Page MenuHomeFreeBSD

No OneTemporary

This file is larger than 256 KB, so syntax highlighting was skipped.
Index: head/security/vuxml/vuln.xml
===================================================================
--- head/security/vuxml/vuln.xml (revision 414235)
+++ head/security/vuxml/vuln.xml (revision 414236)
@@ -1,65595 +1,65629 @@
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE vuxml PUBLIC "-//vuxml.org//DTD VuXML 1.1//EN" "http://www.vuxml.org/dtd/vuxml-1/vuxml-11.dtd">
<!--
Copyright 2003-2014 Jacques Vidrine and contributors
Redistribution and use in source (VuXML) and 'compiled' forms (SGML,
HTML, PDF, PostScript, RTF and so forth) with or without modification,
are permitted provided that the following conditions are met:
1. Redistributions of source code (VuXML) must retain the above
copyright notice, this list of conditions and the following
disclaimer as the first lines of this file unmodified.
2. Redistributions in compiled form (transformed to other DTDs,
published online in any format, converted to PDF, PostScript,
RTF and other formats) must reproduce the above copyright
notice, this list of conditions and the following disclaimer
in the documentation and/or other materials provided with the
distribution.
THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS"
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS
BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,
EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
$FreeBSD$
QUICK GUIDE TO ADDING A NEW ENTRY
1. run 'make newentry' to add a template to the top of the document
2. fill in the template
3. use 'make validate' to verify syntax correctness (you might need to install
textproc/libxml2 for parser, and this port for catalogs)
4. fix any errors
5. use 'make VID=xxx-yyy-zzz html' to emit the entry's html file for formatting review
6. profit!
Additional tests can be done this way:
$ pkg audit -f ./vuln.xml py26-django-1.6
$ pkg audit -f ./vuln.xml py27-django-1.6.1
Extensive documentation of the format and help with writing and verifying
a new entry is available in The Porter's Handbook at:
http://www.freebsd.org/doc/en/books/porters-handbook/security-notify.html
Help is also available from ports-security@freebsd.org.
Notes:
* Please add new entries to the beginning of this file.
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+ <vuln vid="f2d4f879-0d7c-11e6-925f-6805ca0b3d42">
+ <topic>logstash -- password disclosure vulnerability</topic>
+ <affects>
+ <package>
+ <name>logstash</name>
+ <range><ge>2.1.0</ge><lt>2.3.2</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>Logstash developers report:</p>
+ <blockquote cite="https://www.elastic.co/blog/logstash-2.3.1-and-2.2.4-released#Passwords_Printed_in_Log_Files_under_Some_Conditions_18">
+ <h2>Passwords Printed in Log Files under Some Conditions</h2>
+ <p>It was discovered that, in Logstash 2.1.0+, log messages
+ generated by a stalled pipeline during shutdown will print
+ plaintext contents of password fields. While investigating
+ this issue we also discovered that debug logging has
+ included this data for quite some time. Our latest releases
+ fix both leaks. You will want to scrub old log files if this
+ is of particular concern to you. This was fixed in issue
+ #4965</p>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <url>https://www.elastic.co/blog/logstash-2.3.1-and-2.2.4-released#Passwords_Printed_in_Log_Files_under_Some_Conditions_18</url>
+ <url>https://github.com/elastic/logstash/pull/4965</url>
+ </references>
+ <dates>
+ <discovery>2016-04-01</discovery>
+ <entry>2016-04-28</entry>
+ </dates>
+ </vuln>
+
<vuln vid="c8174b63-0d3a-11e6-b06e-d43d7eed0ce2">
<topic>subversion -- multiple vulnerabilities</topic>
<affects>
<package>
<name>subversion</name>
<range><ge>1.9.0</ge><lt>1.9.4</lt></range>
<range><ge>1.0.0</ge><lt>1.8.15</lt></range>
</package>
<package>
<name>subversion18</name>
<range><ge>1.0.0</ge><lt>1.8.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Subversion project reports:</p>
<blockquote cite="http://subversion.apache.org/security/CVE-2016-2167-advisory.txt">
<p>svnserve, the svn:// protocol server, can optionally use the Cyrus
SASL library for authentication, integrity protection, and encryption.
Due to a programming oversight, authentication against Cyrus SASL
would permit the remote user to specify a realm string which is
a prefix of the expected realm string.</p>
</blockquote>
<blockquote cite="http://subversion.apache.org/security/CVE-2016-2168-advisory.txt">
<p>Subversion's httpd servers are vulnerable to a remotely triggerable crash
in the mod_authz_svn module. The crash can occur during an authorization
check for a COPY or MOVE request with a specially crafted header value.</p>
<p>This allows remote attackers to cause a denial of service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2167</cvename>
<url>http://subversion.apache.org/security/CVE-2016-2167-advisory.txt</url>
<cvename>CVE-2016-2168</cvename>
<url>http://subversion.apache.org/security/CVE-2016-2168-advisory.txt</url>
</references>
<dates>
<discovery>2016-04-21</discovery>
<entry>2016-04-28</entry>
</dates>
</vuln>
<vuln vid="b2487d9a-0c30-11e6-acd0-d050996490d0">
<topic>ntp -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ntp</name>
<range><lt>4.2.8p7</lt></range>
</package>
<package>
<name>ntp-devel</name>
<range><lt>4.3.92</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Network Time Foundation reports:</p>
<blockquote cite="http://support.ntp.org/bin/view/Main/SecurityNotice#April_2016_NTP_4_2_8p7_Security">
<p>NTF's NTP Project has been notified of the following low-
and medium-severity vulnerabilities that are fixed in
ntp-4.2.8p7, released on Tuesday, 26 April 2016:</p>
<ul>
<li>Bug 3020 / CVE-2016-1551: Refclock impersonation
vulnerability, AKA: refclock-peering. Reported by
Matt Street and others of Cisco ASIG</li>
<li>Bug 3012 / CVE-2016-1549: Sybil vulnerability:
ephemeral association attack, AKA: ntp-sybil -
MITIGATION ONLY. Reported by Matthew Van Gundy
of Cisco ASIG</li>
<li>Bug 3011 / CVE-2016-2516: Duplicate IPs on
unconfig directives will cause an assertion botch.
Reported by Yihan Lian of the Cloud Security Team,
Qihoo 360</li>
<li>Bug 3010 / CVE-2016-2517: Remote configuration
trustedkey/requestkey values are not properly
validated. Reported by Yihan Lian of the Cloud
Security Team, Qihoo 360</li>
<li>Bug 3009 / CVE-2016-2518: Crafted addpeer with
hmode &gt; 7 causes array wraparound with MATCH_ASSOC.
Reported by Yihan Lian of the Cloud Security Team,
Qihoo 360</li>
<li>Bug 3008 / CVE-2016-2519: ctl_getitem() return
value not always checked. Reported by Yihan Lian
of the Cloud Security Team, Qihoo 360</li>
<li>Bug 3007 / CVE-2016-1547: Validate crypto-NAKs,
AKA: nak-dos. Reported by Stephen Gray and
Matthew Van Gundy of Cisco ASIG</li>
<li>Bug 2978 / CVE-2016-1548: Interleave-pivot -
MITIGATION ONLY. Reported by Miroslav Lichvar of
RedHat and separately by Jonathan Gardner of
Cisco ASIG.</li>
<li>Bug 2952 / CVE-2015-7704: KoD fix: peer
associations were broken by the fix for
NtpBug2901, AKA: Symmetric active/passive mode
is broken. Reported by Michael Tatarinov,
NTP Project Developer Volunteer</li>
<li>Bug 2945 / Bug 2901 / CVE-2015-8138: Zero
Origin Timestamp Bypass, AKA: Additional KoD Checks.
Reported by Jonathan Gardner of Cisco ASIG</li>
<li>Bug 2879 / CVE-2016-1550: Improve NTP security
against buffer comparison timing attacks,
authdecrypt-timing, AKA: authdecrypt-timing.
Reported independently by Loganaden Velvindron,
and Matthew Van Gundy and Stephen Gray of
Cisco ASIG.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7704</cvename>
<cvename>CVE-2015-8138</cvename>
<cvename>CVE-2016-1547</cvename>
<cvename>CVE-2016-1548</cvename>
<cvename>CVE-2016-1549</cvename>
<cvename>CVE-2016-1550</cvename>
<cvename>CVE-2016-1551</cvename>
<cvename>CVE-2016-2516</cvename>
<cvename>CVE-2016-2517</cvename>
<cvename>CVE-2016-2518</cvename>
<cvename>CVE-2016-2519</cvename>
<url>http://support.ntp.org/bin/view/Main/SecurityNotice#April_2016_NTP_4_2_8p7_Security</url>
</references>
<dates>
<discovery>2016-04-26</discovery>
<entry>2016-04-27</entry>
</dates>
</vuln>
<vuln vid="92d44f83-a7bf-41cf-91ee-3d1b8ecf579f">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<name>linux-firefox</name>
<range><lt>46.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.43</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><ge>39.0,1</ge><lt>45.1.0,1</lt></range>
<range><lt>38.8.0,1</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><ge>39.0</ge><lt>45.1.0</lt></range>
<range><lt>38.8.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firefox46">
<p>MFSA 2016-39 Miscellaneous memory safety hazards (rv:46.0 /
rv:45.1 / rv:38.8)</p>
<p>MFSA 2016-42 Use-after-free and buffer overflow
in Service Workers</p>
<p>MFSA 2016-44 Buffer overflow in libstagefright with
CENC offsets</p>
<p>MFSA 2016-45 CSP not applied to pages sent with
multipart/x-mixed-replace</p>
<p>MFSA 2016-46 Elevation of privilege with
chrome.tabs.update API in web extensions</p>
<p>MFSA 2016-47 Write to invalid HashMap entry through
JavaScript.watch()</p>
<p>MFSA 2016-48 Firefox Health Reports could accept events
from untrusted domains</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2804</cvename>
<cvename>CVE-2016-2805</cvename>
<cvename>CVE-2016-2806</cvename>
<cvename>CVE-2016-2807</cvename>
<cvename>CVE-2016-2808</cvename>
<cvename>CVE-2016-2811</cvename>
<cvename>CVE-2016-2812</cvename>
<cvename>CVE-2016-2814</cvename>
<cvename>CVE-2016-2816</cvename>
<cvename>CVE-2016-2817</cvename>
<cvename>CVE-2016-2820</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2016-39/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-42/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-44/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-45/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-46/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-47/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-48/</url>
</references>
<dates>
<discovery>2016-04-26</discovery>
<entry>2016-04-26</entry>
</dates>
</vuln>
<vuln vid="f87a9376-0943-11e6-8fc4-00a0986f28c4">
<topic>phpmyfaq -- cross-site request forgery vulnerability</topic>
<affects>
<package>
<name>phpmyfaq</name>
<range><lt>2.8.27</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyFAQ team reports:</p>
<blockquote cite="http://www.phpmyfaq.de/security/advisory-2016-04-11">
<p>The vulnerability exists due to application does not properly
verify origin of HTTP requests in "Interface Translation"
functionality.: A remote unauthenticated attacker can create
a specially crafted malicious web page with CSRF exploit, trick
a logged-in administrator to visit the page, spoof the HTTP
request, as if it was coming from the legitimate user, inject
and execute arbitrary PHP code on the target system with privileges
of the webserver.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.phpmyfaq.de/security/advisory-2016-04-11</url>
<url>https://www.htbridge.com/advisory/HTB23300</url>
</references>
<dates>
<discovery>2016-04-11</discovery>
<entry>2016-04-23</entry>
</dates>
</vuln>
<vuln vid="1b0d2938-0766-11e6-94fa-002590263bf5">
<topic>libtasn1 -- denial of service parsing malicious DER certificates</topic>
<affects>
<package>
<name>libtasn1</name>
<range><lt>4.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GNU Libtasn1 NEWS reports:</p>
<blockquote cite="http://git.savannah.gnu.org/gitweb/?p=libtasn1.git;a=blob_plain;f=NEWS;hb=e9bcdc86b920d72c9cffc2570d14eea2f6365b37">
<p>Fixes to avoid an infinite recursion when decoding without the
ASN1_DECODE_FLAG_STRICT_DER flag. Reported by Pascal Cuoq.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-4008</cvename>
<url>http://www.openwall.com/lists/oss-security/2016/04/13/3</url>
<url>http://git.savannah.gnu.org/gitweb/?p=libtasn1.git;a=blob_plain;f=NEWS;hb=e9bcdc86b920d72c9cffc2570d14eea2f6365b37</url>
</references>
<dates>
<discovery>2016-04-11</discovery>
<entry>2016-04-21</entry>
</dates>
</vuln>
<vuln vid="e05bfc92-0763-11e6-94fa-002590263bf5">
<topic>squid -- multiple vulnerabilities</topic>
<affects>
<package>
<name>squid</name>
<range><lt>3.5.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Squid security advisory 2016:5 reports:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2016_5.txt">
<p>Due to incorrect buffer management Squid cachemgr.cgi tool is
vulnerable to a buffer overflow when processing remotely supplied
inputs relayed to it from Squid.</p>
<p>This problem allows any client to seed the Squid manager reports
with data that will cause a buffer overflow when processed by the
cachemgr.cgi tool. However, this does require manual administrator
actions to take place. Which greatly reduces the impact and
possible uses.</p>
</blockquote>
<p>Squid security advisory 2016:6 reports:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2016_6.txt">
<p>Due to buffer overflow issues Squid is vulnerable to a denial of
service attack when processing ESI responses. Due to incorrect input
validation Squid is vulnerable to public information disclosure of
the server stack layout when processing ESI responses. Due to
incorrect input validation and buffer overflow Squid is vulnerable
to remote code execution when processing ESI responses.</p>
<p>These problems allow ESI components to be used to perform a denial
of service attack on the Squid service and all other services on the
same machine. Under certain build conditions these problems allow
remote clients to view large sections of the server memory. However,
the bugs are exploitable only if you have built and configured the
ESI features to be used by a reverse-proxy and if the ESI components
being processed by Squid can be controlled by an attacker.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-4051</cvename>
<cvename>CVE-2016-4052</cvename>
<cvename>CVE-2016-4053</cvename>
<cvename>CVE-2016-4054</cvename>
<freebsdpr>ports/208939</freebsdpr>
<url>http://www.squid-cache.org/Advisories/SQUID-2016_5.txt</url>
<url>http://www.squid-cache.org/Advisories/SQUID-2016_6.txt</url>
</references>
<dates>
<discovery>2016-04-20</discovery>
<entry>2016-04-21</entry>
</dates>
</vuln>
<vuln vid="253c6889-06f0-11e6-925f-6805ca0b3d42">
<topic>ansible -- use of predictable paths in lxc_container</topic>
<affects>
<package>
<name>ansible</name>
<range><ge>2.0.0.0</ge><lt>2.0.2.0</lt></range>
</package>
<package>
<name>ansible1</name>
<range><lt>1.9.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ansible developers report:</p>
<blockquote cite="https://github.com/ansible/ansible-modules-extras/pull/1941/commits/8c6fe646ee79f5e55361b885b7efed5bec72d4a4">
<p>CVE-2016-3096: do not use predictable paths in lxc_container</p>
<ul>
<li>do not use a predictable filename for the LXC attach
script</li>
<li>don't use predictable filenames for LXC attach script
logging</li>
<li>don't set a predictable archive_path</li>
</ul>
<p>this should prevent symlink attacks which could result
in</p>
<ul>
<li>data corruption</li>
<li>data leakage</li>
<li>privilege escalation</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-3096</cvename>
<url>https://github.com/ansible/ansible-modules-extras/pull/1941/commits/8c6fe646ee79f5e55361b885b7efed5bec72d4a4</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1322925</url>
</references>
<dates>
<discovery>2016-04-02</discovery>
<entry>2016-04-20</entry>
</dates>
</vuln>
<vuln vid="a733b5ca-06eb-11e6-817f-3085a9a4510d">
<topic>proftpd -- vulnerability in mod_tls</topic>
<affects>
<package>
<name>proftpd</name>
<range><lt>1.3.5b</lt></range>
<range><eq>1.3.6.r1</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3125">
<p>The mod_tls module in ProFTPD before 1.3.5b and 1.3.6 before
1.3.6rc2 does not properly handle the TLSDHParamFile directive, which
might cause a weaker than intended Diffie-Hellman (DH) key to be used
and consequently allow attackers to have unspecified impact via
unknown vectors.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-3125</cvename>
</references>
<dates>
<discovery>2016-03-08</discovery>
<entry>2016-04-20</entry>
</dates>
</vuln>
<vuln vid="6d8505f0-0614-11e6-b39c-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>50.0.2661.75</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2016/04/stable-channel-update_13.html">
<p>20 security fixes in this release, including:</p>
<ul>
<li>[590275] High CVE-2016-1652: Universal XSS in extension
bindings. Credit to anonymous.</li>
<li>[589792] High CVE-2016-1653: Out-of-bounds write in V8. Credit
to Choongwoo Han.</li>
<li>[591785] Medium CVE-2016-1651: Out-of-bounds read in Pdfium
JPEG2000 decoding. Credit to kdot working with HP's Zero Day
Initiative.</li>
<li>[589512] Medium CVE-2016-1654: Uninitialized memory read in
media. Credit to Atte Kettunen of OUSPG.</li>
<li>[582008] Medium CVE-2016-1655: Use-after-free related to
extensions. Credit to Rob Wu.</li>
<li>[570750] Medium CVE-2016-1656: Android downloaded file path
restriction bypass. Credit to Dzmitry Lukyanenko.</li>
<li>[567445] Medium CVE-2016-1657: Address bar spoofing. Credit to
Luan Herrera.</li>
<li>[573317] Low CVE-2016-1658: Potential leak of sensitive
information to malicious extensions. Credit to Antonio Sanso
(@asanso) of Adobe.</li>
<li>[602697] CVE-2016-1659: Various fixes from internal audits,
fuzzing and other initiatives.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1651</cvename>
<cvename>CVE-2016-1652</cvename>
<cvename>CVE-2016-1653</cvename>
<cvename>CVE-2016-1654</cvename>
<cvename>CVE-2016-1655</cvename>
<cvename>CVE-2016-1656</cvename>
<cvename>CVE-2016-1657</cvename>
<cvename>CVE-2016-1658</cvename>
<cvename>CVE-2016-1659</cvename>
<url>http://googlechromereleases.blogspot.nl/2016/04/stable-channel-update_13.html</url>
</references>
<dates>
<discovery>2016-04-13</discovery>
<entry>2016-04-19</entry>
</dates>
</vuln>
<vuln vid="976567f6-05c5-11e6-94fa-002590263bf5">
<topic>wpa_supplicant -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wpa_supplicant</name>
<range><lt>2.5_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jouni Malinen reports:</p>
<blockquote cite="http://w1.fi/security/2015-6/wpa_supplicant-unauthorized-wnm-sleep-mode-gtk-control.txt">
<p>wpa_supplicant unauthorized WNM Sleep Mode GTK control. (2015-6 -
CVE-2015-5310)</p>
</blockquote>
<blockquote cite="http://w1.fi/security/2015-7/eap-pwd-missing-last-fragment-length-validation.txt">
<p>EAP-pwd missing last fragment length validation. (2015-7 -
CVE-2015-5315)</p>
</blockquote>
<blockquote cite="http://w1.fi/security/2015-8/eap-pwd-unexpected-confirm.txt">
<p>EAP-pwd peer error path failure on unexpected Confirm message.
