/?p=qemu.git;a=commit;h=36fef36b91f7ec0435215860f1458b5342ce2811 - https://github.com/seanbruno/qemu-bsd-user/commit/36fef36b91f7ec0435215860f1458b5342ce2811 - - - 2015-12-21 - 2016-01-03 - 2016-07-06 - - - - - qemu -- denial of service vulnerability in VMWARE VMXNET3 NIC support - - - qemu - qemu-devel - 2.5.0 - - - qemu-sbruno - qemu-user-static - 2.5.50.g20160213 - - - - -

Prasad J Pandit, Red Hat Product Security Team, reports:

-
-

Qemu emulator built with a VMWARE VMXNET3 paravirtual NIC emulator - support is vulnerable to a memory leakage flaw. It occurs when a - guest repeatedly tries to activate the vmxnet3 device.

-

A privileged guest user could use this flaw to leak host memory, - resulting in DoS on the host.

-
- - - - CVE-2015-8567 - CVE-2015-8568 - ports/205813 - ports/205814 - http://www.openwall.com/lists/oss-security/2015/12/15/4 - https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg02299.html - http://git.qemu.org/?p=qemu.git;a=commit;h=aa4a3dce1c88ed51b616806b8214b7c8428b7470 - https://github.com/seanbruno/qemu-bsd-user/commit/aa4a3dce1c88ed51b616806b8214b7c8428b7470 - - - 2015-12-15 - 2016-01-03 - 2016-07-06 - - - - - qemu -- denial of service vulnerability in USB EHCI emulation support - - - qemu - qemu-devel - 2.5.0 - - - qemu-sbruno - qemu-user-static - 2.5.50.g20151224 - - - - -

Prasad J Pandit, Red Hat Product Security Team, reports:

-
-

Qemu emulator built with the USB EHCI emulation support is - vulnerable to an infinite loop issue. It occurs during communication - between host controller interface(EHCI) and a respective device - driver. These two communicate via a isochronous transfer descriptor - list(iTD) and an infinite loop unfolds if there is a closed loop in - this list.

-

A privileges user inside guest could use this flaw to consume - excessive CPU cycles & resources on the host.

-
- - - - CVE-2015-8558 - ports/205814 - http://www.openwall.com/lists/oss-security/2015/12/14/9 - http://git.qemu.org/?p=qemu.git;a=commit;h=156a2e4dbffa85997636a7a39ef12da6f1b40254 - https://github.com/seanbruno/qemu-bsd-user/commit/156a2e4dbffa85997636a7a39ef12da6f1b40254 - - - 2015-12-14 - 2016-01-03 - - - - - qemu -- denial of service vulnerability in MSI-X support - - - qemu - qemu-devel - 2.5.0 - - - qemu-sbruno - qemu-user-static - 2.5.50.g20151224 - - - - -

Prasad J Pandit, Red Hat Product Security Team, reports:

-
-

Qemu emulator built with the PCI MSI-X support is vulnerable to - null pointer dereference issue. It occurs when the controller - attempts to write to the pending bit array(PBA) memory region. - Because the MSI-X MMIO support did not define the .write method.

-

A privileges used inside guest could use this flaw to crash the - Qemu process resulting in DoS issue.

-
- - - - CVE-2015-7549 - http://www.openwall.com/lists/oss-security/2015/12/14/2 - http://git.qemu.org/?p=qemu.git;a=commit;h=43b11a91dd861a946b231b89b7542856ade23d1b - https://github.com/seanbruno/qemu-bsd-user/commit/43b11a91dd861a946b231b89b7542856ade23d1b - - - 2015-06-26 - 2016-01-03 - - - - - qemu -- denial of service vulnerability in VNC - - - qemu - qemu-devel - 2.5.0 - - - qemu-sbruno - qemu-user-static - 2.5.50.g20151224 - - - - -

Prasad J Pandit, Red Hat Product Security Team, reports:

-
-

Qemu emulator built with the VNC display driver support is - vulnerable to an arithmetic exception flaw. It occurs on the VNC - server side while processing the 'SetPixelFormat' messages from a - client.

-

A privileged remote client could use this flaw to crash the guest - resulting in DoS.

-
- - - - CVE-2015-8504 - http://www.openwall.com/lists/oss-security/2015/12/08/4 - http://git.qemu.org/?p=qemu.git;a=commitdiff;h=4c65fed8bdf96780735dbdb92a8bd0d6b6526cc3 - https://github.com/seanbruno/qemu-bsd-user/commit/4c65fed8bdf96780735dbdb92a8bd0d6b6526cc3 - - - 2015-12-08 - 2016-01-03 - - - - - qemu and xen-tools -- denial of service vulnerabilities in AMD PC-Net II NIC support - - - qemu - qemu-devel - 2.5.0 - - - qemu-sbruno - qemu-user-static - 2.5.50.g20151224 - - - xen-tools - 4.5.2_1 - - - - -

Prasad J Pandit, Red Hat Product Security Team, reports:

-
-

Qemu emulator built with the AMD PC-Net II Ethernet Controller - support is vulnerable to a heap buffer overflow flaw. While - receiving packets in the loopback mode, it appends CRC code to the - receive buffer. If the data size given is same as the receive buffer - size, the appended CRC code overwrites 4 bytes beyond this - 's->buffer' array.

-

A privileged(CAP_SYS_RAWIO) user inside guest could use this flaw - to crash the Qemu instance resulting in DoS or potentially execute - arbitrary code with privileges of the Qemu process on the host.

-
-
-

The AMD PC-Net II emulator(hw/net/pcnet.c), while receiving packets - from a remote host(non-loopback mode), fails to validate the - received data size, thus resulting in a buffer overflow issue. It - could potentially lead to arbitrary code execution on the host, with - privileges of the Qemu process. It requires the guest NIC to have - larger MTU limit.

-

A remote user could use this flaw to crash the guest instance - resulting in DoS or potentially execute arbitrary code on a remote - host with privileges of the Qemu process.

-
- - - - CVE-2015-7504 - CVE-2015-7512 - http://www.openwall.com/lists/oss-security/2015/11/30/2 - http://www.openwall.com/lists/oss-security/2015/11/30/3 - http://git.qemu.org/?p=qemu.git;a=commit;h=837f21aacf5a714c23ddaadbbc5212f9b661e3f7 - http://git.qemu.org/?p=qemu.git;a=commit;h=8b98a2f07175d46c3f7217639bd5e03f2ec56343 - https://github.com/seanbruno/qemu-bsd-user/commit/837f21aacf5a714c23ddaadbbc5212f9b661e3f7 - https://github.com/seanbruno/qemu-bsd-user/commit/8b98a2f07175d46c3f7217639bd5e03f2ec56343 - http://xenbits.xen.org/xsa/advisory-162.html - - - 2015-11-30 - 2016-01-03 - 2016-01-06 - - - - - qemu -- denial of service vulnerabilities in eepro100 NIC support - - - qemu - qemu-devel - 2.5.50 - - - qemu-sbruno - qemu-user-static - 2.5.50.g20160213 - - - - -

Prasad J Pandit, Red Hat Product Security Team, reports:

-
-

Qemu emulator built with the i8255x (PRO100) emulation support is - vulnerable to an infinite loop issue. It could occur while - processing a chain of commands located in the Command Block List - (CBL). Each Command Block(CB) points to the next command in the - list. An infinite loop unfolds if the link to the next CB points - to the same block or there is a closed loop in the chain.

-

A privileged(CAP_SYS_RAWIO) user inside guest could use this flaw - to crash the Qemu instance resulting in DoS.

-
- - - - CVE-2015-8345 - ports/205813 - ports/205814 - http://www.openwall.com/lists/oss-security/2015/11/25/3 - https://lists.gnu.org/archive/html/qemu-devel/2015-10/msg03911.html - http://git.qemu.org/?p=qemu.git;a=commit;h=00837731d254908a841d69298a4f9f077babaf24 - https://github.com/seanbruno/qemu-bsd-user/commit/00837731d254908a841d69298a4f9f077babaf24 - - - 2015-10-16 - 2016-01-03 - 2016-07-06 - - - - - qemu -- denial of service vulnerability in virtio-net support - - - qemu - qemu-devel - 2.4.1 - - - qemu-sbruno - qemu-user-static - 2.5.50.g20151224 - - - - -

Prasad J Pandit, Red Hat Product Security Team, reports:

-
-

Qemu emulator built with the Virtual Network Device(virtio-net) - support is vulnerable to a DoS issue. It could occur while receiving - large packets over the tuntap/macvtap interfaces and when guest's - virtio-net driver did not support big/mergeable receive buffers.

-

An attacker on the local network could use this flaw to disable - guest's networking by sending a large number of jumbo frames to the - guest, exhausting all receive buffers and thus leading to a DoS - situation.

-
- - - - CVE-2015-7295 - http://www.openwall.com/lists/oss-security/2015/09/18/5 - http://git.qemu.org/?p=qemu.git;a=commit;h=696317f1895e836d53b670c7b77b7be93302ba08 - https://github.com/seanbruno/qemu-bsd-user/commit/0cf33fb6b49a19de32859e2cdc6021334f448fb3 - - - 2015-09-18 - 2016-01-02 - - - - - qemu -- denial of service vulnerabilities in NE2000 NIC support - - - qemu - qemu-devel - 2.4.0.1 - - - qemu-sbruno - qemu-user-static - 2.5.50.g20151224 - - - - -

Prasad J Pandit, Red Hat Product Security Team, reports:

-
-

Qemu emulator built with the NE2000 NIC emulation support is - vulnerable to an infinite loop issue. It could occur when receiving - packets over the network.

-

A privileged user inside guest could use this flaw to crash the - Qemu instance resulting in DoS.

-
-
-

Qemu emulator built with the NE2000 NIC emulation support is - vulnerable to a heap buffer overflow issue. It could occur when - receiving packets over the network.

-

A privileged user inside guest could use this flaw to crash the - Qemu instance or potentially execute arbitrary code on the host.

-
- - - - CVE-2015-5278 - CVE-2015-5279 - http://www.openwall.com/lists/oss-security/2015/09/15/2 - http://www.openwall.com/lists/oss-security/2015/09/15/3 - http://git.qemu.org/?p=qemu.git;a=commit;h=5a1ccdfe44946e726b4c6fda8a4493b3931a68c1 - https://github.com/seanbruno/qemu-bsd-user/commit/737d2b3c41d59eb8f94ab7eb419b957938f24943 - http://git.qemu.org/?p=qemu.git;a=commit;h=7aa2bcad0ca837dd6d4bf4fa38a80314b4a6b755 - https://github.com/seanbruno/qemu-bsd-user/commit/9bbdbc66e5765068dce76e9269dce4547afd8ad4 - - - 2015-09-15 - 2016-01-02 - - - - - qemu -- denial of service vulnerability in IDE disk/CD/DVD-ROM emulation - - - qemu - qemu-devel - 2.4.1 - - - qemu-sbruno - qemu-user-static - 2.5.50.g20151224 - - - - -

Prasad J Pandit, Red Hat Product Security Team, reports:

-
-

Qemu emulator built with the IDE disk and CD/DVD-ROM emulation - support is vulnerable to a divide by zero issue. It could occur - while executing an IDE command WIN_READ_NATIVE_MAX to determine - the maximum size of a drive.

-

A privileged user inside guest could use this flaw to crash the - Qemu instance resulting in DoS.

-
- - - - CVE-2015-6855 - http://www.openwall.com/lists/oss-security/2015/09/10/1 - http://git.qemu.org/?p=qemu.git;a=commit;h=63d761388d6fea994ca498c6e7a210851a99ad93 - https://github.com/seanbruno/qemu-bsd-user/commit/d9033e1d3aa666c5071580617a57bd853c5d794a - - - 2015-09-09 - 2016-01-02 - - - - - qemu -- denial of service vulnerability in e1000 NIC support - - - qemu - qemu-devel - 2.4.0.1 - - - qemu-sbruno - qemu-user-static - 2.5.50.g20151224 - - - - -

Prasad J Pandit, Red Hat Product Security Team, reports:

-
-

Qemu emulator built with the e1000 NIC emulation support is - vulnerable to an infinite loop issue. It could occur while - processing transmit descriptor data when sending a network packet. -

-

A privileged user inside guest could use this flaw to crash the - Qemu instance resulting in DoS.

-
- - - - CVE-2015-6815 - http://www.openwall.com/lists/oss-security/2015/09/04/4 - http://git.qemu.org/?p=qemu.git;a=commit;h=3a56af1fbc17ff453f6e90fb08ce0c0e6fd0b61b - https://github.com/seanbruno/qemu-bsd-user/commit/b947ac2bf26479e710489739c465c8af336599e7 - - - 2015-09-04 - 2016-01-02 - - - - - qemu -- denial of service vulnerability in VNC - - - qemu - qemu-devel - 2.1.0 - - - qemu-sbruno - qemu-user-static - 2.2.50.g20141230 - - - - -

Prasad J Pandit, Red Hat Product Security Team, reports:

-
-

Qemu emulator built with the VNC display driver is vulnerable to an - infinite loop issue. It could occur while processing a - CLIENT_CUT_TEXT message with specially crafted payload message.

-

A privileged guest user could use this flaw to crash the Qemu - process on the host, resulting in DoS.

-
- - - - CVE-2015-5239 - http://www.openwall.com/lists/oss-security/2015/09/02/7 - http://git.qemu.org/?p=qemu.git;a=commit;h=f9a70e79391f6d7c2a912d785239ee8effc1922d - https://github.com/seanbruno/qemu-bsd-user/commit/f9a70e79391f6d7c2a912d785239ee8effc1922d - - - 2014-06-30 - 2016-01-02 - - - - - qemu -- buffer overflow vulnerability in VNC - - - qemu - qemu-devel - 2.4.0.1 - - - qemu-sbruno - qemu-user-static - 2.4.50.g20151011 - - - - -

Prasad J Pandit, Red Hat Product Security Team, reports:

-
-

Qemu emulator built with the VNC display driver support is - vulnerable to a buffer overflow flaw leading to a heap memory - corruption issue. It could occur while refreshing the server - display surface via routine vnc_refresh_server_surface().

-

A privileged guest user could use this flaw to corrupt the heap - memory and crash the Qemu process instance OR potentially use it - to execute arbitrary code on the host.

-
- - - - CVE-2015-5225 - http://www.openwall.com/lists/oss-security/2015/08/21/6 - http://git.qemu.org/?p=qemu.git;a=commit;h=efec4dcd2552e85ed57f276b58f09fc385727450 - https://github.com/seanbruno/qemu-bsd-user/commit/eb8934b0418b3b1d125edddc4fc334a54334a49b - - - 2015-08-17 - 2016-01-01 - - - - - qemu -- buffer overflow vulnerability in virtio-serial message exchanges - - - qemu - qemu-devel - 2.4.0 - - - qemu-sbruno - qemu-user-static - 2.4.50.g20150814 - - - - -

Prasad J Pandit, Red Hat Product Security Team, reports:

-
-

Qemu emulator built with the virtio-serial vmchannel support is - vulnerable to a buffer overflow issue. It could occur while - exchanging virtio control messages between guest and the host.

-

A malicious guest could use this flaw to corrupt few bytes of Qemu - memory area, potentially crashing the Qemu process.

-
- - - - CVE-2015-5745 - http://www.openwall.com/lists/oss-security/2015/08/06/5 - http://git.qemu.org/?p=qemu.git;a=commit;h=7882080388be5088e72c425b02223c02e6cb4295 - https://github.com/seanbruno/qemu-bsd-user/commit/7882080388be5088e72c425b02223c02e6cb4295 - - - 2015-08-06 - 2016-01-01 - - - - - qemu -- stack buffer overflow while parsing SCSI commands - - - qemu - qemu-devel - 2.4.0 - - - qemu-sbruno - qemu-user-static - 2.4.50.g20150814 - - - - -

Prasad J Pandit, Red Hat Product Security Team, reports:

-
-

Qemu emulator built with the SCSI device emulation support is - vulnerable to a stack buffer overflow issue. It could occur while - parsing SCSI command descriptor block with an invalid operation - code.

-

A privileged(CAP_SYS_RAWIO) user inside guest could use this flaw - to crash the Qemu instance resulting in DoS.

-
- - - - CVE-2015-5158 - http://openwall.com/lists/oss-security/2015/07/23/6 - http://git.qemu.org/?p=qemu.git;a=commit;h=c170aad8b057223b1139d72e5ce7acceafab4fa9 - https://github.com/seanbruno/qemu-bsd-user/commit/c170aad8b057223b1139d72e5ce7acceafab4fa9 - - - 2015-07-23 - 2016-01-01 - - - - - qemu -- code execution on host machine - - - qemu - qemu-devel - 2.4.0 - - - qemu-sbruno - qemu-user-static - 2.4.50.g20150814 - - - - -

Petr Matousek of Red Hat Inc. reports:

-
-

Due converting PIO to the new memory read/write api we no longer - provide separate I/O region lenghts for read and write operations. - As a result, reading from PIT Mode/Command register will end with - accessing pit->channels with invalid index and potentially cause - memory corruption and/or minor information leak.

-

A privileged guest user in a guest with QEMU PIT emulation enabled - could potentially (tough unlikely) use this flaw to execute - arbitrary code on the host with the privileges of the hosting QEMU - process.

-

Please note that by default QEMU/KVM guests use in-kernel (KVM) PIT - emulation and are thus not vulnerable to this issue.

-
- - - - CVE-2015-3214 - http://openwall.com/lists/oss-security/2015/06/17/5 - http://git.qemu.org/?p=qemu.git;a=commit;h=d4862a87e31a51de9eb260f25c9e99a75efe3235 - https://github.com/seanbruno/qemu-bsd-user/commit/d4862a87e31a51de9eb260f25c9e99a75efe3235 - - - 2015-06-17 - 2016-01-01 - - - - - mono -- DoS and code execution - - - mono - 4.2 - - - - -

NCC Group reports:

-
-

An attacker who can cause a carefully-chosen string to be - converted to a floating-point number can cause a crash and potentially - induce arbitrary code execution.

-
- - - - http://seclists.org/oss-sec/2015/q4/543 - CVE-2009-0689 - - - 2015-12-19 - 2015-12-31 - - - - - flash -- multiple vulnerabilities - - - linux-c6-flashplugin - linux-f10-flashplugin - linux-c6_64-flashplugin - 11.2r202.559 - - - - -

Adobe reports:

-
-

These updates resolve a type confusion vulnerability that - could lead to code execution (CVE-2015-8644).

- -

These updates resolve an integer overflow vulnerability - that could lead to code execution (CVE-2015-8651).

- -

These updates resolve use-after-free vulnerabilities that - could lead to code execution (CVE-2015-8634, CVE-2015-8635, - CVE-2015-8638, CVE-2015-8639, CVE-2015-8640, CVE-2015-8641, - CVE-2015-8642, CVE-2015-8643, CVE-2015-8646, CVE-2015-8647, - CVE-2015-8648, CVE-2015-8649, CVE-2015-8650).

- -

These updates resolve memory corruption vulnerabilities - that could lead to code execution (CVE-2015-8459, - CVE-2015-8460, CVE-2015-8636, CVE-2015-8645).

-
- - - - CVE-2015-8459 - CVE-2015-8460 - CVE-2015-8634 - CVE-2015-8636 - CVE-2015-8638 - CVE-2015-8639 - CVE-2015-8640 - CVE-2015-8641 - CVE-2015-8642 - CVE-2015-8643 - CVE-2015-8644 - CVE-2015-8645 - CVE-2015-8646 - CVE-2015-8647 - CVE-2015-8648 - CVE-2015-8649 - CVE-2015-8650 - CVE-2015-8651 - https://helpx.adobe.com/security/products/flash-player/apsb16-01.html - - - 2015-12-28 - 2015-12-29 - - - - - inspircd -- DoS - - - inspircd - 2.0.19 - - - - -

Inspircd reports:

-
-

This release fixes the issues discovered since 2.0.18, - containing multiple important stability and correctness related - improvements, including a fix for a bug which allowed malformed DNS - records to cause netsplits on a network.

-
- - - - http://www.inspircd.org/2015/04/16/v2019-released.html - https://github.com/inspircd/inspircd/commit/6058483d9fbc1b904d5ae7cfea47bfcde5c5b559 - http://comments.gmane.org/gmane.comp.security.oss.general/18464 - CVE-2015-8702 - - - 2015-04-16 - 2015-12-29 - 2015-12-29 - - - - - ffmpeg -- multiple vulnerabilities - - - libav - - 0 - - - gstreamer-ffmpeg - - - 0 - - - handbrake - - - 1.2.0 - - - ffmpeg - 2.8,12.8.4,1 - 2.7.4,1 - - - ffmpeg26 - 2.6.6 - - - ffmpeg25 - 2.5.9 - - - ffmpeg24 - 2.4.12 - - - ffmpeg-devel - ffmpeg23 - ffmpeg2 - ffmpeg1 - ffmpeg-011 - ffmpeg0 - - 0 - - - avidemux - avidemux2 - avidemux26 - - - 2.6.11 - - - kodi - - 16.0 - - - mplayer - mencoder - - 1.2.r20151219_1 - - - mythtv - mythtv-frontend - - 0.27.5,1 - - - plexhometheater - - - 0 - - - - -

NVD reports:

-
-

The ff_dwt_decode function in libavcodec/jpeg2000dwt.c in - FFmpeg before 2.8.4 does not validate the number of - decomposition levels before proceeding with Discrete Wavelet - Transform decoding, which allows remote attackers to cause a - denial of service (out-of-bounds array access) or possibly - have unspecified other impact via crafted JPEG 2000 - data.

-
-
-

The ff_get_buffer function in libavcodec/utils.c in - FFmpeg before 2.8.4 preserves width and height values after - a failure, which allows remote attackers to cause a denial - of service (out-of-bounds array access) or possibly have - unspecified other impact via a crafted .mov file.

-
- - - - CVE-2015-8662 - CVE-2015-8663 - https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=75422280fbcdfbe9dc56bde5525b4d8b280f1bc5 - https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=abee0a1c60612e8638640a8a3738fffb65e16dbf - https://ffmpeg.org/security.html - - - 2015-12-20 - 2015-12-28 - 2018-03-25 - - - - - NSS -- MD5 downgrade in TLS 1.2 signatures - - - nss - linux-c6-nss - 3.203.20.2 - 3.19.2.2 - - - linux-firefox - 43.0.2,1 - - - linux-thunderbird - 38.5.1 - - - linux-seamonkey - 2.40 - - - - -

The Mozilla Project reports:

-
-

Security researcher Karthikeyan Bhargavan reported an - issue in Network Security Services (NSS) where MD5 - signatures in the server signature within the TLS 1.2 - ServerKeyExchange message are still accepted. This is an - issue since NSS has officially disallowed the accepting MD5 - as a hash algorithm in signatures since 2011. This issues - exposes NSS based clients such as Firefox to theoretical - collision-based forgery attacks.

-
- - - - CVE-2015-7575 - https://www.mozilla.org/security/advisories/mfsa2015-150/ - https://hg.mozilla.org/projects/nss/rev/94e1157f3fbb - - - 2015-12-22 - 2015-12-28 - - - - - phpMyAdmin -- path disclosure vulnerability - - - phpMyAdmin - 4.5.04.5.3.1 - - - - -

The phpMyAdmin development team reports:

-
-

By calling some scripts that are part of phpMyAdmin in an - unexpected way, it is possible to trigger phpMyAdmin to - display a PHP error message which contains the full path of - the directory where phpMyAdmin is installed.

-

We consider these vulnerabilities to be non-critical.

-

This path disclosure is possible on servers where the - recommended setting of the PHP configuration directive - display_errors is set to on, which is against the - recommendations given in the PHP manual for a production - server.

-
- - - - https://www.phpmyadmin.net/security/PMASA-2015-6/ - CVE-2015-8669 - - - 2015-12-25 - 2015-12-26 - - - - - dpkg -- stack-based buffer overflow - - - dpkg - 1.16.17 - 1.17.26 - 1.18.4 - - - - -

Salvatore Bonaccorso reports:

-
-

Hanno Boeck discovered a stack-based buffer overflow in the - dpkg-deb component of dpkg, the Debian package management system. - This flaw could potentially lead to arbitrary code execution if a - user or an automated system were tricked into processing a specially - crafted Debian binary package (.deb) in the old style Debian binary - package format.

-
- - - - CVE-2015-0860 - http://openwall.com/lists/oss-security/2015/11/26/3 - https://anonscm.debian.org/cgit/dpkg/dpkg.git/commit/?id=f1aac7d933819569bf6f347c3c0d5a64a90bbce0 - - - 2015-11-26 - 2015-12-25 - - - - - mantis -- information disclosure vulnerability - - - mantis - 1.2.19_1 - - - - -

Mantis reports:

-
-

CVE-2015-5059: documentation in private projects can be seen by - every user

-
- - - - CVE-2015-5059 - ports/201106 - https://mantisbt.org/bugs/view.php?id=19873 - http://openwall.com/lists/oss-security/2015/06/25/3 - - - 2015-06-23 - 2015-12-24 - - - - - mediawiki -- multiple vulnerabilities - - - mediawiki123 - 1.23.12 - - - mediawiki124 - 1.24.5 - - - mediawiki125 - 1.25.4 - - - mediawiki126 - 1.26.1 - - - - -

MediaWiki reports:

-
-

(T117899) SECURITY: $wgArticlePath can no longer be set to relative - paths that do not begin with a slash. This enabled trivial XSS - attacks. Configuration values such as "http://my.wiki.com/wiki/$1" - are fine, as are "/wiki/$1". A value such as "$1" or "wiki/$1" is - not and will now throw an error.

-

(T119309) SECURITY: Use hash_compare() for edit token comparison. -

-

(T118032) SECURITY: Don't allow cURL to interpret POST parameters - starting with '@' as file uploads.

-

(T115522) SECURITY: Passwords generated by User::randomPassword() - can no longer be shorter than $wgMinimalPasswordLength.

-

(T97897) SECURITY: Improve IP parsing and trimming. Previous - behavior could result in improper blocks being issued.

-

(T109724) SECURITY: Special:MyPage, Special:MyTalk, - Special:MyContributions and related pages no longer use HTTP - redirects and are now redirected by MediaWiki.

-
- - - - CVE-2015-8622 - CVE-2015-8623 - CVE-2015-8624 - CVE-2015-8625 - CVE-2015-8626 - CVE-2015-8627 - CVE-2015-8628 - https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-December/000186.html - https://phabricator.wikimedia.org/T117899 - https://phabricator.wikimedia.org/T119309 - https://phabricator.wikimedia.org/T118032 - https://phabricator.wikimedia.org/T115522 - https://phabricator.wikimedia.org/T97897 - https://phabricator.wikimedia.org/T109724 - http://www.openwall.com/lists/oss-security/2015/12/23/7 - - - 2015-12-18 - 2015-12-24 - - - - - Ruby -- unsafe tainted string vulnerability - - - ruby - 2.0.0,12.0.0.648,1 - 2.1.0,12.1.8,1 - 2.2.0,12.2.4,1 - - - - -

Ruby developer reports:

-
-

There is an unsafe tainted string vulnerability in Fiddle and DL. - This issue was originally reported and fixed with CVE-2009-5147 in - DL, but reappeared after DL was reimplemented using Fiddle and - libffi.

-

And, about DL, CVE-2009-5147 was fixed at Ruby 1.9.1, but not - fixed at other branches, then rubies which bundled DL except Ruby - 1.9.1 are still vulnerable.

-
- - - - https://www.ruby-lang.org/en/news/2015/12/16/unsafe-tainted-string-usage-in-fiddle-and-dl-cve-2015-7551/ - CVE-2015-7551 - - - 2015-12-16 - 2015-12-23 - - - - - Bugzilla security issues - - - bugzilla44 - 4.4.11 - - - bugzilla50 - 5.0.2 - - - - -

Bugzilla Security Advisory

-
-

During the generation of a dependency graph, the code for - the HTML image map is generated locally if a local dot - installation is used. With escaped HTML characters in a bug - summary, it is possible to inject unfiltered HTML code in - the map file which the CreateImagemap function generates. - This could be used for a cross-site scripting attack.

-

If an external HTML page contains a <script> element with - its src attribute pointing to a buglist in CSV format, some - web browsers incorrectly try to parse the CSV file as valid - JavaScript code. As the buglist is generated based on the - privileges of the user logged into Bugzilla, the external - page could collect confidential data contained in the CSV - file.

-
- - - - CVE-2015-8508 - CVE-2015-8509 - https://bugzilla.mozilla.org/show_bug.cgi?id=1221518 - https://bugzilla.mozilla.org/show_bug.cgi?id=1232785 - - - 2015-12-22 - 2015-12-23 - - - - - librsvg2 -- denial of service vulnerability - - - librsvg2 - 2.40.12 - - - - -

Adam Maris, Red Hat Product Security, reports:

-
-

CVE-2015-7558: Stack exhaustion due to cyclic dependency causing to - crash an application was found in librsvg2 while parsing SVG file. - It has been fixed in 2.40.12 by many commits that has rewritten the - checks for cyclic references.

-
- - - - CVE-2015-7558 - ports/205502 - http://www.openwall.com/lists/oss-security/2015/12/21/5 - https://bugzilla.redhat.com/1268243 - - - 2015-10-02 - 2015-12-22 - - - - - librsvg2 -- denial of service vulnerability - - - librsvg2 - 2.40.7 - - - - -

Adam Maris, Red Hat Product Security, reports:

-
-

CVE-2015-7557: Out-of-bounds heap read in librsvg2 was found when - parsing SVG file.

-
- - - - CVE-2015-7557 - http://www.openwall.com/lists/oss-security/2015/12/21/5 - https://git.gnome.org/browse/librsvg/commit/rsvg-shapes.c?id=40af93e6eb1c94b90c3b9a0b87e0840e126bb8df - - - 2015-02-06 - 2015-12-22 - - - - - quassel -- remote denial of service - - - quassel - 0.12.2_1 - - - - -

Pierre Schweitzer reports:

-
-

Any client sending the command "/op *" in a query will - cause the Quassel core to crash.

-
- - - - http://www.openwall.com/lists/oss-security/2015/12/12/1 - CVE-2015-8547 - - - 2015-11-22 - 2015-12-18 - - - - - libvirt -- ACL bypass using ../ to access beyond storage pool - - - libvirt - 1.1.01.2.19_2 - 1.2.201.3.0 - - - - -

Libvit development team reports:

-
-

Various virStorageVol* API operate on user-supplied volume names by - concatenating the volume name to the pool location. Note that the - virStoragePoolListVolumes API, when used on a storage pool backed by - a directory in a file system, will only list volumes immediately in - that directory (there is no traversal into subdirectories). However, - other APIs such as virStorageVolCreateXML were not checking if a - potential volume name represented one of the volumes that could be - returned by virStoragePoolListVolumes; because they were not rejecting - the use of '/' in a volume name.

-

Because no checking was done on volume names, a user could supply - a potential volume name of something like '../../../etc/passwd' to - attempt to access a file not belonging to the storage pool. When - fine-grained Access Control Lists (ACL) are in effect, a user with - storage_vol:create ACL permission but lacking domain:write permission - could thus abuse virStorageVolCreateXML and similar APIs to gain - access to files not normally permitted to that user. Fortunately, it - appears that the only APIs that could leak information or corrupt - files require read-write connection to libvirtd; and when ACLs are not - in use (the default without any further configuration), a user with - read-write access can already be considered to have full access to the - machine, and without an escalation of privilege there is no security - problem.

-
- - - - CVE-2015-5313 - http://security.libvirt.org/2015/0004.html - - - 2015-10-30 - 2015-12-20 - - - - - samba -- multiple vulnerabilities - - - samba36 - 3.6.03.6.25_2 - - - samba4 - 4.0.04.0.26 - - - samba41 - 4.1.04.1.22 - - - samba42 - 4.2.04.2.7 - - - samba43 - 4.3.04.3.3 - - - ldb - 1.0.01.1.24 - - - - -

Samba team reports:

-
-

[CVE-2015-3223] Malicious request can cause Samba LDAP server to hang, spinning using CPU.

-

[CVE-2015-5330] Malicious request can cause Samba LDAP server - to return uninitialized memory that should not be part of the reply.

-

[CVE-2015-5296] Requesting encryption should also request - signing when setting up the connection to protect against man-in-the-middle attacks.

-

[CVE-2015-5299] A missing access control check in the VFS - shadow_copy2 module could allow unauthorized users to access snapshots.

-

[CVE-2015-7540] Malicious request can cause Samba LDAP server to return crash.

-

[CVE-2015-8467] Samba can expose Windows DCs to MS15-096 - Denial of service via the creation of multiple machine accounts(The Microsoft issue is CVE-2015-2535).

-

[CVE-2015-5252] Insufficient symlink verification could allow data access outside share path.

-
- - - - CVE-2015-3223 - https://www.samba.org/samba/security/CVE-2015-3223.html - CVE-2015-5252 - https://www.samba.org/samba/security/CVE-2015-5252.html - CVE-2015-5296 - https://www.samba.org/samba/security/CVE-2015-5296.html - CVE-2015-5299 - https://www.samba.org/samba/security/CVE-2015-5299.html - CVE-2015-5330 - https://www.samba.org/samba/security/CVE-2015-5330.html - CVE-2015-7540 - https://www.samba.org/samba/security/CVE-2015-7540.html - CVE-2015-8467 - https://www.samba.org/samba/security/CVE-2015-8467.html - - - 2015-12-16 - 2015-12-19 - 2016-02-05 - - - - - chromium -- multiple vulnerabilities - - - chromium - chromium-npapi - chromium-pulse - 47.0.2526.106 - - - - -

Google Chrome Releases reports:

-
-

2 security fixes in this release, including:

-
    -
  • [569486] CVE-2015-6792: Fixes from internal audits and - fuzzing.
    • -
-
- - - - CVE-2015-6792 - http://googlechromereleases.blogspot.nl/2015/12/stable-channel-update_15.html - - - 2015-12-16 - 2015-12-18 - - - - - cups-filters -- code execution - - - cups-filters - 1.4.0 - - - foomatic-filters - 4.0.17_4 - - - - -

Till Kamppeter reports:

-
-

Cups Filters/Foomatic Filters does not consider semicolon - as an illegal escape character.

-
- - - - http://www.openwall.com/lists/oss-security/2015/12/14/13 - CVE-2015-8560 - - - 2015-12-12 - 2015-12-17 - - - - - cups-filters -- code execution - - - cups-filters - 1.2.0 - - - foomatic-filters - 4.0.17_4 - - - - -

Salvatore Bonaccorso reports:

-
-

Cups Filters/Foomatic Filters does not consider backtick - as an illegal escape character.

-
- - - - http://www.openwall.com/lists/oss-security/2015/12/13/2 - CVE-2015-8327 - - - 2015-10-30 - 2015-12-17 - - - - - py-amf -- input sanitization errors - - - py27-amf - py32-amf - py33-amf - py34-amf - 0.8.0 - - - - -

oCERT reports:

-
-

A specially crafted AMF payload, containing malicious - references to XML external entities, can be used to trigger Denial of - Service (DoS) conditions or arbitrarily return the contents of files - that are accessible with the running application privileges.

-
- - - - http://www.ocert.org/advisories/ocert-2015-011.html - CVE-2015-8549 - - - 2015-12-01 - 2015-12-17 - - - - - joomla -- multiple vulnerabilities - - - joomla3 - 3.4.6 - - - - -

The JSST and the Joomla! Security Center report:

-
-

[20151201] - Core - Remote Code Execution Vulnerability

-

Browser information is not filtered properly while saving the - session values into the database which leads to a Remote Code - Execution vulnerability.

-
-
-

[20151202] - Core - CSRF Hardening

-

Add additional CSRF hardening in com_templates.

-
-
-

[20151203] - Core - Directory Traversal

-

Failure to properly sanitize input data from the XML install file - located within an extension's package archive allows for directory - traversal.

-
-
-

[20151204] - Core - Directory Traversal

-

Inadequate filtering of request data leads to a Directory Traversal - vulnerability.

-
- - - - https://www.joomla.org/announcements/release-news/5641-joomla-3-4-6-released.html - CVE-2015-8562 - CVE-2015-8563 - CVE-2015-8564 - CVE-2015-8565 - https://developer.joomla.org/security-centre/630-20151214-core-remote-code-execution-vulnerability.html - https://developer.joomla.org/security-centre/633-20151214-core-csrf-hardening.html - https://developer.joomla.org/security-centre/634-20151214-core-directory-traversal.html - https://developer.joomla.org/security-centre/635-20151214-core-directory-traversal-2.html - - - 2015-12-14 - 2015-12-17 - 2016-12-22 - - - - - bind -- multiple vulnerabilities - - - bind99 - 9.9.8P2 - - - bind910 - 9.10.3P2 - - - bind9-devel - 9.11.0.a20151215 - - - FreeBSD - 9.39.3_32 - - - - -

ISC reports:

-
-

Named is potentially vulnerable to the OpenSSL vulnerability described in CVE-2015-3193.

-

Incorrect reference counting could result in an INSIST - failure if a socket error occurred while performing a lookup. This flaw - is disclosed in CVE-2015-8461. [RT#40945]

-

Insufficient testing when parsing a message allowed records - with an incorrect class to be be accepted, triggering a REQUIRE failure - when those records were subsequently cached. This flaw is disclosed in - CVE-2015-8000. [RT #40987]

-
- - - - https://kb.isc.org/article/AA-01328/0/BIND-9.10.3-P2-Release-Notes.html - https://kb.isc.org/article/AA-01317/0/CVE-2015-8000%3A-Responses-with-a-malformed-class-attribute-can-trigger-an-assertion-failure-in-db.c.html - https://kb.isc.org/article/AA-01319/0/CVE-2015-8461%3A-A-race-condition-when-handling-socket-errors-can-lead-to-an-assertion-failure-in-resolver.c.html - CVE-2015-3193 - CVE-2015-8000 - CVE-2015-8461 - SA-15:27.bind - - - 2015-11-24 - 2015-12-16 - 2016-08-09 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 43.0,1 - - - linux-firefox - 43.0,1 - - - seamonkey - 2.40 - - - linux-seamonkey - 2.40 - - - firefox-esr - 38.5.0,1 - - - libxul - 38.5.0 - - - thunderbird - 38.5.0 - - - linux-thunderbird - 38.5.0 - - - - -

The Mozilla Project reports:

-
-

MFSA 2015-134 Miscellaneous memory safety hazards - (rv:43.0 / rv:38.5)

-

MFSA 2015-135 Crash with JavaScript variable assignment - with unboxed objects

-

MFSA 2015-136 Same-origin policy violation using - perfomance.getEntries and history navigation

-

MFSA 2015-137 Firefox allows for control characters to be - set in cookies

-

MFSA 2015-138 Use-after-free in WebRTC when datachannel - is used after being destroyed

-

MFSA 2015-139 Integer overflow allocating extremely large - textures

-

MFSA 2015-140 Cross-origin information leak through web - workers error events

-

MFSA 2015-141 Hash in data URI is incorrectly parsed

-

MFSA 2015-142 DOS due to malformed frames in HTTP/2

-

MFSA 2015-143 Linux file chooser crashes on malformed - images due to flaws in Jasper library

-

MFSA 2015-144 Buffer overflows found through code - inspection

-

MFSA 2015-145 Underflow through code inspection

-

MFSA 2015-146 Integer overflow in MP4 playback in 64-bit - versions

-

MFSA 2015-147 Integer underflow and buffer overflow - processing MP4 metadata in libstagefright

-

MFSA 2015-148 Privilege escalation vulnerabilities in - WebExtension APIs

-

MFSA 2015-149 Cross-site reading attack through data and - view-source URIs

-
- - - - CVE-2015-7201 - CVE-2015-7202 - CVE-2015-7203 - CVE-2015-7204 - CVE-2015-7205 - CVE-2015-7207 - CVE-2015-7208 - CVE-2015-7210 - CVE-2015-7211 - CVE-2015-7212 - CVE-2015-7213 - CVE-2015-7214 - CVE-2015-7215 - CVE-2015-7216 - CVE-2015-7217 - CVE-2015-7218 - CVE-2015-7219 - CVE-2015-7220 - CVE-2015-7221 - CVE-2015-7222 - CVE-2015-7223 - https://www.mozilla.org/security/advisories/mfsa2015-134/ - https://www.mozilla.org/security/advisories/mfsa2015-135/ - https://www.mozilla.org/security/advisories/mfsa2015-136/ - https://www.mozilla.org/security/advisories/mfsa2015-137/ - https://www.mozilla.org/security/advisories/mfsa2015-138/ - https://www.mozilla.org/security/advisories/mfsa2015-139/ - https://www.mozilla.org/security/advisories/mfsa2015-140/ - https://www.mozilla.org/security/advisories/mfsa2015-141/ - https://www.mozilla.org/security/advisories/mfsa2015-142/ - https://www.mozilla.org/security/advisories/mfsa2015-143/ - https://www.mozilla.org/security/advisories/mfsa2015-144/ - https://www.mozilla.org/security/advisories/mfsa2015-145/ - https://www.mozilla.org/security/advisories/mfsa2015-146/ - https://www.mozilla.org/security/advisories/mfsa2015-147/ - https://www.mozilla.org/security/advisories/mfsa2015-148/ - https://www.mozilla.org/security/advisories/mfsa2015-149/ - - - 2015-12-15 - 2015-12-15 - - - - - java -- multiple vulnerabilities - - - openjdk8 - openjdk8-jre - 8.66.17 - - - openjdk7 - openjdk7-jre - 7.91.02,1 - - - - -

Oracle reports:

-
-

This Critical Patch Update contains 25 new security fixes - for Oracle Java SE. 24 of these vulnerabilities may be remotely - exploitable without authentication, i.e., may be exploited over a - network without the need for a username and password.

-
- - - - http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html#AppendixJAVA - CVE-2015-4835 - CVE-2015-4881 - CVE-2015-4843 - CVE-2015-4883 - CVE-2015-4860 - CVE-2015-4805 - CVE-2015-4844 - CVE-2015-4901 - CVE-2015-4868 - CVE-2015-4810 - CVE-2015-4806 - CVE-2015-4871 - CVE-2015-4902 - CVE-2015-4840 - CVE-2015-4882 - CVE-2015-4842 - CVE-2015-4734 - CVE-2015-4903 - CVE-2015-4803 - CVE-2015-4893 - CVE-2015-4911 - CVE-2015-4872 - CVE-2015-4906 - CVE-2015-4916 - CVE-2015-4908 - - - 2015-10-20 - 2015-12-15 - 2016-01-08 - - - - - subversion -- multiple vulnerabilities - - - subversion17 - 1.7.01.7.22_1 - - - subversion18 - 1.8.01.8.15 - - - subversion - 1.9.01.9.3 - - - mod_dav_svn - 1.7.01.7.22_1 - 1.8.01.8.15 - 1.9.01.9.3 - - - - -

Subversion Project reports:

-
-

Remotely triggerable heap overflow and out-of-bounds read caused - by integer overflow in the svn:// protocol parser.

-

Remotely triggerable heap overflow and out-of-bounds read in - mod_dav_svn caused by integer overflow when parsing skel-encoded - request bodies.

-
- - - - CVE-2015-5343 - http://subversion.apache.org/security/CVE-2015-5343-advisory.txt - CVE-2015-5259 - http://subversion.apache.org/security/CVE-2015-5259-advisory.txt - - - 2015-11-14 - 2015-12-15 - - - - - chromium -- multiple vulnerabilities - - - chromium - - chromium-npapi - chromium-pulse - 47.0.2526.80 - - - - -

Google Chrome Releases reports:

-
-

7 security fixes in this release, including:

-
    -
  • [548273] High CVE-2015-6788: Type confusion in extensions. - Credit to anonymous.
    • -
  • [557981] High CVE-2015-6789: Use-after-free in Blink. Credit to - cloudfuzzer.
    • -
  • [542054] Medium CVE-2015-6790: Escaping issue in saved pages. - Credit to Inti De Ceukelaire.
    • -
  • [567513] CVE-2015-6791: Various fixes from internal audits, - fuzzing and other initiatives.
    • -
  • Multiple vulnerabilities in V8 fixed at the tip of the 4.7 - branch (currently 4.7.80.23).
    • -
-
- - - - CVE-2015-6788 - CVE-2015-6789 - CVE-2015-6790 - CVE-2015-6791 - http://googlechromereleases.blogspot.nl/2015/12/stable-channel-update_8.html - - - 2015-12-08 - 2015-12-13 - - - - - freeimage -- multiple integer overflows - - - freeimage - 3.16.0_1 - - - - -

Pcheng pcheng reports:

-
-

An integer overflow issue in the FreeImage project was - reported and fixed recently.

-
- - - - CVE-2015-0852 - http://www.openwall.com/lists/oss-security/2015/08/28/1 - - - 2015-08-28 - 2015-12-13 - - - - - redmine -- information leak vulnerability - - - redmine - 2.6.9 - 3.0.03.0.7 - 3.1.03.1.3 - - - - -

Redmine reports:

-
-

Data disclosure in atom feed.

-
- - - - CVE-2015-8537 - http://www.redmine.org/projects/redmine/wiki/Security_Advisories - - - 2015-12-05 - 2015-12-10 - 2015-12-11 - - - - - redmine -- multiple vulnerabilities - - - redmine - 2.6.8 - 3.0.03.0.6 - 3.1.03.1.2 - - - - -

Redmine reports:

-
-

Potential changeset message disclosure in issues API.

-

Data disclosure on the time logging form

-
- - - - CVE-2015-8346 - CVE-2015-8473 - http://www.redmine.org/projects/redmine/wiki/Security_Advisories - http://www.openwall.com/lists/oss-security/2015/11/25/12 - http://www.openwall.com/lists/oss-security/2015/12/03/7 - - - 2015-11-14 - 2015-12-10 - - - - - redmine -- open redirect vulnerability - - - redmine - 2.5.12.6.7 - 3.0.03.0.5 - 3.1.0 - - - - -

Redmine reports:

-
-

Open Redirect vulnerability.

-
- - - - CVE-2015-8474 - http://www.redmine.org/projects/redmine/wiki/Security_Advisories - http://www.openwall.com/lists/oss-security/2015/12/04/1 - - - 2015-09-20 - 2015-12-10 - - - - - redmine -- potential XSS vulnerability - - - redmine - 2.6.2 - - - - -

Redmine reports:

-
-

Potential XSS vulnerability when rendering some flash messages.

-
- - - - CVE-2015-8477 - http://www.redmine.org/projects/redmine/wiki/Security_Advisories - http://www.openwall.com/lists/oss-security/2015/12/05/6 - - - 2015-02-19 - 2015-12-10 - - - - - redmine -- information leak vulnerability - - - redmine - 2.4.6 - 2.5.02.5.2 - - - - -

Redmine reports:

-
-

Potential data leak (project names) in the invalid form - authenticity token error screen.

-
- - - - http://www.redmine.org/projects/redmine/wiki/Security_Advisories - - - 2014-07-06 - 2015-12-10 - - - - - redmine -- open redirect vulnerability - - - redmine - 2.4.5 - 2.5.0 - - - - -

Redmine reports:

-
-

Open Redirect vulnerability

-
- - - - CVE-2014-1985 - http://www.redmine.org/projects/redmine/wiki/Security_Advisories - https://jvn.jp/en/jp/JVN93004610/index.html - - - 2014-03-29 - 2015-12-10 - - - - - redmine -- XSS vulnerability - - - redmine - 2.1.02.1.2 - - - - -

Redmine reports:

-
-

XSS vulnerability

-
- - - - http://www.redmine.org/projects/redmine/wiki/Security_Advisories - - - 2012-09-30 - 2015-12-10 - - - - - redmine -- multiple vulnerabilities - - - redmine - 1.3.2 - - - - -

Redmine reports:

-
-

Mass-assignment vulnerability that would allow an attacker to - bypass part of the security checks.

-

Persistent XSS vulnerability

-
- - - - CVE-2012-0327 - http://www.redmine.org/projects/redmine/wiki/Security_Advisories - http://jvn.jp/en/jp/JVN93406632/ - - - 2012-03-11 - 2015-12-10 - - - - - redmine -- CSRF protection bypass - - - redmine - 1.3.0 - - - - -

Redmine reports:

-
-

Vulnerability that would allow an attacker to bypass the CSRF - protection.

-
- - - - http://www.redmine.org/projects/redmine/wiki/Security_Advisories - - - 2011-12-10 - 2015-12-10 - - - - - jenkins -- multiple vulnerabilities - - - jenkins - 1.641 - - - jenkins-lts - 1.625.3 - - - - -

Jenkins Security Advisory:

-
-

Description

-
SECURITY-95 / CVE-2015-7536 (Stored XSS vulnerability through workspace files and archived artifacts)
-

In certain configurations, low privilege users were able to - create e.g. HTML files in workspaces and archived artifacts that - could result in XSS when accessed by other users. Jenkins now sends - Content-Security-Policy headers that enables sandboxing and - prohibits script execution by default.

-
SECURITY-225 / CVE-2015-7537 (CSRF vulnerability in some administrative actions)
-

Several administration/configuration related URLs could be - accessed using GET, which allowed attackers to circumvent CSRF - protection.

-
SECURITY-233 / CVE-2015-7538 (CSRF protection ineffective)
-

Malicious users were able to circumvent CSRF protection on any - URL by sending specially crafted POST requests.

-
SECURITY-234 / CVE-2015-7539 (Jenkins plugin manager vulnerable to MITM attacks)
-

While the Jenkins update site data is digitally signed, and the - signature verified by Jenkins, Jenkins did not verify the provided - SHA-1 checksums for the plugin files referenced in the update site - data. This enabled MITM attacks on the plugin manager, resulting - in installation of attacker-provided plugins.

-
- - - - https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-12-09 - - - 2015-12-09 - 2015-12-09 - - - - - flash -- multiple vulnerabilities - - - linux-c6-flashplugin - linux-f10-flashplugin - linux-c6_64-flashplugin - 11.2r202.554 - - - - -

Adobe reports:

-
-

- These updates resolve heap buffer overflow vulnerabilities that - could lead to code execution (CVE-2015-8438, CVE-2015-8446).

- -

- These updates resolve memory corruption vulnerabilities that - could lead to code execution (CVE-2015-8444, CVE-2015-8443, - CVE-2015-8417, CVE-2015-8416, CVE-2015-8451, CVE-2015-8047, - CVE-2015-8053, CVE-2015-8045, CVE-2015-8051, CVE-2015-8060, - CVE-2015-8419, CVE-2015-8408).

- -

- These updates resolve security bypass vulnerabilities - (CVE-2015-8453, CVE-2015-8440, CVE-2015-8409).

- -

- These updates resolve a stack overflow vulnerability that - could lead to code execution (CVE-2015-8407).

- -

- These updates resolve a type confusion vulnerability that - could lead to code execution (CVE-2015-8439).

- -

- These updates resolve an integer overflow vulnerability - that could lead to code execution (CVE-2015-8445).

- -

- These updates resolve a buffer overflow vulnerability that - could lead to code execution (CVE-2015-8415).

- -

- These updates resolve use-after-free vulnerabilities that - could lead to code execution (CVE-2015-8050, CVE-2015-8049, - CVE-2015-8437, CVE-2015-8450, CVE-2015-8449, CVE-2015-8448, - CVE-2015-8436, CVE-2015-8452, CVE-2015-8048, CVE-2015-8413, - CVE-2015-8412, CVE-2015-8410, CVE-2015-8411, CVE-2015-8424, - CVE-2015-8422, CVE-2015-8420, CVE-2015-8421, CVE-2015-8423, - CVE-2015-8425, CVE-2015-8433, CVE-2015-8432, CVE-2015-8431, - CVE-2015-8426, CVE-2015-8430, CVE-2015-8427, CVE-2015-8428, - CVE-2015-8429, CVE-2015-8434, CVE-2015-8435, CVE-2015-8414, - CVE-2015-8052, CVE-2015-8059, CVE-2015-8058, CVE-2015-8055, - CVE-2015-8057, CVE-2015-8056, CVE-2015-8061, CVE-2015-8067, - CVE-2015-8066, CVE-2015-8062, CVE-2015-8068, CVE-2015-8064, - CVE-2015-8065, CVE-2015-8063, CVE-2015-8405, CVE-2015-8404, - CVE-2015-8402, CVE-2015-8403, CVE-2015-8071, CVE-2015-8401, - CVE-2015-8406, CVE-2015-8069, CVE-2015-8070, CVE-2015-8441, - CVE-2015-8442, CVE-2015-8447).

-
- - - - https://helpx.adobe.com/security/products/flash-player/apsb15-32.html - CVE-2015-8045 - CVE-2015-8047 - CVE-2015-8048 - CVE-2015-8049 - CVE-2015-8050 - CVE-2015-8051 - CVE-2015-8052 - CVE-2015-8053 - CVE-2015-8054 - CVE-2015-8055 - CVE-2015-8056 - CVE-2015-8057 - CVE-2015-8058 - CVE-2015-8059 - CVE-2015-8060 - CVE-2015-8061 - CVE-2015-8062 - CVE-2015-8063 - CVE-2015-8064 - CVE-2015-8065 - CVE-2015-8066 - CVE-2015-8067 - CVE-2015-8068 - CVE-2015-8069 - CVE-2015-8070 - CVE-2015-8071 - CVE-2015-8401 - CVE-2015-8402 - CVE-2015-8403 - CVE-2015-8404 - CVE-2015-8405 - CVE-2015-8406 - CVE-2015-8407 - CVE-2015-8408 - CVE-2015-8409 - CVE-2015-8410 - CVE-2015-8411 - CVE-2015-8412 - CVE-2015-8413 - CVE-2015-8414 - CVE-2015-8415 - CVE-2015-8416 - CVE-2015-8417 - CVE-2015-8419 - CVE-2015-8420 - CVE-2015-8421 - CVE-2015-8422 - CVE-2015-8423 - CVE-2015-8424 - CVE-2015-8425 - CVE-2015-8426 - CVE-2015-8427 - CVE-2015-8428 - CVE-2015-8429 - CVE-2015-8430 - CVE-2015-8431 - CVE-2015-8432 - CVE-2015-8433 - CVE-2015-8434 - CVE-2015-8435 - CVE-2015-8436 - CVE-2015-8437 - CVE-2015-8438 - CVE-2015-8439 - CVE-2015-8440 - CVE-2015-8441 - CVE-2015-8442 - CVE-2015-8443 - CVE-2015-8444 - CVE-2015-8445 - CVE-2015-8446 - CVE-2015-8447 - CVE-2015-8448 - CVE-2015-8449 - CVE-2015-8450 - CVE-2015-8451 - CVE-2015-8452 - CVE-2015-8453 - - - 2015-12-08 - 2015-12-08 - - - - - libressl -- NULL pointer dereference - - - libressl - 2.2.5 - 2.3.02.3.1_1 - - - - -

The OpenBSD project reports:

-
-

A NULL pointer deference could be triggered by a crafted - certificate sent to services configured to verify client - certificates on TLS/SSL connections. -

-
- - - - https://marc.info/?l=openbsd-announce&t=144920914600002 - CVE-2015-3194 - - - 2015-12-03 - 2015-12-08 - - - - - KeePassX -- information disclosure - - - KeePassX - 0.4.4 - - - - -

Yves-Alexis Perez reports:

-
-

Starting an export (using File / Export to / KeepassX XML file) and - cancelling it leads to KeepassX saving a cleartext XML file in - ~/.xml without any warning.

-
- - - - CVE-2015-8378 - ports/205105 - http://www.openwall.com/lists/oss-security/2015/11/30/4 - - - 2015-07-08 - 2015-12-08 - - - - - passenger -- client controlled header overwriting - - - rubygem-passenger - 5.0.05.0.22 - 4.0.60 - - - - -

Daniel Knoppel reports:

-
-

It was discovered by the SUSE security team that it was possible, - in some cases, for clients to overwrite headers set by the server, - resulting in a medium level security issue. CVE-2015-7519 has been - assigned to this issue.

-

Affected use-cases:

-

Header overwriting may occur if all of the following conditions are met:

-
    -
  • Apache integration mode, or standalone+builtin engine without - a filtering proxy
    • -
  • Ruby or Python applications only (Passenger 5); or any - application (Passenger 4)
    • -
  • The app depends on a request header containing a dash (-)
    • -
  • The header is supposed to be trusted (set by the server)
    • -
  • The client correctly guesses the header name
    • -
-

This vulnerability has been fixed by filtering out client headers - that do not consist of alphanumeric/dash characters (Nginx already - did this, so Passenger+Nginx was not affected). If your application - depends on headers that don't conform to this, you can add a - workaround in Apache specifically for those to convert them to a - dash-based format.

-
- - - - CVE-2015-7519 - https://blog.phusion.nl/2015/12/07/cve-2015-7519/ - - - 2015-12-07 - 2015-12-07 - - - - - Salt -- information disclosure - - - py27-salt - 2015.8.3 - - - - -

Salt release notes report:

-
-

CVE-2015-8034: Saving state.sls cache data to disk with insecure - permissions

-

This affects users of the state.sls function. The state run cache - on the minion was being created with incorrect permissions. This - file could potentially contain sensitive data that was inserted via - jinja into the state SLS files. The permissions for this file are - now being set correctly. Thanks to @zmalone for bringing this issue - to our attention.

-
- - - - CVE-2015-8034 - https://docs.saltstack.com/en/latest/topics/releases/2015.8.3.html - - - 2015-11-25 - 2015-12-07 - - - - - libraw -- memory objects not properly initialized - - - libraw - 0.17.1 - - - - -

ChenQin reports:

-
-

The LibRaw raw image decoder has multiple vulnerabilities that can - cause memory errors which may lead to code execution or other - problems.

-

In CVE-2015-8367, LibRaw's phase_one_correct function does not - handle memory initialization correctly, which may cause other - problems.

-
- - - - http://www.libraw.org/news/libraw-0-17-1 - https://github.com/LibRaw/LibRaw/commit/490ef94d1796f730180039e80997efe5c58db780 - http://seclists.org/fulldisclosure/2015/Nov/108 - CVE-2015-8367 - - - 2015-11-30 - 2015-12-07 - - - - - libraw -- index overflow in smal_decode_segment - - - libraw - 0.17.1 - - - - -

ChenQin reports:

-
-

The LibRaw raw image decoder has multiple vulnerabilities that can - cause memory errors which may lead to code execution or other - problems.

-

In CVE-2015-8366, LibRaw's smal_decode_segment function does not - handle indexes carefully, which can cause an index overflow.

-
- - - - http://www.libraw.org/news/libraw-0-17-1 - https://github.com/LibRaw/LibRaw/commit/89d065424f09b788f443734d44857289489ca9e2 - http://seclists.org/fulldisclosure/2015/Nov/108 - CVE-2015-8366 - - - 2015-11-30 - 2015-12-07 - - - - - openssl -- multiple vulnerabilities - - - openssl - 1.0.2_5 - - - mingw32-openssl - 1.0.11.0.2e - - - linux-c6-openssl - 1.0.1e_7 - - - FreeBSD - 10.210.2_8 - 10.110.1_25 - 9.39.3_31 - - - - -

OpenSSL project reports:

-
-
    -
  1. BN_mod_exp may produce incorrect results on x86_64 - (CVE-2015-3193)
    2. -
  2. Certificate verify crash with missing PSS parameter - (CVE-2015-3194)
    3. -
  3. X509_ATTRIBUTE memory leak (CVE-2015-3195)
    4. -
  4. Race condition handling PSK identify hint - (CVE-2015-3196)
    5. -
  5. Anon DH ServerKeyExchange with 0 p parameter - (CVE-2015-1794)
    6. -
-
- - - - SA-15:26.openssl - CVE-2015-1794 - CVE-2015-3193 - CVE-2015-3194 - CVE-2015-3195 - CVE-2015-3196 - https://www.openssl.org/news/secadv/20151203.txt - - - 2015-12-03 - 2015-12-05 - 2016-08-09 - - - - - PHPmailer -- SMTP injection vulnerability - - - phpmailer - 5.2.14 - - - - -

PHPMailer changelog reports:

-
-

Fix vulnerability that allowed email addresses with - line breaks (valid in RFC5322) to pass to SMTP, permitting - message injection at the SMTP level. Mitigated in both - the address validator and in the lower-level SMTP class. - Thanks to Takeshi Terada.

-
- - - - https://github.com/PHPMailer/PHPMailer/blob/v5.2.14/changelog.md - - - 2015-11-05 - 2015-12-03 - - - - - ffmpeg -- multiple vulnerabilities - - - libav - - 0 - - - gstreamer-ffmpeg - - - 0 - - - handbrake - - - 1.2.0 - - - ffmpeg - 2.8,12.8.3,1 - 2.7.3,1 - - - ffmpeg26 - 2.6.5 - - - ffmpeg25 - 2.5.9 - - - ffmpeg24 - 2.4.12 - - - ffmpeg-devel - ffmpeg23 - ffmpeg2 - ffmpeg1 - ffmpeg-011 - ffmpeg0 - - 0 - - - avidemux - avidemux2 - avidemux26 - - - 2.6.11 - - - kodi - - 16.0 - - - mplayer - mencoder - - 1.1.r20150822_7 - - - mythtv - mythtv-frontend - - 0.27.5,1 - - - plexhometheater - - - 0 - - - - -

NVD reports:

-
-

The update_dimensions function in libavcodec/vp8.c in - FFmpeg through 2.8.1, as used in Google Chrome before - 46.0.2490.71 and other products, relies on a - coefficient-partition count during multi-threaded operation, - which allows remote attackers to cause a denial of service - (race condition and memory corruption) or possibly have - unspecified other impact via a crafted WebM file.

-
-
-

The ljpeg_decode_yuv_scan function in - libavcodec/mjpegdec.c in FFmpeg before 2.8.2 omits certain - width and height checks, which allows remote attackers to - cause a denial of service (out-of-bounds array access) or - possibly have unspecified other impact via crafted MJPEG - data.

-
-
-

The ff_hevc_parse_sps function in libavcodec/hevc_ps.c in - FFmpeg before 2.8.2 does not validate the Chroma Format - Indicator, which allows remote attackers to cause a denial - of service (out-of-bounds array access) or possibly have - unspecified other impact via crafted High Efficiency Video - Coding (HEVC) data.

-
-
-

The decode_uncompressed function in libavcodec/faxcompr.c - in FFmpeg before 2.8.2 does not validate uncompressed runs, - which allows remote attackers to cause a denial of service - (out-of-bounds array access) or possibly have unspecified - other impact via crafted CCITT FAX data.

-
-
-

The init_tile function in libavcodec/jpeg2000dec.c in - FFmpeg before 2.8.2 does not enforce minimum-value and - maximum-value constraints on tile coordinates, which allows - remote attackers to cause a denial of service (out-of-bounds - array access) or possibly have unspecified other impact via - crafted JPEG 2000 data.

-
-
-

The jpeg2000_read_main_headers function in - libavcodec/jpeg2000dec.c in FFmpeg before 2.6.5, 2.7.x - before 2.7.3, and 2.8.x through 2.8.2 does not enforce - uniqueness of the SIZ marker in a JPEG 2000 image, which - allows remote attackers to cause a denial of service - (out-of-bounds heap-memory access) or possibly have - unspecified other impact via a crafted image with two or - more of these markers.

-
-
-

Integer overflow in the ff_ivi_init_planes function in - libavcodec/ivi.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3, - and 2.8.x through 2.8.2 allows remote attackers to cause a - denial of service (out-of-bounds heap-memory access) or - possibly have unspecified other impact via crafted image - dimensions in Indeo Video Interactive data.

-
-
-

The smka_decode_frame function in libavcodec/smacker.c in - FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8.x through - 2.8.2 does not verify that the data size is consistent with - the number of channels, which allows remote attackers to - cause a denial of service (out-of-bounds array access) or - possibly have unspecified other impact via crafted Smacker - data.

-
- - - - CVE-2015-6761 - CVE-2015-8216 - CVE-2015-8217 - CVE-2015-8218 - CVE-2015-8219 - CVE-2015-8363 - CVE-2015-8364 - CVE-2015-8365 - https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=dabea74d0e82ea80cd344f630497cafcb3ef872c - https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=d24888ef19ba38b787b11d1ee091a3d94920c76a - https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=93f30f825c08477fe8f76be00539e96014cc83c8 - https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=d4a731b84a08f0f3839eaaaf82e97d8d9c67da46 - https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=43492ff3ab68a343c1264801baa1d5a02de10167 - https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=44a7f17d0b20e6f8d836b2957e3e357b639f19a2 - https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=df91aa034b82b77a3c4e01791f4a2b2ff6c82066 - https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=4a9af07a49295e014b059c1ab624c40345af5892 - https://ffmpeg.org/security.html - - - 2015-11-27 - 2015-12-02 - 2018-03-25 - - - - - chromium -- multiple vulnerabilities - - - chromium - - chromium-npapi - chromium-pulse - 47.0.2526.73 - - - - -

Google Chrome Releases reports:

-
-

41 security fixes in this release, including:

-
    -
  • [558589] Critical CVE-2015-6765: Use-after-free in AppCache. - Credit to anonymous.
    • -
  • [551044] High CVE-2015-6766: Use-after-free in AppCache. - Credit to anonymous.
    • -
  • [554908] High CVE-2015-6767: Use-after-free in AppCache. - Credit to anonymous.
    • -
  • [556724] High CVE-2015-6768: Cross-origin bypass in DOM. - Credit to Mariusz Mlynski.
    • -
  • [534923] High CVE-2015-6769: Cross-origin bypass in core. - Credit to Mariusz Mlynski.
    • -
  • [541206] High CVE-2015-6770: Cross-origin bypass in DOM. - Credit to Mariusz Mlynski.
    • -
  • [544991] High CVE-2015-6771: Out of bounds access in v8. - Credit to anonymous.
    • -
  • [546545] High CVE-2015-6772: Cross-origin bypass in DOM. - Credit to Mariusz Mlynski.
    • -
  • [554946] High CVE-2015-6764: Out of bounds access in v8. - Credit to Guang Gong of Qihoo 360 via pwn2own.
    • -
  • [491660] High CVE-2015-6773: Out of bounds access in Skia. - Credit to cloudfuzzer.
    • -
  • [549251] High CVE-2015-6774: Use-after-free in Extensions. - Credit to anonymous.
    • -
  • [529012] High CVE-2015-6775: Type confusion in PDFium. - Credit to Atte Kettunen of OUSPG.
    • -
  • [457480] High CVE-2015-6776: Out of bounds access in PDFium. - Credit to Hanno Böck.
    • -
  • [544020] High CVE-2015-6777: Use-after-free in DOM. - Credit to Long Liu of Qihoo 360Vulcan Team.
    • -
  • [514891] Medium CVE-2015-6778: Out of bounds access in PDFium. - Credit to Karl Skomski.
    • -
  • [528505] Medium CVE-2015-6779: Scheme bypass in PDFium. - Credit to Til Jasper Ullrich.
    • -
  • [490492] Medium CVE-2015-6780: Use-after-free in Infobars. - Credit to Khalil Zhani.
    • -
  • [497302] Medium CVE-2015-6781: Integer overflow in Sfntly. - Credit to miaubiz.
    • -
  • [536652] Medium CVE-2015-6782: Content spoofing in Omnibox. - Credit to Luan Herrera.
    • -
  • [537205] Medium CVE-2015-6783: Signature validation issue in - Android Crazy Linker. Credit to Michal Bednarski.
    • -
  • [503217] Low CVE-2015-6784: Escaping issue in saved pages. - Credit to Inti De Ceukelaire.
    • -
  • [534542] Low CVE-2015-6785: Wildcard matching issue in CSP. - Credit to Michael Ficarra / Shape Security.
    • -
  • [534570] Low CVE-2015-6786: Scheme bypass in CSP. Credit to - Michael Ficarra / Shape Security.
    • -
  • [563930] CVE-2015-6787: Various fixes from internal audits, - fuzzing and other initiatives.
    • -
  • Multiple vulnerabilities in V8 fixed at the tip of the 4.7 - branch (currently 4.7.80.23).
    • -
-
- - - - CVE-2015-6765 - CVE-2015-6766 - CVE-2015-6767 - CVE-2015-6768 - CVE-2015-6769 - CVE-2015-6770 - CVE-2015-6771 - CVE-2015-6772 - CVE-2015-6773 - CVE-2015-6774 - CVE-2015-6775 - CVE-2015-6776 - CVE-2015-6777 - CVE-2015-6778 - CVE-2015-6779 - CVE-2015-6780 - CVE-2015-6781 - CVE-2015-6782 - CVE-2015-6783 - CVE-2015-6784 - CVE-2015-6785 - CVE-2015-6786 - CVE-2015-6787 - http://googlechromereleases.blogspot.nl/2015/12/stable-channel-update.html - - - 2015-12-01 - 2015-12-02 - - - - - piwik -- multiple vulnerabilities - - - piwik - 2.15.0 - - - - -

Piwik changelog reports:

-
-

This release is rated critical. - - We are grateful for Security researchers who disclosed - security issues privately to the Piwik Security Response - team: Elamaran Venkatraman, Egidio Romano and Dmitriy - Shcherbatov. The following vulnerabilities were fixed: - XSS, CSRF, possible file inclusion in older PHP versions - (low impact), possible Object Injection Vulnerability - (low impact).

-
- - - - CVE-2015-7815 - CVE-2015-7816 - http://piwik.org/changelog/piwik-2-15-0/ - - - 2015-11-17 - 2015-12-02 - - - - - cyrus-imapd -- integer overflow in the start_octet addition - - - cyrus-imapd25 - 2.5.02.5.7 - - - cyrus-imapd24 - 2.4.02.4.18_2 - - - - -

Cyrus IMAP 2.5.7 Release Note states:

-
-

CVE-2015-8077, CVE-2015-8078: protect against integer overflow in urlfetch range checks

-
- - - - CVE-2015-8078 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8078 - http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-8078.html - https://security-tracker.debian.org/tracker/CVE-2015-8078 - CVE-2015-8077 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8077 - http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-8077.html - https://security-tracker.debian.org/tracker/CVE-2015-8077 - - - 2015-11-04 - 2015-12-01 - - - - - django -- information leak vulnerability - - - py27-django - py32-django - py33-django - py34-django - 1.8.7 - - - py27-django18 - py32-django18 - py33-django18 - py34-django18 - 1.8.7 - - - py27-django17 - py32-django17 - py33-django17 - py34-django17 - 1.7.11 - - - py27-django-devel - py32-django-devel - py33-django-devel - py34-django-devel - 20150709,1 - - - - -

Tim Graham reports:

-
-

If an application allows users to specify an unvalidated - format for dates and passes this format to the date filter, e.g. {{ - last_updated|date:user_date_format }}, then a malicious user could - obtain any secret in the application's settings by specifying a settings - key instead of a date format. e.g. "SECRET_KEY" instead of "j/m/Y".

-
- - - - https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/ - CVE-2015-8213 - - - 2015-11-24 - 2015-11-30 - 2015-12-24 - - - - - kibana4 -- CSRF vulnerability - - - kibana4 - kibana41 - 4.0.04.1.3 - - - kibana42 - 4.2.04.2.1 - - - - -

Elastic reports:

-
-

Vulnerability Summary: Kibana versions prior to 4.1.3 and 4.2.1 - are vulnerable to a CSRF attack.

-

Remediation Summary: Users should upgrade to 4.1.3 or 4.2.1.

-
- - - - CVE-2015-8131 - https://www.elastic.co/community/security/ - - - 2015-11-17 - 2015-11-22 - - - - - a2ps -- format string vulnerability - - - a2ps - 4.13b_8 - - - - -

Jong-Gwon Kim reports:

-
-

When user runs a2ps with malicious crafted pro(a2ps prologue) file, - an attacker can execute arbitrary code.

-
- - - - CVE-2015-8107 - http://www.openwall.com/lists/oss-security/2015/11/16/4 - - - 2015-11-16 - 2015-11-22 - - - - - libxslt -- DoS vulnerability due to type confusing error - - - libsxlt - 1.1.28_8 - - - - -

libxslt maintainer reports:

-
-

CVE-2015-7995: - http://www.openwall.com/lists/oss-security/2015/10/27/10 - We need to check that the parent node is an element before - dereferencing its namespace.

-
- - - - CVE-2015-7995 - https://git.gnome.org/browse/libxslt/commit/?id=7ca19df892ca22d9314e95d59ce2abdeff46b617 - - - 2015-10-29 - 2015-11-20 - - - - - libxml2 -- multiple vulnerabilities - - - libxml2 - 2.9.3 - - - - -

reports:

-
-

CVE-2015-5312 Another entity expansion issue (David Drysdale).

-

CVE-2015-7497 Avoid an heap buffer overflow in - xmlDictComputeFastQKey (David Drysdale).

-

CVE-2015-7498 Avoid processing entities after encoding - conversion failures (Daniel Veillard).

-

CVE-2015-7499 (1) Add xmlHaltParser() to stop the parser - (Daniel Veillard).

-

CVE-2015-7499 (2) Detect incoherency on GROW (Daniel - Veillard).

-

CVE-2015-7500 Fix memory access error due to incorrect - entities boundaries (Daniel Veillard).

-

CVE-2015-7941 (1) Stop parsing on entities boundaries - errors (Daniel Veillard).

-

CVE-2015-7941 (2) Cleanup conditional section error - handling (Daniel Veillard).

-

CVE-2015-7942 Another variation of overflow in - Conditional sections (Daniel Veillard).

-

CVE-2015-7942 (2) Fix an error in previous Conditional - section patch (Daniel Veillard).

-

CVE-2015-8035 Fix XZ compression support loop - (Daniel Veillard).

-

CVE-2015-8242 Buffer overead with HTML parser in push - mode (Hugh Davenport)

-
- - - - CVE-2015-5312 - CVE-2015-7497 - CVE-2015-7498 - CVE-2015-7499 - CVE-2015-7500 - CVE-2015-7941 - CVE-2015-7942 - CVE-2015-8035 - CVE-2015-8241 - CVE-2015-8242 - http://xmlsoft.org/news.html - http://www.openwall.com/lists/oss-security/2015/11/18/23 - - - 2015-11-20 - 2015-11-20 - - - - - mozilla -- multiple vulnerabilities - - - nspr - 4.10.10 - - - linux-c6-nspr - 4.10.10 - - - nss - 3.203.20.1 - 3.19.33.19.4 - 3.19.2.1 - - - firefox - 42.0,1 - - - linux-firefox - 42.0,1 - - - seamonkey - 2.39 - - - linux-seamonkey - 2.39 - - - firefox-esr - 38.4.0,1 - - - libxul - 38.4.0 - - - thunderbird - 38.4.0 - - - linux-thunderbird - 38.4.0 - - - - -

The Mozilla Project reports:

-
-

MFSA 2015-133 NSS and NSPR memory corruption issues

-

MFSA 2015-132 Mixed content WebSocket policy bypass - through workers

-

MFSA 2015-131 Vulnerabilities found through code - inspection

-

MFSA 2015-130 JavaScript garbage collection crash with - Java applet

-

MFSA 2015-129 Certain escaped characters in host of - Location-header are being treated as non-escaped

-

MFSA 2015-128 Memory corruption in libjar through zip - files

-

MFSA 2015-127 CORS preflight is bypassed when - non-standard Content-Type headers are received

-

MFSA 2015-126 Crash when accessing HTML tables with - accessibility tools on OS X

-

MFSA 2015-125 XSS attack through intents on Firefox for - Android

-

MFSA 2015-124 Android intents can be used on Firefox for - Android to open privileged files

-

MFSA 2015-123 Buffer overflow during image interactions - in canvas

-

MFSA 2015-122 Trailing whitespace in IP address hostnames - can bypass same-origin policy

-

MFSA 2015-121 Disabling scripts in Add-on SDK panels has - no effect

-

MFSA 2015-120 Reading sensitive profile files through - local HTML file on Android

-

MFSA 2015-119 Firefox for Android addressbar can be - removed after fullscreen mode

-

MFSA 2015-118 CSP bypass due to permissive Reader mode - whitelist

-

MFSA 2015-117 Information disclosure through NTLM - authentication

-

MFSA 2015-116 Miscellaneous memory safety hazards - (rv:42.0 / rv:38.4)

-
- - - - CVE-2015-4513 - CVE-2015-4514 - CVE-2015-4515 - CVE-2015-4518 - CVE-2015-7181 - CVE-2015-7182 - CVE-2015-7183 - CVE-2015-7185 - CVE-2015-7186 - CVE-2015-7187 - CVE-2015-7188 - CVE-2015-7189 - CVE-2015-7190 - CVE-2015-7191 - CVE-2015-7192 - CVE-2015-7193 - CVE-2015-7194 - CVE-2015-7195 - CVE-2015-7196 - CVE-2015-7197 - CVE-2015-7198 - CVE-2015-7199 - CVE-2015-7200 - https://www.mozilla.org/security/advisories/mfsa2015-116/ - https://www.mozilla.org/security/advisories/mfsa2015-117/ - https://www.mozilla.org/security/advisories/mfsa2015-118/ - https://www.mozilla.org/security/advisories/mfsa2015-119/ - https://www.mozilla.org/security/advisories/mfsa2015-120/ - https://www.mozilla.org/security/advisories/mfsa2015-121/ - https://www.mozilla.org/security/advisories/mfsa2015-122/ - https://www.mozilla.org/security/advisories/mfsa2015-123/ - https://www.mozilla.org/security/advisories/mfsa2015-124/ - https://www.mozilla.org/security/advisories/mfsa2015-125/ - https://www.mozilla.org/security/advisories/mfsa2015-126/ - https://www.mozilla.org/security/advisories/mfsa2015-127/ - https://www.mozilla.org/security/advisories/mfsa2015-128/ - https://www.mozilla.org/security/advisories/mfsa2015-129/ - https://www.mozilla.org/security/advisories/mfsa2015-130/ - https://www.mozilla.org/security/advisories/mfsa2015-131/ - https://www.mozilla.org/security/advisories/mfsa2015-132/ - https://www.mozilla.org/security/advisories/mfsa2015-133/ - - - 2015-11-03 - 2015-11-19 - 2016-04-13 - - - - - gdm -- lock screen bypass when holding escape key - - - gdm - 3.16.2_1 - - - - -

Ray Strode reports:

-
-

CVE-2015-7496 - lock screen bypass when holding escape key.

-
- - - - CVE-2015-7496 - https://mail.gnome.org/archives/ftp-release-list/2015-November/msg00074.html - https://bugzilla.gnome.org/show_bug.cgi?id=758032 - - - 2015-11-12 - 2015-11-18 - - - - - strongswan -- authentication bypass vulnerability in the eap-mschapv2 plugin - - - strongswan - 5.3.4 - - - - -

Strongswan Release Notes reports:

-
-

Fixed an authentication bypass vulnerability in the eap-mschapv2 plugin that - was caused by insufficient verification of the internal state when handling - MSCHAPv2 Success messages received by the client. - This vulnerability has been registered as CVE-2015-8023.

-
- - - - CVE-2015-8023 - https://github.com/strongswan/strongswan/commit/453e204ac40dfff2e0978e8f84a5f8ff0cbc45e2 - - - 2015-11-16 - 2015-11-16 - - - - - moodle -- multiple vulnerabilities - - - moodle27 - 2.7.11 - - - moodle28 - 2.8.9 - - - moodle29 - 2.9.3 - - - - -

Moodle Release Notes report:

-
-

MSA-15-0037 Possible to send a message to a user who blocked - messages from non contacts

-

MSA-15-0038 DDoS possibility in Atto

-

MSA-15-0039 CSRF in site registration form

-

MSA-15-0040 Student XSS in survey

-

MSA-15-0041 XSS in flash video player

-

MSA-15-0042 CSRF in lesson login form

-

MSA-15-0043 Web service core_enrol_get_enrolled_users does not - respect course group mode

-

MSA-15-0044 Capability to view available badges is not - respected

-

MSA-15-0045 SCORM module allows to bypass access restrictions based - on date

-

MSA-15-0046 Choice module closing date can be bypassed

-
- - - - https://docs.moodle.org/dev/Moodle_2.7.11_release_notes - https://docs.moodle.org/dev/Moodle_2.8.9_release_notes - https://docs.moodle.org/dev/Moodle_2.9.3_release_notes - - - 2015-11-09 - 2015-11-16 - 2015-12-21 - - - - - xen-kernel -- CPU lockup during exception delivery - - - xen-kernel - 4.5.2 - - - - -

The Xen Project reports:

-
-

A malicious HVM guest administrator can cause a denial of service. - Specifically, prevent use of a physical CPU for a significant, - perhaps indefinite period. If a host watchdog (Xen or dom0) is in - use, this can lead to a watchdog timeout and consequently a reboot - of the host. If another, innocent, guest, is configured with a - watchdog, this issue can lead to a reboot of such a guest.

-
- - - - CVE-2015-5307 - CVE-2015-8104 - http://xenbits.xen.org/xsa/advisory-156.html - - - 2015-11-10 - 2015-11-16 - - - - - libpng buffer overflow in png_set_PLTE - - - png - 1.6.20 - - - - -

libpng reports:

-
-

CVE for a vulnerability in libpng, all versions, in the - png_set_PLTE/png_get_PLTE functions. These functions failed to check for - an out-of-range palette when reading or writing PNG files with a bit_depth - less than 8. Some applications might read the bit depth from the IHDR - chunk and allocate memory for a 2^N entry palette, while libpng can return - a palette with up to 256 entries even when the bit depth is less than 8.

-
- - - - http://www.openwall.com/lists/oss-security/2015/11/12/2 - http://www.openwall.com/lists/oss-security/2015/12/03/6 - CVE-2015-8126 - CVE-2015-8472 - - - 2015-11-15 - 2015-11-15 - 2015-12-08 - - - - - flash -- multiple vulnerabilities - - - linux-c6-flashplugin - linux-f10-flashplugin - linux-c6_64-flashplugin - 11.2r202.548 - - - - -

Adobe reports:

-
-

These updates resolve a type confusion vulnerability that - could lead to code execution (CVE-2015-7659).

- -

These updates resolve a security bypass vulnerability that - could be exploited to write arbitrary data to the file - system under user permissions (CVE-2015-7662).

- -

These updates resolve use-after-free vulnerabilities that - could lead to code execution (CVE-2015-7651, CVE-2015-7652, - CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, - CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661, - CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, - CVE-2015-8046).

-
- - - - https://helpx.adobe.com/security/products/flash-player/apsb15-28.html - CVE-2015-7651 - CVE-2015-7652 - CVE-2015-7653 - CVE-2015-7654 - CVE-2015-7655 - CVE-2015-7656 - CVE-2015-7657 - CVE-2015-7658 - CVE-2015-7659 - CVE-2015-7660 - CVE-2015-7661 - CVE-2015-7662 - CVE-2015-7663 - CVE-2015-8043 - CVE-2015-8044 - CVE-2015-8046 - - - 2015-11-10 - 2015-11-14 - - - - - chromium -- multiple vulnerabilities - - - chromium - - chromium-npapi - chromium-pulse - 46.0.2490.86 - - - - -

Google Chrome Releases reports:

-
-

[520422] High CVE-2015-1302: Information leak in PDF viewer. - Credit to Rob Wu.

-
- - - - CVE-2015-1302 - http://googlechromereleases.blogspot.nl/2015/11/stable-channel-update.html - - - 2015-11-10 - 2015-11-11 - - - - - MySQL - Multiple vulnerabilities - - - mariadb-client - 5.3.13 - - - mariadb-server - 5.3.13 - - - mariadb55-client - 5.5.46 - - - mariadb55-server - 5.5.46 - - - mariadb100-client - 10.0.22 - - - mariadb100-server - 10.0.22 - - - mysql55-client - 5.5.46 - - - mysql55-server - 5.5.46 - - - mysql56-client - 5.6.27 - - - mysql56-server - 5.6.27 - - - percona55-client - 5.5.46 - - - percona55-server - 5.5.46 - - - percona56-client - 5.6.27 - - - percona56-server - 5.6.27 - - - - -

Oracle reports:

-
-

Critical Patch Update: MySQL Server, version(s) 5.5.45 and prior, 5.6.26 and prior

-
- - - - http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html - CVE-2015-4802 - CVE-2015-4807 - CVE-2015-4815 - CVE-2015-4826 - CVE-2015-4830 - CVE-2015-4836 - CVE-2015-4858 - CVE-2015-4861 - CVE-2015-4870 - CVE-2015-4913 - CVE-2015-4792 - https://mariadb.com/kb/en/mariadb/mariadb-5546-release-notes/ - https://mariadb.com/kb/en/mariadb/mariadb-10022-release-notes/ - https://www.percona.com/doc/percona-server/5.5/release-notes/Percona-Server-5.5.46-37.5.html - https://www.percona.com/doc/percona-server/5.6/release-notes/Percona-Server-5.6.27-75.0.html - - - 2015-11-10 - 2015-11-11 - - - - - jenkins -- remote code execution via unsafe deserialization - - - jenkins - 1.638 - - - jenkins-lts - 1.625.2 - - - - -

Jenkins Developers report:

-
-

Unsafe deserialization allows unauthenticated remote attackers to - run arbitrary code on the Jenkins master.

-
- - - - https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11 - https://jenkins-ci.org/content/mitigating-unauthenticated-remote-code-execution-0-day-jenkins-cli - http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/#thefix - - - 2015-11-06 - 2015-11-11 - - - - - owncloudclient -- Improper validation of certificates when using self-signed certificates - - - owncloudclient - 2.0.1 - - - - -

owncloud.org reports:

-
-

The ownCloud Desktop Client was vulnerable against MITM attacks until version 2.0.0 in combination with self-signed certificates.

-
- - - - https://owncloud.org/security/advisory/?id=oc-sa-2015-016 - CVE-2015-7298 - - - 2015-09-21 - 2015-11-11 - - - - - xen-tools -- populate-on-demand balloon size inaccuracy can crash guests - - - xen-tools - 3.44.5.1_2 - - - - -

The Xen Project reports:

-
-

Guests configured with PoD might be unstable, especially under - load. In an affected guest, an unprivileged guest user might be - able to cause a guest crash, perhaps simply by applying load so - as to cause heavy memory pressure within the guest.

-
- - - - CVE-2015-7972 - http://xenbits.xen.org/xsa/advisory-153.html - - - 2015-10-29 - 2015-11-11 - - - - - xen-kernel -- some pmu and profiling hypercalls log without rate limiting - - - xen-kernel - 3.24.5.1_1 - - - - -

The Xen Project reports:

-
-

HYPERCALL_xenoprof_op and HYPERVISOR_xenpmu_op log some errors and - attempts at invalid operations. These log messages are not - rate-limited, even though they can be triggered by guests.

-

A malicious guest could cause repeated logging to the hypervisor - console, leading to a Denial of Service attack.

-
- - - - CVE-2015-7971 - http://xenbits.xen.org/xsa/advisory-152.html - - - 2015-10-29 - 2015-11-11 - - - - - xen-kernel -- leak of per-domain profiling-related vcpu pointer array - - - xen-kernel - 4.04.5.1_1 - - - - -

The Xen Project reports:

-
-

A domain's xenoprofile state contains an array of per-vcpu - information... This array is leaked on domain teardown. This memory - leak could -- over time -- exhaust the host's memory.

-

The following parties can mount a denial of service attack - affecting the whole system:

-
    -
  • A malicious guest administrator via XENOPROF_get_buffer.
    • -
  • A domain given suitable privilege over another domain via - XENOPROF_set_passive (this would usually be a domain being - used to profile another domain, eg with the xenoprof tool).
    • -
-

The ability to also restart or create suitable domains is also - required to fully exploit the issue. Without this the leak is - limited to a small multiple of the maximum number of vcpus for the - domain.

-
- - - - CVE-2015-7969 - http://xenbits.xen.org/xsa/advisory-151.html - - - 2015-10-29 - 2015-11-11 - - - - - xen-kernel -- Long latency populate-on-demand operation is not preemptible - - - xen-kernel - 3.44.5.1_1 - - - - -

The Xen Project reports:

-
-

When running an HVM domain in Populate-on-Demand mode, Xen would - sometimes search the domain for memory to reclaim, in response to - demands for population of other pages in the same domain. This - search runs without preemption. The guest can, by suitable - arrangement of its memory contents, create a situation where this - search is a time-consuming linear scan of the guest's address - space.

-

A malicious HVM guest administrator can cause a denial of service. - Specifically, prevent use of a physical CPU for a significant - period.

-
- - - - CVE-2015-7970 - http://xenbits.xen.org/xsa/advisory-150.html - - - 2015-10-29 - 2015-11-11 - - - - - xen-kernel -- leak of main per-domain vcpu pointer array - - - xen-kernel - 4.5.1_1 - - - - -

The Xen Project reports:

-
-

A domain's primary array of vcpu pointers can be allocated by a - toolstack exactly once in the lifetime of a domain via the - XEN_DOMCTL_max_vcpus hypercall. This array is leaked on domain - teardown. This memory leak could -- over time -- exhaust the host's - memory.

-

A domain given partial management control via XEN_DOMCTL_max_vcpus - can mount a denial of service attack affecting the whole system. The - ability to also restart or create suitable domains is also required - to fully exploit the issue. Without this the leak is limited to a - small multiple of the maximum number of vcpus for the domain. The - maximum leak is 64kbytes per domain (re)boot (less on ARM).

-
- - - - CVE-2015-7969 - http://xenbits.xen.org/xsa/advisory-149.html - - - 2015-10-29 - 2015-11-11 - - - - - xen-kernel -- Uncontrolled creation of large page mappings by PV guests - - - xen-kernel - 3.44.5.1_1 - - - - -

The Xen Project reports:

-
-

The code to validate level 2 page table entries is bypassed when - certain conditions are satisfied. This means that a PV guest can - create writable mappings using super page mappings. Such writable - mappings can violate Xen intended invariants for pages which Xen is - supposed to keep read-only. This is possible even if the - "allowsuperpage" command line option is not used.

-

Malicious PV guest administrators can escalate privilege so as to - control the whole system.

-
- - - - CVE-2015-7835 - http://xenbits.xen.org/xsa/advisory-148.html - - - 2015-10-29 - 2015-11-11 - - - - - xen-tools -- libxl fails to honour readonly flag on disks with qemu-xen - - - xen-tools - 4.14.5.1_1 - - - - -

The Xen Project reports:

-
-

Callers of libxl can specify that a disk should be read-only to the - guest. However, there is no code in libxl to pass this information - to qemu-xen (the upstream-based qemu); and indeed there is no way in - qemu to make a disk read-only.

-

The vulnerability is exploitable only via devices emulated by the - device model, not the parallel PV devices for supporting PVHVM. - Normally the PVHVM device unplug protocol renders the emulated - devices inaccessible early in boot.

-

Malicious guest administrators or (in some situations) users may be - able to write to supposedly read-only disk images.

-

CDROM devices (that is, devices specified to be presented to the - guest as CDROMs, regardless of the nature of the backing storage on - the host) are not affected.

-
- - - - CVE-2015-7311 - http://xenbits.xen.org/xsa/advisory-142.html - - - 2015-09-22 - 2015-11-11 - - - - - p5-HTML-Scrubber -- XSS vulnerability - - - p5-HTML-Scrubber - 0.15 - - - - -

MITRE reports:

-
-

Cross-site scripting (XSS) vulnerability in the HTML-Scrubber - module before 0.15 for Perl, when the comment feature is enabled, - allows remote attackers to inject arbitrary web script or HTML via - a crafted comment.

-
- - - - CVE-2015-5667 - https://metacpan.org/release/HTML-Scrubber - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000171 - http://jvn.jp/en/jp/JVN53973084/index.html - - - 2015-10-10 - 2015-11-11 - - - - - libvpx -- buffer overflow in vp9_init_context_buffers - - - libvpx - 1.4.0.488_1 - - - - -

The Mozilla Project reports:

-
-

Security researcher Khalil Zhani reported that a - maliciously crafted vp9 format video could be used to - trigger a buffer overflow while parsing the file. This leads - to a potentially exploitable crash due to a flaw in the - libvpx library.

-
- - - - CVE-2015-4506 - https://www.mozilla.org/security/advisories/mfsa2015-101/ - - - 2015-09-22 - 2015-11-10 - - - - - powerdns -- Denial of Service - - - powerdns - 3.4.43.4.7 - - - - -

PowerDNS reports:

-
-

A bug was found using afl-fuzz in our packet parsing code. - This bug, when exploited, causes an assertion error and consequent - termination of the the pdns_server process, causing a Denial of Service.

-
- - - - https://doc.powerdns.com/md/security/powerdns-advisory-2015-03/ - CVE-2015-5311 - - - 2015-11-03 - 2015-11-09 - - - - - PuTTY -- memory corruption in terminal emulator's erase character handling - - - putty - 0.540.66 - - - - -

Ben Harris reports:

-
-

Versions of PuTTY and pterm between 0.54 and 0.65 inclusive have a - potentially memory-corrupting integer overflow in the handling of - the ECH (erase characters) control sequence in the terminal - emulator.

-

To exploit a vulnerability in the terminal emulator, an attacker - must be able to insert a carefully crafted escape sequence into the - terminal stream. For a PuTTY SSH session, this must be before - encryption, so the attacker likely needs access to the server you're - connecting to. For instance, an attacker on a multi-user machine - that you connect to could trick you into running cat on a file they - control containing a malicious escape sequence. (Unix write(1) is - not a vector for this, if implemented correctly.)

-

Only PuTTY, PuTTYtel, and pterm are affected; other PuTTY tools do - not include the terminal emulator, so cannot be exploited this - way.

-
- - - - http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-ech-overflow.html - CVE-2015-5309 - - - 2015-11-06 - 2015-11-09 - - - - - OpenOffice 4.1.1 -- multiple vulnerabilities - - - apache-openoffice - 4.1.2 - - - apache-openoffice-devel - 4.2.1705368,3 - - - - -

The Apache OpenOffice Project reports:

-
-

A vulnerability in OpenOffice settings of OpenDocument Format - files and templates allows silent access to files that are - readable from an user account, over-riding the user's default - configuration settings. Once these files are imported into a - maliciously-crafted document, the data can be silently hidden - in the document and possibly exported to an external party - without being observed.

-
-

The Apache OpenOffice Project reports:

-
-

A crafted ODF document can be used to create a buffer that is - too small for the amount of data loaded into it, allowing an - attacker to cause denial of service (memory corruption and - application crash) and possible execution of arbitrary code.

-
-

The Apache OpenOffice Project reports:

-
-

A crafted Microsoft Word DOC file can be used to specify a - document buffer that is too small for the amount of data - provided for it. Failure to detect the discrepancy allows an - attacker to cause denial of service (memory corruption and - application crash) and possible execution of arbitrary code.

-
-

The Apache OpenOffice Project reports:

-
-

A crafted Microsoft Word DOC can contain invalid bookmark - positions leading to memory corruption when the document is - loaded or bookmarks are manipulated. The defect allows an - attacker to cause denial of service (memory corruption and - application crash) and possible execution of arbitrary code.

-
- - - - CVE-2015-4551 - http://www.openoffice.org/security/cves/CVE-2015-4551.html - CVE-2015-5212 - http://www.openoffice.org/security/cves/CVE-2015-5212.html - CVE-2015-5213 - http://www.openoffice.org/security/cves/CVE-2015-5213.html - CVE-2015-5214 - http://www.openoffice.org/security/cves/CVE-2015-5214.html - - - 2015-11-04 - 2015-11-05 - 2015-11-05 - - - - - codeigniter -- multiple vulnerabilities - - - codeigniter - 2.2.6 - - - - -

The CodeIgniter changelog reports:

-
-

Fixed an XSS attack vector in Security Library method - xss_clean().

-

Changed Config Library method base_url() to fallback to - ``$_SERVER['SERVER_ADDR']`` in order to avoid Host header - injections.

-

Changed CAPTCHA Helper to try to use the operating system's PRNG - first.

-
- - - - ports/203403 - https://codeigniter.com/userguide2/changelog.html - - - 2015-10-31 - 2015-11-01 - - - - - openafs -- information disclosure - - - openafs - 1.6.15 - - - - -

The OpenAFS development team reports:

-
-

When constructing an Rx acknowledgment (ACK) packet, Andrew-derived Rx - implementations do not initialize three octets of data that are padding - in the C language structure and were inadvertently included in the wire - protocol (CVE-2015-7762). Additionally, OpenAFS Rx in versions 1.5.75 - through 1.5.78, 1.6.0 through 1.6.14, and 1.7.0 through 1.7.32 include - a variable-length padding at the end of the ACK packet, in an attempt to - detect the path MTU, but only four octets of the additional padding are - initialized (CVE-2015-7763).

-
- - - - http://openafs.org/pages/security/OPENAFS-SA-2015-007.txt - CVE-2015-7762 - CVE-2015-7763 - - - 2015-10-28 - 2015-10-28 - - - - - xscreensaver - lock bypass - - - xscreensaver - xscreensaver-gnome - xscreensaver-gnome-hacks - 5.34 - - - - -

RedHat bugzilla reports:

-
-

In dual screen configurations, unplugging one screen will cause - xscreensaver to crash, leaving the screen unlocked.

-
- - - - https://www.jwz.org/xscreensaver/changelog.html - https://bugzilla.redhat.com/show_bug.cgi?id=1274452 - CVE-2015-8025 - - - 2015-10-24 - 2015-10-27 - 2015-11-04 - - - - - lldpd -- Buffer overflow/Denial of service - - - lldpd - 0.5.60.7.19 - - - - -

The lldpd developer Vincent Bernat reports:

-
-

A buffer overflow may allow arbitrary code execution - only if hardening was disabled.

-
-
-

Malformed packets should not make lldpd crash. Ensure we can - handle them by not using assert() in this part.

-
- - - - CVE-2015-8011 - CVE-2015-8012 - https://github.com/vincentbernat/lldpd/raw/0.7.19/NEWS - http://www.openwall.com/lists/oss-security/2015/10/30/2 - - - 2015-10-04 - 2015-10-26 - 2015-11-10 - - - - - wireshark -- Pcapng file parser crash - - - wireshark - wireshark-lite - wireshark-qt5 - tshark - tshark-lite - 1.12.8 - - - - -

Wireshark development team reports:

-
-

The following vulnerability has been fixed.

-
    -

  • wnpa-sec-2015-30

    -

    Pcapng file parser crash. (Bug 11455)

    • -
-
- - - - https://www.wireshark.org/docs/relnotes/wireshark-1.12.8.html - CVE-2015-7830 - - - 2015-10-14 - 2015-10-25 - - - - - Joomla! -- Core - SQL Injection/ACL Violation vulnerabilities - - - joomla3 - 3.2.03.4.5 - - - - -

The JSST and the Joomla! Security Center report:

-
-

[20151001] - Core - SQL Injection

-

Inadequate filtering of request data leads to a SQL Injection - vulnerability.

-
-
-

[20151002] - Core - ACL Violations

-

Inadequate ACL checks in com_contenthistory provide potential read - access to data which should be access restricted.

-
- - - - CVE-2015-7297 - CVE-2015-7857 - CVE-2015-7858 - CVE-2015-7859 - http://developer.joomla.org/security-centre/628-20151001-core-sql-injection.html - http://developer.joomla.org/security-centre/629-20151002-core-acl-violations.html - https://www.joomla.org/announcements/release-news/5634-joomla-3-4-5-released.html - - - 2015-10-22 - 2015-10-25 - - - - - Joomla! -- Core - ACL Violation vulnerabilities - - - joomla3 - 3.0.03.4.5 - - - - -

The JSST and the Joomla! Security Center report:

-
-

[20151003] - Core - ACL Violations

-

Inadequate ACL checks in com_content provide potential read access - to data which should be access restricted.

-
- - - - CVE-2015-7899 - http://developer.joomla.org/security-centre/630-20151003-core-acl-violations.html - https://www.joomla.org/announcements/release-news/5634-joomla-3-4-5-released.html - - - 2015-10-22 - 2015-10-25 - - - - - Joomla! -- Core - XSS Vulnerability - - - joomla3 - 3.4.03.4.4 - - - - -

The JSST and the Joomla! Security Center report:

-
-

[20150908] - Core - XSS Vulnerability

-

Inadequate escaping leads to XSS vulnerability in login module.

-
- - - - CVE-2015-6939 - http://developer.joomla.org/security-centre/626-20150908-core-xss-vulnerability.html - https://www.joomla.org/announcements/release-news/5628-joomla-3-4-4-released.html - - - 2015-09-08 - 2015-10-25 - - - - - Joomla! -- Core - CSRF Protection vulnerabilities - - - joomla3 - 3.2.03.4.2 - - - - -

The JSST and the Joomla! Security Center report:

-
-

[20150602] - Core - CSRF Protection

-

Lack of CSRF checks potentially enabled uploading malicious code. -

-
- - - - CVE-2015-5397 - http://developer.joomla.org/security-centre/618-20150602-core-remote-code-execution.html - https://www.joomla.org/announcements/release-news/5589-joomla-3-4-2-released.html - - - 2015-06-30 - 2015-10-25 - - - - - Joomla! -- Core - Open Redirect vulnerability - - - joomla3 - 3.0.03.4.2 - - - - -

The JSST and the Joomla! Security Center report:

-
-

[20150601] - Core - Open Redirect

-

Inadequate checking of the return value allowed to redirect to an - external page.

-
- - - - CVE-2015-5608 - http://developer.joomla.org/security-centre/617-20150601-core-open-redirect.html - https://www.joomla.org/announcements/release-news/5589-joomla-3-4-2-released.html - - - 2015-06-30 - 2015-10-25 - - - - - Joomla! -- Core - Remote File Execution/Denial of Service vulnerabilities - - - joomla3 - 3.2.6 - 3.3.03.3.5 - - - joomla2 - 2.5.42.5.26 - - - - -

The JSST and the Joomla! Security Center report:

-
-

[20140903] - Core - Remote File Inclusion

-

Inadequate checking allowed the potential for remote files to be - executed.

-
-
-

[20140904] - Core - Denial of Service

-

Inadequate checking allowed the potential for a denial of service - attack.

-
- - - - CVE-2014-7228 - CVE-2014-7229 - http://developer.joomla.org/security-centre/595-20140903-core-remote-file-inclusion.html - http://developer.joomla.org/security-centre/596-20140904-core-denial-of-service.html - https://www.joomla.org/announcements/release-news/5567-joomla-3-3-5-released.html - https://www.joomla.org/announcements/release-news/5566-joomla-2-5-26-released.html - - - 2014-09-30 - 2015-10-25 - - - - - Joomla! -- Core - Unauthorized Login vulnerability - - - joomla3 - 3.2.5 - 3.3.03.3.4 - - - joomla2 - 2.5.25 - - - - -

The JSST and the Joomla! Security Center report:

-
-

[20140902] - Core - Unauthorized Logins

-

Inadequate checking allowed unauthorized logins via LDAP - authentication.

-
- - - - CVE-2014-6632 - http://developer.joomla.org/security-centre/594-20140902-core-unauthorised-logins.html - https://www.joomla.org/announcements/release-news/5564-joomla-3-3-4-released.html - https://www.joomla.org/announcements/release-news/5563-joomla-2-5-25-released.html - - - 2014-09-23 - 2015-10-25 - - - - - Joomla! -- Core - XSS Vulnerability - - - joomla3 - 3.2.03.2.5 - 3.3.03.3.4 - - - - -

The JSST and the Joomla! Security Center report:

-
-

[20140901] - Core - XSS Vulnerability

-

Inadequate escaping leads to XSS vulnerability in com_media.

-
- - - - CVE-2014-6631 - http://developer.joomla.org/security-centre/593-20140901-core-xss-vulnerability.html - https://www.joomla.org/announcements/release-news/5564-joomla-3-3-4-released.html - - - 2014-09-23 - 2015-10-25 - - - - - drupal -- open redirect vulnerability - - - drupal7 - 7.41 - - - - -

Drupal development team reports:

-
-

The Overlay module in Drupal core displays administrative pages - as a layer over the current page (using JavaScript), rather than - replacing the page in the browser window. The Overlay module does - not sufficiently validate URLs prior to displaying their contents, - leading to an open redirect vulnerability.

-

This vulnerability is mitigated by the fact that it can only be - used against site users who have the "Access the administrative - overlay" permission, and that the Overlay module must be enabled. -

-

An incomplete fix for this issue was released as part of - SA-CORE-2015-002.

-
- - - - CVE-2015-7943 - https://www.drupal.org/SA-CORE-2015-004 - http://www.openwall.com/lists/oss-security/2015/10/23/6 - - - 2015-10-21 - 2015-10-24 - - - - - phpMyAdmin -- Content spoofing vulnerability - - - phpMyAdmin - 4.4.04.4.15.1 - 4.5.04.5.1 - - - - -

The phpMyAdmin development team reports:

-
-

This vulnerability allows an attacker to perform a - content spoofing attack using the phpMyAdmin's redirection - mechanism to external sites.

-

We consider this vulnerability to be non critical since - the spoofed content is escaped and no HTML injection is - possible.

-
- - - - https://www.phpmyadmin.net/security/PMASA-2015-5/ - CVE-2015-7873 - - - 2015-10-23 - 2015-10-23 - - - - - mediawiki -- multiple vulnerabilities - - - mediawiki123 - 1.23.11 - - - mediawiki124 - 1.24.4 - - - mediawiki125 - 1.25.3 - - - - -

MediaWiki reports:

-
-

Wikipedia user RobinHood70 reported two issues in the chunked - upload API. The API failed to correctly stop adding new chunks to - the upload when the reported size was exceeded (T91203), allowing - a malicious users to upload add an infinite number of chunks for a - single file upload. Additionally, a malicious user could upload - chunks of 1 byte for very large files, potentially creating a very - large number of files on the server's filesystem (T91205).

-

Internal review discovered that it is not possible to throttle file - uploads.

-

Internal review discovered a missing authorization check when - removing suppression from a revision. This allowed users with the - 'viewsuppressed' user right but not the appropriate - 'suppressrevision' user right to unsuppress revisions.

-

Richard Stanway from teamliquid.net reported that thumbnails of PNG - files generated with ImageMagick contained the local file path in - the image metadata.

-
- - - - CVE-2015-8001 - CVE-2015-8002 - CVE-2015-8003 - CVE-2015-8004 - CVE-2015-8005 - CVE-2015-8006 - CVE-2015-8007 - CVE-2015-8008 - CVE-2015-8009 - https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-October/000181.html - https://phabricator.wikimedia.org/T91203 - https://phabricator.wikimedia.org/T91205 - https://phabricator.wikimedia.org/T91850 - https://phabricator.wikimedia.org/T95589 - https://phabricator.wikimedia.org/T108616 - http://www.openwall.com/lists/oss-security/2015/10/29/14 - - - 2015-10-16 - 2015-10-23 - 2015-12-24 - - - - - ntp -- 13 low- and medium-severity vulnerabilities - - - ntp - 4.2.8p4 - - - ntp-devel - 4.3.76 - - - FreeBSD - 10.210.2_7 - 10.110.1_24 - 9.39.3_30 - - - - -

ntp.org reports:

-
-

NTF's NTP Project has been notified of the following 13 low- - and medium-severity vulnerabilities that are fixed in - ntp-4.2.8p4, released on Wednesday, 21 October 2015:

-
    -
  • Bug 2941 CVE-2015-7871 NAK to the Future: Symmetric - association authentication bypass via crypto-NAK - (Cisco ASIG)
    • -
  • Bug 2922 CVE-2015-7855 decodenetnum() will ASSERT botch - instead of returning FAIL on some bogus values (IDA)
    • -
  • Bug 2921 CVE-2015-7854 Password Length Memory Corruption - Vulnerability. (Cisco TALOS)
    • -
  • Bug 2920 CVE-2015-7853 Invalid length data provided by a - custom refclock driver could cause a buffer overflow. - (Cisco TALOS)
    • -
  • Bug 2919 CVE-2015-7852 ntpq atoascii() Memory Corruption - Vulnerability. (Cisco TALOS)
    • -
  • Bug 2918 CVE-2015-7851 saveconfig Directory Traversal - Vulnerability. (OpenVMS) (Cisco TALOS)
    • -
  • Bug 2917 CVE-2015-7850 remote config logfile-keyfile. - (Cisco TALOS)
    • -
  • Bug 2916 CVE-2015-7849 trusted key use-after-free. - (Cisco TALOS)
    • -
  • Bug 2913 CVE-2015-7848 mode 7 loop counter underrun. - (Cisco TALOS)
    • -
  • Bug 2909 CVE-2015-7701 Slow memory leak in CRYPTO_ASSOC. - (Tenable)
    • -
  • Bug 2902 : CVE-2015-7703 configuration directives "pidfile" - and "driftfile" should only be allowed locally. (RedHat)
    • -
  • Bug 2901 : CVE-2015-7704, CVE-2015-7705 Clients that - receive a KoD should validate the origin timestamp field. - (Boston University)
    • -
  • Bug 2899 : CVE-2015-7691, CVE-2015-7692, CVE-2015-7702 - Incomplete autokey data packet length checks. (Tenable)
    • -
-

The only generally-exploitable bug in the above list is the - crypto-NAK bug, which has a CVSS2 score of 6.4.

-

Additionally, three bugs that have already been fixed in - ntp-4.2.8 but were not fixed in ntp-4.2.6 as it was EOL'd - have a security component, but are all below 1.8 CVSS score, - so we're reporting them here:

-
    -
  • Bug 2382 : Peer precision < -31 gives division by zero
    • -
  • Bug 1774 : Segfaults if cryptostats enabled when built - without OpenSSL
    • -
  • Bug 1593 : ntpd abort in free() with logconfig syntax error
    • -
-
- - - - SA-15:25.ntp - CVE-2015-7691 - CVE-2015-7692 - CVE-2015-7701 - CVE-2015-7702 - CVE-2015-7703 - CVE-2015-7704 - CVE-2015-7705 - CVE-2015-7848 - CVE-2015-7849 - CVE-2015-7850 - CVE-2015-7851 - CVE-2015-7852 - CVE-2015-7853 - CVE-2015-7854 - CVE-2015-7855 - CVE-2015-7871 - http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities - - - 2015-10-21 - 2015-10-21 - 2016-08-09 - - - - - codeigniter -- multiple XSS vulnerabilities - - - codeigniter - 2.2.5 - - - - -

The CodeIgniter changelog reports:

-
-

Fixed a number of XSS attack vectors in Security Library method - xss_clean (thanks to Frans Rosén from Detectify.

-
- - - - ports/203403 - https://codeigniter.com/userguide2/changelog.html - - - 2015-10-08 - 2015-10-20 - - - - - Git -- Execute arbitrary code - - - git - 2.6.1 - - - git-gui - 2.6.1 - - - git-lite - 2.6.1 - - - git-subversion - 2.6.1 - - - - -

Git release notes:

-
-

Some protocols (like git-remote-ext) can execute arbitrary code - found in the URL. The URLs that submodules use may come from - arbitrary sources (e.g., .gitmodules files in a remote - repository), and can hurt those who blindly enable recursive - fetch. Restrict the allowed protocols to well known and safe - ones.

-
- - - - CVE-2015-7545 - https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.6.1.txt - http://www.openwall.com/lists/oss-security/2015/12/11/7 - - - 2015-09-23 - 2015-10-19 - 2015-12-12 - - - - - Salt -- multiple vulnerabilities - - - py27-salt - 2015.8.1 - - - - -

Salt release notes:

-
-

CVE-2015-6918 - Git modules leaking HTTPS auth credentials to debug log

-

Updated the Git state and execution modules to no longer display HTTPS basic - authentication credentials in loglevel debug output on the Salt master. These - credentials are now replaced with REDACTED in the debug output. Thanks to - Andreas Stieger for bringing this to our attention.

-

CVE-2015-6941 - win_useradd module and salt-cloud display passwords in debug - log

-

Updated the win_useradd module return data to no longer include the password - of the newly created user. The password is now replaced with the string - XXX-REDACTED-XXX. Updated the Salt Cloud debug output to no longer display - win_password and sudo_password authentication credentials. Also updated the - Linode driver to no longer display authentication credentials in debug logs. - These credentials are now replaced with REDACTED in the debug output.

-
- - - - https://docs.saltstack.com/en/latest/topics/releases/2015.8.1.html - CVE-2015-6918 - CVE-2015-6941 - - - 2015-10-16 - 2015-10-17 - - - - - firefox -- Cross-origin restriction bypass using Fetch - - - firefox - 41.0.2,1 - - - linux-firefox - 41.0.2,1 - - - - -

Firefox Developers report:

-
-

Security researcher Abdulrahman Alqabandi reported that the fetch() - API did not correctly implement the Cross-Origin Resource Sharing - (CORS) specification, allowing a malicious page to access private - data from other origins. Mozilla developer Ben Kelly independently reported the - same issue. -

-
- - - - https://www.mozilla.org/en-US/security/advisories/mfsa2015-115/ - CVE-2015-7184 - - - 2015-10-15 - 2015-10-16 - - - - - flash -- remote code execution - - - linux-c6-flashplugin - linux-f10-flashplugin - linux-c6_64-flashplugin - 11.2r202.540 - - - - -

Adobe reports:

-
-

These updates resolve type confusion vulnerabilities that - could lead to code execution (CVE-2015-7645, CVE-2015-7647, - CVE-2015-7648).

-
- - - - CVE-2015-7645 - CVE-2015-7647 - CVE-2015-7648 - https://helpx.adobe.com/security/products/flash-player/apsb15-27.html - - - 2015-10-16 - 2015-10-16 - - - - - LibreSSL -- Memory leak and buffer overflow - - - libressl - 2.2.4 - - - - -

Qualys reports:

-
-

During the code review of OpenSMTPD a memory leak and buffer overflow - (an off-by-one, usually stack-based) were discovered in LibreSSL's - OBJ_obj2txt() function. This function is called automatically during - a TLS handshake (both client-side, unless an anonymous mode is used, - and server-side, if client authentication is requested).

-
- - - - http://marc.info/?l=openbsd-announce&m=144495690528446 - CVE-2015-5333 - CVE-2015-5334 - - - 2015-10-15 - 2015-10-16 - 2015-10-26 - - - - - mbedTLS/PolarSSL -- DoS and possible remote code execution - - - polarssl - 1.2.01.2.17 - - - polarssl13 - 1.3.01.3.14 - - - mbedtls - 2.1.2 - - - - -

ARM Limited reports:

-
-

When the client creates its ClientHello message, due to - insufficient bounds checking it can overflow the heap-based buffer - containing the message while writing some extensions. Two extensions in - particular could be used by a remote attacker to trigger the overflow: - the session ticket extension and the server name indication (SNI) - extension.

-
- - - - https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2015-01 - CVE-2015-5291 - - - 2015-10-05 - 2015-10-15 - - - - - magento -- multiple vulnerabilities - - - magento - 1.9.2.1 - - - - -

Magento, Inc. reports:

-
-

SUPEE-6482 - This patch addresses two issues related to APIs and - two cross-site scripting risks.

-

SUPEE-6285 - This patch provides protection against several types - of security-related issues, including information leaks, request - forgeries, and cross-site scripting.

-

SUPEE-5994 - This patch addresses multiple security - vulnerabilities in Magento Community Edition software, including - issues that can put customer information at risk.

-

SUPEE-5344 - Addresses a potential remote code execution - exploit.

-

SUPEE-1533 - Addresses two potential remote code execution - exploits.

-
- - - - ports/201709 - https://www.magentocommerce.com/download - http://merch.docs.magento.com/ce/user_guide/Magento_Community_Edition_User_Guide.html#magento/release-notes-ce-1.9.2.html - http://merch.docs.magento.com/ce/user_guide/Magento_Community_Edition_User_Guide.html#magento/release-notes-ce-1.9.2.1.html - - - 2014-10-03 - 2015-10-14 - - - - - pear-twig -- remote code execution - - - pear-twig-twig - 1.20.0 - - - - -

Fabien Potencier reports:

-
-

End users can craft valid Twig code that allows them to - execute arbitrary code (RCEs) via the _self variable, which is always - available, even in sandboxed templates.

-
- - - - http://symfony.com/blog/security-release-twig-1-20-0 - CVE-2015-7809 - - - 2015-08-12 - 2015-10-14 - - - - - miniupnpc -- buffer overflow - - - miniupnpc - 1.9.11.9.20150917 - 1.9_1 - - - - -

Talos reports:

-
-

An exploitable buffer overflow vulnerability exists in the - XML parser functionality of the MiniUPnP library. A specially crafted - XML response can lead to a buffer overflow on the stack resulting in - remote code execution. An attacker can set up a server on the local - network to trigger this vulnerability.

-
- - - - CVE-2015-6031 - http://talosintel.com/reports/TALOS-2015-0035/ - https://github.com/miniupnp/miniupnp/commit/79cca974a4c2ab1199786732a67ff6d898051b78 - - - 2015-09-15 - 2015-10-14 - 2015-10-14 - - - - - flash -- multiple vulnerabilities - - - linux-c6-flashplugin - linux-f10-flashplugin - linux-c6_64-flashplugin - 11.2r202.535 - - - - -

Adobe reports:

-
-

These updates resolve a vulnerability that could be exploited - to bypass the same-origin-policy and lead to information - disclosure (CVE-2015-7628).

- -

These updates include a defense-in-depth feature in the Flash - broker API (CVE-2015-5569).

- -

These updates resolve use-after-free vulnerabilities that - could lead to code execution (CVE-2015-7629, CVE-2015-7631, - CVE-2015-7643, CVE-2015-7644).

- -

These updates resolve a buffer overflow vulnerability that - could lead to code execution (CVE-2015-7632).

- -

These updates resolve memory corruption vulnerabilities that - could lead to code execution (CVE-2015-7625, CVE-2015-7626, - CVE-2015-7627, CVE-2015-7630, CVE-2015-7633, CVE-2015-7634).

-
- - - - CVE-2015-5569 - CVE-2015-7625 - CVE-2015-7626 - CVE-2015-7627 - CVE-2015-7628 - CVE-2015-7629 - CVE-2015-7630 - CVE-2015-7631 - CVE-2015-7632 - CVE-2015-7633 - CVE-2015-7634 - CVE-2015-7643 - CVE-2015-7644 - https://helpx.adobe.com/security/products/flash-player/apsb15-25.html - - - 2015-10-13 - 2015-10-14 - - - - - chromium -- multiple vulnerabilities - - - chromium - - chromium-npapi - chromium-pulse - 46.0.2490.71 - - - - -

Google Chrome Releases reports:

-
-

24 security fixes in this release, including:

-
    -
  • [519558] High CVE-2015-6755: Cross-origin bypass in Blink. - Credit to Mariusz Mlynski.
    • -
  • [507316] High CVE-2015-6756: Use-after-free in PDFium. Credit - to anonymous.
    • -
  • [529520] High CVE-2015-6757: Use-after-free in ServiceWorker. - Credit to Collin Payne.
    • -
  • [522131] High CVE-2015-6758: Bad-cast in PDFium. Credit to Atte - Kettunen of OUSPG.
    • -
  • [514076] Medium CVE-2015-6759: Information leakage in - LocalStorage. Credit to Muneaki Nishimura (nishimunea).
    • -
  • [519642] Medium CVE-2015-6760: Improper error handling in - libANGLE. Credit to lastland.net.
    • -
  • [447860,532967] Medium CVE-2015-6761: Memory corruption in - FFMpeg. Credit to Aki Helin of OUSPG and anonymous.
    • -
  • [512678] Low CVE-2015-6762: CORS bypass via CSS fonts. Credit - to Muneaki Nishimura (nishimunea).
    • -
  • [542517] CVE-2015-6763: Various fixes from internal audits, - fuzzing and other initiatives.
    • -
  • Multiple vulnerabilities in V8 fixed at the tip of the 4.6 - branch (currently 4.6.85.23).
    • -
-
- - - - CVE-2015-6755 - CVE-2015-6756 - CVE-2015-6757 - CVE-2015-6758 - CVE-2015-6759 - CVE-2015-6760 - CVE-2015-6761 - CVE-2015-6762 - CVE-2015-6763 - http://googlechromereleases.blogspot.nl/2015/10/stable-channel-update.html - - - 2015-10-13 - 2015-10-13 - - - - - p5-UI-Dialog -- shell command execution vulnerability - - - p5-UI-Dialog - 1.09_2 - - - - -

Matthijs Kooijman reports:

-
-

It seems that the whiptail, cdialog and kdialog backends apply - some improper escaping in their shell commands, causing special - characters present in menu item titles to be interpreted by the - shell. This includes the backtick evaluation operator, so this - constitutes a security issue, allowing execution of arbitrary - commands if an attacker has control over the text displayed in - a menu.

-
- - - - CVE-2008-7315 - ports/203667 - https://rt.cpan.org/Public/Bug/Display.html?id=107364 - https://bugs.debian.org/496448 - https://github.com/kckrinke/UI-Dialog/commit/6adc44cc636c615d76297d86835e1a997681eb61 - - - 2008-08-24 - 2015-10-10 - - - - - devel/ipython -- multiple vulnerabilities - - - ipython - 3.2.2 - - - - -

Matthias Bussonnier reports:

-
-

Summary: Local folder name was used in HTML templates without - escaping, allowing XSS in said pages by carefully crafting folder - name and URL to access it.

-

URI with issues:

-
    -
  • GET /tree/**
    • -
-
-

Benjamin RK reports:

-
-

Vulnerability: A maliciously forged file opened for editing can - execute javascript, specifically by being redirected to /files/ due - to a failure to treat the file as plain text.

-

URI with issues:

-
    -
  • GET /edit/**
    • -
-
- - - - ports/203668 - CVE-2015-6938 - CVE-2015-7337 - http://www.openwall.com/lists/oss-security/2015/09/02/3 - https://github.com/ipython/ipython/commit/3ab41641cf6fce3860c73d5cf4645aa12e1e5892 - http://www.openwall.com/lists/oss-security/2015/09/16/3 - https://github.com/ipython/ipython/commit/0a8096adf165e2465550bd5893d7e352544e5967 - - - 2015-09-01 - 2015-10-10 - - - - - PostgreSQL -- minor security problems. - - - postgresql90-server - 9.0.09.0.22 - - - postgresql91-server - 9.1.09.1.18 - - - postgresql92-server - 9.2.09.2.13 - - - postgresql93-server - 9.3.09.3.9 - - - postgresql94-server - 9.4.09.4.4 - - - - -

PostgreSQL project reports:

-
-

- Two security issues have been fixed in this release which affect - users of specific PostgreSQL features. -

-
    -
  • CVE-2015-5289 json or jsonb input values constructed from - arbitrary user input can crash the PostgreSQL server and cause a denial of - service. -
    • -
  • CVE-2015-5288: The crypt() function included with the optional pgCrypto - extension could be exploited to read a few additional bytes of memory. - No working exploit for this issue has been developed. -
    • -
-
- - - - CVE-2015-5289 - CVE-2015-5288 - - - 2015-10-08 - 2015-10-08 - - - - - ZendFramework1 -- SQL injection vulnerability - - - ZendFramework1 - 1.12.16 - - - - -

Zend Framework developers report:

-
-

The PDO adapters of Zend Framework 1 do not filter null bytes values - in SQL statements. A PDO adapter can treat null bytes in a query as a - string terminator, allowing an attacker to add arbitrary SQL - following a null byte, and thus create a SQL injection.

-
- - - - CVE-2015-7695 - http://www.openwall.com/lists/oss-security/2015/09/30/6 - http://framework.zend.com/security/advisory/ZF2015-08 - - - 2015-09-15 - 2015-10-06 - 2015-10-12 - - - - - OpenSMTPD -- multiple vulnerabilities - - - opensmtpd - 5.7.3,1 - - - - -

OpenSMTPD developers report:

-
-

fix an mda buffer truncation bug which allows a user to create - forward files that pass session checks but fail delivery later down - the chain, within the user mda

-

fix remote buffer overflow in unprivileged pony process

-

reworked offline enqueue to better protect against hardlink - attacks

-
- - - - http://www.openwall.com/lists/oss-security/2015/10/04/2 - https://www.opensmtpd.org/announces/release-5.7.3.txt - - - 2015-10-04 - 2015-10-06 - - - - - mbedTLS/PolarSSL -- multiple vulnerabilities - - - polarssl - 1.2.01.2.16 - - - polarssl13 - 1.3.01.3.13 - - - mbedtls - 2.1.1 - - - - -

ARM Limited reports:

-
-

Florian Weimar from Red Hat published on Lenstra's RSA-CRT attach - for PKCS#1 v1.5 signatures. These releases include countermeasures - against that attack.

-

Fabian Foerg of Gotham Digital Science found a possible client-side - NULL pointer dereference, using the AFL Fuzzer. This dereference can - only occur when misusing the API, although a fix has still been - implemented.

-
- - - - https://tls.mbed.org/tech-updates/releases/mbedtls-2.1.1-and-1.3.13-and-polarssl-1.2.16-released - - - 2015-09-18 - 2015-10-06 - - - - - mbedTLS/PolarSSL -- multiple vulnerabilities - - - polarssl - 1.2.01.2.15 - - - polarssl13 - 1.3.01.3.12 - - - - -

ARM Limited reports:

-
-

In order to strengthen the minimum requirements for connections and - to protect against the Logjam attack, the minimum size of - Diffie-Hellman parameters accepted by the client has been increased - to 1024 bits.

-

In addition the default size for the Diffie-Hellman parameters on - the server are increased to 2048 bits. This can be changed with - ssl_set_dh_params() in case this is necessary.

-
- - - - https://tls.mbed.org/tech-updates/releases/polarssl-1.2.15-and-mbedtls-1.3.12-released - - - 2015-08-11 - 2015-10-06 - - - - - gdk-pixbuf2 -- head overflow and DoS - - - gdk-pixbuf2 - 2.32.1 - - - - -

reports:

-
-

We found a heap overflow and a DoS in the gdk-pixbuf - implementation triggered by the scaling of tga file.

-
-
-

We found a heap overflow in the gdk-pixbuf implementation - triggered by the scaling of gif file.

-
- - - - CVE-2015-7673 - CVE-2015-7674 - https://mail.gnome.org/archives/ftp-release-list/2015-September/msg00201.html - https://mail.gnome.org/archives/ftp-release-list/2015-September/msg00287.html - http://www.openwall.com/lists/oss-security/2015/10/02/9 - http://www.openwall.com/lists/oss-security/2015/10/02/10 - - - 2015-10-02 - 2015-10-05 - - - - - plone -- multiple vulnerabilities - - - plone - 4.3.7 - - - - -

Plone.org reports:

-
-

Versions Affected: All current Plone versions.

-

Versions Not Affected: None.

-

Nature of vulnerability: Allows creation of members by anonymous - users on sites that have self-registration enabled, allowing bypass - of CAPTCHA and similar protections against scripted attacks.

-

The patch can be added to buildouts as Products.PloneHotfix20150910 - (available from PyPI) or downloaded from Plone.org.

-

Immediate Measures You Should Take: Disable self-registration until - you have applied the patch.

-
-
-

Plone's URL checking infrastructure includes a method for checking - if URLs valid and located in the Plone site. By passing HTML into - this specially crafted url, XSS can be achieved.

-
- - - - ports/203255 - https://plone.org/products/plone-hotfix/releases/20150910 - https://plone.org/products/plone/security/advisories/20150910-announcement - https://plone.org/security/20150910/non-persistent-xss-in-plone - https://github.com/plone/Products.CMFPlone/commit/3da710a2cd68587f0bf34f2e7ea1167d6eeee087 - - - 2015-09-10 - 2015-10-05 - - - - - php -- multiple vulnerabilities - - - php5-phar - 5.4.45 - - - php55-phar - 5.5.30 - - - php56-phar - 5.6.14 - - - - -

PHP reports:

-
-

Phar:

-
    -
  • Fixed bug #69720 (Null pointer dereference in - phar_get_fp_offset()).
    • -
  • Fixed bug #70433 (Uninitialized pointer in phar_make_dirstream - when zip entry filename is "/").
    • -
-
- - - - ports/203541 - CVE-2015-7803 - CVE-2015-7804 - http://php.net/ChangeLog-5.php#5.5.30 - http://php.net/ChangeLog-5.php#5.6.14 - - - 2015-10-01 - 2015-10-04 - 2015-10-12 - - - - - OpenSMTPD -- multiple vulnerabilities - - - opensmtpd - 5.7.2,1 - - - - -

OpenSMTPD developers report:

-
-

an oversight in the portable version of fgetln() that allows - attackers to read and write out-of-bounds memory

-

multiple denial-of-service vulnerabilities that allow local users - to kill or hang OpenSMTPD

-

a stack-based buffer overflow that allows local users to crash - OpenSMTPD, or execute arbitrary code as the non-chrooted _smtpd - user

-

a hardlink attack (or race-conditioned symlink attack) that allows - local users to unset the chflags() of arbitrary files

-

a hardlink attack that allows local users to read the first line of - arbitrary files (for example, root's hash from /etc/master.passwd) -

-

a denial-of-service vulnerability that allows remote attackers to - fill OpenSMTPD's queue or mailbox hard-disk partition

-

an out-of-bounds memory read that allows remote attackers to crash - OpenSMTPD, or leak information and defeat the ASLR protection

-

a use-after-free vulnerability that allows remote attackers to - crash OpenSMTPD, or execute arbitrary code as the non-chrooted - _smtpd user

-
- - - - https://www.opensmtpd.org/announces/release-5.7.2.txt - CVE-2015-7687 - - - 2015-10-02 - 2015-10-04 - 2015-10-06 - - - - - james -- multiple vulnerabilities - - - james - 2.3.2.1 - - - - -

The Apache James Project reports:

-
-

This release has many enhancements and bug fixes over the previous - release. See the Release Notes for a detailed list of changes. Some - of the earlier defects could turn a James mail server into an Open - Relay and allow files to be written on disk. All users of James - Server are urged to upgrade to version v2.3.2.1 as soon as - possible.

-
- - - - ports/203461 - 988628 - CVE-2015-7611 - http://james.apache.org/download.cgi#Apache_James_Server - https://blogs.apache.org/james/entry/apache_james_server_2_3 - - - 2015-09-30 - 2015-10-01 - 2015-10-04 - - - - - otrs -- Scheduler Process ID File Access - - - otrs - 3.2.*3.2.18 - 3.3.*3.3.15 - 4.0.*4.0.13 - - - - -

The OTRS project reports:

-
-

An attacker with valid LOCAL credentials could access and - manipulate the process ID file for bin/otrs.schduler.pl from the - CLI.

-

The Proc::Daemon module 0.14 for Perl uses world-writable - permissions for a file that stores a process ID, which allows local - users to have an unspecified impact by modifying this file.

-
- - - - https://www.otrs.com/security-advisory-2015-02-scheduler-process-id-file-access/ - CVE-2015-6842 - CVE-2013-7135 - - - 2015-09-17 - 2015-09-30 - - - - - flash -- multiple vulnerabilities - - - linux-c6-flashplugin - linux-f10-flashplugin - linux-c6_64-flashplugin - 11.2r202.521 - - - - -

Adobe reports:

-
-

These updates resolve a type confusion vulnerability that could - lead to code execution (CVE-2015-5573).

- -

These updates resolve use-after-free vulnerabilities that could - lead to code execution (CVE-2015-5570, CVE-2015-5574, CVE-2015-5581, CVE-2015-5584, CVE-2015-6682).

- -

These updates resolve buffer overflow vulnerabilities that could - lead to code execution (CVE-2015-6676, CVE-2015-6678).

- -

These updates resolve memory corruption vulnerabilities that - could lead to code execution (CVE-2015-5575, CVE-2015-5577, - CVE-2015-5578, CVE-2015-5580, CVE-2015-5582, CVE-2015-5588, - CVE-2015-6677).

- -

These updates include additional validation checks to ensure - that Flash Player rejects malicious content from vulnerable - JSONP callback APIs (CVE-2015-5571).

- -

These updates resolve a memory leak vulnerability - (CVE-2015-5576).

- -

These updates include further hardening to a mitigation to - defend against vector length corruptions (CVE-2015-5568).

- -

These updates resolve stack corruption vulnerabilities that - could lead to code execution (CVE-2015-5567, CVE-2015-5579).

- -

These updates resolve a stack overflow vulnerability that could - lead to code execution (CVE-2015-5587).

- -

These updates resolve a security bypass vulnerability that could - lead to information disclosure (CVE-2015-5572).

- -

These updates resolve a vulnerability that could be exploited to - bypass the same-origin-policy and lead to information disclosure - (CVE-2015-6679).

-
- - - - CVE-2015-5567 - CVE-2015-5568 - CVE-2015-5570 - CVE-2015-5571 - CVE-2015-5572 - CVE-2015-5573 - CVE-2015-5574 - CVE-2015-5575 - CVE-2015-5576 - CVE-2015-5577 - CVE-2015-5578 - CVE-2015-5588 - CVE-2015-6676 - CVE-2015-6677 - CVE-2015-6678 - CVE-2015-6679 - CVE-2015-6682 - https://helpx.adobe.com/security/products/flash-player/apsb15-23.html - - - 2015-09-21 - 2015-09-28 - - - - - codeigniter -- SQL injection vulnerability - - - codeigniter - 2.2.4 - - - - -

The CodeIgniter changelog reports:

-
-

Security: Fixed an SQL injection vulnerability in Active Record - method offset().

-
- - - - ports/203401 - https://codeigniter.com/userguide2/changelog.html - - - 2015-08-20 - 2015-09-28 - - - - - codeigniter -- mysql database driver vulnerability - - - codeigniter - 2.2.3 - - - - -

The CodeIgniter changelog reports:

-
-

Security: Removed a fallback to mysql_escape_string() in the mysql - database driver (escape_str() method) when there's no active database - connection.

-
- - - - ports/203401 - https://codeigniter.com/userguide2/changelog.html - - - 2015-07-15 - 2015-09-28 - - - - - codeigniter -- multiple vulnerabilities - - - codeigniter - 2.2.2 - - - - -

The CodeIgniter changelog reports:

-
-

Security: Added HTTP "Host" header character validation to prevent - cache poisoning attacks when base_url auto-detection is used.

-

Security: Added FSCommand and seekSegmentTime to the "evil - attributes" list in CI_Security::xss_clean().

-
- - - - ports/203401 - https://codeigniter.com/userguide2/changelog.html - - - 2015-04-15 - 2015-09-28 - - - - - codeigniter -- multiple vulnerabilities - - - codeigniter - 2.2.0 - - - - -

The CodeIgniter changelog reports:

-
-

Security: The xor_encode() method in the Encrypt Class has been - removed. The Encrypt Class now requires the Mcrypt extension to be - installed.

-

Security: The Session Library now uses HMAC authentication instead - of a simple MD5 checksum.

-
- - - - ports/203401 - https://codeigniter.com/userguide2/changelog.html - - - 2014-06-05 - 2015-09-28 - - - - - codeigniter -- SQL injection vulnerability - - - codeigniter - 2.0.3 - - - - -

The CodeIgniter changelog reports:

-
-

An improvement was made to the MySQL and MySQLi drivers to prevent - exposing a potential vector for SQL injection on sites using - multi-byte character sets in the database client connection.

-

An incompatibility in PHP versions < 5.2.3 and MySQL > 5.0.7 - with mysql_set_charset() creates a situation where using multi-byte - character sets on these environments may potentially expose a SQL - injection attack vector. Latin-1, UTF-8, and other "low ASCII" - character sets are unaffected on all environments.

-

If you are running or considering running a multi-byte character - set for your database connection, please pay close attention to the - server environment you are deploying on to ensure you are not - vulnerable.

-
- - - - ports/156486 - https://codeigniter.com/userguide2/changelog.html - - - 2011-08-20 - 2015-09-28 - - - - - chromium -- multiple vulnerabilities - - - chromium - 45.0.2454.101 - - - - chromium-npapi - 45.0.2454.101 - - - - chromium-pulse - 45.0.2454.101 - - - - -

Google Chrome Releases reports:

-
-

Two vulnerabilities were fixed in this release:

-
    -
  • [530301] High CVE-2015-1303: Cross-origin bypass in DOM. Credit - to Mariusz Mlynski.
    • -
  • [531891] High CVE-2015-1304: Cross-origin bypass in V8. Credit - to Mariusz Mlynski.
    • -
-
- - - - CVE-2015-1303 - CVE-2015-1304 - http://googlechromereleases.blogspot.nl/2015/09/stable-channel-update_24.html - - - 2015-09-24 - 2015-09-27 - - - - - libssh2 -- denial of service vulnerability - - - libssh2 - 1.5.0,2 - - - - -

Mariusz Ziulek reports:

-
-

A malicious attacker could man in the middle a real server - and cause libssh2 using clients to crash (denial of service) or - otherwise read and use completely unintended memory areas in this - process.

-
- - - - http://www.libssh2.org/adv_20150311.html - https://trac.libssh2.org/ticket/294 - CVE-2015-1782 - - - 2015-01-25 - 2015-09-22 - 2015-09-22 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 41.0,1 - - - linux-firefox - 41.0,1 - - - seamonkey - 2.38 - - - linux-seamonkey - 2.38 - - - firefox-esr - 38.3.0,1 - - - libxul - 38.3.0 - - - thunderbird - 38.3.0 - - - linux-thunderbird - 38.3.0 - - - - -

The Mozilla Project reports:

-
-

MFSA 2015-96 Miscellaneous memory safety hazards (rv:41.0 - / rv:38.3)

-

MFSA 2015-97 Memory leak in mozTCPSocket to servers

-

MFSA 2015-98 Out of bounds read in QCMS library with ICC - V4 profile attributes

-

MFSA 2015-99 Site attribute spoofing on Android by - pasting URL with unknown scheme

-

MFSA 2015-100 Arbitrary file manipulation by local user - through Mozilla updater

-

MFSA 2015-101 Buffer overflow in libvpx while parsing vp9 - format video

-

MFSA 2015-102 Crash when using debugger with SavedStacks - in JavaScript

-

MFSA 2015-103 URL spoofing in reader mode

-

MFSA 2015-104 Use-after-free with shared workers and - IndexedDB

-

MFSA 2015-105 Buffer overflow while decoding WebM - video

-

MFSA 2015-106 Use-after-free while manipulating HTML - media content

-

MFSA 2015-107 Out-of-bounds read during 2D canvas display - on Linux 16-bit color depth systems

-

MFSA 2015-108 Scripted proxies can access inner - window

-

MFSA 2015-109 JavaScript immutable property enforcement - can be bypassed

-

MFSA 2015-110 Dragging and dropping images exposes final - URL after redirects

-

MFSA 2015-111 Errors in the handling of CORS preflight - request headers

-

MFSA 2015-112 Vulnerabilities found through code - inspection

-

MFSA 2015-113 Memory safety errors in libGLES in the - ANGLE graphics library

-

MFSA 2015-114 Information disclosure via the High - Resolution Time API

-
- - - - CVE-2015-4476 - CVE-2015-4500 - CVE-2015-4501 - CVE-2015-4502 - CVE-2015-4503 - CVE-2015-4504 - CVE-2015-4505 - CVE-2015-4506 - CVE-2015-4507 - CVE-2015-4508 - CVE-2015-4509 - CVE-2015-4510 - CVE-2015-4512 - CVE-2015-4516 - CVE-2015-4517 - CVE-2015-4519 - CVE-2015-4520 - CVE-2015-4521 - CVE-2015-4522 - CVE-2015-7174 - CVE-2015-7175 - CVE-2015-7176 - CVE-2015-7177 - CVE-2015-7178 - CVE-2015-7179 - CVE-2015-7180 - https://www.mozilla.org/security/advisories/mfsa2015-96/ - https://www.mozilla.org/security/advisories/mfsa2015-97/ - https://www.mozilla.org/security/advisories/mfsa2015-98/ - https://www.mozilla.org/security/advisories/mfsa2015-99/ - https://www.mozilla.org/security/advisories/mfsa2015-100/ - https://www.mozilla.org/security/advisories/mfsa2015-101/ - https://www.mozilla.org/security/advisories/mfsa2015-102/ - https://www.mozilla.org/security/advisories/mfsa2015-103/ - https://www.mozilla.org/security/advisories/mfsa2015-104/ - https://www.mozilla.org/security/advisories/mfsa2015-105/ - https://www.mozilla.org/security/advisories/mfsa2015-106/ - https://www.mozilla.org/security/advisories/mfsa2015-107/ - https://www.mozilla.org/security/advisories/mfsa2015-108/ - https://www.mozilla.org/security/advisories/mfsa2015-109/ - https://www.mozilla.org/security/advisories/mfsa2015-110/ - https://www.mozilla.org/security/advisories/mfsa2015-111/ - https://www.mozilla.org/security/advisories/mfsa2015-112/ - https://www.mozilla.org/security/advisories/mfsa2015-113/ - https://www.mozilla.org/security/advisories/mfsa2015-114/ - - - 2015-09-22 - 2015-09-22 - - - - - ffmpeg -- multiple vulnerabilities - - - libav - - 0 - - - gstreamer1-libav - - 1.5.90 - - - gstreamer-ffmpeg - - - 0 - - - handbrake - - - 1.2.0 - - - ffmpeg - 2.7.2,1 - - - ffmpeg26 - 2.6.4 - - - ffmpeg25 - 2.5.8 - - - ffmpeg24 - 2.4.11 - - - ffmpeg-devel - ffmpeg23 - ffmpeg2 - ffmpeg1 - ffmpeg-011 - ffmpeg0 - - 0 - - - avidemux - avidemux2 - avidemux26 - - 2.6.11 - - - kodi - - 15.1 - - - mplayer - mencoder - - 1.1.r20150822 - - - mythtv - mythtv-frontend - - 0.27.5,1 - - - plexhometheater - - - 0 - - - - -

NVD reports:

-
-

The decode_ihdr_chunk function in libavcodec/pngdec.c in - FFmpeg before 2.7.2 does not enforce uniqueness of the IHDR - (aka image header) chunk in a PNG image, which allows remote - attackers to cause a denial of service (out-of-bounds array - access) or possibly have unspecified other impact via a - crafted image with two or more of these chunks.

-
-
-

Multiple integer underflows in the ff_mjpeg_decode_frame - function in libavcodec/mjpegdec.c in FFmpeg before 2.7.2 - allow remote attackers to cause a denial of service - (out-of-bounds array access) or possibly have unspecified - other impact via crafted MJPEG data.

-
-
-

The ff_sbr_apply function in libavcodec/aacsbr.c in - FFmpeg before 2.7.2 does not check for a matching AAC frame - syntax element before proceeding with Spectral Band - Replication calculations, which allows remote attackers to - cause a denial of service (out-of-bounds array access) or - possibly have unspecified other impact via crafted AAC - data.

-
-
-

The ff_mpv_common_init function in libavcodec/mpegvideo.c - in FFmpeg before 2.7.2 does not properly maintain the - encoding context, which allows remote attackers to cause a - denial of service (invalid pointer access) or possibly have - unspecified other impact via crafted MPEG data.

-
-
-

The destroy_buffers function in libavcodec/sanm.c in - FFmpeg before 2.7.2 does not properly maintain height and - width values in the video context, which allows remote - attackers to cause a denial of service (segmentation - violation and application crash) or possibly have - unspecified other impact via crafted LucasArts Smush video - data.

-
-
-

The allocate_buffers function in libavcodec/alac.c in - FFmpeg before 2.7.2 does not initialize certain context - data, which allows remote attackers to cause a denial of - service (segmentation violation) or possibly have - unspecified other impact via crafted Apple Lossless Audio - Codec (ALAC) data.

-
-
-

The sws_init_context function in libswscale/utils.c in - FFmpeg before 2.7.2 does not initialize certain pixbuf data - structures, which allows remote attackers to cause a denial - of service (segmentation violation) or possibly have - unspecified other impact via crafted video data.

-
-
-

The ff_frame_thread_init function in - libavcodec/pthread_frame.c in FFmpeg before 2.7.2 mishandles - certain memory-allocation failures, which allows remote - attackers to cause a denial of service (invalid pointer - access) or possibly have unspecified other impact via a - crafted file, as demonstrated by an AVI file.

-
-
-

The ff_rv34_decode_init_thread_copy function in - libavcodec/rv34.c in FFmpeg before 2.7.2 does not initialize - certain structure members, which allows remote attackers to - cause a denial of service (invalid pointer access) or - possibly have unspecified other impact via crafted (1) RV30 - or (2) RV40 RealVideo data.

-
- - - - CVE-2015-6818 - CVE-2015-6819 - CVE-2015-6820 - CVE-2015-6821 - CVE-2015-6822 - CVE-2015-6823 - CVE-2015-6824 - CVE-2015-6825 - CVE-2015-6826 - https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=47f4e2d8960ca756ca153ab8e3e93d80449b8c91 - https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=84afc6b70d24fc0bf686e43138c96cf60a9445fe - https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=79a98294da6cd85f8c86b34764c5e0c43b09eea3 - https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=b160fc290cf49b516c5b6ee0730fd9da7fc623b1 - https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=39bbdebb1ed8eb9c9b0cd6db85afde6ba89d86e4 - https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=f7068bf277a37479aecde2832208d820682b35e6 - https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=a5d44d5c220e12ca0cb7a4eceb0f74759cb13111 - https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=f1a38264f20382731cf2cc75fdd98f4c9a84a626 - https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=3197c0aa87a3b7190e17d49e6fbc7b554e4b3f0a - https://ffmpeg.org/security.html - - - 2015-09-05 - 2015-09-20 - 2018-03-25 - - - - - moodle -- multiple vulnerabilities - - - moodle27 - 2.7.10 - - - moodle28 - 2.8.8 - - - moodle29 - 2.9.2 - - - - -

Moodle Release Notes report:

-
-

MSA-15-0030: Students can re-attempt answering questions in the - lesson (CVE-2015-5264)

-

MSA-15-0031: Teacher in forum can still post to "all participants" - and groups they are not members of (CVE-2015-5272 - 2.7.10 only)

-

MSA-15-0032: Users can delete files uploaded by other users in wiki - (CVE-2015-5265)

-

MSA-15-0033: Meta course synchronization enrolls suspended students - as managers for a short period of time (CVE-2015-5266)

-

MSA-15-0034: Vulnerability in password recovery mechanism - (CVE-2015-5267)

-

MSA-15-0035: Rating component does not check separate groups - (CVE-2015-5268)

-

MSA-15-0036: XSS in grouping description (CVE-2015-5269)

-
- - - - CVE-2015-5264 - CVE-2015-5272 - CVE-2015-5265 - CVE-2015-5266 - CVE-2015-5267 - CVE-2015-5268 - CVE-2015-5269 - http://www.openwall.com/lists/oss-security/2015/09/21/1 - https://docs.moodle.org/dev/Moodle_2.7.10_release_notes - https://docs.moodle.org/dev/Moodle_2.8.8_release_notes - https://docs.moodle.org/dev/Moodle_2.9.2_release_notes - - - 2015-09-14 - 2015-09-18 - 2015-09-24 - - - - - squid -- TLS/SSL parser denial of service vulnerability - - - squid - 3.5.0.13.5.9 - - - - -

Amos Jeffries, release manager of the Squid-3 series, reports:

-
-

Vulnerable versions are 3.5.0.1 to 3.5.8 (inclusive), which are - built with OpenSSL and configured for "SSL-Bump" decryption.

-

Integer overflows can lead to invalid pointer math reading from - random memory on some CPU architectures. In the best case this leads - to wrong TLS extensions being used for the client, worst-case a - crash of the proxy terminating all active transactions.

-

Incorrect message size checks and assumptions about the existence - of TLS extensions in the SSL/TLS handshake message can lead to very - high CPU consumption (up to and including 'infinite loop' - behaviour).

-

The above can be triggered remotely. Though there is one layer of - authorization applied before this processing to check that the - client is allowed to use the proxy, that check is generally weak. MS - Skype on Windows XP is known to trigger some of these.

-
-

The FreeBSD port does not use SSL by default and is not vulnerable - in the default configuration.

- - - - ports/203186 - http://www.squid-cache.org/Advisories/SQUID-2015_3.txt - http://www.openwall.com/lists/oss-security/2015/09/18/1 - - - 2015-09-18 - 2015-09-18 - 2016-02-18 - - - - - remind -- buffer overflow with malicious reminder file input - - - remind - 3.1.15 - - - - -

Dianne Skoll reports:

-
-

BUG FIX: Fix a buffer overflow found by Alexander Keller.

-
-

The bug can be manifested by an extended DUMP command using a system - variable (that is a special variable whose name begins with '$')

- - - - CVE-2015-5957 - ports/202942 - http://lists.roaringpenguin.com/pipermail/remind-fans/2015/003172.html - http://www.openwall.com/lists/oss-security/2015/08/07/1 - - - 2015-07-27 - 2015-09-18 - - - - - shutter -- arbitrary code execution - - - shutter - 0.800.93.1_2 - - - - -

Luke Farone reports:

-
-

In the "Shutter" screenshot application, I discovered that using the - "Show in folder" menu option while viewing a file with a - specially-crafted path allows for arbitrary code execution with the - permissions of the user running Shutter.

-
- - - - http://seclists.org/oss-sec/2015/q3/541 - https://bugs.launchpad.net/shutter/+bug/1495163 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=798862 - CVE-2015-0854 - - - 2015-09-13 - 2015-09-17 - - - - - openjpeg -- use-after-free vulnerability - - - openjpeg - 2.1.1 - - - - -

Feist Josselin reports:

-
-

Use-after-free was found in openjpeg. The vuln is fixed in - version 2.1.1 and was located in opj_j2k_write_mco function.

-
- - - - http://seclists.org/oss-sec/2015/q3/550 - https://github.com/uclouvain/openjpeg/issues/563 - - - 2015-08-14 - 2015-09-17 - - - - - optipng -- use-after-free vulnerability - - - optipng - 0.6.5 - - - - -

Gustavo Grieco reports:

-
-

We found a use-after-free causing an invalid/double free in - optipng 0.6.4.

-
- - - - http://seclists.org/oss-sec/2015/q3/556 - CVE-2015-7801 - - - 2015-09-16 - 2015-09-17 - 2015-10-14 - - - - - openslp -- denial of service vulnerability - - - openslp - 2.0.0 - - - - -

Qinghao Tang reports:

-
-

The function ParseExtension() in openslp 1.2.1 contains - vulnerability: an attacker can cause a denial of service - (infinite loop) via a packet with crafted "nextoffset" - value and "extid" value.

-
- - - - http://seclists.org/oss-sec/2015/q3/559 - CVE-2015-5155 - - - 2015-09-16 - 2015-09-17 - - - - - p7zip -- directory traversal vulnerability - - - p7zip - 9.38.1_2 - - - - -

Alexander Cherepanov reports:

-
-

7z (and 7zr) is susceptible to a directory traversal vulnerability. - While extracting an archive, it will extract symlinks and then follow - them if they are referenced in further entries. This can be exploited by - a rogue archive to write files outside the current directory.

-
- - - - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774660 - http://www.openwall.com/lists/oss-security/2015/01/11/2 - http://sourceforge.net/p/p7zip/bugs/147/ - CVE-2015-1038 - - - 2015-01-05 - 2015-09-16 - - - - - h2o -- directory traversal vulnerability - - - h2o - 1.4.5 - - - - -

Yakuzo reports:

-
-

H2O (up to version 1.4.4 / 1.5.0-beta1) contains a flaw in its URL - normalization logic.

-

When file.dir directive is used, this flaw - allows a remote attacker to retrieve arbitrary files that exist - outside the directory specified by the directive.

-

H2O version 1.4.5 and version 1.5.0-beta2 have been released - to address this vulnerability.

-

Users are advised to upgrade their servers immediately.

-

The vulnerability was reported by: Yusuke OSUMI.

-
- - - - CVE-2015-5638 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5638 - - - 2015-09-14 - 2015-09-16 - - - - - wordpress -- multiple vulnerabilities - - - wordpress - 4.3.1,1 - - - de-wordpress - ja-wordpress - ru-wordpress - zh-wordpress-zh_CN - zh-wordpress-zh_TW - 4.3.1 - - - - -

Samuel Sidler reports:

-
-

WordPress 4.3.1 is now available. This is a security - release for all previous versions and we strongly - encourage you to update your sites immediately.

-
    -
  • WordPress versions 4.3 and earlier are vulnerable - to a cross-site scripting vulnerability when processing - shortcode tags (CVE-2015-5714). Reported by Shahar Tal - and Netanel Rubin of Check Point.
    • -
  • A separate cross-site scripting vulnerability was found - in the user list table. Reported by Ben Bidner of the - WordPress security team.
    • -
  • Finally, in certain cases, users without proper - permissions could publish private posts and make - them sticky (CVE-2015-5715). Reported by Shahar Tal - and Netanel Rubin of Check Point.
    • -
-
- - - - CVE-2015-5714 - CVE-2015-5715 - CVE-2015-7989 - http://www.openwall.com/lists/oss-security/2015/10/28/1 - https://wordpress.org/news/2015/09/wordpress-4-3-1/ - - - 2015-09-15 - 2015-09-15 - 2015-10-29 - - - - - Bugzilla security issues - - - bugzilla44 - 4.4.10 - - - bugzilla50 - 5.0.1 - - - - -

Bugzilla Security Advisory

-
-

Login names (usually an email address) longer than 127 - characters are silently truncated in MySQL which could - cause the domain name of the email address to be - corrupted. An attacker could use this vulnerability to - create an account with an email address different from the - one originally requested. The login name could then be - automatically added to groups based on the group's regular - expression setting.

-
- - - - CVE-2015-4499 - https://bugzilla.mozilla.org/show_bug.cgi?id=1202447 - - - 2015-09-10 - 2015-09-14 - - - - - openldap -- denial of service vulnerability - - - openldap-server - 2.4.42_1 - - - - -

Denis Andzakovic reports:

-
-

By sending a crafted packet, an attacker may cause the - OpenLDAP server to reach an assert(9 9 statement, crashing the daemon.

-
- - - - http://www.openldap.org/its/index.cgi/Software%20Bugs?id=8240 - http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=commit;h=6fe51a9ab04fd28bbc171da3cf12f1c1040d6629 - CVE-2015-6908 - - - 2015-09-09 - 2015-09-12 - 2015-09-13 - - - - - vorbis-tools, opus-tools -- multiple vulnerabilities - - - vorbis-tools - 1.4.0_10,3 - - - opus-tools - 0.1.9_2 - - - - -

Paris Zoumpouloglou reports:

-
-

I discovered an integer overflow issue in oggenc, - related to the number of channels in the input WAV file. - The issue triggers an out-of-bounds memory access which - causes oggenc to crash.

-
-

Paris Zoumpouloglou reports:

-
-

A crafted WAV file with number of channels set to 0 - will cause oggenc to crash due to a division by zero - issue.

-
-

pengsu reports:

-
-

I discovered an buffer overflow issue in oggenc/audio.c - when it tries to open invalid aiff file.

-
- - - - ports/202941 - https://trac.xiph.org/ticket/2136 - CVE-2014-9639 - https://trac.xiph.org/ticket/2137 - CVE-2014-9638 - https://trac.xiph.org/ticket/2212 - CVE-2015-6749 - - - 2015-08-08 - 2015-09-09 - 2015-09-09 - - - - - pgbouncer -- failed auth_query lookup leads to connection as auth_user - - - pgbouncer - 1.6.0 - - - - -

PgBouncer reports:

-
-

New auth_user functionality introduced in 1.6 allows login as - auth_user when client presents unknown username. It's quite likely - auth_user is superuser. Affects only setups that have enabled - auth_user in their config.

-
- - - - CVE-2015-6817 - https://pgbouncer.github.io/2015/09/pgbouncer-1-6-1/ - https://github.com/pgbouncer/pgbouncer/issues/69 - http://www.openwall.com/lists/oss-security/2015/09/04/3 - - - 2015-09-03 - 2015-09-09 - - - - - phpMyAdmin -- reCaptcha bypass - - - phpMyAdmin - 4.4.04.4.14.1 - - - - -

The phpMyAdmin development team reports:

-
-

This vulnerability allows to complete the reCaptcha test - and subsequently perform a brute force attack to guess user - credentials without having to complete further reCaptcha - tests.

- -

We consider this vulnerability to be non critical since - reCaptcha is an additional opt-in security measure.

-
- - - - https://www.phpmyadmin.net/security/PMASA-2015-4/ - CVE-2015-6830 - - - 2015-09-08 - 2015-09-08 - - - - - php -- multiple vulnerabilities - - - php5 - php5-soap - php5-xsl - 5.4.45 - - - php55 - php55-soap - php55-xsl - 5.5.29 - - - php56 - php56-soap - php56-xsl - 5.6.13 - - - - -

PHP reports:

-
-
  • Core: -
      -
    • Fixed bug #70172 (Use After Free Vulnerability in unserialize()).
      • -
    • Fixed bug #70219 (Use after free vulnerability in session deserializer).
      • -
    • -
  • EXIF: -
      -
    • Fixed bug #70385 (Buffer over-read in exif_read_data with TIFF IFD tag byte value of 32 bytes).
      • -
    • -
  • hash: -
      -
    • Fixed bug #70312 (HAVAL gives wrong hashes in specific cases).
      • -
    • -
  • PCRE: -
      -
    • Fixed bug #70345 (Multiple vulnerabilities related to PCRE functions).
      • -
    • -
  • SOAP: -
      -
    • Fixed bug #70388 (SOAP serialize_function_call() type confusion / RCE).
      • -
    • -
  • SPL: -
      -
    • Fixed bug #70365 (Use-after-free vulnerability in unserialize() with SplObjectStorage).
      • -
    • Fixed bug #70366 (Use-after-free vulnerability in unserialize() with SplDoublyLinkedList).
      • -
    • -
  • XSLT: -
      -
    • Fixed bug #69782 (NULL pointer dereference).
      • -
    • -
  • ZIP: -
      -
    • Fixed bug #70350 (ZipArchive::extractTo allows for directory traversal when creating directories).
      • -
    • -
-
- - - - http://php.net/ChangeLog-5.php#5.4.45 - http://php.net/ChangeLog-5.php#5.5.29 - http://php.net/ChangeLog-5.php#5.6.13 - CVE-2015-6834 - CVE-2015-6835 - CVE-2015-6836 - CVE-2015-6837 - CVE-2015-6838 - - - 2015-09-03 - 2015-09-08 - 2015-09-08 - - - - - ganglia-webfrontend -- auth bypass - - - ganglia-webfrontend - 3.7.1 - - - - -

Ivan Novikov reports:

-
-

It's easy to bypass auth by using boolean serialization...

-
- - - - https://github.com/ganglia/ganglia-web/issues/267 - CVE-2015-6816 - - - 2015-09-04 - 2015-09-08 - 2015-09-08 - - - - - wireshark -- multiple vulnerabilities - - - wireshark - wireshark-lite - wireshark-qt5 - tshark - tshark-lite - 1.12.7 - - - - -

Wireshark development team reports:

-
-

The following vulnerabilities have been fixed.

-
    -

  • wnpa-sec-2015-21

    -

    Protocol tree crash. (Bug 11309)

    • -

  • wnpa-sec-2015-22

    -

    Memory manager crash. (Bug 11373)

    • -

  • wnpa-sec-2015-23

    -

    Dissector table crash. (Bug 11381)

    • -

  • wnpa-sec-2015-24

    -

    ZigBee crash. (Bug 11389)

    • -

  • wnpa-sec-2015-25

    -

    GSM RLC/MAC infinite loop. (Bug 11358)

    • -

  • wnpa-sec-2015-26

    -

    WaveAgent crash. (Bug 11358)

    • -

  • wnpa-sec-2015-27

    -

    OpenFlow infinite loop. (Bug 11358)

    • -

  • wnpa-sec-2015-28

    -

    Ptvcursor crash. (Bug 11358)

    • -

  • wnpa-sec-2015-29

    -

    WCCP crash. (Bug 11358)

    • -
-
- - - - https://www.wireshark.org/docs/relnotes/wireshark-1.12.7.html - CVE-2015-6241 - CVE-2015-6242 - CVE-2015-6243 - CVE-2015-6244 - CVE-2015-6245 - CVE-2015-6246 - CVE-2015-6247 - CVE-2015-6248 - CVE-2015-6249 - - - 2015-08-12 - 2015-09-08 - 2015-09-08 - - - - - screen -- stack overflow - - - screen - 4.3.1_2 - - - - -

Kuang-che Wu reports:

-
-

screen will recursively call MScrollV to depth n/256. This - is time consuming and will overflow stack if n is huge.

-
- - - - https://savannah.gnu.org/bugs/?45713 - CVE-2015-6806 - - - 2015-08-07 - 2015-09-08 - - - - - libvncserver -- memory corruption - - - libvncserver - 0.9.8 - - - - -

Petr Pisar reports:

-
-

libvncserver/tight.c:rfbTightCleanup() frees a buffer without zeroing freed pointer.

-
- - - - https://bugzilla.redhat.com/show_bug.cgi?id=706087 - https://github.com/LibVNC/libvncserver/commit/804335f9d296440bb708ca844f5d89b58b50b0c6 - - - 2011-05-19 - 2015-09-08 - - - - - gdk-pixbuf2 -- integer overflows - - - gdk-pixbuf2 - 2.31.7 - - - - -

Matthias Clasen reports:

-
-

Fix several integer overflows.

-
- - - - https://mail.gnome.org/archives/ftp-release-list/2015-September/msg00013.html - - - 2015-09-01 - 2015-09-04 - - - - - bind -- denial of service vulnerability - - - bind99 - 9.9.79.9.7P3 - - - bind910 - 9.10.2P4 - - - bind910-base - bind99-base - 0 - - - - -

ISC reports:

-
-

An incorrect boundary check in openpgpkey_61.c can cause - named to terminate due to a REQUIRE assertion failure. This defect can - be deliberately exploited by an attacker who can provide a maliciously - constructed response in answer to a query.

-
- - - - https://www.isc.org/blogs/cve-2015-5986-an-incorrect-boundary-check-can-trigger-a-require-assertion-failure-in-openpgpkey_61-c/ - CVE-2015-5986 - - - 2015-08-19 - 2015-09-03 - - - - - bind -- denial of service vulnerability - - - bind99 - 9.9.7P3 - - - bind910 - 9.10.29.10.2P4 - - - bind910-base - bind99-base - 0 - - - FreeBSD - 9.39.3_25 - - - - -

ISC reports:

-
-

Parsing a malformed DNSSEC key can cause a validating - resolver to exit due to a failed assertion in buffer.c. It is possible - for a remote attacker to deliberately trigger this condition, for - example by using a query which requires a response from a zone - containing a deliberately malformed key.

-
- - - - https://www.isc.org/blogs/cve-2015-5722-parsing-malformed-keys-may-cause-bind-to-exit-due-to-a-failed-assertion-in-buffer-c/ - CVE-2015-5722 - SA-15:23.bind - - - 2015-08-19 - 2015-09-03 - 2016-08-09 - - - - - chromium -- multiple vulnerabilities - - - chromium - 45.0.2454.85 - - - - chromium-npapi - 45.0.2454.85 - - - - chromium-pulse - 45.0.2454.85 - - - - -

Google Chrome Releases reports:

-
-

29 security fixes in this release, including:

-
    -
  • [516377] High CVE-2015-1291: Cross-origin bypass in DOM. Credit - to anonymous.
    • -
  • [522791] High CVE-2015-1292: Cross-origin bypass in - ServiceWorker. Credit to Mariusz Mlynski.
    • -
  • [524074] High CVE-2015-1293: Cross-origin bypass in DOM. Credit - to Mariusz Mlynski.
    • -
  • [492263] High CVE-2015-1294: Use-after-free in Skia. Credit - to cloudfuzzer.
    • -
  • [502562] High CVE-2015-1295: Use-after-free in Printing. Credit - to anonymous.
    • -
  • [421332] High CVE-2015-1296: Character spoofing in omnibox. - Credit to zcorpan.
    • -
  • [510802] Medium CVE-2015-1297: Permission scoping error in - Webrequest. Credit to Alexander Kashev.
    • -
  • [518827] Medium CVE-2015-1298: URL validation error in - extensions. Credit to Rob Wu.
    • -
  • [416362] Medium CVE-2015-1299: Use-after-free in Blink. Credit - to taro.suzuki.dev.
    • -
  • [511616] Medium CVE-2015-1300: Information leak in Blink. Credit - to cgvwzq.
    • -
  • [526825] CVE-2015-1301: Various fixes from internal audits, - fuzzing and other initiatives.
    • -
-
- - - - CVE-2015-1291 - CVE-2015-1292 - CVE-2015-1293 - CVE-2015-1294 - CVE-2015-1295 - CVE-2015-1296 - CVE-2015-1297 - CVE-2015-1298 - CVE-2015-1299 - CVE-2015-1300 - CVE-2015-1301 - http://googlechromereleases.blogspot.nl - - - 2015-09-01 - 2015-09-02 - - - - - powerdns -- denial of service - - - powerdns - 3.4.03.4.6 - - - - -

PowerDNS reports:

-
-

A bug was found in our DNS packet parsing/generation code, - which, when exploited, can cause individual threads (disabling service) - or whole processes (allowing a supervisor to restart them) to crash with - just one or a few query packets.

-
- - - - https://doc.powerdns.com/md/security/powerdns-advisory-2015-02/ - CVE-2015-5230 - - - 2015-09-02 - 2015-09-02 - - - - - ghostscript -- denial of service (crash) via crafted Postscript files - - - ghostscript7 - ghostscript7-nox11 - ghostscript7-base - ghostscript7-x11 - 7.07_32 - - - ghostscript8 - ghostscript8-nox11 - ghostscript8-base - ghostscript8-x11 - 8.71_19 - - - ghostscript9 - ghostscript9-nox11 - ghostscript9-base - ghostscript9-x11 - 9.06_11 - - - ghostscript9-agpl - ghostscript9-agpl-nox11 - 9.15_2 - - - ghostscript9-agpl-base - ghostscript9-agpl-x11 - 9.16_2 - - - - -

MITRE reports:

-
-

Integer overflow in the gs_heap_alloc_bytes function in - base/gsmalloc.c in Ghostscript 9.15 and earlier allows remote - attackers to cause a denial of service (crash) via a crafted - Postscript (ps) file, as demonstrated by using the ps2pdf command, - which triggers an out-of-bounds read or write.

-
- - - - CVE-2015-3228 - http://bugs.ghostscript.com/show_bug.cgi?id=696041 - http://bugs.ghostscript.com/show_bug.cgi?id=696070 - http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=0c0b0859 - - - 2015-06-17 - 2015-09-01 - 2015-09-02 - - - - - ffmpeg -- out-of-bounds array access - - - libav - 11.011.4 - 10.7 - - - gstreamer1-libav - - 1.5.1 - - - handbrake - - - 1.2.0 - - - ffmpeg - 2.2.0,12.2.15,1 - 2.0.7,1 - - - ffmpeg26 - 2.6.2 - - - ffmpeg25 - 2.5.6 - - - ffmpeg24 - 2.4.8 - - - ffmpeg23 - - - 0 - - - ffmpeg1 - - - 0 - - - avidemux - avidemux26 - - 2.6.11 - - - kodi - - 15.1 - - - mplayer - mencoder - - 1.1.r20150403 - - - mythtv - mythtv-frontend - - 0.27.5,1 - - - - -

NVD reports:

-
-

The msrle_decode_pal4 function in msrledec.c in Libav - before 10.7 and 11.x before 11.4 and FFmpeg before 2.0.7, - 2.2.x before 2.2.15, 2.4.x before 2.4.8, 2.5.x before 2.5.6, - and 2.6.x before 2.6.2 allows remote attackers to have - unspecified impact via a crafted image, related to a pixel - pointer, which triggers an out-of-bounds array access.

-
- - - - CVE-2015-3395 - https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=f7e1367f58263593e6cee3c282f7277d7ee9d553 - https://git.libav.org/?p=libav.git;a=commit;h=5ecabd3c54b7c802522dc338838c9a4c2dc42948 - https://ffmpeg.org/security.html - https://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v11.4 - - - 2015-04-12 - 2015-09-01 - 2018-03-25 - - - - - ffmpeg -- use-after-free - - - libav - 11.011.4 - 10.7 - - - gstreamer1-libav - - 1.5.0 - - - handbrake - - - 1.2.0 - - - ffmpeg - 2.2.0,12.2.12,1 - 2.1.0,12.1.7,1 - 2.0.7,1 - - - ffmpeg25 - 2.5.2 - - - ffmpeg24 - 2.4.5 - - - ffmpeg23 - 2.3.6 - - - ffmpeg1 - 1.2.11 - - - mythtv - mythtv-frontend - - 0.27.5,1 - - - - -

NVD reports:

-
-

Use-after-free vulnerability in the ff_h264_free_tables - function in libavcodec/h264.c in FFmpeg before 2.3.6 allows - remote attackers to cause a denial of service or possibly - have unspecified other impact via crafted H.264 data in an - MP4 file, as demonstrated by an HTML VIDEO element that - references H.264 data.

-
- - - - CVE-2015-3417 - - https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=e8714f6f93d1a32f4e4655209960afcf4c185214 - https://git.libav.org/?p=libav.git;a=commitdiff;h=3b69f245dbe6e2016659a45c4bfe284f6c5ac57e - https://ffmpeg.org/security.html - https://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v11.4 - - - 2014-12-19 - 2015-09-01 - 2018-03-25 - - - - - graphviz -- format string vulnerability - - - graphviz - 2.38.0_7 - - - - -

Joshua Rogers reports:

-
-

A format string vulnerability has been found in `graphviz'.

-
- - - - http://seclists.org/oss-sec/2014/q4/784 - https://github.com/ellson/graphviz/commit/99eda421f7ddc27b14e4ac1d2126e5fe41719081 - - - 2014-11-24 - 2015-08-29 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 40.0.3,1 - - - linux-firefox - 40.0.3,1 - - - firefox-esr - 38.2.1,1 - - - - -

The Mozilla Project reports:

-
-

MFSA 2015-95 Add-on notification bypass through data URLs

-

MFSA 2015-94 Use-after-free when resizing canvas element - during restyling

-
- - - - CVE-2015-4497 - CVE-2015-4498 - https://www.mozilla.org/security/advisories/mfsa2015-94/ - https://www.mozilla.org/security/advisories/mfsa2015-95/ - - - 2015-08-27 - 2015-08-28 - - - - - go -- multiple vulnerabilities - - - go - 1.4.3,1 - - - go14 - 1.4.3 - - - - -

Jason Buberel, Go Product Manager, reports:

-
-

CVE-2015-5739 - "Content Length" treated as valid header

-

CVE-2015-5740 - Double content-length headers does not return 400 - error

-

CVE-2015-5741 - Additional hardening, not sending Content-Length - w/Transfer-Encoding, Closing connections

-
- - - - CVE-2015-5739 - CVE-2015-5740 - CVE-2015-5741 - https://github.com/golang/go/commit/117ddcb83d7f42d6aa72241240af99ded81118e9 - https://github.com/golang/go/commit/143822585e32449860e624cace9d2e521deee62e - https://github.com/golang/go/commit/300d9a21583e7cf0149a778a0611e76ff7c6680f - http://seclists.org/oss-sec/2015/q3/237 - - - 2015-07-29 - 2015-08-25 - - - - - libtremor -- memory corruption - - - libtremor - 1.2.0.s20120120 - - - - -

The Mozilla Project reports:

-
-

Security researcher regenrecht reported via - TippingPoint's Zero Day Initiative the possibility of memory - corruption during the decoding of Ogg Vorbis files. This can - cause a crash during decoding and has the potential for - remote code execution.

-
- - - - CVE-2012-0444 - https://bugzilla.mozilla.org/show_bug.cgi?id=719612 - https://git.xiph.org/?p=tremor.git;a=commitdiff;h=3daa274 - - - 2012-01-31 - 2015-08-25 - 2015-08-25 - - - - - libtremor -- multiple vulnerabilities - - - libtremor - 1.2.0.s20101013 - - - - -

The RedHat Project reports:

-
-

Will Drewry of the Google Security Team reported multiple - issues in OGG Vorbis and Tremor libraries, that could cause - application using those libraries to crash (NULL pointer - dereference or divide by zero), enter an infinite loop or - cause heap overflow caused by integer overflow.

-
- - - - CVE-2008-1418 - CVE-2008-1419 - CVE-2008-1420 - CVE-2008-1423 - CVE-2008-2009 - http://redpig.dataspill.org/2008/05/multiple-vulnerabilities-in-ogg-tremor.html - https://git.xiph.org/?p=tremor.git;a=commitdiff;h=7e94eea - https://git.xiph.org/?p=tremor.git;a=commitdiff;h=1d1f93e - https://git.xiph.org/?p=tremor.git;a=commitdiff;h=159efc4 - - - 2008-03-19 - 2015-08-25 - 2015-08-25 - - - - - pcre -- heap overflow vulnerability - - - pcre - 8.37_4 - - - - -

Guanxing Wen reports:

-
-

PCRE library is prone to a vulnerability which leads to - Heap Overflow. - During the compilation of a malformed regular expression, more data is - written on the malloced block than the expected size output by - compile_regex(). - The Heap Overflow vulnerability is caused by the following regular - expression.

-

/(?J:(?|(:(?|(?'R')(\z(?|(?'R')(\k'R')|((?'R')))k'R')|((?'R')))H'Ak'Rf)|s(?'R')))/

-

A dry run of this particular regular expression with pcretest will - reports "double free or corruption (!prev)". - But it is actually a heap overflow problem. - The overflow only affects pcre 8.x branch, pcre2 branch is not affected.

-
- - - - http://seclists.org/oss-sec/2015/q3/295 - https://bugs.exim.org/show_bug.cgi?id=1672 - - - 2015-08-21 - 2015-08-24 - - - - - drupal -- multiple vulnerabilities - - - drupal6 - 6.37 - - - drupal7 - 7.39 - - - - -

Drupal development team reports:

-
-

This security advisory fixes multiple vulnerabilities. - See below for a list.

-

Cross-site Scripting - Ajax system - Drupal 7

-

A vulnerability was found that allows a malicious - user to perform a cross-site scripting attack by - invoking Drupal.ajax() on a whitelisted HTML element.

-

This vulnerability is mitigated on sites that do not - allow untrusted users to enter HTML.

-

Cross-site Scripting - Autocomplete system - Drupal 6 and 7

-

A cross-site scripting vulnerability was found in - the autocomplete functionality of forms. The - requested URL is not sufficiently sanitized.

-

This vulnerability is mitigated by the fact that - the malicious user must be allowed to upload files.

-

SQL Injection - Database API - Drupal 7

-

A vulnerability was found in the SQL comment - filtering system which could allow a user with - elevated permissions to inject malicious code in - SQL comments.

-

This vulnerability is mitigated by the fact that - only one contributed module that the security team - found uses the comment filtering system in a way - that would trigger the vulnerability. That module - requires you to have a very high level of access - in order to perform the attack.

-

Cross-site Request Forgery - Form API - Drupal 6 and 7

-

A vulnerability was discovered in Drupal's form API - that could allow file upload value callbacks to run - with untrusted input, due to form token validation - not being performed early enough. This vulnerability - could allow a malicious user to upload files to the - site under another user's account.

-

This vulnerability is mitigated by the fact that - the uploaded files would be temporary, and Drupal - normally deletes temporary files automatically - after 6 hours.

-

Information Disclosure in Menu Links - Access system - Drupal 6 and 7

-

Users without the "access content" permission - can see the titles of nodes that they do not have - access to, if the nodes are added to a menu on the - site that the users have access to.

-
- - - - https://www.drupal.org/SA-CORE-2015-003 - - - 2015-08-19 - 2015-08-22 - - - - - OpenSSH -- PAM vulnerabilities - - - openssh-portable - 7.0.p1,1 - - - FreeBSD - 10.210.2_2 - 10.110.1_19 - 9.39.3_24 - - - - -
-

OpenSSH 6.8 and 6.9 incorrectly set TTYs to be world-writable. - Local attackers may be able to write arbitrary messages to - logged-in users, including terminal escape sequences. Reported - by Nikolay Edigaryev.

-

Fixed a privilege separation - weakness related to PAM support. Attackers who could successfully - compromise the pre-authentication process for remote code - execution and who had valid credentials on the host could - impersonate other users.

-

Fixed a use-after-free bug - related to PAM support that was reachable by attackers who could - compromise the pre-authentication process for remote code - execution.

-
- - - - http://www.openssh.com/txt/release-7.0 - CVE-2015-6563 - CVE-2015-6564 - CVE-2015-6565 - SA-15:22.openssh - - - 2015-08-11 - 2015-08-21 - 2016-08-09 - - - - - OpenSSH -- PermitRootLogin may allow password connections with 'without-password' - - - openssh-portable - 7.0.p1,1 - - - - -
-

OpenSSH 7.0 contained a logic error in PermitRootLogin= - prohibit-password/without-password that could, depending on - compile-time configuration, permit password authentication to - root while preventing other forms of authentication. This problem - was reported by Mantas Mikulenas. -

-
- - - - http://www.openssh.com/txt/release-7.1 - - - 2015-08-20 - 2015-08-21 - - - - - tarsnap -- buffer overflow and local DoS - - - tarsnap - 1.0.36 - - - - -

Colin Percival reports:

-
-

1. SECURITY FIX: When constructing paths of objects being archived, a buffer - could overflow by one byte upon encountering 1024, 2048, 4096, etc. byte - paths. Theoretically this could be exploited by an unprivileged user whose - files are being archived; I do not believe it is exploitable in practice, - but I am offering a $1000 bounty for the first person who can prove me wrong: - http://www.daemonology.net/blog/2015-08-21-tarsnap-1000-exploit-bounty.html

-

2. SECURITY FIX: An attacker with a machine's write keys, or with read keys - and control of the tarsnap service, could make tarsnap allocate a large - amount of memory upon listing archives or reading an archive the attacker - created; on 32-bit machines, tarsnap can be caused to crash under the - aforementioned conditions.

-
- - - - http://mail.tarsnap.com/tarsnap-announce/msg00032.html - http://www.daemonology.net/blog/2015-08-21-tarsnap-1000-exploit-bounty.html - - - 2015-08-21 - 2015-08-21 - - - - - vlc -- arbitrary pointer dereference vulnerability - - - vlc - 2.2.1_5,4 - - - - -

oCERT reports:

-
-

The stable VLC version suffers from an arbitrary pointer - dereference vulnerability.

-

The vulnerability affects the 3GP file format parser, - insufficient restrictions on a writable buffer can be - exploited to execute arbitrary code via the heap memory. - A specific 3GP file can be crafted to trigger the - vulnerability.

-

Credit: vulnerability reported by Loren Maggiore of - Trail of Bits.

-
- - - - CVE-2015-5949 - https://git.videolan.org/?p=vlc/vlc-2.2.git;a=commitdiff;h=ce91452460a75d7424b165c4dc8db98114c3cbd9;hp=9e12195d3e4316278af1fa4bcb6a705ff27456fd - https://www.ocert.org/advisories/ocert-2015-009.html - - - 2015-08-20 - 2015-08-20 - - - - - libpgf -- use-after-free - - - libpgf - 6.14.12 - - - - -

Pengsu Cheng reports:

-
-

An use-after-free issue in Decoder.cpp was reported to - upstream. The problem is due to lack of validation of ColorTableSize.

-
- - - - http://seclists.org/oss-sec/2015/q3/404 - https://sourceforge.net/p/libpgf/code/147/ - https://sourceforge.net/p/libpgf/code/148/ - CVE-2015-6673 - - - 2015-08-08 - 2015-08-20 - 2015-08-26 - - - - - gdk-pixbuf2 -- heap overflow and DoS - - - gdk-pixbuf2 - 2.31.6 - - - - -

Gustavo Grieco reports:

-
-

We found a heap overflow and a DoS in the gdk-pixbuf - implementation triggered by the scaling of a malformed bmp.

-
- - - - CVE-2015-4491 - https://bugzilla.gnome.org/show_bug.cgi?id=752297 - - - 2015-07-12 - 2015-08-19 - - - - - django -- multiple vulnerabilities - - - py27-django - py32-django - py33-django - py34-django - 1.8.4 - - - py27-django17 - py32-django17 - py33-django17 - py34-django17 - 1.7.10 - - - py27-django14 - py32-django14 - py33-django14 - py34-django14 - 1.4.22 - - - py27-django-devel - py32-django-devel - py33-django-devel - py34-django-devel - 20150709,1 - - - - -

Tim Graham reports:

-
-

Denial-of-service possibility in logout() view by filling - session store

-

Previously, a session could be created when anonymously - accessing the django.contrib.auth.views.logout view - (provided it wasn't decorated with django.contrib.auth.decorators.login_required - as done in the admin). This could allow an attacker to - easily create many new session records by sending repeated - requests, potentially filling up the session store or - causing other users' session records to be evicted.

-

The django.contrib.sessions.middleware.SessionMiddleware - has been modified to no longer create empty session records.

-

This portion of the fix has been assigned CVE-2015-5963.

-

Additionally, on the 1.4 and 1.7 series only, the - contrib.sessions.backends.base.SessionBase.flush() and - cache_db.SessionStore.flush() methods have been modified - to avoid creating a new empty session. Maintainers of - third-party session backends should check if the same - vulnerability is present in their backend and correct - it if so.

-

This portion of the fix has been assigned CVE-2015-5964. - Anyone reporting a similar vulnerability in a third-party - session backend should not use this CVE ID.

-

Thanks Lin Hua Cheng for reporting the issue.

-
- - - - https://www.djangoproject.com/weblog/2015/aug/18/security-releases/ - CVE-2015-5963 - CVE-2015-5964 - - - 2015-08-18 - 2015-08-18 - - - - - unreal -- denial of service - - - Unreal - 3.2.103.2.10.5 - - - - -

Unreal reports:

-
-

Summary: If SASL support is enabled in UnrealIRCd (this is - not the default) and is also enabled in your services - package then a malicious user with a services account can cause - UnrealIRCd to crash.

-
- - - - https://www.unrealircd.org/txt/unrealsecadvisory.20150816.txt - http://seclists.org/oss-sec/2015/q3/367 - - - 2015-08-13 - 2015-08-18 - - - - - jasper -- multiple vulnerabilities - - - jasper - 1.900.1_16 - - - - -

Martin Prpic reports:

-
-

A double free flaw was found in the way JasPer's - jasper_image_stop_load() function parsed certain JPEG 2000 image files. - A specially crafted file could cause an application using JasPer to - crash.

-
-

Feist Josselin reports:

-
-

A new use-after-free was found in Jasper JPEG-200. The - use-after-free appears in the function mif_process_cmpt of the - src/libjasper/mif/mif_cod.c file.

-
- - - - https://bugzilla.redhat.com/show_bug.cgi?id=1254242#c0 - http://seclists.org/oss-sec/2015/q3/366 - http://seclists.org/oss-sec/2015/q3/408 - CVE-2015-5203 - CVE-2015-5221 - - - 2015-08-17 - 2015-08-18 - 2016-02-24 - - - - - freexl -- integer overflow - - - freexl - 1.0.2 - - - - -

Stefan Cornelius reports:

-
-

There's an integer overflow in the allocate_cells() function - when trying to allocate the memory for worksheet with specially - crafted row/column dimensions. This can be exploited to cause a - heap memory corruption. The most likely outcome of this is a crash - when trying to initialize the cells later in the function.

-
- - - - http://www.openwall.com/lists/oss-security/2015/07/06/7 - - - 2015-07-06 - 2015-08-18 - - - - - freexl -- multiple vulnerabilities - - - freexl - 1.0.1 - - - - -

Jodie Cunningham reports:

-
-

#1: A flaw was found in the way FreeXL reads sectors from - the input file. A specially crafted file could possibly - result in stack corruption near freexl.c:3752.

-

#2: A flaw was found in the function allocate_cells(). A - specially crafted file with invalid workbook dimensions - could possibly result in stack corruption near freexl.c:1074

-

#3: A flaw was found in the way FreeXL handles a premature EOF. A - specially crafted input file could possibly result in stack corruption - near freexl.c:1131

-

#4: FreeXL 1.0.0g did not properly check requests for workbook memory - allocation. A specially crafted input file could cause a Denial of - Service, or possibly write onto the stack.

-
- - - - http://www.openwall.com/lists/oss-security/2015/03/25/1 - CVE-2015-2776 - - - 2015-03-24 - 2015-08-18 - - - - - mod_jk -- information disclosure - - - ap22-mod_jk - ap24-mod_jk - 1.2.41,1 - - - - -

NIST reports:

-
-

Apache Tomcat Connectors (mod_jk) before 1.2.41 ignores - JkUnmount rules for subtrees of previous JkMount rules, which allows - remote attackers to access otherwise restricted artifacts via - unspecified vectors.

-
- - - - https://www.mail-archive.com/users@tomcat.apache.org/msg118949.html - http://readlist.com/lists/tomcat.apache.org/users/27/135512.html - http://www.cvedetails.com/cve/CVE-2014-8111/ - CVE-2014-8111 - - - 2015-01-15 - 2015-08-17 - - - - - qemu, xen-tools -- QEMU leak of uninitialized heap memory in rtl8139 device model - - - qemu - qemu-devel - 0.11.1_20 - 0.122.3.0_2 - - - qemu-sbruno - qemu-user-static - 2.4.50.g20150814 - - - xen-tools - 4.5.1 - - - - -

The Xen Project reports:

-
-

The QEMU model of the RTL8139 network card did not sufficiently - validate inputs in the C+ mode offload emulation. This results in - uninitialized memory from the QEMU process's heap being leaked to - the domain as well as to the network.

-

A guest may be able to read sensitive host-level data relating to - itself which resides in the QEMU process.

-

Such information may include things such as information relating to - real devices backing emulated devices or passwords which the host - administrator does not intend to share with the guest admin.

-
- - - - CVE-2015-5165 - http://xenbits.xen.org/xsa/advisory-140.html - http://git.qemu.org/?p=qemu.git;a=commit;h=2a3612ccc1fa9cea77bd193afbfe21c77e7e91ef - - - 2015-08-03 - 2015-08-17 - 2015-08-19 - - - - - qemu, xen-tools -- use-after-free in QEMU/Xen block unplug protocol - - - qemu - qemu-devel - 0.11.1_20 - 0.122.3.0_2 - - - qemu-sbruno - qemu-user-static - 2.4.50.g20150814 - - - xen-tools - 4.5.1 - - - - -

The Xen Project reports:

-
-

When unplugging an emulated block device the device was not fully - unplugged, meaning a second unplug attempt would attempt to unplug - the device a second time using a previously freed pointer.

-

An HVM guest which has access to an emulated IDE disk device may be - able to exploit this vulnerability in order to take over the qemu - process elevating its privilege to that of the qemu process.

-
- - - - CVE-2015-5166 - http://xenbits.xen.org/xsa/advisory-139.html - http://git.qemu.org/?p=qemu.git;a=commit;h=260425ab405ea76c44dd59744d05176d4f579a52 - - - 2015-08-03 - 2015-08-17 - 2015-08-19 - - - - - php5 -- multiple vulnerabilities - - - php5 - php5-openssl - php5-phar - php5-soap - 5.4.44 - - - php55 - php55-openssl - php55-phar - php55-soap - 5.5.28 - - - php56 - php56-openssl - php56-phar - php56-soap - 5.6.12 - - - - -

The PHP project reports:

-
-

Core:

-
    -
  • Fixed bug #69793 (Remotely triggerable stack exhaustion via - recursive method calls).
    • -
  • Fixed bug #70121 (unserialize() could lead to unexpected methods - execution / NULL pointer deref).
    • -
-

OpenSSL:

-
    -
  • Fixed bug #70014 (openssl_random_pseudo_bytes() is not - cryptographically secure).
    • -
-

Phar:

-
    -
  • Improved fix for bug #69441.
    • -
  • Fixed bug #70019 (Files extracted from archive may be placed - outside of destination directory).
    • -
-

SOAP:

-
    -
  • Fixed bug #70081 (SoapClient info leak / null pointer - dereference via multiple type confusions).
    • -
-

SPL:

-
    -
  • Fixed bug #70068 (Dangling pointer in the unserialization of - ArrayObject items).
    • -
  • Fixed bug #70166 (Use After Free Vulnerability in unserialize() - with SPLArrayObject).
    • -
  • Fixed bug #70168 (Use After Free Vulnerability in unserialize() - with SplObjectStorage).
    • -
  • Fixed bug #70169 (Use After Free Vulnerability in unserialize() - with SplDoublyLinkedList).
    • -
-
- - - - http://php.net/ChangeLog-5.php#5.4.44 - http://php.net/ChangeLog-5.php#5.5.28 - http://php.net/ChangeLog-5.php#5.6.12 - CVE-2015-6831 - CVE-2015-6832 - CVE-2015-6833 - - - 2015-08-06 - 2015-08-17 - 2015-09-08 - - - - - mediawiki -- multiple vulnerabilities - - - mediawiki123 - 1.23.10 - - - mediawiki124 - 1.24.3 - - - mediawiki125 - 1.25.2 - - - - -

MediaWiki reports:

-
-

Internal review discovered that Special:DeletedContributions did - not properly protect the IP of autoblocked users. This fix makes - the functionality of Special:DeletedContributions consistent with - Special:Contributions and Special:BlockList.

-

Internal review discovered that watchlist anti-csrf tokens were not - being compared in constant time, which could allow various timing - attacks. This could allow an attacker to modify a user's watchlist - via csrf

-

John Menerick reported that MediaWiki's thumb.php failed to sanitize - various error messages, resulting in xss.

-
- - - - CVE-2015-6727 - CVE-2013-7444 - CVE-2015-6728 - CVE-2015-6729 - CVE-2015-6730 - CVE-2015-6731 - CVE-2015-6733 - CVE-2015-6734 - CVE-2015-6735 - CVE-2015-6736 - CVE-2015-6737 - https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-August/000179.html - https://phabricator.wikimedia.org/T106893 - https://phabricator.wikimedia.org/T94116 - https://phabricator.wikimedia.org/T97391 - http://www.openwall.com/lists/oss-security/2015/08/27/6 - - - 2015-08-10 - 2015-08-14 - 2015-12-24 - - - - - freeradius3 -- insufficient validation on packets - - - freeradius3 - 3.0.8 - - - - -

Jouni Malinen reports:

-
-

The EAP-PWD module performed insufficient validation on - packets received from an EAP peer. This module is not enabled in the - default configuration. Administrators must manually enable it for their - server to be vulnerable. Only versions 3.0 up to 3.0.8 are affected.

-
- - - - http://freeradius.org/security.html#eap-pwd-2015 - - - 2015-04-04 - 2015-08-14 - - - - - gnutls -- double free in certificate DN decoding - - - gnutls - 3.3.17 - - - - -

gnutls.org reports:

-
-

Kurt Roeckx reported that decoding a specific certificate with very - long DistinguishedName (DN) entries leads to double free, which may - result to a denial of service. Since the DN decoding occurs in almost - all applications using certificates it is recommended to upgrade the - latest GnuTLS version fixing the issue. Recommendation: Upgrade to - GnuTLS 3.4.4, or 3.3.17.

-
- - - - http://www.gnutls.org/security.html#GNUTLS-SA-2015-3 - http://seclists.org/oss-sec/2015/q3/308 - https://gitlab.com/gnutls/gnutls/commit/272854367efc130fbd4f1a51840d80c630214e12 - CVE-2015-6251 - - - 2015-07-20 - 2015-08-14 - 2015-08-18 - - - - - gnutls -- MD5 downgrade in TLS signatures - - - gnutls - 3.3.15 - - - - -

Karthikeyan Bhargavan reports:

-
-

GnuTLS does not by default support MD5 signatures. Indeed the RSA-MD5 - signature-hash algorithm needs to be explicitly enabled using the - priority option VERIFY_ALLOW_SIGN_RSA_MD5. In the NORMAL and SECURE - profiles, GnuTLS clients do not offer RSA-MD5 in the signature - algorithms extension. However, we find that all GnuTLS clients still - accept RSA-MD5 in the ServerKeyExchange and GnuTLS servers still - accept RSA-MD5 in the ClientCertificateVerify.

-
- - - - http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/8132 - http://www.gnutls.org/security.html#GNUTLS-SA-2015-2 - http://seclists.org/oss-sec/2015/q2/367 - - - 2015-04-25 - 2015-08-14 - - - - - froxlor -- database password information leak - - - froxlor - 0.9.33.2 - - - - -

oss-security-list@demlak.de reports:

-
-

An unauthenticated remote attacker is able to get the database - password via webaccess due to wrong file permissions of the /logs/ - folder in froxlor version 0.9.33.1 and earlier. The plain SQL - password and username may be stored in the /logs/sql-error.log file. - This directory is publicly reachable under the default - configuration/setup.

-
-

Note that froxlor 0.9.33.2 prevents future logging of passwords but - does not retroactively remove passwords already logged. Michael - Kaufmann, the Froxlor lead developer reports:

-
-

Removing all .log files from the directory should do the job, - alternatively just use the class.ConfigIO.php from Github

-
- - - - CVE-2015-5959 - ports/202262 - http://seclists.org/oss-sec/2015/q3/238 - https://forum.froxlor.org/index.php/topic/13054-important-bugfix-release-09332/ - - - 2015-07-29 - 2015-08-13 - - - - - RT -- two XSS vulnerabilities - - - rt42 - 4.2.04.2.12 - - - rt40 - 4.0.04.0.24 - - - - -

Best Practical reports:

-
-

RT 4.0.0 and above are vulnerable to a cross-site - scripting (XSS) attack via the user and group rights - management pages. This vulnerability is assigned - CVE-2015-5475. It was discovered and reported by Marcin - Kopec at Data Reliance Shared Service Center.

-

RT 4.2.0 and above are vulnerable to a cross-site - scripting (XSS) attack via the cryptography interface. - This vulnerability could allow an attacker with a - carefully-crafted key to inject JavaScript into RT's user - interface. Installations which use neither GnuPG nor - S/MIME are unaffected.

-
- - - - CVE-2015-5475 - CVE-2015-6506 - http://blog.bestpractical.com/2015/08/security-vulnerabilities-in-rt.html - - - 2015-08-12 - 2015-08-12 - 2015-08-18 - - - - - py-foolscap -- local file inclusion - - - py27-foolscap - py32-foolscap - py33-foolscap - py34-foolscap - 0.7.0 - - - - -

Brian Warner reports:

-
-

The "flappserver" feature was found to have a vulnerability in the - service-lookup code which, when combined with an attacker who has the ability - to write files to a location where the flappserver process could read them, - would allow that attacker to obtain control of the flappserver process.

-
- - - - https://github.com/warner/foolscap/blob/a17218e18e01c05a9655863cd507b80561692c14/NEWS - http://foolscap.lothar.com/trac/ticket/226 - - - 2014-09-23 - 2015-08-12 - - - - - libvpx -- out-of-bounds write - - - libvpx - 1.4.0 - - - firefox - 33.0,1 - - - firefox-esr - 31.1.2,1 - - - linux-firefox - 33.0,1 - - - linux-seamonkey - 2.30 - - - linux-thunderbird - 31.1.2 - - - seamonkey - 2.30 - - - thunderbird - 31.1.2 - - - libxul - 31.1.2 - - - - -

The Mozilla Project reports:

-
-

Using the Address Sanitizer tool, security researcher - Abhishek Arya (Inferno) of the Google Chrome Security Team - found an out-of-bounds write when buffering WebM format - video containing frames with invalid tile sizes. This can - lead to a potentially exploitable crash during WebM video - playback.

-
- - - - CVE-2014-1578 - https://www.mozilla.org/security/advisories/mfsa2014-77/ - https://hg.mozilla.org/releases/mozilla-esr31/rev/6023f0b4f8ba - - - 2014-10-14 - 2015-08-12 - - - - - Adobe Flash Player -- critical vulnerabilities - - - linux-c6-flashplugin - linux-c6_64-flashplugin - 11.2r202.508 - - - linux-f10-flashplugin - 11.2r202.508 - - - - -

Adobe reports:

-
-

Adobe has released security updates for Adobe Flash Player. - These updates address critical vulnerabilities that could - potentially allow an attacker to take control of the affected - system.

-

These updates resolve type confusion vulnerabilities that could - lead to code execution (CVE-2015-5128, CVE-2015-5554, - CVE-2015-5555, CVE-2015-5558, CVE-2015-5562).

-

These updates include further hardening to a mitigation - introduced in version 18.0.0.209 to defend against vector - length corruptions (CVE-2015-5125).

-

These updates resolve use-after-free vulnerabilities that could - lead to code execution (CVE-2015-5550, CVE-2015-5551, - CVE-2015-3107, CVE-2015-5556, CVE-2015-5130, CVE-2015-5134, - CVE-2015-5539, CVE-2015-5540, CVE-2015-5557, CVE-2015-5559, - CVE-2015-5127, CVE-2015-5563, CVE-2015-5561, CVE-2015-5124, - CVE-2015-5564).

-

These updates resolve heap buffer overflow vulnerabilities - that could lead to code execution (CVE-2015-5129, - CVE-2015-5541).

-

These updates resolve buffer overflow vulnerabilities that - could lead to code execution (CVE-2015-5131, CVE-2015-5132, - CVE-2015-5133).

-

These updates resolve memory corruption vulnerabilities that - could lead to code execution (CVE-2015-5544, CVE-2015-5545, - CVE-2015-5546, CVE-2015-5547, CVE-2015-5548, CVE-2015-5549, - CVE-2015-5552, CVE-2015-5553).

-

These updates resolve an integer overflow vulnerability that - could lead to code execution (CVE-2015-5560).

-
- - - - CVE-2015-3107 - CVE-2015-5124 - CVE-2015-5125 - CVE-2015-5127 - CVE-2015-5128 - CVE-2015-5129 - CVE-2015-5130 - CVE-2015-5131 - CVE-2015-5132 - CVE-2015-5133 - CVE-2015-5134 - CVE-2015-5539 - CVE-2015-5540 - CVE-2015-5541 - CVE-2015-5544 - CVE-2015-5545 - CVE-2015-5546 - CVE-2015-5547 - CVE-2015-5548 - CVE-2015-5549 - CVE-2015-5550 - CVE-2015-5551 - CVE-2015-5552 - CVE-2015-5553 - CVE-2015-5554 - CVE-2015-5555 - CVE-2015-5556 - CVE-2015-5557 - CVE-2015-5558 - CVE-2015-5559 - CVE-2015-5560 - CVE-2015-5561 - CVE-2015-5562 - CVE-2015-5563 - CVE-2015-5564 - https://helpx.adobe.com/security/products/flash-player/apsb15-19.html - - - 2015-08-11 - 2015-08-12 - - - - - libvpx -- multiple buffer overflows - - - libvpx - 1.4.0.488 - - - firefox - 40.0,1 - - - linux-firefox - 40.0,1 - - - - -

The Mozilla Project reports:

-
-

Security researcher Abhishek Arya (Inferno) of the Google - Chrome Security Team used the Address Sanitizer tool to - discover two buffer overflow issues in the Libvpx library - used for WebM video when decoding a malformed WebM video - file. These buffer overflows result in potentially - exploitable crashes.

-
- - - - CVE-2015-4485 - CVE-2015-4486 - https://www.mozilla.org/security/advisories/mfsa2015-89/ - - - 2015-08-11 - 2015-08-11 - 2015-08-14 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 40.0,1 - - - linux-firefox - 40.0,1 - - - seamonkey - 2.362.37 - - 2.35 - - - linux-seamonkey - 2.362.37 - - 2.35 - - - firefox-esr - 38.2.0,1 - - - libxul - 38.2.0 - - - thunderbird - 38.2.0 - - - linux-thunderbird - 38.2.0 - - - - -

The Mozilla Project reports:

-
-

MFSA 2015-79 Miscellaneous memory safety hazards (rv:40.0 - / rv:38.2)

-

MFSA 2015-80 Out-of-bounds read with malformed MP3 - file

-

MFSA 2015-81 Use-after-free in MediaStream playback

-

MFSA 2015-82 Redefinition of non-configurable JavaScript object properties

-

MFSA 2015-83 Overflow issues in libstagefright

-

MFSA 2015-84 Arbitrary file overwriting through Mozilla - Maintenance Service with hard links

-

MFSA 2015-85 Out-of-bounds write with Updater and - malicious MAR file

-

MFSA 2015-86 Feed protocol with POST bypasses mixed - content protections

-

MFSA 2015-87 Crash when using shared memory in - JavaScript

-

MFSA 2015-88 Heap overflow in gdk-pixbuf when scaling - bitmap images

-

MFSA 2015-90 Vulnerabilities found through code - inspection

-

MFSA 2015-91 Mozilla Content Security Policy allows for - asterisk wildcards in violation of CSP specification

-

MFSA 2015-92 Use-after-free in XMLHttpRequest with shared - workers

-
- - - - CVE-2015-4473 - CVE-2015-4474 - CVE-2015-4475 - CVE-2015-4477 - CVE-2015-4478 - CVE-2015-4479 - CVE-2015-4480 - CVE-2015-4481 - CVE-2015-4482 - CVE-2015-4483 - CVE-2015-4484 - CVE-2015-4487 - CVE-2015-4488 - CVE-2015-4489 - CVE-2015-4490 - CVE-2015-4491 - CVE-2015-4492 - CVE-2015-4493 - https://www.mozilla.org/security/advisories/mfsa2015-79/ - https://www.mozilla.org/security/advisories/mfsa2015-80/ - https://www.mozilla.org/security/advisories/mfsa2015-81/ - https://www.mozilla.org/security/advisories/mfsa2015-82/ - https://www.mozilla.org/security/advisories/mfsa2015-83/ - https://www.mozilla.org/security/advisories/mfsa2015-84/ - https://www.mozilla.org/security/advisories/mfsa2015-85/ - https://www.mozilla.org/security/advisories/mfsa2015-86/ - https://www.mozilla.org/security/advisories/mfsa2015-87/ - https://www.mozilla.org/security/advisories/mfsa2015-88/ - https://www.mozilla.org/security/advisories/mfsa2015-90/ - https://www.mozilla.org/security/advisories/mfsa2015-91/ - https://www.mozilla.org/security/advisories/mfsa2015-92/ - - - 2015-08-11 - 2015-08-11 - 2015-08-22 - - - - - lighttpd -- Log injection vulnerability in mod_auth - - - lighttpd - 1.4.36 - - - - -

MITRE reports:

-
-

mod_auth in lighttpd before 1.4.36 allows remote attackers to - inject arbitrary log entries via a basic HTTP authentication string - without a colon character, as demonstrated by a string containing a - NULL and new line character.

-
- - - - CVE-2015-3200 - http://redmine.lighttpd.net/issues/2646 - - - 2015-05-25 - 2015-08-10 - - - - - pcre -- heap overflow vulnerability in '(?|' situations - - - pcre - 8.37_2 - - - - -

Venustech ADLAB reports:

-
-

PCRE library is prone to a vulnerability which leads to Heap - Overflow. During the compilation of a malformed regular expression, - more data is written on the malloced block than the expected size - output by compile_regex. Exploits with advanced Heap Fengshui - techniques may allow an attacker to execute arbitrary code in the - context of the user running the affected application.

-

Latest version of PCRE is prone to a Heap Overflow vulnerability - which could caused by the following regular expression.

-

/(?J:(?|(:(?|(?'R')(\k'R')|((?'R')))H'Rk'Rf)|s(?'R'))))/

-
- - - - ports/202209 - https://bugs.exim.org/show_bug.cgi?id=1667 - - - 2015-08-05 - 2015-08-10 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 39.0.3,1 - - - linux-firefox - 39.0.3,1 - - - firefox-esr - 38.1.1,1 - - - - -

The Mozilla Project reports:

-
-

MFSA 2015-78 Same origin violation and local file - stealing via PDF reader

-
- - - - CVE-2015-4495 - https://www.mozilla.org/security/advisories/mfsa2015-78/ - - - 2015-08-06 - 2015-08-07 - - - - - wordpress -- Multiple vulnerability - - - wordpress - 4.2.4,1 - - - de-wordpress - ja-wordpress - ru-wordpress - zh-wordpress-zh_CN - zh-wordpress-zh_TW - 4.2.4 - - - - -

Gary Pendergast reports:

-
-

WordPress 4.2.4 fixes three cross-site scripting vulnerabilities - and a potential SQL injection that could be used to compromise a - site.

-
- - - - https://wordpress.org/news/2015/08/wordpress-4-2-4-security-and-maintenance-release/ - CVE-2015-2213 - CVE-2015-5730 - CVE-2015-5731 - CVE-2015-5732 - CVE-2015-5733 - CVE-2015-5734 - - - 2015-08-04 - 2015-08-06 - 2015-09-15 - - - - - subversion -- multiple vulnerabilities - - - subversion - 1.8.01.8.14 - 1.7.01.7.21 - - - - -

Subversion reports:

-
-

CVE-2015-3184:
- Subversion's mod_authz_svn does not properly restrict anonymous access - in some mixed anonymous/authenticated environments when - using Apache httpd 2.4.

-

CVE-2015-3187:
- Subversion servers, both httpd and svnserve, will reveal some - paths that should be hidden by path-based authz.

-
- - - - CVE-2015-3184 - http://subversion.apache.org/security/CVE-2015-3184-advisory.txt - CVE-2015-3187 - http://subversion.apache.org/security/CVE-2015-3187-advisory.txt - - - 2015-07-27 - 2015-08-06 - - - - - elasticsearch -- directory traversal attack via snapshot API - - - elasticsearch - 1.0.01.6.1 - - - - -

Elastic reports:

-
-

Vulnerability Summary: Elasticsearch versions from 1.0.0 to 1.6.0 - are vulnerable to a directory traversal attack.

-

Remediation Summary: Users should upgrade to 1.6.1 or later, or - constrain access to the snapshot API to trusted sources.

-
- - - - CVE-2015-5531 - ports/201834 - https://www.elastic.co/community/security - - - 2015-07-16 - 2015-08-05 - - - - - elasticsearch -- remote code execution via transport protocol - - - elasticsearch - 1.6.1 - - - - -

Elastic reports:

-
-

Vulnerability Summary: Elasticsearch versions prior to 1.6.1 are - vulnerable to an attack that can result in remote code execution.

-

Remediation Summary: Users should upgrade to 1.6.1 or 1.7.0. - Alternately, ensure that only trusted applications have access to - the transport protocol port.

-
- - - - CVE-2015-5377 - ports/201834 - https://www.elastic.co/community/security - - - 2015-07-16 - 2015-08-05 - - - - - qemu, xen-tools -- QEMU heap overflow flaw with certain ATAPI commands - - - qemu - qemu-devel - 0.11.1_20 - 0.122.3.0_2 - - - qemu-sbruno - qemu-user-static - 2.4.50.g20150814 - - - xen-tools - 4.5.0_9 - - - - -

The Xen Project reports:

-
-

A heap overflow flaw was found in the way QEMU's IDE subsystem - handled I/O buffer access while processing certain ATAPI - commands.

-

A privileged guest user in a guest with CDROM drive enabled could - potentially use this flaw to execute arbitrary code on the host - with the privileges of the host's QEMU process corresponding to - the guest.

-
- - - - CVE-2015-5154 - http://xenbits.xen.org/xsa/advisory-138.html - http://git.qemu.org/?p=qemu.git;a=commit;h=e40db4c6d391419c0039fe274c74df32a6ca1a28 - - - 2015-07-27 - 2015-08-04 - 2015-08-19 - - - - - net-snmp -- snmptrapd crash - - - net-snmp - 5.7.05.7.2.1 - 5.6.05.6.2.1 - 5.5.05.5.2.1 - 5.4.05.4.4 - - - - -

Murray McAllister reports:

-
-

A remote denial-of-service flaw was found in the way - snmptrapd handled certain SNMP traps when started with the - "-OQ" option. If an attacker sent an SNMP trap containing a - variable with a NULL type where an integer variable type was - expected, it would cause snmptrapd to crash.

-
- - - - http://seclists.org/oss-sec/2014/q3/473 - http://sourceforge.net/p/net-snmp/code/ci/7f4a7b891332899cea26e95be0337aae01648742/ - https://sourceforge.net/p/net-snmp/official-patches/48/ - CVE-2014-3565 - - - 2014-07-31 - 2015-07-31 - - - - - net-snmp -- snmp_pdu_parse() function incomplete initialization - - - net-snmp - 5.7.3_7 - - - - -

Qinghao Tang reports:

-
-

Incompletely initialized vulnerability exists in the function - ‘snmp_pdu_parse()’ of ‘snmp_api.c', and remote attackers can cause memory - leak, DOS and possible command executions by sending malicious packets.

-
- - - - http://seclists.org/oss-sec/2015/q2/116 - http://sourceforge.net/p/net-snmp/code/ci/f23bcd3ac6ddee5d0a48f9703007ccc738914791/ - https://bugzilla.redhat.com/show_bug.cgi?id=1212408 - CVE-2015-5621 - - - 2015-04-11 - 2015-07-31 - - - - - bind -- denial of service vulnerability - - - bind910 - 9.10.2P3 - - - bind99 - 9.9.7P2 - - - bind910-base - bind99-base - 0 - - - FreeBSD - 9.39.3_21 - 8.48.4_35 - - - - -

ISC reports:

-
-

An error in the handling of TKEY queries can be exploited - by an attacker for use as a denial-of-service vector, as a constructed - packet can use the defect to trigger a REQUIRE assertion failure, - causing BIND to exit.

-
- - - - SA-15:17.bind - CVE-2015-5477 - https://kb.isc.org/article/AA-01272/ - - - 2015-07-21 - 2015-07-28 - 2016-08-09 - - - - - OpenSSH -- MaxAuthTries limit bypass via duplicates in KbdInteractiveDevices - - - openssh-portable - 6.9.p1_2,1 - - - FreeBSD - 10.110.1_16 - 9.39.3_21 - 8.48.4_36 - - - - -
-

It was discovered that the OpenSSH sshd daemon did not check the - list of keyboard-interactive authentication methods for duplicates. - A remote attacker could use this flaw to bypass the MaxAuthTries - limit, making it easier to perform password guessing attacks.

-
- - - - https://access.redhat.com/security/cve/CVE-2015-5600 - CVE-2015-5600 - SA-15:16.openssh - - - 2015-07-21 - 2015-07-27 - 2016-08-09 - - - - - logstash -- SSL/TLS vulnerability with Lumberjack input - - - logstash - 1.4.4 - 1.5.01.5.3 - - - - -

Elastic reports:

-
-

Vulnerability Summary: All Logstash versions prior to 1.5.2 that - use Lumberjack input (in combination with Logstash Forwarder agent) - are vulnerable to a SSL/TLS security issue called the FREAK attack. - This allows an attacker to intercept communication and access secure - data. Users should upgrade to 1.5.3 or 1.4.4.

-

Remediation Summary: Users that do not want to upgrade can address - the vulnerability by disabling the Lumberjack input.

-
- - - - CVE-2015-5378 - https://www.elastic.co/community/security - - - 2015-07-22 - 2015-07-27 - - - - - chromium -- multiple vulnerabilities - - - chromium - 44.0.2403.89 - - - - chromium-npapi - 44.0.2403.89 - - - - chromium-pulse - 44.0.2403.89 - - - - -

Google Chrome Releases reports:

-
-

43 security fixes in this release, including:

-
    -
  • [446032] High CVE-2015-1271: Heap-buffer-overflow in pdfium. - Credit to cloudfuzzer.
    • -
  • [459215] High CVE-2015-1273: Heap-buffer-overflow in pdfium. - Credit to makosoft.
    • -
  • [461858] High CVE-2015-1274: Settings allowed executable files - to run immediately after download. Credit to andrewm.bpi.
    • -
  • [462843] High CVE-2015-1275: UXSS in Chrome for Android. Credit - to WangTao(neobyte) of Baidu X-Team.
    • -
  • [472614] High CVE-2015-1276: Use-after-free in IndexedDB. - Credit to Collin Payne.
    • -
  • [483981] High CVE-2015-1279: Heap-buffer-overflow in pdfium. - Credit to mlafon.
    • -
  • [486947] High CVE-2015-1280: Memory corruption in skia. Credit - to cloudfuzzer.
    • -
  • [487155] High CVE-2015-1281: CSP bypass. Credit to Masato - Kinugawa.
    • -
  • [487928] High CVE-2015-1282: Use-after-free in pdfium. Credit - to Chamal de Silva.
    • -
  • [492052] High CVE-2015-1283: Heap-buffer-overflow in expat. - Credit to sidhpurwala.huzaifa.
    • -
  • [493243] High CVE-2015-1284: Use-after-free in blink. Credit to - Atte Kettunen of OUSPG.
    • -
  • [504011] High CVE-2015-1286: UXSS in blink. Credit to - anonymous.
    • -
  • [505374] High CVE-2015-1290: Memory corruption in V8. Credit to - Yongjun Liu of NSFOCUS Security Team.
    • -
  • [419383] Medium CVE-2015-1287: SOP bypass with CSS. Credit to - filedescriptor.
    • -
  • [444573] Medium CVE-2015-1270: Uninitialized memory read in - ICU. Credit to Atte Kettunen of OUSPG.
    • -
  • [451456] Medium CVE-2015-1272: Use-after-free related to - unexpected GPU process termination. Credit to Chamal de - Silva.
    • -
  • [479743] Medium CVE-2015-1277: Use-after-free in accessibility. - Credit to SkyLined.
    • -
  • [482380] Medium CVE-2015-1278: URL spoofing using pdf files. - Credit to Chamal de Silva.
    • -
  • [498982] Medium CVE-2015-1285: Information leak in XSS auditor. - Credit to gazheyes.
    • -
  • [479162] Low CVE-2015-1288: Spell checking dictionaries fetched - over HTTP. Credit to mike@michaelruddy.com.
    • -
  • [512110] CVE-2015-1289: Various fixes from internal audits, - fuzzing and other initiatives.
    • -
-
- - - - CVE-2015-1270 - CVE-2015-1271 - CVE-2015-1272 - CVE-2015-1273 - CVE-2015-1274 - CVE-2015-1275 - CVE-2015-1276 - CVE-2015-1277 - CVE-2015-1278 - CVE-2015-1279 - CVE-2015-1280 - CVE-2015-1281 - CVE-2015-1282 - CVE-2015-1283 - CVE-2015-1284 - CVE-2015-1285 - CVE-2015-1286 - CVE-2015-1287 - CVE-2015-1288 - CVE-2015-1289 - CVE-2015-1290 - http://googlechromereleases.blogspot.nl/ - - - 2015-07-21 - 2015-07-25 - - - - - shibboleth-sp -- DoS vulnerability - - - xmltooling - 1.5.5 - - - opensaml2 - 2.5.5 - - - shibboleth-sp - 2.5.5 - - - - -

Shibboleth consortium reports:

-
-

- Shibboleth SP software crashes on well-formed but invalid XML. -

-

- The Service Provider software contains a code path with an uncaught - exception that can be triggered by an unauthenticated attacker by - supplying well-formed but schema-invalid XML in the form of SAML - metadata or SAML protocol messages. The result is a crash and so - causes a denial of service. -

-

- You must rebuild opensaml and shibboleth with xmltooling-1.5.5 or - later. The easiest way to do so is to update the whole chain including - shibboleth-2.5.5 an opensaml2.5.5. -

-
- - - - http://shibboleth.net/community/advisories/secadv_20150721.txt - CVE-2015-2684 - - - 2015-07-21 - 2015-07-23 - - - - - wordpress -- XSS vulnerability - - - wordpress - 4.2.3,1 - - - de-wordpress - ja-wordpress - ru-wordpress - zh-wordpress-zh_CN - zh-wordpress-zh_TW - 4.2.3 - - - - -

Gary Pendergast reports:

-
-

WordPress versions 4.2.2 and earlier are affected by a - cross-site scripting vulnerability, which could allow users with the - Contributor or Author role to compromise a site. This was reported by - Jon Cave and fixed by Robert Chapin, both of the WordPress security - team.

-
- - - - https://wordpress.org/news/2015/07/wordpress-4-2-3/ - CVE-2015-5622 - CVE-2015-5623 - - - 2015-07-23 - 2015-07-23 - 2015-09-15 - - - - - libidn -- out-of-bounds read issue with invalid UTF-8 input - - - libidn - 1.31 - - - - -

Simon Josefsson reports:

-
-

stringprep_utf8_to_ucs4 now rejects invalid UTF-8. This function - has always been documented to not validate that the input UTF-8 - string is actually valid UTF-8... -

-
- - - - CVE-2015-2059 - http://git.savannah.gnu.org/cgit/libidn.git/plain/NEWS?id=libidn-1-31 - - - 2015-02-09 - 2015-07-23 - 2015-08-03 - - - - - sox -- memory corruption vulnerabilities - - - sox - 14.4.2 - - - - -

Michele Spagnuolo, Google Security Team, reports:

-
-

The write heap buffer overflows are related to ADPCM handling in - WAV files, while the read heap buffer overflow is while opening a - .VOC.

-
- - - - http://seclists.org/oss-sec/2015/q3/167 - - - 2015-07-22 - 2015-07-23 - - - - - sox -- input sanitization errors - - - sox - 14.4.2 - - - - -

oCERT reports:

-
-

The sox command line tool is affected by two heap-based buffer - overflows, respectively located in functions start_read() and - AdpcmReadBlock().

-

A specially crafted wav file can be used to trigger the - vulnerabilities.

-
- - - - 71774 - CVE-2014-8145 - http://www.ocert.org/advisories/ocert-2014-010.html - - - 2014-11-20 - 2015-07-23 - - - - - gdk-pixbuf2 -- heap overflow and DoS affecting Firefox and other programs - - - gdk-pixbuf2 - 2.31.2_2 - - - - -

gustavo.grieco@imag.fr reports:

-
-

We found a heap overflow and a DoS in the gdk-pixbuf - implementation triggered by the scaling of a malformed bmp.

-
- - - - https://bugzilla.gnome.org/show_bug.cgi?id=752297 - - - 2015-07-12 - 2015-07-22 - - - - - pcre -- Heap Overflow Vulnerability in find_fixedlength() - - - pcre - 8.37_1 - - - - -

Venustech ADLAB reports:

-
-

PCRE library is prone to a vulnerability which leads to Heap - Overflow. During subpattern calculation of a malformed regular - expression, an offset that is used as an array index is fully - controlled and can be large enough so that unexpected heap - memory regions are accessed.

-

One could at least exploit this issue to read objects nearby of - the affected application's memory.

-

Such information disclosure may also be used to bypass memory - protection method such as ASLR.

-
- - - - CVE-2015-5073 - https://bugs.exim.org/show_bug.cgi?id=1651 - http://vcs.pcre.org/pcre?view=revision&revision=1571 - http://www.openwall.com/lists/oss-security/2015/06/26/1 - - - 2015-06-23 - 2015-06-29 - - - - - cacti -- Multiple XSS and SQL injection vulnerabilities - - - cacti - 0.8.8e - - - - -

The Cacti Group, Inc. reports:

-
-

Important Security Fixes

-
    -
  • Multiple XSS and SQL injection vulnerabilities
    • -
  • CVE-2015-4634 - SQL injection in graphs.php
    • -
-

Changelog

-
    -
  • bug: Fixed various SQL Injection vectors
    • -
  • bug#0002574: SQL Injection Vulnerabilities in graph items and - graph template items
    • -
  • bug#0002577: CVE-2015-4634 - SQL injection in graphs.php
    • -
  • bug#0002579: SQL Injection Vulnerabilities in data sources
    • -
  • bug#0002580: SQL Injection in cdef.php
    • -
  • bug#0002582: SQL Injection in data_templates.php
    • -
  • bug#0002583: SQL Injection in graph_templates.php
    • -
  • bug#0002584: SQL Injection in host_templates.php
    • -
-
- - - - CVE-2015-4634 - ports/201702 - http://www.cacti.net/release_notes_0_8_8e.php - http://seclists.org/oss-sec/2015/q3/150 - - - 2015-07-12 - 2015-07-20 - - - - - php-phar -- multiple vulnerabilities - - - php56-phar - 5.6.11 - - - php55-phar - 5.5.27 - - - php5-phar - 5.4.43 - - - - -

reports:

-
-

Segfault in Phar::convertToData on invalid file.

-

Buffer overflow and stack smashing error in phar_fix_filepath.

-
- - - - http://seclists.org/oss-sec/2015/q3/141 - https://bugs.php.net/bug.php?id=69958 - http://git.php.net/?p=php-src.git;a=commit;h=bf58162ddf970f63502837f366930e44d6a992cf - https://bugs.php.net/bug.php?id=69923 - http://git.php.net/?p=php-src.git;a=commit;h=6dedeb40db13971af45276f80b5375030aa7e76f - CVE-2015-5589 - CVE-2015-5590 - - - 2015-06-24 - 2015-07-18 - 2015-12-18 - - - - - moodle -- multiple vulnerabilities - - - moodle27 - 2.7.9 - - - moodle28 - 2.8.7 - - - moodle29 - 2.9.1 - - - - -

Marina Glancy reports:

-
-

MSA-15-0026: Possible phishing when redirecting to external site - using referer header. (CVE-2015-3272)

-

MSA-15-0027: Capability 'mod/forum:canposttomygroups' is not - respected when using 'Post a copy to all groups' in forum - (CVE-2015-3273)

-

MSA-15-0028: Possible XSS through custom text profile fields in Web - Services (CVE-2015-3274)

-

MSA-15-0029: Javascript injection in SCORM module (CVE-2015-3275) -

-
- - - - CVE-2015-3272 - CVE-2015-3273 - CVE-2015-3274 - CVE-2015-3275 - http://seclists.org/oss-sec/2015/q3/94 - https://docs.moodle.org/dev/Moodle_2.7.9_release_notes - https://docs.moodle.org/dev/Moodle_2.8.7_release_notes - https://docs.moodle.org/dev/Moodle_2.9.1_release_notes - - - 2015-07-06 - 2015-07-18 - 2015-07-19 - - - - - apache22 -- chunk header parsing defect - - - apache22 - apache22-event-mpm - apache22-itk-mpm - apache22-peruser-mpm - apache22-worker-mpm - 2.2.29_5 - - - - -

Apache Foundation reports:

-
-

CVE-2015-3183 core: Fix chunk header parsing defect. Remove - apr_brigade_flatten(), buffering and duplicated code from the HTTP_IN - filter, parse chunks in a single pass with zero copy. Limit accepted - chunk-size to 2^63-1 and be strict about chunk-ext authorized - characters.

-
- - - - http://www.apache.org/dist/httpd/Announcement2.2.html - https://github.com/apache/httpd/commit/29779fd08c18b18efc5e640d74cbe297c7ec007e - CVE-2015-3183 - - - 2015-06-24 - 2015-07-17 - - - - - zenphoto -- multiple vulnerabilities - - - zenphoto - 1.4.9 - - - - -

zenphoto reports:

-
-

Fixes several SQL Injection, XSS and path traversal - security issues

-
- - - - http://www.zenphoto.org/news/zenphoto-1.4.9 - http://seclists.org/oss-sec/2015/q3/123 - https://github.com/zenphoto/zenphoto/pull/935 - CVE-2015-5591 - CVE-2015-5592 - CVE-2015-5593 - CVE-2015-5594 - CVE-2015-5595 - - - 2015-05-24 - 2015-07-16 - 2015-07-18 - - - - - groovy -- remote execution of untrusted code - - - groovy - 1.7.02.4.4 - - - - -

Cédric Champeau reports:

-
-

Description

-

When an application has Groovy on the classpath and that - it uses standard Java serialization mechanism to communicate - between servers, or to store local data, it is possible for - an attacker to bake a special serialized object that will - execute code directly when deserialized. All applications - which rely on serialization and do not isolate the code which - deserializes objects are subject to this vulnerability.

-
- - - - http://seclists.org/oss-sec/2015/q3/121 - http://groovy-lang.org/security.html - https://issues.apache.org/jira/browse/GROOVY-7504 - CVE-2015-3253 - - - 2015-07-09 - 2015-07-16 - - - - - libav -- divide by zero - - - libav - 11.3_2 - - - - -

Agostino Sarubbo reports:

-
-

libav: divide-by-zero in ff_h263_decode_mba()

-
- - - - https://blogs.gentoo.org/ago/2015/07/16/libav-divide-by-zero-in-ff_h263_decode_mba/ - https://git.libav.org/?p=libav.git;a=commitdiff;h=0a49a62f998747cfa564d98d36a459fe70d3299b;hp=6f4cd33efb5a9ec75db1677d5f7846c60337129f - CVE-2015-5479 - - - 2015-06-21 - 2015-07-16 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 39.0,1 - - - linux-firefox - 39.0,1 - - - seamonkey - - 2.35 - - - linux-seamonkey - - 2.35 - - - firefox-esr - 31.8.0,1 - 38.0,138.1.0,1 - - - libxul - 31.8.0 - 38.038.1.0 - - - thunderbird - 31.8.0 - 38.038.1.0 - - - linux-thunderbird - 31.8.0 - 38.038.1.0 - - - - -

The Mozilla Project reports:

-
-

MFSA 2015-59 Miscellaneous memory safety hazards (rv:39.0 - / rv:31.8 / rv:38.1)

-

MFSA 2015-60 Local files or privileged URLs in pages can - be opened into new tabs

-

MFSA 2015-61 Type confusion in Indexed Database - Manager

-

MFSA 2015-62 Out-of-bound read while computing an - oscillator rendering range in Web Audio

-

MFSA 2015-63 Use-after-free in Content Policy due to - microtask execution error

-

MFSA 2015-64 ECDSA signature validation fails to handle - some signatures correctly

-

MFSA 2015-65 Use-after-free in workers while using - XMLHttpRequest

-

MFSA 2015-66 Vulnerabilities found through code - inspection

-

MFSA 2015-67 Key pinning is ignored when overridable - errors are encountered

-

MFSA 2015-68 OS X crash reports may contain entered key - press information

-

MFSA 2015-69 Privilege escalation through internal - workers

-

MFSA 2015-70 NSS accepts export-length DHE keys with - regular DHE cipher suites

-

MFSA 2015-71 NSS incorrectly permits skipping of - ServerKeyExchange

-
- - - - CVE-2015-2721 - CVE-2015-2722 - CVE-2015-2724 - CVE-2015-2725 - CVE-2015-2726 - CVE-2015-2727 - CVE-2015-2728 - CVE-2015-2729 - CVE-2015-2730 - CVE-2015-2731 - CVE-2015-2733 - CVE-2015-2734 - CVE-2015-2735 - CVE-2015-2736 - CVE-2015-2737 - CVE-2015-2738 - CVE-2015-2739 - CVE-2015-2740 - CVE-2015-2741 - CVE-2015-2742 - CVE-2015-2743 - CVE-2015-4000 - https://www.mozilla.org/security/advisories/mfsa2015-59/ - https://www.mozilla.org/security/advisories/mfsa2015-60/ - https://www.mozilla.org/security/advisories/mfsa2015-61/ - https://www.mozilla.org/security/advisories/mfsa2015-62/ - https://www.mozilla.org/security/advisories/mfsa2015-63/ - https://www.mozilla.org/security/advisories/mfsa2015-64/ - https://www.mozilla.org/security/advisories/mfsa2015-65/ - https://www.mozilla.org/security/advisories/mfsa2015-66/ - https://www.mozilla.org/security/advisories/mfsa2015-67/ - https://www.mozilla.org/security/advisories/mfsa2015-68/ - https://www.mozilla.org/security/advisories/mfsa2015-69/ - https://www.mozilla.org/security/advisories/mfsa2015-70/ - https://www.mozilla.org/security/advisories/mfsa2015-71/ - - - 2015-07-02 - 2015-07-16 - 2015-09-22 - - - - - PolarSSL -- Security Fix Backports - - - polarssl - 1.2.14 - - - - -

Paul Bakker reports:

-
-

PolarSSL 1.2.14 fixes one remotely-triggerable issues that was - found by the Codenomicon Defensics tool, one potential remote crash - and countermeasures against the "Lucky 13 strikes back" cache-based - attack.

-
- - - - https://tls.mbed.org/tech-updates/releases/polarssl-1.2.14-released - - - 2015-06-26 - 2015-07-15 - - - - - libwmf -- multiple vulnerabilities - - - libwmf - 0.2.8.4_14 - - - - -

Mitre reports:

-
-

Multiple buffer overflows in the gd graphics library (libgd) 2.0.21 - and earlier may allow remote attackers to execute arbitrary code via - malformed image files that trigger the overflows due to improper - calls to the gdMalloc function, a different set of vulnerabilities - than CVE-2004-0990.

-
-
-

Buffer overflow in the gdImageStringFTEx function in gdft.c in GD - Graphics Library 2.0.33 and earlier allows remote attackers to cause - a denial of service (application crash) and possibly execute - arbitrary code via a crafted string with a JIS encoded font.

-
-
-

The gdPngReadData function in libgd 2.0.34 allows user-assisted - attackers to cause a denial of service (CPU consumption) via a - crafted PNG image with truncated data, which causes an infinite loop - in the png_read_info function in libpng.

-
-
-

Integer overflow in gdImageCreateTrueColor function in the GD - Graphics Library (libgd) before 2.0.35 allows user-assisted remote - attackers to have unspecified attack vectors and impact.

-
-
-

The gdImageCreateXbm function in the GD Graphics Library (libgd) - before 2.0.35 allows user-assisted remote attackers to cause a - denial of service (crash) via unspecified vectors involving a - gdImageCreate failure.

-
-
-

The (a) imagearc and (b) imagefilledarc functions in GD Graphics - Library (libgd) before 2.0.35 allow attackers to cause a denial of - service (CPU consumption) via a large (1) start or (2) end angle - degree value.

-
-
-

The _gdGetColors function in gd_gd.c in PHP 5.2.11 and 5.3.x before - 5.3.1, and the GD Graphics Library 2.x, does not properly verify a - certain colorsTotal structure member, which might allow remote - attackers to conduct buffer overflow or buffer over-read attacks via - a crafted GD file, a different vulnerability than CVE-2009-3293. - NOTE: some of these details are obtained from third party - information.

-
-
-

Heap-based buffer overflow in libwmf 0.2.8.4 allows remote - attackers to cause a denial of service (crash) or possibly execute - arbitrary code via a crafted BMP image.

-
-
-

meta.h in libwmf 0.2.8.4 allows remote attackers to cause a denial - of service (out-of-bounds read) via a crafted WMF file.

-
-
-

Use-after-free vulnerability in libwmf 0.2.8.4 allows remote - attackers to cause a denial of service (crash) via a crafted WMF - file to the (1) wmf2gd or (2) wmf2eps command.

-
-
-

Heap-based buffer overflow in the DecodeImage function in libwmf - 0.2.8.4 allows remote attackers to cause a denial of service (crash) - or possibly execute arbitrary code via a crafted "run-length count" - in an image in a WMF file.

-
- - - - 11663 - 22289 - 24089 - 24651 - 36712 - ports/201513 - CVE-2004-0941 - CVE-2007-0455 - CVE-2007-2756 - CVE-2007-3472 - CVE-2007-3473 - CVE-2007-3477 - CVE-2009-3546 - CVE-2015-0848 - CVE-2015-4695 - CVE-2015-4696 - CVE-2015-4588 - - - 2004-10-12 - 2015-07-15 - - - - - apache24 -- multiple vulnerabilities - - - apache24 - 2.4.16 - - - - -

Jim Jagielski reports:

-
-

CVE-2015-3183 (cve.mitre.org) - core: Fix chunk header parsing defect. - Remove apr_brigade_flatten(), buffering and duplicated code from - the HTTP_IN filter, parse chunks in a single pass with zero copy. - Limit accepted chunk-size to 2^63-1 and be strict about chunk-ext - authorized characters.

-

CVE-2015-3185 (cve.mitre.org) - Replacement of ap_some_auth_required (unusable in Apache httpd 2.4) - with new ap_some_authn_required and ap_force_authn hook.

-

CVE-2015-0253 (cve.mitre.org) - core: Fix a crash with ErrorDocument 400 pointing to a local URL-path - with the INCLUDES filter active, introduced in 2.4.11. PR 57531.

-

CVE-2015-0228 (cve.mitre.org) - mod_lua: A maliciously crafted websockets PING after a script - calls r:wsupgrade() can cause a child process crash.

-
- - - - https://mail-archives.apache.org/mod_mbox/www-announce/201507.mbox/%3CAA5C882C-A9C3-46B9-9320-5040A2152E83@apache.org%3E - CVE-2015-3183 - CVE-2015-3185 - CVE-2015-0253 - CVE-2015-0228 - - - 2015-02-04 - 2015-07-15 - - - - - Adobe Flash Player -- critical vulnerabilities - - - linux-c6-flashplugin - 11.2r202.491 - - - linux-f10-flashplugin - 11.2r202.491 - - - - -

Adobe reports:

-
-

Critical vulnerabilities (CVE-2015-5122, CVE-2015-5123) have - been identified. Successful exploitation could cause a crash - and potentially allow an attacker to take control of the - affected system. Adobe is aware of reports that exploits - targeting these vulnerabilities have been published publicly.

-
- - - - CVE-2015-5122 - CVE-2015-5123 - https://helpx.adobe.com/security/products/flash-player/apsb15-18.html - - - 2015-07-10 - 2015-07-14 - 2015-07-16 - - - - - php -- use-after-free vulnerability - - - php56-sqlite3 - 5.6.11 - - - php55-sqlite3 - 5.5.27 - - - php5-sqlite3 - 5.4.43 - - - - -

Symeon Paraschoudis reports:

-
-

Use-after-free vulnerability in sqlite3SafetyCheckSickOrOk()

-
- - - - https://bugs.php.net/bug.php?id=69972 - - - 2015-06-30 - 2015-07-13 - - - - - php -- use-after-free vulnerability - - - php56 - 5.6.11 - - - php55 - 5.5.27 - - - php5 - 5.4.43 - - - - -

Symeon Paraschoudis reports:

-
-

Use-after-free vulnerability in spl_recursive_it_move_forward_ex()

-
- - - - https://bugs.php.net/bug.php?id=69970 - - - 2015-06-30 - 2015-07-13 - - - - - php -- arbitrary code execution - - - php56 - 5.6.11 - - - php55 - 5.5.27 - - - php5 - 5.4.43 - - - - -

cmb reports:

-
-

When delayed variable substitution is enabled (can be set in the - Registry, for instance), !ENV! works similar to %ENV%, and the - value of the environment variable ENV will be subsituted.

-
- - - - https://bugs.php.net/bug.php?id=69768 - - - 2015-06-07 - 2015-07-13 - - - - - mysql -- SSL Downgrade - - - php56-mysql - php56-mysqli - 5.6.11 - - - php55-mysql - php55-mysqli - 5.5.27 - - - php5-mysql - php5-mysqli - 5.4.43 - - - mariadb55-client - 5.5.44 - - - mariadb100-client - 10.0.20 - - - - -

Duo Security reports:

-
-

Researchers have identified a serious vulnerability in some - versions of Oracle’s MySQL database product that allows an attacker to - strip SSL/TLS connections of their security wrapping transparently.

-
- - - - https://bugs.php.net/bug.php?id=69669 - https://www.duosecurity.com/blog/backronym-mysql-vulnerability - http://www.ocert.org/advisories/ocert-2015-003.html - https://mariadb.atlassian.net/browse/MDEV-7937 - https://mariadb.com/kb/en/mariadb/mariadb-10020-changelog/ - https://mariadb.com/kb/en/mariadb/mariadb-5544-changelog/ - CVE-2015-3152 - - - 2015-03-20 - 2015-07-13 - 2015-07-18 - - - - - devel/ipython -- CSRF possible remote execution vulnerability - - - ipython - 0.123.2.1 - - - - -

Kyle Kelley reports:

-
-

Summary: POST requests exposed via the IPython REST API are - vulnerable to cross-site request forgery (CSRF). Web pages on - different domains can make non-AJAX POST requests to known IPython - URLs, and IPython will honor them. The user's browser will - automatically send IPython cookies along with the requests. The - response is blocked by the Same-Origin Policy, but the request - isn't.

-

API paths with issues:

-
    -
  • POST /api/contents/<path>/<file>
    • -
  • POST /api/contents/<path>/<file>/checkpoints
    • -
  • POST /api/contents/<path>/<file>/checkpoints/<checkpoint_id>
    • -
  • POST /api/kernels
    • -
  • POST /api/kernels/<kernel_id>/<action>
    • -
  • POST /api/sessions
    • -
  • POST /api/clusters/<cluster_id>/<action>
    • -
-
- - - - CVE-2015-5607 - http://seclists.org/oss-sec/2015/q3/92 - http://ipython.org/ipython-doc/3/whatsnew/version3.html#ipython-3-2-1 - - - 2015-07-12 - 2015-07-13 - 2015-07-22 - - - - - freeradius -- insufficient CRL application vulnerability - - - freeradius2 - 2.2.8 - - - freeradius3 - 3.0.9 - - - - -

oCERT reports:

-
-

The FreeRADIUS server relies on OpenSSL to perform certificate - validation, including Certificate Revocation List (CRL) checks. The - FreeRADIUS usage of OpenSSL, in CRL application, limits the checks - to leaf certificates, therefore not detecting revocation of - intermediate CA certificates.

-

An unexpired client certificate, issued by an intermediate CA with - a revoked certificate, is therefore accepted by FreeRADIUS.

-

Specifically sets the X509_V_FLAG_CRL_CHECK flag for leaf - certificate CRL checks, but does not use X509_V_FLAG_CRL_CHECK_ALL - for CRL checks on the complete trust chain.

-

The FreeRADIUS project advises that the recommended configuration - is to use self-signed CAs for all EAP-TLS methods.

-
- - - - CVE-2015-4680 - ports/201058 - ports/201059 - http://www.ocert.org/advisories/ocert-2015-008.html - http://freeradius.org/security.html - - - 2015-06-22 - 2015-07-13 - - - - - xen-tools -- xl command line config handling stack overflow - - - xen-tools - 4.14.5.0_8 - - - - -

The Xen Project reports:

-
-

The xl command line utility mishandles long configuration values - when passed as command line arguments, with a buffer overrun.

-

A semi-trusted guest administrator or controller, who is intended - to be able to partially control the configuration settings for a - domain, can escalate their privileges to that of the whole host.

-
- - - - CVE-2015-3259 - http://xenbits.xen.org/xsa/advisory-137.html - - - 2015-07-07 - 2015-07-11 - - - - - xen-kernel -- vulnerability in the iret hypercall handler - - - xen-kernel - 3.14.5.0_3 - - - - -

The Xen Project reports:

-
-

A buggy loop in Xen's compat_iret() function iterates the wrong way - around a 32-bit index. Any 32-bit PV guest kernel can trigger this - vulnerability by attempting a hypercall_iret with EFLAGS.VM set.

-

Given the use of __get/put_user(), and that the virtual addresses - in question are contained within the lower canonical half, the guest - cannot clobber any hypervisor data. Instead, Xen will take up to - 2^33 pagefaults, in sequence, effectively hanging the host.

-

Malicious guest administrators can cause a denial of service - affecting the whole system.

-
- - - - CVE-2015-4164 - http://xenbits.xen.org/xsa/advisory-136.html - - - 2015-06-11 - 2015-07-11 - - - - - xen-kernel -- GNTTABOP_swap_grant_ref operation misbehavior - - - xen-kernel - 4.24.5.0_3 - - - - -

The Xen Project reports:

-
-

With the introduction of version 2 grant table operations, a - version check became necessary for most grant table related - hypercalls. The GNTTABOP_swap_grant_ref call was lacking such a - check. As a result, the subsequent code behaved as if version 2 was - in use, when a guest issued this hypercall without a prior - GNTTABOP_setup_table or GNTTABOP_set_version.

-

The effect is a possible NULL pointer dereferences. However, this - cannot be exploited to elevate privileges of the attacking domain, - as the maximum memory address that can be wrongly accessed this way - is bounded to far below the start of hypervisor memory.

-

Malicious or buggy guest domain kernels can mount a denial of - service attack which, if successful, can affect the whole system.

-
- - - - CVE-2015-4163 - http://xenbits.xen.org/xsa/advisory-134.html - - - 2015-06-11 - 2015-07-11 - - - - - xen-kernel -- Information leak through XEN_DOMCTL_gettscinfo - - - xen-kernel - 4.04.5.0_3 - - - - -

The Xen Project reports:

-
-

The handler for XEN_DOMCTL_gettscinfo failed to initialize a - padding field subsequently copied to guest memory.

-

A similar leak existed in XEN_SYSCTL_getdomaininfolist, which is - being addressed here regardless of that operation being declared - unsafe for disaggregation by XSA-77.

-

Malicious or buggy stub domain kernels or tool stacks otherwise - living outside of Domain0 may be able to read sensitive data - relating to the hypervisor or other guests not under the control of - that domain.

-
- - - - CVE-2015-3340 - http://xenbits.xen.org/xsa/advisory-132.html - - - 2015-04-20 - 2015-07-11 - - - - - xen-tools -- Unmediated PCI register access in qemu - - - xen-tools - 3.34.5.0_6 - - - - -

The Xen Project reports:

-
-

Qemu allows guests to not only read, but also write all parts of - the PCI config space (but not extended config space) of passed - through PCI devices not explicitly dealt with for (partial) - emulation purposes.

-

Since the effect depends on the specific purpose of the the config - space field, it's not possible to give a general statement about the - exact impact on the host or other guests. Privilege escalation, - host crash (Denial of Service), and leaked information all cannot be - excluded.

-
- - - - CVE-2015-4106 - http://xenbits.xen.org/xsa/advisory-131.html - - - 2015-06-02 - 2015-07-11 - - - - - xen-tools -- Guest triggerable qemu MSI-X pass-through error messages - - - xen-tools - 3.34.5.0_6 - - - - -

The Xen Project reports:

-
-

Device model code dealing with guest PCI MSI-X interrupt management - activities logs messages on certain (supposedly) invalid guest - operations.

-

A buggy or malicious guest repeatedly invoking such operations may - result in the host disk to fill up, possibly leading to a Denial of - Service.

-
- - - - CVE-2015-4105 - http://xenbits.xen.org/xsa/advisory-130.html - - - 2015-06-02 - 2015-07-11 - - - - - xen-tools -- PCI MSI mask bits inadvertently exposed to guests - - - xen-tools - 3.34.5.0_6 - - - - -

The Xen Project reports:

-
-

The mask bits optionally available in the PCI MSI capability - structure are used by the hypervisor to occasionally suppress - interrupt delivery. Unprivileged guests were, however, nevertheless - allowed direct control of these bits.

-

Interrupts may be observed by Xen at unexpected times, which may - lead to a host crash and therefore a Denial of Service.

-
- - - - CVE-2015-4104 - http://xenbits.xen.org/xsa/advisory-129.html - - - 2015-06-02 - 2015-07-11 - - - - - xen-tools -- Potential unintended writes to host MSI message data field via qemu - - - xen-tools - 3.34.5.0_6 - - - - -

The Xen Project reports:

-
-

Logic is in place to avoid writes to certain host config space - fields when the guest must nevertheless be able to access their - virtual counterparts. A bug in how this logic deals with accesses - spanning multiple fields allows the guest to write to the host MSI - message data field.

-

While generally the writes write back the values previously read, - their value in config space may have got changed by the host between - the qemu read and write. In such a case host side interrupt handling - could become confused, possibly losing interrupts or allowing - spurious interrupt injection into other guests.

-

Certain untrusted guest administrators may be able to confuse host - side interrupt handling, leading to a Denial of Service.

-
- - - - CVE-2015-4103 - http://xenbits.xen.org/xsa/advisory-128.html - - - 2015-06-02 - 2015-07-11 - - - - - xen-kernel -- Certain domctl operations may be abused to lock up the host - - - xen-kernel - 4.34.5.0_3 - - - - -

The Xen Project reports:

-
-

XSA-77 put the majority of the domctl operations on a list - excepting them from having security advisories issued for them if - any effects their use might have could hamper security. Subsequently - some of them got declared disaggregation safe, but for a small - subset this was not really correct: Their (mis-)use may result in - host lockups.

-

As a result, the potential security benefits of toolstack - disaggregation are not always fully realised.

-

Domains deliberately given partial management control may be able - to deny service to the entire host.

-

As a result, in a system designed to enhance security by radically - disaggregating the management, the security may be reduced. But, - the security will be no worse than a non-disaggregated design.

-
- - - - CVE-2015-2751 - http://xenbits.xen.org/xsa/advisory-127.html - - - 2015-03-31 - 2015-07-11 - - - - - xen-tools -- Unmediated PCI command register access in qemu - - - xen-tools - 3.34.5.0_6 - - - - -

The Xen Project reports:

-
-

HVM guests are currently permitted to modify the memory and I/O - decode bits in the PCI command register of devices passed through to - them. Unless the device is an SR-IOV virtual function, after - disabling one or both of these bits subsequent accesses to the MMIO - or I/O port ranges would - on PCI Express devices - lead to - Unsupported Request responses. The treatment of such errors is - platform specific.

-

Furthermore (at least) devices under control of the Linux pciback - driver in the host are handed to guests with the aforementioned bits - turned off. This means that such accesses can similarly lead to - Unsupported Request responses until these flags are set as needed by - the guest.

-

In the event that the platform surfaces aforementioned UR responses - as Non-Maskable Interrupts, and either the OS is configured to treat - NMIs as fatal or (e.g. via ACPI's APEI) the platform tells the OS to - treat these errors as fatal, the host would crash, leading to a - Denial of Service.

-
- - - - CVE-2015-2756 - http://xenbits.xen.org/xsa/advisory-126.html - - - 2015-03-31 - 2015-07-11 - - - - - xen-kernel and xen-tools -- Long latency MMIO mapping operations are not preemptible - - - xen-kernel - 4.5.0_3 - - - xen-tools - 4.5.0_6 - - - - -

The Xen Project reports:

-
-

The XEN_DOMCTL_memory_mapping hypercall allows long running - operations without implementing preemption.

-

This hypercall is used by the device model as part of the emulation - associated with configuration of PCI devices passed through to HVM - guests and is therefore indirectly exposed to those guests.

-

This can cause a physical CPU to become busy for a significant - period, leading to a host denial of service in some cases.

-

If a host denial of service is not triggered then it may instead be - possible to deny service to the domain running the device model, - e.g. domain 0.

-

This hypercall is also exposed more generally to all toolstacks. - However the uses of it in libxl based toolstacks are not believed - to open up any avenue of attack from an untrusted guest. Other - toolstacks may be vulnerable however.

-

The vulnerability is exposed via HVM guests which have a PCI device - assigned to them. A malicious HVM guest in such a configuration can - mount a denial of service attack affecting the whole system via its - associated device model (qemu-dm).

-

A guest is able to trigger this hypercall via operations which it - is legitimately expected to perform, therefore running the device - model as a stub domain does not offer protection against the host - denial of service issue. However it does offer some protection - against secondary issues such as denial of service against dom0.

-
- - - - CVE-2015-2752 - http://xenbits.xen.org/xsa/advisory-125.html - - - 2015-03-31 - 2015-07-11 - - - - - xen-kernel -- Hypervisor memory corruption due to x86 emulator flaw - - - xen-kernel - 4.5.0_3 - - - - -

The Xen Project reports:

-
-

Instructions with register operands ignore eventual segment - overrides encoded for them. Due to an insufficiently conditional - assignment such a bogus segment override can, however, corrupt a - pointer used subsequently to store the result of the instruction.

-

A malicious guest might be able to read sensitive data relating to - other guests, or to cause denial of service on the host. Arbitrary - code execution, and therefore privilege escalation, cannot be - excluded.

-
- - - - CVE-2015-2151 - http://xenbits.xen.org/xsa/advisory-123.html - - - 2015-03-10 - 2015-07-11 - - - - - xen-kernel -- Information leak through version information hypercall - - - xen-kernel - 4.5.0_3 - - - - -

The Xen Project reports:

-
-

The code handling certain sub-operations of the - HYPERVISOR_xen_version hypercall fails to fully initialize all - fields of structures subsequently copied back to guest memory. Due - to this hypervisor stack contents are copied into the destination of - the operation, thus becoming visible to the guest.

-

A malicious guest might be able to read sensitive data relating to - other guests.

-
- - - - CVE-2015-2045 - http://xenbits.xen.org/xsa/advisory-122.html - - - 2015-03-05 - 2015-07-11 - - - - - xen-kernel -- Information leak via internal x86 system device emulation - - - xen-kernel - 4.5.0_3 - - - - -

The Xen Project reports:

-
-

Emulation routines in the hypervisor dealing with certain system - devices check whether the access size by the guest is a supported - one. When the access size is unsupported these routines failed to - set the data to be returned to the guest for read accesses, so that - hypervisor stack contents are copied into the destination of the - operation, thus becoming visible to the guest.

-

A malicious HVM guest might be able to read sensitive data relating - to other guests.

-
- - - - CVE-2015-2044 - http://xenbits.xen.org/xsa/advisory-121.html - - - 2015-03-05 - 2015-07-11 - - - - - xen-tools -- HVM qemu unexpectedly enabling emulated VGA graphics backends - - - xen-tools - 4.5.0_6 - - - - -

The Xen Project reports:

-
-

When instantiating an emulated VGA device for an x86 HVM guest qemu - will by default enable a backend to expose that device, either SDL - or VNC depending on the version of qemu and the build time - configuration.

-

The libxl toolstack library does not explicitly disable these - default backends when they are not enabled, leading to an unexpected - backend running.

-

If either SDL or VNC is explicitly enabled in the guest - configuration then only the expected backends will be enabled.

-

This affects qemu-xen and qemu-xen-traditional differently.

-

If qemu-xen was compiled with SDL support then this would result in - an SDL window being opened if $DISPLAY is valid, or a failure to - start the guest if not.

-

If qemu-xen was compiled without SDL support then qemu would - instead start a VNC server listening on ::1 (IPv6 localhost) or - 127.0.0.1 (IPv4 localhost) with IPv6 preferred if available. A VNC - password will not be configured even if one is present in the guest - configuration.

-

qemu-xen-traditional will never start a vnc backend unless - explicitly configured. However by default it will start an SDL - backend if it was built with SDL support and $DISPLAY is valid.

-
- - - - CVE-2015-2152 - http://xenbits.xen.org/xsa/advisory-119.html - - - 2015-03-13 - 2015-07-11 - - - - - xen-kernel -- arm: vgic: incorrect rate limiting of guest triggered logging - - - xen-kernel - 4.44.5.0_3 - - - - -

The Xen Project reports:

-
-

On ARM systems the code which deals with virtualizing the GIC - distributor would, under various circumstances, log messages on a - guest accessible code path without appropriate rate limiting.

-

A malicious guest could cause repeated logging to the hypervisor - console, leading to a Denial of Service attack.

-
- - - - CVE-2015-1563 - http://xenbits.xen.org/xsa/advisory-118.html - - - 2015-01-29 - 2015-07-11 - - - - - xen-kernel -- arm: vgic-v2: GICD_SGIR is not properly emulated - - - xen-kernel - 4.54.5.0_3 - - - - -

The Xen Project reports:

-
-

When decoding a guest write to a specific register in the virtual - interrupt controller Xen would treat an invalid value as a critical - error and crash the host.

-

By writing an invalid value to the GICD.SGIR register a guest can - crash the host, resulting in a Denial of Service attack.

-
- - - - CVE-2015-0268 - http://xenbits.xen.org/xsa/advisory-117.html - - - 2015-02-12 - 2015-07-11 - - - - - pivotx -- Multiple unrestricted file upload vulnerabilities - - - pivotx - 2.3.9 - - - - -

Pivotx reports:

-
-

Multiple unrestricted file upload vulnerabilities in fileupload.php - in PivotX before 2.3.9 allow remote authenticated users to execute - arbitrary PHP code by uploading a file with a (1) .php or (2) .php# - extension, and then accessing it via unspecified vectors.

-
- - - - CVE-2014-0341 - - - 2014-04-15 - 2015-07-11 - - - - - pivotx -- cross-site scripting (XSS) vulnerability - - - pivotx - 2.3.9 - - - - -

pivotx reports:

-
-

cross-site scripting (XSS) vulnerability in the nickname (and - possibly the email) field. Mitigated by the fact that an attacker - must have a PivotX account.

-
- - - - CVE-2014-0341 - - - 2014-04-15 - 2015-07-11 - - - - - wpa_supplicant -- WPS_NFC option payload length validation vulnerability - - - wpa_supplicant - 2.4_4 - - - - -

Jouni Malinen reports:

-
-

Incomplete WPS and P2P NFC NDEF record payload length - validation. (2015-5)

-
- - - - CVE-2015-8041 - http://w1.fi/security/2015-5/incomplete-wps-and-p2p-nfc-ndef-record-payload-length-validation.txt - - - 2015-07-08 - 2015-07-09 - 2015-11-10 - - - - - openssl -- alternate chains certificate forgery vulnerability - - - openssl - 1.0.2_21.0.2_4 - - - mingw32-openssl - 1.0.2b1.0.2d - - - - -

OpenSSL reports:

-
-

During certificate verification, OpenSSL (starting from version - 1.0.1n and 1.0.2b) will attempt to find an alternative certificate - chain if the first attempt to build such a chain fails. An error - in the implementation of this logic can mean that an attacker could - cause certain checks on untrusted certificates to be bypassed, - such as the CA flag, enabling them to use a valid leaf certificate - to act as a CA and "issue" an invalid certificate.

-
- - - - CVE-2015-1793 - https://www.openssl.org/news/secadv_20150709.txt - - - 2015-07-09 - 2015-07-09 - - - - - django -- multiple vulnerabilities - - - py27-django - 1.4.01.4.21 - - - py32-django - 1.4.01.4.21 - - - py33-django - 1.4.01.4.21 - - - py34-django - 1.4.01.4.21 - - - py27-django - 1.7.01.7.9 - - - py32-django - 1.7.01.7.9 - - - py33-django - 1.7.01.7.9 - - - py34-django - 1.7.01.7.9 - - - py27-django - 1.8.01.8.3 - - - py32-django - 1.8.01.8.3 - - - py33-django - 1.8.01.8.3 - - - py34-django - 1.8.01.8.3 - - - py27-django-devel - 20150531,1 - - - py32-django-devel - 20150531,1 - - - py33-django-devel - 20150531,1 - - - py34-django-devel - 20150531,1 - - - - -

Tim Graham reports:

-
-

In accordance with our security release policy, the Django - team is issuing multiple releases -- Django 1.4.21, 1.7.9, and 1.8.3. - These releases are now available on PyPI and our download page. These - releases address several security issues detailed below. We encourage - all users of Django to upgrade as soon as possible. The Django master - branch has also been updated.

-
- - - - https://www.djangoproject.com/weblog/2015/jul/08/security-releases/ - https://github.com/django/django/commit/df049ed77a4db67e45db5679bfc76a85d2a26680 - https://github.com/django/django/commit/014247ad1922931a2f17beaf6249247298e9dc44 - https://github.com/django/django/commit/17d3a6d8044752f482453f5906026eaf12c39e8e - CVE-2015-5143 - CVE-2015-5144 - CVE-2015-5145 - - - 2015-06-10 - 2015-07-09 - - - - - Adobe Flash Player -- critical vulnerabilities - - - linux-c6-flashplugin - 11.2r202.481 - - - linux-f10-flashplugin - 11.2r202.481 - - - - -

Adobe reports:

-
-

- Adobe has released security updates for Adobe Flash Player. These - updates address critical vulnerabilities that could potentially - allow an attacker to take control of the affected system. Adobe is - aware of a report that an exploit targeting CVE-2015-5119 has been - publicly published. -

-
- - - - https://helpx.adobe.com/security/products/flash-player/apsb15-16.html - CVE-2015-5119 - - - 2015-07-07 - 2015-07-08 - - - - - bind -- denial of service vulnerability - - - bind910 - 9.10.2P2 - - - bind99 - 9.9.7P1 - - - bind910-base - bind99-base - 0 - - - FreeBSD - 9.39.3_19 - 8.48.4_33 - - - - -

ISC reports:

-
-

A very uncommon combination of zone data has been found - that triggers a bug in BIND, with the result that named - will exit with a "REQUIRE" failure in name.c when validating - the data returned in answer to a recursive query.

-

A recursive resolver that is performing DNSSEC validation - can be deliberately terminated by any attacker who can - cause a query to be performed against a maliciously - constructed zone. This will result in a denial of - service to clients who rely on that resolver.

-
- - - - SA-15:11.bind - CVE-2015-4620 - https://kb.isc.org/article/AA-01267/ - - - 2015-07-07 - 2015-07-07 - 2016-08-09 - - - - - haproxy -- information leak vulnerability - - - haproxy - 1.5.01.5.14 - - - - -

HAProxy reports:

-
-

A vulnerability was found when HTTP pipelining is used. In - some cases, a client might be able to cause a buffer alignment issue and - retrieve uninitialized memory contents that exhibit data from a past - request or session. I want to address sincere congratulations to Charlie - Smurthwaite of aTech Media for the really detailed traces he provided - which made it possible to find the cause of this bug. Every user of - 1.5-dev, 1.5.x or 1.6-dev must upgrade to 1.5.14 or latest 1.6-dev - snapshot to fix this issue, or use the backport of the fix provided by - their operating system vendors. CVE-2015-3281 was assigned to this bug.

-
- - - - http://www.haproxy.org/news.html - http://git.haproxy.org/?p=haproxy-1.5.git;a=commit;h=7ec765568883b2d4e5a2796adbeb492a22ec9bd4 - http://seclists.org/oss-sec/2015/q3/61 - CVE-2015-3281 - - - 2015-07-02 - 2015-07-07 - - - - - roundcube -- multiple vulnerabilities - - - roundcube - 1.1.0,11.1.2,1 - 1.0.6,1 - - - - -

Roundcube reports:

-
-

We just published updates to both stable versions 1.0 and - 1.1 after fixing many minor bugs and adding some security improvements - to the 1.1 release branch. Version 1.0.6 comes with cherry-picked fixes - from the more recent version to ensure proper long term support - especially in regards of security and compatibility.
-
- The security-related fixes in particular are:
-
- * XSS vulnerability in _mbox argument
- * security improvement in contact photo handling
- * potential info disclosure from temp directory

-
- - - - CVE-2015-5381 - CVE-2015-5383 - http://openwall.com/lists/oss-security/2015/07/06/10 - https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released/ - - - 2015-05-30 - 2015-07-07 - - - - - turnserver -- SQL injection vulnerability - - - turnserver - 4.4.5.3 - - - - -

Oleg Moskalenko reports:

-
-

SQL injection security hole fixed.

-
- - - - http://turnserver.open-sys.org/downloads/v4.4.5.3/ChangeLog - https://groups.google.com/d/msg/turn-server-project-rfc5766-turn-server/Dj3MmgyZX1o/ZaFo3zvxIw0J - - - 2015-06-20 - 2015-07-02 - - - - - squid -- Improper Protection of Alternate Path with CONNECT requests - - - squid - 3.5.6 - - - - -

Squid security advisory 2015:2 reports:

-
-

Squid configured with cache_peer and operating on explicit proxy - traffic does not correctly handle CONNECT method peer responses.

-

The bug is important because it allows remote clients to bypass - security in an explicit gateway proxy.

-

However, the bug is exploitable only if you have configured - cache_peer to receive CONNECT requests.

-
- - - - http://www.squid-cache.org/Advisories/SQUID-2015_2.txt - CVE-2015-5400 - - - 2015-07-06 - 2015-07-06 - 2015-07-17 - - - - - squid -- client-first SSL-bump does not correctly validate X509 server certificate - - - squid - 3.53.5.4 - 3.43.4.13 - - - squid33 - 3.33.3.14 - - - squid32 - 3.23.2.14 - - - - -

Squid security advisory 2015:1 reports:

-
-

Squid configured with client-first SSL-bump does not correctly - validate X509 server certificate domain / hostname fields.

-

The bug is important because it allows remote servers to bypass - client certificate validation. Some attackers may also be able - to use valid certificates for one domain signed by a global - Certificate Authority to abuse an unrelated domain.

-

However, the bug is exploitable only if you have configured - Squid to perform SSL Bumping with the "client-first" or "bump" - mode of operation.

-

Sites that do not use SSL-Bump are not vulnerable.

-

All Squid built without SSL support are not vulnerable to the - problem.

-
-

The FreeBSD port does not use SSL by default and is not vulnerable - in the default configuration.

- - - - CVE-2015-3455 - http://www.squid-cache.org/Advisories/SQUID-2015_1.txt - - - 2015-05-01 - 2015-07-06 - - - - - ansible -- multiple vulnerabilities - - - ansible - 1.9.2 - - - - -

Ansible, Inc. reports:

-
-

Ensure that hostnames match certificate names when using HTTPS - - resolved in Ansible 1.9.2

-

Improper symlink handling in zone, jail, and chroot connection - plugins could lead to escape from confined environment - resolved - in Ansible 1.9.2

-
- - - - CVE-2015-3908 - CVE-2015-6240 - http://www.ansible.com/security - https://raw.githubusercontent.com/ansible/ansible/v1.9.2-1/CHANGELOG.md - - - 2015-06-25 - 2015-07-02 - 2015-08-18 - - - - - ansible -- multiple vulnerabilities - - - ansible - 1.7 - - - - -

Ansible, Inc. reports:

-
-

Arbitrary execution from data from compromised remote hosts or - local data when using a legacy Ansible syntax - resolved in - Ansible 1.7

-

ansible-galaxy command when used on local tarballs (and not - galaxy.ansible.com) can install a malformed tarball if so provided - - resolved in Ansible 1.7

-
- - - - http://www.ansible.com/security - https://raw.githubusercontent.com/ansible/ansible/devel/CHANGELOG.md - - - 2014-08-06 - 2015-07-02 - - - - - ansible -- code execution from compromised remote host data or untrusted local data - - - ansible - 1.6.7 - - - - -

Ansible, Inc. reports:

-
-

Arbitrary execution from data from compromised remote hosts or - untrusted local data - resolved in Ansible 1.6.7

-
- - - - CVE-2014-4966 - 68794 - http://www.ansible.com/security - https://raw.githubusercontent.com/ansible/ansible/devel/CHANGELOG.md - - - 2014-07-21 - 2015-07-02 - - - - - ansible -- remote code execution vulnerability - - - ansible - 1.6.4 - - - - -

Ansible, Inc. reports:

-
-

Incomplete Fix Remote Code Execution Vulnerability - Fixed in - Ansible 1.6.4

-
- - - - CVE-2014-4678 - 68335 - http://www.ansible.com/security - https://raw.githubusercontent.com/ansible/ansible/devel/CHANGELOG.md - - - 2014-06-25 - 2015-07-02 - - - - - ansible -- local symlink exploits - - - ansible - 1.2.3 - - - - -

MITRE reports:

-
-

runner/connection_plugins/ssh.py in Ansible before 1.2.3, when - using ControlPersist, allows local users to redirect a ssh session - via a symlink attack on a socket file with a predictable name in - /tmp/.

-
-
-

lib/ansible/playbook/__init__.py in Ansible 1.2.x before 1.2.3, - when playbook does not run due to an error, allows local users to - overwrite arbitrary files via a symlink attack on a retry file with - a predictable name in /var/tmp/ansible/.

-
- - - - CVE-2013-4259 - CVE-2013-4260 - http://www.ansible.com/security - https://groups.google.com/forum/#!topic/ansible-project/UVDYW0HGcNg - - - 2013-08-21 - 2015-07-02 - - - - - ansible -- enable host key checking in paramiko connection type - - - ansible - 1.2.1 - - - - -

Ansible changelog reports:

-
-

Host key checking is on by default. Disable it if you like by - adding host_key_checking=False in the [default] section of - /etc/ansible/ansible.cfg or ~/ansible.cfg or by exporting - ANSIBLE_HOST_KEY_CHECKING=False.

-
- - - - CVE-2013-2233 - https://raw.githubusercontent.com/ansible/ansible/devel/CHANGELOG.md - http://www.ansible.com/security - https://github.com/ansible/ansible/issues/857 - - - 2012-08-13 - 2015-07-02 - - - - - bitcoin -- denial of service - - - bitcoin - 0.10.2 - - - - -

Gregory Maxwell reports:

-
-

On July 7th I will be making public details of several - serious denial of service vulnerabilities which have fixed in recent - versions of Bitcoin Core, including including CVE-2015-3641. - - I strongly recommend anyone running production nodes exposed to inbound - connections from the internet upgrade to 0.10.2 as soon as possible.

-
- - - - CVE-2015-3641 - http://bitcoin-development.narkive.com/tO8M0R0j/upcoming-dos-vulnerability-announcements-for-bitcoin-core - https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures - - - 2015-06-27 - 2015-07-06 - - - - - node, iojs, and v8 -- denial of service - - - node - 0.12.6 - - - node-devel - 0.12.6 - - - iojs - 2.3.3 - - - v8 - 3.18.5 - - - v8-devel - 3.27.7_2 - - - - -

node reports:

-
-

This release of Node.js fixes a bug that triggers an - out-of-band write in V8's utf-8 decoder. This bug impacts all Buffer to - String conversions. This is an important security update as this bug can - be used to cause a denial of service attack.

-
- - - - http://blog.nodejs.org/2015/07/03/node-v0-12-6-stable/ - https://github.com/joyent/node/commit/78b0e30954111cfaba0edbeee85450d8cbc6fdf6 - https://github.com/nodejs/io.js/commit/030f8045c706a8c3925ec7cb3184fdfae4ba8676 - https://codereview.chromium.org/1226493003 - CVE-2015-5380 - - - 2015-07-03 - 2015-07-06 - 2015-07-10 - - - - - cups-filters -- texttopdf integer overflow - - - cups-filters - 1.0.71 - - - - -

Stefan Cornelius from Red Hat reports:

-
-

An integer overflow flaw leading to a heap-based buffer overflow was - discovered in the way the texttopdf utility of cups-filter processed - print jobs with a specially crafted line size. An attacker being able - to submit print jobs could exploit this flaw to crash texttopdf or, - possibly, execute arbitrary code with the privileges of the 'lp' user.

-
-

Tim Waugh reports:

-
-

The Page allocation is moved into textcommon.c, where it does all the - necessary checking: lower-bounds for CVE-2015-3258 and upper-bounds - for CVE-2015-3259 due to integer overflows for the calloc() call - initializing Page[0] and the memset() call in texttopdf.c's - WritePage() function zeroing the entire array.

-
- - - - CVE-2015-3279 - https://access.redhat.com/security/cve/CVE-2015-3279 - http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7365 - http://osdir.com/ml/opensource-software-security/2015-07/msg00021.html - - - 2015-07-03 - 2015-07-03 - 2015-07-07 - - - - - libxml2 -- Enforce the reader to run in constant memory - - - libxml2 - 2.9.2_3 - - - linux-c6-libxml2 - 2.7.6_5 - - - linux-f10-libxml2 - * - - - - -

Daniel Veilland reports:

-
-

Enforce the reader to run in constant memory. One of the - operation on the reader could resolve entities leading to - the classic expansion issue. Make sure the buffer used for - xmlreader operation is bounded. Introduce a new allocation - type for the buffers for this effect.

-
- - - - CVE-2015-1819 - https://git.gnome.org/browse/libxml2/commit/?id=213f1fe0d76d30eaed6e5853057defc43e6df2c9 - - - 2015-04-14 - 2015-07-01 - 2016-01-31 - - - - - wesnoth -- disclosure of .pbl files with lowercase, uppercase, and mixed-case extension - - - wesnoth - 1.12.4,1 - - - - -

Ignacio R. Morelle reports:

-
-

As mentioned in the Wesnoth 1.12.4 and Wesnoth 1.13.1 release - announcements, a security vulnerability targeting add-on authors - was found (bug #23504) which allowed a malicious user to obtain - add-on server passphrases from the client's .pbl files and transmit - them over the network, or store them in saved game files intended - to be shared by the victim. This vulnerability affects all existing - releases up to and including versions 1.12.2 and 1.13.0. - Additionally, version 1.12.3 included only a partial fix that failed - to guard users against attempts to read from .pbl files with an - uppercase or mixed-case extension. CVE-2015-5069 and CVE-2015-5070 - have been assigned to the vulnerability affecting .pbl files with a - lowercase extension, and .pbl files with an uppercase or mixed-case - extension, respectively.

-
- - - - CVE-2015-5069 - CVE-2015-5070 - http://forums.wesnoth.org/viewtopic.php?t=42776 - http://forums.wesnoth.org/viewtopic.php?t=42775 - - - 2015-06-28 - 2015-07-01 - - - - - cups-filters -- buffer overflow in texttopdf size allocation - - - cups-filters - 1.0.70 - - - - -

Stefan Cornelius from Red Hat reports:

-
-

A heap-based buffer overflow was discovered in the way the - texttopdf utility of cups-filters processed print jobs with a - specially crafted line size. An attacker being able to submit - print jobs could exploit this flaw to crash texttopdf or, - possibly, execute arbitrary code.

-
-

Till Kamppeter reports:

-
-

texttopdf: Fixed buffer overflow on size allocation of texttopdf - when working with extremely small line sizes, which causes the size - calculation to result in 0 (CVE-2015-3258, thanks to Stefan - Cornelius from Red Hat for the patch).

-
- - - - CVE-2015-3258 - http://www.openwall.com/lists/oss-security/2015/06/26/4 - http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7363 - - - 2015-06-26 - 2015-06-29 - - - - - ntp -- control message remote Denial of Service vulnerability - - - ntp - 4.2.8p3 - - - ntp-devel - 4.3.25 - - - - -

ntp.org reports:

-
-

Under limited and specific circumstances an attacker can send a - crafted packet to cause a vulnerable ntpd instance to crash. - This requires each of the following to be true:

-
    -
  • ntpd set up to allow for remote configuration (not - allowed by default), and
    • -
  • knowledge of the configuration password, and
    • -
  • access to a computer entrusted to perform remote - configuration.
    • -
-
- - - - http://bugs.ntp.org/show_bug.cgi?id=2853 - https://www.kb.cert.org/vuls/id/668167 - http://support.ntp.org/bin/view/Main/SecurityNotice#June_2015_NTP_Security_Vulnerabi - - - 2015-06-29 - 2015-06-30 - - - - - qemu -- Heap overflow in QEMU PCNET controller, allowing guest to host escape (CVE-2015-3209) - - - qemu - qemu-devel - 0.11.1_20 - 0.122.3.0_2 - - - qemu-sbruno - 2.3.50.g20150618_1 - - - xen-tools - 4.5.0_6 - - - - -

The QEMU security team reports:

-
-

A guest which has access to an emulated PCNET network - device (e.g. with "model=pcnet" in their VIF configuration) - can exploit this vulnerability to take over the qemu - process elevating its privilege to that of the qemu - process.

-
- - - - http://xenbits.xen.org/xsa/advisory-135.html - CVE-2015-3209 - - - 2015-04-10 - 2015-06-26 - 2015-07-11 - - - - - elasticsearch -- security fix for shared file-system repositories - - - elasticsearch - 1.0.01.6.0 - - - - -

Elastic reports:

-
-

Vulnerability Summary: All Elasticsearch versions from 1.0.0 to - 1.5.2 are vulnerable to an attack that uses Elasticsearch to modify - files read and executed by certain other applications.

-

Remediation Summary: Users should upgrade to 1.6.0. Alternately, - ensure that other applications are not present on the system, or - that Elasticsearch cannot write into areas where these applications - would read.

-
- - - - CVE-2015-4165 - ports/201008 - https://www.elastic.co/community/security - https://www.elastic.co/blog/elasticsearch-1-6-0-released - - - 2015-06-09 - 2015-06-26 - - - - - elasticsearch -- directory traversal attack with site plugins - - - elasticsearch - 1.4.5 - 1.5.01.5.2 - - - - -

Elastic reports:

-
-

Vulnerability Summary: All Elasticsearch versions prior to 1.5.2 - and 1.4.5 are vulnerable to a directory traversal attack that allows - an attacker to retrieve files from the server running Elasticsearch - when one or more site plugins are installed, or when Windows is the - server OS.

-

Remediation Summary: Users should upgrade to 1.4.5 or 1.5.2. Users - that do not want to upgrade can address the vulnerability by - disabling site plugins. See the CVE description for additional - options.

-
- - - - CVE-2015-3337 - 74353 - https://www.elastic.co/community/security - https://www.elastic.co/blog/elasticsearch-1-5-2-and-1-4-5-released - https://www.exploit-db.com/exploits/37054/ - https://packetstormsecurity.com/files/131646/Elasticsearch-Directory-Traversal.html - http://www.securityfocus.com/archive/1/535385 - - - 2015-04-27 - 2015-06-26 - - - - - elasticsearch -- remote OS command execution via Groovy scripting engine - - - elasticsearch - 1.3.01.3.8 - 1.4.01.4.3 - - - - -

Elastic reports:

-
-

Vulnerability Summary: Elasticsearch versions 1.3.0-1.3.7 and - 1.4.0-1.4.2 have vulnerabilities in the Groovy scripting engine that - were introduced in 1.3.0. The vulnerability allows an attacker to - construct Groovy scripts that escape the sandbox and execute shell - commands as the user running the Elasticsearch Java VM.

-

Remediation Summary: Users should upgrade to 1.3.8 or 1.4.3. Users - that do not want to upgrade can address the vulnerability by setting - script.groovy.sandbox.enabled to false in elasticsearch.yml and - restarting the node.

-
- - - - CVE-2015-1427 - 72585 - https://www.elastic.co/community/security - https://www.elastic.co/blog/elasticsearch-1-4-3-and-1-3-8-released - http://www.securityfocus.com/archive/1/archive/1/534689/100/0/threaded - https://packetstormsecurity.com/files/130368/Elasticsearch-1.3.7-1.4.2-Sandbox-Escape-Command-Execution.html - https://packetstormsecurity.com/files/130784/ElasticSearch-Unauthenticated-Remote-Code-Execution.html - - - 2015-02-11 - 2015-06-26 - - - - - elasticsearch -- cross site scripting vulnerability in the CORS functionality - - - elasticsearch - 1.4.0 - - - - -

Elastic reports:

-
-

Vulnerability Summary: Elasticsearch versions 1.3.x and prior have - a default configuration for CORS that allows an attacker to craft - links that could cause a user's browser to send requests to - Elasticsearch instances on their local network. These requests could - cause data loss or compromise.

-

Remediation Summary: Users should either set "http.cors.enabled" to - false, or set "http.cors.allow-origin" to the value of the server - that should be allowed access, such as localhost or a server hosting - Kibana. Disabling CORS entirely with the former setting is more - secure, but may not be suitable for all use cases.

-
- - - - CVE-2014-6439 - 70233 - https://www.elastic.co/community/security - https://www.elastic.co/blog/elasticsearch-1-4-0-beta-released - https://packetstormsecurity.com/files/128556/Elasticsearch-1.3.x-CORS-Issue.html - http://www.securityfocus.com/archive/1/archive/1/533602/100/0/threaded - - - 2014-10-01 - 2015-06-26 - - - - - elasticsearch and logstash -- remote OS command execution via dynamic scripting - - - elasticsearch - 1.2.0 - - - logstash - 1.4.3 - - - - -

Elastic reports:

-
-

Vulnerability Summary: In Elasticsearch versions 1.1.x and prior, - dynamic scripting is enabled by default. This could allow an - attacker to execute OS commands.

-

Remediation Summary: Disable dynamic scripting.

-
-
-

Logstash 1.4.2 was bundled with Elasticsearch 1.1.1, which is - vulnerable to CVE-2014-3120. These binaries are used in - Elasticsearch output specifically when using the node protocol. - Since a node client joins the Elasticsearch cluster, the attackers - could use scripts to execute commands on the host OS using the node - client's URL endpoint. With 1.4.3 release, we are packaging Logstash - with Elasticsearch 1.5.2 binaries which by default disables the - ability to run scripts. This also affects users who are using the - configuration option embedded=>true in the Elasticsearch output - which starts a local embedded Elasticsearch cluster. This is - typically used in development environment and proof of concept - deployments. Regardless of this vulnerability, we strongly recommend - not using embedded in production.

-

Note that users of transport and http protocol are not vulnerable - to this attack.

-
- - - - CVE-2014-3120 - 67731 - https://www.elastic.co/community/security - https://www.elastic.co/blog/elasticsearch-1-2-0-released - https://www.elastic.co/blog/logstash-1-4-3-released - https://www.exploit-db.com/exploits/33370/ - http://bouk.co/blog/elasticsearch-rce/ - http://www.rapid7.com/db/modules/exploit/multi/elasticsearch/script_mvel_rce - https://www.found.no/foundation/elasticsearch-security/#staying-safe-while-developing-with-elasticsearch - - - 2014-05-22 - 2015-06-26 - - - - - logstash -- Directory traversal vulnerability in the file output plugin - - - logstash - 1.4.3 - - - - -

Elastic reports:

-
-

An attacker could use the File output plugin with dynamic field - references in the path option to traverse paths outside of Logstash - directory. This technique could also be used to overwrite any files - which can be accessed with permissions associated with Logstash - user. This release sandboxes the paths which can be traversed using - the configuration. We have also disallowed use of dynamic field - references if the path options is pointing to an absolute path.

-

We have added this vulnerability to our CVE page and are working - on filling out the CVE. We would like to thank Colin Coghill for - reporting the issue and working with us on the resolution.

-
- - - - CVE-2015-4152 - https://www.elastic.co/blog/logstash-1-4-3-released - https://www.elastic.co/community/security - - - 2015-06-09 - 2015-06-24 - - - - - logstash -- Remote command execution in Logstash zabbix and nagios_nsca outputs - - - logstash - 1.4.2 - - - - -

Elastic reports:

-
-

The vulnerability impacts deployments that use the either the - zabbix or the nagios_nsca outputs. In these cases, an attacker - with an ability to send crafted events to any source of data for - Logstash could execute operating system commands with the - permissions of the Logstash process.

-

Deployments that do not use the zabbix or the nagios_nsca outputs - are not vulnerable and do not need to upgrade for this reason.

-

We have added this vulnerability to our CVE page and are working - on filling out the CVE.

-

We would like to thank Jan Karwowski and Danila Borisiuk for - reporting the issue and working with us on the resolution.

-
- - - - CVE-2014-4326 - https://www.elastic.co/blog/logstash-1-4-2 - https://www.elastic.co/community/security - - - 2014-06-24 - 2015-06-24 - - - - - logstash-forwarder and logstash -- susceptibility to POODLE vulnerability - - - logstash-forwarder - 0.4.0.20150507 - - - logstash - 1.4.3 - - - - -

Elastic reports:

-
-

The combination of Logstash Forwarder and Lumberjack input (and - output) was vulnerable to the POODLE attack in SSLv3 protocol. We - have disabled SSLv3 for this combination and set the minimum version - to be TLSv1.0. We have added this vulnerability to our CVE page and - are working on filling out the CVE.

-

Thanks to Tray Torrance, Marc Chadwick, and David Arena for - reporting this.

-
-
-

SSLv3 is no longer supported; TLS 1.0+ is required (compatible - with Logstash 1.4.2+).

-
- - - - - ports/201065 - ports/201065 - https://www.elastic.co/blog/logstash-1-4-3-released - https://www.elastic.co/blog/logstash-forwarder-0-4-0-released - - - 2015-06-09 - 2015-06-24 - 2015-06-24 - - - - - Adobe Flash Player -- critical vulnerabilities - - - linux-c6-flashplugin - 11.2r202.466 - - - linux-f10-flashplugin - 11.2r202.466 - - - - -

Adobe reports:

-
-

- Adobe has released security updates for Adobe Flash Player for - Windows, Macintosh and Linux. These updates address a critical - vulnerability (CVE-2015-3113) that could potentially allow an - attacker to take control of the affected system. -

-

- Adobe is aware of reports that CVE-2015-3113 is being actively - exploited in the wild via limited, targeted attacks. Systems running - Internet Explorer for Windows 7 and below, as well as Firefox on - Windows XP, are known targets. -

-
- - - - https://helpx.adobe.com/security/products/flash-player/apsb15-14.html - CVE-2015-3113 - - - 2015-06-23 - 2015-06-24 - - - - - rubygem-bson -- DoS and possible injection - - - rubygem-bson - 3.0.4 - - - - -

Phill MV reports:

-
-

By submitting a specially crafted string to a service relying on - the bson rubygem, an attacker may trigger denials of service or even - inject data into victim's MongoDB instances.

