diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 9807c17b5fd0..a8705a3642ef 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -1,4342 +1,4342 @@ ]> Gitlab -- Vulnerabilities gitlab-ce 13.11.013.11.2 13.10.013.10.4 11.6.013.9.7

Gitlab reports:

Read API scoped tokens can execute mutations

Pull mirror credentials were exposed

Denial of Service when querying repository branches API

Non-owners can set system_note_timestamp when creating / updating issues

DeployToken will impersonate a User with the same ID when using Dependency Proxy

https://about.gitlab.com/releases/2021/04/28/security-release-gitlab-13-11-2-released/ CVE-2021-22209 CVE-2021-22206 CVE-2021-22210 CVE-2021-22208 CVE-2021-22211 2021-04-28 2021-04-28 Carrierwave -- Multiple vulnerabilities rubygem-carrierwave 1.3.2

Community reports:

Fix Code Injection vulnerability in CarrierWave::RMagick

Fix SSRF vulnerability in the remote file download feature

https://github.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md#132---2021-02-08 CVE-2021-21288 CVE-2021-21305 2021-02-08 2021-04-28 sympa -- Inappropriate use of the cookie parameter can be a security threat. This parameter may also not provide sufficient security. sympa 6.2.62

Earlier versions of Sympa require a parameter named cookie in sympa.conf configuration file.

This parameter was used to make some identifiers generated by the system unpredictable. For example, it was used as following:

To be used as a salt to encrypt passwords stored in the database by the RC4 symmetric key algorithm.
Note that RC4 is no longer considered secure enough and is not supported in the current version of Sympa.

To prevent attackers from sending crafted messages to achieve XSS and so on in message archives.

There were the following problems with the use of this parameter.

This parameter, for its purpose, should be different for each installation, and once set, it cannot be changed. As a result, some sites have been operating without setting this parameter. This completely invalidates the security measures described above.

Even if this parameter is properly set, it may be considered not being strong enough against brute force attacks.

https://sympa-community.github.io/security/2021-001.html 2021-04-27 2021-04-27 chromium -- multiple vulnerabilities chromium 90.0.4430.93

Chrome Releases reports:

This release contains 9 security fixes, including:

[1199345] High CVE-2021-21227: Insufficient data validation in V8. Reported by Gengming Liu of Singular Security Lab on 2021-04-15

[1175058] High CVE-2021-21232: Use after free in Dev Tools. Reported by Abdulrahman Alqabandi, Microsoft Browser Vulnerability Research on 2021-02-05

[1182937] High CVE-2021-21233: Heap buffer overflow in ANGLE. Reported by Omair on 2021-02-26

[1139156] Medium CVE-2021-21228: Insufficient policy enforcement in extensions. Reported by Rob Wu on 2020-10-16

[$TBD][1198165] Medium CVE-2021-21229: Incorrect security UI in downloads. Reported by Mohit Raj (shadow2639) on 2021-04-12

[1198705] Medium CVE-2021-21230: Type Confusion in V8. Reported by Manfred Paul on 2021-04-13

[1198696] Low CVE-2021-21231: Insufficient data validation in V8. Reported by Sergei Glazunov of Google Project Zero on 2021-04-13

CVE-2021-21227 CVE-2021-21228 CVE-2021-21229 CVE-2021-21230 CVE-2021-21231 CVE-2021-21232 CVE-2021-21233 https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_26.html 2021-04-26 2021-04-27 sbibboleth-sp -- denial of service vulnerability shibboleth-sp 3.0.0 3.2.1_1

Shibboleth project reports:

Session recovery feature contains a null pointer deference.

The cookie-based session recovery feature added in V3.0 contains a flaw that is exploitable on systems *not* using the feature if a specially crafted cookie is supplied.

This manifests as a crash in the shibd daemon/service process.

Because it is very simple to trigger this condition remotely, it results in a potential denial of service condition exploitable by a remote, unauthenticated attacker.

https://shibboleth.net/community/advisories/secadv_20210426.txt 2021-04-23 2021-04-26 zeek -- null-pointer dereference vulnerability zeek 4.0.1

Jon Siwek of Corelight reports:

Fix null-pointer dereference when encountering an invalid enum name in a config/input file that tries to read it into a set[enum]. For those that have such an input feed whose contents may come from external/remote sources, this is a potential DoS vulnerability.

https://github.com/zeek/zeek/releases/tag/v4.0.1 2021-04-01 2021-04-21 openvpn -- deferred authentication can be bypassed in specific circumstances openvpn 2.5.2 openvpn-mbedtls 2.5.2

Gert Döring reports:

OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with deferred authentication, which can be used to potentially trigger further information leaks.

https://community.openvpn.net/openvpn/wiki/CVE-2020-15078 https://github.com/OpenVPN/openvpn/blob/release/2.5/Changes.rst#overview-of-changes-in-252 CVE-2020-15078 2021-03-02 2021-04-21 chromium -- multiple vulnerabilities chromium 90.0.4430.85

Chrome Reelases reports:

This release includes 7 security fixes, including:

1194046] High CVE-2021-21222: Heap buffer overflow in V8. Reported by Guang Gong of Alpha Lab, Qihoo 360 on 2021-03-30

[1195308] High CVE-2021-21223: Integer overflow in Mojo. Reported by Guang Gong of Alpha Lab, Qihoo 360 on 2021-04-02

[1195777] High CVE-2021-21224: Type Confusion in V8. Reported by Jose Martinez (tr0y4) from VerSprite Inc. on 2021-04-05

[1195977] High CVE-2021-21225: Out of bounds memory access in V8. Reported by Brendon Tiszka (@btiszka) supporting the EFF on 2021-04-05

[1197904] High CVE-2021-21226: Use after free in navigation. Reported by Brendon Tiszka (@btiszka) supporting the EFF on 2021-04-11

CVE-2021-21222 CVE-2021-21223 CVE-2021-21224 CVE-2021-21225 CVE-2021-21226 https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_20.html 2021-04-20 2021-04-21 jenkins -- Denial of service vulnerability in bundled Jetty jenkins 2.286 jenkins-lts 2.277.3

Jenkins Security Advisory:

Description

(High) JENKINS-65280 / CVE-2021-28165

Denial of service vulnerability in bundled Jetty

https://www.jenkins.io/security/advisory/2021-04-20/ 2021-04-20 2021-04-20 MySQL -- Multiple vulnerabilities mysql57-server 5.7.34 mysql80-server 8.0.24

Oracle reports:

This Critical Patch Update contains 49 new security patches for Oracle MySQL. 10 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.
The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle MySQL is 9.8.

https://www.oracle.com/security-alerts/cpuapr2021.html 2021-04-20 2021-04-20 All versions of Apache OpenOffice through 4.1.9 can open non-http(s) hyperlinks. If the link is specifically crafted this could lead to untrusted code execution. apache-openoffice 4.1.10 apache-openoffice-devel - 4.2.1612022694,4 + 4.2.1619649022,4

The Apache Openofffice project reports:

The project received a report that all versions of Apache OpenOffice through 4.1.8 can open non-http(s) hyperlinks. The problem has existed since about 2006 and the issue is also in 4.1.9. If the link is specifically crafted this could lead to untrusted code execution. It is always best practice to be careful opening documents from unknown and unverified sources. The mitigation in Apache OpenOffice 4.1.10 (unreleased) assures that a security warning is displayed giving the user the option of continuing to open the hyperlink.

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30245 CVE-2021-30245 2021-01-25 2021-04-20 Apache Maven -- multiple vulnerabilities maven 3.8.1

The Apache Maven project reports:

We received a report from Jonathan Leitschuh about a vulnerability of custom repositories in dependency POMs. We've split this up into three separate issues:

Possible Man-In-The-Middle-Attack due to custom repositories using HTTP. More and more repositories use HTTPS nowadays, but this hasn't always been the case. This means that Maven Central contains POMs with custom repositories that refer to a URL over HTTP. This makes downloads via such repository a target for a MITM attack. At the same time, developers are probably not aware that for some downloads an insecure URL is being used. Because uploaded POMs to Maven Central are immutable, a change for Maven was required. To solve this, we extended the mirror configuration with blocked parameter, and we added a new external:http:* mirror selector (like existing external:*), meaning "any external URL using HTTP". The decision was made to block such external HTTP repositories by default: this is done by providing a mirror in the conf/settings.xml blocking insecure HTTP external URLs.

Possible Domain Hijacking due to custom repositories using abandoned domains Sonatype has analyzed which domains were abandoned and has claimed these domains.

Possible hijacking of downloads by redirecting to custom repositories This one was the hardest to analyze and explain. The short story is: you're safe, dependencies are only downloaded from repositories within their context. So there are two main questions: what is the context and what is the order? The order is described on the Repository Order page. The first group of repositories are defined in the settings.xml (both user and global). The second group of repositories are based on inheritence, with ultimately the super POM containing the URL to Maven Central. The third group is the most complex one but is important to understand the term context: repositories from the effective POMs from the dependency path to the artifact. So if a dependency was defined by another dependency or by a Maven project, it will also include their repositories. In the end this is not a bug, but a design feature.

http://maven.apache.org/docs/3.8.1/release-notes.html#cve-2021-26291 CVE-2021-26291 CVE-2020-13956 2021-04-04 2021-04-19 Consul -- Multiple vulnerabilities consul 1.9.5

Hashicorp reports:

Add content-type headers to raw KV responses to prevent XSS attacks (CVE-2020-25864). audit-logging: Parse endpoint URL to prevent requests from bypassing the audit log (CVE-2021-28156).

https://github.com/hashicorp/consul/releases/tag/v1.9.5 CVE-2020-25864 CVE-2021-28156 2021-04-15 2021-04-17 AccountService -- Insufficient path check in user_change_icon_file_authorized_cb() accountsservice 0.6.50

NVD reports:

Directory Traversal with ../ sequences occurs in AccountsService before 0.6.50 because of an insufficient path check in user_change_icon_file_authorized_cb() in user.c.

http://www.openwall.com/lists/oss-security/2018/07/02/2 https://nvd.nist.gov/vuln/detail/CVE-2018-14036 https://www.securityfocus.com/bid/104757 https://bugs.freedesktop.org/show_bug.cgi?id=107085 https://bugzilla.suse.com/show_bug.cgi?id=1099699 https://cgit.freedesktop.org/accountsservice/commit/?id=f9abd359f71a5bce421b9ae23432f539a067847a CVE-2018-14036 2018-07-13 2021-04-15 mdbook -- XSS in mdBook's search page mdbook 0.4.5

Rust Security Response Working Group reports:

The search feature of mdBook (introduced in version 0.1.4) was affected by a cross site scripting vulnerability that allowed an attacker to execute arbitrary JavaScript code on an user's browser by tricking the user into typing a malicious search query, or tricking the user into clicking a link to the search page with the malicious search query prefilled. mdBook 0.4.5 fixes the vulnerability by properly escaping the search query.

https://github.com/rust-lang/mdBook/blob/master/CHANGELOG.md#mdbook-045 https://github.com/rust-lang/mdBook/commit/32abeef088e98327ca0dfccdad92e84afa9d2e9b https://github.com/rust-lang/mdBook/security/advisories/GHSA-gx5w-rrhp-f436 https://groups.google.com/g/rustlang-security-announcements/c/3-sO6of29O0?pli=1 https://nvd.nist.gov/vuln/detail/CVE-2020-26297 CVE-2020-26297 2021-04-01 2021-04-15 Gitlab -- Vulnerabilities gitlab-ce 13.10.013.10.3 13.9.013.9.6 7.1213.8.8

SO-AND-SO reports:

Remote code execution when uploading specially crafted image files

Update Rexml

https://about.gitlab.com/releases/2021/04/14/security-release-gitlab-13-10-3-released/ CVE-2021-28965 2021-04-14 2021-04-15 chromium -- multiple vulnerabilities chromium 90.0.4430.72

Chrome Releases reports:

This release contains 37 security fixes, including:

[1025683] High CVE-2021-21201: Use after free in permissions. Reported by Gengming Liu, Jianyu Chen at Tencent Keen Security Lab on 2019-11-18

[1188889] High CVE-2021-21202: Use after free in extensions. Reported by David Erceg on 2021-03-16

[1192054] High CVE-2021-21203: Use after free in Blink. Reported by asnine on 2021-03-24

[1189926] High CVE-2021-21204: Use after free in Blink. Reported by Chelse Tsai-Simek, Jeanette Ulloa, and Emily Voigtlander of Seesaw on 2021-03-19

[1165654] High CVE-2021-21205: Insufficient policy enforcement in navigation. Reported by Alison Huffman, Microsoft Browser Vulnerability Research on 2021-01-12

[1195333] High CVE-2021-21221: Insufficient validation of untrusted input in Mojo. Reported by Guang Gong of Alpha Lab, Qihoo 360 on 2021-04-02

[1185732] Medium CVE-2021-21207: Use after free in IndexedDB. Reported by koocola (@alo_cook) and Nan Wang (@eternalsakura13) of 360 Alpha Lab on 2021-03-08

[1039539] Medium CVE-2021-21208: Insufficient data validation in QR scanner. Reported by Ahmed Elsobky (@0xsobky) on 2020-01-07

[1143526] Medium CVE-2021-21209: Inappropriate implementation in storage. Reported by Tom Van Goethem (@tomvangoethem) on 2020-10-29

[1184562] Medium CVE-2021-21210: Inappropriate implementation in Network. Reported by @bananabr on 2021-03-04

[1103119] Medium CVE-2021-21211: Inappropriate implementation in Navigation. Reported by Akash Labade (m0ns7er) on 2020-07-08

[1145024] Medium CVE-2021-21212: Incorrect security UI in Network Config UI. Reported by Hugo Hue and Sze Yiu Chau of the Chinese University of Hong Kong on 2020-11-03

[1161806] Medium CVE-2021-21213: Use after free in WebMIDI. Reported by raven (@raid_akame) on 2020-12-25

[1170148] Medium CVE-2021-21214: Use after free in Network API. Reported by Anonymous on 2021-01-24

[1172533] Medium CVE-2021-21215: Inappropriate implementation in Autofill. Reported by Abdulrahman Alqabandi, Microsoft Browser Vulnerability Research on 2021-01-30

[1173297] Medium CVE-2021-21216: Inappropriate implementation in Autofill. Reported by Abdulrahman Alqabandi, Microsoft Browser Vulnerability Research on 2021-02-02

[1166462] Low CVE-2021-21217: Uninitialized Use in PDFium. Reported by Zhou Aiting (@zhouat1) of Qihoo 360 Vulcan Team on 2021-01-14

[1166478] Low CVE-2021-21218: Uninitialized Use in PDFium. Reported by Zhou Aiting (@zhouat1) of Qihoo 360 Vulcan Team on 2021-01-14

[1166972] Low CVE-2021-21219: Uninitialized Use in PDFium. Reported by Zhou Aiting (@zhouat1) of Qihoo 360 Vulcan Team on 2021-01-15

CVE-2021-21201 CVE-2021-21202 CVE-2021-21203 CVE-2021-21204 CVE-2021-21205 CVE-2021-21221 CVE-2021-21207 CVE-2021-21208 CVE-2021-21209 CVE-2021-21210 CVE-2021-21211 CVE-2021-21212 CVE-2021-21213 CVE-2021-21214 CVE-2021-21215 CVE-2021-21216 CVE-2021-21217 CVE-2021-21218 CVE-2021-21219 https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_14.html 2021-04-14 2021-04-15 chromium -- multiple vulnerabilities chromium 89.0.4389.128

Chrome Releases reports:

This release contains two security fixes:

[1196781] High CVE-2021-21206: Use after free in Blink. Reported by Anonymous on 2021-04-07

[1196683] High CVE-2021-21220: Insufficient validation of untrusted input in V8 for x86_64. Reported by Bruno Keith (@bkth_) and Niklas Baumstark (@_niklasb) of Dataflow Security (@dfsec_it) via ZDI (ZDI-CAN-13569) on 2021-04-07>

CVE-2021-21206 CVE-2021-21220 https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop.html 2021-04-13 2021-04-14 xorg-server -- Input validation failures in X server XInput extension xorg-server 1.20.11,1 xwayland 1.20.11,1 xwayland-devel 1.20.0.877

X.Org server security reports for release 1.20.11:

Fix XChangeFeedbackControl() request underflow

.

https://gitlab.freedesktop.org/xorg/xserver/-/tags/xorg-server-1.20.11 2021-04-13 2021-04-13 gitea -- multiple vulnerabilities gitea 1.14.0

The Gitea Team reports for release 1.14.0:

Validate email in external authenticator registration form

Ensure validation occurs on clone addresses too

https://github.com/go-gitea/gitea/releases/tag/v1.14.0 ports/254976 2021-03-11 2021-04-11 syncthing -- crash due to malformed relay protocol message syncthing 1.15.0

syncthing developers report:

syncthing can be caused to crash and exit if sent a malformed relay protocol message message with a negative length field.

The relay server strelaysrv can be caused to crash and exit if sent a malformed relay protocol message with a negative length field.

CVE-2021-21404 https://github.com/syncthing/syncthing/security/advisories/GHSA-x462-89pf-6r5h 2021-04-06 2021-04-12 python -- Information disclosure via pydoc -p: /getfile?key=path allows to read arbitrary file on the filesystem python38 3.8.9 python39 3.9.3

David Schwörer reports:

Remove the getfile feature of the pydoc module which could be abused to read arbitrary files on the disk (directory traversal vulnerability). Moreover, even source code of Python modules can contain sensitive data like passwords.

CVE-2021-3426 https://pythoninsider.blogspot.com/2021/04/python-393-and-389-are-now-available.html https://bugs.python.org/issue42988 2021-01-21 2021-04-10 curl -- TLS 1.3 session ticket proxy host mixup curl 7.63.07.76.0

Daniel Stenberg reports:

Enabled by default, libcurl supports the use of TLS 1.3 session tickets to resume previous TLS sessions to speed up subsequent TLS handshakes.

When using a HTTPS proxy and TLS 1.3, libcurl can confuse session tickets arriving from the HTTPS proxy but work as if they arrived from the remote server and then wrongly "short-cut" the host handshake. The reason for this confusion is the modified sequence from TLS 1.2 when the session ids would provided only during the TLS handshake, while in TLS 1.3 it happens post hand-shake and the code was not updated to take that changed behavior into account.

When confusing the tickets, a HTTPS proxy can trick libcurl to use the wrong session ticket resume for the host and thereby circumvent the server TLS certificate check and make a MITM attack to be possible to perform unnoticed.

This flaw can allow a malicious HTTPS proxy to MITM the traffic. Such a malicious HTTPS proxy needs to provide a certificate that curl will accept for the MITMed server for an attack to work - unless curl has been told to ignore the server certificate check.

CVE-2021-22890 https://curl.se/docs/CVE-2021-22890.html 2021-03-31 2021-04-10 curl -- Automatic referer leaks credentials curl 7.1.17.76.0

Daniel Stenberg reports:

libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request.

libcurl automatically sets the Referer: HTTP request header field in outgoing HTTP requests if the CURLOPT_AUTOREFERER option is set. With the curl tool, it is enabled with --referer ";auto".

CVE-2021-22876 https://curl.se/docs/CVE-2021-22876.html 2021-03-31 2021-04-10 gitea -- multiple vulnerabilities gitea 1.13.7

The Gitea Team reports for release 1.13.7:

Update to bluemonday-1.0.6

Clusterfuzz found another way

https://github.com/go-gitea/gitea/releases/tag/v1.13.7 ports/254930 2021-04-07 2021-04-09 clamav -- Multiple vulnerabilites clamav 0.103.2,1

Micah Snyder reports:

CVE-2021-1252

Excel XLM parser infinite loop

CVE-2021-1404

PDF parser buffer over-read; possible crash.

CVE-2021-1405

Mail parser NULL-dereference crash.

CVE-2021-1252 CVE-2021-1404 CVE-2021-1405 https://blog.clamav.net/2021/04/clamav-01032-security-patch-release.html 2021-04-07 2021-04-07 jenkins -- multiple vulnerabilities jenkins 2.287 jenkins-lts 2.277.2

Jenkins Security Advisory:

Description

(Low) SECURITY-1721 / CVE-2021-21639

Lack of type validation in agent related REST API

(Medium) SECURITY-1871 / CVE-2021-21640

View name validation bypass

https://www.jenkins.io/security/advisory/2021-04-07/ 2021-04-07 2021-04-08 Node.js -- April 2021 Security Releases node10 10.24.1 node12 12.22.1 node14 14.16.1 node 15.14.0

Node.js reports:

OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (High) (CVE-2021-3450)

This is a vulnerability in OpenSSL which may be exploited through Node.js. You can read more about it in https://www.openssl.org/news/secadv/20210325.txt

OpenSSL - NULL pointer deref in signature_algorithms processing (High) (CVE-2021-3449)

This is a vulnerability in OpenSSL which may be exploited through Node.js. You can read more about it in https://www.openssl.org/news/secadv/20210325.txt

npm upgrade - Update y18n to fix Prototype-Pollution (High) (CVE-2020-7774)

This is a vulnerability in the y18n npm module which may be exploited by prototype pollution. You can read more about it in https://github.com/advisories/GHSA-c4w7-xm78-47vh

https://nodejs.org/en/blog/vulnerability/april-2021-security-releases/ https://www.openssl.org/news/secadv/20210325.txt https://github.com/advisories/GHSA-c4w7-xm78-47vh CVE-2021-3450 CVE-2021-3449 CVE-2020-7774 2021-04-06 2021-04-07 FreeBSD -- jail escape possible by mounting over jail root FreeBSD-kernel 12.212.2_6 11.411.4_9

Problem Description:

Due to a race condition between lookup of ".." and remounting a filesystem, a process running inside a jail might access filesystem hierarchy outside of jail.