(2015-8 - CVE-2015-5316)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5310</cvename>
<cvename>CVE-2015-5315</cvename>
<cvename>CVE-2015-5316</cvename>
<freebsdpr>ports/208482</freebsdpr>
<url>http://w1.fi/security/2015-6/wpa_supplicant-unauthorized-wnm-sleep-mode-gtk-control.txt</url>
<url>http://w1.fi/security/2015-7/eap-pwd-missing-last-fragment-length-validation.txt</url>
<url>http://w1.fi/security/2015-8/eap-pwd-unexpected-confirm.txt</url>
</references>
<dates>
<discovery>2015-11-10</discovery>
<entry>2016-04-19</entry>
</dates>
</vuln>
<vuln vid="092156c9-04d7-11e6-b1ce-002590263bf5">
<topic>dhcpcd -- remote code execution/denial of service</topic>
<affects>
<package>
<name>dhcpcd</name>
<range><lt>6.9.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7912">
<p>The get_option function in dhcp.c in dhcpcd before 6.2.0, as used
in dhcpcd 5.x in Android before 5.1 and other products, does not
validate the relationship between length fields and the amount of
data, which allows remote DHCP servers to execute arbitrary code or
cause a denial of service (memory corruption) via a large length
value of an option in a DHCPACK message.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-7912</cvename>
<url>http://roy.marples.name/projects/dhcpcd/info/d71cfd8aa203bffe</url>
</references>
<dates>
<discovery>2015-06-19</discovery>
<entry>2016-04-17</entry>
</dates>
</vuln>
<vuln vid="6ec9f210-0404-11e6-9aee-bc5ff4fb5ea1">
<topic>dhcpcd -- remote code execution/denial of service</topic>
<affects>
<package>
<name>dhcpcd</name>
<range><lt>6.10.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7913">
<p>The print_option function in dhcp-common.c in dhcpcd through 6.9.1,
as used in dhcp.c in dhcpcd 5.x in Android before 5.1 and other
products, misinterprets the return value of the snprintf function,
which allows remote DHCP servers to execute arbitrary code or cause
a denial of service (memory corruption) via a crafted message.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-7913</cvename>
<freebsdpr>ports/208702</freebsdpr>
<url>http://roy.marples.name/projects/dhcpcd/info/528541c4c619520e</url>
</references>
<dates>
<discovery>2016-01-22</discovery>
<entry>2016-04-17</entry>
</dates>
</vuln>
<vuln vid="e21474c6-031a-11e6-aa86-001999f8d30b">
<topic>PJSIP -- TCP denial of service in PJProject</topic>
<affects>
<package>
<name>pjsip</name>
<range><le>2.4.5</le></range>
</package>
<package>
<name>pjsip-extsrtp</name>
<range><le>2.4.5</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>PJProject has a limit on the number of TCP connections
that it can accept. Furthermore, PJProject does not close
TCP connections it accepts. By default, this value is
approximately 60.</p>
<p>An attacker can deplete the number of allowed TCP
connections by opening TCP connections and sending no
data to Asterisk.</p>
<p>If PJProject has been compiled in debug mode, then
once the number of allowed TCP connections has been
depleted, the next attempted TCP connection to Asterisk
will crash due to an assertion in PJProject.</p>
<p>If PJProject has not been compiled in debug mode, then
any further TCP connection attempts will be rejected.
This makes Asterisk unable to process TCP SIP traffic.</p>
<p>Note that this only affects TCP/TLS, since UDP is
connectionless.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2016-005.html</url>
</references>
<dates>
<discovery>2016-02-15</discovery>
<entry>2016-04-15</entry>
</dates>
</vuln>
<vuln vid="ee50726e-0319-11e6-aa86-001999f8d30b">
<topic>asterisk -- Long Contact URIs in REGISTER requests can crash Asterisk</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.8.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>Asterisk may crash when processing an incoming REGISTER
request if that REGISTER contains a Contact header with
a lengthy URI.</p>
<p>This crash will only happen for requests that pass
authentication. Unauthenticated REGISTER requests will
not result in a crash occurring.</p>
<p>This vulnerability only affects Asterisk when using
PJSIP as its SIP stack. The chan_sip module does not have
this problem.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2016-004.html</url>
</references>
<dates>
<discovery>2016-01-19</discovery>
<entry>2016-04-15</entry>
</dates>
</vuln>
<vuln vid="f2217cdf-01e4-11e6-b1ce-002590263bf5">
<topic>go -- remote denial of service</topic>
<affects>
<package>
<name>go</name>
<range><lt>1.6.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jason Buberel reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2016/04/05/2">
<p>Go has an infinite loop in several big integer routines that makes
Go programs vulnerable to remote denial of service attacks. Programs
using HTTPS client authentication or the Go ssh server libraries are
both exposed to this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-3959</cvename>
<url>http://www.openwall.com/lists/oss-security/2016/04/05/2</url>
<url>https://golang.org/cl/21533</url>
</references>
<dates>
<discovery>2016-04-05</discovery>
<entry>2016-04-14</entry>
</dates>
</vuln>
<vuln vid="a636fc26-00d9-11e6-b704-000c292e4fd8">
<topic>samba -- multiple vulnerabilities</topic>
<affects>
<package>
<name>samba36</name>
<range><ge>3.6.0</ge><le>3.6.25_3</le></range>
</package>
<package>
<name>samba4</name>
<range><ge>4.0.0</ge><le>4.0.26</le></range>
</package>
<package>
<name>samba41</name>
<range><ge>4.1.0</ge><le>4.1.23</le></range>
</package>
<package>
<name>samba42</name>
<range><ge>4.2.0</ge><lt>4.2.11</lt></range>
</package>
<package>
<name>samba43</name>
<range><ge>4.3.0</ge><lt>4.3.8</lt></range>
</package>
<package>
<name>samba44</name>
<range><ge>4.4.0</ge><lt>4.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Samba team reports:</p>
<blockquote cite="https://www.samba.org/samba/latest_news.html#4.4.2">
<p>[CVE-2015-5370] Errors in Samba DCE-RPC code can lead to denial of service
(crashes and high cpu consumption) and man in the middle attacks.</p>
<p>[CVE-2016-2110] The feature negotiation of NTLMSSP is not downgrade protected.
A man in the middle is able to clear even required flags, especially
NTLMSSP_NEGOTIATE_SIGN and NTLMSSP_NEGOTIATE_SEAL.</p>
<p>[CVE-2016-2111] When Samba is configured as Domain Controller it allows remote
attackers to spoof the computer name of a secure channel's endpoints, and obtain
sensitive session information, by running a crafted application and leveraging
the ability to sniff network traffic.</p>
<p>[CVE-2016-2112] A man in the middle is able to downgrade LDAP connections
to no integrity protection.</p>
<p>[CVE-2016-2113] Man in the middle attacks are possible for client triggered LDAP
connections (with ldaps://) and ncacn_http connections (with https://).</p>
<p>[CVE-2016-2114] Due to a bug Samba doesn't enforce required smb signing, even if explicitly configured.</p>
<p>[CVE-2016-2115] The protection of DCERPC communication over ncacn_np (which is
the default for most the file server related protocols) is inherited from the underlying SMB connection.</p>
<p>[CVE-2016-2118] a.k.a. BADLOCK. A man in the middle can intercept any DCERPC traffic
between a client and a server in order to impersonate the client and get the same privileges
as the authenticated user account. This is most problematic against active directory domain controllers.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5370</cvename>
<url>https://www.samba.org/samba/security/CVE-2015-5370.html</url>
<cvename>CVE-2016-2110</cvename>
<url>https://www.samba.org/samba/security/CVE-2016-2110.html</url>
<cvename>CVE-2016-2111</cvename>
<url>https://www.samba.org/samba/security/CVE-2016-2111.html</url>
<cvename>CVE-2016-2112</cvename>
<url>https://www.samba.org/samba/security/CVE-2016-2112.html</url>
<cvename>CVE-2016-2113</cvename>
<url>https://www.samba.org/samba/security/CVE-2016-2113.html</url>
<cvename>CVE-2016-2114</cvename>
<url>https://www.samba.org/samba/security/CVE-2016-2114.html</url>
<cvename>CVE-2016-2115</cvename>
<url>https://www.samba.org/samba/security/CVE-2016-2115.html</url>
<cvename>CVE-2016-2118</cvename>
<url>https://www.samba.org/samba/security/CVE-2016-2118.html</url>
</references>
<dates>
<discovery>2016-04-12</discovery>
<entry>2016-04-12</entry>
<modified>2016-04-12</modified>
</dates>
</vuln>
<vuln vid="482d40cb-f9a3-11e5-92ce-002590263bf5">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php70</name>
<name>php70-fileinfo</name>
<name>php70-mbstring</name>
<name>php70-phar</name>
<name>php70-snmp</name>
<range><lt>7.0.5</lt></range>
</package>
<package>
<name>php56</name>
<name>php56-fileinfo</name>
<name>php56-mbstring</name>
<name>php56-phar</name>
<name>php56-snmp</name>
<range><lt>5.6.20</lt></range>
</package>
<package>
<name>php55</name>
<name>php55-fileinfo</name>
<name>php55-mbstring</name>
<name>php55-phar</name>
<name>php55-snmp</name>
<range><lt>5.5.34</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP Group reports:</p>
<blockquote cite="http://php.net/ChangeLog-7.php#7.0.5">
<ul><li>Fileinfo:
<ul>
<li>Fixed bug #71527 (Buffer over-write in finfo_open with
malformed magic file).</li>
</ul></li>
<li>mbstring:
<ul>
<li>Fixed bug #71906 (AddressSanitizer: negative-size-param (-1)
in mbfl_strcut).</li>
</ul></li>
<li>Phar:
<ul>
<li>Fixed bug #71860 (Invalid memory write in phar on filename with
\0 in name).</li>
</ul></li>
<li>SNMP:
<ul>
<li>Fixed bug #71704 (php_snmp_error() Format String Vulnerability).
</li>
</ul></li>
<li>Standard:
<ul>
<li>Fixed bug #71798 (Integer Overflow in php_raw_url_encode).</li>
</ul></li>
</ul>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/208465</freebsdpr>
<url>http://php.net/ChangeLog-7.php#7.0.5</url>
<url>http://php.net/ChangeLog-5.php#5.6.20</url>
<url>http://php.net/ChangeLog-5.php#5.5.34</url>
</references>
<dates>
<discovery>2016-03-31</discovery>
<entry>2016-04-03</entry>
</dates>
</vuln>
<vuln vid="497b82e0-f9a0-11e5-92ce-002590263bf5">
<topic>pcre -- heap overflow vulnerability</topic>
<affects>
<package>
<name>pcre</name>
<range><lt>8.38_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1283">
<p>The pcre_compile2 function in pcre_compile.c in PCRE 8.38
mishandles the /((?:F?+(?:^(?(R)a+\"){99}-))(?J)(?'R'(?'R'&lt;((?'RR'(?'R'\){97)?J)?J)(?'R'(?'R'\){99|(:(?|(?'R')(\k'R')|((?'R')))H'R'R)(H'R))))))/
pattern and related patterns with named subgroups, which allows
remote attackers to cause a denial of service (heap-based buffer
overflow) or possibly have unspecified other impact via a crafted
regular expression, as demonstrated by a JavaScript RegExp object
encountered by Konqueror.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1283</cvename>
<freebsdpr>ports/208260</freebsdpr>
<url>https://bugs.exim.org/show_bug.cgi?id=1767</url>
</references>
<dates>
<discovery>2016-02-27</discovery>
<entry>2016-04-03</entry>
</dates>
</vuln>
<vuln vid="df328fac-f942-11e5-92ce-002590263bf5">
<topic>py-djblets -- Self-XSS vulnerability</topic>
<affects>
<package>
<name>py27-djblets</name>
<name>py32-djblets</name>
<name>py33-djblets</name>
<name>py34-djblets</name>
<name>py35-djblets</name>
<range><lt>0.9.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Djblets Release Notes reports:</p>
<blockquote cite="https://www.reviewboard.org/docs/releasenotes/djblets/0.9.2/">
<p>A recently-discovered vulnerability in the datagrid templates allows an
attacker to generate a URL to any datagrid page containing malicious code
in a column sorting value. If the user visits that URL and then clicks
that column, the code will execute.</p>
<p>The cause of the vulnerability was due to a template not escaping
user-provided values.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.reviewboard.org/docs/releasenotes/djblets/0.9.2/</url>
</references>
<dates>
<discovery>2016-03-01</discovery>
<entry>2016-04-03</entry>
</dates>
</vuln>
<vuln vid="a430e15d-f93f-11e5-92ce-002590263bf5">
<topic>moodle -- multiple vulnerabilities</topic>
<affects>
<package>
<name>moodle28</name>
<range><lt>2.8.11</lt></range>
</package>
<package>
<name>moodle29</name>
<range><lt>2.9.5</lt></range>
</package>
<package>
<name>moodle30</name>
<range><lt>3.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Marina Glancy reports:</p>
<blockquote cite="https://moodle.org/security/">
<ul>
<li><p>MSA-16-0003: Incorrect capability check when displaying
users emails in Participants list</p></li>
<li><p>MSA-16-0004: XSS from profile fields from external db</p>
</li>
<li><p>MSA-16-0005: Reflected XSS in mod_data advanced search</p>
</li>
<li><p>MSA-16-0006: Hidden courses are shown to students in Event
Monitor</p></li>
<li><p>MSA-16-0007: Non-Editing Instructor role can edit exclude
checkbox in Single View</p></li>
<li><p>MSA-16-0008: External function get_calendar_events return
events that pertains to hidden activities</p></li>
<li><p>MSA-16-0009: CSRF in Assignment plugin management page</p>
</li>
<li><p>MSA-16-0010: Enumeration of category details possible without
authentication</p></li>
<li><p>MSA-16-0011: Add no referrer to links with _blank target
attribute</p></li>
<li><p>MSA-16-0012: External function mod_assign_save_submission
does not check due dates</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2151</cvename>
<cvename>CVE-2016-2152</cvename>
<cvename>CVE-2016-2153</cvename>
<cvename>CVE-2016-2154</cvename>
<cvename>CVE-2016-2155</cvename>
<cvename>CVE-2016-2156</cvename>
<cvename>CVE-2016-2157</cvename>
<cvename>CVE-2016-2158</cvename>
<cvename>CVE-2016-2190</cvename>
<cvename>CVE-2016-2159</cvename>
<url>https://moodle.org/security/</url>
</references>
<dates>
<discovery>2016-03-21</discovery>
<entry>2016-04-03</entry>
</dates>
</vuln>
<vuln vid="297117ba-f92d-11e5-92ce-002590263bf5">
<topic>squid -- multiple vulnerabilities</topic>
<affects>
<package>
<name>squid</name>
<range><lt>3.5.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Squid security advisory 2016:3 reports:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2016_3.txt">
<p>Due to a buffer overrun Squid pinger binary is vulnerable to
denial of service or information leak attack when processing
ICMPv6 packets.</p>
<p>This bug also permits the server response to manipulate other
ICMP and ICMPv6 queries processing to cause information leak.</p>
<p>This bug allows any remote server to perform a denial of service
attack on the Squid service by crashing the pinger. This may
affect Squid HTTP routing decisions. In some configurations,
sub-optimal routing decisions may result in serious service
degradation or even transaction failures.</p>
<p>If the system does not contain buffer-overrun protection leading
to that crash this bug will instead allow attackers to leak
arbitrary amounts of information from the heap into Squid log
files. This is of higher importance than usual because the pinger
process operates with root priviliges.</p>
</blockquote>
<p>Squid security advisory 2016:4 reports:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2016_4.txt">
<p>Due to incorrect bounds checking Squid is vulnerable to a denial
of service attack when processing HTTP responses.</p>
<p>This problem allows a malicious client script and remote server
delivering certain unusual HTTP response syntax to trigger a
denial of service for all clients accessing the Squid service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-3947</cvename>
<cvename>CVE-2016-3948</cvename>
<freebsdpr>ports/208463</freebsdpr>
<url>http://www.squid-cache.org/Advisories/SQUID-2016_3.txt</url>
<url>http://www.squid-cache.org/Advisories/SQUID-2016_4.txt</url>
</references>
<dates>
<discovery>2016-03-28</discovery>
<entry>2016-04-02</entry>
</dates>
</vuln>
<vuln vid="97a24d2e-f74c-11e5-8458-6cc21735f730">
<topic>PostgreSQL -- minor security problems.</topic>
<affects>
<package>
<name>postgresql95-server</name>
<name>postgresql95-contrib</name>
<range><ge>9.5.0</ge><lt>9.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PostgreSQL project reports:</p>
<blockquote cite="http://www.postgresql.org/about/news/1656/">
<p>Security Fixes for RLS, BRIN</p>
<p>
This release closes security hole CVE-2016-2193
(https://access.redhat.com/security/cve/CVE-2016-2193), where a query
plan might get reused for more than one ROLE in the same session.