-
- - - - CVE-2015-4412 - http://www.openwall.com/lists/oss-security/2015/06/06/1 - http://sakurity.com/blog/2015/06/04/mongo_ruby_regexp.html - https://github.com/mongodb/bson-ruby/commit/976da329ff03ecdfca3030eb6efe3c85e6db9999 - - - 2015-06-04 - 2015-06-23 - - - - - php5 -- multiple vulnerabilities - - - php5-dom - php5-ftp - php5-gd - php5-pgsql - 5.4.42 - - - php55-dom - php55-ftp - php55-gd - php55-pgsql - 5.5.26 - - - php56-dom - php56-ftp - php56-gd - php56-psql - 5.6.10 - - - - -

The PHP project reports:

-
-

DOM and GD:

-
    -
  • Fixed bug #69719 (Incorrect handling of paths with NULs).
    • -
-

FTP:

-
    -
  • Improved fix for bug #69545 (Integer overflow in ftp_genlist() - resulting in heap overflow). (CVE-2015-4643)
    • -
-

Postgres:

-
    -
  • Fixed bug #69667 (segfault in php_pgsql_meta_data). - (CVE-2015-4644)
    • -
-
- - - - CVE-2015-4643 - CVE-2015-4644 - http://www.php.net/ChangeLog-5.php#5.4.42 - http://www.php.net/ChangeLog-5.php#5.5.26 - http://www.php.net/ChangeLog-5.php#5.6.10 - http://openwall.com/lists/oss-security/2015/06/18/3 - - - 2015-06-11 - 2015-06-23 - - - - - devel/ipython -- remote execution - - - ipython - 3.2.0 - - - - -

Kyle Kelley reports:

-
-

Summary: JSON error responses from the IPython notebook REST API - contained URL parameters and were incorrectly reported as text/html - instead of application/json. The error messages included some of these - URL params, resulting in a cross site scripting attack. This affects - users on Mozilla Firefox but not Chromium/Google Chrome.

-

API paths with issues:

-
    -
  • /api/contents (3.0-3.1)
    • -
  • /api/notebooks (2.0-2.4, 3.0-3.1)
    • -
-
- - - - CVE-2015-4706 - CVE-2015-4707 - http://seclists.org/oss-sec/2015/q2/779 - - - 2015-06-22 - 2015-06-22 - - - - - www/chromium -- multiple vulnerabilities - - - chromium - 43.0.2357.130 - - - - chromium-npapi - 43.0.2357.130 - - - - chromium-pulse - 43.0.2357.130 - - - - -

Google Chrome Releases reports:

-
-

4 security fixes in this release:

-
    -
  • [464922] High CVE-2015-1266: Scheme validation error in WebUI. - Credit to anonymous.
    • -
  • [494640] High CVE-2015-1268: Cross-origin bypass in Blink. - Credit to Mariusz Mlynski.
    • -
  • [497507] Medium CVE-2015-1267: Cross-origin bypass in Blink. - Credit to anonymous.
    • -
  • [461481] Medium CVE-2015-1269: Normalization error in HSTS/HPKP - preload list. Credit to Mike Ruddy.
    • -
-
- - - - CVE-2015-1266 - CVE-2015-1267 - CVE-2015-1268 - CVE-2015-1269 - http://googlechromereleases.blogspot.nl/2015/06/chrome-stable-update.html - - - 2015-06-22 - 2015-06-22 - - - - - rubygem-paperclip -- validation bypass vulnerability - - - rubygem-paperclip - 4.2.2 - - - - -

Jon Yurek reports:

-
-

Thanks to MORI Shingo of DeNA Co., Ltd. for reporting this.

-

There is an issue where if an HTML file is uploaded with a .html - extension, but the content type is listed as being `image/jpeg`, - this will bypass a validation checking for images. But it will also - pass the spoof check, because a file named .html and containing - actual HTML passes the spoof check.

-

This change makes it so that we also check the supplied content - type. So even if the file contains HTML and ends with .html, it - doesn't match the content type of `image/jpeg` and so it fails.

-
- - - - CVE-2015-2963 - https://github.com/thoughtbot/paperclip/commit/9aee4112f36058cd28d5fe4a006d6981bd1eda57 - https://robots.thoughtbot.com/paperclip-security-release - http://jvn.jp/en/jp/JVN83881261/index.html - - - 2015-06-05 - 2015-06-22 - - - - - chicken -- Potential buffer overrun in string-translate* - - - chicken - 4.10.0.r2,1 - - - - -

chicken developer Peter Bex reports:

-
-

Using gcc's Address Sanitizer, it was discovered that the string-translate* - procedure from the data-structures unit can scan beyond the input string's - length up to the length of the source strings in the map that's passed to - string-translate*. This issue was fixed in master 8a46020, and it will - make its way into CHICKEN 4.10.

-

This bug is present in all released versions of CHICKEN.

-
- - - - CVE-2015-4556 - ports/200980 - http://lists.nongnu.org/archive/html/chicken-announce/2015-06/msg00010.html - http://lists.nongnu.org/archive/html/chicken-hackers/2015-06/msg00037.html - http://lists.nongnu.org/archive/html/chicken-announce/2015-07/msg00001.html - - - 2015-06-15 - 2015-06-22 - 2015-07-31 - - - - - chicken -- buffer overrun in substring-index[-ci] - - - chicken - 4.10.0.r1,1 - - - - -

chicken developer Moritz Heidkamp reports:

-
-

The substring-index[-ci] procedures of the data-structures unit are - vulnerable to a buffer overrun attack when passed an integer greater - than zero as the optional START argument.

-

As a work-around you can switch to SRFI 13's - string-contains procedure which also returns the substring's index in - case it is found.

-
- - - - CVE-2014-9651 - http://lists.gnu.org/archive/html/chicken-users/2015-01/msg00048.html - http://lists.nongnu.org/archive/html/chicken-hackers/2014-12/txt2UqAS9CtvH.txt - - - 2015-01-12 - 2015-06-22 - 2015-06-23 - - - - - cacti -- Multiple XSS and SQL injection vulnerabilities - - - cacti - 0.8.8d - - - - -

The Cacti Group, Inc. reports:

-
-

Important Security Fixes

-
    -
  • Multiple XSS and SQL injection vulnerabilities
    • -
-

Changelog

-
    -
  • bug: Fixed SQL injection VN: JVN#78187936 / - TN:JPCERT#98968540
    • -
  • bug#0002542: [FG-VD-15-017] Cacti Cross-Site Scripting - Vulnerability Notification
    • -
  • bug#0002571: SQL Injection and Location header injection from - cdef id CVE-2015-4342
    • -
  • bug#0002572: SQL injection in graph template
    • -
-
- - - - CVE-2015-4342 - ports/200963 - http://www.cacti.net/release_notes_0_8_8d.php - http://seclists.org/fulldisclosure/2015/Jun/19 - - - 2015-06-09 - 2015-06-21 - - - - - cacti -- multiple security vulnerabilities - - - cacti - 0.8.8c - - - - -

The Cacti Group, Inc. reports:

-
-

Important Security Fixes

-
    -
  • CVE-2013-5588 - XSS issue via installer or device editing
    • -
  • CVE-2013-5589 - SQL injection vulnerability in device editing
    • -
  • CVE-2014-2326 - XSS issue via CDEF editing
    • -
  • CVE-2014-2327 - Cross-site request forgery (CSRF) vulnerability
    • -
  • CVE-2014-2328 - Remote Command Execution Vulnerability in graph export
    • -
  • CVE-2014-4002 - XSS issues in multiple files
    • -
  • CVE-2014-5025 - XSS issue via data source editing
    • -
  • CVE-2014-5026 - XSS issues in multiple files
    • -
-
- - - - CVE-2013-5588 - CVE-2013-5589 - CVE-2014-2326 - CVE-2014-2327 - CVE-2014-2328 - CVE-2014-4002 - CVE-2014-5025 - CVE-2014-5026 - ports/198586 - http://sourceforge.net/p/cacti/mailman/message/33072838/ - http://www.cacti.net/release_notes_0_8_8c.php - - - 2014-11-23 - 2015-06-21 - - - - - p5-Dancer -- possible to abuse session cookie values - - - p5-Dancer - 1.3138 - - - - -

Russell Jenkins reports:

-
-

It was possible to abuse session cookie values so that - file-based session stores such as Dancer::Session::YAML or - Dancer2::Session::YAML would attempt to read/write from - any file on the filesystem with the same extension the - file-based store uses, such as '*.yml' for the YAML - stores.

-
- - - - http://lists.preshweb.co.uk/pipermail/dancer-users/2015-June/004621.html - - - 2015-06-12 - 2015-06-20 - - - - - drupal -- multiple vulnerabilities - - - drupal6 - 6.36 - - - drupal7 - 7.38 - - - - -

Drupal development team reports:

-
-

Impersonation (OpenID module - Drupal 6 and 7 - Critical)

-

A vulnerability was found in the OpenID module that allows - a malicious user to log in as other users on the site, - including administrators, and hijack their accounts.

-

This vulnerability is mitigated by the fact that the victim - must have an account with an associated OpenID identity from - a particular set of OpenID providers (including, but not - limited to, Verisign, LiveJournal, or StackExchange).

-

Open redirect (Field UI module - Drupal 7 - Less critical)

-

The Field UI module uses a "destinations" query string parameter - in URLs to redirect users to new destinations after completing - an action on a few administration pages. Under certain - circumstances, malicious users can use this parameter to - construct a URL that will trick users into being redirected - to a 3rd party website, thereby exposing the users to potential - social engineering attacks.

-

This vulnerability is mitigated by the fact that only sites - with the Field UI module enabled are affected.

-

Drupal 6 core is not affected, but see the similar advisory - for the Drupal 6 contributed CCK module: - SA-CONTRIB-2015-126

-

Open redirect (Overlay module - Drupal 7 - Less critical)

-

The Overlay module displays administrative pages as a layer - over the current page (using JavaScript), rather than replacing - the page in the browser window. The Overlay module does not - sufficiently validate URLs prior to displaying their contents, - leading to an open redirect vulnerability.

-

This vulnerability is mitigated by the fact that it can only - be used against site users who have the "Access the administrative - overlay" permission, and that the Overlay module must be enabled.

-

Information disclosure (Render cache system - Drupal 7 - - Less critical)

-

On sites utilizing Drupal 7's render cache system to cache - content on the site by user role, private content viewed by - user 1 may be included in the cache and exposed to non-privileged - users.

-

This vulnerability is mitigated by the fact that render caching - is not used in Drupal 7 core itself (it requires custom code or - the contributed Render - Cache module to enable) and that it only affects sites that - have user 1 browsing the live site. Exposure is also limited if an - administrative role has been assigned to the user 1 account (which - is done, for example, by the Standard install profile that ships - with Drupal core).

-
- - - - CVE-2015-3231 - CVE-2015-3232 - CVE-2015-3233 - CVE-2015-3234 - https://www.drupal.org/SA-CORE-2015-002 - - - 2015-06-17 - 2015-06-19 - - - - - cURL -- Multiple Vulnerability - - - curl - 7.407.43 - - - - -

cURL reports:

-
-

libcurl can wrongly send HTTP credentials when re-using - connections.

-

libcurl allows applications to set credentials for the - upcoming transfer with HTTP Basic authentication, like - with CURLOPT_USERPWD for example. Name and password. - Just like all other libcurl options the credentials - are sticky and are kept associated with the "handle" - until something is made to change the situation.

-

Further, libcurl offers a curl_easy_reset() function - that resets a handle back to its pristine state in - terms of all settable options. A reset is of course - also supposed to clear the credentials. A reset is - typically used to clear up the handle and prepare - it for a new, possibly unrelated, transfer.

-

Within such a handle, libcurl can also store a - set of previous connections in case a second transfer - is requested to a host name for which an existing - connection is already kept alive.

-

With this flaw present, using the handle even - after a reset would make libcurl accidentally use - those credentials in a subsequent request if done - to the same host name and connection as was - previously accessed.

-

An example case would be first requesting a password - protected resource from one section of a web site, and - then do a second request of a public resource from a - completely different part of the site without - authentication. This flaw would then inadvertently - leak the credentials in the second request.

-
-
-

libcurl can get tricked by a malicious SMB server to - send off data it did not intend to.

-

In libcurl's state machine function handling the SMB - protocol (smb_request_state()), two length and offset - values are extracted from data that has arrived over - the network, and those values are subsequently used - to figure out what data range to send back.

-

The values are used and trusted without boundary - checks and are just assumed to be valid. This allows - carefully handcrafted packages to trick libcurl - into responding and sending off data that was not - intended. Or just crash if the values cause libcurl - to access invalid memory.

-
- - - - CVE-2015-3236 - CVE-2015-3237 - http://curl.haxx.se/docs/adv_20150617A.html - http://curl.haxx.se/docs/adv_20150617B.html - - - 2015-06-17 - 2015-06-17 - - - - - rubygem-rails -- multiple vulnerabilities - - - rubygem-activesupport - 3.2.22 - - - rubygem-activesupport4 - 4.2.2 - - - rubygem-jquery-rails - 3.1.3 - - - rubygem-jquery-rails4 - 4.0.4 - - - rubygem-rack - 1.4.6 - - - rubygem-rack15 - 1.5.4 - - - rubygem-rack16 - 1.6.2 - - - rubygem-rails - 3.2.22 - - - rubygem-rails4 - 4.2.2 - - - rubygem-web-console - 2.1.3 - - - - -

Ruby on Rails blog:

-
-

Rails 3.2.22, 4.1.11 and 4.2.2 have been released, along with web - console and jquery-rails plugins and Rack 1.5.4 and 1.6.2.

-
- - - - CVE-2015-1840 - CVE-2015-3224 - CVE-2015-3225 - CVE-2015-3226 - CVE-2015-3227 - http://weblog.rubyonrails.org/2015/6/16/Rails-3-2-22-4-1-11-and-4-2-2-have-been-released-and-more/ - - - 2015-06-16 - 2015-06-17 - - - - - testdisk -- buffer overflow with malicious disk image - - - testdisk - 7.0 - - - - -

CGSecurity TestDisk Changelog reports:

-
-

Various fix including security fix, thanks to:

-
    -

  • Coverity scan (Static Analysis of source code)

    • -

  • afl-fuzz (security-oriented fuzzer).

    • -

  • Denis Andzakovic from Security Assessment for reporting an - exploitable Stack Buffer Overflow.

    • -
-
-

Denis Andzakovic reports:

-
-

A buffer overflow is triggered within the software when a malicious - disk image is attempted to be recovered. This may be leveraged by an - attacker to crash TestDisk and gain control of program execution. An - attacker would have to coerce the victim to run TestDisk against - their malicious image.

-
- - - - http://www.cgsecurity.org/wiki/TestDisk_7.0_Release - http://www.security-assessment.com/files/documents/advisory/Testdisk%20Check_OS2MB%20Stack%20Buffer%20Overflow%20-%20Release.pdf - - - 2015-04-30 - 2015-06-16 - - - - - tomcat -- multiple vulnerabilities - - - tomcat - 6.0.44 - - - tomcat7 - 7.0.55 - - - tomcat8 - 8.0.9 - - - hadoop2 - 2.6.0 - - - oozie - 4.1.0 - - - - -

Apache Software Foundation reports:

-
-

Low: Denial of Service CVE-2014-0230

-

When a response for a request with a request body is - returned to the user agent before the request body is - fully read, by default Tomcat swallows the remaining - request body so that the next request on the connection - may be processed. There was no limit to the size of - request body that Tomcat would swallow. This permitted - a limited Denial of Service as Tomcat would never close - the connection and a processing thread would remain - allocated to the connection.

-

Moderate: Security Manager bypass CVE-2014-7810

-

Malicious web applications could use expression - language to bypass the protections of a Security - Manager as expressions were evaluated within a - privileged code section.

-
- - - - CVE-2014-0230 - CVE-2014-7810 - https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.44 - - - 2015-05-12 - 2015-06-16 - 2017-03-18 - - - - - security/ossec-hids-* -- root escalation via syscheck feature - - - ossec-hids-server - ossec-hids-client - ossec-hids-local - 2.72.8.2 - - - - -

OSSEC reports:

-
-

The CVE-2015-3222 vulnerability, which allows for root escalation - via sys check has been fixed in OSSEC 2.8.2. This issue does not - affect agents.

-
- - - - CVE-2015-3222 - ports/200801 - http://www.ossec.net/?p=1198 - https://github.com/ossec/ossec-hids/releases/tag/2.8.2 - - - 2015-06-11 - 2015-06-12 - - - - - openssl -- multiple vulnerabilities - - - openssl - 1.0.2_2 - - - mingw32-openssl - 1.0.11.0.2b - - - linux-c6-openssl - 1.0.1e_6 - - - libressl - 2.1.7 - - - FreeBSD - 10.110.1_12 - 9.39.3_16 - 8.48.4_30 - - - - -

The OpenSSL team reports:

-
-
    -
  • Missing DHE man-in-the-middle protection (Logjam) - (CVE-2015-4000)
    • -
  • Malformed ECParameters causes infinite loop (CVE-2015-1788)
    • -
  • Exploitable out-of-bounds read in X509_cmp_time - (CVE-2015-1789)
    • -
  • PKCS#7 crash with missing EnvelopedContent (CVE-2015-1790)
    • -
  • CMS verify infinite loop with unknown hash function - (CVE-2015-1792)
    • -
  • Race condition handling NewSessionTicket (CVE-2015-1791)
    • -
  • Invalid free in DTLS (CVE-2014-8176)
    • -
-
- - - - CVE-2014-8176 - CVE-2015-1788 - CVE-2015-1789 - CVE-2015-1790 - CVE-2015-1791 - CVE-2015-1792 - CVE-2015-4000 - SA-15:10.openssl - https://www.openssl.org/news/secadv_20150611.txt - - - 2015-06-11 - 2015-06-11 - 2016-08-09 - - - - - Adobe Flash Player -- critical vulnerabilities - - - linux-c6-flashplugin - 11.2r202.466 - - - linux-f10-flashplugin - 11.2r202.466 - - - - -

Adobe reports:

-
-

- Adobe has released security updates for Adobe Flash Player for - Windows, Macintosh and Linux. These updates address vulnerabilities - that could potentially allow an attacker to take control of the - affected system. -

-

- These updates resolve a vulnerability (CVE-2015-3096) that could be - exploited to bypass the fix for CVE-2014-5333. -

-

- These updates improve memory address randomization of the Flash heap - for the Window 7 64-bit platform (CVE-2015-3097). -

-

- These updates resolve vulnerabilities that could be exploited to - bypass the same-origin-policy and lead to information disclosure - (CVE-2015-3098, CVE-2015-3099, CVE-2015-3102). -

-

- These updates resolve a stack overflow vulnerability that could lead - to code execution (CVE-2015-3100). -

-

- These updates resolve a permission issue in the Flash broker for - Internet Explorer that could be exploited to perform privilege - escalation from low to medium integrity level (CVE-2015-3101). -

-

- These updates resolve an integer overflow vulnerability that could - lead to code execution (CVE-2015-3104). -

-

- These updates resolve a memory corruption vulnerability that could - lead to code execution (CVE-2015-3105). -

-

- These updates resolve use-after-free vulnerabilities that could lead - to code execution (CVE-2015-3103, CVE-2015-3106, CVE-2015-3107). -

-

- These updates resolve a memory leak vulnerability that could be used - to bypass ASLR (CVE-2015-3108). -

-
- - - - https://helpx.adobe.com/security/products/flash-player/apsb15-11.html - CVE-2015-3096 - CVE-2015-3097 - CVE-2015-3098 - CVE-2015-3099 - CVE-2015-3100 - CVE-2015-3101 - CVE-2015-3102 - CVE-2015-3103 - CVE-2015-3104 - CVE-2015-3105 - CVE-2015-3106 - CVE-2015-3107 - CVE-2015-3108 - - - 2015-06-09 - 2015-06-11 - - - - - libzmq4 -- V3 protocol handler vulnerable to downgrade attacks - - - libzmq4 - 4.0.04.0.6 - 4.1.04.1.1 - - - - -

Pieter Hintjens reports:

-
-

It is easy to bypass the security mechanism in 4.1.0 and 4.0.5 by - sending a ZMTP v2 or earlier header. The library accepts such - connections without applying its security mechanism.

-
- - - - CVE-2014-9721 - https://github.com/zeromq/libzmq/issues/1273 - http://www.openwall.com/lists/oss-security/2015/05/07/8 - ports/200502 - - - 2014-12-04 - 2015-06-10 - 2015-09-28 - - - - - pgbouncer -- remote denial of service - - - pgbouncer - 1.5.5 - - - - -

PgBouncer reports:

-
-

Fix remote crash - invalid packet order causes lookup of NULL pointer. Not - exploitable, just DoS.

-
- - - - CVE-2015-4054 - https://pgbouncer.github.io/2015/04/pgbouncer-1-5-5/ - http://www.openwall.com/lists/oss-security/2015/05/21/2 - ports/200507 - - - 2015-04-08 - 2015-06-10 - 2015-09-28 - - - - - cups -- multiple vulnerabilities - - - cups-base - 2.0.3 - - - - -

CUPS development team reports:

-
-

The new release addresses two security vulnerabilities, - add localizations for German and Russian, and includes - several general bug fixes. Changes include:

-

Security: Fixed CERT VU #810572/CVE-2015-1158/CVE-2015-1159 - exploiting the dynamic linker (STR #4609)

-

Security: The scheduler could hang with malformed - gzip data (STR #4602)

-
- - - - CVE-2015-1158 - CVE-2015-1159 - https://cups.org/blog.php?L1082 - https://www.kb.cert.org/vuls/id/810572 - - - 2015-06-09 - 2015-06-09 - - - - - strongswan -- Denial-of-service and potential remote code execution vulnerability - - - strongswan - 5.2.25.3.1 - - - - -

StrongSwan Project reports

-
-

A denial-of-service and potential remote code execution vulnerability - triggered by crafted IKE messages was discovered in strongSwan. Versions - 5.2.2 and 5.3.0 are affected.

-
- - - - CVE-2015-3991 - https://www.strongswan.org/blog/2015/06/01/strongswan-vulnerability-(cve-2015-3991).html - - - 2015-05-15 - 2015-06-09 - 2015-09-28 - - - - - strongswan -- Information Leak Vulnerability - - - strongswan - 4.3.05.3.2 - - - - -

strongSwan Project reports:

-
-

An information leak vulnerability was fixed that, in certain IKEv2 - setups, allowed rogue servers with a valid certificate accepted by - the client to trick it into disclosing user credentials (even plain - passwords if the client accepts EAP-GTC). This was caused because - constraints against the server's authentication were enforced too - late. All versions since 4.3.0 are affected.

-
- - - - CVE-2015-4171 - http://www.strongswan.org/blog/2015/06/08/strongswan-5.3.2-released.html - - - 2015-06-08 - 2015-06-09 - - - - - redis -- EVAL Lua Sandbox Escape - - - redis - redis-devel - 2.6.02.8.21 - 3.03.0.2 - - - - -

Ben Murphy reports:

-
-

It is possible to break out of the Lua sandbox in - Redis and execute arbitrary code.

-

This shouldn’t pose a threat to users under the - trusted Redis security model where only trusted - users can connect to the database. However, in real - deployments there could be databases that can be - accessed by untrusted users. The main deployments - that are vulnerable are developers machines, places - where redis servers can be reached via SSRF attacks - and cloud hosting.

-
- - - - CVE-2015-4335 - http://benmmurphy.github.io/blog/2015/06/04/redis-eval-lua-sandbox-escape/ - - - 2015-06-04 - 2015-06-08 - - - - - tidy -- heap-buffer-overflow - - - tidy4 - 20000804_3 - - - tidy-devel - 090315.c_2 - - - tidy-lib - 090315.c_2 - - - tidy-html5 - 4.9.31 - - - - -

Geoff McLane reports:

-
-

tidy is affected by a write out of bounds when processing malformed html files.

-

This issue could be abused on server side applications that use php-tidy extension with user input.

-

The issue was confirmed, analyzed, and fixed by the tidy5 maintainer.

-
- - - - https://github.com/htacg/tidy-html5/issues/217 - http://seclists.org/oss-sec/2015/q2/633 - http://seclists.org/oss-sec/2015/q3/116 - CVE-2015-5522 - CVE-2015-5523 - - - 2015-06-03 - 2015-06-08 - 2015-07-15 - - - - - pcre -- multiple vulnerabilities - - - pcre - 8.37_1 - - - - -

Venustech ADLAB reports:

-
-

PCRE library is prone to a vulnerability which leads - to Heap Overflow. During the compilation of a malformed - regular expression, more data is written on the malloced - block than the expected size output by compile_regex.

-
-
-

PCRE library is prone to a vulnerability which leads to - Stack Overflow. Without enough bound checking inside - match(), the stack memory could be overflowed via a - crafted regular expression.

-
- - - - CVE-2015-3210 - CVE-2015-3217 - https://bugs.exim.org/show_bug.cgi?id=1636 - https://bugs.exim.org/show_bug.cgi?id=1638 - - - 2015-05-29 - 2015-06-04 - 2015-06-07 - - - - - hostapd and wpa_supplicant -- multiple vulnerabilities - - - hostapd - 2.4_1 - - - wpa_supplicant - 2.4_3 - - - - -

Jouni Malinen reports:

-
-

WPS UPnP vulnerability with HTTP chunked transfer encoding. (2015-2 - - CVE-2015-4141)

-
-
-

Integer underflow in AP mode WMM Action frame processing. (2015-3 - - CVE-2015-4142)

-
-
-

EAP-pwd missing payload length validation. (2015-4 - CVE-2015-4143, - CVE-2015-4144, CVE-2015-4145, CVE-2015-4146)

-
- - - - http://w1.fi/security/2015-2/wps-upnp-http-chunked-transfer-encoding.txt - http://w1.fi/security/2015-3/integer-underflow-in-ap-mode-wmm-action-frame.txt - http://w1.fi/security/2015-4/eap-pwd-missing-payload-length-validation.txt - CVE-2015-4141 - CVE-2015-4142 - CVE-2015-4143 - CVE-2015-4144 - CVE-2015-4145 - CVE-2015-4146 - http://openwall.com/lists/oss-security/2015/05/31/6 - - - 2015-05-04 - 2015-06-01 - - - - - ffmpeg -- multiple vulnerabilities - - - ffmpeg - ffmpeg0 - 0.7.17,1 - - - - -

Please reference CVE/URL list for details

- - - - CVE-2012-5150 - CVE-2014-4609 - CVE-2014-8541 - CVE-2014-8542 - CVE-2014-8543 - CVE-2014-8545 - CVE-2014-8547 - CVE-2014-8548 - CVE-2014-9316 - CVE-2014-9317 - CVE-2014-9603 - CVE-2015-1872 - https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=c3ece52decafc4923aebe7fd74b274e9ebb1962e - https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=1b291e0466308b341bc2e8c2a49d44862400f014 - https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=b5e661bcd2bb4fe771cb2c1e21215c68e6a17665 - https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=cd3c4d8c55222337b0b59af4ea1fecfb46606e5e - https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=73962e677d871fa0dde5385ee04ea07c048d8864 - https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=7a5590ef4282e19d48d70cba0bc4628c13ec6fd8 - https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=ef32bc8dde52439afd13988f56012a9f4dd55a83 - https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=5b2097626d0e4ccb432d7d8ab040aa8dbde9eb3a - https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=30e8a375901f8802853fd6d478b77a127d208bd6 - https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=cb1db92cca98f963e91f421ee0c84f8866325a73 - https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=fac6f744d8170585f05e098ce9c9f27eeffa818e - https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=75b0cfcf105c8720a47a2ee80a70ba16799d71b7 - https://ffmpeg.org/security.html - - - 2015-03-12 - 2015-06-02 - - - - - avidemux26 -- multiple vulnerabilities in bundled FFmpeg - - - avidemux2 - 2.6.8 - - - avidemux26 - 2.6.8 - - - - -

The Mageia project reports:

-
-

Avidemux is built with a bundled set of FFmpeg libraries. - The bundled FFmpeg version has been updated from 1.2.10 - to 1.2.12 to fix these security issues and other bugs - fixed upstream in FFmpeg.

-
- - - - CVE-2014-9316 - CVE-2014-9317 - CVE-2014-9603 - CVE-2014-9604 - CVE-2015-1872 - CVE-2015-3417 - ports/200507 - http://advisories.mageia.org/MGASA-2015-0233.html - - - 2015-05-18 - 2015-06-01 - 2015-09-28 - - - - - rest-client -- plaintext password disclosure - - - rubygem-rest-client - 1.6.7_1 - - - - -

The open sourced vulnerability database reports:

-
-

REST Client for Ruby contains a flaw that is due to the application - logging password information in plaintext. This may allow a local - attacker to gain access to password information.

-
- - - - CVE-2015-3448 - ports/200504 - https://github.com/rest-client/rest-client/issues/349 - http://osvdb.org/show/osvdb/117461 - - - 2015-01-12 - 2015-05-31 - 2015-09-28 - - - - - rest-client -- session fixation vulnerability - - - rubygem-rest-client - 1.6.7_1 - - - - -

Andy Brody reports:

-
-

When Ruby rest-client processes an HTTP redirection response, - it blindly passes along the values from any Set-Cookie headers to the - redirection target, regardless of domain, path, or expiration.

-
- - - - CVE-2015-1820 - ports/200504 - https://github.com/rest-client/rest-client/issues/369 - - - 2015-03-24 - 2015-05-31 - 2015-09-28 - - - - - cabextract -- directory traversal with UTF-8 symbols in filenames - - - cabextract - 1.6 - - - - -

Cabextract ChangeLog reports:

-
-

It was possible for cabinet files to extract to absolute file - locations, and it was possible on Cygwin to get around cabextract's - absolute and relative path protections by using backslashes.

-
- - - - http://www.cabextract.org.uk/#changes - http://www.openwall.com/lists/oss-security/2015/02/18/3 - CVE-2015-2060 - - - 2015-02-18 - 2015-05-31 - - - - - libmspack -- frame_end overflow which could cause infinite loop - - - libmspack - 0.5 - - - cabextract - 1.5 - - - - -

There is a denial of service vulnerability in libmspack. The - libmspack code is built into cabextract, so it is also - vulnerable.

-

MITRE reports:

-
-

Integer overflow in the qtmd_decompress function in libmspack 0.4 - allows remote attackers to cause a denial of service (hang) via a - crafted CAB file, which triggers an infinite loop.

-
- - - - CVE-2014-9556 - https://bugs.debian.org/773041 - http://www.openwall.com/lists/oss-security/2015/01/07/2 - - - 2014-12-11 - 2015-05-31 - - - - - django -- Fixed session flushing in the cached_db backend - - - py27-django - 1.81.8.2 - - - py32-django - 1.81.8.2 - - - py33-django - 1.81.8.2 - - - py34-django - 1.81.8.2 - - - py27-django-devel - 20150531,1 - - - py32-django-devel - 20150531,1 - - - py33-django-devel - 20150531,1 - - - py34-django-devel - 20150531,1 - - - - -

The Django project reports:

-
-

A change to session.flush() in the cached_db session backend in - Django 1.8 mistakenly sets the session key to an empty string - rather than None. An empty string is treated as a valid session key - and the session cookie is set accordingly. Any users with an empty - string in their session cookie will use the same session store. - session.flush() is called by django.contrib.auth.logout() and, more - seriously, by django.contrib.auth.login() when a user switches accounts. - If a user is logged in and logs in again to a different account - (without logging out) the session is flushed to avoid reuse. - After the session is flushed (and its session key becomes '') the - account details are set on the session and the session is saved. - Any users with an empty string in their session cookie will now be - logged into that account.

-

Thanks to Sam Cooke for reporting the issue.

-
- - - - https://www.djangoproject.com/weblog/2015/may/20/security-release/ - CVE-2015-3982 - - - 2015-05-20 - 2015-05-31 - - - - - proxychains-ng -- current path as the first directory for the library search path - - - proxychains-ng - 4.9 - - - - -

Mamoru TASAKA reports:

-
-

proxychains4 sets LD_PRELOAD to dlopen libproxychains4.so - and execvp() the arbitrary command user has specified. - proxychains4 sets the current directory as the first path - to search libproxychains4.so

-
- - - - http://openwall.com/lists/oss-security/2015/05/12/6 - http://seclists.org/oss-sec/2015/q2/430 - CVE-2015-3887 - - - 2015-05-11 - 2015-05-29 - - - - - wireshark -- multiple vulnerabilities - - - wireshark - wireshark-lite - tshark - tshark-lite - 1.12.5 - - - - -

Wireshark development team reports:

-
-

The following vulnerabilities have been fixed.

-
    -

  • wnpa-sec-2015-12

    -

    The LBMR dissector could go into an infinite loop. - (Bug 11036) CVE-2015-3808, CVE-2015-3809

    • -

  • wnpa-sec-2015-13

    -

    The WebSocket dissector could recurse excessively. - (Bug 10989) CVE-2015-3810

    • -

  • wnpa-sec-2015-14

    -

    The WCP dissector could crash while decompressing data. - (Bug 10978) CVE-2015-3811

    • -

  • wnpa-sec-2015-15

    -

    The X11 dissector could leak memory. (Bug 11088) - CVE-2015-3812

    • -

  • wnpa-sec-2015-16

    -

    The packet reassembly code could leak memory. - (Bug 11129) CVE-2015-3813

    • -

  • wnpa-sec-2015-17

    -

    The IEEE 802.11 dissector could go into an infinite loop. - (Bug 11110) CVE-2015-3814

    • -

  • wnpa-sec-2015-18

    -

    The Android Logcat file parser could crash. Discovered by - Hanno Böck. (Bug 11188) CVE-2015-3815

    • -
-
- - - - CVE-2015-3808 - CVE-2015-3809 - CVE-2015-3810 - CVE-2015-3811 - CVE-2015-3812 - CVE-2015-3813 - CVE-2015-3814 - CVE-2015-3815 - https://www.wireshark.org/docs/relnotes/wireshark-1.12.5.html - https://www.wireshark.org/security/wnpa-sec-2015-12.html - https://www.wireshark.org/security/wnpa-sec-2015-13.html - https://www.wireshark.org/security/wnpa-sec-2015-14.html - https://www.wireshark.org/security/wnpa-sec-2015-15.html - https://www.wireshark.org/security/wnpa-sec-2015-16.html - https://www.wireshark.org/security/wnpa-sec-2015-17.html - https://www.wireshark.org/security/wnpa-sec-2015-18.html - - - 2015-05-12 - 2015-05-28 - - - - - krb5 -- requires_preauth bypass in PKINIT-enabled KDC - - - krb5 - 1.13.2 - - - krb5-112 - 1.12.3_2 - - - - -

MIT reports:

-
-

In MIT krb5 1.12 and later, when the KDC is configured - with PKINIT support, an unauthenticated remote attacker - can bypass the requires_preauth flag on a client principal - and obtain a ciphertext encrypted in the principal's - long-term key. This ciphertext could be used to conduct - an off-line dictionary attack against the user's password.

-
- - - - CVE-2015-2694 - http://krbdev.mit.edu/rt/Ticket/Display.html?id=8160 - - - 2015-05-25 - 2015-05-28 - - - - - cURL -- sensitive HTTP server headers also sent to proxies - - - curl - 7.42.1 - - - - -

cURL reports:

-
-

libcurl provides applications a way to set custom HTTP - headers to be sent to the server by using CURLOPT_HTTPHEADER. - A similar option is available for the curl command-line - tool with the '--header' option.

-

When the connection passes through an HTTP proxy the - same set of headers is sent to the proxy as well by default. - While this is by design, it has not necessarily been clear - nor understood by application programmers.

-
- - - - CVE-2015-3153 - http://curl.haxx.se/docs/adv_20150429.html - - - 2015-04-29 - 2015-05-26 - - - - - cURL -- multiple vulnerabilities - - - curl - 7.42.0 - - - - -

cURL reports:

-
-

libcurl keeps a pool of its last few connections around - after use to facilitate easy, convenient, and completely - transparent connection re-use for applications.

-

When doing HTTP requests NTLM authenticated, the entire - connection becomes authenticated and not just the - specific HTTP request which is otherwise how HTTP works. - This makes NTLM special and a subject for special - treatment in the code. With NTLM, once the connection is - authenticated, no further authentication is necessary until - the connection gets closed.

-
-
-

When doing HTTP requests Negotiate authenticated, the - entire connection may become authenticated and not just - the specific HTTP request which is otherwise how HTTP - works, as Negotiate can basically use NTLM under the hood. - curl was not adhering to this fact but would assume that - such requests would also be authenticated per request.

-
-
-

libcurl supports HTTP "cookies" as documented in RFC 6265. - Together with each individual cookie there are several - different properties, but for this vulnerability we - focus on the associated "path" element. It tells - information about for which path on a given host the - cookies is valid.

-

The internal libcurl function called sanitize_cookie_path() - that cleans up the path element as given to it from a - remote site or when read from a file, did not properly - validate the input. If given a path that consisted of a - single double-quote, libcurl would index a newly - allocated memory area with index -1 and assign a zero - to it, thus destroying heap memory it wasn't supposed to.

-
-
-

There is a private function in libcurl called fix_hostname() - that removes a trailing dot from the host name if there is - one. The function is called after the host name has been - extracted from the URL libcurl has been told to act on.

-

If a URL is given with a zero-length host name, like in - "http://:80" or just ":80", fix_hostname() will index the - host name pointer with a -1 offset (as it blindly assumes - a non-zero length) and both read and assign that address.

-
- - - - http://curl.haxx.se/docs/adv_20150422A.html - http://curl.haxx.se/docs/adv_20150422B.html - http://curl.haxx.se/docs/adv_20150422C.html - http://curl.haxx.se/docs/adv_20150422D.html - CVE-2014-3143 - CVE-2014-3144 - CVE-2014-3145 - CVE-2014-3148 - - - 2015-04-22 - 2015-05-26 - - - - - cassandra -- remote execution of arbitrary code - - - cassandra - 1.2.01.2.19 - - - cassandra2 - 2.0.02.0.14 - 2.1.02.1.4 - - - - -

Jake Luciani reports:

-
-

Under its default configuration, Cassandra binds an unauthenticated - JMX/RMI interface to all network interfaces. As RMI is an API for the - transport and remote execution of serialized Java, anyone with access - to this interface can execute arbitrary code as the running user.

-

Mitigation:

-

1.2.x has reached EOL, so users of <= 1.2.x are recommended to upgrade - to a supported version of Cassandra, or manually configure encryption - and authentication of JMX, - (see https://wiki.apache.org/cassandra/JmxSecurity).

-

2.0.x users should upgrade to 2.0.14

-

2.1.x users should upgrade to 2.1.4

-

Alternately, users of any version not wishing to upgrade can - reconfigure JMX/RMI to enable encryption and authentication according - to https://wiki.apache.org/cassandra/JmxSecurityor - http://docs.oracle.com/javase/7/docs/technotes/guides/management/agent.html

-

Credit:

-

This issue was discovered by Georgi Geshev of MWR InfoSecurity

-
- - - - http://mail-archives.apache.org/mod_mbox/cassandra-dev/201504.mbox/raw/%3CCALamADJu4yo=cO8HgA6NpgFc1wQN_VNqpkMn-3SZwhPq9foLBw@mail.gmail.com%3E/ - CVE-2015-0225 - - - 2015-04-01 - 2015-05-24 - - - - - py-salt -- potential shell injection vulnerabilities - - - py27-salt - 2015.5.0 - - - - -

Colton Myers reports:

-
-

In order to fix potential shell injection vulnerabilities in salt - modules, a change has been made to the various cmd module functions. - These functions now default to python_shell=False, which means that - the commands will not be sent to an actual shell.

-

The largest side effect of this change is that "shellisms", such as - pipes, will not work by default. The modules shipped with salt have - been audited to fix any issues that might have arisen from this - change. Additionally, the cmd state module has been unaffected, and - use of cmd.run in jinja is also unaffected. cmd.run calls on the - CLI will also allow shellisms.

-

However, custom execution modules which use shellisms in cmd calls - will break, unless you pass python_shell=True to these calls.

-

As a temporary workaround, you can set cmd_safe: False in your - minion and master configs. This will revert the default, but is - also less secure, as it will allow shell injection vulnerabilities - to be written in custom code. We recommend you only set this - setting for as long as it takes to resolve these issues in your - custom code, then remove the override.

-
- - - - http://docs.saltstack.com/en/latest/topics/releases/2015.5.0.html - - - 2015-05-11 - 2015-05-24 - - - - - davmail -- fix potential CVE-2014-3566 vulnerability (POODLE) - - - davmail - 4.6.0 - - - - -

Mickaël Guessant reports:

-
-

DavMail 4.6.0 released

-

Enhancements: Fix potential CVE-2014-3566 vulnerability.

-
- - - - http://sourceforge.net/p/davmail/mailman/message/33279118/ - http://sourceforge.net/p/davmail/code/2322/ - CVE-2014-3566 - - - 2014-10-27 - 2015-05-23 - - - - - dnsmasq -- remotely exploitable buffer overflow in release candidate - - - dnsmasq-devel - 2.73rc62.73rc8 - - - - -

Simon Kelley reports:

-
-

Anyone running 2.[73]rc6 or 2.[73]rc7 should be aware that there's a - remotely exploitable buffer overflow in those trees. I just tagged - 2.[73]rc8, which includes the fix. -

-
-

(Corrections from second URL.)

- - - - http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2015q2/009529.html - http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2015q2/009535.html - - - 2015-05-15 - 2015-05-23 - - - - - dnsmasq -- data exposure and denial of service - - - dnsmasq - 2.72_1 - - - dnsmasq-devel - 2.73rc4 - - - - -

Nick Sampanis reported a potential memory exposure and denial of service vulnerability against dnsmasq 2.72. The CVE entry summarizes this as: -

-

The tcp_request function in Dnsmasq before 2.73rc4 - does not properly handle the return value of the setup_reply function, - which allows remote attackers to read process memory and cause a - denial of service (out-of-bounds read and crash) via a malformed DNS - request."

-
- - - - http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2015q2/009382.html - CVE-2015-3294 - http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commitdiff;h=ad4a8ff7d9097008d7623df8543df435bfddeac8 - - - 2015-04-07 - 2015-05-23 - - - - - pcre -- multiple vulnerabilities - - - pcre - 8.37 - - - - -

PCRE development team reports:

-
-

A pattern such as "((?2){0,1999}())?", which has a group - containing a forward reference repeated a large (but limited) - number of times within a repeated outer group that has a zero - minimum quantifier, caused incorrect code to be compiled, - leading to the error "internal error: previously-checked - referenced subpattern not found" when an incorrect memory - address was read. This bug was reported as "heap overflow", - discovered by Kai Lu of Fortinet's FortiGuard Labs and given - the CVE number CVE-2015-2325.

-

A pattern such as "((?+1)(\1))/" containing a forward - reference subroutine call within a group that also contained - a recursive back reference caused incorrect code to be - compiled. This bug was reported as "heap overflow", - discovered by Kai Lu of Fortinet's FortiGuard Labs, - and given the CVE number CVE-2015-2326.

-
- - - - CVE-2015-2325 - CVE-2015-2326 - http://www.pcre.org/original/changelog.txt - - - 2015-04-28 - 2015-05-22 - 2015-06-07 - - - - - php -- multiple vulnerabilities - - - php5 - 5.4.41 - - - php55 - 5.5.25 - - - php56 - 5.6.9 - - - - -

PHP development team reports:

-
-

Fixed bug #69364 (PHP Multipart/form-data remote DoS - Vulnerability). (CVE-2015-4024)

-

Fixed bug #69418 (CVE-2006-7243 fix regressions in - 5.4+). (CVE-2015-4025)

-

Fixed bug #69545 (Integer overflow in ftp_genlist() - resulting in heap overflow). (CVE-2015-4022)

-

Fixed bug #68598 (pcntl_exec() should not allow null - char). (CVE-2015-4026)

-

Fixed bug #69453 (Memory Corruption in phar_parse_tarfile - when entry filename starts with null). (CVE-2015-4021)

-
- - - - CVE-2015-4021 - CVE-2015-4022 - CVE-2015-4024 - CVE-2015-4025 - CVE-2015-4026 - https://php.net/ChangeLog-5.php#5.6.9 - - - 2015-05-14 - 2015-05-22 - - - - - PostgreSQL -- minor security problems. - - - postgresql90-server - 9.0.09.0.20 - - - postgresql91-server - 9.1.09.1.16 - - - postgresql92-server - 9.2.09.2.11 - - - postgresql93-server - 9.3.09.3.7 - - - postgresql94-server - 9.4.09.4.2 - - - - -

PostgreSQL project reports:

-
-

- This update fixes three security vulnerabilities reported in - PostgreSQL over the past few months. Nether of these issues is seen as - particularly urgent. However, users should examine them in case their - installations are vulnerable:. -

-
    -
  • CVE-2015-3165 Double "free" after authentication timeout.
    • -
  • CVE-2015-3166 Unanticipated errors from the standard library.
    • -
  • CVE-2015-3167 pgcrypto has multiple error messages for decryption with an incorrect key.
    • -
-
- - - - CVE-2015-3165 - CVE-2015-3166 - CVE-2015-3167 - - - 2015-04-10 - 2015-05-22 - - - - - proftpd -- arbitrary code execution vulnerability with chroot - - - proftpd - 1.3.5_7 - - - - -

ProFTPd development team reports:

-
-

Vadim Melihow reported a critical issue with proftpd - installations that use the mod_copy module's SITE CPFR/SITE - CPTO commands; mod_copy allows these commands to be used by - *unauthenticated clients*.

-
- - - - CVE-2015-3306 - http://bugs.proftpd.org/show_bug.cgi?id=4169 - - - 2015-04-15 - 2015-05-20 - - - - - ipsec-tools -- Memory leak leading to denial of service - - - ipsec-tools - 0.8.2_1 - - - - -

Javantea reports:

-
-

It is a null dereference crash, leading to denial of - service against the IKE daemon.

-
- - - - https://www.altsci.com/ipsec/ - - - 2015-05-18 - 2015-05-19 - - - - - chromium -- multiple vulnerabilities - - - chromium - 43.0.2357.65 - - - - chromium-npapi - 43.0.2357.65 - - - - chromium-pulse - 43.0.2357.65 - - - - -

Google Chrome Releases reports:

-
-

37 security fixes in this release, including:

-
    -
  • [474029] High CVE-2015-1252: Sandbox escape in Chrome. Credit - to anonymous.
    • -
  • [464552] High CVE-2015-1253: Cross-origin bypass in DOM. Credit - to anonymous.
    • -
  • [444927] High CVE-2015-1254: Cross-origin bypass in Editing. - Credit to armin@rawsec.net.
    • -
  • [473253] High CVE-2015-1255: Use-after-free in WebAudio. Credit - to Khalil Zhani.
    • -
  • [478549] High CVE-2015-1256: Use-after-free in SVG. Credit to - Atte Kettunen of OUSPG.
    • -
  • [481015] High CVE-2015-1251: Use-after-free in Speech. Credit - to SkyLined working with HP's Zero Day Initiative.
    • -
  • [468519] Medium CVE-2015-1257: Container-overflow in SVG. - Credit to miaubiz.
    • -
  • [450939] Medium CVE-2015-1258: Negative-size parameter in - libvpx. Credit to cloudfuzzer
    • -
  • [468167] Medium CVE-2015-1259: Uninitialized value in PDFium. - Credit to Atte Kettunen of OUSPG
    • -
  • [474370] Medium CVE-2015-1260: Use-after-free in WebRTC. Credit - to Khalil Zhani.
    • -
  • [466351] Medium CVE-2015-1261: URL bar spoofing. Credit to Juho - Nurminen.
    • -
  • [476647] Medium CVE-2015-1262: Uninitialized value in Blink. - Credit to miaubiz.
    • -
  • [479162] Low CVE-2015-1263: Insecure download of spellcheck - dictionary. Credit to Mike Ruddy.
    • -
  • [481015] Low CVE-2015-1264: Cross-site scripting in bookmarks. - Credit to K0r3Ph1L.
    • -
  • [489518] CVE-2015-1265: Various fixes from internal audits, - fuzzing and other initiatives.
    • -
  • Multiple vulnerabilities in V8 fixed at the tip of the 4.3 - branch (currently 4.3.61.21).
    • -
-
- - - - http://googlechromereleases.blogspot.nl/2015/05/stable-channel-update_19.html - CVE-2015-1251 - CVE-2015-1252 - CVE-2015-1253 - CVE-2015-1254 - CVE-2015-1255 - CVE-2015-1256 - CVE-2015-1257 - CVE-2015-1258 - CVE-2015-1259 - CVE-2015-1260 - CVE-2015-1261 - CVE-2015-1262 - CVE-2015-1263 - CVE-2015-1264 - CVE-2015-1265 - - - 2015-05-19 - 2015-05-19 - - - - - clamav -- multiple vulnerabilities - - - clamav - 0.98.7 - - - clamav-devel - 0 - - - - -

ClamAV project reports:

-
-

ClamAV 0.98.7 is here! This release contains new - scanning features and bug fixes.

-

Fix infinite loop condition on crafted y0da cryptor file. - Identified and patch suggested by Sebastian Andrzej Siewior. - CVE-2015-2221.

-

Fix crash on crafted petite packed file. Reported and patch - supplied by Sebastian Andrzej Siewior. CVE-2015-2222.

-

Fix an infinite loop condition on a crafted "xz" archive - file. This was reported by Dimitri Kirchner and Goulven - Guiheux. CVE-2015-2668.

-

Apply upstream patch for possible heap overflow in Henry - Spencer's regex library. CVE-2015-2305.

-

Fix crash in upx decoder with crafted file. Discovered and - patch supplied by Sebastian Andrzej Siewior. CVE-2015-2170.

-
- - - - CVE-2015-2170 - CVE-2015-2221 - CVE-2015-2222 - CVE-2015-2305 - CVE-2015-2668 - http://blog.clamav.net/2015/04/clamav-0987-has-been-released.html - - - 2015-04-29 - 2015-05-19 - - - - - rubygems -- request hijacking vulnerability - - - ruby20-gems - 2.4.7 - - - ruby21-gems - 2.4.7 - - - ruby22-gems - 2.4.7 - - - - -

Jonathan Claudius reports:

-
-

RubyGems provides the ability of a domain to direct clients to a - separate host that is used to fetch gems and make API calls against. - This mechanism is implemented via DNS, specifically a SRV record - _rubygems._tcp under the original requested domain.

-

RubyGems did not validate the hostname returned in the SRV record - before sending requests to it. This left clients open to a DNS - hijack attack, whereby an attacker could return a SRV of their - choosing and get the client to use it.

-
- - - - ports/200264 - CVE-2015-3900 - http://blog.rubygems.org/2015/05/14/CVE-2015-3900.html - - - 2015-05-14 - 2015-05-17 - - - - - qemu, xen and VirtualBox OSE -- possible VM escape and code execution ("VENOM") - - - qemu - qemu-devel - 0.11.1_19 - 0.122.3.0_1 - - - qemu-sbruno - 2.3.50.g20150501_1 - - - virtualbox-ose - 4.3.28 - - - xen-tools - 4.5.04.5.0_5 - - - - -

Jason Geffner, CrowdStrike Senior Security Researcher reports:

-
-

VENOM, CVE-2015-3456, is a security vulnerability in - the virtual floppy drive code used by many computer - virtualization platforms. This vulnerability may allow - an attacker to escape from the confines of an affected - virtual machine (VM) guest and potentially obtain - code-execution access to the host. Absent mitigation, - this VM escape could open access to the host system and - all other VMs running on that host, potentially giving - adversaries significant elevated access to the host's - local network and adjacent systems.

-
- - - - CVE-2015-3456 - ports/200255 - ports/200256 - ports/200257 - http://venom.crowdstrike.com/ - http://www.oracle.com/technetwork/topics/security/alert-cve-2015-3456-2542656.html - http://xenbits.xen.org/xsa/advisory-133.html - - - 2015-04-29 - 2015-05-17 - 2015-09-28 - - - - - Quassel IRC -- SQL injection vulnerability - - - quassel - 0.11.1 - - - - -

Quassel IRC developers report:

-
-

Restarting a PostgreSQL database while Quassel Core is running - would not properly re-initialize the database session inside Quassel, - bringing back an old security issue (CVE-2013-4422).

-
- - - - https://github.com/quassel/quassel/commit/6605882f41331c80f7ac3a6992650a702ec71283 - CVE-2015-3427 - - - 2015-04-23 - 2015-05-16 - - - - - rubygem-redcarpet -- XSS vulnerability - - - rubygem-redcarpet - 3.2.3 - - - - -

Daniel LeCheminant reports:

-
-

When markdown is being presented as HTML, there seems to be a - strange interaction between _ and @ that lets an attacker insert - malicious tags.

-
- - - - http://openwall.com/lists/oss-security/2015/04/07/11 - https://hackerone.com/reports/46916 - http://danlec.com/blog/bug-in-sundown-and-redcarpet - - - 2015-04-07 - 2015-05-14 - - - - - dcraw -- integer overflow condition - - - cinepaint - - 0.22.0 - - - darktable - 1.6.7 - - - dcraw - 7.009.26 - - - dcraw-m - - 0 - - - exact-image - 0.9.1 - - - flphoto - - 0 - - - freeimage - 3.13.03.16.0_1 - - - kodi - 14.2_1 - - - libraw - 0.16.1 - - - lightzone - 4.1.2 - - - netpbm - 10.35.96 - - - opengtl - - 0 - - - rawstudio - 2.0_11 - - - ufraw - 0.21 - - - - -

ocert reports:

-
-

The dcraw tool, as well as several other projects re-using its - code, suffers from an integer overflow condition which lead to a - buffer overflow.

-

The vulnerability concerns the 'len' variable, parsed without - validation from opened images, used in the ljpeg_start() - function.

-

A maliciously crafted raw image file can be used to trigger the - vulnerability, causing a Denial of Service condition.

-
- - - - CVE-2015-3885 - http://www.ocert.org/advisories/ocert-2015-006.html - https://github.com/rawstudio/rawstudio/commit/983bda1f0fa5fa86884381208274198a620f006e - https://github.com/LibRaw/LibRaw/commit/4606c28f494a750892c5c1ac7903e62dd1c6fdb5 - https://sourceforge.net/p/netpbm/code/2512/ - - - 2015-04-24 - 2015-05-15 - 2016-01-08 - - - - - phpMyAdmin -- XSRF and man-in-the-middle vulnerabilities - - - phpMyAdmin - 4.4.04.4.6.1 - - - - -

The phpMyAdmin development team reports:

-
-

XSRF/CSRF vulnerability in phpMyAdmin setup.

-

By deceiving a user to click on a crafted URL, it is - possible to alter the configuration file being generated - with phpMyAdmin setup.

-

This vulnerability only affects the configuration file - generation process and does not affect the effective - configuration file. Moreover, the configuration file being - generated is at risk only during the period when it's - writable.

-
-
-

Vulnerability allowing man-in-the-middle attack on API - call to GitHub.

-

A vulnerability in the API call to GitHub can be - exploited to perform a man-in-the-middle attack.

-

We consider this vulnerability to be serious.

-
- - - - http://www.phpmyadmin.net/home_page/security/PMASA-2015-2.php - http://www.phpmyadmin.net/home_page/security/PMASA-2015-3.php - CVE-2015-3902 - CVE-2015-3903 - - - 2015-05-13 - 2015-05-13 - - - - - Adobe Flash Player -- critical vulnerabilities - - - linux-c6-flashplugin - 11.2r202.457 - - - linux-f10-flashplugin - 11.2r202.457 - - - - -

Adobe reports:

-
-

- Adobe has released security updates for Adobe Flash Player for - Windows, Macintosh and Linux. These updates address vulnerabilities - that could potentially allow an attacker to take control of the - affected system. Adobe recommends users update their product - installations to the latest versions. -

-

- These updates resolve memory corruption vulnerabilities that could - lead to code execution (CVE-2015-3078, CVE-2015-3089, CVE-2015-3090, - CVE-2015-3093). -

-

- These updates resolve a heap overflow vulnerability that could lead - to code execution (CVE-2015-3088). -

-

- These updates resolve a time-of-check time-of-use (TOCTOU) race - condition that could be exploited to bypass Protected Mode in - Internet Explorer (CVE-2015-3081). -

-

- These updates resolve validation bypass issues that could be - exploited to write arbitrary data to the file system under user - permissions (CVE-2015-3082, CVE-2015-3083, CVE-2015-3085). -

-

- These updates resolve an integer overflow vulnerability that could - lead to code execution (CVE-2015-3087). -

-

- These updates resolve a type confusion vulnerability that could lead - to code execution (CVE-2015-3077, CVE-2015-3084, CVE-2015-3086). -

-

- These updates resolve a use-after-free vulnerability that could lead - to code execution (CVE-2015-3080). -

-

- These updates resolve memory leak vulnerabilities that could be used - to bypass ASLR (CVE-2015-3091, CVE-2015-3092). -

-

- These updates resolve a security bypass vulnerability that could lead - to information disclosure (CVE-2015-3079), and provide additional - hardening to protect against CVE-2015-3044. -

-
- - - - CVE-2015-3044 - CVE-2015-3077 - CVE-2015-3078 - CVE-2015-3079 - CVE-2015-3080 - CVE-2015-3081 - CVE-2015-3082 - CVE-2015-3083 - CVE-2015-3084 - CVE-2015-3085 - CVE-2015-3086 - CVE-2015-3087 - CVE-2015-3088 - CVE-2015-3089 - CVE-2015-3090 - CVE-2015-3091 - CVE-2015-3092 - CVE-2015-3093 - https://helpx.adobe.com/security/products/flash-player/apsb15-09.html - - - 2015-05-12 - 2015-05-13 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 38.0,1 - - - linux-firefox - 38.0,1 - - - seamonkey - 2.35 - - - linux-seamonkey - 2.35 - - - firefox-esr - 31.7.0,1 - - - libxul - 31.7.0 - 32.038.0 - - - thunderbird - 31.7.0 - 32.038.0 - - - linux-thunderbird - 31.7.0 - 32.038.0 - - - - -

The Mozilla Project reports:

-
-

MFSA-2015-46 Miscellaneous memory safety hazards (rv:38.0 - / rv:31.7)

-

MFSA-2015-47 Buffer overflow parsing H.264 video with - Linux Gstreamer

-

MFSA-2015-48 Buffer overflow with SVG content and CSS

-

MFSA-2015-49 Referrer policy ignored when links opened by - middle-click and context menu

-

MFSA-2015-50 Out-of-bounds read and write in asm.js validation

-

MFSA-2015-51 Use-after-free during text processing with - vertical text enabled

-

MFSA-2015-52 Sensitive URL encoded information written to - Android logcat

-

MFSA-2015-53 Use-after-free due to Media Decoder Thread creation - during shutdown

-

MFSA-2015-54 Buffer overflow when parsing compressed XML

-

MFSA-2015-55 Buffer overflow and out-of-bounds read while - parsing MP4 video metadata

-

MFSA-2015-56 Untrusted site hosting trusted page can - intercept webchannel responses

-

MFSA-2015-57 Privilege escalation through IPC channel messages

-

MFSA-2015-58 Mozilla Windows updater can be run outside - of application directory

-

MFSA 2015-93 Integer overflows in libstagefright while processing - MP4 video metadata

-
- - - - CVE-2011-3079 - CVE-2015-0797 - CVE-2015-0833 - CVE-2015-2708 - CVE-2015-2709 - CVE-2015-2710 - CVE-2015-2711 - CVE-2015-2712 - CVE-2015-2713 - CVE-2015-2714 - CVE-2015-2715 - CVE-2015-2716 - CVE-2015-2717 - CVE-2015-2718 - CVE-2015-2720 - CVE-2015-4496 - https://www.mozilla.org/security/advisories/mfsa2015-46/ - https://www.mozilla.org/security/advisories/mfsa2015-47/ - https://www.mozilla.org/security/advisories/mfsa2015-48/ - https://www.mozilla.org/security/advisories/mfsa2015-49/ - https://www.mozilla.org/security/advisories/mfsa2015-50/ - https://www.mozilla.org/security/advisories/mfsa2015-51/ - https://www.mozilla.org/security/advisories/mfsa2015-52/ - https://www.mozilla.org/security/advisories/mfsa2015-53/ - https://www.mozilla.org/security/advisories/mfsa2015-54/ - https://www.mozilla.org/security/advisories/mfsa2015-55/ - https://www.mozilla.org/security/advisories/mfsa2015-56/ - https://www.mozilla.org/security/advisories/mfsa2015-57/ - https://www.mozilla.org/security/advisories/mfsa2015-58/ - https://www.mozilla.org/security/advisories/mfsa2015-93/ - - - 2015-05-12 - 2015-05-12 - 2015-08-28 - - - - - suricata -- TLS/DER Parser Bug (DoS) - - - suricata - 2.0.8 - - - - -

OISF Development Team reports:

-
-

The OISF development team is pleased to announce Suricata 2.0.8. - This release fixes a number of issues in the 2.0 series.

- -

The most important issue is a bug in the DER parser which is used to - decode SSL/TLS certificates could crash Suricata. This issue was - reported by Kostya Kortchinsky of the Google Security Team and was fixed - by Pierre Chifflier of ANSSI.

- -

Those processing large numbers of (untrusted) pcap files need to update - as a malformed pcap could crash Suricata. Again, credits go to Kostya - Kortchinsky.

-
- - - - CVE-2015-0971 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0971 - https://github.com/inliniac/suricata/commit/fa73a0bb8f312fd0a95cc70f6b3ee4e4997bdba7 - - - 2015-05-06 - 2015-05-12 - - - - - libssh -- null pointer dereference - - - libssh - 0.6.5 - - - - -

Andreas Schneider reports:

-
-

libssh versions 0.5.1 and above have a logical error in the - handling of a SSH_MSG_NEWKEYS and SSH_MSG_KEXDH_REPLY package. A - detected error did not set the session into the error state - correctly and further processed the packet which leads to a null - pointer dereference. This is the packet after the initial key - exchange and doesn’t require authentication.

-

This could be used for a Denial of Service (DoS) attack.

-
- - - - CVE-2015-3146 - https://www.libssh.org/2015/04/30/libssh-0-6-5-security-and-bugfix-release - - - 2015-04-30 - 2015-05-10 - - - - - Vulnerability in HWP document filter - - - libreoffice - 4.3.7 - - - apache-openoffice - 4.1.1_9 - - - apache-openoffice-devel - 4.2.1677190,3 - - - - -

US-CERT/NIST reports:

-
-

The HWP filter in LibreOffice before 4.3.7 and 4.4.x before - 4.4.2 and Apache OpenOffice before 4.1.2 allows remote - attackers to cause a denial of service (crash) or possibly - execute arbitrary code via a crafted HWP document, which - triggers an out-of-bounds write.

-
- - - - CVE-2015-1774 - http://www.openoffice.org/security/cves/CVE-2015-1774.html - https://www.libreoffice.org/about-us/security/advisories/cve-2015-1774/ - - - 2015-04-27 - 2015-05-07 - - - - - wordpress -- 2 cross-site scripting vulnerabilities - - - wordpress - 4.2.2,1 - - - de-wordpress - 4.2.2 - - - ja-wordpress - 4.2.2 - - - ru-wordpress - 4.2.2 - - - zh-wordpress-zh_CN - 4.2.2 - - - zh-wordpress-zh_TW - 4.2.2 - - - - -

Samuel Sidler reports:

-
-

The Genericons icon font package, which is used in a number of - popular themes and plugins, contained an HTML file vulnerable to - a cross-site scripting attack. All affected themes and plugins - hosted on WordPress.org (including the Twenty Fifteen default - theme) have been updated today by the WordPress security team - to address this issue by removing this nonessential file. To - help protect other Genericons usage, WordPress 4.2.2 - proactively scans the wp-content directory for this HTML - file and removes it. Reported by Robert Abela of Netsparker.

- -

WordPress versions 4.2 and earlier are affected by a critical - cross-site scripting vulnerability, which could enable anonymous - users to compromise a site. WordPress 4.2.2 includes a - comprehensive fix for this issue.

- -

The release also includes hardening for a potential cross-site - scripting vulnerability when using the visual editor. This issue - was reported by Mahadev Subedi.

-
- - - - https://wordpress.org/news/2015/05/wordpress-4-2-2/ - - - 2015-05-07 - 2015-05-07 - 2015-09-15 - - - - - wordpress -- cross-site scripting vulnerability - - - wordpress - 4.2.1,1 - - - de-wordpress - 4.2.1 - - - ja-wordpress - 4.2.1 - - - ru-wordpress - 4.2.1 - - - zh-wordpress-zh_CN - 4.2.1 - - - zh-wordpress-zh_TW - 4.2.1 - - - - -

Gary Pendergast reports:

-
-

WordPress 4.2.1 is now available. This is a critical security - release for all previous versions and we strongly encourage you - to update your sites immediately.

-

A few hours ago, the WordPress team was made aware of a - cross-site scripting vulnerability, which could enable commenters - to compromise a site. The vulnerability was discovered by Jouko - Pynnöne.

-
- - - - https://wordpress.org/news/2015/04/wordpress-4-2-1/ - - - 2015-04-27 - 2015-05-07 - 2015-09-15 - - - - - powerdns -- Label decompression bug can cause crashes or CPU spikes - - - powerdns - 3.4.5 - - - powerdns-recursor - 3.7.3 - - - - -

The PowerDNS project reports:

-
-

A bug was discovered in our label decompression code, making it - possible for names to refer to themselves, thus causing a loop during - decompression. On some platforms, this bug can be abused to cause - crashes. On all platforms, this bug can be abused to cause - service-affecting CPU spikes.

-
- - - - CVE-2015-1868 - CVE-2015-5470 - https://doc.powerdns.com/md/security/powerdns-advisory-2015-01/ - http://www.openwall.com/lists/oss-security/2015/07/10/8 - - - 2015-04-23 - 2015-05-01 - 2015-07-12 - - - - - chromium -- multiple vulnerabilities - - - chromium - 42.0.2311.135 - - - - chromium-npapi - 42.0.2311.135 - - - - chromium-pulse - 42.0.2311.135 - - - - -

Google Chrome Releases reports:

-
-

5 security fixes in this release, including:

-
    -
  • [453279] High CVE-2015-1243: Use-after-free in DOM. Credit to - Saif El-Sherei.
    • -
  • [481777] CVE-2015-1250: Various fixes from internal audits, - fuzzing and other initiatives.
    • -
-
- - - - CVE-2015-1243 - CVE-2015-1250 - http://googlechromereleases.blogspot.nl/2015/04/stable-channel-update_28.html - - - 2015-04-28 - 2015-04-28 - - - - - chromium -- multiple vulnerabilities - - - chromium - 42.0.2311.90 - - - - chromium-npapi - 42.0.2311.90 - - - - chromium-pulse - 42.0.2311.90 - - - - -

Google Chrome Releases reports:

-
-

45 new security fixes, including:

-
    -
  • [456518] High CVE-2015-1235: Cross-origin-bypass in HTML - parser. Credit to anonymous.
    • -
  • [313939] Medium CVE-2015-1236: Cross-origin-bypass in Blink. - Credit to Amitay Dobo.
    • -
  • [461191] High CVE-2015-1237: Use-after-free in IPC. Credit to - Khalil Zhani.
    • -
  • [445808] High CVE-2015-1238: Out-of-bounds write in Skia. - Credit to cloudfuzzer.
    • -
  • [463599] Medium CVE-2015-1240: Out-of-bounds read in WebGL. - Credit to w3bd3vil.
    • -
  • [418402] Medium CVE-2015-1241: Tap-Jacking. Credit to Phillip - Moon and Matt Weston of Sandfield Information Systems.
    • -
  • [460917] High CVE-2015-1242: Type confusion in V8. Credit to - fcole@onshape.com.
    • -
  • [455215] Medium CVE-2015-1244: HSTS bypass in WebSockets. - Credit to Mike Ruddy.
    • -
  • [444957] Medium CVE-2015-1245: Use-after-free in PDFium. Credit - to Khalil Zhani.
    • -
  • [437399] Medium CVE-2015-1246: Out-of-bounds read in Blink. - Credit to Atte Kettunen of OUSPG.
    • -
  • [429838] Medium CVE-2015-1247: Scheme issues in OpenSearch. - Credit to Jann Horn.
    • -
  • [380663] Medium CVE-2015-1248: SafeBrowsing bypass. Credit to - Vittorio Gambaletta (VittGam).
    • -
  • [476786] CVE-2015-1249: Various fixes from internal audits, - fuzzing and other initiatives. Multiple vulnerabilities in V8 - fixed at the tip of the 4.2 branch (currently 4.2.77.14).
    • -
-
- - - - http://googlechromereleases.blogspot.nl/2015/04/stable-channel-update_14.html - CVE-2015-1235 - CVE-2015-1236 - CVE-2015-1237 - CVE-2015-1238 - CVE-2015-1240 - CVE-2015-1241 - CVE-2015-1242 - CVE-2015-1244 - CVE-2015-1245 - CVE-2015-1246 - CVE-2015-1247 - CVE-2015-1248 - CVE-2015-1249 - - - 2015-04-14 - 2015-04-27 - - - - - wpa_supplicant -- P2P SSID processing vulnerability - - - wpa_supplicant - 2.4_1 - - - - -

Jouni Malinen reports:

-
-

A vulnerability was found in how wpa_supplicant uses SSID information - parsed from management frames that create or update P2P peer entries - (e.g., Probe Response frame or number of P2P Public Action frames). SSID - field has valid length range of 0-32 octets. However, it is transmitted - in an element that has a 8-bit length field and potential maximum - payload length of 255 octets. wpa_supplicant was not sufficiently - verifying the payload length on one of the code paths using the SSID - received from a peer device.

-

This can result in copying arbitrary data from an attacker to a fixed - length buffer of 32 bytes (i.e., a possible overflow of up to 223 - bytes). The SSID buffer is within struct p2p_device that is allocated - from heap. The overflow can override couple of variables in the struct, - including a pointer that gets freed. In addition about 150 bytes (the - exact length depending on architecture) can be written beyond the end of - the heap allocation.

-

This could result in corrupted state in heap, unexpected program - behavior due to corrupted P2P peer device information, denial of service - due to wpa_supplicant process crash, exposure of memory contents during - GO Negotiation, and potentially arbitrary code execution.

-

Vulnerable versions/configurations

-

wpa_supplicant v1.0-v2.4 with CONFIG_P2P build option enabled - (which is not compiled by default).

-

Attacker (or a system controlled by the attacker) needs to be within - radio range of the vulnerable system to send a suitably constructed - management frame that triggers a P2P peer device information to be - created or updated.

-

The vulnerability is easiest to exploit while the device has started an - active P2P operation (e.g., has ongoing P2P_FIND or P2P_LISTEN control - interface command in progress). However, it may be possible, though - significantly more difficult, to trigger this even without any active - P2P operation in progress.

-
- - - - CVE-2015-1863 - http://w1.fi/security/2015-1/wpa_supplicant-p2p-ssid-overflow.txt - - - 2015-04-22 - 2015-04-25 - - - - - Several vulnerabilities found in PHP - - - php5 - 5.4.40 - - - php55 - 5.5.24 - - - php56 - 5.6.8 - - - - -

The PHP project reports:

-
-

The PHP development team announces the immediate - availability of PHP 5.4.40. 14 security-related - bugs were fixed in this release, including - CVE-2014-9709, CVE-2015-2301, CVE-2015-2783, - CVE-2015-1352. All PHP 5.4 users are encouraged to - upgrade to this version.

-

The PHP development team announces the immediate - availability of PHP 5.5.24. Several bugs have been - fixed, some of them being security related, like - CVE-2015-1351 and CVE-2015-1352. All PHP 5.5 users - are encouraged to upgrade to this version.

-

The PHP development team announces the immediate - availability of PHP 5.6.8. Several bugs have been - fixed, some of them being security related, like - CVE-2015-1351 and CVE-2015-1352. All PHP 5.6 users - are encouraged to upgrade to this version.

-
- - - - http://php.net/archive/2015.php#id2015-04-16-2 - CVE-2014-9709 - CVE-2015-2301 - CVE-2015-2783 - CVE-2015-1351 - CVE-2015-1352 - ports/199585 - - - 2015-04-16 - 2015-04-25 - 2015-05-22 - - - - - wordpress -- multiple vulnerabilities - - - wordpress - 4.1.2 - - - de-wordpress - 4.1.2 - - - ja-wordpress - 4.1.2 - - - ru-wordpress - 4.1.2 - - - zh-wordpress-zh_CN - 4.1.2 - - - zh-wordpress-zh_TW - 4.1.2 - - - - -

Gary Pendergast reports:

-
-

WordPress 4.1.2 is now available. This is a critical security - release for all previous versions and we strongly encourage you - to update your sites immediately.

-

WordPress versions 4.1.1 and earlier are affected by a critical - cross-site scripting vulnerability, which could enable anonymous - users to compromise a site. This was reported by Cedric Van - Bockhaven and fixed by Gary Pendergast, Mike Adams, and Andrew - Nacin of the WordPress security team.

-

We also fixed three other security issues:

-
    -
  • In WordPress 4.1 and higher, files with invalid or unsafe - names could be uploaded. Discovered by Michael Kapfer and - Sebastian Kraemer of HSASec.
    • -
  • In WordPress 3.9 and higher, a very limited cross-site - scripting vulnerability could be used as part of a social - engineering attack. Discovered by Jakub Zoczek.
    • -
  • Some plugins were vulnerable to an SQL injection - vulnerability. Discovered by Ben Bidner of the WordPress - security team.
    • -
-

We also made four hardening changes, discovered by J.D. Grimes, - Divyesh Prajapati, Allan Collins, Marc-Alexandre Montpas and - Jeff Bowen.

-
- - - - https://wordpress.org/news/2015/04/wordpress-4-1-2/ - - - 2015-04-21 - 2015-04-24 - 2015-04-24 - - - - - libtasn1 -- stack-based buffer overflow in asn1_der_decoding - - - libtasn1 - 4.4 - - - - -

Debian reports:

-
-

Hanno Boeck discovered a stack-based buffer overflow in - the asn1_der_decoding function in Libtasn1, a library to - manage ASN.1 structures. A remote attacker could take advantage - of this flaw to cause an application using the Libtasn1 library - to crash, or potentially to execute arbitrary code.

-
- - - - CVE-2015-2806 - https://www.debian.org/security/2015/dsa-3220.en.html - - - 2015-04-11 - 2015-04-22 - - - - - mozilla -- use-after-free - - - firefox - 37.0.2,1 - - - linux-firefox - 37.0.2,1 - - - - -

The Mozilla Project reports:

-
-

MFSA 2015-45 Memory corruption during failed plugin - initialization

-
- - - - CVE-2015-2706 - https://www.mozilla.org/en-US/security/advisories/mfsa2015-45/ - - - 2015-04-20 - 2015-04-21 - - - - - sqlite -- multiple vulnerabilities - - - sqlite3 - 3.8.9 - - - - -

NVD reports:

-
-

SQLite before 3.8.9 does not properly implement the - dequoting of collation-sequence names, which allows - context-dependent attackers to cause a denial of service - (uninitialized memory access and application crash) or - possibly have unspecified other impact via a crafted - COLLATE clause, as demonstrated by COLLATE"""""""" at the - end of a SELECT statement.

-
-
-

The sqlite3VdbeExec function in vdbe.c in SQLite before - 3.8.9 does not properly implement comparison operators, - which allows context-dependent attackers to cause a denial - of service (invalid free operation) or possibly have - unspecified other impact via a crafted CHECK clause, as - demonstrated by CHECK(0&O>O) in a CREATE TABLE statement. -

-
-
-

The sqlite3VXPrintf function in printf.c in SQLite before - 3.8.9 does not properly handle precision and width values - during floating-point conversions, which allows - context-dependent attackers to cause a denial of service - (integer overflow and stack-based buffer overflow) or - possibly have unspecified other impact via large integers - in a crafted printf function call in a SELECT statement.

-
- - - - CVE-2015-3414 - CVE-2015-3415 - CVE-2015-3416 - https://www.sqlite.org/src/info/eddc05e7bb31fae7 - https://www.sqlite.org/src/info/02e3c88fbf6abdcf - https://www.sqlite.org/src/info/c494171f77dc2e5e - http://seclists.org/fulldisclosure/2015/Apr/31 - - - 2015-04-14 - 2015-04-18 - 2015-05-08 - - - - - chrony -- multiple vulnerabilities - - - chrony - 1.31.1 - - - - -

Chrony News reports:

-
-

CVE-2015-1853: DoS attack on authenticated symmetric NTP - associations

-

CVE-2015-1821: Heap-based buffer overflow in access - configuration

-

CVE-2015-1822: Use of uninitialized pointer in command - processing

-
- - - - http://chrony.tuxfamily.org/News.html - CVE-2015-1821 - CVE-2015-1822 - CVE-2015-1853 - - - 2015-02-17 - 2015-04-18 - - - - - Dulwich -- Remote code execution - - - py27-dulwich - 0.9.9 - - - - -

MITRE reports:

-
-

Buffer overflow in the C implementation of the apply_delta - function in _pack.c in Dulwich before 0.9.9 allows remote - attackers to execute arbitrary code via a crafted pack file.

-
- - - - CVE-2015-0838 - - - 2015-01-07 - 2015-04-17 - - - - - Adobe Flash Player -- critical vulnerabilities - - - linux-c6-flashplugin - 11.2r202.451 - - - linux-f10-flashplugin - 11.2r202.451 - - - - -

Adobe reports:

-
-

- Adobe has released security updates for Adobe Flash Player for - Windows, Macintosh and Linux. These updates address vulnerabilities - that could potentially allow an attacker to take control of the - affected system. Adobe is aware of a report that an exploit for - CVE-2015-3043 exists in the wild, and recommends users update their - product installations to the latest versions. -

-
    -
  • - These updates resolve memory corruption vulnerabilities that could - lead to code execution (CVE-2015-0347, CVE-2015-0350, CVE-2015-0352, - CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360, - CVE-2015-3038, CVE-2015-3041, CVE-2015-3042, CVE-2015-3043). -
    • -
  • - These updates resolve a type confusion vulnerability that could lead - to code execution (CVE-2015-0356). -
    • -
  • - These updates resolve a buffer overflow vulnerability that could - lead to code execution (CVE-2015-0348). -
    • -
  • - These updates resolve use-after-free vulnerabilities that could lead - to code execution (CVE-2015-0349, CVE-2015-0351, CVE-2015-0358, - CVE-2015-3039). -
    • -
  • - These updates resolve double-free vulnerabilities that could lead to - code execution (CVE-2015-0346, CVE-2015-0359). -
    • -
  • - These updates resolve memory leak vulnerabilities that could be used - to bypass ASLR (CVE-2015-0357, CVE-2015-3040). -
    • -
  • - These updates resolve a security bypass vulnerability that could - lead to information disclosure (CVE-2015-3044). -
    • -
-
- - - - https://helpx.adobe.com/security/products/flash-player/apsb15-06.html - CVE-2015-3038 - CVE-2015-3039 - CVE-2015-3040 - CVE-2015-3041 - CVE-2015-3042 - CVE-2015-3043 - CVE-2015-3044 - CVE-2015-0346 - CVE-2015-0347 - CVE-2015-0348 - CVE-2015-0349 - CVE-2015-0350 - CVE-2015-0351 - CVE-2015-0352 - CVE-2015-0353 - CVE-2015-0354 - CVE-2015-0355 - CVE-2015-0356 - CVE-2015-0357 - CVE-2015-0358 - CVE-2015-0359 - CVE-2015-0360 - - - 2015-04-14 - 2015-04-17 - - - - - Wesnoth -- Remote information disclosure - - - wesnoth - wesnoth-devel - 1.7.01.12.2 - - - - -

US-CERT/NIST reports:

-
-

The WML/Lua API in Battle for Wesnoth 1.7.x through - 1.11.x and 1.12.x before 1.12.2 allows remote attackers to - read arbitrary files via a crafted (1) campaign or (2) map - file.

-
- - - - CVE-2015-0844 - - - 2015-04-11 - 2015-04-17 - - - - - qt4-imageformats, qt4-gui, qt5-gui -- Multiple Vulnerabilities in Qt Image Format Handling - - - qt4-imageformats - 4.8.6_3 - - - qt4-gui - 4.8.6_5 - - - qt5-gui - 5.4.1_1 - - - - -

Richard J. Moore reports:

-
-

Due to two recent vulnerabilities identified in the built-in image - format handling code, it was decided that this area required further - testing to determine if further issues remained. Fuzzing using - afl-fuzz located a number of issues in the handling of BMP, ICO and - GIF files. The issues exposed included denial of service and buffer - overflows leading to heap corruption. It is possible the latter could - be used to perform remote code execution.

-
- - - - http://lists.qt-project.org/pipermail/announce/2015-April/000067.html - CVE-2015-1858 - CVE-2015-1859 - CVE-2015-1860 - - - 2015-04-12 - 2015-04-14 - - - - - Ruby -- OpenSSL Hostname Verification Vulnerability - - - ruby - ruby20 - 2.0,12.0.0.645,1 - - - ruby - ruby21 - 2.1,12.1.6,1 - - - ruby - ruby22 - 2.2,12.2.2,1 - - - - -

Ruby Developers report:

-
-

After reviewing RFC 6125 and RFC 5280, we found multiple violations - of matching hostnames and particularly wildcard certificates.

-

Ruby’s OpenSSL extension will now provide a string-based matching - algorithm which follows more strict behavior, as recommended by - these RFCs. In particular, matching of more than one wildcard per - subject/SAN is no-longer allowed. As well, comparison of these - values are now case-insensitive.

-
- - - - https://www.ruby-lang.org/en/news/2015/04/13/ruby-openssl-hostname-matching-vulnerability/ - CVE-2015-1855 - - - 2015-04-13 - 2015-04-14 - 2015-09-23 - - - - - mailman -- path traversal vulnerability - - - mailman - 2.1.20 - - - mailman-with-htdig - 2.1.20 - - - ja-mailman - 2.1.14.j7_2,1 - - - - -

Mark Sapiro reports:

-
-

A path traversal vulnerability has been discovered and fixed. This - vulnerability is only exploitable by a local user on a Mailman - server where the suggested Exim transport, the Postfix - postfix_to_mailman.py transport or some other programmatic MTA - delivery not using aliases is employed.

-
- - - - https://mail.python.org/pipermail/mailman-announce/2015-March/000209.html - https://bugs.launchpad.net/mailman/+bug/1437145 - CVE-2015-2775 - - - 2015-03-27 - 2015-04-09 - 2015-06-17 - - - - - asterisk -- TLS Certificate Common name NULL byte exploit - - - asterisk - 1.8.32.3 - - - asterisk11 - 11.17.1 - - - asterisk13 - 13.3.2 - - - - -

The Asterisk project reports:

-
-

When Asterisk registers to a SIP TLS device and and - verifies the server, Asterisk will accept signed certificates - that match a common name other than the one Asterisk is - expecting if the signed certificate has a common name - containing a null byte after the portion of the common - name that Asterisk expected. For example, if Asterisk is - trying to register to www.domain.com, Asterisk will accept - certificates of the form - www.domain.com\x00www.someotherdomain.com

-
- - - - http://downloads.asterisk.org/pub/security/AST-2015-003.html - CVE-2015-3008 - - - 2015-04-04 - 2015-04-08 - - - - - ntp -- multiple vulnerabilities - - - ntp - 4.2.8p2 - - - ntp-devel - 4.3.14 - - - FreeBSD - 10.110.1_9 - 9.39.3_13 - 8.48.4_27 - - - - -

ntp.org reports:

-
-
    -
  • [Sec 2779] ntpd accepts unauthenticated packets - with symmetric key crypto.
    • -
  • [Sec 2781] Authentication doesn't protect symmetric - associations against DoS attacks.
    • -
-
- - - - SA-15:07.ntp - CVE-2015-1798 - CVE-2015-1799 - http://archive.ntp.org/ntp4/ChangeLog-stable - - - 2015-04-07 - 2015-04-07 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 37.0.1,1 - - - linux-firefox - 37.0.1,1 - - - - -

The Mozilla Project reports:

-
-

MFSA 2015-44 Certificate verification bypass through the - HTTP/2 Alt-Svc header

-

MFSA 2015-43 Loading privileged content through Reader - mode

-
- - - - CVE-2015-0798 - CVE-2015-0799 - https://www.mozilla.org/security/advisories/mfsa2015-43/ - https://www.mozilla.org/security/advisories/mfsa2015-44/ - https://www.mozilla.org/security/advisories/ - - - 2015-04-03 - 2015-04-04 - - - - - Several vulnerabilities in libav - - - libav - 11.3 - - - - -

The libav project reports:

-
-

utvideodec: Handle slice_height being zero (CVE-2014-9604)

-

tiff: Check that there is no aliasing in pixel format selection (CVE-2014-8544)

-
- - - - https://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v11.3 - CVE-2014-8544 - CVE-2014-9604 - - - 2015-03-24 - 2015-04-03 - - - - - Several vulnerabilities found in PHP - - - php53 - 5.3.29_5 - - - php5 - 5.4.39 - - - php55 - 5.5.23 - - - php56 - 5.6.7 - - - - -

The PHP project reports:

-
-

The PHP development team announces the immediate - availability of PHP 5.6.7. Several bugs have been - fixed as well as CVE-2015-0231, CVE-2015-2305 and - CVE-2015-2331. All PHP 5.6 users are encouraged to - upgrade to this version.

-

The PHP development team announces the immediate - availability of PHP 5.5.23. Several bugs have been - fixed as well as CVE-2015-0231, CVE-2015-2305 and - CVE-2015-2331. All PHP 5.5 users are encouraged - to upgrade to this version.

-

The PHP development team announces the immediate - availability of PHP 5.4.39. Six security-related - bugs were fixed in this release, including - CVE-2015-0231, CVE-2015-2305 and CVE-2015-2331. - All PHP 5.4 users are encouraged to upgrade to - this version.

-
- - - - http://php.net/archive/2015.php#id2015-03-20-2 - CVE-2015-0231 - CVE-2015-2305 - CVE-2015-2311 - ports/198739 - - - 2015-03-19 - 2015-04-01 - - - - - subversion -- DoS vulnerabilities - - - mod_dav_svn - 1.5.01.7.20 - 1.8.01.8.13 - - - subversion16 - 1.0.01.7.20 - - - subversion17 - 1.0.01.7.20 - - - subversion - 1.0.01.7.20 - 1.8.01.8.13 - - - - -

Subversion Project reports:

-
-

Subversion HTTP servers with FSFS repositories are vulnerable to a remotely - triggerable excessive memory use with certain REPORT requests.

-

Subversion mod_dav_svn and svnserve are vulnerable to a remotely triggerable - assertion DoS vulnerability for certain requests with dynamically evaluated - revision numbers.

-

Subversion HTTP servers allow spoofing svn:author property values for new - revisions.

-
- - - - http://subversion.apache.org/security/ - CVE-2015-0202 - CVE-2015-0248 - CVE-2015-0251 - http://subversion.apache.org/security/CVE-2015-0202-advisory.txt - http://subversion.apache.org/security/CVE-2015-0248-advisory.txt - http://subversion.apache.org/security/CVE-2015-0251-advisory.txt - - - 2015-03-31 - 2015-03-31 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 37.0,1 - - - firefox-esr - 31.6.0,1 - - - linux-firefox - 37.0,1 - - - linux-seamonkey - 2.34 - - - linux-thunderbird - 31.6.0 - - - seamonkey - 2.34 - - - thunderbird - 31.6.0 - - - libxul - 31.6.0 - - - - -

The Mozilla Project reports:

-
-

MFSA-2015-30 Miscellaneous memory safety hazards (rv:37.0 - / rv:31.6)

-

MFSA-2015-31 Use-after-free when using the Fluendo MP3 - GStreamer plugin

-

MFSA-2015-32 Add-on lightweight theme installation - approval bypassed through MITM attack

-

MFSA-2015-33 resource:// documents can load privileged - pages

-

MFSA-2015-34 Out of bounds read in QCMS library

-

MFSA-2015-35 Cursor clickjacking with flash and images

-

MFSA-2015-36 Incorrect memory management for simple-type - arrays in WebRTC

-

MFSA-2015-37 CORS requests should not follow 30x - redirections after preflight

-

MFSA-2015-38 Memory corruption crashes in Off Main Thread - Compositing

-

MFSA-2015-39 Use-after-free due to type confusion flaws

-

MFSA-2015-40 Same-origin bypass through anchor navigation

-

MFSA-2015-41 PRNG weakness allows for DNS poisoning on - Android

-

MFSA-2015-42 Windows can retain access to privileged - content on navigation to unprivileged pages

-
- - - - CVE-2012-2808 - CVE-2015-0800 - CVE-2015-0801 - CVE-2015-0802 - CVE-2015-0803 - CVE-2015-0804 - CVE-2015-0805 - CVE-2015-0806 - CVE-2015-0807 - CVE-2015-0808 - CVE-2015-0810 - CVE-2015-0811 - CVE-2015-0812 - CVE-2015-0813 - CVE-2015-0814 - CVE-2015-0815 - CVE-2015-0816 - https://www.mozilla.org/security/advisories/mfsa2015-30/ - https://www.mozilla.org/security/advisories/mfsa2015-31/ - https://www.mozilla.org/security/advisories/mfsa2015-32/ - https://www.mozilla.org/security/advisories/mfsa2015-33/ - https://www.mozilla.org/security/advisories/mfsa2015-34/ - https://www.mozilla.org/security/advisories/mfsa2015-35/ - https://www.mozilla.org/security/advisories/mfsa2015-36/ - https://www.mozilla.org/security/advisories/mfsa2015-37/ - https://www.mozilla.org/security/advisories/mfsa2015-38/ - https://www.mozilla.org/security/advisories/mfsa2015-39/ - https://www.mozilla.org/security/advisories/mfsa2015-40/ - https://www.mozilla.org/security/advisories/mfsa2015-41/ - https://www.mozilla.org/security/advisories/mfsa2015-42/ - https://www.mozilla.org/security/advisories/ - - - 2015-03-31 - 2015-03-31 - - - - - osc -- shell command injection via crafted _service files - - - osc - 0.151.0 - - - - -

SUSE Security Update reports:

-
-

osc before 0.151.0 allows remote attackers to execute - arbitrary commands via shell metacharacters in a _service - file.

-
- - - - CVE-2015-0778 - https://www.suse.com/security/cve/CVE-2015-0778.html - https://bugzilla.suse.com/show_bug.cgi?id=901643 - http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00012.html - - - 2015-03-16 - 2015-03-31 - - - - - cpio -- multiple vulnerabilities - - - gcpio - 2.11_3 - - - - -

From the Debian Security Team:

-
-

Heap-based buffer overflow in the process_copy_in - function in GNU Cpio 2.11 allows remote attackers to cause - a denial of service via a large block value in a cpio - archive.

-
-
-

cpio 2.11, when using the --no-absolute-filenames - option, allows local users to write to arbitrary files - via a symlink attack on a file in an archive.

-
- - - - CVE-2014-9112 - https://security-tracker.debian.org/tracker/CVE-2014-9112 - CVE-2015-1197 - https://bugzilla.suse.com/show_bug.cgi?id=658010 - - - 2015-03-27 - 2015-03-31 - - - - - libzip -- integer overflow - - - libzip - 0.11.2_2 - - - ppsspp - 1.0.1_5 - - - ppsspp-devel - 1.0.1.2668_1 - - - radare2 - 0.9.8_1 - - - openlierox - 0.58.r3_5,1 - - - - -

libzip developers report:

-
-

Avoid integer overflow. Fixed similarly to patch used in PHP copy of libzip.

-
- - - - https://bugs.php.net/bug.php?id=69253 - https://github.com/php/php-src/commit/ef8fc4b53d92fbfcd8ef1abbd6f2f5fe2c4a11e5 - http://hg.nih.at/libzip/rev/9f11d54f692e - CVE-2015-2331 - - - 2015-03-18 - 2015-03-28 - 2015-09-20 - - - - - django -- multiple vulnerabilities - - - py27-django - 1.41.4.20 - 1.61.6.11 - 1.71.7.7 - - - py32-django - 1.41.4.20 - 1.61.6.11 - 1.71.7.7 - - - py33-django - 1.41.4.20 - 1.61.6.11 - 1.71.7.7 - - - py34-django - 1.41.4.20 - 1.61.6.11 - 1.71.7.7 - - - py27-django-devel - 20150326,1 - - - py32-django-devel - 20150326,1 - - - py33-django-devel - 20150326,1 - - - py34-django-devel - 20150326,1 - - - - -

The Django project reports:

-
-

In accordance with our security release policy, the Django team - is issuing multiple releases -- Django 1.4.20, 1.6.11, 1.7.7 and - 1.8c1. These releases are now available on PyPI and our download - page. These releases address several security issues detailed - below. We encourage all users of Django to upgrade as soon as - possible. The Django master branch has also been updated.

-
- - - - https://www.djangoproject.com/weblog/2015/mar/18/security-releases/ - CVE-2015-2316 - CVE-2015-2317 - - - 2015-03-18 - 2015-03-27 - - - - - GNU binutils -- multiple vulnerabilities - - - cross-binutils - 2.25 - - - x86_64-pc-mingw32-binutils - 2.25 - - - m6811-binutils - 2.25 - - - - -

US-CERT/NIST reports:

-
-

The _bfd_XXi_swap_aouthdr_in function in bfd/peXXigen.c in GNU - binutils 2.24 and earlier allows remote attackers to cause a - denial of service (out-of-bounds write) and possibly have other - unspecified impact via a crafted NumberOfRvaAndSizes field in the - AOUT header in a PE executable.

-
-

US-CERT/NIST reports:

-
-

Heap-based buffer overflow in the pe_print_edata function in - bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remote - attackers to cause a denial of service (crash) and possibly have - other unspecified impact via a truncated export table in a PE - file.

-
-

US-CERT/NIST reports:

-
-

Stack-based buffer overflow in the ihex_scan function in - bfd/ihex.c in GNU binutils 2.24 and earlier allows remote - attackers to cause a denial of service (crash) and possibly have - other unspecified impact via a crafted ihex file.

-
- - - - CVE-2014-8501 - CVE-2014-8502 - CVE-2014-8503 - https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8501 - https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8502 - https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8503 - - - 2014-12-09 - 2015-03-24 - 2016-01-08 - - - - - libuv -- incorrect revocation order while relinquishing privileges - - - node010 - 0.10.36 - - - - -

Nodejs releases reports:

-
-
CVE-2015-0278
-

This may potentially allow an attacker to gain elevated privileges.

-
- - - - http://blog.nodejs.org/2015/03/14/node-v0-10-37-stable - ports/198861 - CVE-2015-0278 - - - 2015-03-14 - 2015-03-24 - - - - - jenkins -- multiple vulnerabilities - - - jenkins - 1.605 - - - jenkins-lts - 1.596.1 - - - - -

Jenkins Security Advisory:

-
-

Description

-
SECURITY-171, SECURITY-177 (Reflective XSS vulnerability)
-

An attacker without any access to Jenkins can navigate the user - to a carefully crafted URL and have the user execute unintended - actions. This vulnerability can be used to attack Jenkins inside - firewalls from outside so long as the location of Jenkins is known - to the attacker.

-
SECURITY-180 (forced API token change)
-

The part of Jenkins that issues a new API token was not - adequately protected against anonymous attackers. This allows an - attacker to escalate privileges on Jenkins.

-
- - - - https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-03-23 - - - 2015-03-23 - 2015-03-24 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 36.0.4,1 - - - firefox-esr - 31.5.3,1 - - - linux-firefox - 36.0.4,1 - - - linux-seamonkey - 2.33.1 - - - seamonkey - 2.33.1 - - - libxul - 31.5.3 - - - - -

The Mozilla Project reports:

-
-

MFSA-2015-28 Privilege escalation through SVG navigation

-

MFSA-2015-29 Code execution through incorrect JavaScript - bounds checking elimination

-
- - - - CVE-2015-0817 - CVE-2015-0818 - https://www.mozilla.org/security/advisories/mfsa2015-28/ - https://www.mozilla.org/security/advisories/mfsa2015-29/ - https://www.mozilla.org/security/advisories/ - - - 2015-03-20 - 2015-03-22 - - - - - OpenSSL -- multiple vulnerabilities - - - openssl - 1.0.11.0.1_19 - - - mingw32-openssl - 1.0.11.0.1m - - - linux-c6-openssl - 1.0.1e_4 - - - libressl - 2.1.5_1 - - - FreeBSD - 10.110.1_8 - 9.39.3_12 - 8.48.4_26 - - - - -

OpenSSL project reports:

-
-
    -
  • Reclassified: RSA silently downgrades to EXPORT_RSA - [Client] (CVE-2015-0204). OpenSSL only.
    • -
  • Segmentation fault in ASN1_TYPE_cmp (CVE-2015-0286)
    • -
  • ASN.1 structure reuse memory corruption (CVE-2015-0287)
    • -
  • PKCS#7 NULL pointer dereferences (CVE-2015-0289)
    • -
  • Base64 decode (CVE-2015-0292). OpenSSL only.
    • -
  • DoS via reachable assert in SSLv2 servers - (CVE-2015-0293). OpenSSL only.
    • -
  • Use After Free following d2i_ECPrivatekey error - (CVE-2015-0209)
    • -
  • X509_to_X509_REQ NULL pointer deref (CVE-2015-0288)
    • -
-
- - - - SA-15:06.openssl - ports/198681 - CVE-2015-0204 - CVE-2015-0286 - CVE-2015-0287 - CVE-2015-0289 - CVE-2015-0292 - CVE-2015-0293 - CVE-2015-0209 - CVE-2015-0288 - https://www.openssl.org/news/secadv_20150319.txt - - - 2015-03-19 - 2015-03-19 - 2016-08-09 - - - - - libXfont -- BDF parsing issues - - - libXfont - 1.5.1 - - - linux-c6-xorg-libs - 7.4_4 - - - linux-f10-xorg-libs - 7.4_4 - - - - -

Alan Coopersmith reports:

-
-

Ilja van Sprundel, a security researcher with IOActive, has - discovered an issue in the parsing of BDF font files by libXfont. - Additional testing by Alan Coopersmith and William Robinet with - the American Fuzzy Lop (afl) tool uncovered two more issues in - the parsing of BDF font files.

- -

As libXfont is used by the X server to read font files, and an - unprivileged user with access to the X server can tell the X - server to read a given font file from a path of their choosing, - these vulnerabilities have the potential to allow unprivileged - users to run code with the privileges of the X server - (often root access).

-
- - - - http://lists.x.org/archives/xorg-announce/2015-March/002550.html - CVE-2015-1802 - CVE-2015-1803 - CVE-2015-1804 - - - 2015-03-17 - 2015-03-18 - 2016-01-31 - - - - - Adobe Flash Player -- critical vulnerabilities - - - linux-c6-flashplugin - 11.2r202.442 - - - linux-f10-flashplugin - 11.2r202.442 - - - - -

Adobe reports:

-
-

- Adobe has released security updates for Adobe Flash Player for - Windows, Macintosh and Linux. These updates address vulnerabilities - that could potentially allow an attacker to take control of the - affected system. - These updates resolve memory corruption vulnerabilities that could - lead to code execution (CVE-2015-0332, CVE-2015-0333, CVE-2015-0335, - CVE-2015-0339). - These updates resolve type confusion vulnerabilities that could lead - to code execution (CVE-2015-0334, CVE-2015-0336). - These updates resolve a vulnerability that could lead to a - cross-domain policy bypass (CVE-2015-0337). - These updates resolve a vulnerability that could lead to a file - upload restriction bypass (CVE-2015-0340). - These updates resolve an integer overflow vulnerability that could - lead to code execution (CVE-2015-0338). - These updates resolve use-after-free vulnerabilities that could lead - to code execution (CVE-2015-0341, CVE-2015-0342). -

-
- - - - https://helpx.adobe.com/security/products/flash-player/apsb15-05.html - CVE-2015-0332 - CVE-2015-0333 - CVE-2015-0334 - CVE-2015-0335 - CVE-2015-0336 - CVE-2015-0337 - CVE-2015-0338 - CVE-2015-0339 - CVE-2015-0340 - CVE-2015-0341 - CVE-2015-0342 - - - 2015-03-12 - 2015-03-13 - - - - - sympa -- Remote attackers can read arbitrary files - - - sympa - 6.1.24 - - - - -

The Sympa Project reports:

-
-

The newsletter posting area in the web interface in Sympa 6.0.x before 6.0.10 and 6.1.x before 6.1.24 allows remote attackers to read arbitrary files via unspecified vectors.

-
- - - - https://www.sympa.org/security_advisories - CVE-2015-1306 - - - 2015-01-13 - 2015-03-13 - - - - - rt -- Remote DoS, Information disclosure and Session Hijackingvulnerabilities - - - rt42 - 4.2.04.2.10 - - - rt40 - 4.0.04.0.23 - - - - -

Best Practical reports:

-
-

RT 3.0.0 and above, if running on Perl 5.14.0 or higher, - are vulnerable to a remote denial-of-service via the email - gateway; any installation which accepts mail from untrusted - sources is vulnerable, regardless of the permissions - configuration inside RT. This denial-of-service may - encompass both CPU and disk usage, depending on RT's logging - configuration. This vulnerability is assigned - CVE-2014-9472.

-

RT 3.8.8 and above are vulnerable to an information - disclosure attack which may reveal RSS feeds URLs, and thus - ticket data; this vulnerability is assigned - CVE-2015-1165. RSS feed URLs can also be leveraged to - perform session hijacking, allowing a user with the URL to - log in as the user that created the feed; this vulnerability - is assigned CVE-2015-1464.

-
- - - - http://blog.bestpractical.com/2015/02/security-vulnerabilities-in-rt.html - CVE-2014-9472 - CVE-2015-1165 - CVE-2015-1464 - - - 2015-02-26 - 2015-03-08 - - - - - phpMyAdmin -- Risk of BREACH attack due to reflected parameter - - - phpMyAdmin - 4.3.04.3.11.1 - - - - -

The phpMyAdmin development team reports:

-
-

Risk of BREACH attack due to reflected parameter.

-

With a large number of crafted requests it was possible to infer - the CSRF token by a BREACH attack.

-

Mitigation factor: this vulnerability can only be exploited in - the presence of another vulnerability that allows the attacker to - inject JavaScript into victim's browser.

-
- - - - http://www.phpmyadmin.net/home_page/security/PMASA-2015-1.php - CVE-2015-2206 - - - 2015-03-04 - 2015-03-08 - - - - - mono -- TLS bugs - - - mono - 3.10.1 - 3.123.12.1 - - - - -

The Mono project reports:

-
-

Mono’s implementation of the SSL/TLS stack failed to check the order of the handshake messages. Which would allow various attacks on the protocol to succeed. Details of this vulnerability are discussed in SKIP-TLS post.

-

Mono’s implementation of SSL/TLS also contained support for the weak EXPORT cyphers and was susceptible to the FREAK attack.

-
- - - - http://www.mono-project.com/docs/about-mono/vulnerabilities/#tls-bugs - - - 2015-03-06 - 2015-03-07 - - - - - PuTTY -- fails to scrub private keys from memory after use - - - putty - 0.64 - - - - -

Simon Tatham reports:

-
-

When PuTTY has sensitive data in memory and has no further need for - it, it should wipe the data out of its memory, in case malware later - gains access to the PuTTY process or the memory is swapped out to - disk or written into a crash dump file. An obvious example of this - is the password typed during SSH login; other examples include - obsolete session keys, public-key passphrases, and the private - halves of public keys.

-

PuTTY 0.63 and earlier versions, after loading a private key - from a disk file, mistakenly leak a memory buffer containing a - copy of the private key, in the function ssh2_load_userkey. The - companion function ssh2_save_userkey (only called by PuTTYgen) can - also leak a copy, but only in the case where the file it tried to - save to could not be created.

-
- - - - http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-wiped-2.html - CVE-2015-2157 - - - 2015-02-28 - 2015-03-05 - - - - - chromium -- multiple vulnerabilities - - - chromium - 41.0.2272.76 - - - chromium-npapi - 41.0.2272.76 - - - chromium-pulse - 41.0.2272.76 - - - - -

Chrome Releases reports:

-
-

51 security fixes in this release, including:

-
    -
  • [456516] High CVE-2015-1212: Out-of-bounds write in media. - Credit to anonymous.
    • -
  • [448423] High CVE-2015-1213: Out-of-bounds write in skia - filters. Credit to cloudfuzzer.
    • -
  • [445810] High CVE-2015-1214: Out-of-bounds write in skia - filters. Credit to cloudfuzzer.
    • -
  • [445809] High CVE-2015-1215: Out-of-bounds write in skia - filters. Credit to cloudfuzzer.
    • -
  • [454954] High CVE-2015-1216: Use-after-free in v8 bindings. - Credit to anonymous.
    • -
  • [456192] High CVE-2015-1217: Type confusion in v8 bindings. - Credit to anonymous.
    • -
  • [456059] High CVE-2015-1218: Use-after-free in dom. - Credit to cloudfuzzer.
    • -
  • [446164] High CVE-2015-1219: Integer overflow in webgl. - Credit to Chen Zhang (demi6od) of NSFOCUS Security Team.
    • -
  • [437651] High CVE-2015-1220: Use-after-free in gif decoder. - Credit to Aki Helin of OUSPG.
    • -
  • [455368] High CVE-2015-1221: Use-after-free in web databases. - Credit to Collin Payne.
    • -
  • [448082] High CVE-2015-1222: Use-after-free in service workers. - Credit to Collin Payne.
    • -
  • [454231] High CVE-2015-1223: Use-after-free in dom. - Credit to Maksymillian Motyl.
    • -
  • High CVE-2015-1230: Type confusion in v8. - Credit to Skylined working with HP's Zero Day Initiative.
    • -
  • [449958] Medium CVE-2015-1224: Out-of-bounds read in vpxdecoder. - Credit to Aki Helin of OUSPG.
    • -
  • [446033] Medium CVE-2015-1225: Out-of-bounds read in pdfium. - Credit to cloudfuzzer.
    • -
  • [456841] Medium CVE-2015-1226: Validation issue in debugger. - Credit to Rob Wu.
    • -
  • [450389] Medium CVE-2015-1227: Uninitialized value in blink. - Credit to Christoph Diehl.
    • -
  • [444707] Medium CVE-2015-1228: Uninitialized value in rendering. - Credit to miaubiz.
    • -
  • [431504] Medium CVE-2015-1229: Cookie injection via proxies. - Credit to iliwoy.
    • -
  • [463349] CVE-2015-1231: Various fixes from internal audits, - fuzzing, and other initiatives.
    • -
-
- - - - CVE-2015-1212 - CVE-2015-1213 - CVE-2015-1214 - CVE-2015-1215 - CVE-2015-1216 - CVE-2015-1217 - CVE-2015-1218 - CVE-2015-1219 - CVE-2015-1220 - CVE-2015-1221 - CVE-2015-1222 - CVE-2015-1223 - CVE-2015-1224 - CVE-2015-1225 - CVE-2015-1226 - CVE-2015-1227 - CVE-2015-1228 - CVE-2015-1229 - CVE-2015-1230 - CVE-2015-1231 - http://googlechromereleases.blogspot.nl - - - 2015-03-03 - 2015-03-04 - - - - - qt4-gui, qt5-gui -- DoS vulnerability in the BMP image handler - - - qt4-gui - 4.8.6_4 - - - qt5-gui - 5.3.2_2 - - - - -

Richard J. Moore reports:

-
-

The builtin BMP decoder in QtGui prior to Qt 5.5 contained a bug - that would lead to a division by zero when loading certain corrupt - BMP files. This in turn would cause the application loading these - hand crafted BMPs to crash.

-
- - - - CVE-2015-0295 - http://lists.qt-project.org/pipermail/announce/2015-February/000059.html - - - 2015-02-22 - 2015-03-05 - - - - - jenkins -- multiple vulnerabilities - - - jenkins - 1.600 - - - jenkins-lts - 1.580.3 - - - - -

Kohsuke Kawaguchi from Jenkins team reports:

-
-

Description

-
SECURITY-125 (Combination filter Groovy script unsecured)
-

This vulnerability allows users with the job configuration - privilege to escalate his privileges, resulting in arbitrary code - execution to the master.

-
SECURITY-162 (directory traversal from artifacts via symlink)
-

This vulnerability allows users with the job configuration - privilege or users with commit access to the build script to - access arbitrary files/directories on the master, resulting in - the exposure of sensitive information, such as encryption keys.

-
SECURITY-163 (update center metadata retrieval DoS attack)
-

This vulnerability allows authenticated users to disrupt the - operation of Jenkins by feeding malicious update center data into - Jenkins, affecting plugin installation and tool installation.

-
SECURITY-165 (external entity injection via XPath)
-

This vulnerability allows users with the read access to Jenkins - to retrieve arbitrary XML document on the server, resulting in - the exposure of sensitive information inside/outside Jenkins.

-
SECURITY-166 (HudsonPrivateSecurityRealm allows creation of - reserved names)
-

For users using "Jenkins' own user database" setting, Jenkins - doesn't refuse reserved names, thus allowing privilege escalation.

-
SECURITY-167 (External entity processing in XML can reveal - sensitive local files)
-

This vulnerability allows attackers to create malicious XML - documents and feed that into Jenkins, which causes Jenkins to - retrieve arbitrary XML document on the server, resulting in the - exposure of sensitive information inside/outside Jenkins.

-

Severity

-

SECURITY-125 is rated critical. This attack can be - only mounted by users with some trust, but it results in arbitrary - code execution on the master.

-

SECURITY-162 is rated critical. This attack can be - only mounted by users with some trust, but it results in the - exposure of sensitive information.

-

SECURITY-163 is rated medium, as it results in the - loss of functionality.

-

SECURITY-165 is rated critical. This attack is - easy to mount, and it results in the exposure of sensitive - information.

-

SECURITY-166 is rated critical. For users who use - the affected feature, this attack results in arbitrary code - execution on the master.

-

SECURITY-167 is rated critical. This attack is - easy to mount, and it results in the exposure of sensitive information.

-
- - - - https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27 - - - 2015-03-01 - 2015-03-01 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 36.0,1 - - - firefox-esr - 31.5.0,1 - - - linux-firefox - 36.0,1 - - - linux-seamonkey - 2.33 - - - linux-thunderbird - 31.5.0 - - - seamonkey - 2.33 - - - thunderbird - 31.5.0 - - - libxul - 31.5.0 - - - - -

The Mozilla Project reports:

-
-

MFSA-2015-11 Miscellaneous memory safety hazards (rv:36.0 - / rv:31.5)

-

MFSA-2015-12 Invoking Mozilla updater will load locally - stored DLL files

-

MFSA-2015-13 Appended period to hostnames can bypass HPKP - and HSTS protections

-

MFSA-2015-14 Malicious WebGL content crash when writing - strings

-

MFSA-2015-15 TLS TURN and STUN connections silently fail - to simple TCP connections

-

MFSA-2015-16 Use-after-free in IndexedDB

-

MFSA-2015-17 Buffer overflow in libstagefright during MP4 - video playback

-

MFSA-2015-18 Double-free when using non-default memory - allocators with a zero-length XHR

-

MFSA-2015-19 Out-of-bounds read and write while rendering - SVG content

-

MFSA-2015-20 Buffer overflow during CSS restyling

-

MFSA-2015-21 Buffer underflow during MP3 playback

-

MFSA-2015-22 Crash using DrawTarget in Cairo graphics - library

-

MFSA-2015-23 Use-after-free in Developer Console date - with OpenType Sanitiser

-

MFSA-2015-24 Reading of local files through manipulation - of form autocomplete

-

MFSA-2015-25 Local files or privileged URLs in pages can - be opened into new tabs

-

MFSA-2015-26 UI Tour whitelisted sites in background tab - can spoof foreground tabs

-

MFSA-2015-27 Caja Compiler JavaScript sandbox bypass

-
- - - - CVE-2015-0819 - CVE-2015-0820 - CVE-2015-0821 - CVE-2015-0822 - CVE-2015-0823 - CVE-2015-0824 - CVE-2015-0825 - CVE-2015-0826 - CVE-2015-0827 - CVE-2015-0828 - CVE-2015-0829 - CVE-2015-0830 - CVE-2015-0831 - CVE-2015-0832 - CVE-2015-0833 - CVE-2015-0834 - CVE-2015-0835 - CVE-2015-0836 - https://www.mozilla.org/security/advisories/mfsa2015-11/ - https://www.mozilla.org/security/advisories/mfsa2015-12/ - https://www.mozilla.org/security/advisories/mfsa2015-13/ - https://www.mozilla.org/security/advisories/mfsa2015-14/ - https://www.mozilla.org/security/advisories/mfsa2015-15/ - https://www.mozilla.org/security/advisories/mfsa2015-16/ - https://www.mozilla.org/security/advisories/mfsa2015-17/ - https://www.mozilla.org/security/advisories/mfsa2015-18/ - https://www.mozilla.org/security/advisories/mfsa2015-19/ - https://www.mozilla.org/security/advisories/mfsa2015-20/ - https://www.mozilla.org/security/advisories/mfsa2015-21/ - https://www.mozilla.org/security/advisories/mfsa2015-22/ - https://www.mozilla.org/security/advisories/mfsa2015-23/ - https://www.mozilla.org/security/advisories/mfsa2015-24/ - https://www.mozilla.org/security/advisories/mfsa2015-25/ - https://www.mozilla.org/security/advisories/mfsa2015-26/ - https://www.mozilla.org/security/advisories/mfsa2015-27/ - https://www.mozilla.org/security/advisories/ - - - 2015-02-24 - 2015-02-27 - - - - - php5 -- multiple vulnerabilities - - - php5 - 5.4.38 - - - php55 - 5.5.22 - - - php56 - 5.6.6 - - - - -

The PHP Project reports:

-
-

Use after free vulnerability in unserialize() with DateTimeZone.

-

Mitigation for CVE-2015-0235 -- GHOST: glibc gethostbyname buffer - overflow.

-
- - - - CVE-2015-0235 - CVE-2015-0273 - http://php.net/ChangeLog-5.php#5.4.38 - http://php.net/ChangeLog-5.php#5.5.22 - http://php.net/ChangeLog-5.php#5.6.6 - - - 2015-02-18 - 2015-02-26 - - - - - krb5 1.11 -- New release/fix multiple vulnerabilities - - - krb5-111 - 1.11.6 - - - - -

The MIT Kerberos team announces the availability of MIT Kerberos 5 Release 1.11.6:

-
-

Handle certain invalid RFC 1964 GSS tokens correctly to avoid - invalid memory reference vulnerabilities. [CVE-2014-4341

-

Fix memory management vulnerabilities in GSSAPI SPNEGO. - [CVE-2014-4343 CVE-2014-4344]

-

Fix buffer overflow vulnerability in LDAP KDB back end. - [CVE-2014-4345]

-

Fix multiple vulnerabilities in the LDAP KDC back end. - [CVE-2014-5354 CVE-2014-5353]

-

Fix multiple kadmind vulnerabilities, some of which are based - in the gssrpc library. [CVE-2014-5352 CVE-2014-9421 - CVE-2014-9422 CVE-2014-9423]

-
- - - - http://web.mit.edu/kerberos/krb5-1.11/README-1.11.6.txt - - - 2015-02-25 - 2015-02-25 - - - - - samba -- Unexpected code execution in smbd - - - samba4 - 4.0.04.0.25 - - - samba41 - 4.1.04.1.17 - - - samba36 - 3.6.03.6.25 - - - - -

Samba development team reports:

-
-

All versions of Samba from 3.5.0 to 4.2.0rc4 are - vulnerable to an unexpected code execution vulnerability - in the smbd file server daemon.

-

A malicious client could send packets that may set up the - stack in such a way that the freeing of memory in a - subsequent anonymous netlogon packet could allow execution - of arbitrary code. This code would execute with root - privileges.

-
- - - - CVE-2015-0240 - https://www.samba.org/samba/security/CVE-2015-0240 - - - 2015-02-23 - 2015-02-23 - - - - - e2fsprogs -- buffer overflow if s_first_meta_bg too big - - - e2fsprogs - 1.42.12 - - - - -

Theodore Ts'o reports:

-
-

If s_first_meta_bg is greater than the of number block group descriptor blocks, then reading or writing the block group descriptors will end up overruning the memory buffer allocated for the descriptors.

-

The finding is credited to a vulnerability report from Jose Duart of Google Security Team <jduart AT google.com> and was reported through oCERT-2015-002.

-
- - - - http://git.kernel.org/cgit/fs/ext2/e2fsprogs.git/commit/?id=f66e6ce4 - http://www.ocert.org/advisories/ocert-2015-002.html - https://bugzilla.redhat.com/show_bug.cgi?id=1187032 - CVE-2015-0247 - - - 2014-08-09 - 2015-02-24 - - - - - e2fsprogs -- potential buffer overflow in closefs() - - - e2fsprogs - 1.42.12_2 - - - - -

Theodore Ts'o reports:

-
-

On a carefully crafted filesystem that gets modified through - tune2fs or debugfs, it is possible to trigger a buffer overrun when - the file system is closed via closefs().

-
- - - - http://git.kernel.org/cgit/fs/ext2/e2fsprogs.git/commit/?h=maint&id=49d0fe2a14f2a23da2fe299643379b8c1d37df73 - CVE-2015-1572 - - - 2015-02-06 - 2015-02-24 - - - - - bind -- denial of service vulnerability - - - bind910 - bind910-base - 9.10.1P2 - - - bind99 - bind99-base - 9.9.6P2 - - - FreeBSD - 9.39.3_10 - 8.48.4_24 - - - - -

ISC reports:

-
-

When configured to perform DNSSEC validation, named can - crash when encountering a rare set of conditions in the - managed trust anchors.

-
- - - - SA-15:05.bind - CVE-2015-1349 - https://kb.isc.org/article/AA-01235 - - - 2015-02-18 - 2015-02-23 - 2016-08-09 - - - - - krb5 1.12 -- New release/fix multiple vulnerabilities - - - krb5-112 - 1.12.3 - - - - -

The MIT Kerberos team announces the availability of MIT Kerberos 5 Release 1.12.3:

-
-

Fix multiple vulnerabilities in the LDAP KDC back end. - [CVE-2014-5354] [CVE-2014-5353]

-

Fix multiple kadmind vulnerabilities, some of which are based - in the gssrpc library. [CVE-2014-5352 CVE-2014-5352 - CVE-2014-9421 CVE-2014-9422 CVE-2014-9423]

-
- - - - http://web.mit.edu/kerberos/krb5-1.12/README-1.12.3.txt - - - 2015-02-20 - 2015-02-21 - - - - - unzip -- heap based buffer overflow in iconv patch - - - unzip - 6.0_5 - - - - -

Ubuntu Security Notice USN-2502-1 reports:

-
-

unzip could be made to run programs if it opened a specially crafted file.

-
- - - - CVE-2015-1315 - http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-1315.html - https://security-tracker.debian.org/tracker/CVE-2015-1315 - http://www.ubuntu.com/usn/usn-2502-1/ - - - 2015-02-17 - 2015-02-17 - - - - - krb5 -- Vulnerabilities in kadmind, libgssrpc, gss_process_context_token VU#540092 - - - krb5 - 1.13.1 - - - krb5-112 - 1.12.2_2 - - - krb5-111 - 1.11.5_5 - - - - -

The MIT Kerberos team reports:

-
-

CVE-2014-5353: The krb5_ldap_get_password_policy_from_dn - function in plugins/kdb/ldap/libkdb_ldap/ldap_pwd_policy.c in - MIT Kerberos 5 (aka krb5) before 1.13.1, when the KDC uses LDAP, - allows remote authenticated users to cause a denial of service - (daemon crash) via a successful LDAP query with no results, as - demonstrated by using an incorrect object type for a password - policy.

-

CVE-2014-5354: plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in - MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.1, when - the KDC uses LDAP, allows remote authenticated users to cause a - denial of service (NULL pointer dereference and daemon crash) by - creating a database entry for a keyless principal, as - demonstrated by a kadmin "add_principal -nokey" or "purgekeys - -all" command.

-
- - - - CVE-2014-5353 - CVE-2014-5354 - http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt - - - 2015-02-12 - 2015-02-12 - 2015-02-13 - - - - - xorg-server -- Information leak in the XkbSetGeometry request of X servers. - - - xorg-server - 1.14.7_2,1 - - - xorg-server - 1.15.0,11.16.4,1 - - - - -

Peter Hutterer reports:

-
-

Olivier Fourdan from Red Hat has discovered a protocol handling - issue in the way the X server code base handles the XkbSetGeometry - request.

-

The issue stems from the server trusting the client to send valid - string lengths in the request data. A malicious client with string - lengths exceeding the request length can cause the server to copy - adjacent memory data into the XKB structs. This data is then - available to the client via the XkbGetGeometry request. The - data length is at least up to 64k, it is possible to obtain - more data by chaining strings, each string length is then - determined by whatever happens to be in that 16-bit region of - memory.

-

A similarly crafted request can likely cause the X server - to crash.

-
- - - - CVE-2015-0255 - http://lists.freedesktop.org/archives/xorg/2015-February/057158.html - - - 2015-02-10 - 2015-02-12 - - - - - openldap -- two remote denial of service vulnerabilities - - - openldap-server - 2.4.40_3 - - - - -

Ryan Tandy reports:

-
-

With the deref overlay enabled, ldapsearch with '-E deref=member:' - causes slapd to crash.

-
-
-

Bill MacAllister discovered that certain queries cause slapd - to crash while freeing operation controls. This is a 2.4.40 regression. - Earlier releases are not affected.

-
- - - - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776988 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776991 - - - 2015-02-02 - 2015-02-06 - - - - - chromium -- multiple vulnerabilities - - - chromium - 40.0.2214.111 - - - chromium-pulse - 40.0.2214.111 - - - - -

Chrome Releases reports:

-
-

11 security fixes in this release, including:

-
    -
  • [447906] High CVE-2015-1209: Use-after-free in DOM. Credit to - Maksymillian.
    • -
  • [453979] High CVE-2015-1210: Cross-origin-bypass in V8 - bindings. Credit to anonymous.
    • -
  • [453982] High CVE-2015-1211: Privilege escalation using service - workers. Credit to anonymous.
    • -
  • [455225] CVE-2015-1212: Various fixes from internal audits, - fuzzing and other initiatives.
    • -
-
- - - - CVE-2015-1209 - CVE-2015-1210 - CVE-2015-1211 - CVE-2015-1212 - http://googlechromereleases.blogspot.nl - - - 2015-02-05 - 2015-02-06 - - - - - PostgreSQL -- multiple buffer overflows and memory issues - - - postgresql90-server - 9.0.09.0.19 - - - postgresql91-server - 9.1.09.1.15 - - - postgresql92-server - 9.2.09.2.10 - - - postgresql93-server - 9.3.09.3.6 - - - postgresql94-server - 9.4.09.4.1 - - - - -

PostgreSQL Project reports:

-
-

This update fixes multiple security issues reported in PostgreSQL - over the past few months. All of these issues require prior - authentication, and some require additional conditions, and as such - are not considered generally urgent. However, users should examine - the list of security holes patched below in case they are particularly - vulnerable.

-
    -
  1. CVE-2015-0241 Buffer overruns in "to_char" functions.
    2. -
  2. CVE-2015-0242 Buffer overrun in replacement printf family of - functions.
    3. -
  3. CVE-2015-0243 Memory errors in functions in the pgcrypto extension.
    4. -
  4. CVE-2015-0244 An error in extended protocol message reading.
    5. -
  5. CVE-2014-8161 Constraint violation errors can cause display of values in columns - which the user would not normally have rights to see.
    6. -
-
- - - - CVE-2015-0241 - CVE-2015-0242 - CVE-2015-0243 - CVE-2015-0244 - CVE-2014-8161 - - - 2015-02-05 - 2015-02-05 - - - - - krb5 -- Vulnerabilities in kadmind, libgssrpc, gss_process_context_token VU#540092 - - - krb5 - 1.13_1 - - - krb5-112 - 1.12.2_1 - - - krb5-111 - 1.11.5_4 - - - - -

SO-AND-SO reports:

-
-

CVE-2014-5352: In the MIT krb5 libgssapi_krb5 library, after - gss_process_context_token() is used to process a valid context - deletion token, the caller is left with a security context handle - containing a dangling pointer. Further uses of this handle will - result in use-after-free and double-free memory access violations. - libgssrpc server applications such as kadmind are vulnerable as - they can be instructed to call gss_process_context_token().

-

CVE-2014-9421: If the MIT krb5 kadmind daemon receives invalid XDR - data from an authenticated user, it may perform use-after-free and - double-free memory access violations while cleaning up the partial - deserialization results. Other libgssrpc server applications may - also be vulnerable if they contain insufficiently defensive XDR - functions.

-

CVE-2014-9422: The MIT krb5 kadmind daemon incorrectly accepts - authentications to two-component server principals whose first - component is a left substring of "kadmin" or whose realm is a left - prefix of the default realm.

-

CVE-2014-9423: libgssrpc applications including kadmind output - four or eight bytes of uninitialized memory to the network as - part of an unused "handle" field in replies to clients.

-
- - - - CVE-2014-5352 - CVE-2014-9421 - CVE-2014-9422 - CVE-2014-9423 - http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt - - - 2015-02-03 - 2015-02-04 - - - - - unzip -- out of boundary access issues in test_compr_eb - - - unzip - 6.0_4 - - - - -

Ubuntu Security Notice USN-2489-1 reports:

-
-

Michal Zalewski discovered that unzip incorrectly handled - certain malformed zip archives. If a user or automated system - were tricked into processing a specially crafted zip archive, - an attacker could possibly execute arbitrary code.

-
- - - - CVE-2014-9636 - http://www.ubuntu.com/usn/usn-2489-1/ - http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-9636.html - http://seclists.org/oss-sec/2014/q4/489 - http://www.info-zip.org/phpBB3/viewtopic.php?f=7&t=450 - - - 2014-11-02 - 2015-02-03 - - - - - Xymon -- buffer overrun - - - xymon-server - 4.3.44.3.18 - - - - -

Debian reports:

-
-

web/acknowledge.c uses a string twice in a format string, but only - allocates memory for one copy.

-
- - - - http://www.openwall.com/lists/oss-security/2015/01/31/4 - https://security-tracker.debian.org/tracker/CVE-2015-1430 - CVE-2015-1430 - - - 2014-09-28 - 2015-02-02 - - - - - rabbitmq -- Security issues in management plugin - - - rabbitmq - 3.4.3 - - - - -

The RabbitMQ project reports:

-
-

Some user-controllable content was not properly HTML-escaped - before being presented to a user in the management web UI:

-
    -
  • When a user unqueued a message from the management UI, - message details (header names, arguments, etc.) were displayed - unescaped. An attacker could publish a specially crafted - message to add content or execute arbitrary Javascript code on - behalf of a user, if this user unqueued the message from the - management UI.
    • -
  • When viewing policies, their name was displayed unescaped. - An attacker could create a policy with a specially crafted name - to add content or execute arbitrary Javascript code on behalf - of a user who is viewing policies.
    • -
  • When listing connected AMQP network clients, client details - such as its version were displayed unescaped. An attacker could - use a client with a specially crafted version field to add - content or execute arbitrary Javascript code on behalf of a - user who is viewing connected clients.
    • -
-

In all cases, the attacker needs a valid user account on the - targeted RabbitMQ cluster.

-

Furthermore, some admin-controllable content was not properly - escaped:

-
    -
  • user names;
    • -
  • the cluster name.
    • -
-

Likewise, an attacker could add content or execute arbitrary - Javascript code on behalf of a user using the management web UI. - However, the attacker must be an administrator on the RabbitMQ - cluster, thus a trusted user.

-
- - - - http://www.rabbitmq.com/news.html#2015-01-08T10:14:05+0100 - http://www.rabbitmq.com/release-notes/README-3.4.3.txt - CVE-2015-0862 - - - 2015-01-08 - 2015-01-31 - - - - - apache24 -- several vulnerabilities - - - apache24 - 2.4.12 - - - - -

Apache HTTP SERVER PROJECT reports:

-
-

mod_proxy_fcgi: Fix a potential crash due to buffer over-read, - with response headers' size above 8K.

-

mod_cache: Avoid a crash when Content-Type has an empty value. PR 56924.

-

mod_lua: Fix handling of the Require line when a LuaAuthzProvider is used - in multiple Require directives with different arguments. PR57204.

-

core: HTTP trailers could be used to replace HTTP headers late during - request processing, potentially undoing or otherwise confusing modules - that examined or modified request headers earlier. Adds "MergeTrailers" - directive to restore legacy behavior.

-
- - - - CVE-2014-3583 - CVE-2014-3581 - CVE-2014-8109 - CVE-2013-5704 - - - 2015-01-29 - 2015-01-31 - - - - - asterisk -- Mitigation for libcURL HTTP request injection vulnerability - - - asterisk - 1.8.32.2 - - - asterisk11 - 11.15.1 - - - asterisk13 - 13.1.1 - - - - -

The Asterisk project reports:

-
-

CVE-2014-8150 reported an HTTP request injection - vulnerability in libcURL. Asterisk uses libcURL in its - func_curl.so module (the CURL() dialplan function), as - well as its res_config_curl.so (cURL realtime backend) - modules.

-

Since Asterisk may be configured to allow for user-supplied - URLs to be passed to libcURL, it is possible that an - attacker could use Asterisk as an attack vector to inject - unauthorized HTTP requests if the version of libcURL - installed on the Asterisk server is affected by - CVE-2014-8150.

-
- - - - http://downloads.asterisk.org/pub/security/AST-2015-002.html - - - 2015-01-12 - 2015-01-29 - - - - - asterisk -- File descriptor leak when incompatible codecs are offered - - - asterisk13 - 13.1.1 - - - - -

The Asterisk project reports:

-
-

Asterisk may be configured to only allow specific audio - or video codecs to be used when communicating with a - particular endpoint. When an endpoint sends an SDP offer - that only lists codecs not allowed by Asterisk, the offer - is rejected. However, in this case, RTP ports that are - allocated in the process are not reclaimed.

-

This issue only affects the PJSIP channel driver in - Asterisk. Users of the chan_sip channel driver are not - affected.

-

As the resources are allocated after authentication, - this issue only affects communications with authenticated - endpoints.

-
- - - - http://downloads.asterisk.org/pub/security/AST-2015-001.html - CVE-2015-1558 - - - 2015-01-06 - 2015-01-29 - 2015-02-17 - - - - - glibc -- gethostbyname buffer overflow - - - linux_base-c6 - 6.6_2 - - - linux_base-f10 - 0 - - - linux-c6-devtools - 6.6_3 - - - linux-f10-devtools - 0 - - - - -

Robert Krátký reports:

-
-

- GHOST is a 'buffer overflow' bug affecting the gethostbyname() and - gethostbyname2() function calls in the glibc library. This - vulnerability allows a remote attacker that is able to make an - application call to either of these functions to execute arbitrary - code with the permissions of the user running the application. - The gethostbyname() function calls are used for DNS resolving, which - is a very common event. To exploit this vulnerability, an attacker - must trigger a buffer overflow by supplying an invalid hostname - argument to an application that performs a DNS resolution.

-
- - - - CVE-2015-0235 - https://access.redhat.com/articles/1332213 - http://www.openwall.com/lists/oss-security/2015/01/27/9 - - - 2015-01-27 - 2015-01-28 - 2015-02-02 - - - - - Adobe Flash Player -- critical vulnerability - - - linux-c6-flashplugin - 11.2r202.438 - - - linux-f10-flashplugin - 11.2r202.438 - - - - -

Adobe reports:

-
-

Successful exploitation could cause a crash and potentially allow - an attacker to take control of the affected system. We are aware - of reports that this vulnerability is being actively exploited in - the wild via drive-by-download attacks against systems running - Internet Explorer and Firefox on Windows 8.1 and below.

-
- - - - CVE-2015-0311 - https://helpx.adobe.com/security/products/flash-player/apsa15-01.html - - - 2015-01-22 - 2015-01-26 - - - - - Bugzilla multiple security issues - - - bugzilla44 - 4.4.7 - - - - -

Bugzilla Security Advisory

-
-
Command Injection
-

Some code in Bugzilla does not properly utilize 3 arguments form - for open() and it is possible for an account with editcomponents - permissions to inject commands into product names and other - attributes.

-
Information Leak
-

Using the WebServices API, a user can possibly execute imported - functions from other non-WebService modules. A whitelist has now - been added that lists explicit methods that can be executed via the - API.

-
- - - - CVE-2014-8630 - https://bugzilla.mozilla.org/show_bug.cgi?id=1079065 - https://bugzilla.mozilla.org/show_bug.cgi?id=1090275 - - - 2015-01-21 - 2015-01-26 - - - - - django -- multiple vulnerabilities - - - py27-django - 1.41.4.18 - 1.51.5.12 - 1.61.6.10 - 1.71.7.3 - - - py32-django - 1.41.4.18 - 1.51.5.12 - 1.61.6.10 - 1.71.7.3 - - - py33-django - 1.41.4.18 - 1.51.5.12 - 1.61.6.10 - 1.71.7.3 - - - py34-django - 1.41.4.18 - 1.51.5.12 - 1.61.6.10 - 1.71.7.3 - - - py27-django-devel - 20150124,1 - - - py32-django-devel - 20150124,1 - - - py33-django-devel - 20150124,1 - - - py34-django-devel - 20150124,1 - - - - -

The Django project reports:

-
-

Today the Django team is issuing multiple releases -- - Django 1.4.18, Django 1.6.10, and Django 1.7.3 -- as part of our - security process. These releases are now available on PyPI and our - download page.

-

These releases address several security issues. We encourage all - users of Django to upgrade as soon as possible.

-
- - - - https://www.djangoproject.com/weblog/2015/jan/13/security/ - CVE-2015-0219 - CVE-2015-0220 - CVE-2015-0221 - CVE-2015-0222 - - - 2015-01-13 - 2015-01-23 - 2015-01-24 - - - - - libutp -- remote denial of service or arbitrary code execution - - - bittorrent-libutp - 0.20130514_1 - - - transmission-cli - transmission-deamon - transmission-gtk - transmission-qt4 - 2.74 - - - - -

NVD reports:

-
-

Stack-based buffer overflow in utp.cpp in libutp, as used - in Transmission before 2.74 and possibly other products, - allows remote attackers to cause a denial of service (crash) - and possibly execute arbitrary code via crafted "micro - transport protocol packets."

-
- - - - CVE-2012-6129 - https://github.com/bittorrent/libutp/issues/38 - https://trac.transmissionbt.com/ticket/5002 - - - 2012-08-01 - 2014-12-29 - - - - - LibreSSL -- DTLS vulnerability - - - libressl - 2.1.3 - - - - -

OpenSSL Security Advisory:

-
-

- A memory leak can occur in the dtls1_buffer_record function under certain - conditions. In particular this could occur if an attacker sent repeated DTLS - records with the same sequence number but for the next epoch. The memory leak - could be exploited by an attacker in a Denial of Service attack through memory - exhaustion. -

-
- - - - CVE-2015-0206 - https://www.openssl.org/news/secadv_20150108.txt - - - 2015-01-08 - 2015-01-22 - - - - - Adobe Flash Player -- multiple vulnerabilities - - - linux-c6-flashplugin - 11.2r202.429 - - - linux-f10-flashplugin - 11.2r202.429 - - - - -

Adobe reports:

-
-

These updates address vulnerabilities that could potentially allow - an attacker to take control of the affected system.

-
- - - - CVE-2015-0301 - CVE-2015-0302 - CVE-2015-0303 - CVE-2015-0304 - CVE-2015-0305 - CVE-2015-0306 - CVE-2015-0307 - CVE-2015-0308 - CVE-2015-0309 - http://helpx.adobe.com/security/products/flash-player/apsb15-01.html - - - 2015-01-13 - 2015-01-22 - - - - - chromium -- multiple vulnerabilities - - - chromium - 40.0.2214.91 - - - chromium-pulse - 40.0.2214.91 - - - - -

Google Chrome Releases reports:

-
-

62 security fixes in this release, including:

-
    -
  • [430353] High CVE-2014-7923: Memory corruption in ICU. Credit - to yangdingning.
    • -
  • [435880] High CVE-2014-7924: Use-after-free in IndexedDB. - Credit to Collin Payne.
    • -
  • [434136] High CVE-2014-7925: Use-after-free in WebAudio. Credit - to mark.buer.
    • -
  • [422824] High CVE-2014-7926: Memory corruption in ICU. Credit - to yangdingning.
    • -
  • [444695] High CVE-2014-7927: Memory corruption in V8. Credit to - Christian Holler.
    • -
  • [435073] High CVE-2014-7928: Memory corruption in V8. Credit to - Christian Holler.
    • -
  • [442806] High CVE-2014-7930: Use-after-free in DOM. Credit to - cloudfuzzer.
    • -
  • [442710] High CVE-2014-7931: Memory corruption in V8. Credit to - cloudfuzzer.
    • -
  • [443115] High CVE-2014-7929: Use-after-free in DOM. Credit to - cloudfuzzer.
    • -
  • [429666] High CVE-2014-7932: Use-after-free in DOM. Credit to - Atte Kettunen of OUSPG.
    • -
  • [427266] High CVE-2014-7933: Use-after-free in FFmpeg. Credit - to aohelin.
    • -
  • [427249] High CVE-2014-7934: Use-after-free in DOM. Credit to - cloudfuzzer.
    • -
  • [402957] High CVE-2014-7935: Use-after-free in Speech. Credit - to Khalil Zhani.
    • -
  • [428561] High CVE-2014-7936: Use-after-free in Views. Credit - to Christoph Diehl.
    • -
  • [419060] High CVE-2014-7937: Use-after-free in FFmpeg. Credit - to Atte Kettunen of OUSPG.
    • -
  • [416323] High CVE-2014-7938: Memory corruption in Fonts. Credit - to Atte Kettunen of OUSPG.
    • -
  • [399951] High CVE-2014-7939: Same-origin-bypass in V8. Credit - to Takeshi Terada.
    • -
  • [433866] Medium CVE-2014-7940: Uninitialized-value in ICU. - Credit to miaubiz.
    • -
  • [428557] Medium CVE-2014-7941: Out-of-bounds read in UI. Credit - to Atte Kettunen of OUSPG and Christoph Diehl.
    • -
  • [426762] Medium CVE-2014-7942: Uninitialized-value in Fonts. - Credit to miaubiz.
    • -
  • [422492] Medium CVE-2014-7943: Out-of-bounds read in Skia. - Credit to Atte Kettunen of OUSPG.
    • -
  • [418881] Medium CVE-2014-7944: Out-of-bounds read in PDFium. - Credit to cloudfuzzer.
    • -
  • [414310] Medium CVE-2014-7945: Out-of-bounds read in PDFium. - Credit to cloudfuzzer.
    • -
  • [414109] Medium CVE-2014-7946: Out-of-bounds read in Fonts. - Credit to miaubiz.
    • -
  • [430566] Medium CVE-2014-7947: Out-of-bounds read in PDFium. - Credit to fuzztercluck.
    • -
  • [414026] Medium CVE-2014-7948: Caching error in AppCache. - Credit to jiayaoqijia.
    • -
  • [449894] CVE-2015-1205: Various fixes from internal audits, - fuzzing and other initiatives.
    • -
  • Multiple vulnerabilities in V8 fixed at the tip of the 3.30 - branch (currently 3.30.33.15).
    • -
-
- - - - CVE-2014-7923 - CVE-2014-7924 - CVE-2014-7925 - CVE-2014-7926 - CVE-2014-7927 - CVE-2014-7928 - CVE-2014-7929 - CVE-2014-7930 - CVE-2014-7931 - CVE-2014-7932 - CVE-2014-7933 - CVE-2014-7934 - CVE-2014-7935 - CVE-2014-7936 - CVE-2014-7937 - CVE-2014-7938 - CVE-2014-7939 - CVE-2014-7940 - CVE-2014-7941 - CVE-2014-7942 - CVE-2014-7943 - CVE-2014-7944 - CVE-2014-7945 - CVE-2014-7946 - CVE-2014-7947 - CVE-2014-7948 - CVE-2015-1205 - http://googlechromereleases.blogspot.nl - - - 2015-01-21 - 2015-01-21 - - - - - polarssl -- Remote attack using crafted certificates - - - polarssl - 1.2.01.2.12_1 - - - polarssl13 - 1.3.01.3.9_1 - - - - -

PolarSSL team reports:

-
-

During the parsing of a ASN.1 sequence, a pointer in the linked list of asn1_sequence is not - initialized by asn1_get_sequence_of(). In case an error occurs during parsing of the list, a - situation is created where the uninitialized pointer is passed to polarssl_free().

-

This sequence can be triggered when a PolarSSL entity is parsing a certificate. So practically this - means clients when receiving a certificate from the server or servers in case they are actively - asking for a client certificate.

-
- - - - CVE-2015-1182 - https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2014-04 - https://www.certifiedsecure.com/polarssl-advisory/ - - - 2015-01-14 - 2015-01-19 - - - - - unzip -- input sanitization errors - - - unzip - 6.0_2 - - - - -

oCERT reports:

-
-

The UnZip tool is an open source extraction utility for archives - compressed in the zip format.

-

The unzip command line tool is affected by heap-based buffer - overflows within the CRC32 verification, the test_compr_eb() and - the getZip64Data() functions. The input errors may result in - arbitrary code execution.

-

A specially crafted zip file, passed to unzip -t, can be used to - trigger the vulnerability.

-
- - - - CVE-2014-8139 - CVE-2014-8140 - CVE-2014-8141 - http://www.info-zip.org/UnZip.html - https://bugzilla.redhat.com/show_bug.cgi?id=1174844 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-8140 - https://bugzilla.redhat.com/show_bug.cgi?id=1174856 - - - 2014-12-03 - 2015-01-16 - - - - - samba -- Elevation of privilege to Active Directory Domain Controller - - - samba4 - 4.0.04.0.23 - - - samba41 - 4.1.04.1.15 - - - - -

Samba team reports:

-
-

In Samba's AD DC we neglected to ensure that - attempted modifications of the userAccountControl attribute - did not allow the UF_SERVER_TRUST_ACCOUNT bit to be set. -

-
- - - - CVE-2014-8143 - https://www.samba.org/samba/security/CVE-2014-8143 - - - 2015-01-15 - 2015-01-16 - - - - - kde-runtime -- incorrect CBC encryption handling - - - kde-runtime - 4.12_3 - - - - -

Valentin Rusu reports:

-
-

Until KDE Applications 14.12.0, kwalletd incorrectly handled CBC - encryption blocks when encrypting secrets in kwl files. The secrets - were still encrypted, but the result binary data corresponded to an - ECB encrypted block instead of CBC.

-

The ECB encryption algorithm, even if it'll scramble user data, - will produce same encrypted byte sequence for the same input text. - As a result, attackers may eventually find-out the encrypted - text.

-
- - - - CVE-2013-7252 - https://www.kde.org/info/security/advisory-20150109-1.txt - - - 2015-01-09 - 2015-01-14 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 35.0,1 - - - firefox-esr - 31.4.0,1 - - - linux-firefox - 35.0,1 - - - linux-seamonkey - 2.32 - - - linux-thunderbird - 31.4.0 - - - seamonkey - 2.32 - - - thunderbird - 31.4.0 - - - libxul - 31.4.0 - - - - -

The Mozilla Project reports:

-
-

MFSA-2015-01 Miscellaneous memory safety hazards (rv:35.0 - / rv:31.4)

-

MFSA-2015-02 Uninitialized memory use during bitmap - rendering

-

MFSA-2015-03 sendBeacon requests lack an Origin header

-

MFSA-2015-04 Cookie injection through Proxy Authenticate - responses

-

MFSA-2015-05 Read of uninitialized memory in Web Audio

-

MFSA-2015-06 Read-after-free in WebRTC

-

MFSA-2015-07 Gecko Media Plugin sandbox escape

-

MFSA-2015-08 Delegated OCSP responder certificates failure - with id-pkix-ocsp-nocheck extension

-

MFSA-2015-09 XrayWrapper bypass through DOM objects

-
- - - - CVE-2014-8634 - CVE-2014-8635 - CVE-2014-8637 - CVE-2014-8638 - CVE-2014-8639 - CVE-2014-8640 - CVE-2014-8641 - CVE-2014-8642 - CVE-2014-8643 - CVE-2014-8636 - https://www.mozilla.org/en-US/security/advisories/mfsa2015-01/ - https://www.mozilla.org/en-US/security/advisories/mfsa2015-02/ - https://www.mozilla.org/en-US/security/advisories/mfsa2015-03/ - https://www.mozilla.org/en-US/security/advisories/mfsa2015-04/ - https://www.mozilla.org/en-US/security/advisories/mfsa2015-05/ - https://www.mozilla.org/en-US/security/advisories/mfsa2015-06/ - https://www.mozilla.org/en-US/security/advisories/mfsa2015-07/ - https://www.mozilla.org/en-US/security/advisories/mfsa2015-08/ - https://www.mozilla.org/en-US/security/advisories/mfsa2015-09/ - https://www.mozilla.org/security/advisories/ - - - 2015-01-13 - 2015-01-14 - - - - - libevent -- integer overflow in evbuffers - - - libevent - 1.4.15 - 2.02.0.22 - - - libevent2 - 2.0.22 - - - - -

Debian Security Team reports:

-
-

Andrew Bartlett of Catalyst reported a defect affecting certain - applications using the Libevent evbuffer API. This defect leaves - applications which pass insanely large inputs to evbuffers open - to a possible heap overflow or infinite loop. In order to exploit - this flaw, an attacker needs to be able to find a way to provoke - the program into trying to make a buffer chunk larger than what - will fit into a single size_t or off_t. -

-
- - - - CVE-2014-6272 - https://www.debian.org/security/2015/dsa-3119 - - - 2015-01-05 - 2015-01-11 - 2017-02-20 - - - - - cURL -- URL request injection vulnerability - - - curl - 7.40.0 - - - - -

cURL reports:

-
-

When libcurl sends a request to a server via a HTTP proxy, it - copies the entire URL into the request and sends if off. - If the given URL contains line feeds and carriage returns those will - be sent along to the proxy too, which allows the program to for - example send a separate HTTP request injected embedded in the URL. - Many programs allow some kind of external sources to set the URL or - provide partial pieces for the URL to ask for, and if the URL as - received from the user is not stripped good enough this flaw allows - malicious users to do additional requests in a way that was not - intended, or just to insert request headers into the request that - the program didn't intend. - We are not aware of any exploit of this flaw.

-
- - - - CVE-2014-8150 - http://curl.haxx.se/docs/adv_20150108B.html - - - 2014-12-25 - 2015-01-09 - - - - - WebKit-gtk -- Multiple vulnerabilities - - - webkit-gtk2 - 1.4.8 - - - webkit-gtk3 - 1.4.8 - - - - -

Webkit release team reports:

-
-

This release fixes the following security issues: - CVE-2014-1344, CVE-2014-1384, CVE-2014-1385, CVE-2014-1386, - CVE-2014-1387, CVE-2014-1388, CVE-2014-1389, CVE-2014-1390.

-
- - - - http://webkitgtk.org/2015/01/07/webkitgtk2.4.8-released.html - CVE-2014-1344 - CVE-2014-1384 - CVE-2014-1385 - CVE-2014-1386 - CVE-2014-1387 - CVE-2014-1388 - CVE-2014-1389 - CVE-2014-1390 - - - 2015-01-07 - 2015-01-09 - - - - - OpenSSL -- multiple vulnerabilities - - - openssl - 1.0.11.0.1_17 - - - mingw32-openssl - 1.0.11.0.1k - - - linux-c6-openssl - 1.0.1e_3 - - - FreeBSD - 10.110.1_4 - 10.010.0_16 - 9.39.3_8 - 8.48.4_22 - - - - -

OpenSSL project reports:

-
-

DTLS segmentation fault in dtls1_get_record (CVE-2014-3571)

-

DTLS memory leak in dtls1_buffer_record (CVE-2015-0206)

-

no-ssl3 configuration sets method to NULL (CVE-2014-3569)

-

ECDHE silently downgrades to ECDH [Client] (CVE-2014-3572)

-

RSA silently downgrades to EXPORT_RSA [Client] (CVE-2015-0204)

-

DH client certificates accepted without verification [Server] (CVE-2015-0205)

-

Certificate fingerprints can be modified (CVE-2014-8275)

-

Bignum squaring may produce incorrect results (CVE-2014-3570)

-
- - - - SA-15:01.openssl - CVE-2014-3569 - CVE-2014-3570 - CVE-2014-3571 - CVE-2014-3572 - CVE-2014-8275 - CVE-2015-0204 - CVE-2015-0205 - CVE-2015-0206 - https://www.openssl.org/news/secadv_20150108.txt - - - 2015-01-08 - 2015-01-08 - 2016-08-09 - - - - - wordpress -- multiple vulnerabilities - - - wordpress - 3.7.5,1 - 3.8,13.8.5,1 - 3.9,13.9.3,1 - 4.0,14.0.1,1 - - - zh-wordpress - 3.7.5 - 3.83.8.5 - 3.93.9.3 - 4.04.0.1 - - - de-wordpress - 3.7.5 - 3.83.8.5 - 3.93.9.3 - 4.04.0.1 - - - ja-wordpress - 3.7.5 - 3.83.8.5 - 3.93.9.3 - 4.04.0.1 - - - ru-wordpress - 3.7.5 - 3.83.8.5 - 3.93.9.3 - 4.04.0.1 - - - - -

MITRE reports:

-
-

wp-login.php in WordPress before 3.7.5, 3.8.x before - 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow - remote attackers to reset passwords by leveraging access to - an e-mail account that received a password-reset message.

-
-
-

wp-includes/http.php in WordPress before 3.7.5, 3.8.x - before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 - allows remote attackers to conduct server-side request - forgery (SSRF) attacks by referring to a 127.0.0.0/8 - resource.

-
-
-

WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before - 3.9.3, and 4.x before 4.0.1 might allow remote attackers to - obtain access to an account idle since 2008 by leveraging an - improper PHP dynamic type comparison for an MD5 hash.

-
-
-

Cross-site scripting (XSS) vulnerability in WordPress - before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and - 4.x before 4.0.1 allows remote attackers to inject arbitrary - web script or HTML via a crafted Cascading Style Sheets - (CSS) token sequence in a post.

-
-
-

Cross-site scripting (XSS) vulnerability in Press This in - WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before - 3.9.3, and 4.x before 4.0.1 allows remote attackers to - inject arbitrary web script or HTML via unspecified - vectors

-
-
-

wp-includes/class-phpass.php in WordPress before 3.7.5, - 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 - allows remote attackers to cause a denial of service (CPU - consumption) via a long password that is improperly handled - during hashing, a similar issue to CVE-2014-9016.

-
-
-

Cross-site request forgery (CSRF) vulnerability in - wp-login.php in WordPress 3.7.4, 3.8.4, 3.9.2, and 4.0 - allows remote attackers to hijack the authentication of - arbitrary users for requests that reset passwords.

-
- - - - CVE-2014-9033 - CVE-2014-9034 - CVE-2014-9035 - CVE-2014-9036 - CVE-2014-9037 - CVE-2014-9038 - CVE-2014-9039 - - - 2014-11-25 - 2015-01-05 - - - - - png -- heap overflow for 32-bit builds - - - png - 1.2.61.5.21 - 1.61.6.16 - - - - -

32-bit builds of PNG library are vulnerable to an unsigned - integer overflow that is triggered by a crafted wide - interlaced images. - Overflow results in a heap corruption that will crash the - application and may lead to the controlled overwrite of a - selected portions of process address space.

- - - - http://tfpwn.com/files/libpng_heap_overflow_1.6.15.txt - http://codelabs.ru/security/vulns/analysis/libpng/2014-dec-libpng-1.6.15/ - - - 2014-12-23 - 2015-01-05 - - - - - file -- multiple vulnerabilities - - - file - 5.21 - - - FreeBSD - 8.48.4_20 - 9.19.1_23 - 9.29.2_16 - 9.39.3_6 - 10.010.0_13 - 10.110.1_1 - - - - -

RedHat reports:

-
-

Thomas Jarosch of Intra2net AG reported a number of - denial of service issues (resource consumption) in - the ELF parser used by file(1). These issues were - fixed in the 5.21 release of file(1), but by mistake - are missing from the changelog.

-
- - - - CVE-2014-3710 - CVE-2014-8116 - CVE-2014-8117 - SA-14:28.file - http://seclists.org/oss-sec/2014/q4/1056 - - - 2014-12-16 - 2015-01-02 - - - - - mutt -- denial of service via crafted mail message - - - mutt - 1.5.221.5.23_7 - - - ja-mutt - 1.5.221.5.23_7 - - - zh-mutt - 1.5.221.5.23_7 - - - - -

NVD reports:

-
-

The write_one_header function in mutt 1.5.23 does not - properly handle newline characters at the beginning of a - header, which allows remote attackers to cause a denial of - service (crash) via a header with an empty body, which - triggers a heap-based buffer overflow in the mutt_substrdup - function.

-
- - - - 71334 - CVE-2014-9116 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=771125 - http://dev.mutt.org/trac/ticket/3716 - - - 2014-11-26 - 2014-12-23 - - - - - ntp -- multiple vulnerabilities - - - ntp - ntp-devel - 4.2.8 - - - - -

CERT reports:

-
-

The Network Time Protocol (NTP) provides networked - systems with a way to synchronize time for various - services and applications. ntpd version 4.2.7 and - previous versions allow attackers to overflow several - buffers in a way that may allow malicious code to - be executed. ntp-keygen prior to version 4.2.7p230 - also uses a non-cryptographic random number generator - when generating symmetric keys.

-

The buffer overflow vulnerabilities in ntpd may - allow a remote unauthenticated attacker to execute - arbitrary malicious code with the privilege level - of the ntpd process. The weak default key and - non-cryptographic random number generator in - ntp-keygen may allow an attacker to gain - information regarding the integrity checking - and authentication encryption schemes.

-
- - - - CVE-2014-9293 - CVE-2014-9294 - CVE-2014-9295 - CVE-2014-9296 - http://www.kb.cert.org/vuls/id/852879 - - - 2014-12-19 - 2014-12-20 - - - - - git -- Arbitrary command execution on case-insensitive filesystems - - - git - 2.2.1 - - - - -

The Git Project reports:

-
-

When using a case-insensitive filesystem an attacker can - craft a malicious Git tree that will cause Git to overwrite - its own .git/config file when cloning or checking out a - repository, leading to arbitrary command execution in the - client machine. If you are a hosting service whose users - may fetch from your service to Windows or Mac OS X machines, - you are strongly encouraged to update to protect such users - who use existing versions of Git.

-
- - - - CVE-2014-9390 - https://github.com/blog/1938-git-client-vulnerability-announced - http://article.gmane.org/gmane.linux.kernel/1853266 - - - 2014-12-19 - 2014-12-19 - - - - - otrs -- Incomplete Access Control - - - otrs - 3.2.*3.2.17 - 3.3.*3.3.11 - 4.0.*4.0.3 - - - - -

The OTRS project reports:

-
-

An attacker with valid OTRS credentials could access and manipulate ticket data - of other users via the GenericInterface, if a ticket webservice is configured - and not additionally secured.

-
- - - - http://www.otrs.com/security-advisory-2014-06-incomplete-access-control/ - CVE-2014-9324 - - - 2014-12-16 - 2014-12-16 - - - - - subversion -- DoS vulnerabilities - - - mod_dav_svn - 1.8.01.8.11 - - - subversion16 - 1.0.01.7.19 - - - subversion17 - 1.0.01.7.19 - - - subversion - 1.0.01.7.19 - 1.8.01.8.11 - - - - -

Subversion Project reports:

-
-

Subversion's mod_dav_svn Apache HTTPD server module will crash when it - receives a REPORT request for some invalid formatted special URIs.

-

Subversion's mod_dav_svn Apache HTTPD server module will crash when it - receives a request for some invalid formatted special URIs.

-

We consider this to be a medium risk vulnerability. Repositories which - allow for anonymous reads will be vulnerable without authentication. - Unfortunately, no special configuration is required and all mod_dav_svn - servers are vulnerable.

-
- - - - CVE-2014-3580 - CVE-2014-8108 - http://subversion.apache.org/security/CVE-2014-3580-advisory.txt - http://subversion.apache.org/security/CVE-2014-8108-advisory.txt - - - 2014-12-13 - 2014-12-15 - - - - - NVIDIA UNIX driver -- remote denial of service or arbitrary code execution - - - nvidia-driver - 340.65 - - - nvidia-driver-304 - 304.125 - - - nvidia-driver-173 - 173.14.35_3 - - - nvidia-driver-96 - 96.43.23_2 - - - nvidia-driver-71 - 71.86.15_4 - - - - -

NVIDIA Unix security team reports:

-
-

The GLX indirect rendering support supplied on NVIDIA products - is subject to the recently disclosed X.Org vulnerabilities - (CVE-2014-8093, CVE-2014-8098) as well as internally identified - vulnerabilities (CVE-2014-8298).

-

Depending on how it is configured, the X server typically runs - with raised privileges, and listens for GLX indirect rendering - protocol requests from a local socket and potentially a TCP/IP - port. The vulnerabilities could be exploited in a way that - causes the X server to access uninitialized memory or overwrite - arbitrary memory in the X server process. This can cause a - denial of service (e.g., an X server segmentation fault), or - could be exploited to achieve arbitrary code execution.

-
- - - - CVE-2014-8298 - CVE-2014-8093 - CVE-2014-8098 - - - 2014-12-03 - 2014-12-14 - - - - - bind -- denial of service vulnerability - - - bind99 - bind99-base - 9.9.6 - - - bind98 - bind98-base - bind96 - bind96-base - 0 - - - FreeBSD - 9.39.3_6 - 9.29.2_16 - 9.19.1_23 - 8.48.4_20 - - - - -

ISC reports:

-
-

We have today posted updated versions of 9.9.6 and 9.10.1 - to address a significant security vulnerability in DNS - resolution. The flaw was discovered by Florian Maury of - ANSSI, and applies to any recursive resolver that does not - support a limit on the number of recursions. [CERTFR-2014-AVI-512], - [USCERT VU#264212]

-

A flaw in delegation handling could be exploited to put named - into an infinite loop, in which each lookup of a name server - triggered additional lookups of more name servers. This has - been addressed by placing limits on the number of levels of - recursion named will allow (default 7), and on the number of - queries that it will send before terminating a recursive query - (default 50). The recursion depth limit is configured via the - max-recursion-depth option, and the query limit via the - max-recursion-queries option. For more information, see the - security advisory at https://kb.isc.org/article/AA-01216/. - [CVE-2014-8500] - [RT #37580]

-

In addition, we have also corrected a potential security - vulnerability in the GeoIP feature in the 9.10.1 release only. - For more information on this issue, see the security advisory - at https://kb.isc.org/article/AA-01217. - [CVE-2014-8680]

-
- - - - SA-14:29.bind - CVE-2014-8500 - CVE-2014-8680 - https://www.isc.org/blogs/important-security-advisory-posted/ - - - 2014-12-08 - 2014-12-11 - 2016-08-09 - - - - - asterisk -- Remote Crash Vulnerability in WebSocket Server - - - asterisk11 - 11.14.2 - - - - -

The Asterisk project reports:

-
-

When handling a WebSocket frame the res_http_websocket - module dynamically changes the size of the memory used - to allow the provided payload to fit. If a payload length - of zero was received the code would incorrectly attempt - to resize to zero. This operation would succeed and end - up freeing the memory but be treated as a failure. When - the session was subsequently torn down this memory would - get freed yet again causing a crash.

-

Users of the WebSocket functionality also did not take - into account that provided text frames are not guaranteed - to be NULL terminated. This has been fixed in chan_sip - and chan_pjsip in the applicable versions.

-
- - - - http://downloads.asterisk.org/pub/security/AST-2014-019.html - CVE-2014-9374 - - - 2014-10-30 - 2014-12-11 - 2015-01-29 - - - - - xserver -- multiple issue with X client request handling - - - xorg-server - 1.12.4_10,1 - - - - -

Alan Coopersmith reports:

-
-

Ilja van Sprundel, a security researcher with IOActive, has - discovered a large number of issues in the way the X server - code base handles requests from X clients, and has worked - with X.Org's security team to analyze, confirm, and fix - these issues.

- -

The vulnerabilities could be exploited to cause the X server - to access uninitialized memory or overwrite arbitrary memory - in the X server process. This can cause a denial of service - (e.g., an X server segmentation fault), or could be exploited - to achieve arbitrary code execution.

- -

The GLX extension to the X Window System allows an X client - to send X protocol to the X server, to request that the X - server perform OpenGL rendering on behalf of the X client. - This is known as "GLX indirect rendering", as opposed to - "GLX direct rendering" where the X client submits OpenGL - rendering commands directly to the GPU, bypassing the X - server and avoiding the X server code for GLX protocol - handling.

- -

Most GLX indirect rendering implementations share some - common ancestry, dating back to "Sample Implementation" - code from Silicon Graphics, Inc (SGI), which SGI - originally commercially licensed to other Unix workstation - and graphics vendors, and later released as open source, so - those vulnerabilities may affect other licensees of SGI's - code base beyond those running code from the X.Org Foundation - or the XFree86 Project.

-
- - - - http://lists.x.org/archives/xorg-announce/2014-December/002500.html - CVE-2014-8091 - CVE-2014-8092 - CVE-2014-8093 - CVE-2014-8094 - CVE-2014-8095 - CVE-2014-8096 - CVE-2014-8097 - CVE-2014-8098 - CVE-2014-8099 - CVE-2014-8100 - CVE-2014-8101 - CVE-2014-8102 - - - 2014-12-09 - 2014-12-10 - - - - - unbound -- can be tricked into following an endless series of delegations, this consumes a lot of resources - - - unbound - 1.5.1 - - - FreeBSD - 10.010.0_14 - 10.110.1_2 - - - - -

Unbound developer reports:

-
-

The resolver can be tricked into following an endless series of - delegations, this consumes a lot of resources.

-
- - - - http://unbound.net/downloads/CVE-2014-8602.txt - SA-14:30.unbound - CVE-2014-8602 - - - 2014-12-08 - 2014-12-09 - 2016-08-09 - - - - - freetype -- Out of bounds stack-based read/write - - - freetype2 - 2.5.4 - - - - -

Werner LEMBERG reports:

-
-

The fix for CVE-2014-2240 was not 100% complete to fix the issue - from the CVE completly.

-
- - - - http://lists.nongnu.org/archive/html/freetype-announce/2014-12/msg00000.html - CVE-2014-2240 - - - 2014-12-07 - 2014-12-07 - - - - - phpMyAdmin -- XSS and DoS vulnerabilities - - - phpMyAdmin - 4.2.04.2.13.1 - - - - -

The phpMyAdmin development team reports:

-
-

DoS vulnerability with long passwords.

-

With very long passwords it was possible to initiate a - denial of service attack on phpMyAdmin.

-

We consider this vulnerability to be serious.

-

This vulnerability can be mitigated by configuring - throttling in the webserver.

-
- -
-

XSS vulnerability in redirection mechanism.

-

With a crafted URL it was possible to trigger an XSS in - the redirection mechanism in phpMyAdmin.

-

We consider this vulnerability to be non critical.

-
- - - - http://www.phpmyadmin.net/home_page/security/PMASA-2014-17.php - http://www.phpmyadmin.net/home_page/security/PMASA-2014-18.php - CVE-2014-9218 - CVE-2014-9219 - - - 2014-12-03 - 2014-12-04 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 34.0,1 - - - firefox-esr - 31.3.0,1 - - - linux-firefox - 34.0,1 - - - linux-seamonkey - 2.31 - - - linux-thunderbird - 31.3.0 - - - seamonkey - 2.31 - - - thunderbird - 31.3.0 - - - libxul - 31.3.0 - - - nss - 3.17.3 - - - - -

The Mozilla Project reports:

-
-

ASN.1 DER decoding of lengths is too permissive, allowing - undetected smuggling of arbitrary data

-

MFSA-2014-90 Apple CoreGraphics framework on OS X 10.10 - logging input data to /tmp directory

-

MFSA-2014-89 Bad casting from the BasicThebesLayer to - BasicContainerLayer

-

MFSA-2014-88 Buffer overflow while parsing media content

-

MFSA-2014-87 Use-after-free during HTML5 parsing

-

MFSA-2014-86 CSP leaks redirect data via violation reports

-

MFSA-2014-85 XMLHttpRequest crashes with some input streams

-

MFSA-2014-84 XBL bindings accessible via improper CSS - declarations

-

MFSA-2014-83 Miscellaneous memory safety hazards (rv:34.0 - / rv:31.3)

-
- - - - CVE-2014-1587 - CVE-2014-1588 - CVE-2014-1589 - CVE-2014-1590 - CVE-2014-1591 - CVE-2014-1592 - CVE-2014-1593 - CVE-2014-1594 - CVE-2014-1595 - CVE-2014-1569 - https://www.mozilla.org/security/advisories/mfsa2014-83 - https://www.mozilla.org/security/advisories/mfsa2014-84 - https://www.mozilla.org/security/advisories/mfsa2014-85 - https://www.mozilla.org/security/advisories/mfsa2014-86 - https://www.mozilla.org/security/advisories/mfsa2014-87 - https://www.mozilla.org/security/advisories/mfsa2014-88 - https://www.mozilla.org/security/advisories/mfsa2014-89 - https://www.mozilla.org/security/advisories/mfsa2014-90 - https://www.mozilla.org/security/advisories/ - - - 2014-12-01 - 2014-12-02 - - - - - OpenVPN -- denial of service security vulnerability - - - openvpn - 2.0.11 - 2.1.02.2.3 - 2.3.02.3.6 - - - - -

The OpenVPN project reports:

-
-

In late November 2014 Dragana Damjanovic notified OpenVPN - developers of a critical denial of service security vulnerability - (CVE-2014-8104). The vulnerability allows an tls-authenticated - client to crash the server by sending a too-short control channel - packet to the server. In other words this vulnerability is denial - of service only.

-
- - - - CVE-2014-8104 - https://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-97597e732b - - - 2014-12-01 - 2014-12-02 - - - - - flac -- Multiple vulnerabilities - - - flac - 1.3.0_3 - - - linux-c6-flac - 1.2.1_3 - - - - -

Erik de Castro Lopo reports:

-
-

Google Security Team member, Michele Spagnuolo, recently - found two potential problems in the FLAC code base. They are:

-
    -
  • CVE-2014-9028: Heap buffer write overflow.
    • -
  • CVE-2014-8962: Heap buffer read overflow.
    • -
-
- - - - https://git.xiph.org/?p=flac.git;a=commit;h=5b3033a2b355068c11fe637e14ac742d273f076e - CVE-2014-8962 - https://git.xiph.org/?p=flac.git;a=commit;h=fcf0ba06ae12ccd7c67cee3c8d948df15f946b85 - CVE-2014-9028 - - - 2014-11-25 - 2014-11-25 - 2015-07-15 - - - - - asterisk -- Multiple vulnerabilities - - - asterisk11 - 11.14.1 - - - - -

The Asterisk project reports:

-
-

AST-2014-014 - High call load may result in hung - channels in ConfBridge.

-

AST-2014-017 - Permission escalation through ConfBridge - actions/dialplan functions.

-
- - - - http://downloads.asterisk.org/pub/security/AST-2014-014.html - CVE-2014-8414 - http://downloads.asterisk.org/pub/security/AST-2014-017.html - CVE-2014-8417 - - - 2014-11-21 - 2014-11-21 - - - - - asterisk -- Multiple vulnerabilities - - - asterisk - 1.8.32.1 - - - asterisk11 - 11.14.1 - - - - -

The Asterisk project reports:

-
-

AST-2014-012 - Mixed IP address families in access - control lists may permit unwanted traffic.

-

AST-2014-018 - AMI permission escalation through DB - dialplan function.

-
- - - - http://downloads.asterisk.org/pub/security/AST-2014-012.html - CVE-2014-8412 - http://downloads.asterisk.org/pub/security/AST-2014-018.html - CVE-2014-8418 - - - 2014-11-21 - 2014-11-21 - - - - - phpMyAdmin -- XSS and information disclosure vulnerabilities - - - phpMyAdmin - 4.2.04.2.12 - - - - -

The phpMyAdmin development team reports:

-
-
    -
  • With a crafted database, table or column name it is - possible to trigger an XSS attack in the table browse - page.
    • -
  • With a crafted ENUM value it is possible to trigger - XSS attacks in the table print view and zoom search - pages.
    • -
  • With a crafted value for font size it is possible to - trigger an XSS attack in the home page.
    • -
-

These vulnerabilities can be triggered only by someone - who is logged in to phpMyAdmin, as the usual token - protection prevents non-logged-in users from accessing the - required pages. Moreover, exploitation of the XSS - vulnerability related to the font size requires forgery of - the pma_fontsize cookie.

-
-
-

In the GIS editor feature, a parameter specifying the - geometry type was not correcly validated, opening the door - to a local file inclusion attack.

-

This vulnerability can be triggered only by someone who - is logged in to phpMyAdmin, as the usual token protection - prevents non-logged-in users from accessing the required - page.

-
-
-

With a crafted file name it is possible to trigger an - XSS in the error reporting page.

-

This vulnerability can be triggered only by someone who - is logged in to phpMyAdmin, as the usual token protection - prevents non-logged-in users from accessing the required - page.

-
-
-

In the error reporting feature, a parameter specifying - the file was not correctly validated, allowing the - attacker to derive the line count of an arbitrary file

-

This vulnerability can be triggered only by someone who - is logged in to phpMyAdmin, as the usual token protection - prevents non-logged-in users from accessing the required - page.

-
- - - - http://www.phpmyadmin.net/home_page/security/PMASA-2014-13.php - http://www.phpmyadmin.net/home_page/security/PMASA-2014-14.php - http://www.phpmyadmin.net/home_page/security/PMASA-2014-15.php - http://www.phpmyadmin.net/home_page/security/PMASA-2014-16.php - CVE-2014-8958 - CVE-2014-8959 - CVE-2014-8960 - CVE-2014-8961 - - - 2014-11-20 - 2014-11-21 - - - - - kwebkitpart, kde-runtime -- insufficient input validation - - - kde-runtime - 4.14.2_2 - - - kwebkitpart - 1.3.2_4 - - - - -

Albert Aastals Cid reports:

-
-

kwebkitpart and the bookmarks:// io slave were not sanitizing - input correctly allowing to some javascript being executed on the - context of the referenced hostname.

-

Whilst in most cases, the JavaScript will be executed in an - untrusted context, with the bookmarks IO slave, it will be executed - in the context of the referenced hostname. It should however be - noted that KDE mitigates this risk by attempting to ensure that - such URLs cannot be embedded directly into Internet hosted - content.

-
- - - - https://www.kde.org/info/security/advisory-20141113-1.txt - CVE-2014-8600 - - - 2014-11-13 - 2014-11-20 - - - - - yii -- Remote arbitrary PHP code execution - - - yii - 1.1.15 - - - - -

Yii PHP Framework developers report:

-
-

We are releasing Yii 1.1.15 to fix a security issue - found in 1.1.14. We urge all 1.1.14 users to upgrade their - Yii to this latest release. Note that the issue only - affects 1.1.14. All previous releases are not affected. - Upgrading to this release from 1.1.14 is very safe and - will not break your existing code.

-

The vulnerability is in the CDetailView widget. When - a Yii application uses this widget and configures the - "value" property of a CDetailView attribute using end - user inputs, it may allow attackers to potentially execute - arbitrary PHP scripts on the server. We are not showing - how to exploit it here to allow users to upgrade before - details about the exploit become publicly known. To our - knowledge the details of this issue are only known to - core team members.

-
- - - - CVE-2014-4672 - http://www.yiiframework.com/news/78/yii-1-1-15-is-released-security-fix - - - 2014-07-03 - 2014-11-19 - - - - - chromium -- multiple vulnerabilities - - - chromium - 39.0.2171.65 - - - chromium-pulse - 39.0.2171.65 - - - - -

Google Chrome Releases reports:

-
-

42 security fixes in this release, including:

-
    -
  • [389734] High CVE-2014-7899: Address bar spoofing. Credit to - Eli Grey.
    • -
  • [406868] High CVE-2014-7900: Use-after-free in pdfium. Credit - to Atte Kettunen from OUSPG.
    • -
  • [413375] High CVE-2014-7901: Integer overflow in pdfium. Credit - to cloudfuzzer.
    • -
  • [414504] High CVE-2014-7902: Use-after-free in pdfium. Credit - to cloudfuzzer.
    • -
  • [414525] High CVE-2014-7903: Buffer overflow in pdfium. Credit - to cloudfuzzer.
    • -
  • [418161] High CVE-2014-7904: Buffer overflow in Skia. Credit to - Atte Kettunen from OUSPG.
    • -
  • [421817] High CVE-2014-7905: Flaw allowing navigation to - intents that do not have the BROWSABLE category. Credit to - WangTao(neobyte) of Baidu X-Team.
    • -
  • [423030] High CVE-2014-7906: Use-after-free in pepper plugins. - Credit to Chen Zhang (demi6od) of the NSFOCUS Security Team.
    • -
  • [423703] High CVE-2014-0574: Double-free in Flash. Credit to - biloulehibou.
    • -
  • [424453] High CVE-2014-7907: Use-after-free in blink. Credit to - Chen Zhang (demi6od) of the NSFOCUS Security Team.
    • -
  • [425980] High CVE-2014-7908: Integer overflow in media. Credit - to Christoph Diehl.
    • -
  • [391001] Medium CVE-2014-7909: Uninitialized memory read in - Skia. Credit to miaubiz.
    • -
  • CVE-2014-7910: Various fixes from internal audits, fuzzing and - other initiatives.
    • -
-
- - - - CVE-2014-0574 - CVE-2014-7899 - CVE-2014-7900 - CVE-2014-7901 - CVE-2014-7902 - CVE-2014-7903 - CVE-2014-7904 - CVE-2014-7905 - CVE-2014-7906 - CVE-2014-7907 - CVE-2014-7908 - CVE-2014-7909 - CVE-2014-7910 - http://googlechromereleases.blogspot.nl/2014/11/stable-channel-update_18.html - - - 2014-11-18 - 2014-11-18 - - - - - kde-workspace -- privilege escalation - - - kde-workspace - 4.11.13_1 - - - - -

David Edmundson reports:

-
-

KDE workspace configuration module for setting the date and time - has a helper program which runs as root for performing actions. - This is secured with polkit.

-

This helper takes the name of the ntp utility to run as an - argument. This allows a hacker to run any arbitrary command as root - under the guise of updating the time.

-

An application can gain root priveledges from an admin user with - either misleading information or no interaction.

-

On some systems the user will be shown a prompt to change the - time. However, if the system has policykit-desktop-privileges - installed, the datetime helper will be invoked by an admin user - without any prompts.

-
- - - - CVE-2014-8651 - http://seclists.org/oss-sec/2014/q4/520 - - - 2014-11-06 - 2014-11-17 - - - - - dbus -- incomplete fix for CVE-2014-3636 part A - - - dbus - 1.8.10 - - - - -

Simon McVittie reports:

-
-

The patch issued by the D-Bus maintainers for CVE-2014-3636 - was based on incorrect reasoning, and does not fully prevent - the attack described as "CVE-2014-3636 part A", which is - repeated below. Preventing that attack requires raising the - system dbus-daemon's RLIMIT_NOFILE (ulimit -n) to a higher - value. CVE-2014-7824 has been allocated for this - vulnerability.

-
- - - - CVE-2014-7824 - http://lists.freedesktop.org/archives/dbus/2014-November/016395.html - - - 2014-11-10 - 2014-11-11 - - - - - wget -- path traversal vulnerability in recursive FTP mode - - - wget - 1.16 - - - - -

MITRE reports:

-
-

Absolute path traversal vulnerability in GNU Wget before - 1.16, when recursion is enabled, allows remote FTP servers - to write to arbitrary files, and consequently execute - arbitrary code, via a LIST response that references the same - filename within two entries, one of which indicates that the - filename is for a symlink.

-
- - - - CVE-2014-4877 - 685996 - - - 2014-10-27 - 2014-11-08 - - - - - Konversation -- out-of-bounds read on a heap-allocated array - - - konversation - 1.5.1 - - - - -

Konversation developers report:

-
-

Konversation's Blowfish ECB encryption support assumes incoming blocks - to be the expected 12 bytes. The lack of a sanity-check for the actual - size can cause a denial of service and an information leak to the local - user.

-
- - - - CVE-2014-8483 - https://www.kde.org/info/security/advisory-20141104-1.txt - - - 2014-11-04 - 2014-11-05 - - - - - twiki -- remote Perl code execution - - - twiki - 5.1.4_1,1 - - - - -

TWiki developers report:

-
-

The debugenableplugins request parameter allows arbitrary - Perl code execution.

-

Using an HTTP GET request towards a TWiki server, - add a specially crafted debugenableplugins request parameter - to TWiki's view script (typically port 80/TCP). - Prior authentication may or may not be necessary.

-

A remote attacker can execute arbitrary Perl code - to view and modify any file the webserver user has access to.

-

Example: http://www.example.com/do/view/Main/WebHome?debugenableplugins=BackupRestorePlugin%3bprint("Content-Type:text/html\r\n\r\nVulnerable!")%3bexit

-

The TWiki site is vulnerable if you see a page with text - "Vulnerable!".

-
- - - - CVE-2014-7236 - http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2014-7236 - - - 2014-10-09 - 2014-10-31 - - - - - jenkins -- slave-originated arbitrary code execution on master servers - - - jenkins - 1.587 - - - jenkins-lts - 1.580.1 - - - - -

Kohsuke Kawaguchi from Jenkins team reports:

-
-

Historically, Jenkins master and slaves behaved as if - they altogether form a single distributed process. This - means a slave can ask a master to do just about anything - within the confinement of the operating system, such as - accessing files on the master or trigger other jobs on - Jenkins.

-

This has increasingly become problematic, as larger - enterprise deployments have developed more sophisticated - trust separation model, where the administators of a master - might take slaves owned by other teams. In such an - environment, slaves are less trusted than the master. - Yet the "single distributed process" assumption was not - communicated well to the users, resulting in vulnerabilities - in some deployments.

-

SECURITY-144 (CVE-2014-3665) introduces a new subsystem - to address this problem. This feature is off by default for - compatibility reasons. See Wiki for more details, who should - turn this on, and implications.

-

CVE-2014-3566 is rated high. It only affects - installations that accept slaves from less trusted - computers, but this will allow an owner of of such slave to - mount a remote code execution attack on Jenkins.

-
- - - - CVE-2014-3665 - https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-30 - https://wiki.jenkins-ci.org/display/JENKINS/Slave+To+Master+Access+Control - http://www.cloudbees.com/jenkins-security-advisory-2014-10-30 - - - 2014-10-30 - 2014-10-31 - - - - - libssh -- PRNG state reuse on forking servers - - - libssh - 0.6.3 - - - - -

Aris Adamantiadis reports:

-
-

When accepting a new connection, the server forks and the - child process handles the request. The RAND_bytes() function - of openssl doesn't reset its state after the fork, but - simply adds the current process id (getpid) to the PRNG - state, which is not guaranteed to be unique.

-
- - - - CVE-2014-0017 - http://www.openwall.com/lists/oss-security/2014/03/05/1 - http://secunia.com/advisories/57407 - - - 2014-03-05 - 2014-10-29 - - - - - libpurple/pidgin -- multiple vulnerabilities - - - libpurple - 2.10.10 - - - pidgin - 2.10.10 - - - - -

The pidgin development team reports:

-
-

.

-
- - - - CVE-2014-3694 - CVE-2014-3697 - CVE-2014-3696 - CVE-2014-3695 - CVE-2014-3698 - https://developer.pidgin.im/wiki/ChangeLog - - - 2014-10-22 - 2014-10-24 - - - - - phpMyAdmin -- XSS vulnerabilities in SQL debug output and server monitor page. - - - phpMyAdmin - 4.2.04.2.10.1 - - - - -

The phpMyAdmin development team reports:

-
-

With a crafted database or table name it is possible to - trigger an XSS in SQL debug output when enabled and in - server monitor page when viewing and analysing executed - queries.

-

This vulnerability can be triggered only by someone who - is logged in to phpMyAdmin, as the usual token protection - prevents non-logged-in users from accessing the required - pages. Moreover, debugging SQL is a developer option which - is disabled by default and expected to be disabled in - production environments.

-
- - - - http://www.phpmyadmin.net/home_page/security/PMASA-2014-12.php - CVE-2014-8326 - - - 2014-10-21 - 2014-10-22 - - - - - asterisk -- Asterisk Susceptibility to POODLE Vulnerability - - - asterisk - 1.8.31.1 - - - asterisk11 - 11.13.1 - - - - -

The Asterisk project reports:

-
-

The POODLE vulnerability is described under CVE-2014-3566. - This advisory describes the Asterisk's project susceptibility - to this vulnerability.

-
- - - - http://downloads.asterisk.org/pub/security/AST-2014-011.html - CVE-2014-3566 - - - 2014-10-20 - 2014-10-21 - - - - - libxml2 -- Denial of service - - - libxml2 - 2.9.2 - - - linux-c6-libxml2 - 2.7.6_2 - - - linux-f10-libxml2 - * - - - - -

RedHat reports:

-
-

A denial of service flaw was found in libxml2, a library - providing support to read, modify and write XML and HTML - files. A remote attacker could provide a specially crafted - XML file that, when processed by an application using - libxml2, would lead to excessive CPU consumption (denial of - service) based on excessive entity substitutions, even if - entity substitution was disabled, which is the parser default - behavior.

-
- - - - CVE-2014-3660 - https://rhn.redhat.com/errata/RHSA-2014-1655.html - - - 2014-10-16 - 2014-10-18 - 2015-07-15 - - - - - drupal7 -- SQL injection - - - drupal7 - 7.32 - - - - -

Drupal Security Team reports:

-
-

Drupal 7 includes a database abstraction API to ensure that - queries executed against the database are sanitized to prevent - SQL injection attacks. - A vulnerability in this API allows an attacker to send - specially crafted requests resulting in arbitrary SQL execution. - Depending on the content of the requests this can lead to - privilege escalation, arbitrary PHP execution, or other attacks. - This vulnerability can be exploited by anonymous users.

-
- - - - CVE-2014-3704 - https://www.drupal.org/SA-CORE-2014-005 - https://www.sektioneins.de/en/blog/14-10-15-drupal-sql-injection-vulnerability.html - - - 2014-10-15 - 2014-10-16 - - - - - OpenSSL -- multiple vulnerabilities - - - openssl - 1.0.11.0.1_16 - - - mingw32-openssl - 1.0.11.0.1j - - - linux-c6-openssl - 1.0.1e_1 - - - FreeBSD - 8.48.4_17 - 9.19.1_20 - 9.29.2_13 - 9.39.3_3 - 10.010.0_10 - - - - -

The OpenSSL Project reports:

-
-

A flaw in the DTLS SRTP extension parsing code allows an - attacker, who sends a carefully crafted handshake message, - to cause OpenSSL to fail to free up to 64k of memory causing - a memory leak. This could be exploited in a Denial Of Service - attack. This issue affects OpenSSL 1.0.1 server implementations - for both SSL/TLS and DTLS regardless of whether SRTP is used - or configured. Implementations of OpenSSL that have been - compiled with OPENSSL_NO_SRTP defined are not affected. - [CVE-2014-3513].

-

When an OpenSSL SSL/TLS/DTLS server receives a session - ticket the integrity of that ticket is first verified. - In the event of a session ticket integrity check failing, - OpenSSL will fail to free memory causing a memory leak. - By sending a large number of invalid session tickets an - attacker could exploit this issue in a Denial Of Service - attack. [CVE-2014-3567].

-

OpenSSL has added support for TLS_FALLBACK_SCSV to allow - applications to block the ability for a MITM attacker to - force a protocol downgrade.

-

Some client applications (such as browsers) will reconnect - using a downgraded protocol to work around interoperability - bugs in older servers. This could be exploited by an active - man-in-the-middle to downgrade connections to SSL 3.0 even - if both sides of the connection support higher protocols. - SSL 3.0 contains a number of weaknesses including POODLE - [CVE-2014-3566].

-

When OpenSSL is configured with "no-ssl3" as a build option, - servers could accept and complete a SSL 3.0 handshake, and - clients could be configured to send them. [CVE-2014-3568].

-
- - - - SA-14:23.openssl - CVE-2014-3513 - CVE-2014-3566 - CVE-2014-3567 - CVE-2014-3568 - https://www.openssl.org/news/secadv_20141015.txt - - - 2014-10-15 - 2014-10-15 - 2016-08-09 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 33.0,1 - - - firefox-esr - 31.2.0,1 - - - linux-firefox - 33.0,1 - - - linux-seamonkey - 2.30 - - - linux-thunderbird - 31.2.0 - - - seamonkey - 2.30 - - - thunderbird - 31.2.0 - - - libxul - 31.2.0 - - - - -

The Mozilla Project reports:

-
-

MFSA 2014-74 Miscellaneous memory safety hazards - (rv:33.0 / rv:31.2)

-

MFSA 2014-75 Buffer overflow during CSS manipulation

-

MFSA 2014-76 Web Audio memory corruption issues with - custom waveforms

-

MFSA 2014-78 Further uninitialized memory use during GIF

-

MFSA 2014-79 Use-after-free interacting with text - directionality

-

MFSA 2014-80 Key pinning bypasses

-

MFSA 2014-81 Inconsistent video sharing within iframe

-

MFSA 2014-82 Accessing cross-origin objects via the - Alarms API

-
- - - - CVE-2014-1574 - CVE-2014-1575 - CVE-2014-1576 - CVE-2014-1577 - CVE-2014-1580 - CVE-2014-1581 - CVE-2014-1582 - CVE-2014-1583 - CVE-2014-1584 - CVE-2014-1585 - CVE-2014-1586 - https://www.mozilla.org/security/announce/2014/mfsa2014-74.html - https://www.mozilla.org/security/announce/2014/mfsa2014-75.html - https://www.mozilla.org/security/announce/2014/mfsa2014-76.html - https://www.mozilla.org/security/announce/2014/mfsa2014-78.html - https://www.mozilla.org/security/announce/2014/mfsa2014-79.html - https://www.mozilla.org/security/announce/2014/mfsa2014-80.html - https://www.mozilla.org/security/announce/2014/mfsa2014-81.html - https://www.mozilla.org/security/announce/2014/mfsa2014-82.html - https://www.mozilla.org/security/announce/ - - - 2014-10-14 - 2014-10-14 - 2015-08-12 - - - - - foreman-proxy SSL verification issue - - - foreman-proxy - 1.6.2 - - - - -

Foreman Security reports:

-
-

The smart proxy when running in an SSL-secured mode permits incoming - API calls to any endpoint without requiring, or performing any - verification of an SSL client certificate. This permits any client - with access to the API to make requests and perform actions - permitting control of Puppet CA, DHCP, DNS etc.)

-
- - - - CVE-2014-3691 - https://groups.google.com/forum/#!topic/foreman-announce/LcjZx25Bl7U - - - 2014-05-09 - 2014-10-09 - - - - - Bugzilla multiple security issues - - - bugzilla44 - 4.4.6 - - - - -

Bugzilla Security Advisory

-
-
Unauthorized Account Creation
-

An attacker creating a new Bugzilla account can override certain - parameters when finalizing the account creation that can lead to the - user being created with a different email address than originally - requested. The overridden login name could be automatically added - to groups based on the group's regular expression setting.

-
Cross-Site Scripting
-

During an audit of the Bugzilla code base, several places - were found where cross-site scripting exploits could occur which - could allow an attacker to access sensitive information.

-
Information Leak
-

If a new comment was marked private to the insider group, and a flag - was set in the same transaction, the comment would be visible to - flag recipients even if they were not in the insider group.

-
Social Engineering
-

Search results can be exported as a CSV file which can then be - imported into external spreadsheet programs. Specially formatted - field values can be interpreted as formulas which can be executed - and used to attack a user's computer.

-
- - - - CVE-2014-1572 - CVE-2014-1573 - CVE-2014-1571 - https://bugzilla.mozilla.org/show_bug.cgi?id=1074812 - https://bugzilla.mozilla.org/show_bug.cgi?id=1075578 - https://bugzilla.mozilla.org/show_bug.cgi?id=1064140 - https://bugzilla.mozilla.org/show_bug.cgi?id=1054702 - - - 2014-10-06 - 2014-10-06 - - - - - rt42 -- vulnerabilities related to shellshock - - - rt42 - 4.2.04.2.8 - - - - -

Best Practical reports:

-
-

RT 4.2.0 and above may be vulnerable to arbitrary - execution of code by way of CVE-2014-7169, CVE-2014-7186, - CVE-2014-7187, CVE-2014-6277, or CVE-2014-6271 -- - collectively known as "Shellshock." This vulnerability - requires a privileged user with access to an RT instance - running with SMIME integration enabled; it applies to both - mod_perl and fastcgi deployments. If you have already - taken upgrades to bash to resolve "Shellshock," you are - protected from this vulnerability in RT, and there is no - need to apply this patch. This vulnerability has been - assigned CVE-2014-7227.

-
- - - - http://blog.bestpractical.com/2014/10/security-vulnerability-in-rt-42x-cve-2014-7227.html - CVE-2014-7227 - - - 2014-10-02 - 2014-10-02 - - - - - jenkins -- remote execution, privilege escalation, XSS, password exposure, ACL hole, DoS - - - jenkins - 1.583 - - - jenkins-lts - 1.565.3 - - - - -

Jenkins Security Advisory:

-
-

Please reference CVE/URL list for details

-
- - - - https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01 - CVE-2014-3661 - CVE-2014-3662 - CVE-2014-3663 - CVE-2014-3664 - CVE-2014-3680 - CVE-2014-3681 - CVE-2014-3666 - CVE-2014-3667 - CVE-2013-2186 - CVE-2014-1869 - CVE-2014-3678 - CVE-2014-3679 - - - 2014-10-01 - 2014-10-01 - - - - - bash -- remote code execution - - - bash - bash-static - 4.3.25_2 - - - - -

Note that this is different than the public "Shellshock" - issue.

-

Specially crafted environment variables could lead to remote - arbitrary code execution. This was fixed in bash 4.3.27, however - the port was patched with a mitigation in 4.3.25_2.

- - - - http://lcamtuf.blogspot.com/2014/09/bash-bug-apply-unofficial-patch-now.html - CVE-2014-6277 - CVE-2014-6278 - - - 2014-09-27 - 2014-10-01 - - - - - phpMyAdmin -- XSS vulnerabilities - - - phpMyAdmin - 4.2.04.2.9.1 - - - - -

The phpMyAdmin development team reports:

-
-

With a crafted ENUM value it is possible to trigger an - XSS in table search and table structure pages. This - vulnerability can be triggered only by someone who is - logged in to phpMyAdmin, as the usual token protection - prevents non-logged-in users from accessing the required - pages.

-
- - - - http://www.phpmyadmin.net/home_page/security/PMASA-2014-11.php - CVE-2014-7217 - - - 2014-10-01 - 2014-10-01 - - - - - bash -- out-of-bounds memory access in parser - - - bash - bash-static - 4.3.27_1 - - - - -

RedHat security team reports:

-
-

It was discovered that the fixed-sized redir_stack could be forced - to overflow in the Bash parser, resulting in memory corruption, and - possibly leading to arbitrary code execution when evaluating - untrusted input that would not otherwise be run as code.

-
-
-

An off-by-one error was discovered in the way Bash was handling - deeply nested flow control constructs. Depending on the layout of - the .bss segment, this could allow arbitrary execution of code that - would not otherwise be executed by Bash.

-
- - - - https://access.redhat.com/security/cve/CVE-2014-7186 - CVE-2014-7186 - CVE-2014-7187 - - - 2014-09-25 - 2014-10-01 - - - - - rsyslog -- remote syslog PRI vulnerability - - - rsyslog - 7.6.7 - - - rsyslog8 - 8.4.2 - - - - -

The rsyslog project reports:

-
-

potential abort when a message with PRI > 191 was processed - if the "pri-text" property was used in active templates, - this could be abused to a remote denial of service from - permitted senders

-

The original fix for CVE-2014-3634 was not adequate.

-
- - - - http://www.rsyslog.com/remote-syslog-pri-vulnerability/ - CVE-2014-3634 - - - 2014-09-30 - 2014-09-30 - 2014-10-02 - - - - - fish -- local privilege escalation and remote code execution - - - fish - 1.6.02.1.1 - - - - -

Fish developer David Adam reports:

-
-

This release fixes a number of local privilege escalation - vulnerability and one remote code execution vulnerability.

-
- - - - http://www.openwall.com/lists/oss-security/2014/09/28/8 - CVE-2014-2905 - https://github.com/fish-shell/fish-shell/issues/1436 - CVE-2014-2906 - CVE-2014-3856 - https://github.com/fish-shell/fish-shell/issues/1437 - CVE-2014-2914 - https://github.com/fish-shell/fish-shell/issues/1438 - CVE-2014-3219 - https://github.com/fish-shell/fish-shell/issues/1440 - - - 2014-09-28 - 2014-09-29 - - - - - Flash player -- Multiple security vulnerabilities in www/linux-*-flashplugin11 - - - linux-f10-flashplugin - 11.2r202.400 - - - linux-c6-flashplugin - 11.2r202.400 - - - - -

Adobe reports:

-
-

These updates address vulnerabilities that could cause a crash - and potentially allow an attacker to take control of the affected system.

-
- - - - CVE-2014-0547 - CVE-2014-0548 - CVE-2014-0549 - CVE-2014-0550 - CVE-2014-0551 - CVE-2014-0552 - CVE-2014-0553 - CVE-2014-0554 - CVE-2014-0555 - CVE-2014-0556 - CVE-2014-0557 - CVE-2014-0559 - http://helpx.adobe.com/security/products/flash-player/apsb14-21.html - - - 2014-09-09 - 2014-09-25 - - - - - NSS -- RSA Signature Forgery - - - linux-firefox - 32.0.3,1 - - - linux-thunderbird - 31.1.2 - - - linux-seamonkey - 2.29.1 - - - nss - 3.17.1 - - - linux-c6-nss - 3.16.1 - - - - -

The Mozilla Project reports:

-
-

Antoine Delignat-Lavaud discovered that NSS is vulnerable - to a variant of a signature forgery attack previously - published by Daniel Bleichenbacher. This is due to lenient - parsing of ASN.1 values involved in a signature and could - lead to the forging of RSA certificates.

-
- - - - CVE-2014-1568 - https://www.mozilla.org/security/announce/2014/mfsa2014-73.html - - - 2014-09-23 - 2014-09-25 - - - - - krfb -- Multiple security issues in bundled libvncserver - - - krfb - 4.12.5_4 - - - - -

Martin Sandsmark reports:

-
-

krfb 4.14 [and earlier] embeds libvncserver which has had - several security issues.

-

Several remotely exploitable security issues have been - uncovered in libvncserver, some of which might allow a - remote authenticated user code execution or application - crashes.

-
- - - - CVE-2014-6055 - http://lists.kde.org/?l=kde-announce&m=141153917319769&w=2 - - - 2014-09-23 - 2014-09-25 - - - - - bash -- remote code execution vulnerability - - - bash - bash-static - 3.03.0.17 - 3.13.1.18 - 3.23.2.52 - 4.04.0.39 - 4.14.1.12 - 4.24.2.48 - 4.34.3.25_1 - - - linux_base-c6 - 6.5_1 - - - - -

Chet Ramey reports:

-
-

Under certain circumstances, bash will execute user code - while processing the environment for exported function - definitions.

-
-

The original fix released for CVE-2014-6271 was not adequate. A - similar vulnerability was discovered and tagged as CVE-2014-7169.

- - - - CVE-2014-6271 - CVE-2014-7169 - https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/ - https://lists.gnu.org/archive/html/bug-bash/2014-09/msg00081.html - http://seclists.org/oss-sec/2014/q3/690 - - - 2014-09-24 - 2014-09-24 - 2014-09-25 - - - - - asterisk -- Remotely triggered crash - - - asterisk11 - 11.12.1 - - - - -

The Asterisk project reports:

-
-

When an out of call message - delivered by either the - SIP or PJSIP channel driver or the XMPP stack - is handled - in Asterisk, a crash can occur if the channel servicing - the message is sent into the ReceiveFax dialplan application - while using the res_fax_spandsp module.

-

Note that this crash does not occur when using the - res_fax_digium module. While this crash technically - occurs due to a configuration issue, as attempting to - receive a fax from a channel driver that only contains - textual information will never succeed, the likelihood - of having it occur is sufficiently high as to warrant - this advisory.

-
- - - - http://downloads.asterisk.org/pub/security/AST-2014-010.pdf - https://issues.asterisk.org/jira/browse/ASTERISK-24301 - https://www.asterisk.org/security - - - 2014-09-05 - 2014-09-18 - - - - - squid -- Buffer overflow in SNMP processing - - - squid - 3.4.8 - - - squid32 - 0 - - - squid33 - 3.3.13_2 - - - - -

The squid-cache project reports:

-
-

Due to incorrect buffer management Squid can be caused - by an attacker to write outside its allocated SNMP buffer.

-
- - - - http://www.squid-cache.org/Advisories/SQUID-2014_3.txt - CVE-2014-6270 - - - 2014-09-15 - 2014-09-18 - - - - - dbus -- multiple vulnerabilities - - - dbus - 1.8.8 - - - - -

Simon McVittie reports:

-
-

Do not accept an extra fd in the padding of a cmsg message, - which could lead to a 4-byte heap buffer overrun - (CVE-2014-3635).

-

Reduce default for maximum Unix file descriptors passed per - message from 1024 to 16, preventing a uid with the default - maximum number of connections from exhausting the system - bus' file descriptors under Linux's default rlimit - (CVE-2014-3636).

-

Disconnect connections that still have a fd pending - unmarshalling after a new configurable limit, - pending_fd_timeout (defaulting to 150 seconds), removing - the possibility of creating an abusive connection that - cannot be disconnected by setting up a circular reference - to a connection's file descriptor (CVE-2014-3637).

-

Reduce default for maximum pending replies per connection - from 8192 to 128, mitigating an algorithmic complexity - denial-of-service attack (CVE-2014-3638).

-

Reduce default for authentication timeout on the system - bus from 30 seconds to 5 seconds, avoiding denial of service - by using up all unauthenticated connection slots; and when - all unauthenticated connection slots are used up, make new - connection attempts block instead of disconnecting them - (CVE-2014-3639).

-
- - - - CVE-2014-3635 - CVE-2014-3636 - CVE-2014-3637 - CVE-2014-3638 - CVE-2014-3639 - http://lists.freedesktop.org/archives/dbus/2014-September/016343.html - - - 2014-09-16 - 2014-09-17 - - - - - nginx -- inject commands into SSL session vulnerability - - - nginx - 0.6.01.6.2,2 - - - nginx-devel - 0.5.61.7.5 - - - - -

The nginx project reports:

-
-

Security: it was possible to reuse SSL sessions in unrelated contexts - if a shared SSL session cache or the same TLS session ticket key was - used for multiple "server" blocks (CVE-2014-3616).

-
- - - - CVE-2014-3616 - http://mailman.nginx.org/pipermail/nginx-announce/2014/000147.html - - - 2014-09-16 - 2014-09-16 - - - - - phpMyAdmin -- XSRF/CSRF due to DOM based XSS in the micro history feature - - - phpMyAdmin - 4.2.04.2.8.1 - - - - -

The phpMyAdmin development team reports:

-
-

XSRF/CSRF due to DOM based XSS in the micro history feature.

-

By deceiving a logged-in user to click on a crafted URL, - it is possible to perform remote code execution and in some - cases, create a root account due to a DOM based XSS - vulnerability in the micro history feature.

-
- - - - http://www.phpmyadmin.net/home_page/security/PMASA-2014-10.php - CVE-2014-6300 - - - 2014-09-13 - 2014-09-13 - - - - - security/ossec-hids-* -- root escalation via temp files - - - ossec-hids-server - ossec-hids-client - ossec-hids-local - 2.8.1 - - - - -

OSSEC reports:

-
-

This correction will create the temp file for the hosts deny file - in /var/ossec and will use mktemp where available to create - NON-predictable temp file name. In cases where mktemp is not - available we have written a BAD version of mktemp, but should be a - little better then just process id.

-
- - - - CVE-2014-5284 - http://www.ossec.net/?p=1135 - - - 2014-09-09 - 2014-09-11 - - - - - trafficserver -- unspecified vulnerability - - - trafficserver - 5.0.1 - - - - -

Bryan Call reports:

-
-

Below is our announcement for the security issue reported to us - from Yahoo! Japan. All versions of Apache Traffic Server are - vulnerable. We urge users to upgrade to either 4.2.1.1 or 5.0.1 - immediately.

-

This fixes CVE-2014-3525 and limits access to how the health - checks are performed.

-
- - - - CVE-2014-3525 - http://mail-archives.apache.org/mod_mbox/trafficserver-users/201407.mbox/%3CBFCEC9C8-1BE9-4DCA-AF9C-B8FE798EEC07@yahoo-inc.com%3E - - - 2014-07-23 - 2014-09-05 - - - - - file -- buffer overruns and missing buffer size tests - - - file - 5.19 - - - - -

Christos Zoulas reports:

-
-

A specially crafted file can cause a segmentation fault.

-
- - - - http://mx.gw.com/pipermail/file/2014/001553.html - - - 2014-06-09 - 2014-08-21 - - - - - django -- multiple vulnerabilities - - - py27-django - 1.61.6.6 - - - py27-django15 - 1.51.5.9 - - - py27-django14 - 1.41.4.14 - - - py32-django - 1.61.6.6 - - - py32-django15 - 1.51.5.9 - - - py33-django - 1.61.6.6 - - - py33-django15 - 1.51.5.9 - - - py34-django - 1.61.6.6 - - - py34-django15 - 1.51.5.9 - - - py27-django-devel - 20140821,1 - - - py32-django-devel - 20140821,1 - - - py33-django-devel - 20140821,1 - - - py34-django-devel - 20140821,1 - - - - -

The Django project reports:

-
-

These releases address an issue with reverse() generating external - URLs; a denial of service involving file uploads; a potential - session hijacking issue in the remote-user middleware; and a data - leak in the administrative interface. We encourage all users of - Django to upgrade as soon as possible.

-
- - - - https://www.djangoproject.com/weblog/2014/aug/20/security/ - CVE-2014-0480 - CVE-2014-0481 - CVE-2014-0482 - CVE-2014-0483 - - - 2014-08-20 - 2014-08-21 - - - - - PHP multiple vulnerabilities - - - php53 - 5.3.29 - - - - -

The PHP Team reports:

-
-

insecure temporary file use in the configure script

-

unserialize() SPL ArrayObject / SPLObjectStorage Type Confusion -

-

Heap buffer over-read in DateInterval

-

fileinfo: cdf_read_short_sector insufficient boundary check

-

fileinfo: CDF infinite loop in nelements DoS

-

fileinfo: fileinfo: numerous file_printf calls resulting in - performance degradation)

-

Fix potential segfault in dns_check_record()

-
- - - - CVE-2013-6712 - CVE-2014-0207 - CVE-2014-0237 - CVE-2014-0238 - CVE-2014-3515 - CVE-2014-3981 - CVE-2014-4049 - http://php.net/ChangeLog-5.php#5.3.29 - https://www.sektioneins.de/en/blog/14-07-04-phpinfo-infoleak.html - - - 2014-08-14 - 2014-08-18 - - - - - phpMyAdmin -- XSS vulnerabilities - - - phpMyAdmin - 4.2.04.2.7.1 - - - - -

The phpMyAdmin development team reports:

-
-

Multiple XSS vulnerabilities in browse table, ENUM - editor, monitor, query charts and table relations pages.

-

With a crafted database, table or a primary/unique key - column name it is possible to trigger an XSS when dropping - a row from the table. With a crafted column name it is - possible to trigger an XSS in the ENUM editor dialog. With - a crafted variable name or a crafted value for unit field - it is possible to trigger a self-XSS when adding a new - chart in the monitor page. With a crafted value for x-axis - label it is possible to trigger a self-XSS in the query - chart page. With a crafted relation name it is possible to - trigger an XSS in table relations page.

-
-
-

XSS in view operations page.

-

With a crafted view name it is possible to trigger an - XSS when dropping the view in view operation page.

-
- - - - http://www.phpmyadmin.net/home_page/security/PMASA-2014-8.php - http://www.phpmyadmin.net/home_page/security/PMASA-2014-9.php - CVE-2014-5273 - CVE-2014-5274 - - - 2014-08-17 - 2014-08-17 - - - - - serf -- SSL Certificate Null Byte Poisoning - - - serf - 1.3.7 - - - - -

serf Development list reports:

-
-

Serf provides APIs to retrieve information about a certificate. These - APIs return the information as NUL terminated strings (commonly called C - strings). X.509 uses counted length strings which may include a NUL byte. - This means that a library user will interpret any information as ending - upon seeing this NUL byte and will only see a partial value for that field. -

-

Attackers could exploit this vulnerability to create a certificate that a - client will accept for a different hostname than the full certificate is - actually for by embedding a NUL byte in the certificate.

-

This can lead to a man-in-the-middle attack. There are no known instances - of this problem being exploited in the wild and in practice it should be - difficult to actually exploit this vulnerability.

-
- - - - CVE-2014-3504 - - - 2014-08-06 - 2014-08-11 - - - - - subversion -- several vulnerabilities - - - subversion16 - 1.0.01.7.18 - - - subversion17 - 1.0.01.7.18 - - - subversion - 1.0.01.7.18 - 1.8.01.8.10 - - - - -

Subversion Project reports:

-
-

Using the Serf RA layer of Subversion for HTTPS uses the apr_fnmatch API - to handle matching wildcards in certificate Common Names and Subject - Alternate Names. However, apr_fnmatch is not designed for this purpose. - Instead it is designed to behave like common shell globbing. In particular - this means that '*' is not limited to a single label within a hostname - (i.e. it will match '.'). But even further apr_fnmatch supports '?' and - character classes (neither of which are part of the RFCs defining how - certificate validation works).

-

Subversion stores cached credentials by an MD5 hash based on the URL and - the authentication realm of the server the credentials are cached for. - MD5 has been shown to be subject to chosen plaintext hash collisions. - This means it may be possible to generate an authentication realm which - results in the same MD5 hash for a different URL.

-
- - - - CVE-2014-3522 - CVE-2014-3528 - http://subversion.apache.org/security/CVE-2014-3522-advisory.txt - http://subversion.apache.org/security/CVE-2014-3528-advisory.txt - - - 2014-08-06 - 2014-08-11 - - - - - nginx -- inject commands into SSL session vulnerability - - - nginx - 1.6.0,21.6.1,2 - - - nginx-devel - 1.5.61.7.4 - - - - -

The nginx project reports:

-
-

Security: pipelined commands were not discarded after STARTTLS - command in SMTP proxy (CVE-2014-3556); the bug had appeared in 1.5.6.

-
- - - - CVE-2014-3556 - http://mailman.nginx.org/pipermail/nginx-announce/2014/000144.html - - - 2014-08-05 - 2014-08-09 - - - - - OpenSSL -- multiple vulnerabilities - - - openssl - 1.0.11.0.1_14 - - - mingw32-openssl - 1.0.11.0.1i - - - FreeBSD - 8.48.4_15 - 9.19.1_18 - 9.29.2_11 - 9.39.3_1 - 10.010.0_8 - - - - -

The OpenSSL Project reports:

-
-

A flaw in OBJ_obj2txt may cause pretty printing functions - such as X509_name_oneline, X509_name_print_ex et al. to leak - some information from the stack. [CVE-2014-3508]

-

The issue affects OpenSSL clients and allows a malicious - server to crash the client with a null pointer dereference - (read) by specifying an SRP ciphersuite even though it was - not properly negotiated with the client. [CVE-2014-5139]

-

If a multithreaded client connects to a malicious server - using a resumed session and the server sends an ec point - format extension it could write up to 255 bytes to freed - memory. [CVE-2014-3509]

-

An attacker can force an error condition which causes - openssl to crash whilst processing DTLS packets due to - memory being freed twice. This can be exploited through - a Denial of Service attack. [CVE-2014-3505]

-

An attacker can force openssl to consume large amounts - of memory whilst processing DTLS handshake messages. - This can be exploited through a Denial of Service - attack. [CVE-2014-3506]

-

By sending carefully crafted DTLS packets an attacker - could cause openssl to leak memory. This can be exploited - through a Denial of Service attack. [CVE-2014-3507]

-

OpenSSL DTLS clients enabling anonymous (EC)DH - ciphersuites are subject to a denial of service attack. - A malicious server can crash the client with a null pointer - dereference (read) by specifying an anonymous (EC)DH - ciphersuite and sending carefully crafted handshake - messages. [CVE-2014-3510]

-

A flaw in the OpenSSL SSL/TLS server code causes the - server to negotiate TLS 1.0 instead of higher protocol - versions when the ClientHello message is badly - fragmented. This allows a man-in-the-middle attacker - to force a downgrade to TLS 1.0 even if both the server - and the client support a higher protocol version, by - modifying the client's TLS records. [CVE-2014-3511]

-

A malicious client or server can send invalid SRP - parameters and overrun an internal buffer. Only - applications which are explicitly set up for SRP - use are affected. [CVE-2014-3512]

-
- - - - https://www.openssl.org/news/secadv_20140806.txt - SA-14:18.openssl - CVE-2014-3505 - CVE-2014-3506 - CVE-2014-3507 - CVE-2014-3508 - CVE-2014-3509 - CVE-2014-3510 - CVE-2014-3511 - CVE-2014-3512 - CVE-2014-5139 - - - 2014-08-06 - 2014-08-06 - 2016-08-09 - - - - - krfb -- Possible Denial of Service or code execution via integer overflow - - - krfb - 4.12.5_1 - - - - -

Albert Aastals Cid reports:

-
-

krfb embeds libvncserver which embeds liblzo2, it contains various - flaws that result in integer overflow problems.

-

This potentially allows a malicious application to create a - possible denial of service or code execution. Due to the need to - exploit precise details of the target architecture and threading it - is unlikely that remote code execution can be achieved in - practice.

-
- - - - CVE-2014-4607 - http://lists.kde.org/?l=kde-announce&m=140709940701878&w=2 - - - 2014-08-03 - 2014-08-03 - - - - - samba -- remote code execution - - - samba4 - 4.0.04.0.21 - - - samba41 - 4.1.04.1.11 - - - - -

Samba developers report:

-
-

A malicious browser can send packets that may overwrite the heap of - the target nmbd NetBIOS name services daemon. It may be possible to - use this to generate a remote code execution vulnerability as the - superuser (root).

-
- - - - CVE-2014-3560 - http://www.samba.org/samba/security/CVE-2014-3560 - - - 2014-07-31 - 2014-08-02 - - - - - gpgme -- heap-based buffer overflow in gpgsm status handler - - - gpgme - 1.5.0 - - - - -

Tomas Trnka reports:

-
-

Gpgme contains a buffer overflow in the gpgsm status handler - that could possibly be exploited using a specially crafted certificate.

-
- - - - CVE-2014-3564 - https://bugzilla.redhat.com/show_bug.cgi?id=1113267 - - - 2014-06-25 - 2014-08-02 - - - - - kdelibs -- KAuth PID Reuse Flaw - - - kdelibs - 4.12.5_3 - - - - -

Martin Sandsmark reports:

-
-

The KAuth framework uses polkit-1 API which tries to authenticate - using the requestors PID. This is prone to PID reuse race - conditions.

-

This potentially allows a malicious application to pose as another - for authentication purposes when executing privileged actions.

-
- - - - CVE-2014-5033 - http://lists.kde.org/?l=kde-announce&m=140674898412923&w=2 - - - 2014-07-30 - 2014-07-31 - - - - - tor -- traffic confirmation attack - - - tor - 0.2.4.23 - - - tor-devel - 0.2.5.6.a - - - - -

The Tor Project reports:

-
-

Tor before 0.2.4.23 and 0.2.5 before 0.2.5.6-alpha maintains a - circuit after an inbound RELAY_EARLY cell is received by a client, - which makes it easier for remote attackers to conduct - traffic-confirmation attacks by using the pattern of RELAY and - RELAY_EARLY cells as a means of communicating information about - hidden service names.

-
- - - - https://lists.torproject.org/pipermail/tor-announce/2014-July/000094.html - https://blog.torproject.org/blog/tor-security-advisory-relay-early-traffic-confirmation-attack - CVE-2014-5117 - - - 2014-07-30 - 2014-07-30 - - - - - i2p -- Multiple Vulnerabilities - - - i2p - 0.9.14 - - - - -

The i2p project reports:

-
-

XSS and remote execution vulnerabilities reported by Exodus Intelligence.

-
-

Exodus Intelligence reports:

-
-

The vulnerability we have found is able to perform remote code - execution with a specially crafted payload. This payload can be - customized to unmask a user and show the public IP address in - which the user connected from within 'a couple of seconds.'

-
- - - - http://blog.exodusintel.com/2014/07/23/silverbullets_and_fairytails/ - http://geti2p.net/en/blog/post/2014/07/26/0.9.14-Release - - - 2014-07-24 - 2014-07-28 - - - - - bugzilla -- Cross Site Request Forgery - - - bugzilla44 - 4.4.5 - - - - -

A Bugzilla Security Advisory reports:

-
-

Adobe does not properly restrict the SWF file format, - which allows remote attackers to conduct cross-site - request forgery (CSRF) attacks against Bugzilla's JSONP - endpoint, possibly obtaining sensitive bug information, - via a crafted OBJECT element with SWF content satisfying - the character-set requirements of a callback API.

-
- - - - CVE-2014-1546 - - - 2014-07-24 - 2014-07-25 - - - - - apache22 -- several vulnerabilities - - - apache22 - 2.2.02.2.29 - - - apache22-event-mpm - 2.2.02.2.29 - - - apache22-itk-mpm - 2.2.02.2.29 - - - apache22-peruser-mpm - 2.2.02.2.29 - - - apache22-worker-mpm - 2.2.02.2.29 - - - - -

Apache HTTP SERVER PROJECT reports:

-
-

mod_deflate: The DEFLATE input filter (inflates request bodies) now - limits the length and compression ratio of inflated request bodies to - avoid denial of service via highly compressed bodies. See directives - DeflateInflateLimitRequestBody, DeflateInflateRatioLimit, and - DeflateInflateRatioBurst.

-

mod_cgid: Fix a denial of service against CGI scripts that do not consume - stdin that could lead to lingering HTTPD child processes filling up the - scoreboard and eventually hanging the server. By default, the client I/O - timeout (Timeout directive) now applies to communication with scripts. The - CGIDScriptTimeout directive can be used to set a different timeout for - communication with scripts.

-

Fix a race condition in scoreboard handling, which could lead to a heap - buffer overflow.

-

core: HTTP trailers could be used to replace HTTP headers late during - request processing, potentially undoing or otherwise confusing modules - that examined or modified request headers earlier. Adds "MergeTrailers" - directive to restore legacy behavior.

-
- - - - CVE-2014-0118 - CVE-2014-0231 - CVE-2014-0226 - CVE-2013-5704 - - - 2014-07-19 - 2014-07-24 - 2014-09-03 - - - - - tomcat -- multiple vulnerabilities - - - tomcat - 6.0.40 - - - tomcat7 - 7.0.53 - - - tomcat8 - 8.0.4 - - - - -

Tomcat Security Team reports:

-
-

Tomcat does not properly restrict XSLT stylesheets, which allows - remote attackers to bypass security-manager restrictions and read - arbitrary files via a crafted web application that provides an XML - external entity declaration in conjunction with an entity - reference, related to an XML External Entity (XXE) issue.

-

An integer overflow, when operated behind a reverse proxy, allows - remote attackers to conduct HTTP request smuggling attacks via a - crafted Content-Length HTTP header.

-

An integer overflow in parseChunkHeader allows remote attackers - to cause a denial of service (resource consumption) via a malformed - chunk size in chunked transfer coding of a request during the - streaming of data.

-
- - - - CVE-2014-0096 - CVE-2014-0099 - CVE-2014-0075 - https://tomcat.apache.org/security-6.html - https://tomcat.apache.org/security-7.html - https://tomcat.apache.org/security-8.html - - - 2014-05-23 - 2014-07-23 - 2017-03-18 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 31.0,1 - - - firefox-esr - 24.7.0,1 - - - linux-firefox - 31.0,1 - - - linux-thunderbird - 24.7.0 - - - thunderbird - 24.7.0 - - - nss - 3.16.1_2 - - - - - -

The Mozilla Project reports:

-
-

MFSA 2014-66 IFRAME sandbox same-origin access through - redirect

-

MFSA 2014-65 Certificate parsing broken by non-standard - character encoding

-

MFSA 2014-64 Crash in Skia library when scaling high - quality images

-

MFSA 2014-63 Use-after-free while when manipulating - certificates in the trusted cache

-

MFSA 2014-62 Exploitable WebGL crash with Cesium - JavaScript library

-

MFSA 2014-61 Use-after-free with FireOnStateChange - event

-

MFSA 2014-60 Toolbar dialog customization event - spoofing

-

MFSA 2014-59 Use-after-free in DirectWrite font - handling

-

MFSA 2014-58 Use-after-free in Web Audio due to - incorrect control message ordering

-

MFSA 2014-57 Buffer overflow during Web Audio - buffering for playback

-

MFSA 2014-56 Miscellaneous memory safety hazards - (rv:31.0 / rv:24.7)

-
- - - - CVE-2014-1544 - CVE-2014-1547 - CVE-2014-1548 - CVE-2014-1549 - CVE-2014-1550 - CVE-2014-1551 - CVE-2014-1552 - CVE-2014-1555 - CVE-2014-1556 - CVE-2014-1557 - CVE-2014-1558 - CVE-2014-1559 - CVE-2014-1560 - CVE-2014-1561 - https://www.mozilla.org/security/announce/2014/mfsa2014-56.html - https://www.mozilla.org/security/announce/2014/mfsa2014-57.html - https://www.mozilla.org/security/announce/2014/mfsa2014-58.html - https://www.mozilla.org/security/announce/2014/mfsa2014-59.html - https://www.mozilla.org/security/announce/2014/mfsa2014-60.html - https://www.mozilla.org/security/announce/2014/mfsa2014-61.html - https://www.mozilla.org/security/announce/2014/mfsa2014-62.html - https://www.mozilla.org/security/announce/2014/mfsa2014-63.html - https://www.mozilla.org/security/announce/2014/mfsa2014-64.html - https://www.mozilla.org/security/announce/2014/mfsa2014-65.html - https://www.mozilla.org/security/announce/2014/mfsa2014-66.html - https://www.mozilla.org/security/announce/ - - - 2014-07-22 - 2014-07-23 - - - - - mcollective -- cert valication issue - - - mcollective - 2.5.3 - - - - -

Melissa Stone reports:

-
-

The MCollective aes_security public key plugin does not correctly - validate certs against the CA. By exploiting this vulnerability - within a race/initialization window, an attacker with local access - could initiate an unauthorized MCollective client connection with a - server, and thus control the mcollective plugins running on that - server. This vulnerability requires a collective be configured to - use the aes_security plugin. Puppet Enterprise and open source - MCollective are not configured to use the plugin and are not - vulnerable by default.

-
- - - - CVE-2014-3251 - https://groups.google.com/forum/#!topic/puppet-announce/cPykqUXMmK4 - - - 2014-07-09 - 2014-07-21 - - - - - qt4-imageformats, qt5-gui -- DoS vulnerability in the GIF image handler - - - qt4-imageformats - 4.8.6_1 - - - qt5-gui - 5.2.1_4 - - - - -

Richard J. Moore reports:

-
-

The builtin GIF decoder in QtGui prior to Qt 5.3 contained a bug - that would lead to a null pointer dereference when loading certain - hand crafted corrupt GIF files. This in turn would cause the - application loading these hand crafted GIFs to crash.

-
- - - - CVE-2014-0190 - 67087 - http://lists.qt-project.org/pipermail/announce/2014-April/000045.html - - - 2014-04-24 - 2014-07-19 - 2014-07-21 - - - - - apache24 -- several vulnerabilities - - - apache24 - 2.4.10 - - - - -

Apache HTTP SERVER PROJECT reports:

-
-

mod_proxy: Fix crash in Connection header handling which allowed a - denial of service attack against a reverse proxy with a threaded MPM.

-

Fix a race condition in scoreboard handling, which could lead to a - heap buffer overflow.

-

mod_deflate: The DEFLATE input filter (inflates request bodies) now - limits the length and compression ratio of inflated request bodies to avoid - denial of sevice via highly compressed bodies. See directives - DeflateInflateLimitRequestBody, DeflateInflateRatioLimit, - and DeflateInflateRatioBurst.

-

mod_cgid: Fix a denial of service against CGI scripts that do - not consume stdin that could lead to lingering HTTPD child processes - filling up the scoreboard and eventually hanging the server. By - default, the client I/O timeout (Timeout directive) now applies to - communication with scripts. The CGIDScriptTimeout directive can be - used to set a different timeout for communication with scripts.

-
- - - - CVE-2014-0117 - CVE-2014-3523 - CVE-2014-0226 - CVE-2014-0118 - CVE-2014-0231 - - - 2014-07-15 - 2014-07-19 - - - - - phpMyAdmin -- multiple XSS vulnerabilities, missing validation - - - phpMyAdmin - 4.2.04.2.6 - - - - -

The phpMyAdmin development team reports:

-
-

Self-XSS due to unescaped HTML output in database - structure page.

-

With a crafted table comment, it is possible to trigger - an XSS in database structure page.

-
-
-

Self-XSS due to unescaped HTML output in database - triggers page.

-

When navigating into the database triggers page, it is - possible to trigger an XSS with a crafted trigger - name.

-
-
-

Multiple XSS in AJAX confirmation messages.

-

With a crafted column name it is possible to trigger an - XSS when dropping the column in table structure page. With - a crafted table name it is possible to trigger an XSS when - dropping or truncating the table in table operations - page.

-
-
-

Access for an unprivileged user to MySQL user list.

-

An unpriviledged user could view the MySQL user list and - manipulate the tabs displayed in phpMyAdmin for them.

-
- - - - CVE-2014-4954 - CVE-2014-4955 - CVE-2014-4986 - CVE-2014-4987 - http://www.phpmyadmin.net/home_page/security/PMASA-2014-4.php - http://www.phpmyadmin.net/home_page/security/PMASA-2014-5.php - http://www.phpmyadmin.net/home_page/security/PMASA-2014-6.php - http://www.phpmyadmin.net/home_page/security/PMASA-2014-7.php - - - 2014-07-18 - 2014-07-18 - 2014-07-20 - - - - - kdelibs4 -- KMail/KIO POP3 SSL Man-in-the-middle Flaw - - - kdelibs - 4.10.954.12.5_2 - - - - -

Richard J. Moore reports:

-
-

The POP3 kioslave used by KMail will accept invalid - certificates without presenting a dialog to the user due a - bug that leads to an inability to display the dialog - combined with an error in the way the result is checked.

-

This flaw allows an active attacker to perform MITM - attacks against the ioslave which could result in the leakage of - sensitive data such as the authentication details and the contents of - emails.

-
- - - - CVE-2014-3494 - 68113 - http://lists.kde.org/?l=kde-announce&m=140312275318160&w=2 - - - 2014-06-17 - 2014-07-16 - - - - - postfixadmin -- SQL injection vulnerability - - - postfixadmin - 2.3.7 - - - - -

Thijs Kinkhorst reports:

-
-

Postfixadmin has an SQL injection vulnerability. This - vulnerability is only exploitable by authenticated users able to - create new aliases.

-
- - - - CVE-2014-2655 - 66455 - ports/189248 - http://www.openwall.com/lists/oss-security/2014/03/26/6 - https://www.debian.org/security/2014/dsa-2889 - - - 2014-03-28 - 2014-07-13 - 2015-09-28 - - - - - dbus -- multiple vulnerabilities - - - dbus - 1.8.6 - - - - -

Simon McVittie reports:

-
-

Alban Crequy at Collabora Ltd. discovered a bug in dbus-daemon's - support for file descriptor passing. A malicious process could - force system services or user applications to be disconnected - from the D-Bus system bus by sending them a message containing - a file descriptor, then causing that file descriptor to exceed - the kernel's maximum recursion depth (itself introduced to fix - a DoS) before dbus-daemon forwards the message to the victim - process. Most services and applications exit when disconnected - from the system bus, leading to a denial of service.

-

Additionally, Alban discovered that bug fd.o#79694, a bug - previously reported by Alejandro Martínez Suárez which was n - believed to be security flaw, could be used for a similar denial - of service, by causing dbus-daemon to attempt to forward invalid - file descriptors to a victim process when file descriptors become - associated with the wrong message.

-
- - - - CVE-2014-3532 - CVE-2014-3533 - http://lists.freedesktop.org/archives/dbus/2014-July/016235.html - - - 2014-07-02 - 2014-07-03 - - - - - mencoder -- potential buffer overrun when processing malicious lzo compressed input - - - mencoder - 1.1.r20140418_1 - - - - -

Michael Niedermayer and Luca Barbato report in upstream ffmpeg:

-
-

avutil/lzo: Fix integer overflow

-
- - - - http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=ccda51b14c0fcae2fad73a24872dce75a7964996 - http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=d6af26c55c1ea30f85a7d9edbc373f53be1743ee - CVE-2014-4610 - - - 2014-06-24 - 2014-06-28 - - - - - mplayer -- potential buffer overrun when processing malicious lzo compressed input - - - mplayer - 1.1.r20140418_3 - - - - -

Michael Niedermayer and Luca Barbato report in upstream ffmpeg:

-
-

avutil/lzo: Fix integer overflow

-
- - - - http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=ccda51b14c0fcae2fad73a24872dce75a7964996 - http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=d6af26c55c1ea30f85a7d9edbc373f53be1743ee - CVE-2014-4610 - - - 2014-06-24 - 2014-06-28 - - - - - LZO -- potential buffer overrun when processing malicious input data - - - lzo2 - 2.07 - - - busybox - 1.22.1_2 - - - - -

Markus Franz Xaver Johannes Oberhumer reports, in the package's NEWS file:

-
-

Fixed a potential integer overflow condition in the "safe" - decompressor variants which could result in a possible buffer - overrun when processing maliciously crafted compressed input - data.

- -

As this issue only affects 32-bit systems and also can only happen - if you use uncommonly huge buffer sizes where you have to decompress - more than 16 MiB (2^24 bytes) compressed bytes within a single - function call, the practical implications are limited.

-
- - - - http://www.oberhumer.com/opensource/lzo/download/lzo-2.07.tar.gz - CVE-2014-4608 - - - 2014-06-25 - 2014-06-26 - 2015-01-06 - - - - - gnupg -- possible DoS using garbled compressed data packets - - - gnupg1 - 1.4.17 - - - gnupg - 2.0.24 - - - - -

Werner Koch reports:

-
-

This release includes a *security fix* to stop - a possible DoS using garbled compressed data packets which can be used - to put gpg into an infinite loop.

-
- - - - http://lists.gnupg.org/pipermail/gnupg-announce/2014q2/000344.html - http://lists.gnupg.org/pipermail/gnupg-announce/2014q2/000345.html - - - 2014-06-23 - 2014-06-23 - - - - - samba -- multiple vulnerabilities - - - samba36 - 3.6.24 - - - samba4 - 4.0.19 - - - samba41 - 4.1.9 - - - - -

The samba project reports:

-
-

A malformed packet can cause the nmbd server to loop the CPU and - prevent any further NetBIOS name service.

-

Valid unicode path names stored on disk can cause smbd to - crash if an authenticated client attempts to read them - using a non-unicode request.

-
- - - - CVE-2014-0244 - CVE-2014-3493 - https://www.samba.org/samba/security/CVE-2014-0244 - https://www.samba.org/samba/security/CVE-2014-3493 - - - 2014-06-23 - 2014-06-23 - - - - - phpMyAdmin -- two XSS vulnerabilities due to unescaped db/table names - - - phpMyAdmin - 4.1.04.2.4 - - - - -

The phpMyAdmin development team reports:

-
-

Self-XSS due to unescaped HTML output in recent/favorite - tables navigation.

- -

When marking a crafted database or table name as - favorite or having it in recent tables, it is possible to - trigger an XSS.

- - -

This vulnerability can be triggered only by someone who - logged in to phpMyAdmin, as the usual token protection - prevents non-logged-in users from accessing the required - form.

- -
-
-

Self-XSS due to unescaped HTML output in navigation items - hiding feature.

- -

When hiding or unhiding a crafted table name in the - navigation, it is possible to trigger an XSS.

- -

This vulnerability can be triggered only by someone who - logged in to phpMyAdmin, as the usual token protection - prevents non-logged-in users from accessing the required - form.

-
- - - - CVE-2014-4348 - CVE-2014-4349 - http://www.phpmyadmin.net/home_page/security/PMASA-2014-2.php - http://www.phpmyadmin.net/home_page/security/PMASA-2014-3.php - - - 2014-06-20 - 2014-06-20 - 2014-06-24 - - - - - iodined -- authentication bypass - - - iodine - 0.7.0 - - - - -

Erik Ekman of the iodine project reports:

-
-

The client could bypass the password check by continuing after - getting error from the server and guessing the network parameters. - The server would still accept the rest of the setup and also network - traffic.

-
- - - - https://github.com/yarrick/iodine/commit/b715be5cf3978fbe589b03b09c9398d0d791f850 - - - 2014-06-16 - 2014-06-18 - - - - - asterisk -- multiple vulnerabilities - - - asterisk11 - 11.10.1 - - - asterisk18 - 1.8.28.1 - - - - -

The Asterisk project reports:

-
-

Asterisk Manager User Unauthorized Shell Access. Manager users can - execute arbitrary shell commands with the MixMonitor manager action. - Asterisk does not require system class authorization for a manager - user to use the MixMonitor action, so any manager user who is - permitted to use manager commands can potentially execute shell - commands as the user executing the Asterisk process.

-

Exhaustion of Allowed Concurrent HTTP Connections. Establishing a - TCP or TLS connection to the configured HTTP or HTTPS port - respectively in http.conf and then not sending or completing a HTTP - request will tie up a HTTP session. By doing this repeatedly until the - maximum number of open HTTP sessions is reached, legitimate requests - are blocked.

-
- - - - CVE-2014-4046 - CVE-2014-4047 - http://downloads.asterisk.org/pub/security/AST-2014-006.pdf - http://downloads.asterisk.org/pub/security/AST-2014-007.pdf - https://www.asterisk.org/security - - - 2014-06-12 - 2014-06-17 - - - - - dbus -- local DoS - - - dbus - 1.8.01.8.4 - 1.6.20 - - - - -

Simon MvVittie reports:

-
-

Alban Crequy at Collabora Ltd. discovered and fixed a - denial-of-service flaw in dbus-daemon, part of the reference - implementation of D-Bus. Additionally, in highly unusual - environments the same flaw could lead to a side channel between - processes that should not be able to communicate.

-
- - - - CVE-2014-3477 - http://lists.freedesktop.org/archives/dbus/2014-June/016220.html - - - 2014-06-10 - 2014-06-14 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 30.0,1 - - - firefox-esr - 24.6.0,1 - - - seamonkey - 2.26.1 - - - linux-firefox - 30.0,1 - - - linux-seamonkey - 2.26.1 - - - linux-thunderbird - 24.6.0 - - - nspr - 4.10.6 - - - thunderbird - 24.6.0 - - - - -

The Mozilla Project reports:

-
-

MFSA 2014-48 Miscellaneous memory safety hazards - (rv:30.0 / rv:24.6)

-

MFSA 2014-49 Use-after-free and out of bounds - issues found using Address Sanitizer

-

MFSA 2014-51 Use-after-free in Event Listener - Manager

-

MFSA 2014-52 Use-after-free with SMIL Animation - Controller

-

MFSA 2014-53 Buffer overflow in Web Audio Speex - resampler

-

MFSA 2014-54 Buffer overflow in Gamepad API

-

MFSA 2014-55 Out of bounds write in NSPR

-
- - - - CVE-2014-1533 - CVE-2014-1534 - CVE-2014-1536 - CVE-2014-1537 - CVE-2014-1540 - CVE-2014-1541 - CVE-2014-1542 - CVE-2014-1543 - CVE-2014-1545 - https://www.mozilla.org/security/announce/2014/mfsa2014-48.html - https://www.mozilla.org/security/announce/2014/mfsa2014-49.html - https://www.mozilla.org/security/announce/2014/mfsa2014-51.html - https://www.mozilla.org/security/announce/2014/mfsa2014-52.html - https://www.mozilla.org/security/announce/2014/mfsa2014-53.html - https://www.mozilla.org/security/announce/2014/mfsa2014-54.html - https://www.mozilla.org/security/announce/2014/mfsa2014-55.html - - - 2014-06-10 - 2014-06-10 - - - - - OpenSSL -- multiple vulnerabilities - - - openssl - 1.0.11.0.1_13 - - - mingw32-openssl - 1.0.11.0.1h - - - FreeBSD - 8.08.4_12 - 9.19.1_15 - 9.29.2_8 - 10.010.0_5 - - - - -

The OpenSSL Project reports:

-
-

An attacker using a carefully crafted handshake can force - the use of weak keying material in OpenSSL SSL/TLS clients - and servers. This can be exploited by a Man-in-the-middle - (MITM) attack where the attacker can decrypt and modify - traffic from the attacked client and server. [CVE-2014-0224]

-

By sending an invalid DTLS handshake to an OpenSSL DTLS - client the code can be made to recurse eventually crashing - in a DoS attack. [CVE-2014-0221]

-

A buffer overrun attack can be triggered by sending invalid - DTLS fragments to an OpenSSL DTLS client or server. This is - potentially exploitable to run arbitrary code on a vulnerable - client or server. [CVE-2014-0195]

-

OpenSSL TLS clients enabling anonymous ECDH ciphersuites are - subject to a denial of service attack. [CVE-2014-3470]

-
- - - - CVE-2014-0195 - CVE-2014-0221 - CVE-2014-0224 - CVE-2014-3470 - SA-14:14.openssl - http://www.openssl.org/news/secadv_20140605.txt - - - 2014-06-05 - 2014-06-05 - - - - - gnutls -- client-side memory corruption - - - gnutls - 2.12.23_6 - - - - -

GnuTLS project reports:

-
-

This vulnerability affects the client side of the gnutls library. - A server that sends a specially crafted ServerHello could corrupt - the memory of a requesting client.

-
- - - - CVE-2014-3466 - http://www.gnutls.org/security.html#GNUTLS-SA-2014-3 - - - 2014-05-14 - 2014-06-04 - - - - - gnutls -- client-side memory corruption - - - gnutls3 - 3.13.1.25 - - - - -

GnuTLS project reports:

-
-

This vulnerability affects the client side of the gnutls library. - A server that sends a specially crafted ServerHello could corrupt - the memory of a requesting client.

-
- - - - CVE-2014-3466 - http://www.gnutls.org/security.html#GNUTLS-SA-2014-3 - - - 2014-05-14 - 2014-06-03 - - - - - mumble -- multiple vulnerabilities - - - mumble - 1.2.01.2.6 - - - - -

Mumble reports:

-
-

SVG images with local file references could trigger client DoS

-

The Mumble client did not properly HTML-escape some external strings - before using them in a rich-text (HTML) context.

-
- - - - http://mumble.info/security/Mumble-SA-2014-005.txt - http://mumble.info/security/Mumble-SA-2014-006.txt - - - 2014-04-16 - 2014-05-29 - - - - - mumble -- NULL pointer dereference and heap-based buffer overflow - - - mumble - 1.2.41.2.4_6 - - - - -

Mumble reports:

-
-

A malformed Opus voice packet sent to a Mumble client could trigger - a NULL pointer dereference or an out-of-bounds array access.

-

A malformed Opus voice packet sent to a Mumble client could trigger a - heap-based buffer overflow.

-
- - - - CVE-2014-0044 - CVE-2014-0045 - http://mumble.info/security/Mumble-SA-2014-001.txt - http://mumble.info/security/Mumble-SA-2014-002.txt - - - 2014-01-25 - 2014-05-29 - - - - - - - - - linux-flashplugin -- multiple vulnerabilities - - - linux-f10-flashplugin - 11.2r202.359 - - - - -

Adobe reports:

-
-

These updates address vulnerabilities that could cause a crash - and potentially allow an attacker to take control of the affected system.

-
- - - - CVE-2014-0510 - CVE-2014-0516 - CVE-2014-0517 - CVE-2014-0518 - CVE-2014-0519 - CVE-2014-0520 - https://helpx.adobe.com/security/products/flash-player/apsb14-14.html - - - 2014-03-13 - 2014-05-26 - - - - - openjpeg -- Multiple vulnerabilities - - - openjpeg - 1.5.2 - - - - -

Openjpeg release notes report:

-
-

That CVE-2012-3535 and CVE-2012-3358 are fixed in the 1.5.1 - release.

-
-
-

That CVE-2013-4289, CVE-2013-4290, CVE-2013-1447, CVE-2013-6045, - CVE-2013-6052, CVE-2013-6054, CVE-2013-6053, CVE-2013-6887, - where fixed in the 1.5.2 release.

-
- - - - CVE-2012-3358 - CVE-2012-3535 - CVE-2013-1447 - CVE-2013-4289 - CVE-2013-4290 - CVE-2013-6045 - CVE-2013-6052 - CVE-2013-6053 - CVE-2013-6054 - CVE-2013-6887 - http://openjpeg.googlecode.com/svn/tags/version.1.5.1/NEWS - http://openjpeg.googlecode.com/svn/tags/version.1.5.2/NEWS - - - 2012-05-13 - 2014-05-24 - - - - - libXfont -- X Font Service Protocol and Font metadata file handling issues - - - libXfont - 1.4.7_3 - - - linux-c6-xorg-libs - 7.4_2 - - - linux-f10-xorg-libs - * - - - - -

Alan Coopersmith reports:

-
-

Ilja van Sprundel, a security researcher with IOActive, has - discovered several issues in the way the libXfont library - handles the responses it receives from xfs servers, and has - worked with X.Org's security team to analyze, confirm, and fix - these issues.

-

Most of these issues stem from libXfont trusting the font server - to send valid protocol data, and not verifying that the values - will not overflow or cause other damage. This code is commonly - called from the X server when an X Font Server is active in the - font path, so may be running in a setuid-root process depending - on the X server in use. Exploits of this path could be used by - a local, authenticated user to attempt to raise privileges; or - by a remote attacker who can control the font server to attempt - to execute code with the privileges of the X server.

-
- - - - CVE-2014-0209 - CVE-2014-0210 - CVE-2014-0211 - http://lists.x.org/archives/xorg-announce/2014-May/002431.html - - - 2014-05-13 - 2014-05-13 - 2015-07-15 - - - - - libxml2 -- lack of end-of-document check DoS - - - libxml2 - 2.9.1 - - - linux-c6-libxml2 - 2.7.6_2 - - - linux-f10-libxml2 - * - - - - -

CVE MITRE reports:

-
-

parser.c in libxml2 before 2.9.0, as used in Google - Chrome before 28.0.1500.71 and other products, allows remote - attackers to cause a denial of service (out-of-bounds read) - via a document that ends abruptly, related to the lack of - certain checks for the XML_PARSER_EOF state.

-
- - - - CVE-2013-2877 - https://git.gnome.org/browse/libxml2/tag/?id=CVE-2013-2877 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2877 - https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-2877 - - - 2013-04-11 - 2013-07-10 - 2015-07-15 - - - - - libxml2 -- entity substitution DoS - - - libxml2 - 2.9.1 - - - linux-c6-libxml2 - 2.7.6_2 - - - linux-f10-libxml2 - * - - - - -

Stefan Cornelius reports:

-
-

It was discovered that libxml2, a library providing - support to read, modify and write XML files, incorrectly - performs entity substitution in the doctype prolog, even if - the application using libxml2 disabled any entity - substitution. A remote attacker could provide a - specially-crafted XML file that, when processed, would lead - to the exhaustion of CPU and memory resources or file - descriptors.

-

This issue was discovered by Daniel Berrange of Red Hat.

-
- - - - CVE-2014-0191 - http://www.openwall.com/lists/oss-security/2014/05/06/4 - https://git.gnome.org/browse/libxml2/tag/?id=CVE-2014-0191 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0191 - - - 2013-12-03 - 2014-05-06 - 2015-07-15 - - - - - OpenSSL -- NULL pointer dereference / DoS - - - openssl - 1.0.11.0.1_12 - - - FreeBSD - 10.010.0_3 - - - - -

OpenBSD and David Ramos reports:

-
-

Applications that use SSL_MODE_RELEASE_BUFFERS, such as nginx/apache, - are prone to a race condition which may allow a remote attacker to - crash the current service.

-
- - - - http://www.openwall.com/lists/oss-security/2014/05/02/5 - https://rt.openssl.org/Ticket/Display.html?user=guest&pass=guest&id=3321 - SA-14:10.openssl - CVE-2014-0198 - - - 2014-05-02 - 2014-05-03 - 2016-08-09 - - - - - qt4-xml -- XML Entity Expansion Denial of Service - - - qt4-xml - 4.8.6 - - - - -

Richard J. Moore reports:

-
-

QXmlSimpleReader in Qt versions prior to 5.2 supports - expansion of internal entities in XML documents without - placing restrictions to ensure the document does not cause - excessive memory usage. If an application using this API - processes untrusted data then the application may use - unexpected amounts of memory if a malicious document is - processed.

-

It is possible to construct XML documents using internal - entities that consume large amounts of memory and other - resources to process, this is known as the 'Billion Laughs' - attack. Qt versions prior to 5.2 did not offer protection - against this issue.

-
- - - - CVE-2013-4549 - http://lists.qt-project.org/pipermail/announce/2013-December/000036.html - - - 2013-12-05 - 2014-05-05 - - - - - strongswan -- Remote Authentication Bypass - - - strongswan - 5.1.3 - - - - -

strongSwan developers report:

-
-

Remote attackers are able to bypass authentication by rekeying an - IKE_SA during (1) initiation or (2) re-authentication, which - triggers the IKE_SA state to be set to established.

-

Only installations that actively initiate or re-authenticate IKEv2 - IKE_SAs are affected.

-
- - - - CVE-2014-2338 - http://www.strongswan.org/blog/2014/04/14/strongswan-authentication-bypass-vulnerability-%28cve-2014-2338%29.html - - - 2014-03-12 - 2014-05-04 - - - - - mohawk -- multiple vulnerabilities - - - mohawk - 2.0.12 - - - - -

The mohawk project reports:

-
-

Segfault when parsing malformed / unescaped url, coredump when setting syslog facility.

-
- - - - http://fossil.bsdsx.fr/mohawk/tktview?name=1707f0e351 - http://fossil.bsdsx.fr/mohawk/tktview?name=1c7565019e - - - 2014-04-10 - 2014-04-30 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 29.0,1 - - - firefox-esr - 24.5.0,1 - - - linux-firefox - 29.0,1 - - - linux-seamonkey - 2.26 - - - linux-thunderbird - 24.5.0 - - - seamonkey - 2.26 - - - thunderbird - 24.5.0 - - - - -

The Mozilla Project reports:

-
-

MFSA 2014-34 Miscellaneous memory safety hazards - (rv:29.0 / rv:24.5)

-

MFSA 2014-35 Privilege escalation through Mozilla Maintenance - Service Installer

-

MFSA 2014-36 Web Audio memory corruption issues

-

MFSA 2014-37 Out of bounds read while decoding JPG images

-

MFSA 2014-38 Buffer overflow when using non-XBL object as - XBL

-

MFSA 2014-39 Use-after-free in the Text Track Manager - for HTML video

-

MFSA 2014-41 Out-of-bounds write in Cairo

-

MFSA 2014-42 Privilege escalation through Web Notification - API

-

MFSA 2014-43 Cross-site scripting (XSS) using history - navigations

-

MFSA 2014-44 Use-after-free in imgLoader while resizing - images

-

MFSA 2014-45 Incorrect IDNA domain name matching for - wildcard certificates

-

MFSA 2014-46 Use-after-free in nsHostResolve

-

MFSA 2014-47 Debugger can bypass XrayWrappers - with JavaScript

-
- - - - CVE-2014-1492 - CVE-2014-1518 - CVE-2014-1519 - CVE-2014-1520 - CVE-2014-1522 - CVE-2014-1523 - CVE-2014-1524 - CVE-2014-1525 - CVE-2014-1526 - CVE-2014-1527 - CVE-2014-1528 - CVE-2014-1529 - CVE-2014-1530 - CVE-2014-1531 - CVE-2014-1532 - https://www.mozilla.org/security/announce/2014/mfsa2014-34.html - https://www.mozilla.org/security/announce/2014/mfsa2014-35.html - https://www.mozilla.org/security/announce/2014/mfsa2014-36.html - https://www.mozilla.org/security/announce/2014/mfsa2014-37.html - https://www.mozilla.org/security/announce/2014/mfsa2014-38.html - https://www.mozilla.org/security/announce/2014/mfsa2014-39.html - https://www.mozilla.org/security/announce/2014/mfsa2014-41.html - https://www.mozilla.org/security/announce/2014/mfsa2014-42.html - https://www.mozilla.org/security/announce/2014/mfsa2014-43.html - https://www.mozilla.org/security/announce/2014/mfsa2014-44.html - https://www.mozilla.org/security/announce/2014/mfsa2014-45.html - https://www.mozilla.org/security/announce/2014/mfsa2014-46.html - https://www.mozilla.org/security/announce/2014/mfsa2014-47.html - http://www.mozilla.org/security/known-vulnerabilities/ - - - 2014-04-29 - 2014-04-29 - - - - - django -- multiple vulnerabilities - - - py26-django - 1.61.6.3 - - - py27-django - 1.61.6.3 - - - py31-django - 1.61.6.3 - - - py32-django - 1.61.6.3 - - - py33-django - 1.61.6.3 - - - py34-django - 1.61.6.3 - - - py26-django15 - 1.51.5.6 - - - py27-django15 - 1.51.5.6 - - - py31-django15 - 1.51.5.6 - - - py32-django15 - 1.51.5.6 - - - py33-django15 - 1.51.5.6 - - - py34-django15 - 1.51.5.6 - - - py26-django14 - 1.41.4.11 - - - py27-django14 - 1.41.4.11 - - - py31-django14 - 1.41.4.11 - - - py32-django14 - 1.41.4.11 - - - py33-django14 - 1.41.4.11 - - - py34-django14 - 1.41.4.11 - - - py26-django-devel - 20140423,1 - - - py27-django-devel - 20140423,1 - - - - -

The Django project reports:

-
-

These releases address an unexpected code-execution issue, a - caching issue which can expose CSRF tokens and a MySQL typecasting - issue. While these issues present limited risk and may not affect - all Django users, we encourage all users to evaluate their own - risk and upgrade as soon as possible.

-
- - - - https://www.djangoproject.com/weblog/2014/apr/21/security/ - CVE-2014-0472 - CVE-2014-0473 - CVE-2014-0474 - - - 2014-04-21 - 2014-04-23 - 2014-04-30 - - - - - OpenSSL -- Remote Data Injection / DoS - - - openssl - 1.0.11.0.1_11 - - - mingw32-openssl - 1.0.11.0.1g - - - FreeBSD - 10.010.0_2 - - - - -

Applications that use SSL_MODE_RELEASE_BUFFERS, such as nginx, are - prone to a race condition which may allow a remote attacker to - inject random data into other connections.

- - - - https://rt.openssl.org/Ticket/Display.html?id=2167 - http://www.tedunangst.com/flak/post/analysis-of-openssl-freelist-reuse - SA-14:09.openssl - CVE-2010-5298 - - - 2010-02-09 - 2014-04-23 - 2016-08-09 - - - - - bugzilla -- Cross-Site Request Forgery - - - bugzilla40 - 2.0.04.4.3 - - - bugzilla42 - 2.0.04.4.3 - - - bugzilla44 - 2.0.04.4.3 - - - - -

A Bugzilla Security Advisory reports:

-
-

The login form had no CSRF protection, meaning that - an attacker could force the victim to log in using the - attacker's credentials. If the victim then reports a new - security sensitive bug, the attacker would get immediate - access to this bug.

-

- Due to changes involved in the Bugzilla API, this fix is - not backported to the 4.0 and 4.2 branches, meaning that - Bugzilla 4.0.12 and older, and 4.2.8 and older, will - remain vulnerable to this issue.

-
- - - - CVE-2014-1517 - https://bugzilla.mozilla.org/show_bug.cgi?id=713926 - - - 2014-04-17 - 2014-04-18 - 2014-04-18 - - - - - bugzilla -- Social Engineering - - - bugzilla40 - 2.0.04.0.12 - - - bugzilla42 - 4.1.14.2.8 - - - bugzilla44 - 4.4.04.4.3 - - - - -

A Bugzilla Security Advisory reports:

-
-

Dangerous control characters can be inserted into - Bugzilla, notably into bug comments. If the text, which - may look safe, is copied into a terminal such as xterm or - gnome-terminal, then unexpected commands could be executed - on the local machine.

-
- - - - https://bugzilla.mozilla.org/show_bug.cgi?id=968576 - - - 2014-04-17 - 2014-04-18 - 2014-04-18 - - - - - OpenLDAP -- incorrect handling of NULL in certificate Common Name - - - openldap24-client - 2.4.18 - - - linux-f10-openldap - 2.4.18 - - - - -

Jan Lieskovsky reports:

-
-

OpenLDAP does not properly handle a '\0' character in a domain name - in the subject's Common Name (CN) field of an X.509 certificate, - which allows man-in-the-middle attackers to spoof arbitrary SSL - servers via a crafted certificate issued by a legitimate - Certification Authority

-
- - - - CVE-2009-3767 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-3767 - - - 2009-08-07 - 2014-04-11 - - - - - cURL -- inappropriate GSSAPI delegation - - - curl - 7.10.67.21.6 - - - linux-f10-curl - 7.10.67.21.6 - - - - -

cURL reports:

-
-

When doing GSSAPI authentication, libcurl unconditionally performs - credential delegation. This hands the server a copy of the client's - security credentials, allowing the server to impersonate the client - to any other using the same GSSAPI mechanism.

-
- - - - CVE-2011-2192 - http://curl.haxx.se/docs/adv_20110623.html - - - 2011-06-23 - 2014-04-11 - 2014-04-30 - - - - - dbus-glib -- privledge escalation - - - dbus-glib - 0.100.1 - - - linux-f10-dbus-glib - 0.100.1 - - - - -

Sebastian Krahmer reports:

-
-

A privilege escalation flaw was found in the way dbus-glib, the - D-Bus add-on library to integrate the standard D-Bus library with - the GLib thread abstraction and main loop, performed filtering of - the message sender (message source subject), when the - NameOwnerChanged signal was received. A local attacker could use - this flaw to escalate their privileges.

-
- - - - CVE-2013-0292 - https://bugs.freedesktop.org/show_bug.cgi?id=60916 - - - 2013-02-15 - 2014-04-11 - 2014-04-30 - - - - - nas -- multiple vulnerabilities - - - nas - 1.9.4 - - - linux-f10-nas-libs - 1.9.4 - - - - -

Hamid Zamani reports:

-
-

multiple security problems (buffer overflows, format string - vulnerabilities and missing input sanitising), which could lead to - the execution of arbitrary code.

-
- - - - CVE-2013-4256 - CVE-2013-4257 - CVE-2013-4258 - http://radscan.com/pipermail/nas/2013-August/001270.html - - - 2013-08-07 - 2014-04-11 - - - - - libaudiofile -- heap-based overflow in Microsoft ADPCM compression module - - - libaudiofile - 0.2.7 - - - linux-f10-libaudiofile - 0.2.7 - - - - -

Debian reports:

-
-

Heap-based buffer overflow in msadpcm.c in libaudiofile in audiofile - 0.2.6 allows context-dependent attackers to cause a denial of service - (application crash) or possibly execute arbitrary code via a crafted - WAV file.

-
- - - - CVE-2014-0159 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=510205 - - - 2008-12-30 - 2014-04-11 - 2014-04-30 - - - - - ChaSen -- buffer overflow - - - chasen-base - 2.4.5 - - - chasen - 2.4.5 - - - - -

JVN iPedia reports:

-
-

ChaSen provided by Nara Institute of Science and Technology is a - software for morphologically analyzing Japanese. ChaSen contains an - issue when reading in strings, which may lead to a buffer - overflow.

-

An arbitrary script may be executed by an attacker with access to - a system that is running a product listed in "Products - Affected."

-
- - - - CVE-2011-4000 - http://jvn.jp/en/jp/JVN16901583/index.html - - - 2011-11-08 - 2014-04-13 - - - - - OpenSSL -- Local Information Disclosure - - - openssl - 1.0.11.0.1_10 - - - mingw32-openssl - 1.0.11.0.1g - - - FreeBSD - 8.38.3_15 - 8.48.4_8 - 9.19.1_11 - 9.29.2_4 - 10.010.0_1 - - - - -

OpenSSL reports:

-
-

A flaw in the implementation of Montgomery Ladder Approach would - create a side-channel that leaks sensitive timing information.

-

A local attacker might be able to snoop a signing process and - might recover the signing key from it.

-
- - - - CVE-2014-0076 - SA-14:06.openssl - https://www.openssl.org/news/vulnerabilities.html#2014-0076 - - - 2014-04-07 - 2014-04-11 - - - - - openafs -- Denial of Service - - - openafs - 1.4.81.6.7 - - - - -

The OpenAFS development team reports:

-
-

An attacker with the ability to connect to an OpenAFS fileserver can - trigger a buffer overflow, crashing the server.

-

The buffer overflow can be triggered by sending an unauthenticated - request for file server statistical information.

-

Clients are not affected.

-
- - - - CVE-2014-0159 - http://openafs.org/security/OPENAFS-SA-2014-001.txt - - - 2014-04-09 - 2014-04-09 - - - - - OpenSSL -- Remote Information Disclosure - - - openssl - 1.0.11.0.1_10 - - - mingw32-openssl - 1.0.11.0.1g - - - FreeBSD - 10.010.0_1 - - - - -

OpenSSL Reports:

-
-

A missing bounds check in the handling of the TLS heartbeat extension can be - used to reveal up to 64k of memory to a connected client or server.

-

Affected users should upgrade to OpenSSL 1.0.1g. Users unable to immediately - upgrade can alternatively recompile OpenSSL with -DOPENSSL_NO_HEARTBEATS.

-
-
-

The bug allows anyone on the Internet to read the memory of the - systems protected by the vulnerable versions of the OpenSSL software. - This compromises the secret keys used to identify the service - providers and to encrypt the traffic, the names and passwords of the - users and the actual content. This allows attackers to eavesdrop - communications, steal data directly from the services and users and - to impersonate services and users.

-
-
-

The code used to handle the Heartbeat Extension does not do - sufficient boundary checks on record length, which allows reading - beyond the actual payload.

-
- - - - CVE-2014-0160 - SA-14:06.openssl - https://www.openssl.org/news/secadv_20140407.txt - https://www.openssl.org/news/vulnerabilities.html#2014-0076 - http://www.heartbleed.com - - - 2014-04-07 - 2014-04-07 - 2014-04-11 - - - - - otrs -- Clickjacking issue - - - otrs - 3.1.21 - 3.2.*3.2.16 - 3.3.*3.3.6 - - - - -

The OTRS Project reports:

-
-

An attacker could embed OTRS in a hidden iframe tag of another - page, tricking the user into clicking links in OTRS.

-
- - - - http://www.w3.org/1999/xhtml - CVE-2014-2554 - - - 2014-04-01 - 2014-04-03 - - - - - LibYAML input sanitization errors - - - libyaml - 0.1.6 - - - mingw32-libyaml - 0.1.6 - - - - -

oCERT reports:

-
-

The LibYAML project is an open source YAML 1.1 parser and - emitter written in C.

-

The library is affected by a heap-based buffer overflow - which can lead to arbitrary code execution. The - vulnerability is caused by lack of proper expansion for the - string passed to the yaml_parser_scan_uri_escapes() - function.

-

A specially crafted YAML file, with a long sequence of - percent-encoded characters in a URL, can be used to trigger - the overflow.

-
- - - - CVE-2014-2525 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2525 - - - 2014-03-11 - 2014-03-26 - - - - - Icinga -- buffer overflow in classic web interface - - - icinga - 1.11.1 - - - - -

The Icinga Team reports:

-
-

Wrong strlen check against MAX_INPUT_BUFFER without taking '\0' into account [...]

-
- - - - CVE-2014-2386 - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-2386 - - - 2014-02-18 - 2014-03-29 - - - - - file -- out-of-bounds access in search rules with offsets from input file - - - file - 5.18 - - - - -

Aaron Reffett reports:

-
-

softmagic.c in file ... and libmagic allows context-dependent - attackers to cause a denial of service (out-of-bounds memory access and - crash) via crafted offsets in the softmagic of a PE executable.

-
- - - - CVE-2014-2270 - http://bugs.gw.com/view.php?id=31 - - - 2013-12-20 - 2014-03-29 - - - - - Joomla! -- Core - Multiple Vulnerabilities - - - joomla2 - 2.5.*2.5.18 - - - joomla3 - 3.0.*3.2.2 - - - - -

The JSST and the Joomla! Security Center report:

-
-

[20140301] - Core - SQL Injection

-

Inadequate escaping leads to SQL injection vulnerability.

-
-
-

[20140302] - Core - XSS Vulnerability

-

Inadequate escaping leads to XSS vulnerability in com_contact.

-
-
-

[20140303] - Core - XSS Vulnerability

-

Inadequate escaping leads to XSS vulnerability.

-
-
-

[20140304] - Core - Unauthorised Logins

-

Inadequate checking allowed unauthorised logins via GMail authentication.

-
- - - - http://developer.joomla.org/security/578-20140301-core-sql-injection.html - http://developer.joomla.org/security/579-20140302-core-xss-vulnerability.html - http://developer.joomla.org/security/580-20140303-core-xss-vulnerability.html - http://developer.joomla.org/security/581-20140304-core-unauthorised-logins.html - - - 2014-03-01 - 2014-03-23 - 2014-04-30 - - - - - mail/trojita -- may leak mail contents (not user credentials) over unencrypted connection - - - trojita - 0.4.1 - - - - -

Jan Kundrát reports:

-
-

An SSL stripping vulnerability was discovered in Trojitá, a fast Qt - IMAP e-mail client. User's credentials are never leaked, but if a - user tries to send an e-mail, the automatic saving into the "sent" - or "draft" folders could happen over a plaintext connection even if - the user's preferences specify STARTTLS as a requirement.

-
- - - - CVE-2014-2567 - http://jkt.flaska.net/blog/Trojita_0_4_1__a_security_update_for_CVE_2014_2567.html - - - 2014-03-20 - 2014-03-23 - - - - - nginx-devel -- SPDY heap buffer overflow - - - nginx-devel - 1.3.151.5.12 - - - - -

The nginx project reports:

-
-

A bug in the experimental SPDY implementation in nginx was found, which - might allow an attacker to cause a heap memory buffer overflow in a - worker process by using a specially crafted request, potentially - resulting in arbitrary code execution (CVE-2014-0133).

- -

The problem affects nginx 1.3.15 - 1.5.11, compiled with the - ngx_http_spdy_module module (which is not compiled by default) and - without --with-debug configure option, if the "spdy" option of the - "listen" directive is used in a configuration file.

- -

The problem is fixed in nginx 1.5.12, 1.4.7.

-
- - - - CVE-2014-0133 - http://mailman.nginx.org/pipermail/nginx-announce/2014/000135.html - - - 2014-03-18 - 2014-03-23 - - - - - nginx -- SPDY heap buffer overflow - - - nginx - 1.4.7 - - - - -

The nginx project reports:

-
-

A bug in the experimental SPDY implementation in nginx was found, which - might allow an attacker to cause a heap memory buffer overflow in a - worker process by using a specially crafted request, potentially - resulting in arbitrary code execution (CVE-2014-0133).

- -

The problem affects nginx 1.3.15 - 1.5.11, compiled with the - ngx_http_spdy_module module (which is not compiled by default) and - without --with-debug configure option, if the "spdy" option of the - "listen" directive is used in a configuration file.

- -

The problem is fixed in nginx 1.5.12, 1.4.7.

-
- - - - CVE-2014-0133 - http://mailman.nginx.org/pipermail/nginx-announce/2014/000135.html - - - 2014-03-18 - 2014-03-23 - - - - - apache -- several vulnerabilities - - - apache24 - 2.4.02.4.9 - - - apache22 - 2.2.02.2.27 - - - apache22-event-mpm - 2.2.02.2.27 - - - apache22-itk-mpm - 2.2.02.2.27 - - - apache22-peruser-mpm - 2.2.02.2.27 - - - apache22-worker-mpm - 2.2.02.2.27 - - - - -

Apache HTTP SERVER PROJECT reports:

-
-

Clean up cookie logging with fewer redundant string parsing passes. - Log only cookies with a value assignment. Prevents segfaults when - logging truncated cookies.

-

mod_dav: Keep track of length of cdata properly when removing leading - spaces. Eliminates a potential denial of service from specifically - crafted DAV WRITE requests.

-
- - - - CVE-2014-0098 - CVE-2013-6438 - - - 2014-02-25 - 2014-03-22 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 28.0,1 - - - firefox-esr - 24.4.0,1 - - - linux-firefox - 28.0,1 - - - linux-seamonkey - 2.25 - - - linux-thunderbird - 24.4.0 - - - seamonkey - 2.25 - - - thunderbird - 24.4.0 - - - - -

The Mozilla Project reports:

-
-

MFSA 2014-15 Miscellaneous memory safety hazards - (rv:28.0 / rv:24.4)

-

MFSA 2014-16 Files extracted during updates are not always - read only

-

MFSA 2014-17 Out of bounds read during WAV file decoding

-

MFSA 2014-18 crypto.generateCRMFRequest does not validate - type of key

-

MFSA 2014-19 Spoofing attack on WebRTC permission prompt

-

MFSA 2014-20 onbeforeunload and Javascript navigation DOS

-

MFSA 2014-21 Local file access via Open Link in new tab

-

MFSA 2014-22 WebGL content injection from one domain to - rendering in another

-

MFSA 2014-23 Content Security Policy for data: documents - not preserved by session restore

-

MFSA 2014-24 Android Crash Reporter open to manipulation

-

MFSA 2014-25 Firefox OS DeviceStorageFile object vulnerable - to relative path escape

-

MFSA 2014-26 Information disclosure through polygon - rendering in MathML

-

MFSA 2014-27 Memory corruption in Cairo during PDF font - rendering

-

MFSA 2014-28 SVG filters information disclosure through - feDisplacementMap

-

MFSA 2014-29 Privilege escalation using WebIDL-implemented - APIs

-

MFSA 2014-30 Use-after-free in TypeObject

-

MFSA 2014-31 Out-of-bounds read/write through neutering - ArrayBuffer objects

-

MFSA 2014-32 Out-of-bounds write through TypedArrayObject - after neutering

-
- - - - CVE-2014-1493 - CVE-2014-1494 - CVE-2014-1496 - CVE-2014-1497 - CVE-2014-1498 - CVE-2014-1499 - CVE-2014-1500 - CVE-2014-1501 - CVE-2014-1502 - CVE-2014-1504 - CVE-2014-1505 - CVE-2014-1506 - CVE-2014-1507 - CVE-2014-1508 - CVE-2014-1509 - CVE-2014-1510 - CVE-2014-1511 - CVE-2014-1512 - CVE-2014-1513 - CVE-2014-1514 - https://www.mozilla.org/security/announce/2014/mfsa2014-15.html - https://www.mozilla.org/security/announce/2014/mfsa2014-16.html - https://www.mozilla.org/security/announce/2014/mfsa2014-17.html - https://www.mozilla.org/security/announce/2014/mfsa2014-18.html - https://www.mozilla.org/security/announce/2014/mfsa2014-19.html - https://www.mozilla.org/security/announce/2014/mfsa2014-20.html - https://www.mozilla.org/security/announce/2014/mfsa2014-21.html - https://www.mozilla.org/security/announce/2014/mfsa2014-22.html - https://www.mozilla.org/security/announce/2014/mfsa2014-23.html - https://www.mozilla.org/security/announce/2014/mfsa2014-24.html - https://www.mozilla.org/security/announce/2014/mfsa2014-25.html - https://www.mozilla.org/security/announce/2014/mfsa2014-26.html - https://www.mozilla.org/security/announce/2014/mfsa2014-27.html - https://www.mozilla.org/security/announce/2014/mfsa2014-28.html - https://www.mozilla.org/security/announce/2014/mfsa2014-29.html - https://www.mozilla.org/security/announce/2014/mfsa2014-30.html - https://www.mozilla.org/security/announce/2014/mfsa2014-31.html - https://www.mozilla.org/security/announce/2014/mfsa2014-32.html - http://www.mozilla.org/security/known-vulnerabilities/ - - - 2014-03-19 - 2014-03-19 - 2014-03-20 - - - - - mutt -- denial of service, potential remote code execution - - - mutt - 1.5.23 - - - - -

Beatrice Torracca and Evgeni Golov report:

-
-

A buffer overflow has been discovered that could result in - denial of service or potential execution of arbitrary code.

-

This condition can be triggered by malformed RFC2047 header - lines

-
- - - - CVE-2014-0467 - http://packetstormsecurity.com/files/cve/CVE-2014-0467 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0467 - - - 2014-03-12 - 2014-03-14 - - - - - wemux -- read-only can be bypassed - - - wemux - 3.2.0 - - - - -

JonApps reports:

-
-

The read-only mode can be bypassed and any command sent to bash session

-
- - - - https://github.com/zolrath/wemux/issues/36 - - - 2013-12-24 - 2014-03-13 - - - - - samba -- multiple vulnerabilities - - - samba34 - 0 - - - samba35 - 0 - - - samba36 - 3.6.*3.6.23 - - - samba4 - 4.0.*4.0.16 - - - samba41 - 4.1.*4.1.6 - - - - -

Samba project reports:

-
-

In Samba's SAMR server we neglect to ensure that attempted - password changes will update the bad password count, nor set - the lockout flags. This would allow a user unlimited attempts - against the password by simply calling ChangePasswordUser2 - repeatedly.

-

This is available without any other authentication.

-
-
-

smbcacls can remove a file or directory ACL by mistake.

-
- - - - CVE-2013-4496 - CVE-2013-6442 - http://www.samba.org/samba/security/CVE-2013-4496 - http://www.samba.org/samba/security/CVE-2013-6442 - - - 2014-03-11 - 2014-03-11 - - - - - asterisk -- multiple vulnerabilities - - - asterisk11 - 11.8.1 - - - asterisk18 - 1.8.26.1 - - - - -

The Asterisk project reports:

-
-

Stack Overflow in HTTP Processing of Cookie Headers. Sending a HTTP - request that is handled by Asterisk with a large number of Cookie - headers could overflow the stack. You could even exhaust memory if you - sent an unlimited number of headers in the request.

-

Denial of Service Through File Descriptor Exhaustion with chan_sip - Session-Timers. An attacker can use all available file descriptors - using SIP INVITE requests. Asterisk will respond with code 400, 420, - or 422 for INVITEs meeting this criteria. - Each INVITE meeting these conditions will leak a channel and several - file descriptors. The file descriptors cannot be released without - restarting Asterisk which may allow intrusion detection systems to be - bypassed by sending the requests slowly.

-

Remote Crash Vulnerability in PJSIP channel driver. A remotely - exploitable crash vulnerability exists in the PJSIP channel driver if - the "qualify_frequency" configuration option is enabled on an AOR and - the remote SIP server challenges for authentication of the resulting - OPTIONS request. The response handling code wrongly assumes that a - PJSIP endpoint will always be associated with an outgoing request which - is incorrect.

-
- - - - CVE-2014-2286 - CVE-2014-2287 - CVE-2014-2288 - http://downloads.asterisk.org/pub/security/AST-2014-001.pdf - http://downloads.asterisk.org/pub/security/AST-2014-002.pdf - http://downloads.asterisk.org/pub/security/AST-2014-003.pdf - https://www.asterisk.org/security - - - 2014-03-10 - 2014-03-10 - - - - - freetype2 -- Out of bounds read/write - - - freetype2 - 2.5.3 - - - - -

Mateusz Jurczyk reports:

-
-

Out of bounds stack-based read/write in - cf2_hintmap_build.

-

This is a critical vulnerability in the CFF Rasterizer - code recently contributed by Adobe, leading to potential - arbitrary code execution in the context of the FreeType2 - library client.

-
- - - - http://savannah.nongnu.org/bugs/?41697 - - - 2014-02-25 - 2014-03-09 - - - - - xmms -- Integer Overflow And Underflow Vulnerabilities - - - xmms - 1.2.11_20 - - - - -

Secunia reports:

-
-

Secunia Research has discovered two vulnerabilities in XMMS, which can - be exploited by malicious people to compromise a user's system.

- -

1) An integer underflow error exists in the processing of skin bitmap - images. This can be exploited to cause a stack-based buffer overflow - via specially crafted skin images containing manipulated header - information.

- -

Successful exploitation allows execution of arbitrary code.

- -

2) An integer overflow error exists in the processing of skin bitmap - images. This can be exploited to cause memory corruption via specially - crafted skin images containing manipulated header information.

- -

Successful exploitation may allow the execution of arbitrary code.

-
- - - - CVE-2007-0653 - CVE-2007-0654 - - - 2007-02-06 - 2014-03-06 - - - - - nginx -- SPDY memory corruption - - - nginx-devel - 1.5.10 - - - - -

The nginx project reports:

-
-

A bug in the experimental SPDY implementation in nginx 1.5.10 was found, - which might allow an attacker to corrupt worker process memory by using - a specially crafted request, potentially resulting in arbitrary code - execution (CVE-2014-0088).

- -

The problem only affects nginx 1.5.10 on 32-bit platforms, compiled with - the ngx_http_spdy_module module (which is not compiled by default), if - the "spdy" option of the "listen" directive is used in a configuration - file.

-
- - - - CVE-2014-0088 - http://mailman.nginx.org/pipermail/nginx-announce/2014/000132.html - - - 2014-03-04 - 2014-03-06 - - - - - gnutls -- multiple certificate verification issues - - - gnutls - 2.12.23_4 - - - linux-f10-gnutls - 2.12.23_4 - - - gnutls-devel - 3.1.22 - 3.2.03.2.12 - - - gnutls3 - 3.1.22 - 3.2.03.2.12 - - - - -

GnuTLS project reports:

-
-

A vulnerability was discovered that affects the - certificate verification functions of all gnutls - versions. A specially crafted certificate could - bypass certificate validation checks. The - vulnerability was discovered during an audit of - GnuTLS for Red Hat.

-
-
-

Suman Jana reported a vulnerability that affects - the certificate verification functions of - gnutls 2.11.5 and later versions. A version 1 - intermediate certificate will be considered as - a CA certificate by default (something that - deviates from the documented behavior).

-
- - - - CVE-2014-0092 - CVE-2014-1959 - http://www.gnutls.org/security.html#GNUTLS-SA-2014-1 - http://www.gnutls.org/security.html#GNUTLS-SA-2014-2 - - - 2014-03-03 - 2014-03-04 - 2014-04-30 - - - - - file -- denial of service - - - file - 5.17 - - - - -

The Fine Free file project reports:

-
-

file before 5.17 allows context-dependent attackers to - cause a denial of service (infinite recursion, CPU consumption, and - crash) via a crafted indirect offset value in the magic of a file.

-
- - - - CVE-2014-1943 - http://mx.gw.com/pipermail/file/2014/001327.html - - - 2014-02-16 - 2014-03-03 - - - - - Python -- buffer overflow in socket.recvfrom_into() - - - python27 - 2.7.6_3 - - - python31 - 3.1.5_10 - - - python32 - 3.2.5_7 - - - python33 - 3.3.3_2 - - - - -

Vincent Danen via Red Hat Issue Tracker reports:

-
-

A vulnerability was reported in Python's socket module, due to a - boundary error within the sock_recvfrom_into() function, which could be - exploited to cause a buffer overflow. This could be used to crash a - Python application that uses the socket.recvfrom_info() function or, - possibly, execute arbitrary code with the permissions of the user - running vulnerable Python code.

- -

This vulnerable function, socket.recvfrom_into(), was introduced in - Python 2.5. Earlier versions are not affected by this flaw.

-
- - - - 65379 - CVE-2014-1912 - https://mail.python.org/pipermail/python-dev/2014-February/132758.html - http://bugs.python.org/issue20246 - https://bugzilla.redhat.com/show_bug.cgi?id=1062370 - - - 2014-01-14 - 2014-03-01 - - - - - subversion -- mod_dav_svn vulnerability - - - subversion - 1.3.01.7.16 - 1.8.01.8.8 - - - subversion16 - 1.3.01.7.16 - - - subversion17 - 1.3.01.7.16 - - - - -

Subversion Project reports:

-
-

Subversion's mod_dav_svn Apache HTTPD server module will crash when it - receives an OPTIONS request against the server root and Subversion is - configured to handle the server root and SVNListParentPath is on. - This can lead to a DoS. There are no known instances of this - problem being exploited in the wild, but the details of how to exploit - it have been disclosed on the Subversion development mailing list.

-
- - - - CVE-2014-0032 - https://subversion.apache.org/security/CVE-2014-0032-advisory.txt - - - 2014-01-10 - 2014-02-26 - 2014-04-30 - - - - - otrs -- XSS Issue - - - otrs - 3.1.20 - 3.2.*3.2.15 - 3.3.*3.3.5 - - - - -

The OTRS Project reports:

-
-

An attacker could send a specially prepared HTML email to OTRS. If -he can then trick an agent into following a special link to display this email, -JavaScript code would be executed.

-
- - - - https://www.otrs.com/security-advisory-2014-03-xss-issue/ - CVE-2014-1695 - - - 2014-02-25 - 2014-02-25 - - - - - PostgreSQL -- multiple privilege issues - - - postgresql-server - 8.4.20 - 9.0.09.0.16 - 9.1.09.1.12 - 9.2.09.2.7 - 9.3.09.3.3 - - - - -

PostgreSQL Project reports:

-
-

This update fixes CVE-2014-0060, in which PostgreSQL did not - properly enforce the WITH ADMIN OPTION permission for ROLE management. - Before this fix, any member of a ROLE was able to grant others access - to the same ROLE regardless if the member was given the WITH ADMIN - OPTION permission. It also fixes multiple privilege escalation issues, - including: CVE-2014-0061, CVE-2014-0062, CVE-2014-0063, CVE-2014-0064, - CVE-2014-0065, and CVE-2014-0066. More information on these issues can - be found on our security page and the security issue detail wiki page. -

-

- With this release, we are also alerting users to a known security hole - that allows other users on the same machine to gain access to an - operating system account while it is doing "make check": - CVE-2014-0067. "Make check" is normally part of building PostgreSQL - from source code. As it is not possible to fix this issue without - causing significant issues to our testing infrastructure, a patch will - be released separately and publicly. Until then, users are strongly - advised not to run "make check" on machines where untrusted users have - accounts.

-
- - - - CVE-2014-0060 - CVE-2014-0061 - CVE-2014-0062 - CVE-2014-0063 - CVE-2014-0064 - CVE-2014-0065 - CVE-2014-0066 - CVE-2014-0067 - - - 2014-02-20 - 2014-02-20 - - - - - phpMyAdmin -- Self-XSS due to unescaped HTML output in import. - - - phpMyAdmin - 3.3.14.1.7 - - - - -

The phpMyAdmin development team reports:

-
-

When importing a file with crafted filename, it is - possible to trigger an XSS. We consider this vulnerability - to be non critical.

-
- - - - http://www.phpmyadmin.net/home_page/security/PMASA-2014-1.php - CVE-2014-1879 - - - 2014-02-15 - 2014-02-15 - - - - - jenkins -- multiple vulnerabilities - - - jenkins - 1.551 - - - jenkins-lts - 1.532.2 - - - - -

Jenkins Security Advisory reports:

-
-

This advisory announces multiple security vulnerabilities that - were found in Jenkins core.

-

Please reference CVE/URL list for details

-
- - - - https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14 - CVE-2013-5573 - CVE-2013-7285 - - - 2014-02-14 - 2014-02-15 - - - - - lighttpd -- multiple vulnerabilities - - - lighttpd - 1.4.34 - - - - -

lighttpd security advisories report:

-
-

It is possible to inadvertantly enable vulnerable ciphers when using - ssl.cipher-list.

-
-
-

In certain cases setuid() and similar can fail, potentially triggering - lighttpd to restart running as root.

-
-
-

If FAMMonitorDirectory fails, the memory intended to store the context is - released; some lines below the "version" compoment of that context is read. - Reading invalid data doesn't matter, but the memory access could trigger a - segfault.

-
- - - - http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_01.txt - http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_02.txt - http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_03.txt - CVE-2013-4508 - CVE-2013-4559 - CVE-2013-4560 - - - 2013-11-28 - 2014-02-14 - - - - - phpmyfaq -- multiple vulnerabilities - - - phpmyfaq - 2.8.6 - - - - -

The phpMyFAQ team reports:

-
-

An arbitrary script may be executed on the user's Internet - Explorer when using an older version of the browser. If a user views - a malicious page while logged in, settings may be changed - unintentionally.

-
- - - - CVE-2014-0813 - CVE-2014-0814 - http://www.phpmyfaq.de/advisory_2014-02-04.php - - - 2014-02-04 - 2014-02-06 - - - - - linux-flashplugin -- multiple vulnerabilities - - - linux-f10-flashplugin - 11.2r202.336 - - - - -

Adobe reports:

-
-

These updates address vulnerabilities that could cause a crash - and potentially allow an attacker to take control of the affected system.