Impact:

A process with superuser privileges running inside a jail configured with the allow.mount permission (not enabled by default) could change the root directory outside of the jail, and thus gain full read and write access to all files and directories in the system.

CVE-2020-25584 SA-21:10.jail_mount 2021-04-06 2021-04-07 FreeBSD -- double free in accept_filter(9) socket configuration interface FreeBSD-kernel 12.212.2_6

Problem Description:

An unprivileged process can configure an accept filter on a listening socket. This is done using the setsockopt(2) system call. The process supplies the name of the accept filter which is to be attached to the socket, as well as a string containing filter-specific information.

If the filter implements the accf_create callback, the socket option handler attempts to preserve the process-supplied argument string. A bug in the socket option handler caused this string to be freed prematurely, leaving a dangling pointer. Additional operations on the socket can turn this into a double free or a use-after-free.

Impact:

The bug may be exploited to trigger local privilege escalation or kernel memory disclosure.

CVE-2021-29627 SA-21:09.accept_filter 2021-04-06 2021-04-07 FreeBSD -- Memory disclosure by stale virtual memory mapping FreeBSD-kernel 12.212.2_6 11.411.4_9

Problem Description:

A particular case of memory sharing is mishandled in the virtual memory system. It is possible and legal to establish a relationship where multiple descendant processes share a mapping which shadows memory of an ancestor process. In this scenario, when one process modifies memory through such a mapping, the copy-on-write logic fails to invalidate other mappings of the source page. These stale mappings may remain even after the mapped pages have been reused for another purpose.

Impact:

An unprivileged local user process can maintain a mapping of a page after it is freed, allowing that process to read private data belonging to other processes or the kernel.

CVE-2021-29626 SA-21:08.vm 2021-04-06 2021-04-07 upnp -- stack overflow vulnerability upnp 1.14.5,1

Mitre reports:

A stack overflow in pupnp 1.16.1 can cause the denial of service through the Parser_parseDocument() function. ixmlNode_free() will release a child node recursively, which will consume stack space and lead to a crash.

CVE-2021-28302 https://github.com/pupnp/pupnp/issues/249 2021-03-12 2021-04-06 ruby -- XML round-trip vulnerability in REXML ruby 2.5.0,12.5.9,1 2.6.0,12.6.7,1 2.7.0,12.7.3,1 3.0.0.p1,13.0.1,1 rubygem-rexml 3.2.5

Juho Nurminen reports:

When parsing and serializing a crafted XML document, REXML gem (including the one bundled with Ruby) can create a wrong XML document whose structure is different from the original one. The impact of this issue highly depends on context, but it may lead to a vulnerability in some programs that are using REXML.

CVE-2021-28965 https://www.ruby-lang.org/en/news/2021/04/05/xml-round-trip-vulnerability-in-rexml-cve-2021-28965/ 2021-04-05 2021-04-05 chromium -- multiple vulnerabilities chromium 89.0.4389.114

Chrome Releases reports:

This update contains 8 security fixes, including:

[1181228] High CVE-2021-21194: Use after free in screen capture. Reported by Leecraso and Guang Gong of 360 Alpha Lab on 2021-02-23

[1182647] High CVE-2021-21195: Use after free in V8. Reported by Bohan Liu (@P4nda20371774) and Moon Liang of Tencent Security Xuanwu Lab on 2021-02-26

[1175992] High CVE-2021-21196: Heap buffer overflow in TabStrip. Reported by Khalil Zhani on 2021-02-08

[1173903] High CVE-2021-21197: Heap buffer overflow in TabStrip. Reported by Abdulrahman Alqabandi, Microsoft Browser Vulnerability Research on 2021-02-03

[1184399] High CVE-2021-21198: Out of bounds read in IPC. Reported by Mark Brand of Google Project Zero on 2021-03-03

[1179635] High CVE-2021-21199: Use Use after free in Aura. Reported by Weipeng Jiang (@Krace) from Codesafe Team of Legendsec at Qi'anxin Group and Evangelos Foutras

CVE-2021-21194 CVE-2021-21195 CVE-2021-21196 CVE-2021-21197 CVE-2021-21198 CVE-2021-21199 https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-desktop_30.html 2021-03-31 2021-03-31 Gitlab -- Multiple vulnerabilities gitlab-ce 13.10.013.10.1 13.9.013.9.5 913.8.7

Gitlab reports:

Arbitrary File Read During Project Import

Kroki Arbitrary File Read/Write

Stored Cross-Site-Scripting in merge requests

Access data of an internal project through a public project fork as an anonymous user

Incident metric images can be deleted by any user

Infinite Loop When a User Access a Merge Request

Stored XSS in scoped labels

Admin CSRF in System Hooks Execution Through API

Update OpenSSL dependency

Update PostgreSQL dependency

https://about.gitlab.com/releases/2021/03/31/security-release-gitlab-13-10-1-released/ 2021-03-31 2021-04-06 samba -- Multiple Vulnerabilities samba411 4.11.15 samba412 4.12.14 samba413 4.13.7 samba414 4.14.2

The Samba Team reports:

CVE-2020-27840: An anonymous attacker can crash the Samba AD DC LDAP server by sending easily crafted DNs as part of a bind request. More serious heap corruption is likely also possible.

CVE-2021-20277: User-controlled LDAP filter strings against the AD DC LDAP server may crash the LDAP server.

https://www.samba.org/samba/security/CVE-2020-27840.html https://www.samba.org/samba/security/CVE-2021-20277.html CVE-2020-27840 CVE-2021-20277 2021-03-24 2021-03-28 nettle 3.7.2 -- fix serious ECDSA signature verify bug nettle 3.7.2 linux-c7-nettle 3.7.2

Niels Möller reports:

I've prepared a new bug-fix release of Nettle, a low-level cryptographics library, to fix a serious bug in the function to verify ECDSA signatures. Implications include an assertion failure, which could be used for denial-of-service, when verifying signatures on the secp_224r1 and secp521_r1 curves.

Even when no assert is triggered in ecdsa_verify, ECC point multiplication may get invalid intermediate values as input, and produce incorrect results. [...] It appears difficult to construct an alleged signature that makes the function misbehave in such a way that an invalid signature is accepted as valid, but such attacks can't be ruled out without further analysis.

https://lists.lysator.liu.se/pipermail/nettle-bugs/2021/009458.html 2021-03-21 2021-03-27 OpenSSL -- Multiple vulnerabilities openssl 1.1.1k,1 FreeBSD 12.212.2_5

The OpenSSL project reports:

High: CA certificate check bypass with X509_V_FLAG_X509_STRICT (CVE-2021-3450)
The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default.

High: NULL pointer deref in signature_algorithms processing (CVE-2021-3449)
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack.

https://www.openssl.org/news/secadv/20210325.txt CVE-2021-3449 CVE-2021-3450 SA-21:07.openssl 2021-03-25 2021-03-26 2021-04-07 spamassassin -- Malicious rule configuration (.cf) files can be configured to run system commands spamassassin 3.4.5

The Apache SpamAssassin project reports:

Apache SpamAssassin 3.4.5 was recently released [1], and fixes an issue of security note where malicious rule configuration (.cf) files can be configured to run system commands.

In Apache SpamAssassin before 3.4.5, exploits can be injected in a number of scenarios. In addition to upgrading to SA 3.4.5, users should only use update channels or 3rd party .cf files from trusted places.

https://spamassassin.apache.org/news.html https://mail-archives.apache.org/mod_mbox/spamassassin-announce/202103.mbox/%3C5b7cfd35-27b7-584b-1b39-b7ff0a55f586%40apache.org%3E https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-1946 CVE-2020-1946 2021-03-24 2021-03-24 gitea -- multiple vulnerabilities gitea 1.13.6

The Gitea Team reports for release 1.13.6:

Fix bug on avatar middleware

Fix another clusterfuzz identified issue

https://github.com/go-gitea/gitea/releases/tag/v1.13.5 ports/254515 2021-03-21 2021-03-23 gitea -- quoting in markdown text gitea 1.13.5

The Gitea Team reports for release 1.13.5:

Update to goldmark 1.3.3

https://github.com/go-gitea/gitea/releases/tag/v1.13.5 ports/254130 2021-03-20 2021-03-21 OpenSSH -- Double-free memory corruption in ssh-agent openssh-portable openssh-portable-hpn openssh-portable-gssapi 8.2.p1,18.4.p1_4,1

OpenBSD Project reports:

ssh-agent(1): fixed a double-free memory corruption that was introduced in OpenSSH 8.2 . We treat all such memory faults as potentially exploitable. This bug could be reached by an attacker with access to the agent socket.

On modern operating systems where the OS can provide information about the user identity connected to a socket, OpenSSH ssh-agent and sshd limit agent socket access only to the originating user and root. Additional mitigation may be afforded by the system's malloc(3)/free(3) implementation, if it detects double-free conditions.

The most likely scenario for exploitation is a user forwarding an agent either to an account shared with a malicious user or to a host with an attacker holding root access.

CVE-2021-28041 https://www.openssh.com/txt/release-8.5 2021-03-03 2021-03-13 2021-04-20 Gitlab -- Multiple vulnerabilities gitlab-ce 13.9.013.9.4 13.8.013.8.6 13.2.013.7.9

Gigtlab reports:

Remote code execution via unsafe user-controlled markdown rendering options

https://about.gitlab.com/releases/2021/03/17/security-release-gitlab-13-9-4-released/ 2021-03-17 2021-03-18 dnsmasq -- cache poisoning vulnerability in certain configurations dnsmasq 2.85.r1,1 dnsmasq-devel 2.85.r1,3

Simon Kelley reports:

[In configurations where the forwarding server address contains an @ character for specifying a sending interface or source address, the] random source port behavior was disabled, making cache poisoning attacks possible.