This could cause the wrong set of Row Level Security (RLS) policies to
be used for the query.</p>
<p>
The update also fixes CVE-2016-3065
(https://access.redhat.com/security/cve/CVE-2016-3065), a server crash
bug triggered by using `pageinspect` with BRIN index pages. Since an
attacker might be able to expose a few bytes of server memory, this
crash is being treated as a security issue.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2193</cvename>
<cvename>CVE-2016-3065</cvename>
</references>
<dates>
<discovery>2016-03-01</discovery>
<entry>2016-03-31</entry>
</dates>
</vuln>
<vuln vid="f7b3d1eb-f738-11e5-a710-0011d823eebd">
<topic>flash -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<name>linux-f10-flashplugin</name>
<name>linux-c6_64-flashplugin</name>
<range><lt>11.2r202.577</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb16-08.html">
<p>These updates resolve integer overflow vulnerabilities that
could lead to code execution (CVE-2016-0963, CVE-2016-0993,
CVE-2016-1010).</p>
<p>These updates resolve use-after-free vulnerabilities that could
lead to code execution (CVE-2016-0987, CVE-2016-0988,
CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995,
CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999,
CVE-2016-1000).</p>
<p>These updates resolve a heap overflow vulnerability that could
lead to code execution (CVE-2016-1001).</p>
<p>These updates resolve memory corruption vulnerabilities that
could lead to code execution (CVE-2016-0960, CVE-2016-0961,
CVE-2016-0962, CVE-2016-0986, CVE-2016-0989, CVE-2016-0992,
CVE-2016-1002, CVE-2016-1005).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-0960</cvename>
<cvename>CVE-2016-0961</cvename>
<cvename>CVE-2016-0962</cvename>
<cvename>CVE-2016-0963</cvename>
<cvename>CVE-2016-0986</cvename>
<cvename>CVE-2016-0987</cvename>
<cvename>CVE-2016-0988</cvename>
<cvename>CVE-2016-0989</cvename>
<cvename>CVE-2016-0990</cvename>
<cvename>CVE-2016-0991</cvename>
<cvename>CVE-2016-0992</cvename>
<cvename>CVE-2016-0993</cvename>
<cvename>CVE-2016-0994</cvename>
<cvename>CVE-2016-0995</cvename>
<cvename>CVE-2016-0996</cvename>
<cvename>CVE-2016-0997</cvename>
<cvename>CVE-2016-0998</cvename>
<cvename>CVE-2016-0999</cvename>
<cvename>CVE-2016-1000</cvename>
<cvename>CVE-2016-1001</cvename>
<cvename>CVE-2016-1002</cvename>
<cvename>CVE-2016-1005</cvename>
<cvename>CVE-2016-1010</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb16-08.html</url>
</references>
<dates>
<discovery>2016-03-10</discovery>
<entry>2016-03-31</entry>
</dates>
</vuln>
<vuln vid="4cd9b19f-f66d-11e5-b94c-001999f8d30b">
<topic>Multiple vulnerabilities in Botan</topic>
<affects>
<package>
<name>botan110</name>
<range><lt>1.10.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The botan developers reports:</p>
<blockquote cite="http://botan.randombit.net/security.html">
<p>Infinite loop in modular square root algorithm - The ressol function implements the Tonelli-Shanks algorithm for finding square roots could be sent into a nearly infinite loop due to a misplaced conditional check. This could occur if a composite modulus is provided, as this algorithm is only defined for primes. This function is exposed to attacker controlled input via the OS2ECP function during ECC point decompression.</p>
<p>Heap overflow on invalid ECC point - The PointGFp constructor did not check that the affine coordinate arguments were less than the prime, but then in curve multiplication assumed that both arguments if multiplied would fit into an integer twice the size of the prime.</p>
<p>The bigint_mul and bigint_sqr functions received the size of the output buffer, but only used it to dispatch to a faster algorithm in cases where there was sufficient output space to call an unrolled multiplication function.</p>
<p>The result is a heap overflow accessible via ECC point decoding, which accepted untrusted inputs. This is likely exploitable for remote code execution.</p>
<p>On systems which use the mlock pool allocator, it would allow an attacker to overwrite memory held in secure_vector objects. After this point the write will hit the guard page at the end of the mmapped region so it probably could not be used for code execution directly, but would allow overwriting adjacent key material.</p>
</blockquote>
</body>
</description>
<references>
<url>http://botan.randombit.net/security.html</url>
<cvename>CVE-2016-2194</cvename>
<cvename>CVE-2016-2195</cvename>
</references>
<dates>
<discovery>2016-02-01</discovery>
<entry>2016-03-31</entry>
</dates>
</vuln>
<vuln vid="2004616d-f66c-11e5-b94c-001999f8d30b">
<topic>Botan BER Decoder vulnerabilities</topic>
<affects>
<package>
<name>botan110</name>
<range><lt>1.10.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The botan developers reports:</p>
<blockquote cite="http://botan.randombit.net/">
<p>Excess memory allocation in BER decoder - The BER decoder would allocate a fairly arbitrary amount of memory in a length field, even if there was no chance the read request would succeed. This might cause the process to run out of memory or invoke the OOM killer.</p>
<p>Crash in BER decoder - The BER decoder would crash due to reading from offset 0 of an empty vector if it encountered a BIT STRING which did not contain any data at all. This can be used to easily crash applications reading untrusted ASN.1 data, but does not seem exploitable for code execution.</p>
</blockquote>
</body>
</description>
<references>
<url>http://botan.randombit.net/security.html</url>
<cvename>CVE-2015-5726</cvename>
<cvename>CVE-2015-5727</cvename>
</references>
<dates>
<discovery>2015-08-03</discovery>
<entry>2016-03-31</entry>
</dates>
</vuln>
<vuln vid="e1085b15-f609-11e5-a230-0014a5a57822">
<topic>mercurial -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mercurial</name>
<range><lt>2.7.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mercurial reports:</p>
<blockquote cite="https://www.mercurial-scm.org/pipermail/mercurial/2016-March/049452.html">
<p>CVE-2016-3630: Remote code execution in binary delta decoding</p>
<p>CVE-2016-3068: Arbitrary code execution with Git subrepos</p>
<p>CVE-2016-3069: Arbitrary code execution when converting
Git repos</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-3630</cvename>
<cvename>CVE-2016-3068</cvename>
<cvename>CVE-2016-3069</cvename>
<url>https://www.mercurial-scm.org/pipermail/mercurial/2016-March/049452.html</url>
</references>
<dates>
<discovery>2016-03-29</discovery>
<entry>2016-03-29</entry>
</dates>
</vuln>
<vuln vid="8be8ca39-ae70-4422-bf1a-d8fae6911c5e">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>49.0.2623.108</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.de/2016/03/stable-channel-update_24.html">
<p>[594574] High CVE-2016-1646: Out-of-bounds read in V8.</p>
<p>[590284] High CVE-2016-1647: Use-after-free in Navigation.</p>
<p>[590455] High CVE-2016-1648: Use-after-free in Extensions.</p>
<p>[597518] CVE-2016-1650: Various fixes from internal audits,
fuzzing and other initiatives.</p>
<p>Multiple vulnerabilities in V8 fixed at the tip of the
4.9 branch</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1646</cvename>
<cvename>CVE-2016-1647</cvename>
<cvename>CVE-2016-1648</cvename>
<cvename>CVE-2016-1649</cvename>
<cvename>CVE-2016-1650</cvename>
<url>http://googlechromereleases.blogspot.de/2016/03/stable-channel-update_24.html</url>
</references>
<dates>
<discovery>2016-03-24</discovery>
<entry>2016-03-29</entry>
</dates>
</vuln>
<vuln vid="5c288f68-c7ca-4c0d-b7dc-1ec6295200b3">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>49.0.2623.87</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.de/2016/03/stable-channel-update_8.html">
<p>[589838] High CVE-2016-1643: Type confusion in Blink.</p>
<p>[590620] High CVE-2016-1644: Use-after-free in Blink.</p>
<p>[587227] High CVE-2016-1645: Out-of-bounds write in PDFium.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1643</cvename>
<cvename>CVE-2016-1644</cvename>
<cvename>CVE-2016-1645</cvename>
<url>http://googlechromereleases.blogspot.de/2016/03/stable-channel-update_8.html</url>
</references>
<dates>
<discovery>2016-03-08</discovery>
<entry>2016-03-29</entry>
</dates>
</vuln>
<vuln vid="cd409df7-f483-11e5-92ce-002590263bf5">
<topic>bind -- denial of service vulnerability</topic>
<affects>
<package>
<name>bind910</name>
<range><ge>9.10.0</ge><lt>9.10.3P4</lt></range>
</package>
<package>
<name>bind9-devel</name>
<range><lt>9.11.0.a20160309</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01351">
<p>A response containing multiple DNS cookies causes servers with
cookie support enabled to exit with an assertion failure.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2088</cvename>
<url>https://kb.isc.org/article/AA-01351</url>
</references>
<dates>
<discovery>2016-03-09</discovery>
<entry>2016-03-28</entry>
</dates>
</vuln>
<vuln vid="cba246d2-f483-11e5-92ce-002590263bf5">
<topic>bind -- denial of service vulnerability</topic>
<affects>
<package>
<name>bind98</name>
<range><le>9.8.8</le></range>
</package>
<package>
<name>bind99</name>
<range><ge>9.9.0</ge><lt>9.9.8P4</lt></range>
</package>
<package>
<name>bind910</name>
<range><ge>9.10.0</ge><lt>9.10.3P4</lt></range>
</package>
<package>
<name>bind9-devel</name>
<range><lt>9.11.0.a20160309</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><gt>9.3</gt><le>9.3_38</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01353">
<p>A problem parsing resource record signatures for DNAME resource
records can lead to an assertion failure in resolver.c or db.c</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1286</cvename>
<freebsdsa>SA-16:13.bind</freebsdsa>
<url>https://kb.isc.org/article/AA-01353</url>
</references>
<dates>
<discovery>2016-03-09</discovery>
<entry>2016-03-28</entry>
</dates>
</vuln>
<vuln vid="c9075321-f483-11e5-92ce-002590263bf5">
<topic>bind -- denial of service vulnerability</topic>
<affects>
<package>
<name>bind98</name>
<range><le>9.8.8</le></range>
</package>
<package>
<name>bind99</name>
<range><ge>9.9.0</ge><lt>9.9.8P4</lt></range>
</package>
<package>
<name>bind910</name>
<range><ge>9.10.0</ge><lt>9.10.3P4</lt></range>
</package>
<package>
<name>bind9-devel</name>
<range><lt>9.11.0.a20160309</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><gt>9.3</gt><le>9.3_38</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01352">
<p>An error parsing input received by the rndc control channel can
cause an assertion failure in sexpr.c or alist.c.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1285</cvename>
<freebsdsa>SA-16:13.bind</freebsdsa>
<url>https://kb.isc.org/article/AA-01352</url>
</references>
<dates>
<discovery>2016-03-09</discovery>
<entry>2016-03-28</entry>
</dates>
</vuln>
<vuln vid="6d25c306-f3bb-11e5-92ce-002590263bf5">
<topic>salt -- Insecure configuration of PAM external authentication service</topic>
<affects>
<package>
<name>py27-salt</name>
<name>py32-salt</name>
<name>py33-salt</name>
<name>py34-salt</name>
<name>py35-salt</name>
<range><lt>2015.5.10</lt></range>
<range><ge>2015.8.0</ge><lt>2015.8.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SaltStack reports:</p>
<blockquote cite="https://docs.saltstack.com/en/latest/topics/releases/2015.8.8.html">
<p>This issue affects all Salt versions prior to 2015.8.8/2015.5.10
when PAM external authentication is enabled. This issue involves
passing an alternative PAM authentication service with a command
that is sent to LocalClient, enabling the attacker to bypass the
configured authentication service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-3176</cvename>
<url>https://docs.saltstack.com/en/latest/topics/releases/2015.8.8.html</url>
</references>
<dates>
<discovery>2016-03-17</discovery>
<entry>2016-03-27</entry>
</dates>
</vuln>
<vuln vid="a258604d-f2aa-11e5-b4a9-ac220bdcec59">
<topic>activemq -- Unsafe deserialization</topic>
<affects>
<package>
<name>activemq</name>
<range><lt>5.13.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Alvaro Muatoz, Matthias Kaiser and Christian Schneider reports:</p>
<blockquote cite="http://activemq.apache.org/security-advisories.data/CVE-2015-5254-announcement.txt">
<p>JMS Object messages depends on Java Serialization for
marshaling/unmashaling of the message payload. There are a couple of places
inside the broker where deserialization can occur, like web console or stomp
object message transformation. As deserialization of untrusted data can leaed to
security flaws as demonstrated in various reports, this leaves the broker
vunerable to this attack vector. Additionally, applications that consume
ObjectMessage type of messages can be vunerable as they deserlize objects on
ObjectMessage.getObject() calls.</p>
</blockquote>
</body>
</description>
<references>
<url>http://activemq.apache.org/security-advisories.data/CVE-2015-5254-announcement.txt</url>
<cvename>CVE-2015-5254</cvename>
</references>
<dates>
<discovery>2016-01-08</discovery>
<entry>2016-03-25</entry>
</dates>
</vuln>
<vuln vid="950b2d60-f2a9-11e5-b4a9-ac220bdcec59">
<topic>activemq -- Web Console Clickjacking</topic>
<affects>
<package>
<name>activemq</name>
<range><lt>5.13.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Michael Furman reports:</p>
<blockquote cite="http://activemq.apache.org/security-advisories.data/CVE-2016-0734-announcement.txt">
<p>The web based administration console does not set the
X-Frame-Options header in HTTP responses. This allows the console to be embedded
in a frame or iframe which could then be used to cause a user to perform an
unintended action in the console.</p>
</blockquote>
</body>
</description>
<references>
<url>http://activemq.apache.org/security-advisories.data/CVE-2016-0734-announcement.txt</url>
<cvename>CVE-2016-0734</cvename>
</references>
<dates>
<discovery>2016-03-10</discovery>
<entry>2016-03-25</entry>
</dates>
</vuln>
<vuln vid="a6cc5753-f29e-11e5-b4a9-ac220bdcec59">
<topic>activemq -- Web Console Cross-Site Scripting</topic>
<affects>
<package>
<name>activemq</name>
<range><lt>5.13.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Vladimir Ivanov (Positive Technologies) reports:</p>
<blockquote cite="http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt">
<p>Several instances of cross-site scripting vulnerabilities were
identified to be present in the web based administration console as well as the
ability to trigger a Java memory dump into an arbitrary folder. The root cause
of these issues are improper user data output validation and incorrect
permissions configured on Jolokia.</p>
</blockquote>
</body>
</description>
<references>
<url>http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt</url>
<cvename>CVE-2016-0782</cvename>
</references>
<dates>
<discovery>2016-03-10</discovery>
<entry>2016-03-25</entry>
</dates>
</vuln>
<vuln vid="7033b42d-ef09-11e5-b766-14dae9d210b8">
<topic>pcre -- stack buffer overflow</topic>
<affects>
<package>
<name>pcre</name>
<range><lt>8.38</lt></range>
</package>
<package>
<name>pcre2</name>
<range><lt>10.20_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Philip Hazel reports:</p>
<blockquote cite="https://bugs.exim.org/show_bug.cgi?id=1791">
<p>PCRE does not validate that handling the (*ACCEPT) verb
will occur within the bounds of the cworkspace stack buffer, leading to
a stack buffer overflow.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.exim.org/show_bug.cgi?id=1791</url>
<cvename>CVE-2016-3191</cvename>
</references>
<dates>
<discovery>2016-02-09</discovery>
<entry>2016-03-21</entry>
<modified>2016-03-21</modified>
</dates>
</vuln>
<vuln vid="c428de09-ed69-11e5-92ce-002590263bf5">
<topic>kamailio -- SEAS Module Heap overflow</topic>
<affects>
<package>
<name>kamailio</name>
<range><lt>4.3.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Stelios Tsampas reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2016/q1/338">
<p>A (remotely exploitable) heap overflow vulnerability was found in
Kamailio v4.3.4.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2385</cvename>
<url>https://github.com/kamailio/kamailio/commit/f50c9c853e7809810099c970780c30b0765b0643</url>
<url>https://census-labs.com/news/2016/03/30/kamailio-seas-heap-overflow/</url>
<url>http://seclists.org/oss-sec/2016/q1/338</url>
</references>
<dates>
<discovery>2016-02-15</discovery>
<entry>2016-03-19</entry>
<modified>2016-04-03</modified>
</dates>
</vuln>
<vuln vid="5dd39f26-ed68-11e5-92ce-002590263bf5">
<topic>hadoop2 -- unauthorized disclosure of data vulnerability</topic>
<affects>
<package>
<name>hadoop2</name>
<range><ge>2.6</ge><lt>2.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Arun Suresh reports:</p>
<blockquote cite="http://mail-archives.apache.org/mod_mbox/hadoop-general/201602.mbox/browser">
<p>RPC traffic from clients, potentially including authentication
credentials, may be intercepted by a malicious user with access to
run tasks or containers on a cluster.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1776</cvename>
<url>http://mail-archives.apache.org/mod_mbox/hadoop-general/201602.mbox/browser</url>
</references>
<dates>
<discovery>2016-02-15</discovery>
<entry>2016-03-19</entry>
</dates>
</vuln>
<vuln vid="d2a84feb-ebe0-11e5-92ce-002590263bf5">
<topic>git -- integer overflow</topic>
<affects>
<package>
<name>git</name>
<range><lt>2.4.11</lt></range>
<range><ge>2.5.0</ge><lt>2.5.5</lt></range>
<range><ge>2.6.0</ge><lt>2.6.6</lt></range>
<range><ge>2.7.0</ge><lt>2.7.4</lt></range>
</package>
<package>
<name>git-gui</name>
<range><lt>2.4.11</lt></range>
<range><ge>2.5.0</ge><lt>2.5.5</lt></range>
<range><ge>2.6.0</ge><lt>2.6.6</lt></range>
<range><ge>2.7.0</ge><lt>2.7.4</lt></range>
</package>
<package>
<name>git-lite</name>
<range><lt>2.4.11</lt></range>
<range><ge>2.5.0</ge><lt>2.5.5</lt></range>
<range><ge>2.6.0</ge><lt>2.6.6</lt></range>
<range><ge>2.7.0</ge><lt>2.7.4</lt></range>
</package>
<package>
<name>git-subversion</name>
<range><lt>2.4.11</lt></range>
<range><ge>2.5.0</ge><lt>2.5.5</lt></range>
<range><ge>2.6.0</ge><lt>2.6.6</lt></range>
<range><ge>2.7.0</ge><lt>2.7.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Debian reports:</p>
<blockquote cite="https://security-tracker.debian.org/tracker/CVE-2016-2324">
<p>integer overflow due to a loop which adds more to "len".</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2324</cvename>
<url>https://security-tracker.debian.org/tracker/CVE-2016-2324</url>
<url>https://github.com/git/git/commit/9831e92bfa833ee9c0ce464bbc2f941ae6c2698d</url>
</references>
<dates>
<discovery>2016-02-24</discovery>
<entry>2016-03-18</entry>
</dates>
</vuln>
<vuln vid="93ee802e-ebde-11e5-92ce-002590263bf5">
<topic>git -- potential code execution</topic>
<affects>
<package>
<name>git</name>
<range><lt>2.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Debian reports:</p>
<blockquote cite="https://security-tracker.debian.org/tracker/CVE-2016-2315">
<p>"int" is the wrong data type for ... nlen assignment.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2315</cvename>
<url>http://www.openwall.com/lists/oss-security/2016/03/15/6</url>
<url>https://marc.info/?l=oss-security&amp;m=145809217306686&amp;w=2</url>
<url>https://github.com/git/git/commit/34fa79a6cde56d6d428ab0d3160cb094ebad3305</url>
<url>https://security-tracker.debian.org/tracker/CVE-2016-2315</url>
</references>
<dates>
<discovery>2015-09-24</discovery>
<entry>2016-03-17</entry>
</dates>
</vuln>
<vuln vid="6d33b3e5-ea03-11e5-85be-14dae9d210b8">
<topic>node -- multiple vulnerabilities</topic>
<affects>
<package>
<name>node</name>
<range><lt>5.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jeremiah Senkpiel reports:</p>
<blockquote cite="https://github.com/nodejs/node/commit/805f054cc7791c447dbb960fbf3b179ea05294ac">
<ul>
<li><p>Fix a double-free defect in parsing malformed DSA keys
that may potentially be used for DoS or memory corruption attacks.</p></li>
<li><p>Fix a defect that can cause memory corruption in
certain very rare cases</p></li>
<li><p>Fix a defect that makes the CacheBleed Attack possible</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/nodejs/node/commit/805f054cc7791c447dbb960fbf3b179ea05294ac</url>
<cvename>CVE-2016-0702</cvename>
<cvename>CVE-2016-0705</cvename>
<cvename>CVE-2016-0797</cvename>
</references>
<dates>
<discovery>2016-03-02</discovery>
<entry>2016-03-14</entry>
</dates>
</vuln>
<vuln vid="8eb78cdc-e9ec-11e5-85be-14dae9d210b8">
<topic>dropbear -- authorized_keys command= bypass</topic>
<affects>
<package>
<name>dropbear</name>
<range><lt>2016.72</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matt Johnson reports:</p>
<blockquote cite="https://matt.ucc.asn.au/dropbear/CHANGES">
<p>Validate X11 forwarding input. Could allow bypass of
authorized_keys command= restrictions</p>
</blockquote>
</body>
</description>
<references>
<url>https://matt.ucc.asn.au/dropbear/CHANGES</url>
<cvename>CVE-2016-3116</cvename>
</references>
<dates>
<discovery>2016-03-11</discovery>
<entry>2016-03-14</entry>
</dates>
</vuln>
<vuln vid="77b7ffb7-e937-11e5-8bed-5404a68ad561">
<topic>jpgraph2 -- XSS vulnerability</topic>
<affects>
<package>
<name>jpgraph2</name>
<range><lt>3.0.7_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Martin Barbella reports:</p>
<blockquote cite="http://www.securityfocus.com/archive/1/archive/1/508586/100/0/threaded">
<p>JpGraph is an object oriented library for PHP that can be used to create
various types of graphs which also contains support for client side
image maps.