-
- - - - CVE-2014-0497 - http://www.adobe.com/support/security/bulletins/apsb14-04.html - - - 2014-02-04 - 2014-02-04 - 2014-02-05 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 25.0,127.0,1 - 24.3.0,1 - - - linux-firefox - 27.0,1 - - - linux-seamonkey - 2.24 - - - linux-thunderbird - 24.3.0 - - - seamonkey - 2.24 - - - thunderbird - 24.3.0 - - - - -

The Mozilla Project reports:

-
-

MFSA 2014-01 Miscellaneous memory safety hazards - (rv:27.0 / rv:24.3)

-

MFSA 2014-02 Clone protected content with XBL scopes

-

MFSA 2014-03 UI selection timeout missing on download - prompts

-

MFSA 2014-04 Incorrect use of discarded images by - RasterImage

-

MFSA 2014-05 Information disclosure with *FromPoint on - iframes

-

MFSA 2014-06 Profile path leaks to Android system log

-

MFSA 2014-07 XSLT stylesheets treated as styles in Content - Security Policy

-

MFSA 2014-08 Use-after-free with imgRequestProxy and image - proccessing

-

MFSA 2014-09 Cross-origin information leak through web - workers

-

MFSA 2014-10 Firefox default start page UI content invokable - by script

-

MFSA 2014-11 Crash when using web workers with asm.js

-

MFSA 2014-12 NSS ticket handling issues

-

MFSA 2014-13 Inconsistent JavaScript handling of access to - Window objects

-
- - - - CVE-2014-1477 - CVE-2014-1478 - CVE-2014-1479 - CVE-2014-1480 - CVE-2014-1481 - CVE-2014-1482 - CVE-2014-1483 - CVE-2014-1484 - CVE-2014-1485 - CVE-2014-1486 - CVE-2014-1487 - CVE-2014-1488 - CVE-2014-1489 - CVE-2014-1490 - CVE-2014-1491 - https://www.mozilla.org/security/announce/2014/mfsa2014-01.html - https://www.mozilla.org/security/announce/2014/mfsa2014-02.html - https://www.mozilla.org/security/announce/2014/mfsa2014-03.html - https://www.mozilla.org/security/announce/2014/mfsa2014-04.html - https://www.mozilla.org/security/announce/2014/mfsa2014-05.html - https://www.mozilla.org/security/announce/2014/mfsa2014-06.html - https://www.mozilla.org/security/announce/2014/mfsa2014-07.html - https://www.mozilla.org/security/announce/2014/mfsa2014-08.html - https://www.mozilla.org/security/announce/2014/mfsa2014-09.html - https://www.mozilla.org/security/announce/2014/mfsa2014-10.html - https://www.mozilla.org/security/announce/2014/mfsa2014-11.html - https://www.mozilla.org/security/announce/2014/mfsa2014-12.html - http://www.mozilla.org/security/known-vulnerabilities/ - - - 2014-02-04 - 2014-02-04 - - - - - libyaml heap overflow resulting in possible code execution - - - libyaml - 0.1.4_3 - - - pkg - 1.2.6 - - - pkg-devel - 1.2.6 - - - - -

libyaml was prone to a heap overflow that could result in - arbitrary code execution. Pkg uses libyaml to parse - the package manifests in some cases. Pkg also used libyaml - to parse the remote repository until 1.2.

-

RedHat Product Security Team reports on libyaml:

-
-

A heap-based buffer overflow flaw was found in the way libyaml - parsed YAML tags. A remote attacker could provide a - specially-crafted YAML document that, when parsed by an application - using libyaml, would cause the application to crash or, potentially, - execute arbitrary code with the privileges of the user running the - application.

-
- - - - CVE-2013-6393 - https://bugzilla.redhat.com/show_bug.cgi?id=1033990 - - - 2013-11-24 - 2014-02-01 - 2014-02-01 - - - - - socat -- buffer overflow with data from command line - - - socat - 1.7.2.3 - - - - -

Florian Weimer of the Red Hat Product Security Team reports:

-
-

Due to a missing check during assembly of the HTTP request line a long - target server name in the PROXY-CONNECT address can cause a stack buffer - overrun. Exploitation requires that the attacker is able to provide the - target server name to the PROXY-CONNECT address in the command line. - This can happen for example in scripts that receive data from untrusted - sources.

-
- - - - CVE-2014-0019 - http://www.dest-unreach.org/socat/contrib/socat-secadv5.txt - - - 2014-01-24 - 2014-01-29 - - - - - otrs -- multiple vulnerabilities - - - otrs - 3.1.19 - 3.2.*3.2.14 - 3.3.*3.3.4 - - - - -

The OTRS Project reports:

-
-

SQL injection issue

-
-
-

An attacker that managed to take over the session of a logged in customer - could create tickets and/or send follow-ups to existing tickets due to - missing challenge token checks.

-
- - - - CVE-2014-1471 - https://www.otrs.com/security-advisory-2014-02-sql-injection-issue/ - https://www.otrs.com/security-advisory-2014-01-csrf-issue-customer-web-interface/ - - - 2014-01-28 - 2014-01-28 - 2014-02-06 - - - - - - - - - rt42 -- denial-of-service attack via the email gateway - - - rt42 - 4.24.2.1_3 - 4.2.24.2.2_2 - - - p5-Email-Address-List - 0.02 - - - - -

The RT development team reports:

-
-

Versions of RT between 4.2.0 and 4.2.2 (inclusive) are - vulnerable to a denial-of-service attack via the email - gateway; any installation which accepts mail from untrusted - sources is vulnerable, regardless of the permissions - configuration inside RT. This vulnerability is assigned - CVE-2014-1474.

-

This vulnerability is caused by poor parsing performance - in the Email::Address::List module, which RT depends on. We - recommend that affected users upgrade their version of - Email::Address::List to v0.02 or above, which resolves the - issue. Due to a communications mishap, the release on CPAN - will temporarily appear as "unauthorized," and the - command-line cpan client will hence not install it. We - expect this to be resolved shortly; in the meantime, the - release is also available from our server.

-
- - - - CVE-2014-1474 - http://blog.bestpractical.com/2014/01/security-vulnerability-in-rt-42.html - - - 2014-01-27 - 2014-01-27 - - - - - strongswan -- multiple DoS vulnerabilities - - - strongswan - 5.1.1 - - - - -

strongSwan Project reports:

-
-

A DoS vulnerability triggered by crafted IKEv1 fragmentation - payloads was discovered in strongSwan's IKE daemon charon. All - versions since 5.0.2 are affected.

-
-
-

A DoS vulnerability and potential authorization bypass triggered - by a crafted ID_DER_ASN1_DN ID payload was discovered in strongSwan. - All versions since 4.3.3 are affected.

-
-
-

A DoS vulnerability in strongSwan was discovered, which is - triggered by XAuth usernames and EAP identities in versions - 5.0.3 and 5.0.4.

-
- - - - CVE-2013-5018 - CVE-2013-6075 - CVE-2013-6076 - http://www.strongswan.org/blog/2013/08/01/strongswan-denial-of-service-vulnerability-%28cve-2013-5018%29.html - http://www.strongswan.org/blog/2013/11/01/strongswan-denial-of-service-vulnerability-%28cve-2013-6075%29.html - http://www.strongswan.org/blog/2013/11/01/strongswan-denial-of-service-vulnerability-%28cve-2013-6076%29.html - - - 2013-11-01 - 2014-01-27 - - - - - varnish -- DoS vulnerability in Varnish HTTP cache - - - varnish - 3.0.5 - - - - -

Varnish Cache Project reports:

-
-

If Varnish receives a certain illegal request, and the subroutine - 'vcl_error{}' restarts the request, the varnishd worker process - will crash with an assert. -

-

The varnishd management process will restart the worker process, but - there will be a brief interruption of service and the cache will be - emptied, causing more traffic to go to the backend. -

-

We are releasing this advisory because restarting from vcl_error{} is - both fairly common and documented.

-

This is purely a denial of service vulnerability, there is no risk of - privilege escalation.

-

Workaround

-

Insert this at the top of your VCL file:

- 
-		sub vcl_error {
-			if (obj.status == 400 || obj.status == 413) {
-				return(deliver);
-			}
-		}
-
-		Or add this test at the top of your existing vcl_error{}.
-
-
- - - - CVE-2013-4484 - https://www.varnish-cache.org/lists/pipermail/varnish-announce/2013-October/000686.html - - - 2013-10-30 - 2014-01-25 - - - - - linux-flashplugin -- multiple vulnerabilities - - - linux-f10-flashplugin - 11.2r202.335 - - - - -

Adobe reports:

-
-

These updates address vulnerabilities that could cause a crash - and potentially allow an attacker to take control of the affected system.

-
- - - - CVE-2014-0491 - CVE-2014-0492 - http://helpx.adobe.com/security/products/flash-player/apsb14-02.html - - - 2014-01-14 - 2014-01-24 - - - - - HTMLDOC -- buffer overflow issues when reading AFM files and parsing page sizes - - - htmldoc - 1.8.28 - - - - -

Michael Sweet reports:

-
-

HTMLDOC 1.8.28 fixes some known security issues and - formatting bugs. Changes include:

-
    -
  • SECURITY: Fixed three buffer overflow issues when - reading AFM files and parsing page sizes.
    • -
-
- - - - http://www.msweet.org/projects.php?Z1 - - - 2014-01-06 - 2014-01-22 - 2014-01-23 - - - - - virtualbox-ose -- local vulnerability - - - virtualbox-ose - 4.2.22 - - - - -

Oracle reports:

-
-

Unspecified vulnerability in the Oracle VM VirtualBox - component in Oracle Virtualization VirtualBox prior to - 3.2.20, 4.0.22, 4.1.30, 4.2.22, and 4.3.6 allows local - users to affect confidentiality, integrity, and availability - via unknown vectors related to Core.

-
- - - - CVE-2013-5892 - http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html - - - 2014-01-15 - 2014-01-16 - - - - - ntpd DRDoS / Amplification Attack using ntpdc monlist command - - - ntp - 4.2.7p26 - - - FreeBSD - 8.38.3_14 - 8.48.4_7 - 9.19.1_10 - 9.29.2_3 - - - - -

ntp.org reports:

-
-

Unrestricted access to the monlist feature in - ntp_request.c in ntpd in NTP before 4.2.7p26 allows remote - attackers to cause a denial of service (traffic - amplification) via forged (1) REQ_MON_GETLIST or (2) - REQ_MON_GETLIST_1 requests, as exploited in the wild in - December 2013

-

Use noquery to your default restrictions to block all - status queries.

-

Use disable monitor to disable the ``ntpdc -c monlist'' - command while still allowing other status queries.

-
- - - - CVE-2013-5211 - SA-14:02.ntpd - http://support.ntp.org/bin/view/Main/SecurityNotice#DRDoS_Amplification_Attack_using - - - 2014-01-01 - 2014-01-14 - 2016-08-09 - - - - - nagios -- denial of service vulnerability - - - nagios - 3.5.1_3 - - - - -

Eric Stanley reports:

-
-

Most CGIs previously incremented the input variable counter twice - when it encountered a long key value. This could cause the CGI to - read past the end of the list of CGI variables.

-
- - - - CVE-2013-7108 - CVE-2013-7205 - http://sourceforge.net/p/nagios/nagioscore/ci/d97e03f32741a7d851826b03ed73ff4c9612a866/ - https://bugzilla.redhat.com/show_bug.cgi?id=1046113 - - - 2013-12-20 - 2014-01-14 - - - - - bind -- denial of service vulnerability - - - bind99 - 9.9.4.2 - - - bind99-base - 9.9.4.2 - - - bind98 - 9.8.6.2 - - - bind98-base - 9.8.6.2 - - - bind96 - 9.6.3.2.ESV.R10.2 - - - bind96-base - 9.6.3.2.ESV.R10.2 - - - FreeBSD - 9.29.2_3 - 9.19.1_10 - 8.48.4_7 - 8.38.3_14 - - - - -

ISC reports:

-
-

Because of a defect in handling queries for NSEC3-signed zones, - BIND can crash with an "INSIST" failure in name.c when processing - queries possessing certain properties. By exploiting this defect - an attacker deliberately constructing a query with the right - properties could achieve denial of service against an authoritative - nameserver serving NSEC3-signed zones.

-
- - - - CVE-2014-0591 - SA-14:04.bind - https://kb.isc.org/article/AA-01078/74/ - - - 2014-01-08 - 2014-01-13 - 2016-08-09 - - - - - libXfont -- Stack buffer overflow in parsing of BDF font files in libXfont - - - libXfont - 1.4.7,1 - - - - -

freedesktop.org reports:

-
-

A BDF font file containing a longer than expected string can cause - a buffer overflow on the stack. Testing in X servers built with - Stack Protector restulted in an immediate crash when reading a - user-proveded specially crafted font.

-

As libXfont is used to read user-specified font files in all X - servers distributed by X.Org, including the Xorg server which is - often run with root privileges or as setuid-root in order to access - hardware, this bug may lead to an unprivileged user acquiring root - privileges in some systems.

-
- - - - CVE-2013-6462 - http://lists.x.org/archives/xorg-announce/2014-January/002389.html - - - 2013-12-24 - 2014-01-08 - - - - - openssl -- multiple vulnerabilities - - - openssl - 1.0.1_9 - - - - -

OpenSSL development team reports:

-
-

Major changes between OpenSSL 1.0.1e and OpenSSL 1.0.1f [6 Jan 2014]:

-
    -
  • Fix for TLS record tampering bug [CVE-2013-4353]
    • -
  • Fix for TLS version checking bug [CVE-2013-6449]
    • -
  • Fix for DTLS retransmission bug [CVE-2013-6450]
    • -
-
- - - - SA-14:03.openssl - CVE-2013-4353 - CVE-2013-6449 - CVE-2013-6450 - http://www.openssl.org/news/openssl-1.0.1-notes.html - - - 2014-01-06 - 2014-01-06 - 2016-08-09 - - - - - OpenX -- SQL injection vulnerability - - - openx - 3.0.2 - - - - -

Revive reports:

-
-

An SQL-injection vulnerability was recently discovered and reported - to the Revive Adserver team by Florian Sander. The vulnerability is - known to be already exploited to gain unauthorised access to the - application using brute force mechanisms, however other kind of - attacks might be possible and/or already in use. The risk is rated - to be critical as the most common end goal of the attackers is to - spread malware to the visitors of all the websites and ad networks - that the ad server is being used on.

-

The vulnerability is also present and exploitable in OpenX Source - 2.8.11 and earlier versions, potentially back to phpAdsNew 2.0.x.

-
- - - - http://www.revive-adserver.com/security/revive-sa-2013-001/ - http://www.kreativrauschen.com/blog/2013/12/18/zero-day-vulnerability-in-openx-source-2-8-11-and-revive-adserver-3-0-1/ - CVE-2013-7149 - - - 2013-12-20 - 2013-12-22 - - - - - cURL library -- cert name check ignore with GnuTLS - - - curl - 7.21.47.33.0_2 - - - - -

cURL project reports:

-
-

libcurl is vulnerable to a case of missing out the checking - of the certificate CN or SAN name field when the digital - signature verification is turned off.

-

libcurl offers two separate and independent options for - verifying a server's TLS certificate. CURLOPT_SSL_VERIFYPEER - and CURLOPT_SSL_VERIFYHOST. The first one tells libcurl to - verify the trust chain using a CA cert bundle, while the - second tells libcurl to make sure that the name fields in - the server certificate meets the criteria. Both options are - enabled by default.

-

This flaw had the effect that when an application disabled - CURLOPT_SSL_VERIFYPEER, libcurl mistakenly also skipped the - CURLOPT_SSL_VERIFYHOST check. Applications can disable - CURLOPT_SSL_VERIFYPEER and still achieve security by doing - the check on its own using other means.

-

The curl command line tool is not affected by this problem - as it either enables both options or disables both at the - same time.

-
- - - - http://curl.haxx.se/docs/adv_20131217.html - CVE-2013-6422 - - - 2013-12-17 - 2013-12-18 - - - - - gnupg -- RSA Key Extraction via Low-Bandwidth Acoustic Cryptanalysis attack - - - gnupg - 1.4.16 - - - gnupg1 - 1.4.16 - - - - -

Werner Koch reports:

-
-

CVE-2013-4576 has been assigned to this security bug.

-

The paper describes two attacks. The first attack allows - to distinguish keys: An attacker is able to notice which key is - currently used for decryption. This is in general not a problem but - may be used to reveal the information that a message, encrypted to a - commonly not used key, has been received by the targeted machine. We - do not have a software solution to mitigate this attack.

-

The second attack is more serious. It is an adaptive - chosen ciphertext attack to reveal the private key. A possible - scenario is that the attacker places a sensor (for example a standard - smartphone) in the vicinity of the targeted machine. That machine is - assumed to do unattended RSA decryption of received mails, for example - by using a mail client which speeds up browsing by opportunistically - decrypting mails expected to be read soon. While listening to the - acoustic emanations of the targeted machine, the smartphone will send - new encrypted messages to that machine and re-construct the private - key bit by bit. A 4096 bit RSA key used on a laptop can be revealed - within an hour.

-
- - - - CVE-2013-4576 - http://lists.gnupg.org/pipermail/gnupg-announce/2013q4/000337.html - - - 2013-12-18 - 2013-12-18 - 2014-04-30 - - - - - asterisk -- multiple vulnerabilities - - - asterisk10 - 10.12.4 - - - asterisk11 - 11.6.1 - - - asterisk18 - 1.8.24.1 - - - - -

The Asterisk project reports:

-
-

A 16 bit SMS message that contains an odd message length value will - cause the message decoding loop to run forever. The message buffer is - not on the stack but will be overflowed resulting in corrupted memory - and an immediate crash.

-

External control protocols, such as the Asterisk Manager Interface, - often have the ability to get and set channel variables; this allows - the execution of dialplan functions. Dialplan functions within - Asterisk are incredibly powerful, which is wonderful for building - applications using Asterisk. But during the read or write execution, - certain diaplan functions do much more. For example, reading the SHELL() - function can execute arbitrary commands on the system Asterisk is - running on. Writing to the FILE() function can change any file that - Asterisk has write access to. When these functions are executed from an - external protocol, that execution could result in a privilege escalation.

-
- - - - CVE-2013-7100 - http://downloads.asterisk.org/pub/security/AST-2013-006.pdf - http://downloads.asterisk.org/pub/security/AST-2013-007.pdf - https://www.asterisk.org/security - - - 2013-12-16 - 2013-12-17 - - - - - phpmyfaq -- arbitrary PHP code execution vulnerability - - - phpmyfaq - 2.8.4 - - - - -

The phpMyFAQ team reports:

-
-

Secunia noticed while analysing the advisory that authenticated - users with "Right to add attachments" are able to exploit an already - publicly known issue in the bundled Ajax File Manager of phpMyFAQ version - 2.8.3, which leads to arbitrary PHP code execution for authenticated - users with the permission "Right to add attachments".

-
- - - - http://en.securitylab.ru/lab/PT-2013-41 - http://www.phpmyfaq.de/advisory_2013-11-26.php - - - 2013-11-26 - 2013-12-16 - 2013-12-17 - - - - - zabbix -- shell command injection vulnerability - - - zabbix2-agent - 2.0.10 - - - - -

Recurity Labs Team project reports:

-
-

Zabbix agent is vulnerable to remote command execution - from the Zabbix server in some cases.

-
- - - - CVE-2013-6824 - https://support.zabbix.com/browse/ZBX-7479 - - - 2013-12-03 - 2013-12-16 - - - - - PHP5 -- memory corruption in openssl_x509_parse() - - - php5 - 5.4.05.4.23 - - - php53 - 5.3.28 - - - php55 - 5.5.05.5.7 - - - - -

Stefan Esser reports:

-
-

The PHP function openssl_x509_parse() uses a helper function - called asn1_time_to_time_t() to convert timestamps from ASN1 - string format into integer timestamp values. The parser within - this helper function is not binary safe and can therefore be - tricked to write up to five NUL bytes outside of an allocated - buffer.

-

This problem can be triggered by x509 certificates that contain - NUL bytes in their notBefore and notAfter timestamp fields and - leads to a memory corruption that might result in arbitrary - code execution.

-

Depending on how openssl_x509_parse() is used within a PHP - application the attack requires either a malicious cert signed - by a compromised/malicious CA or can be carried out with a - self-signed cert.

-
- - - - CVE-2013-6420 - https://www.sektioneins.de/advisories/advisory-012013-php-openssl_x509_parse-memory-corruption-vulnerability.html - - - 2013-12-13 - 2013-12-14 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 25.0,126.0,1 - 24.2.0,1 - - - linux-firefox - 26.0,1 - - - linux-seamonkey - 2.23 - - - linux-thunderbird - 24.2.0 - - - seamonkey - 2.23 - - - thunderbird - 24.2.0 - - - - -

The Mozilla Project reports:

-
-

MFSA 2013-116 JPEG information leak

-

MFSA 2013-105 Application Installation doorhanger persists on - navigation

-

MFSA 2013-106 Character encoding cross-origin XSS attack

-

MFSA 2013-107 Sandbox restrictions not applied to nested object - elements

-

MFSA 2013-108 Use-after-free in event listeners

-

MFSA 2013-109 Use-after-free during Table Editing

-

MFSA 2013-110 Potential overflow in JavaScript binary search - algorithms

-

MFSA 2013-111 Segmentation violation when replacing ordered list - elements

-

MFSA 2013-112 Linux clipboard information disclosure though - selection paste

-

MFSA 2013-113 Trust settings for built-in roots ignored during EV - certificate validation

-

MFSA 2013-114 Use-after-free in synthetic mouse movement

-

MFSA 2013-115 GetElementIC typed array stubs can be generated - outside observed typesets

-

MFSA 2013-116 JPEG information leak

-

MFSA 2013-117 Mis-issued ANSSI/DCSSI certificate

-
- - - - CVE-2013-5609 - CVE-2013-5610 - CVE-2013-5611 - CVE-2013-5612 - CVE-2013-5613 - CVE-2013-5614 - CVE-2013-5615 - CVE-2013-5616 - CVE-2013-5618 - CVE-2013-5619 - CVE-2013-6629 - CVE-2013-6630 - CVE-2013-6671 - CVE-2013-6672 - CVE-2013-6673 - https://www.mozilla.org/security/announce/2013/mfsa2013-104.html - https://www.mozilla.org/security/announce/2013/mfsa2013-105.html - https://www.mozilla.org/security/announce/2013/mfsa2013-106.html - https://www.mozilla.org/security/announce/2013/mfsa2013-107.html - https://www.mozilla.org/security/announce/2013/mfsa2013-108.html - https://www.mozilla.org/security/announce/2013/mfsa2013-109.html - https://www.mozilla.org/security/announce/2013/mfsa2013-110.html - https://www.mozilla.org/security/announce/2013/mfsa2013-111.html - https://www.mozilla.org/security/announce/2013/mfsa2013-112.html - https://www.mozilla.org/security/announce/2013/mfsa2013-113.html - https://www.mozilla.org/security/announce/2013/mfsa2013-114.html - https://www.mozilla.org/security/announce/2013/mfsa2013-115.html - https://www.mozilla.org/security/announce/2013/mfsa2013-116.html - https://www.mozilla.org/security/announce/2013/mfsa2013-117.html - http://www.mozilla.org/security/known-vulnerabilities/ - - - 2013-12-09 - 2013-12-14 - - - - - samba -- multiple vulnerabilities - - - samba34 - 0 - - - samba35 - 0 - - - samba36 - 3.6.*3.6.22 - - - samba4 - 4.0.*4.0.13 - - - samba41 - 4.1.*4.1.3 - - - - -

The Samba project reports:

-
-

These are security releases in order to address CVE-2013-4408 - (DCE-RPC fragment length field is incorrectly checked) and CVE-2012-6150 - (pam_winbind login without require_membership_of restrictions).

-
- - - - CVE-2012-6150 - CVE-2013-4408 - http://www.samba.org/samba/security/CVE-2012-6150 - http://www.samba.org/samba/security/CVE-2013-4408 - - - 2012-06-12 - 2013-12-11 - - - - - rails -- multiple vulnerabilities - - - rubygem-actionmailer - 3.2.16 - - - rubygem-actionpack - 3.2.16 - - - rubygem-activemodel - 3.2.16 - - - rubygem-activerecord - 3.2.16 - - - rubygem-activeresource - 3.2.16 - - - rubygem-activesupport - 3.2.16 - - - rubygem-rails - 3.2.16 - - - rubygem-railties - 3.2.16 - - - rubygem-actionpack4 - 4.0.2 - - - rubygem-activesupport4 - 4.0.2 - - - - -

Rails weblog:

-
-

Rails 3.2.16 and 4.0.2 have been released! These two - releases contain important security fixes, so please upgrade - as soon as possible! In order to make upgrading as smooth as - possible, we've only included commits directly related to - each security issue.

-

The security fixes in 3.2.16 are:

-
    -
  • CVE-2013-4491
    • -
  • CVE-2013-6414
    • -
  • CVE-2013-6415
    • -
  • CVE-2013-6417
    • -
-

The security fixes in 4.0.2 are:

-
    -
  • CVE-2013-4491
    • -
  • CVE-2013-6414
    • -
  • CVE-2013-6415
    • -
  • CVE-2013-6416
    • -
  • CVE-2013-6417
    • -
-
- - - - CVE-2013-4491 - CVE-2013-6414 - CVE-2013-6415 - CVE-2013-6416 - CVE-2013-6417 - http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released/ - - - 2013-12-03 - 2013-12-08 - 2014-04-23 - - - - - drupal -- multiple vulnerabilities - - - drupal6 - 6.29 - - - drupal7 - 7.24 - - - - -

Drupal Security Team reports:

-
-

Multiple vulnerabilities were fixed in the supported Drupal - core versions 6 and 7.

-
    -
  • Multiple vulnerabilities due to optimistic cross-site - request forgery protection (Form API validation - Drupal 6 - and 7)
    • -
  • Multiple vulnerabilities due to weakness in pseudorandom - number generation using mt_rand() (Form API, OpenID and - random password generation - Drupal 6 and 7)
    • -
  • Code execution prevention (Files directory .htaccess for - Apache - Drupal 6 and 7)
    • -
  • Access bypass (Security token validation - Drupal 6 and 7)
    • -
  • Cross-site scripting (Image module - Drupal 7)
    • -
  • Cross-site scripting (Color module - Drupal 7)
    • -
  • Open redirect (Overlay module - Drupal 7)
    • -
-
- - - - https://drupal.org/SA-CORE-2013-003 - - - 2013-11-20 - 2013-12-06 - - - - - Joomla! -- Core XSS Vulnerabilities - - - joomla2 - 2.5.*2.5.14 - - - joomla3 - 3.0.*3.1.5 - - - - -

The JSST and the Joomla! Security Center report:

-
-

[20131101] Core XSS Vulnerability

-

Inadequate filtering leads to XSS vulnerability in com_contact.

-
-
-

[20131102] Core XSS Vulnerability

-

Inadequate filtering leads to XSS vulnerability in com_contact, com_weblinks, com_newsfeeds.

-
-
-

[20131103] Core XSS Vulnerability

-

Inadequate filtering leads to XSS vulnerability in com_contact.

-
- - - - http://developer.joomla.org/security/570-core-xss-20131101.html - http://developer.joomla.org/security/571-core-xss-20131102.html - http://developer.joomla.org/security/572-core-xss-20131103.html - - - 2013-11-01 - 2013-12-04 - 2014-04-23 - - - - - OpenTTD -- Denial of service using forcefully crashed aircrafts - - - openttd - 0.3.61.3.3 - - - - -

The OpenTTD Team reports:

-
-

The problem is caused by incorrectly handling the fact that - the aircraft circling the corner airport will be outside of the - bounds of the map. In the 'out of fuel' crash code the height - of the tile under the aircraft is determined. In this case - that means a tile outside of the allocated map array, which - could occasionally trigger invalid reads.

-
- - - - CVE-2013-6411 - https://security.openttd.org/en/CVE-2013-6411 - http://bugs.openttd.org/task/5820 - http://vcs.openttd.org/svn/changeset/26134 - - - 2013-11-28 - 2013-11-28 - - - - - monitorix -- serious bug in the built-in HTTP server - - - monitorix - 3.3.1 - - - - -

Monitorix Project reports:

-
-

A serious bug in the built-in HTTP server. It was discovered that the - handle_request() routine did not properly perform input sanitization - which led into a number of security vulnerabilities. An unauthenticated, - remote attacker could exploit this flaw to execute arbitrary commands on - the remote host. All users still using older versions are advised to - upgrade to this version, which resolves this issue.

-
- - - - http://www.monitorix.org/news.html#N331 - https://github.com/mikaku/Monitorix/issues/30 - - - 2013-11-21 - 2013-12-01 - - - - - subversion -- multiple vulnerabilities - - - subversion - 1.4.01.7.14 - 1.8.01.8.5 - - - - -

Subversion Project reports:

-
-

mod_dontdothat does not restrict requests from serf based clients

-

mod_dontdothat allows you to block update REPORT requests against certain - paths in the repository. It expects the paths in the REPORT request - to be absolute URLs. Serf based clients send relative URLs instead - of absolute URLs in many cases. As a result these clients are not blocked - as configured by mod_dontdothat.

-

mod_dav_svn assertion triggered by non-canonical URLs in autoversioning commits

-

When SVNAutoversioning is enabled via SVNAutoversioning on - commits can be made by single HTTP requests such as MKCOL and - PUT. If Subversion is built with assertions enabled any such - requests that have non-canonical URLs, such as URLs with a - trailing /, may trigger an assert. An assert will cause the - Apache process to abort.

-
- - - - CVE-2013-4505 - CVE-2013-4558 - http://subversion.apache.org/security/CVE-2013-4505-advisory.txt - http://subversion.apache.org/security/CVE-2013-4558-advisory.txt - - - 2013-11-15 - 2013-11-25 - - - - - ruby-gems -- Algorithmic Complexity Vulnerability - - - ruby19-gems - 1.8.27 - - - ruby20-gems - 1.8.27 - - - - -

Ruby Gem developers report:

-
-

The patch for CVE-2013-4363 was insufficiently verified so the - combined regular expression for verifying gem version remains - vulnerable following CVE-2013-4363.

-

RubyGems validates versions with a regular expression that is - vulnerable to denial of service due to backtracking. For specially - crafted RubyGems versions attackers can cause denial of service - through CPU consumption.

-
- - - - CVE-2013-4363 - - - 2013-09-24 - 2013-11-24 - - - - - ruby-gems -- Algorithmic Complexity Vulnerability - - - ruby19-gems - 1.8.26 - - - ruby20-gems - 1.8.26 - - - - -

Ruby Gem developers report:

-
-

RubyGems validates versions with a regular expression that is - vulnerable to denial of service due to backtracking. For specially - crafted RubyGems versions attackers can cause denial of service - through CPU consumption.

-
- - - - CVE-2013-4287 - - - 2013-09-09 - 2013-11-24 - - - - - ruby -- Heap Overflow in Floating Point Parsing - - - ruby19 - 1.9.3.484,1 - - - ruby20 - 2.0.0.353,1 - - - - -

Ruby developers report:

-
-

Any time a string is converted to a floating point value, a - specially crafted string can cause a heap overflow. This can lead - to a denial of service attack via segmentation faults and possibly - arbitrary code execution. Any program that converts input of - unknown origin to floating point values (especially common when - accepting JSON) are vulnerable. -

-
- - - - https://www.ruby-lang.org/en/news/2013/11/22/ruby-1-9-3-p484-is-released/ - https://www.ruby-lang.org/en/news/2013/11/22/ruby-2-0-0-p353-is-released/ - CVE-2013-4164 - - - 2013-11-22 - 2013-11-23 - - - - - samba -- Private key in key.pem world readable - - - samba4 - 4.0.*4.0.11 - - - samba41 - 4.1.*4.1.1 - - - - -

The Samba project reports:

-
-

Samba 4.0.x before 4.0.11 and 4.1.x before 4.1.1, when LDAP or HTTP is - provided over SSL, uses world-readable permissions for a private key, - which allows local users to obtain sensitive information by reading the - key file, as demonstrated by access to the local filesystem on an AD - domain controller.

-
- - - - CVE-2013-4476 - http://www.samba.org/samba/security/CVE-2013-4476 - - - 2013-06-12 - 2013-11-19 - - - - - samba -- ACLs are not checked on opening an alternate data stream on a file or directory - - - samba34 - 0 - - - samba35 - 0 - - - samba36 - 3.6.*3.6.20 - - - samba4 - 4.0.*4.0.11 - - - samba41 - 4.1.*4.1.1 - - - - -

The Samba project reports:

-
-

Samba versions 3.2.0 and above (all versions of 3.2.x, 3.3.x, - 3.4.x, 3.5.x, 3.6.x, 4.0.x and 4.1.x) do not check the underlying - file or directory ACL when opening an alternate data stream.

-

According to the SMB1 and SMB2+ protocols the ACL on an underlying - file or directory should control what access is allowed to alternate - data streams that are associated with the file or directory.

-
- - - - CVE-2013-4475 - http://www.samba.org/samba/security/CVE-2013-4475 - - - 2013-06-12 - 2013-11-19 - - - - - nginx -- Request line parsing vulnerability - - - nginx - 0.8.411.4.4,1 - - - nginx-devel - 0.8.411.5.7 - - - - -

The nginx project reports:

-
-

Ivan Fratric of the Google Security Team discovered a bug in nginx, which might - allow an attacker to bypass security restrictions in certain configurations by - using a specially crafted request, or might have potential other impact - (CVE-2013-4547).

-
- - - - CVE-2013-4547 - http://mailman.nginx.org/pipermail/nginx-announce/2013/000125.html - - - 2013-11-19 - 2013-11-19 - - - - - linux-flashplugin -- multiple vulnerabilities - - - linux-f10-flashplugin - 11.2r202.327 - - - - -

Adobe reports:

-
-

These updates address vulnerabilities that could cause a crash - and potentially allow an attacker to take control of the affected system.

-
- - - - CVE-2013-5329 - CVE-2013-5330 - http://www.adobe.com/support/security/bulletins/apsb13-26.html - - - 2013-11-12 - 2013-11-12 - - - - - OpenSSH -- Memory corruption in sshd - - - openssh-portable - 6.2.p2,16.4.p1,1 - - - openssh-portable-base - 6.2.p2,16.4.p1,1 - - - - -

The OpenSSH development team reports:

-
-

A memory corruption vulnerability exists in the post- - authentication sshd process when an AES-GCM cipher - (aes128-gcm@openssh.com or aes256-gcm@openssh.com) is - selected during kex exchange.

-

If exploited, this vulnerability might permit code execution - with the privileges of the authenticated user and may - therefore allow bypassing restricted shell/command - configurations.

-

Either upgrade to 6.4 or disable AES-GCM in the server - configuration. The following sshd_config option will disable - AES-GCM while leaving other ciphers active:

-

Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc

-
- - - - http://www.openssh.com/txt/gcmrekey.adv - - - 2013-11-07 - 2013-11-08 - 2013-11-13 - - - - - Quassel IRC -- SQL injection vulnerability - - - quassel - 0.9.1 - - - - -

Quassel IRC developers report:

-
-

SQL injection vulnerability in Quassel IRC before 0.9.1, - when Qt 4.8.5 or later and PostgreSQL 8.2 or later are used, - allows remote attackers to execute arbitrary SQL commands via - a \ (backslash) in a message.

-
- - - - CVE-2013-4422 - - - 2013-10-07 - 2013-11-06 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 24.1.0,1 - - - linux-firefox - 25.0,1 - - - linux-seamonkey - 2.22 - - - linux-thunderbird - 24.1.0 - - - seamonkey - 2.22 - - - thunderbird - 24.1.0 - - - - -

The Mozilla Project reports:

-
-

MFSA 2013-93 Miscellaneous memory safety hazards (rv:25.0 / - rv:24.1 / rv:17.0.10)

-

MFSA 2013-94 Spoofing addressbar though SELECT element

-

MFSA 2013-95 Access violation with XSLT and uninitialized data

-

MFSA 2013-96 Improperly initialized memory and overflows in some - JavaScript functions

-

MFSA 2013-97 Writing to cycle collected object during image - decoding

-

MFSA 2013-98 Use-after-free when updating offline cache

-

MFSA 2013-99 Security bypass of PDF.js checks using iframes

-

MFSA 2013-100 Miscellaneous use-after-free issues found through - ASAN fuzzing

-

MFSA 2013-101 Memory corruption in workers

-

MFSA 2013-102 Use-after-free in HTML document templates

-
- - - - CVE-2013-1739 - CVE-2013-5590 - CVE-2013-5591 - CVE-2013-5592 - CVE-2013-5593 - CVE-2013-5595 - CVE-2013-5596 - CVE-2013-5597 - CVE-2013-5598 - CVE-2013-5599 - CVE-2013-5600 - CVE-2013-5601 - CVE-2013-5602 - CVE-2013-5603 - CVE-2013-5604 - https://www.mozilla.org/security/announce/2013/mfsa2013-93.html - https://www.mozilla.org/security/announce/2013/mfsa2013-94.html - https://www.mozilla.org/security/announce/2013/mfsa2013-95.html - https://www.mozilla.org/security/announce/2013/mfsa2013-96.html - https://www.mozilla.org/security/announce/2013/mfsa2013-97.html - https://www.mozilla.org/security/announce/2013/mfsa2013-98.html - https://www.mozilla.org/security/announce/2013/mfsa2013-99.html - https://www.mozilla.org/security/announce/2013/mfsa2013-100.html - https://www.mozilla.org/security/announce/2013/mfsa2013-101.html - https://www.mozilla.org/security/announce/2013/mfsa2013-102.html - http://www.mozilla.org/security/known-vulnerabilities/ - - - 2013-10-29 - 2013-10-30 - 2013-10-31 - - - - - mod_pagespeed -- critical cross-site scripting (XSS) vulnerability - - - mod_pagespeed - 1.2.24.2,1 - - - - -

mod_pagespeed developers report:

-
-

Various versions of mod_pagespeed are subject to critical - cross-site scripting (XSS) vulnerability, CVE-2013-6111. This - permits a hostile third party to execute JavaScript in users' - browsers in context of the domain running mod_pagespeed, which - could permit theft of users' cookies or data on the site.

-
- - - - CVE-2013-6111 - - - 2013-10-04 - 2013-10-28 - - - - - - - - - gnutls -- denial of service - - - gnutls3 - 3.1.16 - - - - -

Salvatore Bonaccorso reports:

-
-

This vulnerability affects the DANE library of gnutls 3.1.x and - gnutls 3.2.x. A server that returns more 4 DANE entries could - corrupt the memory of a requesting client.

-
- - - - CVE-2013-4466 - http://www.gnutls.org/security.html#GNUTLS-SA-2013-3 - - - 2013-10-25 - 2013-10-25 - 2013-11-01 - - - - - xorg-server -- use-after-free - - - xorg-server - 1.7.01.7.7_11 - 1.12.01.12.4_4 - - - - -

Alan Coopersmith reports:

-
-

Pedro Ribeiro (pedrib at gmail.com) reported an issue to the X.Org - security team in which an authenticated X client can cause an X - server to use memory after it was freed, potentially leading to - crash and/or memory corruption.

-
- - - - CVE-2013-4396 - http://lists.x.org/archives/xorg-announce/2013-October/002332.html - - - 2013-10-08 - 2013-10-24 - - - - - pycrypto -- PRNG reseed race condition - - - py26-pycrypto - 2.6.1 - - - py27-pycrypto - 2.6.1 - - - py31-pycrypto - 2.6.1 - - - py32-pycrypto - 2.6.1 - - - py33-pycrypto - 2.6.1 - - - - -

Dwayne Litzenberger reports:

-
-

In PyCrypto before v2.6.1, the Crypto.Random pseudo-random - number generator (PRNG) exhibits a race condition that may cause - it to generate the same 'random' output in multiple processes that - are forked from each other. Depending on the application, this - could reveal sensitive information or cryptographic keys to remote - attackers.

-
- - - - CVE-2013-1445 - http://lists.dlitz.net/pipermail/pycrypto/2013q4/000702.html - - - 2013-10-17 - 2013-10-19 - 2014-04-30 - - - - - wordpress -- multiple vulnerabilities - - - zh-wordpress-zh_CN - 3.6.1 - - - zh-wordpress-zh_TW - 3.6.1 - - - de-wordpress - 3.6.1 - - - ja-wordpress - 3.6.1 - - - ru-wordpress - 3.6.1 - - - wordpress - 3.6.1 - - - - -

The wordpress development team reports:

-
-
    -
  • Block unsafe PHP unserialization that could occur in limited - situations and setups, which can lead to remote code - execution.
    • -
  • Prevent a user with an Author role, using a specially crafted - request, from being able to create a post "written by" another - user.
    • -
  • Fix insufficient input validation that could result in - redirecting or leading a user to another website.
    • -
-

Additionally, we've adjusted security restrictions around file - uploads to mitigate the potential for cross-site scripting.

-
- - - - CVE-2013-4338 - CVE-2013-4339 - CVE-2013-4340 - CVE-2013-5738 - CVE-2013-5739 - http://wordpress.org/news/2013/09/wordpress-3-6-1/ - - - 2013-09-11 - 2013-10-19 - 2014-04-30 - - - - - node.js -- DoS Vulnerability - - - node - 0.10.21 - - - node-devel - 0.11.7 - - - - -

node.js developers report

-
-

This release contains a security fix for the http server implementation, please upgrade as soon as possible.

-
- - - - http://blog.nodejs.org/2013/10/18/node-v0-10-21-stable/ - - - 2013-10-19 - 2013-10-19 - - - - - bugzilla -- multiple vulnerabilities - - - bugzilla - 4.0.04.0.11 - - - bugzilla40 - 4.0.04.0.11 - - - bugzilla42 - 4.2.04.2.7 - - - bugzilla44 - 4.44.4.1 - - - - -

A Bugzilla Security Advisory reports:

-
-

Cross-Site Request Forgery

-

When a user submits changes to a bug right after another - user did, a midair collision page is displayed to inform - the user about changes recently made. This page contains - a token which can be used to validate the changes if the - user decides to submit his changes anyway. A regression - in Bugzilla 4.4 caused this token to be recreated if a - crafted URL was given, even when no midair collision page - was going to be displayed, allowing an attacker to bypass - the token check and abuse a user to commit changes on his - behalf.

-

Cross-Site Request Forgery

-

When an attachment is edited, a token is generated to - validate changes made by the user. Using a crafted URL, - an attacker could force the token to be recreated, - allowing him to bypass the token check and abuse a user - to commit changes on his behalf.

-

Cross-Site Scripting

-

Some parameters passed to editflagtypes.cgi were not - correctly filtered in the HTML page, which could lead - to XSS.

-

Cross-Site Scripting

-

Due to an incomplete fix for CVE-2012-4189, some - incorrectly filtered field values in tabular reports - could lead to XSS.

-
- - - - CVE-2013-1733 - https://bugzilla.mozilla.org/show_bug.cgi?id=911593 - CVE-2013-1734 - https://bugzilla.mozilla.org/show_bug.cgi?id=913904 - CVE-2013-1742 - https://bugzilla.mozilla.org/show_bug.cgi?id=924802 - CVE-2013-1743 - https://bugzilla.mozilla.org/show_bug.cgi?id=924932 - - - 2013-10-16 - 2013-10-17 - 2014-04-30 - - - - - dropbear -- exposure of sensitive information, DoS - - - dropbear - 2012.552013.59 - - - - -

The Dropbear project reports:

-
-

A weakness and a vulnerability have been reported in Dropbear - SSH Server, which can be exploited by malicious people to disclose - certain sensitive information and cause a DoS.

-
- - - - 62958 - 62993 - CVE-2013-4421 - CVE-2013-4434 - http://secunia.com/advisories/55173 - - - 2013-05-08 - - 2013-10-17 - - - - - mod_fcgid -- possible heap buffer overwrite - - - ap22-mod_fcgid - 2.3.9 - - - ap24-mod_fcgid - 2.3.9 - - - - -

Apache Project reports:

-
-

Fix possible heap buffer overwrite.

-
- - - - CVE-2013-4365 - - - 2013-09-29 - 2013-10-10 - - - - - gnupg -- possible infinite recursion in the compressed packet parser - - - gnupg - 1.4.15 - 2.0.02.0.22 - - - - -

Werner Koch reports:

-
-

Special crafted input data may be used to cause a denial of service -against GPG (GnuPG's OpenPGP part) and some other OpenPGP -implementations. All systems using GPG to process incoming data are -affected..

-
- - - - CVE-2013-4402 - - - 2013-10-05 - 2013-10-05 - - - - - xinetd -- ignores user and group directives for TCPMUX services - - - xinetd - 2.3.15_1 - - - - -

xinetd would execute configured TCPMUX services without dropping - privilege to match the service configuration allowing the service to - run with same privilege as the xinetd process (root).

- - - - CVE-2013-4342 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=324678 - https://bugzilla.redhat.com/show_bug.cgi?id=1006100 - - - 2005-08-23 - 2013-10-03 - - - - - polarssl -- Timing attack against protected RSA-CRT implementation - - - polarssl - 1.2.9 - - - - -

PolarSSL Project reports:

-
-

The researchers Cyril Arnaud and Pierre-Alain Fouque - investigated the PolarSSL RSA implementation and discovered - a bias in the implementation of the Montgomery multiplication - that we used. For which they then show that it can be used to - mount an attack on the RSA key. Although their test attack is - done on a local system, there seems to be enough indication - that this can properly be performed from a remote system as - well.

-

All versions prior to PolarSSL 1.2.9 and 1.3.0 are affected - if a third party can send arbitrary handshake messages to your - server.

-

If correctly executed, this attack reveals the entire private - RSA key after a large number of attack messages (> 600.000 on - a local machine) are sent to show the timing differences.

-
- - - - CVE-2013-5915 - https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2013-05 - https://polarssl.org/tech-updates/releases/polarssl-1.2.9-released - - - 2013-10-01 - 2013-10-02 - - - - - py-graphite-web -- Multiple vulnerabilities - - - py26-graphite-web - 0.9.50.9.11 - - - py27-graphite-web - 0.9.50.9.11 - - - py31-graphite-web - 0.9.50.9.11 - - - py32-graphite-web - 0.9.50.9.11 - - - py33-graphite-web - 0.9.50.9.11 - - - - -

Graphite developers report:

-
-

This release contains several security fixes for cross-site - scripting (XSS) as well as a fix for a remote-execution exploit in - graphite-web (CVE-2013-5903).

-
- - - - CVE-2013-5093 - https://github.com/rapid7/metasploit-framework/pull/2260 - - - 2013-08-21 - 2013-09-30 - 2014-04-30 - - - - - django -- denial-of-service via large passwords - - - py26-django - 1.51.5.4 - 1.41.4.8 - - - py27-django - 1.51.5.4 - 1.41.4.8 - - - py26-django-devel - 20130922,1 - - - py27-django-devel - 20130922,1 - - - - -

The Django project reports:

-
-

These releases address a denial-of-service attack against Django's - authentication framework. All users of Django are encouraged to - upgrade immediately.

-
- - - - CVE-2013-1443 - https://www.djangoproject.com/weblog/2013/sep/15/security/ - - - 2013-09-15 - 2013-09-22 - 2014-04-30 - - - - - FreeBSD -- Cross-mount links between nullfs(5) mounts - - - FreeBSD - 9.19.1_7 - 8.48.4_4 - 8.38.3_11 - - - - -

Problem Description:

-

The nullfs(5) implementation of the VOP_LINK(9) VFS - operation does not check whether the source and target of - the link are both in the same nullfs instance. It is - therefore possible to create a hardlink from a location in - one nullfs instance to a file in another, as long as the - underlying (source) filesystem is the same.

-

Impact:

-

If multiple nullfs views into the same filesystem are - mounted in different locations, a user with read access to - one of these views and write access to another will be able - to create a hard link from the latter to a file in the - former, even though they are, from the user's perspective, - different filesystems. The user may thereby gain write - access to files which are nominally on a read-only - filesystem.

- - - - CVE-2013-5710 - SA-13:13.nullfs - - - 2013-09-10 - 2013-09-19 - 2016-08-09 - - - - - FreeBSD -- Insufficient credential checks in network ioctl(2) - - - FreeBSD - 9.19.1_7 - 8.48.4_4 - 8.38.3_11 - - - - -

Problem Description:

-

As is commonly the case, the IPv6 and ATM network layer - ioctl request handlers are written in such a way that an - unrecognized request is passed on unmodified to the link - layer, which will either handle it or return an error - code.

-

Network interface drivers, however, assume that the - SIOCSIFADDR, SIOCSIFBRDADDR, SIOCSIFDSTADDR and - SIOCSIFNETMASK requests have been handled at the network - layer, and therefore do not perform input validation or - verify the caller's credentials. Typical link-layer actions - for these requests may include marking the interface as "up" - and resetting the underlying hardware.

-

Impact:

-

An unprivileged user with the ability to run arbitrary code - can cause any network interface in the system to perform the - link layer actions associated with a SIOCSIFADDR, - SIOCSIFBRDADDR, SIOCSIFDSTADDR or SIOCSIFNETMASK ioctl - request; or trigger a kernel panic by passing a specially - crafted address structure which causes a network interface - driver to dereference an invalid pointer.

-

Although this has not been confirmed, the possibility that - an attacker may be able to execute arbitrary code in kernel - context cannot be ruled out.

- - - - CVE-2013-5691 - SA-13:12.ifioctl - - - 2013-09-10 - 2013-09-19 - 2016-08-09 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 18.0,124.0,1 - 17.0.9,1 - - - linux-firefox - 17.0.9,1 - - - linux-seamonkey - 2.21 - - - linux-thunderbird - 17.0.9 - - - seamonkey - 2.21 - - - thunderbird - 24.0 - - - - -

The Mozilla Project reports:

-
-

MFSA 2013-76 Miscellaneous memory safety hazards (rv:24.0 / - rv:17.0.9)

-

MFSA 2013-77 Improper state in HTML5 Tree Builder with templates

-

MFSA 2013-78 Integer overflow in ANGLE library

-

MFSA 2013-79 Use-after-free in Animation Manager during stylesheet - cloning

-

MFSA 2013-80 NativeKey continues handling key messages after - widget is destroyed

-

MFSA 2013-81 Use-after-free with select element

-

MFSA 2013-82 Calling scope for new Javascript objects can lead to - memory corruption

-

MFSA 2013-83 Mozilla Updater does not lock MAR file after - signature verification

-

MFSA 2013-84 Same-origin bypass through symbolic links

-

MFSA 2013-85 Uninitialized data in IonMonkey

-

MFSA 2013-86 WebGL Information disclosure through OS X NVIDIA - graphic drivers

-

MFSA 2013-87 Shared object library loading from writable location

-

MFSA 2013-88 compartment mismatch re-attaching XBL-backed nodes

-

MFSA 2013-89 Buffer overflow with multi-column, lists, and floats

-

MFSA 2013-90 Memory corruption involving scrolling

-

MFSA 2013-91 User-defined properties on DOM proxies get the wrong - "this" object

-

MFSA 2013-92 GC hazard with default compartments and frame chain - restoration

-
- - - - CVE-2013-1718 - CVE-2013-1719 - CVE-2013-1720 - CVE-2013-1721 - CVE-2013-1722 - CVE-2013-1723 - CVE-2013-1724 - CVE-2013-1725 - CVE-2013-1726 - CVE-2013-1727 - CVE-2013-1728 - CVE-2013-1729 - CVE-2013-1730 - CVE-2013-1731 - CVE-2013-1732 - CVE-2013-1735 - CVE-2013-1736 - CVE-2013-1737 - CVE-2013-1738 - https://www.mozilla.org/security/announce/2013/mfsa2013-76.html - https://www.mozilla.org/security/announce/2013/mfsa2013-77.html - https://www.mozilla.org/security/announce/2013/mfsa2013-78.html - https://www.mozilla.org/security/announce/2013/mfsa2013-79.html - https://www.mozilla.org/security/announce/2013/mfsa2013-80.html - https://www.mozilla.org/security/announce/2013/mfsa2013-81.html - https://www.mozilla.org/security/announce/2013/mfsa2013-82.html - https://www.mozilla.org/security/announce/2013/mfsa2013-83.html - https://www.mozilla.org/security/announce/2013/mfsa2013-84.html - https://www.mozilla.org/security/announce/2013/mfsa2013-85.html - https://www.mozilla.org/security/announce/2013/mfsa2013-86.html - https://www.mozilla.org/security/announce/2013/mfsa2013-87.html - https://www.mozilla.org/security/announce/2013/mfsa2013-88.html - https://www.mozilla.org/security/announce/2013/mfsa2013-89.html - https://www.mozilla.org/security/announce/2013/mfsa2013-90.html - https://www.mozilla.org/security/announce/2013/mfsa2013-91.html - https://www.mozilla.org/security/announce/2013/mfsa2013-92.html - http://www.mozilla.org/security/known-vulnerabilities/ - - - 2013-08-17 - 2013-08-18 - 2013-09-19 - - - - - linux-flashplugin -- multiple vulnerabilities - - - linux-f10-flashplugin - 11.2r202.310 - - - - -

Adobe reports:

-
-

These updates address vulnerabilities that could cause a crash - and potentially allow an attacker to take control of the affected system.

-
- - - - CVE-2013-3361 - CVE-2013-3362 - CVE-2013-3363 - CVE-2013-5324 - http://www.adobe.com/support/security/bulletins/apsb13-21.html - - - 2013-09-10 - 2013-09-13 - - - - - django -- multiple vulnerabilities - - - py26-django - 1.51.5.3 - 1.41.4.7 - - - py27-django - 1.51.5.3 - 1.41.4.7 - - - py26-django-devel - 20130912,1 - - - py27-django-devel - 20130912,1 - - - - -

The Django project reports:

-
-

These releases address a directory-traversal vulnerability in one - of Django's built-in template tags. While this issue requires some - fairly specific factors to be exploitable, we encourage all users - of Django to upgrade promptly.

-
- - - - CVE-2013-4315 - https://www.djangoproject.com/weblog/2013/sep/10/security-releases-issued/ - - - 2013-09-10 - 2013-09-12 - 2014-04-30 - - - - - svnserve is vulnerable to a local privilege escalation vulnerability via symlink attack. - - - subversion - 1.4.01.6.23_2 - 1.7.01.7.13 - 1.8.01.8.3 - - - - -

Subversion Project reports:

-
-

svnserve takes a --pid-file option which creates a file containing the - process id it is running as. It does not take steps to ensure that the file - it has been directed at is not a symlink. If the pid file is in a directory - writeable by unprivileged users, the destination could be replaced by a - symlink allowing for privilege escalation. svnserve does not create a pid - file by default.

-

All versions are only vulnerable when the --pid-file=ARG option is used.

-
- - - - CVE-2013-4277 - http://subversion.apache.org/security/CVE-2013-4277-advisory.txt - - - 2013-08-30 - 2013-09-02 - - - - - cacti -- allow remote attackers to execute arbitrary SQL commands - - - cacti - 0.8.8b - - - - -

Cacti release reports:

-
-

Multiple security vulnerabilities have been fixed:

-
    -
  • SQL injection vulnerabilities
    • -
-
- - - - CVE-2013-1434 - CVE-2013-1435 - http://www.cacti.net/release_notes_0_8_8b.php - - - 2013-08-06 - 2013-08-29 - - - - - asterisk -- multiple vulnerabilities - - - asterisk11 - 11.*11.5.1 - - - asterisk10 - 10.*10.12.3 - - - asterisk18 - 1.8.*1.8.21.1 - - - - -

The Asterisk project reports:

-
-

Remote Crash From Late Arriving SIP ACK With SDP

-

Remote Crash when Invalid SDP is sent in SIP Request

-
- - - - CVE-2013-5641 - CVE-2013-5642 - http://downloads.asterisk.org/pub/security/AST-2013-004.html - http://downloads.asterisk.org/pub/security/AST-2013-005.html - https://www.asterisk.org/security - - - 2013-08-27 - 2013-08-28 - 2013-08-29 - - - - - gstreamer-ffmpeg -- Multiple vulnerabilities in bundled libav - - - gstreamer-ffmpeg - 0.10.13_1 - - - - -
-

Bundled version of libav in gstreamer-ffmpeg contains a number of - vulnerabilities.

-
- - - - CVE-2011-3892 - CVE-2011-3893 - CVE-2011-3895 - CVE-2011-3929 - CVE-2011-3936 - CVE-2011-3937 - CVE-2011-3940 - CVE-2011-3945 - CVE-2011-3947 - CVE-2011-3951 - CVE-2011-3952 - CVE-2011-4031 - CVE-2011-4351 - CVE-2011-4352 - CVE-2011-4353 - CVE-2011-4364 - CVE-2011-4579 - CVE-2012-0848 - CVE-2012-0850 - CVE-2012-0851 - CVE-2012-0852 - CVE-2012-0853 - CVE-2012-0858 - CVE-2012-0947 - CVE-2012-2772 - CVE-2012-2775 - CVE-2012-2777 - CVE-2012-2779 - CVE-2012-2783 - CVE-2012-2784 - CVE-2012-2786 - CVE-2012-2787 - CVE-2012-2788 - CVE-2012-2790 - CVE-2012-2791 - CVE-2012-2793 - CVE-2012-2794 - CVE-2012-2798 - CVE-2012-2800 - CVE-2012-2801 - CVE-2012-2803 - CVE-2012-5144 - http://libav.org/releases/libav-0.7.7.changelog - - - 2013-08-20 - 2013-08-20 - - - - - GnuPG and Libgcrypt -- side-channel attack vulnerability - - - libgcrypt - 1.5.3 - - - linux-f10-libgcrypt - 1.5.3 - - - - -

Werner Koch of the GNU project reports:

-
-

Noteworthy changes in version 1.5.3:

-

Mitigate the Yarom/Falkner flush+reload side-channel attack on RSA secret keys...

-

Note that Libgcrypt is used by GnuPG 2.x and thus this release fixes the above - problem. The fix for GnuPG less than 2.0 can be found in the just released GnuPG - 1.4.14.

-
- - - - CVE-2013-4242 - http://eprint.iacr.org/2013/448 - http://lists.gnupg.org/pipermail/gnupg-announce/2013q3/000329.html - http://lists.gnupg.org/pipermail/gnupg-announce/2013q3/000330.html - - - 2013-07-18 - 2013-08-17 - - - - - puppet -- multiple vulnerabilities - - - puppet - 2.72.7.23 - 3.03.2.4 - - - - -

Puppet Labs reports:

-
-

By using the `resource_type` service, an attacker could - cause puppet to load arbitrary Ruby files from the puppet - master node's file system. While this behavior is not - enabled by default, `auth.conf` settings could be modified - to allow it. The exploit requires local file system access - to the Puppet Master.

-

Puppet Module Tool (PMT) did not correctly control - permissions of modules it installed, instead transferring - permissions that existed when the module was built.

-
- - - - CVE-2013-4761 - CVE-2013-4956 - http://puppetlabs.com/security/cve/cve-2013-4761/ - http://puppetlabs.com/security/cve/cve-2013-4956/ - - - 2013-07-05 - 2013-08-16 - - - - - lcms2 -- Null Pointer Dereference Denial of Service Vulnerability - - - lcms2 - 2.5 - - - - -

Mageia security team reports:

-
-

It was discovered that Little CMS did not properly verify certain - memory allocations. If a user or automated system using Little CMS - were tricked into opening a specially crafted file, an attacker - could cause Little CMS to crash (CVE-2013-4160). -

-
- - - - CVE-2013-4160 - http://advisories.mageia.org/MGASA-2013-0240.html - https://bugs.mageia.org/show_bug.cgi?id=10816 - - - 2013-07-22 - 2013-08-15 - 2013-08-19 - - - - - polarssl -- denial of service vulnerability - - - polarssl - 1.2.8 - - - - -

Paul Bakker reports:

-
-

A bug in the logic of the parsing of PEM encoded certificates in - x509parse_crt() can result in an infinite loop, thus hogging processing - power.

-

While parsing a Certificate message during the SSL/TLS handshake, - PolarSSL extracts the presented certificates and sends them on to - be parsed. As the RFC specifies that the certificates in the - Certificate message are always X.509 certificates in DER format, - bugs in the decoding of PEM certificates should normally not be - triggerable via the SSL/TLS handshake.

-

Versions of PolarSSL prior to 1.1.7 in the 1.1 branch and prior - to 1.2.8 in the 1.2 branch call the generic x509parse_crt() - function for parsing during the handshake. x509parse_crt() is a - generic functions that wraps parsing of both PEM-encoded and - DER-formatted certificates. As a result it is possible to craft - a Certificate message that includes a PEM encoded certificate in - the Certificate message that triggers the infinite loop.

-
- - - - CVE-2013-4623 - https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2013-03 - - - 2013-06-21 - 2013-08-13 - 2013-08-15 - - - - - samba -- denial of service vulnerability - - - samba34 - 0 - - - samba35 - 0 - - - samba36 - 3.6.*3.6.17 - - - samba4 - 4.0.*4.0.8 - - - - -

The Samba project reports:

-
-

All current released versions of Samba are vulnerable to - a denial of service on an authenticated or guest connection. - A malformed packet can cause the smbd server to loop the CPU - performing memory allocations and preventing any further service.

-

A connection to a file share, or a local account is needed - to exploit this problem, either authenticated or unauthenticated - if guest connections are allowed.

-
- - - - CVE-2013-4124 - http://www.samba.org/samba/security/CVE-2013-4124 - - - 2013-08-05 - 2013-08-09 - 2013-08-09 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 18.0,123.0,1 - 17.0.8,1 - - - linux-firefox - 17.0.8,1 - - - linux-seamonkey - 2.20 - - - linux-thunderbird - 17.0.8 - - - seamonkey - 2.20 - - - thunderbird - 11.017.0.8 - - - - -

The Mozilla Project reports:

-
-

MFSA 2013-63 Miscellaneous memory safety hazards (rv:23.0 / - rv:17.0.8)

-

MFSA 2013-64 Use after free mutating DOM during SetBody

-

MFSA 2013-65 Buffer underflow when generating CRMF requests

-

MFSA 2013-66 Buffer overflow in Mozilla Maintenance Service and - Mozilla Updater

-

MFSA 2013-67 Crash during WAV audio file decoding

-

MFSA 2013-68 Document URI misrepresentation and masquerading

-

MFSA 2013-69 CRMF requests allow for code execution and XSS - attacks

-

MFSA 2013-70 Bypass of XrayWrappers using XBL Scopes

-

MFSA 2013-71 Further Privilege escalation through Mozilla Updater

-

MFSA 2013-72 Wrong principal used for validating URI for some - Javascript components

-

MFSA 2013-73 Same-origin bypass with web workers and - XMLHttpRequest

-

MFSA 2013-74 Firefox full and stub installer DLL hijacking

-

MFSA 2013-75 Local Java applets may read contents of local file - system

-
- - - - CVE-2013-1701 - CVE-2013-1702 - CVE-2013-1704 - CVE-2013-1705 - CVE-2013-1706 - CVE-2013-1707 - CVE-2013-1708 - CVE-2013-1709 - CVE-2013-1710 - CVE-2013-1711 - CVE-2013-1712 - CVE-2013-1713 - CVE-2013-1714 - CVE-2013-1715 - CVE-2013-1717 - https://www.mozilla.org/security/announce/2013/mfsa2013-63.html - https://www.mozilla.org/security/announce/2013/mfsa2013-64.html - https://www.mozilla.org/security/announce/2013/mfsa2013-65.html - https://www.mozilla.org/security/announce/2013/mfsa2013-66.html - https://www.mozilla.org/security/announce/2013/mfsa2013-67.html - https://www.mozilla.org/security/announce/2013/mfsa2013-68.html - https://www.mozilla.org/security/announce/2013/mfsa2013-69.html - https://www.mozilla.org/security/announce/2013/mfsa2013-70.html - https://www.mozilla.org/security/announce/2013/mfsa2013-71.html - https://www.mozilla.org/security/announce/2013/mfsa2013-72.html - http://www.mozilla.org/security/known-vulnerabilities/ - - - 2013-08-06 - 2013-08-08 - - - - - PuTTY -- Four security holes in versions before 0.63 - - - putty - 0.63 - - - - -

Simon Tatham reports:

-
-

This [0.63] release fixes multiple security holes in previous versions of - PuTTY, which can allow an SSH-2 server to make PuTTY overrun or - underrun buffers and crash. [...] -

- These vulnerabilities can be triggered before host key verification, - which means that you are not even safe if you trust the server you - think you're connecting to, since it could be spoofed over the - network and the host key check would not detect this before the attack - could take place. -

- Additionally, when PuTTY authenticated with a user's private key, the - private key or information equivalent to it was accidentally kept in - PuTTY's memory for the rest of its run, where it could be retrieved by - other processes reading PuTTY's memory, or written out to swap files - or crash dumps. This release fixes that as well.

-
- - - - CVE-2013-4206 - CVE-2013-4207 - CVE-2013-4208 - CVE-2013-4852 - http://lists.tartarus.org/pipermail/putty-announce/2013/000018.html - http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-modmul.html - http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-bignum-division-by-zero.html - http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-wiped.html - http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-signature-stringlen.html - - - 2013-07-08 - 2013-08-07 - - - - - typo3 -- Multiple vulnerabilities in TYPO3 Core - - - typo3 - 4.5.04.5.29 - 4.7.04.7.14 - 6.1.06.1.3 - - - - -

Typo Security Team reports:

-
-

It has been discovered that TYPO3 Core is vulnerable to - Cross-Site Scripting and Remote Code Execution.

-

TYPO3 bundles flash files for video and audio playback. Old - versions of FlowPlayer and flashmedia are susceptible to - Cross-Site Scripting. No authentication is required to exploit - this vulnerability.

-

The file upload component and the File Abstraction Layer are - failing to check for denied file extensions, which allows - authenticated editors (even with limited permissions) to - upload php files with arbitrary code, which can then be - executed in web server's context.

-
- - - - CVE-2011-3642 - CVE-2013-1464 - - - 2013-07-30 - 2013-08-05 - - - - - phpMyAdmin -- clickJacking protection can be bypassed - - - phpMyAdmin - 4.0.5 - - - - -

The phpMyAdmin development team reports:

-
-

phpMyAdmin has a number of mechanisms to avoid a - clickjacking attack, however these mechanisms either work - only in modern browser versions, or can be bypassed.

-

"We have no solution for 3.5.x, due to the proposed - solution requiring JavaScript. We don't want to introduce a - dependency to JavaScript in the 3.5.x family."

-
- - - - http://www.phpmyadmin.net/home_page/security/PMASA-2013-10.php - - - 2013-08-04 - 2013-08-04 - - - - - phpMyAdmin -- multiple vulnerabilities - - - phpMyAdmin - 4.04.0.4.2 - - - phpMyAdmin35 - 3.53.5.8.2 - - - - -

The phpMyAdmin development team reports:

-
-

XSS due to unescaped HTML Output when executing a SQL query.

-
-
-

5 XSS vulnerabilities in setup, chart display, process - list, and logo link.

-
-
-

If a crafted version.json would be presented, an XSS - could be introduced.

-
-
-

Full path disclosure vulnerabilities.

-
-
-

XSS vulnerability when a text to link transformation is - used.

-
-
-

Self-XSS due to unescaped HTML output in schema - export.

-
-
-

SQL injection vulnerabilities, producing a privilege - escalation (control user).

-
- - - - http://www.phpmyadmin.net/home_page/security/PMASA-2013-8.php - http://www.phpmyadmin.net/home_page/security/PMASA-2013-9.php - http://www.phpmyadmin.net/home_page/security/PMASA-2013-11.php - http://www.phpmyadmin.net/home_page/security/PMASA-2013-12.php - http://www.phpmyadmin.net/home_page/security/PMASA-2013-13.php - http://www.phpmyadmin.net/home_page/security/PMASA-2013-14.php - http://www.phpmyadmin.net/home_page/security/PMASA-2013-15.php - http://sourceforge.net/projects/phpmyadmin/files/phpMyAdmin/3.5.8.2/phpMyAdmin-3.5.8.2-notes.html/view - http://sourceforge.net/projects/phpmyadmin/files/phpMyAdmin/4.0.4.2/phpMyAdmin-4.0.4.2-notes.html/view - - - 2013-07-28 - 2013-07-28 - 2013-07-29 - - - - - wordpress -- multiple vulnerabilities - - - wordpress - 3.5.2,1 - - - zh-wordpress-zh_CN - 3.5.2 - - - zh-wordpress-zh_TW - 3.5.2 - - - de-wordpress - 3.5.2 - - - ja-wordpress - 3.5.2 - - - ru-wordpress - 3.5.2 - - - - -

The wordpress development team reports:

-
-
    -
  • Blocking server-side request forgery attacks, which could - potentially enable an attacker to gain access to a site
    • -
  • Disallow contributors from improperly publishing posts
    • -
  • An update to the SWFUpload external library to fix cross-site - scripting vulnerabilities
    • -
  • Prevention of a denial of service attack, affecting sites - using password-protected posts
    • -
  • An update to an external TinyMCE library to fix a cross-site - scripting vulnerability
    • -
  • Multiple fixes for cross-site scripting
    • -
  • Avoid disclosing a full file path when a upload fails
    • -
-
- - - - CVE-2013-2199 - CVE-2013-2200 - CVE-2013-2201 - CVE-2013-2202 - CVE-2013-2203 - CVE-2013-2204 - CVE-2013-2205 - https://wordpress.org/news/2013/06/wordpress-3-5-2/ - - - 2013-06-21 - 2013-07-27 - 2014-04-30 - - - - - bind -- denial of service vulnerability - - - bind99 - 9.9.39.9.3.2 - - - bind99-base - 9.9.39.9.3.2 - - - bind98 - 9.8.59.8.5.2 - - - bind98-base - 9.8.59.8.5.2 - - - FreeBSD - 9.09.1_5 - 8.48.4_2 - - - - -

ISC reports:

-
-

A specially crafted query that includes malformed - rdata can cause named to terminate with an assertion - failure while rejecting the malformed query.

-
- - - - CVE-2013-4854 - SA-13:07.bind - https://kb.isc.org/article/AA-01015/0 - - - 2013-07-26 - 2013-07-26 - 2016-08-09 - - - - - gnupg -- side channel attack on RSA secret keys - - - gnupg - 1.4.14 - - - - -

A Yarom and Falkner paper reports:

-
-

Flush+Reload is a cache side-channel attack that monitors access to - data in shared pages. In this paper we demonstrate how to use the - attack to extract private encryption keys from GnuPG. The high - resolution and low noise of the Flush+Reload attack enables a spy - program to recover over 98% of the bits of the private key in a - single decryption or signing round. Unlike previous attacks, the - attack targets the last level L3 cache. Consequently, the spy - program and the victim do not need to share the execution core of - the CPU. The attack is not limited to a traditional OS and can be - used in a virtualised environment, where it can attack programs - executing in a different VM.

-
- - - - http://eprint.iacr.org/2013/448 - http://lists.gnupg.org/pipermail/gnupg-announce/2013q3/000330.html - - - 2013-07-18 - 2013-07-25 - 2013-07-26 - - - - - openafs -- single-DES cell-wide key brute force vulnerability - - - openafs - 1.6.5 - - - - -

OpenAFS Project reports:

-
-

The small size of the DES key space permits an attacker to brute - force a cell's service key and then forge traffic from any user - within the cell. The key space search can be performed in under 1 - day at a cost of around $100 using publicly available services.

-
- - - - CVE-2013-4134 - http://openafs.org/pages/security/OPENAFS-SA-2013-003.txt - http://openafs.org/pages/security/how-to-rekey.txt - http://openafs.org/pages/security/install-rxkad-k5-1.6.txt - - - 2013-07-24 - 2013-07-25 - - - - - subversion -- remotely triggerable "Assertion failed" DoS vulnerability or read overflow. - - - subversion - 1.8.01.8.1 - 1.7.01.7.11 - - - - -

Subversion Project reports:

-
-

Subversion's mod_dav_svn Apache HTTPD server module will trigger an assertion - on some requests made against a revision root. This can lead to a DoS. - If assertions are disabled it will trigger a read overflow which may cause a - SEGFAULT (or equivalent) or undefined behavior.

-

Commit access is required to exploit this.

-
- - - - CVE-2013-4131 - http://subversion.apache.org/security/CVE-2013-4131-advisory.txt - - - 2013-07-19 - 2013-07-24 - 2013-07-25 - - - - - suPHP -- Privilege escalation - - - suphp - 0.7.2 - - - - -

suPHP developer Sebastian Marsching reports:

-
-

When the suPHP_PHPPath was set, mod_suphp would use the specified PHP - executable to pretty-print PHP source files (MIME type - x-httpd-php-source or application/x-httpd-php-source).

-

However, it would not sanitize the environment. Thus a user that was - allowed to use the SetEnv directive in a .htaccess file (AllowOverride - FileInfo) could make PHP load a malicious configuration file (e.g. - loading malicious extensions).

-

As the PHP process for highlighting the source file was run with the - privileges of the user Apache HTTPd was running as, a local attacker - could probably execute arbitrary code with the privileges of this user.

-
- - - - https://lists.marsching.com/pipermail/suphp/2013-May/002552.html - - - 2013-05-20 - 2013-07-22 - - - - - apache24 -- several vulnerabilities - - - apache24 - 2.4.6 - - - - -

Apache HTTP SERVER PROJECT reports:

-
-

mod_dav: Sending a MERGE request against a URI handled by mod_dav_svn - with the source href (sent as part of the request body as XML) pointing - to a URI that is not configured for DAV will trigger a segfault.

-

mod_session_dbd: Make sure that dirty flag is respected when saving - sessions, and ensure the session ID is changed each time the session - changes. This changes the format of the updatesession SQL statement. - Existing configurations must be changed.

-
- - - - CVE-2013-1896 - CVE-2013-2249 - http://www.apache.org/dist/httpd/Announcement2.4.html - - - 2013-07-11 - 2013-07-20 - 2013-07-21 - - - - - gallery -- multiple vulnerabilities - - - gallery3 - 3.0.9 - - - - -

Red Hat Security Response Team reports:

-
-

Gallery upstream has released 3.0.9 version, correcting two - security flaws:

-

Issue #1 - Improper stripping of URL fragments in flowplayer - SWF file might lead to reply attacks (a different flaw than - CVE-2013-2138).

-

Issue #2 - gallery3: Multiple information exposure flaws in - data rest core module.

-
- - - - CVE-2013-2240 - CVE-2013-2241 - http://sourceforge.net/apps/trac/gallery/ticket/2073 - https://bugzilla.redhat.com/show_bug.cgi?id=981197 - http://sourceforge.net/apps/trac/gallery/ticket/2074 - https://bugzilla.redhat.com/show_bug.cgi?id=981198 - http://galleryproject.org/gallery_3_0_9 - - - 2013-06-28 - 2013-07-17 - - - - - PHP5 -- Heap corruption in XML parser - - - php53 - 5.3.27 - - - - -

The PHP development team reports:

-
-

ext/xml/xml.c in PHP before 5.3.27 does not properly - consider parsing depth, which allows remote attackers to - cause a denial of service (heap memory corruption) or - possibly have unspecified other impact via a crafted - document that is processed by the xml_parse_into_struct - function.

-
- - - - CVE-2013-4113 - https://bugs.php.net/bug.php?id=65236 - - - 2013-07-10 - 2013-07-16 - - - - - PHP5 -- Integer overflow in Calendar module - - - php5 - 5.4.05.4.16 - - - php53 - 5.3.26 - - - - -

The PHP development team reports:

-
-

Integer overflow in the SdnToJewish function in jewish.c - in the Calendar component in PHP before 5.3.26 and 5.4.x - before 5.4.16 allows context-dependent attackers to cause a - denial of service (application hang) via a large argument to - the jdtojewish function.

-
- - - - CVE-2013-4635 - https://bugs.php.net/bug.php?id=64895 - - - 2013-05-22 - 2013-07-16 - - - - - linux-flashplugin -- multiple vulnerabilities - - - linux-f10-flashplugin - 11.2r202.297 - - - - -

Adobe reports:

-
-

These updates address vulnerabilities that could cause a crash - and potentially allow an attacker to take control of the affected system.

-
- - - - CVE-2013-3344 - CVE-2013-3345 - CVE-2013-3347 - http://www.adobe.com/support/security/bulletins/apsb13-17.html - - - 2013-07-09 - 2013-07-15 - 2013-07-18 - - - - - squid -- denial of service - - - squid - 3.23.2.12 - 3.33.3.8 - - - - -

Squid project reports:

-
-

Due to incorrect data validation Squid is vulnerable to a - denial of service attack when processing specially crafted - HTTP requests

-

This problem allows any client who can generate HTTP requests - to perform a denial of service attack on the Squid service.

-
- - - - CVE-2013-4123 - http://www.squid-cache.org/Advisories/SQUID-2013_3.txt - - - 2013-07-13 - 2013-07-15 - - - - - libzrtpcpp -- multiple security vulnerabilities - - - libzrtpcpp - 2.3.4 - - - - -

Mark Dowd reports:

-
-

Vulnerability 1. Remote Heap Overflow: If an attacker sends a - packet larger than 1024 bytes that gets stored temporarily (which - occurs many times - such as when sending a ZRTP Hello packet), a - heap overflow will occur, leading to potential arbitrary code - execution on the vulnerable host.

-

Vulnerability 2. Multiple Stack Overflows: ZRTPCPP contains - multiple stack overflows that arise when preparing a response - to a client's ZRTP Hello packet.

-

Vulnerability 3. Information Leaking / Out of Bounds Reads: - The ZRTPCPP library performs very little validation regarding the - expected size of a packet versus the actual amount of data - received. This can lead to both information leaking and out - of bounds data reads (usually resulting in a crash). - Information leaking can be performed for example by sending - a malformed ZRTP Ping packet.

-
- - - - CVE-2013-2221 - CVE-2013-2222 - CVE-2013-2223 - - - 2013-06-27 - 2013-07-11 - - - - - ruby -- Hostname check bypassing vulnerability in SSL client - - - ruby19 - 1.9.3.448,1 - - - ruby18 - 1.8.7.374,1 - - - - -

Ruby Developers report:

-
-

Ruby's SSL client implements hostname identity check but it does - not properly handle hostnames in the certificate that contain null - bytes. -

-
- - - - CVE-2013-4073 - http://www.ruby-lang.org/en/news/2013/06/27/hostname-check-bypassing-vulnerability-in-openssl-client-cve-2013-4073/ - - - 2013-06-27 - 2013-07-11 - 2013-09-24 - - - - - otrs -- Sql Injection + Xss Issue - - - otrs - 3.2.9 - - - - -

The OTRS Project reports:

-
-

An attacker with a valid agent login could manipulate URLs leading to SQL injection. An attacker with a valid agent login could manipulate URLs in the ITSM ConfigItem search, leading to a JavaScript code injection (XSS) problem.

-
- - - - CVE-2013-4717 - CVE-2013-4718 - http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-05/ - - - 2013-07-09 - 2013-07-11 - - - - - apache22 -- several vulnerabilities - - - apache22 - 2.2.02.2.25 - - - apache22-event-mpm - 2.2.02.2.25 - - - apache22-itk-mpm - 2.2.02.2.25 - - - apache22-peruser-mpm - 2.2.02.2.25 - - - apache22-worker-mpm - 2.2.02.2.25 - - - - -

Apache HTTP SERVER PROJECT reports:

-
-

The mod_rewrite module in the Apache HTTP Server 2.2.x before - 2.2.25 writes data to a log file without sanitizing - non-printable characters, which might allow remote attackers to - execute arbitrary commands via an HTTP request containing an - escape sequence for a terminal emulator.

-

mod_dav: Sending a MERGE request against a URI handled by - mod_dav_svn with the source href (sent as part of the request - body as XML) pointing to a URI that is not configured for DAV - will trigger a segfault.

-
- - - - CVE-2013-1862 - CVE-2013-1896 - - - 2013-06-21 - 2013-07-05 - 2013-07-10 - - - - - phpMyAdmin -- Global variable scope injection - - - phpMyAdmin - 4.04.0.4.1 - - - - -

The phpMyAdmin development team reports:

-
-

The import.php script was vulnerable to GLOBALS variable - injection. Therefore, an attacker could manipulate any - configuration parameter.

-

This vulnerability can be triggered only by someone who - logged in to phpMyAdmin, as the usual token protection - prevents non-logged-in users from accessing the required - form.

-
- - - - http://www.phpmyadmin.net/home_page/security/PMASA-2013-7.php - CVE-2013-4729 - - - 2013-06-30 - 2013-06-30 - - - - - apache-xml-security-c -- heap overflow during XPointer evaluation - - - apache-xml-security-c - 1.7.2 - - - - -

The Apache Software Foundation reports:

-
-

The attempted fix to address CVE-2013-2154 introduced the - possibility of a heap overflow, possibly leading to arbitrary code - execution, in the processing of malformed XPointer expressions in the - XML Signature Reference processing code.

-
- - - - CVE-2013-2210 - http://santuario.apache.org/secadv.data/CVE-2013-2210.txt - - - 2013-06-27 - 2013-06-28 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 18.0,122.0,1 - 17.0.7,1 - - - linux-firefox - 17.0.7,1 - - - linux-seamonkey - 2.19 - - - linux-thunderbird - 17.0.7 - - - seamonkey - 2.19 - - - thunderbird - 11.017.0.7 - - - - -

The Mozilla Project reports:

-
-

Miscellaneous memory safety hazards (rv:22.0 / rv:17.0.7)

-

Title: Memory corruption found using Address Sanitizer

-

Privileged content access and execution via XBL

-

Arbitrary code execution within Profiler

-

Execution of unmapped memory through onreadystatechange

-

Data in the body of XHR HEAD requests leads to CSRF attacks

-

SVG filters can lead to information disclosure

-

PreserveWrapper has inconsistent behavior

-

Sandbox restrictions not applied to nested frame elements

-

X-Frame-Options ignored when using server push with multi-part - responses

-

XrayWrappers can be bypassed to run user defined methods in a - privileged context

-

getUserMedia permission dialog incorrectly displays location

-

Homograph domain spoofing in .com, .net and .name

-

Inaccessible updater can lead to local privilege escalation

-
- - - - CVE-2013-1682 - CVE-2013-1683 - CVE-2013-1684 - CVE-2013-1685 - CVE-2013-1686 - CVE-2013-1687 - CVE-2013-1688 - CVE-2013-1690 - CVE-2013-1692 - CVE-2013-1693 - CVE-2013-1694 - CVE-2013-1695 - CVE-2013-1696 - CVE-2013-1697 - CVE-2013-1698 - CVE-2013-1699 - CVE-2013-1700 - http://www.mozilla.org/security/announce/2013/mfsa2013-49.html - http://www.mozilla.org/security/announce/2013/mfsa2013-50.html - http://www.mozilla.org/security/announce/2013/mfsa2013-51.html - http://www.mozilla.org/security/announce/2013/mfsa2013-52.html - http://www.mozilla.org/security/announce/2013/mfsa2013-53.html - http://www.mozilla.org/security/announce/2013/mfsa2013-54.html - http://www.mozilla.org/security/announce/2013/mfsa2013-55.html - http://www.mozilla.org/security/announce/2013/mfsa2013-56.html - http://www.mozilla.org/security/announce/2013/mfsa2013-57.html - http://www.mozilla.org/security/announce/2013/mfsa2013-58.html - http://www.mozilla.org/security/announce/2013/mfsa2013-59.html - http://www.mozilla.org/security/announce/2013/mfsa2013-60.html - http://www.mozilla.org/security/announce/2013/mfsa2013-61.html - http://www.mozilla.org/security/announce/2013/mfsa2013-62.html - http://www.mozilla.org/security/known-vulnerabilities/ - - - 2013-06-25 - 2013-06-26 - - - - - cURL library -- heap corruption in curl_easy_unescape - - - curl - 7.77.24.0_4 - - - - -

cURL developers report:

-
-

libcurl is vulnerable to a case of bad checking of the - input data which may lead to heap corruption.

-

The function curl_easy_unescape() decodes URL-encoded - strings to raw binary data. URL-encoded octets are - represented with %HH combinations where HH is a two-digit - hexadecimal number. The decoded string is written to an - allocated memory area that the function returns to the - caller.

-

The function takes a source string and a length - parameter, and if the length provided is 0 the function will - instead use strlen() to figure out how much data to - parse.

-

The "%HH" parser wrongly only considered the case where a - zero byte would terminate the input. If a length-limited - buffer was passed in which ended with a '%' character which - was followed by two hexadecimal digits outside of the buffer - libcurl was allowed to parse alas without a terminating - zero, libcurl would still parse that sequence as well. The - counter for remaining data to handle would then be decreased - too much and wrap to become a very large integer and the - copying would go on too long and the destination buffer that - is allocated on the heap would get overwritten.

-

We consider it unlikely that programs allow user-provided - strings unfiltered into this function. Also, only the not - zero-terminated input string use case is affected by this - flaw. Exploiting this flaw for gain is probably possible for - specific circumstances but we consider the general risk for - this to be low.

-

The curl command line tool is not affected by this - problem as it doesn't use this function.

-

There are no known exploits available at this time.

-
- - - - CVE-2013-2174 - http://curl.haxx.se/docs/adv_20130622.html - - - 2013-06-22 - 2013-06-23 - 2013-07-01 - - - - - puppet -- Unauthenticated Remote Code Execution Vulnerability - - - puppet - 2.72.7.22 - 3.03.2.2 - - - - -

Puppet Developers report:

-
-

When making REST api calls, the puppet master takes YAML from an - untrusted client, deserializes it, and then calls methods on the - resulting object. A YAML payload can be crafted to cause the - deserialization to construct an instance of any class available in - the ruby process, which allows an attacker to execute code - contained in the payload. -

-
- - - - CVE-2013-3567 - - - 2013-06-13 - 2013-06-22 - 2013-08-01 - - - - - otrs -- information disclosure - - - otrs - 3.2.8 - - - - -

The OTRS Project reports:

-
-

An attacker with a valid agent login could manipulate URLs in the ticket - watch mechanism to see contents of tickets they are not permitted to see.

-
- - - - CVE-2013-4088 - http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-04/ - - - 2013-06-18 - 2013-06-19 - - - - - FreeBSD -- Privilege escalation via mmap - - - FreeBSD - 9.09.1_4 - - - - -
-

Due to insufficient permission checks in the virtual memory - system, a tracing process (such as a debugger) may be able to - modify portions of the traced process's address space to which - the traced process itself does not have write access.

-
- - - - CVE-2013-2171 - SA-13:06.mmap - - - 2013-06-18 - 2013-06-18 - 2016-08-09 - - - - - apache-xml-security-c -- heap overflow - - - apache-xml-security-c - 1.7.1 - - - - -

The Apache Software Foundation reports:

-
-

A heap overflow exists in the processing of the PrefixList - attribute optionally used in conjunction with Exclusive - Canonicalization, potentially allowing arbitary code execution. - If verification of the signature occurs prior to actual evaluation of a - signing key, this could be exploited by an unauthenticated attacker.

-
- - - - CVE-2013-2156 - http://santuario.apache.org/secadv.data/CVE-2013-2156.txt - - - 2013-06-18 - 2013-06-18 - - - - - tor -- guard discovery - - - tor-devel - 0.2.4.13.a_1 - - - - -

The Tor Project reports:

-
-

Disable middle relay queue overfill detection code due to possible guard discovery attack

-
- - - - https://trac.torproject.org/projects/tor/ticket/9072 - - - 2013-06-15 - 2013-06-16 - - - - - dbus -- local dos - - - dbus - 1.6.12 - - - - -

Simon McVittie reports:

-
-

Alexandru Cornea discovered a vulnerability in libdbus caused - by an implementation bug in _dbus_printf_string_upper_bound(). - This vulnerability can be exploited by a local user to crash - system services that use libdbus, causing denial of service. - It is platform-specific: x86-64 Linux is known to be affected.

-
- - - - CVE-2013-2168 - http://lists.freedesktop.org/archives/dbus/2013-June/015696.html - - - 2013-06-13 - 2013-06-13 - - - - - linux-flashplugin -- multiple vulnerabilities - - - linux-f10-flashplugin - 11.2r202.291 - - - - -

Adobe reports:

-
-

These updates address vulnerabilities that could cause a crash - and potentially allow an attacker to take control of the affected system.

-
- - - - CVE-2013-3343 - - - 2013-06-11 - 2013-06-14 - 2013-06-18 - - - - - owncloud -- Multiple security vulnerabilities - - - owncloud - 5.0.7 - - - - -

The ownCloud development team reports:

-
-

oC-SA-2013-019 / CVE-2013-2045: Multiple SQL Injections. - Credit to Mateusz Goik (aliantsoft.pl).

-

oC-SA-2013-020 / CVE-2013-[2039,2085]: Multiple directory traversals. - Credit to Mateusz Goik (aliantsoft.pl).

-

oC-SQ-2013-021 / CVE-2013-[2040-2042]: Multiple XSS vulnerabilities. - Credit to Mateusz Goik (aliantsoft.pl) and Kacper R. (http://devilteam.pl).

-

oC-SA-2013-022 / CVE-2013-2044: Open redirector. - Credit to Mateusz Goik (aliantsoft.pl).

-

oC-SA-2013-023 / CVE-2013-2047: Password autocompletion.

-

oC-SA-2013-024 / CVE-2013-2043: Privilege escalation in the calendar application. - Credit to Mateusz Goik (aliantsoft.pl).

-

oC-SA-2013-025 / CVE-2013-2048: Privilege escalation and CSRF in the API.

-

oC-SA-2013-026 / CVE-2013-2089: Incomplete blacklist vulnerability.

-

oC-SA-2013-027 / CVE-2013-2086: CSRF token leakage.

-

oC-SA-2013-028 / CVE-2013-[2149-2150]: Multiple XSS vulnerabilities.

-
- - - - http://owncloud.org/about/security/advisories/oC-SA-2013-019/ - http://owncloud.org/about/security/advisories/oC-SA-2013-020/ - http://owncloud.org/about/security/advisories/oC-SA-2013-021/ - http://owncloud.org/about/security/advisories/oC-SA-2013-022/ - http://owncloud.org/about/security/advisories/oC-SA-2013-023/ - http://owncloud.org/about/security/advisories/oC-SA-2013-024/ - http://owncloud.org/about/security/advisories/oC-SA-2013-025/ - http://owncloud.org/about/security/advisories/oC-SA-2013-026/ - http://owncloud.org/about/security/advisories/oC-SA-2013-027/ - http://owncloud.org/about/security/advisories/oC-SA-2013-028/ - CVE-2013-2039 - CVE-2013-2040 - CVE-2013-2041 - CVE-2013-2042 - CVE-2013-2043 - CVE-2013-2044 - CVE-2013-2045 - CVE-2013-2047 - CVE-2013-2048 - CVE-2013-2085 - CVE-2013-2086 - CVE-2013-2089 - CVE-2013-2149 - CVE-2013-2150 - - - 2013-05-14 - 2013-06-11 - - - - - php5 -- Heap based buffer overflow in quoted_printable_encode - - - php5 - 5.4.16 - - - php53 - 5.3.26 - - - - -

The PHP development team reports:

-
-

A Heap-based buffer overflow flaw was found in the php - quoted_printable_encode() function. A remote attacker could use - this flaw to cause php to crash or execute arbirary code with the - permission of the user running php

-
- - - - CVE-2013-2110 - https://bugzilla.redhat.com/show_bug.cgi?id=964969 - - - 2013-06-06 - 2013-06-07 - - - - - dns/bind9* -- A recursive resolver can be crashed by a query for a malformed zone - - - bind99 - 9.9.39.9.3.1 - - - bind99-base - 9.9.39.9.3.1 - - - bind98 - 9.8.59.8.5.1 - - - bind98-base - 9.8.59.8.5.1 - - - bind96 - 9.6.3.1.ESV.R99.6.3.2.ESV.R9 - - - bind96-base - 9.6.3.1.ESV.R99.6.3.2.ESV.R9 - - - - -

ISC reports:

-
-

A bug has been discovered in the most recent releases of - BIND 9 which has the potential for deliberate exploitation - as a denial-of-service attack. By sending a recursive - resolver a query for a record in a specially malformed zone, - an attacker can cause BIND 9 to exit with a fatal - "RUNTIME_CHECK" error in resolver.c.

-
- - - - CVE-2013-3919 - - - 2013-06-04 - 2013-06-06 - 2013-06-07 - - - - - phpMyAdmin -- XSS due to unescaped HTML output in Create View page - - - phpMyAdmin - 4.04.0.3 - - - - -

The phpMyAdmin development team reports:

-
-

When creating a view with a crafted name and an incorrect - CREATE statement, it is possible to trigger an XSS.

-

This vulnerability can be triggered only by someone who - logged in to phpMyAdmin, as the usual token protection - prevents non-logged-in users from accessing the required - form.

-
- - - - http://www.phpmyadmin.net/home_page/security/PMASA-2013-6.php - CVE-2013-3742 - - - 2013-06-05 - 2013-06-05 - - - - - telepathy-gabble -- TLS verification bypass - - - telepathy-gabble - 0.16.6 - - - - -

Simon McVittie reports:

-
-

This release fixes a man-in-the-middle attack.

-

If you use an unencrypted connection to a "legacy Jabber" - (pre-XMPP) server, this version of Gabble will not connect - until you make one of these configuration changes:

-

. upgrade the server software to something that supports XMPP 1.0; or

-

. use an encrypted "old SSL" connection, typically on port 5223 - (old-ssl); or

-

. turn off "Encryption required (TLS/SSL)" (require-encryption).

-
- - - - CVE-2013-1431 - http://lists.freedesktop.org/archives/telepathy/2013-May/006449.html - - - 2013-05-27 - 2013-06-05 - - - - - xorg -- protocol handling issues in X Window System client libraries - - - libX11 - 1.6.0 - - - libXext - 1.3.2 - - - libXfixes - 5.0.1 - - - libXi - 1.7_1 - - - libXinerama - 1.1.3 - - - libXp - 1.0.2 - - - libXrandr - 1.4.1 - - - libXrender - 0.9.7_1 - - - libXres - 1.0.7 - - - libXtst - 1.2.2 - - - libXv - 1.0.8 - - - libXvMC - 1.0.7_1 - - - libXxf86dga - 1.1.4 - - - libdmx - 1.1.3 - - - libxcb - 1.9.1 - - - libGL - 7.6.1_4 - 7.8.08.0.5_4 - - - xf86-video-openchrome - 0.3.3 - - - libFS - 1.0.5 - - - libXxf86vm - 1.1.3 - - - libXt - 1.1.4 - - - libXcursor - 1.1.14 - - - - -

freedesktop.org reports:

-
-

Ilja van Sprundel, a security researcher with IOActive, has - discovered a large number of issues in the way various X client - libraries handle the responses they receive from servers, and has - worked with X.Org's security team to analyze, confirm, and fix - these issues.

-

Most of these issues stem from the client libraries trusting the - server to send correct protocol data, and not verifying that the - values will not overflow or cause other damage. Most of the time X - clients & servers are run by the same user, with the server - more privileged from the clients, so this is not a problem, but - there are scenarios in which a privileged client can be connected - to an unprivileged server, for instance, connecting a setuid X - client (such as a screen lock program) to a virtual X server (such - as Xvfb or Xephyr) which the user has modified to return invalid - data, potentially allowing the user to escalate their privileges.

-

The vulnerabilities include:

-

Integer overflows calculating memory needs for replies.

-

Sign extension issues calculating memory needs for replies.

-

Buffer overflows due to not validating length or offset values in - replies.

-

Integer overflows parsing user-specified files.

-

Unbounded recursion parsing user-specified files.

-

Memory corruption due to unchecked return values.

-
- - - - CVE-2013-1981 - CVE-2013-1982 - CVE-2013-1983 - CVE-2013-1984 - CVE-2013-1985 - CVE-2013-1986 - CVE-2013-1987 - CVE-2013-1988 - CVE-2013-1989 - CVE-2013-1990 - CVE-2013-1991 - CVE-2013-1992 - CVE-2013-1993 - CVE-2013-1994 - CVE-2013-1995 - CVE-2013-1996 - CVE-2013-1997 - CVE-2013-1998 - CVE-2013-1999 - CVE-2013-2000 - CVE-2013-2001 - CVE-2013-2002 - CVE-2013-2003 - CVE-2013-2004 - CVE-2013-2005 - CVE-2013-2062 - CVE-2013-2063 - CVE-2013-2064 - CVE-2013-2066 - - - 2013-05-23 - 2013-06-04 - - - - - krb5 -- UDP ping-pong vulnerability in the kpasswd (password changing) service. [CVE-2002-2443] - - - krb5 - 1.11.2 - - - - -

No advisory has been released yet.

-
-

schpw.c in the kpasswd service in kadmind in MIT Kerberos 5 - (aka krb5) before 1.11.3 does not properly validate UDP packets - before sending responses, which allows remote attackers to cause - a denial of service (CPU and bandwidth consumption) via a forged - packet that triggers a communication loop, as demonstrated by - krb_pingpong.nasl, a related issue to CVE-1999-0103. - [CVE-2002-2443].

-
- - - - CVE-2002-2443 - http://web.mit.edu/kerberos/www/krb5-1.11/ - - - 2013-05-10 - 2013-06-03 - - - - - net/openafs -- buffer overflow - - - openafs - 1.6.2.* - - - - -

Nickolai Zeldovich reports:

-
-

An attacker with the ability to manipulate AFS directory ACLs may - crash the fileserver hosting that volume. - In addition, once a corrupt ACL is placed on a fileserver, its - existence may crash client utilities manipulating ACLs - on that server.

-
- - - - http://www.openafs.org/pages/security/OPENAFS-SA-2013-001.txt - CVE-2013-1794 - - - 2013-02-27 - 2013-06-03 - - - - - www/mod_security -- NULL pointer dereference DoS - - - mod_security - 2.7.3 - - - - -

SecurityFocus reports:

-
-

When ModSecurity receives a request body with a size bigger than the - value set by the "SecRequestBodyInMemoryLimit" and with a "Content-Type" - that has no request body processor mapped to it, ModSecurity will - systematically crash on every call to "forceRequestBodyVariable".

-
- - - - CVE-2013-2765 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-2765 - - - 2013-05-27 - 2013-06-03 - - - - - passenger -- security vulnerability - - - rubygem-passenger - 4.0.5 - - - - -

The Phusion reports:

-
-

A denial of service and arbitrary code execution by hijacking temp files. [CVE-2013-2119]

-
- - - - CVE-2013-2119 - http://blog.phusion.nl/2013/05/29/phusion-passenger-4-0-5-released/ - - - 2013-05-29 - 2013-06-01 - - - - - devel/subversion -- svnserve remotely triggerable DoS - - - subversion - 1.7.01.7.10 - 1.0.01.6.23 - - - - -

Subversion team reports:

-
-

Subversion's svnserve server process may exit when an incoming TCP connection - is closed early in the connection process.

-
- - - - CVE-2013-2112 - - - 2013-05-31 - 2013-05-31 - - - - - devel/subversion -- contrib hook-scripts can allow arbitrary code execution - - - subversion - 1.7.01.7.10 - 1.2.01.6.23 - - - - -

Subversion team reports:

-
-

The script contrib/hook-scripts/check-mime-type.pl does not escape - argv arguments to 'svnlook' that start with a hyphen. This could be - used to cause 'svnlook', and hence check-mime-type.pl, to error out.

-

The script contrib/hook-scripts/svn-keyword-check.pl parses filenames - from the output of 'svnlook changed' and passes them to a further - shell command (equivalent to the 'system()' call of the C standard - library) without escaping them. This could be used to run arbitrary - shell commands in the context of the user whom the pre-commit script - runs as (the user who owns the repository).

-
- - - - CVE-2013-2088 - - - 2013-05-31 - 2013-05-31 - - - - - devel/subversion -- fsfs repositories can be corrupted by newline characters in filenames - - - subversion - 1.7.01.7.10 - 1.1.01.6.23 - - - - -

Subversion team reports:

-
-

If a filename which contains a newline character (ASCII 0x0a) is - committed to a repository using the FSFS format, the resulting - revision is corrupt.

-
- - - - CVE-2013-1968 - - - 2013-05-31 - 2013-05-31 - - - - - irc/bitchx -- multiple vulnerabilities - - - BitchX - 1.2.*,1 - - - - -

bannedit reports:

-
-

Stack-based buffer overflow in BitchX 1.1 Final allows remote IRC - servers to execute arbitrary code via a long string in a MODE - command, related to the p_mode variable.

-
-

Nico Golde reports:

-
-

There is a security issue in ircii-pana in bitchx' hostname - command. The e_hostname function (commands.c) uses tmpnam to - create a temporary file which is known to be insecure.

-
-

Chris reports:

-
-

Chris has reported a vulnerability in the Cypress script for - BitchX, which can be exploited by malicious people to disclose - potentially sensitive information or to compromise a vulnerable - system.

- -

The vulnerability is caused due to malicious code being present - in the modules/mdop.m file. This can be exploited to disclose the - content of various system files or to execute arbitrary shell - commands.

- -

Successful exploitation allows execution of arbitrary code, but - requires the control of the "lsyn.webhop.net" domain.

-
- - - - CVE-2007-4584 - CVE-2007-5839 - CVE-2007-5922 - - - 2007-08-28 - 2013-05-31 - - - - - znc -- null pointer dereference in webadmin module - - - znc - 1.0_1 - - - - -

No advisory has been released yet.

-
-

Fix NULL pointer dereference in webadmin.

-
- - - - https://github.com/znc/znc/commit/2bd410ee5570cea127233f1133ea22f25174eb28 - - - 2013-05-27 - 2013-05-28 - - - - - socat -- FD leak - - - socat - 1.7.2.2 - - - - -

Gerhard Rieger reports:

-
-

Under certain circumstances an FD leak occurs and can be misused for - denial of service attacks against socat running in server mode.

-
- - - - CVE-2013-3571 - http://seclists.org/oss-sec/2013/q2/411 - - - 2013-05-26 - 2013-05-26 - - - - - ruby -- Object taint bypassing in DL and Fiddle in Ruby - - - ruby19 - 1.9.3.429,1 - - - - -

Ruby Developers report:

-
-

There is a vulnerability in DL and Fiddle in Ruby where tainted - strings can be used by system calls regardless of the $SAFE level - set in Ruby. -

-

Native functions exposed to Ruby with DL or Fiddle do not check the - taint values set on the objects passed in. This can result in - tainted objects being accepted as input when a SecurityError - exception should be raised. -

-
- - - - CVE-2013-2065 - http://www.ruby-lang.org/en/news/2013/05/14/taint-bypass-dl-fiddle-cve-2013-2065/ - - - 2013-05-14 - 2013-05-26 - - - - - couchdb -- DOM based Cross-Site Scripting via Futon UI - - - couchdb - 1.2.1,1 - - - - -

Jan Lehnardt reports:

-
-

Query parameters passed into the browser-based test suite - are not sanitised, and can be used to load external resources. - An attacker may execute JavaScript code in the browser, using - the context of the remote user.

-
- - - - CVE-2012-5650 - http://mail-archives.apache.org/mod_mbox/couchdb-user/201301.mbox/%3C2FFF2FD7-8EAF-4EBF-AFDA-5AEB6EAC853F@apache.org%3E - - - 2012-01-14 - 2013-05-26 - - - - - otrs -- information disclosure - - - otrs - 3.2.7 - - - - -

The OTRS Project reports:

-
-

An attacker with a valid agent login could manipulate URLs in the ticket split mechanism to see contents of tickets and they are not permitted to see.

-
- - - - CVE-2013-3551 - http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-03/ - - - 2013-05-22 - 2013-05-23 - - - - - otrs -- XSS vulnerability - - - otrs - 3.1.8 - - - - -

The OTRS Project reports:

-
-

An attacker with permission to write changes, workorder items or FAQ articles could inject JavaScript code into the articles which would be executed by the browser of other users reading the article.

-
- - - - CVE-2013-2637 - http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-02/ - - - 2013-04-02 - 2013-05-23 - - - - - RT -- multiple vulnerabilities - - - rt38 - 3.83.8.17 - - - rt40 - 4.04.0.13 - - - - -

Thomas Sibley reports:

-
-

We discovered a number of security vulnerabilities which - affect both RT 3.8.x and RT 4.0.x. We are releasing RT - versions 3.8.17 and 4.0.13 to resolve these vulnerabilities, - as well as patches which apply atop all released versions of - 3.8 and 4.0.

-

The vulnerabilities addressed by 3.8.17, 4.0.13, and the - below patches include the following:

-

RT 4.0.0 and above are vulnerable to a limited privilege - escalation leading to unauthorized modification of ticket - data. The DeleteTicket right and any custom lifecycle - transition rights may be bypassed by any user with - ModifyTicket. This vulnerability is assigned - CVE-2012-4733.

-

RT 3.8.0 and above include a version of bin/rt that uses - semi-predictable names when creating tempfiles. This could - possibly be exploited by a malicious user to overwrite files - with permissions of the user running bin/rt. This - vulnerability is assigned CVE-2013-3368.

-

RT 3.8.0 and above allow calling of arbitrary Mason - components (without control of arguments) for users who can - see administration pages. This could be used by a malicious - user to run private components which may have negative - side-effects. This vulnerability is assigned - CVE-2013-3369.

-

RT 3.8.0 and above allow direct requests to private - callback components. Though no callback components ship - with RT, this could be used to exploit an extension or local - callback which uses the arguments passed to it insecurely. - This vulnerability is assigned CVE-2013-3370.

-

RT 3.8.3 and above are vulnerable to cross-site scripting - (XSS) via attachment filenames. The vector is difficult to - exploit due to parsing requirements. Additionally, RT 4.0.0 - and above are vulnerable to XSS via maliciously-crafted - "URLs" in ticket content when RT's "MakeClicky" feature is - configured. Although not believed to be exploitable in the - stock configuration, a patch is also included for RTIR 2.6.x - to add bulletproofing. These vulnerabilities are assigned - CVE-2013-3371.

-

RT 3.8.0 and above are vulnerable to an HTTP header - injection limited to the value of the Content-Disposition - header. Injection of other arbitrary response headers is - not possible. Some (especially older) browsers may allow - multiple Content-Disposition values which could lead to XSS. - Newer browsers contain security measures to prevent this. - Thank you to Dominic Hargreaves for reporting this - vulnerability. This vulnerability is assigned - CVE-2013-3372.

-

RT 3.8.0 and above are vulnerable to a MIME header - injection in outgoing email generated by RT. The vectors - via RT's stock templates are resolved by this patchset, but - any custom email templates should be updated to ensure that - values interpolated into mail headers do not contain - newlines. This vulnerability is assigned CVE-2013-3373.

-

RT 3.8.0 and above are vulnerable to limited session - re-use when using the file-based session store, - Apache::Session::File. RT's default session configuration - only uses Apache::Session::File for Oracle. RT instances - using Oracle may be locally configured to use the - database-backed Apache::Session::Oracle, in which case - sessions are never re-used. The extent of session re-use is - limited to information leaks of certain user preferences and - caches, such as queue names available for ticket creation. - Thank you to Jenny Martin for reporting the problem that - lead to discovery of this vulnerability. This vulnerability - is assigned CVE-2013-3374.

-
- - - - http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html - http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html - http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html - CVE-2012-4733 - CVE-2013-3368 - CVE-2013-3369 - CVE-2013-3370 - CVE-2013-3371 - CVE-2013-3372 - CVE-2013-3373 - CVE-2013-3374 - - - 2013-05-22 - 2013-05-23 - - - - - plib -- stack-based buffer overflow - - - plib - 1.8.5_4 - - - - -

CVE reports:

-
-

Stack-based buffer overflow in the error function in - ssg/ssgParser.cxx in PLIB 1.8.5 allows remote attackers to - execute arbitrary code via a crafted 3d model file that - triggers a long error message, as demonstrated by a .ase - file.

-
- - - - 55839 - CVE-2012-4552 - http://www.openwall.com/lists/oss-security/2012/10/29/8 - - - 2012-10-09 - 2013-05-19 - - - - - plib -- buffer overflow - - - plib - 1.8.5_4 - - - - -

Secunia reports:

-
-

A vulnerability has been discovered in PLIB, which can be - exploited by malicious people to compromise an application - using the library. The vulnerability is caused due to a - boundary error within the "ulSetError()" function - (src/util/ulError.cxx) when creating the error message, - which can be exploited to overflow a static buffer.

-

Successful exploitation allows the execution of arbitrary - code but requires that the attacker can e.g. control the - content of an overly long error message passed to the - "ulSetError()" function.

-

The vulnerability is confirmed in version 1.8.5. Other - versions may also be affected.

-

Originally reported in TORCS by Andres Gomez.

-
- - - - CVE-2011-4620 - http://openwall.com/lists/oss-security/2011/12/21/2 - - - 2011-12-21 - 2013-05-19 - - - - - linux-flashplugin -- multiple vulnerabilities - - - linux-f10-flashplugin - 11.2r202.285 - - - - -

Adobe reports:

-
-

These updates address vulnerabilities that could cause a crash - and potentially allow an attacker to take control of the affected system.

-
- - - - CVE-2013-2728 - CVE-2013-3324 - CVE-2013-3325 - CVE-2013-3326 - CVE-2013-3327 - CVE-2013-3328 - CVE-2013-3329 - CVE-2013-3330 - CVE-2013-3331 - CVE-2013-3332 - CVE-2013-3333 - CVE-2013-3334 - CVE-2013-3335 - - - 2013-05-14 - 2013-05-16 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 18.0,121.0,1 - 17.0.6,1 - - - linux-firefox - 17.0.6,1 - - - linux-seamonkey - 2.17.1 - - - linux-thunderbird - 17.0.6 - - - seamonkey - 2.17.1 - - - thunderbird - 11.017.0.6 - - - - -

The Mozilla Project reports:

-
-

MFSA 2013-41 Miscellaneous memory safety hazards (rv:21.0 - / rv:17.0.6)

-

MFSA 2013-42 Privileged access for content level constructor

-

MFSA 2013-43 File input control has access to full path

-

MFSA 2013-44 Local privilege escalation through Mozilla - Maintenance Service

-

MFSA 2013-45 Mozilla Updater fails to update some Windows Registry - entries

-

MFSA 2013-46 Use-after-free with video and onresize event

-

MFSA 2013-47 Uninitialized functions in DOMSVGZoomEvent

-

MFSA 2013-48 Memory corruption found using Address Sanitizer

-
- - - - CVE-2012-1942 - CVE-2013-0801 - CVE-2013-1669 - CVE-2013-1670 - CVE-2013-1671 - CVE-2013-1672 - CVE-2013-1674 - CVE-2013-1675 - CVE-2013-1676 - CVE-2013-1677 - CVE-2013-1678 - CVE-2013-1679 - CVE-2013-1680 - CVE-2013-1681 - http://www.mozilla.org/security/announce/2013/mfsa2013-40.html - http://www.mozilla.org/security/announce/2013/mfsa2013-41.html - http://www.mozilla.org/security/announce/2013/mfsa2013-42.html - http://www.mozilla.org/security/announce/2013/mfsa2013-43.html - http://www.mozilla.org/security/announce/2013/mfsa2013-44.html - http://www.mozilla.org/security/announce/2013/mfsa2013-45.html - http://www.mozilla.org/security/announce/2013/mfsa2013-46.html - http://www.mozilla.org/security/announce/2013/mfsa2013-47.html - http://www.mozilla.org/security/announce/2013/mfsa2013-48.html - http://www.mozilla.org/security/known-vulnerabilities/ - - - 2013-05-14 - 2013-05-15 - 2013-05-21 - - - - - nginx -- multiple vulnerabilities - - - nginx - 1.2.0,11.2.8,1 - 1.3.0,11.4.1,1 - - - nginx-devel - 1.1.41.2.8 - 1.3.01.5.0 - - - - -

The nginx project reports:

-
-

A stack-based buffer overflow might occur in a worker process - process while handling a specially crafted request, potentially - resulting in arbitrary code execution. [CVE-2013-2028]

-

A security problem related to CVE-2013-2028 was identified, - affecting some previous nginx versions if proxy_pass to - untrusted upstream HTTP servers is used.

-

The problem may lead to a denial of service or a disclosure of a - worker process memory on a specially crafted response from an - upstream proxied server. [CVE-2013-2070]

-
- - - - CVE-2013-2028 - CVE-2013-2070 - http://mailman.nginx.org/pipermail/nginx-announce/2013/000114.html - http://mailman.nginx.org/pipermail/nginx-announce/2013/000112.html - - - 2013-05-07 - 2013-05-07 - 2013-05-16 - - - - - strongSwan -- ECDSA signature verification issue - - - strongswan - 5.0.4 - - - - -

strongSwan security team reports:

-
-

If the openssl plugin is used for ECDSA signature verification an empty, - zeroed or otherwise invalid signature is handled as a legitimate one. - Both IKEv1 and IKEv2 are affected.

-

Affected are only installations that have enabled and loaded the OpenSSL - crypto backend (--enable-openssl). Builds using the default crypto backends - are not affected.

-
- - - - CVE-2013-2944 - - - 2013-04-30 - 2013-05-03 - - - - - jenkins -- multiple vulnerabilities - - - jenkins - 1.514 - - - - -

Jenkins Security Advisory reports:

-
-

This advisory announces multiple security vulnerabilities that - were found in Jenkins core.

-
    -
  1. -

    SECURITY-63 / CVE-2013-2034

    -

    This creates a cross-site request forgery (CSRF) vulnerability - on Jenkins master, where an anonymous attacker can trick an - administrator to execute arbitrary code on Jenkins master by - having him open a specifically crafted attack URL.

    -

    There's also a related vulnerability where the permission - check on this ability is done imprecisely, which may affect - those who are running Jenkins instances with a custom - authorization strategy plugin.

    -
    2. -
  2. -

    SECURITY-67 / CVE-2013-2033

    -

    This creates a cross-site scripting (XSS) vulnerability, where - an attacker with a valid user account on Jenkins can execute - JavaScript in the browser of other users, if those users are - using certain browsers.

    -
    3. -
  3. -

    SECURITY-69 / CVE-2013-2034

    -

    This is another CSRF vulnerability that allows an attacker to - cause a deployment of binaries to Maven repositories. This - vulnerability has the same CVE ID as SEUCRITY-63.

    -
    4. -
  4. -

    SECURITY-71 / CVE-2013-1808

    -

    This creates a cross-site scripting (XSS) vulnerability.

    -
    5. -
-
- - - - https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-05-02 - CVE-2013-2034 - CVE-2013-2033 - CVE-2013-2034 - CVE-2013-1808 - - - 2013-05-02 - 2013-05-03 - - - - - FreeBSD -- NFS remote denial of service - - - FreeBSD - 8.38.3_8 - 9.19.1_3 - - - - -
-

Insufficient input validation in the NFS server allows an - attacker to cause the underlying file system to treat a - regular file as a directory.

-
- - - - CVE-2013-3266 - SA-13:05.nfsserver - - - 2013-04-21 - 2013-04-29 - 2016-08-09 - - - - - Joomla! -- XXS and DDoS vulnerabilities - - - joomla - 2.0.*2.5.10 - - - - -

The JSST and the Joomla! Security Center report:

-
-

[20130405] - Core - XSS Vulnerability

-

Inadequate filtering leads to XSS vulnerability in Voting plugin.

-
-
-

[20130403] - Core - XSS Vulnerability

-

Inadequate filtering allows possibility of XSS exploit in some - circumstances.

-
-
-

[20130402] - Core - Information Disclosure

-

Inadequate permission checking allows unauthorised user to see - permission settings in some circumstances.

-
-
-

[20130404] - Core - XSS Vulnerability

-

Use of old version of Flash-based file uploader leads to XSS - vulnerability.

-
-
-

[20130401] - Core - Privilege Escalation

-

Inadequate permission checking allows unauthorised user to delete - private messages.

-
-
-

[20130406] - Core - DOS Vulnerability

-

Object unserialize method leads to possible denial of service - vulnerability.

-
-
-

[20130407] - Core - XSS Vulnerability

-

Inadequate filtering leads to XSS vulnerability in highlighter - plugin

-
- - - - CVE-2013-3059 - CVE-2013-3058 - CVE-2013-3057 - http://developer.joomla.org/security/83-20130404-core-xss-vulnerability.html - CVE-2013-3056 - CVE-2013-3242 - CVE-2013-3267 - - - 2013-04-24 - 2013-04-27 - - - - - phpMyAdmin -- Multiple security vulnerabilities - - - phpMyAdmin - 3.53.5.8.1 - - - - -

The phpMyAdmin development team reports:

-
-

In some PHP versions, the preg_replace() function can be - tricked into executing arbitrary PHP code on the - server. This is done by passing a crafted argument as the - regular expression, containing a null byte. phpMyAdmin does - not correctly sanitize an argument passed to preg_replace() - when using the "Replace table prefix" feature, opening the - way to this vulnerability..

-

This vulnerability can be triggered only by someone who - logged in to phpMyAdmin, as the usual token protection - prevents non-logged-in users to access the required - form.

-
-
-

phpMyAdmin can be configured to save an export file on - the web server, via its SaveDir directive. With this in - place, it's possible, either via a crafted filename template - or a crafted table name, to save a double extension file - like foobar.php.sql. In turn, an Apache webserver on which - there is no definition for the MIME type "sql" (the default) - will treat this saved file as a ".php" script, leading to - remote code execution.

-

This vulnerability can be triggered only by someone who - logged in to phpMyAdmin, as the usual token protection - prevents non-logged-in users to access the required - form. Moreover, the SaveDir directive is empty by default, - so a default configuration is not vulnerable. The - $cfg['SaveDir'] directive must be configured, and the server - must be running Apache with mod_mime to be exploitable.

-
- - - - CVE-2013-3238 - CVE-2013-3239 - - - 2013-04-24 - 2013-04-24 - - - - - tinc -- Buffer overflow - - - tinc - 1.0.21 - - - - -

tinc-vpn.org reports:

-
-

Drop packets forwarded via TCP if they are too big.

-
- - - - CVE-2013-1428 - - - 2013-01-26 - 2013-04-22 - - - - - phpMyAdmin -- XSS due to unescaped HTML output in GIS visualisation page - - - phpMyAdmin - 3.53.5.8 - - - - -

The phpMyAdmin development team reports:

-
-

When modifying a URL parameter with a crafted value it - is possible to trigger an XSS.

-

These XSS can only be triggered when a valid database is - known and when a valid cookie token is used.

-
- - - - CVE-2013-1937 - http://www.phpmyadmin.net/home_page/security/PMASA-2013-1.php - - - 2013-04-18 - 2013-04-20 - - - - - roundcube -- arbitrary file disclosure vulnerability - - - roundcube - 0.8.6,1 - - - - -

RoundCube development team reports:

-
-

After getting reports about a possible vulnerability - of Roundcube which allows an attacker to modify its - users preferences in a way that he/she can then read - files from the server, we now published updated packages - as well as patches that fix this security issue.

-
- - - - CVE-2013-1904 - https://secunia.com/advisories/52806/ - - - 2013-03-27 - 2013-04-19 - - - - - jasper -- buffer overflow - - - jasper - 1.900.1_12 - - - - -

Fedora reports:

-
-

JasPer fails to properly decode marker segments and other - sections in malformed JPEG2000 files. Malformed inputs can - cause heap buffer overflows which in turn may result in - execution of attacker-controlled code.

-
- - - - CVE-2008-3520 - CVE-2008-3522 - CVE-2011-4516 - CVE-2011-4517 - http://www.kb.cert.org/vuls/id/887409 - - - 2011-12-09 - 2013-04-18 - - - - - ModSecurity -- XML External Entity Processing Vulnerability - - - mod_security - 2.*2.7.3 - - - - -

Positive Technologies has reported a vulnerability in ModSecurity, - which can be exploited by malicious people to disclose potentially - sensitive information or cause a DoS (Denial Of Serice).

-

The vulnerability is caused due to an error when parsing external - XML entities and can be exploited to e.g. disclose local files or - cause excessive memory and CPU consumption.

-
-

.

-
- - - - CVE-2013-1915 - https://secunia.com/advisories/52847/ - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-1915 - https://bugs.gentoo.org/show_bug.cgi?id=464188 - - - 2013-04-02 - 2013-04-16 - - - - - sieve-connect -- TLS hostname verification was not occurring - - - sieve-connect - 0.85 - - - - -

sieve-connect developer Phil Pennock reports:

-
-

sieve-connect was not actually verifying TLS certificate identities - matched the expected hostname.

-
- - - - http://mail.globnix.net/pipermail/sieve-connect-announce/2013/000005.html - - - 2013-04-14 - 2013-04-15 - - - - - linux-flashplugin -- multiple vulnerabilities - - - linux-f10-flashplugin - 11.2r202.280 - - - - -

Adobe reports:

-
-

These updates address vulnerabilities that could cause a crash - and potentially allow an attacker to take control of the affected system.

-
- - - - CVE-2013-1383 - CVE-2013-1384 - CVE-2013-1385 - CVE-2013-1386 - - - 2013-04-09 - 2013-04-10 - - - - - rubygem-rails -- multiple vulnerabilities - - - rubygem-rails - 3.2.13 - - - rubygem-actionpack - 3.2.13 - - - rubygem-activerecord - 3.2.13 - - - rubygem-activesupport - 3.2.13 - - - - -

Ruby on Rails team reports:

-
-

Rails versions 3.2.13 has been released. This release - contains important security fixes. It is recommended - users upgrade as soon as possible.

-

Four vulnerabilities have been discovered and fixed:

-
    -
  1. (CVE-2013-1854) Symbol DoS vulnerability in Active Record
    2. -
  2. (CVE-2013-1855) XSS vulnerability in sanitize_css in Action Pack
    3. -
  3. (CVE-2013-1856) XML Parsing Vulnerability affecting JRuby users
    4. -
  4. (CVE-2013-1857) XSS Vulnerability in the `sanitize` helper of Ruby on Rails
    5. -
-
- - - - CVE-2013-1854 - CVE-2013-1856 - CVE-2013-1856 - CVE-2013-1857 - http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-3-2-13-3-1-12-and-2-3-18-have-been-released/ - https://groups.google.com/forum/#!topic/ruby-security-ann/o0Dsdk2WrQ0 - https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/4_QHo4BqnN8 - https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/KZwsQbYsOiI - https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/zAAU7vGTPvI - - - 2013-03-18 - 2013-04-10 - - - - - NVIDIA UNIX driver -- ARGB cursor buffer overflow in "NoScanout" mode - - - nvidia-driver - 310.14310.44 - 195.22304.88 - - - - -

NVIDIA Unix security team reports:

-
-

When the NVIDIA driver for the X Window System is operated in - "NoScanout" mode, and an X client installs an ARGB cursor that - is larger than the expected size (64x64 or 256x256, depending on - the driver version), the driver will overflow a buffer. This - can cause a denial of service (e.g., an X server segmentation - fault), or could be exploited to achieve arbitrary code - execution. Because the X server runs as setuid root in many - configurations, an attacker could potentially use this - vulnerability in those configurations to gain root privileges.

-
- - - - CVE-2013-0131 - http://nvidia.custhelp.com/app/answers/detail/a_id/3290 - - - 2013-03-27 - 2013-04-08 - - - - - opera -- moderately severe issue - - - opera - 12.15 - - - opera-devel - 12.15 - - - linux-opera - 12.15 - - - linux-opera-devel - 12.15 - - - - -

Opera reports:

-
-

Fixed a moderately severe issue, as reported by Attila Suszte.

-
- - - - http://www.opera.com/docs/changelogs/unified/1215/ - http://www.opera.com/support/kb/view/1046/ - http://www.opera.com/support/kb/view/1047/ - - - 2013-04-04 - 2014-04-30 - - - - - Subversion -- multiple vulnerabilities - - - subversion - 1.7.01.7.9 - 1.0.01.6.21 - - - - -

Subversion team reports:

-
-

Subversion's mod_dav_svn Apache HTTPD server module will use excessive - amounts of memory when a large number of properties are set or deleted - on a node.

-
-
-

Subversion's mod_dav_svn Apache HTTPD server module will crash when - a LOCK request is made against activity URLs.

-
-
-

Subversion's mod_dav_svn Apache HTTPD server module will crash in some - circumstances when a LOCK request is made against a non-existent URL.

-
-
-

Subversion's mod_dav_svn Apache HTTPD server module will crash when a - PROPFIND request is made against activity URLs.

-
-
-

Subversion's mod_dav_svn Apache HTTPD server module will crash when a - log REPORT request receives a limit that is out of the allowed range.

-
- - - - CVE-2013-1845 - CVE-2013-1846 - CVE-2013-1847 - CVE-2013-1849 - CVE-2013-1884 - - - 2013-04-05 - 2013-04-05 - - - - - otrs -- Information disclosure and Data manipulation - - - otrs - 3.1.14 - - - - -

The OTRS Project reports:

-
-

An attacker with a valid agent login could manipulate URLs in the - object linking mechanism to see titles of tickets and other objects - that are not obliged to be seen. Furthermore, links to objects without - permission can be placed and removed.

-
- - - - CVE-2013-2625 - http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-01/ - - - 2013-04-02 - 2013-04-05 - - - - - PostgreSQL -- anonymous remote access data corruption vulnerability - - - postgresql-server - 8.3.08.3.21_1 - 8.4.08.4.17 - 9.0.09.0.13 - 9.1.09.1.9 - 9.2.09.2.4 - - - - -

PostgreSQL project reports:

-
-

- The PostgreSQL Global Development Group has released a security - update to all current versions of the PostgreSQL database system, - including versions 9.2.4, 9.1.9, 9.0.13, and 8.4.17. This update - fixes a high-exposure security vulnerability in versions 9.0 and - later. All users of the affected versions are strongly urged to apply - the update *immediately*. -

-

- A major security issue (for versions 9.x only) fixed in this release, - [CVE-2013-1899](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1899), - makes it possible for a connection request containing a database name - that begins with "-" to be crafted that can damage or destroy files - within a server's data directory. Anyone with access to the port the - PostgreSQL server listens on can initiate this request. This issue was - discovered by Mitsumasa Kondo and Kyotaro Horiguchi of NTT Open Source - Software Center. -

-

- Two lesser security fixes are also included in this release: - [CVE-2013-1900](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1900), - wherein random numbers generated by contrib/pgcrypto functions may be - easy for another database user to guess (all versions), and - [CVE-2013-1901](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1901), - which mistakenly allows an unprivileged user to run commands that - could interfere with in-progress backups (for versions 9.x only). -

-
- - - - CVE-2013-1899 - CVE-2013-1900 - CVE-2013-1901 - - - 2013-04-04 - 2013-04-04 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 18.0,120.0,1 - 17.0.5,1 - - - linux-firefox - 17.0.5,1 - - - linux-seamonkey - 2.17 - - - linux-thunderbird - 17.0.5 - - - seamonkey - 2.17 - - - thunderbird - 11.017.0.5 - - - - -

The Mozilla Project reports:

-
-

MFSA 2013-30 Miscellaneous memory safety hazards (rv:20.0 / - rv:17.0.5)

-

MFSA 2013-31 Out-of-bounds write in Cairo library

-

MFSA 2013-32 Privilege escalation through Mozilla Maintenance - Service

-

MFSA 2013-33 World read and write access to app_tmp directory on - Android

-

MFSA 2013-34 Privilege escalation through Mozilla Updater

-

MFSA 2013-35 WebGL crash with Mesa graphics driver on Linux

-

MFSA 2013-36 Bypass of SOW protections allows cloning of protected - nodes

-

MFSA 2013-37 Bypass of tab-modal dialog origin disclosure

-

MFSA 2013-38 Cross-site scripting (XSS) using timed history - navigations

-

MFSA 2013-39 Memory corruption while rendering grayscale PNG - images

-

MFSA 2013-40 Out-of-bounds array read in CERT_DecodeCertPackage

-
- - - - CVE-2013-0788 - CVE-2013-0789 - CVE-2013-0790 - CVE-2013-0791 - CVE-2013-0792 - CVE-2013-0793 - CVE-2013-0794 - CVE-2013-0795 - CVE-2013-0796 - CVE-2013-0797 - CVE-2013-0798 - CVE-2013-0799 - CVE-2013-0800 - http://www.mozilla.org/security/announce/2013/mfsa2013-30.html - http://www.mozilla.org/security/announce/2013/mfsa2013-31.html - http://www.mozilla.org/security/announce/2013/mfsa2013-32.html - http://www.mozilla.org/security/announce/2013/mfsa2013-33.html - http://www.mozilla.org/security/announce/2013/mfsa2013-34.html - http://www.mozilla.org/security/announce/2013/mfsa2013-35.html - http://www.mozilla.org/security/announce/2013/mfsa2013-36.html - http://www.mozilla.org/security/announce/2013/mfsa2013-37.html - http://www.mozilla.org/security/announce/2013/mfsa2013-38.html - http://www.mozilla.org/security/announce/2013/mfsa2013-39.html - http://www.mozilla.org/security/announce/2013/mfsa2013-40.html - http://www.mozilla.org/security/known-vulnerabilities/ - - - 2013-04-02 - 2013-04-03 - 2013-04-08 - - - - - FreeBSD -- BIND remote denial of service - - - FreeBSD - 9.09.0_7 - 9.19.1_2 - - - - -
-

A flaw in a library used by BIND allows an - attacker to deliberately cause excessive memory - consumption by the named(8) process. This - affects both recursive and authoritative - servers.

-
- - - - CVE-2013-2266 - SA-13:04.bind - https://kb.isc.org/article/AA-00871 - - - 2013-04-02 - 2013-04-02 - 2016-08-09 - - - - - FreeBSD -- OpenSSL multiple vulnerabilities - - - FreeBSD - 8.38.3_7 - 9.09.0_7 - 9.19.1_2 - - - - -
-

A flaw in the OpenSSL handling of OCSP response - verification could be exploited to cause a denial of - service attack.

-

OpenSSL has a weakness in the handling of CBC - ciphersuites in SSL, TLS and DTLS. The weakness could reveal - plaintext in a timing attack.

-
- - - - CVE-2013-0166 - CVE-2013-0169 - SA-13:03.openssl - http://www.openssl.org/news/secadv_20130205.txt - - - 2013-04-02 - 2013-04-02 - 2016-08-09 - - - - - OpenVPN -- potential side-channel/timing attack when comparing HMACs - - - openvpn - 2.0.9_4 - 2.1.02.2.2_2 - 2.3.02.3.1 - - - - -

The OpenVPN project reports:

-
-

OpenVPN 2.3.0 and earlier running in UDP mode are subject - to chosen ciphertext injection due to a non-constant-time - HMAC comparison function.

-
- - - - https://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-f375aa67cc - CVE-2013-2061 - http://www.openwall.com/lists/oss-security/2013/05/06/6 - https://github.com/OpenVPN/openvpn/commit/11d21349a4e7e38a025849479b36ace7c2eec2ee - - - 2013-03-19 - 2013-03-31 - 2013-06-01 - - - - - libxml2 -- cpu consumption Dos - - - libxml2 - 2.8.0 - - - - -

Kurt Seifried reports:

-
-

libxml2 is affected by the expansion of internal entities - (which can be used to consume resources) and external entities - (which can cause a denial of service against other services, - be used to port scan, etc.)..

-
- - - - CVE-2013-0338 - CVE-2013-0339 - http://seclists.org/oss-sec/2013/q1/391 - https://security-tracker.debian.org/tracker/CVE-2013-0338 - https://security-tracker.debian.org/tracker/CVE-2013-0339 - - - 2013-02-21 - 2013-03-29 - - - - - asterisk -- multiple vulnerabilities - - - asterisk11 - 11.*11.2.2 - - - asterisk10 - 10.*10.12.2 - - - asterisk18 - 1.8.*1.8.20.2 - - - - -

Asterisk project reports:

-
-

Buffer Overflow Exploit Through SIP SDP Header

-

Username disclosure in SIP channel driver

-

Denial of Service in HTTP server

-
- - - - CVE-2013-2685 - CVE-2013-2686 - CVE-2013-2264 - http://downloads.asterisk.org/pub/security/AST-2013-001.html - http://downloads.asterisk.org/pub/security/AST-2013-002.html - http://downloads.asterisk.org/pub/security/AST-2013-003.html - https://www.asterisk.org/security - - - 2013-03-27 - 2013-03-29 - - - - - dns/bind9* -- Malicious Regex Can Cause Memory Exhaustion - - - bind99 - 9.9.2.2 - - - bind99-base - 9.9.2.2 - - - bind98 - 9.8.4.2 - - - bind98-base - 9.8.4.2 - - - - -

ISC reports:

-
-

A critical defect in BIND 9 allows an attacker to cause - excessive memory consumption in named or other programs - linked to libdns.

-
- - - - CVE-2013-2266 - - - 2013-03-11 - 2013-03-27 - - - - - firebird -- Remote Stack Buffer Overflow - - - firebird25-server - 2.5.02.5.2 - - - firebird21-server - 2.1.02.1.5 - - - - -

Firebird Project reports:

-
-

The FirebirdSQL server is vulnerable to a stack buffer overflow - that can be triggered when an unauthenticated user sends a - specially crafted packet. The result can lead to remote code - execution as the user which runs the FirebirdSQL server.

-
- - - - CVE-2013-2492 - https://gist.github.com/zeroSteiner/85daef257831d904479c - - - 2013-01-31 - 2013-03-06 - - - - - optipng -- use-after-free vulnerability - - - optipng - 0.70.7.4 - - - - -

Secunia reports:

-
-

A vulnerability has been reported in OptiPNG, which can be - exploited by malicious people to potentially compromise a user's - system.

-

The vulnerability is caused due to a use-after-free error related - to the palette reduction functionality. No further information is - currently available.

-

Success exploitation may allow execution of arbitrary code.

-
- - - - CVE-2012-4432 - https://secunia.com/advisories/50654 - - - 2012-09-16 - 2013-03-21 - - - - - php5 -- Multiple vulnerabilities - - - php5 - 5.4.13 - - - php53 - 5.3.23 - - - - -

The PHP development team reports:

-
-

PHP does not validate the relationship between the soap.wsdl_cache_dir - directive and the open_basedir directive, which allows remote attackers to - bypass intended access restrictions by triggering the creation of cached - SOAP WSDL files in an arbitrary directory.

-

The SOAP parser in PHP allows remote attackers to read arbitrary files - via a SOAP WSDL file containing an XML external entity declaration in - conjunction with an entity reference, related to an XML External Entity - (XXE) issue in the soap_xmlParseFile and soap_xmlParseMemory functions.

-
- - - - CVE-2013-1635 - CVE-2013-1643 - - - 2013-03-04 - 2013-03-18 - - - - - piwigo -- CSRF/Path Traversal - - - piwigo - 2.4.7 - - - - -

High-Tech Bridge Security Research Lab reports:

-
-

The CSRF vulnerability exists due to insufficient verification of the - HTTP request origin in "/admin.php" script. A remote attacker can trick - a logged-in administrator to visit a specially crafted webpage and - create arbitrary PHP file on the remote server.

-

The path traversal vulnerability exists due to insufficient filtration - of user-supplied input in "dl" HTTP GET parameter passed to - "/install.php" script. The script is present on the system after - installation by default, and can be accessed by attacker without any - restrictions.

-
- - - - CVE-2013-1468 - CVE-2013-1469 - http://piwigo.org/bugs/view.php?id=0002843 - http://piwigo.org/bugs/view.php?id=0002844 - http://dl.packetstormsecurity.net/1302-exploits/piwigo246-traversalxsrf.txt - - - 2013-02-06 - 2013-03-18 - - - - - libexif -- multiple remote vulnerabilities - - - libexif - 0.6.21 - - - - -

libexif project security advisory:

-
-

A number of remotely exploitable issues were discovered in libexif - and exif, with effects ranging from information leakage to potential - remote code execution.

-
- - - - CVE-2012-2812 - CVE-2012-2813 - CVE-2012-2814 - CVE-2012-2836 - CVE-2012-2837 - CVE-2012-2840 - CVE-2012-2841 - CVE-2012-2845 - 54437 - - - 2012-07-12 - 2013-03-13 - - - - - linux-flashplugin -- multiple vulnerabilities - - - linux-f10-flashplugin - 11.2r202.275 - - - - -

Adobe reports:

-
-

These updates address vulnerabilities that could cause a crash - and potentially allow an attacker to take control of the affected system.

-
- - - - CVE-2013-0646 - CVE-2013-0650 - CVE-2013-1371 - CVE-2013-1375 - - - 2013-03-12 - 2013-03-12 - - - - - puppet27 and puppet -- multiple vulnerabilities - - - puppet - 3.03.1.1 - - - puppet27 - 2.72.7.21 - - - - -

Moses Mendoza reports:

-
-

A vulnerability found in Puppet could allow an authenticated client - to cause the master to execute arbitrary code while responding to a - catalog request. Specifically, in order to exploit the - vulnerability, the puppet master must be made to invoke the - 'template' or 'inline_template' functions during catalog compilation. -

-

A vulnerability found in Puppet could allow an authenticated client - to connect to a puppet master and perform unauthorized actions. - Specifically, given a valid certificate and private key, an agent - could retrieve catalogs from the master that it is not authorized - to access or it could poison the puppet master's caches for any - puppet-generated data that supports caching such as catalogs, - nodes, facts, and resources. The extent and severity of this - vulnerability varies depending on the specific configuration of the - master: for example, whether it is using storeconfigs or not, which - version, whether it has access to the cache or not, etc. -

-

A vulnerability has been found in Puppet which could allow - authenticated clients to execute arbitrary code on agents that have - been configured to accept kick connections. This vulnerability is - not present in the default configuration of puppet agents, but if - they have been configured to listen for incoming connections - ('listen=true'), and the agent's auth.conf has been configured to - allow access to the `run` REST endpoint, then a client could - construct an HTTP request which could execute arbitrary code. The - severity of this issue is exacerbated by the fact that puppet - agents typically run as root. -

-

A vulnerability has been found in Puppet that could allow a client - negotiating a connection to a master to downgrade the master's - SSL protocol to SSLv2. This protocol has been found to contain - design weaknesses. This issue only affects systems running older - versions (pre 1.0.0) of openSSL. Newer versions explicitly disable - SSLv2. -

-

A vulnerability found in Puppet could allow unauthenticated clients - to send requests to the puppet master which would cause it to load - code unsafely. While there are no reported exploits, this - vulnerability could cause issues like those described in Rails - CVE-2013-0156. This vulnerability only affects puppet masters - running Ruby 1.9.3 and higher. -

-

This vulnerability affects puppet masters 0.25.0 and above. By - default, auth.conf allows any authenticated node to submit a report - for any other node. This can cause issues with compliance. The - defaults in auth.conf have been changed. -

-
- - - - CVE-2013-1640 - CVE-2013-1652 - CVE-2013-1653 - CVE-2013-1654 - CVE-2013-1655 - CVE-2013-2275 - https://puppetlabs.com/security/cve/cve-2013-1640/ - https://puppetlabs.com/security/cve/cve-2013-1652/ - https://puppetlabs.com/security/cve/cve-2013-1653/ - https://puppetlabs.com/security/cve/cve-2013-1654/ - https://puppetlabs.com/security/cve/cve-2013-1655/ - https://puppetlabs.com/security/cve/cve-2013-2275/ - https://groups.google.com/forum/?fromgroups=#!topic/puppet-announce/f_gybceSV6E - https://groups.google.com/forum/?fromgroups=#!topic/puppet-announce/kgDyaPhHniw - - - 2013-03-13 - 2013-03-13 - - - - - puppet26 -- multiple vulnerabilities - - - puppet26 - 2.62.6.18 - - - - -

Moses Mendoza reports:

-
-

A vulnerability found in Puppet could allow an authenticated client - to cause the master to execute arbitrary code while responding to a - catalog request. Specifically, in order to exploit the - vulnerability, the puppet master must be made to invoke the - 'template' or 'inline_template' functions during catalog compilation. -

-

A vulnerability found in Puppet could allow an authenticated client - to connect to a puppet master and perform unauthorized actions. - Specifically, given a valid certificate and private key, an agent - could retrieve catalogs from the master that it is not authorized - to access or it could poison the puppet master's caches for any - puppet-generated data that supports caching such as catalogs, - nodes, facts, and resources. The extent and severity of this - vulnerability varies depending on the specific configuration of the - master: for example, whether it is using storeconfigs or not, which - version, whether it has access to the cache or not, etc. -

-

A vulnerability has been found in Puppet that could allow a client - negotiating a connection to a master to downgrade the master's - SSL protocol to SSLv2. This protocol has been found to contain - design weaknesses. This issue only affects systems running older - versions (pre 1.0.0) of openSSL. Newer versions explicitly disable - SSLv2. -

-

A vulnerability found in Puppet could allow an authenticated client - to execute arbitrary code on a puppet master that is running in the - default configuration, or an agent with `puppet kick` enabled. - Specifically, a properly authenticated and connected puppet agent - could be made to construct an HTTP PUT request for an authorized - report that actually causes the execution of arbitrary code on the - master. -

-

This vulnerability affects puppet masters 0.25.0 and above. By - default, auth.conf allows any authenticated node to submit a report - for any other node. This can cause issues with compliance. The - defaults in auth.conf have been changed. -

-
- - - - CVE-2013-1640 - CVE-2013-1652 - CVE-2013-1654 - CVE-2013-2274 - CVE-2013-2275 - https://puppetlabs.com/security/cve/cve-2013-1640/ - https://puppetlabs.com/security/cve/cve-2013-1652/ - https://puppetlabs.com/security/cve/cve-2013-1654/ - https://puppetlabs.com/security/cve/cve-2013-2274/ - https://puppetlabs.com/security/cve/cve-2013-2275/ - - - 2013-03-13 - 2013-03-13 - - - - - perl -- denial of service via algorithmic complexity attack on hashing routines - - - perl - perl-threaded - 5.12.4_5 - 5.14.05.14.2_3 - 5.16.05.16.2_1 - - - - -

Perl developers report:

-
-

In order to prevent an algorithmic complexity attack - against its hashing mechanism, perl will sometimes - recalculate keys and redistribute the contents of a hash. - This mechanism has made perl robust against attacks that - have been demonstrated against other systems.

-

Research by Yves Orton has recently uncovered a flaw in - the rehashing code which can result in pathological - behavior. This flaw could be exploited to carry out a - denial of service attack against code that uses arbitrary - user input as hash keys.

-

Because using user-provided strings as hash keys is a - very common operation, we urge users of perl to update their - perl executable as soon as possible.

-
- - - - CVE-2013-1667 - http://www.nntp.perl.org/group/perl.perl5.porters/2013/03/msg199755.html - - - 2013-03-04 - 2013-03-10 - 2016-08-22 - - - - - libpurple -- multiple vulnerabilities - - - libpurple - 2.10.7 - - - - -

Pidgin reports:

-
-

libpurple

-

Fix a crash when receiving UPnP responses with abnormally long values.

-

MXit

-

Fix two bugs where a remote MXit user could possibly specify a local file - path to be written to.

-

Fix a bug where the MXit server or a man-in-the-middle could potentially - send specially crafted data that could overflow a buffer and lead to a crash - or remote code execution.

-

Sametime

-

Fix a crash in Sametime when a malicious server sends us an abnormally long - user ID.

-
- - - - CVE-2013-0274 - CVE-2013-0271 - CVE-2013-0272 - CVE-2013-0273 - https://developer.pidgin.im/wiki/ChangeLog - - - 2013-02-13 - 2013-03-10 - 2013-03-16 - - - - - mozilla -- use-after-free in HTML Editor - - - firefox - 18.0,119.0.2,1 - 17.0.3,1 - - - linux-firefox - 17.0.4,1 - - - linux-seamonkey - 2.16.1 - - - linux-thunderbird - 17.0.4 - - - seamonkey - 2.16.1 - - - thunderbird - 11.017.0.4 - 10.0.12 - - - - -

The Mozilla Project reports:

-
-

MFSA 2013-29 Use-after-free in HTML Editor

-
- - - - CVE-2013-0787 - http://www.mozilla.org/security/announce/2013/mfsa2013-29.html - http://www.mozilla.org/security/known-vulnerabilities/ - - - 2013-03-07 - 2013-03-08 - - - - - typo3 -- Multiple vulnerabilities in TYPO3 Core - - - typo3 - 4.5.04.5.23 - 4.6.04.6.16 - 4.7.04.7.8 - 6.0.06.0.2 - - - - -

Typo Security Team reports:

-
-

Extbase Framework - Failing to sanitize user input, the Extbase - database abstraction layer is susceptible to SQL Injection. TYPO3 - sites which have no Extbase extensions installed are not affected. - Extbase extensions are affected if they use the Query Object Model - and relation values are user generated input. Credits go to Helmut - Hummel and Markus Opahle who discovered and reported the issue.

-

Access tracking mechanism - Failing to validate user provided - input, the access tracking mechanism allows redirects to arbitrary - URLs. To fix this vulnerability, we had to break existing - behaviour of TYPO3 sites that use the access tracking mechanism - (jumpurl feature) to transform links to external sites. The link - generation has been changed to include a hash that is checked - before redirecting to an external URL. This means that old links - that have been distributed (e.g. by a newsletter) will not work - any more.

-
- - - - http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-001/ - - - 2013-03-06 - 2013-03-06 - - - - - stunnel -- Remote Code Execution - - - stunnel - 4.214.55 - - - - -

Michal Trojnara reports:

-
-

64-bit versions of stunnel with the following conditions: - * NTLM authentication enabled - * CONNECT protocol negotiation enabled - * Configured in SSL client mode - * An attacker that can either control the proxy server specified in - the "connect" option or execute MITM attacks on the TCP session - between stunnel and the proxy

-

Can be exploited for remote code execution. The code is executed - within the configured chroot directory, with privileges of the - configured user and group.

-
- - - - CVE-2013-1762 - https://www.stunnel.org/CVE-2013-1762.html - - - 2013-03-03 - 2013-03-03 - - - - - apache22 -- several vulnerabilities - - - apache22 - 2.2.02.2.24 - - - apache22-event-mpm - 2.2.02.2.24 - - - apache22-itk-mpm - 2.2.02.2.24 - - - apache22-peruser-mpm - 2.2.02.2.24 - - - apache22-worker-mpm - 2.2.02.2.24 - - - - -

Apache HTTP SERVER PROJECT reports:

-
-

low: XSS due to unescaped hostnames CVE-2012-3499

-

Various XSS flaws due to unescaped hostnames and URIs HTML output in - mod_info, mod_status, mod_imagemap, mod_ldap, and mod_proxy_ftp.

-

moderate: XSS in mod_proxy_balancer CVE-2012-4558

-

A XSS flaw affected the mod_proxy_balancer manager interface.

-
- - - - CVE-2012-3499 - CVE-2012-4558 - - - 2012-10-07 - 2013-03-02 - - - - - sudo -- Authentication bypass when clock is reset - - - sudo - 1.8.6.p7 - - - - -

Todd Miller reports:

-
-

The flaw may allow someone with physical access to a machine that - is not password-protected to run sudo commands without knowing the - logged in user's password. On systems where sudo is the principal - way of running commands as root, such as on Ubuntu and Mac OS X, - there is a greater chance that the logged in user has run sudo - before and thus that an attack would succeed.

-
- - - - CVE-2013-1775 - http://www.sudo.ws/sudo/alerts/epoch_ticket.html - - - 2013-02-27 - 2013-03-01 - - - - - sudo -- Potential bypass of tty_tickets constraints - - - sudo - 1.8.6.p7 - - - - -

Todd Miller reports:

-
-

A (potentially malicious) program run by a user with sudo access - may be able to bypass the "tty_ticket" constraints. In order for - this to succeed there must exist on the machine a terminal device - that the user has previously authenticated themselves on via sudo - within the last time stamp timeout (5 minutes by default).

-
- - - - CVE-2013-1776 - http://www.sudo.ws/sudo/alerts/tty_tickets.html - - - 2013-02-27 - 2013-03-01 - - - - - rubygem-dragonfly -- arbitrary code execution - - - rubygem18-dragonfly - rubygem19-dragonfly - rubygem20-dragonfly - 0.9.14 - - - - -

Mark Evans reports:

-
-

Unfortnately there is a security vulnerability in Dragonfly when - used with Rails which would potentially allow an attacker to run - arbitrary code on a host machine using carefully crafted - requests. -

-
- - - - CVE-2013-1756 - - - 2013-02-19 - 2013-02-28 - - - - - linux-flashplugin -- multiple vulnerabilities - - - linux-f10-flashplugin - 11.2r202.273 - - - - -

Adobe reports:

-
-

These updates address vulnerabilities that could cause a crash - and potentially allow an attacker to take control of the affected system.

-
- - - - CVE-2013-0504 - CVE-2013-0643 - CVE-2013-0648 - - - 2013-02-26 - 2013-02-27 - - - - - otrs -- XSS vulnerability could lead to remote code execution - - - otrs - 3.1.*3.1.11 - - - - -

The OTRS Project reports:

-
-

This advisory covers vulnerabilities discovered in the OTRS core - system. This is a variance of the XSS vulnerability, where an attacker - could send a specially prepared HTML email to OTRS which would cause - JavaScript code to be executed in your browser while displaying the - email. In this case this is achieved by using javascript source - attributes with whitespaces.

-

Affected by this vulnerability are all releases of OTRS 2.4.x up to - and including 2.4.14, 3.0.x up to and including 3.0.16 and 3.1.x up to - and including 3.1.10.

-
- - - - CVE-2012-4751 - http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-03 - - - 2012-10-16 - 2013-02-25 - - - - - otrs -- XSS vulnerability in Firefox and Opera could lead to remote code execution - - - otrs - 3.1.*3.1.10 - - - - -

The OTRS Project reports:

-
-

This advisory covers vulnerabilities discovered in the OTRS core - system. This is a variance of the XSS vulnerability, where an attacker - could send a specially prepared HTML email to OTRS which would cause - JavaScript code to be executed in your browser while displaying the - email in Firefox and Opera. In this case this is achieved with an - invalid HTML structure with nested tags.

-

Affected by this - vulnerability are all releases of OTRS 2.4.x up to and including - 2.4.13, 3.0.x up to and including 3.0.15 and 3.1.x up to and including - 3.1.9 in combination with Firefox and Opera.

-
- - - - CVE-2012-4600 - http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-02 - - - 2012-08-30 - 2013-02-25 - - - - - otrs -- XSS vulnerability in Internet Explorer could lead to remote code execution - - - otrs - 3.1.*3.1.9 - - - - -

The OTRS Project reports:

-
-

This advisory covers vulnerabilities discovered in the OTRS core - system. Due to the XSS vulnerability in Internet Explorer an attacker - could send a specially prepared HTML email to OTRS which would cause - JavaScript code to be executed in your Internet Explorer while - displaying the email.

-

Affected by this vulnerability are all releases of OTRS 2.4.x up to - and including 2.4.12, 3.0.x up to and including 3.0.14 and 3.1.x up to - and including 3.1.8 in combination with Internet Explorer.

-
- - - - CVE-2012-2582 - http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-01 - - - 2012-08-22 - 2013-02-25 - - - - - ruby -- DoS vulnerability in REXML - - - ruby - 1.9,11.9.3.392,1 - - - - -

Ruby developers report:

-
-

Unrestricted entity expansion can lead to a DoS vulnerability in - REXML. (The CVE identifier will be assigned later.) We strongly - recommend to upgrade ruby. -

-

When reading text nodes from an XML document, the REXML parser can - be coerced in to allocating extremely large string objects which - can consume all of the memory on a machine, causing a denial of - service. -

-
- - - - http://www.ruby-lang.org/en/news/2013/02/22/rexml-dos-2013-02-22/ - - - 2013-02-22 - 2013-02-24 - - - - - rubygem-ruby_parser -- insecure tmp file usage - - - rubygem18-ruby_parser - rubygem19-ruby_parser - rubygem20-ruby_parser - 3.1.1 - - - - -

Michael Scherer reports:

-
-

This is a relatively minor tmp file usage issue.

-
- - - - CVE-2013-0162 - - - 2013-02-24 - 2013-02-24 - - - - - django -- multiple vulnerabilities - - - py26-django - py27-django - 1.31.3.6 - 1.41.4.4 - - - - -

The Django Project reports:

-
-

These security releases fix four issues: one potential phishing - vector, one denial-of-service vector, an information leakage issue, - and a range of XML vulnerabilities.

-
    -
  1. -

    Host header poisoning

    -

    an attacker could cause Django to generate and display URLs that - link to arbitrary domains. This could be used as part of a phishing - attack. These releases fix this problem by introducing a new - setting, ALLOWED_HOSTS, which specifies a whitelist of domains your - site is known to respond to.

    -

    Important: by default Django 1.3.6 and 1.4.4 set ALLOWED_HOSTS to - allow all hosts. This means that to actually fix the security - vulnerability you should define this setting yourself immediately - after upgrading.

    -
    2. -
  2. -

    Formset denial-of-service

    -

    an attacker can abuse Django's tracking of the number of forms in - a formset to cause a denial-of-service attack. This has been fixed - by adding a default maximum number of forms of 1,000. You can still - manually specify a bigger max_num, if you wish, but 1,000 should be - enough for anyone.

    -
    3. -
  3. -

    XML attacks

    -

    Django's serialization framework was vulnerable to attacks via XML - entity expansion and external references; this is now fixed. - However, if you're parsing arbitrary XML in other parts of your - application, we recommend you look into the defusedxml Python - packages which remedy this anywhere you parse XML, not just via - Django's serialization framework.

    -
    4. -
  4. -

    Data leakage via admin history log

    -

    Django's admin interface could expose supposedly-hidden - information via its history log. This has been fixed.

    -
    5. -
-
- - - - CVE-2013-1664 - CVE-2013-1665 - CVE-2013-0305 - CVE-2013-0306 - 58022 - 58061 - - - 2013-02-21 - 2013-02-24 - - - - - krb5 -- null pointer dereference in the KDC PKINIT code [CVE-2013-1415] - - - krb5 - 1.11 - - - - -

No advisory has been released yet.

-
-

Fix a null pointer dereference in the KDC PKINIT code [CVE-2013-1415].

-
- - - - CVE-2013-1415 - http://web.mit.edu/kerberos/www/krb5-1.11/ - - - 2013-02-21 - 2013-02-22 - - - - - FreeBSD -- glob(3) related resource exhaustion - - - FreeBSD - 7.47.4_12 - 8.38.3_6 - 9.09.0_6 - 9.19.1_1 - - - - -

Problem description:

-
-

GLOB_LIMIT is supposed to limit the number of paths to prevent against - memory or CPU attacks. The implementation however is insufficient.

-
- - - - SA-13:02.libc - CVE-2010-2632 - - - 2013-02-19 - 2013-02-21 - 2016-08-09 - - - - - FreeBSD -- BIND remote DoS with deliberately crafted DNS64 query - - - FreeBSD - 9.09.0_6 - 9.19.1_1 - - - - -

Problem description:

-
-

Due to a software defect a crafted query can cause named(8) to crash - with an assertion failure.

-
- - - - SA-13:01.bind - CVE-2012-5688 - - - 2013-02-19 - 2013-02-21 - - - - - drupal7 -- Denial of service - - - drupal7 - 7.19 - - - - -

Drupal Security Team reports:

-
-

Drupal core's Image module allows for the on-demand generation - of image derivatives. This capability can be abused by requesting - a large number of new derivatives which can fill up the server disk - space, and which can cause a very high CPU load. Either of these - effects may lead to the site becoming unavailable or unresponsive.

-
- - - - CVE-2013-0316 - https://drupal.org/SA-CORE-2013-002 - - - 2013-02-20 - 2013-02-21 - - - - - nss-pam-ldapd -- file descriptor buffer overflow - - - nss-pam-ldapd - 0.8.12 - - - - -

Garth Mollett reports:

-
-

A file descriptor overflow issue in the use of FD_SET() - in nss-pam-ldapd can lead to a stack-based buffer overflow. - An attacker could, under some circumstances, use this flaw - to cause a process that has the NSS or PAM module loaded to - crash or potentially execute arbitrary code.

-
- - - - CVE-2013-0288 - - - 2013-02-18 - 2013-02-20 - - - - - bugzilla -- multiple vulnerabilities - - - bugzilla - de-bugzilla - ru-bugzilla - ja-bugzilla - 3.6.03.6.13 - 4.0.04.0.10 - 4.2.04.2.5 - - - - -

A Bugzilla Security Advisory reports:

-
-

Cross-Site Scripting

-

When viewing a single bug report, which is the default, - the bug ID is validated and rejected if it is invalid. - But when viewing several bug reports at once, which is - specified by the format=multiple parameter, invalid bug - IDs can go through and are sanitized in the HTML page - itself. But when an invalid page format is passed to the - CGI script, the wrong HTML page is called and data are not - correctly sanitized, which can lead to XSS.

-

Information Leak

-

When running a query in debug mode, the generated SQL - query used to collect the data is displayed. The way this - SQL query is built permits the user to determine if some - confidential field value (such as a product name) exists. - This problem only affects Bugzilla 4.0.9 and older. Newer - releases are not affected by this issue.

-
- - - - CVE-2013-0785 - https://bugzilla.mozilla.org/show_bug.cgi?id=842038 - CVE-2013-0786 - https://bugzilla.mozilla.org/show_bug.cgi?id=824399 - - - 2013-02-19 - 2013-02-20 - 2013-03-31 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 18.0,119.0,1 - 17.0.3,1 - - - linux-firefox - 17.0.3,1 - - - linux-seamonkey - 2.16 - - - linux-thunderbird - 17.0.3 - - - seamonkey - 2.16 - - - thunderbird - 11.017.0.3 - 10.0.12 - - - libxul - 1.9.2.*10.0.12 - - - - -

The Mozilla Project reports:

-
-

MFSA 2013-21 Miscellaneous memory safety hazards (rv:19.0 / - rv:17.0.3)

-

MFSA 2013-22 Out-of-bounds read in image rendering

-

MFSA 2013-23 Wrapped WebIDL objects can be wrapped again

-

MFSA 2013-24 Web content bypass of COW and SOW security wrappers

-

MFSA 2013-25 Privacy leak in JavaScript Workers

-

MFSA 2013-26 Use-after-free in nsImageLoadingContent

-

MFSA 2013-27 Phishing on HTTPS connection through malicious proxy

-

MFSA 2013-28 Use-after-free, out of bounds read, and buffer - overflow issues found using Address Sanitizer

-
- - - - CVE-2013-0765 - CVE-2013-0772 - CVE-2013-0773 - CVE-2013-0774 - CVE-2013-0775 - CVE-2013-0776 - CVE-2013-0783 - CVE-2013-0784 - http://www.mozilla.org/security/announce/2013/mfsa2013-20.html - http://www.mozilla.org/security/announce/2013/mfsa2013-21.html - http://www.mozilla.org/security/announce/2013/mfsa2013-22.html - http://www.mozilla.org/security/announce/2013/mfsa2013-23.html - http://www.mozilla.org/security/announce/2013/mfsa2013-24.html - http://www.mozilla.org/security/announce/2013/mfsa2013-25.html - http://www.mozilla.org/security/announce/2013/mfsa2013-26.html - http://www.mozilla.org/security/announce/2013/mfsa2013-27.html - http://www.mozilla.org/security/known-vulnerabilities/ - - - 2013-02-19 - 2013-02-19 - 2013-02-20 - - - - - Ruby Rack Gem -- Multiple Issues - - - rubygem18-rack - 1.4.5 - - - rubygem19-rack - 1.4.5 - - - - -

Rack developers report:

-
-

Today we are proud to announce the release of Rack 1.4.5.

-

Fix CVE-2013-0263, timing attack against Rack::Session::Cookie

-

Fix CVE-2013-0262, symlink path traversal in Rack::File

-
- - - - CVE-2013-0262 - CVE-2013-0263 - - - 2013-02-08 - 2013-02-17 - - - - - Ruby Activemodel Gem -- Circumvention of attr_protected - - - rubygem18-activemodel - 3.2.12 - - - rubygem19-activemodel - 3.2.12 - - - - -

Aaron Patterson reports:

-
-

The attr_protected method allows developers to specify a blacklist - of model attributes which users should not be allowed to assign to. - By using a specially crafted request, attackers could circumvent - this protection and alter values that were meant to be protected.

-

All users running an affected release should either upgrade or use - one of the work arounds immediately. Users should also consider - switching from attr_protected to the whitelist method - attr_accessible which is not vulnerable to this attack.

-
- - - - CVE-2013-0276 - - - 2013-02-11 - 2013-02-17 - - - - - jenkins -- multiple vulnerabilities - - - jenkins - 1.501 - - - - -

Jenkins Security Advisory reports:

-
-

This advisory announces multiple security vulnerabilities that - were found in Jenkins core.

-
    -
  1. One of the vulnerabilities allows cross-site request - forgery (CSRF) attacks on Jenkins master, which causes an user - to make unwanted actions on Jenkins. Another vulnerability - enables cross-site scripting (XSS) attacks, which has the similar - consequence. Another vulnerability allowed an attacker to bypass - the CSRF protection mechanism in place, thereby mounting more CSRF - attackes. These attacks allow an attacker without direct access to - Jenkins to mount an attack.
    2. -
  2. In the fourth vulnerability, a malicious user of Jenkins can trick - Jenkins into building jobs that he does not have direct access to.
    3. -
  3. And lastly, a vulnerability allows a malicious user of Jenkins to - mount a denial of service attack by feeding a carefully crafted - payload to Jenkins.
    4. -
-
- - - - https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-02-16 - - - 2013-02-16 - 2013-02-17 - - - - - poweradmin -- multiple XSS vulnerabilities - - - poweradmin - 2.1.6 - - - - -

Multiple cross-site scripting (XSS) vulnerabilities

-
-

Multiple scripts are vulnerable to XSS attacks.

-
- - - - 55619 - http://packetstormsecurity.com/files/116698/Poweradmin-Cross-Site-Scripting.html - - - 2012-01-12 - 2013-02-16 - - - - - Ruby -- Denial of Service and Unsafe Object Creation Vulnerability in JSON - - - ruby - 1.9,11.9.3.385,1 - - - rubygem18-json - 1.7.7 - - - rubygem19-json - 1.7.7 - - - rubygem18-json_pure - 1.7.7 - - - rubygem19-json_pure - 1.7.7 - - - - -

Aaron Patterson reports:

-
-

When parsing certain JSON documents, the JSON gem can be coerced in - to creating Ruby symbols in a target system. Since Ruby symbols - are not garbage collected, this can result in a denial of service - attack.

-

The same technique can be used to create objects in a target system - that act like internal objects. These "act alike" objects can be - used to bypass certain security mechanisms and can be used as a - spring board for SQL injection attacks in Ruby on Rails.

-
- - - - CVE-2013-0269 - - - 2013-02-11 - 2013-02-16 - - - - - Ruby -- XSS exploit of RDoc documentation generated by rdoc - - - ruby - 1.9,11.9.3.385,1 - - - rubygem18-rdoc - 3.12.1 - - - rubygem19-rdoc - 3.12.1 - - - - -

Ruby developers report:

-
-

RDoc documentation generated by rdoc bundled with ruby are - vulnerable to an XSS exploit. All ruby users are recommended to - update ruby to newer version which includes security-fixed RDoc. If - you are publishing RDoc documentation generated by rdoc, you are - recommended to apply a patch for the documentaion or re-generate it - with security-fixed RDoc. -

-
- - - - CVE-2013-0256 - - - 2013-02-06 - 2013-02-16 - - - - - linux-flashplugin -- multiple vulnerabilities - - - linux-f10-flashplugin - 11.2r202.262 - - - - -

Adobe reports:

-
-

These updates address vulnerabilities that could cause a crash - and potentially allow an attacker to take control of the affected system.

-
- - - - CVE-2013-0633 - CVE-2013-0634 - https://www.adobe.com/support/security/bulletins/apsb13-04.html - - - 2013-02-07 - 2013-02-08 - - - - - OpenSSL -- TLS 1.1, 1.2 denial of service - - - openssl - 1.0.1_6 - - - - -

OpenSSL security team reports:

-
-

A flaw in the OpenSSL handling of CBC mode ciphersuites in TLS 1.1 - and TLS 1.2 on AES-NI supporting platforms can be exploited in a - DoS attack.

-

A flaw in the OpenSSL handling of OCSP response verification can - be exploited in a denial of service attack.

-
- - - - CVE-2012-2686 - CVE-2013-0166 - CVE-2013-0169 - http://www.openssl.org/news/secadv_20120510.txt - - - 2013-02-05 - 2013-02-06 - - - - - mysql/mariadb/percona server -- multiple vulnerabilities - - - mysql-server - 5.15.1.67 - 5.55.5.29 - - - mariadb-server - 5.35.3.12 - 5.55.5.29 - - - percona-server - 5.55.5.29.29.4 - - - - -

ORACLE reports:

-
-

Multiple SQL injection vulnerabilities in the replication code

-

Stack-based buffer overflow

-

Heap-based buffer overflow

-
- - - - CVE-2012-4414 - CVE-2012-5611 - CVE-2012-5612 - CVE-2012-5615 - CVE-2012-5627 - https://mariadb.atlassian.net/browse/MDEV-4029 - https://mariadb.atlassian.net/browse/MDEV-MDEV-729 - https://mariadb.atlassian.net/browse/MDEV-MDEV-729 - http://www.mysqlperformanceblog.com/2013/01/23/announcing-percona-server-5-5-29-29-4/ - - - 2012-12-01 - 2013-02-01 - - - - - opera -- execution of arbitrary code - - - opera - opera-devel - linux-opera - linux-opera-devel - 12.13 - - - - -

Opera reports:

-
-

Particular DOM event manipulations can cause Opera to crash. In - some cases, this crash might occur in a way that allows execution - of arbitrary code. To inject code, additional techniques would - have to be employed.

-
- - - - http://www.opera.com/support/kb/view/1042/ - http://www.opera.com/support/kb/view/1043/ - - - 2013-01-30 - 2013-02-01 - - - - - upnp -- multiple vulnerabilities - - - upnp - 1.6.18 - - - - -

Project changelog reports:

-
-

This patch addresses three possible buffer overflows in - function unique_service_name().The three issues have the - folowing CVE numbers:

-
    -
  • CVE-2012-5958 Issue #2: Stack buffer overflow of Tempbuf
    • -
  • CVE-2012-5959 Issue #4: Stack buffer overflow of Event->UDN
    • -
  • CVE-2012-5960 Issue #8: Stack buffer overflow of Event->UDN
    • -
-

Notice that the following issues have already been dealt by - previous work:

-
    -
  • CVE-2012-5961 Issue #1: Stack buffer overflow of Evt->UDN
    • -
  • CVE-2012-5962 Issue #3: Stack buffer overflow of Evt->DeviceType
    • -
  • CVE-2012-5963 Issue #5: Stack buffer overflow of Event->UDN
    • -
  • CVE-2012-5964 Issue #6: Stack buffer overflow of Event->DeviceType
    • -
  • CVE-2012-5965 Issue #7: Stack buffer overflow of Event->DeviceType
    • -
-
- - - - CVE-2012-5958 - CVE-2012-5959 - CVE-2012-5960 - CVE-2012-5961 - CVE-2012-5962 - CVE-2012-5963 - CVE-2012-5964 - CVE-2012-5965 - - - 2012-11-21 - 2013-01-30 - - - - - wordpress -- multiple vulnerabilities - - - wordpress - 3.5.1,1 - - - zh-wordpress-zh_CN - 3.5.1 - - - zh-wordpress-zh_TW - 3.5.1 - - - de-wordpress - 3.5.1 - - - ja-wordpress - 3.5.1 - - - ru-wordpress - 3.5.1 - - - - -

Wordpress reports:

-
-

WordPress 3.5.1 also addresses the following security issues:

-
    -
  • A server-side request forgery vulnerability and remote port - scanning using pingbacks. This vulnerability, which could - potentially be used to expose information and compromise a - site, affects all previous WordPress versions. This was fixed - by the WordPress security team. We'd like to thank security - researchers Gennady - Kovshenin and Ryan - Dewhurst for reviewing our work.
    • -
  • Two instances of cross-site scripting via shortcodes and post - content. These issues were discovered by Jon Cave of the WordPress - security team.
    • -
  • A cross-site scripting vulnerability in the external library - Plupload. Thanks to the Moxiecode team for working with us on - this, and for releasing Plupload 1.5.5 to address this issue.
    • -
-
- - - - CVE-2013-0235 - CVE-2013-0236 - CVE-2013-0237 - - - 2013-01-24 - 2013-01-29 - 2014-04-30 - - - - - django-cms -- XSS Vulnerability - - - py-django-cms - 2.3.5 - - - - -

Cross-site scripting (XSS) vulnerability

-
-

Jonas Obrist reports: The security issue allows users with limited - admin access to elevate their privileges through XSS injection - using the page_attribute template tag. Only users with admin access - and the permission to edit at least one django CMS page object - could exploit this vulnerability. Websites that do not use the - page_attribute template tag are not affected.

-
- - - - https://www.django-cms.org/en/blog/2012/12/04/2-3-5-security-release/ - - - 2012-12-04 - 2013-01-25 - - - - - drupal -- multiple vulnerabilities - - - drupal6 - 6.28 - - - drupal7 - 7.19 - - - - -

Drupal Security Team reports:

-
-

Cross-site scripting (Various core and contributed modules)

-

Access bypass (Book module printer friendly version)

-

Access bypass (Image module)

-
- - - - https://drupal.org/SA-CORE-2013-001 - - - 2013-01-16 - 2013-01-20 - - - - - ettercap -- buffer overflow in target list parsing - - - ettercap - 0.7.4.1 - 0.7.50.7.5.2 - - - - -

Host target list parsing routine in ettercap - 0.7.4-series prior to 0.7.4.1 and 0.7.5-series - is prone to the stack-based buffer overflow that - may lead to the code execution with the privileges - of the ettercap process.

-

In order to trigger this vulnerability, user or service - that use ettercap should be tricked to pass the crafted list - of targets via the "-j" option.

- - - - CVE-2013-0722 - http://www.exploit-db.com/exploits/23945/ - https://secunia.com/advisories/51731/ - - - 2013-01-07 - 2013-01-16 - - - - - java 7.x -- security manager bypass - - - openjdk7 - 0 - - - linux-sun-jdk - 7.07.11 - - - linux-sun-jre - 7.07.11 - - - - -

US CERT reports:

-
-

Java 7 Update 10 and earlier versions of Java 7 contain a - vulnerability that can allow a remote, unauthenticated - attacker to execute arbitrary code on a vulnerable - system.

-

The Java JRE plug-in provides its own Security Manager. - Typically, a web applet runs with a security manager - provided by the browser or Java Web Start plugin. Oracle's - document states, "If there is a security manager already - installed, this method first calls the security manager's - checkPermission method with a - RuntimePermission("setSecurityManager") permission to ensure - it's safe to replace the existing security manager. This may - result in throwing a SecurityException".

-

By leveraging the vulnerability in the Java Management - Extensions (JMX) MBean components, unprivileged Java code - can access restricted classes. By using that vulnerability - in conjunction with a second vulnerability involving the - Reflection API and the invokeWithArguments method of the - MethodHandle class, an untrusted Java applet can escalate - its privileges by calling the the setSecurityManager() - function to allow full privileges, without requiring code - signing. Oracle Java 7 update 10 and earlier Java 7 versions - are affected. The invokeWithArguments method was introduced - with Java 7, so therefore Java 6 is not affected.

-

This vulnerability is being attacked in the wild, and is - reported to be incorporated into exploit kits. Exploit code - for this vulnerability is also publicly available.

-
-

Esteban Guillardoy from Immunity Inc. additionally clarifies - on the recursive reflection exploitation technique:

-
-

The real issue is in the native - sun.reflect.Reflection.getCallerClass method.

-

We can see the following information in the Reflection - source code:

-

Returns the class of the method realFramesToSkip frames - up the stack (zero-based), ignoring frames associated with - java.lang.reflect.Method.invoke() and its - implementation.

-

So what is happening here is that they forgot to skip the - frames related to the new Reflection API and only the old - reflection API is taken into account.

-
-

This exploit does not only affect Java applets, but every - piece of software that relies on the Java Security Manager for - sandboxing executable code is affected: malicious code can - totally disable Security Manager.

-

For users who are running native Web browsers with enabled - Java plugin, the workaround is to remove the java/icedtea-web - port and restart all browser instances.

-

For users who are running Linux Web browser flavors, the - workaround is either to disable the Java plugin in browser - or to upgrade linux-sun-* packages to the non-vulnerable - version.

-

It is not recommended to run untrusted applets using - appletviewer, since this may lead to the execution of the - malicious code on vulnerable versions on JDK/JRE.

- - - - CVE-2013-0433 - 625617 - http://www.oracle.com/technetwork/topics/security/alert-cve-2013-0422-1896849.html - https://partners.immunityinc.com/idocs/Java%20MBeanInstantiator.findClass%200day%20Analysis.pdf - - - 2013-01-10 - 2013-01-14 - - - - - nagios -- buffer overflow in history.cgi - - - nagios - 3.4.3_1 - - - - -

full disclosure reports:

-
-

history.cgi is vulnerable to a buffer overflow due to the use of - sprintf with user supplied data that has not been restricted in size.

-
- - - - CVE-2012-6096 - http://archives.neohapsis.com/archives/fulldisclosure/2012-12/0108.html - http://nagios.svn.sourceforge.net/viewvc/nagios?view=revision&revision=2547 - - - 2012-12-21 - 2013-01-10 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 11.0,117.0.2,1 - 10.0.12,1 - - - linux-firefox - 17.0.2,1 - - - linux-seamonkey - 2.15 - - - linux-thunderbird - 17.0.2 - - - seamonkey - 2.15 - - - thunderbird - 11.017.0.2 - 10.0.12 - - - libxul - 1.9.2.*10.0.12 - - - ca_root_nss - 3.14.1 - - - - -

The Mozilla Project reports:

-
-

MFSA 2013-01 Miscellaneous memory safety hazards (rv:18.0/ - rv:10.0.12 / rv:17.0.2)

-

MFSA 2013-02 Use-after-free and buffer overflow issues found using - Address Sanitizer

-

MFSA 2013-03 Buffer Overflow in Canvas

-

MFSA 2013-04 URL spoofing in addressbar during page loads

-

MFSA 2013-05 Use-after-free when displaying table with many - columns and column groups

-

MFSA 2013-06 Touch events are shared across iframes

-

MFSA 2013-07 Crash due to handling of SSL on threads

-

MFSA 2013-08 AutoWrapperChanger fails to keep objects alive during - garbage collection

-

MFSA 2013-09 Compartment mismatch with quickstubs returned values

-

MFSA 2013-10 Event manipulation in plugin handler to bypass - same-origin policy

-

MFSA 2013-11 Address space layout leaked in XBL objects

-

MFSA 2013-12 Buffer overflow in Javascript string concatenation

-

MFSA 2013-13 Memory corruption in XBL with XML bindings containing - SVG

-

MFSA 2013-14 Chrome Object Wrapper (COW) bypass through changing - prototype

-

MFSA 2013-15 Privilege escalation through plugin objects

-

MFSA 2013-16 Use-after-free in serializeToStream

-

MFSA 2013-17 Use-after-free in ListenerManager

-

MFSA 2013-18 Use-after-free in Vibrate

-

MFSA 2013-19 Use-after-free in Javascript Proxy objects

-

MFSA 2013-20 Mis-issued TURKTRUST certificates

-
- - - - CVE-2012-5829 - CVE-2013-0743 - CVE-2013-0744 - CVE-2013-0745 - CVE-2013-0746 - CVE-2013-0747 - CVE-2013-0748 - CVE-2013-0749 - CVE-2013-0750 - CVE-2013-0751 - CVE-2013-0752 - CVE-2013-0753 - CVE-2013-0754 - CVE-2013-0755 - CVE-2013-0756 - CVE-2013-0757 - CVE-2013-0758 - CVE-2013-0759 - CVE-2013-0760 - CVE-2013-0761 - CVE-2013-0762 - CVE-2013-0763 - CVE-2013-0764 - CVE-2013-0766 - CVE-2013-0767 - CVE-2013-0768 - CVE-2013-0769 - CVE-2013-0770 - CVE-2013-0771 - http://www.mozilla.org/security/announce/2013/mfsa2013-01.html - http://www.mozilla.org/security/announce/2013/mfsa2013-02.html - http://www.mozilla.org/security/announce/2013/mfsa2013-03.html - http://www.mozilla.org/security/announce/2013/mfsa2013-04.html - http://www.mozilla.org/security/announce/2013/mfsa2013-05.html - http://www.mozilla.org/security/announce/2013/mfsa2013-06.html - http://www.mozilla.org/security/announce/2013/mfsa2013-07.html - http://www.mozilla.org/security/announce/2013/mfsa2013-08.html - http://www.mozilla.org/security/announce/2013/mfsa2013-09.html - http://www.mozilla.org/security/announce/2013/mfsa2013-10.html - http://www.mozilla.org/security/announce/2013/mfsa2013-11.html - http://www.mozilla.org/security/announce/2013/mfsa2013-12.html - http://www.mozilla.org/security/announce/2013/mfsa2013-13.html - http://www.mozilla.org/security/announce/2013/mfsa2013-14.html - http://www.mozilla.org/security/announce/2013/mfsa2013-15.html - http://www.mozilla.org/security/announce/2013/mfsa2013-16.html - http://www.mozilla.org/security/announce/2013/mfsa2013-17.html - http://www.mozilla.org/security/announce/2013/mfsa2013-18.html - http://www.mozilla.org/security/announce/2013/mfsa2013-19.html - http://www.mozilla.org/security/announce/2013/mfsa2013-20.html - http://www.mozilla.org/security/known-vulnerabilities/ - - - 2013-01-08 - 2013-01-09 - - - - - rubygem-rails -- multiple vulnerabilities - - - rubygem-rails - 3.2.11 - - - rubygem-actionpack - 3.2.11 - - - rubygem-activerecord - 3.2.11 - - - rubygem-activesupport - 3.2.11 - - - - -

Ruby on Rails team reports:

-
-

Two high-risk vulnerabilities have been discovered:

-

(CVE-2013-0155) There is a vulnerability when Active Record is - used in conjunction with JSON parameter parsing.

-

Due to the way Active Record interprets parameters in combination - with the way that JSON parameters are parsed, it is possible for an - attacker to issue unexpected database queries with "IS NULL" or - empty "WHERE" clauses. This issue does not let an attacker insert - arbitrary values into an SQL query, however they can cause the - query to check for NULL or eliminate a WHERE clause when most users - would not expect it.

-

(CVE-2013-0156) There are multiple weaknesses in the parameter - parsing code for Ruby on Rails which allows attackers to bypass - authentication systems, inject arbitrary SQL, inject and execute - arbitrary code, or perform a DoS attack on a Rails application.

-

The parameter parsing code of Ruby on Rails allows applications to - automatically cast values from strings to certain data types. - Unfortunately the type casting code supported certain conversions - which were not suitable for performing on user-provided data - including creating Symbols and parsing YAML. These unsuitable - conversions can be used by an attacker to compromise a Rails - application.

-
- - - - CVE-2013-0155 - CVE-2013-0156 - http://weblog.rubyonrails.org/2013/1/8/Rails-3-2-11-3-1-10-3-0-19-and-2-3-15-have-been-released/ - https://groups.google.com/forum/?fromgroups#!topic/rubyonrails-security/t1WFuuQyavI - https://groups.google.com/forum/?fromgroups#!topic/rubyonrails-security/61bkgvnSGTQ - - - 2013-01-08 - 2013-01-08 - - - - - rubygem-rails -- SQL injection vulnerability - - - rubygem-rails - 3.2.10 - - - - -

Ruby on Rails team reports:

-
-

There is a SQL injection vulnerability in Active Record in ALL - versions. Due to the way dynamic finders in Active Record extract - options from method parameters, a method parameter can mistakenly - be used as a scope. Carefully crafted requests can use the scope - to inject arbitrary SQL.

-
- - - - CVE-2012-5664 - https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/DCNTNp_qjFM - - - 2013-01-02 - 2013-01-07 - - - - - jenkins -- HTTP access to the server to retrieve the master cryptographic key - - - jenkins - 1.498 - - - - -

Jenkins Security Advisory reports:

-
-

This advisory announces a security vulnerability that was found - in Jenkins core.

-

An attacker can then use this master cryptographic key to mount - remote code execution attack against the Jenkins master, or - impersonate arbitrary users in making REST API calls.

-

There are several factors that mitigate some of these problems - that may apply to specific installations.

-
    -
  • The particular attack vector is only applicable on Jenkins - instances that have slaves attached to them, and allow - anonymous read access.
    • -
  • Jenkins allows users to re-generate the API tokens. Those - re-generated API tokens cannot be impersonated by the - attacker.
    • -
-
- - - - https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-01-04 - - - 2013-01-04 - 2013-01-08 - - - - - django -- multiple vulnerabilities - - - django - 1.4.3 - - - django13 - 1.3.5 - - - - -

The Django Project reports:

-
-
    -
  1. -

    Host header poisoning

    -

    Several earlier Django security releases focused on the issue of - poisoning the HTTP Host header, causing Django to generate URLs - pointing to arbitrary, potentially-malicious domains.

    -

    In response to further input received and reports of continuing - issues following the previous release, we're taking additional - steps to tighten Host header validation. Rather than attempt to - accommodate all features HTTP supports here, Django's Host header - validation attempts to support a smaller, but far more common, subset:

    -
      -
    • Hostnames must consist of characters [A-Za-z0-9] plus hyphen - ('-') or dot ('.').
      • -
    • IP addresses -- both IPv4 and IPv6 -- are permitted.
      • -
    • Port, if specified, is numeric.
      • -
    -

    Any deviation from this will now be rejected, raising the exception - django.core.exceptions.SuspiciousOperation.

    -
    2. -
  2. -

    Redirect poisoning

    -

    Also following up on a previous issue: in July of this year, we made - changes to Django's HTTP redirect classes, performing additional - validation of the scheme of the URL to redirect to (since, both - within Django's own supplied applications and many third-party - applications, accepting a user-supplied redirect target is a common - pattern).

    -

    Since then, two independent audits of the code turned up further - potential problems. So, similar to the Host-header issue, we are - taking steps to provide tighter validation in response to reported - problems (primarily with third-party applications, but to a certain - extent also within Django itself). This comes in two parts:

    -
      -
    1. A new utility function, django.utils.http.is_safe_url, is - added; this function takes a URL and a hostname, and checks - that the URL is either relative, or if absolute matches the - supplied hostname. This function is intended for use whenever - user-supplied redirect targets are accepted, to ensure that - such redirects cannot lead to arbitrary third-party sites.
      2. -
    2. All of Django's own built-in views -- primarily in the - authentication system -- which allow user-supplied redirect - targets now use is_safe_url to validate the supplied URL.
      3. -
    -
    3. -
-
- - - - https://www.djangoproject.com/weblog/2012/dec/10/security/ - - - 2012-12-10 - 2013-01-06 - - - - - freetype -- Multiple vulnerabilities - - - freetype2 - 2.4.11 - - - - -

The FreeType Project reports:

-
-

Some vulnerabilities in the BDF implementation have been fixed. - Users of this font format should upgrade.

-
- - - - http://sourceforge.net/projects/freetype/files/freetype2/2.4.11/README/view - - - 2012-12-20 - 2013-01-05 - - - - - moinmoin -- Multiple vulnerabilities - - - moinmoin - 1.9.6 - - - - -

MoinMoin developers report the following vulnerabilities - as fixed in version 1.9.6:

-
-
    -
  • remote code execution vulnerability in - twikidraw/anywikidraw action,
    • -
  • path traversal vulnerability in AttachFile action,
    • -
  • XSS issue, escape page name in rss link.
    • -
-
-

CVE entries at MITRE furher clarify:

-
-

Multiple unrestricted file upload vulnerabilities in the - (1) twikidraw (action/twikidraw.py) and (2) anywikidraw - (action/anywikidraw.py) actions in MoinMoin before 1.9.6 - allow remote authenticated users with write permissions to - execute arbitrary code by uploading a file with an - executable extension, then accessing it via a direct request - to the file in an unspecified directory, as exploited in the - wild in July 2012.

-
-
-

Directory traversal vulnerability in the - _do_attachment_move function in the AttachFile action - (action/AttachFile.py) in MoinMoin 1.9.3 through 1.9.5 - allows remote attackers to overwrite arbitrary files via a - .. (dot dot) in a file name.

-
-
-

Cross-site scripting (XSS) vulnerability in the rsslink - function in theme/__init__.py in MoinMoin 1.9.5 allows - remote attackers to inject arbitrary web script or HTML - via the page name in a rss link.

-
- - - - CVE-2012-6081 - CVE-2012-6080 - CVE-2012-6082 - http://hg.moinmo.in/moin/1.9/raw-file/1.9.6/docs/CHANGES - http://www.debian.org/security/2012/dsa-2593 - - - 2012-12-29 - 2013-01-05 - 2013-01-06 - - - - - asterisk -- multiple vulnerabilities - - - asterisk11 - 11.*11.1.2 - - - asterisk10 - 10.*10.11.1 - - - asterisk18 - 1.8.*1.8.19.1 - - - - -

Asterisk project reports:

-
-

Crashes due to large stack allocations when using TCP

-

Denial of Service Through Exploitation of Device State Caching

-
- - - - CVE-2012-5976 - CVE-2012-5977 - http://downloads.digium.com/pub/security/AST-2012-014.html - http://downloads.digium.com/pub/security/AST-2012-015.html - https://www.asterisk.org/security - - - 2013-01-02 - 2013-01-03 - - - - - ircd-ratbox and charybdis -- remote DoS vulnerability - - - ircd-ratbox - 2.*3.0.8 - - - charybdis - 3.4.2 - - - - -

atheme.org reports:

-
-

All versions of Charybdis are vulnerable to a remotely-triggered - crash bug caused by code originating from ircd-ratbox 2.0. - (Incidentally, this means all versions since ircd-ratbox 2.0 are - also vulnerable.)

-
- - - - http://www.ratbox.org/ASA-2012-12-31.txt - - - 2012-12-31 - 2013-01-02 - - - - - puppet -- multiple vulnerabilities - - - puppet - 2.6.*2.6.17 - - - - -

puppet -- multiple vulnerabilities

-
-

Arbitrary file read on the puppet master from authenticated clients (high). It is possible to construct an HTTP get request from an authenticated client with a valid certificate that will return the contents of an arbitrary file on the Puppet master that the master has read-access to.

-

Arbitrary file delete/D.O.S on Puppet Master from authenticated clients (high). Given a Puppet master with the "Delete" directive allowed in auth.conf for an authenticated host, an attacker on that host can send a specially crafted Delete request that can cause an arbitrary file deletion on the Puppet master, potentially causing a denial of service attack. Note that this vulnerability does *not* exist in Puppet as configured by default.

-

Insufficient input validation for agent hostnames (low). An attacker could trick the administrator into signing an attacker's certificate rather than the intended one by constructing specially crafted certificate requests containing specific ANSI control sequences. It is possible to use the sequences to rewrite the order of text displayed to an administrator such that display of an invalid certificate and valid certificate are transposed. If the administrator signs the attacker's certificate, the attacker can then man-in-the-middle the agent.

-
- - - - CVE-2012-3864 - CVE-2012-3865 - CVE-2012-3867 - http://projects.puppetlabs.com/projects/puppet/wiki/Release_Notes#2.6.17 - http://puppetlabs.com/security/cve/cve-2012-3864/ - http://puppetlabs.com/security/cve/cve-2012-3865/ - http://puppetlabs.com/security/cve/cve-2012-3867/ - - - 2012-07-10 - 2012-12-30 - - - - - otrs -- XSS vulnerability - - - otrs - 3.1.11 - - - - -

OTRS Security Advisory reports:

-
-

This advisory covers vulnerabilities discovered in the OTRS core -system. This is a variance of the XSS vulnerability, where an attacker could -send a specially prepared HTML email to OTRS which would cause JavaScript code -to be executed in your browser while displaying the email. In this case this is -achieved by using javascript source attributes with whitespaces.

-
- - - - CVE-2012-4751 - http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-03/ -http://www.kb.cert.org/vuls/id/603276 - - - 2012-10-16 - 2012-12-30 - - - - - otrs -- XSS vulnerability in Firefox and Opera - - - otrs - 3.1.10 - - - - -

OTRS Security Advisory reports:

-
-

This advisory covers vulnerabilities discovered in the OTRS core -system. This is a variance of the XSS vulnerability, where an attacker could -send a specially prepared HTML email to OTRS which would cause JavaScript code -to be executed in your browser while displaying the email in Firefox and Opera. -In this case this is achieved with an invalid HTML structure with nested tags. -

-
- - - -CVE-2012-4600 - http://www.otrs.com/open-source/community-news/security-advisories/security-advisory-2012-02/ - - - 2012-08-30 - 2012-12-30 - - - - - otrs -- XSS vulnerability in Internet Explorer - - - otrs - 3.1.9 - - - - -

OTRS Security Advisory reports:

-
-

This advisory covers vulnerabilities discovered in the OTRS core -system. Due to the XSS vulnerability in Internet Explorer an attacker could send -a specially prepared HTML email to OTRS which would cause JavaScript code to be -executed in your Internet Explorer while displaying the email.

-
- - - - CVE-2012-2582 - http://www.otrs.com/open-source/community-news/security-advisories/security-advisory-2012-01/ - - - 2012-08-22 - 2012-12-30 - - - - - squid -- denial of service - - - squid - 2.7.9_4 - 3.13.1.23 - 3.23.2.6 - 3.33.3.0.3 - - - - -

Squid developers report:

-
-

Due to missing input validation Squid cachemgr.cgi tool - is vulnerable to a denial of service attack when processing - specially crafted requests.

-

This problem allows any client able to reach the - cachemgr.cgi to perform a denial of service attack on the - service host.

-

The nature of the attack may cause secondary effects - through resource consumption on the host server.

-
- - - - CVE-2012-5643 - CVE-2013-0189 - http://www.squid-cache.org/Advisories/SQUID-2012_1.txt - - - 2012-12-17 - 2012-12-28 - 2013-05-02 - - - - - opera -- execution of arbitrary code - - - opera - 12.12 - - - opera-devel - 12.12 - - - linux-opera - 12.12 - - - linux-opera-devel - 12.12 - - - - -

Opera reports:

-
-

When loading GIF images into memory, Opera should allocate the - correct amount of memory to store that image. Specially crafted - image files can cause Opera to allocate the wrong amount of memory. - Subsequent data may then overwrite unrelated memory with - attacker-controlled data. This can lead to a crash, which may also - execute that data as code.

-
- - - - http://www.opera.com/support/kb/view/1038/ - http://www.opera.com/support/kb/view/1039/ - - - 2012-12-18 - 2012-12-18 - 2014-04-30 - - - - - linux-flashplugin -- multiple vulnerabilities - - - linux-f10-flashplugin - 11.2r202.258 - - - - -

Adobe reports:

-
-

These updates address vulnerabilities that could cause a crash - and potentially allow an attacker to take control of the affected system.

-
- - - - CVE-2012-5676 - CVE-2012-5677 - CVE-2012-5678 - https://www.adobe.com/support/security/bulletins/apsb12-27.html - - - 2012-12-11 - 2012-12-14 - - - - - tomcat -- bypass of CSRF prevention filter - - - tomcat - 6.0.06.0.35 - - - tomcat7 - 7.0.07.0.31 - - - - -

The Apache Software Foundation reports:

-
-

The CSRF prevention filter could be bypassed if a request was made to a - protected resource without a session identifier present in the request.

-
- - - - CVE-2012-4431 - http://tomcat.apache.org/security-6.html - http://tomcat.apache.org/security-7.html - - - 2012-12-04 - 2012-12-04 - 2017-03-18 - - - - - tomcat -- denial of service - - - tomcat - 6.0.06.0.35 - - - tomcat7 - 7.0.07.0.27 - - - - -

The Apache Software Foundation reports:

-
-

When using the NIO connector with sendfile and HTTPS enabled, if a - client breaks the connection while reading the response an infinite loop - is entered leading to a denial of service.

-
- - - - CVE-2012-4534 - http://tomcat.apache.org/security-6.html - http://tomcat.apache.org/security-7.html - - - 2012-12-04 - 2012-12-04 - 2017-03-18 - - - - - tomcat -- bypass of security constraints - - - tomcat - 6.0.06.0.35 - - - tomcat7 - 7.0.07.0.29 - - - - -

The Apache Software Foundation reports:

-
-

When using FORM authentication it was possible to bypass the security - constraint checks in the FORM authenticator by appending - "/j_security_check" to the end of the URL if some other component - (such as the Single-Sign-On valve) had called request.setUserPrincipal() - before the call to FormAuthenticator#authenticate().

-
- - - - CVE-2012-3546 - http://tomcat.apache.org/security-6.html - http://tomcat.apache.org/security-7.html - - - 2012-12-04 - 2012-12-04 - 2017-03-18 - - - - - dns/bind9* -- servers using DNS64 can be crashed by a crafted query - - - bind99 - 9.9.2.1 - - - bind99-base - 9.9.2.1 - - - bind98 - 9.8.4.1 - - - bind98-base - 9.8.4.1 - - - - -

ISC reports:

-
-

BIND 9 nameservers using the DNS64 IPv6 transition mechanism are - vulnerable to a software defect that allows a crafted query to - crash the server with a REQUIRE assertion failure. Remote - exploitation of this defect can be achieved without extensive - effort, resulting in a denial-of-service (DoS) vector against - affected servers.

-
- - - - CVE-2012-5688 - - - 2012-11-27 - 2012-12-04 - - - - - bogofilter -- heap corruption by invalid base64 input - - bogofilter 1.2.3 - bogofilter-sqlite 1.2.3 - bogofilter-tc 1.2.3 - - - -

David Relson reports:

-
-

Fix a heap corruption in base64 decoder on invalid input. - Analysis and patch by Julius Plenz, [FU Berlin, Germany].

-
- - - - CVE-2012-5468 - http://bogofilter.sourceforge.net/security/bogofilter-SA-2012-01 - - - 2012-10-17 - 2012-12-03 - - - - - YUI JavaScript library -- JavaScript injection exploits in Flash components - - - yahoo-ui - 2.8.2 - - - - -

The YUI team reports:

-
-

Vulnerability in YUI 2.4.0 through YUI 2.9.0

-

A XSS vulnerability has been discovered in some YUI 2 .swf files - from versions 2.4.0 through 2.9.0. This defect allows JavaScript - injection exploits to be created against domains that host affected - YUI .swf files.

-

If your site loads YUI 2 from a CDN (yui.yahooapis.com, - ajax.googleapis.com, etc.) and not from your own domain, you - are not affected. YUI 3 is not affected by this issue.

-
- - - - CVE-2012-5881 - CVE-2012-5882 - http://yuilibrary.com/support/20121030-vulnerability/ - - - 2012-10-30 - 2012-11-27 - 2012-11-29 - - - - - FreeBSD -- Linux compatibility layer input validation error - - - FreeBSD - 7.47.4_11 - 8.38.3_5 - 9.09.0_5 - - - - -

Problem description:

-
-

A programming error in the handling of some Linux system calls - may result in memory locations being accessed without proper - validation.

-
- - - - SA-12:08.linux - CVE-2012-4576 - - - 2012-11-22 - 2012-11-24 - - - - - FreeBSD -- Insufficient message length validation for EAP-TLS messages - - - FreeBSD - 8.38.3_5 - 9.09.0_5 - - - - -

Problem description:

-
-

The internal authentication server of hostapd does not - sufficiently validate the message length field of EAP-TLS - messages.

-
- - - - SA-12:07.hostapd - CVE-2012-4445 - - - 2012-11-22 - 2012-11-24 - - - - - FreeBSD -- Multiple Denial of Service vulnerabilities with named(8) - - - FreeBSD - 7.47.4_11 - 8.38.3_5 - 9.09.0_5 - - - - -

Problem description:

-
-

The BIND daemon would crash when a query is made on a resource - record with RDATA that exceeds 65535 bytes.

-

The BIND daemon would lock up when a query is made on specific - combinations of RDATA.

-
- - - - SA-12:06.bind - CVE-2012-4244 - CVE-2012-5166 - - - 2012-11-22 - 2012-11-24 - - - - - opera -- execution of arbitrary code - - - opera - 12.11 - - - opera-devel - 12.11 - - - linux-opera - 12.11 - - - linux-opera-devel - 12.11 - - - - -

Opera reports:

-
-

When requesting pages using HTTP, Opera temporarily stores the - response in a buffer. In some cases, Opera may incorrectly allocate - too little space for a buffer, and may then store too much of the - response in that buffer. This causes a buffer overflow, which in - turn can lead to a memory corruption and crash. It is possible to - use this crash to execute the overflowing data as code, which may - be controlled by an attacking site.

-
- - - - http://www.opera.com/support/kb/view/1036/ - - - 2012-11-19 - 2012-11-22 - 2014-04-30 - - - - - lighttpd -- remote DoS in header parsing - - - lighttpd - 1.4.301.4.32 - - - - -

Lighttpd security advisory reports:

-
-

Certain Connection header values will trigger an endless loop, for example: - "Connection: TE,,Keep-Alive"

-

On receiving such value, lighttpd will enter an endless loop, - detecting an empty token but not incrementing the current string - position, and keep reading the ',' again and again.

-

This bug was introduced in 1.4.31, when we fixed an "invalid read" - bug (it would try to read the byte before the string if it started - with ',', although the value wasn't actually used).

-
- - - - CVE-2012-5533 - - - 2012-11-17 - 2012-11-21 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 11.0,117.0,1 - 10.0.11,1 - - - linux-firefox - 10.0.11,1 - - - linux-seamonkey - 2.14 - - - linux-thunderbird - 10.0.11 - - - seamonkey - 2.14 - - - thunderbird - 11.017.0 - 10.0.11 - - - libxul - 1.9.2.*10.0.11 - - - - -

The Mozilla Project reports:

-
-

MFSA 2012-91 Miscellaneous memory safety hazards (rv:17.0/ - rv:10.0.11)

-

MFSA 2012-92 Buffer overflow while rendering GIF images

-

MFSA 2012-93 evalInSanbox location context incorrectly applied

-

MFSA 2012-94 Crash when combining SVG text on path with CSS

-

MFSA 2012-95 Javascript: URLs run in privileged context on New Tab - page

-

MFSA 2012-96 Memory corruption in str_unescape

-

MFSA 2012-97 XMLHttpRequest inherits incorrect principal within - sandbox

-

MFSA 2012-98 Firefox installer DLL hijacking

-

MFSA 2012-99 XrayWrappers exposes chrome-only properties when not - in chrome compartment

-

MFSA 2012-100 Improper security filtering for cross-origin - wrappers

-

MFSA 2012-101 Improper character decoding in HZ-GB-2312 charset

-

MFSA 2012-102 Script entered into Developer Toolbar runs with - chrome privileges

-

MFSA 2012-103 Frames can shadow top.location

-

MFSA 2012-104 CSS and HTML injection through Style Inspector

-

MFSA 2012-105 Use-after-free and buffer overflow issues found

-

MFSA 2012-106 Use-after-free, buffer overflow, and memory - corruption issues found using Address Sanitizer

-
- - - - CVE-2012-4201 - CVE-2012-4202 - CVE-2012-4203 - CVE-2012-4204 - CVE-2012-4205 - CVE-2012-4206 - CVE-2012-4207 - CVE-2012-4208 - CVE-2012-4209 - CVE-2012-4210 - CVE-2012-4212 - CVE-2012-4213 - CVE-2012-4214 - CVE-2012-4215 - CVE-2012-4216 - CVE-2012-4217 - CVE-2012-4218 - CVE-2012-5829 - CVE-2012-5830 - CVE-2012-5833 - CVE-2012-5835 - CVE-2012-5836 - CVE-2012-5837 - CVE-2012-5838 - CVE-2012-5839 - CVE-2012-5840 - CVE-2012-5841 - CVE-2012-5842 - CVE-2012-5843 - http://www.mozilla.org/security/announce/2012/mfsa2012-90.html - http://www.mozilla.org/security/announce/2012/mfsa2012-91.html - http://www.mozilla.org/security/announce/2012/mfsa2012-92.html - http://www.mozilla.org/security/announce/2012/mfsa2012-93.html - http://www.mozilla.org/security/announce/2012/mfsa2012-94.html - http://www.mozilla.org/security/announce/2012/mfsa2012-95.html - http://www.mozilla.org/security/announce/2012/mfsa2012-96.html - http://www.mozilla.org/security/announce/2012/mfsa2012-97.html - http://www.mozilla.org/security/announce/2012/mfsa2012-98.html - http://www.mozilla.org/security/announce/2012/mfsa2012-99.html - http://www.mozilla.org/security/announce/2012/mfsa2012-100.html - http://www.mozilla.org/security/announce/2012/mfsa2012-101.html - http://www.mozilla.org/security/announce/2012/mfsa2012-102.html - http://www.mozilla.org/security/announce/2012/mfsa2012-103.html - http://www.mozilla.org/security/announce/2012/mfsa2012-104.html - http://www.mozilla.org/security/announce/2012/mfsa2012-105.html - http://www.mozilla.org/security/announce/2012/mfsa2012-106.html - http://www.mozilla.org/security/known-vulnerabilities/ - - - 2012-11-20 - 2012-11-20 - - - - - weechat -- Arbitrary shell command execution via scripts - - - weechat - 0.3.00.3.9.2 - - - weechat-devel - 20121118 - - - - -

Sebastien Helleu reports:

-
-

Untrusted command for function hook_process could lead to - execution of commands, because of shell expansions.

-

Workaround with a non-patched version: remove/unload all scripts - calling function hook_process (for maximum safety).

-
- - - - http://weechat.org/security/ - https://savannah.nongnu.org/bugs/?37764 - - - 2012-11-15 - 2012-11-18 - 2012-11-18 - - - - - bugzilla -- multiple vulnerabilities - - - bugzilla - 3.6.03.6.12 - 4.0.04.0.9 - 4.2.04.2.4 - - - - -

A Bugzilla Security Advisory reports:

-
-

The following security issues have been discovered in - Bugzilla:

-

Information Leak

-

If the visibility of a custom field is controlled by a product - or a component of a product you cannot see, their names are - disclosed in the JavaScript code generated for this custom field - despite they should remain confidential.

-

Calling the User.get method with a 'groups' argument leaks the - existence of the groups depending on whether an error is thrown - or not. This method now also throws an error if the user calling - this method does not belong to these groups (independently of - whether the groups exist or not).

-

Trying to mark an attachment in a bug you cannot see as obsolete - discloses its description in the error message. The description - of the attachment is now removed from the error message.

-

Cross-Site Scripting

-

Due to incorrectly filtered field values in tabular reports, - it is possible to inject code leading to XSS.

-

A vulnerability in swfstore.swf from YUI2 allows JavaScript - injection exploits to be created against domains that host this - affected YUI .swf file.

-
- - - - CVE-2012-4199 - https://bugzilla.mozilla.org/show_bug.cgi?id=731178 - CVE-2012-4198 - https://bugzilla.mozilla.org/show_bug.cgi?id=781850 - CVE-2012-4197 - https://bugzilla.mozilla.org/show_bug.cgi?id=802204 - CVE-2012-4189 - https://bugzilla.mozilla.org/show_bug.cgi?id=790296 - CVE-2012-5881 - CVE-2012-5882 - CVE-2012-5883 - https://bugzilla.mozilla.org/show_bug.cgi?id=808845 - http://yuilibrary.com/support/20121030-vulnerability/ - - - 2012-11-13 - 2012-11-14 - 2012-11-27 - - - - - typo3 -- Multiple vulnerabilities in TYPO3 Core - - - typo3 - 4.5.04.5.21 - 4.6.04.6.14 - 4.7.04.7.6 - - - - -

Typo Security Team reports:

-
-

TYPO3 Backend History Module - Due to missing encoding of user - input, the history module is susceptible to SQL Injection and - Cross-Site Scripting. A valid backend login is required to exploit - this vulnerability. Credits go to Thomas Worm who discovered and - reported the issue.

-

TYPO3 Backend API - Failing to properly HTML-encode user input the - tree render API (TCA-Tree) is susceptible to Cross-Site Scripting. - TYPO3 Versions below 6.0 does not make us of this API, thus is not - exploitable, if no third party extension is installed which uses - this API. A valid backend login is required to exploit this - vulnerability. Credits go to Richard Brain who discovered and - reported the issue.

-
- - - - http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-005/ - - - 2012-11-08 - 2012-11-12 - - - - - DomainKeys Identified Mail (DKIM) Verifiers may inappropriately convey message trust - - - opendkim - 2.7.1 - - - - -

US-CERT reports:

-
-

DomainKeys Identified Mail (DKIM) Verifiers may - inappropriately convey message trust when messages are - signed using test or small bit signing keys.

-
- - - - 268267 - - - 2012-10-24 - 2012-11-12 - - - - - weechat -- Crash or freeze when decoding IRC colors in strings - - - weechat - 0.3.60.3.9.1 - - - weechat-devel - 2011061420121110 - - - - -

Sebastien Helleu reports:

-
-

A buffer overflow is causing a crash or freeze of WeeChat when - decoding IRC colors in strings.

-

Workaround for a non-patched version: - /set irc.network.colors_receive off

-
- - - - CVE-2012-5854 - ports/173513 - http://weechat.org/security/ - https://savannah.nongnu.org/bugs/?37704 - - - 2012-11-09 - 2012-11-10 - 2012-11-13 - - - - - ruby -- Hash-flooding DoS vulnerability for ruby 1.9 - - - ruby - 1.91.9.3.327 - - - - -

The official ruby site reports:

-
-

Carefully crafted sequence of strings can cause a denial of service - attack on the service that parses the sequence to create a Hash - object by using the strings as keys. For instance, this - vulnerability affects web application that parses the JSON data - sent from untrusted entity.

-

This vulnerability is similar to CVS-2011-4815 for ruby 1.8.7. ruby - 1.9 versions were using modified MurmurHash function but it's - reported that there is a way to create sequence of strings that - collide their hash values each other. This fix changes the Hash - function of String object from the MurmurHash to SipHash 2-4.

-
- - - - CVE-2012-5371 - http://www.ruby-lang.org/en/news/2012/11/09/ruby19-hashdos-cve-2012-5371/ - - - 2012-11-10 - 2012-11-10 - - - - - tomcat -- authentication weaknesses - - - tomcat - 5.5.05.5.36 - 6.0.06.0.36 - 7.0.07.0.30 - - - - -

The Apache Software Foundation reports:

-
-

Three weaknesses in Tomcat's implementation of DIGEST - authentication were identified and resolved:

-
    -
  • Tomcat tracked client rather than server nonces and nonce count.
    • -
  • When a session ID was present, authentication was bypassed.
    • -
  • The user name and password were not checked before when indicating - that a nonce was stale.
    • -
-

These issues reduced the security of DIGEST authentication making - replay attacks possible in some circumstances.

-

The first issue was identified by Tilmann Kuhn. The second and third - issues were identified by the Tomcat security team during the code - review resulting from the first issue.

-
- - - - CVE-2012-3439 - http://tomcat.apache.org/security.html - http://tomcat.apache.org/security-5.html - http://tomcat.apache.org/security-6.html - http://tomcat.apache.org/security-7.html - - - 2012-11-05 - 2012-11-08 - 2012-11-09 - - - - - tomcat -- Denial of Service - - - tomcat - 6.0.06.0.36 - 7.0.07.0.28 - - - - -

The Apache Software Foundation reports:

-
-

The checks that limited the permitted size of request headers were - implemented too late in the request parsing process for the HTTP NIO - connector. This enabled a malicious user to trigger an - OutOfMemoryError by sending a single request with very large - headers. This issue was identified by Josh Spiewak.

-
- - - - CVE-2012-2733 - http://tomcat.apache.org/security.html - http://tomcat.apache.org/security-6.html - http://tomcat.apache.org/security-7.html - - - 2012-11-05 - 2012-11-08 - 2012-11-09 - - - - - linux-flashplugin -- multiple vulnerabilities - - - linux-f10-flashplugin - 11.2r202.243 - - - - -

Adobe reports:

-
-

These vulnerabilities could cause a crash and potentially allow an attacker to take control of the affected system.

-
- - - - CVE-2012-5274 - CVE-2012-5275 - CVE-2012-5276 - CVE-2012-5277 - CVE-2012-5278 - CVE-2012-5279 - CVE-2012-5280 - https://www.adobe.com/support/security/bulletins/apsb12-24.html - - - 2012-10-08 - 2012-11-02 - - - - - opera -- multiple vulnerabilities - - - opera - 12.10 - - - opera-devel - 12.10 - - - linux-opera - 12.10 - - - linux-opera-devel - 12.10 - - - - -

Opera reports:

-
-

CORS (Cross-Origin Resource Sharing) allows web pages to retrieve - the contents of pages from other sites, with their permission, - as they would appear for the current user. - When requests are made in this way, the browser should only allow - the page content to be retrieved if the target site sends the - correct headers that give permission for their contents to be - used in this way. Specially crafted requests may trick Opera - into thinking that the target site has given permission when it - had not done so. This can result in the contents of any target page - being revealed to untrusted sites, including any - sensitive information or session IDs contained within the - source of those pages.

-
-

Also reported are vulnerabilities involving SVG graphics and XSS.

- - - - http://www.opera.com/support/kb/view/1030/ - http://www.opera.com/support/kb/view/1031/ - http://www.opera.com/support/kb/view/1033/ - - - 2012-11-06 - 2012-11-06 - 2014-04-30 - - - - - linux-flashplugin -- multiple vulnerabilities - - - linux-f10-flashplugin - 11.2r202.238 - - - - -

Adobe reports:

-
-

These vulnerabilities could cause a crash and potentially allow an attacker to take control of the affected system.

-
- - - - CVE-2012-5248 - CVE-2012-5249 - CVE-2012-5250 - CVE-2012-5251 - CVE-2012-5252 - CVE-2012-5253 - CVE-2012-5254 - CVE-2012-5255 - CVE-2012-5256 - CVE-2012-5257 - CVE-2012-5258 - CVE-2012-5259 - CVE-2012-5260 - CVE-2012-5261 - CVE-2012-5262 - CVE-2012-5263 - CVE-2012-5264 - CVE-2012-5265 - CVE-2012-5266 - CVE-2012-5267 - CVE-2012-5269 - CVE-2012-5270 - CVE-2012-5271 - CVE-2012-5272 - CVE-2012-5285 - CVE-2012-5286 - CVE-2012-5287 - CVE-2012-5673 - CVE-2012-2034 - CVE-2012-2035 - CVE-2012-2036 - CVE-2012-2037 - CVE-2012-2038 - CVE-2012-2039 - CVE-2012-2040 - https://www.adobe.com/support/security/bulletins/apsb12-22.html - - - 2012-10-08 - 2012-11-02 - - - - - apache22 -- several vulnerabilities - - - apache22 - 2.2.02.2.23 - - - apache22-event-mpm - 2.2.02.2.23 - - - apache22-itk-mpm - 2.2.02.2.23 - - - apache22-peruser-mpm - 2.2.02.2.23 - - - apache22-worker-mpm - 2.2.02.2.23 - - - - -

Apache HTTP SERVER PROJECT reports:

-
-

low: XSS in mod_negotiation when untrusted uploads are supported CVE-2012-2687

-

Possible XSS for sites which use mod_negotiation and - allow untrusted uploads to locations which have MultiViews enabled.

-

low: insecure LD_LIBRARY_PATH handling CVE-2012-0883

-

This issue was already fixed in port version 2.2.22_5

-
- - - - CVE-2012-2687 - CVE-2012-0833 - - - 2012-09-13 - 2012-11-02 - - - - - webmin -- potential XSS attack via real name field - - - webmin - 1.600_1 - - - - -

The webmin updates site reports

-
-

Module: Change Passwords; Version: 1.600; Problem: Fix for potential XSS attack - via real name field; Solution: New module.

-
- - - - http://www.webmin.com/updates.html - - - 2012-11-02 - 2012-11-02 - - - - - ruby -- Unintentional file creation caused by inserting an illegal NUL character - - - ruby - 1.9.3,11.9.3.286,1 - - - - -

The official ruby site reports:

-
-

A vulnerability was found that file creation routines can create - unintended files by strategically inserting NUL(s) in file paths. - This vulnerability has been reported as CVE-2012-4522.

-

Ruby can handle arbitrary binary patterns as Strings, including - NUL chars. On the other hand OSes and other libraries tend not. - They usually treat a NUL as an End of String mark. So to interface - them with Ruby, NUL chars should properly be avoided.

-

However methods like IO#open did not check the filename passed to - them, and just passed those strings to lower layer routines. This - led to create unintentional files.

-
- - - - CVE-2012-4522 - http://www.ruby-lang.org/en/news/2012/10/12/poisoned-NUL-byte-vulnerability/ - https://access.redhat.com/security/cve/CVE-2012-4522/ - - - 2012-10-12 - 2012-11-01 - - - - - ruby -- $SAFE escaping vulnerability about Exception#to_s/NameError#to_s - - - ruby - 1.8.7,11.8.7.371,1 - 1.9.3,11.9.3.286,1 - - - - -

The official ruby site reports:

-
-

Vulnerabilities found for Exception#to_s, NameError#to_s, and - name_err_mesg_to_s() which is Ruby interpreter-internal API. A - malicious user code can bypass $SAFE check by utilizing one of - those security holes.

-

Ruby's $SAFE mechanism enables untrusted user codes to run in - $SAFE >= 4 mode. This is a kind of sandboxing so some operations - are restricted in that mode to protect other data outside the - sandbox.

-

The problem found was around this mechanism. Exception#to_s, - NameError#to_s, and name_err_mesg_to_s() interpreter-internal API - was not correctly handling the $SAFE bits so a String object which - is not tainted can destructively be marked as tainted using them. - By using this an untrusted code in a sandbox can modify a - formerly-untainted string destructively.

-

Ruby 1.8 once had a similar security issue. It fixed - Exception#to_s and NameError#to_s, but name_err_mesg_to_str() issue - survived previous security fix

-
- - - - CVE-2012-4464 - CVE-2012-4466 - http://www.ruby-lang.org/en/news/2012/10/12/cve-2012-4464-cve-2012-4466/ - https://access.redhat.com/security/cve/CVE-2012-4464/ - - - 2012-08-21 - 2012-11-01 - - - - - RT -- Multiple Vulnerabilities - - - rt40 - 4.04.0.8 - - - rt38 - 3.8.15 - - - - -

BestPractical report:

-
-

All versions of RT are vulnerable to an email header injection - attack. Users with ModifySelf or AdminUser can cause RT to add - arbitrary headers or content to outgoing mail. Depending on the - scrips that are configured, this may be be leveraged for information - leakage or phishing.

-

RT 4.0.0 and above and RTFM 2.0.0 and above contain a vulnerability - due to lack of proper rights checking, allowing any privileged user - to create Articles in any class.

-

All versions of RT with cross-site-request forgery (CSRF) - protection (RT 3.8.12 and above, RT 4.0.6 and above, and any - instances running the security patches released 2012-05-22) contain - a vulnerability which incorrectly allows though CSRF requests which - toggle ticket bookmarks.

-

All versions of RT are vulnerable to a confused deputy attack on - the user. While not strictly a CSRF attack, users who are not logged - in who are tricked into following a malicious link may, after - supplying their credentials, be subject to an attack which leverages - their credentials to modify arbitrary state. While users who were - logged in would have observed the CSRF protection page, users who - were not logged in receive no such warning due to the intervening - login process. RT has been extended to notify users of pending - actions during the login process.

-

RT 3.8.0 and above are susceptible to a number of vulnerabilities - concerning improper signing or encryption of messages using GnuPG; - if GnuPG is not enabled, none of the following affect you.

-
- - - - CVE-2012-4730 - CVE-2012-4731 - CVE-2012-4732 - CVE-2012-4734 - CVE-2012-4735 - CVE-2012-4884 - http://blog.bestpractical.com/2012/10/security-vulnerabilities-in-rt.html - - - 2012-10-26 - 2012-11-01 - - - - - drupal7 -- multiple vulnerabilities - - - drupal7 - 7.16 - - - - -

Drupal Security Team reports:

-
-
    -
  1. -

    Arbitrary PHP code execution

    -

    A bug in the installer code was identified that allows an attacker - to re-install Drupal using an external database server under certain - transient conditions. This could allow the attacker to execute - arbitrary PHP code on the original server.

    -
    2. -
  2. -

    Information disclosure - OpenID module

    -

    For sites using the core OpenID module, an information disclosure - vulnerability was identified that allows an attacker to read files - on the local filesystem by attempting to log in to the site using a - malicious OpenID server.

    -
    3. -
-
- - - - http://drupal.org/node/1815912 - - - 2012-10-17 - 2012-10-31 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 11.0,116.0.2,1 - 10.0.10,1 - - - linux-firefox - 10.0.10,1 - - - linux-seamonkey - 2.13.2 - - - linux-thunderbird - 10.0.10 - - - seamonkey - 2.13.2 - - - thunderbird - 11.016.0.2 - 10.0.10 - - - libxul - 1.9.2.*10.0.10 - - - - -

The Mozilla Project reports:

-
-

MFSA 2012-90 Fixes for Location object issues

-
- - - - CVE-2012-4194 - CVE-2012-4195 - CVE-2012-4196 - http://www.mozilla.org/security/known-vulnerabilities/ - http://www.mozilla.org/security/announce/2012/mfsa2012-90.html - - - 2012-10-26 - 2012-10-27 - - - - - Exim -- remote code execution - - - exim - 4.704.80.1 - - - - -

This vulnerability affects Exim instances built with DKIM - enabled (this is the default for FreeBSD Exim port) and running - verification of DKIM signatures on the incoming mail - messages.

-

Phil Penncock reports:

-
-

This is a SECURITY release, addressing a CRITICAL remote - code execution flaw in versions of Exim between 4.70 and - 4.80 inclusive, when built with DKIM support (the default).

-

This security vulnerability can be exploited by anyone - who can send email from a domain for which they control the - DNS.

-

You are not vulnerable if you built Exim with DISABLE_DKIM - or if you put this at the start of an ACL plumbed into - acl_smtp_connect or acl_smtp_rcpt:

- 
warn control = dkim_disable_verify
-
- - - - CVE-2012-5671 - https://lists.exim.org/lurker/message/20121026.080330.74b9147b.en.html - - - 2012-10-25 - 2012-10-26 - - - - - django -- multiple vulnerabilities - - - django - 1.4.2 - - - django13 - 1.3.4 - - - - -

The Django Project reports:

-
-
    -
  1. -

    Host header poisoning

    -

    Some parts of Django -- independent of end-user-written applications - -- make use of full URLs, including domain name, which are generated - from the HTTP Host header. Some attacks against this are beyond Django's - ability to control, and require the web server to be properly configured; - Django's documentation has for some time contained notes advising users - on such configuration.

    -

    Django's own built-in parsing of the Host header is, however, still - vulnerable, as was reported to us recently. The Host header parsing - in Django 1.3 and Django 1.4 -- specifically, django.http.HttpRequest.get_host() - -- was incorrectly handling username/password information in the header. - Thus, for example, the following Host header would be accepted by Django when - running on "validsite.com":

    -

    Host: validsite.com:random@evilsite.com

    -

    Using this, an attacker can cause parts of Django -- particularly the - password-reset mechanism -- to generate and display arbitrary URLs to users.

    -

    To remedy this, the parsing in HttpRequest.get_host() is being modified; Host - headers which contain potentially dangerous content (such as username/password - pairs) now raise the exception django.core.exceptions.SuspiciousOperation.

    -
    2. -
  2. -

    Documentation of HttpOnly cookie option

    -

    As of Django 1.4, session cookies are always sent with the HttpOnly flag, which - provides some additional protection from cross-site scripting attacks by denying - client-side scripts access to the session cookie.

    -

    Though not directly a security issue in Django, it has been reported that the - Django 1.4 documentation incorrectly described this change, by claiming that this - was now the default for all cookies set by the HttpResponse.set_cookie() method.

    -

    The Django documentation has been updated to reflect that this only applies to the - session cookie. Users of Django are encouraged to review their use of set_cookie() - to ensure that the HttpOnly flag is being set or unset appropriately.

    -
    3. -
-
- - - - CVE-2012-4520 - https://www.djangoproject.com/weblog/2012/oct/17/security/ - - - 2012-10-17 - 2012-10-24 - - - - - Wireshark -- Multiple Vulnerabilities - - - wireshark - 1.8.2_1 - - - wireshark-lite - 1.8.2_1 - - - tshark - 1.8.2_1 - - - tshark-lite - 1.8.2_1 - - - - -

Wireshark reports:

-
-

The HSRP dissector could go into an infinite loop.

-

The PPP dissector could abort.

-

Martin Wilck discovered an infinite loop in the DRDA - dissector.

-

Laurent Butti discovered a buffer overflow in the LDP - dissector.

-
- - - - CVE-2012-5237 - CVE-2012-5238 - CVE-2012-5239 - CVE-2012-5240 - http://www.wireshark.org/security/wnpa-sec-2012-26.html - http://www.wireshark.org/security/wnpa-sec-2012-27.html - http://www.wireshark.org/security/wnpa-sec-2012-28.html - http://www.wireshark.org/security/wnpa-sec-2012-29.html - http://www.wireshark.org/docs/relnotes/wireshark-1.8.3.html - - - 2012-10-02 - 2012-10-22 - 2013-06-19 - - - - - xlockmore -- local exploit - - - xlockmore - 5.40_1 - - - ja-xlockmore - 5.40_1 - - - - -

Ignatios Souvatzis of NetBSD reports:

-
-

Due to an error in the dclock screensaver in xlockmore, users who - explicitly use this screensaver or a random mix of screensavers using - something like "xlockmore -mode random" may have their screen unlocked - unexpectedly at a random time.

-
- - - - CVE-2012-4524 - http://www.openwall.com/lists/oss-security/2012/10/17/10 - - - 2012-10-17 - 2012-10-17 - 2014-04-30 - - - - - xinetd -- attackers can bypass access restrictions if tcpmux-servers service enabled - - - xinetd - 2.3.15 - - - - -

Thomas Swan reports:

-
-

xinetd allows for services to be configured with the TCPMUX - or TCPMUXPLUS service types, which makes those services - available on port 1, as per RFC 1078 [1], if the tcpmux-server - service is enabled. When the tcpmux-server service is enabled, - xinetd would expose _all_ enabled services via the tcpmux port, - instead of just the configured service(s). This could allow - a remote attacker to bypass firewall restrictions and access - services via the tcpmux port.

-
- - - - CVE-2012-0862 - https://bugzilla.redhat.com/show_bug.cgi?id=790940 - - - 2012-02-15 - 2012-10-17 - - - - - Zend Framework -- Multiple vulnerabilities via XXE injection - - - ZendFramework - 1.11.13 - - - magento - 1.7.0.2 - - - - -

The Zend Framework team reports:

-
-

The XmlRpc package of Zend Framework is vulnerable to XML - eXternal Entity Injection attacks (both server and client). - The SimpleXMLElement class (SimpleXML PHP extension) is used - in an insecure way to parse XML data. External entities can be - specified by adding a specific DOCTYPE element to XML-RPC - requests. By exploiting this vulnerability an application may be - coerced to open arbitrary files and/or TCP connections.

-

Additionally, the Zend_Dom, Zend_Feed, Zend_Soap, and - Zend_XmlRpc components are vulnerable to XML Entity Expansion - (XEE) vectors, leading to Denial of Service vectors. XEE attacks - occur when the XML DOCTYPE declaration includes XML entity - definitions that contain either recursive or circular references; - this leads to CPU and memory consumption, making Denial of - Service exploits trivial to implement.

-
- - - - CVE-2012-3363 - https://www.sec-consult.com/files/20120626-0_zend_framework_xxe_injection.txt - http://framework.zend.com/security/advisory/ZF2012-01 - http://framework.zend.com/security/advisory/ZF2012-02 - http://www.openwall.com/lists/oss-security/2012/06/26/2 - https://secunia.com/advisories/49665/ - http://www.magentocommerce.com/download/release_notes - - - 2012-06-26 - 2012-10-16 - 2015-10-14 - - - - - gitolite -- path traversal vulnerability - - - gitolite - 3.013.04 - - - - -

Sitaram Chamarty reports:

-
-

I'm sorry to say there is a potential path traversal vulnerability in - v3. Thanks to Stephane Chazelas for finding it and alerting me.

-

Can it affect you? This can only affect you if you are using wild - card repos, *and* at least one of your patterns allows the string - "../" to match multiple times.

-

How badly can it affect you? A malicious user who *also* has the - ability to create arbitrary files in, say, /tmp (e.g., he has his own - userid on the same box), can compromise the entire "git" user. - Otherwise the worst he can do is create arbitrary repos in /tmp.

-
- - - - CVE-2012-4506 - https://groups.google.com/forum/#!topic/gitolite/K9SnQNhCQ-0/discussion - - - 2012-10-09 - 2012-10-15 - - - - - phpMyAdmin -- Multiple XSS due to unescaped HTML output in Trigger, Procedure and Event pages and Fetching the version information from a non-SSL site is vulnerable to a MITM attack - - - phpMyAdmin - 3.53.5.3 - - - - -

The phpMyAdmin development team reports:

-
-

When creating/modifying a trigger, event or procedure - with a crafted name, it is possible to trigger an XSS.

-
-
-

To display information about the current phpMyAdmin - version on the main page, a piece of JavaScript is fetched - from the phpmyadmin.net website in non-SSL mode. A - man-in-the-middle could modify this script on the wire to - cause mischief.

-
- - - - CVE-2012-5339 - http://www.phpmyadmin.net/home_page/security/PMASA-2012-6.php - CVE-2012-5368 - http://www.phpmyadmin.net/home_page/security/PMASA-2012-7.php - - - 2012-10-08 - 2012-10-14 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 11.0,116.0.1,1 - 10.0.9,1 - - - linux-firefox - 10.0.9,1 - - - linux-seamonkey - 2.13.1 - - - linux-thunderbird - 10.0.9 - - - seamonkey - 2.13.1 - - - thunderbird - 11.016.0.1 - 10.0.9 - - - libxul - 1.9.2.*10.0.9 - - - - -

The Mozilla Project reports:

-
-

MFSA 2012-74 Miscellaneous memory safety hazards (rv:16.0/ - rv:10.0.8)

-

MFSA 2012-75 select element persistance allows for attacks

-

MFSA 2012-76 Continued access to initial origin after setting - document.domain

-

MFSA 2012-77 Some DOMWindowUtils methods bypass security checks

-

MFSA 2012-78 Reader Mode pages have chrome privileges

-

MFSA 2012-79 DOS and crash with full screen and history navigation

-

MFSA 2012-80 Crash with invalid cast when using instanceof - operator

-

MFSA 2012-81 GetProperty function can bypass security checks

-

MFSA 2012-82 top object and location property accessible by - plugins

-

MFSA 2012-83 Chrome Object Wrapper (COW) does not disallow acces - to privileged functions or properties

-

MFSA 2012-84 Spoofing and script injection through location.hash

-

MFSA 2012-85 Use-after-free, buffer overflow, and out of bounds - read issues found using Address Sanitizer

-

MFSA 2012-86 Heap memory corruption issues found using Address - Sanitizer

-

MFSA 2012-87 Use-after-free in the IME State Manager

-

MFSA 2012-88 Miscellaneous memory safety hazards (rv:16.0.1)

-

MFSA 2012-89 defaultValue security checks not applied

-
- - - - CVE-2012-3982 - CVE-2012-3983 - CVE-2012-3984 - CVE-2012-3985 - CVE-2012-3986 - CVE-2012-3987 - CVE-2012-3988 - CVE-2012-3989 - CVE-2012-3990 - CVE-2012-3991 - CVE-2012-3992 - CVE-2012-3993 - CVE-2012-3994 - CVE-2012-3995 - CVE-2012-4179 - CVE-2012-4180 - CVE-2012-4181 - CVE-2012-4182 - CVE-2012-4183 - CVE-2012-4184 - CVE-2012-4186 - CVE-2012-4187 - CVE-2012-4188 - CVE-2012-4190 - CVE-2012-4191 - CVE-2012-4192 - CVE-2012-4193 - http://www.mozilla.org/security/known-vulnerabilities/ - http://www.mozilla.org/security/announce/2012/mfsa2012-74.html - http://www.mozilla.org/security/announce/2012/mfsa2012-75.html - http://www.mozilla.org/security/announce/2012/mfsa2012-76.html - http://www.mozilla.org/security/announce/2012/mfsa2012-77.html - http://www.mozilla.org/security/announce/2012/mfsa2012-78.html - http://www.mozilla.org/security/announce/2012/mfsa2012-79.html - http://www.mozilla.org/security/announce/2012/mfsa2012-80.html - http://www.mozilla.org/security/announce/2012/mfsa2012-81.html - http://www.mozilla.org/security/announce/2012/mfsa2012-82.html - http://www.mozilla.org/security/announce/2012/mfsa2012-83.html - http://www.mozilla.org/security/announce/2012/mfsa2012-84.html - http://www.mozilla.org/security/announce/2012/mfsa2012-85.html - http://www.mozilla.org/security/announce/2012/mfsa2012-86.html - http://www.mozilla.org/security/announce/2012/mfsa2012-87.html - http://www.mozilla.org/security/announce/2012/mfsa2012-88.html - http://www.mozilla.org/security/announce/2012/mfsa2012-89.html - - - 2012-10-09 - 2012-10-10 - 2012-10-11 - - - - - dns/bind9* -- crash on deliberately constructed combination of records - - - bind99 - 9.9.1.4 - - - bind99-base - 9.9.1.4 - - - bind98 - 9.8.3.4 - - - bind98-base - 9.8.3.4 - - - bind97 - 9.7.6.4 - - - bind97-base - 9.7.6.4 - - - bind96 - 9.6.3.1.ESV.R7.4 - - - bind96-base - 9.6.3.1.ESV.R7.4 - - - - -

ISC reports:

-
-

A deliberately constructed combination of records could cause named - to hang while populating the additional section of a response.

-
- - - - CVE-2012-5166 - - - 2012-09-26 - 2012-10-10 - - - - - OpenX -- SQL injection vulnerability - - - openx - 2.8.10 - - - - -

Secunia reports:

-
-

A vulnerability has been discovered in OpenX, which can be - exploited by malicious people to conduct SQL injection - attacks.

-

Input passed via the "xajaxargs" parameter to - www/admin/updates-history.php (when "xajax" is set to - "expandOSURow") is not properly sanitised in e.g. the - "queryAuditBackupTablesByUpgradeId()" function - (lib/OA/Upgrade/DB_UpgradeAuditor.php) before being used in SQL - queries. This can be exploited to manipulate SQL queries by - injecting arbitrary SQL code.

-

The vulnerability is confirmed in version 2.8.9. Prior versions - may also be affected.

-
- - - - http://secunia.com/advisories/50598/ - - - 2012-09-14 - 2012-09-27 - - - - - eperl -- Remote code execution - - - eperl - 2.2.14_4 - - - - -

David Madison reports:

-
-

ePerl is a multipurpose Perl filter and interpreter program - for Unix systems. The ePerl preprocessor contains an input - validation error. The preprocessor allows foreign data to be - "safely" included using the 'sinclude' directive.

-

The problem occurs when a file referenced by a 'sinclude' - directive contains a 'include' directive; the contents of - the file referred to by the second directive will be loaded - and executed.

-
- - - - CVE-2001-0733 - http://www.shmoo.com/mail/bugtraq/jun01/msg00286.shtml - 2912 - http://xforce.iss.net/xforce/xfdb/6743 - http://osvdb.org/show/osvdb/1880 - - - 2001-06-21 - 2012-09-26 - - - - - ImageMagick and GraphicsMagick -- DoS via specially crafted PNG file - - - ImageMagick - 6.7.8.6 - - - ImageMagick-nox11 - 6.7.8.6 - - - GraphicsMagick - 1.3.01.3.16 - - - GraphicsMagick-nox11 - 1.3.01.3.16 - - - - -

Kurt Seifried reports:

-
-

There is an issue in ImageMagick that is also present in - GraphicsMagick. CVE-2011-3026 deals with libpng memory - allocation, and limitations have been added so that a bad PNG - can't cause the system to allocate a lot of memory and a - denial of service. However on further investigation of - ImageMagick, Tom Lane found that PNG malloc function - (Magick_png_malloc) in turn calls AcquireMagickMemory with an - improper size argument.

-
- - - - CVE-2012-3438 - https://bugzilla.redhat.com/show_bug.cgi?id=844105 - 54716 - http://secunia.com/advisories/50090 - http://xforce.iss.net/xforce/xfdb/77259 - http://osvdb.org/show/osvdb/84323 - - - 2012-07-28 - 2012-09-20 - 2014-04-30 - - - - - php5-sqlite -- open_basedir bypass - - - php5-sqlite - 5.25.2.17_11 - 5.35.3.15 - - - php52-sqlite - 5.2.17_11 - - - php53-sqlite - 5.3.15 - - - - -

MITRE CVE team reports:

-
-

The SQLite functionality in PHP before 5.3.15 allows remote - attackers to bypass the open_basedir protection mechanism via - unspecified vectors.

-
- - - - CVE-2012-3365 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3365 - - - 2012-06-14 - 2012-09-19 - - - - - php5 -- Denial of Service in php_date_parse_tzfile() - - - php5 - 5.25.2.17_11 - 5.35.3.9 - - - php52 - 5.2.17_11 - - - php53 - 5.3.9 - - - - -

MITRE CVE team reports:

-
-

Memory leak in the timezone functionality in PHP before 5.3.9 - allows remote attackers to cause a denial of service (memory - consumption) by triggering many strtotime function calls, which are - not properly handled by the php_date_parse_tzfile cache.

-
- - - - CVE-2012-0789 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0789 - https://bugs.php.net/bug.php?id=53502 - - - 2010-12-08 - 2012-09-19 - - - - - dns/bind9* -- Several vulnerabilities - - - bind99 - 9.9.1.3 - - - bind98 - 9.8.3.3 - - - bind97 - 9.7.6.3 - - - bind96 - 9.6.3.1.ESV.R7.3 - - - - -

ISC reports:

-
-

Prevents a crash when queried for a record whose RDATA exceeds - 65535 bytes.

-

Prevents a crash when validating caused by using "Bad cache" data - before it has been initialized.

-

ISC_QUEUE handling for recursive clients was updated to address - a race condition that could cause a memory leak. This rarely - occurred with UDP clients, but could be a significant problem - for a server handling a steady rate of TCP queries.

-

A condition has been corrected where improper handling of - zero-length RDATA could cause undesirable behavior, including - termination of the named process.

-
- - - - - - - 2012-09-12 - 2012-09-18 - - - - - jenkins -- multiple vulnerabilities - - - jenkins - 1.482 - - - - -

Jenkins Security Advisory reports:

-
-

This advisory announces security vulnerabilities that were found - in Jenkins core and several plugins.

-
    -
  1. The first vulnerability in Jenkins core allows unprivileged - users to insert data into Jenkins master, which can lead to - remote code execution. For this vulnerability to be exploited, - the attacker must have an HTTP access to a Jenkins master, and - he must have a read access to Jenkins.
    2. -
  2. The second vulnerability in Jenkins core is a cross-site - scripting vulnerability. This allows an attacker to craft an URL - that points to Jenkins, and if a legitimate user clicks this link, - and the attacker will be able to hijack the user session.
    3. -
  3. The third vulnerability is a cross-site scripting vulnerability - in the Violations plugin
    4. -
  4. The fourth vulnerability is a cross-site scripting vulnerability - in The Continuous Integration Game plugin
    5. -
-
- - - - https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2012-09-17 - - - 2012-09-17 - 2012-09-17 - - - - - vlc -- arbitrary code execution in Real RTSP and MMS support - - - vlc - 2.0.1,3 - - - - -

Jean-Baptiste Kempf, on behalf of the VideoLAN project reports:

-
-

If successful, a malicious third party could crash the VLC - media player process. Arbitrary code execution could be possible - on some systems.

-
- - - - http://www.videolan.org/security/sa1201.html - http://www.videolan.org/security/sa1202.html - CVE-2012-1775 - CVE-2012-1776 - - - 2012-03-12 - 2012-09-15 - - - - - bacula -- Console ACL Bypass - - - bacula - 5.2.11 - - - - -
-

A security issue has been reported in Bacula, which can be - exploited by malicious users to bypass certain security - restrictions.

-

The security issue is caused due to an error within the implementation - of console ACLs, which can be exploited to gain access to certain - restricted functionality and e.g. dump resources.

-
- - - - CVE-2012-4430 - http://www.bacula.org/git/cgit.cgi/bacula/commit/?id=67debcecd3d530c429e817e1d778e79dcd1db905 - https://secunia.com/advisories/50535/ - http://sourceforge.net/projects/bacula/files/bacula/5.2.11/ReleaseNotes/view - - - 2012-09-12 - 2012-09-15 - - - - - mod_pagespeed -- multiple vulnerabilities - - - mod_pagespeed - 0.10.22.6 - - - - -

Google Reports:

-
-

mod_pagespeed 0.10.22.6 is a security update that fixes two - critical issues that affect earlier versions:

-
    -
  • CVE-2012-4001, a problem with validation of own host name.
    • -
  • CVE-2012-4360, a cross-site scripting attack, which affects versions starting from 0.10.19.1.
    • -
-

The effect of the first problem is that it is possible to confuse - mod_pagespeed about its own host name, and to trick it into - fetching resources from other machines. This could be an issue if - the HTTP server has access to machines that are not otherwise - publicly visible.

-

The second problem would permit a hostile third party to execute - JavaScript in users' browsers in context of the domain running - mod_pagespeed, which could permit interception of users' cookies or - data on the site.

-

Because of the severity of the two problems, users are strongly - encouraged to update immediately.

-

Behavior Changes in the Update:

-

As part of the fix to the first issue, mod_pagespeed will not fetch - resources from machines other than localhost if they are not - explicitly mentioned in the configuration. This means that if you - need resources on the server's domain to be handled by some other - system, you'll need to explicitly use ModPagespeedMapOriginDomain - or ModPagespeedDomain to authorize that.

-
- - - - CVE-2012-4001 - CVE-2012-4360 - https://developers.google.com/speed/docs/mod_pagespeed/announce-0.10.22.6 - - - 2012-09-12 - 2012-09-12 - - - - - freeradius -- arbitrary code execution for TLS-based authentication - - - freeradius - 2.1.102.1.12_2 - - - - -

freeRADIUS security team reports:

-
-

Overflow in EAP-TLS for 2.1.10, 2.1.11 and 2.1.12.

-

The issue was found by Timo Warns, and communicated to - security@freeradius.org. A sample exploit for the issue was - included in the notification.

-

The vulnerability was created in commit a368a6f4f4aaf on - August 18, 2010. Vulnerable versions include 2.1.10, 2.1.11, - and 2.1.12. Also anyone running the git "master" branch - after August 18, 2010 is vulnerable.

-

All sites using TLS-based EAP methods and the above - versions are vulnerable. The only configuration change which - can avoid the issue is to disable EAP-TLS, EAP-TTLS, and - PEAP.

-

An external attacker can use this vulnerability to - over-write the stack frame of the RADIUS server, and cause - it to crash. In addition, more sophisticated attacks may - gain additional privileges on the system running the RADIUS - server.

-

This attack does not require local network access to the - RADIUS server. It can be done by an attacker through a WiFi - Access Point, so long as the Access Point is configured to - use 802.1X authentication with the RADIUS server.

-
- - - - CVE-2012-3547 - http://freeradius.org/security.html - http://www.pre-cert.de/advisories/PRE-SA-2012-06.txt - - - 2012-09-10 - 2012-09-11 - 2012-09-11 - - - - - emacs -- remote code execution vulnerability - - - emacs - 24.*24.2 - 23.*23.4_2 - - - - -

Chong Yidong reports:

-
-

Paul Ling has found a security flaw in the file-local - variables code in GNU Emacs.

-

When the Emacs user option `enable-local-variables' is - set to `:safe' (the default value is t), Emacs should - automatically refuse to evaluate `eval' forms in file-local - variable sections. Due to the bug, Emacs instead - automatically evaluates such `eval' forms. Thus, if the user - changes the value of `enable-local-variables' to `:safe', - visiting a malicious file can cause automatic execution of - arbitrary Emacs Lisp code with the permissions of the - user.

-

The bug is present in Emacs 23.2, 23.3, 23.4, and - 24.1.

-
- - - - 54969 - CVE-2012-3479 - https://lists.gnu.org/archive/html/emacs-devel/2012-08/msg00802.html - http://debbugs.gnu.org/cgi/bugreport.cgi?bug=12155 - - - 2012-08-13 - 2012-09-08 - 2013-05-13 - - - - - wordpress -- multiple unspecified privilege escalation bugs - - - wordpress - 3.4.2 - - - - -

Wordpress reports:

-
-

Version 3.4.2 also fixes a few security issues and contains some - security hardening. The vulnerabilities included potential - privilege escalation and a bug that affects multisite installs with - untrusted users. These issues were discovered and fixed by the - WordPress security team.

-
- - - - http://wordpress.org/news/2012/09/wordpress-3-4-2/ - - - 2012-09-06 - 2012-09-07 - - - - - moinmoin -- cross-site scripting via RST parser - - - moinmoin - 1.9.4 - - - - -

MITRE CVE team reports:

-
-

Cross-site scripting (XSS) vulnerability in the - reStructuredText (rst) parser in parser/text_rst.py in - MoinMoin before 1.9.4, when docutils is installed or when - "format rst" is set, allows remote attackers to inject - arbitrary web script or HTML via a javascript: URL in the - refuri attribute.

-
- - - - 46476 - CVE-2011-1058 - http://moinmo.in/SecurityFixes - - - 2011-02-21 - 2012-09-05 - - - - - moinmoin -- wrong processing of group membership - - - moinmoin - 1.91.9.4_1 - - - - -

MoinMoin developers report:

-
-

If you have group NAMES containing "All" or "Known" or - "Trusted", they behaved wrong until now (they erroneously - included All/Known/Trusted users even if you did not list - them as members), but will start working correctly with this - changeset.

-

E.g. AllFriendsGroup:

-
    -
  • JoeDoe
    • -
-

AllFriendsGroup will now (correctly) include only JoeDoe. - It (erroneously) contained all users (including JoeDoe) - before.

-

E.g. MyTrustedFriendsGroup:

-
    -
  • JoeDoe
    • -
-

MyTrustedFriendsGroup will now (correctly) include only - JoeDoe. It (erroneously) contained all trusted users and - JoeDoe before.

-
- - - - CVE-2012-4404 - http://hg.moinmo.in/moin/1.9/rev/7b9f39289e16 - - - 2012-09-03 - 2012-09-05 - 2012-09-11 - - - - - php5 -- header splitting attack via carriage-return character - - - php5 - 5.25.2.17_11 - 5.35.3.11 - 5.45.4.1 - - - php52 - 5.2.17_11 - - - php53 - 5.3.11 - - - - -

Rui Hirokawa reports:

-
-

As of PHP 5.1.2, header() can no longer be used to send - multiple response headers in a single call to prevent the - HTTP Response Splitting Attack. header() only checks the - linefeed (LF, 0x0A) as line-end marker, it doesn't check the - carriage-return (CR, 0x0D).

-

However, some browsers including Google Chrome, IE also - recognize CR as the line-end.

-

The current specification of header() still has the - vulnerability against the HTTP header splitting attack.

-
- - - - CVE-2011-1398 - https://bugs.php.net/bug.php?id=60227 - - - 2011-11-06 - 2012-09-05 - 2012-09-19 - - - - - bitcoin -- denial of service - - - bitcoin - 0.6.3 - - - - -
-

A unspecified denial-of-service attack that could cause the - bitcoin process to become unresponsive was found.

-
- - - - CVE-2012-3789 - https://bitcointalk.org/?topic=88734 - - - 2012-07-20 - 2012-09-02 - - - - - bugzilla -- multiple vulnerabilities - - - bugzilla - 3.6.03.6.11 - 4.0.04.0.8 - 4.2.04.2.3 - - - - -

A Bugzilla Security Advisory reports:

-
-

The following security issues have been discovered in - Bugzilla:

-

LDAP Injection

-

When the user logs in using LDAP, the username is not - escaped when building the uid=$username filter which is - used to query the LDAP directory. This could potentially - lead to LDAP injection.

-

Directory Browsing

-

Extensions are not protected against directory browsing - and users can access the source code of the templates - which may contain sensitive data. - Directory browsing is blocked in Bugzilla 4.3.3 only, - because it requires a configuration change in the Apache - httpd.conf file to allow local .htaccess files to use - Options -Indexes. To not break existing installations, - this fix has not been backported to stable branches. - The access to templates is blocked for all supported - branches except the old 3.6 branch, because this branch - doesn't have .htaccess in the bzr repository and cannot - be fixed easily for existing installations without - potentially conflicting with custom changes.

-
- - - - CVE-2012-3981 - https://bugzilla.mozilla.org/show_bug.cgi?id=785470 - https://bugzilla.mozilla.org/show_bug.cgi?id=785522 - https://bugzilla.mozilla.org/show_bug.cgi?id=785511 - - - 2012-08-30 - 2012-09-01 - - - - - GNU gatekeeper -- denial of service - - - gatekeeper - 3.1 - - - - -

Jan Willamowius reports:

-
-

GNU Gatekeeper before 3.1 does not limit the number - of connections to the status port, which allows remote - attackers to cause a denial of service (connection and - thread consumption) via a large number of connections.

-
- - - - CVE-2012-3534 - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-3534 - http://www.openwall.com/lists/oss-security/2012/08/25/4 - http://www.gnugk.org/gnugk-3.1.html - - - 2012-08-15 - 2012-09-01 - - - - - mediawiki -- multiple vulnerabilities - - - mediawiki - 1.191.19.2 - 1.181.18.5 - - - - -

Mediawiki reports:

-
-

(Bug 39700) Wikipedia administrator Writ Keeper discovered - a stored XSS (HTML injection) vulnerability. This was - possible due to the handling of link text on File: links for - nonexistent files. MediaWiki 1.16 and later is affected.

-

(Bug 39180) User Fomafix reported several DOM-based XSS - vulnerabilities, made possible by a combination of loose - filtering of the uselang parameter, and JavaScript gadgets - on various language Wikipedias.

-

(Bug 39180) During internal review, it was discovered that - CSRF tokens, available via the api, were not protected with - X-Frame-Options headers. This could lead to a CSRF vulnerability - if the API response is embedded in an external website using - using an iframe.

-

(Bug 39824) During internal review, it was discovered extensions - were not always allowed to prevent the account creation action. - This allowed users blocked by the GlobalBlocking extension to - create accounts.

-

(Bug 39184) During internal review, it was discovered that - password data was always saved to the local MediaWiki database - even if authentication was handled by an extension, such as LDAP. - This could allow a compromised MediaWiki installation to leak - information about user's LDAP passwords. Additionally, in situations - when an authentication plugin returned false in its strict - function, this would allow old passwords to be used for accounts - that did not exist in the external system, indefinitely.

-

(Bug 39823) During internal review, it was discovered that metadata - about blocks, hidden by a user with suppression rights, was visible - to administrators.

-
- - - - https://bugzilla.wikimedia.org/show_bug.cgi?id=39700 - https://bugzilla.wikimedia.org/show_bug.cgi?id=37587 - https://bugzilla.wikimedia.org/show_bug.cgi?id=39180 - https://bugzilla.wikimedia.org/show_bug.cgi?id=39824 - https://bugzilla.wikimedia.org/show_bug.cgi?id=39184 - https://bugzilla.wikimedia.org/show_bug.cgi?id=39823 - CVE-2012-4377 - CVE-2012-4378 - CVE-2012-4379 - CVE-2012-4380 - CVE-2012-4381 - CVE-2012-4382 - - - 2012-08-27 - 2012-09-01 - - - - - wireshark -- denial of service in DRDA dissector - - - wireshark - 1.51.8.2_1 - - - wireshark-lite - 1.51.8.2_1 - - - tshark - 1.51.8.2_1 - - - tshark-lite - 1.51.8.2_1 - - - - -

RedHat security team reports:

-
-

A denial of service flaw was found in the way Distributed - Relational Database Architecture (DRDA) dissector of - Wireshark, a network traffic analyzer, performed processing - of certain DRDA packet capture files. A remote attacker - could create a specially-crafted capture file that, when - opened could lead to wireshark executable to consume - excessive amount of CPU time and hang with an infinite - loop.

-
- - - - CVE-2012-3548 - https://bugzilla.redhat.com/show_bug.cgi?id=849926 - - - 2012-08-21 - 2012-08-31 - 2012-09-05 - - - - - asterisk -- multiple vulnerabilities - - - asterisk - 10.*10.7.1 - - - asterisk18 - 1.8.*1.8.15.1 - - - - -

Asterisk project reports:

-
-

Asterisk Manager User Unauthorized Shell Access

-

ACL rules ignored when placing outbound calls by certain IAX2 - users

-
- - - - CVE-2012-2186 - CVE-2012-4737 - http://downloads.digium.com/pub/security/AST-2012-012.html - http://downloads.digium.com/pub/security/AST-2012-013.html - https://www.asterisk.org/security - - - 2012-08-30 - 2012-08-30 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 11.0,115.0,1 - 10.0.7,1 - - - linux-firefox - 10.0.7,1 - - - linux-seamonkey - 2.12 - - - linux-thunderbird - 10.0.7 - - - seamonkey - 2.12 - - - thunderbird - 11.015.0 - 10.0.7 - - - libxul - 1.9.2.*10.0.7 - - - - -

The Mozilla Project reports:

-
-

MFSA 2012-57 Miscellaneous memory safety hazards (rv:15.0/ - rv:10.0.7)

-

MFSA 2012-58 Use-after-free issues found using Address - Sanitizer

-

MFSA 2012-59 Location object can be shadowed using - Object.defineProperty

-

MFSA 2012-60 Escalation of privilege through about:newtab

-

MFSA 2012-61 Memory corruption with bitmap format images with - negative height

-

MFSA 2012-62 WebGL use-after-free and memory corruption

-

MFSA 2012-63 SVG buffer overflow and use-after-free issues

-

MFSA 2012-64 Graphite 2 memory corruption

-

MFSA 2012-65 Out-of-bounds read in format-number in XSLT

-

MFSA 2012-66 HTTPMonitor extension allows for remote debugging - without explicit activation

-

MFSA 2012-67 Installer will launch incorrect executable following - new installation

-

MFSA 2012-68 DOMParser loads linked resources in extensions when - parsing text/html

-

MFSA 2012-69 Incorrect site SSL certificate data display

-

MFSA 2012-70 Location object security checks bypassed by chrome - code

-

MFSA 2012-71 Insecure use of __android_log_print

-

MFSA 2012-72 Web console eval capable of executing - chrome-privileged code

-
- - - - CVE-2012-1956 - CVE-2012-1970 - CVE-2012-1971 - CVE-2012-1972 - CVE-2012-1973 - CVE-2012-1974 - CVE-2012-1975 - CVE-2012-1976 - CVE-2012-3956 - CVE-2012-3957 - CVE-2012-3958 - CVE-2012-3959 - CVE-2012-3960 - CVE-2012-3961 - CVE-2012-3962 - CVE-2012-3963 - CVE-2012-3964 - CVE-2012-3965 - CVE-2012-3966 - CVE-2012-3967 - CVE-2012-3968 - CVE-2012-3969 - CVE-2012-3970 - CVE-2012-3971 - CVE-2012-3972 - CVE-2012-3973 - CVE-2012-3974 - CVE-2012-3975 - CVE-2012-3976 - CVE-2012-3978 - CVE-2012-3979 - CVE-2012-3980 - http://www.mozilla.org/security/known-vulnerabilities/ - http://www.mozilla.org/security/announce/2012/mfsa2012-57.html - http://www.mozilla.org/security/announce/2012/mfsa2012-58.html - http://www.mozilla.org/security/announce/2012/mfsa2012-59.html - http://www.mozilla.org/security/announce/2012/mfsa2012-60.html - http://www.mozilla.org/security/announce/2012/mfsa2012-61.html - http://www.mozilla.org/security/announce/2012/mfsa2012-62.html - http://www.mozilla.org/security/announce/2012/mfsa2012-63.html - http://www.mozilla.org/security/announce/2012/mfsa2012-64.html - http://www.mozilla.org/security/announce/2012/mfsa2012-65.html - http://www.mozilla.org/security/announce/2012/mfsa2012-66.html - http://www.mozilla.org/security/announce/2012/mfsa2012-67.html - http://www.mozilla.org/security/announce/2012/mfsa2012-68.html - http://www.mozilla.org/security/announce/2012/mfsa2012-69.html - http://www.mozilla.org/security/announce/2012/mfsa2012-70.html - http://www.mozilla.org/security/announce/2012/mfsa2012-71.html - http://www.mozilla.org/security/announce/2012/mfsa2012-72.html - - - 2012-08-28 - 2012-08-30 - - - - - coppermine -- Multiple vulnerabilities - - - coppermine - 1.5.20 - - - - -

The Coppermine Team reports:

-
-

The release covers several path disclosure vulnerabilities. If - unpatched, it's possible to generate an error that will reveal the - full path of the script. A remote user can determine the full path - to the web root directory and other potentially sensitive - information. Furthermore, the release covers a recently discovered - XSS vulnerability that allows (if unpatched) a malevolent visitor to - include own script routines under certain conditions.

-
- - - - CVE-2012-1613 - CVE-2012-1614 - http://seclists.org/oss-sec/2012/q2/11 - http://forum.coppermine-gallery.net/index.php/topic,74682.0.html - - - 2012-03-29 - 2012-08-30 - - - - - Java 1.7 -- security manager bypass - - - openjdk - 7.07.6.24_1 - - - linux-sun-jdk - 7.07.7 - - - linux-sun-jre - 7.07.7 - - - - -

US-CERT reports:

-
-

Oracle Java Runtime Environment (JRE) 1.7 contains a - vulnerability that may allow an applet to call - setSecurityManager in a way that allows setting of arbitrary - permissions.

-

By leveraging the public, privileged getField() function, - an untrusted Java applet can escalate its privileges by - calling the setSecurityManager() function to allow full - privileges, without requiring code signing.

-

This vulnerability is being actively exploited in the - wild, and exploit code is publicly available.

-
-

This exploit does not only affect Java applets, but every - piece of software that relies on the Java Security Manager for - sandboxing executable code is affected: malicious code can - totally disable Security Manager.

- - - - CVE-2012-4681 - 636312 - http://www.deependresearch.org/2012/08/java-7-vulnerability-analysis.html - http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2012-August/020065.html - http://www.oracle.com/technetwork/topics/security/alert-cve-2012-4681-1835715.html - - - 2012-08-27 - 2012-08-30 - 2012-08-31 - - - - - fetchmail -- chosen plaintext attack against SSL CBC initialization vectors - - - fetchmail - 6.3.96.3.22 - - - - -

Matthias Andree reports:

-
-

Fetchmail version 6.3.9 enabled "all SSL workarounds" (SSL_OP_ALL) - which contains a switch to disable a countermeasure against certain - attacks against block ciphers that permit guessing the - initialization vectors, providing that an attacker can make the - application (fetchmail) encrypt some data for him -- which is not - easily the case.

-

Stream ciphers (such as RC4) are unaffected.

-

Credits to Apple Product Security for reporting this.

-
- - - - CVE-2011-3389 - - - 2012-01-19 - 2012-08-30 - - - - - roundcube -- cross-site scripting in HTML email messages - - - roundcube - 0.8.0,10.8.1,1 - - - - -

RoundCube branch 0.8.x prior to the version 0.8.1 is prone - to the cross-scripting attack (XSS) originating from incoming - HTML e-mails: due to the lack of proper sanitization - of JavaScript code inside the "href" attribute, sender - could launch XSS attack when recipient opens the message - in RoundCube interface.

- - - - CVE-2012-3508 - http://trac.roundcube.net/wiki/Changelog - http://trac.roundcube.net/ticket/1488613 - - - 2012-08-14 - 2012-08-27 - - - - - Calligra, KOffice -- input validation failure - - - koffice - 1.6.3_18,2 - - - koffice-kde4 - 2.3.3_7 - - - calligra - 2.5.0 - - - - -

KDE Security Advisory reports:

-
-

A flaw has been found which can allow malicious code to take - advantage of an input validation failure in the Microsoft import - filter in Calligra and KOffice. Exploitation can allow the attacker - to gain control of the running process and execute code on its - behalf.

-
- - - - CVE-2012-3455 - CVE-2012-3456 - http://www.kde.org/info/security/advisory-20120810-1.txt - http://media.blackhat.com/bh-us-12/Briefings/C_Miller/BH_US_12_Miller_NFC_attack_surface_WP.pdf - - - 2012-08-10 - 2012-08-26 - - - - - squidclamav -- cross-site scripting in default virus warning pages - - - squidclamav - 5.8 - 6.06.7 - - - - -

SquidClamav developers report:

-
-

This release fix several security issues by escaping CGI - parameters.

-
-

Prior to versions 6.7 and 5.8, CGI script clwarn.cgi was not - properly sanitizing input variables, so they could be used to - inject arbitrary strings to the generated page, leading - to the cross-site scripting attacks.

- - - - CVE-2012-4667 - http://squidclamav.darold.net/news.html - - - 2012-07-24 - 2012-08-25 - - - - - squidclamav -- Denial of Service - - - squidclamav - 5.7_1 - 6.06.7 - - - - -

SquidClamav developers report:

-
-

Add a workaround for a squidGuard bug that unescape - the URL and send it back unescaped. This result in garbage - staying into pipe of the system command call and could crash - squidclamav on next read or return false information. - This is specially true with URL containing the %0D or %0A - character.

-
-

This vulnerability can be triggered only in configurations - where external chained URL checker is configured via - "squidguard" directive.

- - - - CVE-2012-3501 - http://squidclamav.darold.net/news.html - - - 2012-07-24 - 2012-08-25 - 2012-09-04 - - - - - inn -- plaintext command injection into encrypted channel - - - inn - 2.5.2_2 - - - - -

INN developers report:

-
-

Fixed a possible plaintext command injection during the - negotiation of a TLS layer. The vulnerability detailed - in CVE-2011-0411 affects the STARTTLS and AUTHINFO SASL - commands. nnrpd now resets its read buffer upon - a successful negotiation of a TLS layer. It prevents - malicious commands, sent unencrypted, from being executed - in the new encrypted state of the session.

-
- - - - CVE-2012-3523 - CVE-2011-0411 - https://www.isc.org/software/inn/2.5.3article - - - 2012-08-14 - 2012-08-25 - - - - - jabberd -- domain spoofing in server dialback protocol - - - jabberd - 2.2.16_2 - - - - -

XMPP Standards Foundation reports:

-
-

Some implementations of the XMPP Server Dialback protocol - (RFC 3920/XEP-0220) have not been checking dialback - responses to ensure that validated results are correlated - with requests.

-

An attacking server could spoof one or more domains in - communicating with a vulnerable server implementation, - thereby avoiding the protections built into the Server - Dialback protocol.

-
- - - - CVE-2012-3525 - http://xmpp.org/resources/security-notices/server-dialback/ - - - 2012-08-21 - 2012-08-23 - - - - - rssh -- configuration restrictions bypass - - - rssh - 2.3.3 - - - - -

Derek Martin (rssh maintainer) reports:

-
-

John Barber reported a problem where, if the system - administrator misconfigures rssh by providing too few access - bits in the configuration file, the user will be given - default permissions (scp) to the entire system, potentially - circumventing any configured chroot. Fixing this required a - behavior change: in the past, using rssh without a config - file would give all users default access to use scp on an - unchrooted system. In order to correct the reported bug, - this feature has been eliminated, and you must now have a - valid configuration file. If no config file exists, all - users will be locked out.

-
- - - - http://www.pizzashack.org/rssh/security.shtml - - - 2010-08-01 - 2012-08-22 - - - - - rssh -- arbitrary command execution - - - rssh - 2.3.4 - - - - -

Derek Martin (rssh maintainer) reports:

-
-

Henrik Erkkonen has discovered that, through clever - manipulation of environment variables on the ssh command - line, it is possible to circumvent rssh. As far as I can - tell, there is no way to effect a root compromise, except of - course if the root account is the one you're attempting to - protect with rssh...

-
- - - - 53430 - CVE-2012-3478 - http://sourceforge.net/mailarchive/message.php?msg_id=29235647 - - - 2012-05-08 - 2012-08-22 - - - - - libotr -- buffer overflows - - - libotr - 3.2.1 - - - - -

OTR developers report:

-
-

The otrl_base64_otr_decode() function and similar functions within OTR - suffer from buffer overflows in the case of malformed input; - specifically if a message of the format of "?OTR:===." is received - then a zero-byte allocation is performed without a similar correlation - between the subsequent base64 decoding write, as such it becomes - possible to write between zero and three bytes incorrectly to the - heap, albeit only with a value of '='.

-

Because this code path is highly utilized, specifically in the - reception of instant messages over pidgin or similar, this - vulnerability is considered severe even though in many platforms and - circumstances the bug would yield an unexploitable state and result - simply in denial of service.

-

The developers of OTR promptly fixed the errors and users of OTR are - advised to upgrade the software at the next release cycle.

-
- - - - CVE-2012-3461 - http://lists.cypherpunks.ca/pipermail/otr-dev/2012-July/001347.html - - - 2012-07-27 - 2012-08-18 - - - - - OpenTTD -- Denial of Service - - - openttd - 1.2.1 - - - - -

The OpenTTD Team reports:

-
-

Denial of service (server) using ships on half tiles and - landscaping.

-
- - - - CVE-2012-3436 - http://security.openttd.org/en/CVE-2012-3436 - - - 2012-07-25 - 2012-08-18 - - - - - Wireshark -- Multiple vulnerabilities - - - wireshark - 1.8.2 - - - wireshark-lite - 1.8.2 - - - tshark - 1.8.2 - - - tshark-lite - 1.8.2 - - - - -

Wireshark reports:

-
-

It may be possible to make Wireshark crash by injecting a - malformed packet onto the wire or by convincing someone to read a - malformed packet trace file.

-

It may be possible to make Wireshark consume excessive CPU - resources by injecting a malformed packet onto the wire or by - convincing someone to read a malformed packet trace file.

-

The PPP dissector could crash.

-

The NFS dissector could use excessive amounts of CPU.

-

The DCP ETSI dissector could trigger a zero division.

-

The MongoDB dissector could go into a large loop.

-

The XTP dissector could go into an infinite loop.

-

The ERF dissector could overflow a buffer.

-

The AFP dissector could go into a large loop.

-

The RTPS2 dissector could overflow a buffer.

-

The GSM RLC MAC dissector could overflow a buffer.

-

The CIP dissector could exhaust system memory.

-

The STUN dissector could crash.

-

The EtherCAT Mailbox dissector could abort.

-

The CTDB dissector could go into a large loop.

-

The pcap-ng file parser could trigger a zero division.

-

The Ixia IxVeriWave file parser could overflow a buffer.

-
- - - - CVE-2012-4048 - CVE-2012-4049 - CVE-2012-4285 - CVE-2012-4286 - CVE-2012-4287 - CVE-2012-4288 - CVE-2012-4289 - CVE-2012-4290 - CVE-2012-4291 - CVE-2012-4292 - CVE-2012-4293 - CVE-2012-4294 - CVE-2012-4295 - CVE-2012-4296 - CVE-2012-4297 - CVE-2012-4298 - http://www.wireshark.org/security/wnpa-sec-2012-11.html - http://www.wireshark.org/security/wnpa-sec-2012-12.html - http://www.wireshark.org/security/wnpa-sec-2012-13.html - http://www.wireshark.org/security/wnpa-sec-2012-14.html - http://www.wireshark.org/security/wnpa-sec-2012-15.html - http://www.wireshark.org/security/wnpa-sec-2012-16.html - http://www.wireshark.org/security/wnpa-sec-2012-17.html - http://www.wireshark.org/security/wnpa-sec-2012-18.html - http://www.wireshark.org/security/wnpa-sec-2012-19.html - http://www.wireshark.org/security/wnpa-sec-2012-20.html - http://www.wireshark.org/security/wnpa-sec-2012-21.html - http://www.wireshark.org/security/wnpa-sec-2012-22.html - http://www.wireshark.org/security/wnpa-sec-2012-23.html - http://www.wireshark.org/security/wnpa-sec-2012-24.html - http://www.wireshark.org/security/wnpa-sec-2012-25.html - - - 2012-07-22 - 2012-08-18 - - - - - databases/postgresql*-server -- multiple vulnerabilities - - - postgresql-server - 8.3.*8.3.20 - 8.4.*8.4.13 - 9.0.*9.0.9 - 9.1.*9.1.5 - - - - -

The PostgreSQL Global Development Group reports:

-
-

The PostgreSQL Global Development Group today released - security updates for all active branches of the PostgreSQL - database system, including versions 9.1.5, 9.0.9, 8.4.13 and - 8.3.20. This update patches security holes associated with - libxml2 and libxslt, similar to those affecting other open - source projects. All users are urged to update their - installations at the first available opportunity

-

Users who are relying on the built-in XML functionality to - validate external DTDs will need to implement a workaround, as - this security patch disables that functionality. Users who are - using xslt_process() to fetch documents or stylesheets from - external URLs will no longer be able to do so. The PostgreSQL - project regrets the need to disable both of these features in - order to maintain our security standards. These security issues - with XML are substantially similar to issues patched recently - by the Webkit (CVE-2011-1774), XMLsec (CVE-2011-1425) and PHP5 - (CVE-2012-0057) projects.

-
- - - - CVE-2012-3488 - CVE-2012-3489 - http://www.postgresql.org/about/news/1407/ - - - 2012-08-17 - 2012-08-17 - - - - - phpMyAdmin -- Multiple XSS in Table operations, Database structure, Trigger and Visualize GIS data pages - - - phpMyAdmin - 3.5.2.2 - - - - -

The phpMyAdmin development team reports:

-
-

Using a crafted table name, it was possible to produce a - XSS : 1) On the Database Structure page, creating a new - table with a crafted name 2) On the Database Structure page, - using the Empty and Drop links of the crafted table name 3) - On the Table Operations page of a crafted table, using the - 'Empty the table (TRUNCATE)' and 'Delete the table (DROP)' - links 4) On the Triggers page of a database containing - tables with a crafted name, when opening the 'Add Trigger' - popup 5) When creating a trigger for a table with a crafted - name, with an invalid definition. Having crafted data in a - database table, it was possible to produce a XSS : 6) When - visualizing GIS data, having a crafted label name.

-
- - - - CVE-2012-4345 - http://www.phpmyadmin.net/home_page/security/PMASA-2012-4.php - - - 2012-08-12 - 2012-08-17 - - - - - typo3 -- Multiple vulernabilities in TYPO3 Core - - - typo3 - 4.5.04.5.19 - 4.6.04.6.12 - 4.7.04.7.4 - - - - -

Typo Security Team reports:

-
-

It has been discovered that TYPO3 Core is vulnerable to Cross-Site - Scripting, Information Disclosure, Insecure Unserialize leading to - Arbitrary Code Execution.

-

TYPO3 Backend Help System - Due to a missing signature (HMAC) for a - parameter in the view_help.php file, an attacker could unserialize - arbitrary objects within TYPO3. We are aware of a working exploit, - which can lead to arbitrary code execution. A valid backend user - login or multiple successful cross site request forgery attacks are - required to exploit this vulnerability.

-

TYPO3 Backend - Failing to properly HTML-encode user input in - several places, the TYPO3 backend is susceptible to Cross-Site - Scripting. A valid backend user is required to exploit these - vulnerabilities.

-

TYPO3 Backend - Accessing the configuration module discloses the - Encryption Key. A valid backend user with access to the - configuration module is required to exploit this vulnerability.

-

TYPO3 HTML Sanitizing API - By not removing several HTML5 - JavaScript events, the API method t3lib_div::RemoveXSS() fails to - filter specially crafted HTML injections, thus is susceptible to - Cross-Site Scripting. Failing to properly encode for JavaScript the - API method t3lib_div::quoteJSvalue(), it is susceptible to Cross-Site - Scripting.

-

TYPO3 Install Tool - Failing to properly sanitize user input, the - Install Tool is susceptible to Cross-Site Scripting.

-
- - - - https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-004/ - - - 2012-08-15 - 2012-08-15 - - - - - fetchmail -- two vulnerabilities in NTLM authentication - - - fetchmail - 5.0.86.3.21_1 - - - - -

Matthias Andree reports:

-
-

With NTLM support enabled, fetchmail might mistake a server-side - error message during NTLM protocol exchange for protocol data, - leading to a SIGSEGV.

-

Also, with a carefully crafted NTLM challenge, a malicious server - might cause fetchmail to read from a bad memory location, betraying - confidential data. It is deemed hard, although not impossible, to - steal other accounts' data.

-
- - - - CVE-2012-3482 - - - 2012-08-12 - 2012-08-14 - 2012-08-27 - - - - - Several vulnerabilities found in IcedTea-Web - - - icedtea-web - 1.2.1 - - - - -

The IcedTea project team reports:

-
-

CVE-2012-3422: Use of uninitialized instance pointers

-

An uninitialized pointer use flaw was found in IcedTea-Web web - browser plugin. A malicious web page could use this flaw make - IcedTea-Web browser plugin pass invalid pointer to a web browser. - Depending on the browser used, it may cause the browser to crash - or possibly execute arbitrary code.

-

The get_cookie_info() and get_proxy_info() call - getFirstInTableInstance() with the instance_to_id_map hash as - a parameter. If instance_to_id_map is empty (which can happen - when plugin was recently removed), getFirstInTableInstance() - returns an uninitialized pointer.

-
-
-

CVE-2012-3423: Incorrect handling of non 0-terminated strings

-

It was discovered that the IcedTea-Web web browser plugin - incorrectly assumed that all strings provided by browser are NUL - terminated, which is not guaranteed by the NPAPI (Netscape Plugin - Application Programming Interface). When used in a browser that - does not NUL terminate NPVariant NPStrings, this could lead to - buffer over-read or over-write, resulting in possible information - leak, crash, or code execution.

-

Mozilla browsers currently NUL terminate strings, however recent - Chrome versions are known not to provide NUL terminated data.

-
- - - - CVE-2012-3422 - CVE-2012-3423 - http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2012-July/019580.html - - - 2012-07-31 - 2012-08-13 - - - - - libcloud -- possible SSL MITM due to invalid regexp used to validate target server hostname - - - py-libcloud - 0.11.1 - - - - -

The libcloud development team reports:

-
-

When establishing a secure (SSL / TLS) connection to a target server an invalid regular - expression has been used for performing the hostname verification. Subset instead of the - full target server hostname has been marked an an acceptable match for the given hostname. - For example, certificate with a hostname field of "aexample.com" was considered a valid - certificate for domain "example.com".

-
- - - - CVE-2012-3446 - http://seclists.org/fulldisclosure/2012/Aug/55 - - - 2012-08-01 - 2012-08-11 - - - - - phpMyAdmin -- Path disclosure due to missing library - - - phpMyAdmin - 3.5.2.1 - - - - -

The phpMyAdmin development team reports:

-
-

The show_config_errors.php script does not include a - library, so an error message shows the full path of this - file, leading to possible further attacks.

-
- - - - CVE-2012-4219 - http://www.phpmyadmin.net/home_page/security/PMASA-2012-3.php - - - 2012-08-03 - 2012-08-11 - - - - - rubygem-rails -- multiple vulnerabilities - - - rubygem-rails - 3.2.8 - - - rubygem-actionpack - 3.2.8 - - - rubygem-activesupport - 3.2.8 - - - - -

Rails core team reports:

-
-

This version contains three important security fixes, please upgrade immediately.

-

One of security fixes impacts all users and is related to HTML escaping code. The - other two fixes impacts people using select_tag's prompt option and strip_tags - helper from ActionPack.

-

CVE-2012-3463 Potential XSS Vulnerability in select_tag prompt.

-

CVE-2012-3464 Potential XSS Vulnerability in the HTML escaping code.

-

CVE-2012-3465 XSS Vulnerability in strip_tags.

-
- - - - CVE-2012-3463 - CVE-2012-3464 - CVE-2012-3465 - https://groups.google.com/d/msg/rubyonrails-security/fV3QUToSMSw/eHBSFOUYHpYJ - https://groups.google.com/d/msg/rubyonrails-security/kKGNeMrnmiY/r2yM7xy-G48J - https://groups.google.com/d/msg/rubyonrails-security/FgVEtBajcTY/tYLS1JJTu38J - http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released/ - - - 2012-08-08 - 2012-08-10 - - - - - sudosh -- buffer overflow - - - sudosh2 - 1.0.2 - - - sudosh3 - 3.2.0_2 - - - - -

ISS reports:

-
-

sudosh2 and sudosh3 are vulnerable to a stack-based buffer - overflow, caused by improper bounds checking by the replay() - function. By persuading a victim to replay a specially-crafted - recorded sudo session, a local attacker could overflow a buffer - and execute arbitrary code on the system with elevated privileges - or cause the application to crash.

-
- - - - http://xforce.iss.net/xforce/xfdb/55903 - http://secunia.com/advisories/38349 - http://secunia.com/advisories/38292 - - - 2010-01-17 - 2012-08-09 - - - - - FreeBSD -- named(8) DNSSEC validation Denial of Service - - - FreeBSD - 7.47.4_10 - 8.18.1_13 - 8.28.2_10 - 8.38.3_4 - 9.09.0_4 - - - - -

Problem description:

-
-

BIND 9 stores a cache of query names that are known to be failing - due to misconfigured name servers or a broken chain of trust. - Under high query loads, when DNSSEC validation is active, it is - possible for a condition to arise in which data from this cache of - failing queries could be used before it was fully initialized, - triggering an assertion failure.

-
- - - - SA-12:05.bind - CVE-2012-3817 - - - 2012-07-24 - 2012-08-07 - - - - - automake -- Insecure 'distcheck' recipe granted world-writable distdir - - - automake - 1.5.01.12.2 - - - - -

GNU reports:

-
-

The recipe of the 'distcheck' target granted temporary - world-write permissions on the extracted distdir. This introduced - a locally exploitable race condition for those who run "make - distcheck" with a non-restrictive umask (e.g., 022) in a directory - that was accessible by others. A successful exploit would result - in arbitrary code execution with the privileges of the user - running "make distcheck".

-

It is important to stress that this vulnerability impacts not only - the Automake package itself, but all packages with - Automake-generated makefiles. For an effective fix it is necessary - to regenerate the Makefile.in files with a fixed Automake - version.

-
- - - - CVE-2012-3386 - https://lists.gnu.org/archive/html/automake/2012-07/msg00023.html - - - 2012-07-09 - 2012-08-06 - 2012-08-25 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 11.0,114.0.1,1 - 10.0.6,1 - - - linux-firefox - 10.0.6,1 - - - linux-seamonkey - 2.11 - - - linux-thunderbird - 10.0.6 - - - seamonkey - 2.11 - - - thunderbird - 11.014.0 - 10.0.6 - - - libxul - 1.9.2.*10.0.6 - - - - -

The Mozilla Project reports:

-
-

MFSA 2012-42 Miscellaneous memory safety hazards (rv:14.0/ - rv:10.0.6)

-

MFSA 2012-43 Incorrect URL displayed in addressbar through drag and - drop

-

MFSA 2012-44 Gecko memory corruption

-

MFSA 2012-45 Spoofing issue with location

-

MFSA 2012-46 XSS through data: URLs

-

MFSA 2012-47 Improper filtering of javascript in HTML feed-view

-

MFSA 2012-48 use-after-free in nsGlobalWindow::PageHidden

-

MFSA 2012-49 Same-compartment Security Wrappers can be bypassed

-

MFSA 2012-50 Out of bounds read in QCMS

-

MFSA 2012-51 X-Frame-Options header ignored when duplicated

-

MFSA 2012-52 JSDependentString::undepend string conversion results - in memory corruption

-

MFSA 2012-53 Content Security Policy 1.0 implementation errors - cause data leakage

-

MFSA 2012-54 Clickjacking of certificate warning page

-

MFSA 2012-55 feed: URLs with an innerURI inherit security context - of page

-

MFSA 2012-56 Code execution through javascript: URLs

-
- - - - CVE-2012-1949 - CVE-2012-1950 - CVE-2012-1951 - CVE-2012-1952 - CVE-2012-1953 - CVE-2012-1954 - CVE-2012-1955 - CVE-2012-1957 - CVE-2012-1958 - CVE-2012-1959 - CVE-2012-1960 - CVE-2012-1961 - CVE-2012-1962 - CVE-2012-1963 - CVE-2012-1964 - CVE-2012-1965 - CVE-2012-1966 - CVE-2012-1967 - http://www.mozilla.org/security/known-vulnerabilities/ - http://www.mozilla.org/security/announce/2012/mfsa2012-42.html - http://www.mozilla.org/security/announce/2012/mfsa2012-43.html - http://www.mozilla.org/security/announce/2012/mfsa2012-44.html - http://www.mozilla.org/security/announce/2012/mfsa2012-45.html - http://www.mozilla.org/security/announce/2012/mfsa2012-46.html - http://www.mozilla.org/security/announce/2012/mfsa2012-47.html - http://www.mozilla.org/security/announce/2012/mfsa2012-48.html - http://www.mozilla.org/security/announce/2012/mfsa2012-49.html - http://www.mozilla.org/security/announce/2012/mfsa2012-50.html - http://www.mozilla.org/security/announce/2012/mfsa2012-51.html - http://www.mozilla.org/security/announce/2012/mfsa2012-52.html - http://www.mozilla.org/security/announce/2012/mfsa2012-53.html - http://www.mozilla.org/security/announce/2012/mfsa2012-54.html - http://www.mozilla.org/security/announce/2012/mfsa2012-55.html - http://www.mozilla.org/security/announce/2012/mfsa2012-56.html - - - 2012-07-17 - 2012-08-02 - - - - - Apache -- Insecure LD_LIBRARY_PATH handling - - - apache - 2.2.22_5 - - - apache-event - 2.2.22_5 - - - apache-itk - 2.2.22_5 - - - apache-peruser - 2.2.22_5 - - - apache-worker - 2.2.22_5 - - - - -

Apache reports:

-
-

Insecure handling of LD_LIBRARY_PATH was found that could lead to - the current working directory to be searched for DSOs. This could - allow a local user to execute code as root if an administrator runs - apachectl from an untrusted directory.

-
- - - - CVE-2012-0883 - http://httpd.apache.org/security/vulnerabilities_24.html - http://www.apache.org/dist/httpd/CHANGES_2.4.2 - - - 2012-03-02 - 2012-08-01 - - - - - django -- multiple vulnerabilities - - - py26-django - 1.41.4.1 - 1.31.3.2 - - - py27-django - 1.41.4.1 - 1.31.3.2 - - - py26-django-devel - 20120731,1 - - - py27-django-devel - 20120731,1 - - - - -

The Django project reports:

-
-

Today the Django team is issuing multiple releases -- - Django 1.3.2 and Django 1.4.1 -- to remedy security issues - reported to us:

-
    -
  • Cross-site scripting in authentication views
    • -
  • Denial-of-service in image validation
    • -
  • Denial-of-service via get_image_dimensions()
    • -
-

All users are encouraged to upgrade Django immediately.

-
- - - - CVE-2012-3442 - CVE-2012-3443 - CVE-2012-3444 - https://www.djangoproject.com/weblog/2012/jul/30/security-releases-issued/ - - - 2012-07-30 - 2012-07-31 - 2014-04-30 - - - - - bugzilla -- multiple vulnerabilities - - - bugzilla - 3.6.03.6.10 - 4.0.04.0.7 - 4.2.04.2.2 - - - - -

A Bugzilla Security Advisory reports:

-
-

The following security issues have been discovered in - Bugzilla:

-

Information Leak

-

Versions: 4.1.1 to 4.2.1, 4.3.1

-

In HTML bugmails, all bug IDs and attachment IDs are - linkified, and hovering these links displays a tooltip - with the bug summary or the attachment description if - the user is allowed to see the bug or attachment. - But when validating user permissions when generating the - email, the permissions of the user who edited the bug were - taken into account instead of the permissions of the - addressee. This means that confidential information could - be disclosed to the addressee if the other user has more - privileges than the addressee. - Plain text bugmails are not affected as bug and attachment - IDs are not linkified.

-

Information Leak

-

Versions: 2.17.5 to 3.6.9, 3.7.1 to 4.0.6, 4.1.1 to - 4.2.1, 4.3.1

-

The description of a private attachment could be visible - to a user who hasn't permissions to access this attachment - if the attachment ID is mentioned in a public comment in - a bug that the user can see.