This only affects configurations of the form server=1.1.1.1@em0 or server=1.1.1.1@192.0.2.1, i. e. those that specify an interface to send through, or an IP address to send from, or use together with NetworkManager.

https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2021q1/014835.html CVE-2021-3448 2021-03-17 2021-03-18 minio -- MITM attack minio 2021.03.17.02.33.02

minio developer report:

This is a security issue because it enables MITM modification of request bodies that are meant to have integrity guaranteed by chunk signatures.

In a PUT request using aws-chunked encoding, MinIO ordinarily verifies signatures at the end of a chunk. This check can be skipped if the client sends a false chunk size that is much greater than the actual data sent: the server accepts and completes the request without ever reaching the end of the chunk + thereby without ever checking the chunk signature.

https://github.com/minio/minio/security/advisories/GHSA-xr7r-7gpj-5pgp 2021-03-17 2021-03-17 LibreSSL -- use-after-free libressl 3.2.4_1

OpenBSD reports:

A TLS client using session resumption may cause a use-after-free.

https://marc.info/?l=openbsd-announce&m=161582456312832&w=2 https://ftp.openbsd.org/pub/OpenBSD/patches/6.8/common/017_libssl.patch.sig 2021-03-15 2021-03-16 chromium -- multiple vulnerabilities chromium 89.0.4389.90

Chrome Releases reports:

This release includes 5 security fixes, including:

[1167357] High CVE-2021-21191: Use after free in WebRTC. Reported by raven (@raid_akame) on 2021-01-15

[1181387] High CVE-2021-21192: Heap buffer overflow in tab groups. Reported by Abdulrahman Alqabandi, Microsoft Browser Vulnerability Research on 2021-02-23

[1186287] High CVE-2021-21193: Use after free in Blink. Reported by Anonymous on 2021-03-09

CVE-2021-11191 CVE-2021-11192 CVE-2021-11193 https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-desktop_12.html 2021-03-12 2021-03-16 squashfs-tools -- Integer overflow squashfs-tools 4.4

Phillip Lougher reports:

Integer overflow in the read_fragment_table_4 function in unsquash-4.c in Squashfs and sasquatch allows remote attackers to cause a denial of service (application crash) via a crafted input, which triggers a stack-based buffer overflow.

CVE-2015-4645 https://nvd.nist.gov/vuln/detail/CVE-2015-4645 2017-03-17 2021-03-15 go -- encoding/xml: infinite loop when using xml.NewTokenDecoder with a custom TokenReader; archive/zip: panic when calling Reader.Open go 1.16.1,1

The Go project reports:

The Decode, DecodeElement, and Skip methods of an xml.Decoder provided by xml.NewTokenDecoder may enter an infinite loop when operating on a custom xml.TokenReader which returns an EOF in the middle of an open XML element.

The Reader.Open API, new in Go 1.16, will panic when used on a ZIP archive containing files that start with "../".

CVE-2021-27918 http://golang.org/issue/44913 CVE-2021-27919 http://golang.org/issue/44916 2021-03-05 2021-03-10 gitea -- multiple vulnerabilities gitea 1.13.4

The Gitea Team reports for release 1.13.3:

Turn default hash password algorithm back to pbkdf2 from argon2 until we find a better one

The Gitea Team reports for release 1.13.4:

Fix issue popups

https://github.com/go-gitea/gitea/releases/tag/v1.13.3 https://github.com/go-gitea/gitea/releases/tag/v1.13.4 ports/254130 2021-01-07 2021-02-06 mantis -- multiple vulnerabilities mantis-php72 mantis-php73 mantis-php74 mantis-php80 2.24.4,1

Mantis 2.24.4 release reports:

Security and maintenance release, addressing 6 CVEs:

0027726: CVE-2020-29603: disclosure of private project name

0027727: CVE-2020-29605: disclosure of private issue summary

0027728: CVE-2020-29604: full disclosure of private issue contents, including bugnotes and attachments

0027361: Private category can be access/used by a non member of a private project (IDOR)

0027779: CVE-2020-35571: XSS in helper_ensure_confirmed() calls

0026794: User Account - Takeover

0027363: Fixed in version can be changed to a version that doesn't exist

0027350: When updating an issue, a Viewer user can be set as Reporter

0027370: CVE-2020-35849: Revisions allow viewing private bugnotes id and summary

0027495: CVE-2020-28413: SQL injection in the parameter "access" on the mc_project_get_users function throught the API SOAP.

0027444: Printing unsanitized user input in install.php

CVE-2020-28413 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28413 CVE-2020-35849 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35849 2020-11-10 2021-03-10 Node.js -- February 2021 Security Releases node10 10.24.0 node12 12.21.0 node14 14.16.0 node 15.10.0

Node.js reports:

HTTP2 'unknownProtocol' cause Denial of Service by resource exhaustion (Critical) (CVE-2021-22883)

Affected Node.js versions are vulnerable to denial of service attacks when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also from opening, e.g. a file. If no file descriptor limit is configured, then this lead to an excessive memory usage and cause the system to run out of memory.

DNS rebinding in --inspect (CVE-2021-22884)

Affected Node.js versions are vulnerable to a DNS rebinding attack when the whitelist includes "localhost6". When "localhost6" is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the "localhost6" domain. As long as the attacker uses the "localhost6" domain, they can still apply the attack described in CVE-2018-7160.

OpenSSL - Integer overflow in CipherUpdate (CVE-2021-23840)

This is a vulnerability in OpenSSL which may be exploited through Node.js. You can read more about it in https://www.openssl.org/news/secadv/20210216.txt

https://nodejs.org/en/blog/vulnerability/february-2021-security-releases/ CVE-2021-22883 CVE-2021-22884 CVE-2021-23840 2021-02-23 2021-03-09 Gitlab -- Multiple vulnerabilities gitlab-ce 13.9.013.9.2 13.8.013.8.5 13.7.8

Gitlab reports:

JWT token leak via Workhorse

Stored XSS in wiki pages

Group Maintainers are able to use the Group CI/CD Variables API

Insecure storage of GitLab session keys

https://about.gitlab.com/releases/2021/03/04/security-release-gitlab-13-9-2-released/ CVE-2021-22185 CVE-2021-22186 2021-03-04 2021-03-05 asterisk -- Crash when negotiating T.38 with a zero port asterisk16 16.16.2 asterisk18 18.2.2

The Asterisk project reports:

When Asterisk sends a re-invite initiating T.38 faxing and the endpoint responds with a m=image line and zero port, a crash will occur in Asterisk. This is a reoccurrence of AST-2019-004.

CVE-2019-15297 https://downloads.asterisk.org/pub/security/AST-2021-006.html 2021-02-20 2021-03-04 chromium -- multiple vulnerabilities chromium 89.0.4389.72

Chrome Releases reports:

This release includes 47 security fixes, including the below. Google is aware of reports that an exploit for CVE-2021-21166 exists in the wild.

[1171049] High CVE-2021-21159: Heap buffer overflow in TabStrip. Reported by Khalil Zhani on 2021-01-27

[1170531] High CVE-2021-21160: Heap buffer overflow in WebAudio. Reported by Marcin 'Icewall' Noga of Cisco Talos on 2021-01-25

[1173702] High CVE-2021-21161: Heap buffer overflow in TabStrip. Reported by Khalil Zhani on 2021-02-02

[1172054] High CVE-2021-21162: Use after free in WebRTC. Reported by Anonymous on 2021-01-29

[1111239] High CVE-2021-21163: Insufficient data validation in Reader Mode. Reported by Alison Huffman, Microsoft Browser Vulnerability Research on 2020-07-30

[1164846] High CVE-2021-21164: Insufficient data validation in Chrome for iOS. Reported by Muneaki Nishimura (nishimunea) on 2021-01-11

[1174582] High CVE-2021-21165: Object lifecycle issue in audio. Reported by Alison Huffman, Microsoft Browser Vulnerability Research on 2021-02-04

[1177465] High CVE-2021-21166: Object lifecycle issue in audio. Reported by Alison Huffman, Microsoft Browser Vulnerability Research on 2021-02-11

[1161144] Medium CVE-2021-21167: Use after free in bookmarks. Reported by Leecraso and Guang Gong of 360 Alpha Lab on 2020-12-22

[1152226] Medium CVE-2021-21168: Insufficient policy enforcement in appcache. Reported by Luan Herrera (@lbherrera_) on 2020-11-24

[1166138] Medium CVE-2021-21169: Out of bounds memory access in V8. Reported by Bohan Liu (@P4nda20371774) and Moon Liang of Tencent Security Xuanwu Lab on 2021-01-13

[1111646] Medium CVE-2021-21170: Incorrect security UI in Loader. Reported by David Erceg on 2020-07-31

[1152894] Medium CVE-2021-21171: Incorrect security UI in TabStrip and Navigation. Reported by Irvan Kurniawan (sourc7) on 2020-11-25

[1150810] Medium CVE-2021-21172: Insufficient policy enforcement in File System API. Reported by Maciej Pulikowski on 2020-11-19

[1154250] Medium CVE-2021-21173: Side-channel information leakage in Network Internals. Reported by Tom Van Goethem from imec-DistriNet, KU Leuven on 2020-12-01

[1158010] Medium CVE-2021-21174: Inappropriate implementation in Referrer. Reported by Ashish Gautam Kamble on 2020-12-11

[1146651] Medium CVE-2021-21175: Inappropriate implementation in Site isolation. Reported by Jun Kokatsu, Microsoft Browser Vulnerability Research on 2020-11-07

[1170584] Medium CVE-2021-21176: Inappropriate implementation in full screen mode. Reported by Luan Herrera (@lbherrera_) on 2021-01-26

[1173879] Medium CVE-2021-21177: Insufficient policy enforcement in Autofill. Reported by Abdulrahman Alqabandi, Microsoft Browser Vulnerability Research on 2021-02-03

[1174186] Medium CVE-2021-21178: Inappropriate implementation in Compositing. Reported by Japong on 2021-02-03

[1174943] Medium CVE-2021-21179: Use after free in Network Internals. Reported by Anonymous on 2021-02-05

[1175507] Medium CVE-2021-21180: Use after free in tab search. Reported by Abdulrahman Alqabandi, Microsoft Browser Vulnerability Research on 2021-02-07

[1177875] Medium CVE-2020-27844: Heap buffer overflow in OpenJPEG. Reported by Sean Campbell at Tableau on 2021-02-12

[1182767] Medium CVE-2021-21181: Side-channel information leakage in autofill. Reported by Xu Lin (University of Illinois at Chicago), Panagiotis Ilia (University of Illinois at Chicago), Jason Polakis (University of Illinois at Chicago) on 2021-02-26

[1049265] Low CVE-2021-21182: Insufficient policy enforcement in navigations. Reported by Luan Herrera (@lbherrera_) on 2020-02-05

[1105875] Low CVE-2021-21183: Inappropriate implementation in performance APIs. Reported by Takashi Yoneuchi (@y0n3uchy) on 2020-07-15