The GetURLArguments function for the JpGraph's Graph class does not
properly sanitize the names of get and post variables, leading to a
cross site scripting vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.securityfocus.com/archive/1/archive/1/508586/100/0/threaded</url>
</references>
<dates>
<discovery>2009-12-22</discovery>
<entry>2016-03-13</entry>
</dates>
</vuln>
<vuln vid="5af511e5-e928-11e5-92ce-002590263bf5">
<topic>php7 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php70</name>
<name>php70-soap</name>
<range><lt>7.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP Group reports:</p>
<blockquote cite="http://php.net/ChangeLog-7.php#7.0.4">
<ul><li>Core:
<ul>
<li>Fixed bug #71637 (Multiple Heap Overflow due to integer
overflows in xml/filter_url/addcslashes).</li>
</ul></li>
<li>SOAP:
<ul>
<li>Fixed bug #71610 (Type Confusion Vulnerability - SOAP /
make_http_soap_request()).</li>
</ul></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://php.net/ChangeLog-7.php#7.0.4</url>
</references>
<dates>
<discovery>2016-03-03</discovery>
<entry>2016-03-13</entry>
</dates>
</vuln>
<vuln vid="e991ef79-e920-11e5-92ce-002590263bf5">
<topic>php5 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php55-phar</name>
<name>php55-wddx</name>
<range><lt>5.5.33</lt></range>
</package>
<package>
<name>php56-phar</name>
<name>php56-wddx</name>
<range><lt>5.6.19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP Group reports:</p>
<blockquote cite="http://php.net/ChangeLog-5.php#5.6.19">
<ul><li>Phar:
<ul>
<li>Fixed bug #71498 (Out-of-Bound Read in phar_parse_zipfile()).
</li>
</ul></li>
<li>WDDX:
<ul>
<li>Fixed bug #71587 (Use-After-Free / Double-Free in WDDX
Deserialize).</li>
</ul></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://php.net/ChangeLog-5.php#5.6.19</url>
<url>http://php.net/ChangeLog-5.php#5.5.33</url>
</references>
<dates>
<discovery>2016-03-03</discovery>
<entry>2016-03-13</entry>
</dates>
</vuln>
<vuln vid="e4644df8-e7da-11e5-829d-c80aa9043978">
<topic>openssh -- command injection when X11Forwarding is enabled</topic>
<affects>
<package>
<name>openssh-portable</name>
<range><lt>7.2.p2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSH project reports:</p>
<blockquote cite="http://www.openssh.com/txt/x11fwd.adv">
<p>Missing sanitisation of untrusted input allows an
authenticated user who is able to request X11 forwarding
to inject commands to xauth(1).
</p>
<p>Injection of xauth commands grants the ability to read
arbitrary files under the authenticated user's privilege,
Other xauth commands allow limited information leakage,
file overwrite, port probing and generally expose xauth(1),
which was not written with a hostile user in mind, as an
attack surface.
</p>
<p>Mitigation:</p>
<p>Set X11Forwarding=no in sshd_config. This is the default.</p>
<p>For authorized_keys that specify a "command" restriction,
also set the "restrict" (available in OpenSSH &gt;=7.2) or
"no-x11-forwarding" restrictions.
</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openssh.com/txt/x11fwd.adv</url>
<cvename>CVE-2016-3115</cvename>
</references>
<dates>
<discovery>2016-03-11</discovery>
<entry>2016-03-11</entry>
<modified>2016-03-14</modified>
</dates>
</vuln>
<vuln vid="70c44cd0-e717-11e5-85be-14dae9d210b8">
<topic>quagga -- stack based buffer overflow vulnerability</topic>
<affects>
<package>
<name>quagga</name>
<range><lt>1.0.20160309</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Donald Sharp reports:</p>
<blockquote cite="https://www.kb.cert.org/vuls/id/270232">
<p>A malicious BGP peer may execute arbitrary code in
particularly configured remote bgpd hosts.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.kb.cert.org/vuls/id/270232</url>
<url>http://savannah.nongnu.org/forum/forum.php?forum_id=8476</url>
<cvename>CVE-2016-2342</cvename>
</references>
<dates>
<discovery>2016-01-27</discovery>
<entry>2016-03-10</entry>
</dates>
</vuln>
<vuln vid="d71831ef-e6f8-11e5-85be-14dae9d210b8">
<topic>ricochet -- information disclosure</topic>
<affects>
<package>
<name>ricochet</name>
<range><lt>1.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>special reports:</p>
<blockquote cite="https://github.com/ricochet-im/ricochet/releases/tag/v1.1.2">
<p>By sending a nickname with some HTML tags in a contact
request, an attacker could cause Ricochet to make network requests
without Tor after the request is accepted, which would reveal the user's
IP address.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/ricochet-im/ricochet/releases/tag/v1.1.2</url>
</references>
<dates>
<discovery>2016-02-15</discovery>
<entry>2016-03-10</entry>
</dates>
</vuln>
<vuln vid="77e0b631-e6cf-11e5-85be-14dae9d210b8">
<topic>pidgin-otr -- use after free</topic>
<affects>
<package>
<name>pidgin-otr</name>
<range><lt>4.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Hanno Bock reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2016/q1/572">
<p>The pidgin-otr plugin version 4.0.2 fixes a heap use after
free error.
The bug is triggered when a user tries to authenticate a buddy and
happens in the function create_smp_dialog.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2016/q1/572</url>
<url>https://bugs.otr.im/issues/88</url>
<url>https://bugs.otr.im/issues/128</url>
<cvename>CVE-2015-8833</cvename>
</references>
<dates>
<discovery>2015-04-04</discovery>
<entry>2016-03-10</entry>
</dates>
</vuln>
<vuln vid="c2b1652c-e647-11e5-85be-14dae9d210b8">
<topic>libotr -- integer overflow</topic>
<affects>
<package>
<name>libotr</name>
<range><lt>4.1.1</lt></range>
</package>
<package>
<name>libotr3</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>X41 D-Sec reports:</p>
<blockquote cite="https://www.x41-dsec.de/lab/advisories/x41-2016-001-libotr/">
<p>A remote attacker may crash or execute arbitrary code in
libotr by sending large OTR messages.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.x41-dsec.de/lab/advisories/x41-2016-001-libotr/</url>
<cvename>CVE-2016-2851</cvename>
</references>
<dates>
<discovery>2016-02-17</discovery>
<entry>2016-03-09</entry>
<modified>2016-03-09</modified>
</dates>
</vuln>
<vuln vid="1bcfd963-e483-41b8-ab8e-bad5c3ce49c9">
<topic>brotli -- buffer overflow</topic>
<affects>
<package>
<name>brotli</name>
<range><ge>0.3.0</ge><lt>0.3.0_1</lt></range>
<range><lt>0.2.0_2</lt></range>
</package>
<package>
<name>libbrotli</name>
<range><lt>0.3.0_3</lt></range>
</package>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>48.0.2564.109</lt></range>
</package>
<package>
<name>firefox</name>
<name>linux-firefox</name>
<range><lt>45.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.42</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>38.7.0,1</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>38.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2016/02/stable-channel-update_9.html">
<p>[583607] High CVE-2016-1624: Buffer overflow in Brotli. Credit to lukezli.</p>
</blockquote>
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-30/">
<p>Security researcher Luke Li reported a pointer underflow
bug in the Brotli library's decompression that leads to a
buffer overflow. This results in a potentially exploitable
crash when triggered.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1624</cvename>
<cvename>CVE-2016-1968</cvename>
<url>https://github.com/google/brotli/commit/37a320dd81db8d546cd24a45b4c61d87b45dcade</url>
<url>https://chromium.googlesource.com/chromium/src/+/7716418a27d561ee295a99f11fd3865580748de2%5E!/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-30/</url>
<url>https://hg.mozilla.org/releases/mozilla-release/rev/4a5d8ade4e3e</url>
</references>
<dates>
<discovery>2016-02-08</discovery>
<entry>2016-03-08</entry>
<modified>2016-03-08</modified>
</dates>
</vuln>
<vuln vid="2225c5b4-1e5a-44fc-9920-b3201c384a15">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<name>linux-firefox</name>
<range><lt>45.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.42</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>38.7.0,1</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>38.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firefox45">
<p>MFSA 2016-16 Miscellaneous memory safety hazards (rv:45.0
/ rv:38.7)</p>
<p>MFSA 2016-17 Local file overwriting and potential
privilege escalation through CSP reports</p>
<p>MFSA 2016-18 CSP reports fail to strip location
information for embedded iframe pages</p>
<p>MFSA 2016-19 Linux video memory DOS with Intel
drivers</p>
<p>MFSA 2016-20 Memory leak in libstagefright when deleting
an array during MP4 processing</p>
<p>MFSA 2016-21 Displayed page address can be overridden</p>
<p>MFSA 2016-22 Service Worker Manager out-of-bounds read in
Service Worker Manager</p>
<p>MFSA 2016-23 Use-after-free in HTML5 string parser</p>
<p>MFSA 2016-24 Use-after-free in SetBody</p>
<p>MFSA 2016-25 Use-after-free when using multiple WebRTC
data channels</p>
<p>MFSA 2016-26 Memory corruption when modifying a file
being read by FileReader</p>
<p>MFSA 2016-27 Use-after-free during XML
transformations</p>
<p>MFSA 2016-28 Addressbar spoofing though history
navigation and Location protocol property</p>
<p>MFSA 2016-29 Same-origin policy violation using
perfomance.getEntries and history navigation with session
restore</p>
<p>MFSA 2016-31 Memory corruption with malicious NPAPI
plugin</p>
<p>MFSA 2016-32 WebRTC and LibVPX vulnerabilities found
through code inspection</p>
<p>MFSA 2016-33 Use-after-free in GetStaticInstance in
WebRTC</p>
<p>MFSA 2016-34 Out-of-bounds read in HTML parser following
a failed allocation</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1952</cvename>
<cvename>CVE-2016-1953</cvename>
<cvename>CVE-2016-1954</cvename>
<cvename>CVE-2016-1955</cvename>
<cvename>CVE-2016-1956</cvename>
<cvename>CVE-2016-1957</cvename>
<cvename>CVE-2016-1958</cvename>
<cvename>CVE-2016-1959</cvename>
<cvename>CVE-2016-1960</cvename>
<cvename>CVE-2016-1961</cvename>
<cvename>CVE-2016-1962</cvename>
<cvename>CVE-2016-1963</cvename>
<cvename>CVE-2016-1964</cvename>
<cvename>CVE-2016-1965</cvename>
<cvename>CVE-2016-1966</cvename>
<cvename>CVE-2016-1967</cvename>
<cvename>CVE-2016-1970</cvename>
<cvename>CVE-2016-1971</cvename>
<cvename>CVE-2016-1972</cvename>
<cvename>CVE-2016-1973</cvename>
<cvename>CVE-2016-1974</cvename>
<cvename>CVE-2016-1975</cvename>
<cvename>CVE-2016-1976</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2016-16/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-17/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-18/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-19/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-20/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-21/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-22/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-23/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-24/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-25/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-26/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-27/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-28/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-29/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-31/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-32/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-33/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-34/</url>
</references>
<dates>
<discovery>2016-03-08</discovery>
<entry>2016-03-08</entry>
<modified>2016-03-08</modified>
</dates>
</vuln>
<vuln vid="adffe823-e692-4921-ae9c-0b825c218372">
<topic>graphite2 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>graphite2</name>
<range><lt>1.3.6</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>45.0,1</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>38.7.0</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.42</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-37/">
<p>Security researcher Holger Fuhrmannek and Mozilla
security engineer Tyson Smith reported a number of security
vulnerabilities in the Graphite 2 library affecting version
1.3.5.
The issue reported by Holger Fuhrmannek is a mechanism to
induce stack corruption with a malicious graphite font. This
leads to a potentially exploitable crash when the font is
loaded.