-
- - - - CVE-2012-1968 - CVE-2012-1969 - https://bugzilla.mozilla.org/show_bug.cgi?id=777398 - https://bugzilla.mozilla.org/show_bug.cgi?id=777586 - - - 2012-07-26 - 2012-07-27 - - - - - nsd -- Denial of Service - - - nsd - 3.2.13 - - - - -

Tom Hendrikx reports:

-
-

It is possible to crash (SIGSEGV) a NSD child server process by - sending it a DNS packet from any host on the internet and the per - zone stats build option is enabled. A crashed child process will - automatically be restarted by the parent process, but an attacker - may keep the NSD server occupied restarting child processes by - sending it a stream of such packets effectively preventing the - NSD server to serve.

-
- - - - CVE-2012-2979 - http://www.nlnetlabs.nl/downloads/CVE-2012-2979.txt - - - 2012-07-27 - 2012-07-27 - - - - - rubygem-actionpack -- Denial of Service - - - rubygem-actionpack - 3.2.7 - - - - -
-

There is a DoS vulnerability in Action Pack digest authentication - handling in authenticate_or_request_with_http_digest.

-
- - - - CVE-2012-3424 - https://groups.google.com/forum/?fromgroups#!topic/rubyonrails-security/vxJjrc15qYM - - - 2012-07-26 - 2012-07-26 - - - - - p5-RT-Authen-ExternalAuth -- privilege escalation - - - p5-RT-Authen-ExternalAuth - 0.11 - - - - -

The RT development team reports:

-
-

RT::Authen::ExternalAuth 0.10 and below (for all versions - of RT) are vulnerable to an escalation of privilege attack - where the URL of a RSS feed of the user can be used to - acquire a fully logged-in session as that user. - CVE-2012-2770 has been assigned to this vulnerability.

-

Users of RT 3.8.2 and above should upgrade to - RT::Authen::ExternalAuth 0.11, which resolves this - vulnerability.

-
- - - - http://blog.bestpractical.com/2012/07/security-vulnerabilities-in-three-commonly-deployed-rt-extensions.html - CVE-2012-2770 - - - 2012-07-25 - 2012-07-26 - - - - - isc-dhcp -- multiple vulnerabilities - - - isc-dhcp41-server - 4.1.e_5,2 - - - isc-dhcp42-server - 4.2.4_1 - - - - -

ISC reports:

-
-

An unexpected client identifier parameter can cause the ISC DHCP - daemon to segmentation fault when running in DHCPv6 mode, - resulting in a denial of service to further client requests. In - order to exploit this condition, an attacker must be able to send - requests to the DHCP server.

-

An error in the handling of malformed client identifiers can cause - a DHCP server running affected versions (see "Impact") to enter a - state where further client requests are not processed and the - server process loops endlessly, consuming all available CPU - cycles. - Under normal circumstances this condition should not be - triggered, but a non-conforming or malicious client could - deliberately trigger it in a vulnerable server. In order to - exploit this condition an attacker must be able to send requests - to the DHCP server.

-

Two memory leaks have been found and fixed in ISC DHCP. Both are - reproducible when running in DHCPv6 mode (with the -6 command-line - argument.) The first leak is confirmed to only affect servers - operating in DHCPv6 mode, but based on initial code analysis the - second may theoretically affect DHCPv4 servers (though this has - not been demonstrated.)

-
- - - - CVE-2012-3570 - CVE-2012-3571 - CVE-2012-3954 - https://kb.isc.org/article/AA-00714 - https://kb.isc.org/article/AA-00712 - https://kb.isc.org/article/AA-00737 - - - 2012-07-24 - 2012-07-25 - - - - - dns/bind9* -- Heavy DNSSEC Validation Load Can Cause a 'Bad Cache' Assertion Failure - - - bind99 - 9.9.1.2 - - - bind98 - 9.8.3.2 - - - bind97 - 9.7.6.2 - - - bind96 - 9.6.3.1.ESV.R7.2 - - - - -

ISC reports:

-
-

High numbers of queries with DNSSEC validation enabled can - cause an assertion failure in named, caused by using a 'bad cache' - data structure before it has been initialized.

-

BIND 9 stores a cache of query names that are known to be failing due - to misconfigured name servers or a broken chain of trust. Under high query - loads when DNSSEC validation is active, it is possible for a condition - to arise in which data from this cache of failing queries could be used - before it was fully initialized, triggering an assertion failure.

-

This bug cannot be encountered unless your server is doing DNSSEC - validation.

-
- - - - CVE-2012-3817 - https://kb.isc.org/article/AA-00729 - - - 2012-07-24 - 2012-07-24 - - - - - rubygem-activerecord -- multiple vulnerabilities - - - rubygem-activemodel - 3.2.4 - - - - -

rubygem-activerecord -- multiple vulernabilities

-
-

Due to the way Active Record interprets parameters in - combination with the way that Rack parses query parameters, it - is possible for an attacker to issue unexpected database - queries with "IS NULL" where clauses. This issue does *not* - let an attacker insert arbitrary values into an SQL query, - however they can cause the query to check for NULL where most - users wouldn't expect it.

-

Due to the way Active Record handles nested query parameters, - an attacker can use a specially crafted request to inject some - forms of SQL into your application's SQL queries.

-
- - - - CVE-2012-2660 - CVE-2012-2661 - https://groups.google.com/forum/?fromgroups#!topic/rubyonrails-security/8SA-M3as7A8 - https://groups.google.com/forum/?fromgroups#!topic/rubyonrails-security/dUaiOOGWL1k - - - 2012-05-31 - 2012-07-23 - 2012-07-23 - - - - - php -- potential overflow in _php_stream_scandir - - - php5 - 5.45.4.5 - 5.35.3.15 - 5.25.2.17_10 - - - php53 - 5.3.15 - - - php52 - 5.2.17_10 - - - - -

The PHP Development Team reports:

-
-

The release of PHP 5.4.15 and 5.4.5 fix a potential overflow in - _php_stream_scandir

-
- - - - CVE-2012-2688 - http://www.php.net/archive/2012.php#id2012-07-19-1 - - - 2012-07-19 - 2012-07-23 - 2013-01-15 - - - - - dns/nsd -- DoS vulnerability from non-standard DNS packet - - - nsd - 3.2.11_2 - - - - -

Marek Vavrusa and Lubos Slovak report:

-
-

It is possible to crash (SIGSEGV) a NSD child server process - by sending it a non-standard DNS packet from any host on the - internet. A crashed child process will automatically be restarted - by the parent process, but an attacker may keep the NSD server - occupied restarting child processes by sending it a stream of - such packets effectively preventing the NSD server to serve.

-
- - - - CVE-2012-2978 - ports/170024 - http://www.nlnetlabs.nl/downloads/CVE-2012-2978.txt - - - 2012-07-19 - 2012-07-20 - 2012-07-21 - - - - - libjpeg-turbo -- heap-based buffer overflow - - - libjpeg-turbo - 1.2.1 - - - - -
-

The Changelog for version 1.2.1 says: Fixed a regression caused by - 1.2.0[6] in which decompressing corrupt JPEG images (specifically, - images in which the component count was erroneously set to a large - value) would cause libjpeg-turbo to segfault.

-
-
-

A Heap-based buffer overflow was found in the way libjpeg-turbo - decompressed certain corrupt JPEG images in which the component count - was erroneously set to a large value. An attacker could create a - specially-crafted JPEG image that, when opened, could cause an - application using libpng to crash or, possibly, execute arbitrary code - with the privileges of the user running the application.

-
- - - - CVE-2012-2806 - http://sourceforge.net/projects/libjpeg-turbo/files/1.2.1/README.txt - https://bugzilla.redhat.com/show_bug.cgi?id=826849 - - - 2012-05-31 - 2012-07-18 - 2012-07-19 - - - - - Dokuwiki -- cross site scripting vulnerability - - - dokuwiki - 20120125_2 - - - - -

Secunia Research reports:

-
-

Secunia Research has discovered a vulnerability in DokuWiki, which can - be exploited by malicious people to conduct cross-site scripting - attacks.

-

Input passed to the "ns" POST parameter in lib/exe/ajax.php (when "call" - is set to "medialist" and "do" is set to "media") is not properly - sanitised within the "tpl_mediaFileList()" function in inc/template.php - before being returned to the user. This can be exploited to execute - arbitrary HTML and script code in a user's browser session in context - of an affected site.

-
- - - - http://secunia.com/advisories/49196/ - CVE-2012-0283 - - - 2012-07-13 - 2012-07-18 - - - - - puppet -- multiple vulnerabilities - - - puppet - 2.7.*2.7.18 - - - - -

puppet -- multiple vulnerabilities

-
-

Arbitrary file read on the puppet master from authenticated - clients (high). It is possible to construct an HTTP get request - from an authenticated client with a valid certificate that will - return the contents of an arbitrary file on the Puppet master - that the master has read-access to.

-

Arbitrary file delete/D.O.S on Puppet Master from authenticated - clients (high). Given a Puppet master with the "Delete" - directive allowed in auth.conf for an authenticated host, an - attacker on that host can send a specially crafted Delete - request that can cause an arbitrary file deletion on the Puppet - master, potentially causing a denial of service attack. Note - that this vulnerability does *not* exist in Puppet as - configured by default.

-

The last_run_report.yaml is world readable (medium). The most - recent Puppet run report is stored on the Puppet master with - world-readable permissions. The report file contains the - context diffs of any changes to configuration on an agent, - which may contain sensitive information that an attacker can - then access. The last run report is overwritten with every - Puppet run.

-

Arbitrary file read on the Puppet master by an agent (medium). - This vulnerability is dependent upon vulnerability - "last_run_report.yml is world readable" above. By creating a - hard link of a Puppet-managed file to an arbitrary file that - the Puppet master can read, an attacker forces the contents to - be written to the puppet run summary. The context diff is - stored in last_run_report.yaml, which can then be accessed by - the attacker.

-

Insufficient input validation for agent hostnames (low). An - attacker could trick the administrator into signing an - attacker's certificate rather than the intended one by - constructing specially crafted certificate requests containing - specific ANSI control sequences. It is possible to use the - sequences to rewrite the order of text displayed to an - administrator such that display of an invalid certificate and - valid certificate are transposed. If the administrator signs - the attacker's certificate, the attacker can then - man-in-the-middle the agent.

-

Agents with certnames of IP addresses can be impersonated - (low). If an authenticated host with a certname of an IP - address changes IP addresses, and a second host assumes the - first host's former IP address, the second host will be treated - by the puppet master as the first one, giving the second host - access to the first host's catalog. Note: This will not be - fixed in Puppet versions prior to the forthcoming 3.x. Instead, - with this announcement IP-based authentication in Puppet < 3.x - is deprecated.

-
- - - - CVE-2012-3864 - CVE-2012-3865 - CVE-2012-3866 - CVE-2012-3867 - http://projects.puppetlabs.com/projects/puppet/wiki/Release_Notes#2.7.18 - http://puppetlabs.com/security/cve/cve-2012-3864/ - http://puppetlabs.com/security/cve/cve-2012-3865/ - http://puppetlabs.com/security/cve/cve-2012-3866/ - http://puppetlabs.com/security/cve/cve-2012-3867/ - - - 2012-07-05 - 2012-07-10 - - - - - asterisk -- multiple vulnerabilities - - - asterisk - 10.*10.5.2 - - - asterisk18 - 1.8.*1.8.13.1 - - - - -

Asterisk project reports:

-
-

Possible resource leak on uncompleted re-invite transactions.

-

Remote crash vulnerability in voice mail application.

-
- - - - CVE-2012-3812 - http://downloads.digium.com/pub/security/AST-2012-010.html - http://downloads.digium.com/pub/security/AST-2012-011.html - https://www.asterisk.org/security - - - 2012-07-05 - 2012-07-06 - 2012-08-30 - - - - - typo3 -- Cross-Site Scripting Vulnerability in TYPO3 Core - - - typo3 - 4.54.5.17 - 4.64.6.10 - 4.74.7.2 - - - - -

Typo3 Security Report (TYPO3-CORE-SA-2012-003):

-
-

TYPO3 bundles and uses an external JavaScript and Flash Upload Library - called swfupload. TYPO3 can be configured to use this Flash uploader. - Input passed via the "movieName" parameter to swfupload.swf is not - properly sanitised before being used in a call to - "ExternalInterface.call()". This can be exploited to execute arbitrary - script code in a user's browser session in context of an affected site. - The existance of the swfupload library is sufficient to be vulnerable - to the reported problem.

-
- - - - http://secunia.com/advisories/49780/ - https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-003/ - - - 2012-07-04 - 2012-07-06 - - - - - phpList -- SQL injection and XSS vulnerability - - - phplist - 2.10.17 - - - - -

Zero Science Lab reports:

-
-

Input passed via the parameter 'sortby' is not properly - sanitised before being returned to the user or used in SQL queries. - This can be exploited to manipulate SQL queries by injecting - arbitrary SQL code. The param 'num' is vulnerable to a XSS issue - where the attacker can execute arbitrary HTML and script code in - a user's browser session in context of an affected site.

-
- - - - CVE-2012-2740 - CVE-2012-2741 - 52657 - https://www.phplist.com/?lid=567 - http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5081.php - - - 2012-03-21 - 2012-07-02 - - - - - FreeBSD -- Privilege escalation when returning from kernel - - - FreeBSD - 7.47.4_9 - 8.18.1_12 - 8.28.2_9 - 8.38.3_3 - 9.09.0_3 - - - - -

Problem description:

-
-

FreeBSD/amd64 runs on CPUs from different vendors. Due to varying - behaviour of CPUs in 64 bit mode a sanity check of the kernel may be - insufficient when returning from a system call.

-

Successful exploitation of the problem can lead to local kernel privilege - escalation, kernel data corruption and/or crash. - To exploit this vulnerability, an attacker must be able to run code with user - privileges on the target system.

-
- - - - SA-12:04.sysret - CVE-2012-0217 - - - 2012-06-12 - 2012-06-27 - - - - - FreeBSD -- Incorrect handling of zero-length RDATA fields in named(8) - - - FreeBSD - 7.47.4_9 - 8.18.1_11 - 8.28.2_9 - 8.38.3_3 - 9.09.0_3 - - - - -

Problem description:

-
-

The named(8) server does not properly handle DNS resource records where - the RDATA field is zero length, which may cause various issues for the - servers handling them.

-

Resolving servers may crash or disclose some portion of memory to the - client. Authoritative servers may crash on restart after transferring a - zone containing records with zero-length RDATA fields. These would - result in a denial of service, or leak of sensitive information.

-
- - - - SA-12:03.bind - CVE-2012-1667 - - - 2012-06-12 - 2012-06-27 - - - - - FreeBSD -- Incorrect crypt() hashing - - - FreeBSD - 7.47.4_8 - 8.18.1_10 - 8.28.2_8 - 8.38.3_2 - 9.09.0_2 - - - - -

Problem description:

-
-

There is a programming error in the DES implementation used in crypt() - when handling input which contains characters that cannot be represented - with 7-bit ASCII.

-

When the input contains characters with only the most significant bit set - (0x80), that character and all characters after it will be ignored.

-
- - - - SA-12:02.crypt - CVE-2012-2143 - - - 2012-05-30 - 2012-06-27 - - - - - FreeBSD -- OpenSSL multiple vulnerabilities - - - FreeBSD - 7.47.4_8 - 8.18.1_10 - 8.28.2_8 - 8.38.3_2 - 9.09.0_2 - - - - -

Problem description:

-
-

OpenSSL fails to clear the bytes used as block cipher padding in SSL 3.0 - records when operating as a client or a server that accept SSL 3.0 - handshakes. As a result, in each record, up to 15 bytes of uninitialized - memory may be sent, encrypted, to the SSL peer. This could include - sensitive contents of previously freed memory. [CVE-2011-4576]

-

OpenSSL support for handshake restarts for server gated cryptography (SGC) - can be used in a denial-of-service attack. [CVE-2011-4619]

-

If an application uses OpenSSL's certificate policy checking when - verifying X509 certificates, by enabling the X509_V_FLAG_POLICY_CHECK - flag, a policy check failure can lead to a double-free. [CVE-2011-4109]

-

A weakness in the OpenSSL PKCS #7 code can be exploited using - Bleichenbacher's attack on PKCS #1 v1.5 RSA padding also known as the - million message attack (MMA). [CVE-2012-0884]

-

The asn1_d2i_read_bio() function, used by the d2i_*_bio and d2i_*_fp - functions, in OpenSSL contains multiple integer errors that can cause - memory corruption when parsing encoded ASN.1 data. This error can occur - on systems that parse untrusted ASN.1 data, such as X.509 certificates - or RSA public keys. [CVE-2012-2110]

-
- - - - SA-12:01.openssl - CVE-2011-4576 - CVE-2011-4619 - CVE-2011-4109 - CVE-2012-0884 - CVE-2012-2110 - - - 2012-05-03 - 2012-06-27 - - - - - pycrypto -- vulnerable ElGamal key generation - - - py-pycrypto - 2.52.6 - - - - -

Dwayne C. Litzenberger of PyCrypto reports:

-
-

In the ElGamal schemes (for both encryption and signatures), g is - supposed to be the generator of the entire Z^*_p group. However, in - PyCrypto 2.5 and earlier, g is more simply the generator of a random - sub-group of Z^*_p.

-

The result is that the signature space (when the key is used for - signing) or the public key space (when the key is used for encryption) - may be greatly reduced from its expected size of log(p) bits, possibly - down to 1 bit (the worst case if the order of g is 2).

-

While it has not been confirmed, it has also been suggested that an - attacker might be able to use this fact to determine the private key.

-

Anyone using ElGamal keys should generate new keys as soon as - practical.

-

Any additional information about this bug will be tracked at - https://bugs.launchpad.net/pycrypto/+bug/985164

-
- - - - CVE-2012-2417 - http://lists.dlitz.net/pipermail/pycrypto/2012q2/000587.html - https://bugs.launchpad.net/pycrypto/+bug/985164 - - - 2012-05-24 - 2012-06-24 - - - - - joomla -- Privilege Escalation - - - joomla - 2.5.5 - - - - -

Joomla! reported a Core Privilege Escalation::

-
-

Inadequate checking leads to possible user privilege escalation..

-
- - - - http://developer.joomla.org/security/news/470-20120601-core-privilege-escalation.html - - - 2012-04-29 - 2012-06-19 - - - - - clamav -- multiple vulnerabilities - - - clamav - 0.97.5 - - - clamav-devel - 20120612 - - - - -

MITRE Advisories report:

-
-

The TAR parser allows remote attackers to bypass malware detection - via a POSIX TAR file with an initial [aliases] character sequence.

-
-
-

The TAR parser allows remote attackers to bypass malware detection - via a TAR archive entry with a length field that exceeds the total - TAR file size.

-
-
-

The Microsoft CHM file parser allows remote attackers to bypass - malware detection via a crafted reset interval in the LZXC header - of a CHM file.

-
-
-

The TAR file parser allows remote attackers to bypass malware - detection via a TAR archive entry with a length field - corresponding to that entire entry, plus part of the header ofxi - the next entry.

-
- - - - CVE-2012-1419 - CVE-2012-1457 - CVE-2012-1458 - CVE-2012-1459 - - - 2012-03-19 - 2012-06-16 - - - - - asterisk -- remote crash vulnerability - - - asterisk10 - 10.*10.5.1 - - - - -

Asterisk project reports:

-
-

Skinny Channel Driver Remote Crash Vulnerability.

-
- - - - CVE-2012-3553 - http://downloads.digium.com/pub/security/AST-2012-009.html - https://www.asterisk.org/security - - - 2012-06-14 - 2012-06-14 - - - - - ImageMagick -- multiple vulnerabilities - - - ImageMagick - 6.7.6.4 - - - ImageMagick-nox11 - 6.7.6.4 - - - - -

ImageMagick reports:

-
-

Three vulnerabilities have been identified in ImageMagick's - handling of JPEG and TIFF files. With these vulnerabilities, it is - possible to cause a denial of service situation in the target - system.

-
- - - - CVE-2012-0259 - CVE-2012-0260 - CVE-2012-1798 - http://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=20629 - http://www.cert.fi/en/reports/2012/vulnerability635606.html - - - 2012-03-28 - 2012-06-14 - 2014-04-30 - - - - - mantis -- multiple vulnerabilities - - - mantis - 1.2.11 - - - - -

Mantis reports:

-
-

Roland Becker and Damien Regad (MantisBT developers) found that - any user able to report issues via the SOAP interface could also - modify any bugnotes (comments) created by other users. In a - default/typical MantisBT installation, SOAP API is enabled and any - user can sign up to report new issues. This vulnerability therefore - impacts upon many public facing MantisBT installations.

-

Roland Becker (MantisBT developer) found that the - delete_attachments_threshold permission was not being checked when - a user attempted to delete an attachment from an issue. The more - generic update_bug_threshold permission was being checked instead. - MantisBT administrators may have been under the false impression - that their configuration of the delete_attachments_threshold was - successfully preventing unwanted users from deleting - attachments.

-
- - - - CVE-2012-2691 - CVE-2012-2692 - http://www.openwall.com/lists/oss-security/2012/06/09/1 - http://sourceforge.net/mailarchive/forum.php?thread_name=1339229952.28538.22%40d.hx.id.au&forum_name=mantisbt-dev - - - 2012-06-09 - 2012-06-12 - 2012-06-13 - - - - - linux-flashplugin -- multiple vulnerabilities - - - linux-f10-flashplugin - 11.2r202.236 - - - - -

Adobe reports:

-
-

These vulnerabilities could cause a crash and potentially allow an attacker to take control of the affected system.

-
- - - - CVE-2012-2034 - CVE-2012-2035 - CVE-2012-2036 - CVE-2012-2037 - CVE-2012-2038 - CVE-2012-2039 - CVE-2012-2040 - http://www.adobe.com/support/security/bulletins/apsb12-14.html - - - 2012-06-08 - 2012-06-09 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 11.0,113.0,1 - 10.0.5,1 - - - linux-firefox - 10.0.5,1 - - - linux-seamonkey - 2.10 - - - linux-thunderbird - 10.0.5 - - - seamonkey - 2.10 - - - thunderbird - 11.013.0 - 10.0.5 - - - libxul - 1.9.2.*10.0.5 - - - - -

The Mozilla Project reports:

-
-

MFSA 2012-34 Miscellaneous memory safety hazards (rv:13.0/ rv:10.0.5)

-

MFSA 2012-36 Content Security Policy inline-script bypass

-

MFSA 2012-37 Information disclosure though Windows file shares and shortcut files

-

MFSA 2012-38 Use-after-free while replacing/inserting a node in a document

-

MFSA 2012-39 NSS parsing errors with zero length items

-

MFSA 2012-40 Buffer overflow and use-after-free issues found using Address Sanitizer

-
- - - - CVE-2011-3101 - CVE-2012-0441 - CVE-2012-1938 - CVE-2012-1939 - CVE-2012-1937 - CVE-2012-1940 - CVE-2012-1941 - CVE-2012-1944 - CVE-2012-1945 - CVE-2012-1946 - CVE-2012-1947 - http://www.mozilla.org/security/known-vulnerabilities/ - http://www.mozilla.org/security/announce/2012/mfsa2012-34.html - http://www.mozilla.org/security/announce/2012/mfsa2012-36.html - http://www.mozilla.org/security/announce/2012/mfsa2012-37.html - http://www.mozilla.org/security/announce/2012/mfsa2012-38.html - http://www.mozilla.org/security/announce/2012/mfsa2012-39.html - http://www.mozilla.org/security/announce/2012/mfsa2012-40.html - - - 2012-06-05 - 2012-06-05 - - - - - quagga -- BGP OPEN denial of service vulnerability - - - quagga - 0.99.20.1 - - - quagga-re - 0.99.17.10 - - - - -

CERT reports:

-
-

If a pre-configured BGP peer sends a specially-crafted OPEN - message with a malformed ORF capability TLV, Quagga bgpd process - will erroneously try to consume extra bytes from the input packet - buffer. The process will detect a buffer overrun attempt before - it happens and immediately terminate with an error message. All - BGP sessions established by the attacked router will be closed - and its BGP routing disrupted.

-
- - - - CVE-2012-1820 - http://www.kb.cert.org/vuls/id/962587 - - - 2012-06-04 - 2012-06-05 - - - - - mail/sympa* -- Multiple vulnerabilities in Sympa archive management - - - sympa - 6.0.7 - 6.1.*6.1.11 - - - - -

David Verdin reports:

-
-

Multiple vulnerabilities have been discovered in Sympa archive - management that allow to skip the scenario-based authorization - mechanisms.

-

This vulnerability allows the attacker to:

-
    -
  • display the archives management page ('arc_manage')
    • -
  • download the list's archives
    • -
  • delete the list's archives
    • -
-
- - - - http://www.sympa.org/security_advisories#security_breaches_in_archives_management - - - 2012-05-15 - 2012-06-05 - - - - - dns/bind9* -- zero-length RDATA can cause named to terminate, reveal memory - - - bind99 - 9.9.1.1 - - - bind98 - 9.8.3.1 - - - bind97 - 9.7.6.1 - - - bind96 - 9.6.3.1.ESV.R7.1 - - - - -

ISC reports:

-
-

Processing of DNS resource records where the rdata field is zero length - may cause various issues for the servers handling them.

-

Processing of these records may lead to unexpected outcomes. Recursive - servers may crash or disclose some portion of memory to the client. - Secondary servers may crash on restart after transferring a zone - containing these records. Master servers may corrupt zone data if the - zone option "auto-dnssec" is set to "maintain". Other unexpected - problems that are not listed here may also be encountered.

-

Impact: This issue primarily affects recursive nameservers. - Authoritative nameservers will only be impacted if an administrator - configures experimental record types with no data. If the server is - configured this way, then secondaries can crash on restart after - transferring that zone. Zone data on the master can become corrupted if - the zone with those records has named configured to manage the DNSSEC - key rotation.

-
- - - - CVE-2012-1667 - http://www.isc.org/software/bind/advisories/cve-2012-1667 - - - 2012-06-04 - 2012-06-04 - 2012-06-06 - - - - - databases/postgresql*-server -- crypt vulnerabilities - - - postgresql-server - 8.3.*8.3.18_1 - 8.4.*8.4.11_1 - 9.0.*9.0.7_2 - 9.1.*9.1.3_1 - 9.2.*9.2.b1_1 - - - - -

The PostgreSQL Global Development Group reports:

-
-

Today the PHP, OpenBSD and FreeBSD communities announced updates to - patch a security hole involving their crypt() hashing algorithms. This - issue is described in CVE-2012-2143. This vulnerability also affects a - minority of PostgreSQL users, and will be fixed in an update release on - June 4, 2012.

-

Affected users are those who use the crypt(text, text) function - with DES encryption in the optional pg_crypto module. Passwords - affected are those that contain characters that cannot be - represented with 7-bit ASCII. If a password contains a character - that has the most significant bit set (0x80), and DES encryption - is used, that character and all characters after it will be ignored.

-
- - - - CVE-2012-2143 - http://www.postgresql.org/about/news/1397/ - http://git.postgresql.org/gitweb/?p=postgresql.git;a=patch;h=932ded2ed51e8333852e370c7a6dad75d9f236f9 - - - 2012-05-30 - 2012-05-30 - 2012-05-31 - - - - - nut -- upsd can be remotely crashed - - - nut - 2.4.02.6.3 - - - - -

Networkupstools project reports:

-
-

NUT server (upsd), from versions 2.4.0 to 2.6.3, are exposed to - crashes when receiving random data from the network.

-

This issue is related to the way NUT parses characters, especially - from the network. Non printable characters were missed from strings - operation (such as strlen), but still copied to the buffer, causing - an overflow.

-
- - - - CVE-2012-2944 - http://www.mail-archive.com/debian-bugs-dist@lists.debian.org/msg1027934.html - http://trac.networkupstools.org/projects/nut/changeset/3633 - - - 2012-05-30 - 2012-05-30 - - - - - asterisk -- multiple vulnerabilities - - - asterisk16 - 1.6.*1.6.2.24 - - - asterisk18 - 1.8.*1.8.12.1 - - - asterisk10 - 10.*10.4.1 - - - - -

Asterisk project reports:

-
-

Remote crash vulnerability in IAX2 channel driver.

-

Skinny Channel Driver Remote Crash Vulnerability

-
- - - - CVE-2012-2947 - http://downloads.digium.com/pub/security/AST-2012-007.html - CVE-2012-2948 - http://downloads.digium.com/pub/security/AST-2012-008.html - https://www.asterisk.org/security - - - 2012-05-29 - 2012-05-29 - 2012-05-29 - - - - - haproxy -- buffer overflow - - - haproxy - 1.4.21 - - - - -

HAProxy reports:

-
-

A flaw was reported in HAProxy where, due to a boundary error - when copying data into the trash buffer, an external attacker could - cause a buffer overflow. Exploiting this flaw could lead to the - execution of arbitrary code, however it requires non-default settings - for the global.tune.bufsize configuration option (must be set to a - value greater than the default), and also that header rewriting is - enabled (via, for example, the regrep or rsprep directives). - This flaw is reported against 1.4.20, prior versions may also be - affected.

-
- - - - CVE-2012-2391 - https://secunia.com/advisories/49261/ - http://haproxy.1wt.eu/download/1.4/src/CHANGELOG - http://haproxy.1wt.eu/git?p=haproxy-1.4.git;a=commit;h=30297cb17147a8d339eb160226bcc08c91d9530b - http://haproxy.1wt.eu/news.html - - - 2012-05-21 - 2012-05-24 - 2012-05-29 - - - - - RT -- Multiple Vulnerabilities - - - rt40 - 4.04.0.6 - - - rt38 - 3.8.12 - - - - -

BestPractical report:

-
-

Internal audits of the RT codebase have uncovered a - number of security vulnerabilities in RT. We are releasing - versions 3.8.12 and 4.0.6 to resolve these vulnerabilities, - as well as patches which apply atop all released versions of - 3.8 and 4.0.

-

The vulnerabilities addressed by 3.8.12, 4.0.6, and the - below patches include the following:

-

The previously released tool to upgrade weak password - hashes as part of CVE-2011-0009 was an incomplete fix and - failed to upgrade passwords of disabled users.

-

RT versions 3.0 and above contain a number of cross-site - scripting (XSS) vulnerabilities which allow an attacker to - run JavaScript with the user's credentials. CVE-2011-2083 is - assigned to this vulnerability.

-

RT versions 3.0 and above are vulnerable to multiple - information disclosure vulnerabilities. This includes the - ability for privileged users to expose users' previous - password hashes -- this vulnerability is particularly - dangerous given RT's weak hashing previous to the fix in - CVE-2011-0009. A separate vulnerability allows privileged - users to obtain correspondence history for any ticket in - RT. CVE-2011-2084 is assigned to this vulnerability.

-

All publicly released versions of RT are vulnerable to - cross-site request forgery (CSRF). CVE-2011-2085 is assigned - to this vulnerability.

-

We have also added a separate configuration option - ($RestrictLoginReferrer) to prevent login CSRF, a different - class of CSRF attack.

-

RT versions 3.6.1 and above are vulnerable to a remote - execution of code vulnerability if the optional VERP - configuration options ($VERPPrefix and $VERPDomain) are - enabled. RT 3.8.0 and higher are vulnerable to a limited - remote execution of code which can be leveraged for - privilege escalation. RT 4.0.0 and above contain a - vulnerability in the global $DisallowExecuteCode option, - allowing sufficiently privileged users to still execute code - even if RT was configured to not allow it. CVE-2011-4458 is - assigned to this set of vulnerabilities.

-

RT versions 3.0 and above may, under some circumstances, - still respect rights that a user only has by way of a - currently-disabled group. CVE-2011-4459 is assigned to this - vulnerability.

-

RT versions 2.0 and above are vulnerable to a SQL - injection attack, which allow privileged users to obtain - arbitrary information from the database. CVE-2011-4460 is - assigned to this vulnerability.

-
- - - - CVE-2011-0009 - CVE-2011-2082 - CVE-2011-2083 - CVE-2011-2084 - CVE-2011-2085 - CVE-2011-4458 - CVE-2011-4459 - CVE-2011-4460 - http://blog.bestpractical.com/2012/05/security-vulnerabilities-in-rt.html - - - 2012-05-22 - 2012-05-23 - - - - - sympa -- Multiple Security Bypass Vulnerabilities - - - sympa - 6.1.11 - - - - -

Secunia team reports:

-
-

Multiple vulnerabilities have been reported in Sympa, which can be - exploited by malicious people to bypass certain security - restrictions.

-

The vulnerabilities are caused due to the application allowing - access to archive functions without checking credentials. This can - be exploited to create, download, and delete an archive.

-
- - - - CVE-2012-2352 - http://secunia.com/advisories/49045/ - - - 2012-05-14 - 2012-05-21 - - - - - foswiki -- Script Insertion Vulnerability via unchecked user registration fields - - - foswiki - 1.1.5 - - - - -

Foswiki team reports:

-
-

When a new user registers, the new user can add arbitrary HTML and - script code into the user topic which is generated by the - RegistrationAgent via standard registration fields such as - "FirstName" or "OrganisationName".

-

By design, Foswiki's normal editing features allow arbitrary HTML - markup, including script code, to be inserted into any topic anyway, - assuming the authenticated user has CHANGE permission - which is the - case on many Foswiki sites. However, the assumption that only - authenticated users with CHANGE permission may create script content - is false if new users exploit the vulnerability detailed in this - alert to manipulate the registration agent into creating that - content for them.

-
- - - - CVE-2012-1004 - http://foswiki.org/Support/SecurityAlert-CVE-2012-1004 - - - 2012-04-13 - 2012-05-21 - - - - - libxml2 -- An off-by-one out-of-bounds write by XPointer - - - libxml2 - 2.7.8_3 - - - linux-f10-libxml2 - 2.7.8_3 - - - - -

Google chrome team reports:

-
-

An off-by-one out-of-bounds write flaw was found in the way libxml, a library - for providing XML and HTML support, evaluated certain XPointer parts (XPointer - is used by libxml to include only the part from the returned XML document, that - can be accessed using the XPath expression given with the XPointer). A remote - attacker could provide a specially-crafted XML file, which once opened in an - application, linked against libxml, would lead to that application crash, or, - potentially arbitrary code execution with the privileges of the user running - the application.

-

Note: The flaw to be exploited requires the particular application, linked - against libxml, to use the XPointer evaluation functionality.

-
- - - - CVE-2011-3202 - http://googlechromereleases.blogspot.com/2012/05/stable-channel-update.html - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3102 - - - 2012-05-15 - 2012-05-18 - 2014-04-30 - - - - - inspircd -- buffer overflow - - - inspircd - 1.21.2.9 - 2.02.0.5_2 - - - - -

InspIRCd reports:

-
-

InspIRCd contains a heap corruption vulnerability that exists in the - dns.cpp code. The res[] buffer is allocated on the heap and can be - overflowed. The res[] buffer can be exploited during its deallocation. - The number of overflowed bytes can be controlled with DNS compression - features.

-
- - - - CVE-2012-1836 - http://inspircd.github.com/ - - - 2012-03-19 - 2012-05-17 - 2012-06-21 - - - - - pidgin-otr -- format string vulnerability - - - pidgin-otr - 3.2.1 - - - - -

The authors report:

-
-

Versions 3.2.0 and earlier of the pidgin-otr plugin contain - a format string security flaw. This flaw could potentially be - exploited by a remote attacker to cause arbitrary code to be - executed on the user's machine.

-

The flaw is in pidgin-otr, not in libotr. Other applications - that use libotr are not affected.

-
- - - - CVE-2012-2369 - http://www.cypherpunks.ca/otr/ - - - 2012-05-16 - 2012-05-16 - - - - - sudo -- netmask vulnerability - - - sudo - 1.8.4_1 - - - - -

Todd Miller reports:

-
-

Sudo supports granting access to commands on a per-host basis. - The host specification may be in the form of a host name, a - netgroup, an IP address, or an IP network (an IP address with an - associated netmask).

-

When IPv6 support was added to sudo, a bug was introduced that - caused the IPv6 network matching code to be called when an IPv4 - network address does not match. Depending on the value of the - uninitialized portion of the IPv6 address, it is possible for the - IPv4 network number to match when it should not. This bug only - affects IP network matching and does not affect simple IP address - matching.

-

The reported configuration that exhibited the bug was an - LDAP-based sudo installation where the sudoRole object contained - multiple sudoHost entries, each containing a different IPv4 - network. File-based sudoers should be affected as well as the - same matching code is used.

-
- - - - CVE-2012-2337 - http://www.sudo.ws/sudo/alerts/netmask.html - - - 2012-05-16 - 2012-05-16 - - - - - OpenSSL -- DTLS and TLS 1.1, 1.2 denial of service - - - openssl - 1.0.1_2 - - - - -

OpenSSL security team reports:

-
-

A flaw in the OpenSSL handling of CBC mode ciphersuites in TLS 1.1, 1.2 and - DTLS can be exploited in a denial of service attack on both clients and - servers.

-
- - - - CVE-2012-2333 - http://www.openssl.org/news/secadv_20120510.txt - - - 2012-05-10 - 2012-05-10 - - - - - socat -- Heap-based buffer overflow - - - socat - 1.7.2.1 - - - - -

The socat development team reports:

-
-

This vulnerability can be exploited when socat is invoked with the - READLINE address (this is usually only used interactively) without - option "prompt" and without option "noprompt" and an attacker succeeds - to provide malicious data to the other (arbitrary) address that is then - transferred by socat to the READLINE address for output.

-

Successful exploitation may allow an attacker to execute arbitrary - code with the privileges of the socat process.

-
- - - - CVE-2012-0219 - www.dest-unreach.org/socat/contrib/socat-secadv3.html - - - 2012-05-14 - 2012-05-14 - - - - - php -- multiple vulnerabilities - - - php5 - 5.45.4.3 - 5.3.13 - - - php53 - 5.3.13 - - - php52 - 5.2.17_9 - - - - -

The PHP Development Team reports:

-
-

The release of PHP 5.4.13 and 5.4.3 complete a fix for the - vulnerability in CGI-based setups as originally described in - CVE-2012-1823. (CVE-2012-2311)

-

Note: mod_php and php-fpm are not vulnerable to this attack.

-

PHP 5.4.3 fixes a buffer overflow vulnerability in the - apache_request_headers() (CVE-2012-2329).

-
- - - - CVE-2012-1823 - CVE-2012-2311 - CVE-2012-2329 - - - 2012-05-08 - 2012-05-12 - - - - - libpurple -- Invalid memory dereference in the XMPP protocol plug-in by processing serie of specially-crafted file transfer requests - - - libpurple - 2.10.4 - - - - -

Pidgin reports:

-
-

A series of specially crafted file transfer requests can cause clients to reference invalid memory. The user must have accepted one of the file transfer requests.

-
- - - - CVE-2012-2214 - - - 2012-05-06 - 2012-05-12 - - - - - PivotX -- 'ajaxhelper.php' Cross Site Scripting Vulnerability - - - pivotx - 2.3.2 - - - - -

High-Tech Bridge reports:

-
-

Input passed via the "file" GET parameter to - /pivotx/ajaxhelper.php is not properly sanitised before - being returned to the user. This can be exploited to - execute arbitrary HTML and script code in administrator's - browser session in context of the affected website.

-
- - - - 52159 - CVE-2012-2274 - https://www.htbridge.com/advisory/HTB23087 - - - 2012-05-09 - 2012-05-12 - 2012-05-14 - - - - - NVIDIA UNIX driver -- access to arbitrary system memory - - - nvidia-driver - 173.14.35_2295.71 - 96.43.20_3173.14.35 - 71.86.15_396.43.20_2 - 71.86.15_2 - - - - -

NVIDIA Unix security team reports:

-
-

Security vulnerability CVE-2012-0946 in the NVIDIA UNIX driver - was disclosed to NVIDIA on March 20th, 2012. The vulnerability - makes it possible for an attacker who has read and write access - to the GPU device nodes to reconfigure GPUs to gain access to - arbitrary system memory. NVIDIA is not aware of any reports of - this vulnerability, outside of the disclosure which was made - privately to NVIDIA.

-

NVIDIA has identified the root cause of the vulnerability and - has released updated drivers which close it. [NVIDIA encourages] - all users with Geforce 8 or newer, G80 Quadro or newer, and all - Tesla GPUs to update their drivers to 295.40 or later.

-
-

Later, it was additionally discovered that similar exploit could - be achieved through remapping of VGA window:

-
-

NVIDIA received notification of a security exploit that uses - NVIDIA UNIX device files to map and program registers to redirect - the VGA window. Through the VGA window, the exploit can access - any region of physical system memory. This arbitrary memory - access can be further exploited, for example, to escalate user - privileges.

-
- - - - CVE-2012-0946 - CVE-2012-4225 - - - 2012-03-20 - 2012-05-10 - 2012-09-12 - - - - - rubygem-mail -- multiple vulnerabilities - - - rubygem-mail - 2.4.4 - - - - -

rubygem-mail -- multiple vulnerabilities

-
-

Two issues were fixed. They are a file system traversal in file_delivery method and arbitrary command execution when using exim or sendmail from the command line.

-
- - - - CVE-2012-2139 - CVE-2012-2140 - http://seclists.org/oss-sec/2012/q2/190 - - - 2012-03-14 - 2012-05-09 - - - - - node -- private information disclosure - - - node - node-devel - 0.6.17 - - - - -

Private information disclosure

-
-

An attacker can cause private information disclosure.

-
- - - - http://blog.nodejs.org/2012/05/07/http-server-security-vulnerability-please-upgrade-to-0-6-17/ - - - 2012-04-17 - 2012-05-07 - - - - - p5-Config-IniFiles -- unsafe temporary file creation - - - p5-Config-IniFiles - 2.71 - - - - -

Unsafe Temporary file creation

-
-

Config::IniFiles used a predictable name for its temporary - file without opening it correctly.

-
- - - - CVE-2012-2451 - https://bitbucket.org/shlomif/perl-config-inifiles/changeset/a08fa26f4f59 - - - 2012-05-02 - 2012-05-07 - - - - - php -- vulnerability in certain CGI-based setups - - - php5 - 5.45.4.2 - 5.3.12 - - - php53 - 5.3.12 - - - php4 - 4.4.10 - - - php52 - 5.2.17_8 - - - - -

php development team reports:

-
-

Security Enhancements and Fixes in PHP 5.3.12:

-
    -
  • Initial fix for cgi-bin ?-s cmdarg parse issue - (CVE-2012-1823)
    • -
-
- - - - CVE-2012-1823 - - - 2012-05-03 - 2012-05-05 - - - - - WebCalendar -- multiple vulnerabilities - - - WebCalendar-devel - 1.2.4 - - - - -

Hanno Boeck reports:

-
-

Fixes [are now available] for various security vulnerabilities - including LFI (local file inclusion), XSS (cross site scripting) - and others.

-
- - - - CVE-2012-1495 - CVE-2012-1496 - http://packetstormsecurity.org/files/112332/WebCalendar-1.2.4-Remote-Code-Execution.html - http://packetstormsecurity.org/files/112323/WebCalendar-1.2.4-Pre-Auth-Remote-Code-Injection.html - http://archives.neohapsis.com/archives/bugtraq/2012-04/0182.html - - - 2012-04-28 - 2012-05-02 - - - - - php -- multiple vulnerabilities - - - php53 - 5.3.11 - - - php5 - 5.3.11 - - - - -

php development team reports:

-
-

Security Enhancements for both PHP 5.3.11 and PHP 5.4.1:

-
    -
  • Insufficient validating of upload name leading to corrupted $_FILES indices. (CVE-2012-1172)
    • -
  • Add open_basedir checks to readline_write_history and readline_read_history.
    • -
-

Security Enhancements for both PHP 5.3.11 only:

-
    -
  • Regression in magic_quotes_gpc fix for CVE-2012-0831.
    • -
-
- - - - CVE-2012-0831 - CVE-2012-1172 - http://www.php.net/archive/2012.php#id2012-04-26-1 - - - 2012-03-01 - 2012-04-28 - 2012-05-04 - - - - - samba -- incorrect permission checks vulnerability - - - samba34 - 3.4.*3.4.17 - - - samba35 - 3.5.*3.5.15 - - - samba36 - 3.6.*3.6.5 - - - - -

The Samba project reports:

-
-

Samba versions 3.4.x to 3.6.4 inclusive are affected - by a vulnerability that allows arbitrary users to modify - privileges on a file server.

-

Security checks were incorrectly applied to the Local - Security Authority (LSA) remote proceedure calls (RPC) - CreateAccount, OpenAccount, AddAccountRights and - RemoveAccountRights allowing any authenticated user - to modify the privileges database.

-

This is a serious error, as it means that authenticated - users can connect to the LSA and grant themselves the - "take ownership" privilege. This privilege is used by the - smbd file server to grant the ability to change ownership - of a file or directory which means users could take ownership - of files or directories they do not own.

-
- - - - CVE-2012-2111 - - - 2012-04-30 - 2012-04-30 - - - - - portupgrade-devel -- lack of distfile checksums - - - portupgrade-devel - 0,3 - - - - -

Ports security team reports:

-

The portupgrade-devel port fetched directly from a git - respository without checking against a known good - SHA hash. This means that it is possible that packages - built using this port may not match the one vetted - by the maintainer. Users are advised to rebuild - portupgrade-devel from known good sources.

- - - - http://web.archiveorange.com/archive/v/6ETvLYPz7CfFT9tiHKiI - http://www.freebsd.org/cgi/getmsg.cgi?fetch=100677+0+/usr/local/www/db/text/2012/cvs-ports/20120506.cvs-ports - - - 2012-04-30 - 2012-04-30 - 2012-05-06 - - - - - net-snmp -- Remote DoS - - - net-snmp - 5.7.1_7 - - - - -

The Red Hat Security Response Team reports:

-
-

An array index error, leading to out-of heap-based buffer read flaw was - found in the way the net-snmp agent performed lookups in the - extension table. When certain MIB subtrees were handled by the - extend directive, a remote attacker (having read privileges to the - subntree) could use this flaw to cause a denial of service condition - via an SNMP GET request involving a non-existent extension table - entry.

-
- - - - CVE-2012-2141 - https://bugzilla.redhat.com/show_bug.cgi?id=815813 - http://www.openwall.com/lists/oss-security/2012/04/26/2 - - - 2012-04-26 - 2012-04-27 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 11.0,112.0,1 - 10.0.4,1 - - - linux-firefox - 10.0.4,1 - - - linux-seamonkey - 2.9 - - - linux-thunderbird - 10.0.4 - - - seamonkey - 2.9 - - - thunderbird - 11.012.0 - 10.0.4 - - - libxul - 1.9.2.*10.0.4 - - - - -

The Mozilla Project reports:

-
-

MFSA 2012-20 Miscellaneous memory safety hazards (rv:12.0/ rv:10.0.4)

-

MFSA 2012-21 Multiple security flaws fixed in FreeType v2.4.9

-

MFSA 2012-22 use-after-free in IDBKeyRange

-

MFSA 2012-23 Invalid frees causes heap corruption in gfxImageSurface

-

MFSA 2012-24 Potential XSS via multibyte content processing errors

-

MFSA 2012-25 Potential memory corruption during font rendering using cairo-dwrite

-

MFSA 2012-26 WebGL.drawElements may read illegal video memory due to FindMaxUshortElement error

-

MFSA 2012-27 Page load short-circuit can lead to XSS

-

MFSA 2012-28 Ambiguous IPv6 in Origin headers may bypass webserver access restrictions

-

MFSA 2012-29 Potential XSS through ISO-2022-KR/ISO-2022-CN decoding issues

-

MFSA 2012-30 Crash with WebGL content using textImage2D

-

MFSA 2012-31 Off-by-one error in OpenType Sanitizer

-

MFSA 2012-32 HTTP Redirections and remote content can be read by javascript errors

-

MFSA 2012-33 Potential site identity spoofing when loading RSS and Atom feeds

-
- - - - CVE-2011-1187 - CVE-2011-3062 - CVE-2012-0467 - CVE-2012-0468 - CVE-2012-0469 - CVE-2012-0470 - CVE-2012-0471 - CVE-2012-0472 - CVE-2012-0473 - CVE-2012-0474 - CVE-2012-0475 - CVE-2012-0477 - CVE-2012-0478 - CVE-2012-0479 - CVE-2012-1126 - CVE-2012-1127 - CVE-2012-1128 - CVE-2012-1129 - CVE-2012-1130 - CVE-2012-1131 - CVE-2012-1132 - CVE-2012-1133 - CVE-2012-1134 - CVE-2012-1135 - CVE-2012-1136 - CVE-2012-1137 - CVE-2012-1138 - CVE-2012-1139 - CVE-2012-1140 - CVE-2012-1141 - CVE-2012-1142 - CVE-2012-1143 - CVE-2012-1144 - http://www.mozilla.org/security/announce/2012/mfsa2012-20.html - http://www.mozilla.org/security/announce/2012/mfsa2012-21.html - http://www.mozilla.org/security/announce/2012/mfsa2012-22.html - http://www.mozilla.org/security/announce/2012/mfsa2012-23.html - http://www.mozilla.org/security/announce/2012/mfsa2012-24.html - http://www.mozilla.org/security/announce/2012/mfsa2012-25.html - http://www.mozilla.org/security/announce/2012/mfsa2012-26.html - http://www.mozilla.org/security/announce/2012/mfsa2012-27.html - http://www.mozilla.org/security/announce/2012/mfsa2012-28.html - http://www.mozilla.org/security/announce/2012/mfsa2012-29.html - http://www.mozilla.org/security/announce/2012/mfsa2012-30.html - http://www.mozilla.org/security/announce/2012/mfsa2012-31.html - http://www.mozilla.org/security/announce/2012/mfsa2012-32.html - http://www.mozilla.org/security/announce/2012/mfsa2012-33.html - - - 2012-04-24 - 2012-04-24 - - - - - Dokuwiki -- cross site scripting vulnerability - - - dokuwiki - 20120125_1 - - - - -

Andy Webber reports:

-
-

Add User appears to be vulnerable to Cross Site Request Forgery (CSRF/XSRF).

-
- - - - CVE-2012-2128 - CVE-2012-2129 - - - 2012-04-17 - 2012-04-23 - - - - - asterisk -- multiple vulnerabilities - - - asterisk16 - 1.6.*1.6.2.24 - - - asterisk18 - 1.8.*1.8.11.1 - - - asterisk10 - 10.*10.3.1 - - - - -

Asterisk project reports:

-
-

Remote Crash Vulnerability in SIP Channel Driver

-

Heap Buffer Overflow in Skinny Channel Driver

-

Asterisk Manager User Unauthorized Shell Access

-
- - - - http://downloads.digium.com/pub/security/AST-2012-004.html - CVE-2012-2414 - http://downloads.digium.com/pub/security/AST-2012-005.html - CVE-2012-2415 - http://downloads.digium.com/pub/security/AST-2012-006.html - CVE-2012-2416 - - - 2012-04-23 - 2012-04-23 - - - - - wordpress -- multiple vulnerabilities - - - wordpress - 3.3.2,1 - - - - -

Wordpress reports:

-
-

External code has been updated to - non-vulnerable versions. - In addition the following bugs have been fixed:

-
    -
  • Limited privilege escalation where a site administrator could - deactivate network-wide plugins when running a WordPress network under - particular circumstances.
    • -
  • Cross-site scripting vulnerability when making URLs - clickable.
    • -
  • Cross-site scripting vulnerabilities in redirects after posting - comments in older browsers, and when filtering URLs.
    • -
-
- - - - CVE-2012-2399 - CVE-2012-2400 - CVE-2012-2401 - CVE-2012-2402 - CVE-2012-2403 - CVE-2012-2404 - https://codex.wordpress.org/Version_3.3.2 - - - 2012-04-20 - 2012-04-23 - - - - - OpenSSL -- integer conversions result in memory corruption - - - openssl - 1.0.1_1 - - - - -

OpenSSL security team reports:

-
-

A potentially exploitable vulnerability has been discovered in the OpenSSL - function asn1_d2i_read_bio. - Any application which uses BIO or FILE based functions to read untrusted DER - format data is vulnerable. Affected functions are of the form d2i_*_bio or - d2i_*_fp, for example d2i_X509_bio or d2i_PKCS12_fp.

-
- - - - CVE-2012-2110 - http://marc.info/?l=full-disclosure&m=133483221408243 - http://www.openssl.org/news/secadv_20120419.txt - - - 2012-04-19 - 2012-04-21 - - - - - bugzilla -- multiple vulnerabilities - - - bugzilla - 3.6.03.6.9 - 4.0.04.0.6 - - - - -

A Bugzilla Security Advisory reports:

-
-

The following security issues have been discovered in - Bugzilla:

-

Unauthorized Access

-

Due to a lack of proper validation of the X-FORWARDED-FOR - header of an authentication request, an attacker could bypass - the current lockout policy used for protection against brute- - force password discovery. This vulnerability can only be - exploited if the 'inbound_proxies' parameter is set.

-

Cross Site Scripting

-

A JavaScript template used by buglist.cgi could be used - by a malicious script to permit an attacker to gain access - to some information about bugs he would not normally be - allowed to see, using the victim's credentials. To be - exploitable, the victim must be logged in when visiting - the attacker's malicious page.

-

All affected installations are encouraged to upgrade as soon - as possible.

-
- - - - CVE-2012-0465 - CVE-2012-0466 - https://bugzilla.mozilla.org/show_bug.cgi?id=728639 - https://bugzilla.mozilla.org/show_bug.cgi?id=745397 - - - 2012-04-18 - 2012-04-21 - - - - - typo -- Cross-Site Scripting - - - typo3 - 4.6.04.6.7 - 4.5.04.5.14 - 4.4.04.4.14 - - - - -

Typo Security Team reports:

-
-

Failing to properly encode the output, the default TYPO3 - Exception Handler is susceptible to Cross-Site Scripting. We - are not aware of a possibility to exploit this vulnerability - without third party extensions being installed that put user - input in exception messages. However, it has come to our - attention that extensions using the extbase MVC framework can - be used to exploit this vulnerability if these extensions - accept objects in controller actions.

-
- - - - CVE-2012-2112 - https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-002/ - - - 2012-04-17 - 2012-04-18 - - - - - nginx -- Buffer overflow in the ngx_http_mp4_module - - - nginx - 1.0.15 - - - nginx-devel - 1.1.19 - - - - -

The nginx project reports:

-
-

Buffer overflow in the ngx_http_mp4_module

-
- - - - CVE-2012-2089 - http://nginx.org/en/security_advisories.html - - - 2012-04-12 - 2012-04-16 - - - - - phpmyfaq -- Remote PHP Code Execution Vulnerability - - - phpmyfaq - 2.7.5 - - - - -

The phpMyFAQ project reports:

-
-

The bundled ImageManager library allows injection of arbitrary - PHP code to execute arbitrary PHP code and upload malware and - trojan horses.

-
- - - - http://www.phpmyfaq.de/advisory_2012-04-14.php - - - 2012-04-14 - 2012-04-14 - - - - - puppet -- Multiple Vulnerabilities - - - puppet - 2.7.*2.7.12_1 - - - - -
-

Multiple vulnerabilities exist in puppet that can result in - arbitrary code execution, arbitrary file read access, denial of - service, and arbitrary file write access. Please review the - details in each of the CVEs for additional information.

-
- - - - CVE-2012-1906 - CVE-2012-1986 - CVE-2012-1987 - CVE-2012-1988 - CVE-2012-1989 - http://puppetlabs.com/security/cve/cve-2012-1906/ - http://puppetlabs.com/security/cve/cve-2012-1986/ - http://puppetlabs.com/security/cve/cve-2012-1987/ - http://puppetlabs.com/security/cve/cve-2012-1988/ - http://puppetlabs.com/security/cve/cve-2012-1989/ - - - 2012-03-26 - 2012-04-10 - - - - - samba -- "root" credential remote code execution - - - samba34 - 3.4.*3.4.16 - - - samba35 - 3.5.*3.5.14 - - - samba36 - 3.6.*3.6.4 - - - - -

Samba development team reports:

-
-

Samba versions 3.6.3 and all versions previous to this - are affected by a vulnerability that allows remote code - execution as the "root" user from an anonymous connection.

-

As this does not require an authenticated connection it - is the most serious vulnerability possible in a program, - and users and vendors are encouraged to patch their Samba - installations immediately.

-
- - - - CVE-2012-1182 - - - 2012-04-10 - 2012-04-10 - - - - - bugzilla Cross-Site Request Forgery - - - bugzilla - 4.0.04.0.5 - - - - -

A Bugzilla Security Advisory reports:

-
-

The following security issues have been discovered in - Bugzilla:

-
    -
  • Due to a lack of validation of the enctype form attribute - when making POST requests to xmlrpc.cgi, a possible CSRF - vulnerability was discovered. If a user visits an HTML page - with some malicious HTML code in it, an attacker could make - changes to a remote Bugzilla installation on behalf of the - victim's account by using the XML-RPC API on a site running - mod_perl. Sites running under mod_cgi are not affected. - Also, the user would have had to be already logged in to the - target site for the vulnerability to work.
    • -
-

All affected installations are encouraged to upgrade as soon - as possible.

-
- - - - CVE-2012-0453 - https://bugzilla.mozilla.org/show_bug.cgi?id=725663 - - - 2012-02-22 - 2012-04-10 - - - - - linux-flashplugin -- multiple vulnerabilities - - - linux-f10-flashplugin - 11.2r202.228 - - - - -

Adobe reports:

-
-

Multiple Priority 2 vulnerabilities could cause a crash and - potentially allow an attacker to take control of the affected - system.

-
- - - - CVE-2012-0724 - CVE-2012-0725 - CVE-2012-0772 - CVE-2012-0773 - https://www.adobe.com/support/security/bulletins/apsb12-07.html - - - 2012-04-05 - 2012-04-10 - - - - - png -- memory corruption/possible remote code execution - - - png - linux-f10-png - 1.4.11 - - - - -

The PNG project reports:

-
-

libpng fails to correctly handle malloc() failures for text - chunks (in png_set_text_2()), which can lead to memory - corruption and the possibility of remote code execution.

-
- - - - CVE-2011-3048 - http://www.libpng.org/pub/png/libpng.html - - - 2012-03-29 - 2012-04-08 - - - - - freetype -- multiple vulnerabilities - - - freetype2 - 2.4.9 - - - - -

The Freetype project reports:

-
-

Multiple vulnerabilities exist in freetype that can result in - application crashes and remote code execution. Please review - the details in each of the CVEs for additional information.

-
- - - - CVE-2012-1126 - CVE-2012-1127 - CVE-2012-1128 - CVE-2012-1129 - CVE-2012-1130 - CVE-2012-1131 - CVE-2012-1132 - CVE-2012-1133 - CVE-2012-1134 - CVE-2012-1135 - CVE-2012-1136 - CVE-2012-1137 - CVE-2012-1138 - CVE-2012-1139 - CVE-2012-1140 - CVE-2012-1141 - CVE-2012-1142 - CVE-2012-1143 - CVE-2012-1144 - https://sourceforge.net/projects/freetype/files/freetype2/2.4.9/README/view - https://bugzilla.redhat.com/show_bug.cgi?id=806270 - - - 2012-03-08 - 2012-04-06 - - - - - mutt-devel -- failure to check SMTP TLS server certificate - - - mutt-devel - 1.5.21_4 - - - - -

Dave B reports on Full Disclosure:

-
-

It seems that mutt fails to check the validity of a SMTP - servers certificate during a TLS connection. [...] - This means that an attacker could potentially MITM a - mutt user connecting to their SMTP server even when the - user has forced a TLS connection.

-
- - - - CVE-2011-1429 - http://seclists.org/fulldisclosure/2011/Mar/87 - - - 2012-03-08 - 2012-04-06 - - - - - libpurple -- Remote DoS via an MSN OIM message that lacks UTF-8 encoding - - - libpurple - 2.10.2 - - - - -

US-CERT reports:

-
-

The msn_oim_report_to_user function in oim.c in the MSN protocol - plugin in libpurple in Pidgin before 2.10.2 allows remote servers - to cause a denial of service (application crash) via an OIM message - that lacks UTF-8 encoding.

-
- - - - CVE-2012-1178 - - - 2012-03-15 - 2012-04-01 - - - - - phpMyAdmin -- Path disclosure due to missing verification of file presence - - - phpMyAdmin - 3.43.4.10.2 - - - - -

The phpMyAdmin development team reports:

-
-

The show_config_errors.php scripts did not validate the presence - of the configuration file, so an error message shows the full path - of this file, leading to possible further attacks. For the error - messages to be displayed, php.ini's error_reporting must be set to - E_ALL and display_errors must be On (these settings are not - recommended on a production server in the PHP manual).

-
- - - - CVE-2012-1902 - http://www.phpmyadmin.net/home_page/security/PMASA-2012-2.php - - - 2012-03-28 - 2012-03-28 - - - - - raptor/raptor2 -- XXE in RDF/XML File Interpretation - - - raptor2 - 2.0.7 - - - raptor - 1.4.21_2 - - - - -

Timothy D. Morgan reports:

-
-

In December 2011, VSR identified a vulnerability in multiple open - source office products (including OpenOffice, LibreOffice, KOffice, - and AbiWord) due to unsafe interpretation of XML files with custom - entity declarations. Deeper analysis revealed that the - vulnerability was caused by acceptance of external entities by the - libraptor library, which is used by librdf and is in turn used by - these office products.

-

In the context of office applications, these vulnerabilities could - allow for XML External Entity (XXE) attacks resulting in file theft - and a loss of user privacy when opening potentially malicious ODF - documents. For other applications which depend on librdf or - libraptor, potentially serious consequences could result from - accepting RDF/XML content from untrusted sources, though the impact - may vary widely depending on the context.

-
- - - - CVE-2012-0037 - http://seclists.org/fulldisclosure/2012/Mar/281 - http://www.vsecurity.com/resources/advisory/20120324-1/ - - - 2012-03-24 - 2012-03-25 - - - - - quagga -- multiple vulnerabilities - - - quagga - 0.99.20.1 - - - quagga-re - 0.99.17.8 - - - - -

CERT reports:

-
-

The ospfd implementation of OSPF in Quagga allows a remote - attacker (on a local network segment with OSPF enabled) to cause - a denial of service (daemon aborts due to an assert) with a - malformed OSPF LS-Update message.

-

The ospfd implementation of OSPF in Quagga allows a remote - attacker (on a local network segment with OSPF enabled) to cause - a denial of service (daemon crash) with a malformed OSPF Network- - LSA message.

-

The bgpd implementation of BGP in Quagga allows remote attackers - to cause a denial of service (daemon aborts due to an assert) via - BGP Open message with an invalid AS4 capability.

-
- - - - CVE-2012-0249 - CVE-2012-0250 - CVE-2012-0255 - http://www.kb.cert.org/vuls/id/551715 - - - 2012-03-23 - 2012-03-24 - 2012-03-26 - - - - - Apache Traffic Server -- heap overflow vulnerability - - - trafficserver - 3.0.4 - - - - -

CERT-FI reports:

-
-

A heap overflow vulnerability has been found in the HTTP - (Hypertext Transfer Protocol) protocol handling of Apache - Traffic Server. The vulnerability allows an attacker to cause - a denial of service or potentially to execute his own code by - sending a specially modified HTTP message to an affected - server.

-
- - - - CVE-2012-0256 - - - 2012-03-22 - 2012-03-24 - - - - - libtasn1 -- ASN.1 length decoding vulnerability - - - libtasn1 - 2.12 - - - gnutls - 2.12.18 - - - gnutls-devel - 2.993.0.16 - - - - -

Mu Dynamics, Inc. reports:

-
-

Various functions using the ASN.1 length decoding logic in - Libtasn1 were incorrectly assuming that the return value from - asn1_get_length_der is always less than the length of the - enclosing ASN.1 structure, which is only true for valid - structures and not for intentionally corrupt or otherwise - buggy structures.

-
- - - - CVE-2012-1569 - - - 2012-03-20 - 2012-03-21 - 2012-03-24 - - - - - gnutls -- possible overflow/Denial of service vulnerabilities - - - gnutls - 2.12.18 - - - gnutls-devel - 2.993.0.15 - - - - -

Mu Dynamics, Inc. reports:

-
-

The block cipher decryption logic in GnuTLS assumed that a - record containing any data which was a multiple of the block - size was valid for further decryption processing, leading to - a heap corruption vulnerability.

-
- - - - CVE-2012-1573 - - - 2012-03-20 - 2012-03-21 - 2012-03-24 - - - - - asterisk -- multiple vulnerabilities - - - asterisk14 - 1.4.*1.4.44 - - - asterisk16 - 1.6.*1.6.2.23 - - - asterisk18 - 1.8.*1.8.10.1 - - - asterisk10 - 10.*10.2.1 - - - - -

Asterisk project reports:

-
-

Stack Buffer Overflow in HTTP Manager

-

Remote Crash Vulnerability in Milliwatt Application

-
- - - - http://downloads.asterisk.org/pub/security/AST-2012-002.html - http://downloads.asterisk.org/pub/security/AST-2012-003.html - - - 2012-03-15 - 2012-03-15 - - - - - OpenSSL -- CMS and S/MIME Bleichenbacher attack - - - openssl - 1.0.0_10 - - - - -

The OpenSSL Team reports:

-
-

A weakness in the OpenSSL CMS and PKCS #7 code can be exploited - using Bleichenbacher's attack on PKCS #1 v1.5 RSA padding - also known as the million message attack (MMA).

-

Only users of CMS, PKCS #7, or S/MIME decryption operations are - affected. A successful attack needs on average 2^20 messages. In - practice only automated systems will be affected as humans will - not be willing to process this many messages.

-

SSL/TLS applications are *NOT* affected by this problem since - the SSL/TLS code does not use the PKCS#7 or CMS decryption - code.

-
- - - - CVE-2012-0884 - http://www.openssl.org/news/secadv_20120312.txt - - - 2012-03-12 - 2012-03-15 - - - - - nginx -- potential information leak - - - nginx - 1.0.14,1 - - - nginx-devel - 1.1.17 - - - - -

nginx development team reports:

-
-

Matthew Daley recently discovered a security problem - which may lead to a disclosure of previously freed memory - on specially crafted response from an upstream server, - potentially resulting in sensitive information leak.

-
- - - - http://nginx.net/CHANGES - - - 2012-03-15 - 2012-03-15 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 4.0,110.0.3,1 - 3.6.*,13.6.28 - - - linux-firefox - 10.0.3,1 - - - linux-seamonkey - 2.8 - - - linux-thunderbird - 10.0.3 - - - seamonkey - 2.8 - - - thunderbird - 4.010.0.3 - 3.1.*3.1.20 - - - libxul - 1.9.2.*1.9.2.28 - - - - -

The Mozilla Project reports:

-
-

MFSA 2012-13 XSS with Drag and Drop and Javascript: URL

-

MFSA 2012-14 SVG issues found with Address Sanitizer

-

MFSA 2012-15 XSS with multiple Content Security Policy headers

-

MFSA 2012-16 Escalation of privilege with Javascript: URL as home page

-

MFSA 2012-17 Crash when accessing keyframe cssText after dynamic modification

-

MFSA 2012-18 window.fullScreen writeable by untrusted content

-

MFSA 2012-19 Miscellaneous memory safety hazards (rv:11.0/ rv:10.0.3 / rv:1.9.2.28)

-
- - - - CVE-2012-0451 - CVE-2012-0455 - CVE-2012-0456 - CVE-2012-0457 - CVE-2012-0458 - CVE-2012-0459 - CVE-2012-0460 - CVE-2012-0461 - CVE-2012-0462 - CVE-2012-0463 - CVE-2012-0464 - http://www.mozilla.org/security/announce/2012/mfsa2012-13.html - http://www.mozilla.org/security/announce/2012/mfsa2012-14.html - http://www.mozilla.org/security/announce/2012/mfsa2012-15.html - http://www.mozilla.org/security/announce/2012/mfsa2012-16.html - http://www.mozilla.org/security/announce/2012/mfsa2012-17.html - http://www.mozilla.org/security/announce/2012/mfsa2012-18.html - http://www.mozilla.org/security/announce/2012/mfsa2012-19.html - - - 2012-03-13 - 2012-03-14 - 2012-03-18 - - - - - portaudit -- auditfile remote code execution - - - portaudit - 0.6.0 - - - - -

Michael Gmelin and Jörg Scheinert has reported a remote - command execution vulnerability in portaudit.

-

An attacker who can get the user to use a specially crafted - audit file will be able to run commands on the users system, - with the privileges of the user running running portaudit - (often root).

-

The attack could e.g. happen through DNS hijacking or a man - in the middle attack.

-

Note that if the user has set up portaudit to run from - periodic this attack could happen without direct user - interaction.

-

In the FreeBSD Ports Collection (bsd.port.mk) the check for - vulnerable ports at install-time directly operates on the - auditfile and has the same vulnerability as portaudit. As - the Ports Collection infrastructure does not have a version - number just be sure to have a Ports Collection new enough to - contain the fix for portaudit. Note that this is only - a problem for users which has portaudit installed, as they will - not have the audit database installed or downloaded - otherwise.

- - - - http://cvsweb.FreeBSD.org/ports/ports-mgmt/portaudit/Makefile#rev1.30 - http://cvsweb.FreeBSD.org/ports/Mk/bsd.port.mk#rev1.707 - - - 2012-03-11 - 2012-03-11 - - - - - linux-flashplugin -- multiple vulnerabilities - - - linux-f10-flashplugin - 11.1r102.63 - - - - -
-

These vulnerabilities could cause a crash and potentially allow - an attacker to take control of the affected system.

-
- - - - CVE-2012-0768 - CVE-2012-0769 - https://www.adobe.com/support/security/bulletins/apsb12-05.html - - - 2012-03-05 - 2012-03-09 - - - - - jenkins -- XSS vulnerability - - - jenkins - 1.453 - - - - -

Jenkins Security Advisory reports:

-
-

An XSS vulnerability was found in Jenkins core, which allows an - attacker to inject malicious HTMLs to pages served by Jenkins. - This allows an attacker to escalate his privileges by hijacking - sessions of other users. This vulnerability affects all - versions.

-
- - - - https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2012-03-05 - - - 2012-03-05 - 2012-03-07 - - - - - dropbear -- arbitrary code execution - - - dropbear - 0.512012.55 - - - - -

The Dropbear project reports:

-
-

Dropbear SSH Server could allow a remote authenticated attacker - to execute arbitrary code on the system, caused by a use-after- - free error. If a command restriction is enforced, an attacker - could exploit this vulnerability to execute arbitrary code on - the system with root privileges.

-
- - - - 52159 - CVE-2012-0920 - http://secunia.com/advisories/48147 - http://xforce.iss.net/xforce/xfdb/73444 - - - 2012-02-22 - 2012-03-04 - - - - - openx -- undisclosed security issue - - - openx - 2.8.9 - - - - -

OpenX does not provide information about vulnerabilities beyond their - existence.

- - - - http://blog.openx.org/12/security-matters-3 - - - 2011-12-01 - 2012-03-02 - 2012-07-08 - - - - - databases/postgresql*-client -- multiple vulnerabilities - - - postgresql-client - 8.3.18 - 8.48.4.11 - 99.0.7 - 9.19.1.3 - - - - -

The PostgreSQL Global Development Group reports:

-
-

These vulnerabilities could allow users to define triggers that - execute functions on which the user does not have EXECUTE - permission, allow SSL certificate spoofing and allow line breaks - in object names to be exploited to execute code when loading a - pg_dump file.

-
- - - - CVE-2012-0866 - CVE-2012-0867 - CVE-2012-0868 - http://www.postgresql.org/about/news/1377/ - - - 2012-02-27 - 2012-02-28 - - - - - linux-flashplugin -- multiple vulnerabilities - - - linux-f10-flashplugin - 11.1r102.62 - - - - -
-

These vulnerabilities could cause a crash and potentially allow - an attacker to take control of the affected system.

-
- - - - CVE-2012-0751 - CVE-2012-0752 - CVE-2012-0753 - CVE-2012-0754 - CVE-2012-0755 - CVE-2012-0756 - CVE-2012-0767 - https://www.adobe.com/support/security/bulletins/apsb12-03.html - - - 2012-02-15 - 2012-02-27 - - - - - libxml2 -- heap buffer overflow - - - libxml2 - linux-f10-libxml2 - 2.7.8_2 - - - - -

Google chrome team reports:

-
-

Heap-based buffer overflow in libxml2, allows remote attackers - to cause a denial of service or possibly have unspecified other - impact via unknown vectors.

-
- - - - CVE-2011-3919 - http://googlechromereleases.blogspot.com/2012/01/stable-channel-update.html - - - 2012-01-05 - 2012-02-27 - - - - - plib -- remote code execution via buffer overflow - - - torcs - 1.3.3 - - - plib - 1.8.5_3 - - - - -

Secunia reports:

-
-

A vulnerability has been discovered in PLIB, which can be - exploited by malicious people to compromise an application using - the library.

-

The vulnerability is caused due to a boundary error within the - "ulSetError()" function (src/util/ulError.cxx) when creating the - error message, which can be exploited to overflow a static - buffer.

-

Successful exploitation allows the execution of arbitrary code - but requires that the attacker can e.g. control the content of - an overly long error message passed to the "ulSetError()" - function.

-

The vulnerability is confirmed in version 1.8.5. Other versions - may also be affected.

-
- - - - CVE-2011-4620 - http://secunia.com/advisories/47297/ - http://torcs.sourceforge.net/index.php?name=News&file=article&sid=79 - - - 2011-12-21 - 2012-02-19 - - - - - phpMyAdmin -- XSS in replication setup - - - phpMyAdmin - 3.43.4.10.1 - - - - -

The phpMyAdmin development team reports:

-
-

It was possible to conduct XSS using a crafted database name.

-
- - - - CVE-2012-1190 - http://www.phpmyadmin.net/home_page/security/PMASA-2012-1.php - - - 2012-02-18 - 2012-02-18 - - - - - piwik -- xss and click-jacking issues - - - piwik - 1.7 - - - - -

The Piwik Team reports:

-
-

We would like to thank the following security researchers for - their responsible disclosure of XSS and click-jacking issues: - Piotr Duszynski, Sergey Markov, Mauro Gentile.

-
- - - - "http://piwik.org/blog/2012/02/7775/" - - - 2012-02-16 - 2012-02-16 - - - - - mozilla -- heap-buffer overflow - - - firefox - 10.0,110.0.2,1 - 3.6.*,13.6.27 - - - linux-firefox - 10.0,110.0.2,1 - - - linux-seamonkey - 2.72.7.2 - - - linux-thunderbird - 10.010.0.2 - - - seamonkey - 2.72.7.2 - - - thunderbird - 10.010.0.2 - 3.1.*3.1.19 - - - - -

The Mozilla Project reports:

-
-

MFSA 2012-11 libpng integer overflow

-
- - - - CVE-2011-3026 - https://www.mozilla.org/security/announce/2012/mfsa2012-11.html - - - 2012-02-16 - 2012-02-17 - 2012-03-18 - - - - - Python -- DoS via malformed XML-RPC / HTTP POST request - - - python32 - 3.2.2_2 - - - python31 - 3.1.4_2 - - - python27 - 2.7.2_3 - - - python26 - 2.6.7_2 - - - python25 - 2.5.6_2 - - - python24 - 2.4.5_8 - - - pypy - - 1.7 - - - - -

Jan Lieskovsky reports,

-
-

A denial of service flaw was found in the way Simple XML-RPC - Server module of Python processed client connections, that were - closed prior the complete request body has been received. A - remote attacker could use this flaw to cause Python Simple - XML-RPC based server process to consume excessive amount of - CPU.

-
- - - - CVE-2012-0845 - http://bugs.python.org/issue14001 - https://bugzilla.redhat.com/show_bug.cgi?id=789790 - https://bugs.pypy.org/issue1047 - - - 2012-02-13 - 2012-02-14 - 2012-02-26 - - - - - WebCalendar -- Persistent XSS - - - WebCalendar - 1.2.4 - - - WebCalendar-devel - 1.2.4 - - - - -

tom reports,

-
-

There is no sanitation on the input of the location variable - allowing for persistent XSS.

-
- - - - CVE-2012-0846 - http://sourceforge.net/tracker/?func=detail&aid=3472745&group_id=3870&atid=103870 - - - 2012-01-11 - 2012-02-12 - 2012-02-13 - - - - - mozilla -- use-after-free in nsXBLDocumentInfo::ReadPrototypeBindings - - - firefox - 10.0,110.0.1,1 - - - linux-firefox - 10.0,110.0.1,1 - - - linux-seamonkey - 2.72.7.1 - - - linux-thunderbird - 10.010.0.1 - - - seamonkey - 2.72.7.1 - - - thunderbird - 10.010.0.1 - - - - -

The Mozilla Project reports:

-
-

MFSA 2012-10 use after free in nsXBLDocumentInfo::ReadPrototypeBindings

-
- - - - CVE-2012-0452 - https://www.mozilla.org/security/announce/2012/mfsa2012-10.html - - - 2012-02-10 - 2012-02-11 - - - - - bip -- buffer overflow - - - bip - 0.8.8 - - - - -

Julien Tinnes reports,

-
-

Bip doesn't check if fd is equal or larger than FD_SETSIZE.

-
- - - - CVE-2012-0806 - https://projects.duckcorp.org/projects/bip/repository/revisions/222a33cb84a2e52ad55a88900b7895bf9dd0262c - https://projects.duckcorp.org/issues/269 - - - 2012-01-07 - 2012-02-11 - - - - - surf -- private information disclosure - - - surf - 0.4.1 - - - - -

surf does not protect its cookie jar against access read access from - other local users

- - - - CVE-2012-0842 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=659296 - - - 2012-02-10 - 2012-02-11 - - - - - glpi -- remote attack via crafted POST request - - - glpi - 0.80.2 - - - - -

The GLPI project reports:

-
-

The autocompletion functionality in GLPI before 0.80.2 does not - blacklist certain username and password fields, which allows - remote attackers to obtain sensitive information via a crafted - POST request.

-
- - - - http://www.glpi-project.org/spip.php?page=annonce&id_breve=237&lang=en - https://forge.indepnet.net/issues/3017 - CVE-2011-2720 - - - 2011-07-20 - 2012-02-10 - 2013-06-19 - - - - - drupal -- multiple vulnerabilities - - - drupal6 - 6.23 - - - drupal7 - 7.11 - - - - -

Drupal development team reports:

-
-

Cross Site Request Forgery vulnerability in Aggregator - module

-

CVE: CVE-2012-0826

-

An XSRF vulnerability can force an aggregator feed to update. - Since some services are rate-limited (e.g. Twitter limits - requests to 150 per hour) this could lead to a denial of - service.

-

This issue affects Drupal 6.x and 7.x.

-

OpenID not verifying signed attributes in SREG and AX

-

CVE: CVE-2012-0825

-

A group of security researchers identified a flaw in how some - OpenID relying parties implement Attribute Exchange (AX). Not - verifying that attributes being passed through AX have been - signed could allow an attacker to modify users' information.

-

This issue affects Drupal 6.x and 7.x.

-

Access bypass in File module

-

CVE: CVE-2012-0827

-

When using private files in combination with certain field - access modules, the File module will allow users to download - the file even if they do not have access to view the field it - was attached to.

-

This issue affects Drupal 7.x only.

-
- - - - CVE-2012-0825 - CVE-2012-0826 - CVE-2012-0827 - - - 2012-02-01 - 2012-02-07 - - - - - bugzilla -- multiple vulnerabilities - - - bugzilla - 2.4.*3.6.8 - 4.0.*4.0.4 - - - - -

A Bugzilla Security Advisory reports:

-
-

The following security issues have been discovered in - Bugzilla:

-
    -
  • Account Impersonation: - When a user creates a new account, Bugzilla doesn't correctly - reject email addresses containing non-ASCII characters, which - could be used to impersonate another user account. Such email - addresses could look visually identical to other valid email - addresses, and an attacker could try to confuse other users - and be added to bugs he shouldn't have access to.
    • -
  • Cross-Site Request Forgery: - Due to a lack of validation of the Content-Type head when - making POST requests to jsonrpc.cgi, a possible CSRF - vulnerability was discovered. If a user visits an HTML page - with some malicious JS code in it, an attacker could make - changes to a remote Bugzilla installation on behalf of the - victim's account by using the JSON-RPC API. The user would - have had to be already logged in to the target site for the - vulnerability to work.
    • -
-

All affected installations are encouraged to upgrade as soon as - possible.

-
- - - - CVE-2012-0448 - CVE-2012-0440 - https://bugzilla.mozilla.org/show_bug.cgi?id=714472 - https://bugzilla.mozilla.org/show_bug.cgi?id=718319 - - - 2012-01-31 - 2012-02-06 - - - - - php -- arbitrary remote code execution vulnerability - - - php5 - 5.3.95.3.10 - - - - -

Secunia reports:

-
-

A vulnerability has been reported in PHP, which can be exploited - by malicious people to compromise a vulnerable system.

-

The vulnerability is caused due to a logic error within the - "php_register_variable_ex()" function (php_variables.c) when - hashing form posts and updating a hash table, which can be - exploited to execute arbitrary code.

-
- - - - CVE-2012-0830 - http://www.php.net/archive/2012.php#id2012-02-02-1 - http://secunia.com/advisories/47806/ - - - 2012-02-02 - 2012-02-04 - 2012-02-06 - - - - - mathopd -- directory traversal vulnerability - - - mathopd - 1.5p7 - - - - -

Michiel Boland reports:

-
-

The software has a vulnerability that could lead to directory - traversal if the '*' construct for mass virtual hosting is - used.

-
- - - - http://www.mail-archive.com/mathopd%40mathopd.org/msg00392.html - http://www.mathopd.org/security.html - - - 2012-02-02 - 2012-02-03 - - - - - apache -- multiple vulnerabilities - - - apache - 2.*2.2.22 - - - - -

CVE MITRE reports:

-
-

An exposure was found when using mod_proxy in reverse proxy - mode. In certain configurations using RewriteRule with proxy - flag or ProxyPassMatch, a remote attacker could cause the reverse - proxy to connect to an arbitrary server, possibly disclosing - sensitive information from internal web servers not directly - accessible to attacker.

-

Integer overflow in the ap_pregsub function in server/util.c in - the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through - 2.2.21, when the mod_setenvif module is enabled, allows local - users to gain privileges via a .htaccess file with a crafted - SetEnvIf directive, in conjunction with a crafted HTTP request - header, leading to a heap-based buffer overflow.

-

An additional exposure was found when using mod_proxy in - reverse proxy mode. In certain configurations using RewriteRule - with proxy flag or ProxyPassMatch, a remote attacker could cause - the reverse proxy to connect to an arbitrary server, possibly - disclosing sensitive information from internal web servers - not directly accessible to attacker.

-

A flaw was found in mod_log_config. If the '%{cookiename}C' log - format string is in use, a remote attacker could send a specific - cookie causing a crash. This crash would only be a denial of - service if using a threaded MPM.

-

A flaw was found in the handling of the scoreboard. An - unprivileged child process could cause the parent process to - crash at shutdown rather than terminate cleanly.

-

A flaw was found in the default error response for status code - 400. This flaw could be used by an attacker to expose - "httpOnly" cookies when no custom ErrorDocument is specified.

-
- - - - CVE-2011-3368 - CVE-2011-3607 - CVE-2011-4317 - CVE-2012-0021 - CVE-2012-0031 - CVE-2012-0053 - - - 2011-10-05 - 2012-01-31 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 4.0,110.0,1 - 3.6.*,13.6.26 - - - linux-firefox - 10.0,1 - - - linux-seamonkey - 2.7 - - - linux-thunderbird - 10.0 - - - seamonkey - 2.7 - - - thunderbird - 4.010.0 - 3.1.*3.1.18 - - - - -

The Mozilla Project reports:

-
-

MFSA 2012-01 Miscellaneous memory safety hazards (rv:10.0/ - rv:1.9.2.26)

-

MFSA 2012-02 Overly permissive IPv6 literal syntax

-

MFSA 2012-03 iframe element exposed across domains via name - attribute

-

MFSA 2012-04 Child nodes from nsDOMAttribute still accessible - after removal of nodes

-

MFSA 2012-05 Frame scripts calling into untrusted objects bypass - security checks

-

MFSA 2012-06 Uninitialized memory appended when encoding icon - images may cause information disclosure

-

MFSA 2012-07 Potential Memory Corruption When Decoding Ogg Vorbis - files

-

MFSA 2012-08 Crash with malformed embedded XSLT stylesheets

-

MFSA 2012-09 Firefox Recovery Key.html is saved with unsafe - permission

-
- - - - CVE-2012-0442 - CVE-2012-0443 - CVE-2011-3670 - CVE-2012-0445 - CVE-2011-3659 - CVE-2012-0446 - CVE-2012-0447 - CVE-2012-0449 - CVE-2012-0450 - http://www.mozilla.org/security/announce/2012/mfsa2012-01.html - http://www.mozilla.org/security/announce/2012/mfsa2012-02.html - http://www.mozilla.org/security/announce/2012/mfsa2012-03.html - http://www.mozilla.org/security/announce/2012/mfsa2012-04.html - http://www.mozilla.org/security/announce/2012/mfsa2012-05.html - http://www.mozilla.org/security/announce/2012/mfsa2012-06.html - http://www.mozilla.org/security/announce/2012/mfsa2012-07.html - http://www.mozilla.org/security/announce/2012/mfsa2012-08.html - http://www.mozilla.org/security/announce/2012/mfsa2012-09.html - - - 2012-01-31 - 2012-02-01 - 2012-03-18 - - - - - sudo -- format string vulnerability - - - sudo - 1.8.01.8.3_2 - - - - -

Todd Miller reports:

-
-

Sudo 1.8.0 introduced simple debugging support that was primarily - intended for use when developing policy or I/O logging plugins. - The sudo_debug() function contains a flaw where the program name - is used as part of the format string passed to the fprintf() - function. The program name can be controlled by the caller, - either via a symbolic link or, on some systems, by setting argv[0] - when executing sudo.

-

Using standard format string vulnerability exploitation - techniques it is possible to leverage this bug to achieve root - privileges.

-

Exploitation of the bug does not require that the attacker be - listed in the sudoers file. As such, we strongly suggest that - affected sites upgrade from affected sudo versions as soon as - possible.

-
- - - - CVE-2012-0809 - http://www.gratisoft.us/sudo/alerts/sudo_debug.html - - - 2012-01-30 - 2012-01-30 - 2012-01-31 - - - - - FreeBSD -- pam_ssh() does not validate service names - - - FreeBSD - 7.37.3_9 - 7.47.4_5 - 8.18.1_7 - 8.28.2_5 - - - - -
-

Problem Description:

-

Some third-party applications, including KDE's kcheckpass command, - allow the user to specify the name of the policy on the command - line. Since OpenPAM treats the policy name as a path relative to - /etc/pam.d or /usr/local/etc/pam.d, users who are permitted to run - such an application can craft their own policies and cause the - application to load and execute their own modules.

-
- - - - SA-11:10.pam - CVE-2011-4122 - - - 2011-12-23 - 2012-01-29 - - - - - FreeBSD -- pam_ssh improperly grants access when user account has unencrypted SSH private keys - - - FreeBSD - 7.37.3_9 - 7.47.4_5 - 8.18.1_7 - 8.28.2_5 - - - - -
-

Problem Description:

-

The OpenSSL library call used to decrypt private keys ignores the - passphrase argument if the key is not encrypted. Because the - pam_ssh module only checks whether the passphrase provided by the - user is null, users with unencrypted SSH private keys may - successfully authenticate themselves by providing a dummy - passphrase.

-
- - - - SA-11:09.pam_ssh - - - 2011-12-23 - 2012-01-29 - 2013-06-18 - - - - - FreeBSD -- Buffer overflow in handling of UNIX socket addresses - - - FreeBSD - 7.37.3_8 - 7.47.4_4 - 8.18.1_6 - 8.28.2_4 - - - - -
-

Problem Description:

-

When a UNIX-domain socket is attached to a location using the - bind(2) system call, the length of the provided path is not - validated. Later, when this address was returned via other system - calls, it is copied into a fixed-length buffer.

-

Linux uses a larger socket address structure for UNIX-domain - sockets than FreeBSD, and the FreeBSD's linux emulation code did - not translate UNIX-domain socket addresses into the correct size - of structure.

-
- - - - SA-11:05.unix - - - 2011-09-28 - 2012-01-29 - - - - - FreeBSD -- errors handling corrupt compress file in compress(1) and gzip(1) - - - FreeBSD - 7.37.3_7 - 7.47.4_3 - 8.18.1_5 - 8.28.2_3 - - - - -
-

Problem Description:

-

The code used to decompress a file created by compress(1) does not - do sufficient boundary checks on compressed code words, allowing - reference beyond the decompression table, which may result in a - stack overflow or an infinite loop when the decompressor encounters - a corrupted file.

-
- - - - SA-11:04.compress - CVE-2011-2895 - - - 2011-09-28 - 2012-01-29 - - - - - FreeBSD -- Network ACL mishandling in mountd(8) - - - FreeBSD - 7.37.3_5 - 7.47.4_1 - 8.18.1_3 - 8.28.2_1 - - - - -
-

Problem Description:

-

While parsing the exports(5) table, a network mask in the form of - "-network=netname/prefixlength" results in an incorrect network mask - being computed if the prefix length is not a multiple of 8.

-

For example, specifying the ACL for an export as "-network - 192.0.2.0/23" would result in a netmask of 255.255.127.0 being used - instead of the correct netmask of 255.255.254.0.

-
- - - - SA-11:01.mountd - CVE-2011-1739 - - - 2011-04-20 - 2012-01-29 - - - - - postfixadmin -- Multiple Vulnerabilities - - - postfixadmin - 2.3.5 - - - - -

The Postfix Admin Team reports:

-
-

Multiple XSS vulnerabilities exist:
- - XSS with $_GET[domain] in templates/menu.php and - edit-vacation
- - XSS in some create-domain input fields
- - XSS in create-alias and edit-alias error message
- - XSS (by values stored in the database) in fetchmail list - view, list-domain and list-virtual

-

Multiple SQL injection issues exist:
- - SQL injection in pacrypt() (if $CONF[encrypt] == - 'mysql_encrypt')
- - SQL injection in backup.php - the dump was not mysql_escape()d, - therefore users could inject SQL (for example in the vacation message) - which will be executed when restoring the database dump. - WARNING: database dumps created with backup.php from 2.3.4 or older - might contain malicious SQL. Double-check before using them!

-
- - - - CVE-2012-0811 - CVE-2012-0812 - http://sourceforge.net/projects/postfixadmin/forums/forum/676076/topic/4977778 - - - 2012-01-27 - 2012-01-27 - - - - - mpack -- Information disclosure - - - mpack - 1.6_3 - - - - -

The oss-security list reports:

-
-

Incorrect permissions on temporary files can lead to - information disclosure.

-
- - - - CVE-2011-4919 - http://openwall.com/lists/oss-security/2011/12/31/1 - - - 2011-12-31 - 2012-01-26 - - - - - acroread9 -- Multiple Vulnerabilities - - - acroread9 - 9.4.7 - - - - -

The Adobe Security Team reports:

-
-

An unspecified vulnerability in the U3D component allows - remote attackers to execute arbitrary code (or cause a denial - of service attack) via unknown vectors.

-
-
-

A heap-based buffer overflow allows attackers to execute - arbitrary code via unspecified vectors.

-
- - - - CVE-2011-2462 - CVE-2011-1353 - CVE-2011-2431 - CVE-2011-2432 - CVE-2011-2433 - CVE-2011-2434 - CVE-2011-2435 - CVE-2011-2436 - CVE-2011-2437 - CVE-2011-2438 - CVE-2011-2439 - CVE-2011-2440 - CVE-2011-2441 - CVE-2011-2442 - http://www.adobe.com/support/security/bulletins/apsb11-24.html - http://www.adobe.com/support/security/advisories/apsa11-04.html - - - 2011-12-07 - 2012-01-26 - - - - - Wireshark -- Multiple vulnerabilities - - - wireshark - 1.41.4.11 - 1.6.01.6.5 - - - wireshark-lite - 1.41.4.11 - 1.6.01.6.5 - - - tshark - 1.41.4.11 - 1.6.01.6.5 - - - tshark-lite - 1.41.4.11 - 1.6.01.6.5 - - - - -

Wireshark reports:

-
-

Laurent Butti discovered that Wireshark failed to properly check - record sizes for many packet capture file formats

-

Wireshark could dereference a NULL pointer and crash.

-

The RLC dissector could overflow a buffer.

-
- - - - CVE-2012-0041 - CVE-2012-0066 - CVE-2012-0067 - CVE-2012-0068 - http://www.wireshark.org/security/wnpa-sec-2012-01.html - http://www.wireshark.org/security/wnpa-sec-2012-02.html - http://www.wireshark.org/security/wnpa-sec-2012-03.html - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6663 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6666 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6667 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6668 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6669 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6670 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6634 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6391 - - - 2010-01-10 - 2012-01-23 - - - - - spamdyke -- Buffer Overflow Vulnerabilities - - - spamdyke - 4.3.0 - - - - -

Secunia reports:

-
-

Fixed a number of very serious errors in the usage of - snprintf()/vsnprintf().

-

The return value was being used as the length of the string - printed into the buffer, but the return value really indicates - the length of the string that *could* be printed if the buffer - were of infinite size. Because the returned value could be - larger than the buffer's size, this meant remotely exploitable - buffer overflows were possible, depending on spamdyke's - configuration.

-
- - - - CVE-2012-0802 - https://secunia.com/advisories/47548/ - http://www.spamdyke.org/documentation/Changelog.txt - - - 2012-01-15 - 2012-01-23 - - - - - OpenSSL -- DTLS Denial of Service - - - openssl - 1.0.0_9 - - - - -

The OpenSSL Team reports:

-
-

A flaw in the fix to CVE-2011-4108 can be exploited in a - denial of service attack. Only DTLS applications using OpenSSL - 1.0.0f and 0.9.8s are affected.

-
- - - - CVE-2012-0050 - http://www.openssl.org/news/secadv_20120118.txt - - - 2012-01-18 - 2012-01-20 - - - - - asterisk -- SRTP Video Remote Crash Vulnerability - - - asterisk18 - 1.8.8.2 - - - asterisk10 - 10.0.1 - - - - -

Asterisk project reports:

-
-

An attacker attempting to negotiate a secure video stream can - crash Asterisk if video support has not been enabled and the - res_srtp Asterisk module is loaded.

-
- - - - http://downloads.asterisk.org/pub/security/AST-2012-001.html - - - 2012-01-15 - 2012-01-20 - 2013-06-19 - - - - - tomcat -- Denial of Service - - - tomcat - 5.5.05.5.35 - - - tomcat - 6.0.06.0.34 - - - tomcat - 7.0.07.0.23 - - - - -

The Tomcat security team reports:

-
-

Analysis of the recent hash collision vulnerability identified - unrelated inefficiencies with Apache Tomcat's handling of large - numbers of parameters and parameter values. These inefficiencies - could allow an attacker, via a specially crafted request, to - cause large amounts of CPU to be used which in turn could create - a denial of service. The issue was addressed by modifying the - Tomcat parameter handling code to efficiently process large - numbers of parameters and parameter values.

-
- - - - CVE-2012-0022 - http://tomcat.apache.org/security-5.html#Fixed_in_Apache_Tomcat_5.5.35 - http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.34 - http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.23 - - - 2011-10-21 - 2012-01-17 - - - - - OpenTTD -- Denial of service (server) via slow read attack - - - openttd - 0.3.51.1.5 - - - - -

The OpenTTD Team reports:

-
-

Using a slow read type attack it is possible to prevent anyone - from joining a server with virtually no resources. Once - downloading the map no other downloads of the map can start, so - downloading really slowly will prevent others from joining. - This can be further aggravated by the pause-on-join setting in - which case the game is paused and the players cannot continue - the game during such an attack. This attack requires that the - user is not banned and passes the authorization to the server, - although for many servers there is no server password and thus - authorization is easy.

-
- - - - CVE-2012-0049 - http://security.openttd.org/en/CVE-2012-0049 - - - 2012-01-06 - 2012-01-16 - - - - - Multiple implementations -- DoS via hash algorithm collision - - - jruby - 1.6.5.1 - - - ruby - ruby+nopthreads - ruby+nopthreads+oniguruma - ruby+oniguruma - 1.8.7.357,1 - - - rubygem-rack - 1.3.6,3 - - - v8 - 3.8.5 - - - redis - 2.4.6 - - - node - 0.6.7 - - - - -

oCERT reports:

-
-

A variety of programming languages suffer from a denial-of-service - (DoS) condition against storage functions of key/value pairs in - hash data structures, the condition can be leveraged by exploiting - predictable collisions in the underlying hashing algorithms.

-

The issue finds particular exposure in web server applications - and/or frameworks. In particular, the lack of sufficient limits - for the number of parameters in POST requests in conjunction with - the predictable collision properties in the hashing functions of - the underlying languages can render web applications vulnerable - to the DoS condition. The attacker, using specially crafted HTTP - requests, can lead to a 100% of CPU usage which can last up to - several hours depending on the targeted application and server - performance, the amplification effect is considerable and - requires little bandwidth and time on the attacker side.

-

The condition for predictable collisions in the hashing functions - has been reported for the following language implementations: - Java, JRuby, PHP, Python, Rubinius, Ruby. In the case of the - Ruby language, the 1.9.x branch is not affected by the - predictable collision condition since this version includes a - randomization of the hashing function.

-

The vulnerability outlined in this advisory is practically - identical to the one reported in 2003 and described in the paper - Denial of Service via Algorithmic Complexity Attacks which - affected the Perl language.

-
- - - - CVE-2011-4838 - CVE-2011-4815 - CVE-2011-5036 - CVE-2011-5037 - http://www.ocert.org/advisories/ocert-2011-003.html - http://www.nruns.com/_downloads/advisory28122011.pdf - - - 2011-12-28 - 2012-01-16 - 2012-01-20 - - - - - ffmpeg -- multiple vulnerabilities - - - ffmpeg - 0.7.11,1 - - - - -

Ubuntu Security Notice USN-1320-1 reports:

-
-

Phillip Langlois discovered that FFmpeg incorrectly handled - certain malformed QDM2 streams. If a user were tricked into opening - a crafted QDM2 stream file, an attacker could cause a denial of - service via application crash, or possibly execute arbitrary code - with the privileges of the user invoking the program. - (CVE-2011-4351)

-

Phillip Langlois discovered that FFmpeg incorrectly handled - certain malformed VP3 streams. If a user were tricked into opening - a crafted file, an attacker could cause a denial of service via - application crash, or possibly execute arbitrary code with the - privileges of the user invoking the program. (CVE-2011-4352)

-

Phillip Langlois discovered that FFmpeg incorrectly handled - certain malformed VP5 and VP6 streams. If a user were tricked into - opening a crafted file, an attacker could cause a denial of service - via application crash, or possibly execute arbitrary code with the - privileges of the user invoking the program. (CVE-2011-4353)

-

It was discovered that FFmpeg incorrectly handled certain - malformed VMD files. If a user were tricked into opening a crafted - VMD file, an attacker could cause a denial of service via - application crash, or possibly execute arbitrary code with the - privileges of the user invoking the program. (CVE-2011-4364)

-

Phillip Langlois discovered that FFmpeg incorrectly handled - certain malformed SVQ1 streams. If a user were tricked into opening - a crafted SVQ1 stream file, an attacker could cause a denial of - service via application crash, or possibly execute arbitrary code - with the privileges of the user invoking the program. - (CVE-2011-4579)

-
- - - - CVE-2011-4351 - CVE-2011-4352 - CVE-2011-4353 - CVE-2011-4364 - CVE-2011-4579 - http://www.ubuntu.com/usn/usn-1320-1 - - - 2011-09-14 - 2012-01-14 - - - - - OpenSSL -- multiple vulnerabilities - - - openssl - 1.0.0_8 - - - - -

The OpenSSL Team reports:

-
-

6 security flaws have been fixed in OpenSSL 1.0.0f:

-

If X509_V_FLAG_POLICY_CHECK is set in OpenSSL 0.9.8, - then a policy check failure can lead to a double-free.

-

OpenSSL prior to 1.0.0f and 0.9.8s failed to clear the - bytes used as block cipher padding in SSL 3.0 records. - As a result, in each record, up to 15 bytes of - uninitialized memory may be sent, encrypted, to the SSL - peer. This could include sensitive contents of - previously freed memory.

-

RFC 3779 data can be included in certificates, and if - it is malformed, may trigger an assertion failure. - This could be used in a denial-of-service attack.

-

Support for handshake restarts for server gated - cryptograpy (SGC) can be used in a denial-of-service - attack.

-

A malicious TLS client can send an invalid set of GOST - parameters which will cause the server to crash due to - lack of error checking. This could be used in a - denial-of-service attack.

-
- - - - CVE-2011-4108 - CVE-2011-4109 - CVE-2011-4576 - CVE-2011-4577 - CVE-2011-4619 - CVE-2012-0027 - http://openssl.org/news/secadv_20120104.txt - - - 2012-01-04 - 2012-01-14 - - - - - isc-dhcp-server -- DoS in DHCPv6 - - - isc-dhcp42-server - 4.2.3_2 - - - - -

ISC reports:

-
-

Due to improper handling of a DHCPv6 lease structure, ISC DHCP - servers that are serving IPv6 address pools AND using Dynamic - DNS can encounter a segmentation fault error while updating lease - status under certain conditions.

-

The potential exists for this condition to be intentionally - triggered, resulting in effective denial of service to - clients expecting service from the affected server.

-
- - - - CVE-2011-4868 - https://www.isc.org/software/dhcp/advisories/cve-2011-4868 - - - 2012-01-13 - 2012-01-13 - - - - - PowerDNS -- Denial of Service Vulnerability - - - powerdns - powerdns-devel - 3.0.1 - - - - -

The PowerDNS Team reports:

-
-

Using well crafted UDP packets, one or more PowerDNS servers - could be made to enter a tight packet loop, causing temporary - denial of service.

-
- - - - CVE-2012-0206 - - - 2012-01-10 - 2012-01-12 - - - - - php -- multiple vulnerabilities - - - php5 - php5-exif - 5.3.9 - - - php52 - 5.2.17_5 - - - php52-exif - 5.2.17_6 - - - - -

php development team reports:

-
-

Security Enhancements and Fixes in PHP 5.3.9:

-
    -
  • Added max_input_vars directive to prevent attacks - based on hash collisions. (CVE-2011-4885)
    • -
  • Fixed bug #60150 (Integer overflow during the parsing - of invalid exif header). (CVE-2011-4566)
    • -
-
- - - - CVE-2011-4566 - CVE-2011-4885 - http://www.nruns.com/_downloads/advisory28122011.pdf - - - 2011-12-29 - 2012-01-11 - 2012-01-19 - - - - - torcs -- untrusted local library loading - - - torcs - 1.3.2 - - - - -

TORCS News reports:

-
-

An insecure change to LD_LIBRARY_PATH allows loading of libraries - in directories other than the standard paths. This can be a - problem when downloading and installing untrusted content from the - Internet.

-
- - - - CVE-2010-3384 - http://torcs.sourceforge.net/index.php?name=News&file=article&sid=77 - http://sourceforge.net/tracker/index.php?func=detail&aid=3089384&group_id=3777&atid=103777 - - - 2010-10-20 - 2012-01-09 - - - - - spamdyke -- STARTTLS Plaintext Injection Vulnerability - - - spamdyke - 4.2.1 - - - - -

Secunia reports:

-
-

The vulnerability is caused due to the TLS implementation not - properly clearing transport layer buffers when upgrading from - plaintext to ciphertext after receiving the "STARTTLS" command. - This can be exploited to insert arbitrary plaintext data (e.g. - SMTP commands) during the plaintext phase, which will then be - executed after upgrading to the TLS ciphertext phase.

-
- - - - CVE-2012-0070 - http://secunia.com/advisories/47435/ - http://www.spamdyke.org/documentation/Changelog.txt - - - 2012-01-04 - 2012-01-08 - 2012-01-23 - - - - - bugzilla -- multiple vulnerabilities - - - bugzilla - 2.4.*3.6.7 - 4.0.*4.0.3 - - - - -

A Bugzilla Security Advisory reports:

-
-

The following security issues have been discovered in Bugzilla:

-
    -
  • Tabular and graphical reports, as well as new charts have - a debug mode which displays raw data as plain text. This - text is not correctly escaped and a crafted URL could use - this vulnerability to inject code leading to XSS.
    • -
  • The User.offer_account_by_email WebService method ignores - the user_can_create_account setting of the authentication - method and generates an email with a token in it which the - user can use to create an account. Depending on the - authentication method being active, this could allow the - user to log in using this account. - Installations where the createemailregexp parameter is - empty are not vulnerable to this issue.
    • -
  • The creation of bug reports and of attachments is not - protected by a token and so they can be created without the - consent of a user if the relevant code is embedded in an - HTML page and the user visits this page. This behavior was - intentional to let third-party applications submit new bug - reports and attachments easily. But as this behavior can be - abused by a malicious user, it has been decided to block - submissions with no valid token starting from version 4.2rc1. - Older branches are not patched to not break these third-party - applications after the upgrade.
    • -
-

All affected installations are encouraged to upgrade as soon - as possible.

-
- - - - CVE-2011-3657 - CVE-2011-3667 - CVE-2011-3668 - CVE-2011-3669 - https://bugzilla.mozilla.org/show_bug.cgi?id=697699 - https://bugzilla.mozilla.org/show_bug.cgi?id=711714 - https://bugzilla.mozilla.org/show_bug.cgi?id=703975 - https://bugzilla.mozilla.org/show_bug.cgi?id=703983 - - - 2011-11-28 - 2012-01-05 - - - - - WordPress -- cross site scripting vulnerability - - - wordpress - 3.3.1,1 - - - de-wordpress - zh-wordpress-zh_CN - zh-wordpress-zh_TW - 3.3.1 - - - - -

WordPress development team reports:

-
-

WordPress 3.3.1 is now available. This maintenance release - fixes 15 issues with WordPress 3.3, as well as a fix for a - cross-site scripting vulnerability that affected version 3.3. - Thanks to Joshua H., Hoang T., Stefan Zimmerman, Chris K., and - the Go Daddy security team for responsibly disclosing the bug - to our security team.

-
- - - - http://threatpost.com/en_us/blogs/xss-bug-found-wordpress-33-010312 - - - 2012-01-03 - 2012-01-03 - - - - - zabbix-frontend -- multiple XSS vulnerabilities - - - zabbix-frontend - 1.8.10,2 - - - - -

Martina Matari reports:

-
-

These URLs (hostgroups.php, usergrps.php) are vulnerable to - persistent XSS attacks due to improper sanitation of gname - variable when creating user and host groups.

-
- - - - https://support.zabbix.com/browse/ZBX-4015 - - - 2011-08-04 - 2011-12-29 - - - - - lighttpd -- remote DoS in HTTP authentication - - - lighttpd - 1.4.30 - - - - -

US-CERT/NIST reports:

-
-

Integer signedness error in the base64_decode function in the - HTTP authentication functionality (http_auth.c) in lighttpd 1.4 - before 1.4.30 and 1.5 before SVN revision 2806 allows remote - attackers to cause a denial of service (segmentation fault) - via crafted base64 input that triggers an out-of-bounds read - with a negative index.

-
- - - - CVE-2011-4362 - - - 2011-11-29 - 2011-12-28 - - - - - krb5-appl -- telnetd code execution vulnerability - - - FreeBSD - 7.37.3_9 - 7.47.4_5 - 8.18.1_7 - 8.28.2_5 - - - krb5-appl - 1.0.2_1 - - - - -

The MIT Kerberos Team reports:

-
-

When an encryption key is supplied via the TELNET protocol, - its length is not validated before the key is copied into a - fixed-size buffer. Also see MITKRB5-SA-2011-008.

-
- - - - SA-11:08.telnetd - CVE-2011-4862 - http://security.FreeBSD.org/advisories/FreeBSD-SA-11:08.telnetd.asc - http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-008.txt - - - 2011-12-23 - 2011-12-26 - 2012-01-29 - - - - - proftpd -- arbitrary code execution vulnerability with chroot - - - FreeBSD - 7.37.3_9 - 7.47.4_5 - 8.18.1_6 - 8.28.2_5 - - - proftpd - proftpd-mysql - 1.3.3g_1 - - - proftpd-devel - 1.3.3.r4_3,1 - - - - -

The FreeBSD security advisory FreeBSD-SA-11:07.chroot reports:

-
-

If ftpd is configured to place a user in a chroot environment, - then an attacker who can log in as that user may be able to run - arbitrary code(...).

-
-

Proftpd shares the same problem of a similar nature.

- - - - SA-11:07.chroot - http://seclists.org/fulldisclosure/2011/Nov/452 - - - 2011-11-30 - 2011-12-23 - 2012-01-29 - - - - - phpMyAdmin -- Multiple XSS - - - phpMyAdmin - 3.43.4.9.r1 - - - - -

The phpMyAdmin development team reports:

-
-

Using crafted url parameters, it was possible to produce XSS on - the export panels in the server, database and table sections.

-
-
-

Crafted values entered in the setup interface can produce XSS; - also, if the config directory exists and is writeable, the XSS - payload can be saved to this directory.

-
- - - - CVE-2011-4780 - CVE-2011-4782 - http://www.phpmyadmin.net/home_page/security/PMASA-2011-19.php - http://www.phpmyadmin.net/home_page/security/PMASA-2011-20.php - - - 2011-12-16 - 2011-12-22 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 4.0,19.0,1 - - - linux-firefox - 9.0,1 - - - linux-seamonkey - 2.6 - - - linux-thunderbird - 9.0 - - - seamonkey - 2.6 - - - thunderbird - 4.09.0 - - - - -

The Mozilla Project reports:

-
-

MFSA 2011-53 Miscellaneous memory safety hazards (rv:9.0)

-

MFSA 2011-54 Potentially exploitable crash in the YARR regular - expression library

-

MFSA 2011-55 nsSVGValue out-of-bounds access

-

MFSA 2011-56 Key detection without JavaScript via SVG - animation

-

MFSA 2011-58 Crash scaling video to extreme sizes

-
- - - - CVE-2011-3658 - CVE-2011-3660 - CVE-2011-3661 - CVE-2011-3663 - CVE-2011-3665 - http://www.mozilla.org/security/announce/2011/mfsa2011-53.html - http://www.mozilla.org/security/announce/2011/mfsa2011-54.html - http://www.mozilla.org/security/announce/2011/mfsa2011-55.html - http://www.mozilla.org/security/announce/2011/mfsa2011-56.html - http://www.mozilla.org/security/announce/2011/mfsa2011-58.html - - - 2011-12-20 - 2011-12-21 - 2011-12-21 - - - - - unbound -- denial of service vulnerabilities from nonstandard redirection and denial of existence - - - unbound - 1.4.14 - - - - -

Unbound developer reports:

-
-

Unbound crashes when confronted with a non-standard response - from a server for a domain. This domain produces duplicate RRs - from a certain type and is DNSSEC signed. Unbound also crashes - when confronted with a query that eventually, and under specific - circumstances, resolves to a domain that misses expected NSEC3 - records.

-
- - - - CVE-2011-4528 - http://unbound.nlnetlabs.nl/downloads/CVE-2011-4528.txt - - - 2011-12-19 - 2011-12-19 - - - - - typo3 -- Remote Code Execution - - - typo3 - 4.64.6.2 - 4.5.9 - - - - -

The typo3 security team reports:

-
-

A crafted request to a vulnerable TYPO3 installation will allow - an attacker to load PHP code from an external source and to - execute it on the TYPO3 installation.

-

This is caused by a PHP file, which is part of the workspaces - system extension, that does not validate passed arguments.

-
- - - - CVE-2011-4614 - http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2011-004/ - - - 2011-12-16 - 2011-12-18 - - - - - krb5 -- KDC null pointer dereference in TGS handling - - - krb5 - 1.91.9.2_1 - - - - -

The MIT Kerberos Team reports:

-
-

In releases krb5-1.9 and later, the KDC can crash due to a NULL - pointer dereference in code that handles TGS (Ticket Granting - Service) requests. The trigger condition is trivial to produce - using unmodified client software, but requires the ability to - authenticate as a principal in the KDC's realm.

-
- - - - CVE-2011-1530 - http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2011-007.txt - - - 2011-12-11 - 2011-12-14 - - - - - opera -- multiple vulnerabilities - - - opera - linux-opera - 11.60 - - - opera-devel - 11.60,1 - - - - -

Opera software reports:

-
-
    -
  • Fixed a moderately severe issue; details will be - disclosed at a later date
    • -
  • Fixed an issue that could allow pages to set cookies - or communicate cross-site for some top level domains; - see our advisory
    • -
  • Improved handling of certificate revocation corner - cases
    • -
  • Added a fix for a weakness in the SSL v3.0 and TLS 1.0 - specifications, as reported by Thai Duong and Juliano Rizzo; - see our advisory
    • -
  • Fixed an issue where the JavaScript "in" operator - allowed leakage of cross-domain information, as reported - by David Bloom; see our advisory
    • -
-
- - - - CVE-2011-3389 - CVE-2011-4681 - CVE-2011-4682 - CVE-2011-4683 - http://www.opera.com/support/kb/view/1003/ - http://www.opera.com/support/kb/view/1004/ - http://www.opera.com/support/kb/view/1005/ - - - 2011-12-06 - 2011-12-13 - - - - - PuTTY -- Password vulnerability - - - putty - 0.590.62 - - - - -

Simon Tatham reports:

-
-

PuTTY 0.62 fixes a security issue present in 0.59, 0.60 and 0.61. - If you log in using SSH-2 keyboard-interactive authentication - (which is the usual method used by modern servers to request a - password), the password you type was accidentally kept in PuTTY's - memory for the rest of its run, where it could be retrieved by - other processes reading PuTTY's memory, or written out to swap - files or crash dumps.

-
- - - - CVE-2011-4607 - http://lists.tartarus.org/pipermail/putty-announce/2011/000017.html - http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/password-not-wiped.html - - - 2011-12-10 - 2011-12-12 - 2013-08-07 - - - - - asterisk -- Multiple Vulnerabilities - - - asterisk18 - 1.8.7.2 - - - asterisk16 - 1.6.2.21 - - - - -

Asterisk project reports:

-
-

It is possible to enumerate SIP usernames when the general and - user/peer NAT settings differ in whether to respond to the port - a request is sent from or the port listed for responses in the - Via header.

-
-
-

When the "automon" feature is enabled in features.conf, it is - possible to send a sequence of SIP requests that cause Asterisk - to dereference a NULL pointer and crash.

-
- - - - CVE-2011-4597 - CVE-2011-4598 - http://downloads.asterisk.org/pub/security/AST-2011-013.html - http://downloads.asterisk.org/pub/security/AST-2011-014.html - - - 2011-12-08 - 2011-12-09 - - - - - isc-dhcp-server -- Remote DoS - - - isc-dhcp42-server - 4.2.3_1 - - - isc-dhcp41-server - 4.1.e_3,2 - - - - -

ISC reports:

-
-

A bug exists which allows an attacker who is able to send DHCP - Request packets, either directly or through a relay, to remotely - crash an ISC DHCP server if that server is configured to evaluate - expressions using a regular expression (i.e. uses the "~=" or - "~~" comparison operators).

-
- - - - CVE-2011-4539 - - - 2011-12-07 - 2011-12-07 - - - - - phpMyAdmin -- Multiple XSS - - - phpMyAdmin - 3.43.4.8.r1 - - - - -

The phpMyAdmin development team reports:

-
-

Using crafted database names, it was possible to produce XSS - in the Database Synchronize and Database rename panels. Using - an invalid and crafted SQL query, it was possible to produce - XSS when editing a query on a table overview panel or when - using the view creation dialog. Using a crafted column type, - it was possible to produce XSS in the table search and create - index dialogs.

-
- - - - CVE-2011-4634 - http://www.phpmyadmin.net/home_page/security/PMASA-2011-18.php - - - 2011-11-24 - 2011-12-01 - - - - - hiawatha -- memory leak in PreventSQLi routine - - - hiawatha - 7.67.8.2 - - - - -

Hugo Leisink reports via private mail to maintainer:

-
-

The memory leak was introduced in version 7.6. It is in the - routing that checks for SQL injections. So, if you have set - PreventSQLi to 'no', there is no problem.

-
- - - - http://www.hiawatha-webserver.org/changelog - - - 2011-11-18 - 2011-11-18 - - - - - BIND -- Remote DOS - - - FreeBSD - 7.37.3_9 - 7.47.4_5 - 8.18.1_7 - 8.28.2_5 - - - bind96 - 9.6.3.1.ESV.R5.1 - - - bind97 - 9.7.4.1 - - - bind98 - 9.8.1.1 - - - - -

The Internet Systems Consortium reports:

-
-

Organizations across the Internet reported crashes interrupting - service on BIND 9 nameservers performing recursive queries. - Affected servers crashed after logging an error in query.c with - the following message: "INSIST(! dns_rdataset_isassociated(sigrdataset))" - Multiple versions were reported being affected, including all - currently supported release versions of ISC BIND 9.

-

Because it may be possible to trigger this bug even on networks - that do not allow untrusted users to access the recursive name - servers (perhaps via specially crafted e-mail messages, and/or - malicious web sites) it is recommended that ALL operators of - recursive name servers upgrade immediately.

-
- - - - SA-11:06.bind - CVE-2011-4313 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4313 - https://www.isc.org/software/bind/advisories/cve-2011-4313 - - - 2011-11-16 - 2011-11-16 - 2012-01-29 - - - - - Apache 1.3 -- mod_proxy reverse proxy exposure - - - apache - 1.3.43 - - - apache+ssl - 1.3.43.1.59_2 - - - apache+ipv6 - 1.3.43 - - - apache+mod_perl - 1.3.43 - - - apache+mod_ssl - 1.3.41+2.8.31_4 - - - apache+mod_ssl+ipv6 - 1.3.41+2.8.31_4 - - - ru-apache-1.3 - 1.3.43+30.23_1 - - - ru-apache+mod_ssl - 1.3.43+30.23_1 - - - - -

Apache HTTP server project reports:

-
-

An exposure was found when using mod_proxy in reverse proxy mode. - In certain configurations using RewriteRule with proxy flag, a - remote attacker could cause the reverse proxy to connect to an - arbitrary server, possibly disclosing sensitive information from - internal web servers not directly accessible to attacker. There - is no patch against this issue!

-
- - - - CVE-2011-3368 - http://httpd.apache.org/security/vulnerabilities_13.html - http://seclists.org/fulldisclosure/2011/Oct/232 - - - 2011-10-05 - 2011-11-14 - - - - - kdeutils4 -- Directory traversal vulnerability - - - kdeutils - 4.0.*4.7.3 - - - - -

Tim Brown from Nth Dimention reports:

-
-

I recently discovered that the Ark archiving tool is vulnerable - to directory traversal via malformed. When attempts are made to - view files within the malformed Zip file in Ark's default view, - the wrong file may be displayed due to incorrect construction of - the temporary file name. Whilst this does not allow the wrong - file to be overwritten, after closing the default view, Ark will - then attempt to delete the temporary file which could result in - the deletion of the incorrect file.

-
- - - - CVE-2011-2725 - http://seclists.org/fulldisclosure/2011/Oct/351 - - - 2011-10-19 - 2011-11-14 - - - - - Apache APR -- DoS vulnerabilities - - - apr0 - 0.9.20.0.9.19 - - - - -

The Apache Portable Runtime Project reports:

-
-

Reimplement apr_fnmatch() from scratch using a non-recursive - algorithm; now has improved compliance with the fnmatch() - spec.

-
- - - - CVE-2011-0419 - http://www.apache.org/dist/apr/Announcement0.9.html - - - 2011-05-19 - 2011-11-13 - - - - - phpmyadmin -- Local file inclusion - - - phpMyAdmin - 3.43.4.7.1 - 3.3.10.5 - - - - -

Jan Lieskovsky reports:

-
-

Importing a specially-crafted XML file which contains an XML - entity injection permits to retrieve a local file (limited by the - privileges of the user running the web server).

-
- - - - CVE-2011-4107 - http://www.phpmyadmin.net/home_page/security/PMASA-2011-17.php - - - 2011-11-10 - 2011-11-12 - - - - - linux-flashplugin -- multiple vulnerabilities - - - linux-f10-flashplugin - 10.3r183.11 - 1111.1r102.55 - - - - -

Adobe Product Security Incident Response Team reports:

-
-

Critical vulnerabilities have been identified in Adobe Flash - Player 11.0.1.152 and earlier versions for Windows, Macintosh, - Linux and Solaris, and Adobe Flash Player 11.0.1.153 and earlier - versions for Android.

-
-

In addition a patch was released for users of flash10.

- - - - CVE-2011-2445 - CVE-2011-2450 - CVE-2011-2451 - CVE-2011-2452 - CVE-2011-2453 - CVE-2011-2454 - CVE-2011-2455 - CVE-2011-2456 - CVE-2011-2457 - CVE-2011-2458 - CVE-2011-2459 - CVE-2011-2460 - https://www.adobe.com/support/security/bulletins/apsb11-28.html - - - 2011-11-10 - 2011-11-11 - - - - - libxml -- Integer overflow - - - libxml - 1.8.17_5 - - - libxml2 - linux-f10-libxml2 - 2.7.8 - - - - -

Integer overflow in xpath.c, allows context-dependent attackers - to to cause a denial of service (crash) and possibly execute - arbitrary code via a crafted XML file that triggers a heap-based - buffer overflow when adding a new namespace node, related to - handling of XPath expressions.

- - - - CVE-2011-1944 - - - 2011-09-02 - 2011-11-10 - 2011-11-12 - - - - - libxml -- Multiple use-after-free vulnerabilities - - - libxml - 1.8.17_5 - - - - -

Multiple use-after-free vulnerabilities in libxml 1.8.17 that - allow context-dependent attackers to cause a denial of service - (application crash) via crafted (1) Notation or (2) Enumeration - attribute types in an XML file.

- - - - CVE-2009-2416 - - - 2009-08-03 - 2011-11-10 - 2011-11-12 - - - - - libxml -- Stack consumption vulnerability - - - libxml - 1.8.17_5 - - - - -

Stack consumption vulnerability allows context-dependent - attackers to cause a denial of service (application crash) via - a large depth of element declarations in a DTD.

- - - - CVE-2009-2414 - - - 2009-08-03 - 2011-11-10 - 2011-11-12 - - - - - gnutls -- client session resumption vulnerability - - - gnutls - 2.12.14 - - - - -

The GnuTLS team reports:

-
-

GNUTLS-SA-2011-2 Possible buffer overflow/Denial of service.

-
- - - - CVE-2011-4128 - http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/5596 - - - 2011-11-08 - 2011-11-10 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 4.0,18.0,1 - 3.6.*,13.6.24,1 - - - libxul - 1.9.2.*1.9.2.24 - - - linux-firefox - 8.0,1 - - - linux-thunderbird - 8.0 - - - thunderbird - 4.08.0 - 3.1.16 - - - - -

The Mozilla Project reports:

-
-

MFSA 2011-46 loadSubScript unwraps XPCNativeWrapper scope - parameter (1.9.2 branch)

-

MFSA 2011-47 Potential XSS against sites using Shift-JIS

-

MFSA 2011-48 Miscellaneous memory safety hazards (rv:8.0)

-

MFSA 2011-49 Memory corruption while profiling using Firebug

-

MFSA 2011-50 Cross-origin data theft using canvas and Windows - D2D

-

MFSA 2011-51 Cross-origin image theft on Mac with integrated - Intel GPU

-

MFSA 2011-52 Code execution via NoWaiverWrapper

-
- - - - CVE-2011-3647 - CVE-2011-3648 - CVE-2011-3649 - CVE-2011-3650 - CVE-2011-3651 - CVE-2011-3652 - CVE-2011-3653 - CVE-2011-3654 - CVE-2011-3655 - http://www.mozilla.org/security/announce/2011/mfsa2011-46.html - http://www.mozilla.org/security/announce/2011/mfsa2011-47.html - http://www.mozilla.org/security/announce/2011/mfsa2011-48.html - http://www.mozilla.org/security/announce/2011/mfsa2011-49.html - http://www.mozilla.org/security/announce/2011/mfsa2011-50.html - http://www.mozilla.org/security/announce/2011/mfsa2011-51.html - http://www.mozilla.org/security/announce/2011/mfsa2011-52.html - - - 2011-11-08 - 2011-11-08 - - - - - caml-light -- insecure use of temporary files - - - caml-light - 0.75 - - - - -

caml-light uses mktemp() insecurely, and also does - unsafe things in /tmp during make install.

- - - - CVE-2011-4119 - http://seclists.org/oss-sec/2011/q4/249 - - - 2011-11-02 - 2011-11-06 - - - - - freetype -- Some type 1 fonts handling vulnerabilities - - - freetype2 - 2.4.7 - - - - -

The FreeType project reports:

-
-

A couple of vulnerabilities in handling Type 1 fonts.

-
- - - - CVE-2011-3256 - http://sourceforge.net/projects/freetype/files/freetype2/2.4.7/README/view - https://bugzilla.redhat.com/attachment.cgi?id=528829&action=diff - - - 2011-10-12 - 2011-11-01 - - - - - cacti -- Multiple vulnerabilities - - - cacti - 0.8.7h - - - - -

Cacti Group reports:

-
-

SQL injection issue with user login, and cross-site scripting - issues.

-
- - - - http://www.cacti.net/release_notes_0_8_7h.php - - - 2011-09-26 - 2011-10-26 - - - - - phpmyfaq -- Remote PHP Code Injection Vulnerability - - - phpmyfaq - 2.6.19 - - - - -

The phpMyFAQ project reports:

-
-

The phpMyFAQ Team has learned of a serious security issue that - has been discovered in our bundled ImageManager library we use - in phpMyFAQ 2.6 and 2.7. The bundled ImageManager library - allows injection of arbitrary PHP code via POST requests.

-
- - - - http://www.phpmyfaq.de/advisory_2011-10-25.php - http://forum.phpmyfaq.de/viewtopic.php?f=3&t=13402 - - - 2011-10-25 - 2011-10-26 - - - - - phpLDAPadmin -- Remote PHP code injection vulnerability - - - phpldapadmin - 1.2.01.2.1.1_1,1 - - - - -

EgiX (n0b0d13s at gmail dot com) reports:

-
-

The $sortby parameter passed to 'masort' function in file - lib/functions.php isn't properly sanitized before being used in - a call to create_function() at line 1080. This can be exploited - to inject and execute arbitrary PHP code. The only possible - attack vector is when handling the 'query_engine' command, in - which input passed through $_REQUEST['orderby'] is passed as - $sortby parameter to 'masort' function.

-
- - - - http://packetstormsecurity.org/files/106120/phpldapadmin-inject.txt - http://sourceforge.net/tracker/?func=detail&aid=3417184&group_id=61828&atid=498546 - - - 2011-10-23 - 2011-10-24 - - - - - kdelibs4, rekonq -- input validation failure - - - kdelibs - 4.0.*4.7.2 - - - rekonq - 0.8.0 - - - - -

KDE Security Advisory reports:

-
-

The default rendering type for a QLabel is QLabel::AutoText, - which uses heuristics to determine whether to render the given - content as plain text or rich text. KSSL and Rekonq did not - properly force its QLabels to use QLabel::PlainText. As a result, - if given a certificate containing rich text in its fields, they - would render the rich text. Specifically, a certificate - containing a common name (CN) that has a table element will cause - the second line of the table to be displayed. This can allow - spoofing of the certificate's common name.

-
- - - - http://www.kde.org/info/security/advisory-20111003-1.txt - http://www.nth-dimension.org.uk/pub/NDSA20111003.txt.asc - CVE-2011-3365 - CVE-2011-3366 - - - 2011-10-03 - 2011-10-23 - - - - - piwik -- unknown critical vulnerabilities - - - piwik - 1.11.6 - - - - -

Secunia reports:

-
-

Multiple vulnerabilities with an unknown impact have been - reported in Piwik. The vulnerabilities are caused due to - unspecified errors. No further information is currently - available.

-
- - - - http://secunia.com/advisories/46461/ - http://piwik.org/blog/2011/10/piwik-1-6/ - - - 2011-10-18 - 2011-10-20 - - - - - Xorg server -- two vulnerabilities in X server lock handling code - - - xorg-server - 1.7.7_3 - - - - -

Matthieu Herrb reports:

-
-

It is possible to deduce if a file exists or not by exploiting - the way that Xorg creates its lock files. This is caused by the - fact that the X server is behaving differently if the lock file - already exists as a symbolic link pointing to an existing or - non-existing file.

-

It is possible for a non-root user to set the permissions for - all users on any file or directory to 444, giving unwanted read - access or causing denies of service (by removing execute - permission). This is caused by a race between creating the lock - file and setting its access modes.

-
- - - - CVE-2011-4028 - CVE-2011-4029 - - - 2011-10-18 - 2011-10-18 - - - - - asterisk -- remote crash vulnerability in SIP channel driver - - - asterisk18 - 1.8.*1.8.7.1 - - - asterisk - 10.0.0.*10.0.0.r1 - - - - -

Asterisk project reports:

-
-

A remote authenticated user can cause a crash with a malformed - request due to an unitialized variable.

-
- - - - CVE-2011-4063 - - - 2011-10-17 - 2011-10-17 - - - - - PivotX -- Remote File Inclusion Vulnerability of TimThumb - - - pivotx - 2.3.0 - - - - -

The PivotX team reports:

-
-

TimThumb domain name security bypass and insecure cache - handling. PivotX before 2.3.0 includes a vulnerable version - of TimThumb.

-
-
-

If you are still running PivotX 2.2.6, you might be vulnerable - to a security exploit, that was patched previously. Version - 2.3.0 doesn't have this issue, but any older version of PivotX - might be vulnerable.

-
- - - - 48963 - https://secunia.com/advisories/45416/ - - - 2011-08-03 - 2011-10-17 - - - - - OpenTTD -- Multiple buffer overflows in validation of external data - - - openttd - 0.1.01.1.3 - - - - -

The OpenTTD Team reports:

-
-

Multiple buffer overflows in OpenTTD before 1.1.3 allow local - users to cause a denial of service (daemon crash) or possibly - gain privileges via (1) a crafted BMP file with RLE compression - or (2) crafted dimensions in a BMP file.

-
- - - - CVE-2011-3343 - http://security.openttd.org/en/CVE-2011-3343 - - - 2011-08-25 - 2011-10-16 - - - - - OpenTTD -- Buffer overflows in savegame loading - - - openttd - 0.1.01.1.3 - - - - -

The OpenTTD Team reports:

-
-

Multiple buffer overflows in OpenTTD before 1.1.3 allow remote - attackers to cause a denial of service (daemon crash) or possibly - execute arbitrary code via vectors related to (1) NAME, (2) PLYR, - (3) CHTS, or (4) AIPL (aka AI config) chunk loading from a - savegame.

-
- - - - CVE-2011-3342 - http://security.openttd.org/en/CVE-2011-3342 - - - 2011-08-08 - 2011-10-16 - - - - - OpenTTD -- Denial of service via improperly validated commands - - - openttd - 0.3.51.1.3 - - - - -

The OpenTTD Team reports:

-
-

Multiple off-by-one errors in order_cmd.cpp in OpenTTD before - 1.1.3 allow remote attackers to cause a denial of service (daemon - crash) or possibly execute arbitrary code via a crafted - CMD_INSERT_ORDER command.

-
- - - - CVE-2011-3341 - http://security.openttd.org/en/CVE-2011-3341 - - - 2011-08-25 - 2011-10-16 - - - - - quagga -- multiple vulnerabilities - - - quagga - 0.99.19 - - - - -

CERT-FI reports:

-
-

Five vulnerabilities have been found in the BGP, OSPF, and - OSPFv3 components of Quagga. The vulnerabilities allow an - attacker to cause a denial of service or potentially to - execute his own code by sending a specially modified packets - to an affected server. Routing messages are typically accepted - from the routing peers. Exploiting these vulnerabilities may - require an established routing session (BGP peering or - OSPF/OSPFv3 adjacency) to the router.

-

The vulnerability CVE-2011-3327 - is related to the extended communities handling in BGP - messages. Receiving a malformed BGP update can result - in a buffer overflow and disruption of IPv4 routing.

-

The vulnerability CVE-2011-3326 - results from the handling of LSA (Link State Advertisement) - states in the OSPF service. Receiving a modified Link State - Update message with malicious state information can result in - denial of service in IPv4 routing.

-

The vulnerability CVE-2011-3325 - is a denial of service vulnerability related to Hello message - handling by the OSPF service. As Hello messages are used to - initiate adjacencies, exploiting the vulnerability may be - feasible from the same broadcast domain without an established - adjacency. A malformed packet may result in denial of service - in IPv4 routing.

-

The vulnerabilities CVE-2011-3324 - and CVE-2011-3323 - are related to the IPv6 routing protocol (OSPFv3) implemented - in ospf6d daemon. Receiving modified Database Description and - Link State Update messages, respectively, can result in denial - of service in IPv6 routing.

-
- - - - CVE-2011-3323 - CVE-2011-3324 - CVE-2011-3325 - CVE-2011-3326 - CVE-2011-3327 - - - 2011-09-26 - 2011-10-05 - - - - - Mozilla -- multiple vulnerabilities - - - firefox - 4.0,17.0,1 - 3.6.*,13.6.23,1 - - - libxul - 1.9.2.*1.9.2.23 - - - linux-firefox - 7.0,1 - - - linux-seamonkey - 2.4 - - - linux-thunderbird - 7.0 - - - seamonkey - 2.4 - - - thunderbird - 4.07.0 - 3.1.15 - - - - -

The Mozilla Project reports:

-
-

MFSA 2011-36 Miscellaneous memory safety hazards (rv:7.0 / - rv:1.9.2.23)

-

MFSA 2011-37 Integer underflow when using JavaScript RegExp

-

MFSA 2011-38 XSS via plugins and shadowed window.location - object

-

MFSA 2011-39 Defense against multiple Location headers due to - CRLF Injection

-

MFSA 2011-40 Code installation through holding down Enter

-

MFSA 2011-41 Potentially exploitable WebGL crashes

-

MFSA 2011-42 Potentially exploitable crash in the YARR regular - expression library

-

MFSA 2011-43 loadSubScript unwraps XPCNativeWrapper scope - parameter

-

MFSA 2011-44 Use after free reading OGG headers

-

MFSA 2011-45 Inferring Keystrokes from motion data

-
- - - - CVE-2011-2372 - CVE-2011-2995 - CVE-2011-2996 - CVE-2011-2997 - CVE-2011-2999 - CVE-2011-3000 - CVE-2011-3001 - CVE-2011-3002 - CVE-2011-3003 - CVE-2011-3004 - CVE-2011-3005 - CVE-2011-3232 - http://www.mozilla.org/security/announce/2011/mfsa2011-36.html - http://www.mozilla.org/security/announce/2011/mfsa2011-37.html - http://www.mozilla.org/security/announce/2011/mfsa2011-38.html - http://www.mozilla.org/security/announce/2011/mfsa2011-39.html - http://www.mozilla.org/security/announce/2011/mfsa2011-40.html - http://www.mozilla.org/security/announce/2011/mfsa2011-41.html - http://www.mozilla.org/security/announce/2011/mfsa2011-42.html - http://www.mozilla.org/security/announce/2011/mfsa2011-43.html - http://www.mozilla.org/security/announce/2011/mfsa2011-44.html - http://www.mozilla.org/security/announce/2011/mfsa2011-45.html - - - 2011-09-27 - 2011-09-28 - - - - - linux-flashplugin -- multiple vulnerabilities - - - linux-flashplugin - 9.0r289 - - - linux-f10-flashplugin - 10.3r183.10 - - - - -

Adobe Product Security Incident Response Team reports:

-
-

Critical vulnerabilities have been identified in Adobe Flash - Player 10.3.183.7 and earlier versions for Windows, Macintosh, - Linux and Solaris, and Adobe Flash Player 10.3.186.6 and earlier - versions for Android. These vulnerabilities could cause a crash - and potentially allow an attacker to take control of the - affected system.

-

There are reports that one of these vulnerabilities - (CVE-2011-2444) is being exploited in the wild in active - targeted attacks designed to trick the user into clicking on - a malicious link delivered in an email message. This universal - cross-site scripting issue could be used to take actions on a - user's behalf on any website or webmail provider if the user - visits a malicious website.

-
- - - - https://www.adobe.com/support/security/bulletins/apsb11-26.html - CVE-2011-2426 - CVE-2011-2427 - CVE-2011-2428 - CVE-2011-2429 - CVE-2011-2430 - CVE-2011-2444 - - - 2011-06-06 - 2011-09-22 - - - - - phpMyAdmin -- multiple XSS vulnerabilities - - - phpMyAdmin - 3.4.5 - - - - -

phpMyAdmin development team reports:

-
-

Firstly, if a row contains javascript code, after inline - editing this row and saving, the code is executed. Secondly, - missing sanitization on the db, table and column names leads - to XSS vulnerabilities.

-

Versions 3.4.0 to 3.4.4 were found vulnerable.

-
- - - - http://www.phpmyadmin.net/home_page/security/PMASA-2011-14.php - - - 2011-09-11 - 2011-09-14 - - - - - django -- multiple vulnerabilities - - - py23-django - py24-django - py25-django - py26-django - py27-django - py30-django - py31-django - 1.31.3.1 - 1.21.2.7 - - - py23-django-devel - py24-django-devel - py25-django-devel - py26-django-devel - py27-django-devel - py30-django-devel - py31-django-devel - 16758,1 - - - - -

The Django project reports:

-
-

Please reference CVE/URL list for details

-
- - - - https://www.djangoproject.com/weblog/2011/sep/09/security-releases-issued/ - - - 2011-09-09 - 2011-09-13 - 2011-11-01 - - - - - roundcube -- XSS vulnerability - - - roundcube - 0.5.4,1 - - - - -

RoundCube development Team reports:

-
-

We just published a new release which fixes a recently - reported XSS vulnerability as an update to the stable 0.5 - branch. Please update your installations with this new - version or patch them with the fix which is also published - in the downloads section or our sourceforge.net page.

-
-

and:

-
-

During one of pen-tests I found that _mbox parameter is not - properly sanitized and reflected XSS attack is possible.

-
- - - - CVE-2011-2937 - - - 2011-08-09 - 2011-09-13 - - - - - libsndfile -- PAF file processing integer overflow - - - libsndfile - 1.0.25 - - - - -

Secunia reports:

-
-

Hossein Lotfi has discovered a vulnerability in libsndfile, - which can be exploited by malicious people to potentially - compromise an application using the library. The vulnerability - is caused due to an integer overflow error in the "paf24_init()" - function (src/paf.c) when processing Paris Audio (PAF) files. - This can be exploited to cause a heap-based buffer overflow via - a specially crafted file. Successful exploitation may allow - execution of arbitrary code. The vulnerability is confirmed in - version 1.0.24. Other versions may also be affected.

-
- - - - CVE-2011-2696 - http://secunia.com/advisories/45125/ - - - 2011-07-12 - 2011-09-12 - - - - - OpenSSL -- multiple vulnerabilities - - - openssl - 1.0.01.0.0_6 - 0.9.81.0.0 - - - linux-f10-openssl - 0.9.80.9.8r - - - - -

OpenSSL Team reports:

-
-

Two security flaws have been fixed in OpenSSL 1.0.0e

-

Under certain circumstances OpenSSL's internal certificate - verification routines can incorrectly accept a CRL whose - nextUpdate field is in the past. (CVE-2011-3207)

-

OpenSSL server code for ephemeral ECDH ciphersuites is not - thread-safe, and furthermore can crash if a client violates - the protocol by sending handshake messages in incorrect - order. (CVE-2011-3210)

-
- - - - CVE-2011-3207 - CVE-2011-3210 - http://www.openssl.org/news/secadv_20110906.txt - - - 2011-09-06 - 2011-09-07 - 2014-04-10 - - - - - XSS issue in MantisBT - - - mantis - 1.2.01.2.7 - - - - -
-

Net.Edit0r from BlACK Hat Group reported an XSS issue in - search.php. All MantisBT users (including anonymous users that - are not logged in to public bug trackers) could be impacted by - this vulnerability.

-
- - - - ports/160368 - CVE-2011-2938 - - - 2011-08-18 - 2011-09-05 - - - - - security/cfs -- buffer overflow - - - cfs - 1.4.1_6 - - - - -

Debian reports:

-
-

Zorgon found several buffer overflows in cfsd, a daemon that - pushes encryption services into the Unix(tm) file system. - We are not yet sure if these overflows can successfully be - exploited to gain root access to the machine running the CFS - daemon. However, since cfsd can easily be forced to die, a - malicious user can easily perform a denial of service attack - to it.

-
- - - - CVE-2002-0351 - http://www.debian.org/security/2002/dsa-116 - - - 2002-03-02 - 2011-09-04 - - - - - ca_root_nss -- extraction of explicitly-untrusted certificates into trust bundle - - - ca_root_nss - 3.12.11 - - - - -

Matthias Andree reports that the ca-bundle.pl used in older - versions of the ca_root_nss FreeBSD port before 3.12.11 did not - take the Mozilla/NSS/CKBI untrusted markers into account and - would add certificates to the trust bundle that were marked - unsafe by Mozilla.

- - - - ports/160455 - - - 2011-09-04 - 2011-09-04 - - - - - nss/ca_root_nss -- fraudulent certificates issued by DigiNotar.nl - - - nss - 3.12.11 - - - - ca_root_nss - 3.12.11 - - - - firefox - 3.6.*,13.6.22,1 - 4.0.*,16.0.2,1 - - - seamonkey - 2.3.2 - - - linux-firefox - 3.6.22,1 - - - thunderbird - 3.1.*3.1.14 - 5.0.*6.0.2 - - - linux-thunderbird - 3.1.14 - - - linux-seamonkey - 2.3.2 - - - - -

Heather Adkins, Google's Information Security Manager, reported that - Google received

-
-

[...] reports of attempted SSL man-in-the-middle (MITM) - attacks against Google users, whereby someone tried to get between - them and encrypted Google services. The people affected were - primarily located in Iran. The attacker used a fraudulent SSL - certificate issued by DigiNotar, a root certificate authority that - should not issue certificates for Google (and has since revoked - it). [...]

-
-

VASCO Data Security International Inc., owner of DigiNotar, issued a - press statement confirming this incident:

-
-

On July 19th 2011, DigiNotar detected an intrusion - into its Certificate Authority (CA) infrastructure, which resulted - in the fraudulent issuance of public key certificate requests for - a number of domains, including Google.com. [...] an external - security audit concluded that all fraudulently issued certificates - were - revoked. Recently, it was discovered that at least one fraudulent - certificate had not been revoked at the time. [...]

-
-

Mozilla, maintainer of the NSS package, from which FreeBSD derived - ca_root_nss, stated that they:

-
-

revoked our trust in the DigiNotar certificate authority from - all Mozilla software. This is not a temporary suspension, it is - a complete removal from our trusted root program. Complete - revocation of trust is a decision we treat with careful - consideration, and employ as a last resort. -

Three central issues informed our decision:

-
  1. Failure to notify. [...]
    2. -
  2. The scope of the breach remains unknown. [...]
    3. -
  3. The attack is not theoretical.
-
- - - - http://www.vasco.com/company/press_room/news_archive/2011/news_diginotar_reports_security_incident.aspx - http://www.mozilla.org/security/announce/2011/mfsa2011-34.html - http://googleonlinesecurity.blogspot.com/2011/08/update-on-attempted-man-in-middle.html - - - 2011-07-19 - 2011-09-03 - 2011-09-06 - - - - - apache -- Range header DoS vulnerability - - - apache - apache-event - apache-itk - apache-peruser - apache-worker - 2.*2.2.20 - - - - -

Apache HTTP server project reports:

-
-

A denial of service vulnerability has been found in the way - the multiple overlapping ranges are handled by Apache HTTPD - server.

-
- - - - CVE-2011-3192 - https://people.apache.org/~dirkx/CVE-2011-3192.txt - https://svn.apache.org/viewvc?view=revision&revision=1161534 - https://svn.apache.org/viewvc?view=revision&revision=1162874 - - - 2011-08-24 - 2011-08-30 - 2011-09-01 - - - - - stunnel -- heap corruption vulnerability - - - stunnel - 4.404.42 - - - - -

Michal Trojnara reports:

-
-

Version 4.42, 2011.08.18, urgency: HIGH:

-

Fixed a heap corruption vulnerability in versions 4.40 and 4.41. - It may possibly be leveraged to perform DoS or remote code - execution attacks.

-
- - - - 49254 - CVE-2011-2940 - - - 2011-08-25 - 2011-08-26 - - - - - phpMyAdmin -- multiple XSS vulnerabilities - - - phpMyAdmin - 3.4.4 - - - - -

The phpMyAdmin development team reports:

-
-

Multiple XSS in the Tracking feature.

-
- - - - CVE-2011-3181 - - - 2011-08-24 - 2011-08-24 - - - - - PHP -- crypt() returns only the salt for MD5 - - - php5 - 5.3.75.3.7_2 - - - - -

PHP development team reports:

-
-

If crypt() is executed with MD5 salts, the return value - consists of the salt only. DES and BLOWFISH salts work as - expected.

-
- - - - https://bugs.php.net/bug.php?id=55439 - - - 2011-08-17 - 2011-08-23 - 2011-08-30 - - - - - php -- multiple vulnerabilities - - - php5 - php5-sockets - 5.3.7 - - - - -

PHP development team reports:

-
-

Security Enhancements and Fixes in PHP 5.3.7:

-
    -
  • Updated crypt_blowfish to 1.2. (CVE-2011-2483)
    • -
  • Fixed crash in error_log(). Reported by Mateusz - Kocielski
    • -
  • Fixed buffer overflow on overlog salt in crypt().
    • -
  • Fixed bug #54939 (File path injection vulnerability - in RFC1867 File upload filename). Reported by Krzysztof - Kotowicz. (CVE-2011-2202)
    • -
  • Fixed stack buffer overflow in socket_connect(). - (CVE-2011-1938)
    • -
  • Fixed bug #54238 (use-after-free in substr_replace()). - (CVE-2011-1148)
    • -
-
- - - - 49241 - CVE-2011-2483 - CVE-2011-2202 - CVE-2011-1938 - CVE-2011-1148 - - - 2011-08-18 - 2011-08-20 - - - - - rubygem-rails -- multiple vulnerabilities - - - rubygem-rails - 3.0.10 - - - - -

SecurityFocus reports:

-
-

Ruby on Rails is prone to multiple vulnerabilities - including SQL-injection, information-disclosure, - HTTP-header-injection, security-bypass and cross-site - scripting issues.

-
- - - - 49179 - http://groups.google.com/group/rubyonrails-security/browse_thread/thread/6a1e473744bc389b - http://groups.google.com/group/rubyonrails-security/browse_thread/thread/3420ac71aed312d6 - http://groups.google.com/group/rubyonrails-security/browse_thread/thread/6ffc93bde0298768 - http://groups.google.com/group/rubyonrails-security/browse_thread/thread/2b9130749b74ea12 - http://groups.google.com/group/rubyonrails-security/browse_thread/thread/56bffb5923ab1195 - - - 2011-08-16 - 2011-08-19 - - - - - dovecot -- denial of service vulnerability - - - dovecot - 1.2.17 - 2.02.0.13 - - - - -

Timo Sirainen reports:

-
-

Fixed potential crashes and other problems when parsing header - names that contained NUL characters.

-
- - - - 47930 - CVE-2011-1929 - - - 2011-05-25 - 2011-08-19 - - - - - OTRS -- Vulnerabilities in OTRS-Core allows read access to any file on local file system - - - otrs - 2.1.*3.0.10 - - - - -

OTRS Security Advisory reports:

-
-
    -
  • An attacker with valid session and admin permissions could - get read access to any file on the servers local operating - system. For this it would be needed minimum one installed - OTRS package.
    • -
-
- - - - CVE-2011-2746 - http://otrs.org/advisory/OSA-2011-03-en/ - - - 2011-08-16 - 2011-08-18 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 3.6.*,13.6.20,1 - 5.0.*,16.0,1 - - - seamonkey - 2.3 - - - linux-firefox - 3.6.20,1 - - - thunderbird - 3.1.12 - - - linux-thunderbird - 3.1.12 - - - - -

The Mozilla Project reports:

-
-

MFSA 2011-29 Security issues addressed in Firefox 6

-

MFSA 2011-28 Security issues addressed in Firefox 3.6.20

-
- - - - http://www.mozilla.org/security/announce/2011/mfsa2011-29.html - http://www.mozilla.org/security/announce/2011/mfsa2011-30.html - CVE-2011-2982 - CVE-2011-0084 - CVE-2011-2981 - CVE-2011-2378 - CVE-2011-2984 - CVE-2011-2980 - CVE-2011-2983 - CVE-2011-2989 - CVE-2011-2991 - CVE-2011-2992 - CVE-2011-2985 - CVE-2011-2993 - CVE-2011-2988 - CVE-2011-2987 - CVE-2011-0084 - CVE-2011-2990 - CVE-2011-2986 - - - 2011-08-16 - 2011-08-16 - - - - - Samba -- cross site scripting and request forgery vulnerabilities - - - samba34 - 3.4.*3.4.14 - - - samba35 - 3.5.*3.5.10 - - - - -

Samba security advisory reports:

-
-

All current released versions of Samba are vulnerable to a - cross-site request forgery in the Samba Web Administration Tool - (SWAT). By tricking a user who is authenticated with SWAT into - clicking a manipulated URL on a different web page, it is - possible to manipulate SWAT.

-
-
-

All current released versions of Samba are vulnerable to a - cross-site scripting issue in the Samba Web Administration Tool - (SWAT). On the "Change Password" field, it is possible to insert - arbitrary content into the "user" field.

-
- - - - 48901 - 48899 - CVE-2011-2522 - CVE-2011-2694 - - - 2011-07-27 - 2011-08-16 - - - - - isc-dhcp-server -- server halt upon processing certain packets - - - isc-dhcp31-server - 3.1.ESV_1,1 - - - isc-dhcp41-server - 4.1.e_2,2 - - - isc-dhcp42-server - 4.2.2 - - - - -

ISC reports:

-
-

A pair of defects cause the server to halt upon processing - certain packets. The patch is to properly discard or process - those packets. -

-
- - - - CVE-2011-2748 - CVE-2011-2749 - - - 2011-08-10 - 2011-08-13 - - - - - bugzilla -- multiple vulnerabilities - - - bugzilla - 2.4.*3.6.6 - 4.0.*4.0.2 - - - - -

A Bugzilla Security Advisory reports:

-
-

The following security issues have been discovered in Bugzilla:

-
    -
  • Internet Explorer 8 and older, and Safari before 5.0.6 do - content sniffing when viewing a patch in "Raw Unified" mode, - which could trigger a cross-site scripting attack due to - the execution of malicious code in the attachment.
    • -
  • It is possible to determine whether or not certain group - names exist while creating or updating bugs.
    • -
  • Attachment descriptions with a newline in them could lead - to the injection of crafted headers in email notifications sent - to the requestee or the requester when editing an attachment - flag.
    • -
  • If an attacker has access to a user's session, he can modify - that user's email address without that user being notified - of the change.
    • -
  • Temporary files for uploaded attachments are not deleted - on Windows, which could let a user with local access to - the server read them.
    • -
  • Up to Bugzilla 3.4.11, if a BUGLIST cookie is compromised, - it can be used to inject HTML code when viewing a bug report, - leading to a cross-site scripting attack.
    • -
-

All affected installations are encouraged to upgrade as soon as - possible.

-
- - - - CVE-2011-2379 - CVE-2011-2380 - CVE-2011-2979 - CVE-2011-2381 - CVE-2011-2978 - CVE-2011-2977 - CVE-2011-2976 - https://bugzilla.mozilla.org/show_bug.cgi?id=637981 - https://bugzilla.mozilla.org/show_bug.cgi?id=653477 - https://bugzilla.mozilla.org/show_bug.cgi?id=674497 - https://bugzilla.mozilla.org/show_bug.cgi?id=657158 - https://bugzilla.mozilla.org/show_bug.cgi?id=670868 - https://bugzilla.mozilla.org/show_bug.cgi?id=660502 - https://bugzilla.mozilla.org/show_bug.cgi?id=660053 - - - 2011-08-04 - 2011-08-13 - - - - - dtc -- multiple vulnerabilities - - - dtc - 0.32.9 - - - - -

Ansgar Burchardt reports:

-
-

Ansgar Burchardt discovered several vulnerabilities in DTC, a - web control panel for admin and accounting hosting services: - The bw_per_moth.php graph contains an SQL injection - vulnerability; insufficient checks in bw_per_month.php can lead - to bandwidth usage information disclosure; after a registration, - passwords are sent in cleartext email messages and Authenticated - users could delete accounts using an obsolete interface which - was incorrectly included in the package.

-
- - - - CVE-2011-0434 - CVE-2011-0435 - CVE-2011-0436 - CVE-2011-0437 - http://www.debian.org/security/2011/dsa-2179 - - - 2011-03-02 - 2011-08-13 - - - - - libXfont -- possible local privilege escalation - - - libXfont - 1.4.4_1,1 - - - - -

Tomas Hoger reports:

-
-

The compress/ LZW decompress implentation does not correctly - handle compressed streams that contain code words that were not - yet added to the decompression table. This may lead to - arbitrary memory corruption. Successfull exploitation may - possible lead to a local privilege escalation.

-
- - - - CVE-2011-2895 - https://bugzilla.redhat.com/show_bug.cgi?id=725760 - - - 2011-07-26 - 2011-08-11 - 2012-03-13 - - - - - freetype2 -- execute arbitrary code or cause denial of service - - - freetype2 - 2.4.6 - - - - -

Vincent Danen reports:

-
-

Due to an error within the t1_decoder_parse_charstrings() - function (src/psaux/t1decode.c) and can be exploited to corrupt - memory by tricking a user into processing a specially-crafted - postscript Type1 font in an application that uses the freetype - library.

-
- - - - CVE-2011-0226 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-0226 - - - 2011-07-19 - 2011-08-11 - - - - - linux-flashplugin -- multiple vulnerabilities - - - linux-flashplugin - 9.0r289 - - - linux-f10-flashplugin - 10.3r183.5 - - - - -

Adobe Product Security Incident Response Team reports:

-
-

Critical vulnerabilities have been identified in Adobe Flash - Player 10.3.181.36 and earlier versions for Windows, Macintosh, - Linux and Solaris, and Adobe Flash Player 10.3.185.25 and - earlier versions for Android. These vulnerabilities could - cause a crash and potentially allow an attacker to take control - of the affected system.

-
- - - - CVE-2011-2130 - CVE-2011-2134 - CVE-2011-2135 - CVE-2011-2136 - CVE-2011-2137 - CVE-2011-2138 - CVE-2011-2139 - CVE-2011-2140 - CVE-2011-2414 - CVE-2011-2415 - CVE-2011-2416 - CVE-2011-2417 - CVE-2011-2425 - https://www.adobe.com/support/security/bulletins/apsb11-21.html - - - 2011-05-13 - 2011-08-10 - 2012-11-05 - - - - - libsoup -- unintentionally allow access to entire local filesystem - - - libsoup - 2.32.2_3 - - - - -

Dan Winship reports:

-
-

Fixed a security hole that caused some SoupServer users to - unintentionally allow accessing the entire local filesystem when - they thought they were only providing access to a single - directory.

-
- - - - CVE-2011-2054 - http://mail.gnome.org/archives/ftp-release-list/2011-July/msg00176.html - https://bugzilla.gnome.org/show_bug.cgi?id=653258 - - - 2011-06-23 - 2011-07-28 - - - - - phpmyadmin -- multiple vulnerabilities - - - phpMyAdmin - 3.4.3.2 - - - - -

The phpMyAdmin development team reports:

-
-

XSS in table Print view.

-
-
-

Via a crafted MIME-type transformation parameter, an attacker can - perform a local file inclusion.

-
-
-

In the 'relational schema' code a parameter was not sanitized before - being used to concatenate a class name.

-

The end result is a local file inclusion vulnerability and code - execution.

-
-
-

It was possible to manipulate the PHP session superglobal using - some of the Swekey authentication code.

-

This is very similar to PMASA-2011-5, documented in - 7e4e5c53-a56c-11e0-b180-00216aa06fc2

-
- - - - CVE-2011-2642 - CVE-2011-2643 - http://www.phpmyadmin.net/home_page/security/PMASA-2011-9.php - http://www.phpmyadmin.net/home_page/security/PMASA-2011-10.php - http://www.phpmyadmin.net/home_page/security/PMASA-2011-11.php - http://www.phpmyadmin.net/home_page/security/PMASA-2011-12.php - - - 2011-07-23 - 2011-07-24 - 2011-07-28 - - - - - opensaml2 -- unauthenticated login - - - opensaml2 - 02.4.3 - - - - -

OpenSAML developer reports:

-
-

The Shibboleth software relies on the OpenSAML libraries to - perform verification of signed XML messages such as attribute - queries or SAML assertions. Both the Java and C++ versions are - vulnerable to a so-called "wrapping attack" that allows a remote, - unauthenticated attacker to craft specially formed messages that - can be successfully verified, but contain arbitrary content.

-
- - - - CVE-2011-1411 - https://groups.google.com/a/shibboleth.net/group/announce/browse_thread/thread/cf3e0d76afbb57d9 - - - 2011-07-25 - 2011-07-25 - - - - - rsync -- incremental recursion memory corruption vulnerability - - - rsync - 3.03.0.8 - - - - -

rsync development team reports:

-
-

Fixed a data-corruption issue when preserving hard-links - without preserving file ownership, and doing deletions either - before or during the transfer (CVE-2011-1097). This - fixes some assert errors in the hard-linking code, and some - potential failed checksums (via -c) that should have matched.

-
- - - - CVE-2011-1097 - https://bugzilla.samba.org/show_bug.cgi?id=7936 - - - 2011-04-08 - 2011-07-20 - - - - - BIND -- Remote DoS against authoritative and recursive servers - - - bind96 - 9.6.3.1.ESV.R4.3 - - - bind97 - 9.7.3.3 - - - bind98 - 9.8.0.4 - - - - -

ISC reports:

-
-

A defect in the affected BIND 9 versions allows an attacker to - remotely cause the "named" process to exit using a specially - crafted packet.

-

This defect affects both recursive and authoritative servers.

-
- - - - CVE-2011-2464 - https://www.isc.org/software/bind/advisories/cve-2011-2464 - - - 2011-07-05 - 2011-07-05 - - - - - BIND -- Remote DoS with certain RPZ configurations - - - bind98 - 9.8.0.4 - - - - -

ISC reports:

-
-

Two defects were discovered in ISC's BIND 9.8 code. These - defects only affect BIND 9.8 servers which have recursion - enabled and which use a specific feature of the software known - as Response Policy Zones (RPZ) and where the RPZ zone contains - a specific rule/action pattern.

-
- - - - CVE-2011-2465 - https://www.isc.org/software/bind/advisories/cve-2011-2465 - - - 2011-07-05 - 2011-07-05 - - - - - phpmyadmin -- multiple vulnerabilities - - - phpMyAdmin - 3.4.3.1 - - - - -

The phpMyAdmin development team reports:

-
-

It was possible to manipulate the PHP session superglobal using - some of the Swekey authentication code. This could open a path - for other attacks.

-
-
-

An unsanitized key from the Servers array is written in a comment - of the generated config. An attacker can modify this key by - modifying the SESSION superglobal array. This allows the attacker - to close the comment and inject code.

-
-
-

Through a possible bug in PHP running on Windows systems a NULL - byte can truncate the pattern string allowing an attacker to - inject the /e modifier causing the preg_replace function to - execute its second argument as PHP code.

-
-
-

Fixed filtering of a file path in the MIME-type transformation - code, which allowed for directory traversal.

-
- - - - CVE-2011-2505 - CVE-2011-2506 - CVE-2011-2507 - CVE-2011-2508 - http://www.phpmyadmin.net/home_page/security/PMASA-2011-5.php - http://www.phpmyadmin.net/home_page/security/PMASA-2011-6.php - http://www.phpmyadmin.net/home_page/security/PMASA-2011-7.php - http://www.phpmyadmin.net/home_page/security/PMASA-2011-8.php - - - 2011-07-02 - 2011-07-03 - 2011-07-28 - - - - - Asterisk -- multiple vulnerabilities - - - asterisk14 - 1.4.*1.4.41.2 - - - asterisk16 - 1.6.*1.6.2.18.2 - - - asterisk18 - 1.8.*1.8.4.4 - - - - -

The Asterisk Development Team reports:

-
-

AST-2011-008: If a remote user sends a SIP packet containing a - NULL, Asterisk assumes available data extends past the null to - the end of the packet when the buffer is actually truncated when - copied. This causes SIP header parsing to modify data past the - end of the buffer altering unrelated memory structures. This - vulnerability does not affect TCP/TLS connections.

-

AST-2011-009: A remote user sending a SIP packet containing a - Contact header with a missing left angle bracket causes Asterisk - to access a null pointer.

-

AST-2011-010: A memory address was inadvertently transmitted - over the network via IAX2 via an option control frame and the - remote party would try to access it.

-

Possible enumeration of SIP users due to differing - authentication responses.

-
- - - - CVE-2011-2529 - CVE-2011-2535 - CVE-2011-2536 - http://downloads.asterisk.org/pub/security/AST-2011-008.html - http://downloads.asterisk.org/pub/security/AST-2011-009.html - http://downloads.asterisk.org/pub/security/AST-2011-010.html - http://downloads.asterisk.org/pub/security/AST-2011-011.html - - - 2011-06-24 - 2011-06-25 - 2011-06-29 - - - - - ejabberd -- remote denial of service vulnerability - - - ejabberd - 2.1.7 - - - - -

It's reported in CVE advisory that:

-
-

expat_erl.c in ejabberd before 2.1.7 and 3.x before - 3.0.0-alpha-3, and exmpp before 0.9.7, does not properly detect - recursion during entity expansion, which allows remote attackers - to cause a denial of service (memory and CPU consumption) via a - crafted XML document containing a large number of nested entity - references, a similar issue to CVE-2003-1564.

-
- - - - CVE-2011-1753 - http://www.ejabberd.im/ejabberd-2.1.7 - - - 2011-04-27 - 2011-06-24 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 3.5.*,13.5.20,1 - 3.6.*,13.6.18,1 - 4.0.*,15.0,1 - - - linux-firefox - 3.6.18,1 - - - thunderbird - 3.1.11 - - - linux-thunderbird - 3.1.11 - - - - -

The Mozilla Project reports:

-
-

MFSA 2011-19 Miscellaneous memory safety hazards - (rv:3.0/1.9.2.18)

-

MFSA 2011-20 Use-after-free vulnerability when viewing XUL - document with script disabled

-

MFSA 2011-21 Memory corruption due to multipart/x-mixed-replace - images

-

MFSA 2011-22 Integer overflow and arbitrary code execution in - Array.reduceRight()

-

MFSA 2011-23 Multiple dangling pointer vulnerabilities

-

MFSA 2011-24 Cookie isolation error

-

MFSA 2011-25 Stealing of cross-domain images using WebGL - textures

-

MFSA 2011-26 Multiple WebGL crashes

-

MFSA 2011-27 XSS encoding hazard with inline SVG

-

MFSA 2011-28 Non-whitelisted site can trigger xpinstall

-
- - - - http://www.mozilla.org/security/announce/2011/mfsa2011-19.html - http://www.mozilla.org/security/announce/2011/mfsa2011-20.html - http://www.mozilla.org/security/announce/2011/mfsa2011-21.html - http://www.mozilla.org/security/announce/2011/mfsa2011-22.html - http://www.mozilla.org/security/announce/2011/mfsa2011-23.html - http://www.mozilla.org/security/announce/2011/mfsa2011-24.html - http://www.mozilla.org/security/announce/2011/mfsa2011-25.html - http://www.mozilla.org/security/announce/2011/mfsa2011-26.html - http://www.mozilla.org/security/announce/2011/mfsa2011-27.html - http://www.mozilla.org/security/announce/2011/mfsa2011-28.html - - - 2011-06-21 - 2011-06-21 - 2011-06-23 - - - - - Samba -- Denial of service - memory corruption - - - samba34 - 3.4.*3.4.12 - - - samba35 - 3.5.*3.5.7 - - - - -

The Samba team reports:

-
-

Samba is vulnerable to a denial of service, caused by a memory - corruption error related to missing range checks on file - descriptors being used in the "FD_SET" macro. By performing a - select on a bad file descriptor set, a remote attacker could - exploit this vulnerability to cause the application to crash or - possibly execute arbitrary code on the system.

-
- - - - CVE-2011-0719 - http://www.samba.org/samba/security/CVE-2011-0719.html - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0719 - - - 2011-02-28 - 2011-06-21 - - - - - Piwik -- remote command execution vulnerability - - - piwik - 1.21.5 - - - - -

The Piwik security advisory reports:

-
-

The Piwik 1.5 release addresses a critical security - vulnerability, which affect all Piwik users that have let - granted some access to the "anonymous" user.

-

Piwik contains a remotely exploitable vulnerability that could - allow a remote attacker to execute arbitrary code. Only - installations that have granted untrusted view access to their - stats (ie. grant "view" access to a website to anonymous) are - at risk.

-
- - - - ports/158084 - http://piwik.org/blog/2011/06/piwik-1-5-security-advisory/ - - - 2011-06-21 - 2011-06-21 - - - - - Dokuwiki -- cross site scripting vulnerability - - - dokuwiki - 20110525a - - - - -

Dokuwiki reports:

-
-

We just released a Hotfix Release "2011-05-25a Rincewind". - It contains the following changes:

-

Security fix for a Cross Site Scripting vulnerability. - Malicious users could abuse DokuWiki's RSS embedding mechanism - to create links containing arbitrary JavaScript. Note: this - security problem is present in at least Anteater and Rincewind - but probably in older releases as well.

-
- - - - http://www.freelists.org/post/dokuwiki/Hotfix-Release-20110525a-Rincewind - - - 2011-06-14 - 2011-06-20 - - - - - linux-flashplugin -- remote code execution vulnerability - - - linux-flashplugin - 9.0r289 - - - linux-f10-flashplugin - 10.3r181.26 - - - - -

Adobe Product Security Incident Response Team reports:

-
-

A critical vulnerability has been identified in Adobe Flash - Player 10.3.181.23 and earlier versions for Windows, Macintosh, - Linux and Solaris, and Adobe Flash Player 10.3.185.23 and - earlier versions for Android. This memory corruption - vulnerability (CVE-2011-2110) could cause a crash and - potentially allow an attacker to take control of the affected - system. There are reports that this vulnerability is being - exploited in the wild in targeted attacks via malicious Web - pages.

-
- - - - CVE-2011-2110 - http://www.adobe.com/support/security/bulletins/apsb11-18.html - - - 2011-05-13 - 2011-06-15 - - - - - ikiwiki -- tty hijacking via ikiwiki-mass-rebuild - - - ikiwiki - 3.20110608 - - - - -

The IkiWiki development team reports:

-
-

Ludwig Nussel discovered a way for users to hijack root's tty - when ikiwiki-mass-rebuild was run. Additionally, there was - some potential for information disclosure via symlinks.

-
- - - - CVE-2011-1408 - http://ikiwiki.info/security/#index40h2 - - - 2011-06-08 - 2011-06-15 - - - - - linux-flashplugin -- cross-site scripting vulnerability - - - linux-flashplugin - 9.0r289 - - - linux-f10-flashplugin - 10.3r181.22 - - - - -

Adobe Product Security Incident Response Team reports:

-
-

An important vulnerability has been identified in Adobe - Flash Player 10.3.181.16 and earlier versions for Windows, - Macintosh, Linux and Solaris, and Adobe Flash Player - 10.3.185.22 and earlier versions for Android. This universal - cross-site scripting vulnerability (CVE-2011-2107) could be - used to take actions on a user's behalf on any website or - webmail provider, if the user visits a malicious website. - There are reports that this vulnerability is being exploited - in the wild in active targeted attacks designed to trick - the user into clicking on a malicious link delivered in an - email message.

-
- - - - CVE-2011-2107 - http://www.adobe.com/support/security/bulletins/apsb11-13.html - - - 2011-05-13 - 2011-06-08 - - - - - BIND -- Large RRSIG RRsets and Negative Caching DoS - - - bind9-sdb-ldap - bind9-sdb-postgresql - 9.4.3.4 - - - bind96 - 9.6.3.1.ESV.R4.1 - - - bind97 - 9.7.3.1 - - - bind98 - 9.8.0.2 - - - FreeBSD - 7.37.3_6 - 7.47.4_2 - 8.18.1_4 - 8.28.2_2 - - - - -

ISC reports:

-
-

A BIND 9 DNS server set up to be a caching resolver is - vulnerable to a user querying a domain with very large resource - record sets (RRSets) when trying to negatively cache a response. - This can cause the BIND 9 DNS server (named process) to crash.

-
- - - - CVE-2011-1910 - SA-11:02.bind - http://www.isc.org/software/bind/advisories/cve-2011-1910 - - - 2011-05-26 - 2011-06-04 - 2016-08-09 - - - - - fetchmail -- STARTTLS denial of service - - - fetchmail - 6.3.20 - - - - -

Matthias Andree reports:

-
-

Fetchmail version 5.9.9 introduced STLS support for POP3, - version 6.0.0 added STARTTLS for IMAP. However, the actual - S(TART)TLS-initiated in-band SSL/TLS negotiation was not guarded - by a timeout.

-

Depending on the operating system defaults as to TCP stream - keepalive mode, fetchmail hangs in excess of one week after - sending STARTTLS were observed if the connection failed without - notifying the operating system, for instance, through network - outages or hard server crashes.

-

A malicious server that does not respond, at the network level, - after acknowledging fetchmail's STARTTLS or STLS request, can - hold fetchmail in this protocol state, and thus render fetchmail - unable to complete the poll, or proceed to the next server, - effecting a denial of service.

-

SSL-wrapped mode on dedicated ports was unaffected by this - problem, so can be used as a workaround.

-
- - - - CVE-2011-1947 - http://www.fetchmail.info/fetchmail-SA-2011-01.txt - https://gitorious.org/fetchmail/fetchmail/commit/7dc67b8cf06f74aa57525279940e180c99701314 - - - 2011-04-28 - 2011-06-06 - - - - - asterisk -- Remote crash vulnerability - - - asterisk18 - 1.8.*1.8.4.2 - - - - -

The Asterisk Development Team reports:

-
-

If a remote user initiates a SIP call and the recipient picks - up, the remote user can reply with a malformed Contact header - that Asterisk will improperly handle and cause a crash due to a - segmentation fault.

-
- - - - CVE-2011-2216 - http://downloads.asterisk.org/pub/security/AST-2011-007.pdf - - - 2011-06-02 - 2011-06-02 - - - - - Subversion -- multiple vulnerabilities - - - subversion - 1.6.17 - - - subversion-freebsd - 1.6.17 - - - - -

Subversion team reports:

-
-

Subversion's mod_dav_svn Apache HTTPD server module will - dereference a NULL pointer if asked to deliver baselined WebDAV - resources.

-

This can lead to a DoS. An exploit has been tested, and tools - or users have been observed triggering this problem in the - wild.

-
-
-

Subversion's mod_dav_svn Apache HTTPD server module may in - certain scenarios enter a logic loop which does not exit and - which allocates memory in each iteration, ultimately exhausting - all the available memory on the server.

-

This can lead to a DoS. There are no known instances of this - problem being observed in the wild, but an exploit has been - tested.

-
-
-

Subversion's mod_dav_svn Apache HTTPD server module may leak to - remote users the file contents of files configured to be - unreadable by those users.

-

There are no known instances of this problem being observed in - the wild, but an exploit has been tested.

-
- - - - CVE-2011-1752 - CVE-2011-1783 - CVE-2011-1921 - - - 2011-05-28 - 2011-06-02 - - - - - drupal6 -- multiple vulnerabilities - - - drupal6 - 6.22 - - - - -

Drupal Team reports:

-
-

A reflected cross site scripting vulnerability was discovered - in Drupal's error handler. Drupal displays PHP errors in the - messages area, and a specially crafted URL can cause malicious - scripts to be injected into the message. The issue can be - mitigated by disabling on-screen error display at admin / - settings / error-reporting. This is the recommended setting - for production sites.

-

When using re-colorable themes, color inputs are not sanitized. - Malicious color values can be used to insert arbitrary CSS and - script code. Successful exploitation requires the "Administer - themes" permission.

-
- - - - http://drupal.org/node/1168756 - - - 2011-05-25 - 2011-05-26 - - - - - Erlang -- ssh library uses a weak random number generator - - - erlang - r14b03 - - - - -

US-CERT reports:

-
-

The Erlang/OTP ssh library implements a number of - cryptographic operations that depend on cryptographically - strong random numbers. Unfortunately the RNG used by the - library is not cryptographically strong, and is further - weakened by the use of predictable seed material. The RNG - (Wichman-Hill) is not mixed with an entropy source.

-
- - - - CVE-2011-0766 - http://www.erlang.org/download/otp_src_R14B03.readme - https://github.com/erlang/otp/commit/f228601de45c5b53241b103af6616453c50885a5 - - - 2011-05-25 - 2011-05-25 - - - - - Unbound -- an empty error packet handling assertion failure - - - unbound - 1.4.10 - - - - -

Unbound developer reports:

-
-

NLnet Labs was notified of an error in Unbound's code-path - for error replies which is triggered under special conditions. - The error causes the program to abort.

-
- - - - CVE-2011-1922 - http://unbound.nlnetlabs.nl/downloads/CVE-2011-1922.txt - - - 2011-05-25 - 2011-05-25 - - - - - Pubcookie Login Server -- XSS vulnerability - - - pubcookie-login-server - 3.3.2d - - - - -

Nathan Dors, Pubcookie Project reports:

-
-

A new non-persistent XSS vulnerability was found in the - Pubcookie login server's compiled binary "index.cgi" CGI - program. The CGI program mishandles untrusted data when - printing responses to the browser. This makes the program - vulnerable to carefully crafted requests containing script - or HTML. If an attacker can lure an unsuspecting user to - visit carefully staged content, the attacker can use it to - redirect the user to his or her local Pubcookie login page - and attempt to exploit the XSS vulnerability.

-
- - - - http://pubcookie.org/news/20070606-login-secadv.html - - - 2007-05-25 - 2011-05-23 - - - - - mod_pubcookie -- Empty Authentication Security Advisory - - - ap20-mod_pubcookie - 3.1.03.3.2b - - - - -

Nathan Dors, Pubcookie Project reports:

-
-

An Abuse of Functionality vulnerability in the Pubcookie - authentication process was found. This vulnerability allows an - attacker to appear as if he or she were authenticated using an - empty userid when such a userid isn't expected. Unauthorized - access to web content and applications may result where access - is restricted to users who can authenticate successfully but - where no additional authorization is performed after - authentication.

-
- - - - http://pubcookie.org/news/20061106-empty-auth-secadv.html - - - 2006-10-04 - 2011-05-23 - - - - - ViewVC -- user-reachable override of cvsdb row limit - - - viewvc - 1.1.11 - - - - -

ViewVC.org reports:

-
-

Security fix: remove user-reachable override of cvsdb row limit.

-
- - - - http://viewvc.tigris.org/source/browse/*checkout*/viewvc/branches/1.1.x/CHANGES - - - 2011-05-17 - 2011-05-23 - - - - - Apache APR -- DoS vulnerabilities - - - apr1 - 1.4.5.1.3.12 - - - - -

The Apache Portable Runtime Project reports:

-
-

A flaw was discovered in the apr_fnmatch() function in the - Apache Portable Runtime (APR) library 1.4.4 (or any backported - versions that contained the upstream fix for CVE-2011-0419). - This could cause httpd workers to enter a hung state (100% CPU - utilization).

-

apr-util 1.3.11 could cause crashes with httpd's - mod_authnz_ldap in some situations.

-
- - - - 47929 - CVE-2011-1928 - CVE-2011-0419 - http://www.apache.org/dist/apr/Announcement1.x.html - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-1928 - - - 2011-05-19 - 2011-05-23 - - - - - linux-flashplugin -- multiple vulnerabilities - - - linux-flashplugin - 9.0r289 - - - linux-f10-flashplugin - 10.3r181.14 - - - - -

Adobe Product Security Incident Response Team reports:

-
-

Critical vulnerabilities have been identified in Adobe Flash - Player 10.2.159.1 and earlier versions (Adobe Flash Player - 10.2.154.28 and earlier for Chrome users) for Windows, - Macintosh, Linux and Solaris, and Adobe Flash Player 10.2.157.51 - and earlier versions for Android. These vulnerabilities could - cause the application to crash and could potentially allow an - attacker to take control of the affected system. There are - reports of malware attempting to exploit one of the - vulnerabilities, CVE-2011-0627, in the wild via a Flash (.swf) - file embedded in a Microsoft Word (.doc) or Microsoft Excel - (.xls) file delivered as an email attachment targeting the - Windows platform. However, to date, Adobe has not obtained a - sample that successfully completes an attack.

-
- - - - CVE-2011-0579 - CVE-2011-0618 - CVE-2011-0619 - CVE-2011-0620 - CVE-2011-0621 - CVE-2011-0622 - CVE-2011-0623 - CVE-2011-0624 - CVE-2011-0625 - CVE-2011-0626 - CVE-2011-0627 - http://www.adobe.com/support/security/bulletins/apsb11-12.html - - - 2011-01-20 - 2011-05-23 - - - - - Opera -- code injection vulnerability through broken frameset handling - - opera11.11 - opera-devel11.11 - linux-opera11.11 - - - -

Opera Software ASA reports:

-
-

Fixed an issue with framesets that could allow execution of - arbitrary code, as reported by an anonymous contributor working - with the SecuriTeam Secure Disclosure program.

-
- - - - http://www.opera.com/docs/changelogs/unix/1111/ - http://www.opera.com/support/kb/view/992/ - - - 2011-05-18 - 2011-05-23 - - - - - pureftpd -- multiple vulnerabilities - - - pure-ftpd - 1.0.32 - - - - -

Pure-FTPd development team reports:

-
-

Support for braces expansion in directory listings has been - disabled -- Cf. CVE-2011-0418.

-

Fix a STARTTLS flaw similar to Postfix's CVE-2011-0411. - If you're using TLS, upgrading is recommended.

-
- - - - 46767 - CVE-2011-0418 - CVE-2011-1575 - - - 2011-04-01 - 2011-05-23 - - - - - Exim -- remote code execution and information disclosure - - - exim - 4.704.76 - - - - -

Release notes for Exim 4.76 says:

-
-

Bugzilla 1106: CVE-2011-1764 - DKIM log line was subject to - a format-string attack -- SECURITY: remote arbitrary code - execution.

-

DKIM signature header parsing was double-expanded, second - time unintentionally subject to list matching rules, letting - the header cause arbitrary Exim lookups (of items which can - occur in lists, *not* arbitrary string expansion). This - allowed for information disclosure.

-
-

Also, impact assessment was redone shortly after the original - announcement:

-
-

Further analysis revealed that the second security was - more severe than I realised at the time that I wrote the - announcement. The second security issue has been assigned - CVE-2011-1407 and is also a remote code execution flaw. - For clarity: both issues were introduced with 4.70.

-
- - - - CVE-2011-1764 - CVE-2011-1407 - https://lists.exim.org/lurker/message/20110512.102909.8136175a.en.html - http://bugs.exim.org/show_bug.cgi?id=1106 - - - 2011-05-10 - 2011-05-14 - - - - - Apache APR -- DoS vulnerabilities - - - apr1 - 1.4.4.1.3.11 - - - - -

The Apache Portable Runtime Project reports:

-
-

Note especially a security fix to APR 1.4.4, excessive CPU - consumption was possible due to an unconstrained, recursive - invocation of apr_fnmatch, as apr_fnmatch processed '*' wildcards. - Reimplement apr_fnmatch() from scratch using a non-recursive - algorithm now has improved compliance with the fnmatch() spec. - (William Rowe)

-
- - - - CVE-2011-0419 - http://www.apache.org/dist/apr/Announcement1.x.html - - - 2011-05-10 - 2011-05-12 - - - - - Zend Framework -- potential SQL injection when using PDO_MySql - - - ZendFramework - 1.11.6 - - - - -

The Zend Framework team reports:

-
-

Developers using non-ASCII-compatible encodings in conjunction - with the MySQL PDO driver of PHP may be vulnerable to SQL - injection attacks. Developers using ASCII-compatible encodings - like UTF8 or latin1 are not affected by this PHP issue.

-
- - - - http://framework.zend.com/security/advisory/ZF2011-02 - http://zend-framework-community.634137.n4.nabble.com/Zend-Framework-1-11-6-and-1-10-9-released-td3503741.html - - - 2011-05-06 - 2011-05-13 - - - - - mediawiki -- multiple vulnerabilities - - - mediawiki - 1.16.5 - - - - -

Mediawiki reports:

-
-

(Bug 28534) XSS vulnerability for IE 6 clients. This is the - third attempt at fixing bug 28235.

-

(Bug 28639) Potential privilege escalation when - $wgBlockDisablesLogin is enabled.

-
- - - - https://bugzilla.wikimedia.org/show_bug.cgi?id=28534 - https://bugzilla.wikimedia.org/show_bug.cgi?id=28639 - http://lists.wikimedia.org/pipermail/mediawiki-announce/2011-May/000098.html - http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_16_5/phase3/RELEASE-NOTES - - - 2011-04-14 - 2011-05-12 - - - - - Postfix -- memory corruption vulnerability - - - postfix - postfix-base - 2.8.*,12.8.3,1 - 2.7.*,12.7.4,1 - 2.6.*,12.6.10,1 - 2.5.*,22.5.13,2 - 2.4.16,1 - - - postfix-current - postfix-current-base - 2.9.20110501,4 - - - - -

The Postfix SMTP server has a memory corruption error, when the - Cyrus SASL library is used with authentication mechanisms other - than PLAIN and LOGIN (ANONYMOUS is not affected, but should not - be used for other reasons). This memory corruption is known to - result in a program crash (SIGSEV).

- - - - CVE-2011-1720 - http://www.postfix.org/CVE-2011-1720.html - - - 2011-05-09 - 2011-05-09 - - - - - Mozilla -- multiple vulnerabilities - - - firefox - 3.6.*,13.6.17,1 - 3.5.*,13.5.19,1 - 4.0.*,14.0.1,1 - - - libxul - 1.9.2.*1.9.2.17 - - - linux-firefox - 3.6.17,1 - - - linux-firefox-devel - 3.5.19 - - - linux-seamonkey - 2.0.*2.0.14 - - - seamonkey - 2.0.*2.0.14 - - - - -

The Mozilla Project reports:

-
-

MFSA 2011-12 Miscellaneous memory safety hazards

-

MFSA 2011-13 Multiple dangling pointer vulnerabilities

-

MFSA 2011-14 Information stealing via form history

-

MFSA 2011-15 Escalation of privilege through Java Embedding Plugin

-

MFSA 2011-16 Directory traversal in resource: protocol

-

MFSA 2011-17 WebGLES vulnerabilities

-

MFSA 2011-18 XSLT generate-id() function heap address leak

-
- - - - http://www.mozilla.org/security/announce/2011/mfsa2011-12.html - http://www.mozilla.org/security/announce/2011/mfsa2011-13.html - http://www.mozilla.org/security/announce/2011/mfsa2011-14.html - http://www.mozilla.org/security/announce/2011/mfsa2011-15.html - http://www.mozilla.org/security/announce/2011/mfsa2011-16.html - http://www.mozilla.org/security/announce/2011/mfsa2011-17.html - http://www.mozilla.org/security/announce/2011/mfsa2011-18.html - - - 2011-04-28 - 2011-04-29 - - - - - Asterisk -- multiple vulnerabilities - - - asterisk14 - 1.4.*1.4.40.1 - - - asterisk16 - 1.6.*1.6.2.17.3 - - - asterisk18 - 1.8.*1.8.3.3 - - - - -

The Asterisk Development Team reports:

-
-

It is possible for a user of the Asterisk Manager Interface to - bypass a security check and execute shell commands when they - should not have that ability. Sending the "Async" header with - the "Application" header during an Originate action, allows - authenticated manager users to execute shell commands. Only - users with the "system" privilege should be able to do this.

-

On systems that have the Asterisk Manager Interface, Skinny, SIP - over TCP, or the built in HTTP server enabled, it is possible for - an attacker to open as many connections to asterisk as he wishes. - This will cause Asterisk to run out of available file descriptors - and stop processing any new calls. Additionally, disk space can - be exhausted as Asterisk logs failures to open new file - descriptors.

-
- - - - CVE-2011-1507 - http://downloads.asterisk.org/pub/security/AST-2011-005.pdf - http://downloads.asterisk.org/pub/security/AST-2011-006.pdf - - - 2011-04-21 - 2011-04-21 - - - - - VLC -- Heap corruption in MP4 demultiplexer - - - vlc - 1.0.01.1.9 - - - - -

VideoLAN project reports:

-
-

When parsing some MP4 (MPEG-4 Part 14) files, insufficient - buffer size might lead to corruption of the heap.

-
- - - - http://www.videolan.org/security/sa1103.html - - - 2011-04-07 - 2011-04-17 - - - - - linux-flashplugin -- remote code execution vulnerability - - - linux-flashplugin - 9.0r289 - - - linux-f10-flashplugin - 10.2r159.1 - - - - -

Adobe Product Security Incident Response Team reports:

-
-

A critical vulnerability exists in Flash Player 10.2.153.1 - and earlier versions (Adobe Flash Player 10.2.154.25 and - earlier for Chrome users) for Windows, Macintosh, Linux - and Solaris, Adobe Flash Player 10.2.156.12 and earlier - versions for Android, and the Authplay.dll component that - ships with Adobe Reader and Acrobat X (10.0.2) and earlier - 10.x and 9.x versions for Windows and Macintosh operating - systems.

-

This vulnerability (CVE-2011-0611) could cause a crash - and potentially allow an attacker to take control of the - affected system. There are reports that this vulnerability - is being exploited in the wild in targeted attacks via a - malicious Web page or a Flash (.swf) file embedded in a - Microsoft Word (.doc) or Microsoft Excel (.xls) file - delivered as an email attachment, targeting the Windows - platform. At this time, Adobe is not aware of any attacks - via PDF targeting Adobe Reader and Acrobat. Adobe Reader - X Protected Mode mitigations would prevent an exploit of - this kind from executing.

-
- - - - CVE-2011-0611 - http://www.adobe.com/support/security/advisories/apsa11-02.html - - - 2011-01-20 - 2011-04-17 - - - - - rt -- multiple vulnerabilities - - - rt36 - 3.6.11 - - - rt38 - 3.8.10 - - - - -

Best Practical reports:

-
-

In the process of preparing the release of RT 4.0.0, we performed - an extensive security audit of RT's source code. During this - audit, several vulnerabilities were found which affect earlier - releases of RT.

-
- - - - CVE-2011-1685 - CVE-2011-1686 - CVE-2011-1687 - CVE-2011-1688 - CVE-2011-1689 - CVE-2011-1690 - http://secunia.com/advisories/44189 - - - 2011-04-14 - 2011-04-17 - - - - - krb5 -- MITKRB5-SA-2011-004, kadmind invalid pointer free() [CVE-2011-0285] - - - krb5 - 1.71.7.2 - 1.81.8.4 - 1.9 - - - - -

An advisory published by the MIT Kerberos team says:

-
-

The password-changing capability of the MIT krb5 administration - daemon (kadmind) has a bug that can cause it to attempt to free() - an invalid pointer under certain error conditions. This can cause - the daemon to crash or induce the execution of arbitrary code - (which is believed to be difficult). No exploit that executes - arbitrary code is known to exist, but it is easy to trigger a - denial of service manually.

-

Some platforms detect attempted freeing of invalid pointers and - protectively terminate the process, preventing arbitrary code - execution on those platforms.

-
- - - - CVE-2011-0285 - http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-004.txt - - - 2011-04-12 - 2011-04-14 - - - - - krb5 -- MITKRB5-SA-2011-003, KDC vulnerable to double-free when PKINIT enabled - - - krb5 - 1.71.7.2 - 1.81.8.4 - 1.9 - - - - -

An advisory published by the MIT Kerberos team says:

-
-

The MIT Kerberos 5 Key Distribution Center (KDC) daemon is - vulnerable to a double-free condition if the Public Key - Cryptography for Initial Authentication (PKINIT) capability is - enabled, resulting in daemon crash or arbitrary code execution - (which is believed to be difficult).

-

An unauthenticated remote attacker can induce a double-free - event, causing the KDC daemon to crash (denial of service), - or to execute arbitrary code. Exploiting a double-free event - to execute arbitrary code is believed to be difficult.

-
- - - - CVE-2011-0284 - http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-003.txt - - - 2011-03-15 - 2011-04-14 - - - - - krb5 -- MITKRB5-SA-2011-002, KDC vulnerable to hang when using LDAP back end - - - krb5 - 1.71.7.2 - 1.81.8.4 - 1.9 - - - - -

An advisory published by the MIT Kerberos team says:

-
-

The MIT krb5 Key Distribution Center (KDC) daemon is vulnerable - to denial of service attacks from unauthenticated remote - attackers. CVE-2011-0281 and CVE-2011-0282 occur only in KDCs - using LDAP back ends, but CVE-2011-0283 occurs in all krb5-1.9 - KDCs.

-

Exploit code is not known to exist, but the vulnerabilities are - easy to trigger manually. The trigger for CVE-2011-0281 has - already been disclosed publicly, but that fact might not be - obvious to casual readers of the message in which it was - disclosed. The triggers for CVE-2011-0282 and CVE-2011-0283 - have not yet been disclosed publicly, but they are also - trivial.

-

CVE-2011-0281: An unauthenticated remote attacker can cause a KDC - configured with an LDAP back end to become completely unresponsive - until restarted.

-

CVE-2011-0282: An unauthenticated remote attacker can cause a KDC - configured with an LDAP back end to crash with a null pointer - dereference.

-

CVE-2011-0283: An unauthenticated remote attacker can cause a - krb5-1.9 KDC with any back end to crash with a null pointer - dereference.

-
- - - - CVE-2011-0281 - CVE-2011-0282 - CVE-2011-0283 - http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-002.txt - - - 2011-02-08 - 2011-04-14 - - - - - krb5 -- MITKRB5-SA-2011-001, kpropd denial of service - - - krb5 - 1.71.7.2 - 1.81.8.4 - 1.9 - - - - -

An advisory published by the MIT Kerberos team says:

-
-

The MIT krb5 KDC database propagation daemon (kpropd) is - vulnerable to a denial-of-service attack triggered by invalid - network input. If a kpropd worker process receives invalid - input that causes it to exit with an abnormal status, it can - cause the termination of the listening process that spawned it, - preventing the slave KDC it was running on from receiving - database updates from the master KDC.

-

Exploit code is not known to exist, but the vulnerabilities are - easy to trigger manually.

-

An unauthenticated remote attacker can cause kpropd running in - standalone mode (the "-S" option) to terminate its listening - process, preventing database propagations to the KDC host on - which it was running. Configurations where kpropd runs in - incremental propagation mode ("iprop") or as an inetd server - are not affected.

-
- - - - CVE-2010-4022 - http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-001.txt - - - 2011-02-08 - 2011-04-14 - - - - - xrdb -- root hole via rogue hostname - - - xrdb - 1.0.6_1 - - - - -

Matthias Hopf reports:

-
-

By crafting hostnames with shell escape characters, arbitrary - commands can be executed in a root environment when a display - manager reads in the resource database via xrdb.

-

These specially crafted hostnames can occur in two environments:

-

Systems are affected are: systems set their hostname via DHCP, - and the used DHCP client allows setting of hostnames with illegal - characters. And systems that allow remote logins via xdmcp.

-
- - - - CVE-2011-0465 - http://lists.freedesktop.org/archives/xorg-announce/2011-April/001636.html - - - 2011-04-05 - 2011-04-14 - - - - - OTRS -- Several XSS attacks possible - - - otrs - 2.3.*3.0.7 - - - - -

OTRS Security Advisory reports:

-
-
    -
  • Several XSS attacks possible: - An attacker could trick a logged in user to following a prepared - URL inside of the OTRS system which causes a page to be shown that - possibly includes malicious !JavaScript code because of incorrect - escaping during the generation of the HTML page.
    • -
-
- - - - CVE-2011-1518 - http://otrs.org/advisory/OSA-2011-01-en/ - - - 2011-03-12 - 2011-04-12 - - - - - isc-dhcp-client -- dhclient does not strip or escape shell meta-characters - - - isc-dhcp31-client - 3.1.ESV_1,1 - - - isc-dhcp41-client - 4.1.e,2 - - - - -

ISC reports:

-
-

ISC dhclient did not strip or escape certain shell meta-characters - in responses from the dhcp server (like hostname) before passing the - responses on to dhclient-script. Depending on the script and OS, - this can result in execution of exploit code on the client. -

-
- - - - CVE-2011-0997 - 107886 - - - 2011-04-05 - 2011-04-10 - - - - - tinyproxy -- ACL lists ineffective when range is configured - - - tinyproxy - 1.8.2_2,1 - - - - -

When including a line to allow a network of IP addresses, the access to tinyproxy - 56 is actually allowed for all IP addresses.

- - - - CVE-2011-1499 - https://banu.com/bugzilla/show_bug.cgi?id=90 - - - 2010-05-18 - 2011-04-08 - - - - - quagga -- two DoS vulnerabilities - - - quagga - 0.99.17_6 - - - - -

Quagga developers report:

-
-

Quagga 0.99.18 has been released. - This release fixes 2 denial of services in bgpd, which can be - remotely triggered by malformed AS-Pathlimit or Extended-Community - attributes. These issues have been assigned CVE-2010-1674 and - CVE-2010-1675. Support for AS-Pathlimit has been removed with this - release. -

-
- - - - CVE-2010-1674 - CVE-2010-1675 - http://www.quagga.net/news2.php?y=2011&m=3&d=21#id1300723200 - - - 2010-04-30 - 2011-04-01 - - - - - gdm -- privilege escalation vulnerability - - - gdm - 2.30.5_2 - - - - -

Sebastian Krahmer reports:

-
-

It was discovered that the GNOME Display Manager (gdm) cleared the cache - directory, which is owned by an unprivileged user, with the privileges of the - root user. A race condition exists in gdm where a local user could take - advantage of this by writing to the cache directory between ending the session - and the signal to clean up the session, which could lead to the execution of - arbitrary code as the root user.

-
- - - - CVE-2011-0727 - http://mail.gnome.org/archives/distributor-list/2011-March/msg00008.html - https://bugzilla.redhat.com/show_bug.cgi?id=688323 - - - 2011-03-28 - 2011-03-29 - - - - - php -- ZipArchive segfault with FL_UNCHANGED on empty archive - - - php5-zip - 5.3.6 - - - - -

US-CERT/NIST reports:

-
-

The _zip_name_locate function in zip_name_locate.c in the Zip extension - in PHP before 5.3.6 does not properly handle a ZIPARCHIVE::FL_UNCHANGED - argument, which might allow context-dependent attackers to cause a - denial of service (application crash) via an empty ZIP archive that is - processed with a (1) locateName or (2) statName operation.

-
- - - - CVE-2011-0421 - - - 2011-03-20 - 2011-03-25 - - - - - php -- crash on crafted tag in exif - - - php5-exif - 5.3.6 - - - - -

US-CERT/NIST reports:

-
-

exif.c in the Exif extension in PHP before 5.3.6 on 64-bit platforms - performs an incorrect cast, which allows remote attackers to cause a - denial of service (application crash) via an image with a crafted - Image File Directory (IFD) that triggers a buffer over-read.

-
- - - - CVE-2011-0708 - - - 2011-03-20 - 2011-03-25 - - - - - linux-flashplugin -- remote code execution vulnerability - - - linux-flashplugin - 9.0r289 - - - linux-f8-flashplugin - linux-f10-flashplugin - 10.2r153 - - - - -

Adobe Product Security Incident Response Team reports:

-
-

A critical vulnerability exists in Adobe Flash Player - 10.2.152.33 and earlier versions (Adobe Flash Player - 10.2.154.18 and earlier for Chrome users) for Windows, - Macintosh, Linux and Solaris operating systems, Adobe - Flash Player 10.1.106.16 and earlier versions for Android, - and the Authplay.dll component that ships with Adobe Reader - and Acrobat X (10.0.1) and earlier 10.x and 9.x versions of - Reader and Acrobat for Windows and Macintosh operating systems.

-

This vulnerability (CVE-2011-0609) could cause a crash and - potentially allow an attacker to take control of the affected - system. There are reports that this vulnerability is being - exploited in the wild in targeted attacks via a Flash (.swf) - file embedded in a Microsoft Excel (.xls) file delivered as - an email attachment.

-
- - - - CVE-2011-0609 - http://www.adobe.com/support/security/advisories/apsa11-01.html - - - 2011-01-20 - 2011-03-24 - - - - - mozilla -- update to HTTPS certificate blacklist - - - firefox - 3.6.*,13.6.16,1 - 3.5.*,13.5.18,1 - - - libxul - 1.9.2.*1.9.2.16 - - - linux-firefox - 3.6.16,1 - - - linux-firefox-devel - 3.5.18 - - - linux-seamonkey - 2.0.*2.0.13 - - - seamonkey - 2.0.*2.0.13 - - - - -

The Mozilla Project reports:

-
-

MFSA 2011-11 Update to HTTPS certificate blacklist

-
- - - - http://www.mozilla.org/security/announce/2011/mfsa2011-11.html - - - 2011-03-22 - 2011-03-24 - - - - - postfix -- plaintext command injection with SMTP over TLS - - - postfix - postfix-base - 2.7.*,12.7.3,1 - 2.6.*,12.6.9,1 - 2.5.*,22.5.12,2 - 2.4.*,12.4.16,1 - - - postfix-current - postfix-current-base - 2.9.20100120,4 - - - - -

Wietse Venema has discovered a software flaw that allows - an attacker to inject client commands into an SMTP session - during the unprotected plaintext SMTP protocol phase, such - that the server will execute those commands during the SMTP- - over-TLS protocol phase when all communication is supposed - to be protected.

- - - - CVE-2011-0411 - http://www.postfix.org/CVE-2011-0411.html - http://secunia.com/advisories/43646/ - - - 2011-03-07 - 2011-03-19 - - - - - hiawatha -- integer overflow in Content-Length header parsing - - - hiawatha - 7.4_1 - - - - -

Hugo Leisink reports:

-
-

A bug has been found in version 7.4 of the Hiawatha webserver, - which could lead to a server crash. This is caused by an integer - overflow in the routine that reads the HTTP request. A too large - value of the Content-Length HTTP header results in an overflow.

-
- - - - http://www.hiawatha-webserver.org/weblog/16 - http://secunia.com/advisories/43660/ - http://securityvulns.com/Zdocument902.html - http://packetstormsecurity.org/files/99021/Hiawatha-WebServer-7.4-Denial-Of-Service.html - http://seclists.org/bugtraq/2011/Mar/65 - - - 2011-02-25 - 2011-03-17 - - - - - asterisk -- Multiple Vulnerabilities - - - asterisk16 - 1.6.*1.6.2.17.1 - - - asterisk18 - 1.8.*1.8.3.1 - - - - -

The Asterisk Development Team reports:

-
-

The releases of Asterisk 1.6.1.23, 1.6.2.17.1, and 1.8.3.1 - resolve two issues:

-
    -
  • Resource exhaustion in Asterisk Manager Interface - (AST-2011-003)
    • -
  • Remote crash vulnerability in TCP/TLS server - (AST-2011-004)
    • -
-

The issues and resolutions are described in the AST-2011-003 - and AST-2011-004 security advisories.

-
- - - - http://downloads.asterisk.org/pub/security/AST-2011-003.html - http://downloads.asterisk.org/pub/security/AST-2011-004.html - - - 2011-03-01 - 2011-03-16 - - - - - avahi -- denial of service - - - avahi - avahi-app - avahi-autoipd - avahi-gtk - avahi-libdns - avahi-qt3 - avahi-qt4 - avahi-sharp - 0.6.29 - - - - -

Avahi developers reports:

-
-

A vulnerability has been reported in Avahi, which can be exploited - by malicious people to cause a DoS (Denial of Service). - The vulnerability is caused due to an error when processing certain - UDP packets, which can be exploited to trigger an infinite loop by - e.g. sending an empty packet to port 5353/UDP.

-
- - - - CVE-2011-1002 - CVE-2010-2244 - http://secunia.com/advisories/43361/ - https://bugzilla.redhat.com/show_bug.cgi?id=667187 - - - 2011-02-21 - 2011-03-13 - - - - - mailman -- XSS vulnerability - - - mailman - 2.1.14_1 - - - - -

CVE reports:

-
-

Multiple cross-site scripting (XSS) vulnerabilities in - Cgi/confirm.py in GNU Mailman 2.1.14 and earlier allow remote - attackers to inject arbitrary web script or HTML via the (1) - full name or (2) username field in a confirmation message.

-
- - - - CVE-2011-0707 - http://mail.python.org/pipermail/mailman-announce/2011-February/000157.html - - - 2011-02-13 - 2011-03-10 - - - - - redmine -- XSS vulnerability - - - redmine - 1.01.1.2 - - - - -

Jean-Philippe Lang reports:

-
-

This maintenance release for 1.1.x users includes - 13 bug fixes since 1.1.1 and a security fix (XSS - vulnerability affecting all Redmine versions from - 1.0.1 to 1.1.1). -

-
- - - - http://www.redmine.org/news/53 - - - 2011-03-07 - 2011-03-07 - - - - - subversion -- remote HTTP DoS vulnerability - - - subversion - 1.61.6.15 - 1.51.6.9 - - - subversion-freebsd - 1.61.6.15 - 1.51.6.9 - - - - -

Subversion project reports:

-
-

Subversion HTTP servers up to 1.5.9 (inclusive) or 1.6.15 (inclusive) - are vulnerable to a remotely triggerable NULL-pointer dereference.

-
- - - - CVE-2011-0715 - - - 2011-02-27 - 2011-03-05 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 3.6.*,13.6.14,1 - 3.5.*,13.5.17,1 - - - libxul - 1.9.2.*1.9.2.14 - - - linux-firefox - 3.6.14,1 - - - linux-firefox-devel - 3.5.17 - - - linux-seamonkey - 2.0.*2.0.12 - - - linux-thunderbird - 3.13.1.8 - - - seamonkey - 2.0.*2.0.12 - - - thunderbird - 3.1.8 - - - - -

The Mozilla Project reports:

-
-

MFSA 2011-01 Miscellaneous memory safety hazards (rv:1.9.2.14/ 1.9.1.17)

-

MFSA 2011-02 Recursive eval call causes confirm dialogs to evaluate to true

-

MFSA 2011-03 Use-after-free error in JSON.stringify

-

MFSA 2011-04 Buffer overflow in JavaScript upvarMap

-

MFSA 2011-05 Buffer overflow in JavaScript atom map

-

MFSA 2011-06 Use-after-free error using Web Workers

-

MFSA 2011-07 Memory corruption during text run construction (Windows)

-

MFSA 2011-08 ParanoidFragmentSink allows javascript: URLs in chrome documents

-

MFSA 2011-09 Crash caused by corrupted JPEG image

-

MFSA 2011-10 CSRF risk with plugins and 307 redirects

-
- - - - CVE-2010-1585 - CVE-2011-0051 - CVE-2011-0053 - CVE-2011-0054 - CVE-2011-0055 - CVE-2011-0056 - CVE-2011-0057 - CVE-2011-0058 - CVE-2011-0059 - CVE-2011-0061 - CVE-2011-0062 - https://www.mozilla.org/security/announce/2011/mfsa2011-01.html - https://www.mozilla.org/security/announce/2011/mfsa2011-02.html - https://www.mozilla.org/security/announce/2011/mfsa2011-03.html - https://www.mozilla.org/security/announce/2011/mfsa2011-04.html - https://www.mozilla.org/security/announce/2011/mfsa2011-05.html - https://www.mozilla.org/security/announce/2011/mfsa2011-06.html - https://www.mozilla.org/security/announce/2011/mfsa2011-07.html - https://www.mozilla.org/security/announce/2011/mfsa2011-08.html - https://www.mozilla.org/security/announce/2011/mfsa2011-09.html - https://www.mozilla.org/security/announce/2011/mfsa2011-10.html - - - 2011-03-01 - 2011-03-01 - - - - - openldap -- two security bypass vulnerabilities - - - openldap-server - 2.4.02.4.24 - - - - -

Secunia reports:

-
-

Two vulnerabilities have been reported in - OpenLDAP, which can be exploited by malicious - people to bypass certain security restrictions.

-

The vulnerabilities are reported in versions - prior to 2.4.24.

-
- - - - http://secunia.com/advisories/43331/ - - - 2011-02-14 - 2011-02-25 - - - - - asterisk -- Exploitable Stack and Heap Array Overflows - - - asterisk14 - 1.4.*1.4.39.2 - - - asterisk16 - 1.6.*1.6.2.16.2 - - - asterisk18 - 1.8.*1.8.2.4 - - - - -

The Asterisk Development Team reports:

-
-

The releases of Asterisk 1.4.39.2, 1.6.1.22, 1.6.2.16.2, and - 1.8.2.4 resolve an issue that when decoding UDPTL packets, multiple - heap based arrays can be made to overflow by specially - crafted packets. Systems configured for T.38 pass through or - termination are vulnerable. The issue and resolution are described - in the AST-2011-002 security advisory.

-
- - - - http://downloads.asterisk.org/pub/security/AST-2011-002.html - http://secunia.com/advisories/43429/ - - - 2011-02-21 - 2011-02-22 - - - - - PivotX -- administrator password reset vulnerability - - - pivotx - 2.2.4 - - - - -

US CERT reports:

-
-

PivotX contains a vulnerability that allows an - attacker to change the password of any account - just by guessing the username. Version 2.2.4 has - been reported to not be affected. - This vulnerability is being exploited in the wild - and users should immediately upgrade to 2.2.5 or - later. Mitigation steps for users that have been - compromised have been posted to the PivotX - Support Community.

-
- - - - CVE-2011-1035 - - - 2011-02-18 - 2011-02-20 - - - - - tomcat -- Cross-site scripting vulnerability - - - tomcat - 5.5.05.5.32 - - - tomcat - 6.0.06.0.30 - - - tomcat - 7.0.07.0.6 - - - - -

The Tomcat security team reports:

-
-

The HTML Manager interface displayed web applciation - provided data, such as display names, without filtering. - A malicious web application could trigger script execution - by an administartive user when viewing the manager pages.

-
- - - - CVE-2011-0013 - http://tomcat.apache.org/security-5.html#Fixed_in_Apache_Tomcat_5.5.32 - http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.30 - http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.6 - - - 2010-11-12 - 2011-02-15 - 2011-09-30 - - - - - phpMyAdmin -- multiple vulnerabilities - - - phpMyAdmin - 3.3.9.2 - - - phpMyAdmin211 - 2.11.11.3 - - - - -

phpMyAdmin team reports:

-
-

It was possible to create a bookmark which would be executed - unintentionally by other users.

-
-
-

When the files README, ChangeLog or LICENSE have been removed - from their original place (possibly by the distributor), the - scripts used to display these files can show their full path, - leading to possible further attacks.

-
- - - - http://www.phpmyadmin.net/home_page/security/PMASA-2011-2.php - http://www.phpmyadmin.net/home_page/security/PMASA-2011-1.php - - - 2011-02-08 - 2011-02-11 - - - - - linux-flashplugin -- multiple vulnerabilities - - - linux-flashplugin - 9.0r289 - - - linux-f8-flashplugin - linux-f10-flashplugin - 10.2r152 - - - - -

Adobe Product Security Incident Response Team reports:

-
-

Critical vulnerabilities have been identified in - Adobe Flash Player 10.1.102.64 and earlier versions for - Windows, Macintosh, Linux, and Solaris. These vulnerabilities - could cause the application to crash and could potentially - allow an attacker to take control of the affected system.

-
- - - - CVE-2011-0558 - CVE-2011-0559 - CVE-2011-0560 - CVE-2011-0561 - CVE-2011-0571 - CVE-2011-0572 - CVE-2011-0573 - CVE-2011-0574 - CVE-2011-0575 - CVE-2011-0577 - CVE-2011-0578 - CVE-2011-0607 - CVE-2011-0608 - http://www.adobe.com/support/security/bulletins/apsb11-02.html - - - 2011-02-08 - 2011-02-11 - - - - - mupdf -- Remote System Access - - - mupdf - 0.8 - - - - -

Secunia reports:

-
-

The vulnerability is caused due to an error within the - "closedctd()" function in fitz/filt_dctd.c when processing PDF - files containing certain malformed JPEG images. This can be - exploited to cause a stack corruption by e.g. tricking a user - into opening a specially crafted PDF file.

-
- - - - 46027 - http://secunia.com/advisories/43020/ - - - 2011-01-26 - 2011-02-10 - - - - - rubygem-mail -- Remote Arbitrary Shell Command Injection Vulnerability - - - rubygem-mail - 2.2.15 - - - - -

Secunia reports:

-
-

Input passed via an email from address is not properly sanitised - in the "deliver()" function (lib/mail/network/delivery_methods/sendmail.rb) - before being used as a command line argument. This can be exploited - to inject arbitrary shell commands.

-
- - - - 46021 - CVE-2011-0739 - http://secunia.com/advisories/43077/ - http://groups.google.com/group/mail-ruby/browse_thread/thread/e93bbd05706478dd?pli=1 - - - 2011-01-25 - 2011-02-10 - - - - - plone -- Remote Security Bypass - - - plone - 2.53 - - - plone3 - 33.3 - - - - -

Plone developer reports:

-
-

This is an escalation of privileges attack that can be used by - anonymous users to gain access to a Plone site's administration - controls, view unpublished content, create new content and modify a - site's skin. The sandbox protecting access to the underlying - system is still in place, and it does not grant access to other - applications running on the same Zope instance.

-
- - - - 46102 - CVE-2011-0720 - http://plone.org/products/plone/security/advisories/cve-2011-0720 - - - 2011-02-02 - 2011-02-10 - - - - - exim -- local privilege escalation - - - exim - exim-ldap - exim-ldap2 - exim-mysql - exim-postgresql - exim-sa-exim - 4.74 - - - - -

exim.org reports:

-
-

CVE-2011-0017 - check return value of setuid/setgid. This is a - privilege escalation vulnerability whereby the Exim run-time user - can cause root to append content of the attacker's choosing to - arbitrary files. -

-
- - - - CVE-2011-0017 - ftp://ftp.exim.org/pub/exim/ChangeLogs/ChangeLog-4.74 - - - 2011-01-31 - 2011-02-10 - - - - - openoffice.org -- Multiple vulnerabilities - - - openoffice.org - 3.3.0 - - - - -

OpenOffice.org Security Team reports:

-
-

Fixed in OpenOffice.org 3.3

- -
- - - - http://www.openoffice.org/security/bulletin.html - http://secunia.com/advisories/40775/ - - - 2010-08-04 - 2011-02-10 - - - - - webkit-gtk2 -- Multiple vurnabilities. - - - webkit-gtk2 - 1.2.7 - - - - -

Gustavo Noronha Silva reports:

-
-

This release has essentially security fixes. Refer to the - WebKit/gtk/NEWS file inside the tarball for details. We would like - to thank the Red Hat security team (Huzaifa Sidhpurwala in - particular) and Michael Gilbert from Debian for their help in - checking (and pushing!) security issues affecting the WebKitGTK+ - stable branch for this release.

-
- - - - CVE-2010-2901 - CVE-2010-4040 - CVE-2010-4042 - CVE-2010-4199 - CVE-2010-4492 - CVE-2010-4493 - CVE-2010-4578 - CVE-2011-0482 - CVE-2011-0778 - https://bugs.webkit.org/show_bug.cgi?id=48328 - https://bugs.webkit.org/show_bug.cgi?id=50710 - https://bugs.webkit.org/show_bug.cgi?id=50840 - https://bugs.webkit.org/show_bug.cgi?id=50932 - https://bugs.webkit.org/show_bug.cgi?id=51993 - https://bugs.webkit.org/show_bug.cgi?id=53265 - https://bugs.webkit.org/show_bug.cgi?id=53276 - http://permalink.gmane.org/gmane.os.opendarwin.webkit.gtk/405 - - - 2011-02-08 - 2011-02-10 - - - - - awstats -- arbitrary commands execution vulnerability - - - awstats - 7.0,1 - - - awstats-devel - 0 - - - - -

Awstats change log reports:

-
-
    -
  • Security fix (Traverse directory of LoadPlugin)
    • -
  • Security fix (Limit config to defined directory - to avoid access to external config file via a nfs - or webdav link).
    • -
-
- - - - CVE-2010-4367 - http://www.exploitdevelopment.com/Vulnerabilities/2010-WEB-001.html - http://awstats.sourceforge.net/docs/awstats_changelog.txt - - - 2010-05-01 - 2011-02-10 - - - - - opera -- multiple vulnerabilities - - - opera - opera-devel - linux-opera - 11.01 - - - - -

Opera reports:

-
-

Opera 11.01 is a recommended upgrade offering security and - stability enhancements.

-

The following security vulnerabilities have been fixed:

-
    -
  • Removed support for "javascript:" URLs in - CSS -o-link values, to make it easier for sites to filter - untrusted CSS.
    • -
  • Fixed an issue where large form inputs could allow - execution of arbitrary code, as reported by Jordi Chancel; - see our advisory.
    • -
  • Fixed an issue which made it possible to carry out - clickjacking attacks against internal opera: URLs; - see our advisory.
    • -
  • Fixed issues which allowed web pages to gain limited - access to files on the user's computer; see our - advisory.
    • -
  • Fixed an issue where email passwords were not immediately - deleted when deleting private data; see our - advisory.
    • -
-
- - - - CVE-2011-0450 - CVE-2011-0681 - CVE-2011-0682 - CVE-2011-0683 - CVE-2011-0684 - CVE-2011-0685 - CVE-2011-0686 - CVE-2011-0687 - http://www.opera.com/support/kb/view/982/ - http://www.opera.com/support/kb/view/983/ - http://www.opera.com/support/kb/view/984/ - http://secunia.com/advisories/43023 - - - 2011-01-26 - 2011-02-10 - - - - - django -- multiple vulnerabilities - - - py23-django - py24-django - py25-django - py26-django - py27-django - py30-django - py31-django - 1.21.2.5 - 1.11.1.4 - - - py23-django-devel - py24-django-devel - py25-django-devel - py26-django-devel - py27-django-devel - py30-django-devel - py31-django-devel - 15470,1 - - - - -

Django project reports:

-
-

Today the Django team is issuing multiple releases -- - Django 1.2.5 and Django 1.1.4 -- to remedy three security - issues reported to us. All users of affected versions of - Django are urged to upgrade immediately.

-
- - - - http://www.djangoproject.com/weblog/2011/feb/08/security/ - - - 2011-02-08 - 2011-02-09 - - - - - mediawiki -- multiple vulnerabilities - - - mediawiki - 1.16.2 - - - - -

Medawiki reports:

-
-

An arbitrary script inclusion vulnerability was discovered. The - vulnerability only allows execution of files with names ending in - ".php" which are already present in the local filesystem. Only servers - running Microsoft Windows and possibly Novell Netware are affected. - Despite these mitigating factors, all users are advised to upgrade, - since there is a risk of complete server compromise. MediaWiki 1.8.0 - and later is affected.

-

Security researcher mghack discovered a CSS injection - vulnerability. For Internet Explorer and similar browsers, this is - equivalent to an XSS vulnerability, that is to say, it allows the - compromise of wiki user accounts. For other browsers, it allows private - data such as IP addresses and browsing patterns to be sent to a malicious - external web server. It affects all versions of MediaWiki. All users are - advised to upgrade.

-
- - - - CVE-2011-0047 - https://bugzilla.wikimedia.org/show_bug.cgi?id=27094 - https://bugzilla.wikimedia.org/show_bug.cgi?id=27093 - http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_16_2/phase3/RELEASE-NOTES - http://lists.wikimedia.org/pipermail/mediawiki-announce/2011-February/000095.html - - - 2011-02-01 - 2011-02-09 - - - - - wordpress -- SQL injection vulnerability - - - wordpress - 3.0.2,1 - - - de-wordpress - zh-wordpress-zh_CN - zh-wordpress-zh_TW - 3.0.2 - - - - -

Vendor reports:

-
-

SQL injection vulnerability in the do_trackbacks function in - wp-includes/comment.php in WordPress before 3.0.2 allows remote - authenticated users to execute arbitrary SQL commands via the Send - Trackbacks field.

-
- - - - CVE-2010-4257 - http://www.cvedetails.com/cve/CVE-2010-4257/ - - - 2010-11-16 - 2011-02-05 - 2011-02-09 - - - - - vlc -- Insufficient input validation in MKV demuxer - - - vlc - 1.1.7 - - - - -

VLC team reports:

-
-

When parsing an invalid MKV (Matroska or WebM) file, input - validation are insufficient.

-
- - - - http://www.videolan.org/security/sa1102.html - - - 2011-01-26 - 2011-02-02 - - - - - maradns -- denial of service when resolving a long DNS hostname - - - maradns - 1.4.06 - - - - -

MaraDNS developer Sam Trenholme reports:

-
-

... a mistake in allocating an array of integers, allocating it - in bytes instead of sizeof(int) units. This resulted in a buffer - being too small, allowing it to be overwritten. The impact of this - programming error is that MaraDNS can be crashed by sending - MaraDNS a single "packet of death". Since the data placed in the - overwritten array cannot be remotely controlled (it is a list of - increasing integers), there is no way to increase privileges - exploiting this bug.

-
- - - - 45966 - CVE-2011-0520 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=610834 - - - 2011-01-23 - 2011-01-31 - - - - - isc-dhcp-server -- DHCPv6 crash - - - isc-dhcp41-server - 4.1.2,1 - - - - -

ISC reports:

-
-

When the DHCPv6 server code processes a message for an address - that was previously declined and internally tagged as abandoned - it can trigger an assert failure resulting in the server crashing. - This could be used to crash DHCPv6 servers remotely. This issue - only affects DHCPv6 servers. DHCPv4 servers are unaffected.

-
- - - - CVE-2011-0413 - http://www.isc.org/software/dhcp/advisories/cve-2011-0413 - http://www.kb.cert.org/vuls/id/686084 - - - 2011-01-26 - 2011-01-28 - - - - - bugzilla -- multiple serious vulnerabilities - - - bugzilla - 2.14.*3.6.4 - - - - -

A Bugzilla Security Advisory reports:

-
-

This advisory covers three security issues that have recently been - fixed in the Bugzilla code:

-
    -
  • A weakness in Bugzilla could allow a user to gain unauthorized - access to another Bugzilla account.
    • -
  • A weakness in the Perl CGI.pm module allows injecting HTTP - headers and content to users via several pages in Bugzilla.
    • -
  • If you put a harmful "javascript:" or "data:" URL into - Bugzilla's "URL" field, then there are multiple situations in - which Bugzilla will unintentionally make that link clickable.
    • -
  • Various pages lack protection against cross-site request - forgeries.
    • -
-

All affected installations are encouraged to upgrade as soon as - possible.

-
- - - - 25425 - CVE-2010-4568 - CVE-2010-2761 - CVE-2010-4411 - CVE-2010-4572 - CVE-2010-4567 - CVE-2010-0048 - CVE-2011-0046 - https://bugzilla.mozilla.org/show_bug.cgi?id=621591 - https://bugzilla.mozilla.org/show_bug.cgi?id=619594 - https://bugzilla.mozilla.org/show_bug.cgi?id=591165 - https://bugzilla.mozilla.org/show_bug.cgi?id=621572 - https://bugzilla.mozilla.org/show_bug.cgi?id=619588 - https://bugzilla.mozilla.org/show_bug.cgi?id=628034 - https://bugzilla.mozilla.org/show_bug.cgi?id=621090 - https://bugzilla.mozilla.org/show_bug.cgi?id=621105 - https://bugzilla.mozilla.org/show_bug.cgi?id=621107 - https://bugzilla.mozilla.org/show_bug.cgi?id=621108 - https://bugzilla.mozilla.org/show_bug.cgi?id=621109 - https://bugzilla.mozilla.org/show_bug.cgi?id=621110 - - - 2011-01-24 - 2011-01-25 - - - - - dokuwiki -- multiple privilege escalation vulnerabilities - - - dokuwiki - 20101107a - - - - -

Dokuwiki reports:

-
-

This security update fixes problems in the XMLRPC - interface where ACLs where not checked correctly - sometimes, making it possible to access and write - information that should not have been accessible/writable. - This only affects users who have enabled the XMLRPC - interface (default is off) and have enabled XMLRPC - access for users who can't access/write all content - anyway (default is nobody, see http://www.dokuwiki.org/config:xmlrpcuser - for details).

-

This update also includes a fix for a problem in - the general ACL checking function that could be exploited - to gain access to restricted pages and media files in rare - conditions (when you had rights for an id you could get - the same rights on ids where one character has been - replaced by a ".").

-
- - - - http://bugs.dokuwiki.org/index.php?do=details&task_id=2136 - - - 2011-01-16 - 2011-01-24 - - - - - asterisk -- Exploitable Stack Buffer Overflow - - - asterisk14 - 1.4.*1.4.39.1 - - - asterisk16 - 1.6.*1.6.2.16.1 - - - asterisk18 - 1.8.*1.8.2.2 - - - - -

The Asterisk Development Team reports:

-
-

The releases of Asterisk 1.4.38.1, 1.4.39.1, 1.6.1.21, 1.6.2.15.1, - 1.6.2.16.2, 1.8.1.2, and 1.8.2.1 resolve an issue when forming an - outgoing SIP request while in pedantic mode, which can cause a stack - buffer to be made to overflow if supplied with carefully crafted - caller ID information. The issue and resolution are described in the - AST-2011-001 security advisory.

-
- - - - http://downloads.asterisk.org/pub/security/AST-2011-001.pdf - - - 2011-01-18 - 2011-01-19 - - - - - tarsnap -- cryptographic nonce reuse - - - tarsnap - 1.0.221.0.27 - - - - -

Colin Percival reports:

-
-

In versions 1.0.22 through 1.0.27 of Tarsnap, the CTR nonce value - is not incremented after each chunk is encrypted. (The CTR counter - is correctly incremented after each 16 bytes of data was processed, - but this counter is reset to zero for each new chunk.)

-

Note that since the Tarsnap client-server protocol is encrypted, - being able to intercept Tarsnap client-server traffic does not - provide an attacker with access to the data.

-
- - - - http://www.daemonology.net/blog/2011-01-18-tarsnap-critical-security-bug.html - - - 2011-01-18 - 2011-01-19 - - - - - MoinMoin -- cross-site scripting vulnerabilities - - - moinmoin - 1.9.3 - - - - -

The MoinMoin developers reports:

-
-

Fix XSS in Despam action (CVE-2010-0828)

-
-
-

Fix XSS issues

-
    -
  • by escaping template name in messages
    • -
  • by fixing other places that had similar issues
    • -
-
- - - - 39110 - CVE-2010-0828 - http://hg.moinmo.in/moin/1.9/raw-file/1.9.3/docs/CHANGES - http://moinmo.in/MoinMoinBugs/1.9.2UnescapedInputForThemeAddMsg - - - 2010-04-05 - 2011-01-11 - - - - - tor -- remote code execution and crash - - - tor - 0.2.1.29 - - - tor-devel - 0.2.2.21.a - - - - -

The Tor Project reports:

-
-

A remote heap overflow vulnerability that can allow remote - code execution. Other fixes address a variety of assert and crash - bugs, most of which we think are hard to exploit remotely. - All Tor users should upgrade.

-
- - - - 45832 - CVE-2011-0427 - ports/154099 - http://archives.seul.org/or/announce/Jan-2011/msg00000.html - https://gitweb.torproject.org/tor.git/blob/release-0.2.1:/ChangeLog - https://gitweb.torproject.org/tor.git/blob/release-0.2.2:/ChangeLog - - - 2011-01-15 - 2011-01-17 - - - - - sudo -- local privilege escalation - - - sudo - 1.7.01.7.4.5 - - - - -

Todd Miller reports:

-
-

Beginning with sudo version 1.7.0 it has been possible - to grant permission to run a command using a specified - group via sudo's -g option (run as group), if allowed by - the sudoers file. A flaw exists in sudo's password - checking logic that allows a user to run a command - with only the group changed without being prompted - for a password.

-
- - - - CVE-2011-0010 - http://www.sudo.ws/sudo/alerts/runas_group_pw.html - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=609641 - - - 2011-01-11 - 2011-01-13 - - - - - subversion -- multiple DoS - - - subversion - 1.6.15 - - - subversion-freebsd - 1.6.15 - - - - -

Entry for CVE-2010-4539 says:

-
-

The walk function in repos.c in the mod_dav_svn module - for the Apache HTTP Server, as distributed in Apache - Subversion before 1.6.15, allows remote authenticated - users to cause a denial of service (NULL pointer - dereference and daemon crash) via vectors that trigger - the walking of SVNParentPath collections.

-
-

Entry for CVE-2010-4644 says:

-
-

Multiple memory leaks in rev_hunt.c in Apache Subversion - before 1.6.15 allow remote authenticated users to cause - a denial of service (memory consumption and daemon crash) - via the -g option to the blame command.

-
- - - - 45655 - CVE-2010-4539 - CVE-2010-4644 - - - 2011-01-02 - 2011-01-13 - - - - - php -- multiple vulnerabilities - - - php5 - 5.3.5 - - - php52 - 5.2.17 - - - - -

PHP developers reports:

-
-

Security Enhancements and Fixes in PHP 5.3.5:

-
    -
  • Fixed bug #53632 (PHP hangs on numeric value - 2.2250738585072011e-308). (CVE-2010-4645)
    • -
-
-
-

Security Enhancements and Fixes in PHP 5.2.17:

-
    -
  • Fixed bug #53632 (PHP hangs on numeric value - 2.2250738585072011e-308). (CVE-2010-4645)
    • -
-
- - - - CVE-2010-4645 - - - 2011-01-06 - 2011-01-09 - 2011-01-09 - - - - - exim -- local privilege escalation - - - exim - 4.73 - - - - -

David Woodhouse reports:

-
-

Secondly a privilege escalation where the trusted 'exim' - user is able to tell Exim to use arbitrary config files, - in which further ${run ...} commands will be invoked as - root.

-
- - - - CVE-2010-4345 - http://www.exim.org/lurker/message/20101209.022730.dbb6732d.en.html - https://bugzilla.redhat.com/show_bug.cgi?id=661756#c3 - - - 2010-12-10 - 2011-01-08 - - - - - mediawiki -- Clickjacking vulnerabilities - - - mediawiki - 1.161.16.1 - 1.151.15.5_1 - - - - -

Clickjacking vulnerabilities:

-
-

Clickjacking is a type of vulnerability discovered in 2008, which - is similar to CSRF. The attack involves displaying the target webpage - in a iframe embedded in a malicious website. Using CSS, the submit button - of the form on the targeit webpage is made invisible, and then overlaid - with some button or link on the malicious website that encourages - the user to click on it.

-
- - - - https://bugzilla.wikimedia.org/show_bug.cgi?id=26561 - - - 2011-01-04 - 2011-01-06 - - - - - webkit-gtk2 -- Multiple vulnerabilities - - - webkit-gtk2 - 1.2.6 - - - - -

Gustavo Noronha Silva reports:

-
-

The patches to fix the following CVEs are included with help - from Huzaifa Sidhpurwala from the Red Hat security team.

-
- - - - CVE-2010-1791 - CVE-2010-3812 - CVE-2010-3813 - CVE-2010-4197 - CVE-2010-4198 - CVE-2010-4204 - CVE-2010-4206 - CVE-2010-4577 - http://gitorious.org/webkitgtk/stable/blobs/master/WebKit/gtk/NEWS - - - 2010-12-28 - 2010-12-30 - - - - - django -- multiple vulnerabilities - - - py23-django - py24-django - py25-django - py26-django - py27-django - py30-django - py31-django - 1.21.2.4 - 1.11.1.3 - - - py23-django-devel - py24-django-devel - py25-django-devel - py26-django-devel - py27-django-devel - py30-django-devel - py31-django-devel - 15032,1 - - - - -

Django project reports:

-
-

Today the Django team is issuing multiple releases - -- Django 1.2.4, Django 1.1.3 and Django 1.3 beta 1 -- - to remedy two security issues reported to us. All users - of affected versions of Django are urged to upgrade - immediately.

-

Information leakage in Django administrative interface

-

The Django administrative interface, django.contrib.admin - supports filtering of displayed lists of objects by fields - on the corresponding models, including across database-level - relationships. This is implemented by passing lookup arguments - in the querystring portion of the URL, and options on the - ModelAdmin class allow developers to specify particular - fields or relationships which will generate automatic links - for filtering.

-

Denial-of-service attack in password-reset mechanism

-

Django's bundled authentication framework, - django.contrib.auth, offers views which allow users to - reset a forgotten password. The reset mechanism involves - generating a one-time token composed from the user's ID, - the timestamp of the reset request converted to a base36 - integer, and a hash derived from the user's current password - hash (which will change once the reset is complete, thus - invalidating the token).

-
- - - - 45562 - 45563 - https://bugzilla.redhat.com/show_bug.cgi?id=665373 - http://secunia.com/advisories/42715/ - - - 2010-12-22 - 2010-12-29 - - - - - Drupal Views plugin -- cross-site scripting - - - drupal6-views - 2.12 - - - - -

Drupal security team reports:

-
-

The Views module provides a flexible method for Drupal site - designers to control how lists and tables of content are - presented. Under certain circumstances, Views could display - parts of the page path without escaping, resulting in a - relected Cross Site Scripting (XSS) vulnerability. An attacker - could exploit this to gain full administrative access.

-

Mitigating factors: This vulnerability only occurs with a - specific combination of configuration options for a specific - View, but this combination is used in the default Views - provided by some additional modules. A malicious user would - need to get an authenticated administrative user to visit a - specially crafted URL.

-
- - - - CVE-2010-4521 - http://drupal.org/node/999380 - - - 2010-12-15 - 2010-12-28 - - - - - redmine -- multiple vulnerabilities - - - redmine - 1.0.5 - - - - -

Jean-Philippe Lang reports:

-
-

This release also fixes 3 security issues reported by - joernchen of Phenoelit:

-
    -
  • logged in users may be able to access private data - (affected versions: 1.0.x)
    • -
  • persistent XSS vulnerability in textile formatter - (affected versions: all previous releases)
    • -
  • remote command execution in bazaar repository adapter - (affected versions: 0.9.x, 1.0.x)
    • -
-
- - - - http://www.redmine.org/news/49 - - - 2010-12-23 - 2010-12-23 - - - - - tor -- remote crash and potential remote code execution - - - tor - 0.2.1.28 - - - tor-devel - 0.2.2.20-alpha - - - - -

The Tor Project reports:

-
-

Remotely exploitable bug that could be used to crash instances - of Tor remotely by overflowing on the heap. Remote-code execution - hasn't been confirmed, but can't be ruled out. Everyone should - upgrade.

-
- - - - 45500 - CVE-2010-1676 - ports/153326 - http://archives.seul.org/or/announce/Dec-2010/msg00000.html - http://archives.seul.org/or/talk/Dec-2010/msg00167.html - https://gitweb.torproject.org/tor.git/blob/release-0.2.1:/ChangeLog - https://gitweb.torproject.org/tor.git/blob/release-0.2.2:/ChangeLog - - - 2010-12-17 - 2010-12-22 - - - - - YUI JavaScript library -- JavaScript injection exploits in Flash components - - - yahoo-ui - 2.8.2 - - - - -

The YUI team reports:

-
-

A security-related defect was introduced in the YUI 2 Flash - component infrastructure beginning with the YUI 2.4.0 release. - This defect allows JavaScript injection exploits to be created - against domains that host affected YUI .swf files.

-
- - - - CVE-2010-4207 - CVE-2010-4208 - CVE-2010-4209 - http://www.yuiblog.com/blog/2010/10/25/yui-2-8-2-security-update/ - http://secunia.com/advisories/41955 - http://www.openwall.com/lists/oss-security/2010/11/07/1 - http://yuilibrary.com/support/2.8.2/ - - - 2010-10-25 - 2010-12-15 - - - - - php-zip -- multiple Denial of Service vulnerabilities - - - php5-zip - 5.3.4 - - - php52-zip - 5.2.15 - - - - -

The following DoS conditions in Zip extension - were fixed in PHP 5.3.4 and PHP 5.2.15:

-
    -
  • -
    -

    Fixed crash in zip extract method (possible - CWE-170).

    -
    -
    • -
  • -
    -

    The ZipArchive::getArchiveComment function - in PHP 5.2.x through 5.2.14 and 5.3.x through 5.3.3 - allows context-dependent attackers to cause a denial - of service (NULL pointer dereference and application - crash) via a crafted ZIP archive.

    -
    -
    • -
- - - - CVE-2010-3709 - http://www.php.net/releases/5_3_4.php - http://www.php.net/releases/5_2_15.php - http://securityreason.com/achievement_securityalert/90 - - - 2010-12-13 - 2011-01-13 - - - - - php-filter -- Denial of Service - - - php5-filter - 5.3.4 - - - php52-filter - 5.2.15 - - - - -

The following DoS condition in filter extension - was fixed in PHP 5.3.4 and PHP 5.2.15:

-
-

Stack consumption vulnerability in the filter_var - function in PHP 5.2.x through 5.2.14 and 5.3.x through - 5.3.3, when FILTER_VALIDATE_EMAIL mode is used, allows - remote attackers to cause a denial of service (memory - consumption and application crash) via a long e-mail - address string.

-
- - - - CVE-2010-3710 - http://www.php.net/releases/5_3_4.php - http://www.php.net/releases/5_2_15.php - - - 2010-12-13 - 2011-01-13 - - - - - php-imap -- Denial of Service - - - php5-imap - 5.3.4 - - - php52-imap - 5.2.15 - - - - -

The following DoS condition in IMAP extension - was fixed in PHP 5.3.4 and PHP 5.2.15:

-
-

A remote user can send specially crafted IMAP user name - or password data to trigger a double free memory error - in 'ext/imap/php_imap.c' and cause the target service - to crash.

-

It may be possible to execute arbitrary code. - However, code execution was not confirmed.

-
- - - - CVE-2010-4150 - http://www.php.net/releases/5_3_4.php - http://www.php.net/releases/5_2_15.php - - - 2010-12-13 - 2011-01-13 - - - - - pecl-phar -- format string vulnerability - - - pecl-phar - 0 - - - - -

Entry for CVE-2010-2094 says:

-
-

Multiple format string vulnerabilities in the phar - extension in PHP 5.3 before 5.3.2 allow context-dependent - attackers to obtain sensitive information (memory - contents) and possibly execute arbitrary code via a - crafted phar:// URI that is not properly handled by the - (1) phar_stream_flush, (2) phar_wrapper_unlink, - (3) phar_parse_url, or (4) phar_wrapper_open_url functions - in ext/phar/stream.c; and the (5) phar_wrapper_open_dir - function in ext/phar/dirstream.c, which triggers errors - in the php_stream_wrapper_log_error function.

-
-

PECL source code for PHAR extension shares the same code, - so it is vulnerable too.

- - - - CVE-2010-2094 - http://php-security.org/2010/05/14/mops-2010-024-php-phar_stream_flush-format-string-vulnerability/index.html - http://php-security.org/2010/05/14/mops-2010-025-php-phar_wrapper_open_dir-format-string-vulnerability/index.htm - http://php-security.org/2010/05/14/mops-2010-026-php-phar_wrapper_unlink-format-string-vulnerability/index.htm - http://php-security.org/2010/05/14/mops-2010-027-php-phar_parse_url-format-string-vulnerabilities/index.htm - http://php-security.org/2010/05/14/mops-2010-028-php-phar_wrapper_open_url-format-string-vulnerabilities/index.html - - - 2010-12-13 - 2011-01-13 - - - - - php -- NULL byte poisoning - - - php5 - 5.3.4 - - - php52 - 5.2.17_12 - - - - -

PHP-specific version of NULL-byte poisoning was briefly - described by ShAnKaR:

-
-

Poison NULL byte vulnerability for perl CGI applications - was described in - [1]. - ShAnKaR noted, that same vulnerability also affects - different PHP applications.

-
-

PHP developers report that branch 5.3 received a fix:

-
-

Paths with NULL in them (foo\0bar.txt) are now considered - as invalid (CVE-2006-7243).

-
- - - - CVE-2006-7243 - http://www.securityfocus.com/archive/1/archive/1/445788/100/0/threaded - http://artofhacking.com/files/phrack/phrack55/P55-07.TXT - - - 2010-12-10 - 2011-01-13 - 2012-11-25 - - - - - php -- open_basedir bypass - - - php5 - 5.3.4 - - - php52 - 5.2.15 - - - - -

MITRE reports:

-
-

fopen_wrappers.c in PHP 5.3.x through 5.3.3 might allow - remote attackers to bypass open_basedir restrictions via - vectors related to the length of a filename.

-
- - - - 44723 - CVE-2010-3436 - - - 2010-12-10 - 2011-01-13 - - - - - php -- corruption of $GLOBALS and $this variables via extract() method - - - php5 - 5.3.4 - - - php52 - 5.2.15 - - - - -

Off-by-one error in the sanity validator for the extract() - method allowed attackers to replace the values of $GLOBALS - and $this when mode EXTR_OVERWRITE was used.

- - - - http://www.mail-archive.com/php-cvs@lists.php.net/msg47722.html - http://www.php.net/releases/5_2_15.php - - - 2010-12-10 - 2011-01-13 - - - - - - - - - - - - - mozilla -- multiple vulnerabilities - - - firefox - 3.6.*,13.6.13,1 - 3.5.*,13.5.16,1 - - - libxul - 1.9.2.*1.9.2.13 - - - linux-firefox - 3.6.13,1 - - - linux-firefox-devel - 3.5.16 - - - linux-seamonkey - 2.0.*2.0.11 - - - linux-thunderbird - 3.13.1.7 - - - seamonkey - 2.0.*2.0.11 - - - thunderbird - 3.03.0.11 - 3.13.1.7 - - - - -

The Mozilla Project reports:

-
-

MFSA 2010-74 Miscellaneous memory safety hazards (rv:1.9.2.13/ 1.9.1.16)

-

MFSA 2010-75 Buffer overflow while line breaking after document.write with long string

-

MFSA 2010-76 Chrome privilege escalation with window.open and isindex element

-

MFSA 2010-77 Crash and remote code execution using HTML tags inside a XUL tree

-

MFSA 2010-78 Add support for OTS font sanitizer

-

MFSA 2010-79 Java security bypass from LiveConnect loaded via data: URL meta refresh

-

MFSA 2010-80 Use-after-free error with nsDOMAttribute MutationObserver

-

MFSA 2010-81 Integer overflow vulnerability in NewIdArray

-

MFSA 2010-82 Incomplete fix for CVE-2010-0179

-

MFSA 2010-83 Location bar SSL spoofing using network error page

-

MFSA 2010-84 XSS hazard in multiple character encodings

-
- - - - CVE-2010-3766 - CVE-2010-3767 - CVE-2010-3768 - CVE-2010-3769 - CVE-2010-3770 - CVE-2010-3771 - CVE-2010-3772 - CVE-2010-3773 - CVE-2010-3774 - CVE-2010-3775 - CVE-2010-3776 - CVE-2010-3777 - CVE-2010-3778 - http://www.mozilla.org/security/announce/2010/mfsa2010-74.html - http://www.mozilla.org/security/announce/2010/mfsa2010-75.html - http://www.mozilla.org/security/announce/2010/mfsa2010-76.html - http://www.mozilla.org/security/announce/2010/mfsa2010-77.html - http://www.mozilla.org/security/announce/2010/mfsa2010-78.html - http://www.mozilla.org/security/announce/2010/mfsa2010-79.html - http://www.mozilla.org/security/announce/2010/mfsa2010-80.html - http://www.mozilla.org/security/announce/2010/mfsa2010-81.html - http://www.mozilla.org/security/announce/2010/mfsa2010-82.html - http://www.mozilla.org/security/announce/2010/mfsa2010-83.html - http://www.mozilla.org/security/announce/2010/mfsa2010-84.html - - - 2010-12-09 - 2010-12-10 - - - - - krb5 -- client impersonation vulnerability - - - krb5 - 1.7.01.7.2 - - - - -

The MIT Kerberos team reports:

-
-

MIT krb5 KDC may issue tickets not requested - by a client, based on an attacker-chosen KrbFastArmoredReq.

-

An authenticated remote attacker that controls a legitimate service - principal could obtain a valid service ticket to itself containing - valid KDC-generated authorization data for a client whose TGS-REQ it - has intercepted. The attacker could then use this ticket for - S4U2Proxy to impersonate the targeted client even if the client - never authenticated to the subverted service. The vulnerable - configuration is believed to be rare.

-
- - - - 45122 - CVE-2010-4021 - http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt - http://osvdb.org/69607 - - - 2010-11-30 - 2010-12-09 - - - - - krb5 -- RFC 3961 key-derivation checksum handling vulnerability - - - krb5 - 1.8.01.8.3 - - - - -

The MIT Kerberos team reports:

-
-

MIT krb5 (releases incorrectly accepts RFC 3961 - key-derivation checksums using RC4 keys when verifying AD-SIGNEDPATH - and AD-KDC-ISSUED authorization data.

-

An authenticated remote attacker that controls a legitimate service - principal has a 1/256 chance of forging the AD-SIGNEDPATH signature - if the TGT key is RC4, allowing it to use self-generated "evidence" - tickets for S4U2Proxy, instead of tickets obtained from the user or - with S4U2Self. Configurations using RC4 for the TGT key are - believed to be rare.

-

An authenticated remote attacker has a 1/256 chance of forging - AD-KDC-ISSUED signatures on authdata elements in tickets having - an RC4 service key, resulting in privilege escalation against - a service that relies on these signatures. There are no known - uses of the KDC-ISSUED authdata container at this time.

-
- - - - 45117 - CVE-2010-4020 - http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt - http://osvdb.org/69608 - - - 2010-11-30 - 2010-12-09 - - - - - krb5 -- unkeyed PAC checksum handling vulnerability - - - krb5 - 1.7.01.7.2 - - - - -

The MIT Kerberos team reports:

-
-

MIT krb5 incorrectly accepts an unkeyed checksum for PAC - signatures.

-

An authenticated remote attacker can forge PACs if using a KDC that - does not filter client-provided PAC data. This can result in - privilege escalation against a service that relies on PAC contents - to make authorization decisions.

-
- - - - 45116 - CVE-2010-1324 - http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt - http://osvdb.org/69609 - - - 2010-11-30 - 2010-12-09 - - - - - krb5 -- multiple checksum handling vulnerabilities - - - krb5 - 1.7.01.7.2 - 1.8.01.8.3 - - - - -

The MIT Kerberos team reports:

-
-

MIT krb incorrectly accepts an unkeyed - checksum with DES session keys for version 2 (RFC 4121) - of the GSS-API krb5 mechanism.

-

An unauthenticated remote attacker can forge GSS tokens that are - intended to be integrity-protected but unencrypted, if the targeted - pre-existing application session uses a DES session key.

-

MIT krb5 KDC incorrectly accepts RFC - 3961 key-derivation checksums using RC4 keys when verifying the - req-checksum in a KrbFastArmoredReq.

-

An unauthenticated remote attacker has a 1/256 chance of swapping a - client-issued KrbFastReq into a different KDC-REQ, if the armor - key is RC4. The consequences are believed to be minor.

-
- - - - 45116 - CVE-2010-1324 - http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt - http://osvdb.org/69609 - - - 2010-11-30 - 2010-12-09 - - - - - krb5 -- multiple checksum handling vulnerabilities - - - krb5 - 1.3.01.7.2 - 1.8.01.8.3 - - - - -

The MIT Kerberos team reports:

-
-

MIT krb5 clients incorrectly accept an unkeyed checksums - in the SAM-2 preauthentication challenge.

-

An unauthenticated remote attacker could alter a SAM-2 challenge, - affecting the prompt text seen by the user or the kind of response - sent to the KDC. Under some circumstances, this can negate the - incremental security benefit of using a single-use authentication - mechanism token.

-

MIT krb5 incorrectly accepts RFC 3961 key-derivation checksums - using RC4 keys when verifying KRB-SAFE messages.

-

An unauthenticated remote attacker has a 1/256 chance of forging - KRB-SAFE messages in an application protocol if the targeted - pre-existing session uses an RC4 session key. Few application - protocols use KRB-SAFE messages.

-
- - - - 45118 - CVE-2010-1323 - http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt - http://osvdb.org/69610 - - - 2010-11-30 - 2010-12-09 - - - - - proftpd -- Compromised source packages backdoor - - - proftpd - 1.3.3c_2 - - - - -

The ProFTPD Project team reports:

-
-

The security issue is caused due to the distribution of compromised - ProFTPD 1.3.3c source code packages via the project's main FTP server - and all of the mirror servers, which contain a backdoor allowing - remote root access.

-
- - - - http://sourceforge.net/mailarchive/message.php?msg_name=alpine.DEB.2.00.1012011542220.12930%40familiar.castaglia.org - http://secunia.com/advisories/42449 - - - 2010-11-28 - 2010-12-04 - - - - - phpMyAdmin -- XSS attack in database search - - - phpMyAdmin - 3.3.8.1 - - - phpMyAdmin211 - 2.11.11.1 - - - - -

phpMyAdmin team reports:

-
-

It was possible to conduct a XSS attack using spoofed request on the - db search script.

-
- - - - ports/152685 - ports/152686 - CVE-2010-4329 - http://www.phpmyadmin.net/home_page/security/PMASA-2010-8.php - - - 2010-11-29 - 2010-11-30 - - - - - isc-dhcp-server -- Empty link-address denial of service - - - isc-dhcp41-server - 4.1.04.1.2 - - - - -

ISC reports:

-
-

If the server receives a DHCPv6 packet containing one or more - Relay-Forward messages, and none of them supply an address in the - Relay-Forward link-address field, then the server will crash. This - can be used as a single packet crash attack vector.

-
- - - - CVE-2010-3611 - http://www.isc.org/software/dhcp/advisories/cve-2010-3611 - http://www.kb.cert.org/vuls/id/102047 - - - 2010-11-02 - 2010-11-24 - - - - - OpenTTD -- Denial of service (server/client) via invalid read - - - openttd - 1.0.01.0.5 - - - - -

The OpenTTD Team reports:

-
-

When a client disconnects, without sending the "quit" or - "client error" message, the server has a chance of reading and - writing a just freed piece of memory. The writing can only - happen while the server is sending the map. Depending on what - happens directly after freeing the memory there is a chance of - segmentation fault, and thus a denial of service.

-
- - - - CVE-2010-4168 - http://security.openttd.org/en/CVE-2010-4168 - - - 2010-11-20 - 2010-11-23 - - - - - horde-base -- XSS: VCARD attachments vulnerability - - - horde-base - 3.3.11 - - - - -

The Horde team reports:

-
-

The major changes compared to Horde version 3.3.10 are:

-

* Fixed XSS vulnerability when viewing details of a vCard.

-
- - - - http://article.gmane.org/gmane.comp.horde.announce/532 - http://bugs.horde.org/ticket/9357 - - - 2010-11-02 - 2010-11-23 - - - - - proftpd -- remote code execution vulnerability - - - proftpd - 1.3.3c - - - - -

Tippingpoint reports:

-
-

This vulnerability allows remote attackers to execute arbitrary - code on vulnerable installations of ProFTPD. Authentication is not - required to exploit this vulnerability.

-

The flaw exists within the proftpd server component which - listens by default on TCP port 21. When reading user input if a - TELNET_IAC escape sequence is encountered the process - miscalculates a buffer length counter value allowing a user - controlled copy of data to a stack buffer. A remote attacker can - exploit this vulnerability to execute arbitrary code under the - context of the proftpd process.

-
- - - - 44562 - CVE-2010-4221 - http://www.zerodayinitiative.com/advisories/ZDI-10-229/ - - - 2010-11-02 - 2010-11-23 - - - - - openssl -- TLS extension parsing race condition - - - openssl - 1.0.0_2 - - - - -

OpenSSL Team reports:

-
-

Rob Hulswit has found a flaw in the OpenSSL TLS server extension - code parsing which on affected servers can be exploited in a buffer - overrun attack.

-

Any OpenSSL based TLS server is vulnerable if it is multi-threaded - and uses OpenSSL's internal caching mechanism. Servers that are - multi-process and/or disable internal session caching are NOT - affected.

-

In particular the Apache HTTP server (which never uses OpenSSL - internal caching) and Stunnel (which includes its own workaround) - are NOT affected.

-
- - - - CVE-2010-3864 - http://openssl.org/news/secadv_20101116.txt - - - 2010-10-08 - 2010-11-17 - - - - - linux-flashplugin -- multiple vulnerabilities - - - linux-flashplugin - 9.0r289 - - - linux-f8-flashplugin - linux-f10-flashplugin - 10.1r102 - - - - -

Adobe Product Security Incident Response Team reports:

-
-

Critical vulnerabilities have been identified in - Adobe Flash Player 10.1.85.3 and earlier versions for - Windows, Macintosh, Linux, and Solaris, and Adobe Flash Player - 10.1.95.1 for Android. These vulnerabilities, including - CVE-2010-3654 referenced in Security Advisory APSA10-05, - could cause the application to crash and could potentially - allow an attacker to take control of the affected system.

-
- - - - CVE-2010-3636 - CVE-2010-3637 - CVE-2010-3638 - CVE-2010-3639 - CVE-2010-3640 - CVE-2010-3641 - CVE-2010-3642 - CVE-2010-3643 - CVE-2010-3644 - CVE-2010-3645 - CVE-2010-3646 - CVE-2010-3647 - CVE-2010-3648 - CVE-2010-3649 - CVE-2010-3650 - CVE-2010-3652 - CVE-2010-3654 - CVE-2010-3676 - http://www.adobe.com/support/security/bulletins/apsb10-26.html - http://www.adobe.com/support/security/advisories/apsa10-05.html - - - 2010-09-28 - 2010-11-06 - - - - - Wireshark -- DoS in the BER-based dissectors - - - wireshark - 1.31.4.1 - 1.01.2.12 - - - wireshark-lite - 1.31.4.1 - 1.01.2.12 - - - tshark - 1.31.4.1 - 1.01.2.12 - - - tshark-lite - 1.31.4.1 - 1.01.2.12 - - - - -

Secunia reports:

-
-

A vulnerability has been discovered in Wireshark, which can - be exploited by malicious people to cause a DoS (Denial of - Service).

-

The vulnerability is caused due to an infinite recursion - error in the "dissect_unknown_ber()" function in - epan/dissectors/packet-ber.c and can be exploited to cause a - stack overflow e.g. via a specially crafted SNMP packet.

-

The vulnerability is confirmed in version 1.4.0 and - reported in version 1.2.11 and prior and version 1.4.0 and - prior.

-
- - - - CVE-2010-3445 - http://www.wireshark.org/lists/wireshark-announce/201010/msg00002.html - http://www.wireshark.org/lists/wireshark-announce/201010/msg00001.html - - - 2010-09-16 - 2010-11-05 - - - - - Mailman -- cross-site scripting in web interface - - - mailman - 2.1.14 - - - - -

Secunia reports:

-
-

Two vulnerabilities have been reported in Mailman, which - can be exploited by malicious users to conduct script - insertion attacks.

-

Certain input passed via the list descriptions is not - properly sanitised before being displayed to the user. This - can be exploited to insert arbitrary HTML and script code, - which will be executed in a user's browser session in context - of an affected site when the malicious data is being - viewed.

-

Successful exploitation requires "list owner" permissions.

-
- - - - 43187 - CVE-2010-3089 - http://secunia.com/advisories/41265 - - - 2010-09-14 - 2010-11-03 - - - - - OTRS -- Multiple XSS and denial of service vulnerabilities - - - otrs - 2.3.*2.4.9 - - - - -

OTRS Security Advisory reports:

-
-
    -
  • Multiple Cross Site Scripting issues: - Missing HTML quoting allows authenticated agents or - customers to inject HTML tags. This vulnerability - allows an attacker to inject script code into the OTRS - web-interface which will be loaded and executed - in the browsers of system users.
    • -
  • Possible Denial of Service Attack: - Perl's regular expressions consume 100% CPU time - on the server if an agent or customer views an affected - article. To exploit this vulnerability the malicious user - needs to send extremely large HTML emails to your - system address.
    • -
-
-
-

AgentTicketZoom is vulnerable to XSS attacks from HTML e-mails:

-

Whenever a customer sends an HTML e-mail and RichText is enabled - in OTRS, javascript contained in the email can do everything - in the OTRS agent interface that the agent himself could do.

-

Most relevant is that this type of exploit can be used in such - a way that the agent won't even detect he is being exploited.

-
- - - - CVE-2010-2080 - CVE-2010-4071 - http://otrs.org/advisory/OSA-2010-02-en/ - http://otrs.org/advisory/OSA-2010-03-en/ - - - 2010-09-15 - 2010-11-03 - - - - - mozilla -- Heap buffer overflow mixing document.write and DOM insertion - - - firefox - 3.6.*,13.6.12,1 - 3.5.*,13.5.15,1 - - - libxul - 1.9.2.*1.9.2.12 - - - linux-firefox - 3.6.12,1 - - - linux-firefox-devel - 3.5.15 - - - linux-seamonkey - 2.0.10 - - - linux-thunderbird - 3.1.6 - - - seamonkey - 2.0.*2.0.10 - - - thunderbird - 3.03.0.10 - 3.13.1.6 - - - - -

The Mozilla Project reports:

-
-

MFSA 2010-73 Heap buffer overflow mixing document.write and DOM insertion

-
- - - - CVE-2010-3765 - http://www.mozilla.org/security/announce/2010/mfsa2010-73.html - - - 2010-10-27 - 2010-10-28 - - - - - opera -- multiple vulnerabilities - - - opera - 10.63 - - - - -

The Opera Desktop Team reports:

-
-
    -
  • Fixed an issue that allowed cross-domain checks to be bypassed, - allowing limited data theft using CSS, as reported by Isaac - Dawson.
    • -
  • Fixed an issue where manipulating the window could be used to - spoof the page address.
    • -
  • Fixed an issue with reloads and redirects that could allow - spoofing and cross-site scripting.
    • -
  • Fixed an issue that allowed private video streams to be - intercepted, as reported by Nirankush Panchbhai of Microsoft - Vulnerability Research.
    • -
  • Fixed an issue that caused JavaScript to run in the wrong - security context after manual interaction.
    • -
-
- - - - http://www.opera.com/support/kb/view/971/ - http://www.opera.com/support/kb/view/972/ - http://www.opera.com/support/kb/view/973/ - http://www.opera.com/support/kb/view/974/ - http://www.opera.com/support/kb/view/976/ - - - 2010-10-12 - 2010-10-26 - - - - - bzip2 -- integer overflow vulnerability - - - bzip2 - 1.0.6 - - - - -

Secunia reports:

-
-

A vulnerability has been reported in bzip2, which can be exploited by - malicious people to cause a DoS (Denial of Service) or potentially - compromise a vulnerable system.

-

The vulnerability is caused due to an integer overflow in the - "BZ2_decompress()" function in decompress.c and can be exploited to - cause a crash or potentially execute arbitrary code.

-
- - - - SA-10:08.bzip2 - ports/151364 - CVE-2010-0405 - 43331 - http://www.openwall.com/lists/oss-security/2010/09/21/4 - http://secunia.com/advisories/41452 - - - 2010-09-21 - 2010-10-25 - - - - - FreeBSD -- Integer overflow in bzip2 decompression - - - FreeBSD - 6.46.4_11 - 7.17.1_14 - 7.37.3_3 - 8.08.0_5 - 8.18.1_1 - - - - -

Problem Description:

-

When decompressing data, the run-length encoded values are not - adequately sanity-checked, allowing for an integer overflow.

- - - - SA-10:08.bzip2 - - - 2010-09-20 - 2010-10-24 - 2016-08-09 - - - - - FreeBSD -- Lost mbuf flag resulting in data corruption - - - FreeBSD - 7.17.1_13 - 7.37.3_2 - 8.08.0_4 - - - - -

Problem Description:

-

The read-only flag is not correctly copied when a mbuf buffer - reference is duplicated. When the sendfile(2) system call is used to - transmit data over the loopback interface, this can result in the - backing pages for the transmitted file being modified, causing data - corruption.

- - - - SA-10:07.mbuf - - - 2010-07-13 - 2010-10-24 - 2016-08-09 - - - - - FreeBSD -- Unvalidated input in nfsclient - - - FreeBSD - 7.27.2_8 - 7.37.3_1 - 8.08.0_3 - - - - -

Problem Description:

-

The NFS client subsystem fails to correctly validate the length of a - parameter provided by the user when a filesystem is mounted.

- - - - SA-10:06.nfsclient - - - 2010-05-27 - 2010-10-24 - 2016-08-09 - - - - - FreeBSD -- OPIE off-by-one stack overflow - - - FreeBSD - 6.46.4_10 - 7.17.1_12 - 7.27.2_8 - 7.37.3_1 - 8.08.0_3 - - - - -

Problem Description:

-

A programming error in the OPIE library could allow an off-by-one - buffer overflow to write a single zero byte beyond the end of an - on-stack buffer.

- - - - SA-10:05.opie - - - 2010-05-27 - 2010-10-24 - 2016-08-09 - - - - - FreeBSD -- Insufficient environment sanitization in jail(8) - - - FreeBSD - 8.08.0_3 - - - - -

Problem Description:

-

The jail(8) utility does not change the current working directory - while imprisoning. The current working directory can be accessed by - its descendants.

- - - - SA-10:04.jail - - - 2010-05-27 - 2010-10-24 - 2016-08-09 - - - - - FreeBSD -- ZFS ZIL playback with insecure permissions - - - FreeBSD - 7.17.1_10 - 7.27.2_6 - 8.08.0_2 - - - - -

Problem Description:

-

When replaying setattr transaction, the replay code would set the - attributes with certain insecure defaults, when the logged - transaction did not touch these attributes.

- - - - SA-10:03.zfs - - - 2010-01-06 - 2010-10-24 - 2016-08-09 - - - - - FreeBSD -- ntpd mode 7 denial of service - - - FreeBSD - 6.36.3_15 - 6.46.4_9 - 7.17.1_10 - 7.27.2_6 - 8.08.0_2 - - - - -

Problem Description:

-

If ntpd receives a mode 7 (MODE_PRIVATE) request or error response - from a source address not listed in either a 'restrict ... noquery' - or a 'restrict ... ignore' section it will log the even and send a - mode 7 error response.

- - - - SA-10:02.ntpd - - - 2010-01-06 - 2010-10-24 - 2016-08-09 - - - - - FreeBSD -- BIND named(8) cache poisoning with DNSSEC validation - - - FreeBSD - 6.36.3_15 - 6.46.4_9 - 7.17.1_10 - 7.27.2_6 - 8.08.0_2 - - - - -

Problem Description:

-

If a client requests DNSSEC records with the Checking Disabled (CD) - flag set, BIND may cache the unvalidated responses. These responses - may later be returned to another client that has not set the CD - flag.

- - - - SA-10:01.bind - - - 2010-01-06 - 2010-10-24 - 2016-08-09 - - - - - FreeBSD -- Inappropriate directory permissions in freebsd-update(8) - - - FreeBSD - 6.36.3_14 - 6.46.4_8 - 7.17.1_9 - 7.27.2_5 - 8.08.0_1 - - - - -

Problem Description:

-

When downloading updates to FreeBSD via 'freebsd-update fetch' or - 'freebsd-update upgrade', the freebsd-update(8) utility copies - currently installed files into its working directory - (/var/db/freebsd-update by default) both for the purpose of merging - changes to configuration files and in order to be able to roll back - installed updates.

-

The default working directory used by freebsd-update(8) is normally - created during the installation of FreeBSD with permissions which - allow all local users to see its contents, and freebsd-update(8) does - not take any steps to restrict access to files stored in said - directory.

- - - - SA-09:17.freebsd-update - - - 2009-12-03 - 2010-10-24 - 2016-08-09 - - - - - FreeBSD -- Improper environment sanitization in rtld(1) - - - FreeBSD - 7.17.1_9 - 7.27.2_5 - 8.08.0_1 - - - - -

Problem Description:

-

When running setuid programs rtld will normally remove potentially - dangerous environment variables. Due to recent changes in FreeBSD - environment variable handling code, a corrupt environment may - result in attempts to unset environment variables failing.

- - - - SA-09:16.rtld - - - 2009-12-03 - 2010-10-24 - 2016-08-09 - - - - - FreeBSD -- SSL protocol flaw - - - FreeBSD - 6.36.3_14 - 6.46.4_8 - 7.17.1_9 - 7.27.2_5 - 8.08.0_1 - - - - -

Problem Description:

-

The SSL version 3 and TLS protocols support session - renegotiation without cryptographically tying the new - session parameters to the old parameters.

- - - - SA-09:15.ssl - - - 2009-12-03 - 2010-10-24 - 2016-08-09 - - - - - monotone -- remote denial of service in default setup - - - monotone - 0.48.1 - - - - -

The monotone developers report:

-
-

Running "mtn ''" or "mtn ls ''" doesn't cause an internal - error anymore. In monotone 0.48 and earlier this behavior - could be used to crash a server remotely (but only if it was - configured to allow execution of remote commands).

-
- - - - ports/151665 - http://www.monotone.ca/NEWS - http://www.thomaskeller.biz/blog/2010/10/22/monotone-0-48-1-released-please-update-your-servers/ - - - 2010-10-21 - 2010-10-24 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 3.6.*,13.6.11,1 - 3.5.*,13.5.14,1 - - - libxul - 1.9.2.*1.9.2.11 - - - linux-firefox - 3.6.11,1 - - - linux-firefox-devel - 3.5.14 - - - seamonkey - 2.0.*2.0.9 - - - thunderbird - 3.03.0.9 - 3.13.1.5 - - - - -

The Mozilla Project reports:

-
-

MFSA 2010-64 Miscellaneous memory safety hazards (rv:1.9.2.11/ 1.9.1.14)

-

MFSA 2010-65 Buffer overflow and memory corruption using document.write

-

MFSA 2010-66 Use-after-free error in nsBarProp

-

MFSA 2010-67 Dangling pointer vulnerability in LookupGetterOrSetter

-

MFSA 2010-68 XSS in gopher parser when parsing hrefs

-

MFSA 2010-69 Cross-site information disclosure via modal calls

-

MFSA 2010-70 SSL wildcard certificate matching IP addresses

-

MFSA 2010-71 Unsafe library loading vulnerabilities

-

MFSA 2010-72 Insecure Diffie-Hellman key exchange

-
- - - - CVE-2010-3170 - CVE-2010-3173 - CVE-2010-3174 - CVE-2010-3175 - CVE-2010-3176 - CVE-2010-3177 - CVE-2010-3178 - CVE-2010-3179 - CVE-2010-3180 - CVE-2010-3181 - CVE-2010-3182 - CVE-2010-3183 - http://www.mozilla.org/security/announce/2010/mfsa2010-64.html - http://www.mozilla.org/security/announce/2010/mfsa2010-65.html - http://www.mozilla.org/security/announce/2010/mfsa2010-66.html - http://www.mozilla.org/security/announce/2010/mfsa2010-67.html - http://www.mozilla.org/security/announce/2010/mfsa2010-68.html - http://www.mozilla.org/security/announce/2010/mfsa2010-69.html - http://www.mozilla.org/security/announce/2010/mfsa2010-70.html - http://www.mozilla.org/security/announce/2010/mfsa2010-71.html - http://www.mozilla.org/security/announce/2010/mfsa2010-72.html - - - 2010-10-19 - 2010-10-20 - - - - - Webkit-gtk2 -- Multiple Vulnabilities - - - webkit-gtk2 - 1.2.5 - - - - -

Gustavo Noronha Silva reports:

-
-

The patches to fix the following CVEs are included with help from - Vincent Danen and other members of the Red Hat security team:

-
- - - - CVE-2010-1780 - CVE-2010-1807 - CVE-2010-1812 - CVE-2010-1814 - CVE-2010-1815 - CVE-2010-3113 - CVE-2010-3114 - CVE-2010-3115 - CVE-2010-3116 - CVE-2010-3255 - CVE-2010-3257 - CVE-2010-3259 - http://gitorious.org/webkitgtk/stable/blobs/master/WebKit/gtk/NEWS - - - 2010-10-01 - 2010-10-19 - - - - - apr -- multiple vunerabilities - - - apr1 - 1.4.2.1.3.10 - - - apr0 - 0.9.19.0.9.19 - - - - -

Secunia reports:

-
-

Multiple vulnerabilities have been reported in APR-util, which can - be exploited by malicious people to cause a DoS (Denial of - Service).

-

Two XML parsing vulnerabilities exist in the bundled version of - expat.

-

An error within the "apr_brigade_split_line()" function in - buckets/apr_brigade.c can be exploited to cause high memory - consumption.

-
- - - - 43673 - CVE-2009-3560 - CVE-2009-3720 - CVE-2010-1623 - http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.3 - http://secunia.com/advisories/41701 - - - 2010-10-02 - 2010-10-06 - 2010-10-20 - - - - - phpmyfaq -- cross site scripting vulnerabilities - - - phpmyfaq - 2.6.9 - - - - -

The phpMyFAQ project reports:

-
-

The phpMyFAQ Team has learned of a security issue that has been - discovered in phpMyFAQ 2.6.x: phpMyFAQ doesn't sanitize - some variables in different pages correctly. With a - properly crafted URL it is e.g. possible to inject - JavaScript code into the output of a page, which could - result in the leakage of domain cookies (f.e. session - identifiers)..

-
- - - - ports/151055 - http://www.phpmyfaq.de/advisory_2010-09-28.php - - - 2010-09-28 - 2010-10-02 - - - - - horde-gollem -- XSS vulnerability - - - horde-gollem - 1.1.2 - - - - -

The Horde team reports:

-
-

The major changes compared to Gollem version H3 (1.1.1) are:

-

* Fixed an XSS vulnerability in the file viewer.

-
- - - - http://article.gmane.org/gmane.comp.horde.announce/523 - http://git.horde.org/diff.php/gollem/docs/CHANGES?rt=horde&r1=1.114.2.55&r2=1.114.2.59&ty=h - http://bugs.horde.org/ticket/9191 - - - 2010-08-21 - 2010-09-28 - - - - - horde-imp -- XSS vulnerability - - - horde-imp - 4.2,14.3.8,1 - 4.3.8 - - - - -

The Horde team reports:

-
-

Thanks to Naumann IT Security Consulting for reporting the XSS - vulnerability.

-

The major changes compared to IMP version H3 (4.3.7) are:

-

* Fixed an XSS vulnerability in the Fetchmail configuration.

-
- - - - http://article.gmane.org/gmane.comp.horde.announce/516 - http://git.horde.org/diff.php/imp/docs/CHANGES?rt=horde&r1=1.699.2.424&r2=1.699.2.430&ty=h - - - 2010-09-28 - 2010-09-28 - 2011-09-23 - - - - - horde-base -- XSS and CSRF vulnerabilities - - - horde-base - 3.3.9 - - - - -

The Horde team reports:

-
-

Thanks to Naumann IT Security Consulting for reporting the XSS - vulnerability.

-

Thanks to Secunia for releasing an advisory for the new CSRF - protection in the preference interface

-

The major changes compared to Horde version 3.3.8 are:

-

* Fixed XSS vulnerability in util/icon_browser.php.

-

* Protected preference forms against CSRF attacks.

-
- - - - http://article.gmane.org/gmane.comp.horde.announce/515 - http://cvs.horde.org/diff.php/horde/docs/CHANGES?rt=horde&r1=1.515.2.607&r2=1.515.2.620&ty=h - http://secunia.com/advisories/39860/ - http://holisticinfosec.org/content/view/145/45/ - - - 2010-06-03 - 2010-09-28 - - - - - openx -- remote code execution vulnerability - - - openx - 2.8.7 - - - - -

The OpenX project reported:

-
-

It has been brought to our attention that there is a vulnerability - in the 2.8 downloadable version of OpenX that can result in a server - running the downloaded version of OpenX being compromised.

-
-

This vulnerability exists in the file upload functionality - and allows attackers to upload and execute PHP code of - their choice.

- - - - http://blog.openx.org/09/security-update/ - http://www.h-online.com/security/news/item/Web-sites-distribute-malware-via-hacked-OpenX-servers-1079099.html - - - 2010-09-14 - 2010-09-26 - - - - - squid -- Denial of service vulnerability in request handling - - - squid - 3.0.13.0.25_3 - 3.1.0.13.1.8 - - - - -

Squid security advisory 2010:3 reports:

-
-

Due to an internal error in string handling Squid is - vulnerable to a denial of service attack when processing - specially crafted requests.

-

This problem allows any trusted client to perform a - denial of service attack on the Squid service.

-
- - - - CVE-2010-3072 - http://www.squid-cache.org/Advisories/SQUID-2010_3.txt - - - 2010-08-30 - 2010-09-24 - - - - - linux-flashplugin -- remote code execution - - - linux-flashplugin - 9.0r283 - - - linux-f8-flashplugin - linux-f10-flashplugin - 10.1r85 - - - - -

Adobe Product Security Incident Response Team reports:

-
-

A critical vulnerability exists in Adobe Flash Player - 10.1.82.76 and earlier versions for Windows, Macintosh, - Linux, Solaris, and Adobe Flash Player 10.1.92.10 for - Android. This vulnerability also affects Adobe Reader - 9.3.4 and earlier versions for Windows, Macintosh and - UNIX, and Adobe Acrobat 9.3.4 and earlier versions for - Windows and Macintosh. This vulnerability (CVE-2010-2884) - could cause a crash and potentially allow an attacker - to take control of the affected system. There are - reports that this vulnerability is being actively - exploited in the wild against Adobe Flash Player on - Windows. Adobe is not aware of any attacks exploiting - this vulnerability against Adobe Reader or Acrobat to - date.

-
- - - - CVE-2010-2884 - http://www.adobe.com/support/security/advisories/apsa10-03.html - - - 2010-09-14 - 2010-09-22 - - - - - django -- cross-site scripting vulnerability - - - py23-django - py24-django - py25-django - py26-django - py30-django - py31-django - 1.21.2.2 - - - py23-django-devel - py24-django-devel - py25-django-devel - py26-django-devel - py30-django-devel - py31-django-devel - 13698,1 - - - - -

Django project reports:

-
-

The provided template tag for inserting the CSRF - token into forms -- {% csrf_token %} -- explicitly - trusts the cookie value, and displays it as-is. - Thus, an attacker who is able to tamper with the - value of the CSRF cookie can cause arbitrary content - to be inserted, unescaped, into the outgoing HTML of - the form, enabling cross-site scripting (XSS) attacks.

-
- - - - 43116 - CVE-2010-3082 - http://xforce.iss.net/xforce/xfdb/61729 - - - 2010-09-13 - 2010-09-17 - - - - - webkit-gtk2 -- Multiple vulnerabilities - - - webkit-gtk2 - 1.2.4 - - - - -

Gustavo Noronha Silva reports:

-
-

With help from Vincent Danen and other members of the Red Hat - security team, the following CVE's where fixed.

-
- - - - CVE-2010-1781 - CVE-2010-1782 - CVE-2010-1784 - CVE-2010-1785 - CVE-2010-1786 - CVE-2010-1787 - CVE-2010-1788 - CVE-2010-1790 - CVE-2010-1792 - CVE-2010-1793 - CVE-2010-2647 - CVE-2010-2648 - CVE-2010-3119 - http://gitorious.org/webkitgtk/stable/commit/9d07fda89aab7105962d933eef32ca15dda610d8 - - - 2010-09-07 - 2010-09-10 - - - - - vim6 -- heap-based overflow while parsing shell metacharacters - - - vim6 - vim6+ruby - 6.2.4296.3.62 - - - - -

Description for CVE-2008-3432 says:

-
-

Heap-based buffer overflow in the mch_expand_wildcards - function in os_unix.c in Vim 6.2 and 6.3 allows user-assisted - attackers to execute arbitrary code via shell metacharacters - in filenames, as demonstrated by the netrw.v3 test case.

-
- - - - CVE-2008-3432 - http://www.openwall.com/lists/oss-security/2008/07/15/4 - - - 2008-07-31 - 2010-09-09 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 3.6.*,13.6.9,1 - 3.5.*,13.5.12,1 - - - libxul - 1.9.2.*1.9.2.9 - - - linux-firefox - 3.6.9,1 - - - linux-firefox-devel - 3.5.12 - - - seamonkey - 2.0.*2.0.7 - - - thunderbird - 3.03.0.7 - 3.13.1.3 - - - - -

The Mozilla Project reports:

-
-

MFSA 2010-49 Miscellaneous memory safety hazards (rv:1.9.2.9/ 1.9.1.12)

-

MFSA 2010-50 Frameset integer overflow vulnerability

-

MFSA 2010-51 Dangling pointer vulnerability using DOM plugin array

-

MFSA 2010-52 Windows XP DLL loading vulnerability

-

MFSA 2010-53 Heap buffer overflow in nsTextFrameUtils::TransformText

-

MFSA 2010-54 Dangling pointer vulnerability in nsTreeSelection

-

MFSA 2010-55 XUL tree removal crash and remote code execution

-

MFSA 2010-56 Dangling pointer vulnerability in nsTreeContentView

-

MFSA 2010-57 Crash and remote code execution in normalizeDocument

-

MFSA 2010-58 Crash on Mac using fuzzed font in data: URL

-

MFSA 2010-59 SJOW creates scope chains ending in outer object

-

MFSA 2010-60 XSS using SJOW scripted function

-

MFSA 2010-61 UTF-7 XSS by overriding document charset using object type attribute

-

MFSA 2010-62 Copy-and-paste or drag-and-drop into designMode document allows XSS

-

MFSA 2010-63 Information leak via XMLHttpRequest statusText

-
- - - - CVE-2010-2762 - CVE-2010-2763 - CVE-2010-2764 - CVE-2010-2765 - CVE-2010-2766 - CVE-2010-2767 - CVE-2010-2768 - CVE-2010-2769 - CVE-2010-2770 - CVE-2010-2760 - CVE-2010-3131 - CVE-2010-3166 - CVE-2010-3167 - CVE-2010-3168 - CVE-2010-3169 - http://www.mozilla.org/security/announce/2010/mfsa2010-49.html - http://www.mozilla.org/security/announce/2010/mfsa2010-50.html - http://www.mozilla.org/security/announce/2010/mfsa2010-51.html - http://www.mozilla.org/security/announce/2010/mfsa2010-52.html - http://www.mozilla.org/security/announce/2010/mfsa2010-53.html - http://www.mozilla.org/security/announce/2010/mfsa2010-54.html - http://www.mozilla.org/security/announce/2010/mfsa2010-55.html - http://www.mozilla.org/security/announce/2010/mfsa2010-56.html - http://www.mozilla.org/security/announce/2010/mfsa2010-57.html - http://www.mozilla.org/security/announce/2010/mfsa2010-58.html - http://www.mozilla.org/security/announce/2010/mfsa2010-59.html - http://www.mozilla.org/security/announce/2010/mfsa2010-60.html - http://www.mozilla.org/security/announce/2010/mfsa2010-61.html - http://www.mozilla.org/security/announce/2010/mfsa2010-62.html - http://www.mozilla.org/security/announce/2010/mfsa2010-63.html - - - 2010-09-07 - 2010-09-08 - 2010-09-15 - - - - - sudo -- Flaw in Runas group matching - - - sudo - 1.7.01.7.4.4 - - - - -

Todd Miller reports:

-
-

Beginning with sudo version 1.7.0 it has been possible to grant - permission to run a command using a specified group via sudo -g - option (run as group). A flaw exists in the logic that matches - Runas groups in the sudoers file when the -u option is also - specified (run as user). This flaw results in a positive match for - the user specified via -u so long as the group specified via -g - is allowed by the sudoers file.

-

Exploitation of the flaw requires that Sudo be configured with - sudoers entries that contain a Runas group. Entries that do not - contain a Runas group, or only contain a Runas user are not - affected.

-
- - - - CVE-2010-2956 - http://www.sudo.ws/sudo/alerts/runas_group.html - - - 2010-09-07 - 2010-09-07 - - - - - lftp -- multiple HTTP client download filename vulnerability - - - lftp - 4.0.6 - - - - -

The get1 command, as used by lftpget, in LFTP before 4.0.6 does - not properly validate a server-provided filename before determining - the destination filename of a download, which allows remote servers - to create or overwrite arbitrary files via a Content-Disposition - header that suggests a crafted filename, and possibly execute - arbitrary code as a consequence of writing to a dotfile in a home - directory.

- - - - CVE-2010-2251 - https://bugzilla.redhat.com/show_bug.cgi?id=591580 - - - 2010-06-09 - 2010-09-03 - - - - - wget -- multiple HTTP client download filename vulnerability - - - wget - wget-devel - 1.12_1 - - - - -

GNU Wget version 1.12 and earlier uses a server-provided filename - instead of the original URL to determine the destination filename of - a download, which allows remote servers to create or overwrite - arbitrary files via a 3xx redirect to a URL with a .wgetrc filename - followed by a 3xx redirect to a URL with a crafted filename, and - possibly execute arbitrary code as a consequence of writing to a - dotfile in a home directory.

- - - - CVE-2010-2252 - https://bugzilla.redhat.com/show_bug.cgi?id=602797 - - - 2010-06-09 - 2010-09-03 - - - - - p5-libwww -- possibility to remote servers to create file with a .(dot) character - - - p5-libwww - 5.835 - - - - -

lwp-download in libwww-perl before 5.835 does not reject downloads - to filenames that begin with a `.' (dot) character, which allows - remote servers to create or overwrite files via a 3xx redirect to a - URL with a crafted filename or a Content-Disposition header that - suggests a crafted filename, and possibly execute arbitrary code as - a consequence of writing to a dotfile in a home directory.

- - - - CVE-2010-2253 - http://cpansearch.perl.org/src/GAAS/libwww-perl-5.836/Changes - - - 2010-06-09 - 2010-08-31 - - - - - quagga -- stack overflow and DoS vulnerabilities - - - quagga - 0.99.17 - - - - -

The Red Hat security team reported two vulnerabilities:

-
-

A stack buffer overflow flaw was found in the way Quagga's bgpd - daemon processed Route-Refresh messages. A configured - Border Gateway Protocol (BGP) peer could send a - Route-Refresh message with specially-crafted Outbound - Route Filtering (ORF) record, which would cause the - master BGP daemon (bgpd) to crash or, possibly, execute - arbitrary code with the privileges of the user running - bgpd.

-

A NULL pointer dereference flaw was found in the way - Quagga's bgpd daemon parsed paths of autonomous systems - (AS). A configured BGP peer could send a BGP update AS - path request with unknown AS type, which could lead to - denial of service (bgpd daemon crash).