[1131929] Low CVE-2021-21184: Inappropriate implementation in performance APIs. Reported by James Hartig on 2020-09-24

[1100748] Low CVE-2021-21185: Insufficient policy enforcement in extensions. Reported by David Erceg on 2020-06-30

[1153445] Low CVE-2021-21186: Insufficient policy enforcement in QR scanning. Reported by dhirajkumarnifty on 2020-11-28

[1155516] Low CVE-2021-21187: Insufficient data validation in URL formatting. Reported by Kirtikumar Anandrao Ramchandani on 2020-12-04

[1161739] Low CVE-2021-21188: Use after free in Blink. Reported by Woojin Oh(@pwn_expoit) of STEALIEN on 2020-12-24

[1165392] Low CVE-2021-21189: Insufficient policy enforcement in payments. Reported by Khalil Zhani on 2021-01-11

[1166091] Low CVE-2021-21190: Uninitialized Use in PDFium. Reported by Zhou Aiting(@zhouat1) of Qihoo 360 Vulcan Team on 2021-01-13

CVE-2021-21159 CVE-2021-21160 CVE-2021-21161 CVE-2021-21162 CVE-2021-21163 CVE-2021-21164 CVE-2021-21165 CVE-2021-21166 CVE-2021-21167 CVE-2021-21168 CVE-2021-21169 CVE-2021-21170 CVE-2021-21171 CVE-2021-21172 CVE-2021-21173 CVE-2021-21174 CVE-2021-21175 CVE-2021-21176 CVE-2021-21177 CVE-2021-21178 CVE-2021-21179 CVE-2021-21180 CVE-2021-21181 CVE-2021-21182 CVE-2021-21183 CVE-2021-21184 CVE-2021-21185 CVE-2021-21186 CVE-2021-21187 CVE-2021-21188 CVE-2021-21189 CVE-2021-21190 CVE-2020-27844 https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-desktop.html 2021-03-02 2021-03-04 jasper -- multiple vulnerabilities jasper 2.0.25

JasPer Releases:

- Fix memory-related bugs in the JPEG-2000 codec resulting from attempting to decode invalid code streams. (#264, #265)

This fix is associated with CVE-2021-26926 and CVE-2021-26927.

- Fix wrong return value under some compilers (#260)

- Fix CVE-2021-3272 heap buffer overflow in jp2_decode (#259)

https://github.com/jasper-software/jasper/releases CVE-2021-26926 CVE-2021-26927 CVE-2021-3272 2021-02-07 2021-03-03 salt -- multiple vulnerabilities py36-salt-2019 py37-salt-2019 py38-salt-2019 py36-salt py37-salt py38-salt py39-salt 2019.2.8 30003002.5

SaltStack reports multiple security vulnerabilities in Salt

CVE-2021-3197: The Salt-API.s SSH client is vulnerable to a shell injection by including ProxyCommand in an argument, or via ssh_options provided in an API request.

CVE-2021-25281: The Salt-API does not have eAuth credentials for the wheel_async client.

CVE-2021-25282: The salt.wheel.pillar_roots.write method is vulnerable to directory traversal.

CVE-2021-25283: The jinja renderer does not protect against server-side template injection attacks.

CVE-2021-25284: webutils write passwords in cleartext to /var/log/salt/minion

CVE-2021-3148: command injection in salt.utils.thin.gen_thin()

CVE-2020-35662: Several places where Salt was not verifying the SSL cert by default.

CVE-2021-3144: eauth Token can be used once after expiration.

CVE-2020-28972: Code base not validating SSL/TLS certificate of the server, which might allow attackers to obtain sensitive information via a man-in-the-middle attack

CVE-2020-28243: Local Privilege Escalation in the Minion.

"https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/" CVE-2021-3197 CVE-2021-25281 CVE-2021-25282 CVE-2021-25283 CVE-2021-25284 CVE-2021-3148 CVE-2020-35662 CVE-2021-3144 CVE-2020-28972 CVE-2020-28243 2021-02-25 2021-03-03 vault -- unauthenticated license read vault 1.6.3

vault developers report:

Limited Unauthenticated License Read: We addressed a security vulnerability that allowed for the unauthenticated reading of Vault licenses from DR Secondaries.

CVE-2021-27668 https://github.com/hashicorp/vault/releases/tag/v1.6.3 2021-02-26 2021-02-27 FreeBSD -- jail_remove(2) fails to kill all jailed processes FreeBSD-kernel 12.212.2_4 11.411.4_8

Problem Description:

Due to a race condition in the jail_remove(2) implementation, it may fail to kill some of the processes.

Impact:

A process running inside a jail can avoid being killed during jail termination. If a jail is subsequently started with the same root path, a lingering jailed process may be able to exploit the window during which a devfs filesystem is mounted but the jail's devfs ruleset has not been applied, to access device nodes which are ordinarily inaccessible. If the process is privileged, it may be able to escape the jail and gain full access to the system.

CVE-2020-25581 SA-21:04.jail_remove 2021-02-24 2021-02-25 FreeBSD -- Xen grant mapping error handling issues FreeBSD-kernel 12.212.2_4 11.411.4_8

Problem Description:

Grant mapping operations often occur in batch hypercalls, where a number of operations are done in a single hypercall, the success or failure of each one reported to the backend driver, and the backend driver then loops over the results, performing follow-up actions based on the success or failure of each operation.

Unfortunately, when running in HVM/PVH mode, the FreeBSD backend drivers mishandle this: Some errors are ignored, effectively implying their success from the success of related batch elements. In other cases, errors resulting from one batch element lead to further batch elements not being inspected, and hence successful ones to not be possible to properly unmap upon error recovery.

Impact:

A malicious or buggy frontend driver may be able to cause resource leaks in the domain running the corresponding backend driver.

CVE-2021-26932 SA-21:06.xen 2021-02-24 2021-02-25 FreeBSD -- jail_attach(2) relies on the caller to change the cwd FreeBSD-kernel 12.212.2_4 11.411.4_8

Problem Description:

When a process, such as jexec(8) or killall(1), calls jail_attach(2) to enter a jail, the jailed root can attach to it using ptrace(2) before the current working directory is changed.

Impact:

A process with superuser privileges running inside a jail could change the root directory outside of the jail, thereby gaining full read and writing access to all files and directories in the system.

CVE-2020-25582 SA-21:05.jail_chdir 2021-02-24 2021-02-25 FreeBSD -- login.access fails to apply rules FreeBSD 12.212.2_4 11.411.4_8

Problem Description:

A regression in the login.access(5) rule processor has the effect of causing rules to fail to match even when they should not. This means that rules denying access may be ignored.

Impact:

The configuration in login.access(5) may not be applied, permitting login access to users even when the system is configured to deny it.

CVE-2020-25580 SA-21:03.pam_login_access 2021-02-24 2021-02-25 redis -- Integer overflow on 32-bit systems redis-devel 6.2.0 redis 6.0.11 redis5 5.0.11

Redis Development team reports:

Redis 4.0 or newer uses a configurable limit for the maximum supported bulk input size. By default, it is 512MB which is a safe value for all platforms. If the limit is significantly increased, receiving a large request from a client may trigger several integer overflow scenarios, which would result with buffer overflow and heap corruption.

CVE-2021-21309 2021-02-22 2021-02-23 zeek -- Remote crash vulnerability zeek 3.0.13

Jon Siwek of Corelight reports:

Fix ASCII Input reader's treatment of input files containing null-bytes. An input file containing null-bytes could lead to a buffer-over-read, crash Zeek, and be exploited to cause Denial of Service.

https://github.com/zeek/zeek/releases/tag/v3.0.13 2021-02-10 2021-02-22 raptor2 -- malformed input file can lead to a segfault raptor2 2.0.15_17

Redland Issue Tracker reports:

due to an out of bounds array access in raptor_xml_writer_start_element_common.

https://bugs.librdf.org/mantis/view.php?id=650 2020-11-24 2021-02-20 jenkins -- Privilege escalation vulnerability in bundled Spring Security library jenkins 2.280

Jenkins Security Advisory:

Description

(high) SECURITY-2195 / CVE-2021-22112

Privilege escalation vulnerability in bundled Spring Security library

https://www.jenkins.io/security/advisory/2021-02-19/ 2021-02-19 2021-02-20 asterisk -- Remote Crash Vulnerability in PJSIP channel driver asterisk13 13.38.2 asterisk16 16.16.1 asterisk18 18.2.1

The Asterisk project reports:

Given a scenario where an outgoing call is placed from Asterisk to a remote SIP server it is possible for a crash to occur.

CVE-2021-26906 https://downloads.asterisk.org/pub/security/AST-2021-005.html 2021-02-08 2021-02-18 asterisk -- An unsuspecting user could crash Asterisk with multiple hold/unhold requests asterisk16 16.16.016.16.1 asterisk18 18.2.018.2.1

The Asterisk project reports:

Due to a signedness comparison mismatch, an authenticated WebRTC client could cause a stack overflow and Asterisk crash by sending multiple hold/unhold requests in quick succession.

CVE-2021-26714 https://downloads.asterisk.org/pub/security/AST-2021-004.html 2021-02-11 2021-02-18 asterisk -- Remote attacker could prematurely tear down SRTP calls asterisk13 13.38.113.38.2 asterisk16 16.16.016.16.1 asterisk18 18.2.018.2.1

The Asterisk project reports:

An unauthenticated remote attacker could replay SRTP packets which could cause an Asterisk instance configured without strict RTP validation to tear down calls prematurely.

CVE-2021-26712 https://downloads.asterisk.org/pub/security/AST-2021-003.html 2021-02-18 2021-02-18 asterisk -- Remote crash possible when negotiating T.38 asterisk16 16.15.016.16.1 asterisk18 18.1.018.2.1

The Asterisk project reports:

When re-negotiating for T.38 if the initial remote response was delayed just enough Asterisk would send both audio and T.38 in the SDP. If this happened, and the remote responded with a declined T.38 stream then Asterisk would crash.

CVE-2021-26717 https://downloads.asterisk.org/pub/security/AST-2021-002.html 2021-02-05 2021-02-18 asterisk -- Remote crash in res_pjsip_diversion asterisk13 13.38.113.38.2 asterisk16 16.15.116.16.1 asterisk18 18.1.118.2.1

The Asterisk project reports:

If a registered user is tricked into dialing a malicious number that sends lots of 181 responses to Asterisk, each one will cause a 181 to be sent back to the original caller with an increasing number of entries in the "Supported" header. Eventually the number of entries in the header exceeds the size of the entry array and causes a crash.