Tyson Smith used the Address Sanitizer tool in concert with
a custom software fuzzer to find a series of uninitialized
memory, out-of-bounds read, and out-of-bounds write errors
when working with fuzzed graphite fonts.</p>
</blockquote>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-38/">
<p>Security researcher James Clawson used the Address
Sanitizer tool to discover an out-of-bounds write in the
Graphite 2 library when loading a crafted Graphite font
file. This results in a potentially exploitable crash.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.mozilla.org/security/advisories/mfsa2016-37/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-38/</url>
<cvename>CVE-2016-1969</cvename>
<cvename>CVE-2016-1977</cvename>
<cvename>CVE-2016-2790</cvename>
<cvename>CVE-2016-2791</cvename>
<cvename>CVE-2016-2792</cvename>
<cvename>CVE-2016-2793</cvename>
<cvename>CVE-2016-2794</cvename>
<cvename>CVE-2016-2795</cvename>
<cvename>CVE-2016-2796</cvename>
<cvename>CVE-2016-2797</cvename>
<cvename>CVE-2016-2798</cvename>
<cvename>CVE-2016-2799</cvename>
<cvename>CVE-2016-2800</cvename>
<cvename>CVE-2016-2801</cvename>
<cvename>CVE-2016-2802</cvename>
</references>
<dates>
<discovery>2016-03-08</discovery>
<entry>2016-03-08</entry>
<modified>2016-03-14</modified>
</dates>
</vuln>
<vuln vid="c4292768-5273-4f17-a267-c5fe35125ce4">
<topic>NSS -- multiple vulnerabilities</topic>
<affects>
<package>
<name>nss</name>
<name>linux-c6-nss</name>
<range><ge>3.20</ge><lt>3.21.1</lt></range>
<range><lt>3.19.2.3</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>45.0,1</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>38.7.0</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.42</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-35/">
<p>Security researcher Francis Gabriel reported a heap-based
buffer overflow in the way the Network Security Services
(NSS) libraries parsed certain ASN.1 structures. An attacker
could create a specially-crafted certificate which, when
parsed by NSS, would cause it to crash or execute arbitrary
code with the permissions of the user.</p>
</blockquote>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-36/">
<p>Mozilla developer Tim Taubert used the Address Sanitizer
tool and software fuzzing to discover a use-after-free
vulnerability while processing DER encoded keys in the
Network Security Services (NSS) libraries. The vulnerability
overwrites the freed memory with zeroes.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1950</cvename>
<cvename>CVE-2016-1979</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2016-35/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-36/</url>
<url>https://hg.mozilla.org/projects/nss/rev/b9a31471759d</url>
<url>https://hg.mozilla.org/projects/nss/rev/7033b1193c94</url>
</references>
<dates>
<discovery>2016-03-08</discovery>
<entry>2016-03-08</entry>
</dates>
</vuln>
<vuln vid="75091516-6f4b-4059-9884-6727023dc366">
<topic>NSS -- multiple vulnerabilities</topic>
<affects>
<package>
<name>nss</name>
<name>linux-c6-nss</name>
<range><lt>3.21</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>44.0,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.41</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-07/">
<p>Security researcher Hanno Böck reported that calculations
with mp_div and mp_exptmod in Network Security Services
(NSS) can produce wrong results in some circumstances. These
functions are used within NSS for a variety of cryptographic
division functions, leading to potential cryptographic
weaknesses.</p>
</blockquote>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-15/">
<p>Mozilla developer Eric Rescorla reported that a failed
allocation during DHE and ECDHE handshakes would lead to a
use-after-free vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1938</cvename>
<cvename>CVE-2016-1978</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2016-07/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-15/</url>
<url>https://hg.mozilla.org/projects/nss/rev/a555bf0fc23a</url>
<url>https://hg.mozilla.org/projects/nss/rev/a245a4ccd354</url>
</references>
<dates>
<discovery>2016-01-26</discovery>
<entry>2016-03-08</entry>
</dates>
</vuln>
<vuln vid="f9e6c0d1-e4cc-11e5-b2bd-002590263bf5">
<topic>django -- multiple vulnerabilies</topic>
<affects>
<package>
<name>py27-django</name>
<name>py32-django</name>
<name>py33-django</name>
<name>py34-django</name>
<name>py35-django</name>
<range><lt>1.8.10</lt></range>
</package>
<package>
<name>py27-django18</name>
<name>py32-django18</name>
<name>py33-django18</name>
<name>py34-django18</name>
<name>py35-django18</name>
<range><lt>1.8.10</lt></range>
</package>
<package>
<name>py27-django19</name>
<name>py32-django19</name>
<name>py33-django19</name>
<name>py34-django19</name>
<name>py35-django19</name>
<range><lt>1.9.3</lt></range>
</package>
<package>
<name>py27-django-devel</name>
<name>py32-django-devel</name>
<name>py33-django-devel</name>
<name>py34-django-devel</name>
<name>py35-django-devel</name>
<range><le>20150709,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tim Graham reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/">
<p>Malicious redirect and possible XSS attack via user-supplied
redirect URLs containing basic auth</p>
<p>User enumeration through timing difference on password hasher work
factor upgrade</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2512</cvename>
<cvename>CVE-2016-2513</cvename>
<url>https://www.djangoproject.com/weblog/2016/mar/01/security-releases/</url>
</references>
<dates>
<discovery>2016-03-01</discovery>
<entry>2016-03-08</entry>
</dates>
</vuln>
<vuln vid="fef03980-e4c6-11e5-b2bd-002590263bf5">
<topic>wordpress -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>4.4.2,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<name>zh-wordpress-zh_CN</name>
<name>zh-wordpress-zh_TW</name>
<range><lt>4.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Samuel Sidler reports:</p>
<blockquote cite="https://wordpress.org/news/2016/02/wordpress-4-4-2-security-and-maintenance-release/">
<p>WordPress 4.4.2 is now available. This is a security release for
all previous versions and we strongly encourage you to update your
sites immediately.</p>
<p>WordPress versions 4.4.1 and earlier are affected by two security
issues: a possible SSRF for certain local URIs, reported by Ronni
Skansing; and an open redirection attack, reported by Shailesh
Suthar.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2221</cvename>
<cvename>CVE-2016-2222</cvename>
<url>http://www.openwall.com/lists/oss-security/2016/02/04/6</url>
<url>https://wordpress.org/news/2016/02/wordpress-4-4-2-security-and-maintenance-release/</url>
</references>
<dates>
<discovery>2016-02-02</discovery>
<entry>2016-03-08</entry>
</dates>
</vuln>
<vuln vid="7f0fbb30-e462-11e5-a3f3-080027ef73ec">
<topic>PuTTY - old-style scp downloads may allow remote code execution</topic>
<affects>
<package>
<name>putty</name>
<range><lt>0.67</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon G. Tatham reports:</p>
<blockquote cite="http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-pscp-sink-sscanf.html">
<p>Many versions of PSCP prior to 0.67 have a stack corruption
vulnerability in their treatment of the 'sink' direction (i.e.
downloading from server to client) of the old-style SCP protocol.
</p>
<p>In order for this vulnerability to be exploited, the user must
connect to a malicious server and attempt to download any file.[...]
you can work around it in a vulnerable PSCP by using the -sftp
option to force the use of the newer SFTP protocol, provided your
server supports that protocol.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-pscp-sink-sscanf.html</url>
<cvename>CVE-2016-2563</cvename>
<url>https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-2563</url>
</references>
<dates>
<discovery>2016-02-26</discovery>
<entry>2016-03-07</entry>
</dates>
</vuln>
<vuln vid="12d1b5a6-e39d-11e5-9f77-5453ed2e2b49">
<topic>websvn -- reflected cross-site scripting</topic>
<affects>
<package>
<name>websvn</name>
<range><lt>2.3.3_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sebastien Delafond reports:</p>
<blockquote cite="https://lists.debian.org/debian-security-announce/2016/msg00060.html">
<p>Jakub Palaczynski discovered that websvn, a web viewer for
Subversion repositories, does not correctly sanitize user-supplied
input, which allows a remote user to run reflected cross-site
scripting attacks.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2511</cvename>
<url>https://lists.debian.org/debian-security-announce/2016/msg00060.html</url>
<url>http://seclists.org/fulldisclosure/2016/Feb/99</url>
</references>
<dates>
<discovery>2016-02-22</discovery>
<entry>2016-03-06</entry>
</dates>
</vuln>
<vuln vid="f69e1f09-e39b-11e5-9f77-5453ed2e2b49">
<topic>websvn -- information disclosure</topic>
<affects>
<package>
<name>websvn</name>
<range><lt>2.3.3_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Thijs Kinkhorst reports:</p>
<blockquote cite="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775682">
<p>James Clawson reported:</p>
<p>"Arbitrary files with a known path can be accessed in websvn by
committing a symlink to a repository and then downloading the file
(using the download link).</p>
<p>An attacker must have write access to the repo, and the download
option must have been enabled in the websvn config file."</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-6892</cvename>
<url>https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-6892</url>
<url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775682</url>
</references>
<dates>
<discovery>2015-01-18</discovery>
<entry>2016-03-06</entry>
</dates>
</vuln>
<vuln vid="5a016dd0-8aa8-490e-a596-55f4cc17e4ef">
<topic>rails -- multiple vulnerabilities</topic>
<affects>
<package>
<name>rubygem-actionpack</name>
<range><lt>3.2.22.2</lt></range>
</package>
<package>
<name>rubygem-actionpack4</name>
<range><lt>4.2.5.2</lt></range>
</package>
<package>
<name>rubygem-actionview</name>
<range><lt>4.2.5.2</lt></range>
</package>
<package>
<name>rubygem-rails</name>
<range><lt>3.2.22.2</lt></range>
</package>
<package>
<name>rubygem-rails4</name>
<range><lt>4.2.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby on Rails blog:</p>
<blockquote cite="http://weblog.rubyonrails.org/2016/2/29/Rails-4-2-5-2-4-1-14-2-3-2-22-2-have-been-released/">
<p>Rails 4.2.5.2, 4.1.14.2, and 3.2.22.2 have been released! These
contain the following important security fixes, and it is
recommended that users upgrade as soon as possible.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2097</cvename>
<cvename>CVE-2016-2098</cvename>
<url>https://groups.google.com/d/msg/rubyonrails-security/ddY6HgqB2z4/we0RasMZIAAJ</url>
<url>https://groups.google.com/d/msg/rubyonrails-security/ly-IH-fxr_Q/WLoOhcMZIAAJ</url>
<url>http://weblog.rubyonrails.org/2016/2/29/Rails-4-2-5-2-4-1-14-2-3-2-22-2-have-been-released/</url>
</references>
<dates>
<discovery>2016-02-29</discovery>
<entry>2016-03-06</entry>
</dates>
</vuln>
<vuln vid="f85fa236-e2a6-412e-b5c7-c42120892de5">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>49.0.2623.75</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.de/2016/03/stable-channel-update.html">
<p>[560011] High CVE-2016-1630: Same-origin bypass in Blink.</p>
<p>[569496] High CVE-2016-1631: Same-origin bypass in Pepper Plugin.</p>
<p>[549986] High CVE-2016-1632: Bad cast in Extensions.</p>
<p>[572537] High CVE-2016-1633: Use-after-free in Blink.</p>
<p>[559292] High CVE-2016-1634: Use-after-free in Blink.</p>
<p>[585268] High CVE-2016-1635: Use-after-free in Blink.</p>
<p>[584155] High CVE-2016-1636: SRI Validation Bypass.</p>
<p>[555544] Medium CVE-2016-1637: Information Leak in Skia.</p>
<p>[585282] Medium CVE-2016-1638: WebAPI Bypass.</p>
<p>[572224] Medium CVE-2016-1639: Use-after-free in WebRTC.</p>
<p>[550047] Medium CVE-2016-1640: Origin confusion in Extensions UI.</p>
<p>[583718] Medium CVE-2016-1641: Use-after-free in Favicon.</p>
<p>[591402] CVE-2016-1642: Various fixes from internal audits, fuzzing and other initiatives.</p>
<p>Multiple vulnerabilities in V8 fixed.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1630</cvename>
<cvename>CVE-2016-1631</cvename>
<cvename>CVE-2016-1632</cvename>
<cvename>CVE-2016-1633</cvename>
<cvename>CVE-2016-1634</cvename>
<cvename>CVE-2016-1635</cvename>
<cvename>CVE-2016-1636</cvename>
<cvename>CVE-2016-1637</cvename>
<cvename>CVE-2016-1638</cvename>
<cvename>CVE-2016-1639</cvename>
<cvename>CVE-2016-1640</cvename>
<cvename>CVE-2016-1641</cvename>
<cvename>CVE-2016-1642</cvename>
<url>http://googlechromereleases.blogspot.de/2016/03/stable-channel-update.html</url>
</references>
<dates>
<discovery>2016-03-02</discovery>
<entry>2016-03-05</entry>
</dates>
</vuln>
<vuln vid="6b3591ea-e2d2-11e5-a6be-5453ed2e2b49">
<topic>libssh -- weak Diffie-Hellman secret generation</topic>
<affects>
<package>
<name>libssh</name>
<range><lt>0.7.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Andreas Schneider reports:</p>
<blockquote cite="https://www.libssh.org/2016/02/23/libssh-0-7-3-security-and-bugfix-release/">
<p>libssh versions 0.1 and above have a bits/bytes confusion bug and
generate the an anormaly short ephemeral secret for the
diffie-hellman-group1 and diffie-hellman-group14 key exchange
methods. The resulting secret is 128 bits long, instead of the
recommended sizes of 1024 and 2048 bits respectively. There are
practical algorithms (Baby steps/Giant steps, Pollard’s rho) that can
solve this problem in O(2^63) operations.</p>
<p>Both client and server are are vulnerable, pre-authentication.