-
- - - - http://www.openwall.com/lists/oss-security/2010/08/24/3 - http://www.quagga.net/news2.php?y=2010&m=8&d=19#id1282241100 - - - 2010-08-24 - 2010-08-25 - - - - - bugzilla -- information disclosure, denial of service - - - bugzilla - 2.17.13.6.2 - - - - -

A Bugzilla Security Advisory reports:

-
-
    -
  • Remote Information Disclosure: - An unprivileged user is normally not allowed to view - other users' group membership. But boolean charts - let the user use group-based pronouns, indirectly - disclosing group membership. This security fix - restricts the use of pronouns to groups the user - belongs to.
    • -
  • Notification Bypass: - Normally, when a user is impersonated, he receives - an email informing him that he is being impersonated, - containing the identity of the impersonator. However, - it was possible to impersonate a user without this - notification being sent.
    • -
  • Remote Information Disclosure: - An error message thrown by the "Reports" and "Duplicates" - page confirmed the non-existence of products, thus - allowing users to guess confidential product names. - (Note that the "Duplicates" page was not vulnerable - in Bugzilla 3.6rc1 and above though.)
    • -
  • Denial of Service: - If a comment contained the phrases "bug X" or - "attachment X", where X was an integer larger than the - maximum 32-bit signed integer size, PostgreSQL would - throw an error, and any page containing that comment would - not be viewable. On most Bugzillas, any user can enter - a comment on any bug, so any user could have used this to - deny access to one or all bugs. Bugzillas running on - databases other than PostgreSQL are not affected.
    • -
-
- - - - CVE-2010-2756 - CVE-2010-2757 - CVE-2010-2758 - CVE-2010-2759 - https://bugzilla.mozilla.org/show_bug.cgi?id=417048 - https://bugzilla.mozilla.org/show_bug.cgi?id=450013 - https://bugzilla.mozilla.org/show_bug.cgi?id=577139 - https://bugzilla.mozilla.org/show_bug.cgi?id=519835 - https://bugzilla.mozilla.org/show_bug.cgi?id=583690 - - - 2010-08-05 - 2010-08-24 - - - - - OpenTTD -- Denial of service (server) via infinite loop - - - openttd - 1.0.11.0.3 - - - - -

The OpenTTD Team reports:

-
-

When multiple commands are queued (at the server) for execution - in the next game tick and an client joins the server can get into - an infinite loop. With the default settings triggering this bug - is difficult (if not impossible), however the larger value of - the "frame_freq" setting is easier it is to trigger the bug.

-
- - - - CVE-2010-2534 - http://security.openttd.org/en/CVE-2010-2534 - - - 2010-06-27 - 2010-08-22 - - - - - corkscrew -- buffer overflow vulnerability - - - corkscrew - 2.0 - - - - -

The affected corkscrew versions use sscanf calls without proper - bounds checking. In the authentication file parsing routine - this can cause an exploitable buffer overflow condition. - A similar but issue exists in the server response code but - appears to be non-exploitable.

- - - - http://people.freebsd.org/~niels/issues/corkscrew-20100821.txt - - - 2010-08-21 - 2010-08-21 - - - - - phpmyadmin -- Several XSS vulnerabilities - - - phpMyAdmin - 3.3.5.1 - - - phpMyAdmin211 - 2.11.10.1 - - - - -

phpMyAdmin Team reports:

-
-

It was possible to conduct a XSS attack using crafted URLs org - POST parameters on several pages.

-
- - - - CVE-2010-3056 - http://www.phpmyadmin.net/home_page/security/PMASA-2010-5.php - - - 2010-08-09 - 2010-08-21 - - - - - slim -- insecure PATH assignment - - - slim - 1.3.2 - - - - -

SLiM assigns logged on users a PATH in which the current - working directory ("./") is included. This PATH can allow - unintentional code execution through planted binaries and - has therefore been fixed SLiM version 1.3.2.

- - - - CVE-2010-2945 - http://seclists.org/oss-sec/2010/q3/198 - - - 2010-05-12 - 2010-08-19 - 2010-08-20 - - - - - ruby -- UTF-7 encoding XSS vulnerability in WEBrick - - - ruby - ruby+pthreads - ruby+pthreads+oniguruma - ruby+oniguruma - 1.8.*,11.8.7.248_3,1 - 1.9.*,11.9.1.430,1 - - - - -

The official ruby site reports:

-
-

WEBrick have had a cross-site scripting vulnerability that allows - an attacker to inject arbitrary script or HTML via a crafted URI. - This does not affect user agents that strictly implement HTTP/1.1, - however, some user agents do not.

-
- - - - 40895 - CVE-2010-0541 - http://www.ruby-lang.org/en/news/2010/08/16/xss-in-webrick-cve-2010-0541/ - - - 2010-08-16 - 2010-08-17 - 2010-08-20 - - - - - isolate -- local root exploit - - - isolate - 20100717 - - - - -
-

Isolate currently suffers from some bad security bugs! These - are local root privilege escalation bugs. Thanks to the helpful - person who reported them (email Chris if you want credit!). - We're working to fix them ASAP, but until then, isolate is - unsafe and you should uninstall it. Sorry!

-
- - - - ports/148911 - http://code.google.com/p/isolate/ - - - 2010-07-29 - 2010-08-13 - - - - - vlc -- invalid id3v2 tags may lead to invalid memory dereferencing - - - vlc - 0.9.0,31.1.2_1,3 - - - - -

VideoLAN project reports:

-
-

VLC fails to perform sufficient input validation when trying to - extract some meta-informations about input media through ID3v2 - tags. In the failure case, VLC attempt dereference an invalid - memory address, and a crash will ensure.

-
- - - - CVE-2010-2937 - http://www.videolan.org/security/sa1004.html - - - 2010-07-29 - 2010-08-14 - - - - - linux-flashplugin -- multiple vulnerabilities - - - linux-flashplugin - 9.0r280 - - - linux-f8-flashplugin - linux-f10-flashplugin - 10.1r82 - - - - -

Adobe Product Security Incident Response Team reports:

-
-

Critical vulnerabilities have been identified in Adobe - Flash Player version 10.1.53.64 and earlier. These - vulnerabilities could cause the application to crash and - could potentially allow an attacker to take control of the - affected system.

-
- - - - CVE-2010-0209 - CVE-2010-2188 - CVE-2010-2213 - CVE-2010-2214 - CVE-2010-2215 - CVE-2010-2216 - http://www.adobe.com/support/security/bulletins/apsb10-16.html - - - 2010-01-06 - 2010-08-13 - - - - - opera -- multiple vulnerabilities - - - opera - 10.61 - - - - -

The Opera Destkop Team reports:

-
-
    -
  • Fixed an issue where heap buffer overflow in HTML5 canvas could - be used to execute arbitrary code, as reported by Kuzzcc.
    • -
  • Fixed an issue where unexpected changes in tab focus could be - used to run programs from the Internet, as reported by Jakob Balle - and Sven Krewitt of Secunia.
    • -
  • Fixed an issue where news feed preview could subscribe to feeds - without interaction, as reported by Alexios Fakos.
    • -
-
- - - - http://www.opera.com/support/search/view/966/ - http://www.opera.com/support/search/view/967/ - http://www.opera.com/support/search/view/968/ - - - 2010-08-12 - 2010-08-13 - - - - - firefox -- Dangling pointer crash regression from plugin parameter array fix - - - firefox - 3.6.*,13.6.8,1 - - - linux-firefox - 3.6.8,1 - - - - -

The Mozilla Project reports:

-
-

MFSA 2010-48 Dangling pointer crash regression from plugin parameter array fix

-
- - - - CVE-2010-2755 - https://www.mozilla.org/security/announce/2010/mfsa2010-48.html - - - 2010-07-20 - 2010-08-09 - - - - - Piwik -- Local File Inclusion Vulnerability - - - piwik - 0.60.6.3 - - - - -

Piwik versions 0.6 through 0.6.3 are vulnerable to arbitrary, - remote file inclusion using a directory traversal pattern infinite - a crafted request for a data renderer.

-
-

A vulnerability has been reported in Piwik, which can before - exploited by malicious people to disclose potentially - sensitive information. Input passed to unspecified parameters - when requesting a data renderer is not properly verified before - being used to include files. This can be exploited to includes - arbitrary files from local resources via directory traversal - attacks.

-
- - - - CVE-2010-2786 - http://secunia.com/advisories/40703 - - - 2010-07-28 - 2010-08-04 - - - - - libmspack -- infinite loop denial of service - - - libmspack - 0.0.20060920 - - - cabextract - 1.3 - - - - -

There is a denial of service vulnerability in libmspack. The - libmspack code is built into cabextract, so it is also - vulnerable.

-

Secunia reports:

-
-

The vulnerability is caused due to an error when copying data - from an uncompressed block (block type 0) and can be exploited - to trigger an infinite loop by tricking an application using the - library into processing specially crafted MS-ZIP archives.

-
- - - - http://secunia.com/advisories/40719/ - - - 2010-07-26 - 2010-07-30 - - - - - apache -- Remote DoS bug in mod_cache and mod_dav - - - apache - 2.2.02.2.16 - - - - -

Apache ChangeLog reports:

-
-

mod_dav, mod_cache: Fix Handling of requests without a path segment.

-
- - - - CVE-2010-1452 - http://www.apache.org/dist/httpd/CHANGES_2.2.16 - https://issues.apache.org/bugzilla/show_bug.cgi?id=49246 - http://svn.apache.org/viewvc?view=revision&revision=966349 - - - 2010-07-21 - 2010-07-26 - - - - - git -- buffer overflow vulnerability - - - git - 1.5.61.7.1.1_1 - - - - -

Greg Brockman reports:

-
-

If an attacker were to create a crafted working copy where the - user runs any git command, the attacker could force execution - of arbitrary code.

-
- - - - CVE-2010-2542 - http://git.kernel.org/?p=git/git.git;a=commit;h=3c9d0414ed2db0167e6c828b547be8fc9f88fccc - http://www.openwall.com/lists/oss-security/2010/07/22/1 - - - 2010-07-20 - 2010-07-23 - - - - - codeigniter -- file upload class vulnerability - - - codeigniter - 1.7.2_1 - - - - -

Derek Jones reports:

-
-

A fix has been implemented for a security flaw in - CodeIgniter 1.7.2. All applications using the File - Upload class should install the patch to ensure that - their application is not subject to a vulnerability.

-
- - - - http://codeigniter.com/news/codeigniter_1.7.2_security_patch/ - http://www.phpframeworks.com/news/p/16365/codeigniter-1-7-2-security-patch - - - 2010-07-12 - 2010-07-21 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 3.6.*,13.6.7,1 - 3.5.*,13.5.11,1 - - - linux-firefox - 3.6.7,1 - - - linux-firefox-devel - 3.5.11 - - - seamonkey - 2.0.*2.0.6 - - - thunderbird - 3.03.0.6 - - - - -

The Mozilla Project reports:

-
-

MFSA 2010-34 Miscellaneous memory safety hazards (rv:1.9.2.7/ 1.9.1.11)

-

MFSA 2010-35 DOM attribute cloning remote code execution vulnerability

-

MFSA 2010-36 Use-after-free error in NodeIterator

-

MFSA 2010-37 Plugin parameter EnsureCachedAttrParamArrays remote code execution vulnerability

-

MFSA 2010-38 Arbitrary code execution using SJOW and fast native function

-

MFSA 2010-39 nsCSSValue::Array index integer overflow

-

MFSA 2010-40 nsTreeSelection dangling pointer remote code execution vulnerability

-

MFSA 2010-41 Remote code execution using malformed PNG image

-

MFSA 2010-42 Cross-origin data disclosure via Web Workers and importScripts

-

MFSA 2010-43 Same-origin bypass using canvas context

-

MFSA 2010-44 Characters mapped to U+FFFD in 8 bit encodings cause subsequent character to vanish

-

MFSA 2010-45 Multiple location bar spoofing vulnerabilities

-

MFSA 2010-46 Cross-domain data theft using CSS

-

MFSA 2010-47 Cross-origin data leakage from script filename in error messages

-
- - - - CVE-2010-0654 - CVE-2010-1205 - CVE-2010-1206 - CVE-2010-1207 - CVE-2010-1208 - CVE-2010-1209 - CVE-2010-1210 - CVE-2010-1211 - CVE-2010-1212 - CVE-2010-1213 - CVE-2010-1214 - CVE-2010-1215 - CVE-2010-2751 - CVE-2010-2752 - CVE-2010-2753 - CVE-2010-2754 - http://www.mozilla.org/security/announce/2010/mfsa2010-34.html - http://www.mozilla.org/security/announce/2010/mfsa2010-35.html - http://www.mozilla.org/security/announce/2010/mfsa2010-36.html - http://www.mozilla.org/security/announce/2010/mfsa2010-37.html - http://www.mozilla.org/security/announce/2010/mfsa2010-38.html - http://www.mozilla.org/security/announce/2010/mfsa2010-39.html - http://www.mozilla.org/security/announce/2010/mfsa2010-40.html - http://www.mozilla.org/security/announce/2010/mfsa2010-41.html - http://www.mozilla.org/security/announce/2010/mfsa2010-42.html - http://www.mozilla.org/security/announce/2010/mfsa2010-43.html - http://www.mozilla.org/security/announce/2010/mfsa2010-44.html - http://www.mozilla.org/security/announce/2010/mfsa2010-45.html - http://www.mozilla.org/security/announce/2010/mfsa2010-46.html - http://www.mozilla.org/security/announce/2010/mfsa2010-47.html - - - 2010-07-20 - 2010-07-21 - - - - - vte -- Classic terminal title set+query attack - - - vte - 0.24.3 - - - - -

Kees Cook reports:

-
-

Janne Snabb discovered that applications using VTE, such as - gnome-terminal, did not correctly filter window and icon title - request escape codes. If a user were tricked into viewing - specially crafted output in their terminal, a remote attacker - could execute arbitrary commands with user privileges.

-
- - - - CVE-2010-2713 - http://www.securityfocus.com/archive/1/512388 - - - 2010-07-15 - 2010-07-18 - - - - - webkit-gtk2 -- Multiple vulnerabilities - - - webkit-gtk2 - 1.2.3 - - - - -

Gustavo Noronha reports:

-
-

Debian's Michael Gilbert has done a great job going through all - CVEs released about WebKit, and including patches in the Debian - package. 1.2.3 includes all of the commits from trunk to fix those, - too.

-
- - - - CVE-2010-1386 - CVE-2010-1392 - CVE-2010-1405 - CVE-2010-1407 - CVE-2010-1416 - CVE-2010-1417 - CVE-2010-1418 - CVE-2010-1421 - CVE-2010-1422 - CVE-2010-1501 - CVE-2010-1664 - CVE-2010-1665 - CVE-2010-1758 - CVE-2010-1759 - CVE-2010-1760 - CVE-2010-1761 - CVE-2010-1762 - CVE-2010-1767 - CVE-2010-1770 - CVE-2010-1771 - CVE-2010-1772 - CVE-2010-1773 - CVE-2010-1774 - CVE-2010-2264 - http://blog.kov.eti.br/?p=116 - - - 2010-07-16 - 2010-07-18 - - - - - redmine -- multiple vulnerabilities - - - redmine - 0.9.6 - - - - -

Eric Davis reports:

-
-

This security release addresses some security - vulnerabilities found in the advanced subversion - integration module (Redmine.pm perl script).

-
- - - - http://www.redmine.org/news/41 - - - 2010-07-08 - 2010-07-10 - - - - - bogofilter -- heap underrun on malformed base64 input - - - bogofilter - 1.2.1_2 - - - bogofilter-sqlite - 1.2.1_1 - - - bogofilter-tc - 1.2.1_1 - - - - -

Julius Plenz reports:

-
-

I found a bug in the base64_decode function which may cause memory - corruption when the function is executed on a malformed base64 - encoded string.

-

If a string starting with an equal-sign is passed to the - base64_decode function it triggers a memory corruption that - in some cases makes bogofilter crash.

-
- - - - CVE-2010-2494 - http://bogofilter.sourceforge.net/security/bogofilter-SA-2010-01 - - - 2010-06-28 - 2010-07-06 - - - - - bugzilla -- information disclosure - - - bugzilla - 2.17.13.6.1 - - - - -

A Bugzilla Security Advisory reports:

-
-
    -
  • Normally, information about time-tracking (estimated - hours, actual hours, hours worked, and deadlines) is - restricted to users in the "time-tracking group". - However, any user was able, by crafting their own - search URL, to search for bugs based using those - fields as criteria, thus possibly exposing sensitive - time-tracking information by a user seeing that a bug - matched their search.
    • -
  • If $use_suexec was set to "1" in the localconfig file, - then the localconfig file's permissions were set as - world-readable by checksetup.pl. This allowed any user - with local shell access to see the contents of the file, - including the database password and the site_wide_secret - variable used for CSRF protection.
    • -
-
- - - - CVE-2010-1204 - CVE-2010-0180 - https://bugzilla.mozilla.org/show_bug.cgi?id=309952 - https://bugzilla.mozilla.org/show_bug.cgi?id=561797 - - - 2010-06-24 - 2010-07-05 - - - - - kvirc -- multiple vulnerabilities - - - kvirc - kvirc-devel - 4.0.0 - - - - -

Two security vulnerabilities have been discovered:

-
-

Multiple format string vulnerabilities in the DCC functionality - in KVIrc 3.4 and 4.0 have unspecified impact and remote attack vectors.

-
-
-

Directory traversal vulnerability in the DCC functionality - in KVIrc 3.4 and 4.0 allows remote attackers to overwrite - arbitrary files via unknown vectors.

-
- - - - CVE-2010-2451 - CVE-2010-2452 - http://lists.omnikron.net/pipermail/kvirc/2010-May/000867.html - - - 2010-05-17 - 2010-06-30 - - - - - png -- libpng decompression buffer overflow - - - png - - 1.4.3 - - - - - -

The PNG project describes the problem in an advisory:

-
-

Several versions of libpng through 1.4.2 (and through 1.2.43 - in the older series) contain a bug whereby progressive - applications such as web browsers (or the rpng2 demo app included - in libpng) could receive an extra row of image data beyond the - height reported in the header, potentially leading to an - out-of-bounds write to memory (depending on how the application - is written) and the possibility of execution of an attacker's - code with the privileges of the libpng user (including remote - compromise in the case of a libpng-based browser visiting a - hostile web site).

-
- - - - 41174 - CVE-2010-1205 - http://www.libpng.org/pub/png/libpng.html - - - 2010-03-30 - 2010-06-28 - 2010-06-28 - - - - - moodle -- multiple vulnerabilities - - - moodle - 1.9.9 - - - - -

The Moodle release notes report multiple vulnerabilities - which could allow cross site scripting, XSS attacks, - unauthorised deletion of attempts in some instances.

- - - - http://docs.moodle.org/en/Moodle_1.9.9_release_notes - - - 2010-06-08 - 2010-06-28 - - - - - mDNSResponder -- corrupted stack crash when parsing bad resolv.conf - - - mDNSResponder - 214 - - - - -

Juli Mallett reports:

-
-

mdnsd will crash on some systems with a corrupt stack and once - that's fixed it will still leak a file descriptor when parsing - resolv.conf. The crash is because scanf is used with %10s for a - buffer that is only 10 chars long. The buffer size needs increased - to 11 chars to hold the trailing NUL. To fix the leak, an fclose - needs added.

-
- - - - ports/147007 - - - 2010-05-26 - 2010-06-27 - - - - - opera -- Data URIs can be used to allow cross-site scripting - - - opera - 10.11 - - - opera-devel - 10.20_2,1 - - - - -

The Opera Desktop Team reports:

-
-

Data URIs are allowed to run scripts that manipulate - pages from the site that directly opened them. In some cases, the opening site - is not correctly detected. In these cases, Data URIs may erroneously be able to - run scripts so that they interact with sites that did not directly cause them to - be opened.

-
- - - - http://www.opera.com/support/kb/view/955/ - - - 2010-06-21 - 2010-06-25 - - - - - cacti -- multiple vulnerabilities - - - cacti - 0.8.7f - - - - -

Multiple vulnerabilities have been reported to exist in older version of - Cacti. The release notes of Cacti 0.8.7f summarizes the problems as - follows:

-
-
    -
  • SQL injection and shell escaping issues
    • -
  • Cross-site scripting issues
    • -
  • Cacti Graph Viewer SQL injection vulnerability
    • -
-
- - - - http://php-security.org/2010/05/13/mops-2010-023-cacti-graph-viewer-sql-injection-vulnerability/index.html - http://www.cacti.net/release_notes_0_8_7f.php - http://www.bonsai-sec.com/en/research/vulnerabilities/cacti-os-command-injection-0105.php - http://www.vupen.com/english/advisories/2010/1204 - - - 2010-05-24 - 2010-06-24 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 3.6.*,13.6.4,1 - 3.5.*,13.5.10,1 - - - linux-firefox-devel - 3.5.10 - - - seamonkey - 2.0.*2.0.5 - - - thunderbird - 3.03.0.5 - - - - -

Mozilla Project reports:

-
-

MFSA 2010-33 User tracking across sites using Math.random()

-

MFSA 2010-32 Content-Disposition: attachment ignored if Content-Type: multipart also present

-

MFSA 2010-31 focus() behavior can be used to inject or steal keystrokes

-

MFSA 2010-30 Integer Overflow in XSLT Node Sorting

-

MFSA 2010-29 Heap buffer overflow in nsGenericDOMDataNode::SetTextInternal

-

MFSA 2010-28 Freed object reuse across plugin instances

-

MFSA 2010-27 Use-after-free error in nsCycleCollector::MarkRoots()

-

MFSA 2010-26 Crashes with evidence of memory corruption (rv:1.9.2.4/ 1.9.1.10)

-

MFSA 2010-25 Re-use of freed object due to scope confusion

-
- - - - CVE-2008-5913 - CVE-2010-0183 - CVE-2010-1121 - CVE-2010-1125 - CVE-2010-1197 - CVE-2010-1199 - CVE-2010-1196 - CVE-2010-1198 - CVE-2010-1200 - CVE-2010-1201 - CVE-2010-1202 - CVE-2010-1203 - http://www.mozilla.org/security/announce/2010/mfsa2010-33.html - http://www.mozilla.org/security/announce/2010/mfsa2010-32.html - http://www.mozilla.org/security/announce/2010/mfsa2010-31.html - http://www.mozilla.org/security/announce/2010/mfsa2010-30.html - http://www.mozilla.org/security/announce/2010/mfsa2010-29.html - http://www.mozilla.org/security/announce/2010/mfsa2010-28.html - http://www.mozilla.org/security/announce/2010/mfsa2010-27.html - http://www.mozilla.org/security/announce/2010/mfsa2010-26.html - http://www.mozilla.org/security/announce/2010/mfsa2010-25.html - - - 2010-06-22 - 2010-06-23 - - - - - ziproxy -- security vulnerability in PNG decoder - - - ziproxy - 3.1.0 - 3.1.1 - - - - -

Daniel Mealha Cabrita reports:

-
-

Fixed security vulnerability (heap-related) in PNG decoder. - (new bug from 3.1.0)

-
- - - - http://ziproxy.sourceforge.net/#news - http://sourceforge.net/mailarchive/message.php?msg_name=201006150731.30474.dancab%40gmx.net - - - 2010-06-15 - 2010-06-15 - - - - - tiff -- Multiple integer overflows - - - tiff - 3.9.4 - - - linux-tiff - linux-f10-tiff - 3.9.4 - - - - -

Tielei Wang:

-
-

Multiple integer overflows in inter-color spaces conversion - tools in libtiff 3.8 through 3.8.2, 3.9, and 4.0 allow - context-dependent attackers to execute arbitrary code via a - TIFF image with large (1) width and (2) height values, which - triggers a heap-based buffer overflow in the (a) cvt_whole_image - function in tiff2rgba and (b) tiffcvt function in rgb2ycbcr.

-
- - - - CVE-2009-2347 - http://www.remotesensing.org/libtiff/v3.9.4.html - http://www.ocert.org/advisories/ocert-2009-012.html - - - 2009-05-22 - 2010-06-16 - - - - - linux-flashplugin -- multiple vulnerabilities - - - linux-flashplugin - 9.0r277 - - - linux-f8-flashplugin - linux-f10-flashplugin - 10.1r53 - - - - -

Adobe Product Security Incident Response Team reports:

-
-

Critical vulnerabilities have been identified in Adobe - Flash Player version 10.0.45.2 and earlier. These - vulnerabilities could cause the application to crash and - could potentially allow an attacker to take control of the - affected system.

-
- - - - CVE-2008-4546 - CVE-2009-3793 - CVE-2010-1297 - CVE-2010-2160 - CVE-2010-2161 - CVE-2010-2162 - CVE-2010-2163 - CVE-2010-2164 - CVE-2010-2165 - CVE-2010-2166 - CVE-2010-2167 - CVE-2010-2169 - CVE-2010-2170 - CVE-2010-2171 - CVE-2010-2172 - CVE-2010-2173 - CVE-2010-2174 - CVE-2010-2175 - CVE-2010-2176 - CVE-2010-2177 - CVE-2010-2178 - CVE-2010-2179 - CVE-2010-2180 - CVE-2010-2181 - CVE-2010-2182 - CVE-2010-2183 - CVE-2010-2184 - CVE-2010-2185 - CVE-2010-2186 - CVE-2010-2187 - CVE-2010-2188 - CVE-2010-2189 - http://www.adobe.com/support/security/bulletins/apsb10-14.html - - - 2008-10-02 - 2010-06-14 - - - - - tiff -- buffer overflow vulnerability - - - tiff - 3.9.3 - - - linux-tiff - 3.9.3 - - - - -

Kevin Finisterre reports:

-
-

Multiple integer overflows in the handling of TIFF files may - result in a heap buffer overflow. Opening a maliciously crafted - TIFF file may lead to an unexpected application termination or - arbitrary code execution. The issues are addressed through - improved bounds checking. Credit to Kevin Finisterre of - digitalmunition.com for reporting these issues.

-
- - - - CVE-2010-1411 - http://www.remotesensing.org/libtiff/v3.9.3.html - http://support.apple.com/kb/HT4196 - - - 2010-04-15 - 2010-06-12 - - - - - sudo -- Secure path vulnerability - - - sudo - 1.7.2.7 - - - - -

Todd Miller reports:

-
-

Most versions of the C library function getenv() return the - first instance of an environment variable to the caller. However, - some programs, notably the GNU Bourne Again SHell (bash), do - their own environment parsing and may choose the last instance - of a variable rather than the first one.

-

An attacker may manipulate the environment of the process that - executes Sudo such that a second PATH variable is present. When - Sudo runs a bash script, it is this second PATH variable that - is used by bash, regardless of whether or not Sudo has overwritten - the first instance of PATH. This may allow an attacker to - subvert the program being run under Sudo and execute commands - he/she would not otherwise be allowed to run.

-
- - - - CVE-2010-1646 - http://sudo.ws/sudo/alerts/secure_path.html - - - 2010-06-02 - 2010-06-02 - - - - - ziproxy -- atypical huge picture files vulnerability - - - ziproxy - 3.0.1 - - - - -

Ziproxy 3.0.1 release fixes a security vulnerability related - to atypical huge picture files (>4GB of size once expanded).

- - - - 40344 - CVE-2010-1513 - http://ziproxy.sourceforge.net/#news - http://secunia.com/advisories/39941 - http://sourceforge.net/mailarchive/message.php?msg_name=201005210019.37119.dancab%40gmx.net - - - 2010-05-20 - 2010-05-28 - - - - - mediawiki -- two security vulnerabilities - - - mediawiki - 1.15.4 - - - - -

Two security vulnerabilities were discovered:

-
-

Noncompliant CSS parsing behaviour in Internet Explorer - allows attackers to construct CSS strings which are treated - as safe by previous versions of MediaWiki, but are decoded - to unsafe strings by Internet Explorer.

-

A CSRF vulnerability was discovered in our login interface. - Although regular logins are protected as of 1.15.3, it was - discovered that the account creation and password reset - reset features were not protected from CSRF. This could lead - to unauthorised access to private wikis.

-
- - - - http://secunia.com/advisories/39922/ - http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-May/000091.html - - - 2010-05-28 - 2010-06-02 - - - - - redmine -- multiple vulnerabilities - - - redmine - 0.9.4 - - - - -

The Redmine release announcement reports that - several cross side scripting vulnerabilities - and a potential data disclosure vulnerability have - been fixed in the latest release.

- - - - http://www.redmine.org/news/39 - - - 2010-05-01 - 2010-05-14 - - - - - wireshark -- DOCSIS dissector denial of service - - - wireshark - 1.2.6_1 - - - - -

A vulnerability found in the DOCSIS dissector can cause - Wireshark to crash when a malformed packet trace file is - opened. This means that an attacker will have to trick a - victim into opening such a trace file before being able - to crash the application

- - - - CVE-2010-1455 - http://www.wireshark.org/security/wnpa-sec-2010-03.html - http://www.wireshark.org/security/wnpa-sec-2010-04.html - - - 2010-05-05 - 2010-05-07 - - - - - piwik -- cross site scripting vulnerability - - - piwik - 0.5.5 - - - - -

The Piwik security advisory reports:

-
-

A non-persistent, cross-site scripting vulnerability - (XSS) was found in Piwik's Login form that reflected - the form_url parameter without being properly escaped - or filtered.

-
- - - - CVE-2010-1453 - http://piwik.org/blog/2010/04/piwik-0-6-security-advisory/ - - - 2010-04-15 - 2010-05-07 - - - - - spamass-milter -- remote command execution vulnerability - - - spamass-milter - 0.3.1_8 - - - - -

The spamassassin milter plugin contains a vulnerability - that can allow remote attackers to execute commands on - affected systems.

-

The vulnerability can be exploited trough a special-crafted - email header when the plugin was started with the '-x' - (expand) flag.

- - - - CVE-2010-1132 - http://archives.neohapsis.com/archives/fulldisclosure/2010-03/0139.html - http://xforce.iss.net/xforce/xfdb/56732 - - - 2010-03-07 - 2010-05-06 - - - - - mediawiki -- authenticated CSRF vulnerability - - - mediawiki - 1.15.3 - - - - -

A MediaWiki security announcement reports:

-
-

MediaWiki was found to be vulnerable to login CSRF. - An attacker who controls a user account on the target - wiki can force the victim to log in as the attacker, - via a script on an external website.

-

If the wiki is configured to allow user scripts, say - with "$wgAllowUserJs = true" in LocalSettings.php, then - the attacker can proceed to mount a phishing-style - attack against the victim to obtain their password.

-
- - - - CVE-2010-1150 - http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-April/000090.html - https://bugzilla.wikimedia.org/show_bug.cgi?id=23076 - - - 2010-04-07 - 2010-05-05 - - - - - lxr -- multiple XSS vulnerabilities - - - lxr - 0.9.6 - - - - -

Dan Rosenberg reports:

-
-

There are several cross-site scripting vulnerabilities - in LXR. These vulnerabilities could allow an attacker - to execute scripts in a user's browser, steal cookies - associated with vulnerable domains, redirect the user - to malicious websites, etc.

-
- - - - CVE-2009-4497 - ports/146337 - http://secunia.com/advisories/38117 - http://sourceforge.net/mailarchive/message.php?msg_name=E1NS2s4-0001PE-F2%403bkjzd1.ch3.sourceforge.com - - - 2010-01-05 - 2010-05-05 - - - - - vlc -- unintended code execution with specially crafted data - - - vlc - 1.0.6 - - - - -

VideoLAN project reports:

-
-

VLC media player suffers from various vulnerabilities when - attempting to parse malformatted or overly long byte streams.

-
- - - - 39629 - http://www.videolan.org/security/sa1003.html - - - 2010-04-19 - 2010-05-01 - 2010-05-05 - - - - - joomla -- multiple vulnerabilities - - - joomla15 - 1.5.11.5.15 - - - - -

Joomla! reported the following vulnerabilities:

-
-

If a user entered a URL with a negative query limit - or offset, a PHP notice would display revealing information - about the system..

-
-
-

The migration script in the Joomla! installer does not - check the file type being uploaded. If the installation - application is present, an attacker could use it to - upload malicious files to a server.

-
-
-

Session id doesn't get modified when user logs in. A - remote site may be able to forward a visitor to the - Joomla! site and set a specific cookie. If the user - then logs in, the remote site can use that cookie to - authenticate as that user.

-
-
-

When a user requests a password reset, the reset tokens - were stored in plain text in the database. While this - is not a vulnerability in itself, it allows user accounts - to be compromised if there is an extension on the site - with an SQL injection vulnerability.

-
- - - - http://developer.joomla.org/security/news/308-20100423-core-password-reset-tokens.html - http://developer.joomla.org/security/news/309-20100423-core-sessation-fixation.html - http://developer.joomla.org/security/news/310-20100423-core-installer-migration-script.html - http://developer.joomla.org/security/news/311-20100423-core-negative-values-for-limit-and-offset.html - - - 2010-04-23 - 2010-04-26 - - - - - cacti -- SQL injection and command execution vulnerabilities - - - cacti - 0.8.7e4 - - - - -

Bonsai information security reports:

-
-

A Vulnerability has been discovered in Cacti, which - can be exploited by any user to conduct SQL Injection - attacks. Input passed via the "export_item_id" parameter - to "templates_export.php" script is not properly sanitized - before being used in a SQL query.

-
-

The same source also reported a command execution - vulnerability. This second issue can be exploited by - Cacti users who have the rights to modify device or - graph configurations.

- - - - CVE-2010-1431 - ports/146021 - http://www.bonsai-sec.com/en/research/vulnerabilities/cacti-os-command-injection-0105.php - http://www.bonsai-sec.com/en/research/vulnerabilities/cacti-sql-injection-0104.php - http://www.debian.org/security/2010/dsa-2039 - - - 2010-04-21 - 2010-04-24 - 2013-06-16 - - - - - moodle -- multiple vulnerabilities - - - moodle - 1.9.8 - - - - -

The Moodle release notes report multiple vulnerabilities - which could allow remote attackers to perform, amongst - others, cross site scripting, user enumeration and SQL - injection attacks.

- - - - http://docs.moodle.org/en/Moodle_1.9.8_release_notes - - - 2010-03-25 - 2010-04-24 - - - - - tomcat -- information disclosure vulnerability - - - tomcat - 5.5.05.5.30 - 6.0.06.0.27 - - - - -

The Apache software foundation reports:

-
-

The "WWW-Authenticate" header for BASIC and DIGEST - authentication includes a realm name. If a <realm-name> - element is specified for the application in web.xml it - will be used. However, a <realm-name> is not - specified then Tomcat will generate one.

-

In some circumstances this can expose the local - hostname or IP address of the machine running Tomcat.

-
- - - - CVE-2010-1157 - ports/146022 - http://seclists.org/bugtraq/2010/Apr/200 - - - 2010-04-22 - 2010-04-24 - - - - - - - - - krb5 -- KDC double free vulnerability - - - krb5 - 1.71.7.2 - 1.81.8.2 - - - - -

The MIT Kerberos team reports:

-
-

An authenticated remote attacker can crash the KDC by - inducing the KDC to perform a double free. Under some - circumstances on some platforms, this could also allow - malicious code execution.

-
- - - - CVE-2010-1320 - http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-004.txt - - - 2010-04-20 - 2010-04-21 - - - - - e107 -- code execution and XSS vulnerabilities - - - e107 - 0.7.20 - - - - -

Secunia Research reported two vulnerabilities in e107:

-

The first problem affects installations that have the - Content Manager plugin enabled. This plugin does not - sanitize the "content_heading" parameter correctly and - is therefore vulnerable to a cross site scripting attack.

-

The second vulnerability is related to the avatar upload - functionality. Images containing PHP code can be uploaded - and executed.

- - - - 39540 - CVE-2010-0996 - CVE-2010-0997 - ports/145885 - http://e107.org/comment.php?comment.news.864 - http://secunia.com/secunia_research/2010-43/ - http://secunia.com/secunia_research/2010-44/ - http://xforce.iss.net/xforce/xfdb/57932 - - - 2010-04-15 - 2010-04-20 - - - - - fetchmail -- denial of service vulnerability - - - fetchmail - - 4.6.3 - 6.3.16 - - - - - -

Fetchmail developer Matthias Andree reported a vulnerability - that allows remote attackers to crash the application - when it is runs in verbose mode.

-
-

Fetchmail before release 6.3.17 did not properly - sanitize external input (mail headers and UID). When a - multi-character locale (such as UTF-8) was in use, this - could cause memory exhaustion and thus a denial of - service.

-
- - - - CVE-2010-1167 - ports/145857 - http://gitorious.org/fetchmail/fetchmail/commit/ec06293 - http://seclists.org/oss-sec/2010/q2/76 - - - 2010-04-18 - 2010-04-20 - - - - - pidgin -- multiple remote denial of service vulnerabilities - - - pidgin - 2.6.6 - - - libpurple - 2.6.6 - - - - -

Three denial of service vulnerabilities where found in - pidgin and allow remote attackers to crash the application. - The developers summarized these problems as follows:

-
-

Pidgin can become unresponsive when displaying large - numbers of smileys

-
-
-

Certain nicknames in group chat rooms can trigger a - crash in Finch

-
-
-

Failure to validate all fields of an incoming message - can trigger a crash

-
- - - - 38294 - CVE-2010-0277 - CVE-2010-0420 - CVE-2010-0423 - http://pidgin.im/news/security/?id=43 - http://pidgin.im/news/security/?id=44 - http://pidgin.im/news/security/?id=45 - - - 2010-02-18 - 2010-04-20 - - - - - png -- libpng decompression denial of service - - - png - - 1.2.43 - 1.4.1 - - - - - -

A vulnerability in libpng can result in denial of service - conditions when a remote attacker tricks a victim to open - a specially-crafted PNG file.

-

The PNG project describes the problem in an advisory:

-
-

Because of the efficient compression method used in - Portable Network Graphics (PNG) files, a small PNG file - can expand tremendously, acting as a "decompression - bomb".

-

Malformed PNG chunks can consume a large amount of CPU - and wall-clock time and large amounts of memory, up to - all memory available on a system

-
- - - - 38478 - 576029 - CVE-2010-0205 - http://libpng.sourceforge.net/ADVISORY-1.4.1.html - http://secunia.com/advisories/38774 - http://xforce.iss.net/xforce/xfdb/56661 - - - 2010-02-27 - 2010-04-20 - - - - - curl -- libcurl buffer overflow vulnerability - - - curl - - 7.10.5 - 7.20.0 - - - - - -

The cURL project reports in a security advisory:

-
-

Using the affected libcurl version to download compressed - content over HTTP, an application can ask libcurl to - automatically uncompress data. When doing so, libcurl - can wrongly send data up to 64K in size to the callback - which thus is much larger than the documented maximum - size.

-

An application that blindly trusts libcurl's max limit - for a fixed buffer size or similar is then a possible - target for a buffer overflow vulnerability.

-
- - - - CVE-2010-0734 - http://curl.haxx.se/docs/adv_20100209.html - http://www.debian.org/security/2010/dsa-2023 - http://www.openwall.com/lists/oss-security/2010/02/09/5 - - - 2010-02-09 - 2010-04-19 - - - - - ejabberd -- queue overload denial of service vulnerability - - - ejabberd - 2.1.3 - - - - -

The Red Hat security response team reports:

-
-

A remotely exploitable DoS from XMPP client to ejabberd - server via too many "client2server" messages (causing the - message queue on the server to get overloaded, leading - to server crash) has been found.

-
- - - - 38003 - CVE-2010-0305 - http://secunia.com/advisories/38337 - http://support.process-one.net/browse/EJAB-1173 - http://www.openwall.com/lists/oss-security/2010/01/29/1 - http://xforce.iss.net/xforce/xfdb/56025 - - - 2010-01-29 - 2010-04-19 - - - - - irssi -- multiple vulnerabilities - - - irssi - 0.8.15 - - - zh-irssi - 0.8.15 - - - irssi-devel - 20100325 - - - - -

Two vulnerabilities have found in irssi. The first issue - could allow man-in-the-middle attacks due to a missing - comparison of SSL server hostnames and the certificate - domain names (e.g. CN).

-

A second vulnerability, related to the nick matching code, - could be triggered by remote attackers in order to crash - an irssi client when leaving a channel.

- - - - CVE-2010-1155 - CVE-2010-1156 - http://xforce.iss.net/xforce/xfdb/57790 - http://xforce.iss.net/xforce/xfdb/57791 - - - 2010-04-16 - 2010-04-19 - - - - - krb5 -- remote denial of service vulnerability - - - krb5 - 1.6.3_9 - - - - -

An authenticated remote attacker can causing a denial - of service by using a newer version of the kadmin protocol - than the server supports.

-

The MIT Kerberos team also reports the cause:

-
-

The Kerberos administration daemon (kadmind) can crash - due to referencing freed memory.

-
- - - - 39247 - CVE-2010-0629 - http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-003.txt - - - 2010-04-06 - 2010-04-18 - - - - - krb5 -- multiple denial of service vulnerabilities - - - krb5 - - 1.71.7_2 - - - - - -

Two vulnerabilities in krb5 can be used by remote - attackers in denial of service attacks. The MIT security - advisories report this as follows:

-
-

An unauthenticated remote attacker can send an invalid - request to a KDC process that will cause it to crash - due to an assertion failure, creating a denial of - service.

-
-
-

An unauthenticated remote attacker could cause a GSS-API - application, including the Kerberos administration - daemon (kadmind) to crash.

-
- - - - 38260 - 38904 - CVE-2010-0283 - CVE-2010-0628 - http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-001.txt - http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-002.txt - - - 2010-02-16 - 2010-04-19 - 2013-06-16 - - - - - mahara -- sql injection vulnerability - - - mahara - 1.1.8 - - - - -

The Debian security team reports:

-
-

It was discovered that mahara, an electronic portfolio, - weblog, and resume builder is not properly escaping input - when generating a unique username based on a remote user - name from a single sign-on application. An attacker can - use this to compromise the mahara database via crafted - user names.

-
- - - - 39253 - CVE-2010-0400 - http://www.debian.org/security/2010/dsa-2030 - - - 2010-04-06 - 2010-04-18 - - - - - sudo -- Privilege escalation with sudoedit - - - sudo - 1.7.2.6 - - - - -

Todd Miller reports:

-
-

Sudo's command matching routine expects actual commands to include - one or more slash ('/') characters. The flaw is that sudo's path - resolution code did not add a "./" prefix to commands found in the - current working directory. This creates an ambiguity between a - "sudoedit" command found in the cwd and the "sudoedit" - pseudo-command in the sudoers file. As a result, a user may be - able to run an arbitrary command named "sudoedit" in the current - working directory. For the attack to be successful, the PATH - environment variable must include "." and may not include any other - directory that contains a "sudoedit" command.

-
- - - - CVE-2010-1163 - http://www.sudo.ws/pipermail/sudo-announce/2010-April/000093.html - http://www.sudo.ws/sudo/alerts/sudoedit_escalate2.html - - - 2010-04-09 - 2010-04-15 - - - - - KDM -- local privilege escalation vulnerability - - - kdebase - 3.5.10_6 - - - kdebase-workspace - 4.3.5_1 - - - - -

KDE Security Advisory reports:

-
-

KDM contains a race condition that allows local attackers - to make arbitrary files on the system world-writeable. - This can happen while KDM tries to create its control - socket during user login. A local attacker with a valid - local account can under certain circumstances make use of - this vulnerability to execute arbitrary code as root.

-
- - - - CVE-2010-0436 - http://www.kde.org/info/security/advisory-20100413-1.txt - - - 2010-04-13 - 2010-04-14 - 2010-04-14 - - - - - dojo -- cross-site scripting and other vulnerabilities - - - dojo - 1.4.2 - - - - -

The Dojo Toolkit team reports:

-
-

Some PHP files did not properly escape input.

-

Some files could operate like "open redirects". A bad actor - could form an URL that looks like it came from a trusted - site, but the user would be redirected or load content from - the bad actor's site.

-

A file exposed a more serious cross-site scripting - vulnerability with the possibility of executing code on the - domain where the file exists.

-

The Dojo build process defaulted to copying over tests and - demos, which are normally not needed and just increased the - number of files that could be targets of attacks.

-
- - - - http://dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisory/ - http://osdir.com/ml/bugtraq.security/2010-03/msg00133.html - http://packetstormsecurity.org/1003-exploits/dojo-xss.txt - http://secunia.com/advisories/38964 - http://www.gdssecurity.com/l/b/2010/03/12/multiple-dom-based-xss-in-dojo-toolkit-sdk/ - - - 2010-03-11 - 2010-04-06 - - - - - Zend Framework -- security issues in bundled Dojo library - - - ZendFramework - 1.10.3 - - - - -

The Zend Framework team reports:

-
-

Several files in the bundled Dojo library were identified - as having potential exploits, and the Dojo team also advised - disabling or removing any PHP scripts in the Dojo library tree - when deploying to production.

-
- - - - http://dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisory/ - http://framework.zend.com/security/advisory/ZF2010-07 - http://osdir.com/ml/bugtraq.security/2010-03/msg00133.html - http://packetstormsecurity.org/1003-exploits/dojo-xss.txt - http://secunia.com/advisories/38964 - http://www.gdssecurity.com/l/b/2010/03/12/multiple-dom-based-xss-in-dojo-toolkit-sdk/ - - - 2010-04-01 - 2010-04-06 - - - - - firefox -- Re-use of freed object due to scope confusion - - - firefox - 3.6,13.6.3,1 - - - - -

Mozilla Project reports:

-
-

MFSA 2009-25 Re-use of freed object due to scope confusion

-
- - - - CVE-2010-1121 - http://www.mozilla.org/security/announce/2010/mfsa2010-25.html - - - 2010-04-01 - 2010-04-05 - - - - - mozilla -- multiple vulnerabilities - - - seamonkey - 2.02.0.4 - - - thunderbird - 3.03.0.4 - - - firefox - 3.5.*,13.5.9,1 - 3.*,13.0.19,1 - - - linux-firefox - 3.0.19,1 - - - linux-firefox-devel - 3.5.9 - - - nss - linux-f10-nss - 3.12.5 - - - - -

Mozilla Project reports:

-
-

MFSA 2010-24 XMLDocument::load() doesn't check nsIContentPolicy

-

MFSA 2010-23 Image src redirect to mailto: URL opens email editor

-

MFSA 2010-22 Update NSS to support TLS renegotiation indication

-

MFSA 2010-21 Arbitrary code execution with Firebug XMLHttpRequestSpy

-

MFSA 2010-20 Chrome privilege escalation via forced URL drag and drop

-

MFSA 2010-19 Dangling pointer vulnerability in nsPluginArray

-

MFSA 2010-18 Dangling pointer vulnerability in nsTreeContentView

-

MFSA 2010-17 Remote code execution with use-after-free in nsTreeSelection

-

MFSA 2010-16 Crashes with evidence of memory corruption (rv:1.9.2.2/ 1.9.1.9/ 1.9.0.19)

-
- - - - CVE-2010-0181 - CVE-2009-3555 - CVE-2010-0179 - CVE-2010-0178 - CVE-2010-0177 - CVE-2010-0176 - CVE-2010-0175 - CVE-2010-0174 - CVE-2010-0173 - http://www.mozilla.org/security/announce/2010/mfsa2010-24.html - http://www.mozilla.org/security/announce/2010/mfsa2010-23.html - http://www.mozilla.org/security/announce/2010/mfsa2010-22.html - http://www.mozilla.org/security/announce/2010/mfsa2010-21.html - http://www.mozilla.org/security/announce/2010/mfsa2010-20.html - http://www.mozilla.org/security/announce/2010/mfsa2010-19.html - http://www.mozilla.org/security/announce/2010/mfsa2010-18.html - http://www.mozilla.org/security/announce/2010/mfsa2010-17.html - http://www.mozilla.org/security/announce/2010/mfsa2010-16.html - - - 2010-03-30 - 2010-03-30 - - - - - postgresql -- bitsubstr overflow - - - postgresql-server - 7.47.4.28 - 8.08.0.24 - 8.18.1.20 - 8.28.2.16 - 8.38.3.10 - 8.48.4.3 - - - - -

BugTraq reports:

-
-

PostgreSQL is prone to a buffer-overflow - vulnerability because the application fails to - perform adequate boundary checks on user-supplied - data.

-

Attackers can exploit this issue to execute - arbitrary code with elevated privileges or - crash the affected application.

-
- - - - 37973 - CVE-2010-0442 - - - 2010-01-27 - 2010-03-25 - - - - - gtar -- buffer overflow in rmt client - - - gtar - 1.22_3 - - - - -

Jakob Lell reports:

-
-

The rmt client implementation of GNU Tar/Cpio contains - a heap-based buffer overflow which possibly allows - arbitrary code execution.

-

The problem can be exploited when using an - untrusted/compromised rmt server.

-
- - - CVE-2010-0624 - http://www.agrs.tu-berlin.de/index.php?id=78327 - - 2010-03-24 2010-03-24 - - - - - firefox -- WOFF heap corruption due to integer overflow - - - firefox - 3.6,13.6.2,1 - - - - -

Mozilla Project reports:

-
-

MFSA 2010-08 WOFF heap corruption due to integer overflow

-
- - - - CVE-2010-1028 - http://www.mozilla.org/security/announce/2010/mfsa2010-08.html - - - 2010-03-22 - 2010-03-23 - - - - - mozilla -- multiple vulnerabilities - - - seamonkey - linux-seamonkey - 1.1.19 - - - thunderbird - linux-thunderbird - 2.0.0.24 - - - - -

Mozilla Project reports:

-
-

MFSA 2010-07 Fixes for potentially exploitable crashes ported to the legacy branch

-

MFSA 2010-06 Scriptable plugin execution in SeaMonkey mail

-

MFSA 2009-68 NTLM reflection vulnerability

-

MFSA 2009-62 Download filename spoofing with RTL override

-

MFSA 2009-59 Heap buffer overflow in string to number conversion

-

MFSA 2009-49 TreeColumns dangling pointer vulnerability

-
- - - - CVE-2010-0161 - CVE-2010-0163 - CVE-2009-3075 - CVE-2009-3072 - CVE-2009-2463 - CVE-2009-3385 - CVE-2009-3983 - CVE-2009-3376 - CVE-2009-0689 - CVE-2009-3077 - http://www.mozilla.org/security/announce/2010/mfsa2010-07.html - http://www.mozilla.org/security/announce/2010/mfsa2010-06.html - http://www.mozilla.org/security/announce/2009/mfsa2009-68.html - http://www.mozilla.org/security/announce/2009/mfsa2009-62.html - http://www.mozilla.org/security/announce/2009/mfsa2009-59.html - http://www.mozilla.org/security/announce/2009/mfsa2009-49.html - - - 2010-03-16 - 2010-03-19 - - - - - egroupware -- two vulnerabilities - - - egroupware - 1.6.003 - - - - -

Egroupware Team report:

-
-

Nahuel Grisolia from CYBSEC S.A. Security Systems found two security - problems in EGroupware:

-

Serious remote command execution (allowing to run arbitrary command - on the web server by simply issuing a HTTP request!).

-

A reflected cross-site scripting (XSS).

-

Both require NO valid EGroupware account and work without being logged - in!

-
- - - - 38609 - http://secunia.com/advisories/38859/ - http://www.egroupware.org/Home?category_id=95&item=93 - - - 2010-03-09 - 2010-03-11 - - - - - drupal -- multiple vulnerabilities - - - drupal5 - 5.22 - - - drupal6 - 6.16 - - - - -

Drupal Team reports:

-
-

A user-supplied value is directly output during installation - allowing a malicious user to craft a URL and perform a cross-site - scripting attack. The exploit can only be conducted on sites not yet - installed.

-

The API function drupal_goto() is susceptible to a phishing attack. - An attacker could formulate a redirect in a way that gets the Drupal - site to send the user to an arbitrarily provided URL. No user - submitted data will be sent to that URL.

-

Locale module and dependent contributed modules do not sanitize the - display of language codes, native and English language names properly. - While these usually come from a preselected list, arbitrary - administrator input is allowed. This vulnerability is mitigated by the - fact that the attacker must have a role with the 'administer - languages' permission.

-

Under certain circumstances, a user with an open session that is - blocked can maintain his/her session on the Drupal site, despite being - blocked.

-
- - - - http://drupal.org/node/731710 - - - 2010-03-03 - 2010-03-08 - - - - - sudo -- Privilege escalation with sudoedit - - - sudo - 1.7.2.4 - - - - -

Todd Miller reports:

-
-

When sudo performs its command matching, there is a special case - for pseudo-commands in the sudoers file (currently, the only - pseudo-command is sudoedit). Unlike a regular command, - pseudo-commands do not begin with a slash ('/'). The flaw is that - sudo's the matching code would only check against the list of - pseudo-commands if the user-specified command also contained no - slashes. As a result, if the user ran "sudo ./sudoedit" the normal - matching code path was followed, which uses stat(2) to verify that - the user-specified command matches the one in sudoers. In this - case, it would compare the "./sudoedit" specified by the user with - "sudoedit" from the sudoers file, resulting in a positive - match.

-
- - - - http://www.sudo.ws/pipermail/sudo-announce/2010-February/000092.html - http://www.sudo.ws/sudo/alerts/sudoedit_escalate.html - http://secunia.com/advisories/38659 - CVE-2010-0426 - 38362 - - - 2010-01-29 - 2010-03-01 - - - - - openoffice.org -- multiple vulnerabilities - - - openoffice.org - 3.2.0 - 3.2.200101013.2.20100203 - 3.3.200101013.3.20100207 - - - - -

OpenOffice.org Security Team reports:

-
-

Fixed in OpenOffice.org 3.2

-

CVE-2006-4339: Potential vulnerability from 3rd party - libxml2 libraries

-

CVE-2009-0217: Potential vulnerability from 3rd party - libxmlsec libraries

-

CVE-2009-2493: OpenOffice.org 3 for Windows bundles a vulnerable - version of MSVC Runtime

-

CVE-2009-2949: Potential vulnerability related to XPM file - processing

-

CVE-2009-2950: Potential vulnerability related to GIF file - processing

-

CVE-2009-3301/2: Potential vulnerability related to MS-Word - document processing

-
- - - - http://www.openoffice.org/security/bulletin.html - http://www.openoffice.org/security/cves/CVE-2006-4339.html - http://www.openoffice.org/security/cves/CVE-2009-0217.html - http://www.openoffice.org/security/cves/CVE-2009-2493.html - http://www.openoffice.org/security/cves/CVE-2009-2949.html - http://www.openoffice.org/security/cves/CVE-2009-2950.html - http://www.openoffice.org/security/cves/CVE-2009-3301-3302.html - CVE-2006-4339 - CVE-2009-0217 - CVE-2009-2493 - CVE-2009-2949 - CVE-2009-2950 - CVE-2009-3301 - CVE-2009-3302 - - - 2006-08-24 - 2010-02-25 - 2010-02-27 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 3.5.*,13.5.8,1 - 3.*,13.0.18,1 - - - linux-firefox - 3.0.18,1 - - - linux-firefox-devel - 3.5.8 - - - seamonkey - 2.0.*2.0.3 - - - thunderbird - 3.03.0.2 - - - - -

Mozilla Project reports:

-
-

MFSA 2010-05 XSS hazard using SVG document and binary Content-Type

-

MFSA 2010-04 XSS due to window.dialogArguments being readable cross-domain

-

MFSA 2010-03 Use-after-free crash in HTML parser

-

MFSA 2010-02 Web Worker Array Handling Heap Corruption Vulnerability

-

MFSA 2010-01 Crashes with evidence of memory corruption (rv:1.9.1.8/ 1.9.0.18)

-
- - - - CVE-2010-0159 - CVE-2010-0160 - CVE-2009-1571 - CVE-2009-3988 - CVE-2010-0162 - http://www.mozilla.org/security/announce/2010/mfsa2010-01.html - http://www.mozilla.org/security/announce/2010/mfsa2010-02.html - http://www.mozilla.org/security/announce/2010/mfsa2010-03.html - http://www.mozilla.org/security/announce/2010/mfsa2010-04.html - http://www.mozilla.org/security/announce/2010/mfsa2010-05.html - - - 2010-02-17 - 2010-02-18 - 2010-02-28 - - - - - lighttpd -- denial of service vulnerability - - - lighttpd - 1.4.26 - - - - -

Lighttpd security advisory reports:

-
-

If you send the request data very slow (e.g. sleep - 0.01 after each byte), lighttpd will easily use all - available memory and die (especially for parallel - requests), allowing a DoS within minutes.

-
- - - - 38036 - CVE-2010-0295 - http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2010_01.txt - - - 2010-02-02 - 2010-02-16 - - - - - squid -- Denial of Service vulnerability in HTCP - - - squid - 2.7.12.7.7_4 - 3.0.13.0.24 - - - - -

Squid security advisory 2010:2 reports:

-
-

Due to incorrect processing Squid is vulnerable to a - denial of service attack when receiving specially crafted - HTCP packets.

-

This problem allows any machine to perform a denial - of service attack on the Squid service when its HTCP port - is open.

-
- - - - CVE-2010-0639 - http://www.squid-cache.org/Advisories/SQUID-2010_2.txt - - - 2010-02-12 - 2010-02-14 - 2010-05-02 - - - - - linux-flashplugin -- multiple vulnerabilities - - - linux-flashplugin - 9.0r262 - - - linux-f8-flashplugin - linux-f10-flashplugin - 10.0r45 - - - - -

Adobe Product Security Incident Response Team reports:

-
-

A critical vulnerability has been identified in Adobe - Flash Player version 10.0.42.34 and earlier. This - vulnerability (CVE-2010-0186) could subvert the domain sandbox - and make unauthorized cross-domain requests. This update also - resolves a potential Denial of Service issue (CVE-2010-0187).

-
- - - - CVE-2010-0186 - CVE-2010-0187 - http://www.adobe.com/support/security/bulletins/apsb10-06.html - - - 2010-02-11 - 2010-02-13 - - - - - gnome-screensaver -- Multiple monitor hotplug issues - - - gnome-screensaver - 2.28.3 - - - - -

Ray Strode reports:

-
-

Under certain circumstances it is possible to circumvent the security of screen - locking functionality of gnome-screensaver by changing the systems physical - monitor configuration.

-
-
-

gnome-screensaver can lose its keyboard grab when locked, exposing the system - to intrusion by adding and removing monitors.

-
- - - - CVE-2010-0414 - CVE-2010-0422 - https://bugzilla.gnome.org/show_bug.cgi?id=609337 - https://bugzilla.gnome.org/show_bug.cgi?id=609789 - - - 2010-02-08 - 2010-02-13 - - - - - fetchmail -- heap overflow on verbose X.509 display - - - fetchmail - 6.3.116.3.14 - - - - -

Matthias Andree reports:

-
-

In verbose mode, fetchmail prints X.509 certificate subject and - issuer information to the user, and counts and allocates a malloc() - buffer for that purpose.

-

If the material to be displayed contains characters with high bit - set and the platform treats the "char" type as signed, this can cause - a heap buffer overrun because non-printing characters are escaped as - \xFF..FFnn, where nn is 80..FF in hex.

-
- - - - 38088 - CVE-2010-0562 - http://www.fetchmail.info/fetchmail-SA-2010-01.txt - https://lists.berlios.de/pipermail/fetchmail-announce/2010-February/000073.html - - - 2010-02-04 - 2010-02-12 - - - - - wireshark -- LWRES vulnerability - - - wireshark - wireshark-lite - 1.2.6 - - - - -

Wireshark project reports:

-
-

Babi discovered several buffer overflows in the - LWRES dissector.

-

It may be possible to make Wireshark crash remotely - or by convincing someone to read a malformed packet - trace file.

-
- - - - CVE-2010-0304 - http://secunia.com/advisories/38257/ - http://www.wireshark.org/security/wnpa-sec-2010-02.html - - - 2010-01-27 - 2010-02-10 - - - - - otrs -- SQL injection - - - otrs - 2.4.7 - - - - -

OTRS Security Advisory reports:

-
-

Missing security quoting for SQL statements allows agents and - customers to manipulate SQL queries. So it's possible for - authenticated users to inject SQL queries - via string manipulation of statements.

-

A malicious user may be able to manipulate SQL queries to read - or modify records in the database. This way it could also be - possible to get access to more permissions (e. g. administrator - permissions).

-

To use this vulnerability the malicious user needs to have - a valid Agent- or Customer-session.

-
- - - - CVE-2010-0438 - http://otrs.org/advisory/OSA-2010-01-en/ - - - 2010-02-08 - 2010-02-08 - 2010-05-02 - - - - - apache -- Prevent chunk-size integer overflow on platforms where sizeof(int) < sizeof(long) - - - apache - 1.3.42 - - - apache+mod_perl - 1.3.42 - - - apache+ipv6 - 1.3.42 - - - apache_fp - 0 - - - ru-apache - 1.3.42+30.23 - - - ru-apache+mod_ssl - 1.3.42 - - - apache+ssl - 1.3.42.1.57_2 - - - apache+mod_ssl - apache+mod_ssl+ipv6 - apache+mod_ssl+mod_accel - apache+mod_ssl+mod_accel+ipv6 - apache+mod_ssl+mod_accel+mod_deflate - apache+mod_ssl+mod_accel+mod_deflate+ipv6 - apache+mod_ssl+mod_deflate - apache+mod_ssl+mod_deflate+ipv6 - apache+mod_ssl+mod_snmp - apache+mod_ssl+mod_snmp+mod_accel - apache+mod_ssl+mod_snmp+mod_accel+ipv6 - apache+mod_ssl+mod_snmp+mod_deflate - apache+mod_ssl+mod_snmp+mod_deflate+ipv6 - apache+mod_ssl+mod_snmp+mod_accel+mod_deflate+ipv6 - 1.3.41+2.8.27_2 - - - - -

Apache ChangeLog reports:

-
-

Integer overflow in the ap_proxy_send_fb function in - proxy/proxy_util.c in mod_proxy in the Apache HTTP Server before - 1.3.42 on 64-bit platforms allows remote origin servers to cause a - denial of service (daemon crash) or possibly execute arbitrary code - via a large chunk size that triggers a heap-based buffer overflow.

-
- - - - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-0010 - http://www.security-database.com/detail.php?alert=CVE-2010-0010 - http://security-tracker.debian.org/tracker/CVE-2010-0010 - http://www.vupen.com/english/Reference-CVE-2010-0010.php - - - 2009-06-30 - 2010-02-03 - 2010-02-03 - - - - - squid -- Denial of Service vulnerability in DNS handling - - - squid - 2.7.12.7.7_3 - 3.0.13.0.23 - 3.1.0.13.1.0.15_2 - - - - -

Squid security advisory 2010:1 reports:

-
-

Due to incorrect data validation Squid is vulnerable to a denial - of service attack when processing specially crafted DNS packets.

-

This problem allows any trusted client or external server who can - determine the squid receiving port to perform a short-term denial - of service attack on the Squid service.

-
- - - - CVE-2010-0308 - http://www.squid-cache.org/Advisories/SQUID-2010_1.txt - - - 2010-01-14 - 2010-02-01 - 2010-05-02 - - - - - bugzilla -- information leak - - - bugzilla - 3.3.13.4.5 - - - - -

A Bugzilla Security Advisory reports:

-
-

When moving a bug from one product to another, an intermediate - page is displayed letting you select the groups the bug should - be restricted to in the new product. However, a regression in - the 3.4.x series made it ignore all groups which are not - available in both products. As a workaround, you had to move - the bug to the new product first and then restrict it to the - desired groups, in two distinct steps, which could make the bug - temporarily public.

-
- - - - CVE-2009-3387 - http://www.bugzilla.org/security/3.0.10/ - - - 2010-01-31 - 2010-02-01 - - - - - irc-ratbox -- multiple vulnerabilities - - - ircd-ratbox - 2.2.9 - - - ircd-ratbox-devel - 3.0.6 - - - - -

SecurityFocus reports:

-
-

The first affects the /quote HELP module and allows a user - to trigger an IRCD crash on some platforms.

-

The second affects the /links processing module when the - flatten_links configuration option is not enabled.

-
- - - - CVE-2009-4016 - CVE-2010-0300 - http://www.debian.org/security/2010/dsa-1980 - http://lists.ratbox.org/pipermail/ircd-ratbox/2010-January/000890.html - http://lists.ratbox.org/pipermail/ircd-ratbox/2010-January/000891.html - - - 2010-01-25 - 2010-01-28 - - - - - dokuwiki -- multiple vulnerabilities - - - dokuwiki - 20091225_2 - - - - -

Dokuwiki reports:

-
-

The plugin does no checks against cross-site request - forgeries (CSRF) which can be exploited to e.g. change - the access control rules by tricking a logged in - administrator into visiting a malicious web site.

-
-
-

The bug allows listing the names of arbitrary file on - the webserver - not their contents. This could leak - private information about wiki pages and server structure.

-
- - - - CVE-2010-0288 - CVE-2010-0287 - CVE-2010-0289 - http://bugs.splitbrain.org/index.php?do=details&task_id=1847 - http://bugs.splitbrain.org/index.php?do=details&task_id=1853 - - - 2010-01-17 - 2010-01-18 - 2010-05-02 - - - - - Zend Framework -- multiple vulnerabilities - - - ZendFramework - 1.9.7 - - - - -

The Zend Framework team reports:

-
-

Potential XSS or HTML Injection vector in Zend_Json.

-
-
-

Potential XSS vector in Zend_Service_ReCaptcha_MailHide.

-
-
-

Potential MIME-type Injection in Zend_File_Transfer - Executive Summary.

-
-
-

Potential XSS vector in Zend_Filter_StripTags when - comments allowed.

-
-
-

Potential XSS vector in Zend_Dojo_View_Helper_Editor.

-
-
-

Potential XSS vectors due to inconsistent encodings.

-
-
-

XSS vector in Zend_Filter_StripTags.

-
-
-

LFI vector in Zend_View::setScriptPath() and render().

-
- - - - http://framework.zend.com/security/advisory/ZF2010-06 - http://framework.zend.com/security/advisory/ZF2010-05 - http://framework.zend.com/security/advisory/ZF2010-04 - http://framework.zend.com/security/advisory/ZF2010-03 - http://framework.zend.com/security/advisory/ZF2010-02 - http://framework.zend.com/security/advisory/ZF2010-01 - http://framework.zend.com/security/advisory/ZF2009-02 - http://framework.zend.com/security/advisory/ZF2009-01 - - - 2009-12-31 - 2010-01-11 - - - - - powerdns-recursor -- multiple vulnerabilities - - - powerdns-recursor - 3.1.7.2 - - - - -

PowerDNS Security Advisory reports:

-
-

PowerDNS Recursor up to and including 3.1.7.1 can be - brought down and probably exploited.

-
-
-

PowerDNS Recursor up to and including 3.1.7.1 can be - spoofed into accepting bogus data

-
- - - - 37650 - 37653 - CVE-2009-4010 - CVE-2009-4009 - - - 2010-01-06 - 2010-01-09 - - - - - PEAR -- Net_Ping and Net_Traceroute remote arbitrary command injection - - - pear-Net_Ping - 2.4.5 - - - pear-Net_Traceroute - 0.21.2 - - - - -

PEAR Security Advisory reports:

-
-

Multiple remote arbitrary command injections have been - found in the Net_Ping and Net_Traceroute.

-

When input from forms are used directly, the attacker - could pass variables that would allow him to execute - remote arbitrary command injections.

-
- - - - 37093 - 37094 - CVE-2009-4024 - CVE-2009-4025 - http://pear.php.net/advisory20091114-01.txt - - - 2009-11-14 - 2010-01-04 - - - - - drupal -- multiple cross-site scripting - - - drupal5 - 5.21 - - - drupal6 - 6.15 - - - - -

Drupal Team reports:

-
-

The Contact module does not correctly handle certain user input - when displaying category information. Users privileged to create - contact categories can insert arbitrary HTML and script code into the - contact module administration page. Such a cross-site scripting attack - may lead to the malicious user gaining administrative access.

-

The Menu module does not correctly handle certain user input when - displaying the menu administration overview. Users privileged to - create new menus can insert arbitrary HTML and script code into the - menu module administration page. Such a cross-site scripting attack - may lead to the malicious user gaining administrative access.

-
- - - - CVE-2009-4370 - http://drupal.org/node/661586 - - - 2009-12-16 - 2009-12-25 - 2010-05-02 - - - - - fuser -- missing user's privileges check - - - fuser - 1142334561_2 - - - - -

Denis Barov reports:

-
-

sysutils/fuser allows user to send any signal to any process when - installed with suid bit.

-
- - - - ports/141852 - - - 2009-09-15 - 2009-12-21 - - - - - monkey -- improper input validation vulnerability - - - monkey - 0.9.3 - - - - -

Census Labs reports:

-
-

We have discovered a remotely exploitable - "improper input validation" vulnerability in the Monkey - web server that allows an attacker to perform denial of - service attacks by repeatedly crashing worker threads - that process HTTP requests.

-
- - - - http://census-labs.com/news/2009/12/14/monkey-httpd/ - http://groups.google.com/group/monkeyd/browse_thread/thread/055b4e9b83973861/ - - - 2009-12-14 - 2009-12-21 - - - - - php -- multiple vulnerabilities - - - php5 - 5.2.12 - - - - -

PHP developers reports:

-
-

This release focuses on improving the stability of the - PHP 5.2.x branch with over 60 bug fixes, some of which - are security related. All users of PHP 5.2 are encouraged - to upgrade to this release.

-

Security Enhancements and Fixes in PHP 5.2.12:

-
    -
  • Fixed a safe_mode bypass in tempnam() identified by - Grzegorz Stachowiak. (CVE-2009-3557, Rasmus)
    • -
  • Fixed a open_basedir bypass in posix_mkfifo() - identified by Grzegorz Stachowiak. (CVE-2009-3558, Rasmus)
    • -
  • Added "max_file_uploads" INI directive, which can - be set to limit the number of file uploads per-request - to 20 by default, to prevent possible DOS via temporary - file exhaustion, identified by Bogdan Calin. - (CVE-2009-4017, Ilia)
    • -
  • Added protection for $_SESSION from interrupt - corruption and improved "session.save_path" check, - identified by Stefan Esser. (CVE-2009-4143, Stas)
    • -
  • Fixed bug #49785 (insufficient input string - validation of htmlspecialchars()). (CVE-2009-4142, - Moriyoshi, hello at iwamot dot com)
    • -
-
- - - - CVE-2009-3557 - CVE-2009-3558 - CVE-2009-4017 - CVE-2009-4142 - CVE-2009-4143 - http://www.php.net/releases/5_2_12.php - - - 2009-12-17 - 2009-12-17 - - - - - postgresql -- multiple vulnerabilities - - - postgresql-client - postgresql-server - 7.47.4.27 - 8.08.0.23 - 8.18.1.19 - 8.28.2.15 - 8.38.3.9 - 8.48.4.2 - - - - -

PostgreSQL project reports:

-
-

PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, - 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, - and 8.4.x before 8.4.2 does not properly handle a '\0' character - in a domain name in the subject's Common Name (CN) field of an - X.509 certificate, which (1) allows man-in-the-middle attackers - to spoof arbitrary SSL-based PostgreSQL servers via a crafted - server certificate issued by a legitimate Certification Authority, - and (2) allows remote attackers to bypass intended client-hostname - restrictions via a crafted client certificate issued by a legitimate - Certification Authority, a related issue to CVE-2009-2408.

-
-
-

PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, - 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, - and 8.4.x before 8.4.2 does not properly manage session-local - state during execution of an index function by a database - superuser, which allows remote authenticated users to gain - privileges via a table with crafted index functions, as - demonstrated by functions that modify (1) search_path or - (2) a prepared statement, a related issue to CVE-2007-6600 - and CVE-2009-3230.

-
- - - - CVE-2009-4034 - CVE-2009-4136 - - - 2009-11-20 - 2009-12-17 - - - - - tptest -- pwd Remote Stack Buffer Overflow - - - tptest - 0 - - - - -

SecurityFocus reports:

-
-

TPTEST is prone to a remote stack-based buffer-overflow - vulnerability. An attacker can exploit this issue to - execute arbitrary code within the context of the affected - application. Failed exploit attempts will result in a - denial-of-service condition.

-
- - - - 33785 - - - 2009-02-16 - 2009-12-17 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 3.5.*,13.5.6,1 - 3.*,13.0.16,1 - - - linux-firefox - 3.0.16,1 - - - seamonkey - linux-seamonkey - 2.0.1 - - - thunderbird - 3.03.0.1 - - - - - -

Mozilla Project reports:

-
-

MFSA 2009-71 GeckoActiveXObject exception messages can be used to - enumerate installed COM objects

-

MFSA 2009-70 Privilege escalation via chrome window.opener

-

MFSA 2009-69 Location bar spoofing vulnerabilities

-

MFSA 2009-68 NTLM reflection vulnerability

-

MFSA 2009-67 Integer overflow, crash in libtheora video - library

-

MFSA 2009-66 Memory safety fixes in liboggplay media library

-

MFSA 2009-65 Crashes with evidence of memory corruption (rv:1.9.1.6/ - 1.9.0.16)

-
- - - - CVE-2009-3388 - CVE-2009-3389 - CVE-2009-3979 - CVE-2009-3980 - CVE-2009-3981 - CVE-2009-3982 - CVE-2009-3983 - CVE-2009-3984 - CVE-2009-3985 - CVE-2009-3986 - http://www.mozilla.org/security/announce/2009/mfsa2009-71.html - http://www.mozilla.org/security/announce/2009/mfsa2009-70.html - http://www.mozilla.org/security/announce/2009/mfsa2009-69.html - http://www.mozilla.org/security/announce/2009/mfsa2009-68.html - http://www.mozilla.org/security/announce/2009/mfsa2009-67.html - http://www.mozilla.org/security/announce/2009/mfsa2009-66.html - http://www.mozilla.org/security/announce/2009/mfsa2009-65.html - - - 2009-12-16 - 2009-12-16 - 2010-01-21 - - - - - freeradius -- remote packet of death vulnerability - - - freeradius - 1.1.8 - - - - -

freeRADIUS Vulnerability Notifications reports:

-
-

2009.09.09 v1.1.7 - Anyone who can send packets to - the server can crash it by sending a Tunnel-Password - attribute in an Access-Request packet. This - vulnerability is not otherwise exploitable. We have - released 1.1.8 to correct this vulnerability.

-

This issue is similar to the previous Tunnel-Password - issue noted below. The vulnerable versions are 1.1.3 - through 1.1.7. Version 2.x is not affected.

-
- - - - CVE-2009-3111 - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3111 - http://freeradius.org/security.html - http://www.milw0rm.com/exploits/9642 - - - 2009-09-09 - 2009-12-14 - 2009-12-14 - - - - - pligg -- Cross-Site Scripting and Cross-Site Request Forgery - - - pligg - 1.0.3b - - - - -

secunia reports:

-
-

Russ McRee has discovered some vulnerabilities in Pligg, which can - be exploited by malicious people to conduct cross-site scripting and - request forgery attacks.

-

Input passed via the "Referer" HTTP header to various scripts (e.g. - admin/admin_config.php, admin/admin_modules.php, delete.php, editlink.php, - submit.php, submit_groups.php, user_add_remove_links.php, and - user_settings.php) is not properly sanitised before being returned to - the user. This can be exploited to execute arbitrary HTML and script - code in a user's browser session in context of an affected site.

-

The application allows users to perform certain actions via HTTP - requests without performing any validity checks to verify the requests. - This can be exploited to e.g. create an arbitrary user with administrative - privileges if a logged-in administrative user visits a malicious web - site.

-
- - - - CVE-2009-4786 - CVE-2009-4787 - CVE-2009-4788 - http://secunia.com/advisories/37349/ - http://www.pligg.com/blog/775/pligg-cms-1-0-3-release/ - - - 2009-12-02 - 2009-12-12 - 2010-05-02 - - - - - piwik -- php code execution - - - piwik - 0.5.1 - - - - -

secunia reports:

-
-

Stefan Esser has reported a vulnerability in Piwik, which can be - exploited by malicious people to compromise a vulnerable system.

-

The vulnerability is caused due to the core/Cookie.php script using - "unserialize()" with user controlled input. This can be exploited to - e.g. execute arbitrary PHP code via the "__wakeup()" or "__destruct()" - methods of a serialized object passed via an HTTP cookie.

-
- - - - CVE-2009-4137 - http://secunia.com/advisories/37649/ - http://www.sektioneins.de/de/advisories/advisory-032009-piwik-cookie-unserialize-vulnerability/index.html - http://piwik.org/blog/2009/12/piwik-response-to-shocking-news-in-php-exploitation/ - - - 2009-12-10 - 2009-12-11 - 2010-05-02 - - - - - dovecot -- Insecure directory permissions - - - dovecot - 1.2.*1.2.8 - - - - -

Dovecot author reports:

-
-

Dovecot v1.2.x had been creating base_dir (and its parents if - necessary) with 0777 permissions. The base_dir's permissions get - changed to 0755 automatically at startup, but you may need to - chmod the parent directories manually.

-
- - - - CVE-2009-3897 - 37084 - http://secunia.com/advisories/37443 - - - 2009-11-20 - 2009-12-10 - - - - - linux-flashplugin -- multiple vulnerabilities - - - linux-flashplugin - 9.0r260 - - - linux-f8-flashplugin - linux-f10-flashplugin - 10.0r42 - - - - -

Adobe Product Security Incident Response Team reports:

-
-

Critical vulnerabilities have been identified in Adobe - Flash Player version 10.0.32.18 and earlier. These - vulnerabilities could cause the application to crash and - could potentially allow an attacker to take control of the - affected system.

-
- - - - CVE-2009-3794 - CVE-2009-3796 - CVE-2009-3797 - CVE-2009-3798 - CVE-2009-3799 - CVE-2009-3800 - CVE-2009-3951 - http://www.zerodayinitiative.com/advisories/ZDI-09-092/ - http://www.zerodayinitiative.com/advisories/ZDI-09-093/ - http://www.adobe.com/support/security/bulletins/apsb09-19.html - - - 2009-07-14 - 2009-12-09 - - - - - ruby -- heap overflow vulnerability - - - ruby - 1.9.1,11.9.1.376,1 - - - - -

The official ruby site reports:

-
-

There is a heap overflow vulnerability in String#ljust, - String#center and String#rjust. This has allowed an attacker to run - arbitrary code in some rare cases.

-
- - - - CVE-2009-4124 - http://www.ruby-lang.org/en/news/2009/12/07/heap-overflow-in-string/ - - - 2009-11-30 - 2009-12-09 - - - - - rt -- Session fixation vulnerability - - - rt - 3.8.6 - - - - -

Secunia reports:

-
-

A vulnerability has been reported in RT, which can be exploited by - malicious people to conduct session fixation attacks. - The vulnerability is caused due to an error in the handling of - sessions and can be exploited to hijack another user's session by - tricking the user into logging in after following a specially crafted - link.

-
- - - - 37162 - CVE-2009-3585 - - - 2009-12-01 - 2009-12-09 - - - - - expat2 -- Parser crash with specially formatted UTF-8 sequences - - - expat2 - linux-f10-expat - 2.0.1_1 - - - - -

CVE reports:

-
-

The updatePosition function in lib/xmltok_impl.c in - libexpat in Expat 2.0.1, as used in Python, PyXML, - w3c-libwww, and other software, allows context-dependent - attackers to cause a denial of service (application crash) - via an XML document with crafted UTF-8 sequences that - trigger a buffer over-read.

-
- - - - CVE-2009-3720 - - - 2009-01-17 - 2009-12-08 - - - - - expat2 -- buffer over-read and crash - - - expat2 - 2.0.1_1 - - - - -

CVE reports:

-
-

The big2_toUtf8 function in lib/xmltok.c in libexpat in - Expat 2.0.1, as used in the XML-Twig module for Perl, allows - context-dependent attackers to cause a denial of service - (application crash) via an XML document with malformed UTF-8 - sequences that trigger a buffer over-read, related to the - doProlog function in lib/xmlparse.c.

-
- - - - CVE-2009-3560 - - - 2009-10-05 - 2009-12-08 - - - - - opera -- multiple vulnerabilities - - - opera - 10.10.20091120 - - - linux-opera - 10.10 - - - - -

Opera Team reports:

-
-
    -
  • Fixed a heap buffer overflow in string to number conversion
    • -
  • Fixed an issue where error messages could leak onto unrelated - sites
    • -
  • Fixed a moderately severe issue, as reported by Chris Evans of - the Google Security Team; details will be disclosed at a later - date.
    • -
-
- - - - CVE-2009-0689 - CVE-2009-4071 - http://www.opera.com/support/kb/view/941/ - http://www.opera.com/support/kb/view/942/ - - - 2009-11-23 - 2009-12-01 - 2010-05-02 - - - - - libtool -- Library Search Path Privilege Escalation Issue - - - libtool - 2.2.6b - - - - -

Secunia.com

-
-

Do not attempt to load an unqualified module.la file from the - current directory (by default) since doing so is insecure and is - not compliant with the documentation.

-
- - - - CVE-2009-3736 - http://secunia.com/advisories/37414/ - http://lists.gnu.org/archive/html/libtool/2009-11/msg00059.html - - - 2009-11-25 - 2009-11-28 - 2010-05-02 - - - - - libvorbis -- multiple vulnerabilities - - - libvorbis - 1.2.3_1,3 - - - - -

The Ubuntu security team reports:

-
-

It was discovered that libvorbis did not correctly - handle certain malformed vorbis files. If a user were - tricked into opening a specially crafted vorbis file - with an application that uses libvorbis, an attacker - could cause a denial of service or possibly execute - arbitrary code with the user's privileges.

-
- - - - CVE-2008-1420 - CVE-2009-3379 - - - 2009-11-24 - 2009-11-24 - - - - - bugzilla -- information leak - - - bugzilla - 3.3.13.4.4 - - - - -

A Bugzilla Security Advisory reports:

-
-

When a bug is in a group, none of its information - (other than its status and resolution) should be visible - to users outside that group. It was discovered that - as of 3.3.2, Bugzilla was showing the alias of the bug - (a very short string used as a shortcut for looking up - the bug) to users outside of the group, if the protected - bug ended up in the "Depends On" or "Blocks" list of any - other bug.

-
- - - - CVE-2009-3386 - http://www.bugzilla.org/security/3.4.3/ - - - 2009-11-18 - 2009-11-23 - - - - - cacti -- cross-site scripting issues - - - cacti - 0.8.7e4 - - - - -

The cacti development team reports:

-
-

The Cross-Site Scripting patch has been posted.

-

This patch addresses cross-site scripting issues reported - by Moritz Naumann.

-
- - - - CVE-2009-4032 - http://docs.cacti.net/#cross-site_scripting_fixes - - - 2009-11-21 - 2009-11-23 - 2010-05-02 - - - - - wordpress -- multiple vulnerabilities - - - wordpress - 2.8.6,1 - - - de-wordpress - 2.8.6 - - - - -

secunia reports:

-
-

The security issue is caused due to the wp_check_filetype() - function in /wp-includes/functions.php improperly validating uploaded - files. This can be exploited to execute arbitrary PHP code by - uploading a malicious PHP script with multiple extensions.

-

Successful exploitation of this vulnerability requires that Apache - is not configured to handle the mime-type for media files with an e.g. - "gif", "jpg", "png", "tif", "wmv" extension.

-

Input passed via certain parameters to press-this.php is not - properly sanitised before being displayed to the user. This can be - exploited to insert arbitrary HTML and script code, which will be - executed in a user's browser session in context of an affected site - when the malicious data is being viewed.

-
- - - - CVE-2009-3890 - CVE-2009-3891 - http://wordpress.org/development/2009/11/wordpress-2-8-6-security-release/ - http://secunia.com/advisories/37332/ - - - 2009-11-12 - 2009-11-14 - 2010-05-02 - - - - - p5-HTML-Parser -- denial of service - - - p5-HTML-Parser - 3.63 - - - - -

CVE reports:

-
-

The decode_entities function in util.c in HTML-Parser before - 3.63 allows context-dependent attackers to cause a denial of service - (infinite loop) via an incomplete SGML numeric character reference, - which triggers generation of an invalid UTF-8 character.

-
- - - - 36807 - CVE-2009-3627 - http://secunia.com/advisories/37155 - - - 2009-10-23 - 2009-11-06 - - - - - gd -- '_gdGetColors' remote buffer overflow vulnerability - - - gd - 2.0.35_2,1 - - - php5-gd - 5.2.11_2 - - - php4-gd - 4.4.9_4 - - - - -

CVE reports:

-
-

The _gdGetColors function in gd_gd.c in PHP 5.2.11 and - 5.3.0, and the GD Graphics Library 2.x, does not properly - verify a certain colorsTotal structure member, which might - allow remote attackers to conduct buffer overflow or buffer - over-read attacks via a crafted GD file, a different - vulnerability than CVE-2009-3293.

-
- - - - 36712 - CVE-2009-3546 - http://secunia.com/advisories/37069 - http://secunia.com/advisories/37080 - - - 2009-10-15 - 2009-11-05 - 2010-06-17 - - - - - typo3 -- multiple vulnerabilities in TYPO3 Core - - - typo3 - 4.2.10 - - - - -

TYPO3 develop team reports:

-
-

Affected versions: TYPO3 versions 4.0.13 and below, 4.1.12 - and below, 4.2.9 and below, 4.3.0beta1 and below.

-

SQL injection, Cross-site scripting (XSS), Information - disclosure, Frame hijacking, Remote shell command execution - and Insecure Install Tool authentication/session handling.

-
- - - - 36801 - CVE-2009-3628 - CVE-2009-3629 - CVE-2009-3630 - CVE-2009-3631 - CVE-2009-3632 - CVE-2009-3633 - CVE-2009-3634 - CVE-2009-3635 - CVE-2009-3636 - http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-016/ - http://secunia.com/advisories/37122/ - - - 2009-10-22 - 2009-11-05 - - - - - vlc -- stack overflow in MPA, AVI and ASF demuxer - - - vlc - 0.5.01.0.2 - - - - -

VideoLAN reports:

-
-

When parsing a MP4, ASF or AVI file with an overly deep box - structure, a stack overflow might occur. It would overwrite the - return address and thus redirect the execution flow.

-

If successful, a malicious third party could trigger execution - of arbitrary code within the context of the VLC media player.

-
- - - - http://www.videolan.org/security/sa0901.html - - - 2009-09-14 - 2009-11-03 - - - - - KDE -- multiple vulnerabilities - - - kdebase-runtime - 4.0.*4.3.1_2 - - - kdelibs - 4.0.*4.3.1_5 - - - - -

oCERT reports:

-
-

Ark input sanitization errors: The KDE archiving tool, Ark, - performs insufficient validation which leads to specially crafted - archive files, using unknown MIME types, to be rendered using a KHTML - instance, this can trigger uncontrolled XMLHTTPRequests to remote - sites.

-

IO Slaves input sanitization errors: KDE protocol handlers perform - insufficient input validation, an attacker can craft malicious URI - that would trigger JavaScript execution. Additionally the 'help://' - protocol handler suffer from directory traversal. It should be noted - that the scope of this issue is limited as the malicious URIs cannot - be embedded in Internet hosted content.

-

KMail input sanitization errors: The KDE mail client, KMail, performs - insufficient validation which leads to specially crafted email - attachments, using unknown MIME types, to be rendered using a KHTML - instance, this can trigger uncontrolled XMLHTTPRequests to remote - sites.

-

The exploitation of these vulnerabilities is unlikely according to - Portcullis and KDE but the execution of active content is nonetheless - unexpected and might pose a threat.

-
- - - - http://www.ocert.org/advisories/ocert-2009-015.html - - - 2009-10-30 - 2009-11-02 - - - - - opera -- multiple vulnerabilities - - - opera - 10.01.20091019 - - - linux-opera - 10.01 - - - - -

Opera Team Reports:

-
-
    -
  • Fixed an issue where certain domain names could allow execution - of arbitrary code, as reported by Chris Weber of Casaba Security
    • -
  • Fixed an issue where scripts can run on the feed subscription - page, as reported by Inferno
    • -
-
- - - - CVE-2009-3831 - http://www.opera.com/support/kb/view/938/ - http://www.opera.com/support/kb/view/939/ - - - 2009-10-28 - 2009-10-31 - 2010-05-02 - - - - - Enhanced cTorrent -- stack-based overflow - - - ctorrent - 3.3.2_2 - - - - -

Securityfocus reports:

-
-

cTorrent and dTorrent are prone to a remote buffer-overflow - vulnerability because the software fails to properly - bounds-check user-supplied input before copying it to an - insufficiently sized memory buffer.

-

Successful exploits allow remote attackers to execute - arbitrary machine code in the context of a vulnerable - application. Failed exploit attempts will likely result in - denial-of-service conditions.

-
- - - - 34584 - CVE-2009-1759 - http://sourceforge.net/tracker/?func=detail&aid=2782875&group_id=202532&atid=981959 - - - 2009-10-15 - 2009-10-28 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 3.5.*,13.5.4,1 - 3.*,13.0.15,1 - - - linux-firefox - 3.0.15 - - - seamonkey - linux-seamonkey - 2.0 - - - - -

Mozilla Foundation reports:

-
-

MFSA 2009-64 Crashes with evidence of memory - corruption (rv:1.9.1.4/ 1.9.0.15)

-

MFSA 2009-63 Upgrade media libraries to fix memory - safety bugs

-

MFSA 2009-62 Download filename spoofing with RTL - override

-

MFSA 2009-61 Cross-origin data theft through - document.getSelection()

-

MFSA 2009-59 Heap buffer overflow in string to - number conversion

-

MFSA 2009-57 Chrome privilege escalation in - XPCVariant::VariantDataToJS()

-

MFSA 2009-56 Heap buffer overflow in GIF color map - parser

-

MFSA 2009-55 Crash in proxy auto-configuration - regexp parsing

-

MFSA 2009-54 Crash with recursive web-worker calls

-

MFSA 2009-53 Local downloaded file tampering

-

MFSA 2009-52 Form history vulnerable to stealing

-
- - - - CVE-2009-3380 - CVE-2009-3381 - CVE-2009-3382 - CVE-2009-3383 - CVE-2009-3379 - CVE-2009-3378 - CVE-2009-3377 - CVE-2009-3376 - CVE-2009-3375 - CVE-2009-1563 - CVE-2009-3374 - CVE-2009-3373 - CVE-2009-3372 - CVE-2009-3371 - CVE-2009-3274 - CVE-2009-3370 - http://www.mozilla.org/security/announce/2009/mfsa2009-64.html - http://www.mozilla.org/security/announce/2009/mfsa2009-63.html - http://www.mozilla.org/security/announce/2009/mfsa2009-62.html - http://www.mozilla.org/security/announce/2009/mfsa2009-61.html - http://www.mozilla.org/security/announce/2009/mfsa2009-59.html - http://www.mozilla.org/security/announce/2009/mfsa2009-57.html - http://www.mozilla.org/security/announce/2009/mfsa2009-56.html - http://www.mozilla.org/security/announce/2009/mfsa2009-55.html - http://www.mozilla.org/security/announce/2009/mfsa2009-54.html - http://www.mozilla.org/security/announce/2009/mfsa2009-53.html - http://www.mozilla.org/security/announce/2009/mfsa2009-52.html - - - 2009-10-27 - 2009-10-28 - 2009-12-14 - - - - - elinks -- buffer overflow vulnerability - - - elinks - 0.11.4 - - - - -

SecurityFocus reports:

-
-

ELinks is prone to an off-by-one buffer-overflow vulnerability - because the application fails to accurately reference the last - element of a buffer.

-

Attackers may leverage this issue to execute arbitrary code in - the context of the application. Failed attacks will cause - denial-of-service conditions.

-
- - - - 36574 - CVE-2008-7224 - http://linuxfromscratch.org/pipermail/elinks-users/2008-February/001604.html - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=380347 - - - 2006-07-29 - 2009-10-25 - - - - - squidGuard -- multiple vulnerabilities - - - squidGuard - 1.4_2 - - - - -

SquidGuard website reports:

-
-

Patch 20091015 fixes one buffer overflow problem - in sgLog.c when overlong URLs are requested. - SquidGuard will then go into emergency mode were - no blocking occurs. This is not required in this - situation.

-
-
-

Patch 20091019 fixes two bypass problems with URLs - which length is close to the limit defined by MAX_BUF - (default: 4096) in squidGuard and MAX_URL (default: - 4096 in squid 2.x and 8192 in squid 3.x) in squid. - For this kind of URLs the proxy request exceeds MAX_BUF - causing squidGuard to complain about not being able to - parse the squid request. Increasing the buffer limit - to be higher than the one defined in MAX_URL solves the - issue.

-
- - - - CVE-2009-3700 - CVE-2009-3826 - http://www.squidguard.org/Downloads/Patches/1.4/Readme.Patch-20091015 - http://www.squidguard.org/Downloads/Patches/1.4/Readme.Patch-20091019 - - - 2009-10-15 - 2009-10-22 - 2010-05-06 - - - - - Xpdf -- Multiple Vulnerabilities - - - xpdf - 3.02_11 - - - - -

SecurityFocus reports:

-
-

Some vulnerabilities have been reported in Xpdf, which can be - exploited by malicious people to potentially compromise a user's - system.

-

1) Multiple integer overflows in "SplashBitmap::SplashBitmap()" - can be exploited to cause heap-based buffer overflows.

-

2) An integer overflow error in "ObjectStream::ObjectStream()" - can be exploited to cause a heap-based buffer overflow.

-

3) Multiple integer overflows in "Splash::drawImage()" can be - exploited to cause heap-based buffer overflows.

-

4) An integer overflow error in "PSOutputDev::doImageL1Sep()" - can be exploited to cause a heap-based buffer overflow when - converting a PDF document to a PS file.

-

Successful exploitation of the vulnerabilities may allow execution - of arbitrary code by tricking a user into opening a specially crafted - PDF file.

-
- - - - http://www.securityfocus.com/archive/1/507261 - http://secunia.com/advisories/37053/ - - - 2009-10-14 - 2009-10-20 - - - - - django -- denial-of-service attack - - - py23-django - py24-django - py25-django - py26-django - py30-django - py31-django - 1.1.1 - - - py23-django-devel - py24-django-devel - py25-django-devel - py26-django-devel - py30-django-devel - py31-django-devel - 11603,1 - - - - -

Django project reports:

-
-

Django's forms library includes field types which perform - regular-expression-based validation of email addresses and - URLs. Certain addresses/URLs could trigger a pathological - performance case in these regular expression, resulting in - the server process/thread becoming unresponsive, and consuming - excessive CPU over an extended period of time. If deliberately - triggered, this could result in an effectively - denial-of-service attack.

-
- - - - CVE-2009-3695 - http://www.djangoproject.com/weblog/2009/oct/09/security/ - - - 2009-10-09 - 2009-10-16 - 2010-05-02 - - - - - phpmyadmin -- XSS and SQL injection vulnerabilities - - - phpMyAdmin - 3.2.2.1 - - - phpMyAdmin211 - 2.11.9.6 - - - - -

phpMyAdmin Team reports:

-
-

Cross-site scripting (XSS) vulnerability allows remote attackers to - inject arbitrary web script or HTML via a crafted MySQL table name.

-

SQL injection vulnerability allows remote attackers to inject SQL via - various interface parameters of the PDF schema generator feature.

-
- - - - CVE-2009-3696 - CVE-2009-3697 - http://www.phpmyadmin.net/home_page/security/PMASA-2009-6.php - - - 2009-10-13 - 2009-10-13 - - - - - php5 -- Multiple security issues - - - php5 - 5.2.11 - - - - -

Vendor reports

-
-

Security Enhancements and Fixes in PHP 5.2.11: - Fixed certificate validation inside - php_openssl_apply_verification_policy. - Fixed sanity check for the color index in imagecolortransparent. - Added missing sanity checks around exif processing. - Fixed bug 44683 popen crashes when an invalid mode is passed.

-
- - - - http://www.php.net/releases/5_2_11.php - CVE-2009-3291 - CVE-2009-3292 - CVE-2009-3293 - - - 2009-09-17 - 2009-10-12 - - - - - virtualbox -- privilege escalation - - - virtualbox - 3.0.51.r22902_2 - - - - -

Sun reports:

-
-

A security vulnerability in the VBoxNetAdpCtl configuration tool - for certain Sun VirtualBox 3.0 packages may allow local unprivileged - users who are authorized to run VirtualBox to execute arbitrary - commands with root privileges.

-
- - - - CVE-2009-3692 - http://sunsolve.sun.com/search/document.do?assetkey=1-66-268188-1 - http://secunia.com/advisories/36929 - - - 2009-10-07 - 2009-10-07 - 2010-05-02 - - - - - FreeBSD -- Devfs / VFS NULL pointer race condition - - - FreeBSD - 6.36.3_13 - 6.46.4_7 - 7.17.1_8 - 7.27.2_4 - - - - -

Problem Description:

-

Due to the interaction between devfs and VFS, a race condition - exists where the kernel might dereference a NULL pointer.

-

Impact:

-

Successful exploitation of the race condition can lead to local - kernel privilege escalation, kernel data corruption and/or - crash.

-

To exploit this vulnerability, an attacker must be able to run - code with user privileges on the target system.

-

Workaround:

-

An errata note, FreeBSD-EN-09:05.null has been released - simultaneously to this advisory, and contains a kernel patch - implementing a workaround for a more broad class of - vulnerabilities. However, prior to those changes, no workaround - is available.

- - - - SA-09:14.devfs - - - 2009-10-02 - 2009-10-06 - 2016-08-09 - - - - - FreeBSD -- kqueue pipe race conditions - - - FreeBSD - 6.36.4_7 - 6.46.3_13 - - - - -

Problem Description

-

A race condition exists in the pipe close() code relating - to kqueues, causing use-after-free for kernel memory, which - may lead to an exploitable NULL pointer vulnerability in the - kernel, kernel memory corruption, and other unpredictable - results.

-

Impact:

-

Successful exploitation of the race condition can lead to - local kernel privilege escalation, kernel data corruption - and/or crash.

-

To exploit this vulnerability, an attacker must be able to - run code on the target system.

-

Workaround

-

An errata notice, FreeBSD-EN-09:05.null has been released - simultaneously to this advisory, and contains a kernel patch - implementing a workaround for a more broad class of - vulnerabilities. However, prior to those changes, no - workaround is available.

- - - - SA-09:13.pipe - - - 2009-10-02 - 2009-10-06 - 2016-08-09 - - - - - mybb -- multiple vulnerabilities - - - mybb - 1.4.9 - - - - -

mybb team reports:

-
-

Input passed via avatar extensions is not properly sanitised before - being used in SQL queries. This can be exploited to manipulate SQL - queries by uploading specially named avatars.

-

The script allows to sign up with usernames containing zero width - space characters, which can be exploited to e.g. conduct spoofing - attacks.

-
- - - - 36460 - http://dev.mybboard.net/issues/464 - http://dev.mybboard.net/issues/418 - http://secunia.com/advisories/36803 - http://blog.mybboard.net/2009/09/21/mybb-1-4-9-released-security-update/ - - - 2009-09-21 - 2009-09-30 - - - - - drupal -- multiple vulnerabilities - - - drupal5 - 5.20 - - - drupal6 - 6.14 - - - - -

Drupal Team reports:

-
-

The core OpenID module does not correctly implement Form API for - the form that allows one to link user accounts with OpenID - identifiers. A malicious user is therefore able to use cross site - request forgeries to add attacker controlled OpenID identities to - existing accounts. These OpenID identities can then be used to gain - access to the affected accounts.

-

The OpenID module is not a compliant implementation of the OpenID - Authentication 2.0 specification. An implementation error allows a - user to access the account of another user when they share the same - OpenID 2.0 provider.

-

File uploads with certain extensions are not correctly processed by - the File API. This may lead to the creation of files that are - executable by Apache. The .htaccess that is saved into the files - directory by Drupal should normally prevent execution. The files are - only executable when the server is configured to ignore the directives - in the .htaccess file.

-

Drupal doesn't regenerate the session ID when an anonymous user - follows the one time login link used to confirm email addresses and - reset forgotten passwords. This enables a malicious user to fix and - reuse the session id of a victim under certain circumstances.

-
- - - - http://drupal.org/node/579482 - http://secunia.com/advisories/36787/ - http://secunia.com/advisories/36786/ - http://secunia.com/advisories/36781/ - http://secunia.com/advisories/36776/ - http://secunia.com/advisories/36785/ - - - 2009-09-17 - 2009-09-22 - - - - - fwbuilder -- security issue in temporary file handling - - - fwbuilder - 3.0.7 - - - - -

Firewall Builder release notes reports:

-
-

Vadim Kurland (vadim.kurland@fwbuilder.org) reports:

-

Fwbuilder and libfwbuilder 3.0.4 through to 3.0.6 generate - iptables scripts with a security issue when also used to - generate static routing configurations.

-
- - - - CVE-2009-4664 - http://www.fwbuilder.org/docs/firewall_builder_release_notes.html#3.0.7 - - - 2009-09-18 - 2009-09-18 - 2010-05-02 - - - - - bugzilla -- two SQL injections, sensitive data exposure - - - bugzilla - 3.3.13.4.2 - - - - -

A Bugzilla Security Advisory reports:

-
-
    -
  • It is possible to inject raw SQL into the Bugzilla - database via the "Bug.create" and "Bug.search" WebService - functions.
    • -
  • When a user would change his password, his new password would - be exposed in the URL field of the browser if he logged in right - after changing his password.
    • -
-
- - - - CVE-2009-3125 - CVE-2009-3165 - CVE-2009-3166 - http://www.bugzilla.org/security/3.0.8/ - - - 2009-09-11 - 2009-09-17 - - - - - horde-base -- multiple vulnerabilities - - - horde-base - 3.3.5 - - - - -

The Horde team reports:

-
-

An error within the form library when handling image form fields can - be exploited to overwrite arbitrary local files.

-

An error exists within the MIME Viewer library when rendering unknown - text parts. This can be exploited to execute arbitrary HTML and script - code in a user's browser session in context of an affected site if - malicious data is viewed.

-

The preferences system does not properly sanitise numeric preference - types. This can be exploited to execute arbitrary HTML and script code - in a user's browser session in contact of an affected site.

-
- - - - http://bugs.horde.org/ticket/?id=8311 - http://bugs.horde.org/ticket/?id=8399 - http://secunia.com/advisories/36665/ - http://cvs.horde.org/diff.php/horde/docs/CHANGES?r1=1.515.2.558&r2=1.515.2.559 - - - 2009-05-28 - 2009-09-14 - 2009-09-22 - - - - - nginx -- remote denial of service vulnerability - - - nginx - 0.7.62 - - - nginx-devel - 0.8.15 - - - - -

nginx development team reports:

-
-

A segmentation fault might occur in worker process while - specially crafted request handling.

-
- - - - CVE-2009-2629 - http://nginx.net/CHANGES - http://lists.debian.org/debian-security-announce/2009/msg00205.html - - - 2009-09-14 - 2009-09-14 - 2009-09-15 - - - - - ikiwiki -- insufficient blacklisting in teximg plugin - - - ikiwiki - 3.1415926 - - - - -

The IkiWiki development team reports:

-
-

IkiWikis teximg plugin's blacklisting of insecure TeX commands - is insufficient; it can be bypassed and used to read arbitrary - files.

-
- - - - CVE-2009-2944 - http://ikiwiki.info/security/#index35h2 - - - 2009-08-28 - 2009-09-13 - - - - - xapian-omega -- cross-site scripting vulnerability - - - xapian-omega - 1.0.16 - - - - -

Olly Betts reports:

-
-

There's a cross-site scripting issue in Omega - exception - messages don't currently get HTML entities escaped, but can - contain CGI parameter values in some cases.

-
- - - - CVE-2009-2947 - http://lists.xapian.org/pipermail/xapian-discuss/2009-September/007115.html - - - 2009-09-09 - 2009-09-13 - - - - - mozilla firefox -- multiple vulnerabilities - - - firefox - 3.5.*,13.5.3,1 - 3.*,13.0.13,1 - - - - -

Mozilla Foundation reports:

-
-

MFSA 2009-51 Chrome privilege escalation with FeedWriter

-

MFSA 2009-50 Location bar spoofing via tall line-height Unicode - characters

-

MFSA 2009-49 TreeColumns dangling pointer vulnerability

-

MFSA 2009-48 Insufficient warning for PKCS11 module installation - and removal

-

MFSA 2009-47 Crashes with evidence of memory corruption - (rv:1.9.1.3/1.9.0.14)

-
- - - - CVE-2009-3069 - CVE-2009-3070 - CVE-2009-3071 - CVE-2009-3072 - CVE-2009-3073 - CVE-2009-3074 - CVE-2009-3075 - CVE-2009-3076 - CVE-2009-3077 - CVE-2009-3078 - CVE-2009-3079 - http://www.mozilla.org/security/announce/2009/mfsa2009-47.html - http://www.mozilla.org/security/announce/2009/mfsa2009-48.html - http://www.mozilla.org/security/announce/2009/mfsa2009-49.html - http://www.mozilla.org/security/announce/2009/mfsa2009-50.html - http://www.mozilla.org/security/announce/2009/mfsa2009-51.html - http://secunia.com/advisories/36671/2/ - - - 2009-09-10 - 2009-09-10 - - - - - cyrus-imapd -- Potential buffer overflow in Sieve - - - cyrus-imapd - 2.2.02.2.13_6 - 2.3.02.3.14_2 - - - - -

The Cyrus IMAP Server ChangeLog states:

-
-

Fixed CERT VU#336053 - Potential buffer overflow in Sieve.

-
- - - - CVE-2009-2632 - 36296 - http://www.kb.cert.org/vuls/id/336053 - http://www.debian.org/security/2009/dsa-1881 - - - 2009-09-02 - 2009-09-09 - 2009-09-14 - - - - - silc-toolkit -- Format string vulnerabilities - - - silc-toolkit - 1.1.9 - - - - -

SILC Changlog reports:

-
-

An unspecified format string vulnerability exists in - silc-toolkit.

-
- - - - CVE-2009-3051 - http://silcnet.org/docs/changelog/SILC%20Toolkit%201.1.10 - http://www.openwall.com/lists/oss-security/2009/09/03/5 - - - 2009-08-07 - 2009-09-08 - - - - - opera -- multiple vulnerabilities - - - opera - 10.00.20090830 - - - opera-devel - 10.00.b3_1,1 - - - linux-opera - 10.00 - - - - -

Opera Team Reports:

-
-
    -
  • Issue where sites using revoked intermediate certificates might be shown as secure
    • -
  • Issue where the collapsed address bar didn't show the current domain
    • -
  • Issue where pages could trick users into uploading files
    • -
  • Some IDNA characters not correctly displaying in the address bar
    • -
  • Issue where Opera accepts nulls and invalid wild-cards in certificates
    • -
-
- - - - http://www.opera.com/support/search/view/929/ - http://www.opera.com/support/search/view/930/ - http://www.opera.com/support/search/view/931/ - http://www.opera.com/support/search/view/932/ - http://www.opera.com/support/search/view/934/ - - - 2009-09-01 - 2009-09-04 - 2009-10-29 - - - - - dnsmasq -- TFTP server remote code injection vulnerability - - - dnsmasq - 2.50 - - - - -

Simon Kelley reports:

-
-

Fix security problem which allowed any host permitted to - do TFTP to possibly compromise dnsmasq by remote buffer - overflow when TFTP enabled.

-

Fix a problem which allowed a malicious TFTP client to - crash dnsmasq.

-
- - - - 36121 - 36120 - CVE-2009-2957 - CVE-2009-2958 - http://www.coresecurity.com/content/dnsmasq-vulnerabilities - https://rhn.redhat.com/errata/RHSA-2009-1238.html - - - 2009-08-31 - 2009-09-02 - - - - - apache22 -- several vulnerabilities - - - apache - 2.2.02.2.12 - - - - -

Apache ChangeLog reports:

-
-

CVE-2009-1891: Fix a potential Denial-of-Service attack against mod_deflate or other modules.

-

CVE-2009-1195: Prevent the "Includes" Option from being enabled in an .htaccess file if the AllowOverride restrictions do not permit it.

-

CVE-2009-1890: Fix a potential Denial-of-Service attack against mod_proxy in a reverse proxy configuration.

-

CVE-2009-1191: mod_proxy_ajp: Avoid delivering content from a previous request which failed to send a request body.

-

CVE-2009-0023, CVE-2009-1955, CVE-2009-1956: The bundled copy of the APR-util library has been updated, fixing three different security issues which may affect particular configurations and third-party modules (was already fixed in 2.2.11_5).

-
- - - - CVE-2009-1891 - CVE-2009-1195 - CVE-2009-1890 - CVE-2009-1191 - CVE-2009-0023 - CVE-2009-1955 - CVE-2009-1956 - - - 2009-07-28 - 2009-08-25 - - - - - pidgin -- MSN overflow parsing SLP messages - - - pidgin - libpurple - finch - 2.5.9 - - - - -

Secunia reports:

-
-

A vulnerability has been reported in Pidgin, which can be - exploited by malicious people to potentially compromise a user's - system.

-

The vulnerability is caused due to an error in the - "msn_slplink_process_msg()" function when processing MSN SLP - messages and can be exploited to corrupt memory.

-

Successful exploitation may allow execution of arbitrary - code.

-

The vulnerability is reported in versions 2.5.8 and prior. - Other versions may also be affected.

-
- - - - CVE-2009-2694 - http://secunia.com/advisories/36384/ - http://www.pidgin.im/news/security/?id=34 - - - 2009-08-18 - 2009-08-20 - - - - - GnuTLS -- multiple vulnerabilities - - - gnutls - 2.6.6 - - - gnutls-devel - 2.7.8 - - - - -

SecurityFocus reports:

-
-

GnuTLS is prone to multiple remote vulnerabilities:

-
    -
  • A remote code-execution vulnerability.
    • -
  • A denial-of-service vulnerability.
    • -
  • A signature-generation vulnerability.
    • -
  • A signature-verification vulnerability.
    • -
-

An attacker can exploit these issues to potentially execute - arbitrary code, trigger denial-of-service conditions, carry - out attacks against data signed with weak signatures, and - cause clients to accept expired or invalid certificates from - servers.

-
- - - - CVE-2009-1415 - CVE-2009-1416 - CVE-2009-1417 - 34783 - http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3515 - http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3516 - http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3517 - - - 2009-05-21 - 2009-08-17 - - - - - GnuTLS -- improper SSL certificate verification - - - gnutls - 2.8.3 - - - gnutls-devel - 2.9.0 - - - - -

GnuTLS reports:

-
-

By using a NUL byte in CN/SAN fields, it was possible to fool - GnuTLS into 1) not printing the entire CN/SAN field value when - printing a certificate and 2) cause incorrect positive matches - when matching a hostname against a certificate.

-
- - - - CVE-2009-2730 - http://article.gmane.org/gmane.network.gnutls.general/1733 - http://secunia.com/advisories/36266 - - - 2009-08-11 - 2009-08-17 - - - - - memcached -- memcached stats maps Information Disclosure Weakness - - - memcached - 1.2.8 - - - - -

Secunia reports:

-
-

A weakness has been reported in memcached, which can be exploited - by malicious people to disclose system information.

-

The weakness is caused due to the application disclosing the - content of /proc/self/maps if a stats maps command is received. - This can be exploited to disclose e.g. the addresses of allocated - memory regions.

-
- - - - CVE-2009-1255 - http://secunia.com/advisories/34915/ - - - 2009-04-29 - 2009-08-17 - - - - - wordpress -- remote admin password reset vulnerability - - - wordpress - 2.8.4,1 - - - de-wordpress - 2.8.4 - - - wordpress-mu - 2.8.4a - - - - -

WordPress reports:

-
-

A specially crafted URL could be requested that would allow an - attacker to bypass a security check to verify a user requested a - password reset. As a result, the first account without a key in the - database (usually the admin account) would have its password reset and - a new password would be emailed to the account owner.

-
- - - - CVE-2009-2762 - http://wordpress.org/development/2009/08/2-8-4-security-release/ - http://www.milw0rm.com/exploits/9410 - - - 2009-08-10 - 2009-08-12 - 2010-05-02 - - - - - fetchmail -- improper SSL certificate subject verification - - - fetchmail - 6.3.11 - - - - -

Matthias Andree reports:

-
-

Moxie Marlinspike demonstrated in July 2009 that some CAs would - sign certificates that contain embedded NUL characters in the - Common Name or subjectAltName fields of ITU-T X.509 - certificates.

-

Applications that would treat such X.509 strings as - NUL-terminated C strings (rather than strings that contain an - explicit length field) would only check the part up to and - excluding the NUL character, so that certificate names such as - www.good.example\0www.bad.example.com would be mistaken as a - certificate name for www.good.example. fetchmail also had this - design and implementation flaw.

-
- - - - CVE-2009-2666 - http://www.fetchmail.info/fetchmail-SA-2009-01.txt - - - 2009-08-06 - 2009-08-11 - 2009-08-13 - - - - - joomla15 -- com_mailto Timeout Issue - - - joomla15 - 1.5.14 - - - - -

Joomla! Security Center reports:

-
-

In com_mailto, it was possible to bypass timeout protection against - sending automated emails.

-
- - - - http://developer.joomla.org/security.html - http://secunia.com/advisories/36097/ - - - 2009-07-22 - 2009-08-07 - 2009-08-11 - - - - - subversion -- heap overflow vulnerability - - - subversion - subversion-freebsd - p5-subversion - py-subversion - 1.6.4 - - - - -

A Subversion Security Advisory reports:

-
-

Subversion clients and servers have multiple heap - overflow issues in the parsing of binary deltas. This is - related to an allocation vulnerability in the APR library - used by Subversion.

-

Clients with commit access to a vulnerable server can - cause a remote heap overflow; servers can cause a heap - overflow on vulnerable clients that try to do a checkout - or update.

-

This can lead to a DoS (an exploit has been tested) and - to arbitrary code execution (no exploit tested, but the - possibility is clear).

-
- - - - CVE-2009-2411 - http://subversion.tigris.org/security/CVE-2009-2411-advisory.txt - - - 2009-08-06 - 2009-08-06 - 2009-08-07 - - - - - bugzilla -- product name information leak - - - bugzilla - 3.3.43.4.1 - - - - -

A Bugzilla Security Advisory reports:

-
-

Normally, users are only supposed to see products that - they can file bugs against in the "Product" drop-down on - the bug-editing page. Instead, users were being shown all - products, even those that they normally could not see. Any - user who could edit any bug could see all product - names.

-
- - - - http://www.bugzilla.org/security/3.4/ - - - 2009-07-30 - 2009-08-05 - - - - - mozilla -- multiple vulnerabilities - - - firefox - linux-firefox - 3.*,1 - 3.*,13.0.13,1 - 3.5.*,13.5.2,1 - - - linux-firefox-devel - 3.5.2 - - - seamonkey - linux-seamonkey - 1.1.18 - - - linux-seamonkey-devel - 0 - - - thunderbird - linux-thunderbird - 2.0.0.23 - - - - -

Mozilla Project reports:

-
-

MFSA 2009-38: Data corruption with SOCKS5 reply containing DNS name - longer than 15 characters

-

MFSA 2009-42: Compromise of SSL-protected communication

-

MFSA 2009-43: Heap overflow in certificate regexp parsing

-

MFSA 2009-44: Location bar and SSL indicator spoofing via window.open() - on invalid URL

-

MFSA 2009-45: Crashes with evidence of memory corruption - (rv:1.9.1.2/1.9.0.13)

-

MFSA 2009-46: Chrome privilege escalation due to incorrectly cached - wrapper

-
- - - - CVE-2009-2404 - CVE-2009-2408 - CVE-2009-2454 - CVE-2009-2470 - http://www.mozilla.org/security/announce/2009/mfsa2009-38.html - http://www.mozilla.org/security/announce/2009/mfsa2009-42.html - http://www.mozilla.org/security/announce/2009/mfsa2009-43.html - http://www.mozilla.org/security/announce/2009/mfsa2009-44.html - http://www.mozilla.org/security/announce/2009/mfsa2009-45.html - http://www.mozilla.org/security/announce/2009/mfsa2009-46.html - - - 2009-08-03 - 2009-08-04 - 2009-09-04 - - - - - silc-client -- Format string vulnerability - - - silc-client - silc-irssi-client - 1.1.8 - - - - -

SILC changelog reports:

-
-

An unspecified format string vulnerability exists in - silc-client.

-
- - - - CVE-2009-3051 - http://silcnet.org/docs/changelog/SILC%20Client%201.1.8 - - - 2009-07-31 - 2009-08-04 - 2010-05-02 - - - - - SquirrelMail -- Plug-ins compromise - - - squirrelmail-multilogin-plugin - 2.3.42.3.4_2 - - - - -

Problem Description:

-

The SquirrelMail Web Server has been compromised, and three plugins - are affected.

-

The port of squirrelmail-sasql-plugin is safe (right MD5), and - change_pass is not in the FreeBSD ports tree, but multilogin has a - wrong MD5.

- - - - http://sourceforge.net/mailarchive/message.php?msg_name=4A727634.3080008%40squirrelmail.org - http://squirrelmail.org/index.php - - - 2009-07-31 - 2009-08-02 - - - - - BIND -- Dynamic update message remote DoS - - - bind9 - 9.3.6.1.1 - - - bind9-sdb-postgresql - bind9-sdb-ldap - 9.4.3.3 - - - FreeBSD - 6.36.3_12 - 6.46.4_6 - 7.17.1_7 - 7.27.2_3 - - - - -

Problem Description:

-

When named(8) receives a specially crafted dynamic update - message an internal assertion check is triggered which causes - named(8) to exit.

-

To trigger the problem, the dynamic update message must contains - a record of type "ANY" and at least one resource record set (RRset) - for this fully qualified domain name (FQDN) must exist on the - server.

-

Impact:

-

An attacker which can send DNS requests to a nameserver can cause - it to exit, thus creating a Denial of Service situation.

-

Workaround:

-

No generally applicable workaround is available, but some firewalls - may be able to prevent nsupdate DNS packets from reaching the - nameserver.

-

NOTE WELL: Merely configuring named(8) to ignore dynamic updates - is NOT sufficient to protect it from this vulnerability.

- - - - CVE-2009-0696 - SA-09:12.bind - http://www.kb.cert.org/vuls/id/725188 - https://www.isc.org/node/474 - - - 2009-07-28 - 2009-08-01 - 2009-08-04 - - - - - mono -- XML signature HMAC truncation spoofing - - - mono - 2.4.2.2 - - - - -

Secunia reports:

-
-

A security issue has been reported in Mono, which can be - exploited by malicious people to conduct spoofing attacks.

-

The security issue is caused due to an error when processing - certain XML signatures.

-
- - - - CVE-2009-0217 - http://secunia.com/advisories/35852/ - http://www.kb.cert.org/vuls/id/466161 - - - 2009-07-15 - 2009-07-29 - - - - - squid -- several remote denial of service vulnerabilities - - - squid - 3.0.13.0.17 - 3.1.0.13.1.0.12 - - - - -

Squid security advisory 2009:2 reports:

-
-

Due to incorrect buffer limits and related bound checks Squid - is vulnerable to a denial of service attack when processing - specially crafted requests or responses.

-

Due to incorrect data validation Squid is vulnerable to a - denial of service attack when processing specially crafted - responses.

-

These problems allow any trusted client or external server to - perform a denial of service attack on the Squid service.

-
-

Squid-2.x releases are not affected.

- - - - CVE-2009-2621 - CVE-2009-2622 - http://www.squid-cache.org/Advisories/SQUID-2009_2.txt - - - 2009-07-27 - 2009-07-27 - 2009-08-06 - - - - - mozilla -- corrupt JIT state after deep return from native function - - - firefox - 3.5.*,13.5.1,1 - - - - -

Mozilla Project reports:

-
-

Firefox user zbyte reported a crash that we determined could result - in an exploitable memory corruption problem. In certain cases after a - return from a native function, such as escape(), the Just-in-Time - (JIT) compiler could get into a corrupt state. This could be exploited - by an attacker to run arbitrary code such as installing malware.

-

This vulnerability does not affect earlier versions of Firefox - which do not support the JIT feature.

-
- - - - CVE-2009-2477 - http://www.mozilla.org/security/announce/2009/mfsa2009-41.html - http://www.kb.cert.org/vuls/id/443060 - - - 2009-07-16 - 2009-07-17 - 2010-05-02 - - - - - isc-dhcp-client -- Stack overflow vulnerability - - - isc-dhcp31-client - 3.1.1 - - - isc-dhcp30-client - 3.0.7_1 - - - - -

US-CERT reports:

-
-

The ISC DHCP dhclient application contains a stack buffer - overflow, which may allow a remote, unauthenticated attacker to - execute arbitrary code with root privileges.

-
- - - - CVE-2009-0692 - https://www.isc.org/node/468 - http://secunia.com/advisories/35785 - http://www.kb.cert.org/vuls/id/410676 - - - 2009-07-14 - 2009-07-15 - 2009-07-21 - - - - - drupal -- multiple vulnerabilities - - - drupal5 - 5.19 - - - drupal6 - 6.13 - - - - -

The Drupal Security Team reports:

-
-

Cross-site scripting

-

The Forum module does not correctly handle certain arguments - obtained from the URL. By enticing a suitably privileged user - to visit a specially crafted URL, a malicious user is able to - insert arbitrary HTML and script code into forum pages. Such a - cross-site scripting attack may lead to the malicious user - gaining administrative access. Wikipedia has more information - about cross-site scripting (XSS).

-

User signatures have no separate input format, they use the - format of the comment with which they are displayed. A user - will no longer be able to edit a comment when an administrator - changes the comment's input format to a format that is not - accessible to the user. However they will still be able to - modify their signature, which will then be processed by the new - input format.

-

If the new format is very permissive, via their signature, the - user may be able to insert arbitrary HTML and script code into - pages or, when the PHP filter is enabled for the new format, - execute PHP code. This issue affects Drupal 6.x only.

-

When an anonymous user fails to login due to mistyping his - username or password, and the page he is on contains a sortable - table, the (incorrect) username and password are included in - links on the table. If the user visits these links the password - may then be leaked to external sites via the HTTP referer.

-

In addition, if the anonymous user is enticed to visit the site - via a specially crafted URL while the Drupal page cache is - enabled, a malicious user might be able to retrieve the - (incorrect) username and password from the page cache.

-
- - - - CVE-2009-2372 - CVE-2009-2374 - CVE-2009-2373 - http://drupal.org/node/507572 - http://secunia.com/advisories/35681 - - - 2009-07-01 - 2009-07-13 - 2010-05-02 - - - - - nfsen -- remote command execution - - - nfsen - 1.3.2 - - - - -

nfsen reports:

-
-

Due to double input checking, a remote command execution security - bug exists in all NfSen versions 1.3 and 1.3.1. Users are - requested to update to nfsen-1.3.2.

-
- - - - http://sourceforge.net/forum/forum.php?forum_id=967583 - - - 2009-06-18 - 2009-07-03 - - - - - phpmyadmin -- XSS vulnerability - - - phpMyAdmin - 3.2.0.1 - - - - -

The phpMyAdmin project reports:

-
-

It was possible to conduct an XSS attack via a crafted - SQL bookmark.

-

All 3.x releases on which the "bookmarks" feature is - active are affected, previous versions are not.

-
- - - - CVE-2009-2284 - http://www.phpmyadmin.net/home_page/security/PMASA-2009-5.php - - - 2009-06-30 - 2009-06-30 - 2010-05-02 - - - - - nagios -- Command Injection Vulnerability - - - nagios - 3.0.6_1 - - - nagios2 - 2.12_3 - - - nagios-devel - 3.1.0_1 - - - - -

Secunia reports:

-
-

A vulnerability has been reported in Nagios, which can be - exploited by malicious users to potentially compromise a - vulnerable system.

-

Input passed to the "ping" parameter in statuswml.cgi is not - properly sanitised before being used to invoke the ping command. - This can be exploited to inject and execute arbitrary shell - commands.

-

Successful exploitation requires access to the ping feature - of the WAP interface.

-
- - - - CVE-2009-2288 - http://secunia.com/advisories/35543 - http://tracker.nagios.org/view.php?id=15 - - - 2009-05-29 - 2009-06-30 - 2009-07-13 - - - - - tor-devel -- DNS resolution vulnerability - - - tor-devel - 0.2.1.15-rc - - - - -

The Tor Project reports:

-
-

A malicious exit relay could convince a controller that the - client's DNS question resolves to an internal IP address.

-
- - - - https://git.torproject.org/checkout/tor/master/ChangeLog - - - 2009-06-20 - 2009-06-23 - - - - - cscope -- multiple buffer overflows - - - cscope - 15.7a - - - - -

Secunia reports:

-
-

Some vulnerabilities have been reported in Cscope, which - potentially can be exploited by malicious people to compromise a - user's system.

-

The vulnerabilities are caused due to various boundary errors, - which can be exploited to cause buffer overflows when parsing - specially crafted files or directories.

-
- - - - 34805 - CVE-2009-0148 - http://secunia.com/advisories/34978 - - - 2009-05-31 - 2009-06-16 - - - - - cscope -- buffer overflow - - - cscope - 15.6 - - - - -

SecurityFocus reports:

-
-

Attackers may leverage this issue to execute arbitrary code - in the context of the application. Failed attacks will cause - denial-of-service conditions.

-
- - - - 34832 - CVE-2009-1577 - http://cscope.cvs.sourceforge.net/viewvc/cscope/cscope/src/find.c?view=log#rev1.19 - - - 2009-05-31 - 2009-06-16 - - - - - joomla -- multiple vulnerabilities - - - joomla15 - 1.5.11 - - - - -

Secunia reports:

-
-

Some vulnerabilities have been reported in Joomla!, which can be - exploited by malicious users to conduct script insertion attacks and - by malicious people to conduct cross-site scripting attacks.

-

Certain unspecified input is not properly sanitised before being - used. This can be exploited to insert arbitrary HTML and script code, - which will be executed in a user's browser session in the context of - an affected site when the malicious data is displayed.

-

Certain unspecified input passed to the user view of the com_users - core component is not properly sanitised before being returned to the - user. This can be exploited to execute arbitrary HTML and script code - in a user's browser session in context of an affected site.

-

Input passed via certain parameters to the "JA_Purity" template is - not properly sanitised before being returned to the user. This can be - exploited to execute arbitrary HTML and script code in a user's - browser session in context of an affected site.

-
- - - - CVE-2009-1938 - CVE-2009-1939 - CVE-2009-1940 - http://secunia.com/advisories/35278/ - http://www.joomla.org/announcements/release-news/5235-joomla-1511-security-release-now-available.html - - - 2009-06-03 - 2009-06-16 - 2010-05-02 - - - - - pidgin -- multiple vulnerabilities - - - pidgin - libpurple - finch - 2.5.6 - - - - -

Secunia reports:

-
-

Some vulnerabilities and weaknesses have been reported in Pidgin, - which can be exploited by malicious people to cause a DoS or to - potentially compromise a user's system.

-

A truncation error in the processing of MSN SLP messages can be - exploited to cause a buffer overflow.

-

A boundary error in the XMPP SOCKS5 "bytestream" server when - initiating an outgoing file transfer can be exploited to cause a - buffer overflow.

-

A boundary error exists in the implementation of the - "PurpleCircBuffer" structure. This can be exploited to corrupt memory - and cause a crash via specially crafted XMPP or Sametime - packets.

-

A boundary error in the "decrypt_out()" function can be exploited - to cause a stack-based buffer overflow with 8 bytes and crash the - application via a specially crafted QQ packet.

-
- - - - 35067 - CVE-2009-1373 - CVE-2009-1374 - CVE-2009-1375 - CVE-2009-1376 - http://secunia.com/advisories/35194/ - http://www.pidgin.im/news/security/?id=29 - http://www.pidgin.im/news/security/?id=30 - http://www.pidgin.im/news/security/?id=32 - - - 2009-06-03 - 2009-06-16 - - - - - git -- denial of service vulnerability - - - git - 1.6.3.2_1 - - - - -

SecurityFocus reports:

-
-

Git is prone to a denial-of-service vulnerability because it - fails to properly handle some client requests.

-

Attackers can exploit this issue to cause a daemon process to - enter an infinite loop. Repeated exploits may consume excessive - system resources, resulting in a denial of service condition.

-
- - - - 35338 - CVE-2009-2108 - https://www.redhat.com/archives/fedora-security-list/2009-June/msg00000.html - http://article.gmane.org/gmane.comp.version-control.git/120724 - - - 2009-06-04 - 2009-06-15 - 2010-05-02 - - - - - ruby -- BigDecimal denial of service vulnerability - - - ruby - ruby+pthreads - ruby+pthreads+oniguruma - ruby+oniguruma - 1.8.*,11.8.7.160_1,1 - - - - -

The official ruby site reports:

-
-

A denial of service (DoS) vulnerability was found on the - BigDecimal standard library of Ruby. Conversion from BigDecimal - objects into Float numbers had a problem which enables attackers - to effectively cause segmentation faults.

-

An attacker can cause a denial of service by causing BigDecimal - to parse an insanely large number, such as:

-

BigDecimal("9E69999999").to_s("F")

-
- - - - 35278 - CVE-2009-1904 - http://www.ruby-lang.org/en/news/2009/06/09/dos-vulnerability-in-bigdecimal/ - - - 2009-06-09 - 2009-06-13 - 2010-05-02 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 2.0.0.20_8,1 - 3.*,13.0.11,1 - - - linux-firefox - linux-firefox-devel - 3.0.11 - - - thunderbird - linux-thunderbird - 2.0.0.22 - - - seamonkey - linux-seamonkey - 1.1.17 - - - - -

Mozilla Foundation reports:

-
-

MFSA 2009-32 JavaScript chrome privilege escalation

-

MFSA 2009-31 XUL scripts bypass content-policy checks

-

MFSA 2009-30 Incorrect principal set for file: resources - loaded via location bar

-

MFSA 2009-29 Arbitrary code execution using event listeners - attached to an element whose owner document is null

-

MFSA 2009-28 Race condition while accessing the private data - of a NPObject JS wrapper class object

-

MFSA 2009-27 SSL tampering via non-200 responses to proxy - CONNECT requests

-

MFSA 2009-26 Arbitrary domain cookie access by local file: - resources

-

MFSA 2009-25 URL spoofing with invalid unicode characters

-

MFSA 2009-24 Crashes with evidence of memory corruption (rv:1.9.0.11)

-
- - - - CVE-2009-1392 - CVE-2009-1832 - CVE-2009-1833 - CVE-2009-1834 - CVE-2009-1835 - CVE-2009-1836 - CVE-2009-1837 - CVE-2009-1838 - CVE-2009-1839 - CVE-2009-1840 - CVE-2009-1841 - http://www.mozilla.org/security/announce/2009/mfsa2009-24.html - http://www.mozilla.org/security/announce/2009/mfsa2009-25.html - http://www.mozilla.org/security/announce/2009/mfsa2009-26.html - http://www.mozilla.org/security/announce/2009/mfsa2009-27.html - http://www.mozilla.org/security/announce/2009/mfsa2009-28.html - http://www.mozilla.org/security/announce/2009/mfsa2009-29.html - http://www.mozilla.org/security/announce/2009/mfsa2009-30.html - http://www.mozilla.org/security/announce/2009/mfsa2009-31.html - http://www.mozilla.org/security/announce/2009/mfsa2009-32.html - http://secunia.com/advisories/35331/ - - - 2009-06-11 - 2009-06-12 - 2009-12-12 - - - - - apr -- multiple vulnerabilities - - - apr - 1.3.5.1.3.7 - - - apache - 2.2.02.2.11_5 - 2.0.02.0.63_3 - - - - -

Secunia reports:

-
-

Some vulnerabilities have been reported in APR-util, which - can be exploited by malicious users and malicious people to - cause a DoS (Denial of Service).

-

A vulnerability is caused due to an error in the processing - of XML files and can be exploited to exhaust all available - memory via a specially crafted XML file containing a - predefined entity inside an entity definition.

-

A vulnerability is caused due to an error within the - "apr_strmatch_precompile()" function in - strmatch/apr_strmatch.c, which can be exploited to crash an - application using the library.

-
-

RedHat reports:

-
-

A single NULL byte buffer overflow flaw was found in - apr-util's apr_brigade_vprintf() function.

-
- - - - 35221 - CVE-2009-1955 - CVE-2009-1956 - CVE-2009-0023 - http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.3 - http://secunia.com/advisories/35284/ - https://bugzilla.redhat.com/show_bug.cgi?id=3D504390 - - - 2009-06-05 - 2009-06-08 - - - - - dokuwiki -- Local File Inclusion with register_globals on - - - dokuwiki - 20090214_2 - - - dokuwiki-devel - 0 - - - - -

DokuWiki reports:

-
-

A security hole was discovered which allows an attacker - to include arbitrary files located on the attacked DokuWiki - installation. The included file is executed in the PHP context. - This can be escalated by introducing malicious code through - uploading file via the media manager or placing PHP code in - editable pages.

-
- - - - CVE-2009-1960 - http://bugs.splitbrain.org/index.php?do=details&task_id=1700 - - - 2009-05-26 - 2009-06-04 - 2010-05-02 - - - - - openssl -- denial of service in DTLS implementation - - - openssl - 0.9.80.9.8k_1 - - - linux-f10-openssl - 0.9.8f0.9.8m - - - - -

Secunia reports:

-
-

Some vulnerabilities have been reported in OpenSSL, which can be - exploited by malicious people to cause a DoS.

-

The library does not limit the number of buffered DTLS records with - a future epoch. This can be exploited to exhaust all available memory - via specially crafted DTLS packets.

-

An error when processing DTLS messages can be exploited to exhaust - all available memory by sending a large number of out of sequence - handshake messages.

-
- - - - CVE-2009-1377 - CVE-2009-1378 - http://secunia.com/advisories/35128/ - - - 2009-05-18 - 2009-05-30 - 2014-04-10 - - - - - eggdrop -- denial of service vulnerability - - - eggdrop - 1.6.19_2 - - - - -

Secunia reports:

-
-

The vulnerability is caused due to an error in the processing of - private messages within the server module - (/mod/server.mod/servrmsg.c). This can be exploited to cause a - crash by sending a specially crafted message to the bot.

-
- - - - 34985 - CVE-2009-1789 - http://www.eggheads.org/news/2009/05/14/35 - http://secunia.com/advisories/35104/ - - - 2009-05-15 - 2009-05-30 - - - - - wireshark -- PCNFSD Dissector Denial of Service Vulnerability - - - ethereal - ethereal-lite - tethereal - tethereal-lite - wireshark - wireshark-lite - 1.0.8 - - - - -

Secunia reports:

-
-

A vulnerability has been reported in Wireshark, which can be - exploited by malicious people to cause a DoS.

-

The vulnerability is caused due to an error in the PCNFSD dissector - and can be exploited to cause a crash via a specially crafted PCNFSD - packet.

-
- - - - CVE-2009-1829 - http://secunia.com/advisories/35201/ - http://www.wireshark.org/security/wnpa-sec-2009-03.html - - - 2009-05-21 - 2009-05-30 - 2010-05-02 - - - - - libsndfile -- multiple vulnerabilities - - - libsndfile - 1.0.20 - - - - -

Secunia reports:

-
-

Two vulnerabilities have been reported in libsndfile, which can be - exploited by malicious people to compromise an application using the - library.

-

A boundary error exists within the "voc_read_header()" function in - src/voc.c. This can be exploited to cause a heap-based buffer overflow - via a specially crafted VOC file.

-

A boundary error exists within the "aiff_read_header()" function in - src/aiff.c. This can be exploited to cause a heap-based buffer overflow - via a specially crafted AIFF file.

-
- - - - CVE-2009-1788 - CVE-2009-1791 - http://secunia.com/advisories/35076/ - http://www.trapkit.de/advisories/TKADV2009-006.txt - - - 2009-05-15 - 2009-05-30 - - - - - slim -- local disclosure of X authority magic cookie - - - slim - 1.3.1_3 - - - - -

Secunia reports:

-
-

A security issue has been reported in SLiM, which can be - exploited by malicious, local users to disclose sensitive - information.

-

The security issue is caused due to the application - generating the X authority file by passing the X authority - cookie via the command line to "xauth". This can be exploited - to disclose the X authority cookie by consulting the process - list and e.g. gain access the user's display.

-
- - - - 35015 - CVE-2009-1756 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=529306 - - - 2009-05-20 - 2009-05-30 - - - - - ntp -- stack-based buffer overflow - - - ntp - 4.2.4p7 - - - - -

US-CERT reports:

-
-

ntpd contains a stack buffer overflow which may allow a remote - unauthenticated attacker to execute arbitrary code on a vulnerable - system or create a denial of service.

-
- - - - 35017 - CVE-2009-0159 - CVE-2009-1252 - http://www.kb.cert.org/vuls/id/853097 - - - 2009-05-06 - 2009-05-20 - - - - - imap-uw -- University of Washington IMAP c-client Remote Format String Vulnerability - - - imap-uw - 2007e - - - - -

SecurityFocus reports:

-
-

University of Washington IMAP c-client is prone to a remote - format-string vulnerability because the software fails to adequately - sanitize user-supplied input before passing it as the - format-specifier to a formatted-printing function.

-
- - - - 33795 - - - 2009-02-17 - 2009-05-21 - 2009-05-22 - - - - - nsd -- buffer overflow vulnerability - - - nsd - 3.2.2 - - - nsd2 - 2.3.7_1 - - - - -

NLnet Labs:

-
-

A one-byte buffer overflow has been reported in NSD. The - problem affects all versions 2.0.0 to 3.2.1. The bug allows - a carefully crafted exploit to bring down your DNS server. It - is highly unlikely that this one byte overflow can lead to - other (system) exploits.

-
- - - - CVE-2009-1755 - http://www.nlnetlabs.nl/publications/NSD_vulnerability_announcement.html - - - 2009-05-19 - 2009-05-19 - 2009-05-22 - - - - - libxine -- multiple vulnerabilities - - - libxine - 1.1.16.3 - - - - -

xine developers report:

-
-
    -
  • Fix another possible int overflow in the 4XM demuxer. - (ref. TKADV2009-004, CVE-2009-0385)
    • -
  • Fix an integer overflow in the Quicktime demuxer.
    • -
-
- - - - CVE-2009-0385 - CVE-2009-1274 - http://trapkit.de/advisories/TKADV2009-004.txt - http://trapkit.de/advisories/TKADV2009-005.txt - http://sourceforge.net/project/shownotes.php?release_id=660071 - - - 2009-04-04 - 2009-05-17 - - - - - libxine -- multiple vulnerabilities - - - libxine - 1.1.16.2 - - - - -

Multiple vulnerabilities were fixed in libxine 1.1.16.2.

-

Tobias Klein reports:

-
-

FFmpeg contains a type conversion vulnerability while - parsing malformed 4X movie files. The vulnerability may be - exploited by a (remote) attacker to execute arbitrary code in - the context of FFmpeg or an application using the FFmpeg - library.

-

Note: A similar issue also affects xine-lib < version - 1.1.16.2.

-
-

xine developers report:

-
-
    -
  • Fix broken size checks in various input plugins (ref. - CVE-2008-5239).
    • -
  • More malloc checking (ref. CVE-2008-5240).
    • -
-
- - - - CVE-2009-0698 - CVE-2008-5234 - CVE-2008-5240 - http://trapkit.de/advisories/TKADV2009-004.txt - http://sourceforge.net/project/shownotes.php?release_id=660071 - - - 2009-02-15 - 2009-05-17 - - - - - php -- ini database truncation inside dba_replace() function - - - php4-dba - 4.4.9_1 - - - php5-dba - 5.2.7 - - - - -

securityfocus research reports:

-
-

A bug that leads to the emptying of the INI file contents if - the database key was not found exists in PHP dba extension in - versions 5.2.6, 4.4.9 and earlier.

-

Function dba_replace() are not filtering strings key and value. - There is a possibility for the destruction of the file.

-
- - - - CVE-2008-7068 - http://www.securityfocus.com/archive/1/498746/30/0/threaded - http://securityreason.com/achievement_securityalert/58 - - - 2008-11-28 - 2009-05-16 - 2013-06-16 - - - - - libwmf -- embedded GD library Use-After-Free vulnerability - - - libwmf - 0.2.8.4_3 - - - - -

Secunia reports:

-
-

A vulnerability has been reported in libwmf, which can be exploited - by malicious people to cause a DoS (Denial of Service) or compromise - an application using the library.

-

The vulnerability is caused due to a use-after-free error within the - embedded GD library, which can be exploited to cause a crash or - potentially to execute arbitrary code via a specially crafted WMF - file.

-
- - - - 34792 - CVE-2009-1364 - https://bugzilla.redhat.com/show_bug.cgi?id=496864 - https://rhn.redhat.com/errata/RHSA-2009-0457.html - http://secunia.com/advisories/34901/ - - - 2009-05-05 - 2009-05-16 - - - - - libwmf -- integer overflow vulnerability - - - libwmf - 0.2.8.4_3 - - - - -

Secunia reports:

-
-

infamous41md has reported a vulnerability in libwmf, which - potentially can be exploited by malicious people to compromise an - application using the vulnerable library.

-

The vulnerability is caused due to an integer overflow error when - allocating memory based on a value taken directly from a WMF file - without performing any checks. This can be exploited to cause a - heap-based buffer overflow when a specially crafted WMF file is - processed.

-
- - - - 18751 - CVE-2006-3376 - http://secunia.com/advisories/20921/ - - - 2006-07-03 - 2009-05-16 - - - - - moinmoin -- cross-site scripting vulnerabilities - - - moinmoin - 1.8.3 - - - - -

Secunia reports:

-
-

Input passed via multiple parameters to action/AttachFile.py is not - properly sanitised before being returned to the user. This can be - exploited to execute arbitrary HTML and script code in a user's - browser session in the context of an affected site.

-
- - - - CVE-2009-1482 - http://secunia.com/advisories/34821/ - http://moinmo.in/SecurityFixes - - - 2009-04-21 - 2009-05-16 - - - - - mod_perl -- cross-site scripting - - - mod_perl - 1.31 - - - mod_perl2 - 2.05 - - - - -

Secunia reports:

-
-

Certain input passed to the "Apache::Status" and "Apache2::Status" - modules is not properly sanitised before being returned to the user. - This can be exploited to execute arbitrary HTML and script code in a - user's browser session in context of an affected website.

-
- - - - CVE-2009-0796 - http://secunia.com/advisories/34597 - - - 2009-02-28 - 2009-05-16 - 2009-05-16 - - - - - drupal -- cross-site scripting - - - drupal5 - 5.18 - - - drupal6 - 6.12 - - - - -

The Drupal Security Team reports:

-
-

When outputting user-supplied data Drupal strips potentially - dangerous HTML attributes and tags or escapes characters which - have a special meaning in HTML. This output filtering secures the - site against cross site scripting attacks via user input.

-

Certain byte sequences that are valid in the UTF-8 specification - are potentially dangerous when interpreted as UTF-7. Internet - Explorer 6 and 7 may decode these characters as UTF-7 if they - appear before the <meta http-equiv="Content-Type" /> tag that - specifies the page content as UTF-8, despite the fact that Drupal - also sends a real HTTP header specifying the content as UTF-8. - This enables attackers to execute cross site scripting attacks - with UTF-7. SA-CORE-2009-005 - Drupal core - Cross site scripting - contained an incomplete fix for the issue. HTML exports of books - are still vulnerable, which means that anyone with edit - permissions for pages in outlines is able to insert arbitrary HTML - and script code in these exports.

-

Additionally, the taxonomy module allows users with the - 'administer taxonomy' permission to inject arbitrary HTML and - script code in the help text of any vocabulary.

-
- - - - http://drupal.org/node/461886 - http://secunia.com/advisories/35045 - - - 2009-05-13 - 2009-05-14 - 2009-05-16 - - - - - cyrus-sasl -- buffer overflow vulnerability - - - cyrus-sasl - 2.1.23 - - - - -

US-CERT reports:

-
-

The sasl_encode64() function converts a string into - base64. The Cyrus SASL library contains buffer overflows - that occur because of unsafe use of the sasl_encode64() - function.

-
- - - - CVE-2009-0688 - http://www.kb.cert.org/vuls/id/238019 - - - 2009-04-08 - 2009-05-15 - - - - - moinmoin -- multiple cross site scripting vulnerabilities - - - moinmoin - 1.8.2 - - - - -

Secunia reports:

-
-

Some vulnerabilities have been reported in MoinMoin, which can be - exploited by malicious people to conduct cross-site scripting attacks.

-

Input passed to multiple parameters in action/AttachFile.py is not - properly sanitised before being returned to the user. This can be - exploited to execute arbitrary HTML and script code in a user's - browser session in the context of an affected site.

-

Certain input passed to security/antispam.py is not properly - sanitised before being returned to the user. This can be exploited to - execute arbitrary HTML and script code in a user's browser session in - the context of an affected site.

-
- - - - CVE-2009-0260 - CVE-2009-0312 - http://moinmo.in/SecurityFixes - http://secunia.com/advisories/33593 - - - 2009-01-21 - 2009-05-13 - - - - - ghostscript -- buffer overflow vulnerability - - - ghostscript8 - ghostscript8-nox11 - 8.64 - - - - -

SecurityFocus reports:

-
-

Ghostscript is prone to a remote buffer-overflow vulnerability - because it fails to properly bounds-check user-supplied input before - copying it into a finite-sized buffer.

-

Exploiting this issue allows remote attackers to overwrite a - sensitive memory buffer with arbitrary data, potentially allowing them - to execute malicious machine code in the context of the affected - application. This vulnerability may facilitate the compromise of - affected computers.

-
- - - - 34340 - CVE-2008-6679 - - - 2009-02-03 - 2009-05-13 - - - - - pango -- integer overflow - - - pango - linux-pango - linux-f8-pango - linux-f10-pango - 1.24 - - - - -

oCERT reports:

-
-

Pango suffers from a multiplicative integer overflow which - may lead to a potentially exploitable, heap overflow depending - on the calling conditions.

-

For example, this vulnerability is remotely reachable in Firefox - by creating an overly large document.location value but only results - in a process-terminating, allocation error (denial of service).

-

The affected function is pango_glyph_string_set_size. An overflow - check when doubling the size neglects the overflow possible on the - subsequent allocation.

-
- - - - 34870 - CVE-2009-1194 - http://secunia.com/advisories/35021/ - - - 2009-02-22 - 2009-05-13 - 2009-10-01 - - - - - wireshark -- multiple vulnerabilities - - - ethereal - ethereal-lite - tethereal - tethereal-lite - wireshark - wireshark-lite - 1.0.7 - - - - -

Wireshark team reports:

-
-

Wireshark 1.0.7 fixes the following vulnerabilities:

-
    -
  • The PROFINET dissector was vulnerable to a format - string overflow. (Bug 3382) Versions affected: 0.99.6 to - 1.0.6, CVE-2009-1210.
    • -
  • The Check Point High-Availability Protocol (CPHAP) - dissector could crash. (Bug 3269) Versions affected: 0.9.6 - to 1.0.6; CVE-2009-1268.
    • -
  • Wireshark could crash while loading a Tektronix .rf5 - file. (Bug 3366) Versions affected: 0.99.6 to 1.0.6, - CVE-2009-1269.
    • -
-
- - - - 34291 - 34457 - CVE-2009-1210 - CVE-2009-1268 - CVE-2009-1269 - http://www.wireshark.org/security/wnpa-sec-2009-02.html - http://secunia.com/advisories/34542 - - - 2009-04-06 - 2009-05-09 - 2009-05-13 - - - - - cups -- remote code execution and DNS rebinding - - - cups-base - 1.3.10 - - - - -

Gentoo security team summarizes:

-
-

The following issues were reported in CUPS:

-
    -
  • iDefense reported an integer overflow in the - _cupsImageReadTIFF() function in the "imagetops" filter, - leading to a heap-based buffer overflow (CVE-2009-0163).
    • -
  • Aaron Siegel of Apple Product Security reported that the - CUPS web interface does not verify the content of the "Host" - HTTP header properly (CVE-2009-0164).
    • -
  • Braden Thomas and Drew Yao of Apple Product Security - reported that CUPS is vulnerable to CVE-2009-0146, - CVE-2009-0147 and CVE-2009-0166, found earlier in xpdf and - poppler.
    • -
-

A remote attacker might send or entice a user to send a - specially crafted print job to CUPS, possibly resulting in the - execution of arbitrary code with the privileges of the - configured CUPS user -- by default this is "lp", or a Denial - of Service. Furthermore, the web interface could be used to - conduct DNS rebinding attacks.

-
- - - - 34571 - 34665 - 34568 - CVE-2009-0163 - CVE-2009-0164 - CVE-2009-0146 - CVE-2009-0147 - CVE-2009-0166 - http://www.cups.org/articles.php?L582 - - - 2009-05-05 - 2009-05-07 - 2009-05-13 - - - - - FreeBSD -- remotely exploitable crash in OpenSSL - - - FreeBSD - 6.36.3_10 - 6.46.4_4 - 7.07.0_12 - 7.17.1_5 - - - - -

Problem Description

-

The function ASN1_STRING_print_ex does not properly validate - the lengths of BMPString or UniversalString objects before - attempting to print them.

-

Impact

-

An application which attempts to print a BMPString or - UniversalString which has an invalid length will crash as a - result of OpenSSL accessing invalid memory locations. This - could be used by an attacker to crash a remote application.

-

Workaround

-

No workaround is available, but applications which do not use - the ASN1_STRING_print_ex function (either directly or indirectly) - are not affected.

- - - - SA-09:08.openssl - CVE-2009-0590 - - - 2009-03-25 - 2009-05-07 - 2009-05-13 - - - - - quagga -- Denial of Service - - - quagga - 0.99.11_3 - - - - -

Debian Security Team reports:

-
-

It was discovered that Quagga, an IP routing daemon, could - no longer process the Internet routing table due to broken - handling of multiple 4-byte AS numbers in an AS path. If such - a prefix is received, the BGP daemon crashes with an assert - failure leading to a denial of service.

-
- - - - 34656 - http://lists.quagga.net/pipermail/quagga-dev/2009-April/006541.html - CVE-2009-1572 - - - 2009-05-04 - 2009-05-06 - 2009-05-07 - - - - - openfire -- Openfire No Password Changes Security Bypass - - - openfire - 3.6.4 - - - - -

Secunia reports:

-
-

A vulnerability has been reported in Openfire which can - be exploited by malicious users to bypass certain security - restrictions. The vulnerability is caused due to Openfire - not properly respecting the no password changes setting which - can be exploited to change passwords by sending jabber:iq:auth - passwd_change requests to the server.

-
- - - - CVE-2009-1596 - http://secunia.com/advisories/34984/ - http://www.igniterealtime.org/issues/browse/JM-1532 - http://www.igniterealtime.org/community/message/190288#190288 - - - 2009-05-04 - 2009-05-04 - 2010-05-02 - - - - - drupal -- cross site scripting - - - drupal5 - 5.17 - - - drupal6 - 6.11 - - - - -

Drupal Security Team reports:

-
-

When outputting user-supplied data Drupal strips potentially - dangerous HTML attributes and tags or escapes characters which have a - special meaning in HTML. This output filtering secures the site - against cross site scripting attacks via user input.

-

Certain byte sequences that are valid in the UTF-8 specification - are potentially dangerous when interpreted as UTF-7. Internet Explorer - 6 and 7 may decode these characters as UTF-7 if they appear before the - meta http-equiv="Content-Type" tag that specifies the page content - as UTF-8, despite the fact that Drupal also sends a real HTTP header - specifying the content as UTF-8. This behaviour enables malicious - users to insert and execute Javascript in the context of the website - if site visitors are allowed to post content.

-

In addition, Drupal core also has a very limited information - disclosure vulnerability under very specific conditions. If a user is - tricked into visiting the site via a specially crafted URL and then - submits a form (such as the search box) from that page, the - information in their form submission may be directed to a third-party - site determined by the URL and thus disclosed to the third party. The - third party site may then execute a CSRF attack against the submitted - form.

-
- - - - CVE-2009-1575 - CVE-2009-1576 - http://drupal.org/node/449078 - - - 2009-04-30 - 2009-04-30 - 2010-05-02 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 2.0.0.20_7,1 - 3.*,13.0.9,1 - - - linux-firefox - linux-firefox-devel - 3.0.9 - - - linux-seamonkey-devel - 0 - - - seamonkey - linux-seamonkey - 1.1.17 - - - thunderbird - linux-thunderbird - 2.0.0.22 - - - - -

Mozilla Foundation reports:

-
-

MFSA 2009-22: Firefox allows Refresh header to redirect to - javascript: URIs

-

MFSA 2009-21: POST data sent to wrong site when saving web page - with embedded frame

-

MFSA 2009-20: Malicious search plugins can inject code into - arbitrary sites

-

MFSA 2009-19: Same-origin violations in XMLHttpRequest and - XPCNativeWrapper.toString

-

MFSA 2009-18: XSS hazard using third-party stylesheets and XBL - bindings

-

MFSA 2009-17: Same-origin violations when Adobe Flash loaded via - view-source: scheme

-

MFSA 2009-16: jar: scheme ignores the content-disposition: header - on the inner URI

-

MFSA 2009-15: URL spoofing with box drawing character

-

MFSA 2009-14 Crashes with evidence of memory corruption - (rv:1.9.0.9)

-
- - - - 34656 - CVE-2009-1303 - CVE-2009-1306 - CVE-2009-1307 - CVE-2009-1308 - CVE-2009-1309 - CVE-2009-1312 - CVE-2009-1311 - CVE-2009-1302 - CVE-2009-1304 - CVE-2009-1305 - CVE-2009-1310 - http://www.mozilla.org/security/announce/2009/mfsa2009-22.html - http://www.mozilla.org/security/announce/2009/mfsa2009-21.html - http://www.mozilla.org/security/announce/2009/mfsa2009-20.html - http://www.mozilla.org/security/announce/2009/mfsa2009-19.html - http://www.mozilla.org/security/announce/2009/mfsa2009-18.html - http://www.mozilla.org/security/announce/2009/mfsa2009-17.html - http://www.mozilla.org/security/announce/2009/mfsa2009-16.html - http://www.mozilla.org/security/announce/2009/mfsa2009-15.html - http://www.mozilla.org/security/announce/2009/mfsa2009-14.html - - - 2009-04-21 - 2009-04-22 - 2009-12-12 - - - - - poppler -- Poppler Multiple Vulnerabilities - - - poppler - 0.10.6 - - - - -

Secunia reports:

-
-

Some vulnerabilities have been reported in Poppler which can be - exploited by malicious people to potentially compromise an - application using the library.

-
- - - - http://secunia.com/advisories/34746/ - - - 2009-04-17 - 2009-04-18 - - - - - xpdf -- multiple vulnerabilities - - - xpdf - 3.02_11 - - - - -

Secunia reports:

-
-

Some vulnerabilities have been reported in Xpdf, which can be - exploited by malicious people to potentially compromise a user's - system.

-

A boundary error exists when decoding JBIG2 symbol dictionary - segments. This can be exploited to cause a heap-based buffer - overflow and potentially execute arbitrary code.

-

Multiple integer overflows in the JBIG2 decoder can be - exploited to potentially execute arbitrary code.

-

Multiple boundary errors in the JBIG2 decoder can be - exploited to cause buffer overflows and potentially execute - arbitrary code.

-

Multiple errors in the JBIG2 decoder can be exploited can be - exploited to free arbitrary memory and potentially execute arbitrary - code.

-

Multiple unspecified input validation errors in the JBIG2 decoder can - be exploited to potentially execute arbitrary code.

-
- - - - CVE-2009-0146 - CVE-2009-0147 - CVE-2009-0166 - CVE-2009-0799 - CVE-2009-0800 - CVE-2009-1179 - CVE-2009-1180 - CVE-2009-1181 - CVE-2009-1182 - CVE-2009-1183 - http://secunia.com/advisories/34291 - http://www.vupen.com/english/advisories/2009/1065 - - - 2009-04-16 - 2009-04-18 - 2009-04-18 - - - - - freetype2 -- multiple vulnerabilities - - - freetype2 - 2.3.9_1 - - - - -

Secunia reports:

-
-

Some vulnerabilities have been reported in FreeType, which can be - exploited by malicious people to potentially compromise an application - using the library.

-

An integer overflow error within the "cff_charset_compute_cids()" - function in cff/cffload.c can be exploited to potentially cause a - heap-based buffer overflow via a specially crafted font.

-

Multiple integer overflow errors within validation functions in - sfnt/ttcmap.c can be exploited to bypass length validations and - potentially cause buffer overflows via specially crafted fonts.

-

An integer overflow error within the "ft_smooth_render_generic()" - function in smooth/ftsmooth.c can be exploited to potentially cause a - heap-based buffer overflow via a specially crafted font.

-
- - - - CVE-2009-0946 - http://secunia.com/advisories/34723/ - - - 2009-04-16 - 2009-04-18 - - - - - ejabberd -- cross-site scripting vulnerability - - - ejabberd - 2.0.4 - - - - -

SecurityFocus reports:

-
-

The ejabberd application is prone to a cross-site scripting - vulnerability.

-

An attacker may leverage this issue to execute arbitrary script code - in the browser of an unsuspecting user in the context of the affected - site and to steal cookie-based authentication credentials.

-
- - - - 34133 - CVE-2009-0934 - - - 2009-03-16 - 2009-04-17 - - - - - ziproxy -- multiple vulnerability - - - ziproxy - 2.7.0 - - - - -

Ziproxy Developers reports:

-
-

Multiple HTTP proxy implementations are prone to an - information-disclosure vulnerability related to the interpretation of - the 'Host' HTTP header. Specifically, this issue occurs when the proxy - makes a forwarding decision based on the 'Host' HTTP header instead of - the destination IP address.

-

Attackers may exploit this issue to obtain sensitive information - such as internal intranet webpages. Additional attacks may also be - possible.

-
- - - - 33858 - CVE-2009-0804 - http://www.kb.cert.org/vuls/id/MAPG-7N9GN8 - - - 2009-02-23 - 2009-04-15 - - - - - phpmyadmin -- insufficient output sanitizing when generating configuration file - - - phpMyAdmin - 3.1.3.2 - - - - -

phpMyAdmin Team reports:

-
-

Setup script used to generate configuration can be fooled using a - crafted POST request to include arbitrary PHP code in generated - configuration file. Combined with ability to save files on server, - this can allow unauthenticated users to execute arbitrary PHP code. - This issue is on different parameters than PMASA-2009-3 and it was - missed out of our radar because it was not existing in 2.11.x - branch.

-
- - - - CVE-2009-1285 - http://www.phpmyadmin.net/home_page/security/PMASA-2009-4.php - - - 2009-04-14 - 2009-04-15 - 2010-05-02 - - - - - drupal6-cck -- cross-site scripting - - - drupal6-cck - 2.2 - - - - -

Drupal CCK plugin developer reports:

-
-

The Node reference and User reference sub-modules, which - are part of the Content Construction Kit (CCK) project, lets - administrators define node fields that are references to other - nodes or to users. When displaying a node edit form, the - titles of candidate referenced nodes or names of candidate - referenced users are not properly filtered, allowing malicious - users to inject arbitrary code on those pages. Such a cross - site scripting (XSS) attack may lead to a malicious user - gaining full administrative access.

-
- - - - 34172 - CVE-2009-1069 - http://drupal.org/node/406520 - - - 2009-03-23 - 2009-04-11 - 2010-05-02 - - - - - pivot-weblog -- file deletion vulnerability - - - pivot-weblog - 1.40.7 - - - - -

Secunia reports:

-
-

A vulnerability has been discovered in Pivot, which can be - exploited by malicious people to delete certain files.

-

Input passed to the "refkey" parameter in - extensions/bbclone_tools/count.php is not properly sanitised - before being used to delete files. This can be exploited to - delete files with the permissions of the web server via directory - traversal sequences passed within the "refkey" parameter.

-

NOTE: Users with the "Advanced" user level are able to include and - execute uploaded PHP code via the "pivot_path" parameter in - extensions/bbclone_tools/getkey.php when - extensions/bbclone_tools/hr_conf.php can be deleted.

-
- - - - 34160 - http://secunia.com/advisories/34302/ - - - 2009-03-18 - 2009-03-27 - - - - - phpmyadmin -- insufficient output sanitizing when generating configuration file - - - phpMyAdmin211 - 2.11.9.5 - - - phpMyAdmin - 3.1.3.1 - - - - -

phpMyAdmin reports:

-
-

Setup script used to generate configuration can be fooled - using a crafted POST request to include arbitrary PHP code - in generated configuration file.

-
- - - - CVE-2009-1151 - http://www.phpmyadmin.net/home_page/security/PMASA-2009-3.php - - - 2009-03-24 - 2009-03-25 - 2010-05-02 - - - - - amarok -- multiple vulnerabilities - - - amarok - 1.4.10_3 - - - - -

Secunia reports:

-
-

Tobias Klein has reported some vulnerabilities in Amarok, which - potentially can be exploited by malicious people to compromise a - user's system.

-

Two integer overflow errors exist within the - "Audible::Tag::readTag()" function in - src/metadata/audible/audibletag.cpp. These can be exploited to cause - heap-based buffer overflows via specially crafted Audible Audio - files.

-

Two errors within the "Audible::Tag::readTag()" function in - src/metadata/audible/audibletag.cpp can be exploited to corrupt - arbitrary memory via specially crafted Audible Audio files.

-
- - - - 33210 - CVE-2009-0135 - CVE-2009-0136 - http://www.debian.org/security/2009/dsa-1706 - http://secunia.com/advisories/33505 - - - 2009-01-12 - 2009-03-23 - - - - - wireshark -- multiple vulnerabilities - - - ethereal - ethereal-lite - tethereal - tethereal-lite - wireshark - wireshark-lite - 1.0.6 - - - - -

Vendor reports:

-
-

On non-Windows systems Wireshark could crash if the HOME - environment variable contained sprintf-style string formatting - characters. Wireshark could crash while reading a malformed - NetScreen snoop file. Wireshark could crash while reading a - Tektronix K12 text capture file.

-
- - - - CVE-2009-0599 - CVE-2009-0600 - CVE-2009-0601 - http://www.wireshark.org/security/wnpa-sec-2009-01.html - - - 2009-02-06 - 2009-03-22 - 2010-05-02 - - - - - netatalk -- arbitrary command execution in papd daemon - - - netatalk - 2.0.3_5,1 - - - - -

Secunia reports:

-
-

A vulnerability has been reported in Netatalk, which potentially - can be exploited by malicious users to compromise a vulnerable system.

-

The vulnerability is caused due to the papd daemon improperly - sanitising several received parameters before passing them in a call - to popen(). This can be exploited to execute arbitrary commands via - a specially crafted printing request.

-

Successful exploitation requires that a printer is configured to - pass arbitrary values as parameters to a piped command.

-
- - - - 32925 - CVE-2008-5718 - http://secunia.com/advisories/33227/ - http://www.openwall.com/lists/oss-security/2009/01/13/3 - - - 2008-12-19 - 2009-03-18 - 2009-03-18 - - - - - gstreamer-plugins-good -- multiple memory overflows - - - gstreamer-plugins-good - 0.10.9,30.10.12,3 - - - - -

Secunia reports:

-
-

Tobias Klein has reported some vulnerabilities in GStreamer Good - Plug-ins, which can potentially be exploited by malicious people to - compromise a vulnerable system.

-

A boundary error occurs within the "qtdemux_parse_samples()" - function in gst/gtdemux/qtdemux.c when performing QuickTime "ctts" - Atom parsing. This can be exploited to cause a heap-based buffer - overflow via a specially crafted QuickTime media file.

-

An array indexing error exists in the "qtdemux_parse_samples()" - function in gst/gtdemux/qtdemux.c when performing QuickTime "stss" - Atom parsing. This can be exploited to corrupt memory via a specially - crafted QuickTime media file.

-

A boundary error occurs within the "qtdemux_parse_samples()" - function in gst/gtdemux/qtdemux.c when performing QuickTime "stts" - Atom parsing. This can be exploited to cause a heap-based buffer - overflow via a specially crafted QuickTime media file.

-
- - - - CVE-2009-0386 - CVE-2009-0387 - CVE-2009-0397 - http://secunia.com/advisories/33650/ - http://trapkit.de/advisories/TKADV2009-003.txt - http://gstreamer.freedesktop.org/releases/gst-plugins-good/0.10.12.html - - - 2009-01-22 - 2009-03-16 - - - - - libsndfile -- CAF processing integer overflow vulnerability - - - libsndfile - 1.0.19 - - - - -

Secunia reports:

-
-

The vulnerability is caused due to an integer overflow error in the - processing of CAF description chunks. This can be exploited to cause a - heap-based buffer overflow by tricking the user into processing a - specially crafted CAF audio file.

-
- - - - CVE-2009-0186 - http://secunia.com/advisories/33980/ - - - 2009-03-03 - 2009-03-16 - - - - - ffmpeg -- 4xm processing memory corruption vulnerability - - - ffmpeg - 2008.07.27_9 - - - - -

Secunia reports:

-
-

Tobias Klein has reported a vulnerability in FFmpeg, which - potentially can be exploited by malicious people to compromise an - application using the library.

-

The vulnerability is caused due to a signedness error within the - "fourxm_read_header()" function in libavformat/4xm.c. This can be - exploited to corrupt arbitrary memory via a specially crafted 4xm - file.

-
- - - - 33502 - CVE-2009-0385 - http://secunia.com/advisories/33711/ - http://trapkit.de/advisories/TKADV2009-004.txt - - - 2009-01-28 - 2009-03-16 - - - - - roundcube -- webmail script insertion and php code injection - - - roundcube - 0.2.1,1 - - - - -

Secunia reports:

-
-

Some vulnerabilities have been reported in RoundCube Webmail, which - can be exploited by malicious users to compromise a vulnerable system - and by malicious people to conduct script insertion attacks and - compromise a vulnerable system.

-

The HTML "background" attribute within e.g. HTML emails is not - properly sanitised before being used. This can be exploited to execute - arbitrary HTML and script code in a user's browser session in context - of an affected site if a malicious email is viewed.

-

Input passed via a vCard is not properly sanitised before being - used in a call to "preg_replace()" with the "e" modifier in - program/include/rcube_vcard.php. This can be exploited to inject and - execute arbitrary PHP code by e.g. tricking a user into importing a - malicious vCard file.

-
- - - - CVE-2009-0413 - http://secunia.com/advisories/33622/ - http://sourceforge.net/forum/forum.php?forum_id=927958 - http://trac.roundcube.net/changeset/2245 - http://trac.roundcube.net/ticket/1485689 - - - 2009-01-21 - 2009-03-16 - 2009-03-26 - - - - - proftpd -- multiple sql injection vulnerabilities - - - proftpd - proftpd-mysql - 1.3.2 - - - proftpd-devel - 1.3.20080922 - - - - -

Secunia reports:

-
-

Some vulnerabilities have been reported in ProFTPD, which can be - exploited by malicious people to conduct SQL injection attacks.

-

The application improperly sets the character encoding prior to - performing SQL queries. This can be exploited to manipulate SQL - queries by injecting arbitrary SQL code in an environment using a - multi-byte character encoding.

-

An error exists in the "mod_sql" module when processing e.g. user - names containing '%' characters. This can be exploited to bypass input - sanitation routines and manipulate SQL queries by injecting arbitrary - SQL code.

-
- - - - CVE-2009-0542 - CVE-2009-0543 - http://secunia.com/advisories/33842/ - http://bugs.proftpd.org/show_bug.cgi?id=3173 - http://bugs.proftpd.org/show_bug.cgi?id=3124 - http://milw0rm.com/exploits/8037 - - - 2009-02-06 - 2009-03-16 - - - - - zabbix -- php frontend multiple vulnerabilities - - - zabbix - 1.6.2_1,1 - - - zabbix-agent - 1.6.2_1,2 - - - - -

Secunia reports:

-
-

Some vulnerabilities have been reported in the ZABBIX PHP frontend, - which can be exploited by malicious people to conduct cross-site - request forgery attacks and malicious users to disclose sensitive - information and compromise a vulnerable system.

-

Input appended to and passed via the "extlang" parameter to the - "calc_exp2()" function in include/validate.inc.php is not properly - sanitised before being used. This can be exploited to inject and - execute arbitrary PHP code.

-

The application allows users to perform certain actions via HTTP - requests without performing any validity checks to verify the - requests. This can be exploited to e.g. create users by enticing a - logged in administrator to visit a malicious web page.

-

Input passed to the "srclang" parameter in locales.php (when "next" - is set to a non-NULL value) is not properly verified before being used - to include files. This can be exploited to include arbitrary files - from local resources via directory traversal attacks and URL-encoded - NULL bytes.

-
- - - - http://secunia.com/advisories/34091/ - http://www.ush.it/team/ush/hack-zabbix_162/adv.txt - - - 2009-03-04 - 2009-03-16 - 2009-03-23 - - - - - php-mbstring -- php mbstring buffer overflow vulnerability - - - php4-mbstring - 4.4.9 - - - php5-mbstring - 5.2.9 - - - - -

SecurityFocus reports:

-
-

PHP is prone to a buffer-overflow vulnerability because it fails to - perform boundary checks before copying user-supplied data to - insufficiently sized memory buffers. The issue affects the 'mbstring' - extension included in the standard distribution.

-

An attacker can exploit this issue to execute arbitrary machine - code in the context of the affected webserver. Failed exploit attempts - will likely crash the webserver, denying service to legitimate - users.

-
- - - - 32948 - CVE-2008-5557 - - - 2008-12-21 - 2009-03-16 - - - - - phppgadmin -- directory traversal with register_globals enabled - - - phppgadmin - 4.2.2 - - - - -

Secunia reports:

-
-

Dun has discovered a vulnerability in phpPgAdmin, which can be - exploited by malicious people to disclose sensitive information.

-

Input passed via the "_language" parameter to libraries/lib.inc.php - is not properly sanitised before being used to include files. This can - be exploited to include arbitrary files from local resources via - directory traversal attacks and URL-encoded NULL bytes.

-
- - - - 32670 - CVE-2008-5587 - http://secunia.com/advisories/33014 - - - 2008-12-08 - 2009-03-16 - - - - - opera -- multiple vulnerabilities - - - opera - linux-opera - 9.64 - - - - -

Opera Team reports:

-
-

An unspecified error in the processing of JPEG images can be - exploited to trigger a memory corruption.

-

An error can be exploited to execute arbitrary script code in a - different domain via unspecified plugins.

-

An unspecified error has a "moderately severe" impact. No further - information is available.

-
- - - - CVE-2009-0914 - CVE-2009-0915 - http://www.opera.com/docs/changelogs/freebsd/964/ - http://secunia.com/advisories/34135/ - - - 2009-03-15 - 2009-03-15 - 2010-05-02 - - - - - epiphany -- untrusted search path vulnerability - - - epiphany - 2.24.2.1 - - - - -

CVE Mitre reports:

-
-

Untrusted search path vulnerability in the Python interface in - Epiphany 2.22.3, and possibly other versions, allows local users to - execute arbitrary code via a Trojan horse Python file in the current - working directory, related to a vulnerability in the PySys_SetArgv - function (CVE-2008-5983).

-
- - - - CVE-2008-5985 - CVE-2008-5983 - - - 2009-01-26 - 2009-03-11 - - - - - apache -- Cross-site scripting vulnerability - - - apache - 2.2.02.2.9_2 - 2.0.02.0.63_2 - - - - -

CVE Mitre reports:

-
-

Cross-site scripting (XSS) vulnerability in proxy_ftp.c in the - mod_proxy_ftp module in Apache 2.0.63 and earlier, and mod_proxy_ftp.c - in the mod_proxy_ftp module in Apache 2.2.9 and earlier 2.2 versions, - allows remote attackers to inject arbitrary web script or HTML via a - wildcard in the last directory component in the pathname in an FTP - URI.

-
- - - - CVE-2008-2939 - http://www.rapid7.com/advisories/R7-0033.jsp - - - 2008-07-25 - 2009-03-11 - - - - - pngcrush -- libpng Uninitialised Pointer Arrays Vulnerability - - - pngcrush - 1.6.14 - - - - -

Secunia reports:

-
-

A vulnerability has been reported in Pngcrush, which - can be exploited by malicious people to potentially - compromise a user's system.

-

The vulnerability is caused due to the use of vulnerable - libpng code.

-
- - - - 33827 - CVE-2009-0040 - http://secunia.com/advisories/33976 - http://xforce.iss.net/xforce/xfdb/48819 - - - 2009-02-19 - 2009-03-04 - - - - - curl -- cURL/libcURL Location: Redirect URLs Security Bypass - - - curl - 5.117.19.4 - - - - -

Secunia reports:

-
-

The security issue is caused due to cURL following HTTP Location: - redirects to e.g. scp:// or file:// URLs which can be exploited - by a malicious HTTP server to overwrite or disclose the content of - arbitrary local files and potentially execute arbitrary commands via - specially crafted redirect URLs.

-
- - - - CVE-2009-0037 - http://secunia.com/advisories/34138/ - - - 2009-03-03 - 2009-03-04 - - - - - Zend Framework -- Local File Inclusion vulnerability in Zend_View::render() - - - ZendFramework - 1.7.5 - - - - -

Matthew Weier O'Phinney reports:

-
-

A potential Local File Inclusion (LFI) vulnerability exists in - the Zend_View::render() method. If user input is used to - specify the script path, then it is possible to trigger the - LFI.

-

Note that Zend Framework applications that never call the - Zend_View::render() method with a user-supplied parameter are - not affected by this vulnerability.

-
- - - - http://framework.zend.com/issues/browse/ZF-5748 - - - 2009-02-11 - 2009-02-18 - - - - - dia -- remote command execution vulnerability - - - dia - 0.96.1_6,1 - - - - -

Security Focus reports:

-
-

An attacker could exploit this issue by enticing an - unsuspecting victim to execute the vulnerable - application in a directory containing a malicious - Python file. A successful exploit will allow arbitrary - Python commands to run within the privileges of the currently - logged-in user.

-
- - - - 33448 - CVE-2008-5984 - http://secunia.com/advisories/33672 - - - 2009-01-26 - 2009-02-17 - - - - - pycrypto -- ARC2 module buffer overflow - - - py-pycrypto - 2.0.1_2 - - - - -

Dwayne C. Litzenberger reports:

-
-

pycrypto is exposed to a buffer overflow issue because it fails to - adequately verify user-supplied input. This issue resides in the ARC2 - module. This issue can be triggered with specially crafted ARC2 keys - in excess of 128 bytes.

-
- - - - http://lists.dlitz.net/pipermail/pycrypto/2009q1/000062.html - - - 2009-02-06 - 2009-02-15 - - - - - varnish -- Varnish HTTP Request Parsing Denial of Service - - - varnish - 2.0.1 - - - - -

SecurityFocus reports:

-
-

Varnish is prone to a remote denial-of-service - vulnerability because the application fails to handle - certain HTTP requests.

-

Successfully exploiting this issue allows remote - attackers to crash the affected application denying further - service to legitimate users.

-
- - - - 33712 - http://secunia.com/advisories/33852/ - http://varnish.projects.linpro.no/wiki/WikiStart - - - 2008-10-17 - 2009-02-14 - 2009-02-15 - - - - - tor -- multiple vulnerabilities - - - tor - 0.2.0.34 - - - tor-devel - 0.2.12-alpha - - - - -

Secunia reports:

-
-

Some vulnerabilities have been reported in Tor, where one has an - unknown impact and others can be exploited by malicious people to - cause a DoS.

-

An error when running Tor as a directory authority can be exploited - to trigger the execution of an infinite loop.

-

An unspecified error exists when running on Windows systems prior - to Windows XP. No further information is currently available.

-
- - - - CVE-2009-0936 - CVE-2009-0937 - CVE-2009-0938 - http://secunia.com/advisories/33880/ - http://archives.seul.org/or/announce/Feb-2009/msg00000.html - - - 2009-02-10 - 2009-02-13 - 2009-03-20 - - - - - firefox -- multiple vulnerabilities - - - firefox - 2.0.0.20_3,1 - 3.*,13.0.6,1 - - - linux-firefox - linux-firefox-devel - 3.0.6 - - - linux-seamonkey-devel - 0 - - - seamonkey - linux-seamonkey - 1.1.15 - - - thunderbird - linux-thunderbird - 2.0.0.21 - - - - -

Mozilla Foundation reports:

-
-

MFSA 2009-06: Directives to not cache pages ignored

-

MFSA 2009-05: XMLHttpRequest allows reading HTTPOnly cookies

-

MFSA 2009-04: Chrome privilege escalation via local .desktop - files

-

MFSA 2009-03: Local file stealing with SessionStore

-

MFSA 2009-02: XSS using a chrome XBL method and window.eval

-

MFSA 2009-01: Crashes with evidence of memory corruption (rv:1.9.0.6)

-
- - - - CVE-2009-0352 - CVE-2009-0353 - CVE-2009-0354 - CVE-2009-0355 - CVE-2009-0356 - CVE-2009-0357 - CVE-2009-0358 - http://www.mozilla.org/security/announce/2009/mfsa2009-01.html - http://www.mozilla.org/security/announce/2009/mfsa2009-02.html - http://www.mozilla.org/security/announce/2009/mfsa2009-03.html - http://www.mozilla.org/security/announce/2009/mfsa2009-04.html - http://www.mozilla.org/security/announce/2009/mfsa2009-05.html - http://www.mozilla.org/security/announce/2009/mfsa2009-06.html - http://secunia.com/advisories/33799/ - - - 2009-02-04 - 2009-02-11 - 2009-12-12 - - - - - codeigniter -- arbitrary script execution in the new Form Validation class - - - codeigniter - 1.7.01.7.1 - - - - -

znirkel reports:

-
-

The eval() function in _reset_post_array crashes when posting - certain data. By passing in carefully-crafted input data, the eval() - function could also execute malicious PHP code.

-

Note that CodeIgniter applications that either do not use the - new Form Validation class or use the old Validation class are not - affected by this vulnerability.

-
- - - - http://codeigniter.com/bug_tracker/bug/6068/ - - - 2008-11-28 - 2009-02-11 - - - - - pyblosxom -- atom flavor multiple XML injection vulnerabilities - - - pyblosxom - 1.5.r3 - - - - -

Security Focus reports:

-
-

PyBlosxom is prone to multiple XML-injection - vulnerabilities because the application fails to - properly sanitize user-supplied input before using it - in dynamically generated content.

-

Attacker-supplied XML and script code would run in the - context of the affected browser, potentially allowing - the attacker to steal cookie-based authentication credentials - or to control how the site is rendered to the user. Other attacks - are also possible.

-
- - - - 33676 - - - 2009-02-09 - 2009-02-11 - - - - - typo3 -- cross-site scripting and information disclosure - - - typo3 - 4.2.6 - - - - -

Secunia reports:

-
-

Some vulnerabilities have been reported in Typo3, which can be - exploited by malicious people to conduct cross-site scripting attacks - and disclose sensitive information.

-

Input passed via unspecified fields to the backend user interface - is not properly sanitised before being returned to the user. This can - be exploited to execute arbitrary HTML and script code in a user's - browser session in context of an affected site.

-

An error in the "jumpUrl" mechanism can be exploited to read - arbitrary files from local resources by disclosing a hash secret used - to restrict file access.

-
- - - - CVE-2009-0815 - CVE-2009-0816 - http://secunia.com/advisories/33829/ - http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-002/ - - - 2009-02-10 - 2009-02-11 - 2010-05-02 - - - - - amaya -- multiple buffer overflow vulnerabilities - - - amaya - 0 - - - - -

Secunia reports:

-
-

A boundary error when processing "div" HTML tags can be exploited - to cause a stack-based buffer overflow via an overly long "id" - parameter.

-

A boundary error exists when processing overly long links. This can - be exploited to cause a stack-based buffer overflow by tricking the - user into e.g. editing a malicious link.

-

A boundary error when processing e.g. a "bdo" HTML tag having an - overly long "dir" attribute can be exploited to cause a stack-based - buffer overflow.

-

A boundary error when processing "input" HTML tags can be - exploited to cause a stack-based buffer overflow via an overly long - e.g. "type" attribute.

-
- - - - CVE-2008-5282 - CVE-2009-0323 - http://secunia.com/advisories/32848/ - http://www.bmgsec.com.au/advisory/41/ - http://www.bmgsec.com.au/advisory/40/ - http://milw0rm.com/exploits/7467 - http://www.coresecurity.com/content/amaya-buffer-overflows - - - 2008-11-25 - 2009-02-09 - - - - - websvn -- multiple vulnerabilities - - - websvn - 2.1.0 - - - - -

Secunia reports:

-
-

Some vulnerabilities have been reported in WebSVN, which can be - exploited by malicious users to disclose sensitive information, and by - malicious people to conduct cross-site scripting attacks and - manipulate data.

-

Input passed in the URL to index.php is not properly sanitised - before being returned to the user. This can be exploited to execute - arbitrary HTML and script code in a user's browser session in context - of an affected site.

-

Input passed to the "rev" parameter in rss.php is not properly - sanitised before being used. This can be exploited to overwrite - arbitrary files via directory traversal attacks.

-

Access to restricted repositories is not properly enforced, which - can be exploited to disclose potentially sensitive information by - accessing the repository via "listing.php" and using the "compare with - previous" and "show changed files" links.

-
- - - - CVE-2008-5918 - CVE-2008-5919 - CVE-2009-0240 - http://secunia.com/advisories/32338/ - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=512191 - http://www.gulftech.org/?node=research&article_id=00132-10202008 - - - 2008-10-23 - 2009-02-09 - - - - - phplist -- local file inclusion vulnerability - - - phplist - 2.10.9 - - - - -

Secunia reports:

-
-

Input passed to the "_SERVER[ConfigFile]" parameter in - admin/index.php is not properly verified before being used to include - files. This can be exploited to include arbitrary files from local - resources.

-
- - - - CVE-2009-0422 - http://secunia.com/advisories/33533/ - - - 2009-01-15 - 2009-02-09 - - - - - squid -- remote denial of service vulnerability - - - squid - 2.7.12.7.6 - 3.0.13.0.13 - - - - -

Squid security advisory 2009:1 reports:

-
-

Due to an internal error Squid is vulnerable to a denial - of service attack when processing specially crafted requests.

-

This problem allows any client to perform a denial of service - attack on the Squid service.

-
- - - - CVE-2009-0478 - http://www.squid-cache.org/Advisories/SQUID-2009_1.txt - http://secunia.com/advisories/33731/ - - - 2009-02-04 - 2009-02-09 - 2009-02-10 - - - - - typo3 -- multiple vulnerabilities - - - typo3 - 4.2.4 - - - - -

Secunia reports:

-
-

Some vulnerabilities have been reported in Typo3, which can be - exploited by malicious people to bypass certain security restrictions, - conduct cross-site scripting and session fixation attacks, and - compromise a vulnerable system.

-

The "Install tool" system extension uses insufficiently random - entropy sources to generate an encryption key, resulting in weak - security.

-

The authentication library does not properly invalidate supplied - session tokens, which can be exploited to hijack a user's - session.

-

Certain unspecified input passed to the "Indexed Search Engine" - system extension is not properly sanitised before being used to invoke - commands. This can be exploited to inject and execute arbitrary shell - commands.

-

Input passed via the name and content of files to the "Indexed Search - Engine" system extension is not properly sanitised before being returned - to the user. This can be exploited to execute arbitrary HTML and script - code in a user's browser session in context of an affected site.

-

Certain unspecified input passed to the Workspace module is not - properly sanitised before being returned to the user. This can be - exploited to execute arbitrary HTML and script code in a user's - browser session in context of an affected site.

-

Note: It is also reported that certain unspecified input passed to - test scripts of the "ADOdb" system extension is not properly sanitised - before being returned to the user. This can be exploited to execute - arbitrary HTML and script code in a user's browser session in context - of an affected website.

-
- - - - CVE-2009-0255 - CVE-2009-0256 - CVE-2009-0257 - CVE-2009-0258 - http://secunia.com/advisories/33617/ - http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-001/ - - - 2009-02-07 - 2009-02-09 - 2013-06-19 - - - - - sudo -- certain authorized users could run commands as any user - - - sudo - 1.6.91.6.9.20 - - - - -

Todd Miller reports:

-
-

A bug was introduced in Sudo's group matching code in version - 1.6.9 when support for matching based on the supplemental group - vector was added. This bug may allow certain users listed in - the sudoers file to run a command as a different user than their - access rule specifies.

-
- - - - 33517 - CVE-2009-0034 - http://www.gratisoft.us/pipermail/sudo-announce/2009-February/000085.html - - - 2009-02-04 - 2009-02-06 - - - - - drupal -- multiple vulnerabilities - - - drupal5 - 5.15 - - - drupal6 - 6.9 - - - - -

Drupal Team reports:

-
-

The Content Translation module for Drupal 6.x enables users to make - a translation of an existing item of content (a node). In that proces - the existing node's content is copied into the new node's submission - form.

-

The module contains a flaw that allows a user with the 'translate - content' permission to potentially bypass normal viewing access - restrictions, for example allowing the user to see the content of - unpublished nodes even if they do not have permission to view - unpublished nodes.

-

When user profile pictures are enabled, the default user profile - validation function will be bypassed, possibly allowing invalid user - names or e-mail addresses to be submitted.

-
- - - - http://drupal.org/node/358957 - http://secunia.com/advisories/33550/ - http://secunia.com/advisories/33500/ - http://secunia.com/advisories/33542/ - - - 2009-01-14 - 2009-02-04 - - - - - perl -- Directory Permissions Race Condition - - - perl - 5.8.05.8.9 - - - - -

Secunia reports:

-
-

Paul Szabo has reported a vulnerability in Perl File::Path::rmtree, - which potentially can be exploited by malicious, local users to - gain escalated privileges.

-

The vulnerability is caused due to a race condition in the way - File::Path::rmtree handles directory permissions when cleaning up - directories. This can be exploited by replacing an existing sub - directory in the directory tree with a symbolic link to an arbitrary - file.

-

Successful exploitation may allow changing permissions of arbitrary - files, if root uses an application using the vulnerable code to delete - files in a directory having a world-writable sub directory.

-
- - - - CVE-2005-0448 - http://www.ubuntulinux.org/usn/usn-94-1 - http://secunia.com/advisories/14531/ - - - 2005-03-09 - 2009-02-03 - - - - - moinmoin -- multiple cross site scripting vulnerabilities - - - moinmoin - 1.8.1 - - - - -

Secunia reports:

-
-

Input passed to multiple parameters in action/AttachFile.py is not - properly sanitised before being returned to the user. This can be - exploited to execute arbitrary HTML and script code in a user's - browser session in the context of an affected site.

-

Certain input passed to security/antispam.py is not properly - sanitised before being returned to the user. This can be exploited to - execute arbitrary HTML and script code in a user's browser session in - the context of an affected site.

-
- - - - CVE-2009-0260 - CVE-2009-0312 - http://secunia.com/advisories/33593/ - http://hg.moinmo.in/moin/1.8/file/c76d50dac855 - http://hg.moinmo.in/moin/1.8/rev/89b91bf87dad - http://moinmo.in/SecurityFixes#moin1.8.1 - - - 2009-01-21 - 2009-01-30 - - - - - ganglia -- buffer overflow vulnerability - - - ganglia-monitor-core - ganglia-monitor-webfrontend - 3.1.1 - - - - -

Secunia reports:

-
-

Spike Spiegel has discovered a vulnerability in Ganglia which - can be exploited by malicious people to compromise a - vulnerable system. The vulnerability is caused due to a - boundary error within the process_path function in - gmetad/server.c. This can be exploited to cause a stack-based - buffer overflow by e.g. sending a specially crafted message to - the gmetad service.

-

The vulnerability is confirmed in version 3.1.1. Other - versions may also be affected.

-
- - - - CVE-2009-0241 - http://secunia.com/advisories/33506 - - - 2009-01-26 - 2009-01-30 - 2009-01-30 - - - - - tor -- unspecified memory corruption vulnerability - - - tor - 0.2.0.33 - - - tor-devel - 0.2.1.11-alpha - - - - -

Secunia reports:

-
-

A vulnerability with an unknown impact has been reported in Tor.

-

The vulnerability is caused due to an unspecified error and can be - exploited to trigger a heap corruption. No further information is - currently available.

-
- - - - CVE-2009-0414 - http://secunia.com/advisories/33635/ - http://archives.seul.org/or/announce/Jan-2009/msg00000.html - - - 2009-01-22 - 2009-01-29 - 2010-05-02 - - - - - glpi -- SQL Injection - - - glpi - 0.71.4 - - - - -

The GLPI project reports:

-
-

Input passed via unspecified parameters is not properly sanitised - before being used in SQL queries. This can be exploited to - manipulateSQL queries by injecting arbitrary SQL code.

-
- - - - http://www.glpi-project.org/spip.php?page=annonce&id_breve=161&lang=en - https://mail.gna.org/public/glpi-news/2009-01/msg00002.html - https://dev.indepnet.net/glpi/ticket/1224 - http://secunia.com/advisories/33680/ - - - 2009-01-25 - 2009-01-28 - - - - - openfire -- multiple vulnerabilities - - - openfire - 3.6.3 - - - - -

Core Security Technologies reports:

-
-

Multiple cross-site scripting vulnerabilities have been found - which may lead to arbitrary remote code execution on the server - running the application due to unauthorized upload of Java plugin - code.

-
- - - - 32935 - 32937 - 32938 - 32939 - 32940 - 32943 - 32944 - 32945 - CVE-2009-0496 - CVE-2009-0497 - http://www.coresecurity.com/content/openfire-multiple-vulnerabilities - - - 2009-01-08 - 2009-01-25 - 2010-05-02 - - - - - ipset-tools -- Denial of Service Vulnerabilities - - - ipsec-tools - 0.7.1 - - - - -

SecurityFocus reports:

-
-

IPsec-Tools is affected by multiple remote denial-of-service - vulnerabilities because the software fails to properly handle - certain network packets.

-

A successful attack allows a remote attacker to crash the - software, denying further service to legitimate users.

-
- - - - 30657 - CVE-2008-3651 - CVE-2008-3652 - http://marc.info/?l=ipsec-tools-devel&m=121688914101709&w=2 - - - 2008-07-28 - 2009-01-21 - - - - - Teamspeak Server -- Directory Traversal Vulnerability - - - teamspeak_server - 2.0.23.17 - - - - -

SecurityFocus reports:

-
-

TeamSpeak is prone to a directory-traversal vulnerability because - it fails to sufficiently sanitize user-supplied input data. - Exploiting the issue may allow an attacker to obtain sensitive - information that could aid in further attacks.

-
- - - - 33256 - http://www.securityfocus.com/bid/33256 - - - 2009-01-14 - 2009-01-20 - - - - - optipng -- arbitrary code execution via crafted BMP image - - - optipng - 0.6.2 - - - - -

Secunia reports:

-
-

A vulnerability has been reported in OptiPNG, which - potentially can be exploited by malicious people to compromise - a user's system.

-

The vulnerability is caused due to a boundary error in - the BMP reader and can be exploited to cause a buffer - overflow by tricking a user into processing a specially - crafted file.

-

Successful exploitation may allow execution of arbitrary - code.

-
- - - - CVE-2008-5101 - http://secunia.com/advisories/32651 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=505399 - http://optipng.sourceforge.net/ - - - 2008-11-11 - 2009-01-19 - - - - - git -- gitweb privilege escalation - - - git - 1.6.0.6 - - - - -

Git maintainers report:

-
-

gitweb has a possible local privilege escalation - bug that allows a malicious repository owner to run a command - of his choice by specifying diff.external configuration - variable in his repository and running a crafted gitweb - query.

-
- - - - 32967 - http://marc.info/?l=git&m=122975564100860&w=2 - http://www.kernel.org/pub/software/scm/git/docs/RelNotes-1.6.0.6.txt - - - 2008-12-20 - 2009-01-19 - - - - - gtar -- GNU TAR safer_name_suffix Remote Denial of Service Vulnerability - - - gtar - 1.19 - - - - -

SecurityFocus reports:

-
-

GNUs tar and cpio utilities are prone to a denial-of-service - vulnerability because of insecure use of the alloca() - function.

-

Successfully exploiting this issue allows attackers - to crash the affected utilities and possibly to execute - code but this has not been confirmed.

-
- - - - 26445 - CVE-2007-4476 - http://www.securityfocus.com/bid/26445/ - - - 2007-11-14 - 2009-01-15 - - - - - mplayer -- vulnerability in STR files processor - - - mplayer - mplayer-esound - mplayer-gtk - mplayer-gtk-esound - mplayer-gtk2 - mplayer-gtk2-esound - 0.99.11_10 - - - - -

Secunia reports:

-
-

The vulnerability is caused due to a boundary error within the - "str_read_packet()" function in libavformat/psxstr.c. This can be - exploited to cause a heap-based buffer overflow via a specially - crafted STR file.

-
- - - - CVE-2008-3162 - 30157 - http://secunia.com/advisories/30994 - https://roundup.mplayerhq.hu/roundup/ffmpeg/issue311 - - - 2008-07-09 - 2009-01-15 - - - - - cgiwrap -- XSS Vulnerability - - - cgiwrap - 4.0_2 - - - - -

Secunia reports:

-
-

A vulnerability has been reported in CGIWrap, which can be - exploited by malicious people to conduct cross-site scripting - attacks.

-

The vulnerability is caused due to the application generating - error messages without specifying a charset. This can be exploited - to execute arbitrary HTML and script code in a user's browser - session in context of an affected site.

-

Successful exploitation may require that the victim uses Internet - Explorer or a browser based on Internet Explorer components.

-
- - - - CVE-2008-2852 - http://secunia.com/advisories/30765 - http://cgiwrap.sourceforge.net/changes.html - - - 2008-06-19 - 2009-01-13 - - - - - nagios -- web interface privilege escalation vulnerability - - - nagios - 3.0.5 - - - nagios2 - 2.12_2 - - - - -

securityfocus reports:

-
-

An attacker with low-level privileges may exploit this issue to - bypass authorization and cause arbitrary commands to run within the - context of the Nagios server. This may aid in further attacks.

-
- - - - CVE-2008-5027 - 32156 - http://secunia.com/advisories/33320 - http://www.ubuntu.com/usn/USN-698-1 - http://www.nagios.org/development/history/nagios-3x.php - - - 2008-11-06 - 2009-01-12 - 2009-01-15 - - - - - pdfjam -- insecure temporary files - - - pdfjam - 1.20_4 - - - - -

Secunia reports:

-
-

Some security issues have been reported in PDFjam, which can be - exploited by malicious, local users to perform certain actions with - escalated privileges.

-

The security issues are caused due to the "pdf90", "pdfjoin", and - "pdfnup" scripts using temporary files in an insecure manner. This can - be exploited to overwrite arbitrary files via symlink attacks.

-
- - - - CVE-2008-5743 - https://bugzilla.novell.com/show_bug.cgi?id=459031 - http://secunia.com/advisories/33278 - - - 2008-12-05 - 2009-01-11 - - - - - verlihub -- insecure temporary file usage and arbitrary command execution - - - verlihub - 0.9.8.d.r2_2,1 - - - - -

securityfocus reports:

-
-

An attacker with local access could potentially exploit this issue - to perform symbolic-link attacks, overwriting arbitrary files in the - context of the affected application.

-

Successfully mounting a symlink attack may allow the attacker to - delete or corrupt sensitive files, which may result in a denial of - service. Other attacks may also be possible.

-
-
-

Verlihub is prone to a remote command-execution vulnerability - because it fails to sufficiently validate user input.

-

Successfully exploiting this issue would allow an attacker to - execute arbitrary commands on an affected computer in the context of - the affected application.

-
- - - - CVE-2008-5705 - CVE-2008-5706 - 32889 - 32420 - http://milw0rm.com/exploits/7183 - - - 2008-11-22 - 2009-01-11 - - - - - mysql -- empty bit-string literal denial of service - - - mysql-server - 5.05.0.66 - 5.15.1.26 - 6.06.0.6 - - - - -

MySQL reports:

-
-

The vulnerability is caused due to an error when processing an - empty bit-string literal and can be exploited to crash the server via - a specially crafted SQL statement.

-
- - - - CVE-2008-3963 - http://bugs.mysql.com/bug.php?id=35658 - http://dev.mysql.com/doc/refman/5.0/en/releasenotes-es-5-0-66.html - http://dev.mysql.com/doc/refman/5.1/en/news-5-1-26.html - http://dev.mysql.com/doc/refman/6.0/en/news-6-0-6.html - http://secunia.com/advisories/31769 - - - 2008-09-11 - 2009-01-11 - - - - - mysql -- privilege escalation and overwrite of the system table information - - - mysql-server - 4.14.1.24 - 5.05.0.51 - 5.15.1.23 - 6.06.0.4 - - - - -

MySQL reports:

-
-

Using RENAME TABLE against a table with explicit DATA - DIRECTORY and INDEX DIRECTORY options can be used to overwrite - system table information by replacing the symbolic link - points. the file to which the symlink points.

-
- - - - CVE-2007-5969 - 26765 - http://bugs.mysql.com/bug.php?id=32111 - - - 2007-11-14 - 2009-01-11 - - - - - mysql -- remote dos via malformed password packet - - - mysql-server - 4.14.1.24 - 5.05.0.44 - 5.15.1.20 - - - - -

MySQL reports:

-
-

A malformed password packet in the connection protocol - could cause the server to crash.

-
- - - - CVE-2007-3780 - 25017 - http://bugs.mysql.com/bug.php?id=28984 - - - 2007-07-15 - 2009-01-11 - - - - - mysql -- renaming of arbitrary tables by authenticated users - - - mysql-server - 4.14.1.23 - 5.05.0.42 - 5.15.1.18 - - - - -

MySQL reports:

-
-

The requirement of the DROP privilege for RENAME TABLE was not - enforced.

-
- - - - CVE-2007-2691 - 24016 - http://bugs.mysql.com/bug.php?id=27515 - - - 2007-05-14 - 2009-01-11 - - - - - imap-uw -- imap c-client buffer overflow - - - imap-uw - 2007e - - - - -

SANS reports:

-
-

The University of Washington IMAP library is a library implementing - the IMAP mail protocol. University of Washington IMAP is exposed to a - buffer overflow issue that occurs due to a boundary error within the - rfc822_output_char function in the c-client library. The University of - Washington IMAP library versions prior to 2007e are affected.

-
- - - - CVE-2008-5514 - http://www.washington.edu/imap/documentation/RELNOTES.html - - - 2008-12-16 - 2009-01-11 - 2010-05-02 - - - - - imap-uw -- local buffer overflow vulnerabilities - - - imap-uw - 2007d - - - - -

SANS reports:

-
-

University of Washington "tmail" and "dmail" are mail deliver - agents. "tmail" and "dmail" are exposed to local buffer overflow - issues because they fail to perform adequate boundary checks on - user-supplied data.

-
- - - - CVE-2008-5514 - http://www.washington.edu/imap/documentation/RELNOTES.html - http://www.sans.org/newsletters/risk/display.php?v=7&i=45#08.45.22 - - - 2008-10-29 - 2009-01-11 - 2010-05-02 - - - - - libcdaudio -- remote buffer overflow and code execution - - - libcdaudio - 0.99.12p2_2 - - - - -

securityfocus reports:

-
-

The 'libcdaudio' library is prone to a remote heap code in the - context of an application that uses the library. Failed attacks will - cause denial-of-service conditions.

-
-
-

A buffer-overflow in Grip occurs when the software processes a - response to a CDDB query that has more than 16 matches.

-

To exploit this issue, an attacker must be able to influence the - response to a CDDB query, either by controlling a malicious CDDB - server or through some other means. Successful exploits will allow - arbitrary code to run.

-
- - - - CVE-2008-5030 - CVE-2005-0706 - 32122 - 12770 - - - 2008-11-05 - 2009-01-11 - - - - - FreeBSD -- netgraph / bluetooth privilege escalation - - - FreeBSD - 6.36.3_7 - 6.46.4_1 - 7.07.0_7 - - - - -

Problem Description:

-

Some function pointers for netgraph and bluetooth sockets are - not properly initialized.

-

Impact:

-

A local user can cause the FreeBSD kernel to execute - arbitrary code. This could be used by an attacker directly; - or it could be used to gain root privilege or to escape from - a jail.

-

Workaround:

-

No workaround is available, but systems without local - untrusted users are not vulnerable. Furthermore, systems are - not vulnerable if they have neither the ng_socket nor - ng_bluetooth kernel modules loaded or compiled into the - kernel.

-

Systems with the security.jail.socket_unixiproute_only - sysctl set to 1 (the default) are only vulnerable if they have - local untrusted users outside of jails.

-

If the command

-

# kldstat -v | grep ng_

-

produces no output, the system is not vulnerable.

- - - - SA-08:13.protosw - - - 2008-12-23 - 2009-01-05 - 2016-08-09 - - - - - FreeBSD -- Cross-site request forgery in ftpd(8) - - - FreeBSD - 6.36.3_7 - 6.46.4_1 - 7.07.0_7 - - - - -

Problem Description:

-

The ftpd(8) server splits long commands into several - requests. This may result in the server executing a command - which is hidden inside another very long command.

-

Impact:

-

This could, with a specifically crafted command, be used in a - cross-site request forgery attack.

-

FreeBSD systems running ftpd(8) server could act as a point - of privilege escalation in an attack against users using web - browser to access trusted FTP sites.

-

Workaround:

-

No workaround is available, but systems not running FTP - servers are not vulnerable. Systems not running the FreeBSD - ftp(8) server are not affected, but users of other ftp - daemons are advised to take care since several other ftp - daemons are known to have related bugs.

- - - - CVE-2008-4247 - SA-08:12.ftpd - - - 2008-12-23 - 2009-01-05 - 2016-08-09 - - - - - FreeBSD -- IPv6 Neighbor Discovery Protocol routing vulnerability - - - FreeBSD - 6.36.3_5 - 7.07.0_5 - - - - -

Problem Description

-

IPv6 routers may allow "on-link" IPv6 nodes to create and - update the router's neighbor cache and forwarding - information. A malicious IPv6 node sharing a common router - but on a different physical segment from another node may be - able to spoof Neighbor Discovery messages, allowing it to - update router information for the victim node.

-

Impact:

-

An attacker on a different physical network connected to the - same IPv6 router as another node could redirect IPv6 traffic - intended for that node. This could lead to denial of service - or improper access to private network traffic.

-

Workaround:

-

Firewall packet filters can be used to filter incoming - Neighbor Solicitation messages but may interfere with normal - IPv6 operation if not configured carefully.

-

Reverse path forwarding checks could be used to make - gateways, such as routers or firewalls, drop Neighbor - Solicitation messages from nodes with unexpected source - addresses on a particular interface.

-

IPv6 router administrators are encouraged to read RFC 3756 - for further discussion of Neighbor Discovery security - implications.

- - - - CVE-2008-2476 - SA-08:10.nd6 - - - 2008-10-01 - 2009-01-05 - 2016-08-09 - - - - - FreeBSD -- arc4random(9) predictable sequence vulnerability - - - FreeBSD - 6.36.3_6 - 7.07.0_6 - - - - -

Problem Description:

-

When the arc4random(9) random number generator is - initialized, there may be inadequate entropy to meet the - needs of kernel systems which rely on arc4random(9); and it - may take up to 5 minutes before arc4random(9) is reseeded - with secure entropy from the Yarrow random number generator.

-

Impact:

-

All security-related kernel subsystems that rely on a - quality random number generator are subject to a wide range of - possible attacks for the 300 seconds after boot or until 64k - of random data is consumed. The list includes:

-

* GEOM ELI providers with onetime keys. When a provider is - configured in a way so that it gets attached at the same time - during boot (e.g. it uses the rc subsystem to initialize) it - might be possible for an attacker to recover the encrypted - data.

-

* GEOM shsec providers. The GEOM shsec subsytem is used to - split a shared secret between two providers so that it can be - recovered when both of them are present. This is done by - writing the random sequence to one of providers while - appending the result of the random sequence on the other host - to the original data. If the provider was created within the - first 300 seconds after booting, it might be possible for an - attacker to extract the original data with access to only one - of the two providers between which the secret data is split.

-

* System processes started early after boot may receive - predictable IDs.

-

* The 802.11 network stack uses arc4random(9) to generate - initial vectors (IV) for WEP encryption when operating in - client mode and WEP authentication challenges when operating - in hostap mode, which may be insecure.

-

* The IPv4, IPv6 and TCP/UDP protocol implementations rely - on a quality random number generator to produce unpredictable - IP packet identifiers, initial TCP sequence numbers and - outgoing port numbers. During the first 300 seconds after - booting, it may be easier for an attacker to execute IP - session hijacking, OS fingerprinting, idle scanning, or in - some cases DNS cache poisoning and blind TCP data injection - attacks.

-

* The kernel RPC code uses arc4random(9) to retrieve - transaction identifiers, which might make RPC clients - vulnerable to hijacking attacks.

-

Workaround:

-

No workaround is available for affected systems.

- - - - CVE-2008-5162 - SA-08.11.arc4random - - - 2008-11-24 - 2009-01-05 - 2016-08-09 - - - - - xterm -- DECRQSS remote command execution vulnerability - - - xterm - 238 - - - - -

SecurityFocus reports:

-
-

The xterm program is prone to a remote command-execution - vulnerability because it fails to sufficiently validate user - input.

-

Successfully exploiting this issue would allow an attacker - to execute arbitrary commands on an affected computer in the - context of the affected application.

-
- - - - 33060 - CVE-2008-2383 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=510030 - - - 2008-12-28 - 2009-01-05 - 2009-01-06 - - - - - php5-gd -- uninitialized memory information disclosure vulnerability - - - php5-gd - 5.2.8 - - - - -

According to CVE-2008-5498 entry:

-
-

Array index error in the "imageRotate" function in PHP 5.2.8 and - earlier allows context-dependent attackers to read the contents - of arbitrary memory locations via a crafted value of the third - argument (aka the "bgd_color" or "clrBack" argument) for an indexed - image.

-
- - - - 33002 - CVE-2008-5498 - http://www.securiteam.com/unixfocus/6G00Y0ANFU.html - - - 2008-12-24 - 2009-01-05 - 2009-02-04 - - - - - awstats -- multiple XSS vulnerabilities - - - awstats - 6.9,1 - - - awstats-devel - 0 - - - - -

Secunia reports:

-
-

Morgan Todd has discovered a vulnerability in AWStats, - which can be exploited by malicious people to conduct - cross-site scripting attacks.

-

Input passed in the URL to awstats.pl is not properly - sanitised before being returned to the user. This can be - exploited to execute arbitrary HTML and script code in a - user's browser session in context of an affected site.

-

Successful exploitation requires that the application is - running as a CGI script.

-
- - - - CVE-2008-3714 - CVE-2008-5080 - http://secunia.com/advisories/31519 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=495432 - - - 2008-03-12 - 2009-01-04 - - - - - p5-File-Path -- rmtree allows creation of setuid files - - - p5-File-Path - 2.07_1 - - - - -

Jan Lieskovsky reports:

-
-

perl-File-Path rmtree race condition (CVE-2005-0448 was assigned to - address this)

-

This vulnerability was fixed in 5.8.4-7 but re-introduced - in 5.8.8-1. It's also present in File::Path 2.xx, up to and - including 2.07 which has only a partial fix.

-
- - - - CVE-2005-0448 - http://www.openwall.com/lists/oss-security/2008/11/28/1 - http://www.gossamer-threads.com/lists/perl/porters/233699#233699 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=286905 - - - 2008-11-28 - 2009-01-03 - - - - - vim -- multiple vulnerabilities in the netrw module - - - vim - vim-console - vim-lite - vim-gtk2 - vim-gnome - 7.07.2 - - - - -

Jan Minar reports:

-
-

Applying the ``D'' to a file with a crafted file name, - or inside a directory with a crafted directory name, can - lead to arbitrary code execution.

-
-
-

Lack of sanitization throughout Netrw can lead to arbitrary - code execution upon opening a directory with a crafted - name.

-
-
-

The Vim Netrw Plugin shares the FTP user name and password - across all FTP sessions. Every time Vim makes a new FTP - connection, it sends the user name and password of the - previous FTP session to the FTP server.

-
- - - - CVE-2008-3076 - http://www.openwall.com/lists/oss-security/2008/10/16/2 - http://www.rdancer.org/vulnerablevim-netrw.html - http://www.rdancer.org/vulnerablevim-netrw.v2.html - http://www.rdancer.org/vulnerablevim-netrw.v5.html - http://www.rdancer.org/vulnerablevim-netrw-credentials-dis.html - - - 2008-10-16 - 2009-01-02 - - - - - vinagre -- format string vulnerability - - - vinagre - 0.5.2 - - - - -

CORE Security Technologies reports:

-
-

A format string error has been found on the - vinagre_utils_show_error() function that can be exploited via - commands issued from a malicious server containing format - string specifiers on the VNC name.

-

In a web based attack scenario, the user would be required - to connect to a malicious server. Successful exploitation - would then allow the attacker to execute arbitrary code with - the privileges of the Vinagre user.

-
- - - - 32682 - CVE-2008-5660 - http://www.coresecurity.com/content/vinagre-format-string - http://ftp.gnome.org/pub/GNOME/sources/vinagre/0.5/vinagre-0.5.2.news - - - 2008-12-09 - 2008-12-31 - 2010-05-02 - - - - - twiki -- multiple vulnerabilities - - - twiki - 4.2.4,1 - - - - -

Marc Schoenefeld and Steve Milner of RedHat SRT and Peter Allor of IBM ISS report:

-
-

XSS vulnerability with URLPARAM variable

-

SEARCH variable allows arbitrary shell command execution

-
- - - - 32668 - 32669 - CVE-2008-5304 - CVE-2008-5305 - http://secunia.com/advisories/33040 - http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2008-5304 - http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2008-5305 - http://www.securitytracker.com/alerts/2008/Dec/1021351.html - http://www.securitytracker.com/alerts/2008/Dec/1021352.html - https://www.it-isac.org/postings/cyber/alertdetail.php?id=4513 - http://xforce.iss.net/xforce/xfdb/45293 - - - 2008-12-05 - 2008-12-30 - - - - - roundcube -- remote execution of arbitrary code - - - roundcube - 0.2.b2,1 - - - - -

Entry for CVE-2008-5619 says:

-
-

html2text.php in RoundCube Webmail (roundcubemail) - 0.2-1.alpha and 0.2-3.beta allows remote attackers to execute - arbitrary code via crafted input that is processed by the - preg_replace function with the eval switch.

-
- - - - CVE-2008-5619 - http://trac.roundcube.net/ticket/1485618 - - - 2008-12-12 - 2008-12-30 - - - - - mysql -- MyISAM table privileges security bypass vulnerability for symlinked paths - - - mysql-server - 4.14.1.25 - 5.05.0.75 - 5.15.1.28 - 6.06.0.6 - - - - -

MySQL Team reports:

-
-

Additional corrections were made for the symlink-related privilege - problem originally addressed. The original fix did not correctly - handle the data directory pathname if it contained symlinked - directories in its path, and the check was made only at - table-creation time, not at table-opening time later.

-
- - - - CVE-2008-2079 - CVE-2008-4097 - CVE-2008-4098 - http://bugs.mysql.com/bug.php?id=32167 - http://dev.mysql.com/doc/refman/4.1/en/news-4-1-25.html - http://dev.mysql.com/doc/refman/5.0/en/releasenotes-cs-5-0-75.html - http://dev.mysql.com/doc/refman/5.1/en/news-5-1-28.html - http://dev.mysql.com/doc/refman/6.0/en/news-6-0-6.html - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=480292#25 - - - 2008-07-03 - 2008-12-30 - - - - - mplayer -- twinvq processing buffer overflow vulnerability - - - mplayer - mplayer-esound - mplayer-gtk - mplayer-gtk-esound - mplayer-gtk2 - mplayer-gtk2-esound - 0.99.11_9 - - - - -

A trapkit reports:

-
-

MPlayer contains a stack buffer overflow vulnerability while - parsing malformed TwinVQ media files. The vulnerability may be - exploited by a (remote) attacker to execute arbitrary code in - the context of MPlayer.

-
- - - - CVE-2008-5616 - http://secunia.com/advisories/33136/ - http://trapkit.de/advisories/TKADV2008-014.txt - - - 2008-12-14 - 2008-12-30 - - - - - ampache -- insecure temporary file usage - - - ampache - 3.4.3 - - - - -

Secunia reports:

-
-

A security issue has been reported in Ampache, which can be - exploited by malicious, local users to perform certain actions - with escalated privileges.

-

The security issue is caused due to the "gather-messages.sh" - script handling temporary files in an insecure manner. - This can be exploited via symlink attacks to overwrite arbitrary - files with the privileges of the user running the script.

-
- - - - 30875 - CVE-2008-3929 - http://secunia.com/advisories/31657 - - - 2008-12-24 - 2008-12-26 - - - - - opera -- multiple vulnerabilities - - - opera - linux-opera - 9.63 - - - - -

The Opera Team reports:

-
-

Manipulating certain text-area contents can cause a buffer - overflow, which may be exploited to execute arbitrary code.

-

Certain HTML constructs can cause the resulting DOM to change - unexpectedly, which triggers a crash. To inject code, additional - techniques will have to be employed.

-

Exceptionally long host names in file: URLs can cause a buffer - overflow, which may be exploited to execute arbitrary code. Remote Web - pages cannot refer to file: URLs, so successful exploitation involves - tricking users into manually opening the exploit URL, or a local file - that refers to it.

-

When Opera is previewing a news feed, some scripted URLs are not - correctly blocked. These can execute scripts which are able to - subscribe the user to any feed URL that the attacker chooses, and can - also view the contents of any feeds that the user is subscribed to. - These may contain sensitive information.

-

Built-in XSLT templates incorrectly handle escaped content and can - cause it to be treated as markup. If a site accepts content from - untrusted users, which it then displays using XSLT as escaped strings, - this can allow scripted markup to be injected. The scripts will then - be executed in the security context of that site.

-
- - - - CVE-2008-5178 - http://www.opera.com/support/kb/view/920/ - http://www.opera.com/support/kb/view/921/ - http://www.opera.com/support/kb/view/922/ - http://www.opera.com/support/kb/view/923/ - http://www.opera.com/support/kb/view/924/ - http://secunia.com/advisories/32752/ - - - 2008-11-18 - 2008-12-19 - - - - - mediawiki -- multiple vulnerabilities - - - mediawiki - 1.6.01.6.11 - 1.12.01.12.3 - 1.13.01.13.3 - - - - -

The MediaWiki development team reports:

-
-

Certain unspecified input is not properly sanitised before being - returned to the user. This can be exploited to execute arbitrary HTML - and script code in a user's browser session in context of an affected - site.

-

Certain unspecified input related to uploads is not properly - sanitised before being used. This can be exploited to inject arbitrary - HTML and script code, which will be executed in a user's browser - session in context of an affected site when a malicious data is - opened. Successful exploitation may require that uploads are enabled - and the victim uses an Internet Explorer based browser.

-

Certain SVG scripts are not properly sanitised before being used. - This can be exploited to inject arbitrary HTML and script code, which - will be executed in a user's browser session in context of an affected - site when a malicious data is opened. Successful exploitation may require - that SVG uploads are enabled and the victim uses a browser supporting SVG - scripting.

-

The application allows users to perform certain actions via HTTP - requests without performing any validity checks to verify the - requests. This can be exploited to perform certain operations when a - logged in user visits a malicious site.

-
- - - - CVE-2008-5249 - CVE-2008-5250 - CVE-2008-5252 - http://secunia.com/advisories/33133/ - http://lists.wikimedia.org/pipermail/mediawiki-announce/2008-December/000080.html - - - 2008-12-15 - 2008-12-19 - - - - - drupal -- multiple vulnerabilities - - - drupal5 - 5.14 - - - drupal6 - 6.8 - - - - -

The Drupal Project reports:

-
-

The update system is vulnerable to Cross site request forgeries. - Malicious users may cause the superuser (user 1) to execute old - updates that may damage the database.

-

When an input format is deleted, not all existing content on a site - is updated to reflect this deletion. Such content is then displayed - unfiltered. This may lead to cross site scripting attacks when harmful - tags are no longer stripped from 'malicious' content that was posted - earlier.

-
- - - - CVE-2008-6533 - http://drupal.org/node/345441 - http://secunia.com/advisories/33112/ - - - 2008-12-11 - 2008-12-19 - 2010-05-02 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 2.0.0.20,1 - 3.*,13.0.5,1 - - - linux-firefox - 2.0.0.20 - - - seamonkey - linux-seamonkey - 1.1.14 - - - thunderbird - linux-thunderbird - 2.0.0.18 - - - - -

The Mozilla Foundation reports:

-
-

MFSA 2008-69 XSS vulnerabilities in SessionStore

-

MFSA 2008-68 XSS and JavaScript privilege escalation

-

MFSA 2008-67 Escaped null characters ignored by CSS parser

-

MFSA 2008-66 Errors parsing URLs with leading whitespace and - control characters

-

MFSA 2008-65 Cross-domain data theft via script redirect error - message

-

MFSA 2008-64 XMLHttpRequest 302 response disclosure

-

MFSA 2008-62 Additional XSS attack vectors in feed preview

-

MFSA 2008-61 Information stealing via loadBindingDocument

-

MFSA 2008-60 Crashes with evidence of memory corruption - (rv:1.9.0.5/1.8.1.19)

-
- - - - CVE-2008-5500 - CVE-2008-5501 - CVE-2008-5502 - CVE-2008-5503 - CVE-2008-5504 - CVE-2008-5505 - CVE-2008-5506 - CVE-2008-5507 - CVE-2008-5508 - CVE-2008-5510 - CVE-2008-5511 - CVE-2008-5512 - CVE-2008-5513 - http://www.mozilla.org/security/announce/2008/mfsa2008-60.html - http://www.mozilla.org/security/announce/2008/mfsa2008-61.html - http://www.mozilla.org/security/announce/2008/mfsa2008-62.html - http://www.mozilla.org/security/announce/2008/mfsa2008-63.html - http://www.mozilla.org/security/announce/2008/mfsa2008-64.html - http://www.mozilla.org/security/announce/2008/mfsa2008-65.html - http://www.mozilla.org/security/announce/2008/mfsa2008-66.html - http://www.mozilla.org/security/announce/2008/mfsa2008-67.html - http://www.mozilla.org/security/announce/2008/mfsa2008-68.html - http://www.mozilla.org/security/announce/2008/mfsa2008-69.html - - - 2008-12-17 - 2008-12-19 - - - - - phpmyadmin -- cross-site request forgery vulnerability - - - phpMyAdmin211 - 2.11.9.4 - - - phpMyAdmin - 3.1.1 - - - - -

The phpMyAdmin Team reports:

-
-

A logged-in user can be subject of SQL injection through cross - site request forgery. Several scripts in phpMyAdmin are - vulnerable and the attack can be made through table parameter.

-
- - - - CVE-2008-5621 - http://www.phpmyadmin.net/home_page/security/PMASA-2008-10.php - http://www.milw0rm.com/exploits/7382 - http://secunia.com/advisories/33076/ - - - 2008-12-09 - 2008-12-11 - 2010-05-02 - - - - - php5 -- potential magic_quotes_gpc vulnerability - - - php5 - 5.2.8 - - - - -

PHP Developers reports:

-
-

Due to a security bug found in the PHP 5.2.7 release, it has been - removed from distribution. The bug affects configurations where - magic_quotes_gpc is enabled, because it remains off even when set to - on.

-
- - - - CVE-2008-5844 - http://www.php.net/archive/2008.php#id2008-12-07-1 - - - 2008-12-07 - 2008-12-08 - 2010-05-02 - - - - - wireshark -- SMTP Processing Denial of Service Vulnerability - - - wireshark - wireshark-lite - ethereal - ethereal-lite - tethereal - tethereal-lite - 1.0.4_1 - - - - -

Secunia reports:

-
-

A vulnerability has been reported in Wireshark, which can be - exploited by malicious people to cause a DoS.

-

The vulnerability is caused due to an error in the SMTP dissector - and can be exploited to trigger the execution of an infinite loop via - a large SMTP packet.

-
- - - - CVE-2008-5285 - http://secunia.com/advisories/32840/ - http://lists.grok.org.uk/pipermail/full-disclosure/2008-November/065840.html - - - 2008-11-24 - 2008-12-07 - - - - - php -- multiple vulnerabilities - - - php5 - 5.2.7 - - - - -

Secunia reports:

-
-

Some vulnerabilities have been reported in PHP, where some have an - unknown impact and others can potentially be exploited by malicious - people to cause a DoS (Denial of Service) or compromise a vulnerable - system.

-

An input validation error exists within the - "ZipArchive::extractTo()" function when extracting ZIP archives. - This can be exploited to extract files to arbitrary locations - outside the specified directory via directory traversal sequences in - a specially crafted ZIP archive.

-

An error in the included PCRE library can be exploited to cause a - buffer overflow.

-

The problem is that the "BG(page_uid)" and "BG(page_gid)" variables - are not initialized. No further information is currently - available.

-

The problem is that the "php_value" order is incorrect for Apache - configurations. No further information is currently available.

-

An error in the GD library can be exploited to cause a crash via a - specially crafted font file.

-
- - - - CVE-2008-2371 - CVE-2008-2829 - CVE-2008-3658 - CVE-2008-3659 - CVE-2008-3660 - http://www.php.net/ChangeLog-5.php#5.2.7 - http://www.sektioneins.de/advisories/SE-2008-06.txt - http://secunia.com/advisories/30916/ - http://secunia.com/advisories/31409/ - http://secunia.com/advisories/32964/ - - - 2008-12-04 - 2008-12-07 - - - - - mgetty+sendfax -- symlink attack via insecure temporary files - - - mgetty+sendfax - 1.1.35_2 - - - - -

Debian reports:

-
-

Faxspool in mgetty 1.1.36 allows local users to overwrite - arbitrary files via a symlink attack on a /tmp/faxsp.#### - temporary file.

-
- - - - CVE-2008-4936 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496403 - https://bugs.gentoo.org/show_bug.cgi?id=235806 - - - 2008-08-24 - 2008-12-07 - - - - - dovecot-managesieve -- Script Name Directory Traversal Vulnerability - - - dovecot-managesieve - 0.10.4 - 0.11.00.11.1 - - - - -

Secunia reports:

-
-

The security issue is caused due to an input validation error when - processing script names. This can be exploited to read or modify - arbitrary files having ".sieve" extensions via directory traversal - attacks, with the privileges of the attacker's user id.

-
- - - - CVE-2008-5301 - http://www.vupen.com/english/advisories/2008/3190 - http://secunia.com/Advisories/32768/ - http://dovecot.org/list/dovecot/2008-November/035259.html - - - 2008-11-18 - 2008-12-07 - - - - - habari -- Cross-Site Scripting Vulnerability - - - habari - 0.5.2 - - - - -

Secunia reports:

-
-

Input passed via the "habari_username" parameter when logging in is - not properly sanitised before being returned to the user. This can - be exploited to execute arbitrary HTML and script code in a user's - browser session in context of an affected site.

-
- - - - CVE-2008-4601 - http://packetstorm.linuxsecurity.com/0810-exploits/habaricms-xss.txt - http://secunia.com/advisories/32311/ - - - 2008-10-17 - 2008-12-07 - - - - - vlc -- arbitrary code execution in the RealMedia processor - - - vlc-devel - 0.9.8a - - - - -

Tobias Klein from TrapKit reports:

-
-

The VLC media player contains an integer overflow vulnerability - while parsing malformed RealMedia (.rm) files. The vulnerability - leads to a heap overflow that can be exploited by a (remote) - attacker to execute arbitrary code in the context of VLC media - player.

-
- - - - 32545 - CVE-2008-5276 - http://www.trapkit.de/advisories/TKADV2008-013.txt - http://www.videolan.org/security/sa0811.html - - - 2008-11-30 - 2008-12-06 - 2008-12-07 - - - - - mantis -- php code execution vulnerability - - - mantis - 1.1.4 - - - - -

Secunia reports:

-
-

EgiX has discovered a vulnerability in Mantis, which can be - exploited by malicious users to compromise a vulnerable system.

-

Input passed to the "sort" parameter in manage_proj_page.php is not - properly sanitised before being used in a "create_function()" call. - This can be exploited to execute arbitrary PHP code.

-
- - - - CVE-2008-4687 - http://secunia.com/advisories/32314/ - - - 2008-10-17 - 2008-12-06 - - - - - mantis -- multiple vulnerabilities - - - mantis - 1.1.2 - - - - -

Secunia reports:

-
-

Some vulnerabilities have been reported in Mantis, which can be - exploited by malicious users to compromise a vulnerable system and - malicious people to conduct cross-site scripting and request forgery - attacks.

-

Input passed to the "filter_target" parameter in - return_dynamic_filters.php is not properly sanitised before being - returned to a user. This can be exploited to execute arbitrary HTML - and script code in a user's browser session in context of an affected - site.

-

A vulnerability is caused due to the application allowing users to - perform certain actions via HTTP requests without performing any - validity checks to verify the request. This can be exploited to e.g. - add a new user with administrative privileges by enticing a logged-in - administrator to visit a malicious site.

-

Input passed to the "value" parameter in adm_config_set.php is not - properly sanitised before being used in an "eval()" statement. This - can be exploited to e.g. execute arbitrary PHP commands via a - specially crafted request.

-

Input passed to the "language" parameter in account_prefs_update.php - is not properly verified before being used to include files. This - can be exploited to include arbitrary files from local - resources.

-
- - - - CVE-2008-2276 - CVE-2008-3331 - CVE-2008-3332 - CVE-2008-3333 - http://secunia.com/advisories/30270/ - - - 2008-05-15 - 2008-12-06 - - - - - squirrelmail -- Cross site scripting vulnerability - - - squirrelmail - 1.4.17 - - - - -

Squirrelmail team reports:

-
-

An issue was fixed that allowed an attacker to send specially- - crafted hyperlinks in a message that could execute cross-site - scripting (XSS) when the user viewed the message in SquirrelMail.

-
- - - - CVE-2008-2379 - http://secunia.com/Advisories/32143/ - http://sourceforge.net/project/shownotes.php?release_id=644750&group_id=311 - - - 2008-12-03 - 2008-12-04 - - - - - openoffice -- arbitrary code execution vulnerabilities - - - openoffice.org-2 - openoffice.org-2-RC - openoffice.org-2-devel - 2.42.4.2 - 2.4.20040402 - - - - -

The OpenOffice Team reports:

-
-

A security vulnerability with the way OpenOffice 2.x process WMF - files may allow a remote unprivileged user who provides a - StarOffice/StarSuite document that is opened by a local user to - execute arbitrary commands on the system with the privileges of the - user running StarOffice/StarSuite. No working exploit is known right - now.

-
-
-

A security vulnerability with the way OpenOffice 2.x process EMF - files may allow a remote unprivileged user who provides a - StarOffice/StarSuite document that is opened by a local user to - execute arbitrary commands on the system with the privileges of the - user running StarOffice/StarSuite. No working exploit is known right - now.

-
- - - - CVE-2008-2237 - CVE-2008-2238 - http://www.openoffice.org/security/cves/CVE-2008-2237.html - http://www.openoffice.org/security/cves/CVE-2008-2238.html - - - 2008-10-29 - 2008-11-29 - - - - - wordpress -- header rss feed script insertion vulnerability - - - wordpress - de-wordpress - wordpress-mu - 2.6.5 - - - zh-wordpress - 0 - - - - -

Secunia reports:

-
-

Input passed via the HTTP "Host" header is not properly sanitised - before being used. This can be exploited to execute arbitrary HTML and - script code in a user's browser session in context of an affected site - if malicious data is viewed.

-
- - - - CVE-2008-5278 - http://secunia.com/advisories/32882/ - http://wordpress.org/development/2008/11/wordpress-265/ - - - 2008-11-26 - 2008-11-29 - 2010-05-02 - - - - - samba -- potential leakage of arbitrary memory contents - - - samba - samba3 - ja-samba - 3.0.29,13.0.32_2,1 - - - samba32-devel - 3.2.4_1 - - - - -

Samba Team reports:

-
-

Samba 3.0.29 and beyond contain a change to deal with gcc 4 - optimizations. Part of the change modified range checking for - client-generated offsets of secondary trans, trans2 and nttrans - requests. These requests are used to transfer arbitrary amounts - of memory from clients to servers and back using small SMB - requests and contain two offsets: One offset (A) pointing into - the PDU sent by the client and one (B) to direct the transferred - contents into the buffer built on the server side. While the range - checking for offset (B) is correct, a cut and paste error lets offset - (A) pass completely unchecked against overflow.

-

The buffers passed into trans, trans2 and nttrans undergo higher-level - processing like DCE/RPC requests or listing directories. The missing - bounds check means that a malicious client can make the server do this - higher-level processing on arbitrary memory contents of the smbd process - handling the request. It is unknown if that can be abused to pass arbitrary - memory contents back to the client, but an important barrier is missing from - the affected Samba versions.

-
- - - - CVE-2008-4314 - http://www.samba.org/samba/security/CVE-2008-4314.html - http://secunia.com/advisories/32813/ - - - 2008-11-27 - 2008-11-29 - - - - - hplip -- hpssd Denial of Service - - - hplip - 2.8.2_3 - - - - -

Secunia reports:

-
-

A security issue has been reported in hplip, which can be - exploited by malicious, local users to cause a DoS.

-

The security issue is caused due to an error within hpssd.py when - parsing certain requests. This can be exploited to crash the service - by sending specially crafted requests to the default port 2207/TCP.

-
- - - - CVE-2008-2940 - CVE-2008-2941 - 30683 - https://rhn.redhat.com/errata/RHSA-2008-0818.html - http://secunia.com/advisories/31470 - - - 2008-08-14 - 2008-11-29 - - - - - cups -- potential buffer overflow in PNG reading code - - - cups-base - 1.3.9_2 - - - - -

CUPS reports:

-
-

The PNG image reading code did not validate the - image size properly, leading to a potential buffer overflow - (STR #2974)

-
- - - - CVE-2008-5286 - http://www.cups.org/str.php?L2974 - http://svn.easysw.com/public/cups/trunk/CHANGES-1.3.txt - http://www.openwall.com/lists/oss-security/2008/11/25/2 - - - 2008-10-17 - 2008-11-29 - 2008-12-25 - - - - - imlib2 -- XPM processing buffer overflow vulnerability - - - imlib2 - imlib2-nox11 - 1.4.1.000_1,2 - - - - -

Secunia reports:

-
-

A vulnerability has been discovered in imlib2, which can - be exploited by malicious people to potentially compromise - an application using the library.

-

The vulnerability is caused due to a pointer arithmetic - error within the "load()" function provided by the XPM - loader. This can be exploited to cause a heap-based buffer - overflow via a specially crafted XPM file.

-

Successful exploitation may allow execution of arbitrary - code.

-
- - - - 32371 - CVE-2008-5187 - http://secunia.com/Advisories/32796/ - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=505714#15 - http://bugzilla.enlightenment.org/show_bug.cgi?id=547 - - - 2008-11-20 - 2008-11-24 - - - - - streamripper -- multiple buffer overflows - - - streamripper - 1.64.0 - - - - -

Secunia reports:

-
-

A boundary error exists within http_parse_sc_header() in lib/http.c - when parsing an overly long HTTP header starting with "Zwitterion v".

-

A boundary error exists within http_get_pls() in lib/http.c when - parsing a specially crafted pls playlist containing an overly long - entry.

-

A boundary error exists within http_get_m3u() in lib/http.c when - parsing a specially crafted m3u playlist containing an overly long - "File" entry.

-
- - - - CVE-2008-4829 - http://secunia.com/secunia_research/2008-50/ - http://streamripper.cvs.sourceforge.net/viewvc/streamripper/sripper_1x/CHANGES?revision=1.196 - - - 2008-11-05 - 2008-11-23 - - - - - mantis -- session hijacking vulnerability - - - mantis - 1.1.3 - - - - -

The mantis Team reports:

-
-

When configuring a web application to use only ssl (e. g. by - forwarding all http-requests to https), a user would expect that - sniffing and hijacking the session is impossible. - Though, for this to be secure, one needs to set the session cookie to - have the secure flag. Else the cookie will be transferred through http - if the victim's browser does a single http-request on the same domain.

-
- - - - CVE-2008-3102 - http://www.mantisbt.org/bugs/view.php?id=9524 - http://www.mantisbt.org/bugs/view.php?id=9533 - http://enablesecurity.com/2008/08/11/surf-jack-https-will-not-save-you/ - http://int21.de/cve/CVE-2008-3102-mantis.html - - - 2008-10-14 - 2008-11-22 - - - - - dovecot -- ACL plugin bypass vulnerabilities - - - dovecot - 1.1.4 - - - - -

Timo Sirainen reports in dovecot 1.1.4 release notes:

-
-

ACL plugin fixes: Negative rights were actually treated - as positive rights. 'k' right didn't prevent creating - parent/child/child mailbox. ACL groups weren't working.

-
- - - - 31587 - CVE-2008-4577 - CVE-2008-4578 - - - 2008-10-05 - 2008-11-19 - - - - - libxml2 -- multiple vulnerabilities - - - libxml2 - 2.6.32_2 - - - - -

Secunia reports:

-
-

Two vulnerabilities have been reported in Libxml2, which can be - exploited by malicious people to cause a DoS (Denial of Service) or - to potentially compromise an application using the library.

-

1) An integer overflow error in the "xmlSAX2Characters()" function - can be exploited to trigger a memory corruption via a specially

-

Successful exploitation may allow execution of arbitrary code, but - requires e.g. that the user is tricked into processing an overly - large XML file (2GB or more).

-

2) An integer overflow error in the "xmlBufferResize()" function - can be exploited to trigger the execution of an infinite loop. - The vulnerabilities are reported in version 2.7.2.

-

Other versions may also be affected.

-
- - - - CVE-2008-4225 - CVE-2008-4226 - https://bugzilla.redhat.com/show_bug.cgi?id=470466 - https://bugzilla.redhat.com/show_bug.cgi?id=470480 - http://secunia.com/Advisories/32773/ - - - 2008-11-18 - 2008-11-19 - - - - - openfire -- multiple vulnerabilities - - - openfire - 3.6.1 - - - - -

Andreas Kurtz reports:

-
-

The jabber server Openfire (<= version 3.6.0a) contains several - serious vulnerabilities. Depending on the particular runtime - environment these issues can potentially even be used by an - attacker to execute code on operating system level.

-
    -
  1. Authentication bypass - This vulnerability provides an attacker - full access to all functions in the admin webinterface without - providing any user credentials. The Tomcat filter which is - responsible for authentication could be completely - circumvented.
    2. -
  2. SQL injection - It is possible to pass SQL statements to the - backend database through a SQL injection vulnerability. Depending - on the particular runtime environment and database permissions it - is even possible to write files to disk and execute code on - operating system level.
    3. -
  3. Multiple Cross-Site Scripting - Permits arbitrary insertion - of HTML- and JavaScript code in login.jsp. An attacker could - also manipulate a parameter to specify a destination to which a - user will be forwarded to after successful authentication.
    4. -
-
- - - - CVE-2008-6510 - CVE-2008-6511 - CVE-2008-6508 - CVE-2009-1595 - CVE-2008-1728 - CVE-2008-6509 - http://www.andreas-kurtz.de/advisories/AKADV2008-001-v1.0.txt - http://www.igniterealtime.org/builds/openfire/docs/latest/changelog.html - http://secunia.com/Advisories/32478/ - - - 2008-11-07 - 2008-11-19 - 2010-05-02 - - - - - syslog-ng2 -- startup directory leakage in the chroot environment - - - syslog-ng2 - 2.0.9_2 - - - syslog-ng - 1.6.12_1 - - - - -

Florian Grandel reports:

-
-

I have not had the time to analyze all of syslog-ng code. - But by reading the code section near the chroot call and looking - at strace results I believe that syslog-ng does not chdir to the - chroot jail's location before chrooting into it.

-

This opens up ways to work around the chroot jail.

-
- - - - CVE-2008-5110 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=505791 - http://www.openwall.com/lists/oss-security/2008/11/17/3 - - - 2008-11-15 - 2008-11-18 - 2009-07-01 - - - - - enscript -- arbitrary code execution vulnerability - - - enscript-a4 - enscript-letter - enscript-letterdj - 1.6.4_2 - - - - -

Ulf Harnhammar of Secunia Research reports:

-
-

Stack-based buffer overflow in the read_special_escape function - in src/psgen.c in GNU Enscript 1.6.1 and 1.6.4 beta, when the -e - (aka special escapes processing) option is enabled, allows - user-assisted remote attackers to execute arbitrary code via a - crafted ASCII file, related to the setfilename command.

-
- - - - CVE-2008-3863 - CVE-2008-4306 - http://secunia.com/secunia_research/2008-41/ - - - 2008-10-22 - 2008-11-18 - - - - - gnutls -- X.509 certificate chain validation vulnerability - - - gnutls - 2.4.2 - - - - -

SecurityFocus reports:

-
-

GnuTLS is prone to a security-bypass vulnerability because the - application fails to properly validate chained X.509 certificates. - Successfully exploiting this issue allows attackers to perform - man-in-the-middle attacks by impersonating trusted servers. - Unsuspecting users may be under a false sense of security that can - aid attackers in launching further attacks.

-
- - - - 32232 - CVE-2008-4989 - http://www.gnu.org/software/gnutls/security.html - http://lists.gnu.org/archive/html/gnutls-devel/2008-11/msg00017.html - - - 2008-11-10 - 2008-11-16 - - - - - net-snmp -- DoS for SNMP agent via crafted GETBULK request - - - net-snmp - 5.45.4.2.1 - 5.35.3.2.3 - - - - -

Wes Hardaker reports through sourceforge.net forum:

-
-

SECURITY ISSUE: A bug in the getbulk handling code could - let anyone with even minimal access crash the agent. If you - have open access to your snmp agents (bad bad bad; stop doing - that!) or if you don't trust everyone that does have access to - your agents you should updated immediately to prevent - potential denial of service attacks.

-
-

Description at cve.mitre.org additionally clarifies:

-
-

Integer overflow in the netsnmp_create_subtree_cache - function in agent/snmp_agent.c in net-snmp 5.4 before - 5.4.2.1, 5.3 before 5.3.2.3, and 5.2 before 5.2.5.1 allows - remote attackers to cause a denial of service (crash) via - a crafted SNMP GETBULK request, which triggers a heap-based - buffer overflow, related to the number of responses or - repeats.

-
- - - - CVE-2008-4309 - http://sourceforge.net/forum/forum.php?forum_id=882903 - http://www.openwall.com/lists/oss-security/2008/10/31/1 - http://net-snmp.svn.sourceforge.net/viewvc/net-snmp/tags/Ext-5-2-5-1/net-snmp/agent/snmp_agent.c?r1=17271&r2=17272&pathrev=17272 - - - 2008-10-12 - 2008-11-14 - 2009-03-23 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 2.0.0.18,1 - 3.*,13.0.4,1 - - - linux-firefox - 2.0.0.18 - - - seamonkey - linux-seamonkey - 1.1.13 - - - thunderbird - linux-thunderbird - 2.0.0.18 - - - - -

The Mozilla Foundation reports:

-
-

MFSA 2008-58 Parsing error in E4X default namespace

-

MFSA 2008-57 -moz-binding property bypasses security checks on - codebase principals

-

MFSA 2008-56 nsXMLHttpRequest::NotifyEventListeners() same-origin - violation

-

MFSA 2008-55 Crash and remote code execution in - nsFrameManager

-

MFSA 2008-54 Buffer overflow in http-index-format parser

-

MFSA 2008-53 XSS and JavaScript privilege escalation via session - restore

-

MFSA 2008-52 Crashes with evidence of memory corruption - (rv:1.9.0.4/1.8.1.18)

-

MFSA 2008-51 file: URIs inherit chrome privileges when opened - from chrome

-

MFSA 2008-50 Crash and remote code execution via __proto__ - tampering

-

MFSA 2008-49 Arbitrary code execution via Flash Player dynamic - module unloading

-

MFSA 2008-48 Image stealing via canvas and HTTP redirect

-

MFSA 2008-47 Information stealing via local shortcut files

-

MFSA 2008-46 Heap overflow when canceling newsgroup message

-

MFSA 2008-44 resource: traversal vulnerabilities

-

MFSA 2008-43 BOM characters stripped from JavaScript before - execution

-

MFSA 2008-42 Crashes with evidence of memory corruption - (rv:1.9.0.2/1.8.1.17)

-

MFSA 2008-41 Privilege escalation via XPCnativeWrapper - pollution

-

MFSA 2008-38 nsXMLDocument::OnChannelRedirect() same-origin - violation

-

MFSA 2008-37 UTF-8 URL stack buffer overflow

-
- - - - CVE-2008-0017 - CVE-2008-4582 - CVE-2008-5012 - CVE-2008-5013 - CVE-2008-5014 - CVE-2008-5015 - CVE-2008-5016 - CVE-2008-5017 - CVE-2008-5018 - CVE-2008-5019 - CVE-2008-5021 - CVE-2008-5022 - CVE-2008-5023 - CVE-2008-5024 - http://www.mozilla.org/security/announce/2008/mfsa2008-47.html - http://www.mozilla.org/security/announce/2008/mfsa2008-48.html - http://www.mozilla.org/security/announce/2008/mfsa2008-49.html - http://www.mozilla.org/security/announce/2008/mfsa2008-50.html - http://www.mozilla.org/security/announce/2008/mfsa2008-51.html - http://www.mozilla.org/security/announce/2008/mfsa2008-52.html - http://www.mozilla.org/security/announce/2008/mfsa2008-53.html - http://www.mozilla.org/security/announce/2008/mfsa2008-54.html - http://www.mozilla.org/security/announce/2008/mfsa2008-55.html - http://www.mozilla.org/security/announce/2008/mfsa2008-56.html - http://www.mozilla.org/security/announce/2008/mfsa2008-57.html - http://www.mozilla.org/security/announce/2008/mfsa2008-58.html - - - 2008-11-13 - 2008-11-13 - 2008-11-23 - - - - - faad2 -- heap overflow vulnerability - - - faad2 - 2.6.1_1,1 - - - - -

CVE reports:

-
-

Heap-based buffer overflow in the decodeMP4file function - (frontend/main.c) in FAAD2 2.6.1 and earlier allows remote - attackers to cause a denial of service (crash) and possibly - execute arbitrary code via a crafted MPEG-4 (MP4) file.

-
- - - - CVE-2008-4201 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=499899 - http://www.gentoo.org/security/en/glsa/glsa-200811-03.xml - - - 2008-09-16 - 2008-11-12 - 2008-11-13 - - - - - emacs -- run-python vulnerability - - - emacs - 2222.2_1 - - - - -

Emacs developers report:

-
-

The Emacs command `run-python' launches an interactive - Python interpreter. After the Python process starts up, - Emacs automatically sends it the line:

-

import emacs

-

which normally imports a script named emacs.py which is - distributed with Emacs. This script, which is typically - located in a write-protected installation directory with - other Emacs program files, defines various functions to help - the Python process communicate with Emacs.

-

The vulnerability arises because Python, by default, - prepends '' to the module search path, so modules are looked - for in the current directory. If the current directory is - world-writable, an attacker may insert malicious code by - adding a fake Python module named emacs.py into that - directory.

-
- - - - CVE-2008-3949 - http://lists.gnu.org/archive/html/emacs-devel/2008-09/msg00215.html - - - 2008-09-05 - 2008-11-07 - 2010-05-02 - - - - - clamav -- off-by-one heap overflow in VBA project parser - - - clamav - 0.94.1 - - - clamav-devel - 20081105 - - - - -

Advisory from Moritz Jodeit, November 8th, 2008:

-
-

ClamAV contains an off-by-one heap overflow vulnerability - in the code responsible for parsing VBA project files. - Successful exploitation could allow an attacker to execute - arbitrary code with the privileges of the `clamd' process by - sending an email with a prepared attachment.

-

A VBA project file embedded inside an OLE2 office document - send as an attachment can trigger the off-by-one.

-
-

Entry from Thu Oct 30 13:52:42 CET 2008 (acab) in ChangeLog:

-
-

libclamav/vba_extract.c: get_unicode_name off-by-one, - bb#1239 reported by Moritz Jodeit >moritz*jodeit.org<

-
- - - - http://www.securityfocus.com/archive/1/498169/30/0/threaded - http://svn.clamav.net/svn/clamav-devel/trunk/ChangeLog - CVE-2008-5050 - - - 2008-11-08 - 2008-11-10 - - - - - trac -- potential DOS vulnerability - - - trac - 0.11.2 - - - ja-trac - 0.11.2 - - - - -

Trac development team reports:

-
-

0.11.2 is a new stable maintenance release. It contains - several security fixes and everyone is recommended to - upgrade their installations.

-

Bug fixes:

-

Fixes potential DOS vulnerability with certain wiki markup.

-
- - - - http://groups.google.com/group/trac-announce/browse_thread/thread/67f7a22ec818d97d - - - 2008-11-08 - 2008-11-09 - - - - - vlc -- cue processing stack overflow - - - vlc - 0.8.6.i_2,2 - - - vlc-devel - 0.9.6,3 - - - - -

The VLC Team reports:

-
-

The VLC media player contains a stack overflow vulnerability - while parsing malformed cue files. The vulnerability may be - exploited by a (remote) attacker to execute arbitrary code in - the context of VLC media player.

-
- - - - CVE-2008-5032 - CVE-2008-5036 - http://www.videolan.org/security/sa0810.html - http://www.trapkit.de/advisories/TKADV2008-012.txt - - - 2008-11-05 - 2008-11-08 - 2010-05-02 - - - - - opera -- multiple vulnerabilities - - - opera - linux-opera - 9.62 - - - - -

Opera reports:

-
-

When certain parameters are passed to Opera's History - Search, they can cause content not to be correctly - sanitized. This can allow scripts to be injected into the - History Search results page. Such scripts can then run with - elevated privileges and interact with Opera's configuration, - allowing them to execute arbitrary code.

-
-
-

The links panel shows links in all frames on the current - page, including links with JavaScript URLs. When a page is - held in a frame, the script is incorrectly executed on the - outermost page, not the page where the URL was located. - This can be used to execute scripts in the context of an - unrelated frame, which allows cross-site scripting.

-
- - - - CVE-2008-4794 - http://www.opera.com/support/search/view/906/ - http://www.opera.com/support/search/view/907/ - - - 2008-11-03 - 2008-11-03 - 2010-05-02 - - - - - qemu -- Heap overflow in Cirrus emulation - - - qemu - qemu-devel - 0.9.1_10 - 0.9.1s.20080101*0.9.1s.20080620_2 - - - - -

Aurelien Jarno reports:

-
-

CVE-2008-4539: fix a heap overflow in Cirrus emulation

-

The code in hw/cirrus_vga.c has changed a lot between - CVE-2007-1320 has been announced and the patch has been applied. - As a consequence it has wrongly applied and QEMU is still - vulnerable to this bug if using VNC.

-
- - - - CVE-2008-4539 - http://lists.gnu.org/archive/html/qemu-devel/2008-10/msg01363.html - - - 2008-11-01 - 2008-11-02 - - - - - phpmyadmin -- Cross-Site Scripting Vulnerability - - - phpMyAdmin - 3.03.0.1.1 - 2.11.9.3 - - - phpMyAdmin211 - 2.11.9.3 - - - - -

SecurityFocus reports:

-
-

phpMyAdmin is prone to a cross-site scripting vulnerability - because it fails to sufficiently sanitize user-supplied data.

-

An attacker may leverage this issue to execute arbitrary - script code in the browser of an unsuspecting user in the - context of the affected site. This may allow the attacker - to steal cookie-based authentication credentials and to - launch other attacks.

-
- - - - 31928 - http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-9 - - - 2008-10-30 - 2008-10-31 - 2008-10-31 - - - - - opera -- multiple vulnerabilities - - - opera - linux-opera - 9.61 - - - - -

Opera reports:

-
-

Certain constructs are not escaped correctly by Opera's - History Search results. These can be used to inject scripts - into the page, which can then be used to look through the user's - browsing history, including the contents of the pages they have - visited. These may contain sensitive information.

-
-
-

If a link that uses a JavaScript URL triggers Opera's Fast - Forward feature, when the user activates Fast Forward, the - script should run on the current page. When a page is held in a - frame, the script is incorrectly executed on the outermost page, - not the page where the URL was located. This can be used to - execute scripts in the context of an unrelated frame, which - allows cross-site scripting.

-
-
-

When Opera is previewing a news feed, some scripts are not - correctly blocked. These scripts are able to subscribe the user - to any feed URL that the attacker chooses, and can also view - the contents of any feeds that the user is subscribed to. - These may contain sensitive information.

-
- - - - CVE-2008-4697 - CVE-2008-4698 - CVE-2008-4725 - http://www.opera.com/support/search/view/903/ - http://www.opera.com/support/search/view/904/ - http://www.opera.com/support/search/view/905/ - - - 2008-10-17 - 2008-10-28 - 2010-05-02 - - - - - libspf2 -- Buffer overflow - - - libspf2 - 1.2.8 - - - - -

CVE reports:

-
-

Heap-based buffer overflow in the SPF_dns_resolv_lookup function - in Spf_dns_resolv.c in libspf2 before 1.2.8 allows remote attackers - to execute arbitrary code via a long DNS TXT record with a modified - length field.

-
- - - - 31881 - CVE-2008-2469 - - - 2008-10-21 - 2008-10-27 - - - - - openx -- sql injection vulnerability - - - openx - 2.6.2 - - - - -

Secunia reports:

-
-

OpenX can be exploited by malicious people to conduct SQL injection - attacks.

-

Input passed to the "bannerid" parameter in www/delivery/ac.php is - not properly sanitised before being used in SQL queries. This can be - exploited to manipulate SQL queries by injecting arbitrary SQL - code.

-
- - - - http://secunia.com/advisories/32114/ - http://blog.openx.org/10/openx-security-update/ - - - 2008-10-03 - 2008-10-25 - - - - - flyspray -- multiple vulnerabilities - - - flyspray - 0.9.9.5.1 - - - - -

The Flyspray Project reports:

-
-

Flyspray is affected by a Cross Site scripting Vulnerability - due to an error escaping PHP's $_SERVER['QUERY_STRING'] - superglobal, that can be maliciously used to inject - arbitrary code into the savesearch() javascript function.

-

There is an XSS problem in the history tab, the application - fails to sanitize the "details" parameter correctly, leading - to the possibility of arbitrary code injection into the - getHistory() javascript function.

-
-
-

Flyspray is affected by a Cross Site scripting Vulnerability - due missing escaping of SQL error messages. By including HTML - code in a query and at the same time causing it to fail by - submitting invalid data, an XSS hole can be exploited.

-

There is an XSS problem in the task history attached to - comments, since the application fails to sanitize the - old_value and new_value database fields for changed task - summaries.

-
-
-

Input passed via the "item_summary" parameter to - "index.php?do=details" is not properly sanitised before being - returned to the user. This can be exploited to execute arbitrary - HTML and script code in a user's browser session in context of - an affected site.

-
- - - - CVE-2007-6461 - CVE-2008-1165 - CVE-2008-1166 - http://secunia.com/advisories/29215 - - - 2008-02-24 - 2008-10-25 - - - - - wordpress -- snoopy "_httpsrequest()" shell command execution vulnerability - - - wordpress - de-wordpress - wordpress-mu - 2.6.3 - - - - -

The Wordpress development team reports:

-
-

A vulnerability - in the Snoopy - library was announced today. WordPress uses Snoopy to fetch the feeds - shown in the Dashboard. Although this seems to be a low risk - vulnerability for WordPress users, we wanted to get an update out - immediately.

-
- - - - 31887 - http://secunia.com/Advisories/32361/ - http://wordpress.org/development/2008/10/wordpress-263/ - - - 2008-10-23 - 2008-10-24 - - - - - drupal -- multiple vulnerabilities - - - drupal5 - 5.12 - - - drupal6 - 6.6 - - - - -

The Drupal Project reports:

-
-

On a server configured for IP-based virtual hosts, Drupal may be - caused to include and execute specifically named files outside - of its root directory. This bug affects both Drupal 5 and - Drupal 6.

-

The title of book pages is not always properly escaped, enabling - users with the "create book content" permission or the - permission to edit any node in the book hierarchy to insert - arbitrary HTML and script code into pages. Such a Cross site - scripting attack may lead to the attacker gaining administrator - access. This bug affects Drupal 6.

-
- - - - CVE-2008-6170 - http://drupal.org/node/324824 - - - 2008-10-22 - 2008-10-22 - 2010-05-12 - - - - - libxine -- denial of service vulnerability - - - libxine - 1.1.15 - - - - -

xine team reports:

-
-

A new xine-lib version is now available. This release contains - some security fixes, notably a DoS via corrupted Ogg files - (CVE-2008-3231), some related fixes, and fixes for a few possible - buffer overflows.

-
- - - - CVE-2008-3231 - http://www.xinehq.de/index.php/news - http://xforce.iss.net/xforce/xfdb/44040 - - - 2008-07-13 - 2008-10-19 - - - - - linux-flashplugin -- multiple vulnerabilities - - - linux-flashplugin - 9.0r124_1 - - - - -

Adobe Product Security Incident Response Team reports:

-
-

Potential vulnerabilities have been identified in Adobe Flash - Player 9.0.124.0 and earlier that could allow an attacker who - successfully exploits these potential vulnerabilities to bypass - Flash Player security controls. Adobe recommends users update - to the most current version of Flash Player available for their - platform.

-
- - - - CVE-2007-6243 - CVE-2008-3873 - CVE-2007-4324 - CVE-2008-4401 - CVE-2008-4503 - http://www.adobe.com/support/security/bulletins/apsb08-18.html - - - 2008-10-15 - 2008-10-17 - - - - - libxml2 -- two vulnerabilities - - - libxml2 - 2.6.32_1 - - - - -

Secunia reports:

-
-

Two vulnerabilities have been reported in Libxml2, which can be - exploited by malicious people to cause a DoS (Denial of Service) - or potentially compromise an application using the library.

-

1) A recursion error exists when processing certain XML content. - This can be exploited to e.g. exhaust all available memory and CPU - resources by tricking an application using Libxml2 into processing - specially crafted XML documents.

-

2) A boundary error in the processing of long XML entity names - in parser.c can be exploited to cause a heap-based buffer overflow - when specially crafted XML content is parsed.

-

Successful exploitation may allow execution of arbitrary code.

-
- - - - CVE-2008-3281 - CVE-2008-3529 - - - 2008-08-22 - 2008-10-15 - 2008-10-20 - - - - - drupal -- multiple vulnerabilities - - - drupal5 - 5.11 - - - drupal6 - 6.5 - - - - -

The Drupal Project reports:

-
-

A logic error in the core upload module validation allowed - unprivileged users to attach files to content. Users can view files - attached to content which they do not otherwise have access to. - If the core upload module is not enabled, your site will not be - affected.

-

A deficiency in the user module allowed users who had been blocked - by access rules to continue logging into the site under certain - conditions. If you do not use the 'access rules' functionality in core, - your site will not be affected.

-

The BlogAPI module does not implement correct validation for - certain content fields, allowing for values to be set for fields which - would otherwise be inaccessible on an internal Drupal form. We have - hardened these checks in BlogAPI module for this release, but the - security team would like to re-iterate that the 'Administer content - with BlogAPI' permission should only be given to trusted users. - If the core BlogAPI module is not enabled, your site will not be - affected.

-

A weakness in the node module API allowed for node validation to be - bypassed in certain circumstances for contributed modules implementing - the API. Additional checks have been added to ensure that validation - is performed in all cases. This vulnerability only affects sites using - one of a very small number of contributed modules, all of which will - continue to work correctly with the improved API. None of them were - found vulnerable, so our correction is a preventative measure.

-
- - - - CVE-2008-4791 - CVE-2008-4792 - CVE-2008-4793 - http://drupal.org/node/318706 - http://secunia.com/advisories/32200/ - http://secunia.com/advisories/32201/ - http://secunia.com/advisories/32198/ - - - 2008-10-08 - 2008-10-12 - 2010-05-12 - - - - - cups -- multiple vulnerabilities - - - cups-base - 1.3.9 - - - - -

The release note of cups 1.3.9 reports:

-
-

It contains the following fixes:

-
    -
  • SECURITY: The HP-GL/2 filter did not range check - pen numbers (STR #2911)
    • -
  • SECURITY: The SGI image file reader did not range - check 16-bit run lengths (STR #2918)
    • -
  • SECURITY: The text filter did not range check cpi, - lpi, or column values (STR #2919)
    • -
-
-

Exploitation of this vulnerability results in the execution - of arbitrary code with the privileges of the affected service.

- - - - CVE-2008-3639 - CVE-2008-3640 - CVE-2008-3641 - - - 2008-10-09 - 2008-10-10 - - - - - opera -- multiple vulnerabilities - - - opera - linux-opera - 9.60 - - - - -

Opera reports:

-
-

If a malicious page redirects Opera to a specially crafted - address (URL), it can cause Opera to crash. Given sufficient - address content, the crash could cause execution of code - controlled by the attacking page.

-
-
-

Once a Java applet has been cached, if a page can predict the - cache path for that applet, it can load the applet from the - cache, causing it to run in the context of the local machine. - This allows it to read other cache files on the computer or - perform other normally more restrictive actions. These files - could contain sensitive information, which could then be sent - to the attacker.

-
- - - - CVE-2008-4695 - CVE-2008-4694 - http://www.opera.com/support/search/view/901/ - http://www.opera.com/support/search/view/902/ - - - 2008-10-04 - 2008-10-10 - 2010-05-12 - - - - - mysql -- command line client input validation vulnerability - - - mysql-client - 5.15.1.28_1 - 5.05.0.67_1 - - - - -

Thomas Henlich reports:

-
-

The mysql command-line client does not quote HTML special - characters like < in its output. This allows an attacker who - is able to write data into a table to hide or modify records in - the output, and to inject potentially dangerous code, e. g. - Javascript to perform cross-site scripting or cross-site request - forgery attacks.

-
- - - - 31486 - http://www.henlich.de/it-security/mysql-command-line-client-html-injection-vulnerability/ - - - 2007-04-17 - 2008-10-01 - 2008-10-10 - - - - - mplayer -- multiple integer overflows - - - mplayer - mplayer-esound - mplayer-gtk - mplayer-gtk2 - mplayer-gtk-esound - mplayer-gtk2-esound - 0.99.11_7 - - - - -

The oCERT team reports:

-
-

The MPlayer multimedia player suffers from a vulnerability which - could result in arbitrary code execution and at the least, in - unexpected process termination. Three integer underflows located - in the Real demuxer code can be used to exploit a heap overflow, - a specific video file can be crafted in order to make the - stream_read function reading or writing arbitrary amounts of - memory.

-
- - - - CVE-2008-3827 - http://www.ocert.org/advisories/ocert-2008-013.html - - - 2008-09-30 - 2008-10-01 - 2008-10-02 - - - - - lighttpd -- multiple vulnerabilities - - - lighttpd - 1.4.19_3 - - - - -

Lighttpd seurity annoucement:

-
-

lighttpd 1.4.19, and possibly other versions before 1.5.0, does - not decode the url before matching against rewrite and redirect - patterns, which allows attackers to bypass rewrites rules. this - can be a security problem in certain configurations if these rules - are used to hide certain urls.

-
-
-

lighttpd 1.4.19, and possibly other versions before 1.5.0, does - not lowercase the filename after generating it from the url in - mod_userdir on case insensitive (file)systems.

-

As other modules are case sensitive, this may lead to information - disclosure; for example if one configured php to handle files - ending on ".php", an attacker will get the php source with - http://example.com/~user/file.PHP

-
-
-

lighttpd 1.4.19 does not always release a header if it triggered - a 400 (Bad Request) due to a duplicate header.

-
- - - - 31434 - CVE-2008-4298 - CVE-2008-4359 - CVE-2008-4360 - http://www.lighttpd.net/security/lighttpd_sa_2008_05.txt - http://www.lighttpd.net/security/lighttpd_sa_2008_06.txt - http://www.lighttpd.net/security/lighttpd_sa_2008_07.txt - - - 2008-09-26 - 2008-09-27 - 2009-02-22 - - - - - bitlbee -- account recreation security issues - - - bitlbee - 1.2.3 - - - - -

Secunia reports:

-
-

Some security issues have been reported in BitlBee, which can - be exploited by malicious people to bypass certain security - restrictions and hijack accounts.

-

The security issues are caused due to unspecified errors, which - can be exploited to overwrite existing accounts.

-
- - - - CVE-2008-3920 - CVE-2008-3969 - http://secunia.com/advisories/31633/ - - - 2008-08-27 - 2008-09-26 - 2008-10-03 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 2.0.0.17,1 - 3.*,13.0.2,1 - - - linux-firefox - linux-firefox-devel - 2.0.0.17 - - - seamonkey - linux-seamonkey - 1.1.12 - - - thunderbird - linux-thunderbird - 2.0.0.17 - - - flock - linux-flock - 2.0 - - - linux-seamonkey-devel - 0 - - - - -

The Mozilla Foundation reports:

-
-

MFSA 2008-37
UTF-8 URL stack buffer overflow

-

MFSA 2008-38
nsXMLDocument::OnChannelRedirect() same-origin - violation

-

MFSA 2008-39
Privilege escalation using feed preview page and - XSS flaw

-

MFSA 2008-40
Forced mouse drag

-

MFSA 2008-41
Privilege escalation via XPCnativeWrapper - pollution

-

MFSA 2008-42
Crashes with evidence of memory corruption - (rv:1.9.0.2/1.8.1.17)

-

MFSA 2008-43
BOM characters stripped from JavaScript before - execution

-

MFSA 2008-44
resource: traversal vulnerabilities

-

MFSA 2008-45
XBM image uninitialized memory reading

-
- - - - CVE-2008-0016 - CVE-2008-3835 - CVE-2008-3836 - CVE-2008-3837 - CVE-2008-4058 - CVE-2008-4059 - CVE-2008-4060 - CVE-2008-4061 - CVE-2008-4062 - CVE-2008-4063 - CVE-2008-4064 - CVE-2008-4065 - CVE-2008-4067 - CVE-2008-4068 - CVE-2008-4069 - http://www.mozilla.org/security/announce/2008/mfsa2008-37.html - http://www.mozilla.org/security/announce/2008/mfsa2008-38.html - http://www.mozilla.org/security/announce/2008/mfsa2008-39.html - http://www.mozilla.org/security/announce/2008/mfsa2008-40.html - http://www.mozilla.org/security/announce/2008/mfsa2008-41.html - http://www.mozilla.org/security/announce/2008/mfsa2008-42.html - http://www.mozilla.org/security/announce/2008/mfsa2008-43.html - http://www.mozilla.org/security/announce/2008/mfsa2008-44.html - http://www.mozilla.org/security/announce/2008/mfsa2008-45.html - - - 2008-09-24 - 2008-09-24 - 2009-12-12 - - - - - squirrelmail -- Session hijacking vulnerability - - - squirrelmail - 1.4.15_1 - - - - -

Hanno Boeck reports:

-
-

When configuring a web application to use only ssl (e.g. by - forwarding all http-requests to https), a user would expect that - sniffing and hijacking the session is impossible.

-

Though, for this to be secure, one needs to set the session - cookie to have the secure flag. Otherwise the cookie will be - transferred through HTTP if the victim's browser does a single - HTTP request on the same domain.

-

Squirrelmail does not set that flag. It is fixed in the 1.5 - test versions, but current 1.4.15 is vulnerable.

-
- - - - 31321 - CVE-2008-3663 - http://seclists.org/bugtraq/2008/Sep/0239.html - - - 2008-08-12 - 2008-09-23 - - - - - proftpd -- Long Command Processing Vulnerability - - - proftpd - proftpd-mysql - 1.3.2rc2 - - - proftpd-devel - 1.3.20080922 - - - - -

Secunia reports:

-
-

The vulnerability is caused due to the application truncating an - overly long FTP command, and improperly interpreting the remainder - string as a new FTP command. This can be exploited to execute - arbitrary FTP commands with the privileges of another user by e.g. - tricking the user into following malicious link.

-
- - - - CVE-2008-4242 - CVE-2008-4247 - http://secunia.com/advisories/31930/ - http://bugs.proftpd.org/show_bug.cgi?id=3115 - - - 2008-09-22 - 2008-09-23 - 2010-05-12 - - - - - phpmyadmin -- Cross-Site Scripting Vulnerability - - - phpMyAdmin - 2.11.9.2 - - - - -

Secunia reports:

-
-

An error exists in the "PMA_escapeJsString()" function in - libraries/js_escape.lib.php, which can be exploited to bypass - certain filters and execute arbitrary HTML and script code in a - user's browser session in context of an affected site when e.g. - Microsoft Internet Explorer is used.

-
- - - - http://secunia.com/Advisories/31974/ - http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-8 - - - 2008-09-23 - 2008-09-23 - 2008-10-03 - - - - - gallery -- multiple vulnerabilities - - - gallery - 1.5.9 - - - gallery2 - 2.2.6 - - - - -

Secunia reports:

-
-

An error in the handing of ZIP archives with symbolic links can be - exploited to disclose the contents of arbitrary files.

-
-
-

Input from uploaded Flash animations is not properly sanitised - before being used. This can be exploited to insert arbitrary HTML and - script code, which is executed in a user's browser session in context - of an affected site when the malicious data is viewed.

-
- - - - http://secunia.com/advisories/31912/ - http://secunia.com/advisories/31858/ - - - 2008-09-18 - 2008-09-19 - 2008-10-03 - - - - - phpmyadmin -- Code execution vulnerability - - - phpMyAdmin - 2.11.9.1 - - - - -

A phpMyAdmin security announcement:

-
-

The server_databases.php script was vulnerable to an attack coming - from a user who is already logged-on to phpMyAdmin, where he can - execute shell code (if the PHP configuration permits commands like - exec).

-
- - - - CVE-2008-4096 - http://secunia.com/Advisories/31884/ - http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-7 - - - 2008-09-15 - 2008-09-17 - 2010-05-12 - - - - - twiki -- Arbitrary code execution in session files - - - twiki - 4.2.3 - - - - -

Th1nk3r reports:

-
-

The version of TWiki installed on the remote host allows access to - the 'configure' script and fails to sanitize the 'image' parameter - of that script of directory traversal sequences before returning the - file contents when the 'action' parameter is set to 'image'. An - unauthenticated attacker can leverage this issue to view arbitrary - files on the remote host subject to the privileges of the web server - user id. .

-
- - - - CVE-2008-3195 - http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2008-3195 - http://www.kb.cert.org/vuls/id/362012 - https://inspectit.accessitgroup.com/threats/details.cgi?id=34031 - http://www.nessus.org/plugins/index.php?view=single&id=34031 - - - 2008-08-05 - 2008-09-14 - - - - - neon -- NULL pointer dereference in Digest domain support - - - neon28 - 0.28.3 - - - - -

Joe Orton reports:

-
-

A NULL pointer deference in the Digest authentication support in - neon versions 0.28.0 through 0.28.2 inclusive allows a malicious - server to crash a client application, resulting in possible denial - of service.

-
- - - - 30710 - CVE-2008-3746 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=476571 - http://lists.manyfish.co.uk/pipermail/neon/2008-August/000040.html - - - 2008-08-15 - 2008-09-12 - - - - - clamav -- CHM Processing Denial of Service - - - clamav - 0.94 - - - clamav-devel - 20080902 - - - - -

Hanno Boeck reports:

-
-

A fuzzing test showed weakness in the chm parser of - clamav, which can possibly be exploited. The clamav - team has disabled the chm module in older versions - though freshclam updates and has released 0.94 with - a fixed parser.

-
- - - - CVE-2008-1389 - https://wwws.clamav.net/bugzilla/show_bug.cgi?id=1089 - - - 2008-07-09 - 2008-09-12 - - - - - horde -- multiple vulnerabilities - - - horde-base - 3.2.2 - - - - -

Secunia reports:

-
-

Some vulnerabilities have been reported in various Horde products, - which can be exploited by malicious people to conduct script insertion - attacks

-

Input via MIME attachment linking is not properly sanitised in the - MIME library before being used. This can be exploited to execute - arbitrary HTML and script code in a user's browser session if e.g. a - malicious email is viewed.

-

Certain unspecified input in HTML messages is not properly - sanitised before being used. This can be exploited to execute - arbitrary HTML and script in a user's browser session if e.g. a - malicious HTML email is viewed.

-
- - - - CVE-2008-3823 - CVE-2008-3824 - http://lists.horde.org/archives/announce/2008/000429.html - http://secunia.com/advisories/31842/ - - - 2008-09-10 - 2008-09-11 - 2008-10-03 - - - - - python -- multiple vulnerabilities - - - python24 - 2.4.5_2 - - - python25 - 2.5.2_3 - - - python23 - 0 - - - - -

Secunia reports:

-
-

Some vulnerabilities have been reported in Python, where some have - unknown impact and others can potentially be exploited by malicious - people to cause a DoS (Denial of Service) or to compromise a - vulnerable system.

-

Various integer overflow errors exist in core modules e.g. - stringobject, unicodeobject, bufferobject, longobject, tupleobject, - stropmodule, gcmodule, mmapmodule.

-

An integer overflow in the hashlib module can lead to an unreliable - cryptographic digest results.

-

Integer overflow errors in the processing of unicode strings can be - exploited to cause buffer overflows on 32-bit systems.

-

An integer overflow exists in the PyOS_vsnprintf() function on - architectures that do not have a "vsnprintf()" function.

-

An integer underflow error in the PyOS_vsnprintf() function when - passing zero-length strings can lead to memory corruption.

-
- - - - CVE-2008-2315 - CVE-2008-2316 - CVE-2008-3142 - CVE-2008-3144 - http://bugs.python.org/issue2620 - http://bugs.python.org/issue2588 - http://bugs.python.org/issue2589 - http://secunia.com/advisories/31305 - http://mail.python.org/pipermail/python-checkins/2008-July/072276.html - http://mail.python.org/pipermail/python-checkins/2008-July/072174.html - http://mail.python.org/pipermail/python-checkins/2008-June/070481.html - - - 2008-08-04 - 2008-09-10 - - - - - mysql -- MyISAM table privileges security bypass vulnerability - - - mysql-server - 6.06.0.5 - 5.15.1.24 - 5.05.0.67 - 4.14.1.22_1 - - - - -

SecurityFocus reports:

-
-

MySQL is prone to a security-bypass vulnerability. - An attacker can exploit this issue to overwrite existing - table files in the MySQL data directory, bypassing certain - security restrictions.

-
- - - - 29106 - CVE-2008-2079 - - - 2008-05-05 - 2008-09-10 - 2008-10-10 - - - - - rubygem-rails -- SQL injection vulnerability - - - rubygem-rails - 2.2.2 - - - - -

Jonathan Weiss reports, that it is possible - to perform an SQL injection in Rails applications - via not correctly sanitized :limit and :offset - parameters. It is possible to change arbitrary - values in affected tables or gain access to the - sensitive data.

- - - - CVE-2008-4094 - http://blog.innerewut.de/2008/6/16/why-you-should-upgrade-to-rails-2-1 - - - 2008-09-08 - 2008-09-10 - 2010-05-12 - - - - - wordpress -- remote privilege escalation - - - wordpress - de-wordpress - wordpress-mu - 2.6.2 - - - zh-wordpress - 0 - - - - -

The Wordpress development team reports:

-
-

With open registration enabled, it is possible in WordPress - versions 2.6.1 and earlier to craft a username such that it - will allow resetting another users password to a randomly - generated password. The randomly generated password is not - disclosed to the attacker, so this problem by itself is annoying - but not a security exploit. However, this attack coupled with a - weakness in the random number seeding in mt_rand() could be used - to predict the randomly generated password.

-
- - - - 31068 - CVE-2008-4107 - http://wordpress.org/development/2008/09/wordpress-262/ - - - 2008-09-08 - 2008-10-22 - 2010-05-12 - - - - - FreeBSD -- Remote kernel panics on IPv6 connections - - - FreeBSD - 6.36.3_4 - 7.07.0_4 - - - - -

Problem Description:

-

In case of an incoming ICMPv6 'Packet Too Big Message', there - is an insufficient check on the proposed new MTU for a path to - the destination.

-

Impact:

-

When the kernel is configured to process IPv6 packets and has - active IPv6 TCP sockets, a specifically crafted ICMPv6 'Packet - Too Big Message' could cause the TCP stack of the kernel to - panic.

-

Workaround:

-

Systems without INET6 / IPv6 support are not vulnerable and - neither are systems which do not listen on any IPv6 TCP sockets - and have no active IPv6 connections.

-

Filter ICMPv6 'Packet Too Big Messages' using a firewall, but - this will at the same time break PMTU support for IPv6 - connections.

- - - - CVE-2008-3530 - SA-08:09.icmp6 - - - 2008-09-03 - 2008-09-05 - 2016-08-09 - - - - - FreeBSD -- nmount(2) local arbitrary code execution - - - FreeBSD - 6.36.3_4 - 7.07.0_4 - - - - -

Problem Description:

-

Various user defined input such as mount points, devices, and - mount options are prepared and passed as arguments to - nmount(2) into the kernel. Under certain error conditions, - user defined data will be copied into a stack allocated buffer - stored in the kernel without sufficient bounds checking.

-

Impact:

-

If the system is configured to allow unprivileged users to - mount file systems, it is possible for a local adversary to - exploit this vulnerability and execute code in the context of - the kernel.

-

Workaround:

-

It is possible to work around this issue by allowing only - privileged users to mount file systems by running the - following sysctl(8) command:

- 
# sysctl vfs.usermount=0
- - - - CVE-2008-3531 - SA-08:08.nmount - - - 2008-09-03 - 2008-09-05 - 2016-08-09 - - - - - FreeBSD -- amd64 swapgs local privilege escalation - - - FreeBSD - 6.36.3_4 - 7.07.0_4 - - - - -

Problem Description:

-

If a General Protection Fault happens on a FreeBSD/amd64 - system while it is returning from an interrupt, trap or - system call, the swapgs CPU instruction may be called one - extra time when it should not resulting in userland and - kernel state being mixed.

-

Impact:

-

A local attacker can by causing a General Protection Fault - while the kernel is returning from an interrupt, trap or - system call while manipulating stack frames and, run - arbitrary code with kernel privileges.

-

The vulnerability can be used to gain kernel / supervisor - privilege. This can for example be used by normal users to - gain root privileges, to break out of jails, or bypass - Mandatory Access Control (MAC) restrictions.

-

Workaround:

-

No workaround is available, but only systems running the 64 - bit FreeBSD/amd64 kernels are vulnerable.

-

Systems with 64 bit capable CPUs, but running the 32 bit - FreeBSD/i386 kernel are not vulnerable.

- - - - CVE-2008-3890 - SA-08:07.amd64 - - - 2008-09-03 - 2008-09-05 - 2016-08-09 - - - - - opera -- multiple vulnerabilities - - - opera - linux-opera - 9.52 - - - - -

The Opera Team reports:

-
-

Scripts are able to change the addresses of framed pages that - come from the same site. Due to a flaw in the way that Opera checks - what frames can be changed, a site can change the address of frames - on other sites inside any window that it has opened. This allows - sites to open pages from other sites, and display misleading - information on them.

-
-
-

Custom shortcut and menu commands can be used to activate external - applications. In some cases, the parameters passed to these - applications are not prepared correctly, and may be created from - uninitialized memory. These may be misinterpreted as additional - parameters, and depending on the application, this could allow - execution of arbitrary code.

-

Successful exploitation requires convincing the user to modify - their shortcuts or menu files appropriately, pointing to an - appropriate target application, then to activate that shortcut at - an appropriate time. To inject code, additional means will have to - be employed.

-
-
-

When insecure pages load content from secure sites into a frame, - they can cause Opera to incorrectly report the insecure site as - being secure. The padlock icon will incorrectly be shown, and the - security information dialog will state that the connection is - secure, but without any certificate information.

-
-
-

As a security precaution, Opera does not allow Web pages to - link to files on the user's local disk. However, a flaw exists - that allows Web pages to link to feed source files on the - user's computer. Suitable detection of JavaScript events and - appropriate manipulation can unreliably allow a script to - detect the difference between successful and unsuccessful - subscriptions to these files, to allow it to discover if the - file exists or not. In most cases the attempt will fail.

-
-
-

It has been reported that when a user subscribes to a news - feed using the feed subscription button, the page address - can be changed. This causes the address field not to update - correctly. Although this can mean that misleading - information can be displayed in the address field, it can - only leave the attacking page's address in the address bar, - not a trusted third party address.

-
- - - - CVE-2008-4195 - CVE-2008-4197 - CVE-2008-4198 - CVE-2008-4200 - http://www.opera.com/support/search/view/893/ - http://www.opera.com/support/search/view/894/ - http://www.opera.com/support/search/view/895/ - http://www.opera.com/support/search/view/896/ - http://www.opera.com/support/search/view/897/ - - - 2008-08-20 - 2008-08-25 - 2010-05-12 - - - - - gnutls -- "gnutls_handshake()" Denial of Service - - - gnutls - 2.3.52.4.1 - - - - -

Secunia reports:

-
-

A vulnerability has been reported in GnuTLS, which can - potentially be exploited by malicious people to cause a DoS - (Denial of Service).

-

The vulnerability is caused due to a use-after-free error when an - application calls "gnutls_handshake()" for an already valid session - and can potentially be exploited, e.g. during re-handshakes.

-
- - - - CVE-2008-2377 - http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/2947 - http://secunia.com/advisories/31505/ - - - 2008-08-15 - 2008-08-21 - - - - - joomla -- flaw in the reset token validation - - - joomla15 - 1.5.6 - - - - -

Joomla project reports:

-
-

A flaw in the reset token validation mechanism allows - for non-validating tokens to be forged. This will allow - an unauthenticated, unauthorized user to reset the password - of the first enabled user (lowest id). Typically, this is - an administrator user. Note, that changing the first users - username may lessen the impact of this exploit (since the - person who changed the password does not know the login - associated with the new password). However, the only way - to completely rectify the issue is to upgrade to 1.5.6 - (or patch the /components/com_user/models/reset.php file).

-
- - - - CVE-2008-3681 - - - 2008-08-14 - 2008-08-20 - 2008-08-20 - - - - - cdf3 -- Buffer overflow vulnerability - - - cdf3 - 3.2.1 - - - - -

NASA Goddard Space Flight Center reports:

-
-

The libraries for the scientific data file format, Common Data - Format (CDF) version 3.2 and earlier, have the potential for a - buffer overflow vulnerability when reading specially-crafted - (invalid) CDF files. If successful, this could trigger execution - of arbitrary code within the context of the CDF-reading program - that could be exploited to compromise a system, or otherwise - crash the program. While it's unlikely that you would open CDFs - from untrusted sources, we recommend everyone upgrade to the - latest CDF libraries on their systems, including the IDL and - Matlab plugins. Most worrisome is any service that enables the - general public to submit CDF files for processing.

-

The vulnerability is in the CDF library routines not properly - checking the length tags on a CDF file before copying data to a - stack buffer. Exploitation requires the user to explicitly open - a specially-crafted file. CDF users should not open files from - untrusted third parties until the patch is applied (and continue - then to exercise normal caution for files from untrusted third - parties).

-
- - - - CVE-2008-2080 - http://cdf.gsfc.nasa.gov/CDF32_buffer_overflow.html - - - 2008-05-15 - 2008-08-19 - 2010-05-12 - - - - - drupal -- multiple vulnerabilities - - - drupal5 - 5.10 - - - drupal6 - 6.4 - - - - -

The Drupal Project reports:

-
-

A bug in the output filter employed by Drupal makes it possible - for malicious users to insert script code into pages (cross site - scripting or XSS). A bug in the private filesystem trusts the MIME - type sent by the browser, enabling malicious users with the ability - to upload files to execute cross site scripting attacks.