CVE-2020-35776 https://downloads.asterisk.org/pub/security/AST-2021-001.html 2021-01-04 2021-02-18 Rails -- multiple vulnerabilities rubygem-activerecord52 5.2.4.5 rubygem-actionpack60 rubygem-activerecord60 6.0.3.5 rubygem-actionpack61 rubygem-activerecord61 6.1.2.1

Ruby on Rails blog:

Rails version 5.2.4.5, 6.0.3.5 and 6.1.2.1 have been released! Those version are security releases and addresses two issues:

CVE-2021-22880: Possible DoS Vulnerability in Active Record PostgreSQL adapter.

CVE-2021-22881: Possible Open Redirect in Host Authorization Middleware.

https://weblog.rubyonrails.org/2021/2/10/Rails-5-2-4-5-6-0-3-5-and-6-1-2-1-have-been-released/ https://discuss.rubyonrails.org/t/cve-2021-22880-possible-dos-vulnerability-in-active-record-postgresql-adapter/77129 https://discuss.rubyonrails.org/t/cve-2021-22881-possible-open-redirect-in-host-authorization-middleware/77130 CVE-2021-22880 CVE-2021-22881 2021-02-10 2021-02-17 chromium -- multiple vulnerabilities chromium 88.0.4324.182

Chrome Releases reports:

This release contains 10 security fixes, including:

[1138143] High CVE-2021-21149: Stack overflow in Data Transfer. Reported by Ryoya Tsukasaki on 2020-10-14

[1172192] High CVE-2021-21150: Use after free in Downloads. Reported by Woojin Oh(@pwn_expoit) of STEALIEN on 2021-01-29

[1165624] High CVE-2021-21151: Use after free in Payments. Reported by Khalil Zhani on 2021-01-12

[1166504] High CVE-2021-21152: Heap buffer overflow in Media. Reported by Anonymous on 2021-01-14

[1155974] High CVE-2021-21153: Stack overflow in GPU Process. Reported by Jan Ruge of ERNW GmbH on 2020-12-06

[1173269] High CVE-2021-21154: Heap buffer overflow in Tab Strip. Reported by Abdulrahman Alqabandi, Microsoft Browser Vulnerability Research on 2021-02-01

[1175500] High CVE-2021-21155: Heap buffer overflow in Tab Strip. Reported by Khalil Zhani on 2021-02-07

[1177341] High CVE-2021-21156: Heap buffer overflow in V8. Reported by Sergei Glazunov of Google Project Zero on 2021-02-11

[1170657] Medium CVE-2021-21157: Use after free in Web Sockets. Reported by Anonymous on 2021-01-26

CVE-2021-21149 CVE-2021-21150 CVE-2021-21151 CVE-2021-21152 CVE-2021-21153 CVE-2021-21154 CVE-2021-21155 CVE-2021-21156 CVE-2021-21157 https://chromereleases.googleblog.com/2021/02/stable-channel-update-for-desktop_16.html 2021-02-16 2021-02-17 OpenSSL -- Multiple vulnerabilities openssl 1.1.1j,1 openssl-devel 3.0.0a12

The OpenSSL project reports:

Null pointer deref in X509_issuer_and_serial_hash() CVE-2021-23841
(Moderate) The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a potential denial of service attack.

Integer overflow in CipherUpdate CVE-2021-23840
(Low) Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash.

https://www.openssl.org/news/secadv/20210216.txt CVE-2021-23841 CVE-2021-23840 CVE-2021-23839 2021-02-16 2021-02-16 2021-02-18 openexr, ilmbase -- security fixes related to reading corrupted input files ilmbase 2.5.5 openexr 2.5.5

Cary Phillips reports:

Patch release with various bug/sanitizer/security fixes, primarily related to reading corrupted input files[...].

https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.5.5 2021-02-12 2021-02-12 Gitlab -- Multiple Vulnerabilities gitlab-ce 13.8.013.8.4 13.7.013.7.7 10.513.6.7

Gitlab reports:

Improper Certificate Validation for Fortinet OTP

Denial of Service Attack on gitlab-shell

Resource exhaustion due to pending jobs

Confidential issue titles were exposed

Improper access control allowed demoted project members to access authored merge requests

Improper access control allowed unauthorized users to access analytic pages

Unauthenticated CI lint API may lead to information disclosure and SSRF

Prometheus integration in Gitlab may lead to SSRF

https://about.gitlab.com/releases/2021/02/11/security-release-gitlab-13-8-4-released/ 2021-02-11 2021-02-12 oauth2-proxy -- domain whitelist could be used as redirect oauth2-proxy 7.0.0

SO-AND-SO reports:

In OAuth2 Proxy before version 7.0.0, for users that use the whitelist domain feature, a domain that ended in a similar way to the intended domain could have been allowed as a redirect.

https://nvd.nist.gov/vuln/detail/CVE-2021-21291 2021-02-02 2021-02-12 mod_dav_svn -- server crash mod_dav_svn 1.9.01.10.6 1.11.01.14.0

Subversion project reports:

Subversion's mod_authz_svn module will crash if the server is using in-repository authz rules with the AuthzSVNReposRelativeAccessFile option and a client sends a request for a non-existing repository URL.

https://subversion.apache.org/security/CVE-2020-17525-advisory.txt 2021-01-29 2021-02-10 gitea -- multiple vulnerabilities gitea 1.13.2

The Gitea Team reports for release 1.13.2:

Prevent panic on fuzzer provided string

Add secure/httpOnly attributes to the lang cookie

https://github.com/go-gitea/gitea/releases/tag/v1.13.2 ports/253295 2021-01-07 2021-02-06 chromium -- heap buffer overflow in V8 chromium 88.0.4324.150

Chrome Releases reports:

[1170176] High CVE-2021-21148: Heap buffer overflow in V8. Reported by Mattias Buelens on 2021-01-24. Google is aware of reports that an exploit for CVE-2021-21148 exists in the wild.

CVE-2021-21148 https://chromereleases.googleblog.com/2021/02/stable-channel-update-for-desktop_4.html 2021-02-04 2021-02-05 www/chromium -- multiple vulnerabilities chromium 88.0.4324.146

Chrome Releases reports:

This update include 6 security fixes:

1169317] Critical CVE-2021-21142: Use after free in Payments. Reported by Khalil Zhani on 2021-01-21

[1163504] High CVE-2021-21143: Heap buffer overflow in Extensions. Reported by Allen Parker and Alex Morgan of MU on 2021-01-06

[1163845] High CVE-2021-21144: Heap buffer overflow in Tab Groups. Reported by Leecraso and Guang Gong of 360 Alpha Lab on 2021-01-07

[1154965] High CVE-2021-21145: Use after free in Fonts. Reported by Anonymous on 2020-12-03

[1161705] High CVE-2021-21146: Use after free in Navigation. Reported by Alison Huffman and Choongwoo Han of Microsoft Browser Vulnerability Research on 2020-12-24

[1162942] Medium CVE-2021-21147: Inappropriate implementation in Skia. Reported by Roman Starkov on 2021-01-04

CVE-2021-21142 CVE-2021-21143 CVE-2021-21144 CVE-2021-21145 CVE-2021-21146 CVE-2021-21147 https://chromereleases.googleblog.com/2021/02/stable-channel-update-for-desktop.html 2021-02-02 2021-02-03 Gitlab -- Multiple vulnerabilities gitlab-ce 13.8.013.8.2 13.7.013.7.6 11.813.6.6

Gitlab reports:

Stored XSS in merge request

Stored XSS in epic's pages

Sensitive GraphQL variables exposed in structured log

Guest user can see tag names in private projects

Information disclosure via error message

DNS rebinding protection bypass

Validate existence of private project

https://about.gitlab.com/blog/2021/02/01/security-release-gitlab-13-8-2-released/ CVE-2021-22172 CVE-2021-22169 2021-02-01 2021-02-02 minio -- Server Side Request Forgery minio 2021.01.30.00.20.58

Minio developers report:

Thanks to @phith0n from our community upon a code review, discovered an SSRF (Server Side Request Forgery) in our Browser API implementation. We have not observed this report/attack in the wild or reported elsewhere in the community at large.

All users are advised to upgrade ASAP.

The target application may have functionality for importing data from a URL, publishing data to a URL, or otherwise reading data from a URL that can be tampered with. The attacker modifies the calls to this functionality by supplying a completely different URL or by manipulating how URLs are built (path traversal etc.).

In a Server-Side Request Forgery (SSRF) attack, the attacker can abuse functionality on the server to read or update internal resources. The attacker can supply or modify a URL which the code running on the server will read or submit data, and by carefully selecting the URLs, the attacker may be able to read server configuration such as AWS metadata, connect to internal services like HTTP enabled databases, or perform post requests towards internal services which are not intended to be exposed.

https://github.com/minio/minio/security/advisories/GHSA-m4qq-5f7c-693q 2021-01-29 2021-01-31 FreeBSD -- Xen guests can triger backend Out Of Memory FreeBSD-kernel 12.212.2_3 12.112.1_13 11.411.4_7

Problem Description:

Some OSes (including Linux, FreeBSD, and NetBSD) are processing watch events using a single thread. If the events are received faster than the thread is able to handle, they will get queued.

As the queue is unbound, a guest may be able to trigger a OOM in the backend.

CVE-2020-29568 SA-21:02.xenoom 2021-01-29 2021-01-29 FreeBSD -- Uninitialized kernel stack leaks in several file systems FreeBSD-kernel 12.212.2_3 12.112.1_13 11.411.4_7

Problem Description:

Several file systems were not properly initializing the d_off field of the dirent structures returned by VOP_READDIR. In particular, tmpfs(5), smbfs(5), autofs(5) and mqueuefs(5) were failing to do so. As a result, eight uninitialized kernel stack bytes may be leaked to userspace by these file systems. This problem is not present in FreeBSD 11.

Additionally, msdosfs(5) was failing to zero-fill a pair of padding fields in the dirent structure, resulting in a leak of three uninitialized bytes.

Impact:

Kernel stack disclosures may leak sensitive information which could be used to compromise the security of the system.

CVE-2020-25578 CVE-2020-25579 SA-21:01.fsdisclosure 2021-01-29 2021-01-29 pngcheck -- Buffer-overrun vulnerability pngcheck 3.0.1

The libpng project reports:

pngcheck versions 3.0.0 and earlier have a pair of buffer-overrun bugs related to the sPLT and PPLT chunks (the latter is a MNG-only chunk, but it gets noticed even in PNG files if the -s option is used). Both bugs are fixed in version 3.0.1, released on 24 January 2021. Again, while all known vulnerabilities are fixed in this version, the code is quite crufty, so it would be safest to assume there are still some problems hidden in there. As always, use at your own risk.

http://www.libpng.org/pub/png/apps/pngcheck.html 2021-01-24 2021-01-28 sudo -- Multiple vulnerabilities sudo 1.9.5p2

Todd C. Miller reports:

When invoked as sudoedit, the same set of command line options are now accepted as for sudo -e. The -H and -P options are now rejected for sudoedit and sudo -e which matches the sudo 1.7 behavior. This is part of the fix for CVE-2021-3156.