This vulnerability could be exploited by an eavesdropper with enough
resources to decrypt or intercept SSH sessions. The bug was found
during an internal code review by Aris Adamantiadis of the libssh
team.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-0739</cvename>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-0739</url>
<url>https://www.libssh.org/2016/02/23/libssh-0-7-3-security-and-bugfix-release/</url>
</references>
<dates>
<discovery>2016-02-23</discovery>
<entry>2016-03-05</entry>
</dates>
</vuln>
<vuln vid="7d09b9ee-e0ba-11e5-abc4-6fb07af136d2">
<topic>exim -- local privilleges escalation</topic>
<affects>
<package>
<name>exim</name>
<range><lt>4.86.2</lt></range>
<range><lt>4.85.2</lt></range>
<range><lt>4.84.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Exim development team reports:</p>
<blockquote cite="https://lists.exim.org/lurker/message/20160302.191005.a72d8433.en.html">
<p>All installations having Exim set-uid root and using 'perl_startup' are
vulnerable to a local privilege escalation. Any user who can start an
instance of Exim (and this is normally <strong>any</strong> user) can gain root
privileges. If you do not use 'perl_startup' you <strong>should</strong> be safe.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1531</cvename>
<url>https://lists.exim.org/lurker/message/20160302.191005.a72d8433.en.html</url>
</references>
<dates>
<discovery>2016-02-26</discovery>
<entry>2016-03-02</entry>
</dates>
</vuln>
<vuln vid="db3301be-e01c-11e5-b2bd-002590263bf5">
<topic>cacti -- multiple vulnerabilities</topic>
<affects>
<package>
<name>cacti</name>
<range><lt>0.8.8g</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Cacti Group, Inc. reports:</p>
<blockquote cite="http://www.cacti.net/release_notes_0_8_8g.php">
<p>Changelog</p>
<ul>
<li>bug:0002652: CVE-2015-8604: SQL injection in graphs_new.php</li>
<li>bug:0002655: CVE-2015-8377: SQL injection vulnerability in the
host_new_graphs_save function in graphs_new.php</li>
<li>bug:0002656: Authentication using web authentication as a user
not in the cacti database allows complete access</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8377</cvename>
<cvename>CVE-2015-8604</cvename>
<cvename>CVE-2016-2313</cvename>
<url>http://www.cacti.net/release_notes_0_8_8g.php</url>
<url>http://bugs.cacti.net/view.php?id=2652</url>
<url>http://bugs.cacti.net/view.php?id=2655</url>
<url>http://bugs.cacti.net/view.php?id=2656</url>
<url>http://www.openwall.com/lists/oss-security/2016/02/09/3</url>
</references>
<dates>
<discovery>2016-02-21</discovery>
<entry>2016-03-02</entry>
</dates>
</vuln>
<vuln vid="f682a506-df7c-11e5-81e4-6805ca0b3d42">
<topic>phpmyadmin -- multiple XSS and a man-in-the-middle vulnerability</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><ge>4.5.0</ge><lt>4.5.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-10/">
<p>XSS vulnerability in SQL parser.</p>
<p>Using a crafted SQL query, it is possible to trigger an XSS
attack through the SQL query page.</p>
<p>We consider this vulnerability to be non-critical.</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-11/">
<p>Multiple XSS vulnerabilities.</p>
<p>By sending a specially crafted URL as part of the HOST
header, it is possible to trigger an XSS attack.</p>
<p>A weakness was found that allows an XSS attack with Internet
Explorer versions older than 8 and Safari on Windows using a
specially crafted URL.</p>
<p>Using a crafted SQL query, it is possible to trigger an XSS
attack through the SQL query page.</p>
<p>Using a crafted parameter value, it is possible to trigger
an XSS attack in user accounts page.</p>
<p>Using a crafted parameter value, it is possible to trigger
an XSS attack in zoom search page.</p>
<p>We consider this vulnerability to be non-critical.</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-12/">
<p>Multiple XSS vulnerabilities.</p>
<p>With a crafted table/column name it is possible to trigger
an XSS attack in the database normalization page.</p>
<p>With a crafted parameter it is possible to trigger an XSS
attack in the database structure page.</p>
<p>With a crafted parameter it is possible to trigger an XSS
attack in central columns page.</p>
<p>We consider this vulnerability to be non-critical.</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-13/">
<p>Vulnerability allowing man-in-the-middle attack on API
call to GitHub.</p>
<p>A vulnerability in the API call to GitHub can be exploited
to perform a man-in-the-middle attack.</p>
<p>We consider this vulnerability to be serious.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2016-10/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-11/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-12/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-13/</url>
<cvename>CVE-2016-2559</cvename>
<cvename>CVE-2016-2560</cvename>
<cvename>CVE-2016-2561</cvename>
<cvename>CVE-2016-2562</cvename>
</references>
<dates>
<discovery>2016-02-29</discovery>
<entry>2016-03-01</entry>
</dates>
</vuln>
<vuln vid="45117749-df55-11e5-b2bd-002590263bf5">
<topic>wireshark -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wireshark</name>
<name>wireshark-lite</name>
<name>wireshark-qt5</name>
<name>tshark</name>
<name>tshark-lite</name>
<range><lt>2.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Wireshark development team reports:</p>
<blockquote cite="https://www.wireshark.org/docs/relnotes/wireshark-2.0.2.html">
<p>The following vulnerabilities have been fixed:</p>
<ul>
<li><p>wnpa-sec-2016-02</p>
<p>ASN.1 BER dissector crash. (Bug 11828) CVE-2016-2522</p></li>
<li><p>wnpa-sec-2016-03</p>
<p>DNP dissector infinite loop. (Bug 11938) CVE-2016-2523</p></li>
<li><p>wnpa-sec-2016-04</p>
<p>X.509AF dissector crash. (Bug 12002) CVE-2016-2524</p></li>
<li><p>wnpa-sec-2016-05</p>
<p>HTTP/2 dissector crash. (Bug 12077) CVE-2016-2525</p></li>
<li><p>wnpa-sec-2016-06</p>
<p>HiQnet dissector crash. (Bug 11983) CVE-2016-2526</p></li>
<li><p>wnpa-sec-2016-07</p>
<p>3GPP TS 32.423 Trace file parser crash. (Bug 11982)
</p>CVE-2016-2527</li>
<li><p>wnpa-sec-2016-08</p>
<p>LBMC dissector crash. (Bug 11984) CVE-2016-2528</p></li>
<li><p>wnpa-sec-2016-09</p>
<p>iSeries file parser crash. (Bug 11985) CVE-2016-2529</p></li>
<li><p>wnpa-sec-2016-10</p>
<p>RSL dissector crash. (Bug 11829) CVE-2016-2530
CVE-2016-2531</p></li>
<li><p>wnpa-sec-2016-11</p>
<p>LLRP dissector crash. (Bug 12048) CVE-2016-2532</p></li>
<li><p>wnpa-sec-2016-12</p>
<p>Ixia IxVeriWave file parser crash. (Bug 11795)</p></li>
<li><p>wnpa-sec-2016-13</p>
<p>IEEE 802.11 dissector crash. (Bug 11818)</p></li>
<li><p>wnpa-sec-2016-14</p>
<p>GSM A-bis OML dissector crash. (Bug 11825)</p></li>
<li><p>wnpa-sec-2016-15</p>
<p>ASN.1 BER dissector crash. (Bug 12106)</p></li>
<li><p>wnpa-sec-2016-16</p>
<p>SPICE dissector large loop. (Bug 12151)</p></li>
<li><p>wnpa-sec-2016-17</p>
<p>NFS dissector crash.</p></li>
<li><p>wnpa-sec-2016-18</p>
<p>ASN.1 BER dissector crash. (Bug 11822)</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2522</cvename>
<cvename>CVE-2016-2523</cvename>
<cvename>CVE-2016-2524</cvename>
<cvename>CVE-2016-2525</cvename>
<cvename>CVE-2016-2526</cvename>
<cvename>CVE-2016-2527</cvename>
<cvename>CVE-2016-2528</cvename>
<cvename>CVE-2016-2529</cvename>
<cvename>CVE-2016-2530</cvename>
<cvename>CVE-2016-2531</cvename>
<cvename>CVE-2016-2532</cvename>
<url>https://www.wireshark.org/docs/relnotes/wireshark-2.0.1.html</url>
</references>
<dates>
<discovery>2016-02-26</discovery>
<entry>2016-03-01</entry>
</dates>
</vuln>
<vuln vid="42c2c422-df55-11e5-b2bd-002590263bf5">
<topic>wireshark -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wireshark</name>
<name>wireshark-lite</name>
<name>wireshark-qt5</name>
<name>tshark</name>
<name>tshark-lite</name>
<range><lt>2.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Wireshark development team reports:</p>
<blockquote cite="https://www.wireshark.org/docs/relnotes/wireshark-2.0.1.html">
<p>The following vulnerabilities have been fixed:</p>
<ul>
<li><p>wnpa-sec-2015-31</p>
<p>NBAP dissector crashes. (Bug 11602, Bug 11835, Bug 11841)</p>
</li>
<li><p>wnpa-sec-2015-37</p>
<p>NLM dissector crash.</p></li>
<li><p>wnpa-sec-2015-39</p>
<p>BER dissector crash.</p></li>
<li><p>wnpa-sec-2015-40</p>
<p>Zlib decompression crash. (Bug 11548)</p></li>
<li><p>wnpa-sec-2015-41</p>
<p>SCTP dissector crash. (Bug 11767)</p></li>
<li><p>wnpa-sec-2015-42</p>
<p>802.11 decryption crash. (Bug 11790, Bug 11826)</p></li>
<li><p>wnpa-sec-2015-43</p>
<p>DIAMETER dissector crash. (Bug 11792)</p></li>
<li><p>wnpa-sec-2015-44</p>
<p>VeriWave file parser crashes. (Bug 11789, Bug 11791)</p></li>
<li><p>wnpa-sec-2015-45</p>
<p>RSVP dissector crash. (Bug 11793)</p></li>
<li><p>wnpa-sec-2015-46</p>
<p>ANSI A and GSM A dissector crashes. (Bug 11797)</p></li>
<li><p>wnpa-sec-2015-47</p>
<p>Ascend file parser crash. (Bug 11794)</p></li>
<li><p>wnpa-sec-2015-48</p>
<p>NBAP dissector crash. (Bug 11815)</p></li>
<li><p>wnpa-sec-2015-49</p>
<p>RSL dissector crash. (Bug 11829)</p></li>
<li><p>wnpa-sec-2015-50</p>
<p>ZigBee ZCL dissector crash. (Bug 11830)</p></li>
<li><p>wnpa-sec-2015-51</p>
<p>Sniffer file parser crash. (Bug 11827)</p></li>
<li><p>wnpa-sec-2015-52</p>
<p>NWP dissector crash. (Bug 11726)</p></li>
<li><p>wnpa-sec-2015-53</p>
<p>BT ATT dissector crash. (Bug 11817)</p></li>
<li><p>wnpa-sec-2015-54</p>
<p>MP2T file parser crash. (Bug 11820)</p></li>
<li><p>wnpa-sec-2015-55</p>
<p>MP2T file parser crash. (Bug 11821)</p></li>
<li><p>wnpa-sec-2015-56</p>
<p>S7COMM dissector crash. (Bug 11823)</p></li>
<li><p>wnpa-sec-2015-57</p>
<p>IPMI dissector crash. (Bug 11831)</p></li>
<li><p>wnpa-sec-2015-58</p>
<p>TDS dissector crash. (Bug 11846)</p></li>
<li><p>wnpa-sec-2015-59</p>
<p>PPI dissector crash. (Bug 11876)</p></li>
<li><p>wnpa-sec-2015-60</p>
<p>MS-WSP dissector crash. (Bug 11931)</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.wireshark.org/docs/relnotes/wireshark-2.0.1.html</url>
</references>
<dates>
<discovery>2015-12-29</discovery>
<entry>2016-03-01</entry>
</dates>
</vuln>
<vuln vid="7bbc3016-de63-11e5-8fa8-14dae9d210b8">
<topic>tomcat -- multiple vulnerabilities</topic>
<affects>
<package>
<name>tomcat7</name>
<range><lt>7.0.68</lt></range>
</package>
<package>
<name>tomcat8</name>
<range><lt>8.0.30</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mark Thomas reports:</p>
<blockquote cite="http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEF96.7070701@apache.org%3e">
<ul>
<li><p>CVE-2015-5346 Apache Tomcat Session fixation</p></li>
<li><p>CVE-2015-5351 Apache Tomcat CSRF token leak</p></li>
<li><p>CVE-2016-0763 Apache Tomcat Security Manager Bypass</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEF96.7070701@apache.org%3e</url>
<url>http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEF7B.1010901@apache.org%3e</url>
<url>http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEFB2.9030605@apache.org%3e</url>
<cvename>CVE-2015-5346</cvename>
<cvename>CVE-2015-5351</cvename>
<cvename>CVE-2016-0763</cvename>
</references>
<dates>
<discovery>2016-02-22</discovery>
<entry>2016-02-28</entry>
</dates>
</vuln>
<vuln vid="1f1124fe-de5c-11e5-8fa8-14dae9d210b8">
<topic>tomcat -- multiple vulnerabilities</topic>
<affects>
<package>
<name>tomcat6</name>
<range><lt>6.0.45</lt></range>
</package>
<package>
<name>tomcat7</name>
<range><lt>7.0.68</lt></range>
</package>
<package>
<name>tomcat8</name>
<range><lt>8.0.30</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mark Thomas reports:</p>
<blockquote cite="http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEF96.7070701@apache.org%3e">
<ul>
<li><p>CVE-2015-5345 Apache Tomcat Directory disclosure</p></li>
<li><p>CVE-2016-0706 Apache Tomcat Security Manager bypass</p></li>
<li><p>CVE-2016-0714 Apache Tomcat Security Manager Bypass</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEF96.7070701@apache.org%3e</url>
<url>http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEF6A.70703@apache.org%3e</url>
<url>http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEF4F.5090003@apache.org%3e</url>
<cvename>CVE-2015-5345</cvename>
<cvename>CVE-2015-5346</cvename>
<cvename>CVE-2016-0706</cvename>
<cvename>CVE-2016-0714</cvename>
</references>
<dates>
<discovery>2016-02-22</discovery>
<entry>2016-02-28</entry>
<modified>2016-02-28</modified>
</dates>
</vuln>
<vuln vid="a7f2e9c6-de20-11e5-8458-6cc21735f730">
<topic>xerces-c3 -- Parser Crashes on Malformed Input</topic>
<affects>
<package>
<name>xerces-c3</name>
<range><lt>3.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Software Foundation reports:</p>
<blockquote cite="http://xerces.apache.org/xerces-c/secadv/CVE-2016-0729.txt">
<p>The Xerces-C XML parser mishandles certain kinds of malformed input
documents, resulting in buffer overlows during processing and error
reporting. The overflows can manifest as a segmentation fault or as
memory corruption during a parse operation. The bugs allow for a
denial of service attack in many applications by an unauthenticated
attacker, and could conceivably result in remote code execution.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-0729</cvename>
<url>http://xerces.apache.org/xerces-c/secadv/CVE-2016-0729.txt</url>
</references>
<dates>
<discovery>2016-02-25</discovery>
<entry>2016-02-28</entry>
</dates>
</vuln>
<vuln vid="6b1d8a39-ddb3-11e5-8fa8-14dae9d210b8">
<topic>django -- regression in permissions model</topic>
<affects>
<package>
<name>py27-django19</name>
<name>py33-django19</name>
<name>py34-django19</name>
<name>py35-django19</name>
<range><lt>1.9.2</lt></range>
</package>
<package>
<name>py27-django-devel</name>
<name>py33-django-devel</name>
<name>py34-django-devel</name>
<name>py35-django-devel</name>
<range><le>20150709,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tim Graham reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2016/feb/01/releases-192-and-189/">
<p>User with "change" but not "add" permission can create
objects for ModelAdmin’s with save_as=True</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.djangoproject.com/weblog/2016/feb/01/releases-192-and-189/</url>
<cvename>CVE-2016-2048</cvename>
</references>
<dates>
<discovery>2016-02-01</discovery>
<entry>2016-02-28</entry>
</dates>
</vuln>
<vuln vid="81f9d6a4-ddaf-11e5-b2bd-002590263bf5">
<topic>xen-kernel -- VMX: guest user mode may crash guest with non-canonical RIP</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.5.2_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-170.html">
<p>VMX refuses attempts to enter a guest with an instruction pointer
which doesn't satisfy certain requirements. In particular, the
instruction pointer needs to be canonical when entering a guest
currently in 64-bit mode. This is the case even if the VM entry
information specifies an exception to be injected immediately (in
which case the bad instruction pointer would possibly never get used
for other than pushing onto the exception handler's stack).
Provided the guest OS allows user mode to map the virtual memory
space immediately below the canonical/non-canonical address
boundary, a non-canonical instruction pointer can result even from
normal user mode execution. VM entry failure, however, is fatal to
the guest.</p>
<p>Malicious HVM guest user mode code may be able to crash the
guest.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2271</cvename>
<url>http://xenbits.xen.org/xsa/advisory-170.html</url>
</references>
<dates>
<discovery>2016-02-17</discovery>
<entry>2016-02-28</entry>
</dates>
</vuln>
<vuln vid="80adc394-ddaf-11e5-b2bd-002590263bf5">
<topic>xen-kernel -- VMX: intercept issue with INVLPG on non-canonical address</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><ge>3.3</ge><lt>4.5.2_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-168.html">
<p>While INVLPG does not cause a General Protection Fault when used on
a non-canonical address, INVVPID in its "individual address"
variant, which is used to back the intercepted INVLPG in certain
cases, fails in such cases. Failure of INVVPID results in a
hypervisor bug check.</p>
<p>A malicious guest can crash the host, leading to a Denial of
Service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1571</cvename>
<url>http://xenbits.xen.org/xsa/advisory-168.html</url>
</references>
<dates>
<discovery>2016-01-20</discovery>
<entry>2016-02-28</entry>
</dates>
</vuln>
<vuln vid="7ed7c36f-ddaf-11e5-b2bd-002590263bf5">
<topic>xen-kernel -- PV superpage functionality missing sanity checks</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><eq>3.4.0</eq></range>
<range><eq>3.4.1</eq></range>
<range><ge>4.1</ge><lt>4.5.2_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-167.html">
<p>The PV superpage functionality lacks certain validity checks on
data being passed to the hypervisor by guests. This is the case
for the page identifier (MFN) passed to MMUEXT_MARK_SUPER and
MMUEXT_UNMARK_SUPER sub-ops of the HYPERVISOR_mmuext_op hypercall as
well as for various forms of page table updates.</p>
<p>Use of the feature, which is disabled by default, may have unknown
effects, ranging from information leaks through Denial of Service to
privilege escalation.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1570</cvename>
<url>http://xenbits.xen.org/xsa/advisory-167.html</url>
</references>
<dates>
<discovery>2016-01-20</discovery>
<entry>2016-02-28</entry>
</dates>
</vuln>
<vuln vid="2d299950-ddb0-11e5-8fa8-14dae9d210b8">
<topic>moodle -- multiple vulnerabilities</topic>
<affects>
<package>
<name>moodle28</name>
<range><lt>2.8.10</lt></range>
</package>
<package>
<name>moodle29</name>
<range><lt>2.9.4</lt></range>
</package>
<package>
<name>moodle30</name>
<range><lt>3.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Marina Glancy reports:</p>
<blockquote cite="https://moodle.org/security/">
<ul>
<li><p>MSA-16-0001: Two enrolment-related web services don't
check course visibility</p></li>
<li><p>MSA-16-0002: XSS Vulnerability in course management
search</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://moodle.org/security/</url>
<cvename>CVE-2016-0724</cvename>
<cvename>CVE-2016-0725</cvename>
</references>
<dates>
<discovery>2016-01-18</discovery>
<entry>2016-02-28</entry>
</dates>
</vuln>
<vuln vid="6540c8f0-dca3-11e5-8fa8-14dae9d210b8">
<topic>pitivi -- code execution</topic>
<affects>
<package>
<name>pitivi</name>
<range><lt>0.95</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Luke Farone reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/23/8">
<p>Double-clicking a file in the user's media library with a
specially-crafted path or filename allows for arbitrary code execution
with the permissions of the user running Pitivi.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2015/12/23/8</url>
<url>https://git.gnome.org/browse/pitivi/commit/?id=45a4c84edb3b4343f199bba1c65502e3f49f5bb2</url>
<cvename>CVE-2015-0855</cvename>
</references>
<dates>
<discovery>2015-09-13</discovery>
<entry>2016-02-26</entry>
</dates>
</vuln>
<vuln vid="90c8385a-dc9f-11e5-8fa8-14dae9d210b8">
<topic>giflib -- heap overflow</topic>
<affects>
<package>
<name>giflib</name>
<range><lt>5.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Hans Jerry Illikainen reports:</p>
<blockquote cite="http://seclists.org/bugtraq/2015/Dec/114">
<p>A heap overflow may occur in the giffix utility included in
giflib-5.1.1 when processing records of the type
`IMAGE_DESC_RECORD_TYPE' due to the allocated size of `LineBuffer'
equaling the value of the logical screen width, `GifFileIn-&gt;SWidth',
while subsequently having `GifFileIn-&gt;Image.Width' bytes of data written
to it.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/bugtraq/2015/Dec/114</url>
<cvename>CVE-2015-7555</cvename>
</references>
<dates>
<discovery>2015-12-21</discovery>
<entry>2016-02-26</entry>
</dates>
</vuln>
<vuln vid="59a0af97-dbd4-11e5-8fa8-14dae9d210b8">
<topic>drupal -- multiple vulnerabilities</topic>
<affects>
<package>
<name>drupal6</name>
<range><lt>6.38</lt></range>
</package>
<package>
<name>drupal7</name>
<range><lt>7.43</lt></range>
</package>
<package>
<name>drupal8</name>
<range><lt>8.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team reports:</p>
<blockquote cite="https://www.drupal.org/SA-CORE-2016-001">
<ul>
<li><p>File upload access bypass and denial of service (File
module - Drupal 7 and 8 - Moderately Critical)</p></li>
<li><p>Brute force amplification attacks via XML-RPC (XML-RPC
server - Drupal 6 and 7 - Moderately Critical)</p></li>
<li><p>Open redirect via path manipulation (Base system -
Drupal 6, 7 and 8 - Moderately Critical) </p></li>
<li><p>Form API ignores access restrictions on submit buttons
(Form API - Drupal 6 - Critical)</p></li>
<li><p>HTTP header injection using line breaks (Base system -
Drupal 6 - Moderately Critical)</p></li>
<li><p>Open redirect via double-encoded 'destination'
parameter (Base system - Drupal 6 - Moderately Critical)</p></li>
<li><p>Reflected file download vulnerability (System module -
Drupal 6 and 7 - Moderately Critical)</p></li>
<li><p>Saving user accounts can sometimes grant the user all
roles (User module - Drupal 6 and 7 - Less Critical)</p></li>
<li><p>Email address can be matched to an account (User module
- Drupal 7 and 8 - Less Critical)</p></li>
<li><p>Session data truncation can lead to unserialization of
user provided data (Base system - Drupal 6 - Less Critical)</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.drupal.org/SA-CORE-2016-001</url>
</references>
<dates>
<discovery>2016-02-24</discovery>
<entry>2016-02-25</entry>
</dates>
</vuln>
<vuln vid="7e01df39-db7e-11e5-b937-00e0814cab4e">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><le>1.650</le></range>
</package>
<package>
<name>jenkins-lts</name>
<range><le>1.642.2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Security+Advisory+2016-02-24">
<h1>Description</h1>
<h5>SECURITY-232 / CVE-2016-0788(Remote code execution vulnerability in remoting module)</h5>
<p>A vulnerability in the Jenkins remoting module allowed
unauthenticated remote attackers to open a JRMP listener on the
server hosting the Jenkins master process, which allowed arbitrary
code execution.</p>
<h5>SECURITY-238 / CVE-2016-0789(HTTP response splitting vulnerability)</h5>
<p>An HTTP response splitting vulnerability in the CLI command
documentation allowed attackers to craft Jenkins URLs that serve
malicious content.</p>
<h5>SECURITY-241 / CVE-2016-0790(Non-constant time comparison of API token)</h5>
<p>The verification of user-provided API tokens with the expected
value did not use a constant-time comparison algorithm, potentially
allowing attackers to use statistical methods to determine valid
API tokens using brute-force methods.</p>
<h5>SECURITY-245 / CVE-2016-0791(Non-constant time comparison of CSRF crumbs)</h5>
<p>The verification of user-provided CSRF crumbs with the expected
value did not use a constant-time comparison algorithm, potentially
allowing attackers to use statistical methods to determine valid
CSRF crumbs using brute-force methods.</p>
<h5>SECURITY-247 / CVE-2016-0792(Remote code execution through remote API)</h5>
<p>Jenkins has several API endpoints that allow low-privilege users
to POST XML files that then get deserialized by Jenkins.