-

The BlogAPI module does not validate the extension of uploaded - files, enabling users with the "administer content with blog api" - permission to upload harmful files. This bug affects both Drupal - 5.x and 6.x.

-

Drupal forms contain a token to protect against cross site - request forgeries (CSRF). The token may not be validated properly - for cached forms and forms containing AHAH elements. This bug - affects Drupal 6.x.

-

User access rules can be added or deleted upon accessing a - properly formatted URL, making such modifications vulnerable to - cross site request forgeries (CSRF). This may lead to unintended - addition or deletion of an access rule when a sufficiently - privileged user visits a page or site created by a malicious - person. This bug affects both Drupal 5.x and 6.x.

-

The Upload module in Drupal 6 contains privilege escalation - vulnerabilities for users with the "upload files" permission. This - can lead to users being able to edit nodes which they are normally - not allowed to, delete any file to which the webserver has - sufficient rights, and download attachments of nodes to which they - have no access. Harmful files may also be uploaded via cross site - request forgeries (CSRF). These bugs affect Drupal 6.x.

-
- - - - CVE-2008-3740 - CVE-2008-3741 - CVE-2008-3742 - CVE-2008-3743 - CVE-2008-3744 - CVE-2008-3745 - http://secunia.com/advisories/31462/ - - - 2008-08-13 - 2008-08-18 - 2010-05-12 - - - - - ruby -- multiple vulnerabilities in safe level - - - ruby - ruby+pthreads - ruby+pthreads+oniguruma - ruby+oniguruma - 1.8.*,11.8.6.287,1 - 1.9.*,11.9.1.0,1 - - - - -

The official ruby site reports:

-
-

Several vulnerabilities in safe level have been discovereds:.

-
    -
  • untrace_var is permitted at safe level 4;
    • -
  • $PROGRAM_NAME may be modified at safe level 4;
    • -
  • insecure methods may be called at safe level 1-3;
    • -
  • syslog operations are permitted at safe level 4;
    • -
  • dl doesn't check taintness, so it could allow attackers - to call dangerous functions.
    • -
-
- - - - CVE-2008-3655 - CVE-2008-3656 - CVE-2008-3905 - http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/ - - - 2008-08-08 - 2008-08-16 - 2010-05-12 - - - - - ruby -- DoS vulnerability in WEBrick - - - ruby - ruby+pthreads - ruby+pthreads+oniguruma - ruby+oniguruma - 1.8.*,11.8.6.111_5,1 - 1.9.*,11.9.1.0,1 - - - - -

The official ruby site reports:

-
-

WEBrick::HTTP::DefaultFileHandler is faulty of exponential time - taking requests due to a backtracking regular expression in - WEBrick::HTTPUtils.split_header_value.

-
- - - - CVE-2008-3655 - CVE-2008-3656 - CVE-2008-3905 - http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/ - - - 2008-08-08 - 2008-08-16 - 2010-05-12 - - - - - ruby -- DNS spoofing vulnerability - - - ruby - ruby+pthreads - ruby+pthreads+oniguruma - ruby+oniguruma - 1.8.*,11.8.6.111_5,1 - 1.9.*,11.9.1.0,1 - - - - -

The official ruby site reports:

-
-

resolv.rb allow remote attackers to spoof DNS answers. This risk - can be reduced by randomness of DNS transaction IDs and source - ports.

-
- - - - CVE-2008-1447 - http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/ - - - 2008-08-08 - 2008-08-16 - 2009-02-09 - - - - - Bugzilla -- Directory Traversal in importxml.pl - - - bugzilla - ja-bugzilla - 2.22.12.22.4 - 3.*3.0.4 - - - - -

A Bugzilla Security Advisory reports:

-
-

When importing bugs using importxml.pl, the --attach_path - option can be specified, pointing to the directory where - attachments to import are stored. If the XML file being - read by importxml.pl contains a malicious

- 
../relative_path/to/local_file
-

node, the script follows this relative path and attaches the - local file pointed by it to the bug, making the file public. - The security fix makes sure the relative path is always - ignored.

-
- - - - CVE-2008-4437 - https://bugzilla.mozilla.org/show_bug.cgi?id=437169 - - - 2008-06-03 - 2008-08-15 - 2010-05-12 - - - - - openvpn-devel -- arbitrary code execution - - - openvpn-devel - 2.1.b142.1.r9 - - - - -

James Yonan reports:

-
-

Security Fix - affects non-Windows OpenVPN clients running - OpenVPN 2.1-beta14 through 2.1-rc8 (OpenVPN 2.0.x clients are NOT - vulnerable nor are any versions of the OpenVPN server - vulnerable).

-

An OpenVPN client connecting to a malicious or compromised server - could potentially receive an "lladdr" or "iproute" configuration - directive from the server which could cause arbitrary code execution - on the client. A successful attack requires that (a) the client has - agreed to allow the server to push configuration directives to it by - including "pull" or the macro "client" in its configuration file, - (b) the client succesfully authenticates the server, (c) the server - is malicious or has been compromised and is under the control of the - attacker, and (d) the client is running a non-Windows OS.

-
- - - - CVE-2008-3459 - http://openvpn.net/index.php/documentation/change-log/changelog-21.html - - - 2008-07-31 - 2008-08-07 - - - - - phpmyadmin -- cross site request forgery vulnerabilities - - - phpMyAdmin - 2.11.7.1 - - - - -

A phpMyAdmin security announcement:

-
-

A logged-in user, if abused into clicking a crafted link or loading - an attack page, would create a database he did not intend to, or would - change his connection character set.

-
- - - - http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-5 - http://secunia.com/advisories/31115/ - - - 2008-07-15 - 2008-07-18 - 2008-09-17 - - - - - drupal -- multiple vulnerabilities - - - drupal5 - 5.8 - - - drupal6 - 6.3 - - - - -

The Drupal Project reports:

-
-

Free tagging taxonomy terms can be used to insert arbitrary script - and HTML code (cross site scripting or XSS) on node preview pages. A - successful exploit requires that the victim selects a term containing - script code and chooses to preview the node. This issue affects Drupal - 6.x only. Some values from OpenID providers are output without being - properly escaped, allowing malicious providers to insert arbitrary script - and HTML code (XSS) into user pages. This issue affects Drupal 6.x only. - filter_xss_admin() has been hardened to prevent use of the object HTML - tag in administrator input.

-

Translated strings (5.x, 6.x) and OpenID identities (6.x) are - immediately deleted upon accessing a properly formatted URL, making - such deletion vulnerable to cross site request forgeries (CSRF). This - may lead to unintended deletion of translated strings or OpenID - identities when a sufficiently privileged user visits a page or site - created by a malicious person.

-

When contributed modules such as Workflow NG terminate the current - request during a login event, user module is not able to regenerate - the user's session. This may lead to a session fixation attack, when a - malicious user is able to control another users' initial session ID. - As the session is not regenerated, the malicious user may use the - 'fixed' session ID after the victim authenticates and will have the - same access. This issue affects both Drupal 5 and Drupal 6.

-

Schema API uses an inappropriate placeholder for 'numeric' fields - enabling SQL injection when user-supplied data is used for such - fields.This issue affects Drupal 6 only.

-
- - - - CVE-2008-3218 - CVE-2008-3221 - http://drupal.org/node/280571 - http://secunia.com/advisories/31028/ - - - 2008-07-09 - 2008-07-13 - 2010-05-12 - - - - - FreeBSD -- DNS cache poisoning - - - FreeBSD - 6.36.3_3 - 7.07.0_3 - - - - -

Problem Description:

-

The BIND DNS implementation does not randomize the UDP source - port when doing remote queries, and the query id alone does - not provide adequate randomization.

-

Impact:

-

The lack of source port randomization reduces the amount of - data the attacker needs to guess in order to successfully - execute a DNS cache poisoning attack. This allows the - attacker to influence or control the results of DNS queries - being returned to users from target systems.

-

Workaround:

-

Limiting the group of machines that can do recursive queries - on the DNS server will make it more difficult, but not - impossible, for this vulnerability to be exploited.

-

To limit the machines able to perform recursive queries, add an ACL in - named.conf and limit recursion like the following:

- 
acl example-acl {
- 
   192.0.2.0/24;
- 
};
- 
options {
- 
	recursion yes;
- 
	allow-recursion { example-acl; };
- 
};
- - - - 800113 - CVE-2008-1447 - SA-08:06.bind - - - 2008-07-08 - 2008-07-13 - 2016-08-09 - - - - - poppler -- uninitialized pointer - - - poppler - 0.8.4_2 - - - - -

Felipe Andres Manzano reports:

-
-

The libpoppler pdf rendering library, can free - uninitialized pointers, leading to arbitrary code - execution. This vulnerability results from memory - management bugs in the Page class constructor/destructor.

-
- - - - CVE-2008-2950 - http://milw0rm.com/exploits/6032 - - - 2008-07-07 - 2008-07-09 - - - - - py-pylons -- Path traversal bug - - - py24-pylons - 0.9.6.2 - - - - -

Pylons team reports:

-
-

The error.py controller uses paste.fileapp to serve the static - resources to the browser. The default error.py controller uses - os.path.join to combine the id from Routes with the media path. - Routes prior to 1.8 double unquoted the PATH_INFO, resulting in - FileApp returning files from the filesystem that can be outside - of the intended media path directory.

-

An attacker can craft URL's which utilize the double escaping - to pass in a name to the error.py controller which contains a - leading slash thus escaping the intended media path and serving - files from any location on the filesystem that the Pylons - application has access to.

-
- - - - http://wiki.pylonshq.com/display/pylonsdocs/0.9.6.2 - - - 2008-05-28 - 2008-07-04 - - - - - FreeType 2 -- Multiple Vulnerabilities - - - freetype2 - 2.3.6 - - - - -

Secunia reports:

-
-
    -
  • An integer overflow error exists in the processing of PFB font - files. This can be exploited to cause a heap-based buffer overflow - via a PFB file containing a specially crafted "Private" dictionary - table.
    • -
  • An error in the processing of PFB font files can be exploited - to trigger the "free()" of memory areas that are not allocated on - the heap.
    • -
  • An off-by-one error exists in the processing of PFB font files. - This can be exploited to cause a one-byte heap-based buffer - overflow via a specially crafted PFB file.
    • -
  • An off-by-one error exists in the implementation of the "SHC" - instruction while processing TTF files. This can be exploited to - cause a one-byte heap-based buffer overflow via a specially crafted - TTF file.
    • -
-

Successful exploitation of the vulnerabilities may allow execution - of arbitrary code.

-
- - - - 29637 - 29639 - 29640 - 29641 - CVE-2008-1806 - CVE-2008-1807 - CVE-2008-1808 - http://secunia.com/advisories/30600 - http://sourceforge.net/project/shownotes.php?release_id=605780 - - - 2008-06-10 - 2008-07-03 - - - - - fetchmail -- potential crash in -v -v verbose mode (revised patch) - - - fetchmail - 6.3.8_7 - - - - -

Matthias Andree reports:

-
-

2008-06-24 1.2 also fixed issue in report_complete (reported by - Petr Uzel)

-
- - - - CVE-2008-2711 - http://www.fetchmail.info/fetchmail-SA-2008-01.txt - - - 2008-06-24 - 2008-07-01 - - - - - phpmyadmin -- Cross Site Scripting Vulnerabilities - - - phpMyAdmin - 2.11.7 - - - - -

Secunia report:

-
-

Some vulnerabilities have been reported in phpMyAdmin, which can be - exploited by malicious people to conduct cross-site scripting - attacks.

-

Input passed via unspecified parameters to files in /libraries is not - properly sanitised before being returned to the user. This can be - exploited to execute arbitrary HTML and script code in a user's - browser session in context of an affected site.

-

Successful exploitation requires that "register_globals" is enabled - and support for ".htaccess" files is disabled.

-
- - - - CVE-2008-2960 - http://secunia.com/advisories/30813/ - http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-4 - - - 2008-06-23 - 2008-06-28 - 2010-05-12 - - - - - apache -- multiple vulnerabilities - - - apache - 2.2.02.2.9 - - - - -

Apache HTTP server project reports:

-
-

The following potential security flaws are addressed:

-
    -
  • CVE-2008-2364: mod_proxy_http: Better handling of excessive - interim responses from origin server to prevent potential denial of - service and high memory usage. Reported by Ryujiro Shibuya.
    • -
  • CVE-2007-6420: mod_proxy_balancer: Prevent CSRF attacks against - the balancer-manager interface
    • -
-
- - - - CVE-2007-6420 - CVE-2008-2364 - http://www.apache.org/dist/httpd/Announcement2.2.html - - - 2008-06-14 - 2008-06-24 - - - - - php -- input validation error in safe_mode - - - php5 - 5.2.6_2 - - - - -

According to Maksymilian Arciemowicz research, - it is possible to bypass security restrictions - of safe_mode in various - functions via directory traversal vulnerability. The attacker - can use this attack to gain access to sensitive - information. Functions utilizing - expand_filepath() may be affected.

-

It should be noted that this vulnerability is not - considered to be serious by the FreeBSD Security Team, - since safe_mode and open_basedir - are insecure by design and should not be relied upon.

- - - - CVE-2008-2665 - CVE-2008-2666 - 29797 - http://securityreason.com/achievement_securityalert/54 - - - 2008-06-17 - 2008-06-22 - 2008-09-04 - - - - - vim -- Vim Shell Command Injection Vulnerabilities - - - vim - vim-console - vim-lite - vim-ruby - vim6 - vim6-ruby - 66.4.10 - 77.1.315 - - - - -

Rdancer.org reports:

-
-

Improper quoting in some parts of Vim written in the Vim Script - can lead to arbitrary code execution upon opening a crafted - file.

-
- - - - CVE-2008-2712 - http://www.rdancer.org/vulnerablevim.html - - - 2008-06-16 - 2008-06-21 - - - - - ruby -- multiple integer and buffer overflow vulnerabilities - - - ruby - ruby+pthreads - ruby+pthreads+oniguruma - ruby+oniguruma - 1.8.*,11.8.6.111_3,1 - - - ruby_static - 1.8.*,1 - - - - -

The official ruby site reports:

-
-

Multiple vulnerabilities in Ruby may lead to a denial of service - (DoS) condition or allow execution of arbitrary code.

-
- - - - CVE-2008-2726 - http://www.ruby-lang.org/en/news/2008/06/20/arbitrary-code-execution-vulnerabilities/ - - - 2008-06-19 - 2008-06-21 - - - - - fetchmail -- potential crash in -v -v verbose mode - - - fetchmail - 6.3.8_6 - - - - -

Matthias Andree reports:

-
-

Gunter Nau reported fetchmail crashing on some messages; further - debugging by Petr Uzel and Petr Cerny at Novell/SUSE Czech Republic - dug up that this happened when fetchmail was trying to print, in - -v -v verbose level, headers exceeding 2048 bytes. In this - situation, fetchmail would resize the buffer and fill in further - parts of the message, but forget to reinitialize its va_list - typed source pointer, thus reading data from a garbage address found - on the stack at addresses above the function arguments the caller - passed in; usually that would be the caller's stack frame.

-
- - - - CVE-2008-2711 - http://www.fetchmail.info/fetchmail-SA-2008-01.txt - - - 2008-06-13 - 2008-06-20 - - - - - xorg -- multiple vulnerabilities - - - xorg-server - 1.4.2,1 - - - - -

Matthieu Herrb of X.Org reports:

-
-

Several vulnerabilities have been found in the server-side code - of some extensions in the X Window System. Improper validation of - client-provided data can cause data corruption.

-

Exploiting these overflows will crash the X server or, - under certain circumstances allow the execution of arbitray machine - code.

-

When the X server is running with root privileges (which is the case - for the Xorg server and for most kdrive based servers), these - vulnerabilities can thus also be used to raise privileges.

-

All these vulnerabilities, to be exploited successfully, require either - an already established connection to a running X server (and normally - running X servers are only accepting authenticated connections), or a - shell access with a valid user on the machine where the vulnerable - server is installed.

-
- - - - CVE-2008-1377 - CVE-2008-1379 - CVE-2008-2360 - CVE-2008-2361 - CVE-2008-2362 - http://lists.freedesktop.org/archives/xorg/2008-June/036026.html - http://secunia.com/advisories/30627/ - - - 2008-06-11 - 2008-06-15 - - - - - moinmoin -- superuser privilege escalation - - - moinmoin - 1.6.3 - - - - -

MoinMoin team reports:

-
-

A check in the userform processing was not working as expected and - could be abused for ACL and superuser privilege escalation.

-
- - - - CVE-2008-1937 - http://hg.moinmo.in/moin/1.6/rev/f405012e67af - - - 2008-04-20 - 2008-06-14 - 2008-06-15 - - - - - Courier Authentication Library -- SQL Injection - - - courier-authlib - 0.60.6 - - - - -

Secunia reports:

-
-

A vulnerability has been reported in the Courier Authentication - Library, which can be exploited by malicious people to conduct SQL - injection attacks.

-

Input passed via e.g. the username to the library is not properly - sanitised before being used in SQL queries. This can be exploited to - manipulate SQL queries by injecting arbitrary SQL code and e.g. - potentially bypass authentication.

-

Successful exploitation requires that a MySQL database is used for - authentication and that a Non-Latin character set is selected.

-
- - - - http://secunia.com/advisories/30591/ - - - 2008-06-10 - 2008-06-13 - - - - - ikiwiki -- cleartext passwords - - - ikiwiki - 2.48 - - - - -

The ikiwiki development team reports:

-
-

Until version 2.48, ikiwiki stored passwords in cleartext in - the userdb. That risks exposing all users' passwords if the file - is somehow exposed. To pre-emtively guard against that, current - versions of ikiwiki store password hashes (using Eksblowfish).

-
- - - - http://ikiwiki.info/security/#index32h2 - - - 2008-05-30 - 2008-06-01 - - - - - ikiwiki -- empty password security hole - - - ikiwiki - 1.342.47_1 - - - - -

The ikiwiki development team reports:

-
-

This hole allowed ikiwiki to accept logins using empty - passwords to openid accounts that didn't use a password.

-

Upgrading to a non-vulnerable ikiwiki version immediatly is - recommended if your wiki allows both password and openid - logins.

-
- - - - CVE-2008-0169 - http://ikiwiki.info/security/#index33h2 - - - 2008-05-30 - 2008-05-31 - 2010-05-12 - - - - - linux-flashplugin -- unspecified remote code execution vulnerability - - - linux-flashplugin - 9.0r124 - - - - -

Adobe Product Security Incident Response Team reports:

-
-

An exploit appears to be taking advantage of a known - vulnerability, reported by Mark Dowd of the ISS X-Force and wushi - of team509, that was resolved in Flash Player 9.0.124.0 - (CVE-2007-0071). This exploit does NOT appear to include a new, - unpatched vulnerability as has been reported elsewhere - customers - with Flash Player 9.0.124.0 should not be vulnerable to this - exploit.

-
- - - - 29386 - CVE-2007-0071 - http://blogs.adobe.com/psirt/ - - - 2008-05-27 - 2008-05-30 - - - - - Nagios -- Cross Site Scripting Vulnerability - - - nagios - 2.12 - 3.*3.0.2 - - - nagios-devel - 3.0.2 - - - - -

Secunia reports:

-
-

A vulnerability has been reported in Nagios, which can be - exploited by malicious people to conduct cross-site scripting - attacks.

-
- - - - 29140 - CVE-2007-5803 - http://secunia.com/advisories/30283 - - - 2008-05-20 - 2008-05-28 - 2008-09-08 - - - - - spamdyke -- open relay - - - spamdyke - 3.1.8 - - - - -

Spamdyke Team reports:

-
-

Fixed smtp_filter() to reject the DATA command if no valid - recipients have been specified. Otherwise, a specific scenario could - result in every spamdyke installation being used as an open relay. - If the remote server connects and gives one or more recipients that - are rejected (for relaying or blacklisting), then gives the DATA - command, spamdyke will ignore all other commands, assuming that - message data is being transmitted. However, because all of the - recipients were rejected, qmail will reject the DATA command. From - that point on, the remote server can give as many recipients as it - likes and spamdyke will ignore them all -- they will not be filtered - at all. After that, the remote server can give the DATA command and - send the actual message data. Because spamdyke is controlling - relaying, the RELAYCLIENT environment variable is set and qmail won't - check for relaying either. Thanks to Mirko Buffoni for reporting - this one.

-
- - - - CVE-2008-2784 - http://www.spamdyke.org/documentation/Changelog.txt - - - 2008-05-21 - 2008-05-27 - 2010-05-12 - - - - - peercast -- arbitrary code execution - - - peercast - 0 - - - - -

Nico Golde discovered that PeerCast, a P2P audio and - video streaming server, is vulnerable to a buffer overflow - in the HTTP Basic Authentication code, allowing a remote - attacker to crash PeerCast or execure arbitrary code.

- - - - 28986 - CVE-2008-2040 - http://secunia.com/advisories/30020 - - - 2008-05-20 - 2008-05-21 - - - - - libvorbis -- various security issues - - - libvorbis - 1.2.0_2,3 - - - - -

Red Hat reports:

-
-

Will Drewry of the Google Security Team reported several - flaws in the way libvorbis processed audio data. An - attacker could create a carefully crafted [Vorbis] audio file - in such a way that it could cause an application linked - with libvorbis to crash, or execute arbitrary code when - it was opened.

-
- - - - CVE-2008-1419 - CVE-2008-1420 - CVE-2008-1423 - https://rhn.redhat.com/errata/RHSA-2008-0270.html - - - 2008-05-14 - 2008-05-17 - - - - - django -- XSS vulnerability - - - py23-django - py24-django - py25-django - 0.96.2 - - - py23-django-devel - py24-django-devel - py25-django-devel - 20080511 - - - - -

Django project reports:

-
-

The Django administration application will, when accessed by - a user who is not sufficiently authenticated, display a login - form and ask the user to provide the necessary credentials - before displaying the requested page. This form will be submitted - to the URL the user attempted to access, by supplying the current - request path as the value of the form's "action" attribute.

-

The value of the request path was not being escaped, creating an - opportunity for a cross-site scripting (XSS) attack by leading a - user to a URL which contained URL-encoded HTML and/or JavaScript - in the request path.

-
- - - - CVE-2008-2302 - http://www.djangoproject.com/weblog/2008/may/14/security/ - - - 2008-05-10 - 2008-05-14 - 2010-05-12 - - - - - vorbis-tools -- Speex header processing vulnerability - - - vorbis-tools - 1.2.0_2,3 - - - - -

Secunia reports:

-
-

A vulnerability has been reported in vorbis-tools, - which can potentially be exploited by malicious people - to compromise a user's system.

-

The vulnerability is caused due to an input validation - error when processing Speex headers, which can be - exploited via a specially crafted Speex stream containing - a negative "modeID" field in the header.

-

Successful exploitation may allow execution of arbitrary - code.

-
- - - - CVE-2008-1686 - http://secunia.com/advisories/29882/ - - - 2008-04-18 - 2008-05-11 - - - - - qemu -- "drive_init()" Disk Format Security Bypass - - - qemu - qemu-devel - 0.9.1_6 - 0.9.1s.20070101*0.9.1s.20080302_6 - - - - -

Secunia reports:

-
-

A vulnerability has been reported in QEMU, which can be exploited - by malicious, local users to bypass certain security - restrictions.

-

The vulnerability is caused due to the "drive_init()" function - in vl.c determining the format of a disk from data contained in - the disk's header. This can be exploited by a malicious user in - a guest system to e.g. read arbitrary files on the host by - writing a fake header to a raw formatted disk image.

-
- - - - CVE-2008-2004 - http://secunia.com/advisories/30111/ - http://lists.gnu.org/archive/html/qemu-devel/2008-04/msg00675.html - - - 2008-04-28 - 2008-05-08 - - - - - swfdec -- exposure of sensitive information - - - swfdec - 0.6.4 - - - - -

Secunia reports:

-
-

A vulnerability has been reported in swfdec, which can be - exploited by malicious people to disclose sensitive - information.

-

The vulnerability is caused due to swfdec not properly - restricting untrusted sandboxes from reading local files, - which can be exploited to disclose the content of arbitrary - local files by e.g. tricking a user into visiting a malicious - website.

-
- - - - CVE-2008-1834 - http://secunia.com/advisories/29915 - - - 2008-04-09 - 2008-05-07 - - - - - mt-daapd -- integer overflow - - - mt-daapd - 0.2.4.2 - - - - -

FrSIRT reports:

-
-

A vulnerability has been identified in mt-daapd which could be exploited - by remote attackers to cause a denial of service or compromise an - affected system. This issue is caused by a buffer overflow error in the - ws_getpostvars() function when processing a negative Content-Length: - header value, which could be exploited by remote unauthenticated - attackers to crash an affected application or execute arbitrary - code.

-
- - - - CVE-2008-1771 - http://secunia.com/advisories/29917 - http://www.frsirt.com/english/advisories/2008/1303 - - - 2008-04-21 - 2008-05-02 - - - - - sdl_image -- buffer overflow vulnerabilities - - - sdl_image - 1.2.6_1 - - - - -

Secunia reports:

-
-

Two vulnerabilities have been reported in SDL_image, which can be - exploited by malicious people to cause a Denial of Service or potentially - compromise an application using the library.

-

A boundary error within the LWZReadByte() function in IMG_gif.c can - be exploited to trigger the overflow of a static buffer via a - specially crafted GIF file.

-

A boundary error within the "IMG_LoadLBM_RW()" function in IMG_lbm.c - can be exploited to cause a heap-based buffer overflow via a specially - crafted IFF ILBM file.

-
- - - - CVE-2007-6697 - CVE-2008-0544 - http://secunia.com/advisories/28640 - - - 2008-01-24 - 2008-05-02 - - - - - gnupg -- memory corruption vulnerability - - - gnupg - 1.0.01.4.9 - 2.0.02.0.9 - - - - -

Secunia reports:

-
-

A vulnerability has been reported in GnuPG, which can potentially - be exploited to compromise a vulnerable system.

-

The vulnerability is caused due to an error when importing keys - with duplicated IDs. This can be exploited to cause a memory - corruption when importing keys via --refresh-keys or --import.

-

Successful exploitation potentially allows execution of arbitrary - code, but has not been proven yet.

-
- - - - 28487 - CVE-2008-1530 - http://www.ocert.org/advisories/ocert-2008-1.html - http://secunia.com/advisories/29568 - https://bugs.g10code.com/gnupg/issue894 - - - 2008-03-19 - 2008-04-26 - 2008-04-29 - - - - - extman -- password bypass vulnerability - - - extman - 0.2.40.2.4_1 - - - - -

Extmail team reports:

-
-

Emergency update #4 fixes a serious security vulnerability.

-
-

Successful exploit of this vulnerability would allow attacker to - change user's password without knowing it by using specifically - crafted HTTP request.

- - - - http://www.extmail.org/forum/thread-7260-1-1.html - - - 2008-04-01 - 2008-04-25 - - - - - mailman -- script insertion vulnerability - - - ja-mailman - mailman - mailman-with-htdig - 2.1.10 - - - - -

Secunia reports:

-
-

A vulnerability has been reported in Mailman, which can be - exploited by malicious users to conduct script insertion - attacks.

-

Certain input when editing the list templates and the list info - attribute is not properly sanitised before being stored. This can be - exploited to insert arbitrary HTML and script code, which is - executed in a user's browser session in context of an affected site - when the malicious website is accessed.

-
- - - - CVE-2008-0564 - 27630 - http://www.ubuntu.com/usn/usn-586-1 - http://secunia.com/advisories/28794 - http://sourceforge.net/project/shownotes.php?release_id=593924 - - - 2008-02-05 - 2008-04-25 - - - - - mksh -- TTY attachment privilege escalation - - - mksh - R33d - - - - -

Secunia reports:

-
-

The vulnerability is caused due to an error when attaching to a TTY - via the -T command line switch. This can be exploited to execute - arbitrary commands with the privileges of the user running mksh via - characters previously written to the attached virtual console.

-
- - - - CVE-2008-1845 - http://secunia.com/advisories/29803/ - http://www.mirbsd.org/mksh.htm#clog - - - 2008-04-14 - 2008-04-25 - - - - - serendipity -- multiple cross site scripting vulnerabilities - - - serendipity - 1.3.1 - - - serendipity-devel - 200804242342 - - - - -

Hanno Boeck reports:

-
-

The installer of serendipity 1.3 has various Cross Site Scripting - issues. This is considered low priority, as attack scenarios are - very unlikely.

-

Various path fields are not escaped properly, thus filling them - with javascript code will lead to XSS. MySQL error messages are not - escaped, thus the database host field can also be filled with - javascript.

-
-
-

In the referrer plugin of the blog application serendipity, - the referrer string is not escaped, thus leading to a permanent - XSS.

-
- - - - 28885 - CVE-2008-1385 - CVE-2008-1386 - http://int21.de/cve/CVE-2008-1385-s9y.html - http://int21.de/cve/CVE-2008-1386-s9y.html - http://blog.s9y.org/archives/193-Serendipity-1.3.1-released.html - - - 2008-04-22 - 2008-04-25 - - - - - firefox -- javascript garbage collector vulnerability - - - firefox - 2.0.0.14,1 - - - linux-firefox - linux-firefox-devel - 2.0.0.14 - - - seamonkey - linux-seamonkey - 1.1.10 - - - flock - linux-flock - 1.1.2 - - - linux-seamonkey-devel - 0 - - - thunderbird - linux-thunderbird - 2.0.0.14 - - - - -

Mozilla Foundation reports:

-
-

Fixes for security problems in the JavaScript engine described in - MFSA 2008-15 introduced a stability problem, where some users - experienced crashes during JavaScript garbage collection. This is - being fixed primarily to address stability concerns. We have no - demonstration that this particular crash is exploitable but are - issuing this advisory because some crashes of this type have been - shown to be exploitable in the past.

-
- - - - CVE-2008-1237 - CVE-2008-1380 - 28818 - http://secunia.com/advisories/29787 - http://www.mozilla.org/security/announce/2008/mfsa2008-20.html - - - 2008-04-16 - 2008-04-25 - 2009-12-12 - - - - - png -- unknown chunk processing uninitialized memory access - - - png - 1.2.27 - - - - -

Secunia reports:

-
-

Tavis Ormandy has reported a vulnerability in libpng, which can be - exploited by malicious people to cause a Denial of Service, disclose - potentially sensitive information, or potentially compromise an - application using the library.

-

The vulnerability is caused due to the improper handling of PNG - chunks unknown to the library. This can be exploited to trigger the - use of uninitialized memory in e.g. a free() call via unknown PNG - chunks having a length of zero.

-

Successful exploitation may allow execution of arbitrary code, but - requires that the application calls the png_set_read_user_chunk_fn() - function or the png_set_keep_unknown_chunks() function under - specific conditions.

-
- - - - CVE-2008-1382 - 28770 - http://secunia.com/advisories/29792 - http://libpng.sourceforge.net/Advisory-1.2.26.txt - - - 2008-04-12 - 2008-04-25 - 2008-04-29 - - - - - openfire -- unspecified denial of service - - - openfire - 3.5.0 - - - - -

Secunia reports:

-
-

A vulnerability has been reported in Openfire, which can be - exploited by malicious people to cause a Denial of Service.

-

The vulnerability is caused due to an unspecified error and can be - exploited to cause a Denial of Service.

-
- - - - CVE-2008-1728 - 28722 - http://secunia.com/advisories/29751 - http://www.igniterealtime.org/issues/browse/JM-1289 - - - 2008-04-10 - 2008-04-25 - - - - - php -- integer overflow vulnerability - - - php5 - 5.2.6 - - - - -

CVE reports:

-
-

Integer overflow in PHP 5.2.5 and earlier allows context-dependent - attackers to cause a denial of service and possibly have unspecified - other impact via a printf format parameter with a large width - specifier, related to the php_sprintf_appendstring function in - formatted_print.c and probably other functions for formatted strings - (aka *printf functions).

-
- - - - CVE-2008-1384 - 28392 - http://securityreason.com/achievement_securityalert/52 - - - 2008-03-21 - 2008-04-25 - 2008-05-02 - - - - - python -- Integer Signedness Error in zlib Module - - - python23 - 2.3.6_1 - - - python24 - 2.4.5_1 - - - python25 - 2.5.2_2 - - - - -

Justin Ferguson reports:

-
-

Integer signedness error in the zlib extension module in Python - 2.5.2 and earlier allows remote attackers to execute arbitrary code - via a negative signed integer, which triggers insufficient memory - allocation and a buffer overflow.

-
- - - - CVE-2008-1721 - 28715 - http://securityreason.com/securityalert/3802 - http://bugs.python.org/issue2586 - - - 2008-04-10 - 2008-04-25 - 2008-04-28 - - - - - postgresql -- multiple vulnerabilities - - - postgresql - postgresql-server - 7.37.3.21 - 7.47.4.19 - 8.08.0.15 - 8.18.1.11 - 8.28.2.6 - - - - -

The PostgreSQL developers report:

-
-

PostgreSQL allows users to create indexes on the results of - user-defined functions, known as "expression indexes". This provided - two vulnerabilities to privilege escalation: (1) index functions - were executed as the superuser and not the table owner during VACUUM - and ANALYZE, and (2) that SET ROLE and SET SESSION AUTHORIZATION - were permitted within index functions. Both of these holes have now - been closed.

-
-
-

PostgreSQL allowed malicious users to initiate a denial-of-service - by passing certain regular expressions in SQL queries. First, users - could create infinite loops using some specific regular expressions. - Second, certain complex regular expressions could consume excessive - amounts of memory. Third, out-of-range backref numbers could be used - to crash the backend.

-
-
-

DBLink functions combined with local trust or ident authentication - could be used by a malicious user to gain superuser privileges. This - issue has been fixed, and does not affect users who have not - installed DBLink (an optional module), or who are using password - authentication for local access. This same problem was addressed in - the previous release cycle, but that patch failed to close all forms - of the loophole.

-
- - - - CVE-2007-6600 - CVE-2007-4772 - CVE-2007-6067 - CVE-2007-4769 - CVE-2007-6601 - 27163 - http://www.postgresql.org/about/news.905 - - - 2008-01-06 - 2008-04-24 - - - - - phpmyadmin -- Shared Host Information Disclosure - - - phpMyAdmin - 2.11.5.2 - - - - -

A phpMyAdmin security announcement report:

-
-

It is possible to read the contents of any file that the web - server's user can access. The exact mechanism to achieve this won't - be disclosed. If a user can upload on the same host where - phpMyAdmin is running a PHP script that can read files with the - rights of the web server's user, the current advisory does not - describe an additional threat.

-
- - - - CVE-2008-1924 - http://secunia.com/advisories/29944/ - http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-3 - - - 2008-04-23 - 2008-04-24 - 2008-09-17 - - - - - phpmyadmin -- Username/Password Session File Information Disclosure - - - phpMyAdmin - 2.11.5.1 - - - - -

A phpMyAdmin security announcement report:

-
-

phpMyAdmin saves sensitive information like the MySQL username and - password and the Blowfish secret key in session data, which might be - unprotected on a shared host.

-
- - - - CVE-2008-1567 - http://secunia.com/advisories/29613/ - http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-3 - - - 2008-03-31 - 2008-04-24 - 2008-09-17 - - - - - libxine -- array index vulnerability - - - libxine - 1.1.12 - - - - -

xine Team reports:

-
-

A new xine-lib version is now available. This release contains a - security fix (an unchecked array index that could allows remote - attackers to execute arbitrary code via a header structure - containing a negative offset, which is used to dereference a - function pointer.)

-
- - - - CVE-2008-1686 - http://www.xinehq.de/index.php/news - - - 2008-04-06 - 2008-04-24 - - - - - clamav -- Multiple Vulnerabilities - - - clamav - 0.93 - - - clamav-devel - 20080415 - - - - -

Secunia reports:

-
-

Some vulnerabilities have been reported in ClamAV, which can be - exploited by malicious people to cause a DoS (Denial of Service) - or to compromise a vulnerable system.

-

1) A boundary error exists within the "cli_scanpe()" function in - libclamav/pe.c. This can be exploited to cause a heap-based buffer - overflow via a specially crafted "Upack" executable.

-

Successful exploitation allows execution of arbitrary code.

-

2) A boundary error within the processing of PeSpin packed - executables in libclamav/spin.c can be exploited to cause a - heap-based buffer overflow.

-

Successful exploitation may allow execution of arbitrary code.

-

3) An unspecified error in the processing of ARJ files can be - exploited to hang ClamAV.

-
- - - - CVE-2008-1100 - CVE-2008-1387 - http://secunia.com/advisories/29000 - - - 2008-04-15 - 2008-04-15 - - - - - lighttpd -- OpenSSL Error Queue Denial of Service Vulnerability - - - lighttpd - 1.4.19_1 - - - - -

Secunia reports:

-
-

A vulnerability has been reported in lighttpd, which can be - exploited by malicious people to cause a DoS (Denial of - Service).

-

The vulnerability is caused due to lighttpd not properly clearing - the OpenSSL error queue. This can be exploited to close concurrent - SSL connections of lighttpd by terminating one SSL connection.

-
- - - - 28489 - CVE-2008-1531 - http://secunia.com/advisories/29649 - http://trac.lighttpd.net/trac/ticket/285 - - - 2008-04-02 - 2008-04-13 - - - - - ikiwiki -- cross site request forging - - - ikiwiki - 2.42 - - - - -

The ikiwiki development team reports:

-
-

Cross Site Request Forging could be used to construct a link - that would change a logged-in user's password or other preferences - if they clicked on the link. It could also be used to construct a - link that would cause a wiki page to be modified by a logged-in - user.

-
- - - - CVE-2008-0165 - http://ikiwiki.info/security/#index31h2 - - - 2008-04-10 - 2008-04-13 - 2010-05-12 - - - - - postfix-policyd-weight -- working directory symlink vulnerability - - - postfix-policyd-weight - 0.1.14.17 - - - - -

postfix-policyd-weight does not check for symlink for its working - directory. If the working directory is not already setup by the - super root, an unprivileged user can link it to another directories - in the system. This results in ownership/permission changes on the - target directory.

- - - - 28480 - http://article.gmane.org/gmane.mail.postfix.policyd-weight/815 - http://article.gmane.org/gmane.mail.postfix.policyd-weight/823 - - - 2008-03-24 - 2008-04-06 - - - - - powerdns-recursor -- DNS cache poisoning - - - powerdns-recursor - 3.1.5 - - - - -

If the system random number generator can be predicted by its - past output, then an attacker may spoof Recursor to accept mallicious - data. This leads to DNS cache poisoning and client redirection.

- - - - http://doc.powerdns.com/security-policy.html - - - 2008-03-31 - 2008-04-05 - - - - - suphp -- multiple local privilege escalation vulnerabilities - - - suphp - 0.6.3 - - - - -

Multiple local privilege escalation are found in the symlink - verification code. An attacker may use it to run a PHP script with - the victim's privilege. This attack is a little harder when suphp - operates in paranoid mode. For suphp that runs in owner mode - which is the default in ports, immediate upgrade to latest - version is advised.

- - - - CVE-2008-1614 - 28568 - http://lists.marsching.biz/pipermail/suphp/2008-March/001750.html - - - 2008-03-30 - 2008-04-05 - 2010-05-12 - - - - - opera -- multiple vulnerabilities - - - opera - 9.27.20080331 - - - linux-opera - 9.27.20080331 - - - - -

Opera Software reports of multiple security issues in Opera. - All of them can lead to arbitrary code execution. Details are - as the following:

- - - - - 28585 - CVE-2008-1761 - CVE-2008-1762 - http://www.opera.com/support/search/view/881/ - http://www.opera.com/support/search/view/882/ - - - 2008-04-03 - 2008-04-05 - 2010-05-12 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 2.0.0.13,1 - - - linux-firefox - linux-firefox-devel - 2.0.0.13 - - - seamonkey - linux-seamonkey - 1.1.9 - - - flock - linux-flock - 1.1.1 - - - linux-seamonkey-devel - 0 - - - thunderbird - linux-thunderbird - 2.0.0.14 - - - - -

The Mozilla Foundation reports of multiple security issues - in Firefox, Seamonkey, and Thunderbird. Several of these - issues can probably be used to run arbitrary code with the - privilege of the user running the program.

-
-
    -
  • MFSA 2008-19 - XUL popup spoofing variant (cross-tab popups)
    • -
  • MFSA 2008-18 - Java socket connection to any local port via LiveConnect
    • -
  • MFSA 2008-17 - Privacy issue with SSL Client Authentication
    • -
  • MFSA 2008-16 - HTTP Referrer spoofing with malformed URLs
    • -
  • MFSA 2008-15 - Crashes with evidence of memory corruption (rv:1.8.1.13)
    • -
  • MFSA 2008-14 - JavaScript privilege escalation and arbitrary code execution
    • -
-
- - - - 28448 - CVE-2008-1241 - CVE-2008-1240 - CVE-2007-4879 - CVE-2008-1238 - CVE-2008-1236 - CVE-2008-1237 - CVE-2008-1233 - CVE-2008-1234 - CVE-2008-1235 - - - 2008-03-26 - 2008-03-30 - 2009-12-12 - - - - - silc -- pkcs_decode buffer overflow - - - silc-irssi-client - silc-client - 1.1.4 - - - silc-server - 1.1.2 - - - - -

Core Security Technologies reports:

-
-

A remote buffer overflow vulnerability found in a library - used by both the SILC server and client to process - packets containing cryptographic material may allow an - un-authenticated client to executearbitrary code on the - server with the privileges of the user account running the - server, or a malicious SILC server to compromise client - systems and execute arbitrary code with the privileges of - the user account running the SILC client program.

-
- - - - 28373 - http://www.coresecurity.com/?action=item&id=2206 - - - 2008-03-25 - 2008-03-26 - - - - - bzip2 -- crash with certain malformed archive files - - - bzip2 - 1.0.5 - - - - -

SecurityFocus reports:

-
-

The 'bzip2' application is prone to a remote file-handling - vulnerability because the application fails to properly - handle malformed files.

-

Exploit attempts likely result in application crashes.

-
- - - - 28286 - CVE-2008-1372 - https://www.cert.fi/haavoittuvuudet/joint-advisory-archive-formats.html - http://www.ee.oulu.fi/research/ouspg/protos/testing/c10/archive/ - - - 2008-03-18 - 2008-03-20 - - - - - qemu -- unchecked block read/write vulnerability - - - qemu - qemu-devel - 0.9.1_2 - - - - -

Ian Jackson reports on the debian-security mailinglist:

-
-

When a block device read or write request is made by the guest, - nothing checks that the request is within the range supported by - the backend, but the code in the backend typically assumes that - the request is sensible.

-

Depending on the backend, this can allow the guest to read - and write arbitrary memory locations in qemu, and possibly gain - control over the qemu process, escaping from the - emulation/virtualisation.

-
- - - - CVE-2008-0928 - http://secunia.com/advisories/29172 - http://secunia.com/advisories/29081 - http://lists.debian.org/debian-security/2008/02/msg00064.html - - - 2008-02-19 - 2008-03-11 - - - - - dovecot -- security hole in blocking passdbs - - - dovecot - 1.0.13 - - - - -

Dovecot reports:

-
-

Security hole in blocking passdbs (MySQL always. PAM, passwd - and shadow if blocking=yes) where user could specify extra - fields in the password. The main problem here is when specifying - "skip_password_check" introduced in v1.0.11 for fixing master user - logins, allowing the user to log in as anyone without a valid - password.

-
- - - - http://dovecot.org/list/dovecot-news/2008-March/000065.html - http://secunia.com/advisories/29295/ - - - 2008-03-09 - 2008-03-10 - - - - - mplayer -- multiple vulnerabilities - - - mplayer - mplayer-esound - mplayer-gtk - mplayer-gtk2 - mplayer-gtk-esound - mplayer-gtk2-esound - 0.99.11_2 - - - - -

The Mplayer team reports:

-
-

A buffer overflow was found in the code used to extract album - titles from CDDB server answers. When parsing answers from the - CDDB server, the album title is copied into a fixed-size buffer - with insufficient size checks, which may cause a buffer overflow. - A malicious database entry could trigger a buffer overflow in the - program. That can lead to arbitrary code execution with the UID of - the user running MPlayer.

-

A buffer overflow was found in the code used to escape URL - strings. The code used to skip over IPv6 addresses can be tricked - into leaving a pointer to a temporary buffer with a non-NULL value; - this causes the unescape code to reuse the buffer, and may lead to - a buffer overflow if the old buffer is smaller than required. - A malicious URL string may be used to trigger a buffer overflow in - the program, that can lead to arbitrary code execution with the UID - of the user running MPlayer.

-

A buffer overflow was found in the code used to parse MOV file - headers. The code read some values from the file and used them as - indexes into as array allocated on the heap without performing any - boundary check. A malicious file may be used to trigger a buffer - overflow in the program. That can lead to arbitrary code execution - with the UID of the user running MPlayer.

-
- - - - CVE-2008-0485 - CVE-2008-0486 - CVE-2008-0629 - CVE-2008-0630 - http://secunia.com/advisories/28779 - - - 2008-02-05 - 2008-03-06 - - - - - ghostscript -- zseticcspace() function buffer overflow vulnerability - - - ghostscript-gpl - ghostscript-gpl-nox11 - 8.61_2 - - - - -

Chris Evans from the Google Security Team reports:

-
-

Severity: parsing of evil PostScript file will result in - arbitrary code execution.

-

A stack-based buffer overflow in the zseticcspace() function - in zicc.c allows remote arbitrary code execution via a - malicious PostScript file (.ps) that contains a long Range - array.

-
- - - - 28017 - CVE-2008-0411 - http://scary.beasts.org/security/CESA-2008-001.html - - - 2008-02-28 - 2008-03-05 - - - - - phpmyadmin -- SQL injection vulnerability - - - phpMyAdmin - 2.11.5 - - - - -

A phpMyAdmin security announcement report:

-
-

phpMyAdmin used the $_REQUEST superglobal as a source for - its parameters, instead of $_GET and $_POST. This means that - on most servers, a cookie with the same name as one of - phpMyAdmin's parameters can interfere.

-

Another application could set a cookie for the root path - "/" with a "sql_query" name, therefore overriding the - user-submitted sql_query because by default, the $_REQUEST - superglobal imports first GET, then POST then COOKIE data.

-

Mitigation factor

-

An attacker must trick the victim into visiting a page on - the same web server where he has placed code that creates - a malicious cookie.

-
- - - - 28068 - CVE-2008-1149 - http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-1 - - - 2008-03-01 - 2008-03-04 - 2010-05-12 - - - - - pcre -- buffer overflow vulnerability - - - pcre - 7.6 - - - - -

PCRE developers report:

-
-

A character class containing a very large number of characters with - codepoints greater than 255 (in UTF-8 mode, of course) caused a - buffer overflow.

-
- - - - 27786 - CVE-2008-0674 - http://pcre.org/changelog.txt - - - 2008-01-28 - 2008-02-29 - - - - - libxine -- buffer overflow vulnerability - - - libxine - 1.1.10.1 - - - - -

xine Team reports:

-
-

A new xine-lib version is now available. This release - contains a security fix (array index vulnerability which - may lead to a stack buffer overflow.

-
- - - - CVE-2008-0486 - http://www.xinehq.de/index.php/news - - - 2007-02-08 - 2008-02-26 - - - - - coppermine -- multiple vulnerabilities - - - coppermine - 1.4.15 - - - - -

Coppermine Security advisory

-
-

The development team is releasing a security update for - Coppermine in order to counter a recently discovered - cross-site-scripting vulnerability.

-
- - - - CVE-2008-0504 - CVE-2008-0505 - CVE-2008-0506 - http://coppermine-gallery.net/forum/index.php?topic=48106.0 - http://coppermine-gallery.net/forum/index.php?topic=50103.0 - http://secunia.com/advisories/28682/ - - - 2007-11-06 - 2008-02-25 - - - - - moinmoin -- multiple vulnerabilities - - - moinmoin - 1.6.1 - - - - -

MoinMoin Security advisory

-
-

XSS issue in login action

-

XSS issue in AttachFile action

-

XSS issue in RenamePage/DeletePage action

-

XSS issue in gui editor

-
- - - - 27404 - CVE-2007-0857 - CVE-2007-0901 - CVE-2007-0902 - CVE-2007-2423 - CVE-2007-2673 - CVE-2008-0780 - CVE-2008-0781 - CVE-2008-0782 - http://moinmo.in/SecurityFixes - http://secunia.com/advisories/29010/ - - - 2007-02-08 - 2008-02-25 - 2008-02-26 - - - - - opera -- multiple vulnerabilities - - - opera - opera-devel - linux-opera - 9.26 - - - - -

Opera Software ASA reports about multiple security - fixes:

-
-
    -
  • Fixed an issue where simulated text inputs could trick - users into uploading arbitrary files, as reported by - Mozilla.
    • -
  • Image properties can no longer be used to execute - scripts, as reported by Max Leonov.
    • -
  • Fixed an issue where the representation of DOM - attribute values could allow cross site scripting, as - reported by Arnaud.lb.
    • -
-
- - - - CVE-2008-1080 - CVE-2008-1081 - http://www.opera.com/docs/changelogs/freebsd/926/ - http://www.opera.com/support/search/view/877/ - http://www.opera.com/support/search/view/879/ - http://www.opera.com/support/search/view/880/ - - - 2008-02-20 - 2008-02-22 - 2010-05-12 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 2.0.0.12,1 - - - linux-firefox - linux-firefox-devel - 2.0.0.12 - - - seamonkey - linux-seamonkey - 1.1.8 - - - flock - linux-flock - 1.0.9 - - - linux-seamonkey-devel - 0 - - - - -

The Mozilla Foundation reports of multiple security issues - in Firefox, Seamonkey, and Thunderbird. Several of these - issues can probably be used to run arbitrary code with the - privilege of the user running the program.

-
-
    -
  • Web forgery overwrite with div overlay
    • -
  • URL token stealing via stylesheet redirect
    • -
  • Mishandling of locally-saved plain text files
    • -
  • File action dialog tampering
    • -
  • Possible information disclosure in BMP decoder
    • -
  • Web browsing history and forward navigation stealing
    • -
  • Directory traversal via chrome: URI
    • -
  • Stored password corruption
    • -
  • Privilege escalation, XSS, Remote Code Execution
    • -
  • Multiple file input focus stealing vulnerabilities
    • -
  • Crashes with evidence of memory corruption (rv:1.8.1.12)
    • -
-
- - - - CVE-2008-0412 - CVE-2008-0413 - CVE-2008-0414 - CVE-2008-0415 - CVE-2008-0417 - CVE-2008-0418 - CVE-2008-0419 - CVE-2008-0420 - CVE-2008-0591 - CVE-2008-0592 - CVE-2008-0593 - CVE-2008-0594 - http://www.mozilla.org/projects/security/known-vulnerabilities.html - http://www.mozilla.org/security/announce/2008/mfsa2008-01.html - http://www.mozilla.org/security/announce/2008/mfsa2008-02.html - http://www.mozilla.org/security/announce/2008/mfsa2008-03.html - http://www.mozilla.org/security/announce/2008/mfsa2008-04.html - http://www.mozilla.org/security/announce/2008/mfsa2008-05.html - http://www.mozilla.org/security/announce/2008/mfsa2008-06.html - http://www.mozilla.org/security/announce/2008/mfsa2008-07.html - http://www.mozilla.org/security/announce/2008/mfsa2008-08.html - http://www.mozilla.org/security/announce/2008/mfsa2008-09.html - http://www.mozilla.org/security/announce/2008/mfsa2008-10.html - http://www.mozilla.org/security/announce/2008/mfsa2008-11.html - - - 2008-02-07 - 2008-02-22 - 2009-12-12 - - - - - openldap -- modrdn Denial of Service vulnerability - - - openldap-server - 2.3.41 - 2.4.02.4.8 - - - - -

Secunia Advisory reports:

-
-

A vulnerability has been reported in OpenLDAP, which can - be exploited by malicious users to cause a DoS (Denial of - Service).

-
- - - - 27778 - CVE-2008-0658 - - - 2008-02-13 - 2008-02-22 - - - - - clamav -- ClamAV libclamav PE File Integer Overflow Vulnerability - - - clamav - 0.920.92.1 - - - - -

iDefense Security Advisory 02.12.08:

-
-

Remote exploitation of an integer overflow vulnerability - in Clam AntiVirus' ClamAV, as included in various vendors' - operating system distributions, allows attackers to execute - arbitrary code with the privileges of the affected process.

-

The vulnerability exists within the code responsible - for parsing and scanning PE files. While iterating through - all sections contained in the PE file, several attacker - controlled values are extracted from the file. On each iteration, - arithmetic operations are performed without taking into - consideration 32-bit integer wrap.

-

Since insufficient integer overflow checks are present, - an attacker can cause a heap overflow by causing a specially - crafted Petite packed PE binary to be scanned. This results - in an exploitable memory corruption condition.

-

Exploitation of this vulnerability results in the - execution of arbitrary code with the privileges of the process - using libclamav. In the case of the clamd program, this will - result in code execution with the privileges of the clamav user. - Unsuccessful exploitation results in the clamd process crashing.

-
-

Workaround

-

Disabling the scanning of PE files will prevent exploitation.

-

If using clamscan, this can be done by running clamscan with the - '--no-pe' option.

-

If using clamdscan, set the 'ScanPE' option in the clamd.conf - file to 'no'.

- - - - CVE-2008-0318 - http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=658 - http://svn.clamav.net/svn/clamav-devel/trunk/ChangeLog - - - 2008-01-07 - 2008-02-15 - - - - - cacti -- Multiple security vulnerabilities have been discovered - - - cacti - 0.8.7b - - - - -

The cacti development team reports:

-
-

Multiple security vulnerabilities have been discovered in - Cacti's web interface:

-
    -
  • XSS vulnerabilities
    • -
  • Path disclosure vulnerabilities
    • -
  • SQL injection vulnerabilities
    • -
  • HTTP response splitting vulnerabilities
    • -
-
- - - - http://forums.cacti.net/about25749.html - - - 2008-02-12 - 2008-02-12 - - - - - ikiwiki -- javascript insertion via uris - - - ikiwiki - 2.32.3 - - - - -

The ikiwiki development team reports:

-
-

The htmlscrubber did not block javascript in uris. This was - fixed by adding a whitelist of valid uri types, which does not - include javascript. Some urls specifyable by the meta plugin - could also theoretically have been used to inject javascript; this - was also blocked.

-
- - - - CVE-2008-0808 - http://ikiwiki.info/security/#index30h2 - - - 2008-02-10 - 2008-02-11 - 2010-05-12 - - - - - zenphoto -- XSS vulnerability - - - zenphoto - 1.1.4 - - - - -

zenphoto project reports:

-
-

A new zenphoto version is now available. This release contains - security fixes for HTML, XSS, and SQL injection vulnerabilities. -

-
- - - - CVE-2007-6666 - http://www.securityfocus.com/bid/27084 - http://secunia.com/advisories/28281 - - - 2008-01-03 - 2008-02-09 - - - - - jetty -- multiple vulnerability - - - jetty - 6.1.7 - - - - -

Greg Wilkins reports:

-
-

jetty allows remote attackers to bypass protection mechanisms and - read the source of files via multiple '/' characters in the URI.

-
- - - - 27117 - CVE-2007-6672 - http://jira.codehaus.org/browse/JETTY-386#action_117699 - - - 2007-12-22 - 2008-02-04 - - - - - libxine -- buffer overflow vulnerability - - - libxine - 1.1.10 - - - - -

xine project reports:

-
-

A new xine-lib version is now available. This release contains - a security fix (remotely-expoitable buffer overflow, CVE-2006-1664). - (This is not the first time that that bug has been fixed...) - It also fixes a few more recent bugs, such as the audio output - problems in 1.1.9.

-
- - - - CVE-2006-1664 - http://secunia.com/advisories/19853/ - - - 2008-01-23 - 2008-01-29 - - - - - xorg -- multiple vulnerabilities - - - xorg-server - 1.4_4,1 - - - libXfont - 1.3.1_2,1 - - - - -

Matthieu Herrb of X.Org reports:

-
-

Several vulnerabilities have been identified in server code - of the X window system caused by lack of proper input validation - on user controlled data in various parts of the software, - causing various kinds of overflows.

-

Exploiting these overflows will crash the X server or, - under certain circumstances allow the execution of arbitray - machine code.

-

When the X server is running with root privileges (which is the - case for the Xorg server and for most kdrive based servers), - these vulnerabilities can thus also be used to raise - privileges.

-

All these vulnerabilities, to be exploited succesfully, require - either an already established connection to a running X server - (and normally running X servers are only accepting authenticated - connections), or a shell access with a valid user on the machine - where the vulnerable server is installed.

-
- - - - CVE-2007-5760 - CVE-2007-5958 - CVE-2007-6427 - CVE-2007-6428 - CVE-2007-6429 - CVE-2008-0006 - http://lists.freedesktop.org/archives/xorg/2008-January/031918.html - http://lists.freedesktop.org/archives/xorg/2008-January/032099.html - http://secunia.com/advisories/28532/ - - - 2008-01-18 - 2008-01-23 - - - - - xfce -- multiple vulnerabilities - - - xfce4-panel - libxfce4gui - 4.4.2 - - - - -

Gentoo reports:

-
-

A remote attacker could entice a user to install a specially - crafted "rc" file to execute arbitrary code via long strings - in the "Name" and "Comment" fields or via unspecified vectors - involving the second vulnerability.

-
- - - - CVE-2007-6531 - CVE-2007-6532 - http://www.xfce.org/documentation/changelogs/4.4.2 - http://www.gentoo.org/security/en/glsa/glsa-200801-06.xml - - - 2008-01-09 - 2008-01-22 - 2008-02-13 - - - - - claws-mail -- insecure temporary file creation - - - claws-mail - 3.1.0 - - - - -

Nico Golde reports:

-
-

A local attacker could exploit this vulnerability to conduct - symlink attacks to overwrite files with the privileges of the user - running Claws Mail.

-
- - - - 26676 - CVE-2007-6208 - http://www.gentoo.org/security/en/glsa/glsa-200801-03.xml - http://security.gentoo.org/glsa/glsa-200801-03.xml - http://secunia.com/advisories/27897 - - - 2007-12-03 - 2008-01-22 - 2008-02-12 - - - - - IRC Services-- Denial of Service Vulnerability - - - ircservices - 5.0.63 - - - - -

Secunia reports:

-
-

A vulnerability has been reported in IRC Services, - which can be exploited by malicious people to cause - a Denial of Service. The vulnerability is caused due - to the improper handling of overly long passwords within - the "default_encrypt()" function in encrypt.c and can be - exploited to crash an affected server.

-
- - - - CVE-2007-6122 - http://secunia.com/advisories/27761 - http://ircservices.za.net/Changes.txt - - - 2007-11-21 - 2008-01-19 - - - - - libxine -- buffer overflow vulnerability - - - libxine - 1.1.9.1 - - - - -

xine project reports:

-
-

A new xine-lib version is now available. This release contains - a security fix (remotely-expoitable buffer overflow, CVE-2008-0225). - It also contains a read-past-end fix for an internal library - function which is only used if the OS does not supply it and a - rendering fix for Darwin/PPC.

-
- - - - CVE-2008-0225 - http://aluigi.altervista.org/adv/xinermffhof-adv.txt - http://secunia.com/advisories/28384 - - - 2008-01-08 - 2008-01-19 - - - - - geeklog xss vulnerability - - - geeklog - 1.4.1 - - - - -

Geeklog reports:

-
-

MustLive pointed out a possible XSS in the form to email an - article to a friend that we're fixing with this release.

-

Please note that this problem only exists in Geeklog 1.4.0 - - neither Geeklog 1.4.1 nor any older versions (1.3.x series) - have that problem.

-
- - - - CVE-2006-3756 - http://www.geeklog.net/article.php/geeklog-1.4.0sr6 - - - 2008-01-08 - 2008-01-15 - - - - - drupal -- cross site request forgery - - - drupal5 - 5.6 - - - drupal4 - 4.7.11 - - - - -

The Drupal Project reports:

-
-

The aggregator module fetches items from RSS feeds and makes - them available on the site. The module provides an option to - remove items from a particular feed. This has been implemented - as a simple GET request and is therefore vulnerable to cross - site request forgeries. For example: Should a privileged user - view a page containing an <img> tag with a specially - constructed src pointing to a remove items URL, the items would - be removed.

-
- - - - CVE-2008-0272 - http://drupal.org/node/208562 - http://secunia.com/advisories/28422/ - - - 2008-01-10 - 2008-01-11 - 2010-05-12 - - - - - drupal -- cross site scripting (utf8) - - - drupal5 - 5.6 - - - drupal4 - 4.7.11 - - - - -

The Drupal Project reports:

-
-

When outputting plaintext Drupal strips potentially dangerous - HTML tags and attributes from HTML, and escapes characters which - have a special meaning in HTML. This output filtering secures - the site against cross site scripting attacks via user input.

-

Certain byte sequences that are invalid in the UTF8 - specification are not handled properly by Internet Explorer 6 - and may lead it to see a multibyte start character where none is - present. Internet Explorer 6 then consumes a number of - subsequent UTF-8 characters. This may lead to unsafe attributes - that were outside a tag for the filter to appear inside a tag - for Internet Explorer 6. This behaviour can then be used to - insert and execute javascript in the context of the website.

-
- - - - CVE-2008-0273 - http://drupal.org/node/208564 - http://secunia.com/advisories/28422/ - - - 2008-01-10 - 2008-01-11 - 2010-05-12 - - - - - drupal -- cross site scripting (register_globals) - - - drupal5 - 5.6 - - - drupal4 - 4.7.11 - - - - -

The Drupal Project reports:

-
-

When theme .tpl.php files are accessible via the web and the PHP - setting register_globals is set to enabled, anonymous users are - able to execute cross site scripting attacks via specially - crafted links.

-

Drupal's .htaccess attempts to set register_globals to disabled - and also prevents access to .tpl.php files. Only when both these - measures are not effective and your PHP interpreter is - configured with register_globals set to enabled, will this issue - affect you.

-
- - - - CVE-2008-0274 - http://drupal.org/node/208565 - http://secunia.com/advisories/28422/ - - - 2008-01-10 - 2008-01-11 - 2010-05-12 - - - - - maradns -- CNAME record resource rotation denial of service - - - maradns - 1.2.12.08 - - - - -

Secunia reports:

-
-

A vulnerability has been reported in MaraDNS, which can be - exploited by malicious people to cause a Denial of Service.

-

The vulnerability is caused due to an error within the handling of - certain DNS packets. This can be exploited to cause a resource - rotation by sending specially crafted DNS packets, which cause an - authoritative CNAME record to not resolve, resulting in a Denial of - Sevices.

-
- - - - CVE-2008-0061 - http://maradns.blogspot.com/2007/08/maradns-update-all-versions.html - http://secunia.com/advisories/28329 - - - 2008-01-04 - 2008-01-10 - - - - - linux-realplayer -- multiple vulnerabilities - - - linux-realplayer - 10.0.510.0.9.809.20070726 - - - - -

Secunia reports:

-
-

Multiple vulnerabilities have been reported in - RealPlayer/RealOne/HelixPlayer, which can be exploited by malicious - people to compromise a user's system.

-

An input validation error when processing .RA/.RAM files can be - exploited to cause a heap corruption via a specially crafted - .RA/.RAM file with an overly large size field in the header.

-

An error in the processing of .PLS files can be exploited to cause - a memory corruption and execute arbitrary code via a specially - crafted .PLS file.

-

An input validation error when parsing .SWF files can be exploited - to cause a buffer overflow via a specially crafted .SWF file with - malformed record headers.

-

A boundary error when processing rm files can be exploited to - cause a buffer overflow.

-
- - - - CVE-2007-5081 - CVE-2007-3410 - CVE-2007-2263 - CVE-2007-2264 - http://secunia.com/advisories/27361 - http://service.real.com/realplayer/security/10252007_player/en/ - http://www.zerodayinitiative.com/advisories/ZDI-07-063.html - http://www.zerodayinitiative.com/advisories/ZDI-07-062.html - http://www.zerodayinitiative.com/advisories/ZDI-07-061.html - http://secunia.com/advisories/25819/ - 759385 - - - 2007-10-25 - 2008-01-04 - - - - - linux-flashplugin -- multiple vulnerabilities - - - linux-flashplugin - 9.09.0r115 - 7.07.0r73 - - - - -

Adobe Security bulletin:

-
-

Critical vulnerabilities have been identified in Adobe Flash - Player that could allow an attacker who successfully exploits these - potential vulnerabilities to take control of the affected system. A - malicious SWF must be loaded in Flash Player by the user for an - attacker to exploit these potential vulnerabilities. Users are - recommended to update to the most current version of Flash Player - available for their platform.

-
- - - - CVE-2007-6242 - CVE-2007-4768 - CVE-2007-5275 - CVE-2007-6243 - CVE-2007-6244 - CVE-2007-6245 - CVE-2007-4324 - CVE-2007-6246 - CVE-2007-5476 - http://www.adobe.com/support/security/bulletins/apsb07-20.html - http://secunia.com/advisories/28161/ - - - 2007-12-18 - 2008-01-03 - - - - - dovecot -- Specific LDAP + auth cache configuration may mix up user logins - - - dovecot - 1.0.10 - - - - -

Dovecot reports:

-
-

If two users with the same password and same pass_filter - variables log in within auth_cache_ttl seconds (1h by default), - the second user may get logged in with the first user's cached - pass_attrs. For example if pass_attrs contained the user's - home/mail directory, this would mean that the second user will - be accessing the first user's mails.

-
- - - - http://www.dovecot.org/list/dovecot-news/2007-December/000057.html - - - 2007-12-21 - 2007-12-29 - - - - - gallery2 -- multiple vulnerabilities - - - gallery2 - 2.2.4 - - - - -

The Gallery team reports:

-
-

Gallery 2.2.4 addresses the following security - vulnerabilities:

-
    -
  • Publish XP module - Fixed unauthorized album creation - and file uploads.
    • -
  • URL rewrite module - Fixed local file inclusion - vulnerability in unsecured admin controller and - information disclosure in hotlink protection.
    • -
  • Core / add-item modules - Fixed Cross Site Scripting - (XSS) vulnerabilities through malicious file names.
    • -
  • Installation (Gallery application) - Update - web-accessibility protection of the storage folder for - Apache 2.2.
    • -
  • Core (Gallery application) / MIME module - Fixed - vulnerability in checks for disallowed file extensions - in file uploads.
    • -
  • Gallery Remote module - Added missing permissions - checks for some GR commands.
    • -
  • WebDAV module - Fixed Cross Site Scripting (XSS) - vulnerability through HTTP PROPPATCH.
    • -
  • WebDAV module - Fixed information (item data) - disclosure in a WebDAV view.
    • -
  • Comment module - Fixed information (item data) - disclosure in comment views.
    • -
  • Core module (Gallery application) - Improved - resilience against item information disclosure - attacks.
    • -
  • Slideshow module - Fixed information (item data) - disclosure in the slideshow.
    • -
  • Print modules - Fixed information (item data) - disclosure in several print modules.
    • -
  • Core / print modules - Fixed arbitrary URL redirection - (phishing attacks) in the core module and several print - modules.
    • -
  • WebCam module - Fixed proxied request weakness.
    • -
-
- - - - CVE-2007-6685 - CVE-2007-6686 - CVE-2007-6687 - CVE-2007-6689 - CVE-2007-6690 - CVE-2007-6692 - http://gallery.menalto.com/gallery_2.2.4_released - - - 2007-12-24 - 2007-12-25 - 2010-05-12 - - - - - e2fsprogs -- heap buffer overflow - - - e2fsprogs - 1.40.3 - - - - -

Theodore Y. Ts'o reports:

-
-

Fix a potential security vulnerability where an untrusted - filesystem can be corrupted in such a way that a program using - libext2fs will allocate a buffer which is far too small. This - can lead to either a crash or potentially a heap-based buffer - overflow crash. No known exploits exist, but main concern is - where an untrusted user who possesses privileged access in a - guest Xen environment could corrupt a filesystem which is then - accessed by thus allowing the untrusted user to gain privileged - access in the host OS. Thanks to the McAfee AVERT Research group - for reporting this issue.

-
- - - - 26772 - CVE-2007-5497 - http://secunia.com/advisories/27889/ - http://sourceforge.net/project/shownotes.php?group_id=2406&release_id=560230 - - - 2007-12-07 - 2007-12-20 - - - - - wireshark -- multiple vulnerabilities - - - wireshark - wireshark-lite - ethereal - ethereal-lite - tethereal - tethereal-lite - 0.8.160.99.7 - - - - -

The Wireshark team reports of multiple vulnerabilities:

-
-
    -
  • Wireshark could crash when reading an MP3 file.
    • -
  • Beyond Security discovered that Wireshark could loop - excessively while reading a malformed DNP packet.
    • -
  • Stefan Esser discovered a buffer overflow in the SSL - dissector.
    • -
  • The ANSI MAP dissector could be susceptible to a - buffer overflow on some platforms.
    • -
  • The Firebird/Interbase dissector could go into an - infinite loop or crash.
    • -
  • The NCP dissector could cause a crash.
    • -
  • The HTTP dissector could crash on some systems while - decoding chunked messages.
    • -
  • The MEGACO dissector could enter a large loop and - consume system resources.
    • -
  • The DCP ETSI dissector could enter a large loop and - consume system resources.
    • -
  • Fabiodds discovered a buffer overflow in the iSeries - (OS/400) Communication trace file parser.
    • -
  • The PPP dissector could overflow a buffer.
    • -
  • The Bluetooth SDP dissector could go into an infinite - loop.
    • -
  • A malformed RPC Portmap packet could cause a - crash.
    • -
  • The IPv6 dissector could loop excessively.
    • -
  • The USB dissector could loop excessively or crash.
    • -
  • The SMB dissector could crash.
    • -
  • The RPL dissector could go into an infinite loop.
    • -
  • The WiMAX dissector could crash due to unaligned - access on some platforms.
    • -
  • The CIP dissector could attempt to allocate a huge - amount of memory and crash.
    • -
- -

Impact

- -

It may be possible to make Wireshark or Ethereal crash or - use up available memory by injecting a purposefully - malformed packet onto the wire or by convincing someone to - read a malformed packet trace file.

-
- - - - CVE-2007-6112 - CVE-2007-6113 - CVE-2007-6114 - CVE-2007-6115 - CVE-2007-6117 - CVE-2007-6118 - CVE-2007-6120 - CVE-2007-6121 - CVE-2007-6438 - CVE-2007-6439 - CVE-2007-6441 - CVE-2007-6450 - CVE-2007-6451 - http://www.wireshark.org/security/wnpa-sec-2007-03.html - - - 2007-12-19 - 2007-12-19 - 2007-12-22 - - - - - opera -- multiple vulnerabilities - - - opera - opera-devel - linux-opera - 9.25 - - - - -

Opera Software ASA reports about multiple security - fixes:

-
-
    -
  • Fixed an issue where plug-ins could be used to allow - cross domain scripting, as reported by David - Bloom. Details will be disclosed at a later date.
    • -
  • Fixed an issue with TLS certificates that could be - used to execute arbitrary code, as reported by Alexander - Klink (Cynops GmbH). Details will be disclosed at a - later date.
    • -
  • Rich text editing can no longer be used to allow cross - domain scripting, as reported by David Bloom. See our - advisory.
    • -
  • Prevented bitmaps from revealing random data from - memory, as reported by Gynvael Coldwind. Details will be - disclosed at a later date.
    • -
-
- - - - CVE-2007-6520 - CVE-2007-6521 - CVE-2007-6522 - CVE-2007-6524 - http://www.opera.com/docs/changelogs/freebsd/925/ - http://www.opera.com/support/search/view/875/ - - - 2007-12-19 - 2007-12-19 - 2007-12-29 - - - - - peercast -- buffer overflow vulnerability - - - peercast - 0.1218 - - - - -

Luigi Auriemma reports that peercast is vulnerable to a - buffer overflow which could lead to a DoS or potentially - remote code execution:

-
-

The handshakeHTTP function which handles all the requests - received by the other clients is vulnerable to a heap - overflow which allows an attacker to fill the - loginPassword and loginMount buffers located in the - Servent class with how much data he wants.

-
- - - - CVE-2007-6454 - http://aluigi.altervista.org/adv/peercasthof-adv.txt - http://secunia.com/advisories/28120/ - - - 2007-12-17 - 2007-12-19 - 2010-05-12 - - - - - ganglia-webfrontend -- XSS vulnerabilities - - - ganglia-webfrontend - 3.0.6 - - - - -

The Ganglia project reports:

-
-

The Ganglia development team is pleased to release Ganglia - 3.0.6 (Foss) which is available[...]. This release includes a - security fix for web frontend cross-scripting vulnerability.

-
- - - - http://sourceforge.net/mailarchive/message.php?msg_name=d4c731da0712101044l7245cba9l34974008879f47a3%40mail.gmail.com - http://sourceforge.net/mailarchive/forum.php?thread_name=d4c731da0712101044l7245cba9l34974008879f47a3%40mail.gmail.com&forum_name=ganglia-developers - - - 2007-12-10 - 2007-12-17 - 2007-12-18 - - - - - qemu -- Translation Block Local Denial of Service Vulnerability - - - qemu - qemu-devel - 0.9.0_4 - 0.9.0s.20070101*0.9.0s.20070802_1 - - - - -

SecurityFocus reports:

-
-

QEMU is prone to a local denial-of-service vulnerability - because it fails to perform adequate boundary checks when - handling user-supplied input.

-

Attackers can exploit this issue to cause denial-of-service - conditions. Given the nature of the issue, attackers may also be - able to execute arbitrary code, but this has not been confirmed.

-
- - - - 26666 - CVE-2007-6227 - http://www.securityfocus.com/archive/1/484429 - - - 2007-11-30 - 2007-12-12 - 2007-12-14 - - - - - drupal -- SQL injection vulnerability - - - drupal5 - 5.4 - - - drupal4 - 4.7.9 - - - - -

The Drupal Project reports:

-
-

The function taxonomy_select_nodes() directly injects variables - into SQL queries instead of using placeholders. While taxonomy - module itself validates the input passed to - taxonomy_select_nodes(), this is a weakness in Drupal core. - Several contributed modules, such as taxonomy_menu, ajaxLoader, - and ubrowser, directly pass user input to taxonomy_select_nodes(), - enabling SQL injection attacks by anonymous users.

-
- - - - CVE-2007-6299 - http://drupal.org/node/198162 - http://secunia.com/advisories/27932/ - - - 2007-12-05 - 2007-12-12 - - - - - samba -- buffer overflow vulnerability - - - samba - samba3 - ja-samba - 3.0.28 - *,13.0.28,1 - - - - -

Secuna Research reports:

-
-

Secunia Research has discovered a vulnerability in Samba, which - can be exploited by malicious people to compromise a vulnerable - system. The vulnerability is caused due to a boundary error within - the "send_mailslot()" function. This can be exploited to cause a - stack-based buffer overflow with zero bytes via a specially crafted - "SAMLOGON" domain logon packet containing a username string placed - at an odd offset followed by an overly long GETDC string. - Successful exploitation allows execution of arbitrary code, but - requires that the "domain logons" option is enabled.

-
- - - - CVE-2007-6015 - http://secunia.com/advisories/27760/ - - - 2007-12-10 - 2007-12-12 - 2008-09-26 - - - - - smbftpd -- format string vulnerability - - - smbftpd - 0.96 - - - - -

Secunia reports:

-
-

Format string vulnerability in the SMBDirList function in dirlist.c - in SmbFTPD 0.96 allows remote attackers to execute arbitrary code - via format string specifiers in a directory name.

-
- - - - CVE-2007-5184 - http://secunia.com/advisories/27014/ - http://sourceforge.net/project/shownotes.php?release_id=543077 - - - 2007-10-01 - 2007-12-12 - - - - - jetty -- multiple vulnerabilities - - - jetty - 6.1.6 - - - - -
-

Cross-site scripting (XSS) vulnerability in Dump Servlet in - Mortbay Jetty before 6.1.6rc1 allows remote attackers to inject - arbitrary web script or HTML via unspecified parameters and - cookies.

-
-
-

Mortbay Jetty before 6.1.6rc1 does not properly handle "certain - quote sequences" in HTML cookie parameters, which allows remote - attackers to hijack browser sessions via unspecified vectors.

-
-
-

CRLF injection vulnerability in Mortbay Jetty before 6.1.6rc0 - allows remote attackers to inject arbitrary HTTP headers and - conduct HTTP response splitting attacks via unspecified vectors. -

-
- - - - 237888 - 212984 - 438616 - CVE-2007-5613 - CVE-2007-5614 - CVE-2007-5615 - http://svn.codehaus.org/jetty/jetty/trunk/VERSION.txt - - - 2007-12-05 - 2007-12-10 - - - - - liveMedia -- DoS vulnerability - - - liveMedia - 2007.11.18,1 - - - - -

The live555 development team reports:

-
-

Fixed a bounds-checking error in "parseRTSPRequestString()" - caused by an int vs. unsigned problem.

-
-
-

The function which handles the incoming queries from the - clients is affected by a vulnerability which allows an attacker - to crash the server remotely using the smallest RTSP query - possible to use.

-
- - - - CVE-2007-6036 - http://aluigi.altervista.org/adv/live555x-adv.txt - http://www.live555.com/liveMedia/public/changelog.txt - - - 2007-11-20 - 2007-12-08 - 2007-12-09 - - - - - GNU finger vulnerability - - - gnu-finger - 1.37_1 - - - - -

GNU security announcement:

-
-

GNU Finger unfortunately has not been updated in - many years, and has known security vulnerabilities. - Please do not use it in production environments.

-
- - - - CVE-1999-1165 - http://www.gnu.org/software/finger/ - - - 1999-07-21 - 2007-12-05 - - - - - Squid -- Denial of Service Vulnerability - - - squid - 2.02.6.16_1 - 3.*3.0.r1.20071001_1 - - - - -

Squid secuirty advisory reports:

-
-

Due to incorrect bounds checking Squid is vulnerable - to a denial of service check during some cache update - reply processing.

-

This problem allows any client trusted to use the - service to perform a denial of service attack on the - Squid service.

-
- - - - 26687 - CVE-2007-6239 - - - 2007-11-28 - 2007-12-04 - 2007-12-07 - - - - - rubygem-rails -- session-fixation vulnerability - - - rubygem-rails - 1.2.6 - - - - -

Rails core team reports:

-
-

The rails core team has released ruby on rails 1.2.6 to - address a bug in the fix for session fixation attacks - (CVE-2007-5380). The CVE Identifier for this new issue - is CVE-2007-6077.

-
- - - - CVE-2007-6077 - - - 2007-11-24 - 2007-11-27 - - - - - rubygem-rails -- JSON XSS vulnerability - - - rubygem-rails - 1.2.5 - - - rubygem-activesupport - 1.4.4 - - - - -

Rails core team reports:

-
-

All users of Rails 1.2.4 or earlier are advised to upgrade - to 1.2.5, though it isn't strictly necessary if you - aren't working with JSON. For more information the JSON - vulnerability, see CVE-2007-3227.

-
- - - - CVE-2007-3227 - - - 2007-10-12 - 2007-11-28 - 2007-12-01 - - - - - ikiwiki -- improper symlink verification vulnerability - - - ikiwiki - 2.14 - - - - -

The ikiwiki development team reports:

-
-

Ikiwiki did not check if path to the srcdir to contained a - symlink. If an attacker had commit access to the directories in - the path, they could change it to a symlink, causing ikiwiki to - read and publish files that were not intended to be - published. (But not write to them due to other checks.)

-
- - - - http://ikiwiki.info/security/#index29h2 - - - 2007-11-26 - 2007-11-27 - - - - - firefox -- multiple remote unspecified memory corruption vulnerabilities - - - firefox - 2.0.0.10,1 - - - linux-firefox - 2.0.0.10 - - - seamonkey - linux-seamonkey - 1.1.7 - - - flock - linux-flock - 1.0.2 - - - linux-firefox-devel - 3.0.a2007.12.12 - - - linux-seamonkey-devel - 2.0.a2007.12.12 - - - - -

Mozilla Foundation reports:

-
-

The Firefox 2.0.0.10 update contains fixes for three bugs that - improve the stability of the product. These crashes showed some - evidence of memory corruption under certain circumstances and we - presume that with enough effort at least some of these could be - exploited to run arbitrary code.

-
- - - - 26593 - CVE-2007-5959 - - - 2007-11-26 - 2007-11-27 - 2007-12-14 - - - - - phpmyadmin -- Cross Site Scripting - - - phpmyadmin - 2.11.2.2 - - - - -

phpMyAdmin security announcement:

-
-

The login page auth_type cookie was vulnerable to XSS via - the convcharset parameter. An attacker could use this to - execute malicious code on the visitors computer

-
- - - - CVE-2007-6100 - http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-8 - http://www.nth-dimension.org.uk/downloads.php?id=38 - - - 2007-11-20 - 2007-11-21 - 2010-05-12 - - - - - samba -- multiple vulnerabilities - - - samba - samba3 - ja-samba - 3.0.26a - *,13.0.26a_2,1 - - - - -

The Samba Team reports:

-
-

Secunia Research reported a vulnerability that allows for - the execution of arbitrary code in nmbd. This defect may - only be exploited when the "wins support" parameter has - been enabled in smb.conf.

-
-
-

Samba developers have discovered what is believed to be - a non-exploitable buffer over in nmbd during the processing - of GETDC logon server requests. This code is only used - when the Samba server is configured as a Primary or Backup - Domain Controller.

-
- - - - 26454 - CVE-2007-4572 - CVE-2007-5398 - http://secunia.com/advisories/27450/ - http://us1.samba.org/samba/security/CVE-2007-4572.html - http://us1.samba.org/samba/security/CVE-2007-5398.html - - - 2007-11-15 - 2007-11-21 - 2008-09-26 - - - - - php -- multiple security vulnerabilities - - - php5 - 5.2.5 - - - - -

PHP project reports:

-
-

Security Enhancements and Fixes in PHP 5.2.5:

-
    -
  • Fixed dl() to only accept filenames. Reported by Laurent - Gaffie.
    • -
  • Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887). - Reported by Laurent Gaffie.
    • -
  • Fixed htmlentities/htmlspecialchars not to accept partial - multibyte sequences. Reported by Rasmus Lerdorf
    • -
  • Fixed possible triggering of buffer overflows inside glibc - implementations of the fnmatch(), setlocale() and glob() - functions. Reported by Laurent Gaffie.
    • -
  • Fixed "mail.force_extra_parameters" php.ini directive not to be - modifiable in .htaccess due to the security implications. Reported - by SecurityReason.
    • -
  • Fixed bug #42869 (automatic session id insertion adds sessions - id to non-local forms).
    • -
  • Fixed bug #41561 (Values set with php_admin_* in httpd.conf can - be overwritten with ini_set()).
    • -
-
- - - - 26403 - CVE-2007-4887 - - - 2007-11-08 - 2007-11-16 - - - - - mt-daapd -- denial of service vulnerability - - - mt-daapd - 0.2.4.1 - - - - -

US-CERT reports:

-
-

webserver.c in mt-dappd in Firefly Media Server 0.2.4 and - earlier allows remote attackers to cause a denial of service - (NULL dereference and daemon crash) via a stats method action - to /xml-rpc with (1) an empty Authorization header line, which - triggers a crash in the ws_decodepassword function; or (2) a - header line without a ':' character, which triggers a crash - in the ws_getheaders function.

-
- - - - CVE-2007-5824 - - - 2007-11-05 - 2007-11-12 - - - - - net-snmp -- denial of service via GETBULK request - - - net-snmp - 5.3.1_7 - - - - -

CVE reports:

-
-

The SNMP agent (snmp_agent.c) in net-snmp before 5.4.1 - allows remote attackers to cause a denial of service (CPU - and memory consumption) via a GETBULK request with a large - max-repeaters value.

-
- - - - CVE-2007-5846 - - - 2007-11-06 - 2007-11-13 - 2007-11-14 - - - - - flac -- media file processing integer overflow vulnerabilities - - - flac - 1.1.2_2 - - - - -

iDefense Laps reports:

-
-

Remote exploitation of multiple integer overflow vulnerabilities - in libFLAC, as included with various vendor's software - distributions, allows attackers to execute arbitrary code - in the context of the currently logged in user.

-

These vulnerabilities specifically exist in the handling of - malformed FLAC media files. In each case, an integer overflow can - occur while calculating the amount of memory to allocate. As such, - insufficient memory is allocated for the data that is subsequently - read in from the file, and a heap based buffer overflow occurs.

-
- - - - CVE-2007-4619 - http://secunia.com/advisories/27210/ - http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=608 - - - 2007-10-11 - 2007-11-13 - - - - - xpdf -- multiple remote Stream.CC vulnerabilities - - - cups-base - 1.3.3_2 - - - gpdf - 0 - - - kdegraphics - 3.5.8_1 - - - koffice - 1.6.3_3,2 - - - poppler - 0.6 - - - xpdf - 3.02_5 - - - - -

Secunia Research reports:

-
-

Secunia Research has discovered some vulnerabilities in Xpdf, - which can be exploited by malicious people to compromise a user's - system.

-
    -
  • An array indexing error within the - "DCTStream::readProgressiveDataUnit()" method in xpdf/Stream.cc - can be exploited to corrupt memory via a specially crafted PDF - file.
    • -
  • An integer overflow error within the "DCTStream::reset()" - method in xpdf/Stream.cc can be exploited to cause a heap-based - buffer overflow via a specially crafted PDF file.
    • -
  • A boundary error within the "CCITTFaxStream::lookChar()" method - in xpdf/Stream.cc can be exploited to cause a heap-based buffer - overflow by tricking a user into opening a PDF file containing a - specially crafted "CCITTFaxDecode" filter.
    • -
-

Successful exploitation may allow execution of arbitrary code.

-
- - - - 26367 - CVE-2007-4352 - CVE-2007-5392 - CVE-2007-5393 - - - 2007-11-07 - 2007-11-12 - 2007-11-14 - - - - - plone -- unsafe data interpreted as pickles - - - plone - 2.52.5.5 - 3.03.0.3 - - - - -

Plone projectreports:

-
-

This hotfix corrects a vulnerability in the statusmessages - and linkintegrity modules, where unsafe network data was - interpreted as python pickles. This allows an attacker to - run arbitrary python code within the Zope/Plone process.

-
- - - - 26354 - CVE-2007-5741 - - - 2007-11-06 - 2007-11-12 - - - - - phpmyadmin -- cross-site scripting vulnerability - - - phpMyAdmin - 2.11.2.1 - - - - -

The DigiTrust Group reports:

-
-

When creating a new database, a malicious user can use a - client-side Web proxy to place malicious code in the db parameter of - the POST request. Since db_create.php does not properly sanitize - user-supplied input, an administrator could face a persistent XSS - attack when the database names are displayed.

-
- - - - CVE-2007-5976 - CVE-2007-5977 - http://www.digitrustgroup.com/advisories/tdg-advisory071108a.html - http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-7 - - - 2007-11-11 - 2007-11-11 - 2010-05-12 - - - - - gallery2 -- multiple vulnerabilities - - - gallery2 - 2.2.3 - - - - -

Gallery project reports:

-
-

Gallery 2.2.3 addresses the following security vulnerabilities:

-
    -
  • Unauthorized renaming of items possible with WebDAV (reported - by Merrick Manalastas)
    • -
  • Unauthorized modification and retrieval of item properties - possible with WebDAV
    • -
  • Unauthorized locking and replacing of items possible with - WebDAV
    • -
  • Unauthorized editing of data file possible via linked items with - Reupload and WebDAV (reported by Nicklous Roberts)
    • -
-
- - - - CVE-2007-4650 - 25580 - - - 2007-08-29 - 2007-11-09 - - - - - tikiwiki -- multiple vulnerabilities - - - tikiwik - 1.9.8.2 - - - - -

Secunia reports:

-
-

Some vulnerabilities have been reported in TikiWiki, which - can be exploited by malicious people to conduct cross-site - scripting and script insertion attacks and disclose potentially - sensitive information.

-

Input passed to the username parameter in tiki-remind_password.php - (when remind is set to send me my password) is not properly - sanitised before being returned to the user. This can be exploited - to execute arbitrary HTML and script code (for example with meta - refreshes to a javascript: URL) in a user's browser session in - context of an affected site.

-

Input passed to the local_php and error_handler parameters in - tiki-index.php is not properly verified before being used to include - files. This can be exploited to include arbitrary files from local - resources.

-

Input passed to the imp_language parameter in - tiki-imexport_languages.php is not properly verified before being - used to include files. This can be exploited to include arbitrary - files from local resources.

-

Certain img src elements are not properly santised before being - used. This can be exploited to insert arbitrary HTML and script - code, which is executed in a user's browser session in context of an - affected site when the malicious data is viewed.

-
- - - - CVE-2007-4554 - CVE-2007-5683 - CVE-2007-5684 - http://secunia.com/advisories/26618/ - http://tikiwiki.cvs.sourceforge.net/tikiwiki/tiki/changelog.txt?view=markup&pathrev=REL-1-9-8-2 - - - 2007-08-27 - 2007-11-09 - 2008-10-03 - - - - - cups -- off-by-one buffer overflow - - - cups-base - 1.3.3_1 - - - - -

Secunia reports:

-
-

Secunia Research has discovered a vulnerability in CUPS, which can - be exploited by malicious people to compromise a vulnerable - system.

-

The vulnerability is caused due to a boundary error within the - "ippReadIO()" function in cups/ipp.c when processing IPP (Internet - Printing Protocol) tags. This can be exploited to overwrite one - byte on the stack with a zero by sending an IPP request containing - specially crafted "textWithLanguage" or "nameWithLanguage" tags.

-

Successful exploitation allows execution of arbitrary code.

-
- - - - CVE-2007-4351 - http://secunia.com/secunia_research/2007-76/ - - - 2007-11-06 - 2007-11-09 - 2007-11-12 - - - - - perl -- regular expressions unicode data buffer overflow - - - perl - perl-threaded - 5.8.*5.8.8_1 - - - - -

Red Hat reports:

-
-

A flaw was found in Perl's regular expression engine. Specially - crafted input to a regular expression can cause Perl to improperly - allocate memory, possibly resulting in arbitrary code running with - the permissions of the user running Perl.

-
- - - - CVE-2007-5116 - http://secunia.com/advisories/27546/ - - - 2007-11-05 - 2007-11-06 - 2007-11-07 - - - - - pcre -- arbitrary code execution - - - pcre - pcre-utf8 - 7.3 - - - - -

Debian project reports:

-
-

Tavis Ormandy of the Google Security Team has discovered - several security issues in PCRE, the Perl-Compatible Regular - Expression library, which potentially allow attackers to - execute arbitrary code by compiling specially crafted regular - expressions.

-
- - - - CVE-2007-1659 - CVE-2007-1660 - CVE-2007-1661 - CVE-2007-1662 - CVE-2007-4766 - CVE-2007-4767 - CVE-2007-4768 - http://www.pcre.org/changelog.txt - - - 2007-11-05 - 2007-11-06 - - - - - perdition -- str_vwrite format string vulnerability - - - perdition - 1.17.1 - - - - -

SEC-Consult reports:

-
-

Perdition IMAP is affected by a format string bug in one of its - IMAP output-string formatting functions. The bug allows the - execution of arbitrary code on the affected server. - A successful exploit does not require prior authentication.

-
- - - - 26270 - CVE-2007-5740 - http://www.sec-consult.com/300.html - http://secunia.com/advisories/27458 - - - 2007-10-31 - 2007-11-05 - - - - - gftp -- multiple vulnerabilities - - - gftp - 2.0.18_6 - - - - -

Gentoo reports:

-
-

Kalle Olavi Niemitalo discovered two boundary errors in fsplib code - included in gFTP when processing overly long directory or file - names.

-

A remote attacker could trigger these vulnerabilities by enticing - a user to download a file with a specially crafted directory or file - name, possibly resulting in the execution of arbitrary code or a - Denial of Service.

-
- - - - CVE-2007-3961 - CVE-2007-3962 - http://www.gentoo.org/security/en/glsa/glsa-200711-01.xml - - - 2007-11-01 - 2007-11-05 - 2007-11-11 - - - - - dircproxy -- remote denial of service - - - dircproxy - 1.0.5_1 - - - dircproxy-devel - 1.2.0.b2_1 - - - - -

Securiweb reports:

-
-

dircproxy allows remote attackers to cause a denial of - service (segmentation fault) via an ACTION command without a - parameter, which triggers a NULL pointer dereference, as - demonstrated using a blank /me message from irssi.

-
- - - - CVE-2007-5226 - http://dircproxy.securiweb.net/ticket/89 - https://bugzilla.redhat.com/show_bug.cgi?id=319301 - - - 2006-09-06 - 2007-11-04 - 2008-01-31 - - - - - wordpress -- cross-site scripting - - - wordpress - de-wordpress - 2.3.1 - - - zh-wordpress - 0 - - - - -

A Secunia Advisory report:

-
-

Input passed to the "posts_columns" parameter in - wp-admin/edit-post-rows.php is not properly sanitised before - being returned to the user. This can be exploited to execute - arbitrary HTML and script code in a user's browser session in - context of an affected site.

-
- - - - CVE-2007-5710 - http://secunia.com/advisories/27407 - http://wordpress.org/development/2007/10/wordpress-231/ - - - 2007-10-29 - 2007-11-01 - - - - - openldap -- multiple remote denial of service vulnerabilities - - - openldap-server - 2.3.39 - 2.4.02.4.6 - - - - -

BugTraq reports:

-
-

OpenLDAP is prone to multiple remote denial-of-service - vulnerabilities because of an incorrect NULL-termination - issue and a double-free issue.

-
- - - - 26245 - CVE-2007-5707 - CVE-2007-5708 - - - 2007-10-29 - 2007-10-30 - 2007-10-31 - - - - - py-django -- denial of service vulnerability - - - py23-django - py24-django - py25-django - 0.96.1 - - - py23-django-devel - py24-django-devel - py25-django-devel - 20071026 - - - - -

Django project reports:

-
-

A per-process cache used by Django's internationalization - ("i18n") system to store the results of translation lookups - for particular values of the HTTP Accept-Language header - used the full value of that header as a key. An attacker - could take advantage of this by sending repeated requests - with extremely large strings in the Accept-Language header, - potentially causing a denial of service by filling available - memory.

-

Due to limitations imposed by Web server software on the - size of HTTP header fields, combined with reasonable limits - on the number of requests which may be handled by a single - server process over its lifetime, this vulnerability may be - difficult to exploit. Additionally, it is only present when - the "USE_I18N" setting in Django is "True" and the i18n - middleware component is enabled*. Nonetheless, all users of - affected versions of Django are encouraged to update.

-
- - - - http://www.djangoproject.com/weblog/2007/oct/26/security-fix/ - - - 2007-10-26 - 2007-10-27 - - - - - opera -- multiple vulnerabilities - - - opera - opera-devel - linux-opera - 9.24 - - - - -

An advisory from Opera reports:

-
-

If a user has configured Opera to use an external newsgroup - client or e-mail application, specially crafted Web pages can - cause Opera to run that application incorrectly. In some cases - this can lead to execution of arbitrary code.

-
-
-

When accesing frames from different Web sites, specially crafted - scripts can bypass the same-origin policy, and overwrite functions - from those frames. If scripts on the page then run those functions, - this can cause the script of the attacker's choice to run in the - context of the target Web site.

-
- - - - CVE-2007-5540 - CVE-2007-5541 - http://www.opera.com/support/search/view/866/ - http://www.opera.com/support/search/view/867/ - http://secunia.com/advisories/27277/ - - - 2007-10-17 - 2007-10-25 - - - - - drupal --- multiple vulnerabilities - - - drupal4 - 4.7.8 - - - drupal5 - 5.3 - - - - -

The Drupal Project reports:

-
-

In some circumstances Drupal allows user-supplied data to - become part of response headers. As this user-supplied data - is not always properly escaped, this can be exploited by - malicious users to execute HTTP response splitting attacks - which may lead to a variety of issues, among them cache - poisoning, cross-user defacement and injection of arbitrary - code.

-
-
-

The Drupal installer allows any visitor to provide credentials - for a database when the site's own database is not reachable. This - allows attackers to run arbitrary code on the site's server. - An immediate workaround is the removal of the file install.php - in the Drupal root directory.

-
-
-

The allowed extension list of the core Upload module contains - the extension HTML by default. Such files can be used to execute - arbitrary script code in the context of the affected site when a - user views the file. Revoking upload permissions or removing the - .html extension from the allowed extension list will stop uploads - of malicious files. but will do nothing to protect your site - againstfiles that are already present. Carefully inspect the file - system path for any HTML files. We recommend you remove any HTML - file you did not update yourself. You should look for , CSS - includes, Javascript includes, and onerror="" attributes if - you need to review files individually.

-
-
-

The Drupal Forms API protects against cross site request - forgeries (CSRF), where a malicious site can cause a user - to unintentionally submit a form to a site where he is - authenticated. The user deletion form does not follow the - standard Forms API submission model and is therefore not - protected against this type of attack. A CSRF attack may - result in the deletion of users.

-
-
-

The publication status of comments is not passed during the - hook_comments API operation, causing various modules that rely - on the publication status (such as Organic groups, or Subscriptions) - to mail out unpublished comments.

-
- - - - CVE-2007-5597 - CVE-2007-5596 - CVE-2007-5595 - CVE-2007-5594 - CVE-2007-5593 - http://drupal.org/node/184315 - http://drupal.org/node/184316 - http://drupal.org/node/184348 - http://drupal.org/node/184354 - http://drupal.org/node/184320 - http://secunia.com/advisories/27292 - http://secunia.com/advisories/27292 - http://secunia.com/advisories/27292 - http://secunia.com/advisories/27290 - http://secunia.com/advisories/27290 - - - 2007-10-17 - 2007-10-24 - - - - - ldapscripts -- Command Line User Credentials Disclosure - - - ldapscripts - 1.7.1 - - - - -

Ganael Laplanche reports:

-
-

Up to now, each ldap* command was called with the -w parameter, - which allows to specify the bind password on the command line. - Unfortunately, this could make the password appear to anybody - performing a `ps` during the call. This is now avoided by using - the -y parameter and a password file.

-
- - - - http://sourceforge.net/project/shownotes.php?group_id=156483&release_id=546600 - http://secunia.com/advisories/27111 - CVE-2007-5373 - - - 2007-10-09 - 2007-10-23 - - - - - firefox -- OnUnload Javascript browser entrapment vulnerability - - - firefox - 2.0.0.8,1 - - - linux-firefox - 2.0.0.8 - - - seamonkey - linux-seamonkey - 1.1.5 - - - - -

RedHat reports:

-
-

Several flaws were found in the way in which Firefox - displayed malformed web content. A web page containing - specially-crafted content could potentially trick a user - into surrendering sensitive information. (CVE-2007-1095, - CVE-2007-3844, CVE-2007-3511, CVE-2007-5334)

-
- - - - CVE-2007-1095 - - - 2007-10-19 - 2007-10-22 - 2007-10-23 - - - - - phpmyadmin -- cross-site scripting vulnerability - - - phpMyAdmin - 2.11.1.2 - - - - -

The DigiTrust Group discovered serious XSS vulnerability in - the phpMyAdmin server_status.php script. According to their - report

-
-

vulnerability can be exploited to execute arbitrary HTML and - script code in a user's browser session in context of an affected - site.

-
- - - - CVE-2007-5589 - http://www.digitrustgroup.com/advisories/TDG-advisory071015a.html - http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-6 - - - 2007-10-17 - 2007-10-17 - 2010-05-12 - - - - - phpmyadmin -- cross-site scripting vulnerability - - - phpMyAdmin - 2.11.1.1 - - - - -

SecurityFocus reports:

-
-

phpMyAdmin is prone to a cross-site scripting vulnerability - because it fails to properly sanitize user-supplied input.

-

An attacker may leverage this issue to execute arbitrary script - code in the browser of an unsuspecting user in the context of the - affected site. This may help the attacker steal potentially - sensitive information and launch other attacks.

-
- - - - CVE-2007-5386 - http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-5 - http://www.digitrustgroup.com/advisories/TDG-advisory071009a - http://secunia.com/advisories/27173 - 26020 - - - 2007-10-12 - 2007-10-16 - 2007-10-20 - - - - - nagios-plugins -- Long Location Header Buffer Overflow Vulnerability - - - nagios-plugins - 1.4.10,1 - - - - -

A Secunia Advisory reports:

-
-

The vulnerability is caused due to a boundary error within the - redir() function in check_http.c when processing HTTP Location: - header information. This can be exploited to cause a buffer overflow - by returning an overly long string in the "Location:" header to a - vulnerable system.

-
- - - - http://sourceforge.net/forum/forum.php?forum_id=740172 - http://secunia.com/advisories/27124/ - CVE-2007-5198 - - - 2007-09-28 - 2007-10-11 - - - - - png -- multiple vulnerabilities - - - png - 1.2.22 - - - - -

A Secunia Advisory reports:

-
-

Some vulnerabilities have been reported in libpng, which can be - exploited by malicious people to cause a DoS (Denial of - Service).

-

Certain errors within libpng, including a logical NOT instead of a - bitwise NOT in pngtrtran.c, an error in the 16bit cheap transparency - extension, and an incorrect use of sizeof() may be exploited to - crash an application using the library.

-

Various out-of-bounds read errors exist within the functions - png_handle_pCAL(), png_handle_sCAL(), png_push_read_tEXt(), - png_handle_iTXt(), and png_handle_ztXt(), which may be exploited by - exploited to crash an application using the library.

-
-
-

The vulnerability is caused due to an off-by-one error within - the ICC profile chunk handling, which potentially can be - exploited to crash an application using the library.

-
- - - - http://secunia.com/advisories/27093/ - http://secunia.com/advisories/27130/ - CVE-2007-5267 - CVE-2007-5266 - CVE-2007-5268 - CVE-2007-5269 - - - 2007-10-08 - 2007-10-11 - - - - - ImageMagick -- multiple vulnerabilities - - - ImageMagick - ImageMagick-nox11 - 6.3.5.9 - - - - -

Multiple vulnerabilities have been discovered in ImageMagick.

-
-

ImageMagick before 6.3.5-9 allows context-dependent attackers - to cause a denial of service via a crafted image file that - triggers (1) an infinite loop in the ReadDCMImage function, - related to ReadBlobByte function calls; or (2) an infinite - loop in the ReadXCFImage function, related to ReadBlobMSBLong - function calls.

-
-
-

Multiple integer overflows in ImageMagick before 6.3.5-9 - allow context-dependent attackers to execute arbitrary code - via a crafted (1) .dcm, (2) .dib, (3) .xbm, (4) .xcf, or (5) - .xwd image file, which triggers a heap-based buffer overflow.

-
-
-

Off-by-one error in the ReadBlobString function in blob.c in - ImageMagick before 6.3.5-9 allows context-dependent attackers - to execute arbitrary code via a crafted image file, which - triggers the writing of a '\0' character to an out-of-bounds - address.

-
-
-

Sign extension error in the ReadDIBImage function in - ImageMagick before 6.3.5-9 allows context-dependent attackers - to execute arbitrary code via a crafted width value in an - image file, which triggers an integer overflow and a - heap-based buffer overflow.

-
- - - - CVE-2007-4985 - CVE-2007-4986 - CVE-2007-4987 - CVE-2007-4988 - http://studio.imagemagick.org/pipermail/magick-announce/2007-September/000037.html - - - 2007-09-19 - 2007-10-10 - - - - - jdk/jre -- Applet Caching May Allow Network Access Restrictions to be Circumvented - - - jdk - 1.3.01.6.0.3p3 - 1.5.0,11.5.0.13p7,1 - - - linux-blackdown-jdk - 1.3.0 - - - linux-sun-jdk - 1.3.01.3.1.20 - 1.4.01.4.2.16 - 1.5.0.b1 - 1.5.0.b1,1 - 1.5.0,21.5.0.13,2 - 1.6.01.6.0.03 - - - - -

SUN reports:

-
-

A vulnerability in the Java Runtime Environment (JRE) with applet - caching may allow an untrusted applet that is downloaded from a - malicious website to make network connections to network services - on machines other than the one that the applet was downloaded from. - This may allow network resources (such as web pages) and - vulnerabilities (that exist on these network services) which are not - otherwise normally accessible to be accessed or exploited.

-
- - - - http://sunsolve.sun.com/search/document.do?assetkey=1-26-103079-1 - CVE-2007-5232 - - - 2007-10-03 - 2007-10-08 - 2007-11-16 - - - - - xfs -- multiple vulnerabilities - - - xfs - 1.0.5,1 - - - - -

Matthieu Herrb reports:

-
-

Problem Description:

-

Several vulnerabilities have been identified in xfs, the X font - server. The QueryXBitmaps and QueryXExtents protocol requests - suffer from lack of validation of their 'length' parameters.

-

Impact:

-

On most modern systems, the font server is accessible only for - local clients and runs with reduced privileges, but on some - systems it may still be accessible from remote clients and - possibly running with root privileges, creating an opportunity - for remote privilege escalation.

-
- - - - CVE-2007-4568 - http://lists.freedesktop.org/archives/xorg/2007-October/028899.html - - - 2007-10-02 - 2007-10-08 - - - - - tcl/tk -- buffer overflow in ReadImage function - - - tk - tk-threads - 8.2.*8.2.3_11 - 8.3.*8.3.5_10 - 8.4.*,28.4.16,2 - - - - -

A Buffer overflow in the ReadImage function in generic/tkImgGIF.c - in Tcl/Tk, allows remote attackers to execute arbitrary code via - multi-frame interlaced GIF files in which later frames are smaller - than the first.

- - - - http://secunia.com/advisories/26942 - http://sourceforge.net/project/shownotes.php?release_id=541207 - CVE-2007-5137 - - - 2007-09-27 - 2007-10-05 - 2011-09-04 - - - - - firebird -- multiple remote buffer overflow vulnerabilities - - - firebird-server - 1.*1.5.5 - 2.0.*2.0.3 - - - - -

RISE Security reports:

-
-

There exists multiple vulnerabilities within functions - of Firebird Relational Database, which when properly - exploited can lead to remote compromise of the vulnerable - system.

-
- - - - 25925 - - - 2007-10-03 - 2007-10-04 - - - - - id3lib -- insecure temporary file creation - - - id3lib - 3.8.3_4 - - - - -

Debian Bug report log reports:

-
-

When tagging file $foo, a temporary copy of the file is - created, and for some reason, libid3 doesn't use mkstemp - but just creates $foo.XXXXXX literally, without any checking.

-

This would silently truncate and overwrite an existing - $foo.XXXXXX.

-
- - - - 25372 - CVE-2007-4460 - - - 2007-08-20 - 2007-10-01 - 2007-10-01 - - - - - mediawiki -- cross site scripting vulnerability - - - mediawiki - 1.10.01.10.2 - 1.9.01.9.4 - 1.8.01.8.5 - - - - -

The MediaWiki development team reports:

-
-

A possible HTML/XSS injection vector in the API - pretty-printing mode has been found and fixed.

-

The vulnerability may be worked around in an unfixed version - by simply disabling the API interface if it is not in use, by - adding this to LocalSettings.php:

-

$wgEnableAPI = false;

-

(This is the default setting in 1.8.x.)

-
- - - - CVE-2007-4828 - http://lists.wikimedia.org/pipermail/mediawiki-announce/2007-September/000067.html - - - 2007-09-10 - 2007-09-21 - 2007-10-10 - - - - - wordpress -- remote sql injection vulnerability - - - wordpress - 2.2.3,1 - - - de-wordpress - zh-wordpress - 2.2.3 - - - wordpress-mu - 1.2.4,2 - - - - -

Alexander Concha reports:

-
-

While testing WordPress, it has been discovered a SQL - Injection vulnerability that allows an attacker to retrieve - remotely any user credentials from a vulnerable site, this - bug is caused because of early database escaping and the - lack of validation in query string like parameters.

-
- - - - CVE-2007-4894 - http://www.buayacorp.com/files/wordpress/wordpress-sql-injection-advisory.html - - - 2007-09-10 - 2007-09-21 - - - - - samba -- nss_info plugin privilege escalation vulnerability - - - samba - 3.0.26a - *,13.0.26a,1 - - - - -

The Samba development team reports:

-
-

The idmap_ad.so library provides an nss_info extension to - Winbind for retrieving a user's home directory path, login - shell and primary group id from an Active Directory domain - controller. This functionality is enabled by defining the - "winbind nss info" smb.conf option to either "sfu" or - "rfc2307".

-

Both the Windows "Identity Management for Unix" and - "Services for Unix" MMC plug-ins allow a user to be assigned - a primary group for Unix clients that differs from the user's - Windows primary group. When the rfc2307 or sfu nss_info plugin - has been enabled, in the absence of either the RFC2307 or SFU - primary group attribute, Winbind will assign a primary group ID - of 0 to the domain user queried using the getpwnam() C library - call.

-
- - - - CVE-2007-4138 - http://www.samba.org/samba/security/CVE-2007-4138.html - - - 2007-09-11 - 2007-09-21 - 2008-09-26 - - - - - bugzilla -- multiple vulnerabilities - - - bugzilla - ja-bugzilla - 2.20.*2.22.3 - 3.*3.0.1 - - - - -

A Bugzilla Security Advisory reports:

-
-

This advisory covers three security issues that have recently been - fixed in the Bugzilla code:

-
    -
  • A possible cross-site scripting (XSS) vulnerability when filing - bugs using the guided form.
    • -
  • When using email_in.pl, insufficiently escaped data may be - passed to sendmail.
    • -
  • Users using the WebService interface may access Bugzilla's - time-tracking fields even if they normally cannot see them.
    • -
-

We strongly advise that 2.20.x and 2.22.x users should upgrade to - 2.20.5 and 2.22.3 respectively. 3.0 users, and users of 2.18.x or - below, should upgrade to 3.0.1.

-
- - - - 25425 - CVE-2007-4538 - CVE-2007-4539 - CVE-2007-4543 - http://www.bugzilla.org/security/2.20.4/ - - - 2007-08-23 - 2007-09-21 - - - - - clamav -- multiple remote Denial of Service vulnerabilities - - - clamav - 0.91.2 - - - - -

BugTraq reports:

-
-

ClamAV is prone to multiple denial-of-service vulnerabilities.

-

A successful attack may allow an attacker to crash the - application and deny service to users.

-
- - - - 25398 - CVE-2007-4510 - - - 2007-08-21 - 2007-09-21 - - - - - coppermine -- multiple vulnerabilities - - - coppermine - 1.4.13 - - - - -

The coppermine development team reports two vulnerabilities - with the coppermine application. These vulnerabilities are - caused by improper checking of the log variable in "viewlog.php" - and improper checking of the referer variable in "mode.php". - This could allow local file inclusion, potentially disclosing - valuable information and could lead to an attacker conducting - a cross site scripting attack against the targeted site.

- - - - CVE-2007-4976 - CVE-2007-4977 - http://coppermine-gallery.net/forum/index.php?topic=46847.0 - - - 2007-09-14 - 2007-09-20 - 2010-05-12 - - - - - openoffice -- arbitrary command execution vulnerability - - - openoffice - 0 - - - - -

iDefense reports:

-
-

Remote exploitation of multiple integer overflow - vulnerabilities within OpenOffice, as included in various - vendors' operating system distributions, allows attackers to - execute arbitrary code.

-

These vulnerabilities exist within the TIFF parsing code of - the OpenOffice suite. When parsing the TIFF directory entries - for certain tags, the parser uses untrusted values from the - file to calculate the amount of memory to allocate. By - providing specially crafted values, an integer overflow occurs - in this calculation. This results in the allocation of a - buffer of insufficient size, which in turn leads to a heap - overflow.

-
- - - - CVE-2007-2834 - http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=593 - - - 2007-09-19 - 2007-09-20 - - - - - bugzilla -- "createmailregexp" security bypass vulnerability - - - bugzilla - 3.*3.0.2 - - - - -

The Bugzilla development team reports:

-
-

Bugzilla::WebService::User::offer_account_by_email does - not check the "createemailregexp" parameter, and thus - allows users to create accounts who would normally be - denied account creation. The "emailregexp" parameter is - still checked. If you do not have the SOAP::Lite Perl - module installed on your Bugzilla system, your system is - not vulnerable (because the Bugzilla WebService will not - be enabled).

-
- - - - CVE-2007-5038 - http://www.bugzilla.org/security/3.0.1/ - - - 2007-09-18 - 2007-09-20 - 2010-05-12 - - - - - konquerer -- address bar spoofing - - - kdebase - 3.5.7_3 - - - kdelibs - 3.5.7_2 - - - - -

The KDE development team reports:

-
-

The Konqueror address bar is vulnerable to spoofing attacks - that are based on embedding white spaces in the url. In addition - the address bar could be tricked to show an URL which it is - intending to visit for a short amount of time instead of the - current URL.

-
- - - - CVE-2007-3820 - CVE-2007-4224 - CVE-2007-4225 - http://www.kde.org/info/security/advisory-20070914-1.txt - - - 2007-09-14 - 2007-09-19 - - - - - kdm -- passwordless login vulnerability - - - kdebase3 - 3.5.7_3 - - - - -

The KDE development team reports:

-
-

KDM can be tricked into performing a password-less login - even for accounts with a password set under certain - circumstances, namely autologin to be configured and - "shutdown with password" enabled.

-
- - - - CVE-2007-4569 - http://www.kde.org/info/security/advisory-20070919-1.txt - - - 2007-09-19 - 2007-09-19 - - - - - flyspray -- authentication bypass - - - flyspray - 0.9.9.2 - - - - -

The Flyspray Project reports:

-
-

Flyspray authentication system can be bypassed by sending a - carefully crafted post request.

-

To be vulnerable, PHP configuration directive output_buffering - has to be disabled or set to a low value.

-
- - - - CVE-2007-1788 - http://www.flyspray.org/fsa:1 - - - 2007-03-13 - 2007-09-19 - - - - - mozilla -- code execution via Quicktime media-link files - - - firefox - 2.0.0.7,1 - - - linux-firefox - 2.0.0.7 - - - - seamonkey - linux-seamonkey - 1.1.5 - - - linux-firefox-devel - 3.0.a2007.12.12 - - - linux-seamonkey-devel - 2.0.a2007.12.12 - - - - firefox-ja - linux-mozilla-devel - linux-mozilla - mozilla - 0 - - - - -

The Mozilla Foundation reports a vulnerability within the - mozilla browser. This vulnerability also affects various - other browsers like firefox and seamonkey. The vulnerability - is caused by QuickTime Media-Link files that contain a qtnext - attribute. This could allow an attacker to start the browser - with arbitrary command-line options. This could allow the - attacker to install malware, steal local data and possibly - execute and/or do other arbitrary things within the users - context.

- - - - CVE-2006-4965 - http://www.mozilla.org/security/announce/2007/mfsa2007-28.html - - - 2007-09-18 - 2007-09-19 - 2007-12-14 - - - - - php -- multiple vulnerabilities - - - php5 - 5.2.4 - - - php4 - 4.4.8 - - - - -

The PHP development team reports:

-
-

Security Enhancements and Fixes in PHP 5.2.4:

-
    -
  • Fixed a floating point exception inside wordwrap() (Reported - by Mattias Bengtsson)
    • -
  • Fixed several integer overflows inside the GD extension - (Reported by Mattias Bengtsson)
    • -
  • Fixed size calculation in chunk_split() (Reported by Gerhard - Wagner)
    • -
  • Fixed integer overflow in str[c]spn(). (Reported by Mattias - Bengtsson)
    • -
  • Fixed money_format() not to accept multiple %i or %n tokens. - (Reported by Stanislav Malyshev)
    • -
  • Fixed zend_alter_ini_entry() memory_limit interruption - vulnerability. (Reported by Stefan Esser)
    • -
  • Fixed INFILE LOCAL option handling with MySQL extensions not - to be allowed when open_basedir or safe_mode is active. (Reported - by Mattias Bengtsson)
    • -
  • Fixed session.save_path and error_log values to be checked - against open_basedir and safe_mode (CVE-2007-3378) (Reported by - Maksymilian Arciemowicz)
    • -
  • Fixed a possible invalid read in glob() win32 implementation - (CVE-2007-3806) (Reported by shinnai)
    • -
  • Fixed a possible buffer overflow in php_openssl_make_REQ - (Reported by zatanzlatan at hotbrev dot com)
    • -
  • Fixed an open_basedir bypass inside glob() function (Reported - by dr at peytz dot dk)
    • -
  • Fixed a possible open_basedir bypass inside session extension - when the session file is a symlink (Reported by c dot i dot morris - at durham dot ac dot uk)
    • -
  • Improved fix for MOPB-03-2007.
    • -
  • Corrected fix for CVE-2007-2872.
    • -
-
- - - - CVE-2007-2872 - CVE-2007-3378 - CVE-2007-3806 - CVE-2007-3996 - CVE-2007-3997 - CVE-2007-3998 - CVE-2007-4652 - CVE-2007-4657 - CVE-2007-4658 - CVE-2007-4659 - CVE-2007-4660 - CVE-2007-4661 - CVE-2007-4662 - CVE-2007-4663 - CVE-2007-4670 - http://www.php.net/releases/4_4_8.php - http://www.php.net/releases/5_2_4.php - http://secunia.com/advisories/26642 - - - 2007-08-30 - 2007-09-11 - 2008-01-14 - - - - - apache -- multiple vulnerabilities - - - apache - 2.2.02.2.6 - 2.0.02.0.61 - - - - -

Apache HTTP server project reports:

-
-

The following potential security flaws are addressed:

-
    -
  • CVE-2007-3847: mod_proxy: Prevent reading past the end of a - buffer when parsing date-related headers.
    • -
  • CVE-2007-1863: mod_cache: Prevent a segmentation fault if - attributes are listed in a Cache-Control header without any - value.
    • -
  • CVE-2007-3304: prefork, worker, event MPMs: Ensure that the - parent process cannot be forced to kill processes outside its - process group.
    • -
  • CVE-2006-5752: mod_status: Fix a possible XSS attack against - a site with a public server-status page and ExtendedStatus - enabled, for browsers which perform charset "detection". - Reported by Stefan Esser.
    • -
  • CVE-2006-1862: mod_mem_cache: Copy headers into longer lived - storage; header names and values could previously point to - cleaned up storage.
    • -
-
- - - - CVE-2007-3847 - CVE-2007-1863 - CVE-2006-5752 - CVE-2007-3304 - - - 2007-09-07 - 2007-09-11 - - - - - lighttpd -- FastCGI header overrun in mod_fastcgi - - - lighttpd - 1.4.18 - - - - -

lighttpd maintainer reports:

-
-

Lighttpd is prone to a header overflow when using the mod_fastcgi - extension, this can lead to arbitrary code execution in the fastcgi - application. For a detailed description of the bug see the external - reference.

-

This bug was found by Mattias Bengtsson and Philip Olausson

-
- - - - http://www.lighttpd.net/assets/2007/9/9/lighttpd_sa_2007_12.txt - http://secweb.se/en/advisories/lighttpd-fastcgi-remote-vulnerability/ - CVE-2007-4727 - - - 2007-09-09 - 2007-09-10 - - - - - rkhunter -- insecure temporary file creation - - - rkhunter - 1.2.5 - - - - -

Gentoo reports:

-
-

Sune Kloppenborg Jeppesen and Tavis Ormandy of the Gentoo Linux - Security Team have reported that the check_update.sh script and - the main rkhunter script insecurely creates several temporary - files with predictable filenames.

-

A local attacker could create symbolic links in the temporary - files directory, pointing to a valid file somewhere on the - filesystem. When rkhunter or the check_update.sh script runs, - this would result in the file being overwritten with the rights of - the user running the utility, which could be the root user.

-
- - - - 13399 - CVE-2005-1270 - http://www.gentoo.org/security/en/glsa/glsa-200504-25.xml - - - 2005-04-26 - 2007-09-05 - - - - - lsh -- multiple vulnerabilities - - - lsh - 2.0.1 - - - - -

Secunia reports:

-
-

A vulnerability has been reported in LSH, which potentially - can be exploited by malicious people to cause a DoS (Denial - of Service).

-
- - - - CVE-2003-0826 - CVE-2005-0814 - http://secunia.com/advisories/14609 - - - 2005-03-17 - 2007-09-05 - 2008-01-07 - - - - - fetchmail -- denial of service on reject of local warning message - - - fetchmail - 4.6.86.3.8_4 - - - - -

Matthias Andree reports:

-
-

fetchmail will generate warning messages in certain - circumstances (for instance, when leaving oversized messages - on the server or login to the upstream fails) and send them - to the local postmaster or the user running it.

-

If this warning message is then refused by the SMTP listener - that fetchmail is forwarding the message to, fetchmail - crashes and does not collect further messages until it is - restarted.

-
- - - - CVE-2007-4565 - http://www.fetchmail.info/fetchmail-SA-2007-02.txt - - - 2007-07-29 - 2007-09-02 - - - - - gtar -- Directory traversal vulnerability - - - gtar - 1.18_1 - - - - -

Red Hat reports:

-
-

A path traversal flaw was discovered in the way GNU - tar extracted archives. A malicious user could create a - tar archive that could write to arbitrary files to which - the user running GNU tar had write access.

-
-

Red Hat credits Dmitry V. Levin for reporting the issue.

- - - - 25417 - CVE-2007-4131 - http://rhn.redhat.com/errata/RHSA-2007-0860.html - https://bugzilla.redhat.com/show_bug.cgi?id=251921 - - - 2007-08-23 - 2007-09-01 - - - - - claws-mail -- POP3 Format String Vulnerability - - - claws-mail - sylpheed-claws - 2.10.0_3 - - - sylpheed2 - 2.4.4_1 - - - - -

A Secunia Advisory reports:

-
-

A format string error in the "inc_put_error()" function in - src/inc.c when displaying a POP3 server's error response can - be exploited via specially crafted POP3 server replies containing - format specifiers.

-

Successful exploitation may allow execution of arbitrary code, - but requires that the user is tricked into connecting to a malicious - POP3 server.

-
- - - - CVE-2007-2958 - http://secunia.com/advisories/26550/ - http://secunia.com/secunia_research/2007-70/advisory/ - - - 2007-08-24 - 2007-08-27 - 2010-05-12 - - - - - rsync -- off by one stack overflow - - - rsync - 2.6.9_1 - - - - -

BugTraq reports:

-
-

The rsync utility is prone to an off-by-one buffer-overflow - vulnerability. This issue is due to a failure of the application - to properly bounds-check user-supplied input.

-

Successfully exploiting this issue may allow arbitrary - code-execution in the context of the affected utility.

-
- - - - 25336 - CVE-2007-4091 - - - 2007-08-15 - 2007-08-21 - 2007-08-23 - - - - - opera -- Vulnerability in javascript handling - - - opera - opera-devel - linux-opera - 9.23.20070809 - - - - -

An advisory from Opera reports:

-
-

A specially crafted JavaScript can make Opera execute - arbitrary code.

-
- - - - http://www.opera.com/support/search/view/865/ - - - 2007-08-03 - 2007-08-15 - 2007-08-25 - - - - - fsplib -- multiple vulnerabilities - - - fsplib - 0.9 - - - - -

A Secunia Advisory reports:

-
-

fsplib can be exploited to compromise an application using - the library.

-

A boundary error exists in the processing of file names in - fsp_readdir_native, which can be exploited to cause a stack-based - buffer overflow if the defined MAXNAMLEN is bigger than 256.

-

A boundary error exists in the processing of directory entries in - fsp_readdir, which can be exploited to cause a stack-based buffer - overflow on systems with an insufficient size allocated for the - d_name field of directory entries.

-
- - - - CVE-2007-3961 - CVE-2007-3962 - http://secunia.com/advisories/26184/ - - - 2007-07-24 - 2007-08-02 - - - - - joomla -- multiple vulnerabilities - - - joomla - 1.0.13 - - - - -

A Secunia Advisory reports:

-

joomla can be exploited to conduct session fixation - attacks, cross-site scripting attacks or HTTP response - splitting attacks.

-

Certain unspecified input passed in com_search, com_content and - mod_login is not properly sanitised before being returned to a - user. This can be exploited to execute arbitrary HTML and script - code in a user's browser session in context of an affected - site.

-

Input passed to the url parameter is not properly sanitised - before being returned to the user. This can be exploited to insert - arbitrary HTTP headers, which will be included in a response sent - to the user, allowing for execution of arbitrary HTML and script - code in a user's browser session in context of an affected - site.

-

An error exists in the handling of sessions and can be exploited - to hijack another user's session by tricking the user into logging - in after following a specially crafted link.

- - - - CVE-2007-4188 - CVE-2007-4189 - CVE-2007-4190 - CVE-2007-5577 - http://www.joomla.org/content/view/3677/1/ - http://secunia.com/advisories/26239/ - - - 2007-07-30 - 2007-08-02 - 2010-05-12 - - - - - FreeBSD -- Buffer overflow in tcpdump(1) - - - tcpdump - 3.9.6 - - - FreeBSD - 6.26.2_7 - 6.16.1_19 - 5.55.5_15 - - - - -

Problem Description:

-

An un-checked return value in the BGP dissector code can - result in an integer overflow. This value is used in - subsequent buffer management operations, resulting in a stack - based buffer overflow under certain circumstances.

-

Impact:

-

By crafting malicious BGP packets, an attacker could exploit - this vulnerability to execute code or crash the tcpdump - process on the target system. This code would be executed in - the context of the user running tcpdump(1). It should be - noted that tcpdump(1) requires privileges in order to open live - network interfaces.

-

Workaround:

-

No workaround is available.

- - - - CVE-2007-3798 - SA-07:06.tcpdump - - - 2007-08-01 - 2007-08-02 - 2016-08-09 - - - - - FreeBSD -- Predictable query ids in named(8) - - - named - 9.49.4.1.1 - 9.39.3.4.1 - - - FreeBSD - 6.26.2_7 - 6.16.1_19 - 5.55.5_15 - - - - -

Problem Description:

-

When named(8) is operating as a recursive DNS server or - sending NOTIFY requests to slave DNS servers, named(8) - uses a predictable query id.

-

Impact:

-

An attacker who can see the query id for some request(s) - sent by named(8) is likely to be able to perform DNS cache - poisoning by predicting the query id for other request(s).

-

Workaround:

-

No workaround is available.

- - - - CVE-2007-2926 - SA-07:07.bind - - - 2007-07-24 - 2007-08-02 - 2016-08-09 - - - - - xpdf -- stack based buffer overflow - - - xpdf - 3.02_2 - - - kdegraphics - 3.5.7_1 - - - cups-base - 1.2.11_3 - - - gpdf - 0 - - - pdftohtml - 0.39_3 - - - poppler - 0.5.9_4 - - - - -

The KDE Team reports:

-
-

kpdf, the KDE pdf viewer, shares code with xpdf. xpdf contains - a vulnerability that can cause a stack based buffer overflow - via a PDF file that exploits an integer overflow in - StreamPredictor::StreamPredictor(). Remotely supplied - pdf files can be used to disrupt the kpdf viewer on - the client machine and possibly execute arbitrary code.

-
- - - - 25124 - CVE-2007-3387 - http://www.kde.org/info/security/advisory-20070730-1.txt - - - 2007-07-30 - 2007-07-31 - 2009-04-29 - - - - - - - - - mutt -- buffer overflow vulnerability - - - mutt - mutt-lite - ja-mutt - zh-mutt - 1.4.2.3 - - - - -

Securityfocus reports:

-
-

Mutt is prone to a local buffer-overflow vulnerability - because it fails to properly bounds-check user-supplied - input before using it in a memory copy operation. - An attacker can exploit this issue to execute arbitrary - code with the with the privileges of the victim. Failed - exploit attempts will result in a denial of service.

-
- - - - 24192 - CVE-2007-2683 - http://www.redhat.com/support/errata/RHSA-2007-0386.html - - - 2007-05-28 - 2007-07-29 - - - - - p5-Net-DNS -- multiple Vulnerabilities - - - p5-Net-DNS - 0.60 - - - - -

A Secunia Advisory reports:

-
-

An error exists in the handling of DNS queries where IDs are - incremented with a fixed value and are additionally used for - child processes in a forking server. This can be exploited to - poison the DNS cache of an application using the module if a - valid ID is guessed.

-

An error in the PP implementation within the "dn_expand()" - function can be exploited to cause a stack overflow due to an - endless loop via a specially crafted DNS packet.

-
- - - - CVE-2007-3377 - CVE-2007-3409 - http://secunia.com/advisories/25829/ - - - 2007-06-27 - 2007-07-28 - - - - - phpsysinfo -- url Cross-Site Scripting - - - phpSysInfo - 2.5.3_1 - - - - -

Doz reports:

-
-

A Input passed in the URL to index.php is not properly - sanitised before being returned to the user. This can be - exploited to execute arbitrary HTML and script code in a - user's browser session in context of an affected site.

-
- - - - http://secunia.com/advisories/26248/ - - - 2007-07-27 - 2007-07-28 - 2007-08-01 - - - - - drupal -- Cross site request forgeries - - - drupal5 - 5.2 - - - - -

The Drupal Project reports:

-
-

Several parts in Drupal core are not protected against cross - site request forgeries due to inproper use of the Forms API, - or by taking action solely on GET requests. Malicious users are - able to delete comments and content revisions and disable menu - items by enticing a privileged users to visit certain URLs while - the victim is logged-in to the targeted site.

-
- - - - http://drupal.org/node/162360 - http://secunia.com/advisories/26224/ - - - 2007-07-26 - 2007-07-28 - - - - - drupal -- Multiple cross-site scripting vulnerabilities - - - drupal4 - 4.7.7 - - - drupal5 - 5.2 - - - - -

The Drupal Project reports:

-
-

Some server variables are not escaped consistently. When - a malicious user is able to entice a victim to visit a specially - crafted link or webpage, arbitrary HTML and script code can be - injected and executed in the context of the victim's session on - the targeted website.

-

Custom content type names are not escaped consistently. A - malicious user with the 'administer content types' permission - would be able to inject and execute arbitrary HTML and script - code on the website. Revoking the 'administer content types' - permission provides an immediate workaround.

-
- - - - http://drupal.org/node/162361 - http://secunia.com/advisories/26224/ - - - 2007-07-26 - 2007-07-28 - - - - - vim -- Command Format String Vulnerability - - - vim - vim-console - vim-lite - vim-ruby - vim6 - vim6-ruby - 7.1.39 - - - - -

A Secunia Advisory reports:

-
-

A format string error in the "helptags_one()" function in - src/ex_cmds.c when running the "helptags" command can be exploited - to execute arbitrary code via specially crafted help files.

-
- - - - CVE-2007-2953 - http://secunia.com/advisories/25941/ - - - 2007-07-27 - 2007-07-27 - - - - - libvorbis -- Multiple memory corruption flaws - - - libvorbis - 1.2.0,3 - - - - -

isecpartners reports:

-
-

libvorbis contains several vulnerabilities - allowing heap overwrite, read violations and a function - pointer overwrite. These bugs cause a at least a denial - of service, and potentially code execution.

-
- - - - http://www.isecpartners.com/advisories/2007-003-libvorbis.txt - CVE-2007-3106 - - - 2007-06-05 - 2007-07-26 - - - - - tomcat -- XSS vulnerability in sample applications - - - apache-tomcat - 6.0.06.0.11 - - - tomcat - 5.0.05.5.24 - - - jakarta-tomcat - 5.0.05.5.24 - - - - -

The Apache Project reports:

-
-

The JSP and Servlet included in the sample application within - the Tomcat documentation webapp did not escape user provided - data before including it in the output. This enabled a XSS - attack. These pages have been simplified not to use any user - provided data in the output.

-
- - - - CVE-2007-1355 - 24058 - - - 2007-05-19 - 2007-07-24 - - - - - tomcat -- multiple vulnerabilities - - - apache-tomcat - 4.1.04.1.36 - 6.0.06.0.11 - - - tomcat - 5.0.05.5.23 - - - jakarta-tomcat - 4.0.04.1.0 - 5.0.05.5.23 - - - - -

Apache Project reports:

-
-

The Apache Tomcat team is proud to announce the immediate - availability of Tomcat 4.1.36 stable. This build contains - numerous library updates, A small number of bug fixes and - two important security fixes.

-
- - - - CVE-2005-2090 - CVE-2007-0450 - CVE-2007-1358 - - - 2007-04-27 - 2007-07-24 - - - - - dokuwiki -- XSS vulnerability in spellchecker backend - - - dokuwiki - 20070626_1 - - - dokuwiki-devel - 20070524_1 - - - - -

DokuWiki reports:

-
-

The spellchecker tests the UTF-8 capabilities of the used browser - by sending an UTF-8 string to the backend, which will send it back - unfiltered. By comparing string length the spellchecker can work - around broken implementations. An attacker could construct a form to - let users send JavaScript to the spellchecker backend, resulting in - malicious JavaScript being executed in their browser.

-

Affected are all versions up to and including 2007-06-26 even when - the spell checker is disabled.

-
- - - - http://xforce.iss.net/xforce/xfdb/35501 - CVE-2007-3930 - - - 2007-06-26 - 2007-07-24 - - - - - lighttpd -- multiple vulnerabilities - - - lighttpd - 1.4.15_1 - - - - -

Secunia Advisory reports:

-
-

Some vulnerabilities have been reported in lighttpd, - which can be exploited by malicious people to bypass - certain security restrictions or cause a DoS (Denial - of Service).

-
- - - - CVE-2007-3947 - CVE-2007-3948 - CVE-2007-3949 - CVE-2007-3950 - http://trac.lighttpd.net/trac/ticket/1216 - http://trac.lighttpd.net/trac/ticket/1232 - http://trac.lighttpd.net/trac/ticket/1230 - http://trac.lighttpd.net/trac/ticket/1263 - - - 2007-07-20 - 2007-07-21 - 2010-05-12 - - - - - opera -- multiple vulnerabilities - - - opera - opera-devel - linux-opera - 9.22 - - - - -

Opera Software ASA reports of multiple security fixes in - Opera, including an arbitrary code execute - vulnerability:

-
-

Opera for Linux, FreeBSD, and Solaris has a flaw in the - createPattern function that leaves old data that was in - the memory before Opera allocated it in the new - pattern. The pattern can be read and analyzed by - JavaScript, so an attacker can get random samples of the - user's memory, which may contain data.

-
-
-

Removing a specially crafted torrent from the download - manager can crash Opera. The crash is caused by an - erroneous memory access.

-

An attacker needs to entice the user to accept the - malicious BitTorrent download, and later remove it from - Opera's download manager. To inject code, additional means - will have to be employed.

-

Users clicking a BitTorrent link and rejecting the - download are not affected.

-
-
-

data: URLs embed data inside them, instead of linking to - an external resource. Opera can mistakenly display the end - of a data URL instead of the beginning. This allows an - attacker to spoof the URL of a trusted site.

-
-
-

Opera's HTTP authentication dialog is displayed when the - user enters a Web page that requires a login name and a - password. To inform the user which server it was that - asked for login credentials, the dialog displays the - server name.

-

The user has to see the entire server name. A truncated - name can be misleading. Opera's authentication dialog cuts - off the long server names at the right hand side, adding - an ellipsis (...) to indicate that it has been cut off.

-

The dialog has a predictable size, allowing an attacker - to create a server name which will look almost like a - trusted site, because the real domain name has been cut - off. The three dots at the end will not be obvious to all - users.

-

This flaw can be exploited by phishers who can set up - custom sub-domains, for example by hosting their own - public DNS.

-
- - - - CVE-2007-3929 - CVE-2007-4944 - http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=564 - http://www.opera.com/support/search/view/861/ - http://www.opera.com/support/search/view/862/ - http://www.opera.com/support/search/view/863/ - http://www.opera.com/support/search/view/864/ - http://www.opera.com/docs/changelogs/freebsd/922/ - - - 2007-07-19 - 2007-07-19 - 2010-05-12 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 2.0.0.5,1 - 3.*,13.0.a2_3,1 - - - linux-firefox - linux-thunderbird - mozilla-thunderbird - thunderbird - 2.0.0.5 - - - - seamonkey - linux-seamonkey - 1.1.3 - - - linux-firefox-devel - 3.0.a2007.12.12 - - - linux-seamonkey-devel - 2.0.a2007.12.12 - - - - firefox-ja - linux-mozilla-devel - linux-mozilla - mozilla - 0 - - - - -

The Mozilla Foundation reports of multiple security issues - in Firefox, Seamonkey, and Thunderbird. Several of these - issues can probably be used to run arbitrary code with the - privilege of the user running the program.

-
-
    -
  • MFSA 2007-25 XPCNativeWrapper pollution
    • -
  • MFSA 2007-24 Unauthorized access to wyciwyg:// documents
    • -
  • MFSA 2007-21 Privilege escalation using an event - handler attached to an element not in the document
    • -
  • MFSA 2007-20 Frame spoofing while window is loading
    • -
  • MFSA 2007-19 XSS using addEventListener and setTimeout
    • -
  • MFSA 2007-18 Crashes with evidence of memory corruption
    • -
-
- - - - CVE-2007-3089 - CVE-2007-3734 - CVE-2007-3735 - CVE-2007-3737 - CVE-2007-3738 - http://www.mozilla.org/projects/security/known-vulnerabilities.html#firefox2.0.0.5 - http://www.mozilla.org/security/announce/2007/mfsa2007-18.html - http://www.mozilla.org/security/announce/2007/mfsa2007-19.html - http://www.mozilla.org/security/announce/2007/mfsa2007-20.html - http://www.mozilla.org/security/announce/2007/mfsa2007-21.html - http://www.mozilla.org/security/announce/2007/mfsa2007-24.html - http://www.mozilla.org/security/announce/2007/mfsa2007-25.html - TA07-199A - - - 2007-07-17 - 2007-07-19 - 2008-06-21 - - - - - linux-flashplugin -- critical vulnerabilities - - - linux-flashplugin - 9.09.0r45 - 8.08.0r34 - 7.0r69 - - - - -

Adobe reports:

-
-

Critical vulnerabilities have been identified in - Adobe Flash Player that could allow an attacker who - successfully exploits these potential vulnerabilities - to take control of the affected system. A malicious - SWF must be loaded in Flash Player by the user for - an attacker to exploit these potential vulnerabilities.

-
- - - - CVE-2007-2022 - CVE-2007-3456 - CVE-2007-3457 - - - 2007-07-10 - 2007-07-18 - - - - - wireshark -- Multiple problems - - - wireshark - wireshark-lite - ethereal - ethereal-lite - tethereal - tethereal-lite - 0.8.200.99.6 - - - - -

wireshark Team reports:

-
-

It may be possible to make Wireshark or Ethereal crash or use up - available memory by injecting a purposefully malformed packet onto - the wire or by convincing someone to read a malformed packet trace - file.

-
- - - - CVE-2007-3389 - CVE-2007-3390 - CVE-2007-3391 - CVE-2007-3392 - CVE-2007-3393 - http://secunia.com/advisories/25833/ - http://www.wireshark.org/security/wnpa-sec-2007-02.html - - - 2007-06-29 - 2007-07-06 - 2010-05-12 - - - - - typespeed -- arbitrary code execution - - - typespeed - 0.4.1 - - - - -

Debian reports:

-
-

Ulf Härnhammar from the Debian Security Audit Project - discovered a problem in typespeed, a touch-typist trainer - disguised as game. This could lead to a local attacker - executing arbitrary code.

-
- - - - CVE-2005-0105 - http://www.debian.org/security/2005/dsa-684 - - - 2005-02-16 - 2007-07-03 - 2007-07-09 - - - - - vlc -- format string vulnerability and integer overflow - - - vlc - 0.8.6c - - - - -

isecpartners reports:

-
-

VLC is vulnerable to a format string attack in the parsing - of Vorbis comments in Ogg Vorbis and Ogg Theora files, CDDA - data or SAP/SDP service discovery messages. Additionally, - there are two errors in the handling of wav files, one a - denial of service due to an uninitialized variable, and one - integer overflow in sampling frequency calculations.

-
- - - - CVE-2007-3316 - CVE-2007-3468 - CVE-2007-3467 - http://www.isecpartners.com/advisories/2007-001-vlc.txt - - - 2007-06-05 - 2007-06-18 - 2010-05-12 - - - - - flac123 -- stack overflow in comment parsing - - - flac123 - 0.0.10 - - - - -

isecpartners reports:

-
-

flac123, also known as flac-tools, is vulnerable - to a buffer overflow in vorbis comment parsing. - This allows for the execution of arbitrary code.

-
- - - - CVE-2007-3507 - http://sourceforge.net/forum/forum.php?forum_id=710314 - http://www.isecpartners.com/advisories/2007-002-flactools.txt - - - 2007-06-05 - 2007-06-28 - 2007-08-10 - - - - - gd -- multiple vulnerabilities - - - gd - 2.0.35,1 - - - - -

gd had been reported vulnerable to several - vulnerabilities:

-
    -
  • CVE-2007-3472: Integer overflow in gdImageCreateTrueColor - function in the GD Graphics Library (libgd) before 2.0.35 - allows user-assisted remote attackers has unspecified attack - vectors and impact.
    • -
  • CVE-2007-3473: The gdImageCreateXbm function in the GD - Graphics Library (libgd) before 2.0.35 allows user-assisted - remote attackers to cause a denial of service (crash) via - unspecified vectors involving a gdImageCreate failure.
    • -
  • CVE-2007-3474: Multiple unspecified vulnerabilities in the GIF - reader in the GD Graphics Library (libgd) before 2.0.35 allow - user-assisted remote attackers to have unspecified attack vectors - and impact.
    • -
  • CVE-2007-3475: The GD Graphics Library (libgd) before 2.0.35 - allows user-assisted remote attackers to cause a denial of service - (crash) via a GIF image that has no global color map.
    • -
  • CVE-2007-3476: Array index error in gd_gif_in.c in the GD Graphics - Library (libgd) before 2.0.35 allows user-assisted remote attackers - to cause a denial of service (crash and heap corruption) via large - color index values in crafted image data, which results in a - segmentation fault.
    • -
  • CVE-2007-3477: The (a) imagearc and (b) imagefilledarc functions - in GD Graphics Library (libgd) before 2.0.35 allows attackers to - cause a denial of service (CPU consumption) via a large (1) start or - (2) end angle degree value.
    • -
  • CVE-2007-3478: Race condition in gdImageStringFTEx - (gdft_draw_bitmap) in gdft.c in the GD Graphics Library (libgd) - before 2.0.35 allows user-assisted remote attackers to cause a - denial of service (crash) via unspecified vectors, possibly - involving truetype font (TTF) support.
    • -
- - - - CVE-2007-3472 - CVE-2007-3473 - CVE-2007-3474 - CVE-2007-3475 - CVE-2007-3476 - CVE-2007-3477 - CVE-2007-3478 - http://www.libgd.org/ReleaseNote020035 - http://www.frsirt.com/english/advisories/2007/2336 - http://bugs.libgd.org/?do=details&task_id=89 - http://bugs.libgd.org/?do=details&task_id=94 - http://bugs.libgd.org/?do=details&task_id=70 - http://bugs.libgd.org/?do=details&task_id=87 - http://bugs.libgd.org/?do=details&task_id=92 - http://bugs.libgd.org/?do=details&task_id=74 - http://bugs.libgd.org/?do=details&task_id=48 - http://bugs.php.net/bug.php?id=40578 - - - 2007-06-21 - 2007-06-29 - - - - - evolution-data-server -- remote execution of arbitrary code vulnerability - - - evolution-data-server - 1.10.2_1 - 1.11.*1.11.4 - - - - -

Debian project reports:

-
-

It was discovered that the IMAP code in the Evolution - Data Server performs insufficient sanitising of a value - later used an array index, which can lead to the execution - of arbitrary code.

-
- - - - CVE-2007-3257 - http://secunia.com/advisories/25766/ - http://bugzilla.gnome.org/show_bug.cgi?id=447414 - - - 2007-06-23 - 2007-06-25 - 2007-06-28 - - - - - xpcd -- buffer overflow - - - xpcd - 0 - - - - -

Debian Project reports:

-
-

Erik Sjolund discovered a buffer overflow in pcdsvgaview, - an SVGA PhotoCD viewer. xpcd-svga is part of xpcd and uses - svgalib to display graphics on the Linux console for which - root permissions are required. A malicious user could - overflow a fixed-size buffer and may cause the program to - execute arbitrary code with elevated privileges.

-
- - - - 12523 - CVE-2005-0074 - http://www.debian.org/security/2005/dsa-676 - - - 2005-02-11 - 2007-06-21 - - - - - clamav -- multiple vulnerabilities - - - clamav - 0.90.3 - - - - -

Clamav had been found vulnerable to multiple vulnerabilities:

-
    -
  • Improper checking for the end of an buffer causing an - unspecified attack vector.
    • -
  • Insecure temporary file handling, which could be exploited - to read sensitive information.
    • -
  • A flaw in the parser engine which could allow a remote - attacker to bypass the scanning of RAR files.
    • -
  • A flaw in libclamav/unrar.c which could cause a remote - Denial of Service (DoS) by sending a specially crafted - RAR file with a modified vm_codesize.
    • -
  • A flaw in the OLE2 parser which could cause a remote - Denial of Service (DoS).
    • -
- - - - CVE-2007-2650 - CVE-2007-3023 - CVE-2007-3024 - CVE-2007-3122 - CVE-2007-3123 - http://news.gmane.org/gmane.comp.security.virus.clamav.devel/cutoff=2853 - - - 2007-04-18 - 2007-06-19 - - - - - p5-Mail-SpamAssassin -- local user symlink-attack DoS vulnerability - - - p5-Mail-SpamAssassin - 3.2.1 - - - - -

SpamAssassin website reports:

-
-

A local user symlink-attack DoS vulnerability in - SpamAssassin has been found, affecting versions 3.1.x, - 3.2.0, and SVN trunk.

-
- - - - http://spamassassin.apache.org/advisories/cve-2007-2873.txt - CVE-2007-2873 - - - 2007-06-11 - 2007-06-18 - - - - - cups -- Incomplete SSL Negotiation Denial of Service - - - cups-base - 1.2.11 - - - - -

Secunia reports:

-
-

CUPS is not using multiple workers to handle connections. - This can be exploited to stop CUPS from accepting new connections - by starting but never completing an SSL negotiation.

-
- - - - http://secunia.com/advisories/24517/ - http://security.gentoo.org/glsa/glsa-200703-28.xml - CVE-2007-0720 - - - 2007-05-05 - 2007-06-12 - - - - - c-ares -- DNS Cache Poisoning Vulnerability - - - c-ares - 1.4.0 - - - - -

Secunia reports:

-
-

The vulnerability is caused due to predictable - DNS "Transaction ID" field in DNS queries and can - be exploited to poison the DNS cache of an application - using the library if a valid ID is guessed.

-
- - - - CVE-2007-3152 - CVE-2007-3153 - http://secunia.com/advisories/25579/ - http://cool.haxx.se/cvs.cgi/curl/ares/CHANGES?rev=HEAD&content-type=text/vnd.viewcvs-markup - - - 2007-06-08 - 2007-06-09 - 2010-05-12 - - - - - wordpress -- XMLRPC SQL Injection - - - wordpress - de-wordpress - zh-wordpress - 2.2.1 - - - - -

Secunia reports:

-
-

Slappter has discovered a vulnerability in WordPress, which can - be exploited by malicious users to conduct SQL injection - attacks.

-

Input passed to the "wp.suggestCategories" method in xmlrpc.php - is not properly sanitised before being used in SQL queries. This - can be exploited to manipulate SQL queries by injecting arbitrary - SQL code.

-

Successful exploitation allows e.g. retrieving usernames and - password hashes, but requires valid user credentials and knowledge - of the database table prefix.

-
- - - - 24344 - http://secunia.com/advisories/25552/ - - - 2007-06-06 - 2007-06-09 - 2007-06-24 - - - - - wordpress -- unmoderated comments disclosure - - - wordpress - de-wordpress - zh-wordpress - 2.2.2 - - - - -

Blogsecurity reports:

-
-

An attacker can read comments on posts that have not been - moderated. This can be a real security risk if blog admins - are using unmoderated comments (comments that have not been - made public) to hide sensitive notes regarding posts, future - work, passwords etc. So please be careful if you are one of - these blog admins.

-
- - - - http://blogsecurity.net/news/news-310507/ - - - 2007-06-01 - 2007-06-09 - 2007-08-16 - - - - - webmin -- cross site scripting vulnerability - - - webmin - 1.350 - - - - -

Secunia reports:

-
-

Input passed to unspecified parameters in pam_login.cgi - is not properly sanitised before being returned to the - user. This can be exploited to execute arbitrary HTML and - script code in a user's browser session in context of an - affected site.

-
- - - - 24381 - CVE-2007-3156 - http://secunia.com/advisories/25580/ - http://www.webmin.com/changes-1.350.html - - - 2007-06-01 - 2007-06-09 - 2010-05-12 - - - - - mplayer -- cddb stack overflow - - - mplayer - mplayer-esound - mplayer-gtk - mplayer-gtk2 - mplayer-gtk-esound - mplayer-gtk2-esound - 0.99.10_10 - - - - -

Mplayer Team reports:

-
-

A stack overflow was found in the code used to handle - cddb queries. When copying the album title and category, - no checking was performed on the size of the strings - before storing them in a fixed-size array. A malicious - entry in the database could trigger a stack overflow in - the program, leading to arbitrary code execution with the - uid of the user running MPlayer.

-
- - - - 24302 - CVE-2007-2948 - - - 2007-06-06 - 2007-06-07 - - - - - mod_jk -- information disclosure - - - mod_jk - 1.2.23,1 - - - mod_jk-ap2 - 1.2.23 - - - - -

Kazu Nambo reports:

-
-

URL decoding the the Apache webserver prior to - decoding in the Tomcat server could pypass access - control rules and give access to pages on a different - AJP by sending a crafted URL.

-
- - - - CVE-2007-1860 - http://secunia.com/advisories/25383/ - http://tomcat.apache.org/connectors-doc/news/20070301.html#20070518.1 - http://tomcat.apache.org/security-jk.html - - - 2007-05-18 - 2007-06-05 - 2007-10-31 - - - - - typo3 -- email header injection - - - typo3 - 3.04.0.5 - 4.14.1.1 - - - - -

Olivier Dobberkau, Andreas Otto, and Thorsten Kahler report:

-
-

An unspecified error in the internal form engine can be used for - sending arbitrary mail headers, using it for purposes which it - is not meant for, e.g. sending spam messages.

-
- - - - CVE-2007-1081 - http://secunia.com/advisories/24207/ - http://typo3.org/teams/security/security-bulletins/typo3-20070221-1/ - - - 2007-02-21 - 2007-06-04 - - - - - phppgadmin -- cross site scripting vulnerability - - - phppgadmin - 4.1.1 - - - - -

SecurityFocus reports about phppgadmin:

-
-

Exploiting this vulnerability may allow an attacker to perform - cross-site scripting attacks on unsuspecting users in the context - of the affected website. As a result, the attacker may be able to - steal cookie-based authentication credentials and to launch other - attacks.

-
- - - - 24115 - CVE-2007-5728 - http://lists.grok.org.uk/pipermail/full-disclosure/2007-May/063617.html - http://secunia.com/advisories/25446/ - - - 2007-05-27 - 2007-06-04 - 2010-05-12 - - - - - findutils -- GNU locate heap buffer overrun - - - findutils - 4.2.31 - - - - -

James Youngman reports:

-
-

When GNU locate reads filenames from an old-format locate database, - they are read into a fixed-length buffer allocated on the heap. - Filenames longer than the 1026-byte buffer can cause a buffer - overrun. The overrunning data can be chosen by any person able to - control the names of filenames created on the local system. This - will normally include all local users, but in many cases also remote - users (for example in the case of FTP servers allowing uploads).

-
- - - - CVE-2007-2452 - http://lists.gnu.org/archive/html/bug-findutils/2007-06/msg00000.html - - - 2007-05-30 - 2007-06-01 - - - - - FreeType 2 -- Heap overflow vulnerability - - - freetype2 - 2.2.1_2 - - - - -
-

Integer signedness error in truetype/ttgload.c in Freetype 2.3.4 and - earlier might allow remote attackers to execute arbitrary code via a - crafted TTF image with a negative n_points value, which leads to an - integer overflow and heap-based buffer overflow.

-
- - - - CVE-2007-2754 - http://lists.gnu.org/archive/html/freetype-devel/2007-04/msg00041.html - http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-2754 - https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=240200 - ports/112769 - - - 2007-04-27 - 2007-05-24 - - - - - FreeBSD -- heap overflow in file(1) - - - file - 4.21 - - - FreeBSD - 6.26.2_5 - 6.16.1_17 - 5.55.5_13 - - - - -

Problem Description:

-

When writing data into a buffer in the file_printf function, - the length of the unused portion of the buffer is not - correctly tracked, resulting in a buffer overflow when - processing certain files.

-

Impact:

-

An attacker who can cause file(1) to be run on a maliciously - constructed input can cause file(1) to crash. It may be - possible for such an attacker to execute arbitrary code with - the privileges of the user running file(1).

-

The above also applies to any other applications using the - libmagic(3) library.

-

Workaround:

-

No workaround is available, but systems where file(1) and - other libmagic(3)-using applications are never run on - untrusted input are not vulnerable.

- - - - CVE-2007-1536 - SA-07:04.file - - - 2007-05-23 - 2007-05-23 - 2016-08-09 - - - - - squirrelmail -- Cross site scripting in HTML filter - - - squirrelmail - 1.4.01.4.9a - - - - -

The SquirrelMail developers report:

-
-

Multiple cross-site scripting (XSS) vulnerabilities in the HTML - filter in SquirrelMail 1.4.0 through 1.4.9a allow remote attackers - to inject arbitrary web script or HTML via the (1) data: URI in an - HTML e-mail attachment or (2) various non-ASCII character sets that - are not properly filtered when viewed with Microsoft Internet - Explorer.

-
- - - - CVE-2007-1262 - http://www.squirrelmail.org/security/issue/2007-05-09 - - - 2007-05-09 - 2007-05-21 - - - - - png -- DoS crash vulnerability - - - png - 1.2.17 - - - - -

A Libpng Security Advisory reports:

-
-

A grayscale PNG image with a malformed (bad CRC) tRNS - chunk will crash some libpng applications.

-

This vulnerability could be used to crash a browser when - a user tries to view such a malformed PNG file. It is not - known whether the vulnerability could be exploited - otherwise.

-
- - - - CVE-2007-2445 - 684664 - http://www.mirrorservice.org/sites/download.sourceforge.net/pub/sourceforge/l/li/libpng/libpng-1.2.17-ADVISORY.txt - - - 2007-05-15 - 2007-05-16 - - - - - samba -- multiple vulnerabilities - - - samba - ja-samba - 3.*3.0.25 - 3.*,13.0.25,1 - - - - -

The Samba Team reports:

-
-

A bug in the local SID/Name translation routines may - potentially result in a user being able to issue SMB/CIFS - protocol operations as root.

-

When translating SIDs to/from names using Samba local - list of user and group accounts, a logic error in the smbd - daemon's internal security stack may result in a - transition to the root user id rather than the non-root - user. The user is then able to temporarily issue SMB/CIFS - protocol operations as the root user. This window of - opportunity may allow the attacker to establish additional - means of gaining root access to the server.

-
-
-

Various bugs in Samba's NDR parsing can allow a user to - send specially crafted MS-RPC requests that will overwrite - the heap space with user defined data.

-
-
-

Unescaped user input parameters are passed as arguments - to /bin/sh allowing for remote command execution.

-

This bug was originally reported against the anonymous - calls to the SamrChangePassword() MS-RPC function in - combination with the "username map script" smb.conf option - (which is not enabled by default).

-

After further investigation by Samba developers, it was - determined that the problem was much broader and impacts - remote printer and file share management as well. The - root cause is passing unfiltered user input provided via - MS-RPC calls to /bin/sh when invoking externals scripts - defined in smb.conf. However, unlike the "username map - script" vulnerability, the remote file and printer - management scripts require an authenticated user - session.

-
- - - - CVE-2007-2444 - CVE-2007-2446 - CVE-2007-2447 - http://de5.samba.org/samba/security/CVE-2007-2444.html - http://de5.samba.org/samba/security/CVE-2007-2446.html - http://de5.samba.org/samba/security/CVE-2007-2447.html - - - 2007-05-14 - 2007-05-16 - 2008-09-26 - - - - - php -- multiple vulnerabilities - - - php5-imap - php5-odbc - php5-session - php5-shmop - php5-sqlite - php5-wddx - php5 - 5.2.2 - - - php4-odbc - php4-session - php4-shmop - php4-wddx - php4 - 4.4.7 - - - mod_php4-twig - mod_php4 - mod_php5 - mod_php - php4-cgi - php4-cli - php4-dtc - php4-horde - php4-nms - php5-cgi - php5-cli - php5-dtc - php5-horde - php5-nms - 44.4.7 - 55.2.2 - - - - -

The PHP development team reports:

-
-

Security Enhancements and Fixes in PHP 5.2.2 and PHP - 4.4.7:

-
    -
  • Fixed CVE-2007-1001, GD wbmp used with invalid image - size
    • -
  • Fixed asciiz byte truncation inside mail()
    • -
  • Fixed a bug in mb_parse_str() that can be used to - activate register_globals
    • -
  • Fixed unallocated memory access/double free in in - array_user_key_compare()
    • -
  • Fixed a double free inside session_regenerate_id()
    • -
  • Added missing open_basedir & safe_mode checks to zip:// - and bzip:// wrappers.
    • -
  • Limit nesting level of input variables with - max_input_nesting_level as fix for.
    • -
  • Fixed CRLF injection inside ftp_putcmd().
    • -
  • Fixed a possible super-global overwrite inside - import_request_variables().
    • -
  • Fixed a remotely trigger-able buffer overflow inside - bundled libxmlrpc library.
    • -
-

Security Enhancements and Fixes in PHP 5.2.2 only:

-
    -
  • Fixed a header injection via Subject and To parameters - to the mail() function
    • -
  • Fixed wrong length calculation in unserialize S - type.
    • -
  • Fixed substr_compare and substr_count information - leak.
    • -
  • Fixed a remotely trigger-able buffer overflow inside - make_http_soap_request().
    • -
  • Fixed a buffer overflow inside - user_filter_factory_create().
    • -
-

Security Enhancements and Fixes in PHP 4.4.7 only:

-
    -
  • XSS in phpinfo()
    • -
-
- - - - CVE-2007-1001 - http://www.php.net/releases/4_4_7.php - http://www.php.net/releases/5_2_2.php - - - 2007-05-03 - 2007-05-07 - 2014-04-01 - - - - - qemu -- several vulnerabilities - - - qemu - qemu-devel - 0.9.0_1 - 0.9.0s.20070101*0.9.0s.20070405_3 - - - - -

The Debian Security Team reports:

-
-

Several vulnerabilities have been discovered in the QEMU processor - emulator, which may lead to the execution of arbitrary code or - denial of service. The Common Vulnerabilities and Exposures project - identifies the following problems:

-

CVE-2007-1320
Tavis Ormandy discovered that a memory management - routine of the Cirrus video driver performs insufficient bounds - checking, which might allow the execution of arbitrary code through - a heap overflow.

-

CVE-2007-1321
Tavis Ormandy discovered that the NE2000 network - driver and the socket code perform insufficient input validation, - which might allow the execution of arbitrary code through a heap - overflow.

-

CVE-2007-1322
Tavis Ormandy discovered that the "icebp" - instruction can be abused to terminate the emulation, resulting in - denial of service.

-

CVE-2007-1323
Tavis Ormandy discovered that the NE2000 network - driver and the socket code perform insufficient input validation, - which might allow the execution of arbitrary code through a heap - overflow.

-

CVE-2007-1366
Tavis Ormandy discovered that the "aam" - instruction can be abused to crash qemu through a division by zero, - resulting in denial of service.

-
- - - - CVE-2007-1320 - CVE-2007-1321 - CVE-2007-1322 - CVE-2007-1323 - CVE-2007-1366 - http://lists.debian.org/debian-security-announce/debian-security-announce-2007/msg00040.html - - - 2007-05-01 - 2007-05-01 - 2007-05-02 - - - - - p5-Imager -- possibly exploitable buffer overflow - - - p5-Imager - 0.57 - - - - -

Imager 0.56 and all earlier versions with BMP support have - a security issue when reading compressed 8-bit per pixel BMP - files where either a compressed run of data or a literal run - of data overflows the scan-line.

-

Such an overflow causes a buffer overflow in a malloc() - allocated memory buffer, possibly corrupting the memory arena - headers.

-

The effect depends on your system memory allocator, with glibc - this typically results in an abort, but with other memory - allocators it may be possible to cause local code execution.

- - - - CVE-2007-1942 - CVE-2007-1943 - CVE-2007-1946 - CVE-2007-1948 - https://rt.cpan.org/Public/Bug/Display.html?id=26811 - http://ifsec.blogspot.com/2007/04/several-windows-image-viewers.html - - - 2007-04-04 - 2007-04-30 - 2010-05-12 - - - - - FreeBSD -- IPv6 Routing Header 0 is dangerous - - - FreeBSD - 6.26.2_4 - 6.16.1_16 - 5.55.5_12 - - - - -

Problem Description

-

There is no mechanism for preventing IPv6 routing headers - from being used to route packets over the same link(s) many - times.

-

Impact

-

An attacker can "amplify" a denial of service attack against - a link between two vulnerable hosts; that is, by sending a - small volume of traffic the attacker can consume a much larger - amount of bandwidth between the two vulnerable hosts.

-

An attacker can use vulnerable hosts to "concentrate" a - denial of service attack against a victim host or network; - that is, a set of packets sent over a period of 30 seconds - or more could be constructed such that they all arrive at - the victim within a period of 1 second or less over a - period of 30 seconds or more could be constructed such that - they all arrive at the victim within a period of 1 second or - less.

-

Other attacks may also be possible.

-

Workaround

-

No workaround is available.

- - - - CVE-2007-2242 - SA-07:03.ipv6 - - - 2007-04-26 - 2007-04-28 - 2016-08-09 - - - - - mod_perl -- remote DoS in PATH_INFO parsing - - - mod_perl - 1.30 - - - mod_perl2 - 2.0.3_2,3 - - - - -

Mandriva reports:

-
-

PerlRun.pm in Apache mod_perl 1.29 and earlier, and - RegistryCooker.pm in mod_perl 2.x, does not properly escape - PATH_INFO before use in a regular expression, which allows remote - attackers to cause a denial of service (resource consumption) via a - crafted URI.

-
- - - - CVE-2007-1349 - http://www.mandriva.com/security/advisories?name=MDKSA-2007:083 - http://secunia.com/advisories/24839 - - - 2007-03-29 - 2007-04-24 - 2007-06-27 - - - - - claws-mail -- APOP vulnerability - - - claws-mail - 2.9.0 - - - - -

CVE reports:

-
-

The APOP protocol allows remote attackers to guess the first 3 - characters of a password via man-in-the-middle (MITM) attacks - that use crafted message IDs and MD5 collisions.

-
- - - - CVE-2007-1558 - http://www.claws-mail.org/news.php - - - 2007-04-02 - 2007-04-19 - - - - - lighttpd -- DOS when access files with mtime 0 - - - lighttpd - 1.4.15 - - - - -

Lighttpd SA:

-
-

Lighttpd caches the rendered string for mtime. The cache key has - as a default value 0. At that point the pointer to the string are - still NULL. If a file with an mtime of 0 is requested it tries to - access the pointer and crashes.

-

The bug requires that a malicious user can either upload files or - manipulate the mtime of the files.

-

The bug was reported by cubiq and fixed by Marcus Rueckert.

-
- - - - CVE-2007-1870 - http://www.lighttpd.net/assets/2007/4/13/lighttpd_sa2007_02.txt - - - 2007-01-14 - 2007-04-14 - - - - - lighttpd -- Remote DOS in CRLF parsing - - - lighttpd - 1.4.111.4.13_2 - - - - -

Lighttpd SA:

-
-

If the connection aborts during parsing "\r\n\r\n" the server - might get into a infinite loop and use 100% of the CPU time. - lighttpd still responses to other requests. This can be repeated - until either the server limit for concurrent connections or file - descriptors is reached.

-

The bug was reported and fixed by Robert Jakabosky.

-
- - - - CVE-2007-1869 - http://www.lighttpd.net/assets/2007/4/13/lighttpd_sa2007_01.txt - - - 2006-12-15 - 2007-04-14 - - - - - freeradius -- EAP-TTLS Tunnel Memory Leak Remote DOS Vulnerability - - - freeradius - freeradius-mysql - 1.1.5 - - - - -

The freeradius development team reports:

-
-

A malicious 802.1x supplicant could send malformed Diameter format - attributes inside of an EAP-TTLS tunnel. The server would reject - the authentication request, but would leak one VALUE_PAIR data - structure, of approximately 300 bytes. If an attacker performed - the attack many times (e.g. thousands or more over a period of - minutes to hours), the server could leak megabytes of memory, - potentially leading to an "out of memory" condition, and early - process exit.

-
- - - - 23466 - CVE-2005-1455 - CVE-2005-1454 - CVE-2007-2028 - CVE-2005-4745 - http://www.freeradius.org/security.html - - - 2007-04-10 - 2007-04-13 - 2010-05-12 - - - - - fetchmail -- insecure APOP authentication - - - fetchmail - 6.3.8 - - - - -

Matthias Andree reports:

-
-

The POP3 standard, currently RFC-1939, has specified an optional, - MD5-based authentication scheme called "APOP" which no longer - should be considered secure.

-

Additionally, fetchmail's POP3 client implementation has been - validating the APOP challenge too lightly and accepted random - garbage as a POP3 server's APOP challenge. This made it easier - than necessary for man-in-the-middle attackers to retrieve by - several probing and guessing the first three characters of the - APOP secret, bringing brute forcing the remaining characters well - within reach.

-
- - - - CVE-2007-1558 - http://www.fetchmail.info/fetchmail-SA-2007-01.txt - - - 2007-04-06 - 2007-04-09 - - - - - mcweject -- exploitable buffer overflow - - - mcweject - 0.9 - - - - -

CVE reports:

-
-

Buffer overflow in eject.c in Jason W. Bacon mcweject 0.9 on - FreeBSD, and possibly other versions, allows local users to execute - arbitrary code via a long command line argument, possibly involving - the device name.

-
- - - - CVE-2007-1719 - ports/111365 - http://www.milw0rm.com/exploits/3578 - - - 2007-03-27 - 2007-04-08 - - - - - WebCalendar -- "noSet" variable overwrite vulnerability - - - WebCalendar - 1.0.5 - - - - -

Secunia reports:

-
-

A vulnerability has been discovered in WebCalendar, - which can be exploited by malicious people to compromise - a vulnerable system.

-

Input passed to unspecified parameters is not properly - verified before being used with the "noSet" parameter set. - This can be exploited to overwrite certain variables, and - allows e.g. the inclusion of arbitrary PHP files from internal - or external resources.

-
- - - - CVE-2007-1343 - 22834 - http://sourceforge.net/project/shownotes.php?release_id=491130 - http://xforce.iss.net/xforce/xfdb/32832 - - - 2007-03-04 - 2007-04-08 - - - - - zope -- cross-site scripting vulnerability - - - zope - 2.7.9_2 - 2.8.02.8.8 - 2.9.02.9.6 - 2.10.02.10.2 - - - plone - 2.5.3 - - - - -

The Zope Team reports:

-
-

A vulnerability has been discovered in Zope, where by certain types - of misuse of HTTP GET, an attacker could gain elevated privileges. - All Zope versions up to and including 2.10.2 are affected.

-
- - - - 23084 - CVE-2007-0240 - ports/111119 - http://www.zope.org/Products/Zope/Hotfix-2007-03-20/announcement/view - http://plone.org/products/plone/releases/2.5.3 - - - 2007-01-16 - 2007-04-05 - 2009-03-22 - - - - - Squid -- TRACE method handling denial of service - - - squid - 2.6.*2.6.12 - - - - -

Squid advisory 2007:1 notes:

-
-

Due to an internal error Squid-2.6 is vulnerable to a denial of - service attack when processing the TRACE request method.

-

Workarounds:

-

To work around the problem deny access to using the TRACE method by - inserting the following two lines before your first http_access - rule.

-

acl TRACE method TRACE

-

http_access deny TRACE

-
- - - - CVE-2007-1560 - http://www.squid-cache.org/Advisories/SQUID-2007_1.txt - - - 2007-03-20 - 2007-03-21 - 2010-05-12 - - - - - sql-ledger -- security bypass vulnerability - - - sql-ledger - 2.6.26 - - - - -

Chris Travers reports:

-
-

George Theall of Tenable Security notified the LedgerSMB - core team today of an authentication bypass vulnerability - allowing full access to the administrator interface of - LedgerSMB 1.1 and SQL-Ledger 2.x. The problem is caused - by the password checking routine failing to enforce a - password check under certain circumstances. The user - can then create accounts or effect denial of service - attacks.

-

This is not related to any previous CVE.

-

We have coordinated with the SQL-Ledger vendor and - today both of us released security patches correcting - the problem. SQL-Ledger users who can upgrade to 2.6.26 - should do so, and LedgerSMB 1.1 or 1.0 users should - upgrade to 1.1.9. Users who cannot upgrade should - configure their web servers to use http authentication - for the admin.pl script in the main root directory.

-
- - - - ports/110350 - http://www.securityfocus.com/archive/1/462375 - - - 2007-03-09 - 2007-03-16 - - - - - samba -- potential Denial of Service bug in smbd - - - samba - ja-samba - 3.0.6,13.0.24,1 - - - - -

The Samba Team reports:

-
-

Internally Samba's file server daemon, smbd, implements - support for deferred file open calls in an attempt to serve - client requests that would otherwise fail due to a share mode - violation. When renaming a file under certain circumstances - it is possible that the request is never removed from the deferred - open queue. smbd will then become stuck is a loop trying to - service the open request.

-

This bug may allow an authenticated user to exhaust resources - such as memory and CPU on the server by opening multiple CIFS - sessions, each of which will normally spawn a new smbd process, - and sending each connection into an infinite loop.

-
- - - - CVE-2007-0452 - http://www.samba.org/samba/security/CVE-2007-0452.html - - - 2007-02-05 - 2007-03-16 - - - - - samba -- format string bug in afsacl.so VFS plugin - - - samba - ja-samba - 3.0.6,13.0.24,1 - - - - -

The Samba Team reports:

-
-

NOTE: This security advisory only impacts Samba servers - that share AFS file systems to CIFS clients and which have - been explicitly instructed in smb.conf to load the afsacl.so - VFS module.

-

The source defect results in the name of a file stored on - disk being used as the format string in a call to snprintf(). - This bug becomes exploitable only when a user is able - to write to a share which utilizes Samba's afsacl.so library - for setting Windows NT access control lists on files residing - on an AFS file system.

-
- - - - CVE-2007-0454 - http://www.samba.org/samba/security/CVE-2007-0454.html - - - 2007-02-05 - 2007-03-16 - - - - - ktorrent -- multiple vulnerabilities - - - ktorrent - 2.1.2 - - - ktorrent-devel - 20070311 - - - - -

Two problems have been found in KTorrent:

-
    -
  • KTorrent does not properly sanitize file names to filter - out ".." components, so it's possible for an attacker to create - a malicious torrent in order to overwrite arbitrary files within - the filesystem.
    • -
  • Messages with invalid chunk indexes aren't rejected.
    • -
- - - - CVE-2007-1384 - CVE-2007-1385 - http://ktorrent.org/forum/viewtopic.php?t=1401 - - - 2007-03-09 - 2007-03-11 - 2007-03-14 - - - - - mplayer -- DMO File Parsing Buffer Overflow Vulnerability - - - mplayer - mplayer-esound - mplayer-gtk - mplayer-gtk2 - mplayer-gtk-esound - mplayer-gtk2-esound - 0.99.10_5 - - - - -

"Moritz Jodeit reports:

-
-

There's an exploitable buffer overflow in the current version - of MPlayer (v1.0rc1) which can be exploited with a maliciously - crafted video file. It is hidden in the DMO_VideoDecoder() - function of `loader/dmo/DMO_VideoDecoder.c' file.

-
- - - - 22771 - CVE-2007-1246 - - - 2007-02-11 - 2007-03-09 - - - - - trac -- cross site scripting vulnerability - - - trac - 0.10.3 - - - ja-trac - 0.10.3_1 - - - - -

Secunia reports:

-
-

The vulnerability is caused due to an error within the - "download wiki page as text" function, which can be exploited - to execute arbitrary HTML and script code in a user's browser - session in context of an affected site.

-

Successful exploitation may require that the victim uses IE.

-
- - - - http://secunia.com/advisories/24470 - http://trac.edgewall.org/wiki/ChangeLog#a0.10.3.1 - - - 2007-03-09 - 2007-03-09 - - - - - mod_jk -- long URL stack overflow vulnerability - - - mod_jk-ap2 - mod_jk - 1.2.191.2.21 - - - - -

TippingPoint and The Zero Day Initiative reports:

-
-

This vulnerability allows remote attackers to execute - arbitrary code on vulnerable installations of Apache - Tomcat JK Web Server Connector. Authentication is not - required to exploit this vulnerability.

-

The specific flaw exists in the URI handler for the - mod_jk.so library, map_uri_to_worker(), defined in - native/common/jk_uri_worker_map.c. When parsing a long URL - request, the URI worker map routine performs an unsafe - memory copy. This results in a stack overflow condition - which can be leveraged to execute arbitrary code.

-
- - - - CVE-2007-0774 - http://tomcat.apache.org/security-jk.html - http://www.zerodayinitiative.com/advisories/ZDI-07-008.html - - - 2007-03-02 - 2007-03-05 - 2007-03-06 - - - - - bind -- Multiple Denial of Service vulnerabilities - - - named - 9.3.4 - - - FreeBSD - 6.26.2_1 - 6.16.1_13 - 5.55.5_11 - - - - -

Problem Description:

-

A type * (ANY) query response containing multiple RRsets can - trigger an assertion failure.

-

Certain recursive queries can cause the nameserver to crash - by using memory which has already been freed.

-

Impact:

-

A remote attacker sending a type * (ANY) query to an - authoritative DNS server for a DNSSEC signed zone can cause - the named(8) daemon to exit, resulting in a Denial of - Service.

-

A remote attacker sending recursive queries can cause the - nameserver to crash, resulting in a Denial of Service.

-

Workaround:

-

There is no workaround available, but systems which are not - authoritative servers for DNSSEC signed zones are not - affected by the first issue; and systems which do not permit - untrusted users to perform recursive DNS resolution are not - affected by the second issue. Note that the default - configuration for named(8) in FreeBSD allows local access - only (which on many systems is equivalent to refusing access - to untrusted users).

- - - - CVE-2007-0493 - CVE-2007-0494 - SA-07:02.bind - - - 2007-02-09 - 2007-02-27 - 2016-08-09 - - - - - FreeBSD -- Jail rc.d script privilege escalation - - - FreeBSD - 6.16.1_12 - 6.06.0_17 - 5.55.5_15 - - - - -

Problem Description:

-

In multiple situations the host's jail rc.d(8) script does - not check if a path inside the jail file system structure is - a symbolic link before using the path. In particular this is - the case when writing the output from the jail start-up to - /var/log/console.log and when mounting and unmounting file - systems inside the jail directory structure.

-

Impact:

-

Due to the lack of handling of potential symbolic links the - host's jail rc.d(8) script is vulnerable to "symlink - attacks". By replacing /var/log/console.log inside the jail - with a symbolic link it is possible for the superuser (root) - inside the jail to overwrite files on the host system outside - the jail with arbitrary content. This in turn can be used to - execute arbitrary commands with non-jailed superuser - privileges.

-

Similarly, by changing directory mount points inside the - jail file system structure into symbolic links, it may be - possible for a jailed attacker to mount file systems which - were meant to be mounted inside the jail at arbitrary points - in the host file system structure, or to unmount arbitrary - file systems on the host system.

-

NOTE WELL: The above vulnerabilities occur only when a jail - is being started or stopped using the host's jail rc.d(8) - script; once started (and until stopped), running jails - cannot exploit this.

-

Workaround:

-

If the sysctl(8) variable security.jail.chflags_allowed is - set to 0 (the default), setting the "sunlnk" system flag on - /var, /var/log, /var/log/console.log, and all file system - mount points and their parent directories inside the jail(s) - will ensure that the console log file and mount points are - not replaced by symbolic links. If this is done while jails - are running, the administrator must check that an attacker - has not replaced any directories with symlinks after setting - the "sunlnk" flag.

- - - - CVE-2007-0166 - SA-07:01.jail - - - 2007-01-11 - 2007-02-27 - 2016-08-09 - - - - - gtar -- name mangling symlink vulnerability - - - FreeBSD - 5.55.5_9 - 4.114.11_26 - - - - -

Problem Description:

-

Symlinks created using the "GNUTYPE_NAMES" tar extension can - be absolute due to lack of proper sanity checks.

-

Impact:

-

If an attacker can get a user to extract a specially crafted - tar archive the attacker can overwrite arbitrary files with - the permissions of the user running gtar. If file system - permissions allow it, this may allow the attacker to overwrite - important system file (if gtar is being run as root), or - important user configuration files such as .tcshrc or .bashrc, - which would allow the attacker to run arbitrary commands.

-

Workaround:

-

Use "bsdtar", which is the default tar implementation in - FreeBSD 5.3 and higher. For FreeBSD 4.x, bsdtar is available - in the FreeBSD Ports Collection as - ports/archivers/libarchive.

- - - - CVE-2006-6097 - SA-06:26.gtar - - - 2006-12-06 - 2007-02-27 - 2016-08-09 - - - - - FreeBSD -- Kernel memory disclosure in firewire(4) - - - FreeBSD - 6.16.1_11 - 6.06.2_16 - 5.55.5_9 - 4.114.11_26 - - - - -

Problem Description:

-

In the FW_GCROM ioctl, a signed integer comparison is used - instead of an unsigned integer comparison when computing the - length of a buffer to be copied from the kernel into the - calling application.

-

Impact:

-

A user in the "operator" group can read the contents of - kernel memory. Such memory might contain sensitive - information, such as portions of the file cache or terminal - buffers. This information might be directly useful, or it - might be leveraged to obtain elevated privileges in some way; - for example, a terminal buffer might include a user-entered - password.

-

Workaround:

-

No workaround is available, but systems without IEEE 1394 - ("FireWire") interfaces are not vulnerable. (Note that - systems with IEEE 1394 interfaces are affected regardless of - whether any devices are attached.)

-

Note also that FreeBSD does not have any non-root users in - the "operator" group by default; systems on which no users - have been added to this group are therefore also not - vulnerable.

- - - - CVE-2006-6013 - SA-06:25.kmem - - - 2006-12-06 - 2007-02-27 - 2016-08-09 - - - - - libarchive -- Infinite loop in corrupt archives handling in libarchive - - - libarchive - 1.3.1 - - - - -

Problem Description:

-

If the end of an archive is reached while attempting to - "skip" past a region of an archive, libarchive will enter an - infinite loop wherein it repeatedly attempts (and fails) to - read further data.

-

Impact:

-

An attacker able to cause a system to extract (via "tar -x" - or another application which uses libarchive) or list the - contents (via "tar -t" or another libarchive-using - application) of an archive provided by the attacker can cause - libarchive to enter an infinite loop and use all available - CPU time.

-

Workaround:

-

No workaround is available.

- - - - CVE-2006-5680 - SA-06:24.libarchive - - - 2006-11-08 - 2007-02-26 - - - - - OpenSSL -- Multiple problems in crypto(3) - - - openssl - 0.9.7l_0 - 0.9.80.9.8d_0 - - - FreeBSD - 6.16.1_9 - 6.06.0_14 - 5.55.5_7 - 5.45.4_21 - 5.35.3_36 - 4.114.11_24 - - - - -

Problem Description:

-

Several problems have been found in OpenSSL:

-
    -
  • During the parsing of certain invalid ASN1 structures an - error condition is mishandled, possibly resulting in an - infinite loop.
    • -
  • A buffer overflow exists in the SSL_get_shared_ciphers - function.
    • -
  • A NULL pointer may be dereferenced in the SSL version 2 - client code.
    • -
-

In addition, many applications using OpenSSL do not perform - any validation of the lengths of public keys being used.

-

Impact:

-

Servers which parse ASN1 data from untrusted sources may be - vulnerable to a denial of service attack.

-

An attacker accessing a server which uses SSL version 2 may - be able to execute arbitrary code with the privileges of that - server.

-

A malicious SSL server can cause clients connecting using - SSL version 2 to crash.

-

Applications which perform public key operations using - untrusted keys may be vulnerable to a denial of service - attack.

-

Workaround:

-

No workaround is available, but not all of the - vulnerabilities mentioned affect all applications.

- - - - CVE-2006-2937 - CVE-2006-2938 - CVE-2006-2940 - CVE-2006-3738 - CVE-2006-4343 - SA-06:23.openssl - - - 2006-09-28 - 2007-02-26 - 2016-08-09 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 1.5.0.10,1 - 2.*,12.0.0.2,1 - - - linux-firefox - 1.5.0.10 - - - lightning - 0.3.1 - - - seamonkey - linux-seamonkey - 1.0.8 - 1.11.1.1 - - - thunderbird - linux-thunderbird - mozilla-thunderbird - 1.5.0.10 - - - linux-firefox-devel - 3.0.a2007.04.18 - - - linux-seamonkey-devel - 1.5.a2007.04.18 - - - firefox-ja - linux-mozilla-devel - linux-mozilla - mozilla - 0 - - - - -

The Mozilla Foundation reports of multiple security issues - in Firefox, Seamonkey, and Thunderbird. Several of these - issues can probably be used to run arbitrary code with the - privilege of the user running the program.

-
-
    -
  • MFSA 2007-08 onUnload + document.write() memory corruption
    • -
  • MFSA 2007-07 Embedded nulls in location.hostname confuse same-domain checks
    • -
  • MFSA 2007-06 Mozilla Network Security Services (NSS) SSLv2 buffer overflow
    • -
  • MFSA 2007-05 XSS and local file access by opening blocked popups
    • -
  • MFSA 2007-04 Spoofing using custom cursor and CSS3 hotspot
    • -
  • MFSA 2007-03 Information disclosure through cache collisions
    • -
  • MFSA 2007-02 Improvements to help protect against Cross-Site Scripting attacks
    • -
  • MFSA 2007-01 Crashes with evidence of memory corruption (rv:1.8.0.10/1.8.1.2)
    • -
-
- - - - CVE-2006-6077 - CVE-2007-0008 - CVE-2007-0009 - CVE-2007-0775 - CVE-2007-0776 - CVE-2007-0777 - CVE-2007-0778 - CVE-2007-0779 - CVE-2007-0780 - CVE-2007-0800 - CVE-2007-0981 - CVE-2007-0995 - CVE-2007-1092 - http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=482 - http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=483 - http://www.mozilla.org/security/announce/2007/mfsa2007-01.html - http://www.mozilla.org/security/announce/2007/mfsa2007-02.html - http://www.mozilla.org/security/announce/2007/mfsa2007-03.html - http://www.mozilla.org/security/announce/2007/mfsa2007-04.html - http://www.mozilla.org/security/announce/2007/mfsa2007-05.html - http://www.mozilla.org/security/announce/2007/mfsa2007-06.html - http://www.mozilla.org/security/announce/2007/mfsa2007-07.html - http://www.mozilla.org/security/announce/2007/mfsa2007-08.html - - - 2007-02-23 - 2007-02-24 - 2007-04-19 - - - - - snort -- DCE/RPC preprocessor vulnerability - - - snort - 2.6.12.6.1.3 - - - - -

A IBM Internet Security Systems Protection Advisory - reports:

-
-

Snort is vulnerable to a stack-based buffer overflow as a - result of DCE/RPC reassembly. This vulnerability is in a - dynamic-preprocessor enabled in the default configuration, - and the configuration for this preprocessor allows for - auto-recognition of SMB traffic to perform reassembly - on. No checks are performed to see if the traffic is part - of a valid TCP session, and multiple Write AndX requests - can be chained in the same TCP segment. As a result, an - attacker can exploit this overflow with a single TCP PDU - sent across a network monitored by Snort or Sourcefire.

-

Snort users who cannot upgrade immediately are advised to - disable the DCE/RPC preprocessor by removing the DCE/RPC - preprocessor directives from snort.conf and restarting - Snort. However, be advised that disabling the DCE/RPC - preprocessor reduces detection capabilities for attacks in - DCE/RPC traffic. After upgrading, customers should - re-enable the DCE/RPC preprocessor.

-
- - - - 196240 - CVE-2006-5276 - http://xforce.iss.net/xforce/xfdb/31275 - http://www.snort.org/docs/advisory-2007-02-19.html - - - 2007-02-19 - 2007-02-21 - - - - - rar -- password prompt buffer overflow vulnerability - - - rar - 3.70.b1,1 - - - unrar - zh-unrar - 3.70.b1,4 - - - - -

iDefense reports:

-
-

Remote exploitation of a stack based buffer overflow - vulnerability in RARLabs Unrar may allow an attacker to - execute arbitrary code with the privileges of the user - opening the archive.

-

Unrar is prone to a stack based buffer overflow when - processing specially crafted password protected - archives.

-

If users are using the vulnerable command line based - unrar, they still need to interact with the program in - order to trigger the vulnerability. They must respond to - the prompt asking for the password, after which the - vulnerability will be triggered. They do not need to enter - a correct password, but they must at least push the enter - key.

-
- - - - 22447 - CVE-2007-0855 - http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=472 - http://www.rarsoft.com/rarnew.htm - - - 2007-02-07 - 2007-02-17 - - - - - php -- multiple vulnerabilities - - - php5-imap - php5-odbc - php5-session - php5-shmop - php5-sqlite - php5-wddx - php5 - 5.2.1_2 - - - php4-odbc - php4-session - php4-shmop - php4-wddx - php4 - 4.4.5 - - - mod_php4-twig - mod_php4 - mod_php5 - mod_php - php4-cgi - php4-cli - php4-dtc - php4-horde - php4-nms - php5-cgi - php5-cli - php5-dtc - php5-horde - php5-nms - 44.4.5 - 55.2.1_2 - - - - -

Multiple vulnerabilities have been found in PHP, including: - buffer overflows, stack overflows, format string, and - information disclosure vulnerabilities.

-

The session extension contained safe_mode and - open_basedir bypasses, but the FreeBSD Security - Officer does not consider these real security - vulnerabilities, since safe_mode and - open_basedir are insecure by design and should - not be relied upon.

- - - - CVE-2007-0905 - CVE-2007-0906 - CVE-2007-0907 - CVE-2007-0908 - CVE-2007-0909 - CVE-2007-0910 - CVE-2007-0988 - http://secunia.com/advisories/24089/ - http://www.php.net/releases/4_4_5.php - http://www.php.net/releases/5_2_1.php - - - 2007-02-09 - 2007-02-17 - 2013-04-01 - - - - - joomla -- multiple remote vulnerabilities - - - joomla - 1.0.12 - - - - -

Secunia reports:

-
-

Some vulnerabilities have been reported in Joomla!, where some - have unknown impacts and one can be exploited by malicious people - to conduct cross-site scripting attacks.

-
    -
  1. Input passed to an unspecified parameter is not properly - sanitised before being returned to the user. This can be - exploited to execute arbitrary HTML and script code in a - user's browser session in context of an affected site.
    2. -
  2. The vulnerabilities are caused due to unspecified errors - in Joomla!. The vendor describes them as "several low level - security issues". No further information is currently - available.
    3. -
-
- - - - 21810 - CVE-2006-6832 - CVE-2006-6833 - CVE-2006-6834 - http://secunia.com/advisories/23563/ - - - 2006-12-29 - 2007-01-17 - - - - - sircd -- remote reverse DNS buffer overflow - - - sircd - 0.4.0 - - - - -

Secunia reports:

-
-

A vulnerability in sircd can be exploited by a malicious person - to compromise a vulnerable system. The vulnerability is caused - by a boundary error in the code handling reverse DNS lookups, - when a user connects to the service. If the FQDN (Fully Qualified - Domain Name) returned is excessively long, the allocated buffer - is overflowed making it possible to execute arbitrary code on the - system with the privileges of the sircd daemon.

-
- - - - 6924 - http://secunia.com/advisories/8153 - - - 2003-02-24 - 2007-01-15 - - - - - sircd -- remote operator privilege escalation vulnerability - - - sircd - 0 - - - - -

Secunia reports:

-
-

A vulnerability has been reported in sircd, which can be - exploited by malicious users to gain operator privileges. - The problem is that any user reportedly can set their usermode - to operator. The vulnerability has been reported in - versions 0.5.2 and 0.5.3. Other versions may also be affected.

-
- - - - 9097 - http://secunia.com/advisories/10274/ - - - 2003-11-20 - 2007-01-15 - - - - - cacti -- Multiple vulnerabilities - - - cacti - 0.8.6i.4 - - - - -

Secunia reports:

-
-

rgod has discovered four vulnerabilities in Cacti, - which can be exploited by malicious people to bypass - certain security restrictions, manipulate data - and compromise vulnerable systems.

-
- - - - http://secunia.com/advisories/23528/ - http://forums.cacti.net/about18846-0-asc-0.html - - - 2006-12-28 - 2007-01-12 - - - - - mplayer -- buffer overflow in the code for RealMedia RTSP streams. - - - mplayer - mplayer-esound - mplayer-gtk - mplayer-gtk2 - mplayer-gtk-esound - mplayer-gtk2-esound - 0.99.10_1 - - - - -
-

A potential buffer overflow was found in the code used to handle - RealMedia RTSP streams. When checking for matching asm rules, the code - stores the results in a fixed-size array, but no boundary checks are - performed. This may lead to a buffer overflow if the user is tricked - into connecting to a malicious server. Since the attacker cannot write - arbitrary data into the buffer, creating an exploit is very hard; but a - DoS attack is easily made. - A fix for this problem was committed to SVN on Sun Dec 31 13:27:53 2006 - UTC as r21799. The fix involves three files: stream/realrtsp/asmrp.c, - stream/realrtsp/asmrp.h and stream/realrtsp/real.c.

-
- - - - ports/107217 - CVE-2006-6172 - http://www.mplayerhq.hu/design7/news.html - - - 2006-12-31 - 2007-01-08 - - - - - fetchmail -- crashes when refusing a message bound for an MDA - - - fetchmail - 6.3.56.3.6 - - - - -

Matthias Andree reports:

-
-

When delivering messages to a message delivery agent by means - of the "mda" option, fetchmail can crash (by passing - a NULL pointer to ferror() and fflush()) when refusing a message. - SMTP and LMTP delivery modes aren't affected.

-
- - - - CVE-2006-5974 - http://www.fetchmail.info/fetchmail-SA-2006-03.txt - - - 2007-01-04 - 2007-01-06 - - - - - fetchmail -- TLS enforcement problem/MITM attack/password exposure - - - fetchmail - 6.3.6 - - - - -

Matthias Andree reports:

-
-

Fetchmail has had several longstanding password disclosure - vulnerabilities.

-
    -
  • sslcertck/sslfingerprint options should have implied - "sslproto tls1" in order to enforce TLS negotiation, - but did not.
    • -
  • Even with "sslproto tls1" in the config, fetches - would go ahead in plain text if STLS/STARTTLS wasn't available - (not advertised, or advertised but rejected).
    • -
  • POP3 fetches could completely ignore all TLS options - whether available or not because it didn't reliably issue - CAPA before checking for STLS support - but CAPA is a - requisite for STLS. Whether or not CAPAbilities were probed, - depended on the "auth" option. (Fetchmail only - tried CAPA if the auth option was not set at all, was set - to gssapi, kerberos, kerberos_v4, otp, or cram-md5.)
    • -
  • POP3 could fall back to using plain text passwords, even - if strong authentication had been configured.
    • -
  • POP2 would not complain if strong authentication or TLS - had been requested.
    • -
-
- - - - CVE-2006-5867 - http://www.fetchmail.info/fetchmail-SA-2006-02.txt - - - 2007-01-04 - 2007-01-06 - - - - - opera -- multiple vulnerabilities - - - opera - opera-devel - linux-opera - 9.10 - - - - -

iDefense reports:

-
-

The vulnerability specifically exists due to Opera - improperly processing a JPEG DHT marker. The DHT marker is - used to define a Huffman Table which is used for decoding - the image data. An invalid number of index bytes in the - DHT marker will trigger a heap overflow with partially - user controlled data.

-

Exploitation of this vulnerability would allow an - attacker to execute arbitrary code on the affected - host. The attacker would first need to construct a website - containing the malicious image and trick the vulnerable - user into visiting the site. This would trigger the - vulnerability and allow the code to execute with the - privileges of the local user.

-
-
-

A flaw exists within Opera's Javascript SVG - implementation. When processing a - createSVGTransformFromMatrix request Opera does not - properly validate the type of object passed to the - function. Passing an incorrect object to this function can - result in it using a pointer that is user controlled when - it attempts to make the virtual function call.

-

Exploitation of this vulnerability would allow an - attacker to execute arbitrary code on the affected - host. The attacker would first need to construct a website - containing the malicious JavaScript and trick the - vulnerable user into visiting the site. This would trigger - the vulnerability and allow the code to execute with the - privileges of the local user.

-
- - - - CVE-2007-0126 - CVE-2007-0127 - http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=457 - http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=458 - http://www.opera.com/support/search/supsearch.dml?index=851 - http://www.opera.com/support/search/supsearch.dml?index=852 - - - 2007-01-05 - 2007-01-05 - 2010-05-12 - - - - - drupal -- multiple vulnerabilities - - - drupal - 4.74.7.5 - 4.6.11 - - - - -

The Drupal security team reports:

-
-

A few arguments passed via URLs are not properly sanitized - before display. When an attacker is able to entice an - administrator to follow a specially crafted link, arbitrary - HTML and script code can be injected and executed in the - victim's session. Such an attack may lead to administrator - access if certain conditions are met.

-
-
-

The way page caching was implemented allows a denial of - service attack. An attacker has to have the ability to post - content on the site. He or she would then be able to poison - the page cache, so that it returns cached 404 page not found - errors for existing pages.

-

If the page cache is not enabled, your site is not vulnerable. - The vulnerability only affects sites running on top of MySQL.

-
- - - - CVE-2007-0136 - http://drupal.org/files/sa-2007-001/advisory.txt - http://drupal.org/files/sa-2007-002/advisory.txt - - - 2007-01-05 - 2007-01-05 - 2010-05-12 - - - - - w3m -- format string vulnerability - - - w3m - w3m-img - w3m-m17n - w3m-m17n-img - ja-w3m - ja-w3m-img - 0.5.1_6 - - - - -

An anonymous person reports:

-
-

w3m-0.5.1 crashes when using the -dump or -backend options to - open a HTTPS URL with a SSL certificate where the CN contains - "%n%n%n%n%n%n".

-
- - - - 21735 - CVE-2006-6772 - http://sourceforge.net/tracker/index.php?func=detail&aid=1612792&group_id=39518&atid=425439 - http://secunia.com/advisories/23492/ - - - 2006-12-10 - 2007-01-03 - - - - - plone -- user can masquerade as a group - - - plone - 2.52.5.1_1 - - - - -

Plone.org reports:

-
-

PlonePAS-using Plone releases (Plone 2.5 and Plone 2.5.1) has a - potential vulnerability that allows a user to masquerade as a group. - Please update your sites.

-
- - - - 21460 - CVE-2006-4249 - http://plone.org/products/plone-hotfix/releases/20061031 - - - 2006-11-02 - 2006-12-27 - - - - - proftpd -- remote code execution vulnerabilities - - - proftpd - proftpd-mysql - 1.3.0_5 - - - - -

The proftpd development team reports that several - remote buffer overflows had been found in the - proftpd server.

- - - - CVE-2006-5815 - CVE-2006-6170 - - - 2006-11-10 - 2006-12-21 - - - - - gzip -- multiple vulnerabilities - - - FreeBSD - 6.16.1_7 - 6.06.0_12 - 5.55.5_5 - 5.45.4_19 - 5.35.3_34 - 4.11_22 - - - gzip - 1.3.12 - - - - -

Problem Description

-

Multiple programming errors have been found in gzip which - can be triggered when gzip is decompressing files. These - errors include insufficient bounds checks in buffer use, a - NULL pointer dereference, and a potential infinite loop.

-

Impact

-

The insufficient bounds checks in buffer use can cause gzip - to crash, and may permit the execution of arbitrary code. - The NULL pointer deference can cause gzip to crash. The - infinite loop can cause a Denial-of-Service situation where - gzip uses all available CPU time.

-

Workaround

-

No workaround is available.

- - - - CVE-2006-4334 - CVE-2006-4335 - CVE-2006-4336 - CVE-2006-4337 - CVE-2006-4338 - SA-06:21.gzip - - - 2006-09-19 - 2006-12-19 - 2016-08-09 - - - - - bind9 -- Denial of Service in named(8) - - - FreeBSD - 6.16.1_6 - 6.06.0_11 - 5.55.5_4 - 5.45.4_18 - 5.05.3_33 - - - bind9 - 9.09.3.2.1 - - - - -

Problem Description

-

For a recursive DNS server, a remote attacker sending enough - recursive queries for the replies to arrive after all the - interested clients have left the recursion queue will trigger - an INSIST failure in the named(8) daemon. Also for a - recursive DNS server, an assertion failure can occur when - processing a query whose reply will contain more than one - SIG(covered) RRset.

-

For an authoritative DNS server serving a RFC 2535 DNSSEC - zone which is queried for the SIG records where there are - multiple SIG(covered) RRsets (e.g. a zone apex), named(8) - will trigger an assertion failure when it tries to construct - the response.

-

Impact

-

An attacker who can perform recursive lookups on a DNS server - and is able to send a sufficiently large number of recursive - queries, or is able to get the DNS server to return more than - one SIG(covered) RRsets can stop the functionality of the DNS - service.

-

An attacker querying an authoritative DNS server serving a - RFC 2535 DNSSEC zone may be able to crash the DNS server.

-

Workaround

-

A possible workaround is to only allow trusted clients to - perform recursive queries.

- - - - CVE-2006-4095 - CVE-2006-4096 - SA-06:20.bind - - - 2006-09-06 - 2006-12-19 - 2016-08-09 - - - - - openssl -- Incorrect PKCS#1 v1.5 padding validation in crypto(3) - - - FreeBSD - 6.16.1_6 - 6.06.0_11 - 5.55.5_4 - 5.45.4_18 - 5.35.3_33 - 4.11_21 - - - openssl - 0.9.80.9.8c_9 - 0.9.7k_0 - - - - -

Problem Description

-

When verifying a PKCS#1 v1.5 signature, OpenSSL ignores any - bytes which follow the cryptographic hash being signed. In - a valid signature there will be no such bytes.

-

Impact

-

OpenSSL will incorrectly report some invalid signatures as - valid. When an RSA public exponent of 3 is used, or more - generally when a small public exponent is used with a - relatively large modulus (e.g., a public exponent of 17 with - a 4096-bit modulus), an attacker can construct a signature - which OpenSSL will accept as a valid PKCS#1 v1.5 signature.

-

Workaround

-

No workaround is available.

- - - - CVE-2006-4339 - SA-06:19.openssl - - - 2006-09-06 - 2006-12-19 - 2016-08-09 - - - - - sql-ledger -- multiple vulnerabilities - - - sql-ledger - 2.6.22 - - - - -

The Debian security Team reports:

-
-

Several remote vulnerabilities have been discovered in SQL - Ledger, a web based double-entry accounting program, which may - lead to the execution of arbitrary code. The Common - Vulnerabilities and Exposures project identifies the following - problems:

-

Chris Travers discovered that the session management can be - tricked into hijacking existing sessions.

-

Chris Travers discovered that directory traversal - vulnerabilities can be exploited to execute arbitrary Perl - code.

-

It was discovered that missing input sanitising allows - execution of arbitrary Perl code.

-
- - - - CVE-2006-4244 - CVE-2006-4731 - CVE-2006-5872 - http://www.us.debian.org/security/2006/dsa-1239 - - - 2006-12-17 - 2006-12-18 - - - - - dbus -- match_rule_equal() Weakness - - - dbus - 1.0.2 - - - - -

Secunia reports:

-
-

D-Bus have a weakness, which can be exploited by malicious, local - users to cause a DoS (Denial of Service).

-

An error within the "match_rule_equal()" function can be - exploited to disable the ability of other processes to receive - messages by removing their matches from D-Bus.

-
- - - - CVE-2006-6107 - http://www.freedesktop.org/wiki/Software/dbus - https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=218055 - http://secunia.com/advisories/23373/ - - - 2006-12-12 - 2006-12-14 - - - - - evince -- Buffer Overflow Vulnerability - - - evince - 0.6.1_1 - - - - -

Secunia reports:

-
-

A vulnerability has been discovered in Evince, which can be - exploited by malicious people to compromise a user's system.

-

The vulnerability is caused due to a boundary error within the - "get_next_text()" function in ps/ps.c. This can be exploited to - cause a buffer overflow by e.g. tricking a user into opening a - specially crafted PostScript file.

-
- - - - CVE-2006-5864 - http://secunia.com/advisories/23111/ - - - 2006-11-27 - 2006-12-14 - - - - - tdiary -- injection vulnerability - - - ja-tdiary - tdiary - 2.0.3 - - - ja-tdiary-devel - tdiary-devel - 2.12.1.4_2 - - - - -

An undisclosed eRuby injection vulnerability had been discovered in - tDiary.

- - - - http://sourceforge.net/forum/forum.php?forum_id=642685 - - - 2006-12-10 - 2006-12-13 - 2007-03-16 - - - - - wv -- Multiple Integer Overflow Vulnerabilities - - - wv - 1.2.3 - - - - -

Secunia reports:

-
-

Some vulnerabilities have been reported in wvWare, which can be - exploited by malicious people to cause a DoS (Denial of Service) - and potentially compromise an application using the library.

-

The vulnerabilities are caused due to integer overflows within - the "wvGetLFO_records()" and "wvGetLFO_PLF()" functions. These can - be exploited to cause heap-based buffer overflows by e.g. tricking - a user to open a specially crafted Microsoft Word document with an - application using the library.

-
- - - - CVE-2006-4513 - http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=433 - http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=434 - http://secunia.com/advisories/22595/ - - - 2006-10-26 - 2006-12-13 - - - - - wv2 -- Integer Overflow Vulnerability - - - wv2 - 0.2.3 - - - - -

Secunia reports:

-
-

A vulnerability has been reported in wvWare wv2 Library, which - potentially can be exploited by malicious people to compromise an - application using the library.

-

The vulnerability is caused due to an integer overflow error in - "word_helper.h" when handling a Word document. This can be - exploited to cause a buffer overflow and may allow arbitrary code - execution via a specially crafted Word document.

-
- - - - CVE-2006-2197 - http://secunia.com/advisories/20665/ - - - 2006-06-12 - 2006-12-13 - - - - - tnftpd -- Remote root Exploit - - - tnftpd - 20040810 - - - - -

The tnftpd port suffer from a remote stack overrun, - which can lead to a root compromise.

- - - - CVE-2006-6652 - http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051009.html - - - 2006-12-01 - 2006-12-11 - 2010-05-12 - - - - - clamav -- Multipart Nestings Denial of Service - - - clamav - 0.88.7 - - - clamav-devel - 20061029 - - - - -

Secunia reports:

-
-

Clam AntiVirus have a vulnerability, which can be exploited by - malicious people to cause a DoS (Denial of Service).

-

The vulnerability is caused due to a stack overflow when scanning - messages with deeply nested multipart content. This can be - exploited to crash the service by sending specially crafted emails - to a vulnerable system.

-
- - - - CVE-2006-6481 - http://secunia.com/advisories/23347/ - http://www.quantenblog.net/security/virus-scanner-bypass - - - 2006-12-06 - 2006-12-12 - 2013-06-19 - - - - - libxine -- multiple buffer overflow vulnerabilities - - - libxine - 1.1.3 - - - - -

The libxine development team reports that several - vulnerabilities had been found in the libxine library. The - first vulnerability is caused by improper checking of the - src/input/libreal/real.c "real_parse_sdp()" function. - A remote attacker could exploit this by tricking an user to - connect to a preparated server potentially causing a buffer - overflow. Another buffer overflow had been found in the - libmms library, potentially allowing a remote attacker to - cause a denial of service vulnerability, and possible remote - code execution through the following functions: send_command, - string_utf16, get_data and get_media_packets. Other functions - might be affected as well.

- - - - 18608 - 21435 - CVE-2006-2200 - CVE-2006-6172 - http://sourceforge.net/project/shownotes.php?release_id=468432 - - - 2006-05-04 - 2006-12-07 - 2006-12-09 - - - - - gnupg -- remotely controllable function pointer - - - gnupg - 1.4.6 - - - - -

Werner Koch reports:

-
-

GnuPG uses data structures called filters to process - OpenPGP messages. These filters are used in a similar - way as a pipelines in the shell. For communication - between these filters context structures are used. These - are usually allocated on the stack and passed to the - filter functions. At most places the OpenPGP data stream - fed into these filters is closed before the context - structure gets deallocated. While decrypting encrypted - packets, this may not happen in all cases and the filter - may use a void contest structure filled with garbage. An - attacker may control this garbage. The filter context - includes another context used by the low-level decryption - to access the decryption algorithm. This is done using a - function pointer. By carefully crafting an OpenPGP - message, an attacker may control this function pointer and - call an arbitrary function of the process. Obviously an - exploit needs to prepared for a specific version, - compiler, libc, etc to be successful - but it is - definitely doable.

-

Fixing this is obvious: We need to allocate the context on - the heap and use a reference count to keep it valid as - long as either the controlling code or the filter code - needs it.

-

We have checked all other usages of such a stack based - filter contexts but fortunately found no other vulnerable - places. This allows to release a relatively small patch. - However, for reasons of code cleanness and easier audits - we will soon start to change all these stack based filter - contexts to heap based ones.

-
- - - - CVE-2006-6235 - http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000246.html - http://secunia.com/advisories/23245/ - - - 2006-12-04 - 2006-12-07 - 2006-12-15 - - - - - ruby -- cgi.rb library Denial of Service - - - ruby - ruby+pthreads - ruby+pthreads+oniguruma - ruby+oniguruma - 1.8.*,11.8.5_5,1 - - - ruby_static - 1.8.*,1 - - - - -

The official ruby site reports:

-
-

Another vulnerability has been discovered in the CGI library - (cgi.rb) that ships with Ruby which could be used by a malicious - user to create a denial of service attack (DoS).

-

A specific HTTP request for any web application using cgi.rb - causes CPU consumption on the machine on which the web application - is running. Many such requests result in a denial of service.

-
- - - - CVE-2006-6303 - http://www.ruby-lang.org/en/news/2006/12/04/another-dos-vulnerability-in-cgi-library/ - - - 2006-12-04 - 2006-12-04 - 2010-05-12 - - - - - libmusicbrainz -- multiple buffer overflow vulnerabilities - - - libmusicbrainz - 2.1.3 - - - - -

SecurityFocus reports about libmusicbrainz:

-
-

The libmusicbrainz library is prone to multiple buffer-overflow - vulnerabilities because the application fails to check the size of - the data before copying it into a finite-sized internal memory - buffer.

-

An attacker can exploit these issues to execute arbitrary code - within the context of the application or to cause a - denial-of-service condition.

-
- - - - 19508 - CVE-2006-4197 - http://www.securityfocus.com/bid/21185/discuss - - - 2006-08-17 - 2006-12-02 - - - - - tdiary -- cross site scripting vulnerability - - - ja-tdiary - tdiary - 2.0.2 - - - ja-tdiary-devel - tdiary-devel - 2.12.1.4_1 - - - - -

tDiary was vulnerable to an unspecified Cross-Site - Scripting vulnerability

- - - - CVE-2006-6174 - http://sourceforge.net/forum/forum.php?forum_id=638868 - - - 2006-11-26 - 2006-12-02 - 2010-05-12 - - - - - ImageMagick -- SGI Image File heap overflow vulnerability - - - ImageMagick - ImageMagick-nox11 - 6.0.06.2.9 - - - - -

SecurityFocus reports about ImageMagick:

-
-

ImageMagick is prone to a remote heap-based buffer-overflow - vulnerability because the application fails to properly - bounds-check user-supplied input before copying it to an - insufficiently sized memory buffer.

-

Exploiting this issue allows attackers to execute arbitrary - machine code in the context of applications that use the - ImageMagick library.

-
- - - - 21185 - CVE-2006-5868 - http://www.securityfocus.com/bid/21185/discuss - - - 2006-11-14 - 2006-12-02 - - - - - gtar -- GNUTYPE_NAMES directory traversal vulnerability - - - gtar - 1.16_2 - - - - -

Teemu Salmela reports:

-
-

There is a tar record type, called GNUTYPE_NAMES (an - obsolete GNU extension), that allows the creation of - symbolic links pointing to arbitrary locations in the - filesystem, which makes it possible to create/overwrite - arbitrary files.

-
- - - - 21235 - CVE-2006-6097 - http://archives.neohapsis.com/archives/fulldisclosure/2006-11/0344.html - - - 2006-11-21 - 2006-11-30 - - - - - kronolith -- arbitrary local file inclusion vulnerability - - - kronolith - 2.1.4 - - - - -

iDefense Labs reports:

-
-

Remote exploitation of a design error in Horde's Kronolith - could allow an authenticated web mail user to execute - arbitrary PHP code under the security context of the running - web server.

-

The vulnerability specifically exists due to a design error in the - way it includes certain files. Specifically, the 'lib/FBView.php' - file contains a function 'Kronolith_FreeBusy_View::factory' which - will include local files that are supplied via the 'view' HTTP GET - request parameter.

-
- - - - http://lists.horde.org/archives/announce/2006/000307.html - - - 2006-11-29 - 2006-11-30 - - - - - gnupg -- buffer overflow - - - gnupg - 1.4.5_1 - - - - -

Werner Koch reports:

-
-

When running GnuPG interactively, special crafted - messages may be used to crash gpg or gpg2. Running gpg in - batch mode, as done by all software using gpg as a backend - (e.g. mailers), is not affected by this bug.

-

Exploiting this overflow seems to be possible.

-

gpg-agent, gpgsm, gpgv or other tools from the GnuPG - suite are not affected.

-
- - - - http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000241.html - - - 2006-11-27 - 2006-11-27 - - - - - proftpd -- Remote Code Execution Vulnerability - - - proftpd - proftpd-mysql - 1.3.0_2 - - - - -

FrSIRT reports:

-
-

A vulnerability has been identified in ProFTPD, which could be - exploited by attackers to cause a denial of service or execute - arbitrary commands. This flaw is due to a buffer overflow error - in the "main.c" file where the "cmd_buf_size" size of the buffer - used to handle FTP commands sent by clients is not properly set - to the size configured via the "CommandBufferSize" directive, - which could be exploited by attackers to compromise a vulnerable - server via a specially crafted FTP command.

-
- - - - http://www.frsirt.com/english/advisories/2006/4451 - - - 2006-11-10 - 2006-11-14 - 2006-11-15 - - - - - unzoo -- Directory Traversal Vulnerability - - - unzoo - 4.4_1 - - - - -

Secunia reports:

-
-

Doubles has discovered a vulnerability in Unzoo, which - potentially can be exploited by malicious people to - compromise a user's system.

-

The vulnerability is caused due to an input validation error - when unpacking archives. This can be exploited via a - directory traversal attack to overwrite files outside the - directory, where the files are extracted to, if a user is - tricked into extracting a malicious archive using Unzoo.

-
- - - - 11417 - http://secunia.com/advisories/12857/ - http://securitytracker.com/alerts/2004/Oct/1011673.html - - - 2004-10-18 - 2006-11-14 - 2006-12-15 - - - - - bugzilla -- multiple vulnerabilities - - - bugzilla - ja-bugzilla - 2.*2.22.1 - - - - -

A Bugzilla Security Advisory reports:

-
-
    -
  • Sometimes the information put into the <h1> and - <h2> tags in Bugzilla was not properly escaped, - leading to a possible XSS vulnerability.
    • -
  • Bugzilla administrators were allowed to put raw, - unfiltered HTML into many fields in Bugzilla, leading to - a possible XSS vulnerability. Now, the HTML allowed in - those fields is limited.
    • -
  • attachment.cgi could leak the names of private - attachments
    • -
  • The "deadline" field was visible in the XML format of - a bug, even to users who were not a member of the - "timetrackinggroup."
    • -
  • A malicious user could pass a URL to an admin, and - make the admin delete or change something that he had - not intended to delete or change.
    • -
  • It is possible to inject arbitrary HTML into the - showdependencygraph.cgi page, allowing for a cross-site - scripting attack.
    • -
-
- - - - CVE-2006-5453 - CVE-2006-5454 - CVE-2006-5455 - http://www.bugzilla.org/security/2.18.5/ - - - 2006-10-15 - 2006-11-11 - - - - - Imlib2 -- multiple image file processing vulnerabilities - - - imlib2 - 20060926_1,1 - - - - -

Secunia reports:

-
-

Some vulnerabilities have been reported in imlib2, which can be - exploited by malicious people to cause a DoS (Denial of Service) - or potentially compromise an application using the library.

-

The vulnerabilities are caused due to unspecified errors within - the processing of JPG, ARGB, PNG, LBM, PNM, TIFF, and TGA images. - This may be exploited to execute arbitrary code by e.g. tricking a - user into opening a specially crafted image file with an - application using imlib2.

-
- - - - 20903 - CVE-2006-4806 - CVE-2006-4807 - CVE-2006-4808 - CVE-2006-4809 - - - 2006-11-03 - 2006-11-08 - - - - - ruby -- cgi.rb library Denial of Service - - - ruby - ruby+pthreads - ruby+pthreads+oniguruma - ruby+oniguruma - 1.8.*,11.8.5_4,1 - - - ruby_static - 1.8.*,1 - - - - -

Official ruby site reports:

-
-

A vulnerability has been discovered in the CGI library (cgi.rb) - that ships with Ruby which could be used by a malicious user to - create a denial of service attack (DoS). The problem is triggered - by sending the library an HTTP request that uses multipart MIME - encoding and as an invalid boundary specifier that begins with - "-" instead of "--". Once triggered it will - exhaust all available memory resources effectively creating a DoS - condition.

-
- - - - 20777 - CVE-2006-5467 - http://rubyforge.org/pipermail/mongrel-users/2006-October/001946.html - - - 2006-10-25 - 2006-11-04 - 2006-12-15 - - - - - screen -- combined UTF-8 characters vulnerability - - - screen - 4.0.3 - - - - -

A vulnerability in the handling of combined UTF-8 - characters in screen may allow an user-assisted attacker to - crash screen or potentially allow code execution as the user - running screen. To exploit this issue the user running - scren must in some way interact with the attacker.

- - - - 20727 - CVE-2006-4573 - http://lists.gnu.org/archive/html/screen-users/2006-10/msg00028.html - https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=212056 - - - 2006-10-23 - 2006-10-29 - - - - - mysql -- database suid privilege escalation - - - mysql-server - 5.15.1.12 - 5.05.0.25 - - - - -

Dmitri Lenev reports a privilege escalation in - MySQL. MySQL evaluates arguments of suid routines in the - security context of the routine's definer instead of the - routine's caller, which allows remote and local - authenticated users to gain privileges through a routine - that has been made available using GRANT EXECUTE.

- - - - CVE-2006-4227 - http://bugs.mysql.com/bug.php?id=18630 - - - 2006-03-29 - 2006-10-29 - 2006-10-30 - - - - - mysql -- database "case-sensitive" privilege escalation - - - mysql-server - 5.15.1.12 - 5.05.0.25 - 4.1.21 - - - - -

Michal Prokopiuk reports a privilege escalation in MySQL. - The vulnerability causes MySQL, when run on case-sensitive - filesystems, to allow remote and local authenticated users - to create or access a database when the database name - differs only in case from a database for which they have - permissions.

- - - - 19559 - CVE-2006-4226 - http://bugs.mysql.com/bug.php?id=17647 - - - 2006-08-09 - 2006-10-29 - - - - - Serendipity -- XSS Vulnerabilities - - - serendipity - 1.0.1 - - - - -

The Serendipity Team reports:

-
-

Serendipity failed to correctly sanitize user input on the - media manager administration page. The content of GET variables - were written into JavaScript strings. By using standard string - evasion techniques it was possible to execute arbitrary - JavaScript.

-

Additionally Serendipity dynamically created a HTML form on - the media manager administration page that contained all - variables found in the URL as hidden fields. While the variable - values were correctly escaped it was possible to break out - by specifying strange variable names.

-
- - - - http://www.hardened-php.net/advisory_112006.136.htmlSerendipity - http://secunia.com/advisories/22501/ - - - 2006-10-19 - 2006-10-21 - - - - - kdelibs -- integer overflow in khtml - - - kdelibs - kdelibs-nocups - 3.5.4_4 - - - qt - qt-copy - 3.3.6_3 - - - - -

Red Hat reports:

-
-

An integer overflow flaw was found in the way Qt handled pixmap - images. The KDE khtml library uses Qt in such a way that untrusted - parameters could be passed to Qt, triggering the overflow. - An attacker could for example create a malicious web page that when - viewed by a victim in the Konqueror browser would cause Konqueror - to crash or possibly execute arbitrary code with the privileges of - the victim.

-
- - - - CVE-2006-4811 - http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=210742 - http://rhn.redhat.com/errata/RHSA-2006-0720.html - - - 2006-10-14 - 2006-10-22 - - - - - opera -- URL parsing heap overflow vulnerability - - - opera - opera-devel - linux-opera - 9.*9.02 - - - - -

iDefense Labs reports:

-
-

Remote exploitation of a heap overflow vulnerability - within version 9 of Opera Software's Opera Web browser - could allow an attacker to execute arbitrary code on the - affected host.

-

A flaw exists within Opera when parsing a tag that - contains a URL. A heap buffer with a constant size of 256 - bytes is allocated to store the URL, and the tag's URL is - copied into this buffer without sufficient bounds checking - of its length.

-
- - - - CVE-2006-4819 - http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=424 - http://secunia.com/advisories/22218/ - http://www.opera.com/support/search/supsearch.dml?index=848 - - - 2006-10-17 - 2006-10-20 - - - - - asterisk -- remote heap overwrite vulnerability - - - asterisk - asterisk-bristuff - 1.2.13 - - - - -

Adam Boileau of Security-Assessment.com reports:

-
-

The Asterisk Skinny channel driver for Cisco SCCP phones - (chan_skinny.so) incorrectly validates a length value in - the packet header. An integer wrap-around leads to heap - overwrite, and arbitrary remote code execution as root.

-
- - - - http://www.security-assessment.com/files/advisories/Asterisk_remote_heap_overflow.pdf - http://marc.theaimsgroup.com/?l=bugtraq&m=116121567530170 - - - 2006-10-17 - 2006-10-20 - - - - - plone -- unprotected MembershipTool methods - - - plone - 2.1.2 - - - - -

The Plone Team reports:

-
-

Plone 2.0.5, 2.1.2, and 2.5-beta1 does not restrict - access to the:

-
    -
  • changeMemberPortrait
    • -
  • deletePersonalPortrait
    • -
  • testCurrentPassword
    • -
-

methods, which allows remote attackers to modify portraits.

-
- - - - CVE-2006-1711 - http://plone.org/products/plone/releases/2.1.4 - https://svn.plone.org/svn/plone/PloneHotfix20060410/trunk/README.txt - - - 2006-10-19 - 2006-10-19 - 2006-10-20 - - - - - drupal -- HTML attribute injection - - - drupal - 4.6.10 - - - - -

The Drupal Team reports:

-
-

A malicious user may entice users to visit a specially - crafted URL that may result in the redirection of Drupal - form submission to a third-party site. A user visiting the - user registration page via such a url, for example, will - submit all data, such as his/her e-mail address, but also - possible private profile data, to a third-party site.

-
- - - - http://drupal.org/files/sa-2006-026/advisory.txt - http://drupal.org/drupal-4.7.4 - - - 2006-10-18 - 2006-10-18 - - - - - drupal -- cross site request forgeries - - - drupal - 4.6.10 - - - - -

The Drupal Team reports:

-
-

Visiting a specially crafted page, anywhere on the web, may - allow that page to post forms to a Drupal site in the - context of the visitor's session. To illustrate; suppose - one has an active user 1 session, the most powerful - administrator account for a site, to a Drupal site while - visiting a website created by an attacker. This website - will now be able to submit any form to the Drupal site with - the privileges of user 1, either by enticing the user to - submit a form or by automated means.

-

An attacker can exploit this vulnerability by changing - passwords, posting PHP code or creating new users, for - example. The attack is only limited by the privileges of - the session it executes in.

-
- - - - http://drupal.org/files/sa-2006-025/advisory.txt - http://drupal.org/drupal-4.7.4 - - - 2006-10-18 - 2006-10-18 - - - - - drupal -- multiple XSS vulnerabilities - - - drupal - 4.6.10 - - - - -

The Drupal Team reports:

-
-

A bug in input validation and lack of output validation - allows HTML and script insertion on several pages.

-

Drupal's XML parser passes unescaped data to watchdog - under certain circumstances. A malicious user may execute - an XSS attack via a specially crafted RSS feed. This - vulnerability exists on systems that do not use PHP's - mb_string extension (to check if mb_string is being used, - navigate to admin/settings and look under "String - handling"). Disabling the aggregator module provides an - immediate workaround.

-

The aggregator module, profile module, and forum module do - not properly escape output of certain fields.

-

Note: XSS attacks may lead to administrator access if - certain conditions are met.

-
- - - - http://drupal.org/files/sa-2006-024/advisory.txt - http://drupal.org/drupal-4.7.4 - - - 2006-10-18 - 2006-10-18 - - - - - ingo -- local arbitrary shell command execution - - - ingo - 1.1.2 - - - - -

The Horde team reports a vulnerability within Ingo, the - filter management suite. The vulnerability is caused due to - inadequete escaping, possibly allowing a local user to execute - arbitrary shell commands via procmail.

- - - - CVE-2006-5449 - http://bugs.horde.org/ticket/?id=4513 - http://cvs.horde.org/diff.php/ingo/docs/CHANGES?r1=1.55.2.49&r2=1.55.2.59&ty=h - http://lists.horde.org/archives/announce/2006/000296.html - - - 2006-10-18 - 2006-10-18 - 2010-05-12 - - - - - NVIDIA UNIX driver -- arbitrary root code execution vulnerability - - - nvidia-driver - 1.0.87621.0.8776 - - - - -

Rapid7 reports:

-
-

The NVIDIA Binary Graphics Driver for Linux is vulnerable - to a buffer overflow that allows an attacker to run - arbitrary code as root. This bug can be exploited both - locally or remotely (via a remote X client or an X client - which visits a malicious web page). A working - proof-of-concept root exploit is included with this - advisory.

-

The NVIDIA drivers for Solaris and FreeBSD are also - likely to be vulnerable.

-
-

Disabling Render acceleration in the "nvidia" driver, via - the "RenderAccel" X configuration option, can be used as a - workaround for this issue.

- - - - 147252 - CVE-2006-5379 - http://nvidia.custhelp.com/cgi-bin/nvidia.cfg/php/enduser/std_adp.php?p_faqid=1971 - http://secunia.com/advisories/22419/ - http://www.rapid7.com/advisories/R7-0025.jsp - - - 2006-10-16 - 2006-10-16 - 2006-10-21 - - - - - clamav -- CHM unpacker and PE rebuilding vulnerabilities - - - clamav - 0.88.5 - - - clamav-devel - 20060922 - - - - -

Secunia reports:

-
-

Two vulnerabilities have been reported in Clam AntiVirus, which - potentially can be exploited by malicious people to cause a DoS - (Denial of Service) or compromise a vulnerable system.

-

1) An unspecified error in the CHM unpacker in chmunpack.c can be - exploited to cause a DoS.

-

2) An unspecified error in rebuildpe.c when rebuilding PE files - after unpacking can be exploited to cause a heap-based buffer - overflow.

-
- - - - http://secunia.com/advisories/22370/ - http://lurker.clamav.net/message/20061016.015114.dc6a8930.en.html - http://sourceforge.net/project/shownotes.php?release_id=455799 - - - 2006-10-15 - 2006-10-16 - - - - - tkdiff -- temporary file symlink privilege escalation - - - tkdiff - 4.1.1 - - - - -

Javier Fernández-Sanguino Peña reports a vulnerability in - tkdiff which allows local users to gain priveleges of the - user running tkdiff due to insecure temporary file creation.

- - - - http://www.debian.org/security/2005/dsa-927 - CVE-2005-3343 - 16064 - http://secunia.com/advisories/18083 - - - 2005-12-20 - 2006-10-15 - - - - - vtiger -- multiple remote file inclusion vulnerabilities - - - vtiger - 5.0 - - - - -

Dedi Dwianto a.k.a the_day reports:

-
-

Input passed to the "$calpath" parameter in update.php is - not properly verified before being used. This can be - exploited to execute arbitrary PHP code by including files - from local or external resources.

-
- - - - CVE-2006-5289 - 20435 - http://marc.theaimsgroup.com/?l=bugtraq&m=116049557032343 - http://advisories.echo.or.id/adv/adv54-theday-2006.txt - - - 2006-10-09 - 2006-10-15 - - - - - google-earth -- heap overflow in the KML engine - - - google-earth - 4.0.2414 - - - - -

JAAScois reports:

-

While processing KML/KMZ data Google Earth fails to verify - its size prior to copying it into a fixed-sized buffer. - This can be exploited as a buffer-overflow vulnerability to - cause the application to crash and/or to execute arbitrary - code.

- - - - 20464 - http://www.jaascois.com/exploits/18602024/ - - - 2006-10-10 - 2006-10-14 - 2007-04-13 - - - - - torrentflux -- User-Agent XSS Vulnerability - - - torrentflux - 0 - - - - -
-

Steven Roddis reports that User-Agent string is not - properly escaped when handled by torrentflux. This allows - for arbitrary code insertion.

-
- - - - 20371 - CVE-2006-5227 - http://www.stevenroddis.com.au/2006/10/06/torrentflux-user-agent-xss-vulnerability/ - http://secunia.com/advisories/22293/ - - - 2006-09-30 - 2006-10-07 - 2006-10-15 - - - - - python -- buffer overrun in repr() for unicode strings - - - python+ipv6 - 0 - - - python - 2.4.3_1 - 2.5.*2.5.c2 - - - - -

Benjamin C. Wiley Sittler reports:

-
-

I discovered a [buffer overrun in repr() for unicode - strings]. This causes an unpatched non-debug wide - (UTF-32/UCS-4) build of python to abort.

-
-

Ubuntu security team reports:

-
-

If an application uses repr() on arbitrary untrusted data, - this [bug] could be exploited to execute arbitrary code - with the privileges of the python application.

-
- - - - CVE-2006-4980 - https://launchpad.net/distros/ubuntu/+source/python2.4/+bug/56633 - http://www.ubuntu.com/usn/usn-359-1 - http://secunia.com/advisories/22276/ - - - 2006-08-15 - 2006-10-07 - 2006-10-08 - - - - - php -- _ecalloc Integer Overflow Vulnerability - - - php5 - 5.1.6_1 - - - php5-cli - php5-cgi - php5-dtc - php5-horde - php5-nms - mod_php5 - 55.1.6_1 - - - - -

Stefan Esser reports:

-
-

The PHP 5 branch of the PHP source code lacks the - protection against possible integer overflows inside - ecalloc() that is present in the PHP 4 branch and also for - several years part of our Hardening-Patch and our new - Suhosin-Patch.

-

It was discovered that such an integer overflow can be - triggered when user input is passed to the unserialize() - function. Earlier vulnerabilities in PHP's unserialize() - that were also discovered by one of our audits in December - 2004 are unrelated to the newly discovered flaw, but they - have shown, that the unserialize() function is exposed to - user-input in many popular PHP applications. Examples for - applications that use the content of COOKIE variables with - unserialize() are phpBB and Serendipity.

-

The successful exploitation of this integer overflow will - result in arbitrary code execution.

-
- - - - CVE-2006-4812 - http://www.hardened-php.net/advisory_092006.133.html - http://secunia.com/advisories/22280/ - - - 2006-09-30 - 2006-10-06 - 2013-04-01 - - - - - mambo -- multiple SQL injection vulnerabilities - - - mambo - 4.6.5 - - - - -

James Bercegay reports:

-
-

Mambo is vulnerable to an Authentication Bypass issue that - is due to an SQL Injection in the login function. The SQL - Injection is possible because the $passwd variable is only - sanitized when it is not passed as an argument to the - function.

-
-

Omid reports:

-
-

There are several sql injections in Mambo 4.6 RC2 & - Joomla 1.0.10 (and maybe other versions):

-
    -
  • When a user edits a content, the "id" parameter is not - checked properly in /components/com_content/content.php, - which can cause 2 sql injections.
    • -
  • The "limit" parameter in the administration section is - not checked. This affects many pages of administration - section
    • -
  • In the administration section, while editing/creating a - user, the "gid" parameter is not checked properly.
    • -
-
- - - - 19719 - 19734 - http://www.gulftech.org/?node=research&article_id=00116-10042006 - http://seclists.org/bugtraq/2006/Aug/0491.html - http://www.frsirt.com/english/advisories/2006/3918 - http://mamboxchange.com/forum/forum.php?forum_id=7704 - http://secunia.com/advisories/21644/ - http://secunia.com/advisories/22221/ - - - 2006-08-26 - 2006-10-05 - 2011-06-27 - - - - - tin -- buffer overflow vulnerabilities - - - tin - zh-tin - 1.8.2 - - - - -
-

Urs Janssen and Aleksey Salow report possible buffer - overflows in tin versions 1.8.0 and 1.8.1.

-
-
-

OpenPKG project elaborates there is an allocation - off-by-one bug in version 1.8.0 which can lead to a buffer - overflow.

-
- - - - ftp://ftp.tin.org/pub/news/clients/tin/stable/CHANGES - http://www.openpkg.org/security/advisories/OpenPKG-SA-2006.005-tin.html - - - 2006-02-15 - 2006-10-05 - - - - - openldap -- slapd acl selfwrite Security Issue - - - openldap-server - openldap-sasl-server - 2.3.25 - - - - -

Howard Chu reports:

-
-

An ACL of the form 'access to dn.subtree="ou=groups, - dc=example,dc=com" attr=member by * selfwrite' is intended - to only allow users to add/delete their own DN to the - target attribute. Currently it allows any DNs to be - modified.

-
- - - - 19832 - CVE-2006-4600 - http://www.openldap.org/its/index.cgi/Software%20Bugs?id=4587 - http://www.openldap.org/lists/openldap-announce/200608/msg00000.html - http://secunia.com/advisories/21721 - http://securitytracker.com/alerts/2006/Sep/1016783.html - - - 2006-06-14 - 2006-10-05 - - - - - mono -- "System.CodeDom.Compiler" Insecure Temporary Creation - - - mono - 1.1.13.8.1 - - - - -

Sebastian Krahmer reports:

-
-

Sebastian Krahmer of the SuSE security team discovered - that the System.CodeDom.Compiler classes used temporary - files in an insecure way. This could allow a symbolic link - attack to create or overwrite arbitrary files with the - privileges of the user invoking the program. Under some - circumstances, a local attacker could also exploit this to - inject arbitrary code into running Mono processes.

-
- - - - CVE-2006-5072 - http://www.ubuntu.com/usn/usn-357-1 - http://secunia.com/advisories/22237/ - - - 2006-10-04 - 2006-10-05 - - - - - php -- open_basedir Race Condition Vulnerability - - - php4 - php5 - 4.4.4_1 - 55.1.6_2 - - - php-suhosin - 0.9.6 - - - php4-cli - php5-cli - php4-cgi - php5-cgi - php4-dtc - php5-dtc - php4-horde - php5-horde - php4-nms - php5-nms - mod_php4 - mod_php5 - 44.4.4_1 - 55.1.6_2 - - - - -

Stefan Esser reports:

-
-

PHP's open_basedir feature is meant to disallow scripts to - access files outside a set of configured base directories. - The checks for this are placed within PHP functions dealing - with files before the actual open call is performed.

-

Obviously there is a little span of time between the check - and the actual open call. During this time span the checked - path could have been altered and point to a file that is - forbidden to be accessed due to open_basedir restrictions.

-

Because the open_basedir restrictions often not call PHP - functions but 3rd party library functions to actually open - the file it is impossible to close this time span in a - general way. It would only be possible to close it when PHP - handles the actual opening on it's own.

-

While it seems hard to change the path during this little - time span it is very simple with the use of the symlink() - function combined with a little trick. PHP's symlink() - function ensures that source and target of the symlink - operation are allowed by open_basedir restrictions (and - safe_mode). However it is possible to point a symlink to - any file by the use of mkdir(), unlink() and at least two - symlinks.

-
- - - - 20326 - CVE-2006-5178 - http://www.hardened-php.net/advisory_082006.132.html - http://secunia.com/advisories/22235/ - - - 2006-10-02 - 2006-10-05 - 2013-04-01 - - - - - phpbb -- NULL byte injection vulnerability - - - phpbb - zh-phpbb-tw - 2.0.22 - - - - -

Secunia reports:

-
-

ShAnKaR has discovered a vulnerability in phpBB, which can - be exploited by malicious users to compromise a vulnerable - system.

-

Input passed to the "avatar_path" parameter in - admin/admin_board.php is not properly sanitised before - being used as a configuration variable to store avatar - images. This can be exploited to upload and execute - arbitrary PHP code by changing "avatar_path" to a file with - a trailing NULL byte.

-

Successful exploitation requires privileges to the - administration section.

-
- - - - 20347 - CVE-2006-4758 - http://secunia.com/advisories/22188/ - http://xforce.iss.net/xforce/xfdb/28884 - http://www.security.nnov.ru/Odocument221.html - - - 2006-09-12 - 2006-10-04 - 2006-12-24 - - - - - postnuke -- admin section SQL injection - - - postnuke - 0.763 - - - - -

ISS X-Force reports:

-
-

PostNuke is vulnerable to SQL injection. A remote attacker - could send specially-crafted SQL statements to the admin - section using the hits parameter, which could allow the - attacker to view, add, modify or delete information in the - back-end database.

-
- - - - 20317 - CVE-2006-5121 - http://xforce.iss.net/xforce/xfdb/29271 - http://www.securityfocus.com/archive/1/archive/1/447361/100/0/threaded - http://secunia.com/advisories/22197/ - - - 2006-09-29 - 2006-10-03 - 2007-11-17 - - - - - freetype -- LWFN Files Buffer Overflow Vulnerability - - - freetype2 - 2.1.10_5 - - - - -

SecurityTracker reports:

-
-

A vulnerability was reported in FreeType. A remote user - can cause arbitrary code to be executed on the target - user's system.

-

A remote user can create a specially crafted font file - that, when loaded by the target user's system, will trigger - an integer underflow or integer overflow and crash the - application or execute arbitrary code on the target system.

-

Chris Evans reported these vulnerabilities.

-

Impact: A remote user can create a file that, when loaded - by the target user, will execute arbitrary code on the - target user's system.

-
- - - - 18034 - CVE-2006-0747 - CVE-2006-1861 - CVE-2006-3467 - http://securitytracker.com/alerts/2006/Jul/1016522.html - - - 2006-07-10 - 2006-10-02 - - - - - cscope -- Buffer Overflow Vulnerabilities - - - cscope - 15.6 - - - - -

Secunia reports:

-
-

Will Drewry has reported some vulnerabilities in Cscope, - which potentially can be exploited by malicious people to - compromise a vulnerable system.

-

Various boundary errors within the parsing of file lists - or the expansion of environment variables can be exploited - to cause stack-based buffer overflows when parsing - specially crafted "cscope.lists" files or directories.

-

A boundary error within the parsing of command line - arguments can be exploited to cause a stack-based buffer - overflow when supplying an overly long "reffile" argument.

-

Successful exploitation may allow execution of arbitrary - code.

-
- - - - 19686 - 19687 - CVE-2006-4262 - http://secunia.com/advisories/21601 - http://sourceforge.net/mailarchive/forum.php?thread_id=30266760&forum_id=33500 - http://sourceforge.net/mailarchive/forum.php?thread_id=30266761&forum_id=33500 - - - 2006-08-20 - 2006-10-02 - 2006-10-11 - - - - - gnutls -- RSA Signature Forgery Vulnerability - - - gnutls - gnutls-devel - 1.4.4 - - - - -

Secunia reports:

-
-

A vulnerability has been reported in GnuTLS, which can be - exploited by malicious people to bypass certain security - restrictions.

-

The vulnerability is caused due to an error in the - verification of certain signatures. If a RSA key with - exponent 3 is used, it may be possible to forge PKCS #1 - v1.5 signatures signed with that key.

-
- - - - 20027 - CVE-2006-4790 - http://secunia.com/advisories/21937 - http://lists.gnupg.org/pipermail/gnutls-dev/2006-September/001205.html - - - 2006-09-08 - 2006-10-02 - - - - - MT -- Search Unspecified XSS - - - MT - 3.33.33 - - - - -

Secunia reports:

-
-

Arai has reported a vulnerability in Movable Type and - Movable Type Enterprise, which can be exploited by - malicious people to conduct cross-site scripting attacks.

-

Some unspecified input passed via the search functionality - isn't properly sanitised before being returned to the user. - This can be exploited to execute arbitrary HTML and script - code in a user's browser session in context of an affected - site.

-
- - - - 20228 - CVE-2006-5080 - http://secunia.com/advisories/22109 - http://www.sixapart.com/movabletype/news/2006/09/mt_333-mte_103_updates.html - - - 2006-09-26 - 2006-10-02 - 2006-10-15 - - - - - phpmyadmin -- XSRF vulnerabilities - - - phpMyAdmin - 2.9.0.1 - - - - -

phpMyAdmin team reports:

-
-

We received a security advisory from Stefan Esser - (sesser@hardened-php.net) and we wish to thank him for his - work.

-

It was possible to inject arbitrary SQL commands by - forcing an authenticated user to follow a crafted link.

-
- - - - CVE-2006-5116 - CVE-2006-5117 - http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-5 - http://secunia.com/advisories/22126/ - 20253 - - - 2006-09-28 - 2006-10-02 - 2006-10-03 - - - - - openssh -- multiple vulnerabilities - - - FreeBSD - 6.16.1_10 - 6.06.0_15 - 5.55.5_8 - 5.45.4_22 - 5.05.3_37 - 4.11_25 - - - openssh - 4.4,1 - - - openssh-portable - 4.4.p1,1 - - - - -

Problem Description

-

The CRC compensation attack detector in the sshd(8) daemon, - upon receipt of duplicate blocks, uses CPU time cubic in the - number of duplicate blocks received. [CVE-2006-4924]

-

A race condition exists in a signal handler used by the - sshd(8) daemon to handle the LoginGraceTime option, which - can potentially cause some cleanup routines to be executed - multiple times. [CVE-2006-5051]

-

Impact

-

An attacker sending specially crafted packets to sshd(8) - can cause a Denial of Service by using 100% of CPU time - until a connection timeout occurs. Since this attack can be - performed over multiple connections simultaneously, it is - possible to cause up to MaxStartups (10 by default) sshd - processes to use all the CPU time they can obtain. - [CVE-2006-4924]

-

The OpenSSH project believe that the race condition can - lead to a Denial of Service or potentially remote code - execution, but the FreeBSD Security Team has been unable to - verify the exact impact. [CVE-2006-5051]

-

Workaround

-

The attack against the CRC compensation attack detector can - be avoided by disabling SSH Protocol version 1 support in - sshd_config(5).

-

There is no workaround for the second issue.

- - - - 20216 - CVE-2006-4924 - CVE-2006-5051 - SA-06:22.openssh - http://www.openssh.com/txt/release-4.4 - - - 2006-09-25 - 2006-09-30 - - - - - dokuwiki -- multiple vulnerabilities - - - dokuwiki - 20060309c - - - dokuwiki-devel - 20060909 - - - - -

Secunia reports:

-
-

rgod has discovered a vulnerability in DokuWiki, which can - be exploited by malicious people to compromise a vulnerable - system.

-

Input passed to the "TARGET_FN" parameter in - bin/dwpage.php is not properly sanitised before being used - to copy files. This can be exploited via directory - traversal attacks in combination with DokuWiki's file - upload feature to execute arbitrary PHP code.

-
-

CVE Mitre reports:

-
-

Direct static code injection vulnerability in doku.php in - DokuWiki before 2006-03-09c allows remote attackers to - execute arbitrary PHP code via the X-FORWARDED-FOR HTTP - header, which is stored in config.php.

-
-
-

Unrestricted file upload vulnerability in - lib/exe/media.php in DokuWiki before 2006-03-09c allows - remote attackers to upload executable files into the - data/media folder via unspecified vectors.

-
-
-

DokuWiki before 2006-03-09c enables the debug feature by - default, which allows remote attackers to obtain sensitive - information by calling doku.php with the X-DOKUWIKI-DO HTTP - header set to "debug".

-
- - - - 19911 - CVE-2006-4674 - CVE-2006-4675 - CVE-2006-4679 - http://secunia.com/advisories/21819/ - http://bugs.splitbrain.org/index.php?do=details&id=906 - - - 2006-09-08 - 2006-09-30 - 2006-10-02 - - - - - dokuwiki -- multiple vulnerabilities - - - dokuwiki - 20060309_5 - - - dokuwiki-devel - 20060609_2 - - - - -

Secunia reports:

-
-

Some vulnerabilities have been reported in DokuWiki, which - can be exploited by malicious people to cause a DoS (Denial - of Service) or potentially compromise a vulnerable system.

-

Input passed to the "w" and "h" parameters in - lib/exec/fetch.php is not properly sanitised before being - passed as resize parameters to the "convert" application. - This can be exploited to cause a DoS due to excessive CPU - and memory consumption by passing very large numbers, or to - inject arbitrary shell commands by passing specially - crafted strings to the "w" and "h" parameter.

-

Successful exploitation requires that the - "$conf[imconvert]" option is set.

-
- - - - CVE-2006-5098 - CVE-2006-5099 - http://secunia.com/advisories/22192/ - http://secunia.com/advisories/22199/ - http://bugs.splitbrain.org/?do=details&id=924 - http://bugs.splitbrain.org/?do=details&id=926 - - - 2006-09-26 - 2006-09-30 - 2006-10-02 - - - - - tikiwiki -- multiple vulnerabilities - - - tikiwiki - 1.9.5 - - - - -

Secunia reports:

-
-

Thomas Pollet has discovered a vulnerability in TikiWiki, - which can be exploited by malicious people to conduct - cross-site scripting attacks.

-

Input passed to the "highlight" parameter in - tiki-searchindex.php is not properly sanitised before being - returned to the user. This can be exploited to execute - arbitrary HTML and script code in a user's browser session - in context of an affected site.

-
-
-

rgod has discovered a vulnerability in TikiWiki, which can - be exploited by malicious people to compromise a vulnerable - system.

-

The vulnerability is caused due to the "jhot.php" script - not correctly verifying uploaded files. This can e.g. be - exploited to execute arbitrary PHP code by uploading a - malicious PHP script to the "img/wiki" directory.

-
- - - - 19654 - 19819 - CVE-2006-4299 - CVE-2006-4602 - http://secunia.com/advisories/21536/ - http://secunia.com/advisories/21733/ - - - 2006-08-21 - 2006-09-30 - - - - - punbb -- NULL byte injection vulnerability - - - punbb - 1.2.13 - - - - -

CVE Mitre reports:

-
-

PunBB 1.2.12 does not properly handle an avatar directory - pathname ending in %00, which allows remote authenticated - administrative users to upload arbitrary files and execute - code, as demonstrated by a query to admin_options.php with - an avatars_dir parameter ending in %00. NOTE: this issue - was originally disputed by the vendor, but the dispute was - withdrawn on 20060926.

-
- - - - CVE-2006-4759 - http://forums.punbb.org/viewtopic.php?id=13255 - - - 2006-09-13 - 2006-09-30 - - - - - freeciv -- Denial of Service Vulnerabilities - - - freeciv - freeciv-gtk - freeciv-gtk2 - freeciv-nox11 - 2.0.8_2 - - - - -

Secunia reports:

-
-

Luigi Auriemma has reported a vulnerability in Freeciv, - which can be exploited by malicious people to cause a DoS - (Denial of Service).

-

An error in the "generic_handle_player_attribute_chunk()" - function in common/packets.c can be exploited to crash the - service via a specially crafted - PACKET_PLAYER_ATTRIBUTE_CHUNK packet sent to the server.

-

An error in the "handle_unit_orders()" function in - server/unithand.c can be exploited to crash the service - via a specially crafted packet.

-
- - - - CVE-2006-3913 - 19117 - http://secunia.com/advisories/21171/ - http://aluigi.altervista.org/adv/freecivx-adv.txt - - - 2006-07-23 - 2006-09-26 - - - - - freeciv -- Packet Parsing Denial of Service Vulnerability - - - freeciv - freeciv-gtk - freeciv-gtk2 - freeciv-nox11 - 2.0.8 - - - - -

Secunia reports:

-
-

Luigi Auriemma has reported a vulnerability in Freeciv, which - can be exploited by malicious people to cause a DoS (Denial of - Service).

-

The vulnerability is caused due to an error within the - handling of the packet length in "common/packets.c". This can - be exploited to crash the Freeciv server via a specially- - crafted packet with the size set to "0xffff".

-
- - - - CVE-2006-0047 - 16975 - http://secunia.com/advisories/19120/ - http://aluigi.altervista.org/adv/freecivdos-adv.txt - - - 2006-03-06 - 2006-09-26 - - - - - plans -- multiple vulnerabilities - - - plans - 6.7.2 - - - - -

Secunia reports:

-
-

A vulnerability has been reported in Plans, which can be - exploited by malicious people to conduct SQL injection - attacks.

-

Input passed to the "evt_id" parameter in "plans.cgi" - isn't properly sanitised before being used in a SQL query. - This can be exploited to manipulate SQL queries by - injecting arbitrary SQL code.

-

Successful exploitation requires that SQL database - support has been enabled in "plans_config.pl" (the default - setting is flat files).

-
-
-

Some vulnerabilities have been reported in Plans, which - can be exploited by malicious people to conduct cross-site - scripting attacks or gain knowledge of sensitive - information.

-

Input passed to various unspecified parameters is not - properly sanitised before being returned to users. This - can be exploited to execute arbitrary HTML and script code - in a user's browser session in context of a vulnerable - site.

-

An unspecified error can be exploited to gain knowledge - of the MySQL password.

-
- - - - 14069 - http://secunia.com/advisories/15167/ - http://secunia.com/advisories/15854/ - http://planscalendar.com/forum/viewtopic.php?t=660 - - - 2005-04-28 - 2006-09-26 - 2006-10-15 - - - - - eyeOS -- multiple XSS security bugs - - - eyeOS - 0.9.1 - - - - -

eyeOS team reports:

-
-

[EyeOS 0.9.1] release fixes two XSS security bugs, so we - recommend all users to upgrade to this new version in order - to have the best security. These two bugs were discovered by - Jose Carlos Norte, who is a new eyeOS developer.

-
- - - - 20213 - CVE-2006-5071 - http://eyeos.blogspot.com/2006/09/eyeos-091-released.html - - - 2006-09-25 - 2006-09-25 - 2006-10-15 - - - - - zope -- restructuredText "csv_table" Information Disclosure - - - zope - 2.7.02.7.9_1 - 2.8.02.8.8_1 - - - - -

Secunia reports:

-
-

A vulnerability has been reported in Zope, which can be - exploited by malicious people to disclose potentially - sensitive information.

-

The vulnerability is caused due to an error in the use of - the docutils module to parse and render "restructured" - text. This can be exploited to disclose certain information - via the "csv_table" reStructuredText directive.

-
- - - - 20022 - CVE-2006-4684 - http://secunia.com/advisories/21947/ - http://www.zope.org/Products/Zope/Hotfix-2006-08-21/Hotfix-20060821/README.txt - - - 2006-08-21 - 2006-09-22 - 2006-12-27 - - - - - libmms -- stack-based buffer overflow - - - libmms - 0.3 - - - libxine - 1.1.1 - - - - -

Mitre CVE reports:

-
-

Stack-based buffer overflow in libmms, as used by (a) - MiMMS 0.0.9 and (b) xine-lib 1.1.0 and earlier, allows - remote attackers to cause a denial of service (application - crash) and possibly execute arbitrary code via the (1) - send_command, (2) string_utf16, (3) get_data, and (4) - get_media_packet functions, and possibly other functions.

-
- - - - CVE-2006-2200 - 18608 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=374577 - - - 2006-05-04 - 2006-09-22 - - - - - opera -- RSA Signature Forgery - - - opera - opera-devel - linux-opera - 9.02 - - - - -

Opera reports:

-
-

A specially crafted digital certificate can bypass Opera's - certificate signature verification. Forged certificates can - contain any false information the forger chooses, and Opera - will still present it as valid. Opera will not present any - warning dialogs in this case, and the security status will - be the highest possible (3). This defeats the protection - against "man in the middle", the attacks that SSL was - designed to prevent.

-

There is a flaw in OpenSSL's RSA signature verification - that affects digital certificates using 3 as the public - exponent. Some of the certificate issuers that are on - Opera's list of trusted signers have root certificates with - 3 as the public exponent. The forged certificate can appear - to be signed by one of these.

-
- - - - CVE-2006-4339 - http://secunia.com/advisories/21982/ - http://secunia.com/advisories/21709/ - http://www.cdc.informatik.tu-darmstadt.de/securebrowser/ - http://www.openssl.org/news/secadv_20060905.txt - http://www.mozilla.org/security/announce/2006/mfsa2006-60.html - - - 2006-09-18 - 2006-09-22 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 1.5.0.7,1 - 2.*,12.0_1,1 - - - linux-firefox - 1.5.0.7 - - - seamonkey - linux-seamonkey - 1.0.5 - - - thunderbird - linux-thunderbird - mozilla-thunderbird - 1.5.0.7 - - - linux-firefox-devel - 3.0.a2006.09.21 - - - linux-seamonkey-devel - 1.5.a2006.09.21 - - - linux-mozilla-devel - linux-mozilla - mozilla - 0 - - - - -

The Mozilla Foundation reports of multiple security issues - in Firefox, Seamonkey, and Thunderbird. Several of these - issues can probably be used to run arbitrary code with the - privilege of the user running the program.

-
-
    -
  • MFSA 2006-64 Crashes with evidence of memory - corruption (rv:1.8.0.7)
    • -
  • MFSA 2006-63 JavaScript execution in mail via XBL
    • -
  • MFSA 2006-62 Popup-blocker cross-site scripting (XSS)
    • -
  • MFSA 2006-61 Frame spoofing using document.open()
    • -
  • MFSA 2006-60 RSA Signature Forgery
    • -
  • MFSA 2006-59 Concurrency-related vulnerability
    • -
  • MFSA 2006-58 Auto-Update compromise through DNS and - SSL spoofing
    • -
  • MFSA 2006-57 JavaScript Regular Expression Heap - Corruption
    • -
-
- - - - 20042 - CVE-2006-4253 - CVE-2006-4340 - CVE-2006-4565 - CVE-2006-4566 - CVE-2006-4567 - CVE-2006-4568 - CVE-2006-4569 - CVE-2006-4570 - CVE-2006-4571 - http://www.mozilla.org/security/announce/2006/mfsa2006-57.html - http://www.mozilla.org/security/announce/2006/mfsa2006-58.html - http://www.mozilla.org/security/announce/2006/mfsa2006-59.html - http://www.mozilla.org/security/announce/2006/mfsa2006-60.html - http://www.mozilla.org/security/announce/2006/mfsa2006-61.html - http://www.mozilla.org/security/announce/2006/mfsa2006-62.html - http://www.mozilla.org/security/announce/2006/mfsa2006-63.html - http://www.mozilla.org/security/announce/2006/mfsa2006-64.html - - - 2006-09-14 - 2006-09-15 - 2006-11-02 - - - - - win32-codecs -- multiple vulnerabilities - - - win32-codecs - 3.1.0.p8_1,1 - - - - -

The Apple Security Team reports that there are multiple - vulnerabilities within QuickTime (one of the plugins for - win32-codecs). A remote attacker capable of creating a - malicious SGI image, FlashPix, FLC movie, or a QuickTime - movie can possibly lead to execution of arbitrary code or - cause a Denial of Service (application crash).

-

Users who have QuickTime (/win32-codecs) as a browser plugin - may be vulnerable to remote code execution by visiting a - website containing a malicious SGI image, FlashPix, FLC movie - or a QuickTime movie.

- - - - 20138 - CVE-2006-4381 - CVE-2006-4382 - CVE-2006-4384 - CVE-2006-4385 - CVE-2006-4386 - CVE-2006-4388 - CVE-2006-4389 - http://docs.info.apple.com/article.html?artnum=304357 - - - 2006-09-08 - 2006-09-14 - 2006-10-17 - - - - - php -- multiple vulnerabilities - - - php4 - php5 - 4.4.4 - 55.1.5 - - - php4-cli - php5-cli - php4-cgi - php5-cgi - php4-dtc - php5-dtc - php4-horde - php5-horde - php4-nms - php5-nms - mod_php4 - mod_php5 - 4.4.4 - 55.1.5 - - - - -

The PHP development team reports:

-
-
    -
  • Added missing safe_mode/open_basedir checks inside the - error_log(), file_exists(), imap_open() and imap_reopen() - functions.
    • -
  • Fixed overflows inside str_repeat() and wordwrap() - functions on 64bit systems.
    • -
  • Fixed possible open_basedir/safe_mode bypass in cURL - extension and with realpath cache.
    • -
  • Fixed overflow in GD extension on invalid GIF - images.
    • -
  • Fixed a buffer overflow inside sscanf() function.
    • -
  • Fixed an out of bounds read inside stripos() - function.
    • -
  • Fixed memory_limit restriction on 64 bit system.
    • -
-
- - - - CVE-2006-4481 - CVE-2006-4482 - CVE-2006-4483 - CVE-2006-4484 - CVE-2006-4485 - CVE-2006-4486 - http://www.php.net/release_4_4_4.php - http://www.php.net/release_5_1_5.php - - - 2006-08-18 - 2006-09-13 - 2014-03-28 - - - - - drupal-pubcookie -- authentication may be bypassed - - - drupal-pubcookie - 4.6.0_20060210 - - - - -

The Drupal Project reports:

-
-

It is possible for a malicious user to spoof a user's - identity by bypassing the login redirection mechanism in the - pubcookie module. The malicious user may gain the privileges - of the user they are spoofing, including the administrative - user.

-
- - - - CVE-2006-4717 - http://drupal.org/node/83064 - - - 2006-09-08 - 2006-09-13 - 2010-05-12 - - - - - linux-flashplugin7 -- arbitrary code execution vulnerabilities - - - linux-flashplugin - 7.0r68 - - - - -

Adobe reports:

-
-

Multiple input validation errors have been identified in - Flash Player 8.0.24.0 and earlier versions that could lead - to the potential execution of arbitrary code. These - vulnerabilities could be accessed through content - delivered from a remote location via the user?s web - browser, email client, or other applications that include - or reference the Flash Player. (CVE-2006-3311, - CVE-2006-3587, CVE-2006-3588)

-

These updates include changes to prevent circumvention of - the "allowScriptAccess" option. (CVE-2006-4640)

-
- - - - CVE-2006-3311 - CVE-2006-3587 - CVE-2006-3588 - CVE-2006-4640 - http://www.adobe.com/support/security/bulletins/apsb06-11.html - - - 2006-09-12 - 2006-09-12 - - - - - - - - - mailman -- Multiple Vulnerabilities - - - mailman - ja-mailman - mailman-with-htdig - 2.1.9.r1 - - - - -

Secunia reports:

-
-

Mailman can be exploited by malicious people to conduct cross-site - scripting and phishing attacks, and cause a DoS (Denial of - Service).

-

1) An error in the logging functionality can be exploited to - inject a spoofed log message into the error log via a specially - crafted URL.

-

Successful exploitation may trick an administrator into visiting - a malicious web site.

-

2) An error in the processing of malformed headers which does not - follow the RFC 2231 standard can be exploited to cause a DoS - (Denial of Service).

-

3) Some unspecified input isn't properly sanitised before being - returned to the user. This can be exploited to execute arbitrary - HTML and script code in a user's browser session in context of an - affected site.

-
- - - - 19831 - CVE-2006-2191 - CVE-2006-2941 - CVE-2006-3636 - CVE-2006-4624 - http://secunia.com/advisories/21732/ - http://sourceforge.net/project/shownotes.php?group_id=103&release_id=444295 - - - 2006-06-09 - 2006-09-04 - 2006-10-04 - - - - - hlstats -- multiple cross site scripting vulnerabilities - - - hlstats - 1.35 - - - - -

Kefka reports multiple cross site scripting vulnerabilities - within hlstats. The vulnerabilities are caused due to - improper checking of variables, allowing an attacker to - perform cross site scripting.

- - - - 19745 - CVE-2006-4454 - CVE-2006-6780 - CVE-2006-6781 - CVE-2007-2812 - - - 2006-08-29 - 2006-09-02 - 2011-09-03 - - - - - gtetrinet -- remote code execution - - - gtetrinet - 0.7.10 - - - - -

The Debian Security Team reports:

-
-

Michael Gehring discovered several potential out-of-bounds - index accesses in gtetrinet, a multiplayer Tetris-like game, - which may allow a remote server to execute arbitrary - code

-
- - - - 19766 - CVE-2006-3125 - http://www.debian.org/security/2006/dsa-1163 - - - 2006-08-30 - 2006-09-02 - 2006-10-01 - - - - - joomla -- multiple vulnerabilities - - - joomla - 1.0.11 - - - - -

The Joomla development team reports multiple vulnerabilities - within the joomla application. Joomla is vulnerable to the - following vulnerabilities:

-
    -
  • Improper validation of the mosMail function
    • -
  • Improper validation of the JosIsValidEmail function.
    • -
  • Remote code execution in PEAR.php
    • -
  • Zend Hash del key or index vulnerability
    • -
- - - - http://www.joomla.org/content/view/1841/78/ - - - 2006-08-28 - 2006-08-30 - 2010-05-12 - - - - - sppp -- buffer overflow vulnerability - - - FreeBSD - 4.11_20 - 5.35.3_32 - 5.45.4_17 - 5.55.5_3 - 6.06.0_10 - 6.16.1_4 - - - - -

Problem Description

-

While processing Link Control Protocol (LCP) configuration - options received from the remote host, sppp(4) fails to - correctly validate option lengths. This may result in data - being read or written beyond the allocated kernel memory - buffer.

-

Impact

-

An attacker able to send LCP packets, including the remote - end of a sppp(4) connection, can cause the FreeBSD kernel to - panic. Such an attacker may also be able to obtain - sensitive information or gain elevated privileges.

-

Workaround

-

No workaround is available, but systems which do not use sppp(4) are - not vulnerable.

- - - - CVE-2006-4304 - SA-06:18.ppp - - - 2006-08-23 - 2006-08-23 - 2006-08-30 - - - - - horde -- Phishing and Cross-Site Scripting Vulnerabilities - - - horde - 3.1.2 - - - imp - 4.1.2 - - - - -

Secunia reports:

-
-

Some vulnerabilities have been reported in Horde, which - can be exploited by malicious people to conduct phishing - and cross-site scripting attacks.

-
    -
  1. Input passed to the "url" parameter in index.php isn't - properly verified before it is being used to include an - arbitrary web site in a frameset. This can e.g. be - exploited to trick a user into believing certain - malicious content is served from a trusted web site.
    2. -
  2. Some unspecified input passed in index.php isn't - properly sanitised before being returned to the user. - This can be exploited to execute arbitrary HTML and - script code in a user's browser session in context of an - affected site.
    3. -
-
- - - - 19557 - 19544 - http://secunia.com/advisories/21500/ - http://lists.horde.org/archives/announce/2006/000292.html - - - 2006-08-17 - 2006-08-17 - - - - - globus -- Multiple tmpfile races - - - globus - 4.0.2_20060706 - - - - -

The Globus Alliance reports:

-
-

The proxy generation tool (grid-proxy-init) creates the - file, secures the file to provide access only to owner and - writes proxy to the file. A race condition exists between - the opening of the proxy credentials file, and making sure - it is safe file to write to. The checks to ensure this - file is accessible only to the owner take place using the - filename after the file is opened for writing, but before - any data is written.

-
-
-

Various components of the toolkit use files in shared - directories to store information, some being sensitive - information. For example, the tool to create proxy - certificates, stores the generated proxy certificate by - default in /tmp. Specific vulnerabilities in handling such - files were reported in myproxy-admin-adduser, grid-ca-sign - and grid-security-config.

-
- - - - CVE-2006-4232 - CVE-2006-4233 - http://www.globus.org/mail_archive/security-announce/2006/08/msg00000.html - http://www.globus.org/mail_archive/security-announce/2006/08/msg00001.html - - - 2006-08-08 - 2006-08-15 - 2010-05-12 - - - - - x11vnc -- authentication bypass vulnerability - - - x11vnc - 0.8.2 - - - - -

Ludwig Nussel reports that x11vnc is vulnerable to an - authentication bypass vulnerability. The vulnerability is - caused by an error in auth.c. This could allow a remote - attacker to gain unauthorized and unauthenticated access - to the system.

- - - - 18977 - CVE-2006-2450 - http://bugs.debian.org/376824 - - - 2006-08-08 - 2006-08-13 - - - - - alsaplayer -- multiple vulnerabilities - - - alsaplayer - 0 - - - - -

Luigi Auriemma reports three vulnerabilities within - alsaplayer:

-
-
    -
  • The function which handles the HTTP connections is - vulnerable to a buffer-overflow that happens when it uses - sscanf for copying the URL in the Location's field - received from the server into the redirect buffer of only - 1024 bytes declared in http_open.
    • -
  • A buffer-overflow exists in the functions which add items - to the playlist when the GTK interface is used (so the other - interfaces are not affected by this problem): new_list_item - and CbUpdated in interface/gtk/PlaylistWindow.cpp.
    • -
  • AlsaPlayer automatically queries the CDDB server - specified in its configuration (by default - freedb.freedb.org) when the user choices the CDDA function - for playing audio CDs. The function which queries the - server uses a buffer of 20 bytes and one of 9 for storing - the category and ID strings received from the server while - the buffer which contains this server's response is 32768 - bytes long. Naturally for exploiting this bug the attacker - must have control of the freedb server specified in the - AlsaPlayer's configuration.
    • -
-
-

These vulnerabilities could allow a remote attacker to - execute arbitrary code, possibly gaining access to the - system.

- - - - CVE-2006-4089 - 19450 - http://aluigi.altervista.org/adv/alsapbof-adv.txt - - - 2006-08-09 - 2006-08-13 - 2010-05-12 - - - - - postgresql -- encoding based SQL injection - - - postgresql - postgresql-server - ja-postgresql - 7.37.3.15 - 7.47.4.13 - 8.0.08.0.8 - 8.1.08.1.4 - - - - -

The PostgreSQL development team reports:

-
-

An attacker able to submit crafted strings to an - application that will embed those strings in SQL commands - can use invalidly-encoded multibyte characters to bypass - standard string-escaping methods, resulting in possible - injection of hostile SQL commands into the database. The - attacks covered here work in any multibyte encoding.

-

The widely-used practice of escaping ASCII single quote - "'" by turning it into "\'" is unsafe when operating in - multibyte encodings that allow 0x5c (ASCII code for - backslash) as the trailing byte of a multibyte character; - this includes at least SJIS, BIG5, GBK, GB18030, and UHC. - An application that uses this conversion while embedding - untrusted strings in SQL commands is vulnerable to - SQL-injection attacks if it communicates with the server in - one of these encodings. While the standard client libraries - used with PostgreSQL have escaped "'" in the safe, - SQL-standard way of "''" for some time, the older practice - remains common.

-
- - - - 18092 - CVE-2006-2313 - CVE-2006-2314 - http://www.postgresql.org/docs/techdocs.50 - - - 2006-05-11 - 2006-08-13 - - - - - postgresql -- multiple vulnerabilities - - - postgresql - postgresql-server - ja-postgresql - 7.27.2.7 - 7.37.3.9 - 7.47.4.7 - 8.0.08.0.1 - - - - -

Multiple vulnerabilities had been reported in various - versions of PostgreSQL:

-
    -
  • The EXECUTE restrictions can be bypassed by using the - AGGREGATE function, which is missing a permissions check.
    • -
  • A buffer overflow exists in gram.y which could allow an - attacker to execute arbitrary code by sending a large - number of arguments to a refcursor function, found in - gram.y
    • -
  • The intagg contributed module allows an attacker to crash - the server (Denial of Service) by constructing a malicious - crafted array.
    • -
- - - - CVE-2005-0244 - CVE-2005-0245 - CVE-2005-0246 - http://secunia.com/advisories/12948 - - - 2005-02-01 - 2006-08-13 - - - - - mysql -- format string vulnerability - - - mysql-server - 5.15.1.6 - 5.05.0.19 - 4.14.1.18 - - - - -

Jean-David Maillefer reports a Denial of Service vulnerability - within MySQL. The vulnerability is caused by improper checking - of the data_format routine, which cause the MySQL server to - crash. The crash is triggered by the following code:
- "SELECT date_format('%d%s', 1);

- - - - 19032 - CVE-2006-3469 - http://bugs.mysql.com/bug.php?id=20729 - - - 2006-06-27 - 2006-08-13 - - - - - squirrelmail -- random variable overwrite vulnerability - - - ja-squirrelmail - 1.4.01.4.8,2 - - - squirrelmail - 1.4.01.4.8 - - - - -

The SquirrelMail developers report:

-
-

A logged in user could overwrite random variables in - compose.php, which might make it possible to read/write - other users' preferences or attachments.

-
- - - - CVE-2006-4019 - http://www.squirrelmail.org/security/issue/2006-08-11 - - - 2006-08-11 - 2006-08-12 - - - - - rubygem-rails -- evaluation of ruby code - - - rubygem-rails - 1.1.01.1.3 - 1.1.41.1.6 - - - - -

The Ruby on Rails blog reports:

-
-

With Rails 1.1.0 through 1.1.5 (minus the short-lived 1.1.3), - you can trigger the evaluation of Ruby code through the URL - because of a bug in the routing code of Rails. This means that - you can essentially take down a Rails process by starting - something like /script/profiler, as the code will run for a - long time and that process will be hung while it happens. - Other URLs can even cause data loss.

-
- - - - http://weblog.rubyonrails.org/2006/8/10/rails-1-1-6-backports-and-full-disclosure - - - 2006-08-09 - 2006-08-10 - - - - - clamav -- heap overflow vulnerability - - - clamav - 0.88.10.88.4 - - - clamav-devel - 20060808 - - - - -

Clamav team reports:

-
-

A heap overflow vulnerability was discovered in libclamav - which could cause a denial of service or allow the - execution of arbitrary code.

-

The problem is specifically located in the PE file rebuild - function used by the UPX unpacker.

-

Relevant code from libclamav/upx.c:

-

- memcpy(dst, newbuf, foffset); - *dsize = foffset; - free(newbuf); - - cli_dbgmsg("UPX: PE structure rebuilt from compressed file\n"); - return 1;

-

Due to improper validation it is possible to overflow the above - memcpy() beyond the allocated memory block.

-
- - - - CVE-2006-4018 - http://www.clamav.net/security/0.88.4.html - - - 2006-08-07 - 2006-08-08 - - - - - drupal -- XSS vulnerability - - - drupal - 4.6.9 - - - - -

The Drupal project reports:

-
-

A malicious user can execute a cross site scripting attack - by enticing someone to visit a Drupal site via a specially - crafted link.

-
- - - - http://drupal.org/files/sa-2006-011/advisory.txt - - - 2006-08-02 - 2006-08-02 - 2006-08-08 - - - - - gnupg -- 2 more possible memory allocation attacks - - - gnupg - 1.4.5 - - - - -

Author reports:

-
-

Fixed 2 more possible memory allocation attacks. They are - similar to the problem we fixed with 1.4.4. This bug can easily - be exploted for a DoS; remote code execution is not entirely - impossible.

-
- - - - http://lists.gnupg.org/pipermail/gnupg-announce/2006q3/000229.html - - - 2006-08-01 - 2006-08-02 - - - - - ruby -- multiple vulnerabilities - - - ruby - ruby_static - 1.6.*1.8.* - 1.8.*1.8.4_9,1 - - - - -

Secunia reports:

-
-

Two vulnerabilities have been reported in Ruby, which can - be exploited by malicious people to bypass certain security - restrictions.

-
    -
  1. An error in the handling of the "alias" functionality - can be exploited to bypass the safe level protection and - replace methods called in the trusted level.
    2. -
  2. An error caused due to directory operations not being - properly checked can be exploited to bypass the safe - level protection and close untainted directory streams.
    3. -
-
- - - - 18944 - CVE-2006-3694 - http://secunia.com/advisories/21009/ - http://jvn.jp/jp/JVN%2383768862/index.html - http://jvn.jp/jp/JVN%2313947696/index.html - - - 2006-07-12 - 2006-07-29 - 2006-07-30 - - - - - apache -- mod_rewrite buffer overflow vulnerability - - - apache - 1.3.281.3.36_1 - 2.0.462.0.58_2 - 2.2.02.2.2_1 - - - apache+mod_perl - 1.3.281.3.36_1 - - - apache+ipv6 - 1.3.281.3.37 - - - apache_fp - 0 - - - ru-apache - 1.3.281.3.37+30.23 - - - ru-apache+mod_ssl - 1.3.281.3.34.1.57_2 - - - apache+ssl - 1.3.281.3.34.1.57_2 - - - apache+mod_ssl - apache+mod_ssl+ipv6 - apache+mod_ssl+mod_accel - apache+mod_ssl+mod_accel+ipv6 - apache+mod_ssl+mod_accel+mod_deflate - apache+mod_ssl+mod_accel+mod_deflate+ipv6 - apache+mod_ssl+mod_deflate - apache+mod_ssl+mod_deflate+ipv6 - apache+mod_ssl+mod_snmp - apache+mod_ssl+mod_snmp+mod_accel - apache+mod_ssl+mod_snmp+mod_accel+ipv6 - apache+mod_ssl+mod_snmp+mod_deflate - apache+mod_ssl+mod_snmp+mod_deflate+ipv6 - apache+mod_ssl+mod_snmp+mod_accel+mod_deflate+ipv6 - 1.3.281.3.36+2.8.27_1 - - - - -

The Apache Software Foundation and The Apache HTTP Server - Project reports:

-
-

An off-by-one flaw exists in the Rewrite module, - mod_rewrite, as shipped with Apache 1.3 since 1.3.28, 2.0 - since 2.0.46, and 2.2 since 2.2.0.

-

Depending on the manner in which Apache HTTP Server was - compiled, this software defect may result in a - vulnerability which, in combination with certain types of - Rewrite rules in the web server configuration files, could - be triggered remotely. For vulnerable builds, the nature - of the vulnerability can be denial of service (crashing of - web server processes) or potentially allow arbitrary code - execution. This issue has been rated as having important - security impact by the Apache HTTP Server Security Team.

-

This flaw does not affect a default installation of - Apache HTTP Server. Users who do not use, or have not - enabled, the Rewrite module mod_rewrite are not affected - by this issue. This issue only affects installations using - a Rewrite rule with the following characteristics:

-
    -
  • The RewriteRule allows the attacker to control the - initial part of the rewritten URL (for example if the - substitution URL starts with $1)
    • -
  • The RewriteRule flags do NOT include any of the - following flags: Forbidden (F), Gone (G), or NoEscape - (NE).
    • -
-

Please note that ability to exploit this issue is - dependent on the stack layout for a particular compiled - version of mod_rewrite. If the compiler used to compile - Apache HTTP Server has added padding to the stack - immediately after the buffer being overwritten, it will - not be possible to exploit this issue, and Apache HTTP - Server will continue operating normally.

-

The Apache HTTP Server project thanks Mark Dowd of McAfee - Avert Labs for the responsible reporting of this - vulnerability.

-
- - - - 395412 - CVE-2006-3747 - http://marc.theaimsgroup.com/?l=apache-httpd-announce&m=115409818602955 - - - 2006-07-27 - 2006-07-28 - 2006-11-01 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 1.5.0.5,1 - 2.*,12.0_1,1 - - - linux-firefox - 1.5.0.5 - - - linux-firefox-devel - 3.0.a2006.07.26 - - - seamonkey - linux-seamonkey - 1.0.3 - - - thunderbird - linux-thunderbird - mozilla-thunderbird - 1.5.0.5 - - - mozilla - linux-mozilla - linux-mozilla-devel - 0 - - - - -

A Mozilla Foundation Security Advisory reports of multiple - issues. Several of which can be used to run arbitrary code - with the privilege of the user running the program.

-
-
    -
  • MFSA 2006-56 chrome: scheme loading remote content
    • -
  • MFSA 2006-55 Crashes with evidence of memory corruption - (rv:1.8.0.5)
    • -
  • MFSA 2006-54 XSS with - XPCNativeWrapper(window).Function(...)
    • -
  • MFSA 2006-53 UniversalBrowserRead privilege escalation
    • -
  • MFSA 2006-52 PAC privilege escalation using - Function.prototype.call
    • -
  • MFSA 2006-51 Privilege escalation using named-functions - and redefined "new Object()"
    • -
  • MFSA 2006-50 JavaScript engine vulnerabilities
    • -
  • MFSA 2006-49 Heap buffer overwrite on malformed VCard
    • -
  • MFSA 2006-48 JavaScript new Function race condition
    • -
  • MFSA 2006-47 Native DOM methods can be hijacked across - domains
    • -
  • MFSA 2006-46 Memory corruption with simultaneous events
    • -
  • MFSA 2006-45 Javascript navigator Object Vulnerability
    • -
  • MFSA 2006-44 Code execution through deleted frame - reference
    • -
-
- - - - CVE-2006-3113 - CVE-2006-3677 - CVE-2006-3801 - CVE-2006-3802 - CVE-2006-3803 - CVE-2006-3804 - CVE-2006-3805 - CVE-2006-3806 - CVE-2006-3807 - CVE-2006-3808 - CVE-2006-3809 - CVE-2006-3810 - CVE-2006-3811 - CVE-2006-3812 - http://www.mozilla.org/projects/security/known-vulnerabilities.html#seamonkey1.0.3 - http://www.mozilla.org/security/announce/2006/mfsa2006-44.html - http://www.mozilla.org/security/announce/2006/mfsa2006-45.html - http://www.mozilla.org/security/announce/2006/mfsa2006-46.html - http://www.mozilla.org/security/announce/2006/mfsa2006-47.html - http://www.mozilla.org/security/announce/2006/mfsa2006-48.html - http://www.mozilla.org/security/announce/2006/mfsa2006-49.html - http://www.mozilla.org/security/announce/2006/mfsa2006-50.html - http://www.mozilla.org/security/announce/2006/mfsa2006-51.html - http://www.mozilla.org/security/announce/2006/mfsa2006-52.html - http://www.mozilla.org/security/announce/2006/mfsa2006-53.html - http://www.mozilla.org/security/announce/2006/mfsa2006-54.html - http://www.mozilla.org/security/announce/2006/mfsa2006-55.html - http://www.mozilla.org/security/announce/2006/mfsa2006-56.html - - - 2006-07-25 - 2006-07-27 - 2006-11-02 - - - - - zope -- information disclosure vulnerability - - - zope - 2.7.02.7.9 - 2.8.02.8.7 - 2.9.02.9.3 - - - - -

Zope team reports:

-
-

Unspecified vulnerability in (Zope2) allows local users - to obtain sensitive information via unknown attack vectors - related to the docutils module and "restructured text".

-
- - - - CVE-2006-3458 - http://www.zope.org/Products/Zope/Hotfix-2006-07-05/Hotfix-2006-07-05/view - - - 2006-07-05 - 2006-07-14 - - - - - drupal -- multiple vulnerabilities - - - drupal - 4.6.8 - - - - -

The Drupal team reports:

-
-

Vulnerability: XSS Vulnerability in taxonomy module

-

It is possible for a malicious user to insert and execute - XSS into terms, due to lack of validation on output of the - page title. The fix wraps the display of terms in - check_plain().

-
- - - - CVE-2006-2833 - http://drupal.org/node/66767 - - - 2006-05-18 - 2006-07-13 - 2006-07-14 - - - - - shoutcast -- cross-site scripting, information exposure - - - shoutcast - linux-shoutcast - 1.9.7 - - - - -

Goober's advisory reports reports that shoutcast is vulnerable to an - arbitrary file reading vulnerability:

-
-

Impact of the vulnerability depends on the way the product was - installed. In general, the vulnerability allows the attacker to read - any file which can be read by the Shoutcast server process.

-
- - - - CVE-2006-3007 - http://secunia.com/advisories/20524/ - http://people.ksp.sk/~goober/advisory/001-shoutcast.html - - - 2006-06-09 - 2006-07-11 - - - - - samba -- memory exhaustion DoS in smbd - - - samba - ja-samba - 3.0.1,13.0.23,1 - - - - -

The Samba Team reports:

-
-

The smbd daemon maintains internal data structures used - track active connections to file and printer shares. In - certain circumstances an attacker may be able to - continually increase the memory usage of an smbd process - by issuing a large number of share connection requests. - This defect affects all Samba configurations.

-
- - - - CVE-2006-3403 - http://www.samba.org/samba/security/CAN-2006-3403.html - - - 2006-07-10 - 2006-07-10 - - - - - twiki -- multiple file extensions file upload vulnerability - - - twiki - 4.0.4,1 - - - - -

A TWiki Security Alert reports:

-
-

The TWiki upload filter already prevents executable - scripts such as .php, .php1, .phps, .pl from potentially - getting executed by appending a .txt suffix to the - uploaded filename. However, PHP and some other types - allows additional file suffixes, such as .php.en, .php.1, - and .php.2. TWiki does not check for these suffixes, - e.g. it is possible to upload php scripts with such - suffixes without the .txt filename padding.

-
-

This issue can also be worked around with a restrictive web - server configuration. See the - - TWiki Security Alert for more information about how to do - this.

- - - - 18854 - CVE-2006-3336 - http://secunia.com/advisories/20992/ - http://twiki.org/cgi-bin/view/Codev/SecurityAlertSecureFileUploads - - - 2006-07-05 - 2006-07-10 - - - - - trac -- reStructuredText breach of privacy and denial of service vulnerability - - - trac - ja-trac - 0.9.6 - - - - -

The Trac 0.9.6 Release Notes reports:

-
-

Fixed reStructuredText breach of privacy and denial of - service vulnerability found by Felix Wiemann.

-

The discovered vulnerability requires docutils to be - installed and enabled. Systems that do not have docutils - installed or enabled are not vulnerable. As of this - version version 0.3.9 or greater of docutils is required - for using reStructuredText markup in Trac.