Fixed a potential buffer overflow when unescaping backslashes in the command's arguments. Normally, sudo escapes special characters when running a command via a shell (sudo -s or sudo -i). However, it was also possible to run sudoedit with the -s or -i flags in which case no escaping had actually been done, making a buffer overflow possible. This fixes CVE-2021-3156.

https://www.sudo.ws/stable.html#1.9.5p2 CVE-2021-3156 2021-01-26 2021-01-26 pysaml2 -- multiple vulnerabilities py36-pysaml2 py37-pysaml2 py38-pysaml2 py39-pysaml2 6.5.0

pysaml2 Releases:

Fix processing of invalid SAML XML documents - CVE-2021-21238

Fix unspecified xmlsec1 key-type preference - CVE-2021-21239

https://github.com/IdentityPython/pysaml2/releases https://github.com/IdentityPython/pysaml2/security/advisories/GHSA-f4g9-h89h-jgv9 https://github.com/IdentityPython/pysaml2/security/advisories/GHSA-5p3x-r448-pc62 CVE-2021-21238 CVE-2021-21239 2021-01-20 2021-01-26 jenkins -- Arbitrary file read vulnerability in workspace browsers jenkins 2.276 jenkins-lts 2.263.3

Jenkins Security Advisory:

Description

(Medium) SECURITY-2197 / CVE-2021-21615

Arbitrary file read vulnerability in workspace browsers

https://www.jenkins.io/security/advisory/2021-01-26/ 2021-01-26 2021-01-26 mutt -- denial of service mutt 2.0.5

Tavis Ormandy reports:

rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service (mailbox unavailability) by sending email messages with sequences of semicolon characters in RFC822 address fields (aka terminators of empty groups). A small email message from the attacker can cause large memory consumption, and the victim may then be unable to see email messages from other persons.

https://gitlab.com/muttmua/mutt/-/issues/323 CVE-2021-3181 2021-01-17 2021-01-23 MySQL -- Multiple vulnerabilities mysql56-client 5.6.51 mysql57-client 5.7.33 mysql80-client 8.0.23 mysql56-server 5.6.51 mysql57-server 5.7.33 mysql80-server 8.0.23

Oracle reports:

This Critical Patch Update contains 34 new security patches for Oracle MySQL Server and 4 for MySQL Client.

The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle MySQL is 6.8.

https://www.oracle.com/security-alerts/cpujan2021.html#AppendixMSQL CVE-2021-2046 CVE-2021-2020 CVE-2021-2024 CVE-2021-2011 CVE-2021-2006 CVE-2021-2048 CVE-2021-2028 CVE-2021-2122 CVE-2021-2058 CVE-2021-2001 CVE-2021-2016 CVE-2021-2021 CVE-2021-2030 CVE-2021-2031 CVE-2021-2036 CVE-2021-2055 CVE-2021-2060 CVE-2021-2070 CVE-2021-2076 CVE-2021-2065 CVE-2021-2014 CVE-2021-2002 CVE-2021-2012 CVE-2021-2009 CVE-2021-2072 CVE-2021-2081 CVE-2021-2022 CVE-2021-2038 CVE-2021-2061 CVE-2021-2056 CVE-2021-2087 CVE-2021-2088 CVE-2021-2032 CVE-2021-2010 CVE-2021-1998 CVE-2021-2007 CVE-2021-2019 CVE-2021-2042 2021-01-23 2021-01-23 chromium -- multiple vulnerabilities chromium 88.0.4324.96

Chrome Releases reports:

This release contains 36 security fixes, including:

[1137179] Critical CVE-2021-21117: Insufficient policy enforcement in Cryptohome. Reported by Rory McNamara on 2020-10-10

[1161357] High CVE-2021-21118: Insufficient data validation in V8. Reported by Tyler Nighswander (@tylerni7) of Theori on 2020-12-23

[1160534] High CVE-2021-21119: Use after free in Media. Reported by Anonymous on 2020-12-20

[1160602] High CVE-2021-21120: Use after free in WebSQL. Reported by Nan Wang(@eternalsakura13) and Guang Gong of 360 Alpha Lab on 2020-12-21

[1161143] High CVE-2021-21121: Use after free in Omnibox. Reported by Leecraso and Guang Gong of 360 Alpha Lab on 2020-12-22

[1162131] High CVE-2021-21122: Use after free in Blink. Reported by Renata Hodovan on 2020-12-28

[1137247] High CVE-2021-21123: Insufficient data validation in File System API. Reported by Maciej Pulikowski on 2020-10-11

[1131346] High CVE-2021-21124: Potential user after free in Speech Recognizer. Reported by Chaoyang Ding(@V4kst1z) from Codesafe Team of Legendsec at Qi'anxin Group on 2020-09-23

[1152327] High CVE-2021-21125: Insufficient policy enforcement in File System API. Reported by Ron Masas (Imperva) on 2020-11-24

[1163228] High CVE-2020-16044: Use after free in WebRTC. Reported by Ned Williamson of Project Zero on 2021-01-05

[1108126] Medium CVE-2021-21126: Insufficient policy enforcement in extensions. Reported by David Erceg on 2020-07-22

[1115590] Medium CVE-2021-21127: Insufficient policy enforcement in extensions. Reported by Jasminder Pal Singh, Web Services Point WSP, Kotkapura on 2020-08-12

[1138877] Medium CVE-2021-21128: Heap buffer overflow in Blink. Reported by Liang Dong on 2020-10-15

[1140403] Medium CVE-2021-21129: Insufficient policy enforcement in File System API. Reported by Maciej Pulikowski on 2020-10-20

[1140410] Medium CVE-2021-21130: Insufficient policy enforcement in File System API. Reported by Maciej Pulikowski on 2020-10-20

[1140417] Medium CVE-2021-21131: Insufficient policy enforcement in File System API. Reported by Maciej Pulikowski on 2020-10-20

[1128206] Medium CVE-2021-21132: Inappropriate implementation in DevTools. Reported by David Erceg on 2020-09-15

[1157743] Medium CVE-2021-21133: Insufficient policy enforcement in Downloads. Reported by wester0x01 (https://twitter.com/wester0x01) on 2020-12-11

[1157800] Medium CVE-2021-21134: Incorrect security UI in Page Info. Reported by wester0x01 (https://twitter.com/wester0x01) on 2020-12-11

[1157818] Medium CVE-2021-21135: Inappropriate implementation in Performance API. Reported by ndevtk on 2020-12-11

[1038002] Low CVE-2021-21136: Insufficient policy enforcement in WebView. Reported by Shiv Sahni, Movnavinothan V and Imdad Mohammed on 2019-12-27

[1093791] Low CVE-2021-21137: Inappropriate implementation in DevTools. Reported by bobblybear on 2020-06-11

[1122487] Low CVE-2021-21138: Use after free in DevTools. Reported by Weipeng Jiang (@Krace) from Codesafe Team of Legendsec at Qi'anxin Group on 2020-08-27

[1136327] Low CVE-2021-21140: Uninitialized Use in USB. Reported by David Manouchehri on 2020-10-08

[1140435] Low CVE-2021-21141: Insufficient policy enforcement in File System API. Reported by Maciej Pulikowski on 2020-10-20

CVE-2020-16044 CVE-2021-21117 CVE-2021-21118 CVE-2021-21119 CVE-2021-21120 CVE-2021-21121 CVE-2021-21122 CVE-2021-21123 CVE-2021-21124 CVE-2021-21125 CVE-2021-21126 CVE-2021-21127 CVE-2021-21128 CVE-2021-21129 CVE-2021-21130 CVE-2021-21131 CVE-2021-21132 CVE-2021-21133 CVE-2021-21134 CVE-2021-21135 CVE-2021-21136 CVE-2021-21137 CVE-2021-21138 CVE-2021-21139 CVE-2021-21140 CVE-2021-21141 https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop_19.html 2021-01-19 2021-01-22 chocolate-doom -- Arbitrary code execution chocolate-doom 3.0.1 crispy-doom 5.9.0

Michal Dardas from LogicalTrust reports:

The server in Chocolate Doom 3.0.0 and Crispy Doom 5.8.0 doesn't validate the user-controlled num_players value, leading to a buffer overflow. A malicious user can overwrite the server's stack.

https://github.com/chocolate-doom/chocolate-doom/issues/1293 CVE-2020-14983 2020-06-22 2021-01-22 nokogiri -- Security vulnerability rubygem-nokogiri rubygem-nokogiri18 1.11.0.rc3

Nokogiri reports:

In Nokogiri versions <= 1.11.0.rc3, XML Schemas parsed by Nokogiri::XML::Schema were trusted by default, allowing external resources to be accessed over the network, potentially enabling XXE or SSRF attacks.

https://nokogiri.org/CHANGELOG.html CVE-2020-26247 2021-01-22 2021-01-22 dnsmasq -- DNS cache poisoning, and DNSSEC buffer overflow, vulnerabilities dnsmasq 2.83 dnsmasq-devel 2.83

Simon Kelley reports:

There are broadly two sets of problems. The first is subtle errors in dnsmasq's protections against the chronic weakness of the DNS protocol to cache-poisoning attacks; the Birthday attack, Kaminsky, etc.[...]

the second set of errors is a good old fashioned buffer overflow in dnsmasq's DNSSEC code. If DNSSEC validation is enabled, an installation is at risk.

https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2021q1/014599.html https://www.jsof-tech.com/disclosures/dnspooq/ CVE-2020-25684 CVE-2020-25685 CVE-2020-25686 CVE-2020-25681 CVE-2020-25682 CVE-2020-25683 CVE-2020-25687 2020-09-16 2021-01-20 go -- cmd/go: packages using cgo can cause arbitrary code execution at build time; crypto/elliptic: incorrect operations on the P-224 curve go 1.15.7,1

The Go project reports:

The go command may execute arbitrary code at build time when cgo is in use on Windows. This may occur when running "go get", or any other command that builds code. Only users who build untrusted code (and don't execute it) are affected. In addition to Windows users, this can also affect Unix users who have "." listed explicitly in their PATH and are running "go get" or build commands outside of a module or with module mode disabled.