Maliciously crafted XML files sent to these API endpoints could
result in arbitrary code execution.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wiki.jenkins-ci.org/display/SECURITY/Security+Advisory+2016-02-24</url>
</references>
<dates>
<discovery>2016-02-24</discovery>
<entry>2016-02-25</entry>
</dates>
</vuln>
<vuln vid="660ebbf5-daeb-11e5-b2bd-002590263bf5">
<topic>squid -- remote DoS in HTTP response processing</topic>
<affects>
<package>
<name>squid</name>
<range><lt>3.5.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Squid security advisory 2016:2 reports:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2016_2.txt">
<p>Due to incorrect bounds checking Squid is vulnerable to a denial
of service attack when processing HTTP responses.</p>
<p>These problems allow remote servers delivering certain unusual
HTTP response syntax to trigger a denial of service for all
clients accessing the Squid service.</p>
<p>HTTP responses containing malformed headers that trigger this
issue are becoming common. We are not certain at this time if
that is a sign of malware or just broken server scripting.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2569</cvename>
<cvename>CVE-2016-2570</cvename>
<cvename>CVE-2016-2571</cvename>
<freebsdpr>ports/207454</freebsdpr>
<url>http://www.squid-cache.org/Advisories/SQUID-2016_2.txt</url>
<url>http://www.openwall.com/lists/oss-security/2016/02/24/12</url>
</references>
<dates>
<discovery>2016-02-24</discovery>
<entry>2016-02-24</entry>
<modified>2016-02-28</modified>
</dates>
</vuln>
<vuln vid="9e5bbffc-d8ac-11e5-b2bd-002590263bf5">
<topic>bsh -- remote code execution vulnerability</topic>
<affects>
<package>
<name>bsh</name>
<range><lt>2.0.b6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Stian Soiland-Reyes reports:</p>
<blockquote cite="https://github.com/beanshell/beanshell/releases/tag/2.0b6">
<p>This release fixes a remote code execution vulnerability that was
identified in BeanShell by Alvaro Muñoz and Christian Schneider.
The BeanShell team would like to thank them for their help and
contributions to this fix!</p>
<p>An application that includes BeanShell on the classpath may be
vulnerable if another part of the application uses Java
serialization or XStream to deserialize data from an untrusted
source.</p>
<p>A vulnerable application could be exploited for remote code
execution, including executing arbitrary shell commands.</p>
<p>This update fixes the vulnerability in BeanShell, but it is worth
noting that applications doing such deserialization might still be
insecure through other libraries. It is recommended that application
developers take further measures such as using a restricted class
loader when deserializing. See notes on Java serialization security
XStream security and How to secure deserialization from untrusted
input without using encryption or sealing.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2510</cvename>
<freebsdpr>ports/207334</freebsdpr>
<url>https://github.com/beanshell/beanshell/releases/tag/2.0b6</url>
</references>
<dates>
<discovery>2016-02-18</discovery>
<entry>2016-02-21</entry>
</dates>
</vuln>
<vuln vid="6171eb07-d8a9-11e5-b2bd-002590263bf5">
<topic>libsrtp -- DoS via crafted RTP header vulnerability</topic>
<affects>
<package>
<name>libsrtp</name>
<range><lt>1.5.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libsrtp reports:</p>
<blockquote cite="https://github.com/cisco/libsrtp/commit/704a31774db0dd941094fd2b47c21638b8dc3de2">
<p>Prevent potential DoS attack due to lack of bounds checking on RTP
header CSRC count and extension header length. Credit goes to
Randell Jesup and the Firefox team for reporting this issue.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-6360</cvename>
<freebsdpr>ports/207003</freebsdpr>
<url>https://github.com/cisco/libsrtp/releases/tag/v1.5.3</url>
<url>https://github.com/cisco/libsrtp/commit/704a31774db0dd941094fd2b47c21638b8dc3de2</url>
<url>https://github.com/cisco/libsrtp/commit/be95365fbb4788b688cab7af61c65b7989055fb4</url>
<url>https://github.com/cisco/libsrtp/commit/be06686c8e98cc7bd934e10abb6f5e971d03f8ee</url>
<url>https://github.com/cisco/libsrtp/commit/cdc69f2acde796a4152a250f869271298abc233f</url>
</references>
<dates>
<discovery>2015-11-02</discovery>
<entry>2016-02-21</entry>
</dates>
</vuln>
<vuln vid="006e3b7c-d7d7-11e5-b85f-0018fe623f2b">
<topic>jasper -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jasper</name>
<range><lt>1.900.1_16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>oCERT reports:</p>
<blockquote cite="http://www.ocert.org/advisories/ocert-2014-012.html">
<p>The library is affected by a double-free vulnerability in function
jas_iccattrval_destroy()
as well as a heap-based buffer overflow in function jp2_decode().
A specially crafted jp2 file can be used to trigger the vulnerabilities.</p>
</blockquote>
<p>oCERT reports:</p>
<blockquote cite="http://www.ocert.org/advisories/ocert-2015-001.html">
<p>The library is affected by an off-by-one error in a buffer boundary check
in jpc_dec_process_sot(), leading to a heap based buffer overflow, as well
as multiple unrestricted stack memory use issues in jpc_qmfb.c, leading to
stack overflow.
A specially crafted jp2 file can be used to trigger the vulnerabilities.</p>
</blockquote>
<p>oCERT reports:</p>
<blockquote cite="http://www.ocert.org/advisories/ocert-2014-009.html">
<p>Multiple off-by-one flaws, leading to heap-based buffer overflows, were
found in the way JasPer decoded JPEG 2000 files. A specially crafted file
could cause an application using JasPer to crash or,
possibly, execute arbitrary code.</p>
</blockquote>
<p>limingxing reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2016/q1/233">
<p>A vulnerability was found in the way the JasPer's jas_matrix_clip()
function parses certain JPEG 2000 image files. A specially crafted file
could cause an application using JasPer to crash.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.ocert.org/advisories/ocert-2014-012.html</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1173157</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1173162</url>
<url>http://www.ocert.org/advisories/ocert-2015-001.html</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1179282</url>
<url>http://www.ocert.org/advisories/ocert-2014-009.html</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1167537</url>
<url>http://seclists.org/oss-sec/2016/q1/233</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1302636</url>
<cvename>CVE-2014-8137</cvename>
<cvename>CVE-2014-8138</cvename>
<cvename>CVE-2014-8157</cvename>
<cvename>CVE-2014-8158</cvename>
<cvename>CVE-2014-9029</cvename>
<cvename>CVE-2016-2089</cvename>
</references>
<dates>
<discovery>2014-12-10</discovery>
<entry>2016-02-20</entry>
<modified>2016-02-24</modified>
</dates>
</vuln>
<vuln vid="368993bb-d685-11e5-8858-00262d5ed8ee">
<topic>chromium -- same origin bypass</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>48.0.2564.116</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2016/02/stable-channel-update_18.html">
<p>[583431] Critical CVE-2016-1629: Same-origin bypass in Blink
and Sandbox escape in Chrome. Credit to anonymous.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1629</cvename>
<url>http://googlechromereleases.blogspot.nl/2016/02/stable-channel-update_18.html</url>
</references>
<dates>
<discovery>2016-02-18</discovery>
<entry>2016-02-18</entry>
</dates>
</vuln>
<vuln vid="2dd7e97e-d5e8-11e5-bcbd-bc5ff45d0f28">
<topic>glibc -- getaddrinfo stack-based buffer overflow</topic>
<affects>
<package>
<name>linux_base-c6</name>
<name>linux_base-c6_64</name>
<range><lt>6.7_1</lt></range>
</package>
<package>
<name>linux_base-f10</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Fabio Olive Leite reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-7547">
<p>A stack-based buffer overflow was found in libresolv when invoked
from nss_dns, allowing specially crafted DNS responses to seize
control of EIP in the DNS client. The buffer overflow occurs in the
functions send_dg (send datagram) and send_vc (send TCP) for the
NSS module libnss_dns.so.2 when calling getaddrinfo with AF_UNSPEC
family, or in some cases AF_INET6 family. The use of AF_UNSPEC (or
AF_INET6 in some cases) triggers the low-level resolver code to
send out two parallel queries for A and AAAA. A mismanagement of
the buffers used for those queries could result in the response of
a query writing beyond the alloca allocated buffer created by
__res_nquery.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7547</cvename>
<freebsdpr>ports/207272</freebsdpr>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-7547</url>
<url>https://blog.des.no/2016/02/freebsd-and-cve-2015-7547/</url>
<url>https://googleonlinesecurity.blogspot.no/2016/02/cve-2015-7547-glibc-getaddrinfo-stack.html</url>
<url>https://sourceware.org/ml/libc-alpha/2016-02/msg00416.html</url>
</references>
<dates>
<discovery>2016-02-16</discovery>
<entry>2016-02-18</entry>
</dates>
</vuln>
<vuln vid="56562efb-d5e4-11e5-b2bd-002590263bf5">
<topic>squid -- SSL/TLS processing remote DoS</topic>
<affects>
<package>
<name>squid</name>
<range><ge>3.5.13</ge><lt>3.5.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Squid security advisory 2016:1 reports:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2016_1.txt">
<p>Due to incorrectly handling server errors Squid is vulnerable to a
denial of service attack when connecting to TLS or SSL servers.</p>
<p>This problem allows any trusted client to perform a denial of
service attack on the Squid service regardless of whether TLS or
SSL is configured for use in the proxy.</p>
<p>Misconfigured client or server software may trigger this issue
to perform a denial of service unintentionally.</p>
<p>However, the bug is exploitable only if Squid is built using the
--with-openssl option.</p>
</blockquote>
<p>The FreeBSD port does not use SSL by default and is not vulnerable
in the default configuration.</p>
</body>
</description>
<references>
<cvename>CVE-2016-2390</cvename>
<freebsdpr>ports/207294</freebsdpr>
<url>http://www.squid-cache.org/Advisories/SQUID-2016_1.txt</url>
</references>
<dates>
<discovery>2016-02-16</discovery>
<entry>2016-02-18</entry>
</dates>
</vuln>
<vuln vid="dd563930-d59a-11e5-8fa8-14dae9d210b8">
<topic>adminer -- remote code execution</topic>
<affects>
<package>
<name>adminer</name>
<range><lt>4.2.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jakub Vrana reports:</p>
<blockquote cite="https://github.com/vrana/adminer/commit/e5352cc5acad21513bb02677e2021b80bf7e7b8b">
<p>Fix remote code execution in SQLite query</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/vrana/adminer/commit/e5352cc5acad21513bb02677e2021b80bf7e7b8b</url>
</references>
<dates>
<discovery>2016-02-06</discovery>
<entry>2016-02-17</entry>
</dates>
</vuln>
<vuln vid="18201a1c-d59a-11e5-8fa8-14dae9d210b8">
<topic>adminer -- XSS vulnerability</topic>
<affects>
<package>
<name>adminer</name>
<range><lt>4.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jakub Vrana reports:</p>
<blockquote cite="https://github.com/vrana/adminer/commit/4be0b6655e0bf415960659db2a6dd4e60eebbd66">
<p>Fix XSS in indexes (non-MySQL only)</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/vrana/adminer/commit/4be0b6655e0bf415960659db2a6dd4e60eebbd66</url>
</references>
<dates>
<discovery>2015-11-08</discovery>
<entry>2016-02-17</entry>
</dates>
</vuln>
<vuln vid="ad91ee9b-d599-11e5-8fa8-14dae9d210b8">
<topic>adminer -- XSS vulnerability</topic>
<affects>
<package>
<name>adminer</name>
<range><lt>4.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jakub Vrana reports:</p>
<blockquote cite="https://github.com/vrana/adminer/commit/596f8df373cd3efe5bcb6013858bd7a6bb5ecb2c">
<p>Fix XSS in alter table</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/vrana/adminer/commit/596f8df373cd3efe5bcb6013858bd7a6bb5ecb2c</url>
</references>
<dates>
<discovery>2015-08-05</discovery>
<entry>2016-02-17</entry>
</dates>
</vuln>
<vuln vid="8cf54d73-d591-11e5-8fa8-14dae9d210b8">
<topic>adminer -- XSS vulnerability</topic>
<affects>
<package>
<name>adminer</name>
<range><lt>4.2.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jakub Vrana reports:</p>
<blockquote cite="https://github.com/vrana/adminer/commit/c990de3b3ee1816afb130bd0e1570577bf54a8e5">
<p>Fix XSS in login form</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/vrana/adminer/commit/c990de3b3ee1816afb130bd0e1570577bf54a8e5</url>
<url>https://sourceforge.net/p/adminer/bugs-and-features/436/</url>
</references>
<dates>
<discovery>2015-01-30</discovery>
<entry>2016-02-17</entry>
</dates>
</vuln>
<vuln vid="95b92e3b-d451-11e5-9794-e8e0b747a45a">
<topic>libgcrypt -- side-channel attack on ECDH</topic>
<affects>
<package>
<name>libgcrypt</name>
<range><lt>1.6.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GnuPG reports:</p>
<blockquote cite="https://lists.gnupg.org/pipermail/gnupg-announce/2016q1/000384.html">
<p>Mitigate side-channel attack on ECDH with Weierstrass curves.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7511</cvename>
<url>https://lists.gnupg.org/pipermail/gnupg-announce/2016q1/000384.html</url>
</references>
<dates>
<discovery>2016-02-09</discovery>
<entry>2016-02-16</entry>
</dates>
</vuln>
<vuln vid="f1bf28c5-d447-11e5-b2bd-002590263bf5">
<topic>xdelta3 -- buffer overflow vulnerability</topic>
<affects>
<package>
<name>xdelta3</name>
<range><lt>3.0.9,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Stepan Golosunov reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2016/02/08/1">
<p>Buffer overflow was found and fixed in xdelta3 binary diff tool
that allows arbitrary code execution from input files at least on
some systems.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-9765</cvename>
<url>http://www.openwall.com/lists/oss-security/2016/02/08/1</url>
<url>https://github.com/jmacd/xdelta-devel/commit/ef93ff74203e030073b898c05e8b4860b5d09ef2</url>
</references>
<dates>
<discovery>2014-10-08</discovery>
<entry>2016-02-16</entry>
</dates>
</vuln>
<vuln vid="172b22cb-d3f6-11e5-ac9e-485d605f4717">
<topic>firefox -- Same-origin-policy violation using Service Workers with plugins</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>44.0.2,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>44.0.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firefox44.0.2">
<p>MFSA 2016-13 Jason Pang of OneSignal reported that service workers intercept
responses to plugin network requests made through the browser. Plugins which
make security decisions based on the content of network requests can have these
decisions subverted if a service worker forges responses to those requests. For
example, a forged crossdomain.xml could allow a malicious site to violate the
same-origin policy using the Flash plugin.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1949</cvename>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-13/</url>
</references>
<dates>
<discovery>2016-02-11</discovery>
<entry>2016-02-15</entry>
</dates>
</vuln>
<vuln vid="07718e2b-d29d-11e5-a95f-b499baebfeaf">
<topic>nghttp2 -- Out of memory in nghttpd, nghttp, and libnghttp2_asio</topic>
<affects>
<package>
<name>nghttp2</name>
<range><lt>1.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Nghttp2 reports:</p>
<blockquote cite="https://nghttp2.org/blog/2016/02/11/nghttp2-v1-7-1/">
<p>Out of memory in nghttpd, nghttp, and libnghttp2_asio applications
due to unlimited incoming HTTP header fields.</p>
<p>nghttpd, nghttp, and libnghttp2_asio applications do not limit the memory usage
for the incoming HTTP header field. If peer sends specially crafted HTTP/2
HEADERS frames and CONTINUATION frames, they will crash with out of memory
error.</p>
<p>Note that libnghttp2 itself is not affected by this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>http://nghttp2.org/blog/2016/02/11/nghttp2-v1-7-1/</url>
<cvename>CVE-2016-1544</cvename>
</references>
<dates>
<discovery>2016-02-03</discovery>
<entry>2016-02-13</entry>
</dates>
</vuln>
<vuln vid="3aa8b781-d2c4-11e5-b2bd-002590263bf5">
<topic>horde -- XSS vulnerabilies</topic>
<affects>
<package>
<name>horde</name>
<range><lt>5.2.9</lt></range>
</package>
<package>
<name>pear-Horde_Core</name>
<range><lt>2.22.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Horde Team reports:</p>
<blockquote cite="http://lists.horde.org/archives/announce/2016/001149.html">
<p>Fixed XSS vulnerabilities in menu bar and form renderer.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8807</cvename>
<cvename>CVE-2016-2228</cvename>
<url>https://github.com/horde/horde/commit/11d74fa5a22fe626c5e5a010b703cd46a136f253</url>
<url>https://bugs.horde.org/ticket/14213</url>
<url>https://github.com/horde/horde/commit/f03301cf6edcca57121a15e80014c4d0f29d99a0</url>
<url>https://github.com/horde/horde/commit/ab07a1b447de34e13983b4d7ceb18b58c3a358d8</url>
<url>http://www.openwall.com/lists/oss-security/2016/02/06/4</url>
<url>http://lists.horde.org/archives/announce/2016/001149.html</url>
</references>
<dates>
<discovery>2016-02-02</discovery>
<entry>2016-02-14</entry>
</dates>
</vuln>
<vuln vid="e8b6605b-d29f-11e5-8458-6cc21735f730">
<topic>PostgreSQL -- Security Fixes for Regular Expressions, PL/Java.</topic>
<affects>
<package>
<name>postgresql91-server</name>
<range><ge>9.1.0</ge><lt>9.1.20</lt></range>
</package>
<package>
<name>postgresql92-server</name>
<range><ge>9.2.0</ge><lt>9.2.15</lt></range>
</package>
<package>
<name>postgresql93-server</name>
<range><ge>9.3.0</ge><lt>9.3.11</lt></range>
</package>
<package>
<name>postgresql94-server</name>
<range><ge>9.4.0</ge><lt>9.4.6</lt></range>
</package>
<package>
<name>postgresql95-server</name>
<range><ge>9.5.0</ge><lt>9.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PostgreSQL project reports:</p>
<blockquote cite="http://www.postgresql.org/about/news/1644/">
<p>
Security Fixes for Regular Expressions, PL/Java
</p>
<ul>
<li>CVE-2016-0773: This release closes security hole CVE-2016-0773,
an issue with regular expression (regex) parsing. Prior code allowed
users to pass in expressions which included out-of-range Unicode
characters, triggering a backend crash. This issue is critical for
PostgreSQL systems with untrusted users or which generate regexes
based on user input.