-
- - - - CVE-2005-3980 - CVE-2005-4305 - CVE-2005-4065 - http://projects.edgewall.com/trac/wiki/ChangeLog - http://lists.edgewall.com/archive/trac-announce/2006-July/000013.html - - - 2006-07-06 - 2006-07-07 - 2010-05-12 - - - - - horde -- various problems in dereferrer - - - horde - horde-php5 - 3.1.2 - - - - -

Horde 3.1.2 release announcement:

-
-

Security Fixes:

-
    -
  • Closed XSS problems in dereferrer (IE only), help viewer - and problem reporting screen.
    • -
  • Removed unused image proxy code from dereferrer.
    • -
-
- - - - CVE-2006-3548 - http://lists.horde.org/archives/announce/2006/000288.html - - - 2006-06-28 - 2006-07-05 - 2010-05-12 - - - - - mambo -- SQL injection vulnerabilities - - - mambo - 4.5.4 - - - - -

The Team Mambo reports that two SQL injection - vulnerabilities have been found in Mambo. The - vulnerabilities exists due to missing sanitation of the - title and catid parameters in the - weblinks.php page and can lead to execution of - arbitrary SQL code.

- - - - 16775 - CVE-2006-0871 - CVE-2006-1794 - CVE-2006-3262 - CVE-2006-3263 - http://marc.theaimsgroup.com/?l=bugtraq&m=115056811230529 - http://secunia.com/advisories/18935/ - http://secunia.com/advisories/20745/ - http://www.mamboserver.com/?option=com_content&task=view&id=207 - http://www.gulftech.org/?node=research&article_id=00104-02242006 - - - 2006-06-19 - 2006-07-05 - 2006-10-05 - - - - - phpmyadmin -- cross site scripting vulnerability - - - phpMyAdmin - 2.8.2 - - - - -

phpmyadmin Site reports:

-
-

It was possible to craft a request that contains XSS by attacking - the "table" parameter.

-
- - - - http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-4 - http://securitynews.ir/advisories/phpmyadmin281.txt - - - 2006-06-30 - 2006-07-03 - 2007-10-16 - - - - - webmin, usermin -- arbitrary file disclosure vulnerability - - - webmin - 1.290 - - - usermin - 1.220 - - - - -

The webmin development team reports:

-
-

An attacker without a login to Webmin can read the - contents of any file on the server using a specially - crafted URL. All users should upgrade to version - 1.290 as soon as possible, or setup IP access control - in Webmin.

-
- - - - 18744 - http://www.webmin.com/security.html - - - 2006-06-30 - 2006-07-02 - - - - - mutt -- Remote Buffer Overflow Vulnerability - - - mutt - mutt-lite - 1.4.2.1_2 - - - mutt-devel - mutt-devel-lite - 1.5.11_2 - - - ja-mutt - 1.4.2.1.j1 - - - zh-mutt-devel - 1.5.11_20040617 - - - ja-mutt-devel - 1.5.6.j1_2 - - - mutt-ng - 20060501 - - - - -

SecurityFocus reports:

-
-

Mutt is prone to a remote buffer-overflow vulnerability. - This issue is due to the application's failure to properly - bounds-check user-supplied input before copying it to an - insufficiently sized memory buffer.

-

This issue may allow remote attackers to execute arbitrary - machine code in the context of the affected application. - Failed exploit attempts will likely crash the application, - denying further service to legitimate users.

-
- - - - 18642 - http://dev.mutt.org/cgi-bin/gitweb.cgi?p=mutt/.git;a=commit;h=dc0272b749f0e2b102973b7ac43dbd3908507540 - - - 2006-06-26 - 2006-06-30 - - - - - Joomla -- multiple vulnerabilities - - - joomla - 1.0.10 - - - - -

Joomla Site reports:

-
-
    -
  • Secured "Remember Me" functionality against SQL injection - attacks
    • -
  • Secured "Related Items" module against SQL injection - attacks
    • -
  • Secured "Weblinks" submission against SQL injection - attacks
    • -
  • Secured SEF from XSS vulnerability
    • -
  • Hardened frontend submission forms against spoofing
    • -
  • Secured mosmsg from misuse
    • -
  • Hardened mosgetparam by setting variable type to integer if - default value is detected as numeric
    • -
  • Secured com_messages from XSS vulnerability
    • -
  • Secured getUserStateFromRequest() from XSS vulnerability
    • -
-
- - - - http://secunia.com/advisories/20746/ - http://www.joomla.org/content/view/1510/74/ - - - 2006-06-26 - 2006-06-30 - - - - - hashcash -- heap overflow vulnerability - - - hashcash - 1.22 - - - - -

Andreas Seltenreich reports that hashcash is prone to a heap - overflow vulnerability. This vulnerability is caused by - improper checking of memory allocations within the - "array_push()" function. An attacker could trigger this - vulnerability by passing a lot of "-r" or "-j" flags from - the command line, this only applies when the application is - configured to allow command line options, or by passing a lot - of resource names when the application was started with the - "-m" flag set. This could lead to a Denial or Service or - could allow remote access to the targeted system.

- - - - http://secunia.com/advisories/20800/ - http://www.hashcash.org/source/CHANGELOG - - - 2006-06-27 - 2006-06-27 - - - - - gnupg -- user id integer overflow vulnerability - - - gnupg - 1.4.4 - - - - -

If GnuPG processes a userid with a very long packet length, - GnuPG can crash due to insufficient bounds check. This can - result in a denial-of-service condition or potentially - execution of arbitrary code with the privileges of the user - running GnuPG.

- - - - 18554 - CVE-2006-3082 - http://marc.theaimsgroup.com/?l=gnupg-users&m=115124706210430 - http://marc.theaimsgroup.com/?l=full-disclosure&m=114907659313360 - http://cvs.gnupg.org/cgi-bin/viewcvs.cgi/trunk/g10/parse-packet.c?rev=4157&r1=4141&r2=4157 - - - 2006-05-31 - 2006-06-25 - - - - - - - - - horde -- multiple parameter cross site scripting vulnerabilities - - - horde - horde-php5 - 3.1.1 - - - - -

FrSIRT advisory ADV-2006-2356 reports:

-
-

Multiple vulnerabilities have been identified in Horde - Application Framework, which may be exploited by attackers - to execute arbitrary scripting code. These flaws are due - to input validation errors in the "test.php" and - "templates/problem/problem.inc" scripts that do not - validate the "url", "name", "email", "subject" and - "message" parameters, which could be exploited by - attackers to cause arbitrary scripting code to be executed - by the user's browser in the security context of an - affected Web site.

-
- - - - CVE-2006-2195 - http://www.frsirt.com/english/advisories/2006/2356 - http://cvs.horde.org/diff.php?f=horde%2Ftest.php&r1=1.145&r2=1.146 - http://cvs.horde.org/diff.php?f=horde%2Ftemplates%2Fproblem%2Fproblem.inc&r1=2.25&r2=2.26 - - - 2006-06-10 - 2006-06-17 - - - - - WebCalendar -- information disclosure vulnerability - - - WebCalendar - 1.0.4 - - - - -

Secunia reports:

-
-

socsam has discovered a vulnerability in WebCalendar, - which can be exploited by malicious people to bypass - certain security restrictions and disclose sensitive - information.

-

Input passed to the "includedir" parameter isn't properly - verified, before it is used in an "fopen()" call. This can - be exploited to load an arbitrary setting file from an - external web site.

-

This can further be exploited to disclose the content of - arbitrary files by defining the "user_inc" variable in a - malicious setting file.

-

Successful exploitation requires that "register_globals" - is enabled.

-
- - - - 18175 - CVE-2006-2762 - http://www.securityfocus.com/archive/1/435379 - http://www.securityfocus.com/archive/1/436263 - - - 2006-05-30 - 2006-06-16 - 2006-06-17 - - - - - sendmail -- Incorrect multipart message handling - - - FreeBSD - 4.114.11_19 - 5.35.3_31 - 5.45.4_16 - 5.55.5_2 - 6.06.0_9 - 6.16.1_2 - - - - -

Problem Description

-

A suitably malformed multipart MIME message can cause - sendmail to exceed predefined limits on its stack usage.

-

Impact

-

An attacker able to send mail to, or via, a server can cause - queued messages on the system to not be delivered, by causing - the sendmail process which handles queued messages to crash. - Note that this will not stop new messages from entering the - queue (either from local processes, or incoming via SMTP).

-

Workaround

-

No workaround is available, but systems which do not receive - email from untrusted sources are not vulnerable.

- - - - CVE-2006-1173 - SA-06:17.sendmail - - - 2006-06-14 - 2006-06-14 - - - - - dokuwiki -- multiple vulnerabilities - - - dokuwiki - 20060309_2 - - - - -

Multiple vulnerabilities have been reported within dokuwiki. - dokuwiki is proven vulnerable to:

-
    -
  • arbitrary PHP code insertion via spellcheck module,
    • -
  • XSS attack via "Update your account profile,"
    • -
  • bypassing of ACL controls when enabled.
    • -
- - - - http://bugs.splitbrain.org/index.php?do=details&id=820 - http://bugs.splitbrain.org/index.php?do=details&id=823 - http://bugs.splitbrain.org/index.php?do=details&id=825 - - - 2006-05-31 - 2006-06-11 - 2006-06-12 - - - - - libxine -- buffer overflow vulnerability - - - libxine - 1.1.1_6 - - - - -

A Secunia Advisory reports:

-
-

Federico L. Bossi Bonin has discovered a weakness in xine-lib, - which can be exploited by malicious people to crash certain - applications on a user's system.

-

The weakness is cause due to a heap corruption within the - "xineplug_inp_http.so" plugin when handling an overly large - reply from the HTTP server. This can be exploited to crash - an application that uses the plugin (e.g. gxine).

-
- - - - http://secunia.com/advisories/20369 - CVE-2006-2802 - 18187 - - - 2006-05-31 - 2006-06-11 - - - - - smbfs -- chroot escape - - - FreeBSD - 4.104.10_24 - 4.114.11_18 - 5.35.3_30 - 5.45.4_15 - 5.55.5_1 - 6.06.0_8 - 6.16.1_1 - - - - -

Problem Description

-

smbfs does not properly sanitize paths containing a backslash - character; in particular the directory name '..\' is - interpreted as the parent directory by the SMB/CIFS server, - but smbfs handles it in the same manner as any other - directory.

-

Impact

-

When inside a chroot environment which resides on a smbfs - mounted file-system it is possible for an attacker to escape - out of this chroot to any other directory on the smbfs - mounted file-system.

-

Workaround

-

Mount the smbfs file-systems which need to be used with - chroot on top, in a way so the chroot directory is exactly on - the mount point and not a sub directory

- - - - CVE-2006-2654 - SA-06:16.smbfs - - - 2006-05-31 - 2006-06-09 - - - - - ypserv -- Inoperative access controls in ypserv - - - FreeBSD - 5.35.3_30 - 5.45.4_15 - 5.55.5_1 - 6.06.0_8 - 6.16.1_1 - - - - -

Problem Description

-

There are two documented methods of restricting access to - NIS maps through ypserv(8): through the use of the - /var/yp/securenets file, and through the /etc/hosts.allow file. - While both mechanisms are implemented in the server, a change - in the build process caused the "securenets" access restrictions - to be inadvertantly disabled.

-

Impact

-

ypserv(8) will not load or process any of the networks or - hosts specified in the /var/yp/securenets file, rendering - those access controls ineffective.

-

Workaround

-

One possible workaround is to use /etc/hosts.allow for access - control, as shown by examples in that file.

-

Another workaround is to use a firewall (e.g., ipfw(4), - ipf(4), or pf(4)) to limit access to RPC functions from - untrusted systems or networks, but due to the complexities of - RPC, it might be difficult to create a set of firewall rules - which accomplish this without blocking all access to the - machine in question.

- - - - CVE-2006-2655 - SA-06:15.ypserv - - - 2006-05-31 - 2006-06-09 - - - - - freeradius -- multiple vulnerabilities - - - freeradius - 1.0.01.0.4 - - - - -

The freeradious development team reports:

-
-

Multiple issues exist with version 1.0.4, and all prior - versions of the server. Externally exploitable - vulnerabilities exist only for sites that use the - rlm_sqlcounter module. Those sites may be vulnerable to - SQL injection attacks, similar to the issues noted below. - All sites that have not deployed the rlm_sqlcounter module - are not vulnerable to external exploits.

-

The issues are:
- SQL Injection attack in the rlm_sqlcounter module.
- Buffer overflow in the rlm_sqlcounter module, that may cause - a server crash.
- Buffer overflow while expanding %t, that may cause a server - crash.

-
- - - - 17171 - CVE-2005-4744 - - - 2005-09-09 - 2006-06-08 - - - - - freeradius -- authentication bypass vulnerability - - - freeradius - 1.0.01.1.0 - - - - -

The freeradius development team reports:

-
-

A validation issue exists with the EAP-MSCHAPv2 module - in all versions from 1.0.0 (where the module first - appeared) to 1.1.0. Insufficient input validation was being - done in the EAP-MSCHAPv2 state machine. A malicious - attacker could manipulate their EAP-MSCHAPv2 client state - machine to potentially convince the server to bypass - authentication checks. This bypassing could also result - in the server crashing

-
- - - - 17293 - CVE-2006-1354 - - - 2006-06-03 - 2006-06-08 - - - - - squirrelmail -- plugin.php local file inclusion vulnerability - - - squirrelmail - 1.4.6_1 - - - - -

The SquirrelMail Project Team reports:

-
-

A security issue has been uncovered in - functions/plugin.php that could allow a remote user to - access local files on the server without requiring - login. This issue manifests itself if register_globals is - enabled, and magic_quotes_gpc is disabled.

-
- - - - http://www.squirrelmail.org/security/issue/2006-06-01 - http://secunia.com/advisories/20406/ - - - 2006-06-01 - 2006-06-05 - 2006-06-06 - - - - - dokuwiki -- spellchecker remote PHP code execution - - - dokuwiki - 20060309_1 - - - - -

Stefan Esser reports:

-
-

During the evaluation of DokuWiki for a german/korean - wiki of mine a flaw in DokuWiki's spellchecker was - discovered, that allows injecting arbitrary PHP commands, - by requesting a spellcheck on PHP commands in 'complex - curly syntax'.

-

Because the spellchecker is written as part of the AJAX - functionality of DokuWiki, it can be directly called by - any website visitor, without the need for a wiki - account.

-
- - - - http://www.hardened-php.net/advisory_042006.119.html - http://bugs.splitbrain.org/index.php?do=details&id=823 - http://secunia.com/advisories/20429/ - - - 2006-06-05 - 2006-06-05 - - - - - drupal -- multiple vulnerabilities - - - drupal - 4.6.7 - - - - -

The Drupal team reports:

-
-

Vulnerability: SQL injection

-

A security vulnerability in the database layer allowed - certain queries to be submitted to the database without - going through Drupal's query sanitizer.

-
-
-

Vulnerability: Execution of arbitrary files

-

Certain -- alas, typical -- configurations of Apache - allows execution of carefully named arbitrary scripts in - the files directory. Drupal now will attempt to - automatically create a .htaccess file in your "files" - directory to protect you.

-
- - - - CVE-2006-2742 - CVE-2006-2743 - http://drupal.org/node/65357 - http://drupal.org/node/65409 - - - 2006-05-18 - 2006-06-05 - - - - - MySQL -- SQL-injection security vulnerability - - - mysql-server - 5.15.1.9 - 5.05.0.22 - 4.14.1.20 - - - - -

MySQL reports:

-
-

An SQL-injection security hole has been found in multibyte - encoding processing. An SQL-injection security hole can include a - situation whereby when inserting user supplied data into a - database, the user might inject his own SQL statements that the - server will execute. With regards to this vulnerability discovered, - when character set unaware escaping is used (e.g., addslashes() in - PHP), it is possible to bypass it in some multibyte character sets - (e.g., SJIS, BIG5 and GBK). As a result, a function like - addslashes() is not able to prevent SQL injection attacks. It is - impossible to fix this on the server side. The best solution is for - applications to use character set aware escaping offered in a - function like mysql_real_escape().

-

Workarounds:

-

One can use NO_BACKSLASH_ESCAPES mode as a workaround for a bug - in mysql_real_escape_string(), if you cannot upgrade your server - for some reason. It will enable SQL standard compatibility mode, - where backslash is not considered a special character.

-
- - - - http://lists.mysql.com/announce/364 - http://lists.mysql.com/announce/365 - - - 2006-05-31 - 2006-06-01 - - - - - MySQL -- Information Disclosure and Buffer Overflow Vulnerabilities - - - mysql-server - 4.04.0.27 - 4.14.1.19 - 5.15.1.9 - - - - -

Secunia reports:

-
-

MySQL have some vulnerabilities, which can be exploited by - malicious users to disclose potentially sensitive information - and compromise a vulnerable system.

-

1) An error within the code that generates an error response - to an invalid COM_TABLE_DUMP packet can be exploited by an - authenticated client to disclosure certain memory content of the - server process.

-

2) A boundary error within the handling of specially crafted - invalid COM_TABLE_DUMP packets can be exploited by an authenticated - client to cause a buffer overflow and allows arbitrary code - execution.

-

3) An error within the handling of malformed login packets can be - exploited to disclosure certain memory content of the server - process in the error messages.

-
- - - - CVE-2006-1516 - CVE-2006-1517 - CVE-2006-1518 - 602457 - http://www.wisec.it/vulns.php?page=7 - http://www.wisec.it/vulns.php?page=8 - http://dev.mysql.com/doc/refman/4.1/en/news-4-0-27.html - http://dev.mysql.com/doc/refman/4.1/en/news-4-1-19.html - http://dev.mysql.com/doc/refman/5.1/en/news-5-1-10.html - http://secunia.com/advisories/19929/ - http://www.vuxml.org/freebsd/a8d8713e-dc83-11da-a22b-000c6ec775d9.html - - - 2006-05-02 - 2006-06-01 - - - - - frontpage -- cross site scripting vulnerability - - - frontpage - mod_frontpage13 - mod_frontpage20 - mod_frontpage21 - mod_frontpage22 - 5.0.2.4803 - - - - -

Esteban Martinez Fayo reports:

-
-

The FrontPage Server Extensions 2002 (included in Windows - Sever 2003 IIS 6.0 and available as a separate download - for Windows 2000 and XP) has a web page - /_vti_bin/_vti_adm/fpadmdll.dll that is used for - administrative purposes. This web page is vulnerable to - cross site scripting attacks allowing an attacker to run - client-side script on behalf of an FPSE user. If the - victim is an administrator, the attacker could take - complete control of a Front Page Server Extensions 2002 - server.

-

To exploit the vulnerability an attacker can send a - specially crafted e-mail message to a FPSE user and then - persuade the user to click a link in the e-mail - message.

-

In addition, this vulnerability can be exploited if an - attacker hosts a malicious website and persuade the user - to visit it.

-
- - - - CVE-2006-0015 - http://marc.theaimsgroup.com/?l=bugtraq&m=114487846329000 - http://www.microsoft.com/technet/security/bulletin/MS06-017.mspx - http://www.rtr.com/fpsupport/fpse_release_may_2_2006.htm - - - 2006-04-12 - 2006-05-23 - - - - - cscope -- buffer overflow vulnerabilities - - - cscope - 15.5_2 - - - - -

Jason Duell reports:

-
-

Cscope contains an alarming number of buffer overflow - vulnerabilities. By a rough count, there are at least 48 places - where we blindly sprintf() a file name into a fixed-length buffer - of size PATHLEN without checking to see if the file's name - is <= PATHLEN. We do similar things with environment variable - values.

-
- - - - CVE-2004-2541 - http://sourceforge.net/tracker/index.php?func=detail&aid=1064875&group_id=4664&atid=104664 - http://secunia.com/advisories/13237 - - - 2004-11-11 - 2006-05-23 - - - - - coppermine -- Multiple File Extensions Vulnerability - - - coppermine - 1.4.6 - - - - -

Secunia reports:

-
-

Coppermine Photo Gallery have a vulnerability, which can be - exploited by malicious users to compromise a vulnerable system.

-

The vulnerability is caused due to an error in the handling of - file uploads where a filename has multiple file extensions. This - can be exploited to upload malicious script files inside the web - root (e.g. a PHP script).

-

Successful exploitation may allow execution of script code - depending on the HTTP server configuration (it requires e.g. an - Apache server with the "mod_mime" module installed).

-
- - - - http://sourceforge.net/project/shownotes.php?group_id=89658&release_id=418266 - http://secunia.com/advisories/20211/ - - - 2006-05-22 - 2006-05-22 - - - - - coppermine -- "file" Local File Inclusion Vulnerability - - - coppermine - 1.4.5 - - - - -

Secunia reports:

-
-

Coppermine Photo Gallery have a vulnerability, which can be - exploited by malicious people to disclose sensitive - information.

-

Input passed to the "file" parameter in "index.php" isn't properly - verified, before it is used to include files. This can be exploited - to include arbitrary files from local resources.

-

Example: - http://[host]/index.php?file=.//././/././/././/./[file]%00

-

Successful exploitation requires that "magic_quotes_gpc" is - disabled.

-
- - - - CVE-2006-1909 - http://coppermine-gallery.net/forum/index.php?topic=30655.0 - http://myimei.com/security/2006-04-14/copperminephotogallery144-plugininclusionsystemindexphp-remotefileinclusion-attack.html - http://secunia.com/advisories/19665/ - - - 2006-04-19 - 2006-05-22 - - - - - coppermine -- File Inclusion Vulnerabilities - - - coppermine - 1.4.4 - - - - -

Secunia reports:

-
-

Coppermine Photo Gallery have a vulnerability, which can be - exploited by malicious people and by malicious users to compromise - a vulnerable system.

-

1) Input passed to the "lang" parameter in include/init.inc.php - isn't properly verified, before it is used to include files. This - can be exploited to include arbitrary files from local resources. - The vulnerability can be further exploited by users who are allowed - to upload image files to execute arbitrary PHP code.

-

2) Input passed to the "f" parameter in docs/showdoc.php isn't - properly verified, before it is used to include files. This can be - exploited to include arbitrary files from local resources on the - Windows platform, and remote files from Windows shared folders.

-
- - - - CVE-2006-0872 - CVE-2006-0873 - http://retrogod.altervista.org/cpg_143_adv.html - http://secunia.com/advisories/18941/ - - - 2006-02-20 - 2006-05-22 - - - - - phpmyadmin -- XSRF vulnerabilities - - - phpMyAdmin - 2.8.1 - - - - -

phpMyAdmin security team reports:

-
-

It was possible to inject arbitrary SQL commands by forcing an - authenticated user to follow a crafted link.

-

Such issue is quite common in many PHP applications and users - should take care what links they follow. We consider these - vulnerabilities to be quite dangerous.

-
- - - - CVE-2006-1804 - http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-3 - http://secunia.com/advisories/19659 - - - 2006-05-20 - 2006-05-21 - - - - - vnc -- authentication bypass vulnerability - - - vnc - 4.1.1 - - - - -

RealVNC is susceptible to an authentication-bypass vulnerability. - A malicious VNC client can cause a VNC server to allow it to connect - without any authentication regardless of the authentication settings - configured in the server. Exploiting this issue allows attackers to - gain unauthenticated, remote access to the VNC servers.

- - - - 17978 - http://www.securityfocus.com/archive/1/433994/30/0/threaded - - - 2006-05-15 - 2006-05-18 - - - - - phpldapadmin -- Cross-Site Scripting and Script Insertion vulnerabilities - - - phpldapadmin098 - 0.9.8.3 - - - - -

Secunia reports:

-
-

phpLDAPadmin have some vulnerabilities, which can be exploited by - malicious users to conduct script insertion attacks and by - malicious people to conduct cross-site scripting attacks.

-

1) Some input isn't properly sanitised before being returned to - the user. This can be exploited to execute arbitrary HTML and - script code in a user's browser session in context of an affected - site.

-

2) Input passed to the "Container DN", "Machine Name", and "UID - Number" parameters in "template_engine.php" isn't properly - sanitised before being used. This can be exploited to inject - arbitrary HTML and script code, which will be executed in a user's - browser session in context of an affected site when the malicious - user data is viewed.

-
- - - - CVE-2006-2016 - http://pridels.blogspot.com/2006/04/phpldapadmin-multiple-vuln.html - http://www.frsirt.com/english/advisories/2006/1450 - http://secunia.com/advisories/19747/ - - - 2006-04-21 - 2006-05-14 - - - - - fswiki -- XSS vulnerability - - - fswiki - 3.5.11 - - - - -

JVN reports:

-
-

FreeStyleWiki has XSS vulnerability.

-
- - - - http://jvn.jp/jp/JVN%2335274905/ - - - 2006-04-18 - 2006-05-06 - - - - - mysql50-server -- COM_TABLE_DUMP arbitrary code execution - - - mysql-server - 5.05.0.21 - - - - -

Stefano Di Paola reports:

-
-

An authenticated user could remotely execute arbitrary - commands by taking advantage of a stack overflow.

-

To take advantage of these flaws an attacker should have - direct access to MySQL server communication layer (port - 3306 or unix socket). But if used in conjuction with some - web application flaws (i.e. php code injection) an - attacker could use socket programming (i.e. php sockets) - to gain access to that layer.

-
- - - - CVE-2006-1518 - http://www.wisec.it/vulns.php?page=8 - http://marc.theaimsgroup.com/?l=bugtraq&m=114659633220473 - http://dev.mysql.com/doc/refman/5.0/en/news-5-0-21.html - - - 2006-05-02 - 2006-05-06 - - - - - awstats -- arbitrary command execution vulnerability - - - awstats - 6.5_2,1 - - - - -

OS Reviews reports:

-
-

If the update of the stats via web front-end is allowed, - a remote attacker can execute arbitrary code on the server - using a specially crafted request involving the migrate - parameter. Input starting with a pipe character ("|") - leads to an insecure call to Perl's open function and the - rest of the input being executed in a shell. The code is - run in the context of the process running the AWStats - CGI.

-

Arbitrary code can be executed by uploading a specially - crafted configuration file if an attacker can put a file - on the server with chosen file name and content (e.g. by - using an FTP account on a shared hosting server). In this - configuration file, the LogFile directive can be used to - execute shell code following a pipe character. As above, - an open call on unsanitized input is the source of this - vulnerability.

-
- - - - http://awstats.sourceforge.net/awstats_security_news.php - http://secunia.com/advisories/19969/ - http://www.osreviews.net/reviews/comm/awstats - - - 2006-05-03 - 2006-05-05 - 2006-11-15 - - - - - phpwebftp -- "language" Local File Inclusion - - - phpwebftp - 3.3 - - - - -

Secunia reports:

-
-

phpWebFTP have a vulnerability, which can be exploited by - malicious people to disclose sensitive information.

-

Input passed to the "language" parameter in index.php isn't - properly verified, before it is used to include files. This can be - exploited to include arbitrary files from local resources.

-

Successful exploitation requires that "magic_quotes_gpc" is - disabled.

-
- - - - CVE-2006-1812 - CVE-2006-1813 - https://sourceforge.net/forum/forum.php?forum_id=566199 - http://secunia.com/advisories/19706/ - - - 2006-04-18 - 2006-05-03 - - - - - firefox -- denial of service vulnerability - - - firefox - 1.5.*,11.5.0.3,1 - - - linux-firefox - 1.5.0.3 - - - - -

A Mozilla Foundation Security Advisory reports for - deleted object reference when designMode="on"

-
-

Martijn Wargers and Nick Mott each described crashes that - were discovered to ultimately stem from the same root cause: - attempting to use a deleted controller context when designMode - was turned on. This generally results in crashing the browser, - but in theory references to deleted objects can be abused to - run malicious code.

-

"splices" reported the same crash at the fan site MozillaZine and - on Bugtraq, incorrectly describing it as a buffer overflow.

-
- - - - CVE-2006-1993 - http://www.mozilla.org/security/announce/2006/mfsa2006-30.html - - - 2006-05-02 - 2006-05-03 - 2006-05-05 - - - - - trac -- Wiki Macro Script Insertion Vulnerability - - - trac - ja-trac - 0.9.5 - - - - -

Secunia reports:

-
-

A vulnerability has been reported, which can be exploited by - malicious people to conduct script insertion attacks.

-

Input passed using the wiki macro isn't properly sanitised before - being used. This can be exploited to inject arbitrary HTML and - script code, which will be executed in a user's browser session in - context of an affected site when the malicious user data is - viewed.

-
- - - - http://projects.edgewall.com/trac/wiki/ChangeLog - http://jvn.jp/jp/JVN%2384091359/index.html - http://secunia.com/advisories/19870/ - - - 2006-04-28 - 2006-05-02 - - - - - - - - - clamav -- Freshclam HTTP Header Buffer Overflow Vulnerability - - - clamav - 0.800.88.2 - - - clamav-devel - 2004082620060502 - - - - -

Secunia reports:

-
-

A vulnerability has been reported in ClamAV, which can be - exploited by malicious people to cause a DoS (Denial of Service) - and potentially to compromise a vulnerable system.

-

The vulnerability is caused due to a boundary error within the - HTTP client in the Freshclam command line utility. This can be - exploited to cause a stack-based buffer overflow when the HTTP - headers received from a web server exceeds 8KB.

-

Successful exploitation requires that Freshclam is used to - download virus signature updates from a malicious mirror web - server e.g. via DNS poisoning.

-
- - - - CVE-2006-1989 - http://www.clamav.net/security/0.88.2.html - http://secunia.com/advisories/19880/ - - - 2006-05-01 - 2006-05-03 - - - - - jabberd -- SASL Negotiation Denial of Service Vulnerability - - - jabberd - 2.0.11 - - - - -

Secunia reports:

-
-

A vulnerability has been reported in jabberd, which can be - exploited by malicious people to cause a DoS (Denial of - Service).

-

The vulnerability is caused due to an error within the handling - of SASL negotiation. This can be exploited to cause a crash by - sending a "response" stanza before an "auth" stanza.

-
- - - - CVE-2006-1329 - http://article.gmane.org/gmane.network.jabber.admin/27372 - http://jabberstudio.org/projects/jabberd2/releases/view.php?id=826 - http://secunia.com/advisories/19281/ - - - 2006-03-20 - 2006-05-01 - - - - - cacti -- ADOdb "server.php" Insecure Test Script Security Issue - - - cacti - 0.8.6h - - - - -

Secunia reports:

-
-

Cacti have a security issue, which can be exploited by malicious - people to execute arbitrary SQL code and potentially compromise a - vulnerable system.

-

The problem is caused due to the presence of the insecure - "server.php" test script.

-
- - - - http://secunia.com/advisories/18276/ - http://secunia.com/advisories/17418/ - - - 2006-01-09 - 2006-04-27 - - - - - amaya -- Attribute Value Buffer Overflow Vulnerabilities - - - amaya - 9.5 - - - - -

Secunia reports:

-
-

Amaya have two vulnerabilities, which can be exploited by - malicious people to compromise a user's system.

-

The vulnerabilities are caused due to boundary errors within the - parsing of various attribute values. This can be exploited to cause - stack-based buffer overflows when a user opens a specially crafted - HTML document containing certain tags with overly long attribute - values.

-

Successful exploitation allows execution of arbitrary code.

-
- - - - CVE-2006-1900 - http://morph3us.org/advisories/20060412-amaya-94.txt - http://morph3us.org/advisories/20060412-amaya-94-2.txt - http://secunia.com/advisories/19670/ - - - 2006-04-14 - 2006-04-27 - - - - - lifetype -- ADOdb "server.php" Insecure Test Script Security Issue - - - lifetype - 1.0.3 - - - - -

Secunia reports:

-
-

A security issue has been discovered in LifeType, which can be - exploited by malicious people to execute arbitrary SQL code and - potentially compromise a vulnerable system.

-

The problem is caused due to the presence of the insecure - "server.php" test script.

-
- - - - CVE-2006-0146 - http://secunia.com/advisories/19699/ - http://secunia.com/advisories/17418/ - - - 2006-04-19 - 2006-04-27 - - - - - ethereal -- Multiple Protocol Dissector Vulnerabilities - - - ethereal - ethereal-lite - tethereal - tethereal-lite - 0.8.50.99.0 - - - - -

Secunia reports:

-
-

Multiple vulnerabilities have been reported in Ethereal, which - can be exploited by malicious people to cause a DoS (Denial of - Service) or compromise a vulnerable system.

-

The vulnerabilities are caused due to various types of errors - including boundary errors, an off-by-one error, an infinite loop - error, and several unspecified errors in a multitude of protocol - dissectors.

-

Successful exploitation causes Ethereal to stop responding, - consume a large amount of system resources, crash, or execute - arbitrary code.

-
- - - - CVE-2006-1932 - CVE-2006-1933 - CVE-2006-1934 - CVE-2006-1935 - CVE-2006-1936 - CVE-2006-1937 - CVE-2006-1938 - CVE-2006-1939 - CVE-2006-1940 - http://www.ethereal.com/appnotes/enpa-sa-00023.html - http://secunia.com/advisories/19769/ - - - 2006-04-25 - 2006-04-27 - - - - - asterisk -- denial of service vulnerability, local system access - - - asterisk - 1.2.7 - - - - -

Emmanouel Kellenis reports a denial of service vulnerability - within asterisk. The vulnerability is caused by a buffer - overflow in "format_jpeg.c". A large JPEG image could - trigger this bug, potentially allowing a local attacker to - execute arbitrary code.

- - - - 17561 - CVE-2006-1827 - http://www.cipher.org.uk/index.php?p=advisories/Asterisk_Codec_Integer_Overflow_07-04-2006.advisory - - - 2006-04-07 - 2006-04-25 - - - - - zgv, xzgv -- heap overflow vulnerability - - - zgv - 5.9_1 - - - xzgv - 0.9 - - - - -

Gentoo reports:

-
-

Andrea Barisani of Gentoo Linux discovered xzgv and zgv - allocate insufficient memory when rendering images with - more than 3 output components, such as images using the - YCCK or CMYK colour space. When xzgv or zgv attempt to - render the image, data from the image overruns a heap - allocated buffer.

-

An attacker may be able to construct a malicious image that - executes arbitrary code with the permissions of the xzgv or - zgv user when attempting to render the image.

-
- - - - 17409 - CVE-2006-1060 - http://www.gentoo.org/security/en/glsa/glsa-200604-10.xml - - - 2006-04-21 - 2006-04-23 - 2010-03-22 - - - - - crossfire-server -- denial of service and remote code execution vulnerability - - - crossfire-server - 1.9.0 - - - - -

FRSIRT reports:

-
-

A vulnerability has been identified in CrossFire, which - could be exploited by remote attackers to execute arbitrary - commands or cause a denial of service. This flaw is due to - a buffer overflow error in the "oldsocketmode" module that - fails to properly handle overly large requests, which could - be exploited by a malicious client to crash or compromise a - vulnerable system.

-
- - - - 16883 - CVE-2006-1010 - http://www.frsirt.com/english/advisories/2006/0760 - - - 2006-02-28 - 2006-04-23 - - - - - p5-DBI -- insecure temporary file creation vulnerability - - - p5-DBI-137 - 0 - - - p5-DBI - 1.37_1 - 1.381.48 - - - - -

Javier Fernández-Sanguino Peña reports:

-
-

The DBI library, the Perl5 database interface, creates a - temporary PID file in an insecure manner. This can be - exploited by a malicious user to overwrite arbitrary files - owned by the person executing the parts of the library.

-
- - - - 12360 - CAN-2005-0077 - http://www.debian.org/security/2005/dsa-658 - - - 2005-01-25 - 2006-04-23 - 2006-05-11 - - - - - wordpress -- full path disclosure - - - wordpress - 1.5.2 - - - - -

Dedi Dwianto reports:

-
-

A remote user can access the file directly to cause the - system to display an error message that indicates the - installation path. The resulting error message will - disclose potentially sensitive installation path - information to the remote attacker.

-
- - - - CVE-2005-4463 - http://echo.or.id/adv/adv24-theday-2005.txt - - - 2005-12-20 - 2006-04-23 - - - - - xine -- multiple remote string vulnerabilities - - - xine - 0.99.4_4 - - - - -

c0ntexb reports:

-
-

There are 2 format string bugs in the latest version of - Xine that could be exploited by a malicious person to - execute code on the system of a remote user running the - media player against a malicious playlist file. By passing - a format specifier in the path of a file that is embedded - in a remote playlist, it is possible to trigger this bug.

-
- - - - 17579 - CVE-2006-1905 - http://www.open-security.org/advisories/16 - - - 2006-04-18 - 2006-04-23 - - - - - cyrus-sasl -- DIGEST-MD5 Pre-Authentication Denial of Service - - - cyrus-sasl - 2.*2.1.21 - - - - -

Unspecified vulnerability in the CMU Cyrus Simple - Authentication and Security Layer (SASL) library, has unknown - impact and remote unauthenticated attack vectors, related to - DIGEST-MD5 negotiation.

- - - - CVE-2006-1721 - - - 2006-04-11 - 2006-04-22 - - - - - FreeBSD -- FPU information disclosure - - - FreeBSD - 6.06.0_7 - 5.45.4_14 - 5.35.3_29 - 55.3 - 4.114.11_17 - 4.104.10_23 - 4.10 - - - - -

Problem Description

-

On "7th generation" and "8th generation" processors - manufactured by AMD, including the AMD Athlon, Duron, Athlon - MP, Athlon XP, Athlon64, Athlon64 FX, Opteron, Turion, and - Sempron, the fxsave and fxrstor instructions do not save and - restore the FOP, FIP, and FDP registers unless the exception - summary bit (ES) in the x87 status word is set to 1, - indicating that an unmasked x87 exception has occurred.

-

This behaviour is consistent with documentation provided by - AMD, but is different from processors from other vendors, - which save and restore the FOP, FIP, and FDP registers - regardless of the value of the ES bit. As a result of this - discrepancy remaining unnoticed until now, the FreeBSD kernel - does not restore the contents of the FOP, FIP, and FDP - registers between context switches.

-

Impact

-

On affected processors, a local attacker can monitor the - execution path of a process which uses floating-point - operations. This may allow an attacker to steal - cryptographic keys or other sensitive information.

-

Workaround

-

No workaround is available, but systems which do not use AMD - Athlon, Duron, Athlon MP, Athlon XP, Athlon64, Athlon64 FX, - Opteron, Turion, or Sempron processors are not vulnerable.

- - - - CVE-2006-1056 - SA-06:14.fpu - - - 2006-04-19 - 2006-04-19 - 2016-08-09 - - - - - plone -- "member_id" Parameter Portrait Manipulation Vulnerability - - - plone - 2.1.2_1 - - - - -

Secunia reports:

-
-

The vulnerability is caused due to missing security declarations - in "changeMemberPortrait" and "deletePersonalPortrait". This can - be exploited to manipulate or delete another user's portrait via - the "member_id" parameter.

-
- - - - CVE-2006-1711 - http://dev.plone.org/plone/ticket/5432 - http://www.debian.org/security/2006/dsa-1032 - http://secunia.com/advisories/19633/ - - - 2006-04-13 - 2006-04-18 - - - - - mozilla -- multiple vulnerabilities - - - firefox - 1.0.8,1 - 1.5.*,11.5.0.2,1 - - - linux-firefox - 1.5.0.2 - - - mozilla - 1.7.13,2 - 1.8.*,2 - - - linux-mozilla - 1.7.13 - - - linux-mozilla-devel - 0 - - - seamonkey - linux-seamonkey - 1.0.1 - - - thunderbird - mozilla-thunderbird - 1.5.0.2 - - - - -

A Mozilla Foundation Security Advisory reports of multiple - issues. Several of which can be used to run arbitrary code - with the privilege of the user running the program.

-
-
    -
  • MFSA 2006-29 Spoofing with translucent windows
    • -
  • MFSA 2006-28 Security check of js_ValueToFunctionObject() can be circumvented
    • -
  • MFSA 2006-26 Mail Multiple Information Disclosure
    • -
  • MFSA 2006-25 Privilege escalation through Print Preview
    • -
  • MFSA 2006-24 Privilege escalation using crypto.generateCRMFRequest
    • -
  • MFSA 2006-23 File stealing by changing input type
    • -
  • MFSA 2006-22 CSS Letter-Spacing Heap Overflow Vulnerability
    • -
  • MFSA 2006-20 Crashes with evidence of memory corruption (rv:1.8.0.2)
    • -
  • MFSA 2006-19 Cross-site scripting using .valueOf.call()
    • -
  • MFSA 2006-18 Mozilla Firefox Tag Order Vulnerability
    • -
  • MFSA 2006-17 cross-site scripting through window.controllers
    • -
  • MFSA 2006-16 Accessing XBL compilation scope via valueOf.call()
    • -
  • MFSA 2006-15 Privilege escalation using a JavaScript function's cloned parent
    • -
  • MFSA 2006-14 Privilege escalation via XBL.method.eval
    • -
  • MFSA 2006-13 Downloading executables with "Save Image As..."
    • -
  • MFSA 2006-12 Secure-site spoof (requires security warning dialog)
    • -
  • MFSA 2006-11 Crashes with evidence of memory corruption (rv:1.8)
    • -
  • MFSA 2006-10 JavaScript garbage-collection hazard audit
    • -
  • MFSA 2006-09 Cross-site JavaScript injection using event handlers
    • -
-
- - - - 179014 - 252324 - 329500 - 350262 - 488774 - 736934 - 813230 - 842094 - 932734 - 935556 - 968814 - CVE-2006-0749 - CVE-2006-1045 - CVE-2006-1529 - CVE-2006-1530 - CVE-2006-1531 - CVE-2006-1723 - CVE-2006-1724 - CVE-2006-1725 - CVE-2006-1726 - CVE-2006-1727 - CVE-2006-1728 - CVE-2006-1729 - CVE-2006-1730 - CVE-2006-1731 - CVE-2006-1732 - CVE-2006-1733 - CVE-2006-1734 - CVE-2006-1735 - CVE-2006-1736 - CVE-2006-1737 - CVE-2006-1738 - CVE-2006-1739 - CVE-2006-1740 - CVE-2006-1741 - CVE-2006-1742 - CVE-2006-1790 - http://www.mozilla.org/security/announce/2006/mfsa2006-09.html - http://www.mozilla.org/security/announce/2006/mfsa2006-10.html - http://www.mozilla.org/security/announce/2006/mfsa2006-11.html - http://www.mozilla.org/security/announce/2006/mfsa2006-12.html - http://www.mozilla.org/security/announce/2006/mfsa2006-13.html - http://www.mozilla.org/security/announce/2006/mfsa2006-14.html - http://www.mozilla.org/security/announce/2006/mfsa2006-15.html - http://www.mozilla.org/security/announce/2006/mfsa2006-16.html - http://www.mozilla.org/security/announce/2006/mfsa2006-17.html - http://www.mozilla.org/security/announce/2006/mfsa2006-18.html - http://www.mozilla.org/security/announce/2006/mfsa2006-19.html - http://www.mozilla.org/security/announce/2006/mfsa2006-20.html - http://www.mozilla.org/security/announce/2006/mfsa2006-22.html - http://www.mozilla.org/security/announce/2006/mfsa2006-23.html - http://www.mozilla.org/security/announce/2006/mfsa2006-25.html - http://www.mozilla.org/security/announce/2006/mfsa2006-26.html - http://www.mozilla.org/security/announce/2006/mfsa2006-28.html - http://www.mozilla.org/security/announce/2006/mfsa2006-29.html - http://www.zerodayinitiative.com/advisories/ZDI-06-010.html - TA06-107A - - - 2006-04-13 - 2006-04-16 - 2006-04-27 - - - - - mailman -- Private Archive Script Cross-Site Scripting - - - mailman - ja-mailman - mailman-with-htdig - 2.1.8 - - - - -

Secunia reports:

-
-

A vulnerability has been reported in Mailman, which can be - exploited by malicious people to conduct cross-site scripting - attacks.

-

Unspecified input passed to the private archive script is not - properly sanitised before being returned to users. This can be - exploited to execute arbitrary HTML and script code in a user's - browser session in context of a vulnerable site.

-
- - - - CVE-2006-1712 - http://mail.python.org/pipermail/mailman-announce/2006-April/000084.html - http://secunia.com/advisories/19558/ - - - 2006-04-07 - 2006-04-16 - - - - - f2c -- insecure temporary files - - - f2c - 20060506 - - - - -

Javier Fernández-Sanguino Peña reports two temporary file - vulnerability within f2c. The vulnerabilities are caused - due to weak temporary file handling. An attacker could - create an symbolic link, causing a local user running f2c - to overwrite the symlinked file. This could give the - attacker elevated privileges.

- - - - 1280 - CAN-2005-0017 - - - 2005-01-27 - 2006-04-10 - 2006-08-15 - - - - - mplayer -- Multiple integer overflows - - - mplayer - mplayer-esound - mplayer-gtk - mplayer-gtk2 - mplayer-gtk-esound - mplayer-gtk2-esound - 0.99.7_12 - - - - -

Secunia reports:

-
-

The vulnerabilities are caused due to integer overflow errors - in "libmpdemux/asfheader.c" within the handling of an ASF file, - and in "libmpdemux/aviheader.c" when parsing the "indx" chunk in - an AVI file. This can be exploited to cause heap-based buffer - overflows via a malicious ASF file, or via a AVI file with - specially-crafted "wLongsPerEntry" and "nEntriesInUse" values in - the "indx" chunk.

-
- - - - CVE-2006-1502 - http://www.xfocus.org/advisories/200603/11.html - http://secunia.com/advisories/19418/ - - - 2006-03-29 - 2006-04-07 - - - - - kaffeine -- buffer overflow vulnerability - - - kaffeine - 0.4.20.8.0 - - - - -

The KDE team reports:

-
-

Kaffeine can produce a buffer overflow in http_peek() while - creating HTTP request headers for fetching remote playlists, - which under certain circumstances could be used to crash the - application and/or execute arbitrary code.

-
- - - - 17372 - CVE-2006-0051 - http://www.kde.org/info/security/advisory-20060404-1.txt - - - 2006-04-04 - 2006-04-07 - - - - - thunderbird -- javascript execution - - - thunderbird - mozilla-thunderbird - 1.0.7 - - - - -

Renaud Lifchitz reports a vulnerability within thunderbird. - The vulnerability is caused by improper checking of javascript - scripts. This could lead to javascript code execution which - can lead to information disclosure or a denial of service - (application crash). This vulnerability is present even if - javascript had been disabled in the preferences.

- - - - 16770 - CAN-2006-0884 - - - 2006-02-22 - 2006-04-07 - - - - - phpmyadmin -- XSS vulnerabilities - - - phpMyAdmin - 2.8.0.3 - - - - -

phpMyAdmin security announcement:

-
-

It was possible to conduct an XSS attack with a direct call - to some scripts under the themes directory.

-
- - - - http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-1 - http://secunia.com/advisories/19556/ - - - 2006-04-06 - 2006-04-06 - 2006-04-07 - - - - - phpmyadmin -- 'set_theme' Cross-Site Scripting - - - phpMyAdmin - 2.8.0.2 - - - - -

Secunia reports:

-
-

A vulnerability has been reported in phpMyAdmin, which can be - exploited by malicious people to conduct cross-site scripting - attacks.

-

Input passed to the "set_theme" parameter isn't properly - sanitised before being returned to the user. This can be exploited - to execute arbitrary HTML and script code in a user's browser - session in context of an affected site.

-
- - - - CVE-2006-1258 - http://secunia.com/advisories/19277 - - - 2006-03-17 - 2006-04-06 - - - - - clamav -- Multiple Vulnerabilities - - - clamav - 0.88.1 - - - clamav-devel - 20051104_1 - - - - -

Secunia reports:

-
-

Some vulnerabilities have been reported in ClamAV, which - potentially can be exploited by malicious people to cause a - DoS (Denial of Service) and compromise a vulnerable system.

-

An unspecified integer overflow error exists in the PE header - parser in "libclamav/pe.c". Successful exploitation requires that - the ArchiveMaxFileSize option is disabled.

-

Some format string errors in the logging handling in - "shared/output.c" may be exploited to execute arbitrary code.

-

An out-of-bounds memory access error in the "cli_bitset_test()" - function in "ibclamav/others.c" may be exploited to cause a - crash.

-
- - - - CVE-2006-1614 - CVE-2006-1615 - CVE-2006-1630 - http://secunia.com/advisories/19534/ - http://www.us.debian.org/security/2006/dsa-1024 - - - 2006-04-06 - 2006-04-06 - - - - - mediawiki -- hardcoded placeholder string security bypass vulnerability - - - mediawiki - 1.5.4 - - - - -

The mediawiki development team reports a vulnerability - within the mediawiki application. The vulnerability is - caused by improper checking of inline style attributes. This - could result in the execution of arbitrary javascript code in - Microsoft Internet Explorer. It appears that other browsers - are not affected by this vulnerability.

- - - - 16032 - CAN-2005-4501 - http://sourceforge.net/project/shownotes.php?release_id=379951 - - - 2005-12-22 - 2006-04-05 - - - - - netpbm -- buffer overflow in pnmtopng - - - netpbm - 10.26 - - - - -

Ubuntu reports:

-
-

A buffer overflow was found in the "pnmtopng" conversion - program. By tricking an user (or automated system) to - process a specially crafted PNM image with pnmtopng, this - could be exploited to execute arbitrary code with the - privileges of the user running pnmtopng.

-
- - - - 15128 - CAN-2005-2978 - http://www.ubuntulinux.org/support/documentation/usn/usn-210-1 - - - 2005-10-18 - 2006-04-05 - - - - - zoo -- stack based buffer overflow - - - zoo - 2.10.1_2 - - - - -

Jean-Sébastien Guay-Leroux report a vulnerability - within the zoo archiver. The vulnerability which is present - in the fullpath() function (from the misc.c file) is caused by - improper checking of user supplied data. The data returned - to the buffer can be up to 512 bytes, while the buffer is - created to hold 256 bytes. This could result in a buffer - overflow which could allow remote code execution.

- - - - 16790 - CVE-2006-0855 - http://www.guay-leroux.com/projects/zoo-advisory.txt - - - 2006-02-22 - 2006-04-05 - 2006-04-06 - - - - - mediawiki -- cross site scripting vulnerability - - - mediawiki - 1.41.4.14 - 1.51.5.7 - - - - -

The mediawiki development team reports that there is an - site scripting vulnerability within mediawiki. The - vulnerability is caused by improper checking of encoded - links which could allow the injection of html in the output - generated by mediawiki. This could lead to cross site - scripting attacks against mediawiki installations.

- - - - 17269 - CVE-2006-1498 - http://mail.wikipedia.org/pipermail/mediawiki-announce/2006-March/000040.html - - - 2006-03-27 - 2006-04-05 - - - - - dia -- XFig Import Plugin Buffer Overflow - - - dia - dia-gnome - 0.86_10.94_6,1 - - - - -

Secunia reports:

-
-

Some vulnerabilities have been reported in Dia, which - potentially can be exploited by malicious people to - compromise a user's system.

-

The vulnerabilities are caused due to boundary errors - within the XFig import plugin. This can be exploited to - cause buffer overflows and may allow arbitrary code - execution when a specially-crafted FIG file is imported.

-
- - - - CVE-2006-1550 - http://secunia.com/advisories/19469/ - http://mail.gnome.org/archives/dia-list/2006-March/msg00149.html - - - 2006-03-31 - 2006-04-05 - - - - - openvpn -- LD_PRELOAD code execution on client through malicious or compromised server - - - openvpn - 2.02.0.6 - - - - -

Hendrik Weimer reports:

-
-

OpenVPN clients are a bit too generous when accepting - configuration options from a server. It is possible to transmit - environment variables to client-side shell scripts. There are some - filters in place to prevent obvious nonsense, however they don't - catch the good old LD_PRELOAD trick. All we need is to put a file - onto the client under a known location (e.g. by returning a - specially crafted document upon web access) and we have a remote - root exploit. But since the attack may only come from authenticated - servers, this threat is greatly reduced.

-
- - - - CVE-2006-1629 - http://www.osreviews.net/reviews/security/openvpn-print - http://openvpn.net/changelog.html - http://sourceforge.net/mailarchive/message.php?msg_id=15298074 - - - 2006-04-03 - 2006-04-05 - 2006-04-06 - - - - - samba -- Exposure of machine account credentials in winbind log files - - - samba - 3.0.21a,13.0.22,1 - - - ja-samba - 3.0.21a,13.0.22,1 - - - - -

Samba Security Advisory:

-
-

The machine trust account password is the secret - shared between a domain controller and a specific - member server. Access to the member server machine - credentials allows an attacker to impersonate the - server in the domain and gain access to additional - information regarding domain users and groups.

-

The winbindd daemon writes the clear text of server's - machine credentials to its log file at level 5. - The winbindd log files are world readable by default - and often log files are requested on open mailing - lists as tools used to debug server misconfigurations.

-

This affects servers configured to use domain or - ads security and possibly Samba domain controllers - as well (if configured to use winbindd).

-
- - - - CVE-2006-1059 - http://us1.samba.org/samba/security/CAN-2006-1059.html - http://secunia.com/advisories/19455/ - - - 2006-03-30 - 2006-04-05 - - - - - mod_pubcookie -- cross site scripting vulnerability - - - mod_pubcookie - 3.3.0 - - - - -

Nathan Dors of the Pubcookie Project reports:

-
-

Non-persistent XSS vulnerabilities were found in the - Pubcookie Apache module (mod_pubcookie) and ISAPI - filter. These components mishandle untrusted data when - printing responses to the browser. This makes them - vulnerable to carefully crafted requests containing script - or HTML. If an attacker can lure an unsuspecting user to - visit carefully staged content, the attacker can use it to - redirect the user to a vulnerable Pubcookie application - server and attempt to exploit the XSS vulnerabilities.

-

These vulnerabilities are classified as *high* due to the - nature and purpose of Pubcookie application servers for user - authentication and Web Single Sign-on (SSO). An attacker - who injects malicious script through the vulnerabilities - might steal private Pubcookie data including a user's - authentication assertion ("granting") cookies and - application session cookies.

-
- - - - 314540 - - - 2006-03-06 - 2006-04-05 - - - - - pubcookie-login-server -- cross site scripting vulnerability - - - pubcookie-login-server - 3.3.0 - - - - -

Nathan Dors of the Pubcookie Project reports:

-
-

Multiple non-persistent XSS vulnerabilities were found - in the Pubcookie login server's compiled binary "index.cgi" - CGI program. The CGI program mishandles untrusted data when - printing responses to the browser. This makes the program - vulnerable to carefully crafted requests containing script - or HTML. If an attacker can lure an unsuspecting user to - visit carefully staged content, the attacker can use it to - redirect the user to his or her local Pubcookie login page - and attempt to exploit the XSS vulnerabilities.

-

These vulnerabilities are classified as *critical* due - to the nature and purpose of the Pubcookie login server for - user authentication and Web Single Sign-on (SSO). Specific - threats include:

-
    -
  • An attacker who injects malicious script through the - vulnerabilities might steal senstive user data including - a user's authentication credentials (usernames and - passwords);
    • -
  • An attacker who injects malicious script through the - vulnerabilities might steal private Pubcookie data - including a user's authentication assertion ("granting") - cookies and SSO ("login") session cookies;
    • -
  • An attacker who injects HTML tags through the - vulnerabilities might deface a site's Pubcookie login page - for a single visit by a single user (i.e. a non-persistent - defacement).
    • -
-

At the heart of these threats lies a violation of the - user's trust in the Pubcookie login server.

-
- - - - 337585 - - - 2006-03-06 - 2006-04-05 - - - - - freeradius -- EAP-MSCHAPv2 Authentication Bypass - - - freeradius - 1.0.01.1.1 - - - - -

Freeradius Security Contact reports:

-
-

Insufficient input validation was being done in the - EAP-MSCHAPv2 state machine. A malicious attacker could - manipulate their EAP-MSCHAPv2 client state machine to - potentially convince the server to bypass authentication - checks. This bypassing could also result in the server - crashing.

-
- - - - CVE-2006-1354 - http://www.freeradius.org/security.html#1.1.0 - http://secunia.com/advisories/19300/ - - - 2006-03-21 - 2006-03-29 - - - - - horde -- remote code execution vulnerability in the help viewer - - - horde - horde-php5 - 3.1.1 - - - - -

Horde 3.1.1 release announcement:

-
-

Major changes compared to Horde 3.1 are:

-
    -
  • Fix for remote code execution vulnerability in the - help viewer, discovered by Jan Schneider from the Horde - team.
    • -
-
- - - - 17292 - CVE-2006-1491 - http://lists.horde.org/archives/announce/2006/000271.html - - - 2006-03-28 - 2006-03-28 - 2006-03-30 - - - - - linux-realplayer -- buffer overrun - - - linux-realplayer - 10.0.110.0.7.785.20060201 - - - - -

Secunia Advisories Reports:

-
-

A boundary error when processing SWF files can be exploited to - cause a buffer overflow. This may allow execution of arbitrary - code on the user's system.

-
- - - - CVE-2006-0323 - http://service.real.com/realplayer/security/03162006_player/en/ - http://secunia.com/advisories/19358/ - - - 2006-03-23 - 2006-03-27 - - - - - linux-realplayer -- heap overflow - - - linux-realplayer - 10.0.110.0.6 - - - - -

iDefense Reports:

-
-

Remote exploitation of a heap-based buffer overflow in - RealNetwork Inc's RealPlayer could allow the execution of - arbitrary code in the context of the currently logged in - user.

-

In order to exploit this vulnerability, an attacker would - need to entice a user to follow a link to a malicious server. - Once the user visits a website under the control of an - attacker, it is possible in a default install of RealPlayer - to force a web-browser to use RealPlayer to connect to an - arbitrary server, even when it is not the default application - for handling those types, by the use of embedded object tags - in a webpage. This may allow automated exploitation when the - page is viewed.

-
- - - - CVE-2005-2922 - http://service.real.com/realplayer/security/03162006_player/en/ - http://www.idefense.com/intelligence/vulnerabilities/display.php?id=404 - http://secunia.com/advisories/19358/ - - - 2006-03-23 - 2006-03-27 - - - - - sendmail -- race condition vulnerability - - - sendmail - 8.138.13.6 - - - FreeBSD - 6.06.0_6 - 5.45.4_13 - 5.35.3_28 - 4.114.11_16 - 4.104.10_22 - - - - -

Problem Description

-

A race condition has been reported to exist in the handling - by sendmail of asynchronous signals.

-

Impact

-

A remote attacker may be able to execute arbitrary code with - the privileges of the user running sendmail, typically - root.

-

Workaround

-

There is no known workaround other than disabling - sendmail.

- - - - CVE-2006-0058 - SA-06:13.sendmail - - - 2006-03-22 - 2006-03-24 - 2006-06-09 - - - - - OPIE -- arbitrary password change - - - FreeBSD - 6.06.0_6 - 5.45.4_13 - 5.35.3_28 - 4.114.11_16 - 4.104.10_22 - - - - -

Problem Description

-

The opiepasswd(1) program uses getlogin(2) to identify the - user calling opiepasswd(1). In some circumstances - getlogin(2) will return "root" even when running as an - unprivileged user. This causes opiepasswd(1) to allow an - unpriviled user to configure OPIE authentication for the root - user.

-

Impact

-

In certain cases an attacker able to run commands as a non - privileged users which have not explicitly logged in, for - example CGI scripts run by a web server, is able to configure - OPIE access for the root user. If the attacker is able to - authenticate as root using OPIE authentication, for example if - "PermitRootLogin" is set to "yes" in sshd_config or the - attacker has access to a local user in the "wheel" group, the - attacker can gain root privileges.

-

Workaround

-

Disable OPIE authentication in PAM:

- 
# sed -i "" -e /opie/s/^/#/ /etc/pam.d/*
-

or

-

Remove the setuid bit from opiepasswd:

- 
# chflags noschg /usr/bin/opiepasswd
- 
# chmod 555 /usr/bin/opiepasswd
- 
# chflags schg /usr/bin/opiepasswd
- - - - CVE-2006-1283 - SA-06:12.opie - - - 2006-03-22 - 2006-03-24 - 2006-06-09 - - - - - ipsec -- reply attack vulnerability - - - FreeBSD - 6.06.0_6 - 5.45.4_13 - 5.35.3_28 - 4.114.11_16 - 4.104.10_22 - - - - -

Problem Description

-

IPsec provides an anti-replay service which when enabled - prevents an attacker from successfully executing a replay - attack. This is done through the verification of sequence - numbers. A programming error in the fast_ipsec(4) - implementation results in the sequence number associated with - a Security Association not being updated, allowing packets to - unconditionally pass sequence number verification checks.

-

Impact

-

An attacker able to intercept IPSec packets can replay - them. If higher level protocols which do not provide any - protection against packet replays (e.g., UDP) are used, this - may have a variety of effects.

-

Workaround

-

No workaround is available.

- - - - CVE-2006-0905 - SA-06:11.ipsec - - - 2006-03-22 - 2006-03-24 - 2006-06-09 - - - - - xorg-server -- privilege escalation - - - xorg-server - 6.9.0 - - - - -

Daniel Stone of X.Org reports:

-
-

During the analysis of results from the Coverity code review - of X.Org, we discovered a flaw in the server that allows local - users to execute arbitrary code with root privileges, or cause - a denial of service by overwriting files on the system, again - with root privileges.

-
- - - - CVE-2006-0745 - https://bugs.freedesktop.org/show_bug.cgi?id=6213 - - - 2006-03-20 - 2006-03-21 - - - - - heimdal -- Multiple vulnerabilities - - - heimdal - 0.6.6 - - - - -

A Project heimdal Security Advisory reports:

-
-

The telnet client program in Heimdal has buffer overflows - in the functions slc_add_reply() and env_opt_add(), which - may lead to remote code execution.

-
-
-

The telnetd server program in Heimdal has buffer overflows - in the function getterminaltype, which may lead to remote code - execution.

-
-
-

The rshd server in Heimdal has a privilege escalation bug - when storing forwarded credentials. The code allowes a user - to overwrite a file with its credential cache, and get ownership - of the file.

-
- - - - CVE-2005-0469 - CVE-2005-2040 - CVE-2006-0582 - CVE-2006-0677 - http://www.pdc.kth.se/heimdal/advisory/2005-04-20 - http://www.pdc.kth.se/heimdal/advisory/2005-06-20 - http://www.pdc.kth.se/heimdal/advisory/2006-02-06 - - - 2006-02-06 - 2006-03-20 - - - - - curl -- TFTP packet buffer overflow vulnerability - - - curl - linux-curl - 7.14.17.15.3 - - - - -

A Project cURL Security Advisory reports:

-
-

libcurl uses the given file part of a TFTP URL in a manner that - allows a malicious user to overflow a heap-based memory buffer due - to the lack of boundary check.

-

This overflow happens if you pass in a URL with a TFTP - protocol prefix ("tftp://"), using a valid host and a path - part that is longer than 512 bytes.

-

The affected flaw can be triggered by a redirect, if - curl/libcurl is told to follow redirects and an HTTP - server points the client to a tftp URL with the - characteristics described above.

-
- - - - CVE-2006-1061 - http://curl.haxx.se/docs/adv_20060320.html - - - 2006-03-20 - 2006-03-20 - 2006-10-05 - - - - - drupal -- multiple vulnerabilities - - - drupal - 3.6.6 - - - - -

Drupal reports:

-
-

Mail header injection vulnerability.

-

Linefeeds and carriage returns were not being stripped from - email headers, raising the possibility of bogus headers - being inserted into outgoing email.

-

This could lead to Drupal sites being used to send unwanted - email.

-
-
-

Session fixation vulnerability.

-

If someone creates a clever enough URL and convinces you to - click on it, and you later log in but you do not log off - then the attacker may be able to impersonate you.

-
-
-

XSS vulnerabilities.

-

Some user input sanity checking was missing. This could - lead to possible cross-site scripting (XSS) attacks.

-

XSS can lead to user tracking and theft of accounts and - services.

-
-
-

Security bypass in menu.module.

-

If you use menu.module to create a menu item, the page you - point to will be accessible to all, even if it is an admin - page.

-
- - - - http://drupal.org/node/53806 - http://drupal.org/node/53805 - http://drupal.org/node/53803 - http://drupal.org/node/53796 - - - 2006-03-13 - 2006-03-17 - - - - - horde -- "url" disclosure of sensitive information vulnerability - - - horde - horde-php5 - 3.1 - - - - -

Secunia advisory SA19246:

-
-

Paul Craig has discovered a vulnerability in Horde, which - can be exploited by malicious people to disclose sensitive - information. - Input passed to the "url" parameter in "services/go.php" - isn't properly verified, before it is used in a - "readfile()" call. This can be exploited to disclose the - content of arbitrary files via e.g. the "php://" protocol - wrapper.

-

The vulnerability has been confirmed in version 3.0.9 and - has also been reported in prior versions.

-

Provided and/or discovered by: - Paul Craig, Security-Assessment.com.

-
- - - - http://secunia.com/advisories/19246/ - - - 2006-03-15 - 2006-03-15 - - - - - linux-flashplugin -- arbitrary code execution vulnerability - - - linux-flashplugin - 7.0r63 - - - - -

Adobe reports:

-
-

Critical vulnerabilities have been identified in Flash - Player that could allow an attacker who successfully - exploits these vulnerabilities to take control of the - affected system. A malicious SWF must be loaded in Flash - Player by the user for an attacker to exploit these - vulnerabilities.

-

Flash Player 8 update (8.0.24.0), and Flash Player 7 - update (7.0.63.0) address security vulnerabilities in - previous versions of Flash Player, which could lead to the - potential execution of arbitrary code. These - vulnerabilities could be accessed through content - delivered from a remote location via the users web - browser, email client, or other applications that include - or reference the Flash Player.

-
- - - - CVE-2006-0024 - http://www.macromedia.com/devnet/security/security_zone/apsb06-03.html - - - 2006-03-14 - 2006-03-15 - - - - - nfs -- remote denial of service - - - FreeBSD - 6.06.0_5 - 5.45.4_12 - 5.35.3_27 - 4.114.11_15 - 4.104.10_21 - - - - -

Problem description:

-

A part of the NFS server code charged with handling incoming - RPC messages via TCP had an error which, when the server - received a message with a zero-length payload, would cause a - NULL pointer dereference which results in a kernel panic. The - kernel will only process the RPC messages if a userland nfsd - daemon is running.

-

Impact:

-

The NULL pointer deference allows a remote attacker capable - of sending RPC messages to an affected FreeBSD system to crash - the FreeBSD system.

-

Workaround:

-
    -
  1. -

    Disable the NFS server: set the nfs_server_enable - variable to "NO" in /etc/rc.conf, and reboot.

    -

    Alternatively, if there are no active NFS clients (as - listed by the showmount(8) utility), simply killing the - mountd and nfsd processes should suffice.

    -
    2. -
  2. -

    Add firewall rules to block RPC traffic to the NFS server - from untrusted hosts.

    -
    3. -
- - - - CVE-2006-0900 - SA-06:10.nfs - - - 2006-03-01 - 2006-03-12 - 2016-08-09 - - - - - openssh -- remote denial of service - - - FreeBSD - 5.45.4_12 - 5.35.3_27 - - - - -

Problem description:

-

Because OpenSSH and OpenPAM have conflicting designs (one is event- - driven while the other is callback-driven), it is necessary for - OpenSSH to fork a child process to handle calls to the PAM framework. - However, if the unprivileged child terminates while PAM authentication - is under way, the parent process incorrectly believes that the PAM - child also terminated. The parent process then terminates, and the - PAM child is left behind.

-

Due to the way OpenSSH performs internal accounting, these orphaned - PAM children are counted as pending connections by the master OpenSSH - server process. Once a certain number of orphans has accumulated, the - master decides that it is overloaded and stops accepting client - connections.

-

Impact:

-

By repeatedly connecting to a vulnerable server, waiting for - a password prompt, and closing the connection, an attacker can - cause OpenSSH to stop accepting client connections until the - system restarts or an administrator manually kills the orphaned - PAM processes.

-

Workaround:

-

The following command will show a list of orphaned PAM - processes:

- 
# pgrep -lf 'sshd.*\[pam\]'
-

The following command will kill orphaned PAM processes:

- 
# pkill -f 'sshd.*\[pam\]'
-

To prevent OpenSSH from leaving orphaned PAM processes behind, - perform one of the following:

-
    -
  1. -

    Disable PAM authentication in OpenSSH. Users will still - be able to log in using their Unix password, OPIE or SSH - keys.

    -

    To do this, execute the following commands as root:

    - 
    # echo 'UsePAM no' >>/etc/ssh/sshd_config
    - 
    # echo 'PasswordAuthentication yes' >>/etc/ssh/sshd_config
    - 
    # /etc/rc.d/sshd restart
    -
    2. -
  2. -

    If disabling PAM is not an option - if, for instance, you use - RADIUS authentication, or store user passwords in an SQL database - - you may instead disable privilege separation. However, this may - leave OpenSSH vulnerable to hitherto unknown bugs, and should be - considered a last resort.

    -

    To do this, execute the following commands as root:

    - 
    # echo 'UsePrivilegeSeparation no' >>/etc/ssh/sshd_config
    - 
    # /etc/rc.d/sshd restart
    -
    3. -
- - - - CVE-2006-0883 - SA-06:09.openssh - - - 2006-03-01 - 2006-03-12 - 2016-08-09 - - - - - GnuPG does not detect injection of unsigned data - - - gnupg - 1.4.2.2 - - - - -

Werner Koch reports:

-
-

In the aftermath of the false positive signature - verfication bug (announced 2006-02-15) more thorough testing - of the fix has been done and another vulnerability has been - detected. This new problem affects the use of *gpg* for - verification of signatures which are _not_ detached - signatures. The problem also affects verification of - signatures embedded in encrypted messages; i.e. standard use - of gpg for mails.

-
- - - - CVE-2006-0049 - http://lists.gnupg.org/pipermail/gnupg-announce/2006q1/000216.html - - - 2006-03-09 - 2006-03-10 - 2006-03-11 - - - - - mplayer -- heap overflow in the ASF demuxer - - - mplayer - mplayer-gtk - mplayer-esound - mplayer-gtk-esound - 0.99.7_11 - - - - -

The Mplayer team reports:

-
-

A potential buffer overflow was found in the ASF demuxer. - Arbitrary remote code execution is possible (under the user ID - running the player) when streaming an ASF file from a malicious - server or local code execution (under the user ID running the - player) if a malicious ASF file is played locally.

-
- - - - CVE-2006-0579 - http://www.mplayerhq.hu/design7/news.html#vuln13 - http://secunia.com/advisories/18718 - http://bugs.gentoo.org/show_bug.cgi?id=122029 - - - 2006-02-15 - 2006-03-09 - - - - - SSH.COM SFTP server -- format string vulnerability - - - ssh2 - ssh2-nox11 - 3.2.9.1_5 - - - - -

SSH Communications Security Corp reports a format string - vulnerability in their SFTP server. This vulnerability could - cause a user with SCP/SFTP access only to get permission to - execute also other commands. It could also allow user A to - create a special file that when accessed by user B allows - user A to execute commands as user B.

- - - - CVE-2006-0705 - 16640 - http://www.ssh.com/company/newsroom/article/715/ - http://www.frsirt.com/english/advisories/2006/0554 - http://securitytracker.com/id?1015619 - http://secunia.com/advisories/18828 - http://xforce.iss.net/xforce/xfdb/24651 - - - 2006-02-13 - 2006-03-04 - 2006-03-06 - - - - - gtar -- invalid headers buffer overflow - - - gtar - 1.15.1_2 - - - - -

GNU tar is vulnerable to a buffer overflow, caused by - improper bounds checking of the PAX extended headers. By - tricking an user into processing a specially crafted tar - archive, this could be exploited to execute arbitrary - code with the privileges of the user.

- - - - 16764 - CVE-2006-0300 - - - 2006-02-22 - 2006-03-03 - - - - - bugzilla -- multiple vulnerabilities - - - bugzilla - ja-bugzilla - 2.17.12.20.1 - - - - -

Some vulnerabilities have been reported in Bugzilla, - which can be exploited by malicious users to conduct SQL injection - attacks, and by malicious people to disclose sensitive information - and conduct script insertion attacks.

- - - - CVE-2006-2420 - CVE-2006-0916 - CVE-2006-0915 - CVE-2006-0914 - CVE-2006-0913 - http://www.bugzilla.org/security/2.18.4/ - - - 2006-02-20 - 2006-02-27 - 2006-11-11 - - - - - squirrelmail -- multiple vulnerabilities - - - squirrelmail - 1.4.6 - - - - -

Multiple vulnerabilities has been discovered since 1.4.5, - including IMAP injection as well as some XSS issues.

- - - - CVE-2006-0377 - CVE-2006-0195 - CVE-2006-0188 - - - 2006-02-23 - 2006-02-24 - - - - - gedit -- format string vulnerability - - - gedit - 2.10.3 - - - - -

Yan Feng reports a format string vulnerability in gedit. - This vulnerability could cause a denial of service with a - binary file that contains format string characters within - the filename. It had been reported that web browsers - and email clients can be configured to provide a filename as - an argument to gedit.:

- - - - CAN-2005-1686 - :http://marc.theaimsgroup.com/?l=bugtraq&m=111661117701398 - - - 2005-05-20 - 2006-02-20 - - - - - WebCalendar -- unauthorized access vulnerability - - - WebCalendar - 1.0.0 - - - - -

SecurityFocus reports that WebCalendar is affected by - an unauthorized access vulnerability. The vulnerability - is caused by improper checking of the authentication - mechanism before access is being permitted to the - "assistant_edit.php" file.

- - - - 14072 - CAN-2005-2320 - - - 2005-06-27 - 2006-02-20 - - - - - abiword, koffice -- stack based buffer overflow vulnerabilities - - - koffice - 1.2.01.4.1_1,1 - - - abiword - 2.2.11 - - - - -

Chris Evans reports that AbiWord is vulnerable to multiple - stack-based buffer overflow vulnerabilities. This - is caused by improper checking of the user-supplied data - before it is being copied to an too small buffer. The - vulnerability is triggered when someone is importing RTF - files.

- - - - 15096 - CAN-2005-2972 - http://scary.beasts.org/security/CESA-2005-006.txt - http://www.abisource.com/changelogs/2.2.11.phtml - http://www.kde.org/info/security/advisory-20051011-1.txt - - - 2005-10-14 - 2006-02-20 - 2006-02-20 - - - - - postgresql81-server -- SET ROLE privilege escalation - - - postgresql-server - 8.1.08.1.3 - - - - -

The PostgreSQL team reports:

-
-

Due to inadequate validity checking, a user could exploit - the special case that SET ROLE normally uses to restore - the previous role setting after an error. This allowed - ordinary users to acquire superuser status, for - example.

-
- - - - CVE-2006-0553 - http://www.postgresql.org/docs/8.1/static/release.html#RELEASE-8-1-3 - - - 2006-02-14 - 2006-02-18 - 2006-08-13 - - - - - gnupg -- false positive signature verification - - - gnupg - 1.4.2.1 - - - - -

Werner Koch reports:

-
-

The Gentoo project identified a security related bug in - GnuPG. When using any current version of GnuPG for - unattended signature verification (e.g. by scripts and - mail programs), false positive signature verification of - detached signatures may occur.

-

This problem affects the tool *gpgv*, as well as using - "gpg --verify" to imitate gpgv, if only the exit code of - the process is used to decide whether a detached signature - is valid. This is a plausible mode of operation for - gpgv.

-

If, as suggested, the --status-fd generated output is - used to decide whether a signature is valid, no problem - exists. In particular applications making use of the - GPGME library[2] are not affected.

-
- - - - CVE-2006-0455 - http://marc.theaimsgroup.com/?l=gnupg-devel&m=113999098729114 - - - 2006-02-15 - 2006-02-17 - - - - - rssh -- privilege escalation vulnerability - - - rssh - 2.3.0 - - - - -

Pizzashack reports:

-
-

Max Vozeler has reported a problem whereby rssh can - allow users who have shell access to systems where rssh - is installed (and rssh_chroot_helper is installed SUID) - to gain root access to the system, due to the ability to - chroot to arbitrary locations. There are a lot of - potentially mitigating factors, but to be safe you should - upgrade immediately.

-
- - - - 16050 - CVE-2005-3345 - http://www.pizzashack.org/rssh/security.shtml - - - 2005-12-18 - 2006-02-16 - - - - - tor -- malicious tor server can locate a hidden service - - - tor - 0.1.0.12 - - - - -

Roger Dingledine reports:

-
-

If you offer a Tor hidden service, an adversary who can - run a fast Tor server and who knows some basic statistics - can find the location of your hidden service in a matter of - minutes to hours.

-
- - - - CVE-2006-0414 - http://archives.seul.org/or/announce/Jan-2006/msg00001.html - - - 2006-01-12 - 2006-02-16 - - - - - sudo -- arbitrary command execution - - - sudo - 1.6.8.10 - - - - -

Tavis Ormandy reports:

-
-

The bash shell uses the value of the PS4 environment - variable (after expansion) as a prefix for commands run - in execution trace mode. Execution trace mode (xtrace) is - normally set via bash's -x command line option or - interactively by running "set -o xtrace". However, it may - also be enabled by placing the string "xtrace" in the - SHELLOPTS environment variable before bash is started.

-

A malicious user with sudo access to a shell script that - uses bash can use this feature to run arbitrary commands - for each line of the script.

-
- - - - 15191 - CVE-2005-2959 - http://www.courtesan.com/sudo/alerts/bash_env.html - - - 2005-10-25 - 2006-02-16 - - - - - libtomcrypt -- weak signature scheme with ECC keys - - - libtomcrypt - 1.02 - - - - -

The Secure Science Corporation reports that libtomcrypt is - vulnerable to a weak signature scheme. This allows an - attacker to create a valid random signature and use that to - sign arbitrary messages without requiring the private key.

- - - - http://marc.theaimsgroup.com/?l=bugtraq&m=111540819703204 - - - 2005-05-01 - 2006-02-16 - - - - - mantis -- "view_filters_page.php" cross site scripting vulnerability - - - mantis - 1.0.0a4 - - - - -

r0t reports:

-
-

Mantis contains a flaw that allows a remote cross site - scripting attack. This flaw exists because input passed to - "target_field" parameter in "view_filters_page.php" is not - properly sanitised before being returned to the user. This - could allow a user to create a specially crafted URL that - would execute arbitrary code in a user's browser within the - trust relationship between the browser and the server, - leading to a loss of integrity.

-
- - - - CAN-2005-4238 - http://pridels.blogspot.com/2005/12/mantis-bugtracking-system-xss-vuln.html - - - 2005-12-13 - 2006-02-16 - - - - - phpbb -- multiple vulnerabilities - - - phpbb - zh-phpbb-tw - 2.0.18 - - - - -

Multiple vulnerabilities have been reported within phpbb. - phpbb is proven vulnerable to:

-
    -
  • script insertion,
    • -
  • bypassing of protetion mechanisms,
    • -
  • multiple cross site scripting vulnerabilities,
    • -
  • SQL injection,
    • -
  • arbitrary code execution
    • -
- - - - 15170 - 15243 - CVE-2005-3310 - CVE-2005-3415 - CVE-2005-3416 - CVE-2005-3417 - CVE-2005-3418 - CVE-2005-3419 - CVE-2005-3420 - CVE-2005-3536 - CVE-2005-3537 - http://marc.theaimsgroup.com/?l=bugtraq&m=113017003617987 - http://www.hardened-php.net/advisory_172005.75.html - - - 2005-10-24 - 2006-02-16 - - - - - postgresql -- character conversion and tsearch2 vulnerabilities - - - postgresql - 7.2.07.2.8 - 7.3.07.3.10 - 7.4.07.4.8 - 8.0.08.0.3 - - - - -

The postgresql development team reports:

-
-

The more severe of the two errors is that the functions - that support client-to-server character set conversion - can be called from SQL commands by unprivileged users, - but these functions are not designed to be safe against - malicious choices of argument values. This problem exists - in PostgreSQL 7.3.* through 8.0.*. The recommended fix is - to disable public EXECUTE access for these functions. This - does not affect normal usage of the functions for character - set conversion, but it will prevent misuse.

-

The other error is that the contrib/tsearch2 module - misdeclares several functions as returning type "internal" - when they do not have any "internal" argument. This breaks - the type safety of "internal" by allowing users to - construct SQL commands that invoke other functions accepting - "internal" arguments. The consequences of this have not been - investigated in detail, but it is certainly at least possible - to crash the backend.

-
- - - - CAN-2005-1409 - CAN-2005-1410 - http://www.postgresql.org/about/news.315 - - - 2005-05-02 - 2006-02-16 - - - - - heartbeat -- insecure temporary file creation vulnerability - - - heartbeat - 1.2.4 - - - - -

Eric Romang reports a temporary file creation vulnerability - within heartbeat. The vulnerability is caused by hardcoded - temporary file usage. This can cause an attacker to create - an arbitrary symlink causing the application to overwrite the - symlinked file with the permissions of the user executing the - application.

- - - - CAN-2005-2231 - http://www.zataz.net/adviso/heartbeat-06272005.txt - - - 2005-07-12 - 2006-02-16 - 2006-04-16 - - - - - kpdf -- heap based buffer overflow - - - kdegraphics - 3.5.1_1 - - - - -

The KDE team reports:

-
-

kpdf, the KDE pdf viewer, shares code with xpdf. xpdf - contains a heap based buffer overflow in the splash - rasterizer engine that can crash kpdf or even execute - arbitrary code.

-
- - - - CVE-2006-0301 - http://www.kde.org/info/security/advisory-20060202-1.txt - - - 2006-02-02 - 2006-02-15 - - - - - perl, webmin, usermin -- perl format string integer wrap vulnerability - - - perl - 5.6.05.6.2 - 5.8.05.8.7_1 - - - webmin - 1.250 - - - usermin - 1.180 - - - - -

The Perl Development page reports:

-
-

Dyad Security recently released a security advisory explaining how - in certain cases, a carefully crafted format string passed to - sprintf can cause a buffer overflow. This buffer overflow can then - be used by an attacker to execute code on the machine. This was - discovered in the context of a design problem with the Webmin - administration package that allowed a malicious user to pass - unchecked data into sprintf.

-
- - - - 15629 - CVE-2005-3912 - CVE-2005-3962 - http://dev.perl.org/perl5/news/2005/perl_patches_fix_sprintf_buffer.html - http://www.dyadsecurity.com/perl-0002.html - http://www.dyadsecurity.com/webmin-0001.html - http://www.webmin.com/security.html - - - 2005-09-23 - 2006-02-15 - - - - - phpicalendar -- cross site scripting vulnerability - - - phpicalendar - 2.1 - - - - -

Francesco Ongaro reports that phpicalendar is vulnerable for - a cross site scripting attack. The vulnerability is caused by - improper validation of the index.php file allowing attackers - to include an arbitrary file with the .php extension

- - - - 15193 - CVE-2005-3366 - http://www.ush.it/2005/10/25/php-icalendar-css/ - - - 2005-10-25 - 2006-02-15 - - - - - phpicalendar -- file disclosure vulnerability - - - phpicalendar - 2.21 - - - - -

The phpicalendar team reports that there is an - unspecified vulnerability within phpicalendar. This - seems to be a file disclosure vulnerability caused by - improper checking of the template parsing function. - This would allow an attacker to disclose any file - readable by the user under which the webserver runs.

- - - - http://phpicalendar.net/forums/viewtopic.php?t=396 - - - 2006-02-08 - 2006-02-15 - - - - - FreeBSD -- Infinite loop in SACK handling - - - FreeBSD - 5.45.4_11 - 5.35.3_26 - - - - -

Problem description:

-

When insufficient memory is available to handle an - incoming selective acknowledgement, the TCP/IP stack may - enter an infinite loop.

-

Impact:

-

By opening a TCP connection and sending a carefully crafted - series of packets, an attacker may be able to cause a denial - of service.

-

Workaround:

-

On FreeBSD 5.4, the net.inet.tcp.sack.enable sysctl can be used to - disable the use of SACK:

-

# sysctl net.inet.tcp.sack.enable=0

-

No workaround is available for FreeBSD 5.3.

- - - - CVE-2006-0433 - SA-06:08.sack - - - 2006-02-01 - 2006-02-14 - 2016-08-09 - - - - - pf -- IP fragment handling panic - - - FreeBSD - 6.06.0_4 - 5.45.4_10 - 5.35.3_25 - - - - -

Problem description:

-

A logic bug in pf's IP fragment cache may result in a packet - fragment being inserted twice, violating a kernel - invariant.

-

Impact:

-

By sending carefully crafted sequence of IP packet fragments, - a remote attacker can cause a system running pf with a ruleset - containing a 'scrub fragment crop' or 'scrub fragment - drop-ovl' rule to crash.

-

Workaround:

-

Do not use 'scrub fragment crop' or 'scrub fragment drop-ovl' - rules on systems running pf. In most cases, such rules can be - replaced by 'scrub fragment reassemble' rules; see the - pf.conf(5) manual page for more details.

- -

Systems which do not use pf, or use pf but do not use the - aforementioned rules, are not affected by this issue.

- - - - CVE-2006-0381 - SA-06:07.pf - - - 2006-01-25 - 2006-02-14 - 2016-08-09 - - - - - FreeBSD -- Local kernel memory disclosure - - - FreeBSD - 6.06.0_4 - - - - -

Problem description:

-

A buffer allocated from the kernel stack may not be completely - initialized before being copied to userland. [CVE-2006-0379]

-

A logic error in computing a buffer length may allow too much - data to be copied into userland. [CVE-2006-0380]

-

Impact:

-

Portions of kernel memory may be disclosed to local users. - Such memory might contain sensitive information, such as - portions of the file cache or terminal buffers. This - information might be directly useful, or it might be - leveraged to obtain elevated privileges in some way. For - example, a terminal buffer might include a user-entered - password.

-

Workaround:

-

No workaround is available.

- - - - CVE-2006-0379 - CVE-2006-0380 - SA-06:06.kmem - - - 2006-01-25 - 2006-02-14 - 2016-08-09 - - - - - IEEE 802.11 -- buffer overflow - - - FreeBSD - 6.06.0_3 - - - - -

Problem description:

-

An integer overflow in the handling of corrupt IEEE 802.11 - beacon or probe response frames when scanning for existing - wireless networks can result in the frame overflowing a - buffer.

-

Impact:

-

An attacker able broadcast a carefully crafted beacon or - probe response frame may be able to execute arbitrary code - within the context of the FreeBSD kernel on any system - scanning for wireless networks.

-

Workaround:

-

No workaround is available, but systems without IEEE 802.11 - hardware or drivers loaded are not vulnerable.

- - - - CVE-2006-0226 - SA-06:05.80211 - - - 2006-01-18 - 2006-02-14 - 2016-08-09 - - - - - ipfw -- IP fragment denial of service - - - FreeBSD - 6.06.0_2 - - - - -

Problem description:

-

The firewall maintains a pointer to layer 4 header - information in the event that it needs to send a TCP reset - or ICMP error message to discard packets. Due to incorrect - handling of IP fragments, this pointer fails to get - initialized.

-

Impact:

-

An attacker can cause the firewall to crash by sending ICMP - IP fragments to or through firewalls which match any reset, - reject or unreach actions.

-

Workaround:

-

Change any reset, reject or unreach actions to deny. It - should be noted that this will result in packets being - silently discarded.

- - - - CVE-2006-0054 - SA-06:04.ipfw - - - 2006-01-11 - 2006-02-14 - 2016-08-09 - - - - - kpopup -- local root exploit and local denial of service - - - kpopup - 0.9.10.9.5 - - - - -

Mitre CVE reports:

-
-

Format string vulnerability in main.cpp in kpopup - 0.9.1-0.9.5pre2 allows local users to cause a denial of - service (segmentation fault) and possibly execute - arbitrary code via format string specifiers in command - line arguments.

-
-
-

misc.cpp in KPopup 0.9.1 trusts the PATH variable when - executing killall, which allows local users to elevate - their privileges by modifying the PATH variable to - reference a malicious killall program.

-
-

SecurityFocus credits "b0f" b0fnet@yahoo.com

- - - - CVE-2003-1170 - 8918 - CVE-2003-1167 - 8915 - http://www.securityfocus.com/archive/1/342736 - http://www.henschelsoft.de/kpopup_en.html - - - 2003-10-28 - 2006-02-07 - - - - - cpio -- multiple vulnerabilities - - - FreeBSD - 6.06.0_2 - 5.45.4_9 - 5.35.3_24 - 4.114.11_14 - 4.104.10_20 - - - - -

Problem description:

-

A number of issues has been discovered in cpio:

-

When creating a new file, cpio closes the file before setting - its permissions. (CVE-2005-1111)

-

When extracting files cpio does not properly sanitize file - names to filter out ".." components, even if the - --no-absolute-filenames option is used. (CVE-2005-1229)

-

When adding large files (larger than 4 GB) to a cpio archive - on 64-bit platforms an internal buffer might overflow. - (CVE-2005-4268)

-

Impact

-

The first problem can allow a local attacker to change the - permissions of files owned by the user executing cpio providing - that they have write access to the directory in which the file - is being extracted. (CVE-2005-1111)

-

The lack of proper file name sanitation can allow an attacker - to overwrite arbitrary local files when extracting files from - a cpio archive. (CVE-2005-1229)

-

The buffer-overflow on 64-bit platforms could lead cpio to a - Denial-of-Service situation (crash) or possibly execute - arbitrary code with the permissions of the user running - cpio. (CVE-2005-4268)

-

Workaround

-

Use a different utility to create and extract cpio archives, - for example pax(1) or (on FreeBSD 5.3 or later) tar(1). If - this is not possible, do not extract untrusted archives and - when running on 64-bit platforms do not add untrusted files - to cpio archives.

- - - - CVE-2005-1111 - CVE-2005-1229 - CVE-2005-4268 - SA-06:03.cpio - - - 2006-01-11 - 2006-01-27 - - - - - ee -- temporary file privilege escalation - - - FreeBSD - 6.06.0_2 - 5.45.4_9 - 5.35.3_24 - 4.114.11_14 - 4.104.10_20 - - - - -

Problem description

-

The ispell_op function used by ee(1) while executing spell - check operations employs an insecure method of temporary file - generation. This method produces predictable file names based - on the process ID and fails to confirm which path will be over - written with the user.
- It should be noted that ispell does not have to be installed - in order for this to be exploited. The option simply needs to - be selected.

-

Impact

-

These predictable temporary file names are problematic - because they allow an attacker to take advantage of a race - condition in order to execute a symlink attack, which could - allow them to overwrite files on the system in the context of - the user running the ee(1) editor.

-

Workaround

-

Instead of invoking ispell through ee(1), invoke it directly.

- - - - 16207 - CVE-2006-0055 - SA-06:02.ee - - - 2006-01-11 - 2006-01-27 - - - - - texindex -- temporary file privilege escalation - - - FreeBSD - 6.06.0_2 - 5.45.4_9 - 5.35.3_24 - 4.114.11_14 - 4.104.10_20 - - - - -

Problem description

-

The "sort_offline" function used by texindex(1) employs the - "maketempname" function, which produces predictable file names - and fails to validate that the paths do not exist.

-

Impact

-

These predictable temporary file names are problematic because - they allow an attacker to take advantage of a race condition in - order to execute a symlink attack, which could enable them to - overwrite files on the system in the context of the user running - the texindex(1) utility.

-

Workaround

-

No workaround is available, but the problematic code is only - executed if the input file being processed is 500kB or more in - length; as a result, users working with documents of less than - several hundred pages are very unlikely to be affected.

- - - - 14854 - CAN-2005-3011 - SA-06:01.texindex - - - 2006-01-11 - 2006-01-27 - - - - - cvsbug -- race condition - - - FreeBSD - 5.45.4_7 - 5.35.3_22 - 4.114.11_12 - 4.104.10_18 - - - cvs+ipv6 - 1.11.17_1 - - - - -

Problem description

-

A temporary file is created, used, deleted, and then - re-created with the same name. This creates a window during - which an attacker could replace the file with a link to - another file. While cvsbug(1) is based on the send-pr(1) - utility, this problem does not exist in the version of - send-pr(1) distributed with FreeBSD.
- In FreeBSD 4.10 and 5.3, some additional problems exist - concerning temporary file usage in both cvsbug(1) and - send-pr(1).

-

Impact

-

A local attacker could cause data to be written to any file - to which the user running cvsbug(1) (or send-pr(1) in FreeBSD - 4.10 and 5.3) has write access. This may cause damage in - itself (e.g., by destroying important system files or - documents) or may be used to obtain elevated privileges.

-

Workaround

-

Do not use the cvsbug(1) utility on any system with untrusted - users.
- Do not use the send-pr(1) utility on a FreeBSD 4.10 or 5.3 - system with untrusted users.

- - - - CAN-2005-2693 - SA-05:20.cvsbug - - - 2005-09-07 - 2006-01-27 - 2006-11-08 - - - - - sge -- local root exploit in bundled rsh executable - - - sge - sgeee - 5.3.6.20040330_1 - 6.*6.0.7.1 - - - - -

Sun Microsystems reports:

-
-

The SGE 6.0u7_1 release fixes a security bug which can - allow malicious users to gain root access.

-
- - - - http://gridengine.sunsource.net/project/gridengine/news/SGE60u7_1-announce.html - - - 2005-12-23 - 2006-01-23 - - - - - fetchmail -- crash when bouncing a message - - - fetchmail - 6.3.06.3.2 - - - - -

Matthias Andree reports:

-
-

Fetchmail contains a bug that causes itself to crash when - bouncing a message to the originator or to the local - postmaster. The crash happens after the bounce message has - been sent, when fetchmail tries to free the dynamic array - of failed addresses, and calls the free() function with an - invalid pointer.

-
- - - - CVE-2006-0321 - http://www.fetchmail.info/fetchmail-SA-2006-01.txt - http://bugs.debian.org/348747 - - - 2006-01-22 - 2006-01-23 - - - - - clamav -- possible heap overflow in the UPX code - - - clamav - 0.88 - - - clamav-devel - 20060110 - - - - -

The Zero Day Initiative reports:

-
-

This vulnerability allows remote attackers to execute - arbitrary code on vulnerable Clam AntiVirus - installations. Authentication is not required to exploit - this vulnerability.

-

This specific flaw exists within libclamav/upx.c during - the unpacking of executable files compressed with UPX. Due - to an invalid size calculation during a data copy from the - user-controlled file to heap allocated memory, an - exploitable memory corruption condition is created.

-
- - - - 16191 - CVE-2006-0162 - http://lurker.clamav.net/message/20060109.213247.a16ae8db.en.html - http://www.zerodayinitiative.com/advisories/ZDI-06-001.html - http://secunia.com/advisories/18379/ - - - 2006-01-09 - 2006-01-10 - 2006-01-15 - - - - - milter-bogom -- headerless message crash - - - milter-bogom - 1.8.2 - - - - -

Juan J. Marítnez reports:

-
-

The milter crashes while processing a headerless - message

-

Impact: bogom crashes and sendmail moves it to error - state

-
- - - - http://www.usebox.net/jjm/bogom/errata/bogom-errata-2006-1.txt - http://alf.dyndns.ws/pipermail/milter/2006-January/000076.html - - - 2006-01-05 - 2006-01-09 - - - - - bogofilter -- heap corruption through excessively long words - - - bogofilter - 0.96.20.96.3 - - - - -

Matthias Andree reports:

-
-

Bogofilter's/bogolexer's input handling in version 0.96.2 was not - keeping track of its output buffers properly and could overrun a - heap buffer if the input contained words whose length exceeded - 16,384 bytes, the size of flex's input buffer. A "word" here refers - to a contiguous run of input octets that was not '_' and did not - match at least one of ispunct(), iscntrl() or isspace().

-
- - - - CVE-2005-4592 - http://bogofilter.sourceforge.net/security/bogofilter-SA-2005-02 - - - 2005-10-23 - 2006-01-07 - - - - - bogofilter -- heap corruption through malformed input - - - bogofilter - 0.93.50.96.3 - - - - -

Matthias Andree reports:

-
-

When using Unicode databases (default in more recent bogofilter - installations), upon encountering invalid input sequences, - bogofilter or bogolexer could overrun a malloc()'d buffer, - corrupting the heap, while converting character sets. Bogofilter - would usually be processing untrusted data received from the - network at that time.

- -

This problem was aggravated by an unrelated bug that made - bogofilter process binary attachments as though they were text, and - attempt charset conversion on them. Given the MIME default - character set, US-ASCII, all input octets in the range 0x80...0xff - were considered invalid input sequences and could trigger the heap - corruption.

-
- - - - CVE-2005-4591 - http://bogofilter.sourceforge.net/security/bogofilter-SA-2005-01 - - - 2005-10-22 - 2006-01-07 - - - - - rxvt-unicode -- restore permissions on tty devices - - - rxvt-unicode - 6.3 - - - - -

A rxvt-unicode changelog reports:

-
-

SECURITY FIX: on systems using openpty, permissions were - not correctly updated on the tty device and were left as - world-readable and world-writable (likely in original rxvt, - too), and were not restored properly. Affected are only - systems where non-unix ptys were used (such as most BSDs). - Found, patched and debugged by Ryan Beasley.

-
- - - - http://dist.schmorp.de/rxvt-unicode/Changes - - - 2005-12-31 - 2006-01-04 - - - - - apache -- mod_imap cross-site scripting flaw - - - apache - 1.31.3.34_3 - 2.0.352.0.55_2 - 2.12.1.9_3 - 2.22.2.0_3 - - - apache+mod_perl - 1.3.34_1 - - - apache_fp - 0 - - - apache+ipv6 - 1.3.37 - - - ru-apache - 1.3.34+30.22_1 - - - ru-apache+mod_ssl - 1.3.34+30.22+2.8.25_1 - - - apache+ssl - 1.3.01.3.33.1.55_2 - - - apache+mod_ssl - apache+mod_ssl+ipv6 - apache+mod_ssl+mod_accel - apache+mod_ssl+mod_accel+ipv6 - apache+mod_ssl+mod_accel+mod_deflate - apache+mod_ssl+mod_accel+mod_deflate+ipv6 - apache+mod_ssl+mod_deflate - apache+mod_ssl+mod_deflate+ipv6 - apache+mod_ssl+mod_snmp - apache+mod_ssl+mod_snmp+mod_accel - apache+mod_ssl+mod_snmp+mod_accel+ipv6 - apache+mod_ssl+mod_snmp+mod_deflate - apache+mod_ssl+mod_snmp+mod_deflate+ipv6 - apache+mod_ssl+mod_snmp+mod_accel+mod_deflate+ipv6 - 1.3.34+2.8.25_1 - - - - -

The Apache HTTP Server Project reports:

-
-

A flaw in mod_imap when using the Referer directive with - image maps. In certain site configurations a remote - attacker could perform a cross-site scripting attack if a - victim can be forced to visit a malicious URL using - certain web browsers.

-
- - - - CVE-2005-3352 - 15834 - http://www.apacheweek.com/features/security-13 - http://www.apacheweek.com/features/security-20 - - - 2005-11-01 - 2006-01-01 - 2009-01-23 - - - - - qmail -- 64 bit integer overflows with possible remote code execution on large SMTP requests - - - netqmail - 1.06_4 - - - - -

Georgi Guninski writes:

-
-

There are several issues with qmail on 64 bit platforms - classical integer overflow, pointer with signed index and signedness problem (not counting the memory consumtion dos, which just helps).

-

Update: the problem with the signed index is exploitable on Freebsd 5.4 amd64 wih a lot of virtual memory.

-
-

The national vulnerability database summarizes:

-
-

Integer overflow in the stralloc_readyplus function in qmail, when running on 64 bit platforms with a large amount of virtual memory, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large SMTP request.

-
- - - - http://www.guninski.com/where_do_you_want_billg_to_go_today_4.html - https://www.qualys.com/2020/05/19/cve-2005-1513/remote-code-execution-qmail.txt - CVE-2005-1513 - CVE-2005-1514 - CVE-2005-1515 - - - 2005-05-06 - 2005-05-11 - - - - - qmail -- 64 bit integer overflows with possible remote code execution on large SMTP requests - - - netqmail-tls - 1.06.20160918_2 - - - - -

Georgi Guninski writes:

-
-

There are several issues with qmail on 64 bit platforms - classical integer overflow, pointer with signed index and signedness problem (not counting the memory consumtion dos, which just helps).

-

Update: the problem with the signed index is exploitable on Freebsd 5.4 amd64 wih a lot of virtual memory.

-
-

The national vulnerability database summarizes:

-
-

Integer overflow in the stralloc_readyplus function in qmail, when running on 64 bit platforms with a large amount of virtual memory, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large SMTP request.

-
- - - - http://www.guninski.com/where_do_you_want_billg_to_go_today_4.html - https://www.qualys.com/2020/05/19/cve-2005-1513/remote-code-execution-qmail.txt - CVE-2005-1513 - CVE-2005-1514 - CVE-2005-1515 - - - 2005-05-06 - 2005-05-11 - - - - - qmail -- 64 bit integer overflows with possible remote code execution on large SMTP requests - - - netqmail-mysql - 1.06.1.1.15_1 - - - - -

Georgi Guninski writes:

-
-

There are several issues with qmail on 64 bit platforms - classical integer overflow, pointer with signed index and signedness problem (not counting the memory consumtion dos, which just helps).

-

Update: the problem with the signed index is exploitable on Freebsd 5.4 amd64 wih a lot of virtual memory.

-
-

The national vulnerability database summarizes:

-
-

Integer overflow in the stralloc_readyplus function in qmail, when running on 64 bit platforms with a large amount of virtual memory, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large SMTP request.

-
- - - - http://www.guninski.com/where_do_you_want_billg_to_go_today_4.html - https://www.qualys.com/2020/05/19/cve-2005-1513/remote-code-execution-qmail.txt - CVE-2005-1513 - CVE-2005-1514 - CVE-2005-1515 - - - 2005-05-06 - 2005-05-11 - - - - - nbd-server -- buffer overflow vulnerability - - - nbd-server - 2.8.2_1 - - - - -

Kurt Fitzner reports a buffer overflow vulnerability - within nbd. This could potentially allow the execution - of arbitrary code on the nbd server.

- - - - CVE-2005-3534 - http://www.debian.org/security/2005/dsa-924 - - - 2005-12-21 - 2005-12-22 - 2005-12-25 - - - - - scponly -- local privilege escalation exploits - - - scponly - 4.2 - - - - -

Max Vozeler reports:

-
-

If ALL the following conditions are true, administrators using - scponly-4.1 or older may be at risk of a local privilege - escalation exploit:

-
    -
  • the chrooted setuid scponlyc binary is installed
    • -
  • regular non-scponly users have interactive shell access - to the box
    • -
  • a user executable dynamically linked setuid binary - (such as ping) exists on the same file system mount - as the user's home directory
    • -
  • the operating system supports an LD_PRELOAD style - mechanism to overload dynamic library loading
    • -
-
-

Pekka Pessi also reports:

-
-

If ANY the following conditions are true, administrators - using scponly-4.1 or older may be at risk of a local privilege - escalation exploit:

-
    -
  • scp compatibility is enabled
    • -
  • rsync compatibility is enabled
    • -
-
- - - - https://lists.ccs.neu.edu/pipermail/scponly/2005-December/001027.html - http://sublimation.org/scponly/#relnotes - - - 2005-12-21 - 2005-12-22 - - - - - fetchmail -- null pointer dereference in multidrop mode with headerless email - - - fetchmail - 6.3.1 - - - - -

The fetchmail team reports:

-
-

Fetchmail contains a bug that causes an application crash - when fetchmail is configured for multidrop mode and the - upstream mail server sends a message without headers. As - fetchmail does not record this message as "previously fetched", - it will crash with the same message if it is re-executed, so it - cannot make progress. A malicious or broken-into upstream server - could thus cause a denial of service in fetchmail clients.

-
- - - - CVE-2005-4348 - http://www.fetchmail.info/fetchmail-SA-2005-03.txt - http://article.gmane.org/gmane.mail.fetchmail.user/7573 - http://bugs.debian.org/343836 - - - 2005-12-19 - 2005-12-19 - - - - - mantis -- "t_core_path" file inclusion vulnerability - - - mantis - 1.0.0rc3 - - - - -

Secunia Research reports:

-
-

Input passed to the "t_core_path" parameter in - "bug_sponsorship_list_view_inc.php" isn't properly verified, - before it used to include files. This can be exploited to - include arbitrary files from external and local - resources.

-
- - - - CVE-2005-3335 - http://secunia.com/secunia_research/2005-46/advisory/ - - - 2005-10-26 - 2005-12-14 - - - - - mantis -- "view_filters_page.php" cross-site scripting vulnerability - - - mantis - 1.0.0rc4 - - - - -

r0t reports:

-
-

Mantis contains a flaw that allows a remote cross site - scripting attack. This flaw exists because input passed to - "target_field" parameter in "view_filters_page.php" isn't - properly sanitised before being returned to the user. This - could allow a user to create a specially crafted URL that - would execute arbitrary code in a user's browser within the - trust relationship between the browser and the server, - leading to a loss of integrity.

-
- - - - 15842 - http://pridels.blogspot.com/2005/12/mantis-bugtracking-system-xss-vuln.html - - - 2005-12-13 - 2005-12-14 - - - - - mnemo -- Cross site scripting vulnerabilities in several of the notepad name and note data fields - - - mnemo - 2.0.3 - - - - -

Announce of Mnemo H3 (2.0.3) (final):

-
-

This [2.0.3] is a security release that fixes cross site - scripting vulnerabilities in several of the notepad name - and note data fields. None of the vulnerabilities can be - exploited by unauthenticated users; however, we strongly - recommend that all users of Mnemo 2.0.2 upgrade to 2.0.3 - as soon as possible.

-
- - - - http://marc.theaimsgroup.com/?l=horde-announce&m=113433279228172&w=2 - - - 2005-12-11 - 2005-12-11 - - - - - nag -- Cross site scripting vulnerabilities in several of the tasklist name and task data fields - - - nag - 2.0.4 - - - - -

Announce of Nag H3 (2.0.4) (final):

-
-

This [2.0.4] is a security release that fixes cross site - scripting vulnerabilities in several of the tasklist name - and task data fields. None of the vulnerabilities can be - exploited by unauthenticated users; however, we strongly - recommend that all users of Nag 2.0.3 upgrade to 2.0.4 as - soon as possible.

-
- - - - http://marc.theaimsgroup.com/?l=horde-announce&m=113433205826731&w=2 - - - 2005-12-11 - 2005-12-11 - - - - - turba -- Cross site scripting vulnerabilities in several of the address book name and contact data fields - - - turba - 2.0.5 - - - - -

Announce of Turba H3 (2.0.5) (final):

-
-

This [2.0.5] is a security release that fixes cross site - scripting vulnerabilities in several of the address book - name and contact data fields. None of the vulnerabilities - can be exploited by unauthenticated users; however, we - strongly recommend that all users of Turba 2.0.4 upgrade - to 2.0.5 as soon as possible.

-
- - - - http://marc.theaimsgroup.com/?l=horde-announce&m=113433120829232&w=2 - - - 2005-12-11 - 2005-12-11 - - - - - kronolith -- Cross site scripting vulnerabilities in several of the calendar name and event data fields - - - kronolith - 2.0.6 - - - - -

Announce of Kronolith H3 (2.0.6) (final):

-
-

This [2.0.6] is a security release that fixes cross site - scripting vulnerabilities in several of the calendar name - and event data fields. None of the vulnerabilities can be - exploited by unauthenticated users; however, we strongly - recommend that all users of Kronolith 2.0.5 upgrade to - 2.0.6 as soon as possible.

-
- - - - http://marc.theaimsgroup.com/?l=kronolith&m=113433029822279&w=2 - - - 2005-12-11 - 2005-12-11 - - - - - horde -- Cross site scripting vulnerabilities in several of Horde's templates - - - horde - horde-php5 - 3.0.8 - - - - -

Announce of Horde H3 3.0.8 (final):

-
-

This [3.0.8] is a security release that fixes cross site - scripting vulnerabilities in several of Horde's templates. - None of the vulnerabilities can be exploited by - unauthenticated users; however, we strongly recommend that - all users of Horde 3.0.7 upgrade to 3.0.8 as soon as - possible.

-
- - - - http://marc.theaimsgroup.com/?l=horde-announce&m=113433346726097&w=2 - - - 2005-12-11 - 2005-12-11 - - - - - curl -- URL buffer overflow vulnerability - - - curl - 7.11.27.15.1 - - - - -

A Project cURL Security Advisory reports:

-
-

libcurl's URL parser function can overflow a malloced - buffer in two ways, if given a too long URL.

-

1 - pass in a URL with no protocol (like "http://") - prefix, using no slash and the string is 256 bytes or - longer. This leads to a single zero byte overflow of the - malloced buffer.

-

2 - pass in a URL with only a question mark as separator - (no slash) between the host and the query part of the URL. - This leads to a single zero byte overflow of the malloced - buffer.

-

Both overflows can be made with the same input string, - leading to two single zero byte overwrites.

-

The affected flaw cannot be triggered by a redirect, but - the long URL must be passed in "directly" to libcurl. It - makes this a "local" problem. Of course, lots of programs - may still pass in user-provided URLs to libcurl without doing - much syntax checking of their own, allowing a user to exploit - this vulnerability.

-
- - - - 15756 - CVE-2005-4077 - http://curl.haxx.se/docs/adv_20051207.html - http://www.hardened-php.net/advisory_242005.109.html - http://secunia.com/advisories/17907/ - - - 2005-12-07 - 2005-12-09 - 2006-01-01 - - - - - phpmyadmin -- register_globals emulation "import_blacklist" manipulation - - - phpMyAdmin - 2.7.0.1 - - - - -

Secunia reports:

-
-

Stefan Esser has reported a vulnerability in phpMyAdmin, - which can be exploited by malicious people to conduct - cross-site scripting attacks, disclose sensitive - information, and compromise a vulnerable system.

-

The vulnerability is caused due to an error in the - register_globals emulation layer in "grab_globals.php" - where the "import_blacklist" variable is not properly - protected from being overwritten. This can be exploited - to execute arbitrary HTML and script code in a user's - browser session in context of an affected site, and - include arbitrary files from external and local resources.

-
- - - - http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-9 - http://www.hardened-php.net/advisory_252005.110.html - http://secunia.com/advisories/17925/ - - - 2005-12-07 - 2005-12-07 - - - - - phpmyadmin -- XSS vulnerabilities - - - phpMyAdmin - 2.7.0 - - - - -

A phpMyAdmin security advisory reports:

-
-

It was possible to conduct an XSS attack via the - HTTP_HOST variable; also, some scripts in the libraries - directory that handle header generation were vulnerable - to XSS.

-
- - - - CVE-2005-3665 - http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-8 - http://secunia.com/advisories/17895/ - - - 2005-12-05 - 2005-12-07 - - - - - ffmpeg -- libavcodec buffer overflow vulnerability - - - ffmpeg - 0.4.9.p1_4 - - - ffmpeg-devel - 0.4.9.c.2005120600 - - - - -

Secunia reports:

-
-

Simon Kilvington has reported a vulnerability in - FFmpeg libavcodec, which can be exploited by malicious - people to cause a DoS (Denial of Service) and - potentially to compromise a user's system.

-

The vulnerability is caused due to a boundary error - in the "avcodec_default_get_buffer()" function of - "utils.c" in libavcodec. This can be exploited to - cause a heap-based buffer overflow when a - specially-crafted 1x1 ".png" file containing a palette - is read.

-
- - - - http://article.gmane.org/gmane.comp.video.ffmpeg.devel/26558 - http://secunia.com/advisories/17892/ - - - 2005-11-30 - 2005-12-07 - - - - - trac -- search module SQL injection vulnerability - - - trac - 0.9.2 - - - - -

Secunia reports:

-
-

A vulnerability has been reported in Trac, which - can be exploited by malicious people to conduct SQL - injection attacks.

-

Some unspecified input passed in the search module - isn't properly sanitised before being used in a SQL - query. This can be exploited to manipulate SQL - queries by injecting arbitrary SQL code.

-
- - - - http://projects.edgewall.com/trac/wiki/ChangeLog#a0.9.2 - http://secunia.com/advisories/17894/ - - - 2005-12-05 - 2005-12-07 - - - - - drupal -- multiple vulnerabilities - - - drupal - 4.6.4 - - - - -

Secunia reports:

-
-

Some vulnerabilities have been reported in Drupal, - which can be exploited by malicious people to bypass - certain security restrictions, and conduct script - insertion and HTTP response splitting attacks.

-

1) An input validation error in the filtering of - HTML code can be exploited to inject arbitrary - JavaScript code in submitted content, which will be - executed in a user's browser session in context of - an affected site when the malicious user data is - viewed. - Successful exploitation requires that the user has - access to the full HTML input format. - Ref: sa-2005-007

-

2) An input validation error in the attachment - handling can be exploited to upload a malicious - image with embedded HTML and script content, which - will be executed in a user's browser session in - context of an affected site when viewed directly with - the Microsoft Internet Explorer browser. - This can also be exploited to inject arbitrary HTTP - headers, which will be included in the response sent - to the user. - Ref: sa-2005-008

-

3) The problem is that it is possible to bypass the - "access user profile" permission. However, this cannot - be exploited to modify data. - Successful exploitation requires that the server runs - PHP 5. - Ref: sa-2005-009

-
- - - - http://drupal.org/files/sa-2005-007/advisory.txt - http://drupal.org/files/sa-2005-008/advisory.txt - http://drupal.org/files/sa-2005-009/advisory.txt - http://secunia.com/advisories/17824/ - - - 2005-12-01 - 2005-12-01 - - - - - opera -- multiple vulnerabilities - - - linux-opera - opera-devel - opera - 8.51 - - - - -

Opera reports:

-
-

It is possible to make a form input that looks like an - image link. If the form input has a "title" attribute, the - status bar will show the "title". A "title" which looks - like a URL can mislead the user, since the title can say - http://nice.familiar.com/, while the form action can be - something else.

-

Opera's tooltip says "Title:" before the title text, - making a spoof URL less convincing. A user who has enabled - the status bar and disabled tooltips can be affected by - this. Neither of these settings are Opera's defaults.

-

This exploit is mostly of interest to users who disable - JavaScript. If JavaScript is enabled, any link target or - form action can be overridden by the script. The tooltip - and the statusbar can only be trusted to show the true - location if JavaScript is disabled.

-
-
-

Java code using LiveConnect methods to remove a property - of a JavaScript object may in some cases use null pointers - that can make Opera crash. This crash is not exploitable - and such code is rare on the web.

-
- - - - CVE-2005-3699 - http://secunia.com/advisories/17571/ - http://www.opera.com/support/search/supsearch.dml?index=817 - http://www.opera.com/support/search/supsearch.dml?index=819 - - - 2005-11-16 - 2005-11-30 - - - - - opera -- command line URL shell command injection - - - linux-opera - opera-devel - opera - 8.51 - - - - -

An Opera Advisory reports:

-
-

Opera for UNIX uses a wrapper shell script to start up - Opera. This shell script reads the input arguments, like - the file names or URLs that Opera is to open. It also - performs some environment checks, for example whether Java - is available and if so, where it is located.

-

This wrapper script can also run commands embedded in the - URL, so that a specially crafted URL can make arbitrary - commands run on the recipient's machine. Users who have - other programs set up to use Opera to open Web links are - vulnerable to this flaw. For these users, clicking a Web - link in for example OpenOffice.org or Evolution can run a - command that was put into the link.

-
- - - - 15521 - CVE-2005-3750 - http://secunia.com/secunia_research/2005-57/advisory/ - http://www.opera.com/support/search/supsearch.dml?index=818 - - - 2005-11-17 - 2005-11-30 - - - - - mambo -- "register_globals" emulation layer overwrite vulnerability - - - mambo - 4.5.3 - - - - -

A Secunia Advisory reports:

-
-

peter MC tachatte has discovered a vulnerability in Mambo, - which can be exploited by malicious people to manipulate - certain information and compromise a vulnerable system.

-

The vulnerability is caused due to an error in the - "register_globals" emulation layer in "globals.php" where - certain arrays used by the system can be overwritten. This - can be exploited to include arbitrary files from external - and local resources via the "mosConfig_absolute_path" parameter.

-

Successful exploitation requires that "register_globals" - is disabled.

-
- - - - http://www.mamboserver.com/index.php?option=com_content&task=view&id=172&Itemid=1 - http://secunia.com/advisories/17622/ - - - 2005-11-17 - 2005-11-30 - - - - - ghostscript -- insecure temporary file creation vulnerability - - - ghostscript-gnu - ghostscript-gnu-nox11 - 7.07_14 - - - ghostscript-afpl - ghostscript-afpl-nox11 - 8.53_1 - - - - -
-

Ghostscript is affected by an insecure temporary file - creation vulnerability. This issue is likely due - to a design error that causes the application to fail - to verify the existence of a file before writing to it.

- -

An attacker may leverage this issue to overwrite - arbitrary files with the privileges of an unsuspecting - user that activates the vulnerable application. - Reportedly this issue is unlikely to facilitate - privilege escalation.

-
- - - - 11285 - CVE-2004-0967 - - - 2004-10-19 - 2005-11-27 - - - - - horde -- Cross site scripting vulnerabilities in MIME viewers - - - horde - horde-php5 - 3.0.7 - - - - -

Announce of Horde 3.0.7 (final):

-
-

This [3.0.7] is a security release that fixes cross site - scripting vulnerabilities in two of Horde's MIME viewers. These - holes could for example be exploited by an attacker sending - specially crafted emails to Horde's webmail client IMP. The - attack could be used to steal users' identity information, taking - over users' sessions, or changing users' settings.

-

As a hotfix the css and tgz MIME drivers can be disabled by - removing their entries from the - $mime_drivers_map['horde']['registered'] list in - horde/config/mime_drivers.php.

-
- - - - 15535 - CVE-2005-3759 - http://lists.horde.org/archives/announce/2005/000232.html - - - 2005-11-22 - 2005-11-22 - 2005-11-26 - - - - - phpmyadmin -- HTTP Response Splitting vulnerability - - - phpMyAdmin - 2.6.4.4 - - - - -

A phpMyAdmin security advisory reports:

-
-

Some scripts in phpMyAdmin are vulnerable to an - HTTP Response Splitting attack.

-

Severity:

-

We consider these vulnerabilities to be serious. - However, they can only be triggered on systems running - with register_globals = on.

-
- - - - http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-6 - http://secunia.com/advisories/17578/ - http://www.fitsec.com/advisories/FS-05-02.txt - - - 2005-11-15 - 2005-11-16 - - - - - phpSysInfo -- "register_globals" emulation layer overwrite vulnerability - - - phpSysInfo - 2.5.1 - - - - -

A Secunia Advisory reports:

-
-

Christopher Kunz has reported a vulnerability in - phpSysInfo, which can be exploited by malicious people - to manipulate certain information.

-

The vulnerability is caused due to an error in - the "register_globals" emulation layer where certain - arrays used by the system can be overwritten. This can be - exploited to execute arbitrary HTML and script code in - a user's browser session and include arbitrary files from - local resources.

-
- - - - http://www.hardened-php.net/advisory_222005.81.html - http://secunia.com/advisories/17441/ - - - 2005-11-10 - 2005-11-13 - 2005-12-25 - - - - - Macromedia flash player -- swf file handling arbitrary code - - - linux-flashplugin6 - 6.0r79_3 - - - linux-flashplugin7 - 7.0r61 - - - - -

A Secunia Advisory reports:

-
-

A vulnerability has been reported in Macromedia - Flash Player, which can be exploited by malicious - people to compromise a user's system.

-

The vulnerability is caused due to missing validation - of the frame type identifier that is read from - a SWF file. This value is used as an index in Flash.ocx - to reference an array of function pointers. This can be - exploited via a specially crafted SWF file to cause - the index to reference memory that is under the attacker's - control, which causes Flash Player to use attacker - supplied values as function pointers.

-

Successful exploitation allows execution of arbitrary - code.

-
- - - - http://www.macromedia.com/devnet/security/security_zone/mpsb05-07.html - http://secunia.com/advisories/17430/ - http://www.eeye.com/html/research/advisories/AD20051104.html - - - 2005-06-27 - 2005-11-13 - - - - - flyspray -- cross-site scripting vulnerabilities - - - flyspray - 0.9.8 - - - - -

A Secunia Advisory reports:

-
-

Lostmon has reported some vulnerabilities in Flyspray, - which can be exploited by malicious people to conduct - cross-site scripting attacks.

-

Some input isn't properly sanitised before being - returned to the user. This can be exploited to execute - arbitrary HTML and script code in a user's browser - session in context of an affected site.

-
- - - - 15209 - http://secunia.com/advisories/17316/ - http://lostmon.blogspot.com/2005/10/flyspray-bug-killer-multiple-variable.html - - - 2005-10-26 - 2005-11-10 - 2005-11-29 - - - - - p5-Mail-SpamAssassin -- long message header denial of service - - - p5-Mail-SpamAssassin - 3.1.0 - - - - -

A Secunia Advisory reports:

-
-

A vulnerability has been reported in SpamAssassin, - which can be exploited by malicious people to cause - a DoS (Denial of Service).

-

The vulnerability is caused due to the use of - an inefficient regular expression in - "/SpamAssassin/Message.pm" to parse email headers. - This can cause perl to crash when it runs out of stack - space and can be exploited via a malicious email that - contains a large number of recipients.

-
- - - - http://secunia.com/advisories/17386/ - http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4570 - - - 2005-11-10 - 2005-11-10 - - - - - qpopper -- multiple privilege escalation vulnerabilities - - - qpopper - 4.04.0.5 - - - - -

Jens Steube reports that qpopper is vulnerable to a privilege - escalation vulnerability. qpopper does not properly drop root - privileges so that user supplied configuration and trace files - can be processed with root privileges. This could allow a - local attacker to create or modify arbitrary files.

-

qpopper is also affected by improper umask settings - which could allow users to create group or world-writeable - files, possibly allowing an attacker to overwrite arbitrary - files.

- - - - CVE-2005-1151 - CVE-2005-1152 - http://secunia.com/advisories/15475/ - - - 2005-05-26 - 2005-11-07 - 2005-11-26 - - - - - pear-PEAR -- PEAR installer arbitrary code execution vulnerability - - - pear-PEAR - 1.4.3 - - - - -

Gregory Beaver reports:

-
-

A standard feature of the PEAR installer implemented in - all versions of PEAR can lead to the execution of - arbitrary PHP code upon running the "pear" command - or loading the Web/Gtk frontend.

-

To be vulnerable, a user must explicitly install a - publicly released malicious package using the PEAR - installer, or explicitly install a package that depends on - a malicious package.

-
- - - - http://pear.php.net/advisory-20051104.txt - - - 2005-11-01 - 2005-11-04 - - - - - openvpn -- potential denial-of-service on servers in TCP mode - - - openvpn - 2.02.0.4 - - - - -

James Yonan reports:

-
-

If the TCP server accept() call returns an error status, the - resulting exception handler may attempt to indirect through a NULL - pointer, causing a segfault. Affects all OpenVPN 2.0 versions.

-
- - - - CVE-2005-3409 - http://openvpn.net/changelog.html - - - 2005-11-01 - 2005-11-01 - 2005-11-04 - - - - - openvpn -- arbitrary code execution on client through malicious or compromised server - - - openvpn - 2.02.0.4 - - - - -

James Yonan reports:

-
-

A format string vulnerability - in the foreign_option function in options.c could - potentially allow a malicious or compromised server - to execute arbitrary code on the client. Only - non-Windows clients are affected. The vulnerability - only exists if (a) the client's TLS negotiation with - the server succeeds, (b) the server is malicious or - has been compromised such that it is configured to - push a maliciously crafted options string to the client, - and (c) the client indicates its willingness to accept - pushed options from the server by having "pull" or - "client" in its configuration file (Credit: Vade79).

-
- - - - CVE-2005-3393 - http://www.securityfocus.com/archive/1/415293/30/0/threaded - http://openvpn.net/changelog.html - - - 2005-10-31 - 2005-11-01 - 2005-11-04 - - - - - PHP -- multiple vulnerabilities - - - mod_php4-twig - php4-cgi - php4-cli - php4-dtc - php4-horde - php4-nms - php4 - 4.4.1 - - - mod_php - mod_php4 - 44.4.1,1 - - - - -

A Secunia Advisory reports:

-
-

Some vulnerabilities have been reported in PHP, - which can be exploited by malicious people to conduct - cross-site scripting attacks, bypass certain security - restrictions, and potentially compromise a vulnerable - system.

-
- - - - http://secunia.com/advisories/17371/ - - - 2005-10-31 - 2005-11-01 - - - - - skype -- multiple buffer overflow vulnerabilities - - - skype - 1.2.0.18 - - - - -

A Secunia Advisory reports:

-
-

Some vulnerabilities have been reported in Skype, - which can be exploited by malicious people to cause - a DoS or to compromise a user's system.

-
- - - - CVE-2005-3265 - CVE-2005-3267 - 930345 - 668193 - http://secunia.com/advisories/17305/ - http://skype.com/security/skype-sb-2005-02.html - http://skype.com/security/skype-sb-2005-03.html - - - 2005-10-25 - 2005-11-01 - 2005-11-02 - - - - - squid -- FTP server response handling denial of service - - - squid - 2.5.11_3 - - - - -

A Secunia Advisory reports:

-
-

M.A.Young has reported a vulnerability in Squid, - which can be exploited by malicious people to cause - a DoS (Denial of Service).

-

The vulnerability is caused due to an error in - handling certain FTP server responses. This can be - exploited to crash Squid by visiting a malicious FTP - server via the proxy.

-
- - - - CVE-2005-3258 - http://secunia.com/advisories/17271/ - - - 2005-10-19 - 2005-11-01 - - - - - base -- PHP SQL injection vulnerability - - - base - 1.2.1 - - - - -

A Secunia Advisory reports:

-
-

Remco Verhoef has discovered a vulnerability in - Basic Analysis and Security Engine (BASE), which - can be exploited by malicious users to conduct SQL - injection attacks.

-
- - - - 15199 - http://secunia.com/advisories/17314/ - - - 2005-10-25 - 2005-10-31 - - - - - fetchmail -- fetchmailconf local password exposure - - - fetchmail - 6.2.5.2_1 - - - - -

The fetchmail team reports:

-
-

The fetchmailconf program before and excluding version - 1.49 opened the run control file, wrote the configuration - to it, and only then changed the mode to 0600 (rw-------). - Writing the file, which usually contains passwords, before - making it unreadable to other users, can expose sensitive - password information.

-
- - - - CVE-2005-3088 - http://www.fetchmail.info/fetchmail-SA-2005-02.txt - - - 2005-10-21 - 2005-10-30 - - - - - lynx -- remote buffer overflow - - - lynx - ja-lynx - 2.8.5_1 - 2.8.6*2.8.6d14 - - - lynx-ssl - 2.8.5_1 - - - - -

Ulf Härnhammar reports:

-
-

When Lynx connects to an NNTP server to fetch information - about the available articles in a newsgroup, it will - call a function called HTrjis() with the information - from certain article headers. The function adds missing - ESC characters to certain data, to support Asian character - sets. However, it does not check if it writes outside - of the char array buf, and that causes a remote stack-based - buffer overflow.

-
- - - CVE-2005-3120 - http://lists.grok.org.uk/pipermail/full-disclosure/2005-October/038019.html - - 2005-10-17 - 2005-10-30 - 2006-10-05 - - - - - ruby -- vulnerability in the safe level settings - - - ruby - ruby_static - 1.6.*1.6.8.2004.07.28_2 - 1.8.*1.8.2_5 - - - - -

Ruby home page reports:

-
-

The Object Oriented Scripting Language Ruby supports - safely executing an untrusted code with two mechanisms: - safe level and taint flag on objects.

-

A vulnerability has been found that allows bypassing - these mechanisms.

-

By using the vulnerability, arbitrary code can be executed - beyond the restrictions specified in each safe level. - Therefore, Ruby has to be updated on all systems that use - safe level to execute untrusted code.

-
- - - - CVE-2005-2337 - http://www.ruby-lang.org/en/20051003.html - - - 2005-10-02 - 2005-10-27 - - - - - xloadimage -- buffer overflows in NIFF image title handling - - - xloadimage - 4.1.15 - - - xli - 1.17.0_4 - - - - -

Ariel Berkman reports:

-
-

Unlike most of the supported image formats in xloadimage, - the NIFF image format can store a title name of arbitrary - length as part of the image file.

-

When xloadimage is processing a loaded image, it is - creating a new Image object and then writing the processed - image to it. At that point, it will also copy the title - from the old image to the newly created image.

-

The 'zoom', 'reduce', and 'rotate' functions are using - a fixed length buffer to construct the new title name - when an image processing is done. Since the title name - in a NIFF format is of varying length, and there are - insufficient buffer size validations, the buffer can - be overflowed.

-
- - - - 15051 - CVE-2005-3178 - http://marc.theaimsgroup.com/?l=bugtraq&m=112862493918840&w=2 - - - 2005-10-05 - 2005-10-20 - 2005-10-23 - - - - - snort -- Back Orifice preprocessor buffer overflow vulnerability - - - snort - 2.4.02.4.3 - - - - -

Jennifer Steffens reports:

-
-

The Back Orifice preprocessor contains a stack-based - buffer overflow. This vulnerability could be leveraged by - an attacker to execute code remotely on a Snort sensor - where the Back Orifice preprocessor is enabled. However, - there are a number of factors that make remote code - execution difficult to achieve across different builds of - Snort on different platforms, even on the same platform - with different compiler versions, and it is more likely - that an attacker could use the vulnerability as a denial - of service attack.

-

The Back Orifice preprocessor can be disabled by - commenting out the line "preprocessor bo" in - snort.conf. This can be done in any text editor using the - following procedure:

-
    -
  1. Locate the line "preprocessor bo"
    2. -
  2. Comment out this line by preceding it with a hash - (#). The new line will look like "#preprocessor bo"
    3. -
  3. Save the file
    4. -
  4. Restart snort
    5. -
-
- - - - 175500 - http://www.snort.org/pub-bin/snortnews.cgi#99 - http://xforce.iss.net/xforce/alerts/id/207 - - - 2005-10-18 - 2005-10-18 - - - - - WebCalendar -- remote file inclusion vulnerability - - - WebCalendar - 1.0.1 - - - - -

WebCalendar is proven vulnerable to a remote file inclusion - vulnerability. The send_reminders.php does not properly - verify the "includedir" parameter, giving remote attackers - the possibility to include local and remote files. These - files can be used by the attacker to gain access to the - system.

- - - - 14651 - CVE-2005-2717 - http://sourceforge.net/forum/forum.php?thread_id=1342085&forum_id=11587 - - - 2005-08-26 - 2005-10-15 - 2005-11-08 - - - - - gallery2 -- file disclosure vulnerability - - - gallery2 - 2.0.1 - - - - -

Michael Dipper wrote:

-
-

A vulnerability has been discovered in gallery, - which allows remote users unauthorized access to files - on the webserver.

-

A remote user accessing gallery over the web may use - specially crafted HTTP parameters to access arbitrary - files located on the webserver. All files readable by - the webserver process are subject to disclosure. - The vulnerability is *not* restricted to the webserver's - document root but extends to the whole server file space.

-

The vulnerability may be used by any anonymous user, - there is no login to the application required.

-
- - - - 15108 - CVE-2005-3251 - http://dipper.info/security/20051012/ - - - 2005-10-12 - 2005-10-15 - 2005-11-08 - - - - - openssl -- potential SSL 2.0 rollback - - - openssl - openssl-overwrite-base - 0.9.7g - 0.9.80.9.8_1 - 0.9.*_200503250.9.*_20051011 - - - openssl-beta - openssl-beta-overwrite-base - 0.9.8_1 - 0.9.*_200503250.9.*_20051011 - - - compat5x-alpha - compat5x-amd64 - compat5x-i386 - compat5x-sparc64 - 5.4.0.8 - - - FreeBSD - 4.10_19 - 4.114.11_13 - 5.35.3_23 - 5.45.4_8 - - - - -

Vulnerability:

-
-

Such applications are affected if they use the option - SSL_OP_MSIE_SSLV2_RSA_PADDING. This option is implied by use of - SSL_OP_ALL, which is intended to work around various bugs in - third-party software that might prevent interoperability. The - SSL_OP_MSIE_SSLV2_RSA_PADDING option disables a verification step in - the SSL 2.0 server supposed to prevent active protocol-version - rollback attacks. With this verification step disabled, an attacker - acting as a "man in the middle" can force a client and a server to - negotiate the SSL 2.0 protocol even if these parties both support - SSL 3.0 or TLS 1.0. The SSL 2.0 protocol is known to have severe - cryptographic weaknesses and is supported as a fallback only.

-

Applications using neither SSL_OP_MSIE_SSLV2_RSA_PADDING nor - SSL_OP_ALL are not affected. Also, applications that disable - use of SSL 2.0 are not affected.

-
- - - - SA-05:21.openssl - CVE-2005-2969 - http://www.openssl.org/news/secadv_20051011.txt - - - 2005-10-11 - 2005-10-12 - 2005-10-25 - - - - - phpmyadmin -- local file inclusion vulnerability - - - phpMyAdmin - 2.6.4.r12.6.4.1 - - - - -

A phpMyAdmin security announcement reports:

-
-

In libraries/grab_globals.lib.php, the $__redirect - parameter was not correctly validated, opening the door to - a local file inclusion attack.

-

We consider this vulnerability to be serious.

-
- - - - 15053 - http://marc.theaimsgroup.com/?l=bugtraq&m=112907764728209 - http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-4 - - - 2005-10-11 - 2005-10-11 - 2005-10-13 - - - - - zope -- expose RestructuredText functionality to untrusted users - - - zope - 2.6.02.7.8 - 2.8.02.8.1_2 - - - - -

A Zope Hotfix Alert reports:

-
-

This hotfix resolves a security issue with docutils.

-

Affected are possibly all Zope instances that expose - RestructuredText functionalies to untrusted users through - the web.

-
- - - - CVE-2005-3323 - 15082 - http://www.zope.org/Products/Zope/Hotfix_2005-10-09/security_alert - - - 2005-10-09 - 2005-10-11 - 2005-11-28 - - - - - libxine -- format string vulnerability - - - libxine - 1.1.0_1 - - - - -

Gentoo Linux Security Advisory reports:

-
-

Ulf Harnhammar discovered a format string bug in the routines - handling CDDB server response contents.

-

An attacker could submit malicious information about an audio - CD to a public CDDB server (or impersonate a public CDDB server). - When the victim plays this CD on a multimedia frontend relying - on xine-lib, it could end up executing arbitrary code.

-
- - - - CVE-2005-2967 - http://www.gentoo.org/security/en/glsa/glsa-200510-08.xml - http://xinehq.de/index.php/security/XSA-2005-1 - - - 2005-10-08 - 2005-10-09 - - - - - imap-uw -- mailbox name handling remote buffer vulnerability - - - imap-uw - 2004g - - - - -

FrSIRT reports:

-
-

A vulnerability has been identified in UW-IMAP, which could - be exploited by remote attackers to execute arbitrary commands. - This flaw is due to a stack overflow error in the - "mail_valid_net_parse_work()" [src/c-client/mail.c] function that - does not properly handle specially crafted mailbox names containing - a quote (") character, which could be exploited by authenticated - remote attackers to execute arbitrary commands with the privileges - of the IMAP server.

-
- - - - CVE-2005-2933 - http://www.frsirt.com/english/advisories/2005/1953 - http://www.idefense.com/application/poi/display?id=313&type=vulnerabilities - http://www.washington.edu/imap/documentation/RELNOTES.html - - - 2005-10-05 - 2005-10-05 - - - - - weex -- remote format string vulnerability - - - weex - 2.6.1.5_1 - - - - -

Emanuel Haupt reports:

-
-

Someone who controls an FTP server that weex will log in to - can set up malicious data in the account that weex will use, - and that will cause a format string bug that will allow remote - code execution. It will only happen when weex is first run or - when its cache files are rebuilt with the -r option, - though. The vulnerability was found by Ulf Harnhammar.

-
- - - - ports/86833 - - - 2005-10-02 - 2005-10-02 - - - - - picasm -- buffer overflow vulnerability - - - picasm - 1.12c - - - - -

Shaun Colley reports:

-
-

When generating error and warning messages, picasm copies - strings into fixed length buffers without bounds - checking.

-

If an attacker could trick a user into assembling a - source file with a malformed 'error' directive, arbitrary - code could be executed with the privileges of the user. - This could result in full system compromise.

-
- - - - 13698 - CVE-2005-1679 - http://marc.theaimsgroup.com/?l=bugtraq&m=111661253517089 - - - 2005-05-20 - 2005-10-02 - - - - - uim -- privilege escalation vulnerability - - - ja-uim - 0.4.9.1 - - - - -

The uim developers reports:

-
-

Masanari Yamamoto discovered that incorrect use - of environment variables in uim. This bug causes - privilege escalation if setuid/setgid applications - was linked to libuim.

-

This bug appears in 'immodule for Qt' enabled Qt. - (Normal Qt is also safe.) In some distribution, - mlterm is also an setuid/setgid application.

-
- - - - http://lists.freedesktop.org/archives/uim/2005-September/001346.html - - - 2005-09-28 - 2005-10-01 - - - - - cfengine -- arbitrary file overwriting vulnerability - - - cfengine - 2.1.6_1 - - - cfengine2 - 0 - - - - -

A Debian Security Advisory reports:

-
-

Javier Fernández-Sanguino Peña discovered several - insecure temporary file uses in cfengine, a tool for - configuring and maintaining networked machines, that can - be exploited by a symlink attack to overwrite arbitrary - files owned by the user executing cfengine, which is - probably root.

-
- - - - CVE-2005-2960 - 14994 - http://www.debian.org/security/2005/dsa-835 - http://www.debian.org/security/2005/dsa-836 - - - 2005-10-01 - 2005-10-01 - 2005-10-07 - - - - - clamav -- arbitrary code execution and DoS vulnerabilities - - - clamav - 0.87 - - - clamav-devel - 20050917 - - - - -

Gentoo Linux Security Advisory reports:

-
-

Clam AntiVirus is vulnerable to a buffer overflow in - "libclamav/upx.c" when processing malformed UPX-packed - executables. It can also be sent into an infinite loop in - "libclamav/fsg.c" when processing specially-crafted - FSG-packed executables.

-

By sending a specially-crafted file an attacker could - execute arbitrary code with the permissions of the user - running Clam AntiVirus, or cause a Denial of Service.

-
- - - - 363713 - CVE-2005-2919 - CVE-2005-2920 - http://www.gentoo.org/security/en/glsa/glsa-200509-13.xml - - - 2005-09-16 - 2005-09-24 - 2005-10-22 - - - - - firefox & mozilla -- multiple vulnerabilities - - - firefox - 1.0.7,1 - - - linux-firefox - 1.0.7 - - - mozilla - 1.7.12,2 - 1.8.*,2 - - - linux-mozilla - 1.7.12 - - - linux-mozilla-devel - 0 - - - netscape7 - 0 - - - - de-linux-mozillafirebird - el-linux-mozillafirebird - ja-linux-mozillafirebird-gtk1 - ja-mozillafirebird-gtk2 - linux-mozillafirebird - ru-linux-mozillafirebird - zhCN-linux-mozillafirebird - zhTW-linux-mozillafirebird - 0 - - - - de-linux-netscape - de-netscape7 - fr-linux-netscape - fr-netscape7 - ja-linux-netscape - ja-netscape7 - linux-netscape - linux-phoenix - mozilla+ipv6 - mozilla-embedded - mozilla-firebird - mozilla-gtk1 - mozilla-gtk2 - mozilla-gtk - mozilla-thunderbird - phoenix - pt_BR-netscape7 - 0 - - - - -

A Mozilla Foundation Security Advisory reports of multiple - issues:

-
-

Heap overrun in XBM image processing

-

jackerror reports that an improperly terminated XBM image - ending with space characters instead of the expected end - tag can lead to a heap buffer overrun. This appears to be - exploitable to install or run malicious code on the user's - machine.

-

Thunderbird does not support the XBM format and is not - affected by this flaw.

-

Crash on "zero-width non-joiner" sequence

-

Mats Palmgren discovered that a reported crash on Unicode - sequences with "zero-width non-joiner" characters was due - to stack corruption that may be exploitable.

-

XMLHttpRequest header spoofing

-

It was possible to add illegal and malformed headers to - an XMLHttpRequest. This could have been used to exploit - server or proxy flaws from the user's machine, or to fool - a server or proxy into thinking a single request was a - stream of separate requests. The severity of this - vulnerability depends on the value of servers which might - be vulnerable to HTTP request smuggling and similar - attacks, or which share an IP address (virtual hosting) - with the attacker's page.

-

For users connecting to the web through a proxy this flaw - could be used to bypass the same-origin restriction on - XMLHttpRequests by fooling the proxy into handling a - single request as multiple pipe-lined requests directed at - arbitrary hosts. This could be used, for example, to read - files on intranet servers behind a firewall.

-

Object spoofing using XBL <implements>

-

moz_bug_r_a4 demonstrated a DOM object spoofing bug - similar to MFSA - 2005-55 using an XBL control that <implements> - an internal interface. The severity depends on the version - of Firefox: investigation so far indicates Firefox 1.0.x - releases don't expose any vulnerable functionality to - interfaces spoofed in this way, but that early Deer Park - Alpha 1 versions did.

-

XBL was changed to no longer allow unprivileged controls - from web content to implement XPCOM interfaces.

-

JavaScript integer overflow

-

Georgi Guninski reported an integer overflow in the - JavaScript engine. We presume this could be exploited to - run arbitrary code under favorable conditions.

-

Privilege escalation using about: scheme

-

heatsync and shutdown report two different ways to bypass - the restriction on loading high privileged "chrome" pages - from an unprivileged "about:" page. By itself this is - harmless--once the "about" page's privilege is raised the - original page no longer has access--but should this be - combined with a same-origin violation this could lead to - arbitrary code execution.

-

Chrome window spoofing

-

moz_bug_r_a4 demonstrates a way to get a blank "chrome" - canvas by opening a window from a reference to a closed - window. The resulting window is not privileged, but the - normal browser UI is missing and can be used to construct - a spoof page without any of the safety features of the - browser chrome designed to alert users to phishing sites, - such as the address bar and the status bar.

-
- - - - CVE-2005-2701 - CVE-2005-2702 - CVE-2005-2703 - CVE-2005-2704 - CVE-2005-2705 - CVE-2005-2706 - CVE-2005-2707 - http://www.mozilla.org/security/announce/mfsa2005-58.html - - - 2005-09-22 - 2005-09-23 - 2005-10-26 - - - - - firefox & mozilla -- command line URL shell command injection - - - firefox - 1.0.7,1 - - - linux-firefox - 1.0.7 - - - mozilla - 1.7.12,2 - 1.8.*,2 - - - linux-mozilla - 1.7.12 - - - linux-mozilla-devel - 0 - - - netscape7 - 0 - - - - de-linux-mozillafirebird - el-linux-mozillafirebird - ja-linux-mozillafirebird-gtk1 - ja-mozillafirebird-gtk2 - linux-mozillafirebird - ru-linux-mozillafirebird - zhCN-linux-mozillafirebird - zhTW-linux-mozillafirebird - 0 - - - - de-linux-netscape - de-netscape7 - fr-linux-netscape - fr-netscape7 - ja-linux-netscape - ja-netscape7 - linux-netscape - linux-phoenix - mozilla+ipv6 - mozilla-embedded - mozilla-firebird - mozilla-gtk1 - mozilla-gtk2 - mozilla-gtk - mozilla-thunderbird - phoenix - pt_BR-netscape7 - 0 - - - - -

A Secunia Advisory reports:

-
-

Peter Zelezny has discovered a vulnerability in Firefox, - which can be exploited by malicious people to compromise a - user's system.

-

The vulnerability is caused due to the shell script used - to launch Firefox parsing shell commands that are enclosed - within backticks in the URL provided via the command - line. This can e.g. be exploited to execute arbitrary - shell commands by tricking a user into following a - malicious link in an external application which uses - Firefox as the default browser.

-
- - - - CVE-2005-2968 - https://bugzilla.mozilla.org/show_bug.cgi?id=307185 - http://secunia.com/advisories/16869/ - http://www.mozilla.org/security/announce/mfsa2005-59.html - - - 2005-09-06 - 2005-09-22 - 2005-10-26 - - - - - apache -- Certificate Revocation List (CRL) off-by-one vulnerability - - - apache - 2.*2.0.54_1 - - - - -

Marc Stern reports an off-by-one vulnerability in within - mod_ssl. The vulnerability lies in mod_ssl's Certificate - Revocation List (CRL). If Apache is configured to use a - CRL this could allow an attacker to crash a child process - causing a Denial of Service.

- - - - 14366 - CVE-2005-1268 - - - 2005-07-12 - 2005-09-17 - - - - - squirrelmail -- _$POST variable handling allows for various attacks - - - squirrelmail - ja-squirrelmail - 1.4.01.4.5 - - - - -

A Squirrelmail Advisory reports:

-
-

An extract($_POST) was done in options_identities.php which - allowed for an attacker to set random variables in that - file. This could lead to the reading (and possible - writing) of other people's preferences, cross site scripting - or writing files in webserver-writable locations.

-
- - - - 14254 - CVE-2005-2095 - http://www.squirrelmail.org/security/issue/2005-07-13 - - - 2005-07-13 - 2005-09-17 - 2005-09-19 - - - - - X11 server -- pixmap allocation vulnerability - - - XFree86-Server - 4.5.0_2 - - - xorg-server - 6.8.2_5 - 6.8.996.8.99.12_1 - - - - -

Allocating large pixmaps by a client can trigger an integer - overflow in the X server, potentially leading to execution of - arbitrary code with elevated (root) privileges.

- - - - 14807 - 102441 - CVE-2005-2495 - https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=166856 - https://bugs.freedesktop.org/show_bug.cgi?id=594 - - - 2005-09-12 - 2005-09-15 - - - - - unzip -- permission race vulnerability - - - unzip - zh-unzip - ko-unzip - 5.52_2 - - - - -

Imran Ghory reports a vulnerability within unzip. The - vulnerability is caused by a race condition between - extracting an archive and changing the permissions of the - extracted files. This would give an attacker enough time to - remove a file and hardlink it to another file owned by the - user running unzip. When unzip changes the permissions of - the file it could give the attacker access to files that - normally would not have been accessible for others.

- - - - 14450 - CVE-2005-2475 - http://marc.theaimsgroup.com/?l=bugtraq&m=112300046224117 - - - 2005-08-02 - 2005-09-13 - - - - - firefox & mozilla -- buffer overflow vulnerability - - - firefox - 1.0.6_5,1 - - - linux-firefox - 1.0.7 - - - mozilla - 1.7.11_1,2 - 1.8.*,21.8.b1_5,2 - - - linux-mozilla - 1.7.12 - - - linux-mozilla-devel - 0 - - - netscape7 - 0 - - - - de-linux-mozillafirebird - el-linux-mozillafirebird - ja-linux-mozillafirebird-gtk1 - ja-mozillafirebird-gtk2 - linux-mozillafirebird - ru-linux-mozillafirebird - zhCN-linux-mozillafirebird - zhTW-linux-mozillafirebird - 0 - - - - de-linux-netscape - de-netscape7 - fr-linux-netscape - fr-netscape7 - ja-linux-netscape - ja-netscape7 - linux-netscape - linux-phoenix - mozilla+ipv6 - mozilla-embedded - mozilla-firebird - mozilla-gtk1 - mozilla-gtk2 - mozilla-gtk - mozilla-thunderbird - phoenix - pt_BR-netscape7 - 0 - - - - -

Tom Ferris reports:

-
-

A buffer overflow vulnerability exists within Firefox - version 1.0.6 and all other prior versions which allows - for an attacker to remotely execute arbitrary code on an - affected host.

-

The problem seems to be when a hostname which has all - dashes causes the NormalizeIDN call in - nsStandardURL::BuildNormalizedSpec to return true, but is - sets encHost to an empty string. Meaning, Firefox appends - 0 to approxLen and then appends the long string of dashes - to the buffer instead.

-
-

Note: It is possible to disable IDN - support as a workaround to protect against this buffer - overflow. How to do this is described on the What Firefox - and Mozilla users should know about the IDN buffer overflow - security issue web page.

- - - - 14784 - 573857 - CVE-2005-2871 - http://marc.theaimsgroup.com/?l=full-disclosure&m=112624614008387 - http://www.mozilla.org/security/idn.html - https://bugzilla.mozilla.org/show_bug.cgi?id=307259 - http://www.mozilla.org/security/announce/mfsa2005-57.html - - - 2005-09-08 - 2005-09-10 - 2005-10-26 - - - - - htdig -- cross site scripting vulnerability - - - htdig - 3.2.0.b6_1 - - - - -

Michael Krax reports a vulnerability within htdig. The - vulnerability lies within an unsanitized config parameter, - allowing a malicious attacker to execute arbitrary scripting - code on the target's browser. This might allow the attacker - to obtain the user's cookies which are associated with the - site, including cookies used for authentication.

- - - - 12442 - CVE-2005-0085 - http://www.securitytracker.com/alerts/2005/Feb/1013078.html - - - 2005-02-03 - 2005-09-04 - 2005-09-13 - - - - - squid -- Denial Of Service Vulnerability in sslConnectTimeout - - - squid - 2.5.10_5 - - - - -

The squid patches page notes:

-
-

After certain slightly odd requests Squid crashes with a - segmentation fault in sslConnectTimeout.

-
- - - - 14731 - CVE-2005-2796 - http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE10-sslConnectTimeout - http://www.squid-cache.org/bugs/show_bug.cgi?id=1355 - http://secunia.com/advisories/16674/ - - - 2005-07-21 - 2005-09-04 - 2005-10-02 - - - - - squid -- Possible Denial Of Service Vulnerability in store.c - - - squid - 2.5.10_5 - - - - -

The squid patches page notes:

-
-

Squid crashes with the above assertion failure [assertion failed: - store.c:523: "e->store_status == STORE_PENDING"] in certain - conditions involving aborted requests.

-
- - - - 14761 - CVE-2005-2794 - http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE10-STORE_PENDING - http://www.squid-cache.org/bugs/show_bug.cgi?id=1368 - http://secunia.com/advisories/16708/ - - - 2005-08-02 - 2005-09-04 - 2005-10-02 - - - - - bind9 -- denial of service - - - bind9 - 9.3.0 - - - FreeBSD - 5.35.3_16 - - - - -

Problem description

-

A DNSSEC-related validator function in BIND 9.3.0 contains an - inappropriate internal consistency test. When this test is - triggered, named(8) will exit.

-

Impact

-

On systems with DNSSEC enabled, a remote attacker may be able - to inject a specially crafted packet that will cause the - internal consistency test to trigger, and named(8) to - terminate. As a result, the name server will no longer be - available to service requests.

-

Workaround

-

DNSSEC is not enabled by default, and the "dnssec-enable" - directive is not normally present. If DNSSEC has been - enabled, disable it by changing the "dnssec-enable" directive - to "dnssec-enable no;" in the named.conf(5) configuration - file.

- - - - 938617 - CVE-2005-0034 - http://www.uniras.gov.uk/niscc/docs/al-20050125-00060.html?lang=en - http://www.isc.org/sw/bind/bind9.3.php#security - - - 2005-01-25 - 2005-09-03 - - - - - bind -- buffer overrun vulnerability - - - bind84 - 8.4.48.4.6 - - - - -

An ISC advisory reports a buffer overrun vulnerability within - bind. The vulnerability could result in a Denial of Service. - A workaround is available by disabling recursion and glue - fetching.

- - - - 327633 - CVE-2005-0033 - http://www.uniras.gov.uk/niscc/docs/al-20050125-00059.html?lang=en - http://www.isc.org/sw/bind/bind-security.php - - - 2005-01-25 - 2005-09-03 - 2005-09-21 - - - - - urban -- stack overflow vulnerabilities - - - urban - 1.5.3_2 - - - - -

Several filename-related stack overflow bugs allow a local - attacker to elevate its privileges to the games group, since - urban is installed setgid games.

-

Issue discovered and fixed by <shaun@rsc.cx>.

- - - - CVE-2005-2864 - http://marc.theaimsgroup.com/?l=bugtraq&m=112604855119036 - - - 2005-09-02 - 2005-09-02 - 2005-09-22 - - - - - fswiki -- command injection vulnerability - - - fswiki - 3.5.9 - - - - -

There is a command injection vulnerability in admin page - of fswiki.

- - - - http://jvn.jp/jp/JVN%2342435855/index.html - - - 2005-08-29 - 2005-08-29 - - - - - evolution -- remote format string vulnerabilities - - - evolution - 1.52.2.3_1 - - - - -

A SITIC Vulnerability Advisory reports:

-
-

Evolution suffers from several format string bugs when - handling data from remote sources. These bugs lead to - crashes or the execution of arbitrary assembly language - code.

-
    -
  1. The first format string bug occurs when viewing the - full vCard data attached to an e-mail message.
    2. -
  2. The second format string bug occurs when displaying - contact data from remote LDAP servers.
    3. -
  3. The third format string bug occurs when displaying - task list data from remote servers.
    4. -
  4. The fourth, and least serious, format string bug - occurs when the user goes to the Calendars tab to save - task list data that is vulnerable to problem 3 - above. Other calendar entries that do not come from task - lists are also affected.
    5. -
-
- - - - 14532 - CVE-2005-2549 - CVE-2005-2550 - http://www.sitic.se/eng/advisories_and_recommendations/sa05-001.html - - - 2005-08-10 - 2005-08-27 - 2006-03-24 - - - - - pam_ldap -- authentication bypass vulnerability - - - pam_ldap - 1.8.0 - - - - -

Luke Howard reports:

-
-

If a pam_ldap client authenticates against an LDAP server - that returns a passwordPolicyResponse control, but omits - the optional "error" field of the - PasswordPolicyResponseValue, then the LDAP authentication - result will be ignored and the authentication step will - always succeed.

-
- - - - CVE-2005-2641 - 778916 - https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=166163 - - - 2005-08-22 - 2005-08-27 - - - - - pcre -- regular expression buffer overflow - - - pcre - pcre-utf8 - 6.2 - - - - -

The pcre library is vulnerable to a buffer overflow - vulnerability due to insufficient validation of quantifier - values. This could lead execution of arbitrary code with - the permissions of the program using pcre by way of a - specially crated regular expression.

- - - - 14620 - CVE-2005-2491 - http://www.pcre.org/changelog.txt - - - 2005-08-01 - 2005-08-26 - - - - - elm -- remote buffer overflow in Expires header - - - elm - 2.5.8 - - - - -

Ulf Harnhammar has discovered a remotely exploitable buffer - overflow in Elm e-mail client when parsing the Expires header - of an e-mail message:

-
-

The attacker only needs to send the victim an e-mail - message. When the victim with that message in his or her - inbox starts Elm or simply views the inbox in an already - started copy of Elm, the buffer overflow will happen - immediately. The overflow is stack-based, and it gives full - control over EIP, EBP and EBX. It is caused by a bad - sscanf(3) call, using a format string containing "%s" - to copy from a long char array to a shorter array.

-
- - - - http://archives.neohapsis.com/archives/fulldisclosure/2005-08/0688.html - - - 2005-08-20 - 2005-08-23 - - - - - openvpn -- multiple TCP clients connecting with the same certificate at the same time can crash the server - - - openvpn - 2.0.1 - - - - -

James Yonan reports:

-
-

If two or more client machines try to connect to the server - at the same time via TCP, using the same client certificate, - and when --duplicate-cn is not enabled on the server, a race - condition can crash the server with "Assertion failed at - mtcp.c:411"

-
- - - - CVE-2005-2534 - http://openvpn.net/changelog.html - - - 2005-08-03 - 2005-08-19 - - - - - openvpn -- denial of service: malicious authenticated "tap" client can deplete server virtual memory - - - openvpn - 2.0.1 - - - - -

James Yonan reports:

-
-

A malicious [authenticated] client in "dev tap" - ethernet bridging mode could theoretically flood the server - with packets appearing to come from hundreds of thousands - of different MAC addresses, causing the OpenVPN process to - deplete system virtual memory as it expands its internal - routing table.

-
- - - - CVE-2005-2533 - http://openvpn.net/changelog.html - - - 2005-07-27 - 2005-08-19 - - - - - openvpn -- denial of service: undecryptable packet from authorized client can disconnect unrelated clients - - - openvpn - 2.0.1 - - - - -

James Yonan reports:

-
-

If the client sends a packet which fails to decrypt on the - server, the OpenSSL error queue is not properly flushed, - which can result in another unrelated client instance on the - server seeing the error and responding to it, resulting in - disconnection of the unrelated client.

-
- - - - CVE-2005-2532 - http://openvpn.net/changelog.html - - - 2005-07-27 - 2005-08-19 - - - - - openvpn -- denial of service: client certificate validation can disconnect unrelated clients - - - openvpn - 2.0.1 - - - - -

James Yonan reports:

-
-

DoS attack against server when run with "verb 0" and - without "tls-auth". If a client connection to the server - fails certificate verification, the OpenSSL error queue is - not properly flushed, which can result in another unrelated - client instance on the server seeing the error and - responding to it, resulting in disconnection of the - unrelated client.

-
- - - - CVE-2005-2531 - http://openvpn.net/changelog.html - - - 2005-08-03 - 2005-08-19 - - - - - tor -- diffie-hellman handshake flaw - - - tor - 0.1.0.14 - - - - -

A tor advisory reports

-
-

Tor clients can completely loose anonymity, confidentiality, - and data integrity if the first Tor server in their path is - malicious. Specifically, if the Tor client chooses a - malicious Tor server for her first hop in the circuit, that - server can learn all the keys she negotiates for the rest of - the circuit (or just spoof the whole circuit), and then read - and/or modify all her traffic over that circuit.

-
- - - - CVE-2005-2643 - http://archives.seul.org/or/announce/Aug-2005/msg00002.html - - - 2005-08-11 - 2005-08-17 - 2005-09-21 - - - - - acroread -- plug-in buffer overflow vulnerability - - - acroread - 7.0.1 - 5.*,17.0.1,1 - - - acroread4 - acroread5 - 0 - - - acroread7 - 7.0.1 - - - - -

A Adobe Security Advisory reports:

-
-

The identified vulnerability is a buffer overflow within - a core application plug-in, which is part of Adobe Acrobat - and Adobe Reader. If a malicious file were opened it could - trigger a buffer overflow as the file is being loaded into - Adobe Acrobat and Adobe Reader. A buffer overflow can - cause the application to crash and increase the risk of - malicious code execution.

-
- - - - CVE-2005-2470 - http://www.adobe.com/support/techdocs/321644.html - - - 2005-08-16 - 2005-08-16 - - - - - pear-XML_RPC -- remote PHP code injection vulnerability - - - pear-XML_RPC - 1.4.0 - - - phpmyfaq - 1.4.11 - - - drupal - 4.6.3 - - - eGroupWare - 1.0.0.009 - - - phpAdsNew - 2.0.5 - - - phpgroupware - 0.9.16.007 - - - b2evolution - 0.9.0.12_2 - - - - -

A Hardened-PHP Project Security Advisory reports:

-
-

When the library parses XMLRPC requests/responses, it constructs - a string of PHP code, that is later evaluated. This means any - failure to properly handle the construction of this string can - result in arbitrary execution of PHP code.

-

This new injection vulnerability is cause by not properly - handling the situation, when certain XML tags are nested - in the parsed document, that were never meant to be nested - at all. This can be easily exploited in a way, that - user-input is placed outside of string delimiters within - the evaluation string, which obviously results in - arbitrary code execution.

-
-

Note that several applications contains an embedded version - on XML_RPC, therefor making them the vulnerable to the same - code injection vulnerability.

- - - - CVE-2005-2498 - http://b2evolution.net/news/2005/08/31/fix_for_xml_rpc_vulnerability_again_1 - http://downloads.phpgroupware.org/changelog - http://drupal.org/files/sa-2005-004/advisory.txt - http://phpadsnew.com/two/nucleus/index.php?itemid=45 - http://sourceforge.net/project/shownotes.php?release_id=349626 - http://www.hardened-php.net/advisory_142005.66.html - http://www.hardened-php.net/advisory_152005.67.html - http://www.phpmyfaq.de/advisory_2005-08-15.php - - - 2005-08-15 - 2005-08-15 - 2005-09-04 - - - - - awstats -- arbitrary code execution vulnerability - - - awstats - 6.4_1 - - - - -

An iDEFENSE Security Advisory reports:

-
-

Remote exploitation of an input validation vulnerability - in AWStats allows remote attackers to execute arbitrary - commands.

- -

The problem specifically exists because of insufficient - input filtering before passing user-supplied data to an - eval() function. As part of the statistics - reporting function, AWStats displays information about the - most common referrer values that caused users to visit the - website. The referrer data is used without proper - sanitation in an eval() statement, resulting - in the execution of arbitrary perl code.

- -

Successful exploitation results in the execution of - arbitrary commands with permissions of the web - service. Exploitation will not occur until the stats page - has been regenerated with the tainted referrer values from - the http access log. Note that AWStats is only vulnerable - in situations where at least one URLPlugin is enabled.

-
- - - - CVE-2005-1527 - http://marc.theaimsgroup.com/?l=full-disclosure&m=112377934108902 - http://www.idefense.com/application/poi/display?id=290&type=vulnerabilities - - - 2005-08-09 - 2005-08-14 - 2005-08-23 - - - - - libgadu -- multiple vulnerabilities - - - gaim - ja-gaim - ko-gaim - ru-gaim - 1.4.0_1 - - - kdenetwork - 3.2.23.4.2 - - - pl-ekg - 1.6r3,1 - - - centericq - 4.21.0_1 - - - - -

Wojtek Kaniewski reports:

-
-

Multiple vulnerabilities have been found in libgadu, a - library for handling Gadu-Gadu instant messaging - protocol. It is a part of ekg, a Gadu-Gadu client, but is - widely used in other clients. Also some of the user - contributed scripts were found to behave in an insecure - manner.

-
    -
  • integer overflow in libgadu (CVE-2005-1852) that could - be triggered by an incomming message and lead to - application crash and/or remote code execution
    • -
  • insecure file creation (CVE-2005-1850) and shell - command injection (CVE-2005-1851) in other user - contributed scripts (discovered by Marcin Owsiany and - Wojtek Kaniewski)
    • -
  • several signedness errors in libgadu that could be - triggered by an incomming network data or an application - passing invalid user input to the library
    • -
  • memory alignment errors in libgadu that could be - triggered by an incomming message and lead to bus errors - on architectures like SPARC
    • -
  • endianness errors in libgadu that could cause invalid - behaviour of applications on big-endian - architectures
    • -
-
- - - - 14345 - CVE-2005-1850 - CVE-2005-1851 - CVE-2005-1852 - CVE-2005-2369 - CVE-2005-2370 - CVE-2005-2448 - http://marc.theaimsgroup.com/?l=bugtraq&m=112198499417250 - http://gaim.sourceforge.net/security/?id=20 - http://www.kde.org/info/security/advisory-20050721-1.txt - - - 2005-07-21 - 2005-08-12 - 2005-10-23 - - - - - gaim -- AIM/ICQ non-UTF-8 filename crash - - - gaim - ja-gaim - ko-gaim - ru-gaim - 1.4.0_1 - - - - -

The GAIM team reports:

-
-

A remote user could cause Gaim to crash on some systems - by sending the Gaim user a file whose filename contains - certain invalid characters. It is unknown what combination - of systems are affected, but it is suspected that Windows - users and systems with older versions of GTK+ are - especially susceptible.

-
- - - - CVE-2005-2102 - http://gaim.sourceforge.net/security/?id=21 - - - 2005-08-09 - 2005-08-12 - - - - - gaim -- AIM/ICQ away message buffer overflow - - - gaim - ja-gaim - ko-gaim - ru-gaim - 1.4.0_1 - - - - -

The GAIM team reports:

-
-

A remote AIM or ICQ user can cause a buffer overflow in - Gaim by setting an away message containing many AIM - substitution strings (such as %t or %n).

-
- - - - CVE-2005-2103 - http://gaim.sourceforge.net/security/?id=22 - - - 2005-08-09 - 2005-08-12 - - - - - xpdf -- disk fill DoS vulnerability - - - xpdf - 3.00_7 - - - kdegraphics - 3.4.2 - - - gpdf - 2.10.0_2 - - - cups-base - 1.1.23.0_5 - - - - -

xpdf is vulnerable to a denial of service vulnerability - which can cause xpdf to create an infinitely large file, - thereby filling up the /tmp partition, when opening a - specially crafted PDF file.

-

Note that several applications contains an embedded version - of xpdf, therefor making them the vulnerable to the same - DoS. In CUPS this vulnerability would cause the pdftops - filter to crash.

- - - - 14529 - CVE-2005-2097 - http://rhn.redhat.com/errata/RHSA-2005-670.html - http://www.kde.org/info/security/advisory-20050809-1.txt - - - 2005-08-09 - 2005-08-12 - 2005-09-07 - - - - - gforge -- XSS and email flood vulnerabilities - - - gforge - 0 - - - - -

Jose Antonio Coret reports that GForge contains multiple - Cross Site Scripting vulnerabilities and an e-mail flood - vulnerability:

-
-

The login form is also vulnerable to XSS (Cross Site - Scripting) attacks. This may be used to launch phising - attacks by sending HTML e-mails (i.e.: saying that you - need to upgrade to the latest GForge version due to a - security problem) and putting in the e-mail an HTML link - that points to an specially crafted url that inserts an - html form in the GForge login page and when the user press - the login button, he/she send the credentials to the - attackers website.

- -

The 'forgot your password?' feature allows a remote user - to load a certain URL to cause the service to send a - validation e-mail to the specified user's e-mail address. - There is no limit to the number of messages sent over a - period of time, so a remote user can flood the target - user's secondary e-mail address. E-Mail Flood, E-Mail - bomber.

-
- - - - 14405 - CVE-2005-2430 - CVE-2005-2431 - http://marc.theaimsgroup.com/?l=bugtraq&m=112259845904350 - - - 2005-07-27 - 2005-08-09 - - - - - postnuke -- multiple vulnerabilities - - - postnuke - 0.760 - - - - -

Postnuke Security Announcementss reports of the following - vulnerabilities:

-
-
    -
  • missing input validation within /modules/Messages/readpmsg.php
    • -
  • possible path disclosure within /user.php
    • -
  • possible path disclosure within /modules/News/article.php
    • -
  • possible remote code injection within /includes/pnMod.php
    • -
  • possible cross-site-scripting in /index.php
    • -
-
-
-
    -
  • remote code injection via xml rpc library
    • -
-
- - - - CVE-2005-1621 - CVE-2005-1695 - CVE-2005-1696 - CVE-2005-1698 - CVE-2005-1777 - CVE-2005-1778 - CVE-2005-1921 - http://marc.theaimsgroup.com/?l=bugtraq&m=111721364707520 - http://secunia.com/advisories/15450/ - http://news.postnuke.com/Article2691.html - http://news.postnuke.com/Article2699.html - - - 2005-05-27 - 2005-08-08 - - - - - mambo -- multiple vulnerabilities - - - mambo - 4.5.2.3 - - - - -

A Secunia Advisory reports:

-
-

Some vulnerabilities have been reported in Mambo, where - some have unknown impacts and others can be exploited by - malicious people to conduct spoofing and SQL injection - attacks.

-
    -
  1. Input passed to the "user_rating" parameter when - voting isn't properly sanitised before being used in a - SQL query. This can be exploited to manipulate SQL - queries by injecting arbitrary SQL code.
    2. -
  2. Some unspecified vulnerabilities in the "mosDBTable" - class and the "DOMIT" library have an unknown - impact.
    3. -
  3. An unspecified error in the "administrator/index3.php" - script can be exploited to spoof session IDs.
    4. -
-
- - - - 13966 - CVE-2005-2002 - http://secunia.com/advisories/15710/ - - - 2005-06-15 - 2005-08-05 - - - - - ipsec -- Incorrect key usage in AES-XCBC-MAC - - - FreeBSD - 5.45.4_6 - 5.*5.3_20 - - - - -

Problem description

-

A programming error in the implementation of the - AES-XCBC-MAC algorithm for authentication resulted in a - constant key being used instead of the key specified by the - system administrator.

-

Impact

-

If the AES-XCBC-MAC algorithm is used for authentication in - the absence of any encryption, then an attacker may be able to - forge packets which appear to originate from a different - system and thereby succeed in establishing an IPsec session. - If access to sensitive information or systems is controlled - based on the identity of the source system, this may result - in information disclosure or privilege escalation.

- - - - CVE-2005-2359 - SA-05:19.ipsec - - - 2005-07-27 - 2005-08-05 - - - - - zlib -- buffer overflow vulnerability - - - linux_base-suse - 9.3_1 - - - FreeBSD - 5.45.4_6 - 5.35.3_20 - - - - -

Problem description

-

A fixed-size buffer is used in the decompression of data - streams. Due to erronous analysis performed when zlib was - written, this buffer, which was belived to be sufficiently - large to handle any possible input stream, is in fact too - small.

-

Impact

-

A carefully constructed compressed data stream can result in - zlib overwriting some data structures. This may cause - applications to halt, resulting in a denial of service; or - it may result in an attacker gaining elevated privileges.

- - - - CVE-2005-1849 - SA-05:18.zlib - - - 2005-07-27 - 2005-08-05 - 2005-09-24 - - - - - devfs -- ruleset bypass - - - FreeBSD - 5.45.4_5 - 5.*5.3_19 - - - - -

Problem description

-

Due to insufficient parameter checking of the node type - during device creation, any user can expose hidden device - nodes on devfs mounted file systems within their jail. - Device nodes will be created in the jail with their normal - default access permissions.

-

Impact

-

Jailed processes can get access to restricted resources on - the host system. For jailed processes running with superuser - privileges this implies access to all devices on the system. - This level of access can lead to information leakage and - privilege escalation.

- - - - CVE-2005-2218 - SA-05:17.devfs - - - 2005-07-20 - 2005-08-05 - - - - - proftpd -- format string vulnerabilities - - - proftpd - proftpd-mysql - 1.3.0.rc2 - - - - -

The ProFTPD release notes states:

-
-

sean <infamous42md at hotpop.com> found two format - string vulnerabilities, one in mod_sql's SQLShowInfo - directive, and one involving the 'ftpshut' utility. Both - can be considered low risk, as they require active - involvement on the part of the site administrator in order - to be exploited.

-
-

These vulnerabilities could potentially lead to information - disclosure, a denial-of-server situation, or execution of - arbitrary code with the permissions of the user running - ProFTPD.

- - - - CVE-2005-2390 - http://www.gentoo.org/security/en/glsa/glsa-200508-02.xml - http://www.proftpd.org/docs/RELEASE_NOTES-1.3.0rc2 - - - 2005-07-26 - 2005-08-03 - - - - - nbsmtp -- format string vulnerability - - - nbsmtp - 0.99_1 - - - - -

When nbsmtp is executed in debug mode, server messages - will be printed to stdout and logged via syslog. Syslog is - used insecurely and user-supplied format characters are - directly fed to the syslog function, which results in a - format string vulnerability.

-

Under some circumstances, an SMTP server may be able to - abuse this vulnerability in order to alter the nbsmtp - process and execute malicious code.

- - - - http://people.freebsd.org/~niels/issues/nbsmtp-20050726.txt - - - 2005-07-25 - 2005-08-01 - - - - - sylpheed -- MIME-encoded file name buffer overflow vulnerability - - - sylpheed - sylpheed-gtk2 - sylpheed-claws - 1.0.4 - - - - -

Sylpheed is vulnerable to a buffer overflow when displaying - emails with attachments that have MIME-encoded file names. - This could be used by a remote attacker to crash sylpheed - potentially allowing execution of arbitrary code with the - permissions of the user running sylpheed.

- - - - 12934 - CVE-2005-0926 - http://sylpheed.good-day.net/changelog.html.en - - - 2005-03-29 - 2005-07-31 - - - - - phpmyadmin -- cross site scripting vulnerability - - - phpmyadmin - phpMyAdmin - 2.6.2.r1 - - - - -

A phpMyAdmin security announcement reports:

-
-

The convcharset parameter was not correctly validated, - opening the door to a XSS attack.

-
- - - - 12982 - CVE-2005-0992 - http://marc.theaimsgroup.com/?l=bugtraq&m=111264361622660 - http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-3 - - - 2005-04-03 - 2005-07-31 - - - - - gnupg -- OpenPGP symmetric encryption vulnerability - - - gnupg - 1.4.1 - - - p5-Crypt-OpenPGP - 1.03 - - - pgp - 3.0 - - - - -

Serge Mister and Robert Zuccherato reports that the OpenPGP - protocol is vulnerable to a cryptographic attack when using - symmetric encryption in an automated way.

-

David Shaw reports about the impact:

-
-

This attack, while very significant from a cryptographic - point of view, is not generally effective in the real - world. To be specific, unless you have your OpenPGP - program set up as part of an automated system to accept - encrypted messages, decrypt them, and then provide a - response to the submitter, then this does not affect you - at all.

-
-

Note that the fix in GnuPG does note completely - eliminate the potential problem:

-
-

These patches disable a portion of the OpenPGP protocol - that the attack is exploiting. This change should not be - user visible. With the patch in place, this attack will - not work using a public-key encrypted message. It will - still work using a passphrase-encrypted message.

-
- - - - 303094 - CVE-2005-0366 - http://eprint.iacr.org/2005/033 - http://lists.gnupg.org/pipermail/gnupg-announce/2005q1/000191.html - http://www.pgp.com/newsroom/ctocorner/openpgp.html - - - 2005-02-08 - 2005-07-31 - 2007-04-23 - - - - - vim -- vulnerabilities in modeline handling: glob, expand - - - vim - vim-console - vim-lite - vim+ruby - 6.36.3.82 - - - - -

Georgi Guninski discovered a way to construct Vim modelines - that execute arbitrary shell commands. The vulnerability - can be exploited by including shell commands in modelines - that call the glob() or expand() functions. An attacker - could trick an user to read or edit a trojaned file with - modelines enabled, after which the attacker is able to - execute arbitrary commands with the privileges of the user.

-

Note: It is generally recommended that VIM - users use set nomodeline in - ~/.vimrc to avoid the possibility of trojaned - text files.

- - - - 14374 - CVE-2005-2368 - http://www.guninski.com/where_do_you_want_billg_to_go_today_5.html - - - 2005-07-25 - 2005-07-31 - - - - - tiff -- buffer overflow vulnerability - - - tiff - 3.7.3 - - - linux-tiff - 3.6.1_3 - - - pdflib - pdflib-perl - 6.0.1_2 - - - gdal - 1.2.1_2 - - - ivtools - 1.2.3 - - - paraview - 2.4.3 - - - fractorama - 1.6.7_1 - - - iv - ja-iv - ja-libimg - 0 - - - - -

A Gentoo Linux Security Advisory reports:

-
-

Tavis Ormandy of the Gentoo Linux Security Audit Team - discovered a stack based buffer overflow in the libTIFF - library when reading a TIFF image with a malformed - BitsPerSample tag.

-

Successful exploitation would require the victim to open - a specially crafted TIFF image, resulting in the execution - of arbitrary code.

-
- - - - CVE-2005-1544 - http://bugzilla.remotesensing.org/show_bug.cgi?id=843 - http://www.gentoo.org/security/en/glsa/glsa-200505-07.xml - http://www.remotesensing.org/libtiff/v3.7.3.html - - - 2005-05-10 - 2005-07-30 - 2006-06-08 - - - - - opera -- image dragging vulnerability - - - linux-opera - opera-devel - opera - 8.02 - - - - -

A Secunia Advisory reports:

-
-

Secunia Research has discovered a vulnerability in Opera, - which can be exploited by malicious people to conduct - cross-site scripting attacks and retrieve a user's - files.

-

The vulnerability is caused due to Opera allowing a user - to drag e.g. an image, which is actually a "javascript:" - URI, resulting in cross-site scripting if dropped over - another site. This may also be used to populate a file - upload form, resulting in uploading of arbitrary files to - a malicious web site.

-

Successful exploitation requires that the user is tricked - into dragging and dropping e.g. an image or a link.

-
- - - - http://secunia.com/advisories/15756/ - http://www.opera.com/freebsd/changelogs/802/ - - - 2005-07-28 - 2005-07-30 - 2006-06-08 - - - - - opera -- download dialog spoofing vulnerability - - - linux-opera - opera-devel - opera - 8.02 - - - - -

A Secunia Advisory reports:

-
-

Secunia Research has discovered a vulnerability in Opera, - which can be exploited by malicious people to trick users - into executing malicious files.

-

The vulnerability is caused due to an error in the - handling of extended ASCII codes in the download - dialog. This can be exploited to spoof the file extension - in the file download dialog via a specially crafted - "Content-Disposition" HTTP header.

-

Successful exploitation may result in users being tricked - into executing a malicious file via the download dialog, - but requires that the "Arial Unicode MS" font - (ARIALUNI.TTF) has been installed on the system.

-
- - - - http://secunia.com/advisories/15870/ - http://www.opera.com/freebsd/changelogs/802/ - - - 2005-07-28 - 2005-07-30 - - - - - ethereal -- multiple protocol dissectors vulnerabilities - - - ethereal - ethereal-lite - tethereal - tethereal-lite - 0.8.50.10.12 - - - - -

An Ethreal Security Advisories reports:

-
-

Our testing program has turned up several more security - issues:

-
    -
  • The LDAP dissector could free static memory and crash.
    • -
  • The AgentX dissector could crash.
    • -
  • The 802.3 dissector could go into an infinite loop.
    • -
  • The PER dissector could abort.
    • -
  • The DHCP dissector could go into an infinite loop.
    • -
  • The BER dissector could abort or loop infinitely.
    • -
  • The MEGACO dissector could go into an infinite loop.
    • -
  • The GIOP dissector could dereference a null pointer.
    • -
  • The SMB dissector was susceptible to a buffer overflow.
    • -
  • The WBXML could dereference a null pointer.
    • -
  • The H1 dissector could go into an infinite loop.
    • -
  • The DOCSIS dissector could cause a crash.
    • -
  • The SMPP dissector could go into an infinite loop.
    • -
  • SCTP graphs could crash.
    • -
  • The HTTP dissector could crash.
    • -
  • The SMB dissector could go into a large loop.
    • -
  • The DCERPC dissector could crash.
    • -
  • Several dissectors could crash while reassembling packets.
    • -
-

Steve Grubb at Red Hat found the following issues:

-
    -
  • The CAMEL dissector could dereference a null pointer.
    • -
  • The DHCP dissector could crash.
    • -
  • The CAMEL dissector could crash.
    • -
  • The PER dissector could crash.
    • -
  • The RADIUS dissector could crash.
    • -
  • The Telnet dissector could crash.
    • -
  • The IS-IS LSP dissector could crash.
    • -
  • The NCP dissector could crash.
    • -
-

iDEFENSE found the following issues:

-
    -
  • Several dissectors were susceptible to a format string - overflow.
    • -
-

Impact:

-

It may be possible to make Ethereal crash, use up - available memory, or run arbitrary code by injecting a - purposefully malformed packet onto the wire or by - convincing someone to read a malformed packet trace - file.

-
- - - - http://www.ethereal.com/appnotes/enpa-sa-00020.html - - - 2005-07-26 - 2005-07-30 - - - - - apache -- http request smuggling - - - apache - 1.3.33_2 - 2.*2.0.54_1 - 2.1.02.1.6_1 - - - apache+ssl - 1.3.33.1.55_1 - - - apache+mod_perl - 1.3.33_3 - - - apache+mod_ssl - apache+mod_ssl+ipv6 - apache+mod_ssl+mod_accel - apache+mod_ssl+mod_accel+ipv6 - apache+mod_ssl+mod_accel+mod_deflate - apache+mod_ssl+mod_accel+mod_deflate+ipv6 - apache+mod_ssl+mod_deflate - apache+mod_ssl+mod_deflate+ipv6 - apache+mod_ssl+mod_snmp - apache+mod_ssl+mod_snmp+mod_accel - apache+mod_ssl+mod_snmp+mod_accel+ipv6 - apache+mod_ssl+mod_snmp+mod_deflate - apache+mod_ssl+mod_snmp+mod_deflate+ipv6 - apache+mod_ssl+mod_snmp+mod_accel+mod_deflate+ipv6 - 1.3.33+2.8.22_1 - - - apache_fp - 0 - - - apache+ipv6 - 1.3.37 - - - ru-apache - 1.3.34+30.22 - - - ru-apache+mod_ssl - 1.3.34+30.22+2.8.25 - - - - -

A Watchfire whitepaper reports an vulnerability in the - Apache webserver. The vulnerability can be exploited by - malicious people causing cross site scripting, web cache - poisoining, session hijacking and most importantly the - ability to bypass web application firewall protection. - Exploiting this vulnerability requires multiple carefully - crafted HTTP requests, taking advantage of an caching server, - proxy server, web application firewall etc. This only affects - installations where Apache is used as HTTP proxy in - combination with the following web servers:

-
    -
  • IIS/6.0 and 5.0
    • -
  • Apache 2.0.45 (as web server)
    • -
  • apache 1.3.29
    • -
  • WebSphere 5.1 and 5.0
    • -
  • WebLogic 8.1 SP1
    • -
  • Oracle9iAS web server 9.0.2
    • -
  • SunONE web server 6.1 SP4
    • -
- - - - 14106 - CVE-2005-2088 - http://www.watchfire.com/resources/HTTP-Request-Smuggling.pdf - - - 2005-07-25 - 2005-07-26 - 2009-01-23 - - - - - clamav -- multiple remote buffer overflows - - - clamav - 0.86.2 - - - clamav-devel - 20050704 - - - - -

An Secunia Advisory reports:

-
-

Neel Mehta and Alex Wheeler have reported some - vulnerabilities in Clam AntiVirus, which can be exploited - by malicious people to cause a DoS (Denial of Service) - or compromise a vulnerable system.

-
    -
  1. Two integer overflow errors in "libclamav/tnef.c" - when processing TNEF files can be exploited to cause - a heap-based buffer overflow via a specially crafted - TNEF file with a length value of -1 in the header.
    2. -
  2. An integer overflow error in "libclamav/chmunpack.c" - can be exploited to cause a heap-based buffer overflow - via a specially crafted CHM file with a chunk entry that - has a filename length of -1.
    3. -
  3. A boundary error in "libclamav/fsg.c" when - processing a FSG compressed file can cause a heap-based - buffer overflow.
    4. -
-
- - - - http://www.rem0te.com/public/images/clamav.pdf - http://secunia.com/advisories/16180/ - - - 2005-07-24 - 2005-07-25 - - - - - isc-dhcpd -- format string vulnerabilities - - - isc-dhcp3-client - isc-dhcp3-devel - isc-dhcp3-relay - isc-dhcp3-server - isc-dhcp3 - isc-dhcp - isc-dhcpd - 3.0.1 - - - - -

The ISC DHCP programs are vulnerable to several format - string vulnerabilities which may allow a remote attacker to - execute arbitrary code with the permissions of the DHCP - programs, typically root for the DHCP server.

- - - - 11591 - 448384 - CVE-2004-1006 - http://marc.theaimsgroup.com/?l=dhcp-announce&m=109996073218290 - - - 2004-11-08 - 2005-07-23 - - - - - egroupware -- multiple cross-site scripting (XSS) and SQL injection vulnerabilities - - - egroupware - 1.0.0.007 - - - - -

Multiple cross-site scripting (XSS) vulnerabilities in eGroupware - before 1.0.0.007 allow remote attackers to inject arbitrary web - script or HTML via the (1) ab_id, (2) page, (3) type, - or (4) lang parameter to index.php or (5) category_id parameter. -

-

Multiple SQL injection vulnerabilities in index.php in eGroupware - before 1.0.0.007 allow remote attackers to execute arbitrary SQL - commands via the (1) filter or (2) cats_app parameter. -

- - - - CVE-2005-1202 - CVE-2005-1203 - http://sourceforge.net/project/shownotes.php?release_id=320768 - - - 2005-04-20 - 2005-07-23 - - - - - fetchmail -- denial of service/crash from malicious POP3 server - - - fetchmail - 6.2.5.1 - - - - -

In fetchmail 6.2.5.1, the remote code injection via - POP3 UIDL was fixed, but a denial of service attack was - introduced:

-

Two possible NULL-pointer dereferences allow a malicious - POP3 server to crash fetchmail by respondig with UID lines - containing only the article number but no UID (in violation - of RFC-1939), or a message without Message-ID when no UIDL - support is available.

- - - - http://lists.berlios.de/pipermail/fetchmail-devel/2005-July/000397.html - http://www.fetchmail.info/fetchmail-SA-2005-01.txt - - - 2005-07-21 - 2005-07-22 - - - - - dnrd -- remote buffer and stack overflow vulnerabilities - - - dnrd - 2.19.1 - - - - -

Natanael Copa reports that dnrd is vulnerable to a remote - buffer overflow and a remote stack overflow. These - vulnerabilities can be triggered by sending invalid DNS - packets to dnrd.

-

The buffer overflow could potentially be used to execute - arbitrary code with the permissions of the dnrd daemon. - Note that dnrd runs in an chroot environment and runs as - non-root.

-

The stack overflow vulnerability can cause dnrd to - crash.

- - - - CVE-2005-2315 - CVE-2005-2316 - ports/83851 - - - 2005-07-21 - 2005-07-21 - - - - - PowerDNS -- LDAP backend fails to escape all queries - - - powerdns - 2.9.18 - - - - -

The LDAP backend in PowerDNS has issues with escaping - queries which could cause connection errors. This would - make it possible for a malicious user to temporarily blank - domains.

-
-

This is known to affect all releases prior to 2.9.18.

-
- - - - CVE-2005-2302 - http://doc.powerdns.com/security-policy.html - http://marc.theaimsgroup.com/?l=bugtraq&m=112155941310297&w=2 - - - 2005-07-16 - 2005-07-21 - - - - - fetchmail -- remote root/code injection from malicious POP3 server - - - fetchmail - 6.2.5.1 - - - - -

fetchmail's POP3/UIDL code does not truncate received UIDs properly. - A malicious or compromised POP3 server can thus corrupt fetchmail's - stack and inject code when fetchmail is using UIDL, either through - configuration, or as a result of certain server capabilities. Note - that fetchmail is run as root on some sites, so an attack might - compromise the root account and thus the whole machine.

- - - - CVE-2005-2335 - ports/83805 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=212762 - http://www.fetchmail.info/fetchmail-SA-2005-01.txt - - - 2005-07-20 - 2005-07-20 - 2005-07-21 - - - - - kdebase -- Kate backup file permission leak - - - kdebase - 3.2.03.4.1 - - - linux_base-suse - 9.39.3_2 - - - - -

A KDE Security Advisory explains:

-
-

Kate / Kwrite create a file backup before saving a modified - file. These backup files are created with default permissions, - even if the original file had more strict permissions set.

-

Depending on the system security settings, backup files - might be readable by other users. Kate / Kwrite are - network transparent applications and therefore this - vulnerability might not be restricted to local users.

-
- - - - CVE-2005-1920 - https://bugs.kde.org/show_bug.cgi?id=103331 - http://www.kde.org/info/security/advisory-20050718-1.txt - - - 2005-07-18 - 2005-07-18 - 2005-10-09 - - - - - firefox & mozilla -- multiple vulnerabilities - - - firefox - 1.0.5,1 - - - linux-firefox - 1.0.5 - - - mozilla - 1.7.9,2 - 1.8.*,2 - - - linux-mozilla - linux-mozilla-devel - 1.7.9 - 1.8.* - - - netscape7 - 0 - - - - de-linux-mozillafirebird - el-linux-mozillafirebird - ja-linux-mozillafirebird-gtk1 - ja-mozillafirebird-gtk2 - linux-mozillafirebird - ru-linux-mozillafirebird - zhCN-linux-mozillafirebird - zhTW-linux-mozillafirebird - 0 - - - - de-linux-netscape - de-netscape7 - fr-linux-netscape - fr-netscape7 - ja-linux-netscape - ja-netscape7 - linux-netscape - linux-phoenix - mozilla+ipv6 - mozilla-embedded - mozilla-firebird - mozilla-gtk1 - mozilla-gtk2 - mozilla-gtk - mozilla-thunderbird - phoenix - pt_BR-netscape7 - 0 - - - - -

The Mozilla Foundation reports of multiple security - vulnerabilities in Firefox and Mozilla:

-
-
    -
  • MFSA 2005-56 Code execution through shared function - objects
    • -
  • MFSA 2005-55 XHTML node spoofing
    • -
  • MFSA 2005-54 Javascript prompt origin spoofing
    • -
  • MFSA 2005-53 Standalone applications can run arbitrary - code through the browser
    • -
  • MFSA 2005-52 Same origin violation: frame calling - top.focus()
    • -
  • MFSA 2005-51 The return of frame-injection - spoofing
    • -
  • MFSA 2005-50 Possibly exploitable crash in - InstallVersion.compareTo()
    • -
  • MFSA 2005-49 Script injection from Firefox sidebar - panel using data:
    • -
  • MFSA 2005-48 Same-origin violation with InstallTrigger - callback
    • -
  • MFSA 2005-47 Code execution via "Set as - Wallpaper"
    • -
  • MFSA 2005-46 XBL scripts ran even when Javascript - disabled
    • -
  • MFSA 2005-45 Content-generated event - vulnerabilities
    • -
-
- - - - CVE-2005-1937 - CVE-2005-2260 - CVE-2005-2261 - CVE-2005-2262 - CVE-2005-2263 - CVE-2005-2264 - CVE-2005-2265 - CVE-2005-2266 - CVE-2005-2267 - CVE-2005-2268 - CVE-2005-2269 - CVE-2005-2270 - http://www.mozilla.org/projects/security/known-vulnerabilities.html - http://www.mozilla.org/security/announce/mfsa2005-45.html - http://www.mozilla.org/security/announce/mfsa2005-46.html - http://www.mozilla.org/security/announce/mfsa2005-47.html - http://www.mozilla.org/security/announce/mfsa2005-48.html - http://www.mozilla.org/security/announce/mfsa2005-49.html - http://www.mozilla.org/security/announce/mfsa2005-50.html - http://www.mozilla.org/security/announce/mfsa2005-51.html - http://www.mozilla.org/security/announce/mfsa2005-52.html - http://www.mozilla.org/security/announce/mfsa2005-53.html - http://www.mozilla.org/security/announce/mfsa2005-54.html - http://www.mozilla.org/security/announce/mfsa2005-55.html - http://www.mozilla.org/security/announce/mfsa2005-56.html - - - 2005-07-12 - 2005-07-16 - - - - - drupal -- PHP code execution vulnerabilities - - - drupal - 4.6.2 - - - - -

Kuba Zygmunt discovered a flaw in the input validation routines - of Drupal's filter mechanism. An attacker could execute - arbitrary PHP code on a target site when public comments or - postings are allowed.

- - - - CVE-2005-1921 - CVE-2005-2106 - http://drupal.org/files/sa-2005-002/advisory.txt - - - 2005-06-29 - 2005-07-16 - - - - - phpSysInfo -- cross site scripting vulnerability - - - phpSysInfo - 2.5.1 - - - - -

A Securityreason.com advisory reports that various cross - site scripting vulnerabilities have been found in phpSysInfo. - Input is not properly sanitised before it is returned to the - user. A malicious person could exploit this to execute - arbitrary HTML and script code in a users browser session. - Also it is possible to view the full path of certain scripts - by accessing them directly.

- - - - 12887 - CVE-2005-0869 - CVE-2005-0870 - http://marc.theaimsgroup.com/?l=bugtraq&m=111161017209422 - - - 2005-03-22 - 2005-07-09 - 2005-12-25 - - - - - mysql-server -- insecure temporary file creation - - - mysql-server - 4.14.1.12 - 5.05.0.6 - - - - -

A Zataz advisory reports that MySQL contains a security - flaw which could allow a malicious local user to inject - arbitrary SQL commands during the initial database creation - process.

-

The problem lies in the mysql_install_db script which - creates temporary files based on the PID used by the - script.

- - - - 13660 - CVE-2005-1636 - http://www.zataz.net/adviso/mysql-05172005.txt - - - 2005-05-07 - 2005-07-09 - - - - - net-snmp -- fixproc insecure temporary file creation - - - net-snmp - 5.2.1.2 - - - - -

A Gentoo advisory reports:

-
-

Net-SNMP creates temporary files in an insecure manner, - possibly allowing the execution of arbitrary code.

-

A malicious local attacker could exploit a race condition - to change the content of the temporary files before they - are executed by fixproc, possibly leading to the execution - of arbitrary code. A local attacker could also create - symbolic links in the temporary files directory, pointing - to a valid file somewhere on the filesystem. When fixproc - is executed, this would result in the file being - overwritten.

-
- - - - 13715 - CVE-2005-1740 - http://security.gentoo.org/glsa/glsa-200505-18.xml - - - 2005-05-23 - 2005-07-09 - 2005-07-13 - - - - - phpbb -- multiple vulnerabilities - - - phpbb - 2.0.12 - - - - -

phpBB is vulnerable to remote exploitation of an input - validation vulnerability allows attackers to read the - contents of arbitrary system files under the privileges - of the webserver. This also allows remote attackers to - unlink arbitrary system files under the privileges of the - webserver.

- - - - 12618 - 12621 - 12623 - CVE-2005-0258 - CVE-2005-0259 - http://security.gentoo.org/glsa/glsa-200503-02.xml - http://www.idefense.com/application/poi/display?id=205&type=vulnerabilities - http://www.idefense.com/application/poi/display?id=204&type=vulnerabilities - - - 2005-02-22 - 2005-07-09 - - - - - shtool -- insecure temporary file creation - - - shtool - 2.0.1 - - - - -

A Zataz advisory reports that shtool contains a security - flaw which could allow a malicious local user to create or - overwrite the contents of arbitrary files. The attacker - could fool a user into executing the arbitrary file possibly - executing arbitrary code.

- - - - 13767 - http://www.zataz.net/adviso/shtool-05252005.txt - - - 2005-05-25 - 2005-07-09 - - - - - phppgadmin -- "formLanguage" local file inclusion vulnerability - - - phppgadmin - 3.5.4 - - - - -

A Secunia Advisory reports:

-
-

A vulnerability has been reported in phpPgAdmin, which - can be exploited by malicious people to disclose sensitive - information.

-

Input passed to the "formLanguage" parameter in - "index.php" isn't properly verified, before it is used to - include files. This can be exploited to include arbitrary - files from local resources.

-

Successful exploitation requires that "magic_quotes_gpc" - is disabled.

-
- - - - 14142 - CVE-2005-2256 - http://secunia.com/advisories/15941/ - http://sourceforge.net/project/shownotes.php?release_id=342261 - - - 2005-07-05 - 2005-07-08 - 2005-07-21 - - - - - pear-XML_RPC -- information disclosure vulnerabilities - - - pear-XML_RPC - 1.3.2 - - - - -

The pear-XML_RPC release notes reports that the following - issues has been fixed:

-
-

Eliminate path disclosure vulnerabilities by suppressing - error messages when eval()'ing.

-

Eliminate path disclosure vulnerability by catching bogus - parameters submitted to - XML_RPC_Value::serializeval().

-
- - - - http://pear.php.net/package/XML_RPC/download/1.3.2 - - - 2005-07-07 - 2005-07-08 - - - - - ekg -- insecure temporary file creation - - - pl-ekg - 1.6r2,1 - - - - -

Eric Romang reports that ekg creates temporary files in an - insecure manner. This can be exploited by an attacker using - a symlink attack to overwrite arbitrary files and possibly - execute arbitrary commands with the permissions of the user - running ekg.

- - - - 14146 - CVE-2005-1916 - http://marc.theaimsgroup.com/?l=bugtraq&m=112060146011122 - http://bugs.gentoo.org/show_bug.cgi?id=94172 - - - 2005-07-05 - 2005-07-08 - 2005-07-31 - - - - - bugzilla -- multiple vulnerabilities - - - bugzilla - ja-bugzilla - 2.17.12.18.2 - - - - -

A Bugzilla Security Advisory reports:

-
-

Any user can change any flag on any bug, even if they - don't have access to that bug, or even if they can't - normally make bug changes. This also allows them to expose - the summary of a bug.

-

Bugs are inserted into the database before they are - marked as private, in Bugzilla code. Thus, MySQL - replication can lag in between the time that the bug is - inserted and when it is marked as private (usually less - than a second). If replication lags at this point, the bug - summary will be accessible to all users until replication - catches up. Also, on a very slow machine, there may be a - pause longer than a second that allows users to see the - title of the newly-filed bug.

-
- - - - CVE-2005-2173 - CVE-2005-2174 - http://www.bugzilla.org/security/2.18.1/ - https://bugzilla.mozilla.org/show_bug.cgi?id=292544 - https://bugzilla.mozilla.org/show_bug.cgi?id=293159 - - - 2005-07-07 - 2005-07-08 - 2005-07-18 - - - - - nwclient -- multiple vulnerabilities - - - nwclient - 0 - - - - -

Insecure file permissions, network access control and DNS - usage put systems that use Legato NetWorker at risk.

-

When the software is running, several files that contain - sensitive information are created with insecure permissions. - The information exposed include passwords and can therefore - be used for privilege elevation.

-

An empty "servers" file, which should normally - contain hostnames of authorized backup servers, may allow - unauthorized backups to be made. Sensitive information can - be extracted from these backups.

-

When reverse DNS fails for the Legato client IP a weak - authorization scheme, containing a flaw that allows - unauthorized access, is used. This may allow unauthorized - access.

- - - - 3564 - 3840 - 3842 - CVE-2001-0910 - CVE-2002-0113 - CVE-2002-0114 - http://portal1.legato.com/resources/bulletins/372.html - - - 2002-01-10 - 2005-07-08 - - - - - acroread -- insecure temporary file creation - - - acroread4 - acroread5 - 0 - - - acroread - 7.0.0 - 5.*,17.0.0,1 - - - - -

Secunia Research reports:

-
-

Secunia has discovered a security issue in Adobe Reader - for Linux, which can be exploited by malicious, local - users to gain knowledge of sensitive information.

-

The problem is caused due to temporary files being - created with permissions based on a user's umask in the - "/tmp" folder under certain circumstances when documents - are opened.

-

Successful exploitation allows an unprivileged user to - read arbitrary users' documents.

-
- - - - CVE-2005-1912 - http://secunia.com/secunia_research/2005-6/advisory/ - - - 2005-06-29 - 2005-07-06 - - - - - clamav -- cabinet file handling DoS vulnerability - - - clamav - 0.86 - - - clamav-devel - 20050620 - - - - -

An iDEFENSE Security Advisory reports:

-
-

Remote exploitation of an input validation error in Clam - AntiVirus ClamAV allows attackers to cause a denial of - service condition.

-

The vulnerability specifically exists due to insufficient - validation on cabinet file header data. The - ENSURE_BITS() macro fails to check for zero - length reads, allowing a carefully constructed cabinet - file to cause an infinite loop.

-

ClamAV is used in a number of mail gateway - products. Successful exploitation requires an attacker to - send a specially constructed CAB file through a mail - gateway or personal anti-virus client utilizing the ClamAV - scanning engine. The infinate loop will cause the ClamAV - software to use all available processor resources, - resulting in a denial of service or severe degradation to - system performance. Remote exploitation can be achieved by - sending a malicious file in an e-mail message or during an - HTTP session.

-
- - - - CVE-2005-1923 - http://marc.theaimsgroup.com/?l=bugtraq&m=112006456809016 - - - 2005-06-29 - 2005-07-06 - - - - - clamav -- MS-Expand file handling DoS vulnerability - - - clamav - 0.86 - - - clamav-devel - 20050620 - - - - -

An iDEFENSE Security Advisory reports:

-
-

Remote exploitation of an input validation error in Clam - AntiVirus ClamAV allows attackers to cause a denial of - service condition.

-

The vulnerability specifically exists due to improper - behavior during exceptional conditions.

-

Successful exploitation allows attackers to exhaust file - descriptors pool and memory. Anti-virus detection - functionality will fail if there is no file descriptors - available with which to open files. Remote exploitation - can be achieved by sending a malicious file in an e-mail - message or during an HTTP session.

-
- - - - CVE-2005-1922 - http://marc.theaimsgroup.com/?l=bugtraq&m=112006402411598 - - - 2005-06-29 - 2005-07-06 - - - - - zlib -- buffer overflow vulnerability - - - zsync - 0.4.1 - - - FreeBSD - 5.45.4_4 - 5.35.3_18 - - - - -

Problem Description

-

An error in the handling of corrupt compressed data streams - can result in a buffer being overflowed.

-

Impact

-

By carefully crafting a corrupt compressed data stream, an - attacker can overwrite data structures in a zlib-using - application. This may cause the application to halt, - causing a denial of service; or it may result in the - attacker gaining elevated privileges.

- - - - CVE-2005-2096 - SA-05:16.zlib - - - 2005-07-06 - 2005-07-06 - 2005-10-01 - - - - - acroread -- buffer overflow vulnerability - - - acroread4 - acroread5 - 0 - - - acroread - 7.0.0 - 5.*,17.0.0,1 - - - - -

An Adobe Security Advisory reports:

-
-

A vulnerability within Adobe Reader has been - identified. Under certain circumstances, remote - exploitation of a buffer overflow in Adobe Reader could - allow an attacker to execute arbitrary code.

-

If exploited, it could allow the execution of arbitrary - code under the privileges of the local user. Remote - exploitation is possible if the malicious PDF document is - sent as an email attachment or if the PDF document is - accessed via a web link.

-
- - - - CVE-2005-1625 - http://www.adobe.com/support/techdocs/329083.html - http://marc.theaimsgroup.com/?l=bugtraq&m=112059685332569 - - - 2005-07-05 - 2005-07-06 - - - - - net-snmp -- remote DoS vulnerability - - - net-snmp - 5.2.1.2 - - - - -

A Net-SNMP release announcement reports:

-
-

A security vulnerability has been found in Net-SNMP - releases that could allow a denial of service attack - against Net-SNMP agent's which have opened a stream based - protocol (EG, TCP but not UDP; it should be noted that - Net-SNMP does not by default open a TCP port).

-
- - - - 14168 - CVE-2005-2177 - http://marc.theaimsgroup.com/?l=net-snmp-announce&m=112059518426328 - - - 2005-07-02 - 2005-07-05 - 2005-10-26 - - - - - cacti -- multiple vulnerabilities - - - cacti - 0.8.6f - - - - -

Stefan Esser reports:

-
-

Wrongly implemented user input filters lead to multiple - SQL Injection vulnerabilities which can lead f.e. to - disclosure of the admin password hash.

-
-
-

Wrongly implemented user input filters allows injection - of user input into executed commandline.

-

Alberto Trivero posted his Remote Command Execution - Exploit for Cacti <= 0.8.6d to Bugtraq on the 22th - June. Having analysed his bug we come to the conclusion, - that the malfunctioning input filters, which were already - mentioned in the previous advisory are also responsible - for this bug still being exploitable.

-
-
-

A HTTP headers bypass switch can also be used to - completely bypass the authentification system of Cacti. As - admin it is possible to execute shell commands with the - permission of the webserver.

-

While looking at the source of Cacti a HTTP headers - bypass switch was discovered, that also switches off a - call to session_start() and the manual - application of addslashes() in case of - magic_quotes_gpc=Off.

-

When register_globals is turned on* an attacker can use - this switch to disables Cacti's use of PHP's session - support and therefore supply the session variables on his - own through f.e. the URL. Additionally using the switch - renders several SQL statements vulnerable to SQL - Injections attacks, when magic_quotes_gpc is turned off, - which is the recommended setting.

-

Logged in as an admin it is possible to issue shell - commands.

-

(*) register_globals is turned off by default since PHP - 4.2 but is activated on most servers because of older - scripts requiring it.

-
- - - - http://marc.theaimsgroup.com/?l=bugtraq&m=111954136315248 - http://www.hardened-php.net/advisory-032005.php - http://www.hardened-php.net/advisory-042005.php - http://www.hardened-php.net/advisory-052005.php - - - 2005-06-22 - 2005-07-05 - - - - - wordpress -- multiple vulnerabilities - - - wordpress - 1.5.1.3,1 - - - - -

GulfTech Security Research reports:

-
-

There are a number of vulnerabilities in WordPress that - may allow an attacker to ultimately run arbitrary code on - the vulnerable system. These vulnerabilities include SQL - Injection, Cross Site Scripting, and also issues that may - aid an attacker in social engineering.

-
- - - - CVE-2005-2107 - CVE-2005-2108 - CVE-2005-2109 - CVE-2005-2110 - http://marc.theaimsgroup.com/?l=bugtraq&m=112006967221438 - - - 2005-06-28 - 2005-07-05 - - - - - wordpress -- multiple vulnerabilities - - - wordpress - 1.5.1.2,1 - - - - -

A Gentoo Linux Security Advisory reports:

-
-

Due to a lack of input validation, WordPress is - vulnerable to SQL injection and XSS attacks.

-

An attacker could use the SQL injection vulnerabilities to - gain information from the database. Furthermore the - cross-site scripting issues give an attacker the ability - to inject and execute malicious script code or to steal - cookie-based authentication credentials, potentially - compromising the victim's browser.

-
- - - - CVE-2005-1810 - http://www.gentoo.org/security/en/glsa/glsa-200506-04.xml - - - 2005-04-12 - 2005-07-05 - - - - - phpbb -- remote PHP code execution vulnerability - - - phpbb - 2.0.16 - - - - -

FrSIRT Advisory reports:

-
-

A vulnerability was identified in phpBB, which - may be exploited by attackers to compromise a vulnerable - web server. This flaw is due to an input validation error - in the "viewtopic.php" script that does not properly filter - the "highlight" parameter before calling the "preg_replace()" - function, which may be exploited by remote attackers to execute - arbitrary PHP commands with the privileges of the web server.

-
- - - - CVE-2005-2086 - http://www.frsirt.com/english/advisories/2005/0904 - http://www.phpbb.com/phpBB/viewtopic.php?t=302011 - - - 2005-06-28 - 2005-07-03 - 2005-07-07 - - - - - pear-XML_RPC -- arbitrary remote code execution - - - pear-XML_RPC - 1.3.1 - - - - -

GulfTech Security Research Team reports:

-
-

PEAR XML_RPC is vulnerable to a very high risk php code - injection vulnerability due to unsanatized data being - passed into an eval() call.

-
- - - - CVE-2005-1921 - http://www.gulftech.org/?node=research&article_id=00087-07012005 - http://www.hardened-php.net/advisory-022005.php - - - 2005-06-29 - 2005-07-03 - - - - - kernel -- ipfw packet matching errors with address tables - - - FreeBSD - 5.45.4_3 - - - - -

Problem Description

-

The ipfw tables lookup code caches the result of the last - query. The kernel may process multiple packets - concurrently, performing several concurrent table lookups. - Due to an insufficient locking, a cached result can become - corrupted that could cause some addresses to be incorrectly - matched against a lookup table.

-

Impact

-

When lookup tables are used with ipfw, packets may on very - rare occasions incorrectly match a lookup table. This could - result in a packet being treated contrary to the defined - packet filtering ruleset. For example, a packet may be - allowed to pass through when it should have been - discarded.

-

The problem can only occur on Symmetric Multi-Processor - (SMP) systems, or on Uni Processor (UP) systems with the - PREEMPTION kernel option enabled (not the default).

-

Workaround

-

a) Do not use lookup tables.

-

OR

-

b) Disable concurrent processing of packets in the network - stack by setting the "debug.mpsafenet=0" tunable:

-

# echo "debug.mpsafenet=0" << /boot/loader.conf

- - - - CVE-2005-2019 - SA-05:13.ipfw - - - 2005-06-29 - 2005-06-29 - 2005-07-06 - - - - - bzip2 -- denial of service and permission race vulnerabilities - - - FreeBSD - 5.45.4_3 - 5.05.3_17 - 4.114.11_11 - 4.10_16 - - - bzip2 - 1.0.3_1 - - - - -

Problem Description

-

Two problems have been discovered relating to the - extraction of bzip2-compressed files. First, a carefully - constructed invalid bzip2 archive can cause bzip2 to enter - an infinite loop. Second, when creating a new file, bzip2 - closes the file before setting its permissions.

-

Impact

-

The first problem can cause bzip2 to extract a bzip2 - archive to an infinitely large file. If bzip2 is used in - automated processing of untrusted files this could be - exploited by an attacker to create an denial-of-service - situation by exhausting disk space or by consuming all - available cpu time.

-

The second problem can allow a local attacker to change the - permissions of local files owned by the user executing bzip2 - providing that they have write access to the directory in - which the file is being extracted.

-

Workaround

-

Do not uncompress bzip2 archives from untrusted sources and - do not uncompress files in directories where untrusted users - have write access.

- - - - CVE-2005-0953 - CVE-2005-1260 - SA-05:14.bzip2 - http://scary.beasts.org/security/CESA-2005-002.txt - - - 2005-03-30 - 2005-06-29 - 2016-08-09 - - - - - kernel -- TCP connection stall denial of service - - - FreeBSD - 5.45.4_3 - 5.05.3_17 - 4.114.11_11 - 4.10_16 - - - - -

Problem Description

-

Two problems have been discovered in the FreeBSD TCP stack.

-

First, when a TCP packets containing a timestamp is - received, inadequate checking of sequence numbers is - performed, allowing an attacker to artificially increase the - internal "recent" timestamp for a connection.

-

Second, a TCP packet with the SYN flag set is accepted for - established connections, allowing an attacker to overwrite - certain TCP options.

-

Impact

-

Using either of the two problems an attacker with knowledge - of the local and remote IP and port numbers associated with - a connection can cause a denial of service situation by - stalling the TCP connection. The stalled TCP connection my - be closed after some time by the other host.

-

Workaround

-

In some cases it may be possible to defend against these - attacks by blocking the attack packets using a firewall. - Packets used to effect either of these attacks would have - spoofed source IP addresses.

- - - - 637934 - CVE-2005-0356 - CVE-2005-2068 - SA-05:15.tcp - - - 2005-06-29 - 2005-06-29 - 2016-08-09 - - - - - ethereal -- multiple protocol dissectors vulnerabilities - - - ethereal - ethereal-lite - tethereal - tethereal-lite - 0.8.140.10.11 - - - - -

An Ethreal Security Advisories reports:

-
-

An aggressive testing program as well as independent - discovery has turned up a multitude of security issues

-

Please reference CVE/URL list for details

-
- - - - 13391 - 13504 - 13567 - CVE-2005-1281 - CVE-2005-1456 - CVE-2005-1457 - CVE-2005-1458 - CVE-2005-1459 - CVE-2005-1460 - CVE-2005-1461 - CVE-2005-1462 - CVE-2005-1463 - CVE-2005-1464 - CVE-2005-1465 - CVE-2005-1466 - CVE-2005-1467 - CVE-2005-1468 - CVE-2005-1469 - CVE-2005-1470 - http://www.ethereal.com/appnotes/enpa-sa-00019.html - - - 2005-05-04 - 2005-06-24 - - - - - tor -- information disclosure - - - tor - 0.1.0.10 - - - - -

Roger Dingledine reports:

-
-

The Tor 0.1.0.10 release from a few days ago - includes a fix for a bug that might allow an attacker - to read arbitrary memory (maybe even keys) from an exit - server's process space. We haven't heard any reports of - exploits yet, but hey.

-
- - - - http://archives.seul.org/or/announce/Jun-2005/msg00001.html - - - 2005-06-16 - 2005-06-24 - - - - - linux-realplayer -- RealText parsing heap overflow - - - linux-realplayer - 10.0.4_1 - - - - -

An iDEFENSE Security Advisory reports:

-
-

Remote exploitation of a heap-based buffer - overflow vulnerability in the RealText file format - parser within various versions of RealNetworks - Inc.'s RealPlayer could allow attackers to - execute arbitrary code.

-
- - - - CVE-2005-1277 - http://www.idefense.com/application/poi/display?id=250&type=vulnerabilities&flashstatus=false - http://service.real.com/help/faq/security/050623_player/EN/ - - - 2005-06-23 - 2005-06-24 - - - - - ruby -- arbitrary command execution on XMLRPC server - - - ruby - ruby_static - 1.8.*1.8.2_3 - - - - -

Nobuhiro IMAI reports:

-
-

the default value modification on - Module#public_instance_methods (from false to true) breaks - s.add_handler(XMLRPC::iPIMethods("sample"), MyHandler.new) style - security protection.

-

This problem could allow a remote attacker to execute arbitrary - commands on XMLRPC server of libruby.

-
- - - - CVE-2005-1992 - http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-core/5237 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=315064 - - - 2005-06-22 - 2005-06-23 - 2005-11-06 - - - - - cacti -- potential SQL injection and cross site scripting attacks - - - cacti - 0.8.6d - - - - -

iDEFENSE security group disclosed potential SQL injection - attacks from unchecked user input and two security holes - regarding potential cross site scripting attacks

- - - - http://www.cacti.net/release_notes_0_8_6e.php - - - 2005-06-21 - 2005-06-21 - - - - - opera -- XMLHttpRequest security bypass - - - linux-opera - opera-devel - opera - 8.*8.01 - - - - -

A Secunia Advisory reports:

-
-

Secunia Research has discovered a vulnerability in Opera, - which can be exploited by malicious people to steal - content or to perform actions on other web sites with the - privileges of the user.

-

Normally, it should not be possible for the - XMLHttpRequest object to access resources - from outside the domain of which the object was - opened. However, due to insufficient validation of server - side redirects, it is possible to circumvent this - restriction.

-
- - - - CVE-2005-1475 - http://secunia.com/advisories/15008/ - http://secunia.com/secunia_research/2005-4/advisory/ - http://www.opera.com/freebsd/changelogs/801/#security - - - 2005-06-16 - 2005-06-20 - - - - - opera -- "javascript:" URL cross-site scripting vulnerability - - - linux-opera - opera-devel - opera - 8.01 - - - - -

A Secunia Advisory reports:

-
-

Secunia Research has discovered a vulnerability in Opera, - which can be exploited by malicious people to conduct - cross-site scripting attacks and to read local files.

-

The vulnerability is caused due to Opera not properly - restricting the privileges of "javascript:" URLs when - opened in e.g. new windows or frames.

-
- - - - CVE-2005-1669 - http://secunia.com/advisories/15411/ - http://www.opera.com/freebsd/changelogs/801/#security - - - 2005-06-16 - 2005-06-20 - - - - - opera -- redirection cross-site scripting vulnerability - - - linux-opera - opera-devel - opera - 8.*8.01 - - - - -

A Secunia Advisory reports:

-
-

Secunia Research has discovered a vulnerability in Opera, - which can be exploited by malicious people to conduct - cross-site scripting attacks against users.

-

The vulnerability is caused due to input not being - sanitised, when Opera generates a temporary page for - displaying a redirection when "Automatic redirection" is - disabled (not default setting).

-
- - - - http://secunia.com/advisories/15423/ - http://secunia.com/secunia_research/2003-1/advisory/ - http://www.opera.com/freebsd/changelogs/801/#security - - - 2005-06-16 - 2005-06-20 - - - - - sudo -- local race condition vulnerability - - - sudo - 1.6.8.9 - - - - -

Todd C. Miller reports:

-
-

A race condition in Sudo's command pathname handling - prior to Sudo version 1.6.8p9 that could allow a user with - Sudo privileges to run arbitrary commands.

-

Exploitation of the bug requires that the user be allowed - to run one or more commands via Sudo and be able to create - symbolic links in the filesystem. Furthermore, a sudoers - entry giving another user access to the ALL pseudo-command - must follow the user's sudoers entry for the race to - exist.

-
- - - - 13993 - CVE-2005-1993 - http://marc.theaimsgroup.com/?l=bugtraq&m=111928183431376 - - - 2005-06-20 - 2005-06-20 - 2005-11-14 - - - - - trac -- file upload/download vulnerability - - - trac - 0.8.4 - - - - -

Stefan Esser reports:

-
-

Trac's wiki and ticket systems allows to add attachments - to wiki entries and bug tracker tickets. These attachments - are stored within directories that are determined by the - id of the corresponding ticket or wiki entry.

-

Due to a missing validation of the id parameter it is - possible for an attacker to supply arbitrary paths to the - upload and attachment viewer scripts. This means that a - potential attacker can retrieve any file accessible by the - webserver user.

-

Additionally it is possible to upload arbitrary files (up - to a configured file length) to any place the webserver - has write access too.

-

For obvious reasons this can lead to the execution of - arbitrary code if it possible to upload files to the - document root or it's subdirectories. One example of a - configuration would be f.e. running Trac and - s9y/wordpress with writeable content directories on the - same webserver.

-

Another potential usage of this exploit would be to abuse - Trac powered webservers as storage for f.e. torrent - files.

-
- - - - 13990 - http://www.hardened-php.net/advisory-012005.php - http://projects.edgewall.com/trac/wiki/ChangeLog - - - 2005-06-20 - 2005-06-20 - - - - - razor-agents -- denial of service vulnerability - - - razor-agents - 2.71 - - - - -

A Secunia security advisory reports:

-
-

Two vulnerabilities have been reported in Razor-agents, - which can be exploited by malicious people to cause a DoS - (Denial of Service).

-
    -
  1. An unspecified error in the preprocessing of certain - HTML messages can be exploited to crash the - application.
    2. -
  2. A bug in the discovery logic causes Razor-agents to go - into an infinite loop and consume a large amount of - memory when discovery fails.
    3. -
-
- - - - http://secunia.com/advisories/15739/ - - - 2005-06-17 - 2005-06-20 - - - - - p5-Mail-SpamAssassin -- denial of service vulnerability - - - p5-Mail-SpamAssassin - 3.0.13.0.4 - - - - -

Apache SpamAssassin Security Team reports:

-
-

Apache SpamAssassin 3.0.4 was recently released, and - fixes a denial of service vulnerability in versions 3.0.1, 3.0.2, - and 3.0.3. The vulnerability allows certain misformatted - long message headers to cause spam checking to - take a very long time.

-

While the exploit has yet to be seen in the wild, - we are concerned that there may be attempts to abuse - the vulnerability in the future. Therefore, we strongly - recommend all users of these versions upgrade to - Apache SpamAssassin 3.0.4 as soon as possible.

-
- - - - CVE-2005-1266 - http://mail-archives.apache.org/mod_mbox/spamassassin-announce/200506.mbox/%3c17072.35054.586017.822288@proton.pathname.com%3e - - - 2005-06-15 - 2005-06-18 - - - - - squirrelmail -- Several cross site scripting vulnerabilities - - - squirrelmail - ja-squirrelmail - 1.4.01.4.4 - - - - -

A SquirrelMail Security Advisory reports:

-
-

Several cross site scripting (XSS) vulnerabilities have been - discovered in SquirrelMail versions 1.4.0 - 1.4.4.

-

The vulnerabilities are in two categories: the majority can be - exploited through URL manipulation, and some by sending a specially - crafted email to a victim. When done very carefully, - this can cause the session of the user to be hijacked.

-
- - - - CVE-2005-1769 - http://www.squirrelmail.org/security/issue/2005-06-15 - - - 2005-06-15 - 2005-06-18 - - - - - acroread -- XML External Entity vulnerability - - - acroread7 - ja-acroread - 7.0.07.0.1 - - - - -

Sverre H. Huseby discovered a vulnerability in Adobe Acrobat - and Adobe Reader. - Under certain circumstances, using XML scripts it is possible - to discover the existence of local files.

- - - - CVE-2005-1306 - http://shh.thathost.com/secadv/adobexxe/ - http://www.adobe.com/support/techdocs/331710.html - http://support.adobe.co.jp/faq/faq/qadoc.sv?226360+002+3 - - - 2005-06-15 - 2005-06-18 - 2005-08-28 - - - - - gzip -- directory traversal and permission race vulnerabilities - - - FreeBSD - 5.45.4_2 - 5.05.3_16 - 4.114.11_10 - 4.104.10_15 - 4.94.9_18 - 4.8_33 - - - gzip - 1.3.5_2 - - - - -

Problem Description

-

Two problems related to extraction of files exist in gzip:

-

The first problem is that gzip does not properly sanitize - filenames containing "/" when uncompressing files using the - -N command line option.

-

The second problem is that gzip does not set permissions on - newly extracted files until after the file has been created - and the file descriptor has been closed.

-

Impact

-

The first problem can allow an attacker to overwrite - arbitrary local files when uncompressing a file using the -N - command line option.

-

The second problem can allow a local attacker to change the - permissions of arbitrary local files, on the same partition - as the one the user is uncompressing a file on, by removing - the file the user is uncompressing and replacing it with a - hardlink before the uncompress operation is finished.

-

Workaround

-

Do not use the -N command line option on untrusted files - and do not uncompress files in directories where untrusted - users have write access.

- - - - CVE-2005-0988 - CVE-2005-1228 - SA-05:11.gzip - http://marc.theaimsgroup.com/?l=bugtraq&m=111271860708210 - http://marc.theaimsgroup.com/?l=bugtraq&m=111402732406477 - - - 2005-04-20 - 2005-06-18 - 2005-07-06 - - - - - tcpdump -- infinite loops in protocol decoding - - - FreeBSD - 5.45.4_2 - 5.35.3_16 - - - tcpdump - 3.8.3_2 - - - - -

Problem Description

-

Several tcpdump protocol decoders contain programming - errors which can cause them to go into infinite loops.

-

Impact

-

An attacker can inject specially crafted packets into the - network which, when processed by tcpdump, could lead to a - denial-of-service. After the attack, tcpdump would no - longer capture traffic, and would potentially use all - available processor time.

- - - - CVE-2005-1267 - CVE-2005-1278 - CVE-2005-1279 - CVE-2005-1280 - SA-05:10.tcpdump - http://marc.theaimsgroup.com/?l=bugtraq&m=111454406222040 - http://marc.theaimsgroup.com/?l=bugtraq&m=111454461300644 - http://marc.theaimsgroup.com/?l=bugtraq&m=111928309502304 - - - 2005-06-09 - 2005-06-18 - 2005-06-20 - - - - - gaim -- Yahoo! remote crash vulnerability - - - gaim - ja-gaim - ko-gaim - ru-gaim - 1.3.1 - - - - -

Jacopo Ottaviani reports that Gaim can be crashed by being - offered files with names containing non-ASCII - characters via the Yahoo! protocol.

- - - - 13931 - CVE-2005-1269 - http://gaim.sourceforge.net/security/index.php?id=18 - - - 2005-06-10 - 2005-06-17 - - - - - gaim -- MSN Remote DoS vulnerability - - - gaim - ja-gaim - ko-gaim - ru-gaim - 1.3.1 - - - - -

The GAIM team reports:

-
-

Remote attackers can cause a denial of service (crash) - via a malformed MSN message that leads to a memory - allocation of a large size, possibly due to an integer - signedness error.

-
- - - - 13932 - CVE-2005-1934 - http://gaim.sourceforge.net/security/index.php?id=19 - - - 2005-06-10 - 2005-06-17 - - - - - gallery -- remote code injection via HTTP_POST_VARS - - - gallery - 1.4.1.1 - - - - -

A web server running Gallery can be exploited for arbitrary - PHP code execution through the use of a maliciously crafted - URL.

- - - - CVE-2004-2124 - http://marc.theaimsgroup.com/?l=bugtraq&m=107524414317693 - - - 2004-01-27 - 2005-06-17 - - - - - gallery -- cross-site scripting - - - gallery - 1.4.4.5 - - - - -

Gallery includes several cross-site scripting vulnerabilities - that could allow malicious content to be injected.

- - - - CVE-2004-1106 - CVE-2005-0219 - CVE-2005-0220 - CVE-2005-0221 - CVE-2005-0222 - 11602 - http://gallery.menalto.com/modules.php?op=modload&name=News&file=article&sid=147 - http://marc.theaimsgroup.com/?l=bugtraq&m=110608459222364 - - - 2005-01-26 - 2005-06-17 - - - - - kstars -- exploitable set-user-ID application fliccd - - - kdeedu - 3.3.2_1 - - - - -

A KDE Security Advisory explains:

-
-

Overview

-

KStars includes support for the Instrument Neutral - Distributed Interface (INDI). The build system of this - extra 3rd party software contained an installation hook to - install fliccd (part of INDI) as SUID root - application.

-

Erik Sjölund discovered that the code contains several - vulnerabilities that allow stack based buffer - overflows.

-

Impact

-

If the fliccd binary is installed as suid root, it - enables root privilege escalation for local users, or, if - the daemon is actually running (which it does not by - default) and is running as root, remote root privilege - escalation.

-
- - - - CVE-2005-0011 - http://www.kde.org/info/security/advisory-20050215-1.txt - - - 2005-01-05 - 2005-06-17 - - - - - fd_set -- bitmap index overflow in multiple applications - - - gatekeeper - 2.2.1 - - - citadel - 6.29 - - - 3proxy - 0.5.b - - - jabber - 1.4.3.1_1,1 - 1.4.4 - - - bnc - 2.9.3 - - - rinetd - 0.62_1 - - - dante - 1.1.15 - - - bld - 0.3.3 - - - - -

3APA3A reports:

-
-

If programmer fails to check socket number before using - select() or fd_set macros, it's possible to overwrite - memory behind fd_set structure. Very few select() based - application actually check FD_SETSIZE value. [...]

-

Depending on vulnerable application it's possible to - overwrite portions of memory. Impact is close to - off-by-one overflows, code execution doesn't seems - exploitable.

-
- - - - http://www.gotbnc.com/changes.html#2.9.3 - http://www.security.nnov.ru/advisories/sockets.asp - http://marc.theaimsgroup.com/?l=bugtraq&m=110660879328901 - - - 2004-12-12 - 2005-06-17 - 2006-09-03 - - - - - leafnode -- denial of service vulnerability - - - leafnode - 1.11.3 - - - - -

Matthias Andree reports:

-
-

A vulnerability was found in the fetchnews program (the NNTP - client) that may under some circumstances cause a wait for input - that never arrives, fetchnews "hangs". [...]

-

As only one fetchnews program can run at a time, subsequently - started fetchnews and texpire programs will terminate. [...]

-

Upgrade your leafnode package to version 1.11.3.

-
- - - - CVE-2005-1911 - http://leafnode.sourceforge.net/leafnode-SA-2005-02.txt - ports/82056 - http://marc.theaimsgroup.com/?l=vulnwatch&m=111827180929063 - - - 2005-06-08 - 2005-06-09 - - - - - gforge -- directory traversal vulnerability - - - gforge - 4.0 - - - - -

An STG Security Advisory reports:

-
-

GForge CVS module made by Dragos Moinescu and another - module made by Ronald Petty have a directory traversal - vulnerability. [...] malicious attackers can read - arbitrary directory lists.

-
- - - - CVE-2005-0299 - 12318 - http://marc.theaimsgroup.com/?l=bugtraq&m=110627132209963 - - - 2005-01-20 - 2005-06-03 - - - - - imap-uw -- authentication bypass when CRAM-MD5 is enabled - - - imap-uw - 2004b,1 - - - - -

The CRAM-MD5 authentication support of the University of - Washington IMAP and POP3 servers contains a vulnerability that - may allow an attacker to bypass authentication and impersonate - arbitrary users. Only installations with CRAM-MD5 support - configured are affected.

- - - - CVE-2005-0198 - 702777 - - - 2005-01-04 - 2005-06-03 - - - - - squid -- denial-of-service vulnerabilities - - - squid - 2.5.9 - - - - -

The Squid team reported several denial-of-service - vulnerabilities related to the handling of DNS responses and - NT Lan Manager messages. These may allow an attacker to crash - the Squid cache.

- - - - CVE-2005-0446 - http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE8-dns_assert - CVE-2005-0096 - CVE-2005-0097 - http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-fakeauth_auth - - - 2005-01-16 - 2005-06-03 - - - - - racoon -- remote denial-of-service - - - racoon - 20050510a - - - - -

Sebastian Krahmer discovered that the racoon ISAKMP daemon - could be crashed with a maliciously crafted UDP packet. No - authentication is required in order to perform the attack.

- - - - CVE-2005-0398 - http://sourceforge.net/mailarchive/forum.php?thread_id=6787713&forum_id=32000 - http://xforce.iss.net/xforce/xfdb/19707 - https://bugzilla.redhat.com/bugzilla/attachment.cgi?id=109966&action=view - - - 2005-03-12 - 2005-06-03 - - - - - xli -- integer overflows in image size calculations - - - xli - 1.17.0_1 - - - - -

Tavis Ormandy discovered several integer overflows in xli's - image size handling. A maliciously crafted image may be able - to cause a heap buffer overflow and execute arbitrary code.

- - - - CVE-2005-0639 - http://bugs.gentoo.org/show_bug.cgi?id=79762 - http://pantransit.reptiles.org/prog/xli/CHANGES - - - 2005-02-08 - 2005-06-03 - - - - - xloadimage -- arbitrary command execution when handling compressed files - - - xli - 1.17.0_1 - - - xloadimage - 4.1.10 - - - - -

Tavis Ormandy discovered that xli and xloadimage attempt to - decompress images by piping them through gunzip - or similar decompression tools. Unfortunately, the - unsanitized file name is included as part of the command. - This is dangerous, as in some situations, such as mailcap - processing, an attacker may control the input file name. As a - result, an attacker may be able to cause arbitrary command - execution.

- - - - CVE-2005-0638 - http://bugs.gentoo.org/show_bug.cgi?id=79762 - - - 2005-02-18 - 2005-06-03 - - - - - xloadimage -- buffer overflow in FACES image handling - - - xli - 1.17.0_1 - - - xloadimage - 4.1.9 - - - - -

In 2001, zen-parse discovered a buffer overflow in - xloadimage's FACES image loader. A maliciously crafted image - could cause xloadimage to execute arbitrary code. A published - exploit exists for this vulnerability.

-

In 2005, Rob Holland discovered that the same vulnerability - was present in xli.

- - - - CVE-2001-0775 - http://marc.theaimsgroup.com/?l=bugtraq&m=99477230306845 - https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=46186 - http://bugs.gentoo.org/show_bug.cgi?id=79762 - - - 2000-02-19 - 2005-06-03 - - - - - yamt -- buffer overflow and directory traversal issues - - - yamt - 0.5_2 - - - - -

Stanislav Brabec discovered errors in yamt's path name - handling that lead to buffer overflows and directory traversal - issues. When processing a file with a maliciously crafted ID3 - tag, yamt might overwrite arbitrary files or possibly execute - arbitrary code.

-

The SuSE package ChangeLog contains:

-
-
    -
  • Several security fixes (#49337):
    • -
  • directory traversal in rename
    • -
  • directory traversal in sort
    • -
  • buffer overflow in sort
    • -
  • buffer overflow in rename
    • -
-
- - - - CVE-2005-1846 - CVE-2005-1847 - http://rpmfind.net/linux/RPM/suse/updates/8.2/i386/rpm/i586/yamt-0.5-1277.i586.html - ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/src/yamt-0.5-1277.src.rpm - - - 2005-01-20 - 2005-06-03 - - - - - xview -- multiple buffer overflows in xv_parse_one - - - xview - 3.2.1_3 - - - - -

A Debian Security Advisory reports:

-
-

Erik Sjölund discovered that programs linked against xview - are vulnerable to a number of buffer overflows in the XView - library. When the overflow is triggered in a program which - is installed setuid root a malicious user could perhaps - execute arbitrary code as privileged user.

-
- - - - CVE-2005-0076 - http://www.debian.org/security/2005/dsa-672 - http://xforce.iss.net/xforce/xfdb/19271 - - - 2005-02-09 - 2005-06-01 - - - - - xtrlock -- X display locking bypass - - - xtrlock - 2.0.10 - - - - -

The X display locking program xtrlock contains - an integer overflow bug. It is possible for an attacker with - physical access to the system to bypass the display lock.

- - - - CVE-2005-0079 - http://www.debian.org/security/2005/dsa-649 - http://xforce.iss.net/xforce/xfdb/18991 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=278191 - - - 2004-10-25 - 2005-06-01 - - - - - linux_base -- vulnerabilities in Red Hat 7.1 libraries - - - linux_base - 7.3 - - - - -

Trevor Johnson reported that the Red Hat Linux RPMs used - by linux_base contained multiple older vulnerabilities, such - as a DNS resolver issue and critical bugs in X font handling - and XPM image handling.

- - - - http://fedoralegacy.org/updates/RH7.3/2004-10-23-FLSA_2004_1947__Updated_glibc_packages_fix_flaws.html - http://rhn.redhat.com/errata/RHSA-2004-059.html - http://rhn.redhat.com/errata/RHSA-2004-478.html - http://rhn.redhat.com/errata/RHSA-2004-612.html - CVE-2002-0029 - CVE-2004-0083 - CVE-2004-0084 - CVE-2004-0106 - CVE-2004-0687 - CVE-2004-0688 - CVE-2004-0692 - CVE-2004-0914 - - - 2004-09-27 - 2005-06-01 - - - - - squirrelmail -- XSS and remote code injection vulnerabilities - - - squirrelmail - ja-squirrelmail - 1.4.4 - - - - -

A SquirrelMail Security Advisory reports:

-
-

SquirrelMail 1.4.4 has been released to resolve a number of - security issues disclosed below. It is strongly recommended - that all running SquirrelMail prior to 1.4.4 upgrade to the - latest release.

-

Remote File Inclusion

-

Manoel Zaninetti reported an issue in src/webmail.php which - would allow a crafted URL to include a remote web page. - This was assigned CAN-2005-0103 by the Common - Vulnerabilities and Exposures.

-

Cross Site Scripting Issues

-

A possible cross site scripting issue exists in - src/webmail.php that is only accessible when the PHP - installation is running with register_globals set to On. - This issue was uncovered internally by the SquirrelMail - Development team. This isssue was assigned CAN-2005-0104 by - the Common Vulnerabilities and Exposures.

-

A second issue which was resolved in the 1.4.4-rc1 release - was uncovered and assigned CAN-2004-1036 by the Common - Vulnerabilities and Exposures. This issue could allow a - remote user to send a specially crafted header and cause - execution of script (such as javascript) in the client - browser.

-

Local File Inclusion

-

A possible local file inclusion issue was uncovered by one - of our developers involving custom preference handlers. - This issue is only active if the PHP installation is running - with register_globals set to On.

-
- - - - CVE-2004-1036 - CVE-2005-0075 - CVE-2005-0103 - CVE-2005-0104 - http://marc.theaimsgroup.com/?l=bugtraq&m=110702772714662 - http://www.squirrelmail.org/security/issue/2005-01-14 - http://www.squirrelmail.org/security/issue/2005-01-19 - http://www.squirrelmail.org/security/issue/2005-01-20 - - - 2005-01-29 - 2005-06-01 - - - - - sympa -- buffer overflow in "queue" - - - sympa - 4.1.2_1 - - - - -

Erik Sjölund discovered a vulnerability in Sympa. The - queue application processes messages received via - aliases. It contains a buffer overflow in the usage of - sprintf. In some configurations, it may allow an - attacker to execute arbitrary code as the sympa - user.

- - - - CVE-2005-0073 - http://www.debian.org/security/2005/dsa-677 - - - 2005-02-11 - 2005-06-01 - - - - - mailman -- generated passwords are poor quality - - - mailman - ja-mailman - 2.1.6 - - - - -

Florian Weimer wrote:

-
-

Mailman 2.1.5 uses weak auto-generated passwords for new - subscribers. These passwords are assigned when members - subscribe without specifying their own password (either by - email or the web frontend). Knowledge of this password - allows an attacker to gain access to the list archive even - though she's not a member and the archive is restricted to - members only. [...]

-

This means that only about 5 million different passwords - are ever generated, a number that is in the range of brute - force attacks -- you only have to guess one subscriber - address (which is usually not that hard).

-
- - - - CVE-2004-1143 - http://mail.python.org/pipermail/mailman-developers/2004-December/017553.html - http://mail.python.org/pipermail/mailman-developers/attachments/20041215/be238297/attachment.mht - - - 2004-12-15 - 2005-06-01 - - - - - mailman -- password disclosure - - - mailman - ja-mailman - 2.1.5 - - - - -

Barry Warsaw reports:

-
-

Today I am releasing Mailman 2.1.5, a bug fix release - [...] This version also contains a fix for an exploit that - could allow 3rd parties to retrieve member passwords. It is - thus highly recommended that all existing sites upgrade to - the latest version.

-
- - - - CVE-2004-0412 - http://mail.python.org/pipermail/mailman-announce/2004-May/000072.html - - - 2004-05-15 - 2005-06-01 - - - - - tomcat -- Tomcat Manager cross-site scripting - - - jakarta-tomcat - 5.0.*5.0.30_5 - 5.5.*5.5.7 - - - - -

Oliver Karow discovered cross-site scripting issues in - the Apache Jakarta Tomcat manager. The developers refer to - the issues as minor.

- - - - http://www.oliverkarow.de/research/jakarta556_xss.txt - http://www.mail-archive.com/tomcat-dev@jakarta.apache.org/msg66978.html - - - 2005-01-03 - 2005-06-01 - 2006-09-12 - - - - - fswiki -- XSS problem in file upload form - - - fswiki - 3.5.6 - - - - -

A Secunia security advisory reports:

-
-

A vulnerability has been reported in FreeStyle Wiki and - FSWikiLite, which can be exploited by malicious people to - conduct script insertion attacks.

-

Input passed in uploaded attachments is not properly - sanitised before being used. This can be exploited to inject - arbitrary HTML and script code, which will be executed in a - user's browser session in context of an affected site when - the malicious attachment is viewed.

-
- - - - CVE-2005-1799 - http://secunia.com/advisories/15538 - ports/81520 - http://fswiki.poi.jp/wiki.cgi?page=%CD%FA%CE%F2%2F2005%2D5%2D19 - http://jvn.jp/jp/JVN%23465742E4/index.html - - - 2005-05-19 - 2005-05-29 - 2005-06-01 - - - - - freeradius -- sql injection and denial of service vulnerability - - - freeradius - 1.0.2_1 - - - freeradius-devel - 1.0.2 - - - - -

A Gentoo Advisory reports:

-
-

The FreeRADIUS server is vulnerable to an SQL injection - attack and a buffer overflow, possibly resulting in - disclosure and modification of data and Denial of - Service.

-
- - - - 13540 - 13541 - http://www.gentoo.org/security/en/glsa/glsa-200505-13.xml - - - 2005-05-17 - 2005-05-22 - 2008-01-20 - - - - - ppxp -- local root exploit - - - ppxp - 0 - - - ja-ppxp - 0 - - - - -

A Debian Advisory reports:

-
-

Jens Steube discovered that ppxp, yet another PPP program, - does not release root privileges when opening potentially - user supplied log files. This can be tricked into opening - a root shell.

-
- - - - CVE-2005-0392 - http://www.debian.org/security/2005/dsa-725 - - - 2005-05-19 - 2005-05-22 - - - - - oops -- format string vulnerability - - - oops - 1.5.24 - - - - -

A RST/GHC Advisory reports that there is an format string - vulnerability in oops. The vulnerability can be found in - the MySQL/PgSQL authentication module. Succesful - exploitation may allow execution of arbitrary code.

- - - - 13172 - CVE-2005-1121 - http://rst.void.ru/papers/advisory24.txt - - - 2005-04-14 - 2005-05-22 - - - - - cdrdao -- unspecified privilege escalation vulnerability - - - cdrdao - 1.2.0 - - - - -

The developers of cdrdao report that there is a potential - root exploit in the software. In order to be able to - succesfully exploit this vulnerability cdrdao must be - installed setuid root. When succesfully exploited a local - user might get escalated privileges. By default this port is - not installed setuid root.

- - - - http://secunia.com/advisories/15354/ - http://sourceforge.net/forum/forum.php?forum_id=466399 - - - 2005-05-13 - 2005-05-19 - - - - - gaim -- MSN remote DoS vulnerability - - - gaim - ja-gaim - ko-gaim - ru-gaim - 1.3.0 - - - - -

The GAIM team reports:

-
-

Potential remote denial of service bug resulting from not - checking a pointer for non-NULL before passing it to - strncmp, which results in a crash. This can be triggered - by a remote client sending an SLP message with an empty - body.

-
- - - - CVE-2005-1262 - http://gaim.sourceforge.net/security/index.php?id=17 - - - 2005-05-10 - 2005-05-14 - - - - - gaim -- remote crash on some protocols - - - gaim - ja-gaim - ko-gaim - ru-gaim - 1.3.0 - - - - -

The GAIM team reports that GAIM is vulnerable to a - denial-of-service vulnerability which can cause GAIM to - crash:

-
-

It is possible for a remote user to overflow a static - buffer by sending an IM containing a very large URL - (greater than 8192 bytes) to the Gaim user. This is not - possible on all protocols, due to message length - restrictions. Jabber are SILC are known to be - vulnerable.

-
- - - - CVE-2005-1261 - http://gaim.sourceforge.net/security/index.php?id=16 - - - 2005-05-10 - 2005-05-14 - - - - - kernel -- information disclosure when using HTT - - - FreeBSD - 5.45.4_1 - 5.05.3_15 - 4.114.11_9 - 4.10_14 - - - - -

Problem description and impact

-

When running on processors supporting Hyper-Threading Technology, it - is possible for a malicious thread to monitor the execution of another - thread.

-

Information may be disclosed to local users, allowing in many - cases for privilege escalation. For example, on a multi-user - system, it may be possible to steal cryptographic keys used in - applications such as OpenSSH or SSL-enabled web servers.

-

NOTE: Similar problems may exist in other - simultaneous multithreading implementations, or even some - systems in the absence of simultaneous multithreading. - However, current research has only demonstrated this flaw in - Hyper-Threading Technology, where shared memory caches are - used.

-

Workaround

-

Systems not using processors with Hyper-Threading Technology - support are not affected by this issue. On systems which are - affected, the security flaw can be eliminated by setting the - "machdep.hlt_logical_cpus" tunable:

- 
# echo "machdep.hlt_logical_cpus=1" >> /boot/loader.conf
-

The system must be rebooted in order for tunables to take effect.

-

Use of this workaround is not recommended on "dual-core" systems, as - this workaround will also disable one of the processor - cores.

- - - - CVE-2005-0109 - SA-05:09.htt - http://www.daemonology.net/hyperthreading-considered-harmful/ - - - 2005-05-13 - 2005-05-13 - - - - - leafnode -- fetchnews denial-of-service triggered by transmission abort/timeout - - - leafnode - 1.9.481.11.2 - - - - -

When an upstream server aborts the transmission or stops sending - data after the fetchnews program has requested an article header - or body, fetchnews may crash, without querying further servers - that are configured. This can prevent articles from being fetched. -

- - - - http://leafnode.sourceforge.net/leafnode-SA-2005-01.txt - CVE-2005-1453 - ports/80663 - 13489 - 13492 - http://sourceforge.net/mailarchive/forum.php?thread_id=7186974&forum_id=10210 - http://article.gmane.org/gmane.network.leafnode.announce/52 - http://www.dt.e-technik.uni-dortmund.de/pipermail/leafnode-list/2005q2/000900.html - http://www.fredi.de/maillist/msg00111.html - http://archives.neohapsis.com/archives/vulnwatch/2005-q2/0037.html - http://www.frsirt.com/english/advisories/2005/0468 - http://secunia.com/advisories/15252 - - - 2005-05-04 - 2005-05-13 - - - - - mozilla -- privilege escalation via non-DOM property overrides - - - firefox - 1.0.4,1 - - - linux-firefox - 1.0.4 - - - mozilla - 1.7.8,2 - 1.8.*,2 - - - linux-mozilla - linux-mozilla-devel - 1.7.8 - 1.8.* - - - netscape7 - 0 - - - - de-linux-mozillafirebird - el-linux-mozillafirebird - ja-linux-mozillafirebird-gtk1 - ja-mozillafirebird-gtk2 - linux-mozillafirebird - ru-linux-mozillafirebird - zhCN-linux-mozillafirebird - zhTW-linux-mozillafirebird - 0 - - - - de-linux-netscape - de-netscape7 - fr-linux-netscape - fr-netscape7 - ja-linux-netscape - ja-netscape7 - linux-netscape - linux-phoenix - mozilla+ipv6 - mozilla-embedded - mozilla-firebird - mozilla-gtk1 - mozilla-gtk2 - mozilla-gtk - mozilla-thunderbird - phoenix - pt_BR-netscape7 - 0 - - - - -

A Mozilla Foundation Security Advisory reports:

-
-

Additional checks were added to make sure Javascript eval - and Script objects are run with the privileges of the - context that created them, not the potentially elevated - privilege of the context calling them in order to protect - against an additional variant of MFSA - 2005-41.

-
-

The Mozilla Foundation Security Advisory MFSA 2005-41 - reports:

-
-

moz_bug_r_a4 reported several exploits giving an attacker - the ability to install malicious code or steal data, - requiring only that the user do commonplace actions like - click on a link or open the context menu.

-
- - - - http://www.mozilla.org/security/announce/mfsa2005-44.html - - - 2005-05-11 - 2005-05-12 - - - - - mozilla -- "Wrapped" javascript: urls bypass security checks - - - firefox - 1.0.4,1 - - - linux-firefox - 1.0.4 - - - mozilla - 1.7.8,2 - 1.8.*,2 - - - linux-mozilla - linux-mozilla-devel - 1.7.8 - 1.8.* - - - netscape7 - 0 - - - - de-linux-mozillafirebird - el-linux-mozillafirebird - ja-linux-mozillafirebird-gtk1 - ja-mozillafirebird-gtk2 - linux-mozillafirebird - ru-linux-mozillafirebird - zhCN-linux-mozillafirebird - zhTW-linux-mozillafirebird - 0 - - - - de-linux-netscape - de-netscape7 - fr-linux-netscape - fr-netscape7 - ja-linux-netscape - ja-netscape7 - linux-netscape - linux-phoenix - mozilla+ipv6 - mozilla-embedded - mozilla-firebird - mozilla-gtk1 - mozilla-gtk2 - mozilla-gtk - mozilla-thunderbird - phoenix - pt_BR-netscape7 - 0 - - - - -

A Mozilla Foundation Security Advisory reports:

-
-

Some security checks intended to prevent script injection - were incorrect and could be bypassed by wrapping a - javascript: url in the view-source: - pseudo-protocol. Michael Krax demonstrated that a variant - of his favicon - exploit could still execute arbitrary code, and the same - technique could also be used to perform cross-site - scripting.

-

Georgi Guninski demonstrated the same flaw wrapping - javascript: urls with the jar: pseudo-protocol.

-

L. David Baron discovered a nested variant that defeated - checks in the script security manager.

-

Workaround: Disable Javascript

-
- - - - http://www.mozilla.org/security/announce/mfsa2005-43.html - - - 2005-05-11 - 2005-05-12 - - - - - mozilla -- code execution via javascript: IconURL vulnerability - - - firefox - 1.0.4,1 - - - linux-firefox - 1.0.4 - - - mozilla - 1.7.8,2 - 1.8.*,2 - - - linux-mozilla - linux-mozilla-devel - 1.7.8 - 1.8.* - - - netscape7 - 0 - - - - de-linux-mozillafirebird - el-linux-mozillafirebird - ja-linux-mozillafirebird-gtk1 - ja-mozillafirebird-gtk2 - linux-mozillafirebird - ru-linux-mozillafirebird - zhCN-linux-mozillafirebird - zhTW-linux-mozillafirebird - 0 - - - - de-linux-netscape - de-netscape7 - fr-linux-netscape - fr-netscape7 - ja-linux-netscape - ja-netscape7 - linux-netscape - linux-phoenix - mozilla+ipv6 - mozilla-embedded - mozilla-firebird - mozilla-gtk1 - mozilla-gtk2 - mozilla-gtk - mozilla-thunderbird - phoenix - pt_BR-netscape7 - 0 - - - - -

A Mozilla Foundation Security Advisory reports:

-
-

Two vulnerabilities have been discovered in Firefox, - which can be exploited by malicious people to conduct - cross-site scripting attacks and compromise a user's - system.

-
    -
  1. The problem is that "IFRAME" JavaScript URLs are not - properly protected from being executed in context of - another URL in the history list. This can be exploited - to execute arbitrary HTML and script code in a user's - browser session in context of an arbitrary site.
    2. -
  2. Input passed to the "IconURL" parameter in - "InstallTrigger.install()" is not properly verified - before being used. This can be exploited to execute - arbitrary JavaScript code with escalated privileges via - a specially crafted JavaScript URL.
    3. -
-

Successful exploitation requires that the site is allowed - to install software (default sites are - "update.mozilla.org" and "addons.mozilla.org").

-

A combination of vulnerability 1 and 2 can be exploited - to execute arbitrary code.

-
- - - - CVE-2005-1476 - CVE-2005-1477 - http://www.mozilla.org/security/announce/mfsa2005-42.html - - - 2005-05-08 - 2005-05-11 - - - - - groff -- pic2graph and eqn2graph are vulnerable to symlink attack through temporary files - - - ja-groff - 1.18.11.18.1_8 - - - - -

The eqn2graph and pic2graph scripts in groff 1.18.1 - allow local users to overwrite arbitrary files via - a symlink attack on temporary files.

- - - - ports/80671 - 12058 - CVE-2004-1296 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=286371 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=286372 - - - 2004-12-20 - 2005-05-09 - - - - - groff -- groffer uses temporary files unsafely - - - ja-groff - 1.181.18.1_8 - - - - -

The groffer script in the groff package 1.18 and later versions - allows local users to overwrite files via a symlink attack - on temporary files.

- - - - ports/80671 - 11287 - CVE-2004-0969 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=278265 - - - 2004-09-30 - 2005-05-09 - - - - - sharutils -- unshar insecure temporary file creation - - - sharutils - 4.3.80 - - - - -

An Ubuntu Advisory reports:

-
-

Joey Hess discovered that "unshar" created temporary files - in an insecure manner. This could allow a symbolic link - attack to create or overwrite arbitrary files with the - privileges of the user invoking the program.

-
- - - - 12981 - CVE-2005-0990 - http://www.ubuntulinux.org/support/documentation/usn/usn-104-1 - - - 2005-04-04 - 2005-05-01 - - - - - rsnapshot -- local privilege escalation - - - rsnapshot - 1.1.7 - - - - -

An rsnapshot Advisory reports:

-
-

The copy_symlink() subroutine in rsnapshot incorrectly - changes file ownership on the files pointed to by symlinks, - not on the symlinks themselves. This would allow, under - certain circumstances, an arbitrary user to take ownership - of a file on the main filesystem.

-
- - - - 13095 - CVE-2005-1064 - http://www.rsnapshot.org/security/2005/001.html - - - 2005-04-10 - 2005-05-01 - - - - - coppermine -- IP spoofing and XSS vulnerability - - - coppermine - 1.3.2 - - - - -

GHC team reports about coppermine

-
-

The lack of sanitizing of user defined variables may - result in undesirable consequences such as IP spoofing - or XSS attack.

-

Generally users of Coppermine Gallery can post comments. - Remote address & x-forwarded-for variables are logged - for admin's eyes. X-Forwarded-for variable does not pass - throu any filtration before logging into database. User - can define/redefine this variable.

-
- - - - http://www.securityfocus.com/archive/1/396080 - 13218 - CVE-2005-1172 - http://coppermine.sourceforge.net/board/index.php?topic=17134.0 - - - 2005-04-18 - 2005-05-01 - - - - - ImageMagick -- ReadPNMImage() heap overflow vulnerability - - - ImageMagick - ImageMagick-nox11 - 6.2.2 - - - - -

Damian Put reports about ImageMagick:

-
-

Remote exploitation of a heap overflow vulnerability - could allow execution of arbitrary code or course denial - of service.

-

A heap overflow exists in ReadPNMImage() function, that - is used to decode a PNM image files.

-
- - - - 13351 - http://marc.theaimsgroup.com/?l=bugtraq&m=111445767107869 - - - 2005-04-25 - 2005-04-27 - - - - - mplayer & libxine -- MMS and Real RTSP buffer overflow vulnerabilities - - - mplayer - mplayer-gtk - mplayer-gtk2 - mplayer-esound - mplayer-gtk-esound - mplayer-gtk2-esound - 0.99.7 - - - libxine - 0.9.91.0.1 - - - - -

A xine security announcement reports:

-
-

By a user receiving data from a malicious network - streaming server, an attacker can overrun a heap buffer, - which can, on some systems, lead to or help in executing - attacker-chosen malicious code with the permissions of the - user running a xine-lib based media application.

-

Both the MMS and Real RTSP streaming client code made - some too-strong assumptions on the transferred - data. Several critical bounds checks were missing, - resulting in the possibility of heap overflows, should the - remote server not adhere to these assumptions. In the MMS - case, a remote server could present content with too many - individual streams; in the RTSP case, a remote server's - reply could have too many lines.

-

An attacker can set up a server delivering malicious data - to the users. This can be used to overflow a heap buffer, - which can, with certain implementations of heap - management, lead to attacker chosen data written to the - stack. This can cause attacker-chosen code being executed - with the permissions of the user running the - application. By tricking users to retrieve a stream, which - can be as easy as providing a link on a website, this - vulnerability can be exploited remotely.

-
- - - - 13270 - 13271 - CVE-2005-1195 - http://www.mplayerhq.hu/homepage/design7/news.html#vuln10 - http://www.mplayerhq.hu/homepage/design7/news.html#vuln11 - http://xinehq.de/index.php/security/XSA-2004-8 - - - 2005-04-16 - 2005-04-25 - - - - - gaim -- AIM/ICQ remote denial of service vulnerability - - - gaim - ja-gaim - ko-gaim - ru-gaim - 1.1.3 - - - - -

The GAIM team reports that GAIM is vulnerable to a - denial-of-service vulnerability which can cause GAIM to - freeze:

-
-

Certain malformed SNAC packets sent by other AIM or ICQ - users can trigger an infinite loop in Gaim when parsing - the SNAC. The remote user would need a custom client, able - to generate malformed SNACs.

-
- - - - CVE-2005-0472 - http://gaim.sourceforge.net/security/index.php?id=10 - - - 2005-02-17 - 2005-04-25 - - - - - gaim -- remote DoS on receiving malformed HTML - - - gaim - ja-gaim - ko-gaim - ru-gaim - 1.1.4 - - - - -

The GAIM team reports:

-
-

Receiving malformed HTML can result in an invalid memory - access causing Gaim to crash.

-
- - - - CVE-2005-0208 - CVE-2005-0473 - http://gaim.sourceforge.net/security/index.php?id=11 - http://gaim.sourceforge.net/security/index.php?id=12 - - - 2005-02-17 - 2005-04-25 - - - - - kdewebdev -- kommander untrusted code execution vulnerability - - - kdewebdev - 3.2,23.4.0_1,2 - - - - -

A KDE Security Advisory reports:

-
-

Kommander executes without user confirmation data files - from possibly untrusted locations. As they contain - scripts, the user might accidentally run arbitrary - code.

-

Impact: Remotly supplied kommander files - from untrusted sources are executed without - confirmation.

-
- - - - CVE-2005-0754 - http://www.kde.org/info/security/advisory-20050420-1.txt - - - 2005-04-20 - 2005-04-23 - 2008-08-04 - - - - - junkbuster -- heap corruption vulnerability and configuration modification vulnerability - - - junkbuster - 2.0.2_3 - - - junkbuster-zlib - 0 - - - - -

A Debian advisory reports:

-
-

James Ranson discovered that an attacker can modify the - referrer setting with a carefully crafted URL by accidently - overwriting a global variable.

-

Tavis Ormandy from the Gentoo Security Team discovered - several heap corruptions due to inconsistent use of an - internal function that can crash the daemon or possibly - lead to the execution of arbitrary code.

-
- - - - 13146 - 13147 - CVE-2005-1108 - CVE-2005-1109 - http://www.debian.org/security/2005/dsa-713 - http://www.gentoo.org/security/en/glsa/glsa-200504-11.xml - - - 2005-04-13 - 2005-04-22 - - - - - kdelibs -- kimgio input validation errors - - - kdelibs - 3.23.4.0_2 - - - - -

A KDE Security Advisory reports:

-
-

kimgio contains a PCX image file format reader that does - not properly perform input validation. A source code audit - performed by the KDE security team discovered several - vulnerabilities in the PCX and other image file format - readers, some of them exploitable to execute arbitrary - code.

-

Impact: Remotely supplied, specially - crafted image files can be used to execute arbitrary - code.

-
- - - - CVE-2005-1046 - http://bugs.kde.org/102328 - http://www.kde.org/info/security/advisory-20050421-1.txt - - - 2005-04-21 - 2005-04-22 - - - - - gld -- format string and buffer overflow vulnerabilities - - - gld - 1.5 - - - - -

Gld has been found vulnerable to multiple buffer overflows as - well as multiple format string vulnerabilities.

-
-

An attacker could exploit this vulnerability to execute - arbitrary code with the permissions of the user running Gld, - the default user being root.

-
-

The FreeBSD port defaults to running gld as the root user. - The risk of exploitation can be minimized by making gld - listen on the loopback address only, or configure it to only - accept connections from trusted smtp servers.

- - - - 13129 - 13133 - CVE-2005-1099 - CVE-2005-1100 - http://marc.theaimsgroup.com/?l=bugtraq&m=111339935903880 - http://marc.theaimsgroup.com/?l=bugtraq&m=111342432325670 - - - 2005-04-12 - 2005-04-19 - - - - - axel -- remote buffer overflow - - - axel - 1.0a_4 - - - - -

A Debian Security Advisory reports:

-
-

Ulf Härnhammar from the Debian Security Audit Project - discovered a buffer overflow in axel, a light download - accelerator. When reading remote input the program did - not check if a part of the input can overflow a buffer - and maybe trigger the execution of arbitrary code.

-
- - - - 13059 - CVE-2005-0390 - http://www.debian.org/security/2005/dsa-706 - - - 2005-04-16 - 2005-04-17 - - - - - firefox -- PLUGINSPAGE privileged javascript execution - - - firefox - 1.0.3,1 - - - linux-firefox - 1.0.3 - - - - -

A Mozilla Foundation Security Advisory reports:

-
-

When a webpage requires a plugin that is not installed - the user can click to launch the Plugin Finder Service - (PFS) to find an appropriate plugin. If the service does - not have an appropriate plugin the EMBED tag is checked - for a PLUGINSPAGE attribute, and if one is found the PFS - dialog will contain a "manual install" button that will - load the PLUGINSPAGE url.

-

Omar Khan reported that if the PLUGINSPAGE attribute - contains a javascript: url then pressing the button could - launch arbitrary code capable of stealing local data or - installing malicious code.

-

Doron Rosenberg reported a variant that injects script by - appending it to a malformed URL of any protocol.

-
- - - - CVE-2005-0752 - http://www.mozilla.org/security/announce/mfsa2005-34.html - https://bugzilla.mozilla.org/show_bug.cgi?id=288556 - https://bugzilla.mozilla.org/show_bug.cgi?id=289171 - - - 2005-03-31 - 2005-04-16 - - - - - jdk -- jar directory traversal vulnerability - - - jdk - 1.2.2p11_3 - 1.3.*1.3.1p9_4 - 1.4.*1.4.2p7 - 1.5.*1.5.0p1_1 - - - linux-ibm-jdk - 1.4.2_1 - - - linux-sun-jdk - 1.4.2.08_1 - 1.5.0b1 - 1.5.0b1,1 - 1.5.0,21.5.0.02,2 - - - linux-blackdown-jdk - 1.4.2_2 - - - diablo-jdk - 1.3.1.0_1 - - - diablo-jdk-freebsd6 - i386.1.5.0.07.00 - - - linux-jdk - 0 - - - - -

Pluf has discovered a vulnerability in Sun Java JDK/SDK, - which potentially can be exploited by malicious people to - compromise a user's system.

-
-

The jar tool does not check properly if the files to be - extracted have the string "../" on its names, so it's - possible for an attacker to create a malicious jar file in - order to overwrite arbitrary files within the filesystem.

-
- - - - CVE-2005-1080 - http://marc.theaimsgroup.com/?l=bugtraq&m=111331593310508 - http://www.securiteam.com/securitynews/5IP0C0AFGW.html - http://secunia.com/advisories/14902/ - - - 2005-04-11 - 2005-04-16 - 2006-09-12 - - - - - mozilla -- privilege escalation via DOM property overrides - - - firefox - 1.0.3,1 - - - linux-firefox - 1.0.3 - - - mozilla - 1.7.7,2 - 1.8.*,2 - - - linux-mozilla - linux-mozilla-devel - 1.7.7 - 1.8.* - - - netscape7 - 0 - - - - de-linux-mozillafirebird - el-linux-mozillafirebird - ja-linux-mozillafirebird-gtk1 - ja-mozillafirebird-gtk2 - linux-mozillafirebird - ru-linux-mozillafirebird - zhCN-linux-mozillafirebird - zhTW-linux-mozillafirebird - 0 - - - - de-linux-netscape - de-netscape7 - fr-linux-netscape - fr-netscape7 - ja-linux-netscape - ja-netscape7 - linux-netscape - linux-phoenix - mozilla+ipv6 - mozilla-embedded - mozilla-firebird - mozilla-gtk1 - mozilla-gtk2 - mozilla-gtk - mozilla-thunderbird - phoenix - pt_BR-netscape7 - 0 - - - - -

A Mozilla Foundation Security Advisory reports:

-
-

moz_bug_r_a4 reported several exploits giving an attacker - the ability to install malicious code or steal data, - requiring only that the user do commonplace actions like - click on a link or open the context menu. The common cause - in each case was privileged UI code ("chrome") being - overly trusting of DOM nodes from the content - window. Scripts in the web page can override properties - and methods of DOM nodes and shadow the native values, - unless steps are taken to get the true underlying values.

-

We found that most extensions also interacted with - content DOM in a natural, but unsafe, manner. Changes were - made so that chrome code using this natural DOM coding - style will now automatically use the native DOM value if - it exists without having to use cumbersome wrapper - objects.

-

Most of the specific exploits involved tricking the - privileged code into calling eval() on an - attacker-supplied script string, or the equivalent using - the Script() object. Checks were added in the security - manager to make sure eval and Script objects are run with - the privileges of the context that created them, not the - potentially elevated privileges of the context calling - them.

-

Workaround: Disable Javascript

-
- - - - http://www.mozilla.org/security/announce/mfsa2005-41.html - - - 2005-04-15 - 2005-04-16 - - - - - mozilla -- code execution through javascript: favicons - - - firefox - 1.0.3,1 - - - linux-firefox - 1.0.3 - - - mozilla - 1.7.7,2 - 1.8.*,2 - - - linux-mozilla - linux-mozilla-devel - 1.7.7 - 1.8.* - - - netscape7 - 0 - - - - de-linux-mozillafirebird - el-linux-mozillafirebird - ja-linux-mozillafirebird-gtk1 - ja-mozillafirebird-gtk2 - linux-mozillafirebird - ru-linux-mozillafirebird - zhCN-linux-mozillafirebird - zhTW-linux-mozillafirebird - 0 - - - - de-linux-netscape - de-netscape7 - fr-linux-netscape - fr-netscape7 - ja-linux-netscape - ja-netscape7 - linux-netscape - linux-phoenix - mozilla+ipv6 - mozilla-embedded - mozilla-firebird - mozilla-gtk1 - mozilla-gtk2 - mozilla-gtk - mozilla-thunderbird - phoenix - pt_BR-netscape7 - 0 - - - - -

A Mozilla Foundation Security Advisory reports:

-
-

Firefox and the Mozilla Suite support custom "favicons" - through the <LINK rel="icon"> tag. If a link tag is added - to the page programmatically and a javascript: url is - used, then script will run with elevated privileges and - could run or install malicious software.

-

Workaround: Disable Javascript

-
- - - - http://www.mozilla.org/security/announce/mfsa2005-37.html - - - 2005-04-12 - 2005-04-16 - - - - - mozilla -- javascript "lambda" replace exposes memory contents - - - firefox - 1.0.3,1 - - - linux-firefox - 1.0.3 - - - mozilla - 1.7.7,2 - 1.8.*,2 - - - linux-mozilla - linux-mozilla-devel - 1.7.7 - 1.8.* - - - netscape7 - 0 - - - - de-linux-mozillafirebird - el-linux-mozillafirebird - ja-linux-mozillafirebird-gtk1 - ja-mozillafirebird-gtk2 - linux-mozillafirebird - ru-linux-mozillafirebird - zhCN-linux-mozillafirebird - zhTW-linux-mozillafirebird - 0 - - - - de-linux-netscape - de-netscape7 - fr-linux-netscape - fr-netscape7 - ja-linux-netscape - ja-netscape7 - linux-netscape - linux-phoenix - mozilla+ipv6 - mozilla-embedded - mozilla-firebird - mozilla-gtk1 - mozilla-gtk2 - mozilla-gtk - mozilla-thunderbird - phoenix - pt_BR-netscape7 - 0 - - - - -

A Mozilla Foundation Security Advisory reports:

-
-

A bug in javascript's regular expression string - replacement when using an anonymous function as the - replacement argument allows a malicious script to capture - blocks of memory allocated to the browser. A web site - could capture data and transmit it to a server without - user interaction or knowledge.

-

Workaround: Disable Javascript

-
- - - - CVE-2005-0989 - http://www.mozilla.org/security/announce/mfsa2005-33.html - https://bugzilla.mozilla.org/show_bug.cgi?id=288688 - - - 2005-04-01 - 2005-04-16 - - - - - firefox -- arbitrary code execution in sidebar panel - - - firefox - 1.0.3,1 - - - linux-firefox - 1.0.3 - - - - -

A Mozilla Foundation Security Advisory reports:

-
-

Sites can use the _search target to open links in the - Firefox sidebar. Two missing security checks allow - malicious scripts to first open a privileged page (such as - about:config) and then inject script using a javascript: - url. This could be used to install malicious code or steal - data without user interaction.

-

Workaround: Disable Javascript

-
- - - - http://www.mozilla.org/security/announce/mfsa2005-39.html - - - 2005-04-12 - 2005-04-16 - - - - - openoffice -- DOC document heap overflow vulnerability - - - openoffice - ar-openoffice - ca-openoffice - cs-openoffice - de-openoffice - dk-openoffice - el-openoffice - es-openoffice - et-openoffice - fi-openoffice - fr-openoffice - gr-openoffice - hu-openoffice - it-openoffice - ja-openoffice - ko-openoffice - nl-openoffice - pl-openoffice - pt-openoffice - pt_BR-openoffice - ru-openoffice - se-openoffice - sk-openoffice - sl-openoffice-SI - tr-openoffice - zh-openoffice-CN - zh-openoffice-TW - - jp-openoffice - kr-openoffice - sl-openoffice-SL - zh-openoffice - zh_TW-openoffice - 1.1.4_2 - 2.*2.0.20050406 - - - openoffice - ja-openoffice - 6.0.a6096.0.a638 - 641c645 - 1.1RC4 - 1.1rc5 - - - - -

AD-LAB reports that a heap-based buffer overflow - vulnerability exists in OpenOffice's handling of DOC - documents. When reading a DOC document 16 bit from a 32 bit - integer is used for memory allocation, but the full 32 bit - is used for further processing of the document. This can - allow an attacker to crash OpenOffice, or potentially - execute arbitrary code as the user running OpenOffice, by - tricking an user into opening a specially crafted DOC - document.

- - - - 13092 - CVE-2005-0941 - http://marc.theaimsgroup.com/?l=bugtraq&m=111325305109137 - http://www.openoffice.org/issues/show_bug.cgi?id=46388 - - - 2005-04-11 - 2005-04-13 - 2005-04-20 - - - - - portupgrade -- insecure temporary file handling vulnerability - - - portupgrade - 20041226_2 - - - - -

Simon L. Nielsen discovered that portupgrade handles - temporary files in an insecure manner. This could allow an - unprivileged local attacker to execute arbitrary commands or - overwrite arbitrary files with the permissions of the user - running portupgrade, typically root, by way of a symlink - attack.

-

The following issues exist where the temporary files are - created, by default in the world writeable directory - /var/tmp, with the permissions of the user running - portupgrade:

-
    -
  • pkg_fetch download packages with a predictable local - filename allowing a local attacker to overwrite arbitrary - local files or potentially replace the downloaded package - after download but before install with a package with - malicious content, allowing the attacker to run arbitrary - commands.
    • -
  • portupgrade will, when upgrading ports/packages, write - the old package to a predictable temporary file, allowing - an attacker to overwrite arbitrary files via a symlink - attack.
    • -
  • portupgrade will touch a temporary file - with a constant filename (pkgdb.fixme) allowing an - attacker to create arbitrary zero-byte files via a symlink - attack.
    • -
-

A workaround for these issues is to set the - PKG_TMPDIR environment variable to a directory - only write-able by the user running portupgrade.

- - - - CVE-2005-0610 - - - 2005-04-12 - 2005-04-12 - - - - - gaim -- jabber remote crash - - - gaim - ja-gaim - ko-gaim - ru-gaim - 1.2.1 - - - - -

The GAIM team reports:

-
-

A remote jabber user can cause Gaim to crash by sending a - specific file transfer request.

-
- - - - 13004 - CVE-2005-0967 - http://gaim.sourceforge.net/security/?id=15 - - - 2005-04-04 - 2005-04-10 - - - - - gaim -- remote DoS on receiving certain messages over IRC - - - gaim - ja-gaim - ko-gaim - ru-gaim - 1.2.1 - - - - -

The GAIM team reports:

-
-

The IRC protocol plugin in Gaim 1.2.0, and possibly - earlier versions, allows (1) remote attackers to inject - arbitrary Gaim markup via irc_msg_kick, irc_msg_mode, - irc_msg_part, irc_msg_quit, (2) remote attackers to inject - arbitrary Pango markup and pop up empty dialog boxes via - irc_msg_invite, or (3) malicious IRC servers to cause a - denial of service (application crash) by injecting certain - Pango markup into irc_msg_badmode, irc_msg_banned, - irc_msg_unknown, irc_msg_nochan functions.

-
- - - - 13003 - CVE-2005-0966 - http://gaim.sourceforge.net/security/?id=14 - - - 2005-04-02 - 2005-04-10 - - - - - gaim -- remote DoS on receiving malformed HTML - - - gaim - ja-gaim - ko-gaim - ru-gaim - 1.2.1 - - - - -

The GAIM team reports:

-
-

The gaim_markup_strip_html function in Gaim 1.2.0, and - possibly earlier versions, allows remote attackers to - cause a denial of service (application crash) via a string - that contains malformed HTML, which causes an - out-of-bounds read.

-
- - - - 12999 - CVE-2005-0965 - http://gaim.sourceforge.net/security/?id=13 - - - 2005-04-02 - 2005-04-10 - - - - - php -- readfile() DoS vulnerability - - - mod_php4-twig - php4-cgi - php4-cli - php4-dtc - php4-horde - php4-nms - php4 - 4.3.5_7 - - - mod_php - mod_php4 - 4.3.5_7,1 - - - - -

A SUSE Security advisory reports:

-
-

A bug in the readfile() function of php4 could be used to - to crash the httpd running the php4 code when accessing - files with a multiple of the architectures page size - leading to a denial of service.

-
- - - - 12665 - CVE-2005-0596 - http://bugs.php.net/bug.php?id=27037 - http://www.novell.com/linux/security/advisories/2005_06_sr.html - - - 2004-01-25 - 2005-04-10 - - - - - squid -- DoS on failed PUT/POST requests vulnerability - - - squid - 2.5.7_12 - - - - -

The squid patches page notes:

-
-

An inconsistent state is entered on a failed PUT/POST - request making a high risk for segmentation faults or - other strange errors

-
- - - - CVE-2005-0718 - http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-post - http://www.squid-cache.org/bugs/show_bug.cgi?id=1224 - - - 2005-02-03 - 2005-04-10 - - - - - horde -- Horde Page Title Cross-Site Scripting Vulnerability - - - horde - horde-php5 - 3.*3.0.4 - - - - -

Secunia Advisory: SA14730

-
-

A vulnerability has been reported in Horde, which can be - exploited by malicious people to conduct cross-site scripting - attacks.

-

Input passed when setting the parent frame's page title via - JavaScript is not properly sanitised before being returned to - the user. This can be exploited to execute arbitrary HTML and - script code in a user's browser session in context of an affected - site.

-

The vulnerability has been reported in version 3.0.4-RC2. Prior - versions may also be affected.

-
- - - - CVE-2005-0961 - http://lists.horde.org/archives/announce/2005/000176.html - http://cvs.horde.org/diff.php/horde/docs/CHANGES?r1=1.515.2.49&r2=1.515.2.93&ty=h - - - 2005-03-29 - 2005-04-05 - - - - - wu-ftpd -- remote globbing DoS vulnerability - - - wu-ftpd - 2.6.2_6 - - - wu-ftpd+ipv6 - 2.6.2_7 - - - - -

An iDEFENSE Security Advisory reports:

-
-

Remote exploitation of an input validation vulnerability - in version 2.6.2 of WU-FPTD could allow for a denial of - service of the system by resource exhaustion.

-

The vulnerability specifically exists in the - wu_fnmatch() function in wu_fnmatch.c. When a - pattern containing a '*' character is supplied as input, - the function calls itself recursively on a smaller - substring. By supplying a string which contains a large - number of '*' characters, the system will take a long time - to return the results, during which time it will be using - a large amount of CPU time.

-
- - - - CVE-2005-0256 - http://marc.theaimsgroup.com/?l=bugtraq&m=110935886414939 - - - 2005-02-05 - 2005-04-04 - - - - - hashcash -- format string vulnerability - - - hashcash - 1.17 - - - - -

A Gentoo Linux Security Advisory reports:

-
-

Tavis Ormandy of the Gentoo Linux Security Audit Team - identified a flaw in the Hashcash utility that an attacker - could expose by specifying a malformed reply address.

-

Successful exploitation would permit an attacker to disrupt - Hashcash users, and potentially execute arbitrary code.

-
- - - - CVE-2005-0687 - http://www.gentoo.org/security/en/glsa/glsa-200503-12.xml - - - 2005-03-06 - 2005-04-02 - 2005-04-03 - - - - - clamav -- zip handling DoS vulnerability - - - clamav - 0.81 - - - clamav-devel - 20050408 - - - - -

The clamav daemon is vulnerable to a DoS vulnerability due - to insufficient handling of malformed zip files which can - crash the clamav daemon.

- - - - 12408 - CVE-2005-0133 - http://sourceforge.net/project/shownotes.php?release_id=300116 - - - 2005-01-27 - 2005-03-26 - 2005-04-09 - - - - - wine -- information disclosure due to insecure temporary file handling - - - wine - 20050310 - - - - -

Due to insecure temporary file creation in the Wine Windows - emulator, it is possible for any user to read potentially - sensitive information from temporary registry files.

-
-

When a Win32 application is launched by wine, wine makes - a dump of the Windows registry in /tmp with name - regxxxxyyyy.tmp , where xxxxxx is the pid in hexadecimal - value of the current wine process and yyyy is an integer - value usually equal to zero.

-

regxxxxyyyy.tmp is created with 0644 (-rw-r--r--) - permissions. This could represent a security problem in a - multi-user environment. Indeed, any local user could - access to windows regstry's dump and get sensitive - information, like passwords and other private data.

-
- - - - CVE-2005-0787 - http://marc.theaimsgroup.com/?l=bugtraq&m=111082537009842 - http://bugs.winehq.org/show_bug.cgi?id=2715 - http://www.securitytracker.com/alerts/2005/Mar/1013428.html - http://www.zone-h.org/advisories/read/id=7300 - http://www.securityfocus.com/bid/12791 - http://xforce.iss.net/xforce/xfdb/19697 - - - 2005-03-13 - 2005-03-24 - - - - - firefox -- arbitrary code execution from sidebar panel - - - firefox - 1.0.2,1 - - - linux-firefox - 1.0.2 - - - - -

A Mozilla Foundation Security Advisory states:

-
-

If a user bookmarked a malicious page as a Firefox - sidebar panel that page could execute arbitrary programs - by opening a privileged page and injecting javascript into - it.

-
- - - - CVE-2005-0402 - http://www.mozilla.org/security/announce/mfsa2005-31.html - - - 2005-03-03 - 2005-03-24 - - - - - mozilla -- heap buffer overflow in GIF image processing - - - firefox - 1.0.2,1 - - - thunderbird - linux-firefox - 1.0.2 - - - mozilla - 1.7.6,2 - 1.8.*,2 - - - linux-mozilla - linux-mozilla-devel - 1.7.6 - 1.8.* - - - netscape7 - 0 - - - - de-linux-mozillafirebird - el-linux-mozillafirebird - ja-linux-mozillafirebird-gtk1 - ja-mozillafirebird-gtk2 - linux-mozillafirebird - ru-linux-mozillafirebird - zhCN-linux-mozillafirebird - zhTW-linux-mozillafirebird - 0 - - - - de-linux-netscape - de-netscape7 - fr-linux-netscape - fr-netscape7 - ja-linux-netscape - ja-netscape7 - linux-netscape - linux-phoenix - mozilla+ipv6 - mozilla-embedded - mozilla-firebird - mozilla-gtk1 - mozilla-gtk2 - mozilla-gtk - mozilla-thunderbird - phoenix - pt_BR-netscape7 - 0 - - - - -

A Mozilla Foundation Security Advisory states:

-
-

An (sic) GIF processing error when parsing the - obsolete Netscape extension 2 can lead to an exploitable - heap overrun, allowing an attacker to run arbitrary code on - the user's machine.

-
- - - - CVE-2005-0399 - http://www.mozilla.org/security/announce/mfsa2005-30.html - http://xforce.iss.net/xforce/alerts/id/191 - https://bugzilla.mozilla.org/show_bug.cgi?id=285595 - - - 2005-03-10 - 2005-03-24 - - - - - sylpheed -- buffer overflow in header processing - - - sylpheed - sylpheed-claws - sylpheed-gtk2 - 0.8.*1.0.3 - 1.9.*1.9.5 - - - - -

The Sylpheed web site states:

-
-

A buffer overflow which occurred when replying to a - message with certain headers which contain non-ascii - characters was fixed.

-
- - - - CVE-2005-0667 - http://sylpheed.good-day.net/index.cgi.en#changes - - - 2005-03-07 - 2005-03-23 - - - - - xv -- filename handling format string vulnerability - - - xv - ja-xv - 3.10a_5 - - - - -

A Gentoo Linux Security Advisory reports:

-
-

Tavis Ormandy of the Gentoo Linux Security Audit Team - identified a flaw in the handling of image filenames by xv.

-

Successful exploitation would require a victim to process - a specially crafted image with a malformed filename, - potentially resulting in the execution of arbitrary code.

-
- - - - CVE-2005-0665 - http://www.gentoo.org/security/en/glsa/glsa-200503-09.xml - - - 2005-03-01 - 2005-03-21 - - - - - kdelibs -- local DCOP denial of service vulnerability - - - ja-kdelibs - kdelibs-nocups - kdelibs - 3.4.0 - - - - -

A KDE Security Advisory reports:

-
-

Sebastian Krahmer of the SUSE LINUX Security Team - reported a local denial of service vulnerability in KDE's - Desktop Communication Protocol (DCOP) daemon better known - as dcopserver.

-

A local user can lock up the dcopserver of arbitrary - other users on the same machine. This can cause a - significant reduction in desktop functionality for the - affected users including, but not limited to, the - inability to browse the internet and the inability to - start new applications.

-
- - - - CVE-2005-0396 - http://www.kde.org/info/security/advisory-20050316-1.txt - - - 2005-03-16 - 2005-03-21 - - - - - phpmyadmin -- increased privilege vulnerability - - - phpmyadmin - phpMyAdmin - 2.6.1.3 - - - - -

The phpMyAdmin team reports:

-
-

Escaping of the "_" character was not properly done, - giving a wildcard privilege when editing db-specific - privileges with phpMyAdmin.