The P224() Curve implementation can in rare circumstances generate incorrect outputs, including returning invalid points from ScalarMult. The crypto/x509 and golang.org/x/crypto/ocsp (but not crypto/tls) packages support P-224 ECDSA keys, but they are not supported by publicly trusted certificate authorities. No other standard library or golang.org/x/crypto package supports or uses the P-224 curve.

CVE-2021-3115 http://golang.org/issue/43783 CVE-2021-3114 http://golang.org/issue/43786 2021-01-13 2021-01-19 cloud-init -- Wrong access permissions of authorized keys cloud-init 20.420.4.1

cloud-init reports:

cloud-init release 20.4.1 is now available. This is a hotfix release, that contains a single patch to address a security issue in cloud-init 20.4.

Briefly, for users who provide more than one unique SSH key to cloud-init and have a shared AuthorizedKeysFile configured in sshd_config, cloud-init 20.4 started writing all of these keys to such a file, granting all such keys SSH access as root.

It's worth restating this implication: if you are using the default AuthorizedKeysFile setting in /etc/ssh/sshd_config, as most will be, then you are _not_ affected by this issue.

https://bugs.launchpad.net/cloud-init/+bug/1911680 2021-01-14 2021-01-19 moinmoin -- multiple vulnerabilities moinmoin 1.9.11

MoinMoin reports:

Security fix for CVE-2020-25074: fix remote code execution via cache action

Security fix for CVE-2020-15275: fix malicious SVG attachment causing stored XSS vulnerability

https://github.com/moinwiki/moin-1.9/blob/1.9.11/docs/CHANGES#L13 CVE-2020-25074 CVE-2020-15275 2020-11-08 2021-01-18 Ghostscript -- SAFER Sandbox Breakout ghostscript9-agpl-base 9.509.52_8

SO-AND-SO reports:

A memory corruption issue was found in Artifex Ghostscript 9.50 and 9.52. Use of a non-standard PostScript operator can allow overriding of file access controls. The 'rsearch' calculation for the 'post' size resulted in a size that was too large, and could underflow to max uint32_t. This was fixed in commit 5d499272b95a6b890a1397e11d20937de000d31b.

https://nvd.nist.gov/vuln/detail/CVE-2020-15900 2020-07-28 2021-01-17 Node.js -- January 2021 Security Releases node10 10.23.1 node12 12.20.1 node14 14.15.4 node 15.5.1

Node.js reports:

use-after-free in TLSWrap (High) (CVE-2020-8265)

Affected Node.js versions are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits.

HTTP Request Smuggling in nodejs (Low) (CVE-2020-8287)

Affected versions of Node.js allow two copies of a header field in a http request. For example, two Transfer-Encoding header fields. In this case Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling.

OpenSSL - EDIPARTYNAME NULL pointer de-reference (CVE-2020-1971)

iThis is a vulnerability in OpenSSL which may be exploited through Node.js. You can read more about it in https://www.openssl.org/news/secadv/20201208.txt.

https://nodejs.org/en/blog/vulnerability/january-2021-security-releases/ https://www.openssl.org/news/secadv/20201208.txt CVE-2020-8265 CVE-2020-8287 CVE-2020-1971 2021-01-04 2021-01-14 Gitlab -- vulnerability gitlab-ce 13.7.013.7.4 13.6.013.6.5 12.213.5.7

SO-AND-SO reports:

Ability to steal a user's API access token through GitLab Pages

https://about.gitlab.com/releases/2021/01/14/critical-security-release-gitlab-13-7-4-released/ 2021-01-14 2021-01-14 wavpack -- integer overflow in pack_utils.c wavpack 5.4.0

The wavpack project reports:

src/pack_utils.c - issue #91: fix integer overflows resulting in buffer overruns (CVE-2020-35738) - sanitize configuration parameters better (improves clarity and aids debugging)

https://github.com/dbry/WavPack/blob/733616993d53cc1f9a7ffb88a858447ba51eb0ee/ChangeLog CVE-2020-35738 2020-12-29 2021-01-14 jenkins -- multiple vulnerabilities jenkins 2.275 jenkins-lts 2.263.2

Jenkins Security Advisory:

Description

(Medium) SECURITY-1452 / CVE-2021-21602

Arbitrary file read vulnerability in workspace browsers

(High) SECURITY-1889 / CVE-2021-21603

XSS vulnerability in notification bar

(High) SECURITY-1923 / CVE-2021-21604

Improper handling of REST API XML deserialization errors

(High) SECURITY-2021 / CVE-2021-21605

Path traversal vulnerability in agent names

(Medium) SECURITY-2023 / CVE-2021-21606

Arbitrary file existence check in file fingerprints

(Medium) SECURITY-2025 / CVE-2021-21607

Excessive memory allocation in graph URLs leads to denial of service

(High) SECURITY-2035 / CVE-2021-21608

Stored XSS vulnerability in button labels

(Low) SECURITY-2047 / CVE-2021-21609

Missing permission check for paths with specific prefix

(High) SECURITY-2153 / CVE-2021-21610

Reflected XSS vulnerability in markup formatter preview

(High) SECURITY-2171 / CVE-2021-21611

Stored XSS vulnerability on new item page

https://www.jenkins.io/security/advisory/2021-01-13/ 2021-01-13 2021-01-13 phpmyfaq -- XSS vulnerability phpmyfaq 3.0.6

phpmyfaq developers report:

phpMyFAQ does not implement sufficient checks to avoid XSS injection for displaying tags.

https://www.phpmyfaq.de/security/advisory-2020-12-23 2020-12-23 2021-01-12 sudo -- Potential information leak in sudoedit sudo 1.9.5

Todd C. Miller reports:

A potential information leak in sudoedit that could be used to test for the existence of directories not normally accessible to the user in certain circumstances. When creating a new file, sudoedit checks to make sure the parent directory of the new file exists before running the editor. However, a race condition exists if the invoking user can replace (or create) the parent directory. If a symbolic link is created in place of the parent directory, sudoedit will run the editor as long as the target of the link exists.If the target of the link does not exist, an error message will be displayed. The race condition can be used to test for the existence of an arbitrary directory. However, it _cannot_ be used to write to an arbitrary location.

https://www.sudo.ws/stable.html#1.9.5 CVE-2021-23239 2021-01-11 2021-01-11 CairoSVG -- Regular Expression Denial of Service vulnerability py36-cairosvg py37-cairosvg py38-cairosvg py39-cairosvg 2.0.02.5.1

CairoSVG security advisories:

When processing SVG files, the python package CairoSVG uses two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS).

If an attacker provides a malicious SVG, it can make cairosvg get stuck processing the file for a very long time.

https://github.com/Kozea/CairoSVG/security/advisories/GHSA-hq37-853p-g5cf 2020-12-30 2021-01-10 Gitlab -- multiple vulnerabilities gitlab-ce 13.7.013.7.2 13.6.013.6.4 12.213.5.6

Gitlab reports:

Ability to steal a user's API access token through GitLab Pages

Prometheus denial of service via HTTP request with custom method

Unauthorized user is able to access private repository information under specific conditions

Regular expression denial of service in NuGet API

Regular expression denial of service in package uploads

Update curl dependency

CVE-2019-3881 mitigation

https://about.gitlab.com/releases/2021/01/07/security-release-gitlab-13-7-2-released/ CVE-2021-22166 CVE-2020-26414 CVE-2019-3881 2021-01-07 2021-01-09 chromium -- multiple vulnerabilities chromium 87.0.4280.141

Chrome Releases reports:

This release includes 16 security fixes, including:

[1148749] High CVE-2021-21106: Use after free in autofill. Reported by Weipeng Jiang (@Krace) from Codesafe Team of Legendsec at Qi'anxin Group on 2020-11-13

[1153595] High CVE-2021-21107: Use after free in drag and drop. Reported by Leecraso and Guang Gong of 360 Alpha Lab on 2020-11-30

[1155426] High CVE-2021-21108: Use after free in media. Reported by Leecraso and Guang Gong of 360 Alpha Lab on 2020-12-04

[1152334] High CVE-2021-21109: Use after free in payments. Reported by Rong Jian and Guang Gong of 360 Alpha Lab on 2020-11-24

[1152451] High CVE-2021-21110: Use after free in safe browsing. Reported by Anonymous on 2020-11-24

[1149125] High CVE-2021-21111: Insufficient policy enforcement in WebUI. Reported by Alesandro Ortiz on 2020-11-15

[1151298] High CVE-2021-21112: Use after free in Blink. Reported by YoungJoo Lee(@ashuu_lee) of Raon Whitehat on 2020-11-20

[1155178] High CVE-2021-21113: Heap buffer overflow in Skia. Reported by tsubmunu on 2020-12-03

[1148309] High CVE-2020-16043: Insufficient data validation in networking. Reported by Samy Kamkar, Ben Seri at Armis, Gregory Vishnepolsky at Armis on 2020-11-12

[1150065] High CVE-2021-21114: Use after free in audio. Reported by Man Yue Mo of GitHub Security Lab on 2020-11-17

[1157790] High CVE-2020-15995: Out of bounds write in V8. Reported by Bohan Liu (@P4nda20371774) of Tencent Security Xuanwu Lab on 2020-12-11

[1157814] High CVE-2021-21115: Use after free in safe browsing. Reported by Leecraso and Guang Gong of 360 Alpha Lab on 2020-12-11

[1151069] Medium CVE-2021-21116: Heap buffer overflow in audio. Reported by Alison Huffman, Microsoft Browser Vulnerability Research on 2020-11-19

CVE-2020-15995 CVE-2020-16043 CVE-2021-21106 CVE-2021-21107 CVE-2021-21108 CVE-2021-21109 CVE-2021-21110 CVE-2021-21111 CVE-2021-21112 CVE-2021-21113 CVE-2021-21114 CVE-2021-21115 CVE-2021-21116 https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop.html 2021-01-06 2021-01-07 mail/dovecot -- multiple vulnerabilities dovecot 2.3.13

Aki Tuomi reports:

When imap hibernation is active, an attacker can cause Dovecot to discover file system directory structure and access other users' emails using specially crafted command. The attacker must have valid credentials to access the mail server.

Mail delivery / parsing crashed when the 10 000th MIME part was message/rfc822 (or if parent was multipart/digest). This happened due to earlier MIME parsing changes for CVE-2020-12100.

https://dovecot.org/pipermail/dovecot-news/2021-January/000448.html CVE-2020-24386 CVE-2020-25275 2020-08-17 2021-01-04 &vuln-2020; &vuln-2019; &vuln-2018; &vuln-2017; &vuln-2016; &vuln-2015; &vuln-2014; &vuln-2013; &vuln-2012; &vuln-2011; &vuln-2010; &vuln-2009; &vuln-2008; &vuln-2007; &vuln-2006; &vuln-2005; &vuln-2004; &vuln-2003;