-
- - - - CVE-2005-0653 - http://sourceforge.net/forum/forum.php?forum_id=450948 - http://sourceforge.net/tracker/index.php?func=detail&aid=1113788&group_id=23067&atid=377408 - - - 2005-02-01 - 2005-03-15 - - - - - ethereal -- multiple protocol dissectors vulnerabilities - - - ethereal - ethereal-lite - tethereal - tethereal-lite - 0.9.10.10.10 - - - - -

An Ethreal Security Advisories reports:

-
-

Issues have been discovered in the following protocol - dissectors:

-
    -
  • Matevz Pustisek discovered a buffer overflow in the - Etheric dissector. CVE: CAN-2005-0704
    • -
  • The GPRS-LLC dissector could crash if the "ignore - cipher bit" option was enabled. CVE: CAN-2005-0705
    • -
  • Diego Giago discovered a buffer overflow in the 3GPP2 - A11 dissector. This flaw was later reported by Leon - Juranic. CVE: CAN-2005-0699
    • -
  • Leon Juranic discovered a buffer overflow in the IAPP dissector. - CVE: CAN-2005-0739
    • -
  • A bug in the JXTA dissector could make Ethereal crash.
    • -
  • A bug in the sFlow dissector could make Ethereal crash.
    • -
-
- - - - 12759 - CVE-2005-0699 - CVE-2005-0704 - CVE-2005-0705 - CVE-2005-0739 - http://www.ethereal.com/appnotes/enpa-sa-00018.html - - - 2005-03-09 - 2005-03-14 - 2005-06-24 - - - - - grip -- CDDB response multiple matches buffer overflow vulnerability - - - grip - 3.2.0_7 - - - - -

Joseph VanAndel reports that grip is vulnerability to a - buffer overflow vulnerability when receiving more than 16 - CDDB responses. This could lead to a crash in grip and - potentially execution arbitrary code.

-

A workaround is to disable CDDB lookups.

- - - - 12770 - CVE-2005-0706 - http://sourceforge.net/tracker/index.php?func=detail&aid=834724&group_id=3714&atid=103714 - - - 2003-11-02 - 2005-03-14 - 2005-03-18 - - - - - mysql-server -- multiple remote vulnerabilities - - - mysql-server - 4.0.04.0.24 - 4.1.04.1.10a - - - - -

SecurityFocus reports:

-
-

MySQL is reported prone to an insecure temporary file creation - vulnerability.

-

Reports indicate that an attacker that has 'CREATE TEMPORARY TABLE' - privileges on an affected installation may leverage this - vulnerability to corrupt files with the privileges of the MySQL - process.

-

MySQL is reported prone to an input validation vulnerability that - can be exploited by remote users that have INSERT and DELETE - privileges on the 'mysql' administrative database.

-

Reports indicate that this issue may be leveraged to load an - execute a malicious library in the context of the MySQL process.

-

Finally, MySQL is reported prone to a remote arbitrary code - execution vulnerability. It is reported that the vulnerability may - be triggered by employing the 'CREATE FUNCTION' statement to - manipulate functions in order to control sensitive data - structures.

-

This issue may be exploited to execute arbitrary code in the - context of the database process.

-
- - - - 12781 - CVE-2005-0709 - CVE-2005-0710 - CVE-2005-0711 - - - 2005-03-11 - 2005-03-14 - - - - - rxvt-unicode -- buffer overflow vulnerability - - - rxvt-unicode - 5.3 - - - - -

A rxvt-unicode changelog reports:

-
-

Fix a bug that allowed to overflow a buffer via a long - escape sequence, which is probably exploitable (fix by - Rob Holland / Yoann Vandoorselaere / Gentoo Audit Team).

-
- - - - http://dist.schmorp.de/rxvt-unicode/Changes - - - 2005-03-13 - 2005-03-13 - - - - - phpmyadmin -- information disclosure vulnerability - - - phpmyadmin - phpMyAdmin - 2.6.1.2 - - - - -

A phpMyAdmin security announcement reports:

-
-

By calling some scripts that are part of phpMyAdmin in an - unexpected way (especially scripts in the libraries - subdirectory), it is possible to trigger phpMyAdmin to - display a PHP error message which contains the full path - of the directory where phpMyAdmin is installed.

-

Mitigation factor: This path disclosure - is possible on servers where the recommended setting of - the PHP configuration directive - display_errors is set to on, which is against - the recommendations given in the PHP manual.

-
- - - - CVE-2005-0544 - http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-2 - - - 2005-02-22 - 2005-03-08 - - - - - phpmyadmin -- arbitrary file include and XSS vulnerabilities - - - phpmyadmin - phpMyAdmin - 1.3.12.6.1.2 - - - - -

A phpMyAdmin security announcement reports:

-
-

We received two bug reports by Maksymilian Arciemowicz - about those vulnerabilities and we wish to thank him for - his work. The vulnerabilities apply to those points:

-
    -
  1. css/phpmyadmin.css.php was vulnerable against - $cfg and GLOBALS variable - injections. This way, a possible attacker could - manipulate any configuration parameter. Using - phpMyAdmin's theming mechanism, he was able to include - arbitrary files. This is especially dangerous if php is - not running in safe mode.
    2. -
  2. A possible attacker could manipulate phpMyAdmin's - localized strings via the URL and inject harmful - JavaScript code this way, which could be used for XSS - attacks.
    3. -
-
- - - - 12644 - 12645 - CVE-2005-0543 - CVE-2005-0567 - http://marc.theaimsgroup.com/?l=bugtraq&m=110929725801154 - http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-1 - - - 2005-02-21 - 2005-03-08 - - - - - libexif -- buffer overflow vulnerability - - - libexif - 0.6.10_1 - - - - -

Sylvain Defresne reports that libexif is vulnerable to a - buffer overflow vulnerability due to insufficient input - checking. This could lead crash of applications using - libexif.

- - - - 12744 - CVE-2005-0664 - https://bugzilla.ubuntulinux.org/show_bug.cgi?id=7152 - - - 2005-03-03 - 2005-03-08 - - - - - phpbb -- Insuffient check against HTML code in usercp_register.php - - - phpbb - 2.0.13 - - - - -

Neo Security Team reports:

-
-

If we specify a variable in the html code (any type: - hidden, text, radio, check, etc) with the name allowhtml, - allowbbcode or allowsmilies, is going to be on the html, - bbcode and smilies in our signature.

-
-

This is a low risk vulnerability that allows users to bypass - forum-wide configuration.

- - - - http://marc.theaimsgroup.com/?l=bugtraq&m=110987231502274 - http://marc.theaimsgroup.com/?l=bugtraq&m=110988400407204 - - - 2005-02-28 - 2005-03-05 - 2005-03-07 - - - - - postnuke -- SQL injection vulnerabilities - - - postnuke - 0.760 - - - - -

Two separate SQL injection vulnerabilities have been - identified in the PostNuke PHP content management - system. An attacker can use this vulnerability to - potentially insert executable PHP code into the content - management system (to view all files within the PHP scope, - for instance). Various other SQL injection vulnerabilities - exist, which give attackers the ability to run SQL queries - on any tables within the database.

- - - - CVE-2005-0617 - CVE-2005-0615 - http://marc.theaimsgroup.com/?l=bugtraq&m=110962710805864 - http://marc.theaimsgroup.com/?l=bugtraq&m=110962819232255 - http://news.postnuke.com/Article2669.html - - - 2005-02-28 - 2005-03-04 - - - - - postnuke -- cross-site scripting (XSS) vulnerabilities - - - postnuke - 0.760 - - - - -

A cross-site scripting vulnerability is present in the - PostNuke PHP content management system. By passing data - injected through exploitable errors in input validation, an - attacker can insert code which will run on the machine of - anybody viewing the page. It is feasible that this attack - could be used to retrieve session information from cookies, - thereby allowing the attacker to gain administrative access - to the CMS.

- - - - CVE-2005-0616 - http://marc.theaimsgroup.com/?l=bugtraq&m=110962768300373 - http://news.postnuke.com/Article2669.html - - - 2005-02-28 - 2005-03-04 - - - - - realplayer -- remote heap overflow - - - linux-realplayer - 10.0.2 - - - - -

Two exploits have been identified in the Linux RealPlayer client. - RealNetworks states:

-
-

RealNetworks, Inc. has addressed recently discovered - security vulnerabilities that offered the potential for - an attacker to run arbitrary or malicious code on a - customer's machine. RealNetworks has received no reports - of machines compromised as a result of the now-remedied - vulnerabilities. RealNetworks takes all security - vulnerabilities very seriously.

-

The specific exploits were:

-
    -
  • Exploit 1: To fashion a malicious WAV - file to cause a buffer overflow which could have allowed - an attacker to execute arbitrary code on a customer's - machine.
    • -
  • Exploit 2: To fashion a malicious - SMIL file to cause a buffer overflow which could have - allowed an attacker to execute arbitrary code on a - customer's machine.
    • -
-
- - - - CVE-2005-0611 - http://marc.theaimsgroup.com/?l=vulnwatch&m=110977858619314 - http://service.real.com/help/faq/security/050224_player/EN/ - - - 2005-03-01 - 2005-03-04 - - - - - ImageMagick -- format string vulnerability - - - ImageMagick - ImageMagick-nox11 - 6.2.0.3 - - - - -

Tavis Ormandy reports:

-
-

magemagick-6.2.0-3 fixes an potential issue handling - malformed filenames, the flaw may affect webapps or - scripts that use the imagemagick utilities for image - processing, or applications linked with libMagick.

-
-

This vulnerability could crash ImageMagick or potentially - lead to the execution of arbitrary code with the permissions - of the user running ImageMagick.

- - - - CVE-2005-0397 - http://www.ubuntulinux.org/support/documentation/usn/usn-90-1 - - - 2005-03-02 - 2005-03-03 - - - - - uim -- privilege escalation vulnerability - - - ja-uim - 0.4.6 - - - - -

The uim developers reports:

-
-

Takumi ASAKI discovered that uim always trusts environment - variables. But this is not correct behavior, sometimes environment - variables shouldn't be trusted. This bug causes privilege escalation - when libuim is linked against setuid/setgid application. Since GTK+ - prohibits setuid/setgid applications, the bug appears only in - 'immodule for Qt' enabled Qt. (Normal Qt is also safe.)

-
- - - - CVE-2005-0503 - http://lists.freedesktop.org/pipermail/uim/2005-February/000996.html - 12604 - http://secunia.com/advisories/13981 - - - 2005-02-21 - 2005-03-01 - - - - - lighttpd -- script source disclosure vulnerability - - - lighttpd - 1.3.8 - - - - -

The lighttpd website reports:

-
-

In lighttpd 1.3.7 and below it is possible to fetch the source - files which should be handled by CGI or FastCGI applications.

-
-

The vulnerability is in the handling of urlencoded trailing - NUL bytes. Installations that do not use CGI or FastCGI are - not affected.

- - - - CVE-2005-0453 - http://article.gmane.org/gmane.comp.web.lighttpd/1171 - http://www.lighttpd.net/news/ - http://xforce.iss.net/xforce/xfdb/19350 - 12567 - - - 2005-02-12 - 2005-03-01 - - - - - phpbb -- privilege elevation and path disclosure - - - phpbb - 2.0.13 - - - - -

The phpbb developer group reports:

-
-

phpBB Group announces the release of phpBB 2.0.13, the - "Beware of the furries" edition. This release addresses two - recent security exploits, one of them critical. They were - reported a few days after .12 was released and no one is - more annoyed than us, having to release a new version ini - such a short period of time. Fortunately both fixes are - easy and in each case just one line needs to be edited.

-
- - - - http://www.phpbb.com/phpBB/viewtopic.php?t=267563 - 12678 - - - 2005-02-27 - 2005-02-28 - 2005-03-05 - - - - - curl -- authentication buffer overflow vulnerability - - - curl - 7.13.1 - - - - -

Two iDEFENSE Security Advisories reports:

-
-

An exploitable stack-based buffer overflow condition - exists when using NT Lan Manager (NTLM) - authentication. The problem specifically exists within - Curl_input_ntlm() defined in - lib/http_ntlm.c.

-

Successful exploitation allows remote attackers to - execute arbitrary code under the privileges of the target - user. Exploitation requires that an attacker either coerce - or force a target to connect to a malicious server using - NTLM authentication.

-
-
-

An exploitable stack-based buffer overflow condition - exists when using Kerberos authentication. The problem - specifically exists within the functions - Curl_krb_kauth() and krb4_auth() - defined in lib/krb4.c.

-

Successful exploitation allows remote attackers to - execute arbitrary code under the privileges of the target - user. Exploitation requires that an attacker either coerce - or force a target to connect to a malicious server using - Kerberos authentication.

-
- - - - 12615 - 12616 - CVE-2005-0490 - http://marc.theaimsgroup.com/?l=bugtraq&m=110902850731457 - http://marc.theaimsgroup.com/?l=bugtraq&m=110902601221592 - - - 2004-12-21 - 2005-02-27 - - - - - cyrus-imapd -- multiple buffer overflow vulnerabilities - - - cyrus-imapd - 2.1.18 - 2.2.*2.2.11 - - - - -

The Cyrus IMAP Server ChangeLog states:

-
-
    -
  • Fix possible single byte overflow in mailbox handling - code.
    • -
  • Fix possible single byte overflows in the imapd - annotate extension.
    • -
  • Fix stack buffer overflows in fetchnews (exploitable - by peer news server), backend (exploitable by admin), - and in imapd (exploitable by users though only on - platforms where a filename may be larger than a mailbox - name).
    • -
-
-

The 2.1.X series are reportedly only affected by the second - issue.

-

These issues may lead to execution of arbitrary code with - the permissions of the user running the Cyrus IMAP - Server.

- - - - 12636 - CVE-2005-0546 - http://asg.web.cmu.edu/cyrus/download/imapd/changes.html - - - 2005-02-14 - 2005-02-27 - 2005-04-05 - - - - - sup -- format string vulnerability - - - sup - 2.0.20050226 - - - - -

Debian Security Advisory reports:

-
-

jaguar@felinemenace.org discovered a format string - vulnerability in sup, a set of programs to synchronize - collections of files across a number of machines, - whereby a remote attacker could potentially cause - arbitrary code to be executed with the privileges - of the supfilesrv process (this process does not run - automatically by default).

-
- - - - 10571 - CVE-2004-0451 - http://www.securityfocus.com/advisories/6874 - - - 2004-06-19 - 2005-02-27 - - - - - mozilla -- insecure temporary directory vulnerability - - - firefox - 1.0.1,1 - - - mozilla - 1.7.6,2 - - - linux-mozilla - linux-mozilla-devel - 1.7.6 - - - netscape7 - 0 - - - - de-linux-mozillafirebird - el-linux-mozillafirebird - ja-linux-mozillafirebird-gtk1 - ja-mozillafirebird-gtk2 - linux-mozillafirebird - ru-linux-mozillafirebird - zhCN-linux-mozillafirebird - zhTW-linux-mozillafirebird - 0 - - - - de-linux-netscape - de-netscape7 - fr-linux-netscape - fr-netscape7 - ja-linux-netscape - ja-netscape7 - linux-netscape - linux-phoenix - mozilla+ipv6 - mozilla-embedded - mozilla-firebird - mozilla-gtk1 - mozilla-gtk2 - mozilla-gtk - mozilla-thunderbird - phoenix - pt_BR-netscape7 - 0 - - - - -

A Mozilla Foundation Security Advisory reports:

-
-

A predictable name is used for the plugin temporary - directory. A malicious local user could symlink this to - the victim's home directory and wait for the victim to run - Firefox. When Firefox shuts down the victim's directory - would be erased.

-
- - - - http://www.mozilla.org/security/announce/mfsa2005-28.html - https://bugzilla.mozilla.org/show_bug.cgi?id=281284 - - - 2005-02-06 - 2005-02-26 - - - - - mozilla -- arbitrary code execution vulnerability - - - firefox - 1.0.1,1 - - - mozilla - 1.7.6,2 - - - linux-mozilla - linux-mozilla-devel - 1.7.6 - - - netscape7 - 0 - - - - de-linux-mozillafirebird - el-linux-mozillafirebird - ja-linux-mozillafirebird-gtk1 - ja-mozillafirebird-gtk2 - linux-mozillafirebird - ru-linux-mozillafirebird - zhCN-linux-mozillafirebird - zhTW-linux-mozillafirebird - 0 - - - - de-linux-netscape - de-netscape7 - fr-linux-netscape - fr-netscape7 - ja-linux-netscape - ja-netscape7 - linux-netscape - linux-phoenix - mozilla+ipv6 - mozilla-embedded - mozilla-firebird - mozilla-gtk1 - mozilla-gtk2 - mozilla-gtk - mozilla-thunderbird - phoenix - pt_BR-netscape7 - 0 - - - - -

A Mozilla Foundation Security Advisory reports:

-
-

Plugins (such as flash) can be used to load privileged - content into a frame. Once loaded various spoofs can be - applied to get the user to interact with the privileged - content. Michael Krax's "Fireflashing" example - demonstrates that an attacker can open about:config in a - frame, hide it with an opacity setting, and if the - attacker can get the victim to click at a particular spot - (design some kind of simple game) you could toggle boolean - preferences, some of which would make further attacks - easier.

-

The "firescrolling" example demonstrates arbitrary code - execution (in this case downloading a file) by convincing - the user to scroll twice.

-
-

Workaround: Disable JavaScript.

- - - - CVE-2005-0527 - http://www.mikx.de/fireflashing/ - http://www.mikx.de/firescrolling/ - http://www.mozilla.org/security/announce/mfsa2005-27.html - - - 2005-02-24 - 2005-02-26 - - - - - mkbold-mkitalic -- format string vulnerability - - - mkbold-mkitalic - 0.07 - - - - -

The version 0.06_1 and prior - have a format string vulnerability which can be triggered - by using a carefully-crafted BDF font file.

- - - - http://home.jp.FreeBSD.org/cgi-bin/showmail/ports-jp/15568 - - - 2005-02-23 - 2005-02-24 - - - - - phpbb -- multiple information disclosure vulnerabilities - - - phpbb - 2.0.12 - - - - -

psoTFX reports:

-
-

phpBB Group are pleased to announce the release of phpBB - 2.0.12 the "Horray for Furrywood" release. This release - addresses a number of bugs and a couple of potential - exploits. [...] one of the potential exploits addressed - in this release could be serious in certain situations and - thus we urge all users, as always, to upgrade to this - release as soon as possible. Mostly this release is - concerned with eliminating disclosures of information - which while useful in debug situations may allow third - parties to gain information which could be used to do harm - via unknown or unfixed exploits in this or other - applications.

-
-

The ChangeLog for phpBB 2.0.12 states:

-
-
    -
  • Prevented full path display on critical messages
    • -
  • Fixed full path disclosure in username handling caused - by a PHP 4.3.10 bug - AnthraX101
    • -
  • Added exclude list to unsetting globals (if - register_globals is on) - - SpoofedExistence
    • -
  • Fixed arbitrary file disclosure vulnerability in avatar - handling functions - AnthraX101
    • -
  • Fixed arbitrary file unlink vulnerability in avatar - handling functions - AnthraX101
    • -
  • Fixed path disclosure bug in search.php caused by a - PHP 4.3.10 bug (related to AnthraX101's discovery)
    • -
  • Fixed path disclosure bug in viewtopic.php caused by - a PHP 4.3.10 bug - matrix_killer
    • -
-
- - - - http://www.phpbb.com/support/documents.php?mode=changelog - http://www.phpbb.com/phpBB/viewtopic.php?f=14&t=265423 - ports/77943 - - - 2005-02-22 - 2005-02-23 - 2005-02-25 - - - - - unace -- multiple vulnerabilities - - - unace - 1.2b_2 - - - linux-unace - 0 - - - - -

Ulf Härnhammar reports:

-
    -
  • There are buffer overflows when extracting, testing or - listing specially prepared ACE archives.
    • -
  • There are directory traversal bugs when extracting ACE - archives.
    • -
  • There are also buffer overflows when dealing with long - (>17000 characters) command line arguments.
    • -
-

Secunia reports:

-
-

The vulnerabilities have been confirmed in version 1.2b. - One of the buffer overflow vulnerabilities have also been - reported in version 2.04, 2.2 and 2.5. Other versions may - also be affected.

-

Successful exploitation may allow execution of arbitrary - code.

-
- - - - 215006 - CVE-2005-0160 - CVE-2005-0161 - http://marc.theaimsgroup.com/?l=full-disclosure&m=110911451613135 - http://secunia.com/advisories/14359/ - - - 2005-02-14 - 2005-02-22 - 2006-09-26 - - - - - putty -- pscp/psftp heap corruption vulnerabilities - - - putty - 0.57 - - - - -

Simon Tatham reports:

-
-

This version fixes a security hole in previous versions - of PuTTY, which can allow a malicious SFTP server to - attack your client. If you use either PSCP or PSFTP, you - should upgrade. Users of the main PuTTY program are not - affected. (However, note that the server must have passed - host key verification before this attack can be launched, - so a man-in-the-middle shouldn't be able to attack you if - you're careful.)

-
- - - - 12601 - CVE-2005-0467 - http://lists.tartarus.org/pipermail/putty-announce/2005/000012.html - http://marc.theaimsgroup.com/?l=bugtraq&m=110902510713763 - http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-sftp-readdir.html - http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-sftp-string.html - - - 2005-02-20 - 2005-02-20 - 2005-02-23 - - - - - kdelibs -- insecure temporary file creation - - - kdelibs - ja-kdelibs - 3.3.2_5 - - - - -

Davide Madrisan reports:

-
-

The `dcopidlng' script in the KDE library package - (kdelibs-3.3.2/dcop/dcopidlng/dcopidlng) creates temporary - files in a unsecure manner.

-
-

Note: dcopidlng is only used at build - time, so only users installing KDE are vulnerable, not users - already running KDE.

- - - - CVE-2005-0365 - http://bugs.kde.org/show_bug.cgi?id=97608 - http://marc.theaimsgroup.com/?l=bugtraq&m=110814653804757 - - - 2005-01-21 - 2005-02-18 - 2005-02-20 - - - - - bidwatcher -- format string vulnerability - - - bidwatcher - 1.3.17 - - - - -

A Debian Security Advisory reports:

-
-

Ulf Härnhammer from the Debian Security Audit Project - discovered a format string vulnerability in bidwatcher, a - tool for watching and bidding on eBay auctions. This - problem can be triggered remotely by a web server of eBay, - or someone pretending to be eBay, sending certain data - back.

-
- - - - 12590 - CVE-2005-0158 - http://www.debian.org/security/2005/dsa-687 - - - 2005-02-18 - 2005-02-18 - - - - - gftp -- directory traversal vulnerability - - - gftp - 2.0.18 - - - - -

A Debian Security Advisory reports:

-
-

Albert Puigsech Galicia discovered a directory traversal - vulnerability in a proprietary FTP client (CAN-2004-1376) - which is also present in gftp, a GTK+ FTP client. A - malicious server could provide a specially crafted - filename that could cause arbitrary files to be - overwritten or created by the client.

-
- - - - 12539 - CVE-2005-0372 - http://www.debian.org/security/2005/dsa-686 - http://www.gftp.org/changelog.html - - - 2005-02-04 - 2005-02-18 - - - - - opera -- "data:" URI handler spoofing vulnerability - - - opera - opera-devel - linux-opera - 7.54.20050131 - - - - -

A Secunia Advisory reports:

-
-

Michael Holzt has discovered a vulnerability in Opera, - which can be exploited by malicious people to trick users - into executing malicious files.

-

The vulnerability is caused due to an error in the - processing of "data:" URIs, causing wrong information to - be shown in a download dialog. This can be exploited by - e.g. a malicious website to trick users into executing a - malicious file by supplying a specially crafted "data:" - URI.

-
- - - - CVE-2005-0456 - 882926 - http://secunia.com/advisories/13818/ - http://www.opera.com/freebsd/changelogs/754u2/ - - - 2005-01-12 - 2005-02-18 - - - - - opera -- kfmclient exec command execution vulnerability - - - opera - opera-devel - linux-opera - 7.54.20050131 - - - - -

Giovanni Delvecchio reports:

-
-

Opera for linux uses "kfmclient exec" as "Default - Application" to handle saved files. This could be used by - malicious remote users to execute arbitrary shell commands - on a target system.

-
- - - - CVE-2004-1491 - http://secunia.com/advisories/13447/ - http://www.opera.com/freebsd/changelogs/754u2/ - http://www.zone-h.org/advisories/read/id=6503 - - - 2004-12-12 - 2005-02-18 - - - - - postgresql -- multiple buffer overflows in PL/PgSQL parser - - - postgresql - postgresql-server - ja-postgresql - 7.3.9_1 - 7.4.*7.4.7_1 - 8.*8.0.1_1 - - - - -

The PL/PgSQL parser in postgresql is vulnerable to several - buffer overflows. These could be exploited by a remote - attacker to execute arbitrary code with the permissions of - the postgresql server by running a specially crafted - query.

- - - - CVE-2005-0247 - http://archives.postgresql.org/pgsql-committers/2005-02/msg00049.php - - - 2005-02-07 - 2005-02-17 - 2005-02-19 - - - - - awstats -- arbitrary command execution - - - awstats - 6.4 - - - - -

Several input validation errors exist in AWStats that allow a - remote unauthenticated attacker to execute arbitrary commands - with the priviliges of the web server. These programming - errors involve CGI parameters including - loadplugin, logfile, - pluginmode, update, and possibly - others.

-

Additionally, the debug and other CGI parameters - may be used to cause AWStats to disclose AWStats and system - configuration information.

- - - - CVE-2005-0362 - CVE-2005-0363 - CVE-2005-0435 - CVE-2005-0436 - CVE-2005-0437 - CVE-2005-0438 - 12543 - 12545 - http://marc.theaimsgroup.com/?l=bugtraq&m=110840530924124 - http://awstats.sourceforge.net/docs/awstats_changelog.txt - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=294488 - http://packetstormsecurity.nl/0501-exploits/AWStatsVulnAnalysis.pdf - - - 2005-02-10 - 2005-02-16 - 2005-02-23 - - - - - powerdns -- DoS vulnerability - - - powerdns - 2.9.17 - - - - -

PowerDNS is vulnerable to a temporary denial-of-service - vulnerability that can be triggered using a random stream of - bytes.

- - - - 12446 - http://ds9a.nl/cgi-bin/cvstrac/pdns/tktview?tn=21 - http://doc.powerdns.com/changelog.html#CHANGELOG-2-9-17 - - - 2004-09-18 - 2005-02-14 - - - - - emacs -- movemail format string vulnerability - - - movemail - 1.0 - - - zh-emacs - emacs - 20.7_4 - 21.*21.3_4 - - - xemacs - xemacs-mule - zh-xemacs - zh-xemacs-mule - 21.4.17 - - - xemacs-devel - 21.5.b19,1 - - - xemacs-devel-21.5 - b11 - - - xemacs-devel-mule - 21.5.b19 - - - mule-common - hanemacs - 0 - - - - -

Max Vozeler discovered several format string - vulnerabilities in the movemail utility of Emacs. They can - be exploited when connecting to a malicious POP server and - can allow an attacker can execute arbitrary code under the - privileges of the user running Emacs.

- - - - CVE-2005-0100 - 12462 - - - 2005-01-31 - 2005-02-14 - - - - - ngircd -- format string vulnerability - - - ngircd - 0.8.3 - - - - -

A No System Group security advisory reports that ngircd is - vulnerable to a format string vulnerability in the - Log_Resolver() function of log.c, if IDENT - support is enabled. This could allow a remote attacker to - execute arbitrary code with the permissions of the ngircd - daemon, which is root by default.

-

Note: By default the FreeBSD ngircd port - does not enable IDENT support.

- - - - CVE-2005-0226 - 12434 - http://marc.theaimsgroup.com/?l=bugtraq&m=110746413108183 - - - 2005-02-03 - 2005-02-13 - - - - - ngircd -- buffer overflow vulnerability - - - ngircd - 0.8.2 - - - - -

Florian Westphal discovered a buffer overflow in ngircd - which can be used remotely crash the server and possibly - execute arbitrary code.

- - - - CVE-2005-0199 - 12397 - http://arthur.ath.cx/pipermail/ngircd-ml/2005-January/000228.html - - - 2005-01-26 - 2005-02-13 - - - - - mod_python -- information leakage vulnerability - - - mod_python - 2.7.11 - 3.*3.1.4 - - - - -

Mark J Cox reports:

-
-

Graham Dumpleton discovered a flaw which can affect - anyone using the publisher handle of the Apache Software - Foundation mod_python. The publisher handle lets you - publish objects inside modules to make them callable via - URL. The flaw allows a carefully crafted URL to obtain - extra information that should not be visible (information - leak).

-
- - - - CVE-2005-0088 - - - 2005-01-30 - 2005-02-13 - - - - - mailman -- directory traversal vulnerability - - - mailman - ja-mailman - 2.1.5_2 - - - - -

A directory traversal vulnerability in mailman allow remote - attackers to read arbitrary files due to inadequate input - sanitizing. This could, among other things, lead remote - attackers to gaining access to the mailman configuration - database (which contains subscriber email addresses and - passwords) or to the mail archives for private lists.

- - - - CVE-2005-0202 - http://marc.theaimsgroup.com/?l=full-disclosure&m=110797575304304 - - - 2005-01-02 - 2005-02-12 - - - - - enscript -- multiple vulnerabilities - - - enscript-a4 - enscript-letter - enscript-letterdj - 1.6.4_1 - - - - -

Erik Sjölund discovered several issues in enscript: - it suffers from several buffer overflows, quotes and shell - escape characters are insufficiently sanitized in filenames, - and it supported taking input from an arbitrary command - pipe, with unwanted side effects.

- - - - CVE-2004-1184 - CVE-2004-1185 - CVE-2004-1186 - http://www.gentoo.org/security/en/glsa/glsa-200502-03.xml - - - 2005-02-02 - 2005-02-11 - - - - - postgresql -- privilege escalation vulnerability - - - postgresql - postgresql-server - ja-postgresql - 7.3.9 - 7.4.*7.4.7 - 8.*8.0.1 - - - postgresql-devel - 8.0.1,1 - - - - -

John Heasman and others disovered that non-privileged users - could use the LOAD extension to load arbitrary - libraries into the postgres server process space. This - could be used by non-privileged local users to execute - arbitrary code with the privileges of the postgresql - server.

- - - - 12411 - CVE-2005-0227 - http://archives.postgresql.org/pgsql-announce/2005-02/msg00000.php - http://archives.postgresql.org/pgsql-bugs/2005-01/msg00269.php - - - 2005-01-21 - 2005-02-08 - - - - - ethereal -- multiple protocol dissectors vulnerabilities - - - ethereal - ethereal-lite - tethereal - tethereal-lite - 0.8.100.10.9 - - - - -

An Ethreal Security Advisories reports:

-
-

Issues have been discovered in the following protocol - dissectors:

-
    -
  • The COPS dissector could go into an infinite - loop. CVE: CAN-2005-0006
    • -
  • The DLSw dissector could cause an assertion. CVE: - CAN-2005-0007
    • -
  • The DNP dissector could cause memory corruption. CVE: - CAN-2005-0008
    • -
  • The Gnutella dissector could cuase an assertion. CVE: - CAN-2005-0009
    • -
  • The MMSE dissector could free statically-allocated - memory. CVE: CAN-2005-0010
    • -
  • The X11 dissector is vulnerable to a string buffer - overflow. CVE: CAN-2005-0084
    • -
-

Impact: It may be possible to make Ethereal crash or run - arbitrary code by injecting a purposefully malformed - packet onto the wire or by convincing someone to read a - malformed packet trace file.

-
- - - - CVE-2005-0006 - CVE-2005-0007 - CVE-2005-0008 - CVE-2005-0009 - CVE-2005-0010 - CVE-2005-0084 - 12326 - http://www.ethereal.com/appnotes/enpa-sa-00017.html - - - 2005-01-18 - 2005-02-08 - - - - - squid -- correct handling of oversized HTTP reply headers - - - squid - 2.5.7_12 - - - - -

The squid patches page notes:

-
-

This patch addresses a HTTP protocol mismatch related to oversized - reply headers. In addition it enhances the cache.log reporting on - reply header parsing failures to make it easier to track down which - sites are malfunctioning.

-
-

It is believed that this bug may lead to cache pollution or - allow access controls to be bypassed.

- - - - CVE-2005-0241 - http://www.squid-cache.org/bugs/show_bug.cgi?id=1216 - http://www.squid-cache.org/Versions/v2/2.5/bugs/squid-2.5.STABLE7-oversize_reply_headers.patch - ports/76967 - 823350 - - - 2005-01-31 - 2005-02-08 - - - - - python -- SimpleXMLRPCServer.py allows unrestricted traversal - - - python - python+ipv6 - 2.22.2.3_7 - 2.32.3.4_4 - 2.42.4_1 - 2.5.a0.200501292.5.a0.20050129_1 - - - - -

According to Python Security Advisory PSF-2005-001,

-
-

The Python development team has discovered a flaw in - the SimpleXMLRPCServer library module which - can give remote attackers access to internals of the - registered object or its module or possibly other modules. - The flaw only affects Python XML-RPC servers that use the - register_instance() method to register an object - without a _dispatch() method. Servers using - only register_function() are not affected.

-

On vulnerable XML-RPC servers, a remote attacker may - be able to view or modify globals of the module(s) - containing the registered instance's class(es), potentially - leading to data loss or arbitrary code execution. If the - registered object is a module, the danger is particularly - serious. For example, if the registered module imports - the os module, an attacker could invoke the - os.system() function.

-
-

Note: This vulnerability affects your - system only if you're running - SimpleXMLRPCServer-based server. This isn't - harmful at all if you don't run any internet server written - in Python or your server doesn't serve in XML-RPC protocol.

- - - - CVE-2005-0089 - http://www.python.org/security/PSF-2005-001/ - - - 2005-02-03 - 2005-02-03 - 2006-10-08 - - - - - perl -- vulnerabilities in PERLIO_DEBUG handling - - - perl - perl-threaded - 5.85.8.6_2 - - - - -

Kevin Finisterre discovered bugs in perl's I/O debug support:

-
    -
  • The environmental variable PERLIO_DEBUG is honored even - by the set-user-ID perl command (usually - named sperl or suidperl). As a - result, a local attacker may be able to gain elevated - privileges. (CVE-2005-0155)
    • -
  • A buffer overflow may occur in threaded versions of perl - when the full pathname of the script being executed is - very long. (CVE-2005-0156).
    • -
-

Note: By default, no set-user-ID perl - binary is installed. An administrator must enable it - manually at build time with the ENABLE_SUIDPERL - port flag.

- - - - CVE-2005-0155 - CVE-2005-0156 - - - 2005-02-02 - 2005-02-02 - 2007-11-07 - - - - - newsgrab -- insecure file and directory creation - - - newsgrab - 0.4.0 - - - - -

The newsgrab script uses insecure permissions during the - creation of the local output directory and downloaded files.

-

After a file is created, permissions on it are set using the mode - value of the newsgroup posting. This can potentially be a problem - when the mode is not restrictive enough. In addition, the output - directory is created with world writable permissions allowing other - users to drop symlinks or other files at that location.

- - - - http://people.freebsd.org/~niels/issues/newsgrab-20050114.txt - http://sourceforge.net/project/shownotes.php?release_id=300562 - CVE-2005-0154 - - - 2005-01-18 - 2005-02-01 - - - - - newsgrab -- directory traversal vulnerability - - - newsgrab - 0.4.0 - - - - -

The newsgrab script creates files by using the names provided - in the newsgroup messages in a perl open() call. This is done - without performing any security checks to prevent a - directory traversal. A specially crafted newsgroup message - could cause newsgrab to drop an attachment anywhere on the - file system using the permissions of the user running the - script.

- - - - http://people.freebsd.org/~niels/issues/newsgrab-20050114.txt - http://sourceforge.net/project/shownotes.php?release_id=300562 - CVE-2005-0153 - - - 2005-01-18 - 2005-02-01 - - - - - newspost -- server response buffer overflow vulnerability - - - newspost - 2.1.1 - - - - -

The newspost program uses a function named socket_getline to read - server responses from the network socket. Unfortunately this function - does not check the length of the buffer in which the read data is stored - and only stops reading when a newline character is found.

-

A malicious NNTP server could use this bug to cause a buffer overflow - by sending an overly long response. Such an overflow allows arbitrary - code to be executed, with the privileges of the newspost process, on the - affected systems.

- - - - http://people.freebsd.org/~niels/issues/newspost-20050114.txt - CVE-2005-0101 - - - 2005-01-14 - 2005-02-01 - - - - - newsfetch -- server response buffer overflow vulnerability - - - newsfetch - 1.21_1 - - - - -

The newsfetch program uses the sscanf function to read information - from server responses into static memory buffers. Unfortunately - this is done without any proper bounds checking. As a result long - server responses may cause an overflow when a newsgroup listing is - requested from an NNTP server.

- - - - http://people.freebsd.org/~niels/issues/newsfetch-20050119.txt - CVE-2005-0132 - - - 2005-01-18 - 2005-02-01 - - - - - squid -- buffer overflow in WCCP recvfrom() call - - - squid - 2.5.7_10 - - - - -

According to the Squid Proxy Cache Security Update Advisory - SQUID-2005:3,

-
-

The WCCP recvfrom() call accepts more data than will fit in - the allocated buffer. An attacker may send a larger-than-normal - WCCP message to Squid and overflow this buffer.

-

Severity:

-

The bug is important because it allows remote attackers to crash - Squid, causing a disription in service. However, the bug is - exploitable only if you have configured Squid to send WCCP messages - to, and expect WCCP replies from, a router.

-

Sites that do not use WCCP are not vulnerable.

-
-

Note that while the default configuration of the FreeBSD squid port - enables WCCP support in general, the default configuration - supplied does not actually configure squid to send and receive WCCP - messages.

- - - - CVE-2005-0211 - 886006 - http://www.squid-cache.org/Advisories/SQUID-2005_3.txt - http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-wccp_buffer_overflow - http://www.squid-cache.org/bugs/show_bug.cgi?id=1217 - - - 2005-01-28 - 2005-01-28 - 2005-02-13 - - - - - xpdf -- makeFileKey2() buffer overflow vulnerability - - - xpdf - 3.00_6 - - - kdegraphics - 3.3.2_2 - - - gpdf - 2.8.3 - - - teTeX-base - 2.0.2_9 - - - cups-base - 1.1.23.0_3 - - - koffice - 1.3.5_2,1 - - - pdftohtml - 0.36_2 - - - - -

An iDEFENSE Security Advisory reports:

-
-

Remote exploitation of a buffer overflow vulnerability in - the xpdf PDF viewer included in multiple Unix and Linux - distributions could allow for arbitrary code execution as - the user viewing a PDF file.

-

The vulnerability specifically exists due to insufficient - bounds checking while processing a PDF file that provides - malicious values in the /Encrypt /Length tag. The - offending code can be found in the - Decrypt::makeFileKey2 function in the source - file xpdf/Decrypt.cc.

-
- - - - CVE-2005-0064 - http://marc.theaimsgroup.com/?l=bugtraq&m=110608898221554 - http://www.koffice.org/security/advisory-20050120-1.txt - - - 2005-01-06 - 2005-01-26 - 2005-02-03 - - - - - zhcon -- unauthorized file access - - - zhcon - zh-zhcon - 0.2.3_3 - - - - -

Martin Joey Schulze reports:

-
-

Erik Sjöund discovered that zhcon, a fast console CJK - system using the Linux framebuffer, accesses a - user-controlled configuration file with elevated - privileges. Thus, it is possible to read arbitrary files.

-
-

When installed from the FreeBSD Ports Collection, zhcon is - installed set-user-ID root.

- - - - CVE-2005-0072 - - - 2005-01-25 - 2005-01-25 - - - - - evolution -- arbitrary code execution vulnerability - - - evolution - 2.0.3_1 - - - - -

Martin Joey Schulze reports:

-
-

Max Vozeler discovered an integer overflow in the helper - application camel-lock-helper which runs setuid root or - setgid mail inside of Evolution, a free groupware suite. - A local attacker can cause the setuid root helper to - execute arbitrary code with elevated privileges via a - malicious POP server.

-
- - - - 12354 - CVE-2005-0102 - http://cvs.gnome.org/viewcvs/evolution/camel/camel-lock-helper.c?rev=1.7&view=log#rev1.5.74.1 - - - 2005-01-20 - 2005-01-25 - 2005-02-02 - - - - - mod_dosevasive -- insecure temporary file creation - - - mod_dosevasive20 - 1.10 - - - - -

An LSS Security Advisory reports:

-
-

When a denial of service attack is detected, - mod_dosevasive will, among other things, create a - temporary file which it will use to trace actions from the - offensive IP address. This file is insecurely created in - /tmp and it's name is easily predictable.

-

It is then easy for an attacker to create arbitrary files - in any directory that the user under which apache runs has - privileges to write.

-

[...] once the target file is opened, there is a - race attack (although difficult to exploit) which can lead - to mod_dosevasive overwriting any file that the user under - which apache runs has privileges to write.

-
- - - - ports/77513 - http://security.lss.hr/en/index.php?page=details&ID=LSS-2005-01-01 - - - 2005-01-04 - 2005-01-24 - 2005-02-22 - - - - - squid -- possible cache-poisoning via malformed HTTP responses - - - squid - 2.5.7_9 - - - - -

The squid patches page notes:

-
-

This patch makes Squid considerably stricter while - parsing the HTTP protocol.

-
    -
  1. A Content-length header should only appear once in a - valid request or response. Multiple Content-length - headers, in conjunction with specially crafted requests, - may allow Squid's cache to be poisoned with bad content - in certain situations.
    2. -
  2. CR characters is only allowed as part of the CR NL - line terminator, not alone. This to ensure that all - involved agrees on the structure of HTTP headers.
    3. -
  3. Rejects requests/responses that have whitespace in an - HTTP header name.
    4. -
-
-

To enable these strict parsing rules, update to at least - squid-2.5.7_9 and specify relaxed_header_parser - off in squid.conf.

- - - - CVE-2005-0174 - http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-header_parsing - 768702 - - - 2005-01-24 - 2005-01-24 - 2006-01-02 - - - - - bugzilla -- cross-site scripting vulnerability - - - bugzilla - ja-bugzilla - 2.16.8 - 2.17.*2.18 - - - - -

A Bugzilla advisory states:

-
-

This advisory covers a single cross-site scripting issue - that has recently been discovered and fixed in the - Bugzilla code: If a malicious user links to a Bugzilla - site using a specially crafted URL, a script in the error - page generated by Bugzilla will display the URL unaltered - in the page, allowing scripts embedded in the URL to - execute.

-
- - - - CVE-2004-1061 - http://www.bugzilla.org/security/2.16.7-nr/ - https://bugzilla.mozilla.org/show_bug.cgi?id=272620 - - - 2004-12-01 - 2005-01-24 - - - - - web browsers -- window injection vulnerabilities - - - firefox - 1.0.1,1 - - - mozilla - 1.7.6,2 - - - linux-mozilla - linux-mozilla-devel - 1.7.6 - - - de-linux-mozillafirebird - el-linux-mozillafirebird - ja-linux-mozillafirebird-gtk1 - ja-mozillafirebird-gtk2 - linux-mozillafirebird - ru-linux-mozillafirebird - zhCN-linux-mozillafirebird - zhTW-linux-mozillafirebird - de-netscape7 - fr-netscape7 - ja-netscape7 - netscape7 - pt_BR-netscape7 - mozilla-gtk1 - 0 - - - - de-linux-netscape - fr-linux-netscape - ja-linux-netscape - linux-netscape - linux-phoenix - mozilla+ipv6 - mozilla-embedded - mozilla-firebird - mozilla-gtk2 - mozilla-gtk - mozilla-thunderbird - phoenix - 0 - - - kdebase - kdelibs - 3.3.2 - - - opera - opera-devel - linux-opera - 7.54.20050131 - - - - -

A Secunia Research advisory reports:

-
-

Secunia Research has reported a vulnerability in multiple - browsers, which can be exploited by malicious people to - spoof the content of websites.

-

The problem is that a website can inject content into - another site's window if the target name of the window is - known. This can e.g. be exploited by a malicious website - to spoof the content of a pop-up window opened on a - trusted website.

-

Secunia has constructed a test, which can be used to - check if your browser is affected by this issue: - http://secunia.com/multiple_browsers_window_injection_vulnerability_test/

-
-

A workaround - for Mozilla-based browsers is available.

- - - - http://secunia.com/secunia_research/2004-13/advisory/ - http://secunia.com/multiple_browsers_window_injection_vulnerability_test/ - - CVE-2004-1156 - http://secunia.com/advisories/13129/ - https://bugzilla.mozilla.org/show_bug.cgi?id=273699 - https://bugzilla.mozilla.org/show_bug.cgi?id=103638 - http://mozillanews.org/?article_date=2004-12-08+06-48-46 - - CVE-2004-1157 - http://secunia.com/advisories/13253/ - - CVE-2004-1158 - http://secunia.com/advisories/13254/ - http://www.kde.org/info/security/advisory-20041213-1.txt - - CVE-2004-1160 - http://secunia.com/advisories/13402/ - - - 2004-12-08 - 2005-01-24 - 2005-02-26 - - - - - yamt -- arbitrary command execution vulnerability - - - yamt - 0.5_2 - - - - -

Manigandan Radhakrishnan discovered a security - vulnerability in YAMT which can lead to execution of - arbitrary commands with the privileges of the user running - YAMT when sorting based on MP3 tags. The problem exist in - the id3tag_sort() routine which does not - properly sanitize the artist tag from the MP3 file before - using it as an argument to the mv command.

- - - - 11999 - CVE-2004-1302 - http://tigger.uic.edu/~jlongs2/holes/yamt.txt - - - 2004-12-15 - 2005-01-23 - 2005-01-25 - - - - - squid -- HTTP response splitting cache pollution attack - - - squid - 2.5.7_8 - - - - -

According to a whitepaper published by Sanctum, Inc., it - is possible to mount cache poisoning attacks against, among others, - squid proxies by inserting false replies into the HTTP stream.

-

The squid patches page notes:

-
-

This patch additionally strengthens Squid from the HTTP response - attack described by Sanctum.

-
- - - - CVE-2005-0175 - http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-response_splitting - http://www.squid-cache.org/bugs/show_bug.cgi?id=1200 - https://www.watchfire.com/securearea/whitepapers.aspx?id=8 - 625878 - - - 2004-03-01 - 2005-01-22 - 2005-02-07 - - - - - horde -- XSS vulnerabilities - - - horde - horde-php5 - 3.*3.0.1 - - - - -

A Hyperdose Security Advisory reports:

-
-

Horde contains two XSS attacks that can be exploited - through GET requests. Once exploited, these requests - could be used to execute any javascript commands in the - context of that user, potentially including but not - limited to reading and deleting email, and stealing auth - tokens.

-
- - - - 12255 - http://marc.theaimsgroup.com/?l=bugtraq&m=110564059322774 - http://lists.horde.org/archives/announce/2005/000159.html - - - 2005-01-04 - 2005-01-22 - - - - - mc -- multiple vulnerabilities - - - mc - 4.6.0 - - - - -

Andrew V. Samoilov reported several vulnerabilities that - were corrected in MidnightCommand 4.6.0:

-
    -
  • Format string issues (CVE-2004-1004)
    • -
  • Buffer overflows (CVE-2004-1005)
    • -
  • Denial-of-service, infinite loop (CVE-2004-1009)
    • -
  • Denial-of-service, corrupted section header - (CVE-2004-1090)
    • -
  • Denial-of-service, null pointer dereference (CVE-2004-1091)
    • -
  • Freeing unallocated memory (CVE-2004-1092)
    • -
  • Using already freed memory (CVE-2004-1093)
    • -
- - - - CVE-2004-1004 - CVE-2004-1005 - CVE-2004-1009 - CVE-2004-1090 - CVE-2004-1091 - CVE-2004-1092 - CVE-2004-1093 - - - 2004-12-01 - 2005-01-21 - - - - - perl -- File::Path insecure file/directory permissions - - - perl - perl-threaded - 05.6.2 - 5.8.05.8.6 - - - - -

Jeroen van Wolffelaar reports that the Perl module File::Path - contains a race condition wherein traversed directories and files - are temporarily made world-readable/writable.

- - - - CVE-2004-0452 - http://www.debian.org/security/2004/dsa-620 - http://xforce.iss.net/xforce/xfdb/18650 - - - 2004-12-30 - 2005-01-21 - 2007-11-07 - - - - - - - - - opera -- multiple vulnerabilities in Java implementation - - - opera - opera-devel - linux-opera - 7.54.20041210 - - - - -

Marc Schoenefeld reports:

-
-

Opera 7.54 is vulnerable to leakage of the java sandbox, - allowing malicious applets to gain unacceptable - privileges. This allows them to be used for information - gathering (spying) of local identity information and - system configurations as well as causing annoying crash - effects.

-

Opera 754 [sic] which was released Aug 5,2004 is - vulnerable to the XSLT processor covert channel attack, - which was corrected with JRE 1.4.2_05 [released in July - 04], but in disadvantage to the users the opera packaging - guys chose to bundle the JRE 1.4.2_04 [...]

-

Internal pointer DoS exploitation: Opera.jar contains the - opera replacement of the java plugin. It therefore handles - communication between javascript and the Java VM via the - liveconnect protocol. The public class EcmaScriptObject - exposes a system memory pointer to the java address space, - by constructing a special variant of this type an internal - cache table can be polluted by false entries that infer - proper function of the JSObject class and in the following - proof-of-concept crash the browser.

-

Exposure of location of local java installation Sniffing - the URL classpath allows to retrieve the URLs of the - bootstrap class path and therefore the JDK installation - directory.

-

Exposure of local user name to an untrusted applet An - attacker could use the sun.security.krb5.Credentials class - to retrieve the name of the currently logged in user and - parse his home directory from the information which is - provided by the thrown - java.security.AccessControlException.

-
- - - - http://marc.theaimsgroup.com/?l=bugtraq&m=110088923127820 - - - 2004-11-19 - 2005-01-24 - - - - - sudo -- environmental variable CDPATH is not cleared - - - sudo - 1.6.8.4 - - - - -

A sudo bug report says:

-
-

sudo doesn't unset the CDPATH variable, which leads to - possible security problems.

-
- - - - http://www.sudo.ws/bugs/show_bug.cgi?id=155 - http://www.sudo.ws/pipermail/sudo-announce/2004-November/000044.html - - - 2004-10-18 - 2005-01-21 - 2013-06-19 - - - - - fcron -- multiple vulnerabilities - - - fcron - 2.9.5.1 - - - - -

An iDEFENSE Security Advisory states:

-
-

Multiple vulnerabilities have been found in Fcron.

-
    -
  1. File contents disclosure
    2. -
  2. Configuration Bypass Vulnerability
    3. -
  3. File Removal and Empty File Creation Vulnerability
    4. -
  4. Information Disclosure Vulnerability
    5. -
-
- - - - http://www.idefense.com/application/poi/display?id=157&type=vulnerabilities&flashstatus=false - CVE-2004-1030 - CVE-2004-1031 - CVE-2004-1032 - CVE-2004-1033 - - - 2004-11-15 - 2005-01-21 - - - - - realplayer -- arbitrary file deletion and other vulnerabilities - - - linux-realplayer - 10.0.2 - - - - -

An NGSSoftware Insight Security Research Advisory reports:

-
-

Two vulnerabilities have been discovered in RealPlayer - which may potentially be leveraged to allow remote code - execution, or may used in combination with the Real - Metadata Package File Deletion vulnerability to reliably - delete files from a users system.

-
- - - - http://www.ngssoftware.com/advisories/real-02full.txt - http://www.ngssoftware.com/advisories/real-03full.txt - http://service.real.com/help/faq/security/040928_player/EN/ - - - 2004-10-06 - 2005-01-21 - - - - - imlib -- xpm heap buffer overflows and integer overflows - - - imlib - 1.9.15_2 - - - imlib2 - 1.1.2_1 - - - - -

Pavel Kankovsky reports:

-
-

Imlib affected by a variant of CAN-2004-0782 too.

-

I've discovered more vulnerabilities in Imlib - (1.9.13). In particular, it appears to be affected by a - variant of Chris Evans' libXpm flaw #1 (CAN-2004-0782, see - http://scary.beasts.org/security/CESA-2004-003.txt). Look - at the attached image, it kills ee on my 7.3.

-
-

The flaws also affect imlib2.

- - - - CVE-2004-1025 - CVE-2004-1026 - 11830 - https://bugzilla.fedora.us/show_bug.cgi?id=2051#c11 - https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=138516 - http://cvs.sourceforge.net/viewcvs.py/enlightenment/e17/libs/imlib2/src/modules/loaders/loader_xpm.c#rev1.3 - - - 2004-12-06 - 2005-01-21 - - - - - egroupware -- arbitrary file download in JiNN - - - eGroupWare - 1.0.0.006 - - - - -

eGroupWare contains a bug in the JiNN component that allows - a remote attacker to download arbitrary files.

- - - - http://cvs.sourceforge.net/viewcvs.py/egroupware/jinn/CHANGELOG#rev1.24 - http://sourceforge.net/mailarchive/forum.php?thread_id=5915445&forum_id=35178 - - - 2004-10-15 - 2005-01-21 - - - - - quake2 -- multiple critical vulnerabilities - - - quake2forge - 0 - - - quake2lnx - 0.16.2 - - - - -

An advisory published by Richard Stanway describes numerous - critical vulnerabilities in the Quake II engine:

-
-

Due to unchecked input at various stages in the server, - remote users are able to cause the server to crash, reveal - sensitive information or potentially execute arbitrary - code.

-
- - - - http://secur1ty.net/advisories/001 - http://marc.theaimsgroup.com/?l=bugtraq&m=109892527321706 - - - 2004-10-27 - 2005-01-21 - 2005-03-15 - - - - - konversation -- shell script command injection - - - konversation - 0.15 - - - - -

Konversation comes with Perl scripts that do not properly escape - shell characters on executing a script. This makes it possible - to attack Konversation with shell script command injection.

- - - - CVE-2005-0129 - CVE-2005-0130 - CVE-2005-0131 - http://marc.theaimsgroup.com/?l=full-disclosure&m=110616016509114 - - - 2005-01-19 - 2005-01-19 - 2005-01-21 - - - - - squid -- no sanity check of usernames in squid_ldap_auth - - - squid - 2.5.7_7 - - - - -

The LDAP authentication helper did not strip - leading or trailing spaces from the login name. - According to the squid patches page:

-
-

LDAP is very forgiving about spaces in search - filters and this could be abused to log in - using several variants of the login name, - possibly bypassing explicit access controls - or confusing accounting.

-

Workaround: Block logins with spaces

- 
-	    acl login_with_spaces proxy_auth_regex [:space:]
-		    http_access deny login_with_spaces
-
-
- - - - CVE-2005-0173 - http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-ldap_spaces - http://www.squid-cache.org/bugs/show_bug.cgi?id=1187 - 924198 - - - 2005-01-10 - 2005-01-19 - 2005-02-08 - - - - - cups-base -- CUPS server remote DoS vulnerability - - - cups-base - 1.1.211.1.23 - - - - -

Kenshi Muto discovered that the CUPS server would enter an - infinite loop when processing a URL containing - /...

- - - - 12200 - CVE-2005-2874 - http://www.cups.org/str.php?L1042 - - - 2004-12-30 - 2005-01-18 - 2005-09-21 - - - - - tiff -- divide-by-zero denial-of-service - - - tiff - linux-tiff - 3.6.0 - - - pdflib - pdflib-perl - 6.0.1 - - - gdal - 1.2.1_2 - - - ivtools - 1.2.3 - - - paraview - 2.4.3 - - - fractorama - 1.6.7_1 - - - iv - ja-iv - ja-libimg - 0 - - - - -

A US-CERT vulnerability note reports:

-
-

An Integer overflow in the LibTIFF library may allow a - remote attacker to cause a divide-by-zero error that results - in a denial-of-service condition.

-
- - - - CVE-2004-0804 - 555304 - http://bugzilla.remotesensing.org/show_bug.cgi?id=111 - - - 2002-03-27 - 2005-01-18 - 2006-06-08 - - - - - zgv -- exploitable heap overflows - - - zgv - 5.8_1 - - - xzgv - 0.8_2 - - - - -

infamous41md reports:

-
-

zgv uses malloc() frequently to allocate memory for storing - image data. When calculating how much to allocate, user - supplied data from image headers is multiplied and/or added - without any checks for arithmetic overflows. We can - overflow numerous calculations, and cause small buffers to - be allocated. Then we can overflow the buffer, and - eventually execute code. There are a total of - 11 overflows that are exploitable to execute arbitrary - code.

-
-

These bugs exist in both zgv and xzgv.

- - - - http://marc.theaimsgroup.com/?l=bugtraq&m=109886210702781 - http://marc.theaimsgroup.com/?l=bugtraq&m=109898111915661 - http://rus.members.beeb.net/xzgv.html - http://www.svgalib.org/rus/zgv/ - CVE-2004-0994 - http://www.idefense.com/application/poi/display?id=160&type=vulnerabilities&flashstatus=false - - - 2004-10-26 - 2005-01-18 - 2005-01-21 - - - - - mozilla -- insecure permissions for some downloaded files - - - thunderbird - 0.9 - - - de-linux-mozillafirebird - el-linux-mozillafirebird - firefox - ja-linux-mozillafirebird-gtk1 - ja-mozillafirebird-gtk2 - linux-mozillafirebird - ru-linux-mozillafirebird - zhCN-linux-mozillafirebird - zhTW-linux-mozillafirebird - 1.0.r2,1 - - - de-netscape7 - fr-netscape7 - ja-netscape7 - netscape7 - pt_BR-netscape7 - 7.2 - - - mozilla-gtk1 - linux-mozilla - linux-mozilla-devel - 1.7.5 - - - mozilla - 1.7.5,2 - - - - de-linux-netscape - fr-linux-netscape - ja-linux-netscape - linux-netscape - linux-phoenix - mozilla+ipv6 - mozilla-embedded - mozilla-firebird - mozilla-gtk2 - mozilla-gtk - mozilla-thunderbird - phoenix - 0 - - - - -

In a Mozilla bug report, Daniel Kleinsinger writes:

-
-

I was comparing treatment of attachments opened directly - from emails on different platforms. I discovered that Linux - builds save attachments in /tmp with world readable rights. - This doesn't seem like a good thing. Couldn't someone else - logged onto the same machine read your attachments?

-
-

This could expose the contents of downloaded files or email - attachments to other users on a multi-user system.

- - - - https://bugzilla.mozilla.org/show_bug.cgi?id=251297 - http://marc.theaimsgroup.com/?l=full-disclosure&m=109865078103911 - - - 2004-07-13 - 2005-01-18 - - - - - awstats -- remote command execution vulnerability - - - awstats - 6.3 - - - - -

An iDEFENSE Security Advisory reports:

-
-

Remote exploitation of an input validation vulnerability - in AWStats allows attackers to execute arbitrary commands - under the privileges of the web server.

-

The problem specifically exists when the application is - running as a CGI script on a web server. The "configdir" - parameter contains unfiltered user-supplied data that is - utilized in a call to the Perl routine open()...

-

Successful exploitation allows remote attackers to - execute arbitrary commands under the privileges of the web - server. This can lead to further compromise as it provides - remote attackers with local access.

-
- - - - 12270 - CVE-2005-0116 - 272296 - http://marc.theaimsgroup.com/?l=full-disclosure&m=110600949323439 - http://awstats.sourceforge.net/docs/awstats_changelog.txt - http://www.idefense.com/application/poi/display?id=185&type=vulnerabilities&flashstatus=false - - - 2004-10-21 - 2005-01-18 - 2005-02-23 - - - - - ImageMagick -- PSD handler heap overflow vulnerability - - - ImageMagick - ImageMagick-nox11 - 6.1.8.8 - - - - -

An iDEFENSE Security Advisory reports:

-
-

Remote exploitation of a buffer overflow vulnerability in - The ImageMagick's Project's ImageMagick PSD image-decoding - module could allow an attacker to execute arbitrary - code.

-

Exploitation may allow attackers to run arbitrary code on - a victim's computer if the victim opens a specially - formatted image. Such images could be delivered by e-mail - or HTML, in some cases, and would likely not raise - suspicion on the victim's part. Exploitation is also - possible when a web-based application uses ImageMagick to - process user-uploaded image files.

-
- - - - CVE-2005-0005 - http://www.idefense.com/application/poi/display?id=184&type=vulnerabilities - - - 2004-12-21 - 2005-01-18 - - - - - cups-lpr -- lppasswd multiple vulnerabilities - - - cups-lpr - fr-cups-lpr - 1.1.23 - - - - -

D. J. Bernstein reports that Bartlomiej Sieka has - discovered several security vulnerabilities in lppasswd, - which is part of CUPS. In the following excerpt from - Bernstein's email, CVE names have been added for each issue:

-
-

First, lppasswd blithely ignores write errors in - fputs(line,outfile) at lines 311 and 315 of lppasswd.c, - and in fprintf(...) at line 346. An attacker who fills up - the disk at the right moment can arrange for - /usr/local/etc/cups/passwd to be truncated. - (CAN-2004-1268)

-

Second, if lppasswd bumps into a file-size resource limit - while writing passwd.new, it leaves passwd.new in place, - disabling all subsequent invocations of lppasswd. Any - local user can thus disable lppasswd... - (CAN-2004-1269)

-

Third, line 306 of lppasswd.c prints an error message to - stderr but does not exit. This is not a problem on systems - that ensure that file descriptors 0, 1, and 2 are open for - setuid programs, but it is a problem on other systems; - lppasswd does not check that passwd.new is different from - stderr, so it ends up writing a user-controlled error - message to passwd if the user closes file descriptor - 2. (CAN-2004-1270)

-
-

Note: The third issue, CVE-2004-1270, does - not affect FreeBSD 4.6-RELEASE or later systems, as these - systems ensure that the file descriptors 0, 1, and 2 are - always open for set-user-ID and set-group-ID programs.

- - - - CVE-2004-1268 - CVE-2004-1269 - CVE-2004-1270 - 12007 - 12004 - http://www.cups.org/str.php?L1023 - http://tigger.uic.edu/~jlongs2/holes/cups2.txt - - - 2004-12-11 - 2005-01-17 - - - - - cups-base -- HPGL buffer overflow vulnerability - - - cups-base - fr-cups-base - 1.1.22.0_2 - - - - -

Ariel Berkman has discovered a buffer overflow - vulnerability in CUPS's HPGL input driver. This - vulnerability could be exploited to execute arbitrary code - with the permission of the CUPS server by printing a - specially crated HPGL file.

- - - - 11968 - CVE-2004-1267 - http://tigger.uic.edu/~jlongs2/holes/cups.txt - http://www.cups.org/str.php?L1024 - - - 2004-12-15 - 2005-01-17 - - - - - mysql-scripts -- mysqlaccess insecure temporary file creation - - - mysql-scripts - 3.23.58_2 - 4.*4.0.23a_1 - 4.1.*4.1.9_1 - 5.*5.0.2_1 - - - - -

The Debian Security Team reports:

-
-

Javier Fernández-Sanguino Peña from the Debian Security - Audit Project discovered a temporary file vulnerability in - the mysqlaccess script of MySQL that could allow an - unprivileged user to let root overwrite arbitrary files - via a symlink attack and could also could unveil the - contents of a temporary file which might contain sensitive - information.

-
- - - - CVE-2005-0004 - http://lists.mysql.com/internals/20600 - - - 2005-01-12 - 2005-01-16 - 2005-01-17 - - - - - unrtf -- buffer overflow vulnerability - - - unrtf - 0.19.3_1 - - - - -

Yosef Klein and Limin Wang have found a buffer overflow - vulnerability in unrtf that can allow an attacker to execute - arbitrary code with the permissions of the user running - unrtf, by running unrtf on a specially crafted rtf - document.

- - - - 12030 - CVE-2004-1297 - http://tigger.uic.edu/~jlongs2/holes/unrtf.txt - - - 2004-12-15 - 2005-01-16 - 2005-02-11 - - - - - mozilla -- heap overflow in NNTP handler - - - de-netscape7 - fr-netscape7 - ja-netscape7 - netscape7 - pt_BR-netscape7 - 0 - - - mozilla-gtk1 - linux-mozilla - linux-mozilla-devel - 1.7.5 - - - mozilla - 1.7.5,2 - - - - de-linux-netscape - fr-linux-netscape - ja-linux-netscape - linux-netscape - mozilla+ipv6 - mozilla-embedded - mozilla-gtk2 - mozilla-gtk - 0 - - - - -

Maurycy Prodeus reports a critical vulnerability in - Mozilla-based browsers:

-
-

Mozilla browser supports NNTP urls. Remote side is able to - trigger news:// connection to any server. I found a flaw in - NNTP handling code which may cause heap overflow and allow - remote attacker to execute arbitrary code on client - machine.

-
- - - - CVE-2004-1316 - http://isec.pl/vulnerabilities/isec-0020-mozilla.txt - http://marc.theaimsgroup.com/?l=bugtraq&m=110436284718949 - - - 2004-12-29 - 2005-01-13 - - - - - mpg123 -- buffer overflow vulnerability - - - mpg123 - mpg123-nas - mpg123-esound - 0.59r_17 - - - - -

Yuri D'Elia has found a buffer overflow vulnerability in - mpg123's parsing of frame headers in input streams. This - vulnerability can potentially lead to execution of arbitrary - code with the permissions of the user running mpg123, if the - user runs mpg123 on a specially crafted MP2 or MP3 file.

- - - - CVE-2004-0991 - - - 2005-01-01 - 2005-01-13 - - - - - squid -- denial of service with forged WCCP messages - - - squid - 2.5.7_6 - - - - -

The squid patches page notes:

-
-

WCCP_I_SEE_YOU messages contain a 'number of caches' - field which should be between 1 and 32. Values outside - that range may crash Squid if WCCP is enabled, and if an - attacker can spoof UDP packets with the WCCP router's IP - address.

-
- - - - CVE-2005-0095 - http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-wccp_denial_of_service - http://www.squid-cache.org/bugs/show_bug.cgi?id=1190 - http://www.squid-cache.org/Advisories/SQUID-2005_2.txt - - - 2005-01-07 - 2005-01-12 - 2005-01-22 - - - - - squid -- buffer overflow vulnerability in gopherToHTML - - - squid - 2.5.7_6 - - - - -

The squid patches page notes:

-
-

A malicious gopher server may return a response with very - long lines that cause a buffer overflow in Squid.

-

Workaround: Since gopher is very obscure these days, do - not allow Squid to any gopher servers. Use an ACL rule - like:

- 
acl Gopher proto gopher
-http_access deny Gopher
-
- - - - CVE-2005-0094 - http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-gopher_html_parsing - http://www.squid-cache.org/bugs/show_bug.cgi?id=1189 - http://www.squid-cache.org/Advisories/SQUID-2005_1.txt - - - 2005-01-11 - 2005-01-12 - 2005-01-22 - - - - - libxine -- DVD subpicture decoder heap overflow - - - libxine - 1.0.r6 - - - - -

A xine security announcement states:

-
-

A heap overflow has been found in the DVD subpicture - decoder of xine-lib. This can be used for a remote heap - overflow exploit, which can, on some systems, lead to or - help in executing malicious code with the permissions of the - user running a xine-lib based media application.

-
- - - - CVE-2004-1379 - http://xinehq.de/index.php/security/XSA-2004-5 - - - 2004-09-06 - 2005-01-12 - 2005-01-19 - - - - - libxine -- multiple vulnerabilities in VideoCD handling - - - libxine - 1.0.r21.0.r6 - - - - -

A xine security announcement states:

-
-

Several string overflows on the stack have been fixed in - xine-lib, some of them can be used for remote buffer - overflow exploits leading to the execution of arbitrary code - with the permissions of the user running a xine-lib based - media application.

-

Stack-based string overflows have been found:

-
    -
  1. in the code which handles VideoCD MRLs
    2. -
  2. in VideoCD code reading the disc label
    3. -
  3. in the code which parses text subtitles and prepares - them for display
    4. -
-
- - - - http://xinehq.de/index.php/security/XSA-2004-4 - - - 2004-09-07 - 2005-01-12 - - - - - libxine -- multiple buffer overflows in RTSP - - - mplayer - mplayer-gtk - mplayer-gtk2 - mplayer-esound - mplayer-gtk-esound - mplayer-gtk2-esound - 0.99.4 - - - libxine - 1.0.r4 - - - - -

A xine security announcement states:

-
-

Multiple vulnerabilities have been found and fixed in the - Real-Time Streaming Protocol (RTSP) client for RealNetworks - servers, including a series of potentially remotely - exploitable buffer overflows. This is a joint advisory by - the MPlayer and xine teams as the code in question is common - to these projects.

-

Severity: High (arbitrary remote code execution under the - user ID running the player) when playing Real RTSP streams. - At this time, there is no known exploit for these - vulnerabilities.

-
- - - - CVE-2004-0433 - http://xinehq.de/index.php/security/XSA-2004-3 - http://xforce.iss.net/xforce/xfdb/16019 - 10245 - - - 2004-05-25 - 2005-01-12 - - - - - hylafax -- unauthorized login vulnerability - - - hylafax - 4.2.1 - - - - -

A flaw in HylaFAX may allow an attacker to bypass normal - authentication by spoofing their DNS PTR records.

- - - - CVE-2004-1182 - http://marc.theaimsgroup.com/?l=bugtraq&m=110546971307585 - - - 2005-01-11 - 2005-01-11 - - - - - xshisen -- local buffer overflows - - - xshisen - 1.36_1 - - - - -

Steve Kemp has found buffer overflows in the handling - of the command line flag -KCONV and the XSHISENLIB environment - variable. Ulf Härnhammer has detected an unbounded copy from - the GECOS field to a char array. All overflows can be exploited - to gain group games privileges.

- - - - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=213957 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=289784 - CVE-2003-1053 - CVE-2005-0117 - - - 2005-01-11 - 2005-01-11 - 2005-01-19 - - - - - helvis -- arbitrary file deletion problem - - - ko-helvis - 1.8h2_1 - - - helvis - 1.8h2_1 - - - - -

The setuid root elvprsv utility, used to preserve - recovery helvis files, can be abused by local users to delete - with root privileges.

-

The problem is that elvprsv deletes files when it thinks they - have become corrupt. When elvprsv is pointed to a normal file then - it will almost always think the file is corrupt and deletes it. - This behavior may be exploited by local attackers to delete critical - files.

- - - - CVE-2005-0120 - http://people.freebsd.org/~niels/ports/korean/helvis/issues.txt - - - 2004-11-24 - 2005-01-10 - 2005-01-19 - - - - - helvis -- information leak vulnerabilities - - - ko-helvis - 1.8h2_1 - - - helvis - 1.8h2_1 - - - - -

Once a recovery file has been preserved by the setuid root elvprsv - utility it is placed in a worldreadable directory with worldreadable - permissions. This possibly allows sensitive information to leak.

-

In addition to this information leak, it is possible for users - to recover files that belong to other users by using elvrec, another - setuid root binary.

- - - - CVE-2005-0118 - CVE-2005-0119 - http://people.freebsd.org/~niels/ports/korean/helvis/issues.txt - - - 2004-11-24 - 2005-01-10 - 2005-01-19 - - - - - dillo -- format string vulnerability - - - dillo - 0.8.3_1 - - - - -

dillo contains a format string vulnerability which could - lead to execution of arbitrary code simply by viewing a web - page or opening a HTML file.

- - - - CVE-2005-0012 - http://bugs.gentoo.org/show_bug.cgi?id=76665 - - - 2005-01-04 - 2005-01-08 - - - - - tnftp -- mget does not check for directory escapes - - - tnftp - 20050103 - - - - -

When downloading a batch of files from an FTP server the - mget command does not check for directory escapes. A - specially crafted file on the FTP server could then - potentially overwrite an existing file of the user.

- - - - CVE-2004-1294 - http://tigger.uic.edu/~jlongs2/holes/tnftp.txt - http://cvsweb.netbsd.org/bsdweb.cgi/othersrc/usr.bin/tnftp/src/cmds.c?rev=1.1.1.3&content-type=text/x-cvsweb-markup - http://it.slashdot.org/article.pl?sid=04/12/15/2113202 - http://marc.theaimsgroup.com/?l=bugtraq&m=110321888413132 - - - 2004-12-15 - 2005-01-07 - 2005-01-13 - - - - - tiff -- tiffdump integer overflow vulnerability - - - tiff - 3.7.1_2 - - - linux-tiff - 3.6.1_1 - - - - -

Dmitry V. Levin found a potential integer overflow in the - tiffdump utility which could lead to execution of arbitrary - code. This could be exploited by tricking an user into - executing tiffdump on a specially crafted tiff image.

- - - - CVE-2004-1183 - - - 2005-01-06 - 2005-01-06 - 2005-03-01 - - - - - tiff -- directory entry count integer overflow vulnerability - - - tiff - 3.7.1 - - - linux-tiff - 3.6.1_1 - - - pdflib - pdflib-perl - 6.0.1_1 - - - gdal - 1.2.1_2 - - - ivtools - 1.2.3 - - - paraview - 2.4.3 - - - fractorama - 1.6.7_1 - - - iv - ja-iv - ja-libimg - 0 - - - - -

In an iDEFENSE Security Advisory infamous41md reports:

-
-

Remote exploitation of a heap-based buffer overflow - vulnerability within the LibTIFF package could allow - attackers to execute arbitrary code.

-

The vulnerability specifically exists due to insufficient - validation of user-supplied data when calculating the size - of a directory entry. A TIFF file includes a number of - directory entry header fields that describe the data in - the file. Included in these entries is an entry count and - offset value that are calculated to determine the size and - location of the data for that entry.

-
- - - - 12075 - CVE-2004-1308 - http://www.idefense.com/application/poi/display?id=174&type=vulnerabilities - 125598 - - - 2004-12-17 - 2005-01-06 - 2006-06-08 - - - - - - - - - vim -- vulnerabilities in modeline handling - - - vim - vim-console - vim-lite - vim+ruby - 6.3.45 - - - - -

Ciaran McCreesh discovered news ways in which a VIM modeline - can be used to trojan a text file. The patch by Bram - Moolenaar reads:

-
-

Problem: Unusual characters in an option value may cause - unexpected behavior, especially for a modeline. (Ciaran - McCreesh)

-

Solution: Don't allow setting termcap options or - 'printdevice' or 'titleold' in a modeline. Don't list - options for "termcap" and "all" in a modeline. Don't allow - unusual characters in 'filetype', 'syntax', 'backupext', - 'keymap', 'patchmode' and 'langmenu'.

-
-

Note: It is generally recommended that VIM - users use set nomodeline in - ~/.vimrc to avoid the possibility of trojaned - text files.

- - - - CVE-2004-1138 - ftp://ftp.vim.org/pub/vim/patches/6.3/6.3.045 - http://groups.yahoo.com/group/vimdev/message/38084 - - - 2004-12-09 - 2005-01-06 - 2005-01-13 - - - - - pcal -- buffer overflow vulnerabilities - - - pcal - 4.8.0 - - - - -

Danny Lungstrom has found two buffer overflow - vulnerabilities in pcal which can lead to execution of - arbitrary code by making a user run pcal on a specially - crafted calendar file.

- - - - CVE-2004-1289 - 12035 - 12036 - http://securesoftware.list.cr.yp.to/archive/0/46 - - - 2004-12-15 - 2005-01-06 - - - - - exim -- two buffer overflow vulnerabilities - - - exim - exim-ldap - exim-ldap2 - exim-mysql - exim-postgresql - exim-sa-exim - 4.43+28_1 - - - - -

1. The function host_aton() can overflow a buffer - if it is presented with an illegal IPv6 address - that has more than 8 components.

-

2. The second report described a buffer overflow - in the function spa_base64_to_bits(), which is part - of the code for SPA authentication.

- - - - http://www.exim.org/mail-archives/exim-announce/2005/msg00000.html - http://marc.theaimsgroup.com/?l=bugtraq&m=110573573800377 - CVE-2005-0021 - CVE-2005-0022 - 12185 - 12188 - 12268 - - - 2005-01-05 - 2005-01-05 - 2005-01-18 - - - - - mpg123 -- playlist processing buffer overflow vulnerability - - - mpg123 - mpg123-nas - mpg123-esound - 0.59r_15 - - - - -

A buffer overflow vulnerability exists in the playlist - processing of mpg123. A specially crafted playlist entry - can cause a stack overflow that can be used to inject - arbitrary code into the mpg123 process.

-

Note that a malicious playlist, demonstrating this - vulnerability, was released by the bug finder and may be - used as a template by attackers.

- - - - CVE-2004-1284 - http://tigger.uic.edu/~jlongs2/holes/mpg123.txt - http://secunia.com/advisories/13511/ - http://xforce.iss.net/xforce/xfdb/18626 - 11958 - http://marc.theaimsgroup.com/?l=bugtraq&m=110321888413132 - - - 2004-12-15 - 2005-01-03 - 2005-01-13 - - - - - greed -- insecure GRX file processing - - - greed - 0.81p - - - - -

A buffer overflow vulnerability has been detected in the greed - URL handling code. This bug can especially be a problem when greed is - used to process GRX (GetRight) files that originate from untrusted - sources.

-

The bug finder, Manigandan Radhakrishnan, gave the following - description:

-
-

Here are the bugs. First, in main.c, DownloadLoop() uses strcat() - to copy an input filename to the end of a 128-byte COMMAND array. - Second, DownloadLoop() passes the input filename to system() without - checking for special characters such as semicolons.

- - - - CVE-2004-1273 - CVE-2004-1274 - http://tigger.uic.edu/~jlongs2/holes/greed.txt - http://secunia.com/advisories/13534/ - http://marc.theaimsgroup.com/?l=bugtraq&m=110321888413132 - - - 2004-12-15 - 2005-01-03 - 2005-01-13 - - - - - golddig -- local buffer overflow vulnerabilities - - - golddig - 2.0 - - - - -

Two buffer overflow vulnerabilities where detected. Both issues can - be used by local users to gain group games privileges on affected - systems.

-

The first overflow exists in the map name handling and can be - triggered when a very long name is given to the program during - command-line execution

-

The second overflow exists in the username processing while writing - the players score to disk. Excessivly long usernames, set via the USER - environment variable, are stored without any length checks in a memory - buffer.

- - - - CVE-2005-0121 - http://docs.FreeBSD.org/cgi/mid.cgi?200412021055.iB2AtweU067125 - - - 2004-11-11 - 2005-01-03 - 2005-01-19 - - - - - up-imapproxy -- multiple vulnerabilities - - - up-imapproxy - 1.2.4 - - - pop3proxy - 1.1 - - - - -

Timo Sirainen reports:

-
-

There are various bugs in up-imapproxy which can crash - it. Since up-imapproxy runs in a single process with each - connection handled in a separate thread, any crash kills - all the connections and stops listening for new ones.

-

In 64bit systems it might be possible to make it leak - data (mails, passwords, ..) from other connections to - attacker's connection. However I don't think up-imapproxy - actually works in any 64bit system so this is just a - theoretical problem.

-
- - - - CVE-2004-1035 - 11630 - http://marc.theaimsgroup.com/?l=bugtraq&m=109995749510773 - - - 2004-11-17 - 2005-01-02 - 2008-02-27 - - - - - kdelibs3 -- konqueror FTP command injection vulnerability - - - ja-kdelibs - kdelibs - 3.3.2_2 - - - - -

Albert Puigsech Galicia reports that Konqueror (more - specifically kio_ftp) and Microsoft Internet Explorer are - vulnerable to a FTP command injection vulnerability which - can be exploited by tricking an user into clicking a - specially crafted FTP URI.

-

It is also reported by Ian Gulliver and Emanuele Balla that - this vulnerability can be used to tricking a client into - sending out emails without user interaction.

- - - - 11827 - CVE-2004-1165 - http://marc.theaimsgroup.com/?l=bugtraq&m=110245752232681 - http://marc.theaimsgroup.com/?l=full-disclosure&m=110387390226693 - http://marc.theaimsgroup.com/?l=full-disclosure&m=110390734925183 - http://www.kde.org/info/security/advisory-20050101-1.txt - - - 2004-12-01 - 2005-01-01 - 2005-01-04 - - - - - squid -- possible abuse of cachemgr.cgi - - - squid - 2.5.10 - - - - -

The squid patches page notes:

-
-

This patch adds access controls to the cachemgr.cgi script, - preventing it from being abused to reach other servers than - allowed in a local configuration file.

-
- - - - CVE-1999-0710 - http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE9-cachemgr_conf - http://www.squid-cache.org/bugs/show_bug.cgi?id=1094 - - - 1999-07-29 - 2005-05-19 - - - - - squid -- DNS lookup spoofing vulnerability - - - squid - 2.5.10 - - - - -

The squid patches page notes:

-
-

Malicious users may spoof DNS lookups if the DNS client UDP port - (random, assigned by OS as startup) is unfiltered and your network - is not protected from IP spoofing.

-
- - - - CVE-2005-1519 - http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE9-dns_reply - http://secunia.com/advisories/15294 - - - 2005-05-11 - 2005-05-19 - - - - - jabberd -- 3 buffer overflows - - - jabberd - 2.0.9 - - - - -

There are 3 buffer overflows in jid.c that are triggered - during parsing of JID strings when components (user, host or - resource) are too long.

-
    -
  1. jid.c, line 103: overflow in `str' buffer through - strcpy() when "user" part is too long.
    2. -
  2. jid.c, line 115: overflow in `str' buffer through - strcpy() when "host" part is too long.
    3. -
  3. jid.c, line 127: overflow in `str' buffer through - strcpy() when "resource" part is too - long.
    4. -
-

These overflows can be used to perform a DoS attack on the - server (sm process segfaults) and can possible be used for - arbitrary code execution.

- - - - http://j2.openaether.org/bugzilla/show_bug.cgi?id=99 - - - 2005-07-25 - 2005-07-30 - - - - - squid -- possible denial of service condition regarding NTLM authentication - - - squid - 2.5.10_6 - - - - -

The squid patches page notes:

-
-

Squid may crash with the above error [FATAL: Incorrect scheme in - auth header] when given certain request sentences.

-

Workaround: disable NTLM authentication.

-
- - - - 14977 - CVE-2005-2917 - http://www.squid-cache.org/bugs/show_bug.cgi?id=1391 - http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE10-NTLM-scheme_assert - http://secunia.com/advisories/16992/ - - - 2005-09-12 - 2005-09-15 - 2005-10-02 - - - - - phpmyfaq -- SQL injection, takeover, path disclosure, remote code execution - - - phpmyfaq - 1.5.2 - - - - -

If magic quotes are off there's a SQL injection when - sending a forgotten password. It's possible to overwrite - the admin password and to take over the whole system. In - some files in the admin section there are some cross site - scripting vulnerabilities. In the public frontend it's - possible to include arbitrary php files.

- - - - 14927 - 14928 - 14929 - 14930 - CVE-2005-3046 - CVE-2005-3047 - CVE-2005-3048 - CVE-2005-3049 - CVE-2005-3050 - http://www.phpmyfaq.de/advisory_2005-09-23.php - - - 2005-09-23 - 2005-09-29 - - - - - a2ps -- insecure temporary file creation - - - a2ps-a4 - a2ps-letter - a2ps-letterdj - 4.13b_3 - - - - -

A Secunia Security Advisory reports that Javier - Fernández-Sanguino Peña has found temporary file - creation vulnerabilities in the fixps and psmandup scripts - which are part of a2ps. These vulnerabilities could lead to - an attacker overwriting arbitrary files with the credentials - of the user running the vulnerable scripts.

- - - - CVE-2004-1377 - 12108 - 12109 - http://secunia.com/advisories/13641/ - - - 2004-12-27 - 2004-12-30 - 2005-01-19 - - - - - libxine -- buffer-overflow vulnerability in aiff support - - - libxine - 1.0.r5_3 - - - - -

Due to a buffer overflow in the open_aiff_file function in - demux_aiff.c, a remote attacker is able to execute arbitrary - code via a modified AIFF file.

- - - CVE-2004-1300 - http://tigger.uic.edu/~jlongs2/holes/xine-lib.txt - http://xinehq.de/index.php/security/XSA-2004-7 - - - 2004-12-15 - 2004-12-29 - 2005-01-12 - - - - - jabberd -- denial-of-service vulnerability - - - jabber - 1.4.3.1 - - - - -

José Antonio Calvo discovered a bug in the Jabber 1.x server. - According to Matthias Wimmer:

-
-

Without this patch, it is possible to remotly crash - jabberd14, if there is access to one of the following types - of network sockets:

-
    -
  • Socket accepting client connections
    • -
  • Socket accepting connections from other servers
    • -
  • Socket connecting to an other Jabber server
    • -
  • Socket accepting connections from server components
    • -
  • Socket connecting to server components
    • -
-

This is any socket on which the jabberd server parses - XML!

-

The problem existed in the included expat XML parser code. - This patch removes the included expat code from jabberd14 - and links jabberd against an installed version of expat.

-
- - - - CVE-2004-1378 - http://devel.amessage.info/jabberd14/README.html - http://mail.jabber.org/pipermail/jabberd/2004-September/002004.html - - - 2004-09-19 - 2004-12-26 - 2005-01-19 - - - - - squid -- confusing results on empty acl declarations - - - squid - 2.5.7_5 - - - - -

Applying an empty ACL list results in unexpected behavior: - anything will match an empty ACL list. For example,

-
-

The meaning of the configuration gets very confusing when - we encounter empty ACLs such as

-

acl something src "/path/to/empty_file.txt"
- http_access allow something somewhere

-

gets parsed (with warnings) as

-

http_access allow somewhere

-

And similarily if you are using proxy_auth acls without - having any auth schemes defined.

-
- - - - CVE-2005-0194 - http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-empty_acls - http://www.squid-cache.org/bugs/show_bug.cgi?id=1166 - - - 2004-12-21 - 2004-12-23 - 2005-02-08 - - - - - ethereal -- multiple vulnerabilities - - - ethereal - ethereal-lite - tethereal - tethereal-lite - 0.10.8 - - - - -

An Ethreal Security Advisories reports:

-
-

Issues have been discovered in the following protocol - dissectors:

-
    -
  • Matthew Bing discovered a bug in DICOM dissection that - could make Ethereal crash.
    • -
  • An invalid RTP timestamp could make Ethereal hang and - create a large temporary file, possibly filling - available disk space.
    • -
  • The HTTP dissector could access previously-freed - memory, causing a crash.
    • -
  • Brian Caswell discovered that an improperly formatted - SMB packet could make Ethereal hang, maximizing CPU - utilization.
    • -
-

Impact: It may be possible to make Ethereal crash or run - arbitrary code by injecting a purposefully malformed - packet onto the wire or by convincing someone to read a - malformed packet trace file.

-
- - - - CVE-2004-1139 - CVE-2004-1140 - CVE-2004-1141 - CVE-2004-1142 - http://www.ethereal.com/appnotes/enpa-sa-00016.html - - - 2004-12-14 - 2004-12-23 - - - - - xpdf -- buffer overflow vulnerability - - - xpdf - 3.00_5 - - - kdegraphics - 3.3.2_1 - - - gpdf - 2.8.1 - - - teTeX-base - 2.0.2_6 - - - cups-base - 1.1.22.0 - - - koffice - 1.3.5,1 - - - pdftohtml - 0.36_1 - - - - -

An iDEFENSE Security Advisory reports:

-
-

Remote exploitation of a buffer overflow vulnerability in - the xpdf PDF viewer, as included in multiple Linux - distributions, could allow attackers to execute arbitrary - code as the user viewing a PDF file. The offending code - can be found in the Gfx::doImage() function in the source - file xpdf/Gfx.cc.

-
- - - - CVE-2004-1125 - http://www.idefense.com/application/poi/display?id=172&type=vulnerabilities - - - 2004-11-23 - 2004-12-23 - 2005-01-13 - - - - - acroread5 -- mailListIsPdf() buffer overflow vulnerability - - - acroread - acroread4 - acroread5 - 5.10 - - - - -

An iDEFENSE Security Advisory reports:

-
-

Remote exploitation of a buffer overflow in version 5.09 - of Adobe Acrobat Reader for Unix could allow for execution - of arbitrary code.

-

The vulnerability specifically exists in a the function - mailListIsPdf(). This function checks if the input file - is an email message containing a PDF. It unsafely copies - user supplied data using strcat into a fixed sized - buffer.

-
- - - - CVE-2004-1152 - 253024 - http://www.adobe.com/support/techdocs/331153.html - http://www.idefense.com/application/poi/display?id=161&type=vulnerabilities - - - 2004-10-14 - 2004-12-21 - 2005-01-06 - - - - - ecartis -- unauthorised access to admin interface - - - ecartis - 1.0.0.s20031228_2,1 - - - - -

A Debian security advisory reports:

-
-

A problem has been discovered in ecartis, a mailing-list - manager, which allows an attacker in the same domain as - the list admin to gain administrator privileges and alter - list settings.

-
- - - - CVE-2004-0913 - http://www.debian.org/security/2004/dsa-572 - http://secunia.com/advisories/12918/ - - - 2004-10-12 - 2004-12-21 - - - - - mplayer -- multiple vulnerabilities - - - mplayer - mplayer-gtk - mplayer-gtk2 - mplayer-esound - mplayer-gtk-esound - mplayer-gtk2-esound - 0.99.5_5 - - - libxine - 1.0.r5_3 - - - - -

iDEFENSE and the MPlayer Team have found multiple - vulnerabilities in MPlayer:

-
    -
  • Potential heap overflow in Real RTSP streaming code
    • -
  • Potential stack overflow in MMST streaming code
    • -
  • Multiple buffer overflows in BMP demuxer
    • -
  • Potential heap overflow in pnm streaming code
    • -
  • Potential buffer overflow in mp3lib
    • -
-

These vulnerabilities could allow a remote attacker to - execute arbitrary code as the user running MPlayer. The - problem in the pnm streaming code also affects xine.

- - - - CVE-2004-1187 - CVE-2004-1188 - http://mplayerhq.hu/homepage/design7/news.html#mplayer10pre5try2 - http://marc.theaimsgroup.com/?l=bugtraq&m=110322526210300 - http://www.idefense.com/application/poi/display?id=166 - http://marc.theaimsgroup.com/?l=bugtraq&m=110322829807443 - http://www.idefense.com/application/poi/display?id=167 - http://marc.theaimsgroup.com/?l=bugtraq&m=110323022605345 - http://www.idefense.com/application/poi/display?id=168 - http://xinehq.de/index.php/security/XSA-2004-6 - - - 2004-12-10 - 2004-12-21 - 2005-01-12 - - - - - krb5 -- heap buffer overflow vulnerability in libkadm5srv - - - krb5 - krb5-beta - 1.3.6 - - - - -

A MIT krb5 Security Advisory reports:

-
-

The MIT Kerberos 5 administration library (libkadm5srv) - contains a heap buffer overflow in password history - handling code which could be exploited to execute - arbitrary code on a Key Distribution Center (KDC) - host. The overflow occurs during a password change of a - principal with a certain password history state. An - administrator must have performed a certain password - policy change in order to create the vulnerable state.

-

An authenticated user, not necessarily one with - administrative privileges, could execute arbitrary code on - the KDC host, compromising an entire Kerberos realm.

-
- - - - CVE-2004-1189 - http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-004-pwhist.txt - - - 2004-12-06 - 2004-12-21 - - - - - samba -- integer overflow vulnerability - - - samba - 3.0.10 - *,13.0.10,1 - - - ja-samba - 2.2.12.j1.0beta1_2 - 3.*3.0.10 - 3.*,13.0.10,1 - - - - -

Greg MacManus, iDEFENSE Labs reports:

-
-

Remote exploitation of an integer overflow vulnerability - in the smbd daemon included in Samba 2.0.x, Samba 2.2.x, - and Samba 3.0.x prior to and including 3.0.9 could allow - an attacker to cause controllable heap corruption, leading - to execution of arbitrary commands with root - privileges.

-

Successful remote exploitation allows an attacker to gain - root privileges on a vulnerable system. In order to - exploit this vulnerability an attacker must possess - credentials that allow access to a share on the Samba - server. Unsuccessful exploitation attempts will cause the - process serving the request to crash with signal 11, and - may leave evidence of an attack in logs.

-
- - - - CVE-2004-1154 - http://www.idefense.com/application/poi/display?id=165&type=vulnerabilities - http://www.samba.org/samba/security/CAN-2004-1154.html - - - 2004-12-02 - 2004-12-21 - 2008-09-26 - - - - - php -- multiple vulnerabilities - - - mod_php4-twig - php4-cgi - php4-cli - php4-dtc - php4-horde - php4-nms - php4 - 4.3.10 - - - mod_php - mod_php4 - 44.3.10,1 - - - php5 - php5-cgi - php5-cli - 5.0.3 - - - mod_php5 - 5.0.3,1 - - - - -

Secunia reports:

-
-

Multiple vulnerabilities have been reported in PHP, - which can be exploited to gain escalated privileges, - bypass certain security restrictions, gain knowledge - of sensitive information, or compromise a vulnerable - system.

-
- - - - http://secunia.com/advisories/13481/ - CVE-2004-1019 - CVE-2004-1065 - http://www.php.net/release_4_3_10.php - http://www.hardened-php.net/advisories/012004.txt - - - 2004-12-16 - 2004-12-17 - 2004-12-18 - - - - - mysql -- GRANT access restriction problem - - - mysql-server - 3.23.58_3 - 4.*4.0.21 - - - - -

When a user is granted access to a database with a name containing - an underscore and the underscore is not escaped then that user might - also be able to access other, similarly named, databases on the - affected system.

-

The problem is that the underscore is seen as a wildcard by MySQL - and therefore it is possible that an admin might accidently GRANT a - user access to multiple databases.

- - - - CVE-2004-0957 - 11435 - http://bugs.mysql.com/bug.php?id=3933 - http://rhn.redhat.com/errata/RHSA-2004-611.html - http://www.openpkg.org/security/OpenPKG-SA-2004.045-mysql.html - - - 2004-03-29 - 2004-12-16 - 2005-03-15 - - - - - mysql -- ALTER MERGE denial of service vulnerability - - - mysql-server - 3.23.58_3 - 4.*4.0.21 - 4.1.*4.1.1 - - - - -

Dean Ellis reported a denial of service vulnerability in the MySQL - server:

-
-

Multiple threads ALTERing the same (or different) MERGE tables to - change the UNION eventually crash the server or hang the individual - threads.

-
-

Note that a script demonstrating the problem is included in the - MySQL bug report. Attackers that have control of a MySQL account can - easily use a modified version of that script during an attack.

- - - - CVE-2004-0837 - 11357 - http://bugs.mysql.com/bug.php?id=2408 - http://rhn.redhat.com/errata/RHSA-2004-611.html - - - 2004-01-15 - 2004-12-16 - 2005-03-15 - - - - - mysql -- FTS request denial of service vulnerability - - - mysql-server - 4.*4.0.21 - - - - -

A special crafted MySQL FTS request can cause the server to crash. - Malicious MySQL users can abuse this bug in a denial of service - attack against systems running an affected MySQL daemon.

-

Note that because this bug is related to the parsing of requests, - it may happen that this bug is triggered accidently by a user when he - or she makes a typo.

- - - - http://bugs.mysql.com/bug.php?id=3870 - CVE-2004-0956 - 11432 - - - 2004-03-23 - 2004-12-16 - - - - - mysql -- mysql_real_connect buffer overflow vulnerability - - - mysql-server - 3.23.58_3 - 4.*4.0.21 - - - mysql-client - 3.23.58_3 - 4.*4.0.21 - - - - -

The mysql_real_connect function doesn't properly handle DNS replies - by copying the IP address into a buffer without any length checking. - A specially crafted DNS reply may therefore be used to cause a buffer - overflow on affected systems.

-

Note that whether this issue can be exploitable depends on the - system library responsible for the gethostbyname function. The bug - finder, Lukasz Wojtow, explaines this with the following words:

-
-

In glibc there is a limitation for an IP address to have only 4 - bytes (obviously), but generally speaking the length of the address - comes with a response for dns query (i know it sounds funny but - read rfc1035 if you don't believe). This bug can occur on libraries - where gethostbyname function takes length from dns's response

-
- - - - CVE-2004-0836 - 10981 - http://bugs.mysql.com/bug.php?id=4017 - http://lists.mysql.com/internals/14726 - http://rhn.redhat.com/errata/RHSA-2004-611.html - http://www.osvdb.org/displayvuln.php?osvdb_id=10658 - - - 2004-06-04 - 2004-12-16 - 2005-03-15 - - - - - mysql -- erroneous access restrictions applied to table renames - - - mysql-server - 3.23.58_3 - 4.*4.0.21 - - - - -

A Red Hat advisory reports:

-
-

Oleksandr Byelkin discovered that "ALTER TABLE ... RENAME" checked - the CREATE/INSERT rights of the old table instead of the new - one.

-
-

Table access restrictions, on the affected MySQL servers, may - accidently or intentially be bypassed due to this bug.

- - - - CVE-2004-0835 - 11357 - http://bugs.mysql.com/bug.php?id=3270 - http://rhn.redhat.com/errata/RHSA-2004-611.html - http://xforce.iss.net/xforce/xfdb/17666 - - - 2004-03-23 - 2004-12-16 - 2005-03-15 - - - - - phpmyadmin -- command execution vulnerability - - - phpMyAdmin - 2.6.0.22.6.1.r1 - - - - -

A phpMyAdmin security announcement reports:

-
-

Command execution: since phpMyAdmin 2.6.0-pl2, on a - system where external MIME-based transformations are - activated, an attacker can put into MySQL data an - offensive value that starts a shell command when - browsed.

-
-

Enabling PHP safe mode on the server can be used as - a workaround for this vulnerability.

- - - - CVE-2004-1147 - http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-4 - http://www.exaprobe.com/labs/advisories/esa-2004-1213.html - - - 2004-12-13 - 2004-12-15 - 2004-12-19 - - - - - phpmyadmin -- file disclosure vulnerability - - - phpMyAdmin - 2.6.1.r1 - - - - -

A phpMyAdmin security announcement reports:

-
-

File disclosure: on systems where the UploadDir mecanism - is active, read_dump.php can be called with a crafted - form; using the fact that the sql_localfile variable is - not sanitized can lead to a file disclosure.

-
-

Enabling PHP safe mode on the server can be used as - a workaround for this vulnerability.

- - - - CVE-2004-1148 - http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-4 - http://www.exaprobe.com/labs/advisories/esa-2004-1213.html - - - 2004-12-13 - 2004-12-15 - 2004-12-19 - - - - - wget -- multiple vulnerabilities - - - wget - wget-devel - 1.10.a1 - - - wgetpro - wget+ipv6 - 0 - - - - -

Jan Minar reports that there exists multiple - vulnerabilities in wget:

-
-

Wget erroneously thinks that the current directory is a - fair game, and will happily write in any file in and below - it. Malicious HTTP response or malicious HTML file can - redirect wget to a file that is vital to the system, and - wget will create/append/overwrite it.

-

Wget apparently has at least two methods of - ``sanitizing'' the potentially malicious data it receives - from the HTTP stream, therefore a malicious redirects can - pass the check. We haven't find a way to trick wget into - writing above the parent directory, which doesn't mean - it's not possible.

-

Malicious HTTP response can overwrite parts of the - terminal so that the user will not notice anything wrong, - or will believe the error was not fatal.

-
- - - - CVE-2004-1487 - CVE-2004-1488 - 11871 - http://marc.theaimsgroup.com/?l=bugtraq&m=110269474112384 - http://bugs.debian.org/261755 - - - 2004-12-09 - 2004-12-14 - 2005-04-15 - - - - - konqueror -- Password Disclosure for SMB Shares - - - kdebase - kdelibs - 3.2.03.3.1 - - - - -

When browsing SMB shares with Konqueror, shares with - authentication show up with hidden password in the browser - bar. It is possible to store the URL as a shortcut on the - desktop where the password is then available in plain text.

- - - - CVE-2004-1171 - 305294 - http://www.kde.org/info/security/advisory-20041209-1.txt - http://marc.theaimsgroup.com/?l=bugtraq&m=110178786809694 - - - 2004-10-06 - 2004-12-12 - 2005-01-13 - - - - - mod_access_referer -- null pointer dereference vulnerability - - - mod_access_referer - 1.0.2_1 - - - - -

A malformed Referer header field causes the Apache - ap_parse_uri_components function to discard it with the - result that a pointer is not initialized. The - mod_access_referer module does not take this into account - with the result that it may use such a pointer.

-

The null pointer vulnerability may possibly be used in a - remote denial of service attack against affected Apache - servers.

- - - - CVE-2003-1054 - 7375 - http://secunia.com/advisories/8612/ - http://marc.theaimsgroup.com/?l=full-disclosure&m=105053485515811 - - - 2003-04-16 - 2004-12-11 - 2005-01-19 - - - - - squid -- possible information disclosure - - - squid - 2.5.7_4 - - - - -

The squid-2.5 patches pages notes:

-
-

In certain conditions Squid returns random data as error messages - in response to malformed host name, possibly leaking random - internal information which may come from other requests.

-
- - - - http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-dothost - - - 2004-11-23 - 2004-12-09 - - - - - viewcvs -- information leakage - - - viewcvs - 0.9.2_2 - - - - -

The hide_cvsroot and forbidden - configuration options are not properly honored by viewcvs - when exporting to a tar file which can lead to information - leakage.

- - - - CVE-2004-0915 - 11819 - - - 2004-11-25 - 2004-12-08 - 2004-12-12 - - - - - cscope -- symlink attack vulnerability - - - cscope - 15.5_1 - - - - -

cscope is vulnerable to a symlink attack which could lead - to an attacker overwriting arbitrary files with the - permissions of the user running cscope.

- - - - CVE-2004-0996 - 11697 - http://marc.theaimsgroup.com/?l=bugtraq&m=110133485519690 - http://marc.theaimsgroup.com/?l=bugtraq&m=110072752707293 - http://sourceforge.net/tracker/index.php?func=detail&aid=1062807&group_id=4664&atid=104664 - - - 2003-04-03 - 2004-12-07 - - - - - bnc -- remotely exploitable buffer overflow in getnickuserhost - - - bnc - 2.9.1 - - - - -

A LSS Security Advisory reports:

-
-

There is a buffer overflow vulnerability in - getnickuserhost() function that is called when BNC is - processing response from IRC server.

-

Vulnerability can be exploited if attacker tricks user to - connect to his fake IRC server that will exploit this - vulnerability. If the attacker has access to BNC proxy - server, this vulnerability can be used to gain shell - access on machine where BNC proxy server is set.

-
- - - - CVE-2004-1052 - http://marc.theaimsgroup.com/?l=bugtraq&m=110011817627839 - http://security.lss.hr/en/index.php?page=details&ID=LSS-2004-11-03 - http://www.gotbnc.com/changes.html - - - 2004-11-10 - 2004-12-04 - 2005-02-22 - - - - - rssh & scponly -- arbitrary command execution - - - rssh - 2.2.2 - - - scponly - 4.0 - - - - -

Jason Wies identified both rssh & scponly have a vulnerability - that allows arbitrary command execution. He reports:

-
-

The problem is compounded when you recognize that the main use of - rssh and scponly is to allow file transfers, which in turn allows a - malicious user to transfer and execute entire custom scripts on the - remote machine.

-
- - - - 11791 - 11792 - ports/74633 - http://marc.theaimsgroup.com/?l=bugtraq&m=110202047507273 - - - 2004-11-28 - 2004-12-02 - 2004-12-12 - - - - - rockdodger -- buffer overflows - - - rockdodger - 0.6_3 - - - - -

The environment variable HOME is copied without regard - to buffer size, which can be used to gain elevated privilege - if the binary is installed setgid games, and a string is - read from the high score file without bounds check.

-

The port installs the binary without setgid, but with a - world-writable high score file.

- - - - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=278878 - - - 2004-10-29 - 2004-12-02 - - - - - zip -- long path buffer overflow - - - zip - 2.3_2 - - - - -

A HexView security advisory reports:

-
-

When zip performs recursive folder compression, it does - not check for the length of resulting path. If the path is - too long, a buffer overflow occurs leading to stack - corruption and segmentation fault. It is possible to - exploit this vulnerability by embedding a shellcode in - directory or file name. While the issue is not of primary - concern for regular users, it can be critical for - environments where zip archives are re-compressed - automatically using Info-Zip application.

-
- - - - CVE-2004-1010 - 11603 - http://www.hexview.com/docs/20041103-1.txt - - - 2004-10-03 - 2004-12-01 - 2004-12-12 - - - - - sudoscript -- signal delivery vulnerability - - - sudoscript - 2.1.2 - - - - -

If non-root access is enabled in sudoscript, any member of - the ssers group can send a SIGHUP signal to any process.

- - - - http://egbok.com/sudoscript/archives/2004/11/sudoscript_212.html - - - 2004-11-14 - 2004-12-01 - - - - - jabberd -- remote buffer overflow vulnerability - - - jabberd - 2.*2.0.4 - - - - -

Caused by improper bounds-checking of username - and password in the C2S module, it is possible - for an attacker to cause a remote buffer overflow. - The server directly handles the userinput with - SQL backend functions - malicious input may lead - to buffer overflow.

- - - - http://marc.theaimsgroup.com/?l=bugtraq&m=110144303826709 - - - 2004-11-24 - 2004-11-30 - - - - - Open DC Hub -- remote buffer overflow vulnerability - - - opendchub - 0.7.14_2 - - - - -

Donato Ferrante reported an exploitable buffer overflow in - this software package. Any user that can login with 'admin' - privileges can abuse it, trough the $RedirectAll command, - to execute arbitrary code.

- - - - http://marc.theaimsgroup.com/?l=bugtraq&m=110144606411674 - http://www.gentoo.org/security/en/glsa/glsa-200411-37.xml - - - 2004-11-24 - 2004-11-27 - 2005-02-13 - - - - - unarj -- long filename buffer overflow - - - unarj - 2.43_2 - - - - -

Ludwig Nussel has discovered a buffer overflow - vulnerability in unarj's handling of long filenames which - could potentially lead to execution of arbitrary code with - the permissions of the user running unarj.

- - - - CVE-2004-0947 - 11665 - - - 2004-11-09 - 2004-11-26 - - - - - unarj -- directory traversal vulnerability - - - unarj - 2.43_2 - - - - -

unarj has insufficient checks for filenames that contain - ... This can allow an attacker to overwrite - arbitrary files with the permissions of the user running - unarj.

- - - - CVE-2004-1027 - 11436 - http://marc.theaimsgroup.com/?l=full-disclosure&m=109748984030292 - - - 2004-10-10 - 2004-11-26 - - - - - jdk/jre -- Security Vulnerability With Java Plugin - - - jdk - 1.4.01.4.2p6_6 - 1.3.01.3.1p9_5 - - - linux-jdk - linux-sun-jdk - 1.4.01.4.2.05 - 1.3.01.3.1.13 - - - linux-blackdown-jdk - 1.3.01.4.2 - - - linux-ibm-jdk - 1.3.01.4.2 - - - diablo-jdk - diablo-jre - 1.3.1.01.3.1.0_1 - - - - -

The Sun Java Plugin capability in Java 2 Runtime Environment - (JRE) 1.4.2_01, 1.4.2_04, and possibly earlier versions, does - not properly restrict access between Javascript and Java - applets during data transfer, which allows remote attackers to - load unsafe classes and execute arbitrary code.

- - - - http://sunsolve.sun.com/search/document.do?assetkey=1-26-57591-1&searchclause=%22category:security%22%20%22availability,%20security%22 - http://www.securityfocus.com/archive/1/382072 - CVE-2004-1029 - http://marc.theaimsgroup.com/?l=bugtraq&m=110125046627909 - - - 2004-11-24 - 2004-11-25 - 2005-04-27 - - - - - ProZilla -- server response buffer overflow vulnerabilities - - - prozilla - 1.3.6_3 - - - - -

Buffer overflow vulnerabilities have been reported to exist - in this software package. The vulnerabilities can be triggered by - a remote server and can be used to inject malicious code in the - ProZilla process.

- - - - CVE-2004-1120 - http://www.gentoo.org/security/en/glsa/glsa-200411-31.xml - http://bugs.gentoo.org/show_bug.cgi?id=70090 - http://marc.theaimsgroup.com/?l=bugtraq&m=110136626320497 - - - 2004-11-23 - 2004-11-25 - 2005-10-01 - - - - - Cyrus IMAPd -- APPEND command uses undefined programming construct - - - cyrus-imapd - 2.2.72.2.8 - - - - -

To support MULTIAPPENDS the cmd_append handler uses the - global stage array. This array is one of the things that gets - destructed when the fatal() function is triggered. When the - Cyrus IMAP code adds new entries to this array this is done - with the help of the postfix increment operator in combination - with memory allocation functions. The increment is performed - on a global variable counting the number of allocated - stages. Because the memory allocation function can fail and - therefore internally call fatal() this construct is undefined - arcording to ANSI C. This means that it is not clearly defined - if the numstage counter is already increased when fatal() is - called or not. While older gcc versions increase the counter - after the memory allocation function has returned, on newer - gcc versions (3.x) the counter gets actually increased - before. In such a case the stage destructing process will try - to free an uninitialised and maybe attacker supplied - pointer. Which again could lead to remote code - execution. (Because it is hard for an attacker to let the - memory allocation functions fail in the right moment no PoC - code for this problem was designed)

- - - - http://security.e-matters.de/advisories/152004.html - - - 2004-11-06 - 2004-11-22 - - - - - Cyrus IMAPd -- FETCH command out of bounds memory corruption - - - cyrus-imapd - 2.1.17 - 2.2.*2.2.8 - - - - -

The argument parser of the fetch command suffers a bug very - similiar to the partial command problem. Arguments like - "body[p", "binary[p" or "binary[p" will be wrongly detected - and the bufferposition can point outside of the allocated - buffer for the rest of the parsing process. When the parser - triggers the PARSE_PARTIAL macro after such a malformed - argument was received this can lead to a similiar one byte - memory corruption and allows remote code execution, when the - heap layout was successfully controlled by the attacker.

- - - - CVE-2004-1013 - http://security.e-matters.de/advisories/152004.html - - - 2004-11-06 - 2004-11-22 - 2004-11-24 - - - - - Cyrus IMAPd -- PARTIAL command out of bounds memory corruption - - - cyrus-imapd - 2.1.17 - 2.2.*2.2.6 - - - - -

Due to a bug within the argument parser of the partial - command an argument like "body[p" will be wrongly detected as - "body.peek". Because of this the bufferposition gets increased - by 10 instead of 5 and could therefore point outside the - allocated memory buffer for the rest of the parsing - process. In imapd versions prior to 2.2.7 the handling of - "body" or "bodypeek" arguments was broken so that the - terminating ']' got overwritten by a '\0'. Combined the two - problems allow a potential attacker to overwrite a single byte - of malloc() control structures, which leads to remote code - execution if the attacker successfully controls the heap - layout.

- - - - CVE-2004-1012 - http://security.e-matters.de/advisories/152004.html - - - 2004-11-06 - 2004-11-22 - 2004-11-24 - - - - - Cyrus IMAPd -- IMAPMAGICPLUS preauthentification overflow - - - cyrus-imapd - 2.2.42.2.8 - - - - -

When the option imapmagicplus is activated on a server the - PROXY and LOGIN commands suffer a standard stack overflow, - because the username is not checked against a maximum length - when it is copied into a temporary stack buffer. This bug is - especially dangerous because it can be triggered before any - kind of authentification took place.

- - - - CVE-2004-1011 - http://security.e-matters.de/advisories/152004.html - - - 2004-11-06 - 2004-11-22 - - - - - phpMyAdmin -- cross-site scripting vulnerabilities - - - phpMyAdmin - 2.6.0.2 - - - - -

Multiple cross-site scripting vulnerabilities, caused - by improper input parameter sanitizing, were - detected in phpMyAdmin, which may enable an attacker - to do cross-site scripting attacks.

- - - - http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-3 - - - 2004-11-18 - 2004-11-20 - - - - - Overflow error in fetch - - - FreeBSD - 5.35.3_1 - 5.2.15.2.1_12 - 5.15.1_18 - 5.05.0_22 - 4.104.10_4 - 4.94.9_13 - 4.84.8_26 - 4.7_28 - - - - -

An integer overflow condition in fetch(1) - in the processing of HTTP headers can result in a buffer - overflow.

-

A malicious server or CGI script can respond to an HTTP or - HTTPS request in such a manner as to cause arbitrary - portions of the client's memory to be overwritten, allowing - for arbitrary code execution.

- - - - SA-04:16.fetch - CVE-2004-1053 - 11702 - - - 2004-11-14 - 2004-11-18 - - - - - smbd -- buffer-overrun vulnerability - - - samba - 3.*3.0.8 - 3.*,13.0.8,1 - - - - -

Caused by improper bounds checking of certain trans2 - requests, there is a possible buffer overrun in smbd. - The attacker needs to be able to create files with - very specific Unicode filenames on the share to take - advantage of this issue.

- - - - CVE-2004-0882 - 11678 - http://marc.theaimsgroup.com/?l=bugtraq&m=110055646329581 - - - 2004-11-15 - 2004-11-17 - 2008-09-26 - - - - - twiki -- arbitrary shell command execution - - - twiki - 20040902 - - - - -

Hans Ulrich Niedermann reports:

-
-

The TWiki search function uses a user supplied search - string to compose a command line executed by the Perl - backtick (``) operator.

-

The search string is not checked properly for shell - metacharacters and is thus vulnerable to search string - containing quotes and shell commands.

-

IMPACT: An attacker is able to execute arbitrary shell - commands with the privileges of the TWiki process.

-
- - - - CVE-2004-1037 - http://marc.theaimsgroup.com/?l=bugtraq&m=110037207516456 - http://twiki.org/cgi-bin/view/Codev/SecurityAlertExecuteCommandsWithSearch - - - 2004-11-12 - 2004-11-15 - 2004-11-23 - - - - - proxytunnel -- format string vulnerability - - - proxytunnel - 1.2.3 - - - - -

A Gentoo Linux Security Advisory reports:

-
-

Florian Schilhabel of the Gentoo Linux Security Audit - project found a format string vulnerability in - Proxytunnel. When the program is started in daemon mode - (-a [port]), it improperly logs invalid proxy answers to - syslog.

-

A malicious remote server could send specially-crafted - invalid answers to exploit the format string - vulnerability, potentially allowing the execution of - arbitrary code on the tunnelling host with the rights of - the Proxytunnel process.

-
- - - - CVE-2004-0992 - http://proxytunnel.sourceforge.net/news.html - http://www.gentoo.org/security/en/glsa/glsa-200411-07.xml - - - 2004-11-01 - 2004-11-15 - - - - - sudo -- privilege escalation with bash scripts - - - sudo - 1.6.8.2 - - - - -

A Sudo Security Alerts reports:

-
-

A flaw in exists in sudo's environment sanitizing prior - to sudo version 1.6.8p2 that could allow a malicious user - with permission to run a shell script that utilized the - bash shell to run arbitrary commands.

-
- - - - http://www.courtesan.com/sudo/alerts/bash_functions.html - - - 2004-11-11 - 2004-11-13 - - - - - ruby -- CGI DoS - - - ruby - ruby_r - 1.7.*1.8.2.p2_2 - 1.6.8.2004.07.28_1 - - - ruby-1.7.0 - a2001.05.12a2001.05.26 - - - - -

The Ruby CGI.rb module contains a bug which can cause the - CGI module to go into an infinite loop, thereby causing a - denial-of-service situation on the web server by using all - available CPU time.

- - - - CVE-2004-0983 - http://www.debian.org/security/2004/dsa-586 - - - 2004-11-06 - 2004-11-13 - 2004-11-25 - - - - - samba -- potential remote DoS vulnerability - - - samba - 3.*3.0.8 - 3.*,13.0.8,1 - - - - -

Karol Wiesek at iDEFENSE reports:

-
-

A remote attacker could cause an smbd process to consume - abnormal amounts of system resources due to an input - validation error when matching filenames containing - wildcard characters.

-
-

Although samba.org classifies this as a DoS vulnerability, - several members of the security community believe it may be - exploitable for arbitrary code execution.

- - - - ports/73701 - CVE-2004-0930 - http://us4.samba.org/samba/security/CAN-2004-0930.html - - - 2004-09-30 - 2004-11-12 - 2008-09-26 - - - - - gnats -- format string vulnerability - - - gnats - 4.*4.0_2 - 3.113.1_9 - - - - -

Gnats suffers from a format string bug, which may enable an - attacker to execute arbitary code.

- - - - CVE-2004-0623 - http://marc.theaimsgroup.com/?l=bugtraq&m=108820000823191 - - - 2004-06-21 - 2004-11-12 - - - - - squirrelmail -- cross site scripting vulnerability - - - ja-squirrelmail - 1.4.3a_4,2 - - - squirrelmail - 1.4.3a_3 - - - - -

A SquirrelMail Security Notice reports:

-
-

There is a cross site scripting issue in the decoding of - encoded text in certain headers. SquirrelMail correctly - decodes the specially crafted header, but doesn't sanitize - the decoded strings.

-
- - - - http://marc.theaimsgroup.com/?l=bugtraq&m=110012133608004 - - - 2004-11-03 - 2004-11-12 - - - - - - - - - hafiye -- lack of terminal escape sequence filtering - - - hafiye - 1.0_1 - - - - -

A siyahsapka.org advisory reads:

-
-

Hafiye-1.0 doesnt filter the payload when printing it to - the terminal. A malicious attacker can send packets with - escape sequence payloads to exploit this vulnerability.

-

If Hafiye has been started with -n packet count option , - the vulnerability could allow remote code execution. For - remote code execution the victim must press Enter after - program exit.

-
-

Note that it appears that this bug can only be exploited in - conjunction with a terminal emulator that honors the - appropriate escape sequences.

- - - - ports/70978 - http://deicide.siyahsapka.org/hafiye_esc.txt - http://www.enderunix.org/hafiye/ - - - 2004-08-23 - 2004-11-11 - - - - - ez-ipupdate -- format string vulnerability - - - ez-ipupdate - 3.0.11b8_2 - - - - -

Data supplied by a remote server is used as the format string - instead of as parameters in a syslog() call. This may lead - to crashes or potential running of arbitrary code. It is - only a problem when running in daemon mode (very common) and - when using some service types.

- - - - CVE-2004-0980 - http://lists.netsys.com/pipermail/full-disclosure/2004-November/028590.html - - - 2004-11-11 - 2004-11-11 - - - - - ImageMagick -- EXIF parser buffer overflow - - - ImageMagick - ImageMagick-nox11 - 6.1.3 - - - - -

There exists a buffer overflow vulnerability in - ImageMagick's EXIF parsing code which may lead to execution - of arbitrary code.

- - - - 11548 - CVE-2004-0981 - http://secunia.com/advisories/12995/ - http://www.imagemagick.org/www/Changelog.html - - - 2004-10-25 - 2004-11-11 - 2004-12-12 - - - - - apache2 multiple space header denial-of-service vulnerability - - - apache - 2.*2.0.52_2 - - - - -

It is possible for remote attackers to cause a denial-of-service - scenario on Apache 2.0.52 and earlier by sending an HTTP GET - request with a MIME header containing multiple lines full of - whitespaces.

- - - - CVE-2004-0942 - http://marc.theaimsgroup.com/?l=full-disclosure&m=109930632317208 - - - 2004-11-01 - 2004-11-10 - 2004-11-11 - - - - - socat -- format string vulnerability - - - socat - 1.4.0.3 - - - - -

Socat Security Advisory 1 states:

-
-

socat up to version 1.4.0.2 contains a syslog() based - format string vulnerability. This issue was originally - reported by CoKi on 19 Oct.2004 http://www.nosystem.com.ar/advisories/advisory-07.txt. - Further investigation showed that this vulnerability could - under some circumstances lead to local or remote execution - of arbitrary code with the privileges of the socat - process.

-
- - - - http://www.dest-unreach.org/socat/advisory/socat-adv-1.html - http://www.nosystem.com.ar/advisories/advisory-07.txt - - - 2004-10-18 - 2004-11-10 - - - - - libxml -- remote buffer overflows - - - libxml - 1.8.17_3 - - - libxml2 - 2.6.15 - - - - -

infamous41md reports that libxml contains multiple - buffer overflows in the URL parsing and DNS name resolving - functions. These vulnerabilities could lead to execution of - arbitrary code.

- - - - CVE-2004-0989 - 11526 - http://marc.theaimsgroup.com/?l=bugtraq&m=109880813013482 - http://www.debian.org/security/2004/dsa-582 - - - 2004-10-26 - 2004-11-09 - 2004-11-10 - - - - - p5-Archive-Zip -- virus detection evasion - - - p5-Archive-Zip - 1.14 - - - - -

An AMaViS Security Announcement reports that a - vulnerability exist in the Archive::Zip Perl module which - may lead to bypass of malicious code in anti-virus programs - by creating specially crafted ZIP files.

- - - - http://www.idefense.com/application/poi/display?id=153&type=vulnerabilities - http://www.amavis.org/security/asa-2004-6.txt - http://rt.cpan.org/NoAuth/Bug.html?id=8077 - - - 2004-10-18 - 2004-11-08 - - - - - apache mod_include buffer overflow vulnerability - - - apache - 1.3.33 - - - apache+mod_ssl - 1.3.32+2.8.21_1 - - - apache+mod_ssl+ipv6 - 1.3.32+2.8.21_1 - - - apache+mod_perl - 1.3.31 - - - apache+ipv6 - 1.3.33 - - - apache+ssl - 1.3.29.1.55 - - - ru-apache - 1.3.33+30.21 - - - ru-apache+mod_ssl - 1.3.33+30.21+2.8.22 - - - - -

There is a buffer overflow in a function used by mod_include - that may enable a local user to gain privileges of a httpd - child. Only users that are able to create SSI documents can - take advantage of that vulnerability.

- - - - CVE-2004-0940 - http://www.securitylab.ru/48807.html - - - 2004-10-22 - 2004-11-06 - - - - - postgresql-contrib -- insecure temporary file creation - - - postgresql-contrib - 7.2.6 - 7.3.*7.3.8 - 7.4.*7.4.6 - - - - -

The make_oidjoins_check script in the PostgreSQL RDBMS has - insecure handling of temporary files, which could lead to an - attacker overwriting arbitrary files with the credentials of - the user running the make_oidjoins_check script.

- - - - CVE-2004-0977 - 11295 - http://www.postgresql.org/news/234.html - http://www.trustix.net/errata/2004/0050/ - - - 2004-09-10 - 2004-11-06 - - - - - gd -- integer overflow - - - gd - uk-gd - ja-gd - 2.0.29,1 - 1.*,22.*,2 - - - - -

infamous41md reports about the GD Graphics Library:

-
-

There is an integer overflow when allocating memory in - the routine that handles loading PNG image files. This - later leads to heap data structures being overwritten. If - an attacker tricked a user into loading a malicious PNG - image, they could leverage this into executing arbitrary - code in the context of the user opening image.

-
- - - - 11523 - CVE-2004-0990 - http://marc.theaimsgroup.com/?l=bugtraq&m=109882489302099 - http://www.boutell.com/gd/manual2.0.29.html#whatsnew2.0.29 - - - 2004-10-26 - 2004-11-05 - - - - - putty -- buffer overflow vulnerability in ssh2 support - - - putty - 0.56 - - - - -

There is a bug in SSH2 support that allows a server to execute - malicious code on a connecting PuTTY client. - This attack can be performed before host key verification happens, - so a different machine -- man in the middle attack -- could fake - the machine you are connecting to.

- - - - http://marc.theaimsgroup.com/?l=bugtraq&m=109890310929207 - http://www.gentoo.org/security/en/glsa/glsa-200410-29.xml - http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-ssh2-debug.html - - - 2004-10-26 - 2004-11-04 - 2005-01-19 - - - - - wzdftpd -- remote DoS - - - wzdftpd - 0.4.3 - - - - -

wzdftpd contains a potential remote Denial-of-Service.

- - - - http://sourceforge.net/project/shownotes.php?release_id=263573 - - - 2004-10-28 - 2004-11-03 - - - - - rssh -- format string vulnerability - - - rssh - 2.2.1 - - - - -

There is a format string bug in rssh that enables an attacker - to execute arbitrary code from an account configured to use - rssh. On FreeBSD it is only possible to compromise the rssh - running account, not root.

- - - - http://www.pizzashack.org/rssh/security.shtml - http://marc.theaimsgroup.com/?l=bugtraq&m=109855982425122 - - - 2004-10-23 - 2004-10-25 - - - - - horde -- cross-site scripting vulnerability in help window - - - horde - horde-devel - 2.2.7 - - - - -

A Horde Team announcement states that a potential cross-site - scripting vulnerability in the help window has been - corrected. The vulnerability appears to involve the handling - of the topic and module parameters - of the help window template.

- - - - http://marc.theaimsgroup.com/?l=horde-announce&m=109879164718625 - - - 2004-10-06 - 2004-10-27 - - - - - bogofilter -- RFC 2047 decoder denial-of-service vulnerability - - - bogofilter - bogofilter-qdbm - bogofilter-tdb - ru-bogofilter - 0.17.40.92.8 - - - - -

The bogofilter team has been provided with a test case of a - malformatted (non-conformant) RFC-2047 encoded word that can cause - bogofilter versions 0.92.7 and prior to try to write a NUL byte into - a memory location that is either one byte past the end of a flex - buffer or to a location that is the negative of the encoded word's - start of payload data, causing a segmentation fault.

- - - - ports/73144 - CVE-2004-1007 - http://article.gmane.org/gmane.mail.bogofilter.devel/3308 - http://article.gmane.org/gmane.mail.bogofilter.devel/3317 - http://bugs.debian.org/275373 - http://bogofilter.sourceforge.net/security/bogofilter-SA-2004-01 - - - 2004-10-09 - 2004-10-26 - 2015-09-28 - - - - - xpdf -- integer overflow vulnerabilities - - - gpdf - cups-base - 1.1.22.0 - - - xpdf - 3.00_4 - - - kdegraphics - 3.3.0_1 - - - koffice - 1.3.2_1,1 - - - teTeX-base - 2.0.2_4 - - - - -

Chris Evans discovered several integer arithmetic overflows - in the xpdf 2 and xpdf 3 code bases. The flaws have impacts - ranging from denial-of-service to arbitrary code execution.

- - - - CVE-2004-0888 - CVE-2004-0889 - http://scary.beasts.org/security/CESA-2004-002.txt - http://scary.beasts.org/security/CESA-2004-007.txt - http://www.kde.org/info/security/advisory-20041021-1.txt - - - 2004-10-21 - 2004-10-25 - - - - - gaim -- MSN denial-of-service vulnerabilities - - - gaim - ja-gaim - ko-gaim - ru-gaim - 1.0.2 - - - gaim - 20030000 - - - - -

The Gaim team discovered denial-of-service vulnerabilities in - the MSN protocol handler:

-
-

After accepting a file transfer request, Gaim will attempt - to allocate a buffer of a size equal to the entire filesize, - this allocation attempt will cause Gaim to crash if the size - exceeds the amount of available memory.

-
-
-

Gaim allocates a buffer for the payload of each message - received based on the size field in the header of the - message. A malicious peer could specify an invalid size that - exceeds the amount of available memory.

-
- - - - http://gaim.sourceforge.net/security/?id=7 - http://gaim.sourceforge.net/security/?id=8 - - - 2004-10-19 - 2004-10-25 - - - - - gaim -- Content-Length header denial-of-service vulnerability - - - gaim - ja-gaim - ko-gaim - ru-gaim - 0.82 - - - gaim - 20030000 - - - - -

Sean infamous42md reports:

-
-

When a remote server provides a large "content-length" - header value, Gaim will attempt to allocate a buffer to - store the content, however this allocation attempt will - cause Gaim to crash if the length exceeds the amount of - possible memory. This happens when reading profile - information on some protocols. It also happens when smiley - themes are installed via drag and drop.

-
- - - - http://gaim.sourceforge.net/security/?id=6 - - - 2004-08-26 - 2004-10-25 - - - - - gaim -- multiple buffer overflows - - - gaim - ja-gaim - ko-gaim - ru-gaim - 0.82 - - - gaim - 20030000 - - - - -

Sean infamous42md reports several situations in gaim - that may result in exploitable buffer overflows:

-
    -
  • Rich Text Format (RTF) messages in Novell GroupWise - protocol
    • -
  • Unsafe use of gethostbyname in zephyr protocol
    • -
  • URLs which are over 2048 bytes long once decoded
    • -
- - - - CVE-2004-0785 - http://gaim.sourceforge.net/security/?id=3 - http://gaim.sourceforge.net/security/?id=4 - http://gaim.sourceforge.net/security/?id=5 - - - 2004-08-26 - 2004-10-25 - - - - - gaim -- heap overflow exploitable by malicious GroupWise server - - - gaim - ja-gaim - ko-gaim - ru-gaim - 0.82 - - - gaim - 20030000 - - - - -

Sean infamous42md reports that a malicious GroupWise - messaging server may be able to exploit a heap buffer - overflow in gaim, leading to arbitrary code execution.

- - - - CVE-2004-0754 - http://gaim.sourceforge.net/security/?id=2 - - - 2004-08-26 - 2004-10-25 - - - - - gaim -- malicious smiley themes - - - gaim - ja-gaim - ko-gaim - ru-gaim - 0.82 - - - gaim - 20030000 - - - - -

The Gaim Security Issues page documents a problem with - installing smiley themes from an untrusted source:

-
-

To install a new smiley theme, a user can drag a tarball - from a graphical file manager, or a hypertext link to one - from a web browser. When a tarball is dragged, Gaim executes - a shell command to untar it. However, it does not escape the - filename before sending it to the shell. Thus, a specially - crafted filename could execute arbitrary commands if the - user could be convinced to drag a file into the smiley theme - selector.

-
- - - - CVE-2004-0784 - http://gaim.sourceforge.net/security/?id=1 - - - 2004-08-22 - 2004-10-25 - - - - - gaim -- buffer overflow in MSN protocol support - - - gaim - ja-gaim - ru-gaim - 0.791.0.1 - - - gaim - 20030000 - - - - -

Due to a buffer overflow in the MSN protocol support for - gaim 0.79 to 1.0.1, it is possible for remote clients to do a - denial-of-service attack on the application. - This is caused by an unbounded copy operation, which writes - to the wrong buffer.

- - - - CVE-2004-0891 - http://gaim.sourceforge.net/security/?id=9 - - - 2004-10-19 - 2004-10-25 - - - - - mod_ssl -- SSLCipherSuite bypass - - - ru-apache+mod_ssl - 1.3.31+30.20+2.8.18 - - - apache+mod_ssl - 1.3.31+2.8.20 - - - apache+mod_ssl+ipv6 - 1.3.31+2.8.18_4 - - - apache2 - 2.0.52_1 - - - - -

It is possible for clients to use any cipher suite configured by - the virtual host, whether or not a certain cipher suite is selected - for a specific directory. This might result in clients using a - weaker encryption than originally configured.

- - - - CVE-2004-0885 - http://marc.theaimsgroup.com/?l=apache-modssl&m=109724918128044 - http://issues.apache.org/bugzilla/show_bug.cgi?id=31505 - - - 2004-10-01 - 2004-10-23 - - - - - mpg123 -- buffer overflow in URL handling - - - mpg123 - mpg123-nas - mpg123-esound - 0.59r_15 - - - - -

Carlos Barros reports that mpg123 contains two buffer - overflows. These vulnerabilities can potentially lead to - execution of arbitrary code.

-

The first buffer overflow can occur when mpg123 parses a - URL with a user-name/password field that is more than 256 - characters long. This problem can be triggered either - locally or remotely via a specially crafted play list. The - second potential buffer overflow may be triggered locally by - a specially crafted symlink to the mpg123 binary. This - problem is not as serious, since mpg123 is not installed - setuid by default.

- - - - 11468 - CVE-2004-0982 - http://marc.theaimsgroup.com/?l=bugtraq&m=109834486312407 - - - 2004-10-02 - 2004-10-23 - 2004-12-30 - - - - - apache2 -- SSL remote DoS - - - apache - 2.02.0.51 - - - - -

The Apache HTTP Server 2.0.51 release notes report that the - following issues have been fixed:

-
-

A segfault in mod_ssl which can be triggered by a - malicious remote server, if proxying to SSL servers has - been configured. [CAN-2004-0751]

-

A potential infinite loop in mod_ssl which could be - triggered given particular timing of a connection - abort. [CAN-2004-0748]

-
- - - - 11094 - 11154 - CVE-2004-0748 - CVE-2004-0751 - http://marc.theaimsgroup.com/?l=apache-httpd-announce&m=109527608022322 - http://nagoya.apache.org/bugzilla/show_bug.cgi?id=29964 - http://nagoya.apache.org/bugzilla/show_bug.cgi?id=30134 - - - 2004-07-07 - 2004-10-21 - - - - - phpmyadmin -- remote command execution vulnerability - - - phpMyAdmin - phpmyadmin - 2.6.0.2 - - - - -

From the phpMyAdmin 2.6.0p2 release notes:

-
-

If PHP is not running in safe mode, a problem in the - MIME-based transformation system (with an "external" - transformation) allows to execute any command with the - privileges of the web server's user.

-
- - - - 11391 - http://sourceforge.net/project/shownotes.php?release_id=274709 - http://sourceforge.net/tracker/index.php?func=detail&aid=1044864&group_id=23067&atid=377408 - - - 2004-10-11 - 2004-10-20 - - - - - cabextract -- insecure directory handling - - - cabextract - 1.1 - - - - -

cabextract has insufficient checks for file names that - contain ../. This can cause files to be extracted to - the parent directory.

- - - - CVE-2004-0916 - http://www.kyz.uklinux.net/cabextract.php#changes - - - 2004-10-18 - 2004-10-20 - 2004-10-22 - - - - - a2ps -- insecure command line argument handling - - - a2ps-a4 - 4.13b_2 - - - a2ps-letter - 4.13b_2 - - - a2ps-letterdj - 4.13b_2 - - - - -

Rudolf Polzer reports:

-
-

a2ps builds a command line for file() containing an - unescaped version of the file name, thus might call - external programs described by the file name. Running a - cronjob over a public writable directory a2ps-ing all - files in it - or simply typing "a2ps *.txt" in /tmp - is - therefore dangerous.

-
- - - - CVE-2004-1170 - ports/70618 - 11025 - http://www.osvdb.org/9176 - http://marc.theaimsgroup.com/?l=full-disclosure&m=109334851517137 - - - 2004-08-18 - 2004-10-20 - 2004-12-30 - - - - - ifmail -- unsafe set-user-ID application - - - ifmail - 2.15_4 - - - - -

Niels Heinen reports that ifmail allows one to specify - a configuration file. Since ifmail runs set-user-ID `news', - this may allow a local attacker to write to arbitrary files - or execute arbitrary commands as the `news' user.

- - - - https://svnweb.freebsd.org/changeset/ports/120295 - - - 2004-08-23 - 2004-10-19 - 2015-05-01 - - - - - imwheel -- insecure handling of PID file - - - imwheel - 1.0.0.p12 - - - - -

A Computer Academic Underground advisory describes the - consequences of imwheel's handling of the process ID file (PID - file):

-
-

imwheel exclusively uses a predictably named PID file for - management of multiple imwheel processes. A race condition - exists when the -k command-line option is used to kill - existing imwheel processes. This race condition may be - used by a local user to Denial of Service another user - using imwheel, lead to resource exhaustion of the host - system, or append data to arbitrary files.

-
- - - - http://www.caughq.org/advisories/CAU-2004-0002.txt - http://imwheel.sourceforge.net/files/DEVELOPMENT.txt - - - 2004-08-20 - 2004-10-19 - - - - - squid -- NTLM authentication denial-of-service vulnerability - - - squid - 2.5.7 - - - - -

A remote attacker is able to cause a denial-of-service - situation, when NTLM authentication is enabled in squid. - NTLM authentication uses two functions which lack correct - offset checking.

- - - - CVE-2004-0832 - http://www.squid-cache.org/bugs/show_bug.cgi?id=1045 - - - 2004-08-18 - 2004-10-18 - - - - - cacti -- SQL injection - - - cacti - 0.8.6 - - - - -

Fernando Quintero reports that Cacti 0.8.5a suffers from a - SQL injection attack where an attacker can change the - password for any Cacti user. This attack is not possible if - the PHP option magic_quotes_gpc is set to On, which is the - default for PHP in FreeBSD.

- - - - http://marc.theaimsgroup.com/?l=full-disclosure&m=109269427427368 - - - 2004-08-16 - 2004-10-17 - - - - - apache13-modssl -- format string vulnerability in proxy support - - - apache+mod_ssl - 1.3.31+2.8.19 - - - apache+mod_ssl+ipv6 - 1.3.31+2.8.19 - - - ru-apache+mod_ssl - 1.3.31+30.20+2.8.19 - - - - -

A OpenPKG Security Advisory reports:

-
-

Triggered by a report to Packet Storm from Virulent, a - format string vulnerability was found in mod_ssl, the - Apache SSL/TLS interface to OpenSSL, version (up to and - including) 2.8.18 for Apache 1.3. The mod_ssl in Apache - 2.x is not affected. The vulnerability could be - exploitable if Apache is used as a proxy for HTTPS URLs - and the attacker established a own specially prepared DNS - and origin server environment.

-
- - - - 10736 - 303448 - CVE-2004-0700 - http://www.openpkg.org/security/OpenPKG-SA-2004.032-apache.html - http://packetstormsecurity.org/0407-advisories/modsslFormat.txt - http://marc.theaimsgroup.com/?l=apache-modssl&m=109001100906749 - - - 2004-07-16 - 2004-10-17 - - - - - tor -- remote DoS and loss of anonymity - - - tor - 0.0.8.1 - - - - -

Tor has various remote crashes which could lead to a remote - denial-of-service and be used to defeat clients anonymity. - It is not expected that these vulnerabilities are - exploitable for arbitrary code execution.

- - - - http://archives.seul.org/or/announce/Aug-2004/msg00001.html - http://archives.seul.org/or/announce/Oct-2004/msg00000.html - - - 2004-08-25 - 2004-10-15 - - - - - icecast -- Cross-Site Scripting Vulnerability - - - icecast - 1.3.12_2 - - - - -

Caused by improper filtering of HTML code in the - status display, it is possible for a remote user - to execute scripting code in the target user's - browser.

- - - - CVE-2004-0781 - http://www.securitytracker.com/alerts/2004/Aug/1011047.html - - - 2004-08-24 - 2004-10-13 - - - - - icecast -- HTTP header overflow - - - icecast2 - 2.0.2,1 - - - - -

It is possible to execute remote code simply using - HTTP request plus 31 headers followed by a shellcode that will be - executed directly.

- - - - http://marc.theaimsgroup.com/?l=full-disclosure&m=109646043512722 - - - 2004-09-29 - 2004-10-13 - - - - - freeradius -- denial-of-service vulnerability - - - freeradius - 0.8.01.0.1 - - - - -

A remote attacker may be able to crash the freeRADIUS Server - due to three independant bugs in the function which does - improper checking values while processing RADIUS - attributes.

- - - - CVE-2004-0938 - CVE-2004-0960 - CVE-2004-0961 - http://www.securitytracker.com/alerts/2004/Sep/1011364.html - 541574 - 11222 - - - 2004-09-20 - 2004-10-13 - 2004-10-19 - - - - - xerces-c2 -- Attribute blowup denial-of-service - - - xerces-c2 - 2.6.0 - - - - -

Amit Klein reports about Xerces-C++:

-
-

An attacker can craft a malicious XML document, which - uses XML attributes in a way that inflicts a denial of - service condition on the target machine (XML parser). The - result of this attack is that the XML parser consumes all - the CPU.

-
- - - - 11312 - http://marc.theaimsgroup.com/?l=bugtraq&m=109674050017645 - - - 2004-10-02 - 2004-10-13 - 2004-10-14 - - - - - wordpress -- XSS in administration panel - - - wordpress - 1.2.1 - - - - -

Pages in the administration panel of Wordpress are - vulnerable for XSS attacks.

- - - - http://wordpress.org/development/2004/10/wp-121/ - http://marc.theaimsgroup.com/?l=bugtraq&m=109641484723194 - - - 2004-09-27 - 2004-10-13 - - - - - tiff -- multiple integer overflows - - - tiff - 3.6.1_2 - - - linux-tiff - 3.6.1 - - - pdflib - pdflib-perl - 6.0.1 - - - gdal - 1.2.1_2 - - - ivtools - 1.2.3 - - - paraview - 2.4.3 - - - fractorama - 1.6.7_1 - - - iv - ja-iv - ja-libimg - 0 - - - - -

Dmitry V. Levin discovered numerous integer overflow bugs in - libtiff. Most of these bugs are related to memory management, - and are believed to be exploitable for arbitrary code - execution.

- - - - 687568 - CVE-2004-0886 - http://www.idefense.com/application/poi/display?id=173&type=vulnerabilities - - - 2004-10-13 - 2004-10-13 - 2006-06-08 - - - - - CUPS -- local information disclosure - - - cups-base - 1.1.22 - - - - -

Certain methods of authenticated remote printing in CUPS - can disclose user names and passwords in the log files.

-

A workaround for this problem is to set more strict - access permissions on the CUPS logfiles.

- - - - http://docs.info.apple.com/article.html?artnum=61798 - http://secunia.com/advisories/12690/ - http://www.cups.org/str.php?L920 - CVE-2004-0923 - 557062 - - - 2004-09-23 - 2004-10-13 - - - - - zinf -- potential buffer overflow playlist support - - - zinf - 2.2.5 - - - freeamp - 0 - - - - -

The audio player Zinf is vulnerable to a buffer-overflow - bug in the management of the playlist files.

- - - - http://marc.theaimsgroup.com/?l=bugtraq&m=109608092609200 - - - 2004-09-24 - 2004-10-12 - - - - - tiff -- RLE decoder heap overflows - - - tiff - 3.6.1_1 - - - linux-tiff - 3.6.1 - - - pdflib - pdflib-perl - 6.0.1 - - - gdal - 1.2.1_2 - - - ivtools - 1.2.3 - - - paraview - 2.4.3 - - - fractorama - 1.6.7_1 - - - iv - ja-iv - ja-libimg - 0 - - - - -

Chris Evans discovered several heap buffer overflows in - libtiff's RLE decoder. These overflows could be triggered - by a specially-crafted TIFF image file, resulting in an - application crash and possibly arbitrary code execution.

- - - - 948752 - CVE-2004-0803 - http://scary.beasts.org/security/CESA-2004-006.txt - - - 2004-10-13 - 2004-10-13 - 2006-06-08 - - - - - sharutils -- buffer overflows - - - sharutils - 4.2.1_2 - - - - -

From Gentoo advisory GLSA 200410-01:

-
-

sharutils contains two buffer overflows. Ulf Harnhammar - discovered a buffer overflow in shar.c, where the length - of data returned by the wc command is not checked. - Florian Schilhabel discovered another buffer overflow in - unshar.c.

-

An attacker could exploit these vulnerabilities to - execute arbitrary code as the user running one of the - sharutils programs.

-
- - - - 11298 - http://www.gentoo.org/security/en/glsa/glsa-200410-01.xml - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=265904 - - - 2004-08-15 - 2004-10-13 - - - - - mail-notification -- denial-of-service vulnerability - - - mail-notification - 0.7.0 - - - - -

Caused by an untested return value, and a resulting - null pointer dereference, it is possible for an attacker - to crash the application. However, the attacker must first - hijack the connection between Mail Notification and the - Gmail or IMAP server.

- - - - http://www.nongnu.org/mailnotify/sa/mail-notification-SA-04:2.asc - http://www.nongnu.org/mailnotify/sa/mail-notification-SA-04:3.asc - - - 2004-10-06 - 2004-10-12 - - - - - squid -- SNMP module denial-of-service vulnerability - - - squid - 2.5.7 - 3.0.03.0.7 - - - - -

The Squid-2.5 patches page notes:

-
-

If a certain malformed SNMP request is received squid - restarts with a Segmentation Fault error.

-
-

This only affects squid installations where SNMP is - explicitly enabled via "make config". As a workaround, - SNMP can be disabled by defining "snmp_port 0" in - squid.conf.

-

Squid security advisory SQUID-2008:1 explains that Squid-3 versions - up to and including Squid-3.0.STABLE6 are affected by this error, - too.

- - - - CVE-2004-0918 - http://www.idefense.com/application/poi/display?id=152&type=vulnerabilities - http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE6-SNMP_core_dump - http://www.squid-cache.org/Advisories/SQUID-2004_3.txt - http://www.squid-cache.org/Advisories/SQUID-2008_1.txt - - - 2004-09-29 - 2004-10-12 - 2008-06-28 - - - - - cyrus-sasl -- potential buffer overflow in DIGEST-MD5 plugin - - - cyrus-sasl - 2.*2.1.19 - - - - -

The Cyrus SASL DIGEST-MD5 plugin contains a potential - buffer overflow when quoting is required in the output.

- - - - https://bugzilla.andrew.cmu.edu/cgi-bin/cvsweb.cgi/src/sasl/plugins/digestmd5.c#rev1.171 - - - 2004-07-06 - 2004-10-12 - - - - - cyrus-sasl -- dynamic library loading and set-user-ID applications - - - cyrus-sasl - 1.5.28_3 - 2.*2.1.19 - - - - -

The Cyrus SASL library, libsasl, contains functions which - may load dynamic libraries. These libraries may be loaded - from the path specified by the environmental variable - SASL_PATH, which in some situations may be fully controlled - by a local attacker. Thus, if a set-user-ID application - (such as chsh) utilizes libsasl, it may be possible for a - local attacker to gain superuser privileges.

- - - - CVE-2004-0884 - https://bugzilla.andrew.cmu.edu/cgi-bin/cvsweb.cgi/src/sasl/lib/common.c#rev1.104 - - - 2004-09-22 - 2004-10-08 - - - - - imp3 -- XSS hole in the HTML viewer - - - imp - 3.2.6 - - - - -

The script vulnerabilities can only be exposed with - certain browsers and allow XSS attacks when viewing - HTML messages with the HTML MIME viewer

- - - - http://thread.gmane.org/gmane.comp.horde.imp/15488 - http://cvs.horde.org/diff.php/imp/docs/CHANGES?r1=1.389.2.109&r2=1.389.2.111&ty=h - - - 2004-08-20 - 2004-10-05 - - - - - bmon -- unsafe set-user-ID application - - - bmon - 1.2.1_2 - - - - -

Jon Nistor reported that the FreeBSD port of bmon was - installed set-user-ID root, and executes commands using - relative paths. This could allow local user to easily obtain - root privileges.

- - - - ports/67340 - - - 2004-05-29 - 2004-10-05 - - - - - gnutls -- certificate chain verification DoS - - - gnutls - 1.0.17 - - - gnutls-devel - 1.1.*1.1.12 - - - - -

Patric Hornik reports on a problem in the certificate chain - verification procedures of GnuTLS that may result in a - denial-of-service vulnerability:

-
-

The certificate chain should be verified from last root - certificate to the first certificate. Otherwise a lot - of unauthorized CPU processing can be forced to check - certificate signatures signed with arbitrary RSA/DSA keys - chosen by attacker.

-

In GnuTLS the signatures are checked from first to last - certificate, there is no limit on size of keys and no - limit on length of certificate chain.

-
- - - - http://www.hornik.sk/SA/SA-20040802.txt - http://secunia.com/advisories/12156 - - - 2004-08-02 - 2004-10-05 - - - - - php -- vulnerability in RFC 1867 file upload processing - - - php4 - php4-cgi - 4.3.8_2 - - - mod_php4 - 4.3.8_2,1 - - - php5 - php5-cgi - 5.0.1 - - - mod_php5 - 5.0.1,1 - - - - -

Stefano Di Paola discovered an issue with PHP that - could allow someone to upload a file to any directory - writeable by the httpd process. Any sanitizing performed on - the prepended directory path is ignored. This bug can only - be triggered if the $_FILES element name contains an - underscore.

- - - - http://marc.theaimsgroup.com/?l=bugtraq&m=109534848430404 - http://marc.theaimsgroup.com/?l=bugtraq&m=109648426331965 - - - 2004-09-15 - 2004-09-15 - 2004-10-12 - - - - - php -- php_variables memory disclosure - - - mod_php4-twig - php4-cgi - php4-cli - php4-dtc - php4-horde - php4-nms - php4 - 4.3.8_2 - - - mod_php - mod_php4 - 44.3.8_2,1 - - - php5 - php5-cgi - php5-cli - 5.0.1 - - - mod_php5 - 5.0.1,1 - - - - -

Stefano Di Paola reports:

-
-

Bad array parsing in php_variables.c could lead to show - arbitrary memory content such as pieces of php code - and other data. This affects all GET, POST or COOKIES - variables.

-
- - - - http://marc.theaimsgroup.com/?l=bugtraq&m=109527531130492 - - - 2004-09-15 - 2004-10-05 - - - - - xv -- exploitable buffer overflows - - - xv - xv-m17n - 3.10a_4 - - - - -

In a Bugtraq posting, infamous41md(at)hotpop.com reported:

-
-

there are at least 5 exploitable buffer and heap - overflows in the image handling code. this allows someone - to craft a malicious image, trick a user into viewing the - file in xv, and upon viewing that image execute arbitrary - code under privileges of the user viewing image. note - the AT LEAST part of the above sentence. there is such a - plethora of bad code that I just stopped reading after - a while. there are at least 100 calls to sprintf() and - strcpy() with no regards for bounds of buffers. 95% of - these deal with program arguments or filenames, so they - are of no interest to exploit. however I just got sick of - reading this code after not too long. so im sure there are - still other overflows in the image handling code for other - image types.

-
-

The posting also included an exploit.

- - - - http://marc.theaimsgroup.com/?l=bugtraq&m=109302498125092 - - - 2004-08-20 - 2004-10-05 - 2004-10-12 - - - - - getmail -- symlink vulnerability during maildir delivery - - - getmail - 3.2.5 - - - - -

David Watson reports a symlink vulnerability in getmail. - If run as root (not the recommended mode of operation), a - local user may be able to cause getmail to write files in - arbitrary directories via a symlink attack on subdirectories - of the maildir.

- - - - http://marc.theaimsgroup.com/?l=bugtraq&m=109571883130372 - CVE-2004-0881 - 11224 - - - 2004-09-19 - 2004-10-04 - - - - - Boundary checking errors in syscons - - - FreeBSD - 5.05.2.1_11 - - - - -

The syscons CONS_SCRSHOT ioctl(2) - does insufficient validation of its input arguments. In - particular, negative coordinates or large coordinates may - cause unexpected behavior.

-

It may be possible to cause the CONS_SCRSHOT ioctl to - return portions of kernel memory. Such memory might - contain sensitive information, such as portions of the - file cache or terminal buffers. This information might be - directly useful, or it might be leveraged to obtain elevated - privileges in some way. For example, a terminal buffer - might include a user-entered password.

-

This bug may be exploitable by users who have access to the - physical console or can otherwise open a /dev/ttyv* device - node.

- - - - CVE-2004-0919 - SA-04:15.syscons - https://svnweb.freebsd.org/changeset/base/135942 - - - 2004-09-30 - 2004-10-04 - - - - - racoon -- improper certificate handling - - - racoon - 20040818a - - - - -

Thomas Walpuski noted when OpenSSL would detect an error - condition for a peer certificate, racoon mistakenly ignored - the error. This could allow five invalid certificate states - to properly be used for authentication.

- - - - http://marc.theaimsgroup.com/?l=bugtraq&m=108726102304507 - http://www.kame.net/racoon/racoon-ml/msg00517.html - - - 2004-01-31 - 2004-10-03 - - - - - distcc -- incorrect parsing of IP access control rules - - - distcc - 2.16 - - - - -
-

Fix bug that might cause IP-based access control rules not to - be interpreted correctly on 64-bit platforms.

-
- - - - CVE-2004-0601 - http://distcc.samba.org/ftp/distcc/distcc-2.16.NEWS - - - 2004-06-23 - 2004-10-03 - - - - - mozilla -- scripting vulnerabilities - - - thunderbird - 0.8 - - - de-linux-mozillafirebird - el-linux-mozillafirebird - firefox - ja-linux-mozillafirebird-gtk1 - ja-mozillafirebird-gtk2 - linux-mozillafirebird - ru-linux-mozillafirebird - zhCN-linux-mozillafirebird - zhTW-linux-mozillafirebird - 1.p - - - de-netscape7 - fr-netscape7 - ja-netscape7 - netscape7 - pt_BR-netscape7 - 7.2 - - - mozilla-gtk1 - linux-mozilla - linux-mozilla-devel - 1.7.3 - - - mozilla - 1.7.3,2 - - - - de-linux-netscape - fr-linux-netscape - ja-linux-netscape - linux-netscape - linux-phoenix - mozilla+ipv6 - mozilla-embedded - mozilla-firebird - mozilla-gtk2 - mozilla-gtk - mozilla-thunderbird - phoenix - 0 - - - - -

Several scripting vulnerabilities were discovered and - corrected in Mozilla:

-
-
CVE-2004-0905
-
-
-

javascript; links dragged onto another frame or - page allows an attacker to steal or modify sensitive - information from other sites. The user could be convinced - to drag obscurred links in the context of a game or even a - fake scrollbar. If the user could be convinced to drag two - links in sequence into a separate window (not frame) the - attacker would be able to run arbitrary programs.

-
-
-
CVE-2004-0908
-
-
-

Untrusted javascript code can read and write to the - clipboard, stealing any sensitive data the user might - have copied. Workaround: disable - javascript

-
-
-
CVE-2004-0909
-
-
-

Signed scripts requesting enhanced abilities could - construct the request in a way that led to a confusing - grant dialog, possibly fooling the user into thinking - the privilege requested was inconsequential while - actually obtaining explicit permission to run and - install software. Workaround: Never - grant enhanced abilities of any kind to untrusted web - pages.

-
-
-
- - - - CVE-2004-0905 - CVE-2004-0908 - CVE-2004-0909 - http://bugzilla.mozilla.org/show_bug.cgi?id=250862 - http://bugzilla.mozilla.org/show_bug.cgi?id=257523 - http://bugzilla.mozilla.org/show_bug.cgi?id=253942 - - - 2004-09-13 - 2004-09-30 - - - - - mozilla -- users may be lured into bypassing security dialogs - - - thunderbird - 0.7 - - - de-linux-mozillafirebird - el-linux-mozillafirebird - firefox - ja-linux-mozillafirebird-gtk1 - ja-mozillafirebird-gtk2 - linux-mozillafirebird - ru-linux-mozillafirebird - zhCN-linux-mozillafirebird - zhTW-linux-mozillafirebird - 0.9.2 - - - de-netscape7 - fr-netscape7 - ja-netscape7 - netscape7 - pt_BR-netscape7 - 7.2 - - - mozilla-gtk1 - linux-mozilla - linux-mozilla-devel - 1.7 - - - mozilla - 1.7,2 - - - - de-linux-netscape - fr-linux-netscape - ja-linux-netscape - linux-netscape - linux-phoenix - mozilla+ipv6 - mozilla-embedded - mozilla-firebird - mozilla-gtk2 - mozilla-gtk - mozilla-thunderbird - phoenix - 0 - - - - -

According to the Mozilla project:

-
-

An attacker who could lure users into clicking in - particular places, or typing specific text, could cause a - security permission or software installation dialog to pop - up under the user's mouse click, clicking on the grant (or - install) button.

-
- - - - CVE-2004-0762 - http://bugzilla.mozilla.org/show_bug.cgi?id=162020 - - - 2004-06-05 - 2004-09-30 - - - - - mozilla -- hostname spoofing bug - - - thunderbird - 0.7 - - - de-linux-mozillafirebird - el-linux-mozillafirebird - firefox - ja-linux-mozillafirebird-gtk1 - ja-mozillafirebird-gtk2 - linux-mozillafirebird - ru-linux-mozillafirebird - zhCN-linux-mozillafirebird - zhTW-linux-mozillafirebird - 0.9.2 - - - de-netscape7 - fr-netscape7 - ja-netscape7 - netscape7 - pt_BR-netscape7 - 7.2 - - - mozilla-gtk1 - linux-mozilla - linux-mozilla-devel - 1.7 - - - mozilla - 1.7,2 - - - - de-linux-netscape - fr-linux-netscape - ja-linux-netscape - linux-netscape - linux-phoenix - mozilla+ipv6 - mozilla-embedded - mozilla-firebird - mozilla-gtk2 - mozilla-gtk - mozilla-thunderbird - phoenix - 0 - - - - -

When processing URIs that contain an unqualified host name-- - specifically, a domain name of only one component-- - Mozilla will perform matching against the first component - of the domain name in SSL certificates. In other words, in - some situations, a certificate issued to "www.example.com" - will be accepted as matching "www".

- - - - CVE-2004-0765 - http://bugzilla.mozilla.org/show_bug.cgi?id=234058 - - - 2004-02-12 - 2004-09-30 - - - - - samba -- remote file disclosure - - - samba - 2.2.12 - 3.*3.0.2a - 3.*,13.0.2a_1,1 - - - ja-samba - 2.2.11.j1.0_1 - - - - -

According to a Samba Team security notice:

-
-

A security vulnerability has been located in Samba - 2.2.x <= 2.2.11 and Samba 3.0.x <= 3.0.5. A remote - attacker may be able to gain access to files which exist - outside of the share's defined path. Such files must still - be readable by the account used for the connection.

-
-
-

The original notice for CAN-2004-0815 indicated that - Samba 3.0.x <= 3.0.5 was vulnerable to the security - issue. After further research, Samba developers have - confirmed that only Samba 3.0.2a and earlier releases - contain the exploitable code.

-
- - - - CVE-2004-0815 - http://www.samba.org/samba/news/#security_2.2.12 - - - 2004-09-30 - 2004-09-30 - 2008-09-26 - - - - - mozilla -- BMP decoder vulnerabilities - - - thunderbird - 0.7.3_1 - - - de-linux-mozillafirebird - el-linux-mozillafirebird - firefox - ja-linux-mozillafirebird-gtk1 - ja-mozillafirebird-gtk2 - linux-mozillafirebird - linux-phoenix - phoenix - ru-linux-mozillafirebird - zhCN-linux-mozillafirebird - zhTW-linux-mozillafirebird - 0.9.3_1 - - - de-netscape7 - fr-netscape7 - ja-netscape7 - netscape7 - pt_BR-netscape7 - 7.2 - - - linux-mozilla - linux-mozilla-devel - 1.7.3 - - - mozilla-gtk1 - 1.7.2_3 - - - mozilla - 1.7.2_2,2 - 1.8.a,21.8.a3_1,2 - - - - mozilla+ipv6 - mozilla-embedded - mozilla-firebird - mozilla-gtk - mozilla-gtk2 - mozilla-thunderbird - linux-netscape - de-linux-netscape - fr-linux-netscape - ja-linux-netscape - 0 - - - - -

Gael Delalleau discovered several integer overflows in - Mozilla's BMP decoder that can result in denial-of-service or - arbitrary code execution.

- - - - CVE-2004-0904 - http://bugzilla.mozilla.org/show_bug.cgi?id=255067 - TA04-261A - 847200 - - - 2004-09-13 - 2004-09-28 - 2004-09-30 - - - - - mozilla -- vCard stack buffer overflow - - - thunderbird - 0.7.3_1 - - - mozilla - 1.7.2_2,2 - 1.8.a,21.8.a3_1,2 - - - mozilla-gtk1 - 1.7.2_3 - - - linux-mozilla - 1.7.3 - - - - -

Georgi Guninski discovered a stack buffer overflow which - may be triggered when viewing email messages with vCard - attachments.

- - - - CVE-2004-0903 - http://bugzilla.mozilla.org/show_bug.cgi?id=257314 - TA04-261A - 414240 - - - 2004-09-13 - 2004-09-28 - 2004-09-30 - - - - - mozilla -- multiple heap buffer overflows - - - thunderbird - 0.7.3_1 - - - firefox - 0.9.3_1 - - - mozilla - 1.7.2_2,2 - 1.8.a,21.8.a3_1,2 - - - mozilla-gtk1 - 1.7.2_3 - - - linux-mozilla - 1.7.3 - - - linux-mozillafirebird - 0 - - - - -

Several heap buffer overflows were discovered and fixed in the - most recent versions of Mozilla, Firefox, and Thunderbird. - These overflows may occur when:

-
    -
  • Using the "Send Page" function.
    • -
  • Checking mail on a malicious POP3 server.
    • -
  • Processing non-ASCII URLs.
    • -
-

Each of these vulnerabilities may be exploited for remote - code execution.

- - - - CVE-2004-0902 - http://bugzilla.mozilla.org/show_bug.cgi?id=258005 - http://bugzilla.mozilla.org/show_bug.cgi?id=245066 - http://bugzilla.mozilla.org/show_bug.cgi?id=226669 - http://bugzilla.mozilla.org/show_bug.cgi?id=256316 - TA04-261A - - - 2004-09-13 - 2004-09-28 - - - - - php -- strip_tags cross-site scripting vulnerability - - - mod_php4-twig - php4 - php4-cgi - php4-cli - php4-dtc - php4-horde - php4-nms - 4.3.7_3 - - - mod_php4 - 4.3.7_3,1 - - - php5 - php5-cgi - php5-cli - 5.0.0.r3_2 - - - mod_php5 - 5.0.0.r3_2,1 - - - - -

Stefan Esser of e-matters discovered that PHP's strip_tags() - function would ignore certain characters during parsing of tags, - allowing these tags to pass through. Select browsers could then - parse these tags, possibly allowing cross-site scripting attacks.

- - - - CVE-2004-0595 - http://marc.theaimsgroup.com/?l=bugtraq&m=108981589117423 - http://security.e-matters.de/advisories/122004.html - 10724 - - - 2004-07-07 - 2004-09-27 - 2013-06-19 - - - - - php -- memory_limit related vulnerability - - - mod_php4-twig - php4 - php4-cgi - php4-cli - php4-dtc - php4-horde - php4-nms - 4.3.7_3 - - - mod_php4 - 4.3.7_3,1 - - - php5 - php5-cgi - php5-cli - 5.0.0.r3_2 - - - mod_php5 - 5.0.0.r3_2,1 - - - - -

Stefan Esser of e-matters discovered a condition within PHP - that may lead to remote execution of arbitrary code. The - memory_limit facility is used to notify functions when memory - contraints have been met. Under certain conditions, the entry - into this facility is able to interrupt functions such as - zend_hash_init() at locations not suitable for interruption. - The result would leave these functions in a vulnerable state.

-
-

An attacker that is able to trigger the memory_limit abort - within zend_hash_init() and is additionally able to control - the heap before the HashTable itself is allocated, is able to - supply his own HashTable destructor pointer. [...]

-

All mentioned places outside of the extensions are quite easy - to exploit, because the memory allocation up to those places - is deterministic and quite static throughout different PHP - versions. [...]

-

Because the exploit itself consist of supplying an arbitrary - destructor pointer this bug is exploitable on any platform.

-
- - - - CVE-2004-0594 - http://marc.theaimsgroup.com/?l=bugtraq&m=108981780109154 - http://security.e-matters.de/advisories/112004.html - 10725 - - - 2004-07-07 - 2004-09-27 - 2004-10-02 - - - - - subversion -- WebDAV fails to protect metadata - - - subversion - subversion-perl - subversion-python - 1.0.8 - - - - -

In some situations, subversion metadata may be unexpectedly - disclosed via WebDAV. A subversion advisory states:

-
-

mod_authz_svn, the Apache httpd module which does path-based - authorization on Subversion repositories, is not correctly - protecting all metadata on unreadable paths.

-

This security issue is not about revealing the contents - of protected files: it only reveals metadata about - protected areas such as paths and log messages. This may - or may not be important to your organization, depending - on how you're using path-based authorization, and the - sensitivity of the metadata.

-
- - - - CVE-2004-0749 - http://subversion.tigris.org/security/CAN-2004-0749-advisory.txt - - - 2004-09-15 - 2004-09-26 - - - - - lha -- numerous vulnerabilities when extracting archives - - - lha - 1.14i_6 - - - - -

Source code reviews of lha by Lukasz Wojtow, Thomas Biege, - and others uncovered a number of vulnerabilities affecting - lha:

-
    -
  • Buffer overflows when handling archives and filenames. - (CVE-2004-0694)
    • -
  • Possible command execution via shell meta-characters when - built with NOMKDIR. (CVE-2004-0745)
    • -
  • Buffer overflow resulting in arbitrary code execution when - handling long pathnames in LHZ archives. (CVE-2004-0769)
    • -
  • Buffer overflow in the extract_one. (CVE-2004-0771)
    • -
- - - - CVE-2004-0694 - CVE-2004-0745 - CVE-2004-0769 - CVE-2004-0771 - http://marc.theaimsgroup.com/?l=bugtraq&m=108464470103227 - http://marc.theaimsgroup.com/?l=bugtraq&m=108668791510153 - http://bugs.gentoo.org/show_bug.cgi?id=51285 - http://xforce.iss.net/xforce/xfdb/16196 - 10354 - - - 2004-05-17 - 2004-09-23 - - - - - mysql -- heap buffer overflow with prepared statements - - - mysql-server - mysql-client - 4.1.04.1.4 - - - - -

There is a buffer overflow in the prepared statements API - (libmysqlclient) when a statement containing thousands of - placeholders is executed.

- - - - http://bugs.mysql.com/bug.php?id=5194 - http://dev.mysql.com/doc/mysql/en/News-4.1.5.html - http://mysql.bkbits.net:8080/mysql-4.1/cset@1.1932.152.4 - - - 2004-09-08 - 2004-09-23 - - - - - mozilla -- security icon spoofing - - - firefox - 0.9 - - - linux-mozilla - linux-mozilla-devel - 1.7 - - - mozilla - 1.7,2 - - - mozilla-gtk1 - 1.7 - - - - -

Under certain situations it is possible for the security icon - which Mozilla displays when connected to a site using SSL to - be spoofed. This could be used to make so-called "phishing - attacks" more difficult to detect.

- - - - CVE-2004-0761 - https://bugzilla.mozilla.org/show_bug.cgi?id=240053 - - - 2004-04-08 - 2004-09-22 - - - - - mozilla -- NULL bytes in FTP URLs - - - firefox - 0.9.3 - - - linux-mozilla - linux-mozilla-devel - 1.7.2 - - - mozilla - 1.7.2,2 - 1.8.a,2 - - - mozilla-gtk1 - 1.7.2 - - - - -

When handling FTP URLs containing NULL bytes, Mozilla will - interpret the file content as HTML. This may allow unexpected - execution of Javascript when viewing plain text or other file - types via FTP.

- - - - CVE-2004-0760 - http://bugzilla.mozilla.org/show_bug.cgi?id=250906 - - - 2004-07-11 - 2004-09-22 - 2004-09-24 - - - - - mozilla -- automated file upload - - - mozilla - 1.7.a,21.7,2 - 1.8.a,21.8.a2,2 - - - mozilla-gtk1 - 1.7.a1.7 - - - - -

A malicious web page can cause an automated file upload - from the victim's machine when viewed with Mozilla with - Javascript enabled. This is due to a bug permitting - default values for type="file" <input> elements in - certain situations.

- - - - CVE-2004-0759 - https://bugzilla.mozilla.org/show_bug.cgi?id=241924 - - - 2004-04-28 - 2004-09-22 - 2004-09-26 - - - - - mozilla -- built-in CA certificates may be overridden - - - firefox - 0.9.3 - - - linux-mozilla - linux-mozilla-devel - 1.7.2 - - - mozilla - 1.7.2,2 - 1.8.a,2 - - - mozilla-gtk1 - 1.7.2 - - - - -

Under some situations, Mozilla will automatically import - a certificate from an email message or web site. This - behavior can be used as a denial-of-service attack: if the - certificate has a distinguished name (DN) identical to one - of the built-in Certificate Authorities (CAs), then Mozilla - will no longer be able to certify sites with certificates - issued from that CA.

- - - - CVE-2004-0758 - https://bugzilla.mozilla.org/show_bug.cgi?id=249004 - 160360 - http://banquo.inf.ethz.ch:8080/ - - - 2004-06-29 - 2004-09-22 - - - - - rssh -- file name disclosure bug - - - rssh - 2.2.1 - - - - -

rssh expands command line paramters before invoking chroot. - This could result in the disclosure to the client of file - names outside of the chroot directory. A posting by the rssh - author explains:

-
-

The cause of the problem identified by Mr. McCaw is that - rssh expanded command-line arguments prior to entering - the chroot jail. This bug DOES NOT allow a user to - access any of the files outside the jail, but can allow - them to discover what files are in a directory which is - outside the jail, if their credentials on the server would - normally allow them read/execute access in the specified - directory.

-
- - - - CVE-2004-0609 - http://marc.theaimsgroup.com/?l=bugtraq&m=108787373022844 - 10574 - http://www.osvdb.org/7239 - - - 2004-06-19 - 2004-09-21 - - - - - gnu-radius -- SNMP-related denial-of-service - - - gnu-radius - 1.2.94 - - - - -

An iDEFENSE security advisory reports:

-
-

Remote exploitation of an input validation error in - version 1.2 of GNU radiusd could allow a denial of - service.

-

The vulnerability specifically exists within - the asn_decode_string() function defined in - snmplib/asn1.c. When a very large unsigned number is - supplied, it is possible that an integer overflow will - occur in the bounds-checking code. The daemon will then - attempt to reference unallocated memory, resulting in an - access violation that causes the process to terminate.

-
- - - - CVE-2004-0849 - http://www.idefense.com/application/poi/display?id=141&type=vulnerabilities - - - 2004-09-15 - 2004-09-20 - 2005-05-03 - - - - - sudo -- sudoedit information disclosure - - - sudo - 1.6.8 - - - - -

A new feature of sudo 1.6.8 called "sudoedit" (a safe - editing facility) may allow users to read files to which - they normally have no access.

- - - - http://www.sudo.ws/sudo/alerts/sudoedit.html - - - 2004-09-18 - 2004-09-20 - - - - - apache -- heap overflow in mod_proxy - - - apache - 1.3.31_1 - - - apache13-ssl - 1.3.29.1.53_2 - - - apache13-modssl - 1.3.31+2.8.18_4 - - - apache13+ipv6 - 1.3.29_2 - - - apache13-modperl - 1.3.31 - - - - -

A buffer overflow exists in mod_proxy which may - allow an attacker to launch local DoS attacks - and possibly execute arbitrary code.

- - - - CVE-2004-0492 - http://www.guninski.com/modproxy1.html - - - 2004-06-10 - 2004-09-19 - 2004-10-05 - - - - - cvs -- numerous vulnerabilities - - - cvs+ipv6 - 1.11.17 - - - FreeBSD - 5.25.2.1_10 - 4.104.10_3 - 4.94.9_12 - 4.84.8_25 - - - - -

A number of vulnerabilities were discovered in CVS by - Stefan Esser, Sebastian Krahmer, and Derek Price.

-
    -
  • Insufficient input validation while processing "Entry" - lines. (CVE-2004-0414)
    • -
  • A double-free resulting from erroneous state handling while - processing "Argumentx" commands. (CVE-2004-0416)
    • -
  • Integer overflow while processing "Max-dotdot" commands. - (CVE-2004-0417)
    • -
  • Erroneous handling of empty entries handled while processing - "Notify" commands. (CVE-2004-0418)
    • -
  • A format string bug while processing CVS wrappers.
    • -
  • Single-byte buffer underflows while processing configuration files - from CVSROOT.
    • -
  • Various other integer overflows.
    • -
-

Additionally, iDEFENSE reports an undocumented command-line - flag used in debugging does not perform input validation on - the given path names.

-

CVS servers ("cvs server" or :pserver: modes) are - affected by these vulnerabilities. They vary in impact - but include information disclosure (the iDEFENSE-reported - bug), denial-of-service (CVE-2004-0414, CVE-2004-0416, - CVE-2004-0417 and other bugs), or possibly arbitrary code - execution (CVE-2004-0418). In very special situations where - the attacker may somehow influence the contents of CVS - configuration files in CVSROOT, additional attacks may be - possible.

- - - - CVE-2004-0414 - CVE-2004-0416 - CVE-2004-0417 - CVE-2004-0418 - CVE-2004-0778 - http://secunia.com/advisories/11817 - http://secunia.com/advisories/12309 - http://security.e-matters.de/advisories/092004.html - http://www.idefense.com/application/poi/display?id=130&type=vulnerabilities&flashstatus=false - https://ccvs.cvshome.org/source/browse/ccvs/NEWS?rev=1.116.2.104 - http://www.osvdb.org/6830 - http://www.osvdb.org/6831 - http://www.osvdb.org/6832 - http://www.osvdb.org/6833 - http://www.osvdb.org/6834 - http://www.osvdb.org/6835 - http://www.osvdb.org/6836 - 10499 - SA-04:14.cvs - - - 2004-05-20 - 2004-08-17 - 2004-09-19 - - - - - gdk-pixbuf -- image decoding vulnerabilities - - - linux-gdk-pixbuf - 0.22.0.11.3.5 - - - gtk - 2.02.4.9_1 - - - gdk-pixbuf - 0.22.0_2 - - - - -

Chris Evans discovered several flaws in the gdk-pixbuf - XPM image decoder:

-
    -
  • Heap-based overflow in pixbuf_create_from_xpm
    • -
  • Stack-based overflow in xpm_extract_color
    • -
  • Integer overflows in io-ico.c
    • -
-

Some of these flaws are believed to be exploitable.

- - - - CVE-2004-0782 - CVE-2004-0783 - CVE-2004-0788 - http://scary.beasts.org/security/CESA-2004-005.txt - - - 2004-09-15 - 2004-09-15 - 2004-11-09 - - - - - xpm -- image decoding vulnerabilities - - - agenda-snow-libs - linux_base - open-motif-devel - mupad - zh-cle_base - 0 - - - libXpm - 3.5.1_1 - - - XFree86-libraries - 4.4.0_1 - - - xorg-libraries - 6.7.0_2 - - - lesstif - 0.93.96,2 - - - xpm - 3.4k_1 - - - linux-openmotif - 2.2.4 - - - open-motif - 2.2.3_1 - - - - -

Chris Evans discovered several vulnerabilities in the libXpm - image decoder:

-
    -
  • A stack-based buffer overflow in xpmParseColors
    • -
  • An integer overflow in xpmParseColors
    • -
  • A stack-based buffer overflow in ParsePixels and - ParseAndPutPixels
    • -
-

The X11R6.8.1 release announcement reads:

-
-

This version is purely a security release, addressing - multiple integer and stack overflows in libXpm, the X - Pixmap library; all known versions of X (both XFree86 - and X.Org) are affected, so all users of X are strongly - encouraged to upgrade.

-
- - - - CVE-2004-0687 - CVE-2004-0688 - http://freedesktop.org/pipermail/xorg/2004-September/003172.html - http://scary.beasts.org/security/CESA-2004-003.txt - 537878 - 882750 - - - 2004-09-15 - 2004-09-15 - 2005-01-03 - - - - - cups -- print queue browser denial-of-service - - - cups-base - 1.1.21 - - - - -

If the CUPS server (cupsd) receives a zero-length UDP - message, it will disable its print queue browser service.

- - - - CVE-2004-0558 - http://www.cups.org/str.php?L863 - - - 2004-08-23 - 2004-09-15 - - - - - apache -- apr_uri_parse IPv6 address handling vulnerability - - - apache - 2.02.0.50_3 - - - - -

The Apache Software Foundation Security Team discovered a - programming error in the apr-util library function apr_uri_parse. - When parsing IPv6 literal addresses, it is possible that a - length is incorrectly calculated to be negative, and this - value is passed to memcpy. This may result in an exploitable - vulnerability on some platforms, including FreeBSD.

- - - - CVE-2004-0786 - http://httpd.apache.org - - - 2004-09-15 - 2004-09-15 - - - - - mod_dav -- lock related denial-of-service - - - apache - 2.02.0.50_3 - - - mod_dav - 1.0.3_1 - - - - -

A malicious user with DAV write privileges can trigger a null - pointer dereference in the Apache mod_dav module. This - could cause the server to become unavailable.

- - - - CVE-2004-0809 - http://nagoya.apache.org/bugzilla/show_bug.cgi?id=31183 - - - 2004-09-15 - 2004-09-15 - - - - - apache -- ap_resolve_env buffer overflow - - - apache - 2.02.0.50_3 - - - - -

SITIC discovered a vulnerability in Apache 2's handling of - environmental variable settings in the httpd configuration - files (the main `httpd.conf' and `.htaccess' files). - According to a SITIC advisory:

-
-

The buffer overflow occurs when expanding ${ENVVAR} - constructs in .htaccess or httpd.conf files. The function - ap_resolve_env() in server/util.c copies data from - environment variables to the character array tmp with - strcat(3), leading to a buffer overflow.

-
- - - - CVE-2004-0747 - http://lists.netsys.com/pipermail/full-disclosure/2004-September/026463.html - - - 2004-09-15 - 2004-09-15 - - - - - webmin -- insecure temporary file creation at installation time - - - webmin - 1.150_5 - - - - -

The Webmin developers documented a security issue in the - release notes for version 1.160:

-
-

Fixed a security hole in the maketemp.pl script, used - to create the /tmp/.webmin directory at install time. If - an un-trusted user creates this directory before Webmin - is installed, he could create in it a symbolic link - pointing to a critical file on the system, which would be - overwritten when Webmin writes to the link filename.

-
- - - - CVE-2004-0559 - http://www.webmin.com/changes-1.160.html - - - 2004-09-05 - 2004-09-14 - 2004-09-15 - - - - - samba3 DoS attack - - - samba3 - 3.0.7 - *,13.0.7,1 - - - - -

Code found in nmbd and smbd may allow a remote attacker - to effectively crash the nmbd server or use the smbd - server to exhaust the system memory.

- - - - CVE-2004-0807 - CVE-2004-0808 - http://www.idefense.com/application/poi/display?id=139&type=vulnerabilities - - - 2004-09-02 - 2004-09-14 - 2008-09-26 - - - - - mozilla -- POP client heap overflow - - - mozilla - 1.7,2 - - - linux-mozilla - 1.7 - - - netscape7 - 7.2 - - - thunderbird - 0.7 - - - - -

zen-parse discovered a heap buffer overflow in Mozilla's - POP client implementation. A malicious POP server - could exploit this vulnerability to cause Mozilla to execute - arbitrary code.

- - - - CVE-2004-0757 - http://bugzilla.mozilla.org/show_bug.cgi?id=229374 - http://bugzilla.mozilla.org/show_bug.cgi?id=157644 - - - 2004-07-22 - 2004-09-14 - - - - - mozilla -- SOAPParameter integer overflow - - - firefox - 0.9 - - - linux-mozilla - linux-mozilla-devel - mozilla-gtk1 - 1.7 - - - mozilla - 1.7,2 - - - netscape7 - 7.2 - - - - -

zen-parse discovered and iDEFENSE reported an exploitable - integer overflow in a scriptable Mozilla component - `SOAPParameter':

-
-

Improper input validation to the SOAPParameter object - constructor in Netscape and Mozilla allows execution of - arbitrary code. The SOAPParameter object's constructor - contains an integer overflow which allows controllable - heap corruption. A web page can be constructed to - leverage this into remote execution of arbitrary code.

-
- - - - CVE-2004-0722 - http://bugzilla.mozilla.org/show_bug.cgi?id=236618 - - - 2004-08-02 - 2004-09-14 - 2004-09-22 - - - - - openoffice -- document disclosure - - - openoffice - ar-openoffice - ca-openoffice - cs-openoffice - de-openoffice - dk-openoffice - el-openoffice - es-openoffice - et-openoffice - fi-openoffice - fr-openoffice - gr-openoffice - hu-openoffice - it-openoffice - ja-openoffice - ko-openoffice - nl-openoffice - pl-openoffice - pt-openoffice - pt_BR-openoffice - ru-openoffice - se-openoffice - sk-openoffice - sl-openoffice-SI - tr-openoffice - zh-openoffice-CN - zh-openoffice-TW - 1.1.2_1 - 2.0 - - - - -

OpenOffice creates a working directory in /tmp on startup, - and uses this directory to temporarily store document - content. However, the permissions of the created directory - may allow other user on the system to read these files, - potentially exposing information the user likely assumed was - inaccessible.

- - - - CVE-2004-0752 - http://www.openoffice.org/issues/show_bug.cgi?id=33357 - http://securitytracker.com/alerts/2004/Sep/1011205.html - http://marc.theaimsgroup.com/?l=bugtraq&m=109483308421566 - - - 2004-08-24 - 2004-09-14 - - - - - mpg123 buffer overflow - - - mpg123 - mpg123-nas - mpg123-esound - 0.59r - - - - -

The mpg123 software version 0.59r contains a - buffer overflow vulnerability which may permit - the execution of arbitrary code as the owner of - the mpg123 process.

- - - - CVE-2004-0805 - http://www.alighieri.org/advisories/advisory-mpg123.txt - - - 2003-08-16 - 2004-09-14 - - - - - ImageMagick -- BMP decoder buffer overflow - - - ImageMagick - ImageMagick-nox11 - 6.0.6.2 - - - - -

Marcus Meissner discovered that ImageMagick's BMP decoder would - crash when loading the test BMP file created by Chris Evans - for testing the previous Qt vulnerability.

- - - - CVE-2004-0827 - http://www.imagemagick.org/www/Changelog.html - - - 2004-08-25 - 2004-08-31 - 2004-09-14 - - - - - Mutiple browser frame injection vulnerability - - - kdelibs - 3.2.3_3 - - - kdebase - 3.2.3_1 - - - linux-opera - opera - 7.507.52 - - - firefox - 0.9 - - - linux-mozilla - linux-mozilla-devel - mozilla-gtk1 - 1.7 - - - mozilla - 1.7,2 - - - netscape7 - 7.2 - - - - -

A class of bugs affecting many web browsers in the same way - was discovered. A Secunia advisory reports:

-
-

The problem is that the browsers don't check if a target - frame belongs to a website containing a malicious link, - which therefore doesn't prevent one browser window from - loading content in a named frame in another window.

-

Successful exploitation allows a malicious website to load - arbitrary content in an arbitrary frame in another browser - window owned by e.g. a trusted site.

-
-

A KDE Security Advisory reports:

-
-

A malicious website could abuse Konqueror to insert - its own frames into the page of an otherwise trusted - website. As a result the user may unknowingly send - confidential information intended for the trusted website - to the malicious website.

-
-

Secunia has provided a demonstration of the vulnerability at http://secunia.com/multiple_browsers_frame_injection_vulnerability_test/.

- - - - CVE-2004-0717 - CVE-2004-0718 - CVE-2004-0721 - http://secunia.com/advisories/11978/ - http://bugzilla.mozilla.org/show_bug.cgi?id=246448 - ftp://ftp.kde.org/pub/kde/security_patches/post-3.2.3-kdelibs-htmlframes.patch - ftp://ftp.kde.org/pub/kde/security_patches/post-3.2.3-kdebase-htmlframes.patch - - - 2004-08-11 - 2004-08-12 - 2004-09-14 - - - - - isakmpd payload handling denial-of-service vulnerabilities - - - isakmpd - 20030903 - - - - -

Numerous errors in isakmpd's input packet validation lead to - denial-of-service vulnerabilities. From the Rapid7 advisory:

-
-

The ISAKMP packet processing functions in OpenBSD's - isakmpd daemon contain multiple payload handling flaws - that allow a remote attacker to launch a denial of - service attack against the daemon.

-

Carefully crafted ISAKMP packets will cause the isakmpd - daemon to attempt out-of-bounds reads, exhaust available - memory, or loop endlessly (consuming 100% of the CPU).

-
- - - - CVE-2004-0218 - CVE-2004-0219 - CVE-2004-0220 - CVE-2004-0221 - CVE-2004-0222 - http://www.rapid7.com/advisories/R7-0018.html - http://www.openbsd.org/errata34.html - - - 2004-03-17 - 2004-03-31 - 2004-09-14 - - - - - imlib -- BMP decoder heap buffer overflow - - - imlib - 1.9.14_4 - - - - -

Marcus Meissner discovered that imlib's BMP decoder would - crash when loading the test BMP file created by Chris Evans - for testing the previous Qt vulnerability. It is believed - that this bug could be exploited for arbitrary code execution.

- - - - CVE-2004-0817 - http://bugzilla.gnome.org/show_bug.cgi?id=151034 - - - 2004-08-25 - 2004-08-31 - 2004-09-02 - - - - - krb5 -- double-free vulnerabilities - - - krb5 - 1.3.4_1 - - - - -

An advisory published by the MIT Kerberos team says:

-
-

The MIT Kerberos 5 implementation's Key Distribution Center - (KDC) program contains a double-free vulnerability that - potentially allows a remote attacker to execute arbitrary code. - Compromise of a KDC host compromises the security of the entire - authentication realm served by the KDC. Additionally, double-free - vulnerabilities exist in MIT Kerberos 5 library code, making - client programs and application servers vulnerable.

-
-

Double-free vulnerabilities of this type are not believed to be - exploitable for code execution on FreeBSD systems. However, - the potential for other ill effects may exist.

- - - - CVE-2004-0642 - CVE-2004-0643 - CVE-2004-0772 - 795632 - 866472 - 350792 - http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-002-dblfree.txt - - - 2004-08-31 - 2004-08-31 - - - - - krb5 -- ASN.1 decoder denial-of-service vulnerability - - - krb5 - 1.2.21.3.4 - - - - -

An advisory published by the MIT Kerberos team says:

-
-

The ASN.1 decoder library in the MIT Kerberos 5 distribution - is vulnerable to a denial-of-service attack causing an infinite - loop in the decoder. The KDC is vulnerable to this attack.

-

An unauthenticated remote attacker can cause a KDC or application - server to hang inside an infinite loop.

-

An attacker impersonating a legitimate KDC or application - server may cause a client program to hang inside an infinite - loop.

-
- - - - CVE-2004-0644 - 550464 - http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-003-asn1.txt - - - 2004-08-31 - 2004-08-31 - - - - - imlib2 -- BMP decoder buffer overflow - - - imlib2 - 1.1.1 - - - - -

Marcus Meissner discovered that imlib2's BMP decoder would - crash when loading the test BMP file created by Chris Evans - for testing the previous Qt vulnerability. There appears to - be both a stack-based and a heap-based buffer overflow that - are believed to be exploitable for arbitrary code execution.

- - - - CVE-2004-0802 - http://cvs.sourceforge.net/viewcvs.py/enlightenment/e17/libs/imlib2/ChangeLog?rev=1.20&view=markup - - - 2004-08-31 - 2004-08-31 - - - - - SpamAssassin -- denial-of-service in tokenize_headers - - - p5-Mail-SpamAssassin - 2.64 - - - - -

According to the SpamAssassin 2.64 release announcement:

-
-

Security fix prevents a denial of service attack open - to certain malformed messages; this DoS affects all - SpamAssassin 2.5x and 2.6x versions to date.

-
-

The issue appears to be triggered by overly long message - headers.

- - - - CVE-2004-0796 - 10957 - http://marc.theaimsgroup.com/?l=spamassassin-announce&m=109168121628767 - http://search.cpan.org/src/JMASON/Mail-SpamAssassin-2.64/Changes - - - 2004-08-04 - 2004-08-23 - 2004-08-28 - - - - - tnftpd -- remotely exploitable vulnerability - - - tnftpd - 20040810 - - - lukemftpd - 0 - - - FreeBSD - 4.7 - - - - -

lukemftpd(8) is an enhanced BSD FTP server produced - within the NetBSD project. The sources for lukemftpd are - shipped with some versions of FreeBSD, however it is not - built or installed by default. The build system option - WANT_LUKEMFTPD must be set to build and install lukemftpd. - [NOTE: An exception is FreeBSD 4.7-RELEASE, - wherein lukemftpd was installed, but not enabled, by - default.]

-

Przemyslaw Frasunek discovered several vulnerabilities - in lukemftpd arising from races in the out-of-band signal - handling code used to implement the ABOR command. As a - result of these races, the internal state of the FTP server - may be manipulated in unexpected ways.

-

A remote attacker may be able to cause FTP commands to - be executed with the privileges of the running lukemftpd - process. This may be a low-privilege `ftp' user if the `-r' - command line option is specified, or it may be superuser - privileges if `-r' is *not* specified.

- - - - CVE-2004-0794 - 10967 - http://cvsweb.netbsd.org/bsdweb.cgi/src/libexec/ftpd/ftpd.c#rev1.158 - ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-009.txt.asc - http://lists.netsys.com/pipermail/full-disclosure/2004-August/025418.html - - - 2004-08-17 - 2004-08-17 - 2016-08-11 - - - - - MySQL authentication bypass / buffer overflow - - - mysql-server - 4.14.1.3 - 55.0.0_2 - - - - -

By submitting a carefully crafted authentication packet, it is - possible for an attacker to bypass password authentication in MySQL - 4.1. Using a similar method, a stack buffer used in the authentication - mechanism can be overflowed.

- - - - CVE-2004-0627 - CVE-2004-0628 - 184030 - 645326 - http://www.nextgenss.com/advisories/mysql-authbypass.txt - http://dev.mysql.com/doc/mysql/en/News-4.1.3.html - http://secunia.com/advisories/12020 - http://www.osvdb.org/7475 - http://www.osvdb.org/7476 - http://archives.neohapsis.com/archives/vulnwatch/2004-q3/0003.html - - - 2004-07-01 - 2004-07-05 - 2004-08-28 - - - - - Ruby insecure file permissions in the CGI session management - - - ruby - 1.6.8.2004.07.26 - 1.7.01.8.1.2004.07.23 - - - - -

According to a Debian Security Advisory:

-
-

Andres Salomon noticed a problem in the CGI session - management of Ruby, an object-oriented scripting language. - CGI::Session's FileStore (and presumably PStore [...]) - implementations store session information insecurely. - They simply create files, ignoring permission issues. - This can lead an attacker who has also shell access to the - webserver to take over a session.

-
- - - - CVE-2004-0755 - http://xforce.iss.net/xforce/xfdb/16996 - http://www.debian.org/security/2004/dsa-537 - http://marc.theaimsgroup.com/?l=bugtraq&m=109267579822250&w=2 - - - 2004-08-16 - 2004-08-16 - 2004-08-28 - - - - - nss -- exploitable buffer overflow in SSLv2 protocol handler - - - nss - 3.9.2 - - - - -

ISS X-Force reports that a remotely exploitable buffer - overflow exists in the Netscape Security Services (NSS) - library's implementation of SSLv2. From their advisory:

-
-

The NSS library contains a flaw in SSLv2 record parsing - that may lead to remote compromise. When parsing the - first record in an SSLv2 negotiation, the client hello - message, the server fails to validate the length of a - record field. As a result, it is possible for an attacker - to trigger a heap-based overflow of arbitrary length.

-
-

Note that the vulnerable NSS library is also present in - Mozilla-based browsers. However, it is not believed that - browsers are affected, as the vulnerability is present only in - code used by SSLv2 *servers*.

- - - - http://xforce.iss.net/xforce/alerts/id/180 - http://www.osvdb.org/9116 - http://secunia.com/advisories/12362 - 11015 - - - 2004-08-23 - 2004-08-27 - - - - - ripMIME -- decoding bug allowing content filter bypass - - - ripmime - 1.3.2.3 - - - - -

ripMIME may prematurely terminate decoding Base64 encoded - messages when it encounters multiple blank lines or other - non-standard Base64 constructs. Virus scanning and content - filtering tools that use ripMIME may therefore be - bypassed.

-

The ripMIME CHANGELOG file says:

-
-

There's viruses going around exploiting the ability to - hide the majority of their data in an attachment by using - blank lines and other tricks to make scanning systems - prematurely terminate their base64 decoding.

-
- - - - 10848 - http://www.osvdb.org/8287 - http://www.pldaniels.com/ripmime/CHANGELOG - http://secunia.com/advisories/12201 - http://xforce.iss.net/xforce/xfdb/16867 - - - 2004-07-30 - 2004-08-27 - - - - - moinmoin -- ACL group bypass - - - moinmoin - 1.2.3 - - - - -

The moinmoin package contains two bugs with ACLs and anonymous - users. Both bugs may permit anonymous users to gain access to - administrative functions; for example the delete function.

-

There is no known workaround, the vulnerability exists regardless - if a site is using ACLs or not.

- - - - http://www.osvdb.org/8194 - http://www.osvdb.org/8195 - http://security.gentoo.org/glsa/glsa-200408-25.xml - http://secunia.com/advisories/11832 - 10805 - 10801 - - - 2004-07-21 - 2004-08-26 - - - - - rsync -- path sanitizing vulnerability - - - rsync - 2.6.2_2 - - - - -

An rsync security advisory reports:

-
-

There is a path-sanitizing bug that affects daemon mode in - all recent rsync versions (including 2.6.2) but only if - chroot is disabled.

-
-

The bug may allow a remote user to access files outside - of an rsync module's configured path with the privileges - configured for that module.

- - - - CVE-2004-0792 - http://samba.org/rsync/#security_aug04 - http://lists.samba.org/archive/rsync-announce/2004/000017.html - http://secunia.com/advisories/12294 - http://www.osvdb.org/8829 - - - 2004-08-12 - 2004-08-26 - - - - - gnomevfs -- unsafe URI handling - - - gnomevfs2 - 2.6.2_1 - - - gnomevfs - 1.0.5_6 - - - mc - 4.6.0_12 - - - - -

Alexander Larsson reports that some versions of gnome-vfs and - MidnightCommander contain a number of `extfs' scripts that do not - properly validate user input. If an attacker can cause her - victim to process a specially-crafted URI, arbitrary commands - can be executed with the privileges of the victim.

- - - - CVE-2004-0494 - 10864 - http://www.ciac.org/ciac/bulletins/o-194.shtml - http://xforce.iss.net/xforce/xfdb/16897 - https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=127263 - - - 2004-08-04 - 2004-08-26 - - - - - SoX buffer overflows when handling .WAV files - - - sox - 12.17.112.17.4_1 - - - - -

Ulf Härnhammar discovered a pair of buffer overflows in the - WAV file handling code of SoX. If an attacker can cause her - victim to process a specially-crafted WAV file with SoX (e.g. - through social engineering or through some other program that - relies on SoX), arbitrary code can be executed with the - privileges of the victim.

- - - - CVE-2004-0557 - http://archives.neohapsis.com/archives/vulnwatch/2004-q3/0014.html - http://secunia.com/advisories/12175 - http://www.osvdb.org/8267 - - - 2004-07-28 - 2004-08-26 - - - - - kdelibs -- konqueror cross-domain cookie injection - - - kdelibs - 3.2.3_3 - - - - -

According to a KDE Security Advisory:

-
-

WESTPOINT internet reconnaissance services alerted the - KDE security team that the KDE web browser Konqueror - allows websites to set cookies for certain country - specific secondary top level domains.

-

Web sites operating under the affected domains can - set HTTP cookies in such a way that the Konqueror web - browser will send them to all other web sites operating - under the same domain. A malicious website can use - this as part of a session fixation attack. See e.g. - http://www.acros.si/papers/session_fixation.pdf

-

Affected are all country specific secondary top level - domains that use more than 2 characters in the secondary - part of the domain name and that use a secondary part other - than com, net, mil, org, gov, edu or int. Examples of - affected domains are .ltd.uk, .plc.uk and .firm.in

-

It should be noted that popular domains such as .co.uk, .co.in - and .com are NOT affected.

-
- - - - CVE-2004-0746 - http://www.kde.org/info/security/advisory-20040823-1.txt - http://www.osvdb.org/9117 - http://secunia.com/advisories/12341 - http://www.acros.si/papers/session_fixation.pdf - 10991 - - - 2004-08-23 - 2004-08-26 - - - - - - - - - fidogate -- write files as `news' user - - - fidogate - 4.4.9_3 - - - fidogate-ds - 5.1.1_1 - - - - -

Neils Heinen reports that the setuid `news' binaries - installed as part of fidogate may be used to create files or - append to file with the privileges of the `news' user by - setting the LOGFILE environmental variable.

- - - - http://cvs.sourceforge.net/viewcvs.py/fidogate/fidogate/ChangeLog?rev=4.320&view=markup - - - 2004-08-21 - 2004-08-22 - 2004-08-23 - - - - - Arbitrary code execution via a format string vulnerability in jftpgw - - - jftpgw - 0.13.5 - - - - -

The log functions in jftpgw may allow - remotely authenticated user to execute - arbitrary code via the format string - specifiers in certain syslog messages.

- - - - CVE-2004-0448 - http://www.debian.org/security/2004/dsa-510 - 10438 - http://xforce.iss.net/xforce/xfdb/16271 - - - 2004-05-30 - 2004-08-13 - 2004-08-23 - - - - - qt -- image loader vulnerabilities - - - qt - 3.3.3 - - - - -

Qt contains several vulnerabilities related to image - loading, including possible crashes when loading corrupt - GIF, BMP, or JPEG images. Most seriously, Chris Evans - reports that the BMP crash is actually due to a heap - buffer overflow. It is believed that an attacker may be - able to construct a BMP image that could cause a Qt-using - application to execute arbitrary code when it is loaded.

- - - - CVE-2004-0691 - CVE-2004-0692 - CVE-2004-0693 - http://www.trolltech.com/developer/changes/changes-3.3.3.html - http://scary.beasts.org/security/CESA-2004-004.txt - - - 2004-08-11 - 2004-08-22 - - - - - courier-imap -- format string vulnerability in debug mode - - - courier-imap - 3.0.7,1 - - - - -

An iDEFENSE security advisory describes a format string - vulnerability that could be exploited when Courier-IMAP is run - in debug mode (DEBUG_LOGIN set).

- - - - CVE-2004-0777 - http://lists.netsys.com/pipermail/full-disclosure/2004-August/025478.html - http://www.idefense.com/application/poi/display?id=131&type=vulnerabilities&flashstatus=false - 10976 - - - 2004-08-18 - 2004-08-22 - 2013-06-19 - - - - - mysql -- mysqlhotcopy insecure temporary file creation - - - mysql-scripts - 3.23.58 - 44.0.20 - 4.14.1.3 - 55.0.0_1 - - - - -

According to Christian Hammers:

-
-

[mysqlhotcopy created] temporary files in /tmp which - had predictable filenames and such could be used for a - tempfile run attack.

-
-

Jeroen van Wolffelaar is credited with discovering the issue.

- - - - CVE-2004-0457 - http://www.debian.org/security/2004/dsa-540 - http://lists.mysql.com/internals/15185 - - - 2004-08-18 - 2004-08-22 - - - - - Multiple Potential Buffer Overruns in Samba - - - samba - 3.*3.0.5 - 3.*,13.0.5,1 - 2.2.10 - - - ja-samba - 2.2.10.j1.0 - - - - -

Evgeny Demidov discovered that the Samba server has a - buffer overflow in the Samba Web Administration Tool (SWAT) - on decoding Base64 data during HTTP Basic Authentication. - Versions 3.0.2 through 3.0.4 are affected.

-

Another buffer overflow bug has been found in the code - used to support the "mangling method = hash" smb.conf - option. The default setting for this parameter is "mangling - method = hash2" and therefore not vulnerable. Versions - between 2.2.0 through 2.2.9 and 3.0.0 through 3.0.4 are affected.

- - - - CVE-2004-0600 - CVE-2004-0686 - http://www.securityfocus.com/archive/1/369698 - http://www.securityfocus.com/archive/1/369706 - http://www.samba.org/samba/whatsnew/samba-3.0.5.html - http://www.samba.org/samba/whatsnew/samba-2.2.10.html - http://www.osvdb.org/8190 - http://www.osvdb.org/8191 - http://secunia.com/advisories/12130 - - - 2004-07-14 - 2004-07-21 - 2008-09-26 - - - - - Mozilla / Firefox user interface spoofing vulnerability - - - firefox - 0.9.1_1 - - - linux-mozilla - 1.7.1 - - - linux-mozilla-devel - 1.7.1 - - - mozilla - 1.7.1,2 - 1.8.a,21.8.a2,2 - - - mozilla-gtk1 - 1.7.1_1 - - - - -

The Mozilla project's family of browsers contain a design - flaw that can allow a website to spoof almost perfectly any - part of the Mozilla user interface, including spoofing web - sites for phishing or internal elements such as the "Master - Password" dialog box. This achieved by manipulating "chrome" - through remote XUL content. Recent versions of Mozilla have - been fixed to not allow untrusted documents to utilize - "chrome" in this way.

- - - - CVE-2004-0764 - http://bugzilla.mozilla.org/show_bug.cgi?id=22183 - http://bugzilla.mozilla.org/show_bug.cgi?id=244965 - http://bugzilla.mozilla.org/show_bug.cgi?id=252198 - http://www.nd.edu/~jsmith30/xul/test/spoof.html - http://secunia.com/advisories/12188 - 10832 - - - 2004-07-19 - 2004-07-30 - 2004-08-15 - - - - - libpng stack-based buffer overflow and other code concerns - - - png - 1.2.5_7 - - - linux-png - 1.0.14_3 - 1.21.2.2 - - - firefox - 0.9.3 - - - thunderbird - 0.7.3 - - - linux-mozilla - 1.7.2 - - - linux-mozilla-devel - 1.7.2 - - - mozilla - 1.7.2,2 - 1.8.a,21.8.a2,2 - - - mozilla-gtk1 - 1.7.2 - - - netscape-communicator - netscape-navigator - 4.78 - - - linux-netscape-communicator - linux-netscape-navigator - ko-netscape-navigator-linux - ko-netscape-communicator-linux - ja-netscape-communicator-linux - ja-netscape-navigator-linux - 4.8 - - - netscape7 - ja-netscape7 - 7.1 - - - pt_BR-netscape7 - fr-netscape7 - de-netscape7 - 7.02 - - - - -

Chris Evans has discovered multiple vulnerabilities in libpng, - which can be exploited by malicious people to compromise a - vulnerable system or cause a DoS (Denial of Service).

- - - - http://www.securityfocus.com/archive/1/370853 - http://scary.beasts.org/security/CESA-2004-001.txt - http://www.osvdb.org/8312 - http://www.osvdb.org/8313 - http://www.osvdb.org/8314 - http://www.osvdb.org/8315 - http://www.osvdb.org/8316 - CVE-2004-0597 - CVE-2004-0598 - CVE-2004-0599 - 388984 - 236656 - 160448 - 477512 - 817368 - 286464 - http://secunia.com/advisories/12219 - http://secunia.com/advisories/12232 - http://bugzilla.mozilla.org/show_bug.cgi?id=251381 - TA04-217A - http://dl.sourceforge.net/sourceforge/libpng/ADVISORY.txt - - - 2004-08-04 - 2004-08-04 - 2004-08-15 - - - - - kdelibs insecure temporary file handling - - - kdelibs - 3.2.3_3 - - - - -

According to a KDE Security Advisory, KDE may sometimes - create temporary files without properly checking the ownership - and type of the target path. This could allow a local - attacker to cause KDE applications to overwrite arbitrary - files.

- - - - CVE-2004-0689 - CVE-2004-0690 - http://www.kde.org/info/security/advisory-20040811-1.txt - http://www.kde.org/info/security/advisory-20040811-2.txt - ftp://ftp.kde.org/pub/kde/security_patches/post-3.2.3-kdelibs-kstandarddirs.patch - ftp://ftp.kde.org/pub/kde/security_patches/post-3.2.3-kdelibs-dcopserver.patch - - - 2004-08-11 - 2004-08-12 - - - - - gaim remotely exploitable vulnerabilities in MSN component - - - gaim - ja-gaim - ko-gaim - ru-gaim - 0.81_1 - - - gaim - 20030000 - - - - -

Sebastian Krahmer discovered several remotely exploitable - buffer overflow vulnerabilities in the MSN component of - gaim.

-
-

In two places in the MSN protocol plugins (object.c and - slp.c), strncpy was used incorrectly; the size of the array - was not checked before copying to it. Both bugs affect MSN's - MSNSLP protocol, which is peer-to-peer, so this could - potentially be easy to exploit.

-
- - - - CVE-2004-0500 - http://gaim.sourceforge.net/security/?id=0 - - - 2004-08-12 - 2004-08-12 - 2004-10-25 - - - - - acroread uudecoder input validation error - - - acroread - acroread4 - acroread5 - 5.0.9 - - - - -

An iDEFENSE security advisory reports:

-
-

Remote exploitation of an input validation error in the - uudecoding feature of Adobe Acrobat Reader (Unix) 5.0 - allows an attacker to execute arbitrary code.

-

The Unix and Linux versions of Adobe Acrobat Reader 5.0 - automatically attempt to convert uuencoded documents - back into their original format. The vulnerability - specifically exists in the failure of Acrobat Reader to - check for the backtick shell metacharacter in the filename - before executing a command with a shell. This allows a - maliciously constructed filename to execute arbitrary - programs.

-
- - - - CVE-2004-0630 - http://www.idefense.com/application/poi/display?id=124&type=vulnerabilities - - - 2004-08-12 - 2004-08-12 - 2005-01-06 - - - - - popfile file disclosure - - - popfile - 0.21.1_2 - - - - -

John Graham-Cumming reports that certain configurations of - POPFile may allow the retrieval of any files with the - extensions .gif, .png, .ico, .css, as well as some files with - the extension .html.

- - - - http://sourceforge.net/mailarchive/forum.php?thread_id=5248725&forum_id=12356 - - - 2004-08-02 - 2004-08-12 - - - - - isc-dhcp3-server buffer overflow in logging mechanism - - - isc-dhcp3-relay - isc-dhcp3-server - 3.0.1.r123.0.1.r14 - - - - -

A buffer overflow exists in the logging functionality - of the DHCP daemon which could lead to Denial of Service - attacks and has the potential to allow attackers to - execute arbitrary code.

- - - - CVE-2004-0460 - http://www.osvdb.org/7237 - TA04-174A - 317350 - http://www.securityfocus.com/archive/1/366801 - http://www.securityfocus.com/archive/1/367286 - - - 2004-06-22 - 2004-06-25 - 2004-08-12 - - - - - libpng denial-of-service - - - linux-png - 1.0.14_3 - 1.21.2.2 - - - png - 1.2.5_4 - - - - -

Steve Grubb reports a buffer read overrun in - libpng's png_format_buffer function. A specially - constructed PNG image processed by an application using - libpng may trigger the buffer read overrun and possibly - result in an application crash.

- - - - CVE-2004-0421 - http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=120508 - http://rhn.redhat.com/errata/RHSA-2004-181.html - http://secunia.com/advisories/11505 - http://www.osvdb.org/5726 - 10244 - - - 2004-04-29 - 2004-05-02 - 2004-08-12 - - - - - - - - - Mozilla certificate spoofing - - - firefox - 0.9.10.9.2 - - - linux-mozilla - 1.7.2 - - - linux-mozilla-devel - 1.7.2 - - - mozilla - 1.7.2,2 - 1.8,21.8.a2,2 - - - mozilla-gtk1 - 1.7.2 - - - - -

Mozilla and Mozilla Firefox contains a flaw that may - allow a malicious user to spoof SSL certification.

- - - - http://www.securityfocus.com/archive/1/369953 - http://www.cipher.org.uk/index.php?p=advisories/Certificate_Spoofing_Mozilla_FireFox_25-07-2004.advisory - http://secunia.com/advisories/12160 - http://bugzilla.mozilla.org/show_bug.cgi?id=253121 - http://www.osvdb.org/8238 - 10796 - CVE-2004-0763 - - - 2004-07-25 - 2004-07-30 - 2004-08-12 - - - - - ImageMagick png vulnerability fix - - - ImageMagick - ImageMagick-nox11 - 6.0.4.2 - - - - -

Glenn Randers-Pehrson has contributed a fix for the png - vulnerabilities discovered by Chris Evans.

- - - - http://studio.imagemagick.org/pipermail/magick-users/2004-August/013218.html - http://freshmeat.net/releases/169228 - http://secunia.com/advisories/12236 - http://www.freebsd.org/ports/portaudit/f9e3e60b-e650-11d8-9b0a-000347a4fa7d.html - - - 2004-08-04 - 2004-08-04 - 2004-08-12 - - - - - Courier mail services: remotely exploitable buffer overflows - - - courier - 0.45 - - - courier-imap - 3.0,1 - - - sqwebmail - 4.0 - - - - -

The Courier set of mail services use a common Unicode - library. This library contains buffer overflows in the - converters for two popular Japanese character encodings. - These overflows may be remotely exploitable, triggered by - a maliciously formatted email message that is later processed - by one of the Courier mail services. - From the release notes for the corrected versions of the - Courier set of mail services:

-
-

iso2022jp.c: Converters became (upper-)compatible with - ISO-2022-JP (RFC1468 / JIS X 0208:1997 Annex 2) and - ISO-2022-JP-1 (RFC2237). Buffer overflow vulnerability - (when Unicode character is out of BMP range) has been - closed. Convert error handling was implemented.

-

shiftjis.c: Broken SHIFT_JIS converters has been fixed - and became (upper-)compatible with Shifted Encoding Method - (JIS X 0208:1997 Annex 1). Buffer overflow vulnerability - (when Unicode character is out of BMP range) has been - closed. Convert error handling was implemented.

-
- - - - CVE-2004-0224 - http://cvs.sourceforge.net/viewcvs.py/courier/libs/unicode/iso2022jp.c?rev=1.10&view=markup - http://cvs.sourceforge.net/viewcvs.py/courier/libs/unicode/shiftjis.c?rev=1.6&view=markup - 9845 - http://secunia.com/advisories/11087 - http://www.osvdb.org/4194 - http://www.osvdb.org/6927 - - - 2004-02-01 - 2004-03-31 - 2004-07-16 - - - - - multiple vulnerabilities in ethereal - - - ethereal - tethereal - 0.10.3 - - - - -

Stefan Esser of e-matters Security discovered a baker's dozen - of buffer overflows in Ethereal's decoders, including:

-
    -
  • NetFlow
    • -
  • IGAP
    • -
  • EIGRP
    • -
  • PGM
    • -
  • IRDA
    • -
  • BGP
    • -
  • ISUP
    • -
  • TCAP
    • -
  • UCP
    • -
-

In addition, a vulnerability in the RADIUS decoder was found - by Jonathan Heusser.

-

Finally, there is one uncredited vulnerability described by the - Ethereal team as:

-
-

A zero-length Presentation protocol selector could make - Ethereal crash.

-
- - - - http://www.ethereal.com/appnotes/enpa-sa-00013.html - CVE-2004-0176 - CVE-2004-0365 - CVE-2004-0367 - 119876 - 124454 - 125156 - 433596 - 591820 - 644886 - 659140 - 695486 - 740188 - 792286 - 864884 - 931588 - http://security.e-matters.de/advisories/032004.html - http://secunia.com/advisories/11185 - 9952 - http://www.osvdb.org/4462 - http://www.osvdb.org/4463 - http://www.osvdb.org/4464 - - - 2004-03-23 - 2004-03-26 - 2004-07-11 - - - - - multiple vulnerabilities in ethereal - - - ethereal - ethereal-lite - tethereal - tethereal-lite - 0.10.4 - - - - -

Issues have been discovered in multiple protocol dissectors.

- - - - http://www.ethereal.com/appnotes/enpa-sa-00014.html - CVE-2004-0504 - CVE-2004-0505 - CVE-2004-0506 - CVE-2004-0507 - http://secunia.com/advisories/11608 - 10347 - http://www.osvdb.org/6131 - http://www.osvdb.org/6132 - http://www.osvdb.org/6133 - http://www.osvdb.org/6134 - - - 2004-05-13 - 2004-07-11 - - - - - multiple vulnerabilities in ethereal - - - ethereal - ethereal-lite - tethereal - tethereal-lite - 0.10.5 - - - - -

Issues have been discovered in multiple protocol dissectors.

- - - - http://www.ethereal.com/appnotes/enpa-sa-00015.html - CVE-2004-0633 - CVE-2004-0634 - CVE-2004-0635 - http://secunia.com/advisories/12024 - 10672 - http://www.osvdb.org/7536 - http://www.osvdb.org/7537 - http://www.osvdb.org/7538 - - - 2004-07-06 - 2004-07-11 - - - - - Format string vulnerability in SSLtelnet - - - SSLtelnet - 0.13_1 - - - - -

SSLtelnet contains a format string vulnerability that could - allow remote code execution and privilege escalation.

- - - - CVE-2004-0640 - http://www.idefense.com/application/poi/display?id=114&type=vulnerabilities - - - 2003-04-03 - 2004-07-05 - - - - - "Content-Type" XSS vulnerability affecting other webmail systems - - - openwebmail - 2.32 - - - ilohamail - 0.8.13 - - - - -

Roman Medina-Heigl Hernandez did a survey which other webmail systems - where vulnerable to a bug he discovered in SquirrelMail. This advisory - summarizes the results.

- - - - http://www.rs-labs.com/adv/RS-Labs-Advisory-2004-2.txt - http://www.freebsd.org/ports/portaudit/89a0de27-bf66-11d8-a252-02e0185c0b53.html - http://www.freebsd.org/ports/portaudit/911f1b19-bd20-11d8-84f9-000bdb1444a4.html - http://www.freebsd.org/ports/portaudit/c3e56efa-c42f-11d8-864c-02e0185c0b53.html - CVE-2004-0519 - - - 2004-05-29 - 2004-07-05 - - - - - Pavuk HTTP Location header overflow - - - pavuk - 0.9.28_5 - - - - -

When pavuk sends a request to a web server and the server - sends back the HTTP status code 305 (Use Proxy), pavuk - copies data from the HTTP Location header in an unsafe - manner. This leads to a stack-based buffer overflow with - control over EIP.

- - - - CVE-2004-0456 - http://lists.netsys.com/pipermail/full-disclosure/2004-July/023322.html - http://www.osvdb.org/7319 - - - 2004-06-30 - 2004-07-03 - - - - - Several vulnerabilities found in PHPNuke - - - phpnuke - 7.3 - - - - -

Janek Vind "waraxe" reports that several issues in the - PHPNuke software may be exploited via carefully crafted - URL requests. These URLs will permit the injection of - SQL code, cookie theft, and the readability of the - PHPNuke administrator account.

- - - - CVE-2003-0279 - CVE-2003-0318 - CVE-2004-0266 - CVE-2004-0269 - http://www.waraxe.us/index.php?modname=sa&id=27 - http://secunia.com/advisories/11920 - - - 2004-05-05 - 2004-07-03 - 2004-09-28 - - - - - Remote code injection in phpMyAdmin - - - phpMyAdmin - 2.5.7.1 - - - - -

This vulnerability would allow remote user to inject PHP code - to be executed by eval() function. This vulnerability is only - exploitable if variable $cfg['LeftFrameLight'] is set to FALSE (in - file config.inc.php).

- - - - http://sf.net/forum/forum.php?forum_id=387635 - http://www.securityfocus.com/archive/1/367486 - http://secunia.com/advisories/11974 - http://eagle.kecapi.com/sec/fd/phpMyAdmin.html - - - 2004-06-29 - 2004-07-02 - 2004-09-28 - - - - - GNATS local privilege elevation - - - gnats - 3.113.1_9 - - - - -

GNATS 3.113.1 contains multiple buffer overflows, through which a - local attacker could gain elevated privileges on the system.

- - - - ports/56006 - http://www.securityfocus.com/archive/1/326337 - http://www.securiteam.com/unixfocus/5CP0N0UAAA.html - http://secunia.com/advisories/9096 - http://x82.inetcop.org/h0me/adv1sor1es/INCSA.2003-0x82-018-GNATS-bt.txt - http://www.gnu.org/software/gnats/gnats.html - http://www.osvdb.org/2190 - http://www.osvdb.org/4600 - http://www.osvdb.org/4601 - http://www.osvdb.org/4607 - - - 2003-06-21 - 2004-07-02 - - - - - Linux binary compatibility mode input validation error - - - FreeBSD - 4.94.9_10 - 4.84.8_23 - - - - -

A programming error in the handling of some Linux system - calls may result in memory locations being accessed without - proper validation.

-

It may be possible for a local attacker to read and/or - overwrite portions of kernel memory, resulting in disclosure - of sensitive information or potential privilege escalation. - A local attacker can cause a system panic.

- - - - CVE-2004-0602 - SA-04:13.linux - - - 2004-06-18 - 2004-06-30 - - - - - Remote Denial of Service of HTTP server and client - - - giFT-FastTrack - 0.8.7 - - - - -

giFT-FastTrack is susceptible to a remote - Denial of Service attack which could allow - a remote attacker to render HTTP services - unusable. According to the developers, no - code execution is possible; however, they - recommend an immediate upgrade.

- - - - http://developer.berlios.de/forum/forum.php?forum_id=5814 - http://www.osvdb.org/7266 - http://secunia.com/advisories/11941 - 10604 - - - 2004-06-19 - 2004-06-25 - 2004-06-29 - - - - - XFree86 opens a chooserFd TCP socket even when DisplayManager.requestPort is 0 - - - xorg-clients - 6.7.0 - - - - -

When the IPv6 code was added to xdm a critical - test to disable xdmcp was accidentally removed. This - caused xdm to create the chooser socket regardless if - DisplayManager.requestPort was disabled in xdm-config - or not.

- - - - CVE-2004-0419 - http://bugs.xfree86.org/show_bug.cgi?id=1376 - https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=124900 - - - 2004-05-19 - 2004-06-28 - 2004-06-28 - - - - - MoinMoin administrative group name privilege escalation vulnerability - - - moinmoin - 1.2.2 - - - - -

A serious flaw exists in the MoinMoin software - which may allow a malicious user to gain access to - unauthorized privileges.

- - - - http://www.osvdb.org/6704 - CVE-2004-0708 - 10568 - http://secunia.com/advisories/11807 - - - 2004-05-04 - 2004-06-28 - - - - - Cyrus IMAP pre-authentication heap overflow vulnerability - - - cyrus-imapd - 2.0.17 - 2.12.1.11 - - - - -

In December 2002, Timo Sirainen reported:

-
-

Cyrus IMAP server has a remotely exploitable pre-login - buffer overflow. [...] Note that you don't have to log in - before exploiting this, and since Cyrus - runs everything under one UID, it's possible to read every - user's mail in the system.

-
-

It is unknown whether this vulnerability is exploitable for code - execution on FreeBSD systems.

- - - - CVE-2002-1580 - 6298 - 740169 - http://marc.theaimsgroup.com/?l=bugtraq&m=103886607825605 - http://asg.web.cmu.edu/archive/message.php?mailbox=archive.info-cyrus&msg=19349 - - - 2002-12-02 - 2004-05-12 - 2004-06-27 - - - - - Cyrus IMSPd multiple vulnerabilities - - - cyrus-imspd - 1.6a5 - - - - -

The Cyrus team reported multiple vulnerabilities in older - versions of Cyrus IMSPd:

-
-

These releases correct a recently discovered buffer - overflow vulnerability, as well as clean up a significant - amount of buffer handling throughout the code.

-
- - - - http://asg.web.cmu.edu/archive/message.php?mailbox=archive.cyrus-announce&msg=25 - - - 2004-05-12 - 2004-09-20 - 2013-06-19 - - - - - mplayer heap overflow in http requests - - - mplayer - mplayer-gtk - mplayer-esound - mplayer-gtk-esound - 0.92.1 - - - - -

A remotely exploitable heap buffer overflow vulnerability was - found in MPlayer's URL decoding code. If an attacker can - cause MPlayer to visit a specially crafted URL, arbitrary code - execution with the privileges of the user running MPlayer may - occur. A `visit' might be caused by social engineering, or a - malicious web server could use HTTP redirects which MPlayer - would then process.

- - - - http://www.mplayerhq.hu/homepage/design6/news.html - http://marc.theaimsgroup.com/?l=bugtraq&m=108066964709058 - ports/64974 - - - 2004-03-30 - 2004-03-31 - 2004-06-27 - - - - - ecartis buffer overflows and input validation bugs - - - ecartis - 1.0.0.s20030814,1 - - - - -

Timo Sirainen reports multiple buffer overflows that may be - triggered while parsing messages, as well as input validation - errors that could result in disclosure of mailing list - passwords.

-

These bugs were resolved in the August 2003 snapshot of - ecartis.

- - - - CVE-2003-0781 - CVE-2003-0782 - http://www.securiteam.com/unixfocus/5YP0H2AAUY.html - ports/57082 - - - 2003-08-14 - 2004-03-29 - 2004-06-27 - - - - - ModSecurity for Apache 2.x remote off-by-one overflow - - - mod_security - 1.7.5 - - - - -

When the directive "SecFilterScanPost" is enabled, - the Apache 2.x version of ModSecurity is vulnerable - to an off-by-one overflow

- - - - http://www.s-quadra.com/advisories/Adv-20040315.txt - 9885 - http://secunia.com/advisories/11138 - 779438 - - - 2004-02-09 - 2004-03-17 - 2004-06-27 - - - - - clamav remote denial-of-service - - - clamav - 0.65_7 - - - - -

clamav will exit when a programming - assertion is not met. A malformed uuencoded message can - trigger this assertion, allowing an attacker to trivially - crash clamd or other components of clamav.

- - - - ports/62586 - http://www.securityfocus.com/archive/1/353186 - http://www.osvdb.org/3894 - 9610 - http://secunia.com/advisories/10826 - CVE-2004-0270 - http://xforce.iss.net/xforce/xfdb/15077 - - - 2004-02-09 - 2004-02-12 - 2004-06-27 - - - - - neon date parsing vulnerability - - - neon - 0.24.5_1 - - - sitecopy - 0.13.4_1 - - - - -

Stefan Esser reports:

-
-

A vulnerability within a libneon date parsing function - could cause a heap overflow which could lead to remote - code execution, depending on the application using - libneon.

-
-

The vulnerability is in the function ne_rfc1036_parse, - which is in turn used by the function ne_httpdate_parse. - Applications using either of these neon functions may be - vulnerable.

- - - - CVE-2004-0398 - http://security.e-matters.de/advisories/062004.html - http://secunia.com/advisories/11785 - - - 2004-05-19 - 2004-05-19 - 2004-06-25 - - - - - neon format string vulnerabilities - - - neon - 0.24.5 - - - tla - 1.2_1 - - - sitecopy - 0.13.4_1 - - - - -

Greuff reports that the neon WebDAV client library contains - several format string bugs within error reporting code. A - malicious server may exploit these bugs by sending specially - crafted PROPFIND or PROPPATCH responses.

-

Although several applications include neon, such as cadaver and - subversion, the FreeBSD Ports of these applications are not - impacted. They are specifically configured to NOT use the - included neon. Only packages listed as affected in this - notice are believed to be impacted.

- - - - CVE-2004-0179 - http://www.webdav.org/neon/ - http://secunia.com/advisories/11785 - - - 2004-04-14 - 2004-04-15 - 2004-06-25 - - - - - Gallery 1.4.3 and ealier user authentication bypass - - - gallery - 1.4.3.2 - - - - -

A flaw exists in Gallery versions previous to - 1.4.3-pl1 and post 1.2 which may give an attacker - the potential to log in under the "admin" account. - Data outside of the gallery is unaffected and the - attacker cannot modify any data other than the - photos or photo albums.

- - - - CVE-2004-0522 - http://gallery.menalto.com/modules.php?op=modload&name=News&file=article&sid=123 - http://secunia.com/advisories/11752 - - - 2004-06-01 - 2004-06-24 - - - - - Midnight Commander buffer overflows, format string bugs, and insecure temporary file handling - - - mc - 4.6.0_10 - - - - -

Jakub Jelinek reports several security related bugs in - Midnight Commander, including:

-
    -
  • Multiple buffer overflows (CVE-2004-0226)
    • -
  • Insecure temporary file handling (CVE-2004-0231)
    • -
  • Format string bug (CVE-2004-0232)
    • -
- - - - CVE-2004-0226 - CVE-2004-0231 - CVE-2004-0232 - - - 2004-04-29 - 2004-05-02 - 2004-06-14 - - - - - Buffer overflow in Squid NTLM authentication helper - - - squid - 2.5.5_9 - - - - -

Remote exploitation of a buffer overflow vulnerability in - the NTLM authentication helper routine of the Squid Web - Proxy Cache could allow a remote attacker to execute - arbitrary code. A remote attacker can compromise a target - system if the Squid Proxy is configured to use the NTLM - authentication helper. The attacker can send an overly long - password to overflow the buffer and execute arbitrary - code.

- - - - http://www.idefense.com/application/poi/display?id=107&type=vulnerabilities&flashstatus=false - CVE-2004-0541 - http://www.osvdb.org/6791 - http://secunia.com/advisories/11804 - 10500 - http://www.squid-cache.org/bugs/show_bug.cgi?id=998 - - - 2004-05-20 - 2004-06-09 - - - - - Vulnerabilities in H.323 implementations - - - pwlib - 1.5.0_5 - - - asterisk - 0.7.2 - - - openh323 - 1.12.0_4 - - - - -

The NISCC and the OUSPG - developed a test suite for the H.323 protocol. This test - suite has uncovered vulnerabilities in several H.323 - implementations with impacts ranging from denial-of-service - to arbitrary code execution.

-

In the FreeBSD Ports Collection, `pwlib' is directly - affected. Other applications such as `asterisk' and - `openh323' incorporate `pwlib' statically and so are also - independently affected.

- - - - - http://www.uniras.gov.uk/vuls/2004/006489/h323.htm - http://www.ee.oulu.fi/research/ouspg/protos/testing/c07/h2250v4/index.html - CA-2004-01 - 749342 - - CVE-2004-0097 - http://www.southeren.com/blog/archives/000055.html - - - 2004-01-13 - 2004-02-22 - 2004-06-08 - - - - - jailed processes can manipulate host routing tables - - - FreeBSD - 4.94.9_10 - 4.84.8_23 - - - - -

A programming error resulting in a failure to verify that - an attempt to manipulate routing tables originated from a - non-jailed process.

- -

Jailed processes running with superuser privileges could - modify host routing tables. This could result in a variety - of consequences including packets being sent via an - incorrect network interface and packets being discarded - entirely.

- - - - CVE-2004-0125 - SA-04:12.jailroute - - - 2004-02-03 - 2004-06-07 - - - - - buffer cache invalidation implementation issues - - - FreeBSD - 5.05.2_8 - 4.94.9_9 - 4.04.8_22 - - - - -

Programming errors in the implementation of the msync(2) - system call involving the MS_INVALIDATE operation lead to - cache consistency problems between the virtual memory system - and on-disk contents.

- -

In some situations, a user with read access to a file may - be able to prevent changes to that file from being committed - to disk.

- - - - CVE-2004-0435 - SA-04:11.msync - - - 2004-04-24 - 2004-05-26 - - - - - leafnode denial-of-service triggered by article request - - - leafnode - 1.9.201.9.30 - - - - -

The leafnode NNTP server may go into an unterminated loop with 100% - CPU use when an article is requested by Message-ID that has been - crossposted to several news groups when one of the group names is the - prefix of another group name that the article was cross-posted - to. Found by Jan Knutar.

- - - - http://leafnode.sourceforge.net/leafnode-SA-2002-01.txt - CVE-2002-1661 - http://sourceforge.net/mailarchive/message.php?msg_id=2796226 - http://article.gmane.org/gmane.network.leafnode.announce/8 - 6490 - ports/46613 - - - 2002-11-06 - 2004-05-21 - 2005-05-13 - - - - - leafnode fetchnews denial-of-service triggered by missing header - - - leafnode - 1.9.31.9.41 - - - - -

Fetchnews could hang when a news article to be downloaded lacked one - of the mandatory headers. Found by Joshua Crawford.

- - - - CVE-2003-0744 - http://leafnode.sourceforge.net/leafnode-SA-2003-01.txt - http://sourceforge.net/mailarchive/message.php?msg_id=5975563 - http://article.gmane.org/gmane.network.leafnode.announce/21 - 8541 - ports/53838 - - - 2003-06-20 - 2004-05-21 - 2005-05-13 - - - - - leafnode fetchnews denial-of-service triggered by truncated transmission - - - leafnode - 1.9.47 - - - - -

When a downloaded news article ends prematurely, i. e. when the - server sends [CR]LF.[CR]LF before sending a blank line, fetchnews may - wait indefinitely for data that never arrives. Workaround: configure - "minlines=1" (or use a bigger value) in the configuration file. Found - by Toni Viemerö.

- - - - CVE-2004-2068 - http://leafnode.sourceforge.net/leafnode-SA-2004-01.txt - http://sourceforge.net/tracker/index.php?func=detail&aid=873149&group_id=57767&atid=485349 - http://article.gmane.org/gmane.network.leafnode.announce/32 - http://sourceforge.net/mailarchive/message.php?msg_id=6922570 - ports/61105 - - - 2004-01-08 - 2004-05-21 - 2005-05-13 - - - - - MySQL insecure temporary file creation (mysqlbug) - - - mysql-client - 4.04.0.20 - 4.14.1.1_2 - 5.05.0.0_2 - - - - -

Shaun Colley reports that the script `mysqlbug' included - with MySQL sometimes creates temporary files in an unsafe - manner. As a result, an attacker may create a symlink in - /tmp so that if another user invokes `mysqlbug' and quits - without making any changes, an - arbitrary file may be overwritten with the bug report - template.

- - - - http://marc.theaimsgroup.com/?l=bugtraq&m=108023246916294&w=2 - http://bugs.mysql.com/bug.php?id=3284 - 9976 - CVE-2004-0381 - - - 2004-03-25 - 2004-04-16 - 2004-05-21 - - - - - subversion date parsing vulnerability - - - subversion - 1.0.2_1 - - - - -

Stefan Esser reports:

-
-

Subversion versions up to 1.0.2 are vulnerable to a date - parsing vulnerability which can be abused to allow remote - code execution on Subversion servers and therefore could - lead to a repository compromise.

-
-

NOTE: This vulnerability is similar to the date - parsing issue that affected neon. However, it is a different - and distinct bug.

- - - - CVE-2004-0397 - http://security.e-matters.de/advisories/082004.html - - - 2004-05-19 - 2004-05-19 - - - - - cvs pserver remote heap buffer overflow - - - FreeBSD - 5.25.2_7 - 5.15.1_17 - 5.05.0_21 - 4.94.9_8 - 4.84.8_21 - 4.04.7_27 - - - - -

Due to a programming error in code used to parse data - received from the client, malformed data can cause a heap - buffer to overflow, allowing the client to overwrite - arbitrary portions of the server's memory.

-

A malicious CVS client can exploit this to run arbitrary - code on the server at the privilege level of the CVS server - software.

- - - - CVE-2004-0396 - SA-04:10.cvs - - - 2004-05-02 - 2004-05-19 - - - - - Apache 2 mod_ssl denial-of-service - - - apache - 2.02.0.48_3 - - - - -

Joe Orton reports a memory leak in Apache 2's mod_ssl. - A remote attacker may issue HTTP requests on an HTTPS - port, causing an error. Due to a bug in processing this - condition, memory associated with the connection is - not freed. Repeated requests can result in consuming - all available memory resources, probably resulting in - termination of the Apache process.

- - - - CVE-2004-0113 - http://www.apacheweek.com/features/security-20 - http://cvs.apache.org/viewcvs.cgi/httpd-2.0/modules/ssl/ssl_engine_io.c?r1=1.100.2.11&r2=1.100.2.12 - http://marc.theaimsgroup.com/?l=apache-cvs&m=107869699329638 - http://nagoya.apache.org/bugzilla/show_bug.cgi?id=27106 - 9826 - - - 2004-02-20 - 2004-03-08 - 2004-05-19 - - - - - URI handler vulnerabilities in several browsers - - - linux-opera - opera - 7.50 - - - kdelibs - 3.2.2_3 - - - - -

Karol Wiesek and Greg MacManus reported via iDEFENSE that the - Opera web browser contains a flaw in the handling of - certain URIs. When presented with these URIs, Opera would - invoke external commands to process them after some - validation. However, if the hostname component of a URI - begins with a `-', it may be treated as an option by an external - command. This could have undesirable side-effects, from - denial-of-service to code execution. The impact is very - dependent on local configuration.

-

After the iDEFENSE advisory was published, the KDE team - discovered similar problems in KDE's URI handlers.

- - - - CVE-2004-0411 - http://www.idefense.com/application/poi/display?id=104&type=vulnerabilities - http://www.kde.org/info/security/advisory-20040517-1.txt - http://freebsd.kde.org/index.php#n20040517 - - - 2004-05-12 - 2004-05-18 - - - - - fsp buffer overflow and directory traversal vulnerabilities - - - fspd - 2.8.1.19 - - - - -

The Debian - security team reported a pair of vulnerabilities in - fsp:

-
-

A vulnerability was discovered in fsp, client utilities - for File Service Protocol (FSP), whereby a remote user could - both escape from the FSP root directory (CAN-2003-1022), and - also overflow a fixed-length buffer to execute arbitrary - code (CAN-2004-0011).

-
- - - - CVE-2003-1022 - CVE-2004-0011 - http://www.debian.org/security/2004/dsa-416 - - - 2004-01-06 - 2004-01-19 - 2004-05-17 - - - - - proftpd IP address access control list breakage - - - proftpd - 1.2.91.2.10.r1 - - - - -

Jindrich Makovicka reports a regression in proftpd's - handling of IP address access control lists (IP ACLs). Due - to this regression, some IP ACLs are treated as ``allow - all''.

- - - - CVE-2004-0432 - http://bugs.proftpd.org/show_bug.cgi?id=2267 - - - 2003-11-04 - 2004-05-02 - 2004-05-15 - - - - - insecure temporary file creation in xine-check, xine-bugreport - - - xine - 0.9.23_3 - - - - -

Some scripts installed with xine create temporary files - insecurely. It is recommended that these scripts (xine-check, - xine-bugreport) not be used. They are not needed for normal - operation.

- - - - http://marc.theaimsgroup.com/?l=bugtraq&m=107997911025558 - 9939 - - - 2004-03-20 - 2004-03-26 - 2004-05-09 - - - - - exim buffer overflow when verify = header_syntax is used - - - exim - exim-ldap2 - exim-mysql - exim-postgresql - 4.33+20_1 - - - - -

A remote exploitable buffer overflow has been discovered - in exim when verify = header_syntax is used in the - configuration file. This does not affect the default - configuration.

- - - - http://www.guninski.com/exim1.html - CVE-2004-0400 - - - 2004-05-06 - 2004-05-06 - - - - - phpBB session table exhaustion - - - phpbb - 2.0.8_2 - - - - -

The includes/sessions.php unnecessarily adds session item into - session table and therefore vulnerable to a denial-of-service - attack.

- - - - http://marc.theaimsgroup.com/?l=bugtraq&m=108256462710010 - - - 2004-03-05 - 2004-05-06 - - - - - heimdal kadmind remote heap buffer overflow - - - heimdal - 0.6.1_1 - - - FreeBSD - 4.94.9_7 - 4.04.8_20 - - - - -

An input validation error was discovered in the kadmind - code that handles the framing of Kerberos 4 compatibility - administration requests. The code assumed that the length - given in the framing was always two or more bytes. Smaller - lengths will cause kadmind to read an arbitrary amount of - data into a minimally-sized buffer on the heap.

-

A remote attacker may send a specially formatted message - to kadmind, causing it to crash or possibly resulting in - arbitrary code execution.

-

The kadmind daemon is part of Kerberos 5 support. However, - this bug will only be present if kadmind was built with - additional Kerberos 4 support. Thus, only systems that have - *both* Heimdal Kerberos 5 and Kerberos 4 installed might - be affected.

-

NOTE: On FreeBSD 4 systems, `kadmind' may be - installed as `k5admind'.

- - - - CVE-2004-0434 - SA-04:09.kadmind - - - 2004-05-05 - 2004-05-05 - - - - - CVS path validation errors - - - cvs+ipv6 - 1.11.5_1 - - - FreeBSD - 5.25.2.1_5 - 4.94.9_5 - 4.84.8_18 - - - - -

Two programming errors were discovered in which path names - handled by CVS were not properly validated. In one case, - the CVS client accepts absolute path names from the server - when determining which files to update. In another case, - the CVS server accepts relative path names from the client - when determining which files to transmit, including those - containing references to parent directories (`../').

-

These programming errors generally only have a security - impact when dealing with remote CVS repositories.

-

A malicious CVS server may cause a CVS client to overwrite - arbitrary files on the client's system.

-

A CVS client may request RCS files from a remote system - other than those in the repository specified by $CVSROOT. - These RCS files need not be part of any CVS repository - themselves.

- - - - CVE-2004-0180 - CVE-2004-0405 - http://ccvs.cvshome.org/servlets/NewsItemView?newsID=102 - SA-04:07.cvs - - - 2004-04-14 - 2004-04-14 - 2004-05-05 - - - - - mksnap_ffs clears file system options - - - FreeBSD - 5.25.2_1 - 5.15.1_12 - - - - -

The kernel interface for creating a snapshot of a - filesystem is the same as that for changing the flags on - that filesystem. Due to an oversight, the mksnap_ffs(8) - command called that interface with only the snapshot flag - set, causing all other flags to be reset to the default - value.

-

A regularly scheduled backup of a live filesystem, or - any other process that uses the mksnap_ffs command - (for instance, to provide a rough undelete functionality - on a file server), will clear any flags in effect on the - filesystem being snapshot. Possible consequences depend - on local usage, but can include disabling extended access - control lists or enabling the use of setuid executables - stored on an untrusted filesystem.

-

The mksnap_ffs command is normally only available to - the superuser and members of the `operator' group. There - is therefore no risk of a user gaining elevated privileges - directly through use of the mksnap_ffs command unless - it has been intentionally made available to unprivileged - users.

- - - - CVE-2004-0099 - SA-04:01.mksnap_ffs - - - 2004-01-30 - 2004-04-07 - 2004-05-05 - - - - - shmat reference counting bug - - - FreeBSD - 5.25.2_2 - 5.15.1_14 - 5.05.0_20 - 4.94.9_2 - 4.84.8_15 - 4.7_25 - - - - -

A programming error in the shmat(2) system call can result - in a shared memory segment's reference count being erroneously - incremented.

-

It may be possible to cause a shared memory segment to - reference unallocated kernel memory, but remain valid. - This could allow a local attacker to gain read or write - access to a portion of kernel memory, resulting in sensitive - information disclosure, bypass of access control mechanisms, - or privilege escalation.

- - - - CVE-2004-0114 - SA-04:02.shmat - http://www.pine.nl/press/pine-cert-20040201.txt - - - 2004-02-01 - 2004-04-07 - 2004-05-05 - - - - - jailed processes can attach to other jails - - - FreeBSD - 5.15.1_14 - 5.25.2.1 - - - - -

A programming error has been found in the jail_attach(2) - system call which affects the way that system call verifies - the privilege level of the calling process. Instead of - failing immediately if the calling process was already - jailed, the jail_attach system call would fail only after - changing the calling process's root directory.

-

A process with superuser privileges inside a jail could - change its root directory to that of a different jail, - and thus gain full read and write access to files and - directories within the target jail.

- - - - CVE-2004-0126 - SA-04:03.jail - - - 2004-02-19 - 2004-04-07 - 2004-05-05 - - - - - many out-of-sequence TCP packets denial-of-service - - - FreeBSD - 5.25.2.1_2 - 5.05.1_15 - 4.94.9_3 - 4.84.8_16 - 4.7_26 - - - - -

FreeBSD does not limit the number of TCP segments that - may be held in a reassembly queue. A remote attacker may - conduct a low-bandwidth denial-of-service attack against - a machine providing services based on TCP (there are many - such services, including HTTP, SMTP, and FTP). By sending - many out-of-sequence TCP segments, the attacker can cause - the target machine to consume all available memory buffers - (``mbufs''), likely leading to a system crash.

- - - - CVE-2004-0171 - SA-04:04.tcp - http://www.idefense.com/application/poi/display?id=78&type=vulnerabilities - - - 2004-02-18 - 2004-04-07 - 2004-05-05 - - - - - setsockopt(2) IPv6 sockets input validation error - - - FreeBSD - 5.25.2.1_4 - - - - -

From the FreeBSD Security Advisory:

-
-

A programming error in the handling of some IPv6 socket - options within the setsockopt(2) system call may result - in memory locations being accessed without proper - validation.

-

It may be possible for a local attacker to read portions - of kernel memory, resulting in disclosure of sensitive - information. A local attacker can cause a system - panic.

-
- - - - CVE-2004-0370 - SA-04:06.ipv6 - - - 2004-03-29 - 2004-03-29 - 2004-05-05 - - - - - OpenSSL ChangeCipherSpec denial-of-service vulnerability - - - openssl - openssl-beta - 0.9.7d - - - FreeBSD - 4.04.8_17 - 4.94.9_4 - 5.05.1_16 - 5.25.2.1_3 - - - - -

A remote attacker could cause an application using OpenSSL to - crash by performing a specially crafted SSL/TLS handshake.

- - - - CVE-2004-0079 - http://www.openssl.org/news/secadv_20040317.txt - SA-04:05.openssl - 288574 - 9899 - - - 2004-03-17 - 2004-03-17 - 2004-05-05 - - - - - Incorrect cross-realm trust handling in Heimdal - - - heimdal - 0.6.1 - - - FreeBSD - 5.05.2_6 - 4.94.9_6 - 4.04.8_19 - - - - -

Heimdal does not correctly validate the `transited' field of - Kerberos tickets when computing the authentication path. This - could allow a rogue KDC with which cross-realm relationships - have been established to impersonate any KDC in the - authentication path.

- - - - CVE-2004-0371 - SA-04:08.heimdal - http://www.pdc.kth.se/heimdal/advisory/2004-04-01/ - - - 2004-04-01 - 2004-04-02 - 2004-05-05 - - - - - lha buffer overflows and path traversal issues - - - lha - 1.14i_4 - - - - -

Ulf Härnhammar discovered several vulnerabilities in - LHa for UNIX's path name handling code. Specially constructed - archive files may cause LHa to overwrite files or - execute arbitrary code with the privileges of the user - invoking LHa. This could be particularly harmful for - automated systems that might handle archives such as - virus scanning processes.

- - - - CVE-2004-0234 - CVE-2004-0235 - - - 2004-04-29 - 2004-05-02 - 2004-05-03 - - - - - xchat remotely exploitable buffer overflow (Socks5) - - - xchat2 - 1.82.0.8_2 - - - - -

A straightforward stack buffer overflow exists in XChat's - Socks5 proxy support.

-

The XChat developers report that `tsifra' discovered this - issue.

-

NOTE: XChat Socks5 support is disabled by support in the - FreeBSD Ports Collection.

- - - - CVE-2004-0409 - http://xchat.org/files/source/2.0/patches/xc208-fixsocks5.diff - http://marc.theaimsgroup.com/?l=xchat-announce&m=108114935507357 - - - 2004-04-05 - 2004-04-23 - 2004-05-03 - - - - - rsync path traversal issue - - - rsync - 2.6.1 - - - - -

When running rsync in daemon mode, no checks were made - to prevent clients from writing outside of a module's - `path' setting.

- - - - CVE-2004-0426 - http://rsync.samba.org/#security_apr04 - - - 2004-04-26 - 2004-05-02 - - - - - xine-lib arbitrary file overwrite - - - libxine - 0.91.0.r3_5 - - - - -

From the xinehq advisory:

-
-

By opening a malicious MRL in any xine-lib based media - player, an attacker can write arbitrary content to an - arbitrary file, only restricted by the permissions of the - user running the application.

-
-

The flaw is a result of a feature that allows MRLs (media - resource locator URIs) to specify arbitrary configuration - options.

- - - - 10193 - http://www.xinehq.de/index.php/security/XSA-2004-1 - - - 2004-04-20 - 2004-05-02 - - - - - pound remotely exploitable vulnerability - - - pound - 1.6 - - - - -

An unknown remotely exploitable vulnerability was disclosed. - Robert Segall writes:

-
-

a security vulnerability was brought to my attention - (many thanks to Akira Higuchi). Everyone running any - previous version should upgrade to 1.6 immediately - the - vulnerability may allow a remote exploit. No exploits are - currently known and none have been observed in the wild - till now. The danger is minimised if you run Pound in a - root jail and/or you run Pound as non-root user.

-
- - - - http://www.apsis.ch/pound/pound_list/archive/2003/2003-12/1070234315000 - - - 2003-12-01 - 2004-05-02 - - - - - phpBB IP address spoofing - - - phpbb - 2.0.8_2 - - - - -

The common.php script always trusts the `X-Forwarded-For' - header in the client's HTTP request. A remote user could - forge this header in order to bypass any IP address access - control lists (ACLs).

- - - - http://marc.theaimsgroup.com/?l=bugtraq&m=108239864203144 - - - 2004-04-18 - 2004-04-23 - - - - - - - - - ident2 double byte buffer overflow - - - ident2 - 1.04 - - - - -

Jack of RaptureSecurity reported a double byte buffer - overflow in ident2. The bug may allow a remote attacker to - execute arbitrary code within the context of the ident2 - daemon. The daemon typically runs as user-ID `nobody', but - with group-ID `wheel'.

- - - - CVE-2004-0408 - - - 2004-04-15 - 2004-04-23 - - - - - kdepim exploitable buffer overflow in VCF reader - - - kdepim - 3.1.03.1.4_1 - - - - -

A buffer overflow is present in some versions of the KDE - personal information manager (kdepim) which may be triggered - when processing a specially crafted VCF file.

- - - - CVE-2003-0988 - http://www.kde.org/info/security/advisory-20040114-1.txt - - - 2004-01-14 - 2004-04-15 - - - - - racoon remote denial of service vulnerability (ISAKMP header length field) - - - racoon - 20040408a - - - - -

When racoon receives an ISAKMP header, it will attempt to - allocate sufficient memory for the entire ISAKMP message - according to the header's length field. If an attacker - crafts an ISAKMP header with a ridiculously large value - in the length field, racoon may exceed operating system - resource limits and be terminated, resulting in a denial of - service.

- - - - CVE-2004-0403 - http://www.kame.net/dev/cvsweb2.cgi/kame/kame/kame/racoon/isakmp.c.diff?r1=1.180&r2=1.181 - - - 2004-03-31 - 2004-04-14 - - - - - racoon remote denial of service vulnerability (IKE Generic Payload Header) - - - racoon - 20040407b - - - - -

When racoon receives an IKE message with an incorrectly - constructed Generic Payload Header, it may behave erratically, - going into a tight loop and dropping connections.

- - - - CVE-2004-0392 - http://orange.kame.net/dev/query-pr.cgi?pr=555 - - - 2003-12-03 - 2004-04-07 - 2004-04-14 - - - - - tcpdump ISAKMP payload handling remote denial-of-service - - - tcpdump - 3.8.3 - - - racoon - 20040408a - - - FreeBSD - 5.2.1 - - - - -

Chad Loder has discovered vulnerabilities in tcpdump's - ISAKMP protocol handler. During an audit to repair these - issues, Bill Fenner discovered some related problems.

-

These vulnerabilities may be used by an attacker to crash a - running `tcpdump' process. They can only be triggered if - the `-v' command line option is being used.

-

NOTE: the racoon ISAKMP/IKE daemon incorporates the ISAKMP - protocol handler from tcpdump, and so is also affected by - this issue.

- - - - http://marc.theaimsgroup.com/?l=bugtraq&m=108067265931525 - http://www.rapid7.com/advisories/R7-0017.html - CVE-2004-0183 - CVE-2004-0184 - - - 2004-03-12 - 2004-03-31 - 2016-08-11 - - - - - Midnight Commander buffer overflow during symlink resolution - - - mc - 4.6.0_9 - - - - -

Midnight Commander uses a fixed sized stack buffer while - resolving symbolic links within file archives (tar or cpio). - If an attacker can cause a user to process a specially - crafted file archive with Midnight Commander, - the attacker may be able to obtain the privileges of the - target user.

- - - - CVE-2003-1023 - http://marc.theaimsgroup.com/?l=bugtraq&m=106399528518704 - 8658 - - - 2003-09-19 - 2004-04-03 - 2004-04-13 - - - - - racoon fails to verify signature during Phase 1 - - - racoon - 20040407b - - - - -

Ralf Spenneberg discovered a serious flaw in racoon. - When using Phase 1 main or aggressive mode, racoon does - not verify the client's RSA signature. Any installations - using X.509 authentication are strongly - urged to upgrade.

-

Installations using pre-shared keys are believed - to be unaffected.

- - - - CVE-2004-0155 - http://www.kame.net/dev/cvsweb2.cgi/kame/kame/kame/racoon/crypto_openssl.c?rev=1.84&content-type=text/x-cvsweb-markup - - - 2004-04-05 - 2004-04-07 - - - - - Several remotely exploitable buffer overflows in gaim - - - gaim - ja-gaim - ko-gaim - ru-gaim - 0.75_3 - 0.75_5 - 0.76 - - - gaim - 20030000 - - - - -

Stefan Esser of e-matters found almost a dozen remotely - exploitable vulnerabilities in Gaim. From the e-matters - advisory:

-
-

While developing a custom add-on, an integer overflow - in the handling of AIM DirectIM packets was revealed that - could lead to a remote compromise of the IM client. After - disclosing this bug to the vendor, they had to make a - hurried release because of a change in the Yahoo connection - procedure that rendered GAIM useless. Unfourtunately at the - same time a closer look onto the sourcecode revealed 11 more - vulnerabilities.

- -

The 12 identified problems range from simple standard - stack overflows, over heap overflows to an integer overflow - that can be abused to cause a heap overflow. Due to the - nature of instant messaging many of these bugs require - man-in-the-middle attacks between client and server. But the - underlying protocols are easy to implement and MIM attacks - on ordinary TCP sessions is a fairly simple task.

- -

In combination with the latest kernel vulnerabilities or - the habit of users to work as root/administrator these bugs - can result in remote root compromises.

-
- - - - http://security.e-matters.de/advisories/012004.txt - CVE-2004-0005 - CVE-2004-0006 - CVE-2004-0007 - CVE-2004-0008 - - - 2004-01-26 - 2004-02-12 - 2004-10-25 - - - - - oftpd denial-of-service vulnerability (PORT command) - - - oftpd - 0.3.7 - - - - -

Philippe Oechslin reported a denial-of-service vulnerability - in oftpd. The oftpd server can be crashed by sending a PORT - command containing an integer over 8 bits long (over 255).

- - - - http://www.time-travellers.org/oftpd/oftpd-dos.html - 9980 - CVE-2004-0376 - - - 2004-03-04 - 2004-03-28 - 2004-04-05 - - - - - squid ACL bypass due to URL decoding bug - - - squid - 2.5.5 - - - - -

From the Squid advisory:

-
-

Squid versions 2.5.STABLE4 and earlier contain a bug - in the "%xx" URL decoding function. It may insert a NUL - character into decoded URLs, which may allow users to bypass - url_regex ACLs.

-
- - - - http://www.squid-cache.org/Advisories/SQUID-2004_1.txt - CVE-2004-0189 - - - 2004-02-29 - 2004-03-26 - 2015-05-01 - - - - - zebra/quagga denial of service vulnerability - - - zebra - 0.93b_7 - - - quagga - 0.96.4 - - - - -

A remote attacker could cause zebra/quagga to crash by - sending a malformed telnet command to their management - port.

- - - - CVE-2003-0858 - http://rhn.redhat.com/errata/RHSA-2003-305.html - http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=107140 - http://lists.quagga.net/pipermail/quagga-users/2003-November/000906.html - - - 2003-11-20 - 2004-03-29 - - - - - multiple vulnerabilities in phpBB - - - phpbb - 2.0.8 - - - - -

Users with admin rights can severly damage an phpBB installation, - potentially triggered by viewing a page with a malicious link sent - by an attacker.

- - - - http://www.gulftech.org/03202004.php - http://www.phpbb.com/phpBB/viewtopic.php?t=183982 - 9942 - - - 2004-03-20 - 2004-03-26 - 2004-03-29 - - - - - ezbounce remote format string vulnerability - - - ezbounce - 1.04.a_1 - - - - -

A security hole exists that can be used to crash the proxy and - execute arbitrary code. An exploit is circulating that takes - advantage of this, and in some cases succeeds in obtaining a login - shell on the machine.

- - - - CVE-2003-0510 - http://ezbounce.dc-team.com/ - 8071 - - - 2003-07-01 - 2004-03-26 - 2004-03-29 - - - - - racoon security association deletion vulnerability - - - racoon - 20040116a - - - - -

A remote attacker may use specially crafted IKE/ISAKMP - messages to cause racoon to delete security associations. - This could result in denial-of-service or possibly cause - sensitive traffic to be transmitted in plaintext, depending - upon configuration.

- - - - http://www.securityfocus.com/archive/1/349756 - 9416 - 9417 - CVE-2004-0164 - - - 2004-01-13 - 2004-03-25 - 2004-03-29 - - - - - wu-ftpd ftpaccess `restricted-uid'/`restricted-gid' directive may be bypassed - - - wu-ftpd - 2.6.2_3 - - - wu-ftpd+ipv6 - 2.6.2_5 - - - - -

Glenn Stewart reports a bug in wu-ftpd's ftpaccess - `restricted-uid'/`restricted-gid' directives:

-
-

Users can get around the restriction to their home - directory by issuing a simple chmod command on their home - directory. On the next ftp log in, the user will have '/' - as their root directory.

-
-

Matt Zimmerman discovered that the cause of the bug was a - missing check for a restricted user within a code path that - is executed only when a certain error is encountered.

- - - - CVE-2004-0148 - 9832 - - - 2004-02-17 - 2004-03-08 - 2004-03-29 - - - - - GNU Anubis buffer overflows and format string vulnerabilities - - - anubis - 3.6.2_1 - - - - -

Ulf Härnhammar discovered several vulnerabilities in GNU - Anubis.

-
    -
  • Unsafe uses of `sscanf'. The `%s' format specifier is - used, which allows a classical buffer overflow. (auth.c)
    • -
  • Format string bugs invoking `syslog'. (log.c, errs.c, - ssl.c)
    • -
-

Ulf notes that these vulnerabilities can be exploited by a - malicious IDENT server as a denial-of-service attack.

- - - - http://lists.netsys.com/pipermail/full-disclosure/2004-March/018290.html - 9772 - CVE-2004-0353 - CVE-2004-0354 - - - 2004-03-04 - 2004-03-06 - 2004-03-29 - - - - - Buffer overflows in XFree86 servers - - - XFree86-Server - 4.3.0_13 - 4.3.994.3.99.15_1 - - - - -

A number of buffer overflows were recently discovered in - XFree86, prompted by initial discoveries by iDEFENSE. These - buffer overflows are present in the font alias handling. An - attacker with authenticated access to a running X server may - exploit these vulnerabilities to obtain root privileges on - the machine running the X server.

- - - - http://www.idefense.com/application/poi/display?id=72 - http://www.idefense.com/application/poi/display?id=73 - CVE-2004-0083 - CVE-2004-0084 - CVE-2004-0106 - 9636 - 9652 - 9655 - - - 2004-02-10 - 2004-02-12 - 2004-03-29 - - - - - multiple buffer overflows in xboing - - - xboing - 2.4_2 - - - - -

Steve Kemp reports (in a Debian bug submission):

-
-

Due to improper bounds checking it is possible for a - malicious user to gain a shell with membership group - 'games'. (The binary is installed setgid games).

-

Environmental variables are used without being bounds-checked - in any way, from the source code:

-
-highscore.c:
-   /* Use the environment variable if it exists */
-   if ((str = getenv("XBOING_SCORE_FILE")) != NULL)
-	strcpy(filename, str);
-   else
-	strcpy(filename, HIGH_SCORE_FILE);
-
-misc.c:
-    if ((ptr = getenv("HOME")) != NULL)
-	(void) strcpy(dest, ptr);
-
-

Neither of these checks are boundschecked, and will allow - arbitary shell code to be run.

-
- - - - CVE-2004-0149 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=174924 - 9764 - - - 2003-01-01 - 2004-03-05 - 2004-03-29 - - - - - metamail format string bugs and buffer overflows - - - metamail - 2.7_2 - - - - -

Ulf Härnhammar reported four bugs in metamail: two are format - string bugs and two are buffer overflows. The bugs are in - SaveSquirrelFile(), PrintHeader(), and ShareThisHeader().

-

These vulnerabilities could be triggered by a maliciously - formatted email message if `metamail' or `splitmail' is used - to process it, possibly resulting in arbitrary code execution - with the privileges of the user reading mail.

- - - - CVE-2004-0104 - CVE-2004-0105 - 9692 - - - 2004-02-18 - 2004-02-18 - 2004-03-29 - - - - - Buffer overflows and format string bugs in Emil - - - emil - 2.1b9 - - - - -

Ulf Härnhammar reports multiple buffer overflows in - Emil, some of which are triggered during the parsing - of attachment filenames. In addition, some format string bugs - are present in the error reporting code.

-

Depending upon local configuration, these vulnerabilities - may be exploited using specially crafted messages in order - to execute arbitrary code running with the privileges of - the user invoking Emil.

- - - - http://lists.netsys.com/pipermail/full-disclosure/2004-March/019325.html - http://www.debian.org/security/2004/dsa-468 - CVE-2004-0152 - CVE-2004-0153 - - - 2004-03-24 - 2004-03-28 - - - - - Critical SQL injection in phpBB - - - phpbb - 2.0.8 - - - - -

Anyone can get admin's username and password's md5 hash via a - single web request. - A working example is provided in the advisory.

- - - - http://marc.theaimsgroup.com/?l=bugtraq&m=108032454818873 - 9984 - - - 2004-03-26 - 2004-03-28 - - - - - uudeview buffer overflows - - - uulib - uudeview - xdeview - 0.5.20 - - - - -

The authors of UUDeview report repairing two buffer - overflows in their software.

- - - - http://www.fpx.de/fp/Software/UUDeview/HISTORY.txt - - - 2004-03-01 - 2004-03-18 - 2004-03-25 - - - - - Apache 1.3 IP address access control failure on some 64-bit platforms - - - apache - 1.3.29_2 - - - apache+mod_ssl - 1.3.29+2.8.16_1 - - - apache+ssl - 1.3.29.1.53_1 - - - ru-apache - 1.3.29+30.19_1 - - - ru-apache+mod_ssl - 1.3.29+30.19+2.8.16_1 - - - - -

Henning Brauer discovered a programming error in Apache - 1.3's mod_access that results in the netmasks in IP address - access control rules being interpreted incorrectly on - 64-bit, big-endian platforms. In some cases, this could - cause a `deny from' IP address access control rule including - a netmask to fail.

- - - - CVE-2003-0993 - http://cvs.apache.org/viewcvs.cgi/apache-1.3/src/modules/standard/mod_access.c?r1=1.46&r2=1.47 - http://www.apacheweek.com/features/security-13 - http://nagoya.apache.org/bugzilla/show_bug.cgi?id=23850 - http://marc.theaimsgroup.com/?l=apache-cvs&m=107869603013722 - 9829 - - - 2004-03-07 - 2004-03-08 - 2004-03-12 - - - - - mod_python denial-of-service vulnerability in parse_qs - - - mod_python - 2.72.7.10 - 3.03.0.4 - - - - -

An attacker may cause Apache with mod_python to crash - by using a specially constructed query string.

- - - - CVE-2003-0973 - 9129 - http://www.modpython.org/pipermail/mod_python/2003-November/014532.html - http://www.modpython.org/pipermail/mod_python/2004-January/014879.html - - - 2003-11-28 - 2004-03-03 - 2004-03-11 - - - - - mpg123 vulnerabilities - - - mpg123 - mpg123-nas - mpg123-esound - 0.59r_12 - - - - -

In 2003, two vulnerabilities were discovered in mpg123 - that could result in remote code execution when using - untrusted input or streaming from an untrusted server.

- - - - CVE-2003-0577 - CVE-2003-0865 - 6629 - 8680 - - - 2003-01-16 - 2004-03-07 - - - - - fetchmail -- denial-of-service vulnerability - - - fetchmail - 6.2.5 - - - - -

Dave Jones discovered a denial-of-service vulnerability - in fetchmail. An email message containing a very long line - could cause fetchmail to segfault due to missing NUL - termination in transact.c.

-

Eric Raymond decided not to mention this issue in the - release notes for fetchmail 6.2.5, but it was fixed - there.

- - - - CVE-2003-0792 - 8843 - http://xforce.iss.net/xforce/xfdb/13450 - http://www.openbsd.org/cgi-bin/cvsweb/ports/mail/fetchmail/patches/Attic/patch-rfc822_c?rev=1.1 - - - 2003-10-16 - 2004-02-25 - 2012-09-04 - - - - - mailman denial-of-service vulnerability in MailCommandHandler - - - mailman - 2.1 - - - - -

A malformed message could cause mailman to crash.

- - - - CVE-2003-0991 - http://umn.dl.sourceforge.net/sourceforge/mailman/mailman-2.0.13-2.0.14-diff.txt - - - 2003-11-18 - 2004-02-25 - - - - - mailman XSS in admin script - - - mailman - 2.1.4 - - - - -

Dirk Mueller reports:

-

I've found a cross-site scripting - vulnerability in the admin interface of mailman 2.1.3 that - allows, under certain circumstances, for anyone to retrieve - the (valid) session cookie.

- - - - CVE-2003-0965 - http://mail.python.org/pipermail/mailman-announce/2003-December/000066.html - http://xforce.iss.net/xforce/xfdb/14121 - - - 2003-12-31 - 2004-02-25 - - - - - mailman XSS in create script - - - mailman - 2.1.3 - - - - -

From the 2.1.3 release notes:

-

Closed a cross-site scripting exploit in the - create cgi script.

- - - - CVE-2003-0992 - http://mail.python.org/pipermail/mailman-announce/2003-September/000061.html - - - 2003-09-28 - 2004-02-25 - - - - - mailman XSS in user options page - - - mailman - 2.1.1 - - - - -

From the 2.1.1 release notes:

-

Closed a cross-site scripting vulnerability in - the user options page.

- - - - CVE-2003-0038 - http://mail.python.org/pipermail/mailman-announce/2003-February/000056.html - - - 2003-02-08 - 2004-02-25 - - - - - SQL injection vulnerability in phpnuke - - - phpnuke - 6.9 - - - - -

Multiple researchers have discovered multiple SQL injection - vulnerabilities in some versions of Php-Nuke. These - vulnerabilities may lead to information disclosure, compromise - of the Php-Nuke site, or compromise of the back-end - database.

- - - - http://security.nnov.ru/search/document.asp?docid=5748 - http://www.securityfocus.com/archive/1/348375 - http://www.security-corporation.com/advisories-027.html - http://www.securityfocus.com/archive/1/353201 - - - 2003-12-12 - 2004-02-25 - - - - - lbreakout2 vulnerability in environment variable handling - - - lbreakout2 - 2.2.2_1 - - - - -

Ulf Härnhammar discovered an exploitable vulnerability in - lbreakout2's environmental variable handling. In several - instances, the contents of the HOME environmental variable - are copied to a stack or global buffer without range - checking. A local attacker may use this vulnerability to - acquire group-ID `games' privileges.

-

An exploit for this vulnerability has been published by - ``Li0n7 voila fr''.

- - - - CVE-2004-0158 - http://www.debian.org/security/2004/dsa-445 - http://www.securityfocus.com/archive/1/354760 - - - 2004-02-21 - 2004-02-25 - - - - - hsftp format string vulnerabilities - - - hsftp - 1.14 - - - - -

Ulf Härnhammar discovered a format string bug in hsftp's file - listing code may allow a malicious server to cause arbitrary - code execution by the client.

- - - - http://lists.debian.org/debian-security-announce/debian-security-announce-2004/msg00044.html - - - 2004-02-22 - 2004-02-25 - - - - - Darwin Streaming Server denial-of-service vulnerability - - - DarwinStreamingServer - 4.1.3g - - - - -

An attacker can cause an assertion to trigger by sending - a long User-Agent field in a request.

- - - - CVE-2004-0169 - http://www.idefense.com/application/poi/display?id=75 - - - 2004-02-23 - 2004-02-25 - - - - - libxml2 stack buffer overflow in URI parsing - - - libxml2 - 2.6.6 - - - - -

Yuuichi Teranishi reported a crash in libxml2's URI handling - when a long URL is supplied. The implementation in nanohttp.c - and nanoftp.c uses a 4K stack buffer, and longer URLs will - overwrite the stack. This could result in denial-of-service - or arbitrary code execution in applications using libxml2 - to parse documents.

- - - - CVE-2004-0110 - http://www.xmlsoft.org/news.html - http://mail.gnome.org/archives/xml/2004-February/msg00070.html - - - 2004-02-08 - 2004-02-25 - - - - - file disclosure in phpMyAdmin - - - phpMyAdmin - 2.5.4 - - - - -

Lack of proper input validation in phpMyAdmin may allow an - attacker to obtain the contents of any file on the target - system that is readable by the web server.

- - - - CVE-2004-0129 - http://marc.theaimsgroup.com/?l=bugtraq&m=107582619125932&w=2 - http://cvs.sourceforge.net/viewcvs.py/phpmyadmin/phpMyAdmin/export.php#rev2.3.2.1 - - - 2004-02-17 - 2004-02-22 - - - - - mnGoSearch buffer overflow in UdmDocToTextBuf() - - - mnogosearch - 3.2.*3.2.15 - - - - -

Jedi/Sector One <j@pureftpd.org> reported the following - on the full-disclosure list:

-
-

Every document is stored in multiple parts according to - its sections (description, body, etc) in databases. And - when the content has to be sent to the client, - UdmDocToTextBuf() concatenates those parts together and - skips metadata.

-

Unfortunately, that function lacks bounds checking and - a buffer overflow can be triggered by indexing a large - enough document.

-

'len' is fixed to 10K [in UdmDocToTextBuf] in searchd.c - . S->val length depends on the length of the original - document and on the indexer settings (the sample - configuration file has low limits that work around the - bug, though).

-

Exploitation should be easy, moreover textbuf points to - the stack.

-
- - - - http://lists.netsys.com/pipermail/full-disclosure/2004-February/017366.html - - - 2004-02-15 - 2004-02-15 - - - - - GNU libtool insecure temporary file handling - - - libtool - 1.31.3.5_2 - 1.41.4.3_3 - 1.51.5.2 - - - - -

libtool attempts to create a temporary directory in - which to write scratch files needed during processing. A - malicious user may create a symlink and then manipulate - the directory so as to write to files to which she normally - has no permissions.

-

This has been reported as a ``symlink vulnerability'', - although I do not think that is an accurate description.

-

This vulnerability could possibly be used on a multi-user - system to gain elevated privileges, e.g. root builds some - packages, and another user successfully exploits this - vulnerability to write to a system file.

- - - - http://www.geocrawler.com/mail/msg.php3?msg_id=3438808&list=405 - http://www.securityfocus.com/archive/1/352333 - - - 2004-01-30 - 2004-02-13 - - - - - seti@home remotely exploitable buffer overflow - - - setiathome - 3.0.8 - - - - -

The seti@home client contains a buffer overflow in the HTTP - response handler. A malicious, spoofed seti@home server can - exploit this buffer overflow to cause remote code execution - on the client. Exploit programs are widely available.

- - - - http://setiathome.berkeley.edu/version308.html - http://web.archive.org/web/20030609204812/http://spoor12.edup.tudelft.nl/ - - - 2003-04-08 - 2004-02-12 - - - - - icecast 1.x multiple vulnerabilities - - - icecast - 1.3.12 - - - - -

icecast 1.3.11 and earlier contained numerous security - vulnerabilities, the most severe allowing a remote attacker - to execute arbitrary code as root.

- - - - CVE-2002-0177 - CVE-2001-1230 - CVE-2001-1229 - CVE-2001-1083 - CVE-2001-0784 - 4415 - 2933 - - - 2002-04-28 - 2004-02-12 - - - - - nap allows arbitrary file access - - - nap - 1.4.5 - - - - -

According to the author:

-
-

Fixed security loophole which allowed remote - clients to access arbitrary files on our - system.

-
- - - - http://quasar.mathstat.uottawa.ca/~selinger/nap/NEWS - - - 2001-04-12 - 2004-02-12 - - - - - CCE contains exploitable buffer overflows - - - zh-cce - 0.40 - - - - -

The Chinese Console Environment contains exploitable buffer - overflows.

- - - - http://programmer.lib.sjtu.edu.cn/cce/cce.html - - - 2000-06-22 - 2004-02-12 - - - - - ChiTeX/ChiLaTeX unsafe set-user-id root - - - zh-chitex - 0 - - - - -

Niels Heinen reports that ChiTeX installs set-user-id root - executables that invoked system(3) without setting up the - environment, trivially allowing local root compromise.

- - - - https://docs.freebsd.org/cgi/mid.cgi?200303251301.h2PD1m9Y053389 - - - 2003-04-25 - 2004-02-12 - - - - - pine remotely exploitable buffer overflow in newmail.c - - - zh-pine - iw-pine - pine - pine4-ssl - 4.21 - - - - -

Kris Kennaway reports a remotely exploitable buffer overflow - in newmail.c. Mike Silbersack submitted the fix.

- - - - https://docs.freebsd.org/cgi/mid.cgi?200009290728.AAA69097 - - - 2000-09-29 - 2004-02-12 - - - - - pine insecure URL handling - - - pine - zh-pine - iw-pine - 4.44 - - - - -

An attacker may send an email message containing a specially - constructed URL that will execute arbitrary commands when - viewed.

- - - - SA-02:05.pine - - - 2002-01-04 - 2004-02-12 - - - - - pine remote denial-of-service attack - - - pine - zh-pine - iw-pine - 4.50 - - - - -

An attacker may send a specially-formatted email message - that will cause pine to crash.

- - - - http://marc.theaimsgroup.com/?l=bugtraq&m=103668430620531&w=2 - CVE-2002-1320 - - - 2002-10-23 - 2004-02-12 - - - - - pine remotely exploitable vulnerabilities - - - pine - zh-pine - iw-pine - 4.58 - - - - -

Pine versions prior to 4.58 are affected by two - vulnerabilities discovered by iDEFENSE, a buffer overflow - in mailview.c and an integer overflow in strings.c. Both - vulnerabilities can result in arbitrary code execution - when processing a malicious message.

- - - - CVE-2003-0720 - CVE-2003-0721 - http://www.idefense.com/application/poi/display?id=5 - - - 2003-09-10 - 2004-02-12 - - - - - rsync buffer overflow in server mode - - - rsync - 2.5.7 - - - - -

When rsync is run in server mode, a buffer overflow could - allow a remote attacker to execute arbitrary code with the - privileges of the rsync server. Anonymous rsync servers are - at the highest risk.

- - - - CVE-2003-0962 - http://lists.samba.org/archive/rsync-announce/2003/000011.html - http://rsync.samba.org/#security - - - 2003-12-04 - 2004-02-12 - - - - - Samba 3.0.x password initialization bug - - - samba - 3.0,13.0.1_2,1 - - - - -

From the Samba 3.0.2 release notes:

-
-

Security Announcement: It has been confirmed that - previous versions of Samba 3.0 are susceptible to a password - initialization bug that could grant an attacker unauthorized - access to a user account created by the mksmbpasswd.sh shell - script.

-
- - - - http://www.samba.org/samba/whatsnew/samba-3.0.2.html - CVE-2004-0082 - - - 2004-02-09 - 2004-02-12 - - - - - Buffer overflow in Mutt 1.4 - - - mutt - ja-mutt - 1.41.4.2 - - - - -

Mutt 1.4 contains a buffer overflow that could be exploited - with a specially formed message, causing Mutt to crash or - possibly execute arbitrary code.

- - - - CVE-2004-0078 - http://www.mutt.org/news.html - - - 2004-02-11 - 2004-02-12 - - - - - Apache-SSL optional client certificate vulnerability - - - apache+ssl - 1.3.29.1.53 - - - - -

From the Apache-SSL security advisory:

-
-

If configured with SSLVerifyClient set to 1 or 3 (client - certificates optional) and SSLFakeBasicAuth, Apache-SSL - 1.3.28+1.52 and all earlier versions would permit a - client to use real basic authentication to forge a client - certificate.

- -

All the attacker needed is the "one-line DN" of a valid - user, as used by faked basic auth in Apache-SSL, and the - fixed password ("password" by default).

-
- - - - http://www.apache-ssl.org/advisory-20040206.txt - - - 2004-02-06 - 2004-02-10 - - - - - L2TP, ISAKMP, and RADIUS parsing vulnerabilities in tcpdump - - - tcpdump - 3.8.1_351 - - - FreeBSD - 5.2.1 - - - - -

Jonathan Heusser discovered vulnerabilities in tcpdump's - L2TP, ISAKMP, and RADIUS protocol handlers. These - vulnerabilities may be used by an attacker to crash a running - `tcpdump' process.

- - - - CVE-2003-0989 - CVE-2003-1029 - CVE-2004-0057 - http://www.tcpdump.org/lists/workers/2003/12/msg00083.html - http://marc.theaimsgroup.com/?l=tcpdump-workers&m=107325073018070&w=2 - - - 2003-12-24 - 2004-01-19 - - - - - Buffer overflow in INN control message handling - - - inn - 2.4.*2.4.1 - - - inn-stable - 20031022_1 - - - - -

A small, fixed-size stack buffer is used to construct a - filename based on a received control message. This could - result in a stack buffer overflow.

- - - - http://marc.theaimsgroup.com/?l=inn-workers&m=107351974008605 - - - 2004-01-07 - 2004-01-08 - 2004-10-21 - - - - - ProFTPD ASCII translation bug resulting in remote root compromise - - - proftpd - 1.2.8_1 - - - - -

A buffer overflow exists in the ProFTPD code that handles - translation of newline characters during ASCII-mode file - uploads. An attacker may exploit this buffer overflow by - uploading a specially crafted file, resulting in code - execution and ultimately a remote root compromise.

- - - - http://xforce.iss.net/xforce/alerts/id/154 - CVE-2003-0831 - - - 2003-09-23 - 2004-01-05 - - - - - phpbb -- arbitrary command execution and other vulnerabilities - - - phpbb - 2.0.11 - - - - -

The ChangeLog for phpBB 2.0.11 states:

-
-

Changes since 2.0.10

-
    -
  • Fixed vulnerability in highlighting code (very - high severity, please update your installation as soon - as possible)
    • -
  • Fixed unsetting global vars - Matt - Kavanagh
    • -
  • Fixed XSS vulnerability in username handling - - AnthraX101
    • -
  • Fixed not confirmed sql injection in username handling - - warmth
    • -
  • Added check for empty topic id in topic_review - function
    • -
  • Added visual confirmation mod to code base
    • -
-
-

Additionally, a US-CERT Technical Cyber Security Alert reports:

-
-

phpBB contains an user input validation problem with - regard to the parsing of the URL. An intruder can deface a - phpBB website, execute arbitrary commands, or gain - administrative privileges on a compromised bulletin - board.

-
- - - - CVE-2004-1315 - ports/74106 - TA04-356A - 497400 - http://www.phpbb.com/support/documents.php?mode=changelog - http://marc.theaimsgroup.com/?l=bugtraq&m=110029415208724 - http://marc.theaimsgroup.com/?l=bugtraq&m=110079436714518 - http://www.phpbb.com/phpBB/viewtopic.php?f=14&t=240636 - - - 2004-11-18 - 2004-12-22 - 2005-01-24 - - - - - ElGamal sign+encrypt keys created by GnuPG can be compromised - - - gnupg - 1.0.21.2.3_4 - - - - -

Any ElGamal sign+encrypt keys created by GnuPG contain a - cryptographic weakness that may allow someone to obtain - the private key. These keys should be considered - unusable and should be revoked.

-

The following summary was written by Werner Koch, GnuPG - author:

-
-

Phong Nguyen identified a severe bug in the way GnuPG - creates and uses ElGamal keys for signing. This is - a significant security failure which can lead to a - compromise of almost all ElGamal keys used for signing. - Note that this is a real world vulnerability which will - reveal your private key within a few seconds.

-

...

-

Please take immediate action and revoke your ElGamal - signing keys. Furthermore you should take whatever - measures necessary to limit the damage done for signed or - encrypted documents using that key.

-

Note that the standard keys as generated by GnuPG (DSA - and ElGamal encryption) as well as RSA keys are NOT - vulnerable. Note also that ElGamal signing keys cannot - be generated without the use of a special flag to enable - hidden options and even then overriding a warning message - about this key type. See below for details on how to - identify vulnerable keys.

-
- - - - CVE-2003-0971 - http://lists.gnupg.org/pipermail/gnupg-devel/2003-November/020570.html - - - 2003-11-27 - 2003-12-12 - - - - - bind8 negative cache poison attack - - - bind - 8.38.3.7 - 8.48.4.3 - - - FreeBSD - 5.15.1_11 - 5.05.0_19 - 4.94.9_1 - 4.84.8_14 - 4.74.7_24 - 4.64.6.2_27 - 4.54.5_37 - 4.4_47 - - - - -

A programming error in BIND 8 named can result in a DNS - message being incorrectly cached as a negative response. As - a result, an attacker may arrange for malicious DNS messages - to be delivered to a target name server, and cause that name - server to cache a negative response for some target domain - name. The name server would thereafter respond negatively - to legitimate queries for that domain name, resulting in a - denial-of-service for applications that require DNS.

- - - - CVE-2003-0914 - SA-03:19.bind - 734644 - - - 2003-11-28 - 2003-12-12 - 2004-05-05 - - - - - Mathopd buffer overflow - - - mathopd - 1.4p2 - - - - -

Mathopd contains a buffer overflow in the prepare_reply() - function that may be remotely exploitable.

- - - - http://www.mail-archive.com/mathopd%40mathopd.org/msg00136.html - - - 2003-12-04 - 2003-12-12 - - - - - lftp HTML parsing vulnerability - - - lftp - 2.6.10 - - - - -

A buffer overflow exists in lftp which may be triggered when - requesting a directory listing from a malicious server over - HTTP.

- - - - CVE-2003-0963 - http://lftp.yar.ru/news.html#2.6.10 - - - 2003-12-11 - 2003-12-12 - - - - - qpopper format string vulnerability - - - qpopper - 2.53_1 - - - - -

An authenticated user may trigger a format string - vulnerability present in qpopper's UIDL code, resulting - in arbitrary code execution with group ID `mail' - privileges.

- - - - 1241 - CVE-2000-0442 - http://www.netsys.com/suse-linux-security/2000-May/att-0137/01-b0f5-Qpopper.txt - - - 2000-05-23 - 2003-12-12 - - - - - fetchmail -- address parsing vulnerability - - - fetchmail - 6.2.0 - - - - -

Fetchmail can be crashed by a malicious email message.

- - - - http://security.e-matters.de/advisories/052002.html - - - 2003-10-25 - 2003-10-25 - 2012-09-04 - - - - - Buffer overflow in pam_smb password handling - - - pam_smb - 1.9.9_3 - - - - -

Applications utilizing pam_smb can be compromised by - any user who can enter a password. In many cases, - this is a remote root compromise.

- - - - http://www.skynet.ie/~airlied/pam_smb/ - CVE-2003-0686 - - - 2003-10-25 - 2003-10-25 - 2003-10-25 - - - - - Buffer overflows in libmcrypt - - - libmcrypt - 2.5.6 - - - - -

libmcrypt does incomplete input validation, leading to - several buffer overflows. Additionally, - a memory leak is present. Both of these problems may be - exploited in a denial-of-service attack.

- - - - http://marc.theaimsgroup.com/?l=bugtraq&m=104162752401212&w=2 - CVE-2003-0031 - CVE-2003-0032 - - - 2003-10-25 - 2003-10-25 - 2003-10-25 - - - - - - - - - - - - - - - -- cgit v1.2.3