</li>
<li>CVE-2016-0766: The update also fixes CVE-2016-0766, a privilege
escalation issue for users of PL/Java. Certain custom configuration
settings (GUCS) for PL/Java will now be modifiable only by the
database superuser
</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-0773</cvename>
<cvename>CVE-2016-0766</cvename>
</references>
<dates>
<discovery>2016-02-08</discovery>
<entry>2016-02-12</entry>
</dates>
</vuln>
<vuln vid="5d8e56c3-9e67-4d5b-81c9-3a409dfd705f">
<topic>flash -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<name>linux-f10-flashplugin</name>
<name>linux-c6_64-flashplugin</name>
<range><lt>11.2r202.569</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb16-04.html">
<p>These updates resolve a type confusion vulnerability that
could lead to code execution (CVE-2016-0985).</p>
<p>These updates resolve use-after-free vulnerabilities that
could lead to code execution (CVE-2016-0973, CVE-2016-0974,
CVE-2016-0975, CVE-2016-0982, CVE-2016-0983, CVE-2016-0984).</p>
<p>These updates resolve a heap buffer overflow vulnerability
that could lead to code execution (CVE-2016-0971).</p>
<p>These updates resolve memory corruption vulnerabilities
that could lead to code execution (CVE-2016-0964,
CVE-2016-0965, CVE-2016-0966, CVE-2016-0967, CVE-2016-0968,
CVE-2016-0969, CVE-2016-0970, CVE-2016-0972, CVE-2016-0976,
CVE-2016-0977, CVE-2016-0978, CVE-2016-0979, CVE-2016-0980,
CVE-2016-0981).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-0964</cvename>
<cvename>CVE-2016-0965</cvename>
<cvename>CVE-2016-0966</cvename>
<cvename>CVE-2016-0967</cvename>
<cvename>CVE-2016-0968</cvename>
<cvename>CVE-2016-0969</cvename>
<cvename>CVE-2016-0970</cvename>
<cvename>CVE-2016-0971</cvename>
<cvename>CVE-2016-0972</cvename>
<cvename>CVE-2016-0973</cvename>
<cvename>CVE-2016-0974</cvename>
<cvename>CVE-2016-0975</cvename>
<cvename>CVE-2016-0976</cvename>
<cvename>CVE-2016-0977</cvename>
<cvename>CVE-2016-0978</cvename>
<cvename>CVE-2016-0979</cvename>
<cvename>CVE-2016-0980</cvename>
<cvename>CVE-2016-0981</cvename>
<cvename>CVE-2016-0982</cvename>
<cvename>CVE-2016-0983</cvename>
<cvename>CVE-2016-0984</cvename>
<cvename>CVE-2016-0985</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb16-04.html</url>
</references>
<dates>
<discovery>2016-02-09</discovery>
<entry>2016-02-10</entry>
</dates>
</vuln>
<vuln vid="515b4327-cf8a-11e5-96d6-14dae9d210b8">
<topic>dnscrypt-proxy -- code execution</topic>
<affects>
<package>
<name>dnscrypt-proxy</name>
<range><ge>1.1.0</ge><lt>1.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Frank Denis reports:</p>
<blockquote cite="https://github.com/jedisct1/dnscrypt-proxy/blob/1d129f7d5f0d469308967cbe4eacb4a6919f1fa1/NEWS#L2-L8">
<p>Malformed packets could lead to denial of service or code
execution.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/jedisct1/dnscrypt-proxy/blob/1d129f7d5f0d469308967cbe4eacb4a6919f1fa1/NEWS#L2-L8</url>
</references>
<dates>
<discovery>2016-02-02</discovery>
<entry>2016-02-10</entry>
<modified>2016-02-14</modified>
</dates>
</vuln>
<vuln vid="36034227-cf81-11e5-9c2b-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>48.0.2564.109</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2016/02/stable-channel-update_9.html">
<p>6 security fixes in this release, including:</p>
<ul>
<li>[546677] High CVE-2016-1622: Same-origin bypass in Extensions.
Credit to anonymous.</li>
<li>[577105] High CVE-2016-1623: Same-origin bypass in DOM. Credit
to Mariusz Mlynski.</li>
<li>[509313] Medium CVE-2016-1625: Navigation bypass in Chrome
Instant. Credit to Jann Horn.</li>
<li>[571480] Medium CVE-2016-1626: Out-of-bounds read in PDFium.
Credit to anonymous, working with HP's Zero Day Initiative.</li>
<li>[585517] CVE-2016-1627: Various fixes from internal audits,
fuzzing and other initiatives.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1622</cvename>
<cvename>CVE-2016-1623</cvename>
<cvename>CVE-2016-1625</cvename>
<cvename>CVE-2016-1626</cvename>
<cvename>CVE-2016-1627</cvename>
<url>http://googlechromereleases.blogspot.nl/2016/02/stable-channel-update_9.html</url>
</references>
<dates>
<discovery>2016-02-08</discovery>
<entry>2016-02-09</entry>
<modified>2016-03-08</modified>
</dates>
</vuln>
<vuln vid="8f10fa04-cf6a-11e5-96d6-14dae9d210b8">
<topic>graphite2 -- code execution vulnerability</topic>
<affects>
<package>
<name>graphite2</name>
<range><lt>1.3.5</lt></range>
</package>
<package>
<name>silgraphite</name>
<range><lt>2.3.1_4</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>38.6.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Talos reports:</p>
<blockquote cite="http://blog.talosintel.com/2016/02/vulnerability-spotlight-libgraphite.html">
<ul>
<li><p>An exploitable denial of service vulnerability exists
in the font handling of Libgraphite. A specially crafted font can cause
an out-of-bounds read potentially resulting in an information leak or
denial of service.</p></li>
<li><p>A specially crafted font can cause a buffer overflow
resulting in potential code execution.</p></li>
<li><p>An exploitable NULL pointer dereference exists in the
bidirectional font handling functionality of Libgraphite. A specially
crafted font can cause a NULL pointer dereference resulting in a
crash.</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://blog.talosintel.com/2016/02/vulnerability-spotlight-libgraphite.html</url>
<url>http://www.talosintel.com/reports/TALOS-2016-0061/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-14/</url>
<cvename>CVE-2016-1521</cvename>
<cvename>CVE-2016-1522</cvename>
<cvename>CVE-2016-1523</cvename>
<cvename>CVE-2016-1526</cvename>
</references>
<dates>
<discovery>2016-02-05</discovery>
<entry>2016-02-09</entry>
<modified>2016-03-08</modified>
</dates>
</vuln>
<vuln vid="1cecd5e0-c372-11e5-96d6-14dae9d210b8">
<topic>xymon-server -- multiple vulnerabilities</topic>
<affects>
<package>
<name>xymon-server</name>
<range><lt>4.3.25</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>J.C. Cleaver reports:</p>
<blockquote cite="http://lists.xymon.com/pipermail/xymon/2016-February/042986.html">
<ul>
<li><p>CVE-2016-2054: Buffer overflow in xymond handling of
"config" command</p></li>
<li><p> CVE-2016-2055: Access to possibly confidential files
in the Xymon configuration directory</p></li>
<li><p>CVE-2016-2056: Shell command injection in the
"useradm" and "chpasswd" web applications</p></li>
<li><p>CVE-2016-2057: Incorrect permissions on IPC queues
used by the xymond daemon can bypass IP access filtering</p></li>
<li><p>CVE-2016-2058: Javascript injection in "detailed status
webpage" of monitoring items; XSS vulnerability via malformed
acknowledgment messages</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://lists.xymon.com/pipermail/xymon/2016-February/042986.html</url>
<cvename>CVE-2016-2054</cvename>
<cvename>CVE-2016-2055</cvename>
<cvename>CVE-2016-2056</cvename>
<cvename>CVE-2016-2057</cvename>
<cvename>CVE-2016-2058</cvename>
</references>
<dates>
<discovery>2016-01-19</discovery>
<entry>2016-02-09</entry>
</dates>
</vuln>
<vuln vid="85eb4e46-cf16-11e5-840f-485d605f4717">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php55</name>
<name>php55-phar</name>
<name>php55-wddx</name>
<range><lt>5.5.32</lt></range>
</package>
<package>
<name>php56</name>
<name>php56-phar</name>
<name>php56-wddx</name>
<range><lt>5.6.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PHP reports:</p>
<blockquote cite="http://php.net/ChangeLog-5.php#5.6.18">
<ul><li>Core:
<ul>
<li>Fixed bug #71039 (exec functions ignore length but look for NULL
termination).</li>
<li>Fixed bug #71323 (Output of stream_get_meta_data can be
falsified by its input).</li>
<li>Fixed bug #71459 (Integer overflow in iptcembed()).</li>
</ul></li>
<li>PCRE:
<ul>
<li>Upgraded bundled PCRE library to 8.38.(CVE-2015-8383,
CVE-2015-8386, CVE-2015-8387, CVE-2015-8389, CVE-2015-8390,
CVE-2015-8391, CVE-2015-8393, CVE-2015-8394)</li>
</ul></li>
<li>Phar:
<ul>
<li>Fixed bug #71354 (Heap corruption in tar/zip/phar parser).</li>
<li>Fixed bug #71391 (NULL Pointer Dereference in
phar_tar_setupmetadata()).</li>
<li>Fixed bug #71488 (Stack overflow when decompressing tar
archives). (CVE-2016-2554)</li>
</ul></li>
<li>WDDX:
<ul>
<li>Fixed bug #71335 (Type Confusion in WDDX Packet
Deserialization).</li>
</ul></li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8383</cvename>
<cvename>CVE-2015-8386</cvename>
<cvename>CVE-2015-8387</cvename>
<cvename>CVE-2015-8389</cvename>
<cvename>CVE-2015-8390</cvename>
<cvename>CVE-2015-8391</cvename>
<cvename>CVE-2015-8393</cvename>
<cvename>CVE-2015-8394</cvename>
<cvename>CVE-2016-2554</cvename>
<url>http://php.net/ChangeLog-5.php#5.6.18</url>
<url>http://php.net/ChangeLog-5.php#5.5.32</url>
</references>
<dates>
<discovery>2016-02-04</discovery>
<entry>2016-02-09</entry>
<modified>2016-03-13</modified>
</dates>
</vuln>
<vuln vid="a8de962a-cf15-11e5-805c-5453ed2e2b49">
<topic>py-imaging, py-pillow -- Buffer overflow in PCD decoder</topic>
<affects>
<package>
<name>py27-pillow</name>
<name>py33-pillow</name>
<name>py34-pillow</name>
<name>py35-pillow</name>
<range><lt>2.9.0_1</lt></range>
</package>
<package>
<name>py27-imaging</name>
<range><lt>1.1.7_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Pillow maintainers report:</p>
<blockquote cite="https://pillow.readthedocs.org/en/3.1.x/releasenotes/3.1.1.html">
<p>In all versions of Pillow, dating back at least to the last PIL
1.1.7 release, PcdDecode.c has a buffer overflow error.</p>
<p>The state.buffer for PcdDecode.c is allocated based on a 3 bytes
per pixel sizing, where PcdDecode.c wrote into the buffer assuming
4 bytes per pixel. This writes 768 bytes beyond the end of the
buffer into other Python object storage. In some cases, this causes
a segfault, in others an internal Python malloc error.</p>
</blockquote>
</body>
</description>
<references>
<mlist>http://openwall.com/lists/oss-security/2016/02/02/5</mlist>
<url>https://github.com/python-pillow/Pillow/commit/ae453aa18b66af54e7ff716f4ccb33adca60afd4</url>
<url>https://github.com/python-pillow/Pillow/issues/568</url>
</references>
<dates>
<discovery>2016-02-02</discovery>
<entry>2016-02-09</entry>
</dates>
</vuln>
<vuln vid="0519db18-cf15-11e5-805c-5453ed2e2b49">
<topic>py-pillow -- Integer overflow in Resample.c</topic>
<affects>
<package>
<name>py27-pillow</name>
<name>py33-pillow</name>
<name>py34-pillow</name>
<name>py35-pillow</name>
<range><lt>2.9.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Pillow maintainers report:</p>
<blockquote cite="https://pillow.readthedocs.org/en/3.1.x/releasenotes/3.1.1.html">
<p>If a large value was passed into the new size for an image, it is
possible to overflow an int32 value passed into malloc, leading the
malloc’d buffer to be undersized. These allocations are followed by
a loop that writes out of bounds. This can lead to corruption on
the heap of the Python process with attacker controlled float
data.</p>
<p>This issue was found by Ned Williamson.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/python-pillow/Pillow/commit/41fae6d9e2da741d2c5464775c7f1a609ea03798</url>
<url>https://github.com/python-pillow/Pillow/issues/1710</url>
</references>
<dates>
<discovery>2016-02-05</discovery>
<entry>2016-02-09</entry>
</dates>
</vuln>
<vuln vid="6ea60e00-cf13-11e5-805c-5453ed2e2b49">
<topic>py-imaging, py-pillow -- Buffer overflow in FLI decoding code</topic>
<affects>
<package>
<name>py27-pillow</name>
<name>py33-pillow</name>
<name>py34-pillow</name>
<name>py35-pillow</name>
<range><lt>2.9.0_1</lt></range>
</package>
<package>
<name>py27-imaging</name>
<range><lt>1.1.7_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Pillow maintainers report:</p>
<blockquote cite="https://pillow.readthedocs.org/en/3.1.x/releasenotes/3.1.1.html">
<p>In all versions of Pillow, dating back at least to the last PIL
1.1.7 release, FliDecode.c has a buffer overflow error.</p>
<p>There is a memcpy error where x is added to a target buffer
address. X is used in several internal temporary variable roles,
but can take a value up to the width of the image. Im-&gt;image[y]
is a set of row pointers to segments of memory that are the size of
the row. At the max y, this will write the contents of the line off
the end of the memory buffer, causing a segfault.</p>
<p>This issue was found by Alyssa Besseling at Atlassian.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-0775</cvename>
<url>https://github.com/python-pillow/Pillow/commit/bcaaf97f4ff25b3b5b9e8efeda364e17e80858ec</url>
</references>
<dates>
<discovery>2016-02-05</discovery>
<entry>2016-02-09</entry>
</dates>
</vuln>
<vuln vid="53252879-cf11-11e5-805c-5453ed2e2b49">
<topic>py-pillow -- Buffer overflow in TIFF decoding code</topic>
<affects>
<package>
<name>py27-pillow</name>
<name>py33-pillow</name>
<name>py34-pillow</name>
<name>py35-pillow</name>
<range><lt>2.9.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Pillow maintainers report:</p>
<blockquote cite="https://pillow.readthedocs.org/en/3.1.x/releasenotes/3.1.1.html">
<p>Pillow 3.1.0 and earlier when linked against libtiff &gt;= 4.0.0 on
x64 may overflow a buffer when reading a specially crafted tiff
file.</p>
<p>Specifically, libtiff &gt;= 4.0.0 changed the return type of
TIFFScanlineSize from int32 to machine dependent int32|64. If the
scanline is sized so that it overflows an int32, it may be
interpreted as a negative number, which will then pass the size check
in TiffDecode.c line 236. To do this, the logical scanline size has
to be &gt; 2gb, and for the test file, the allocated buffer size is 64k
against a roughly 4gb scan line size. Any image data over 64k is
written over the heap, causing a segfault.</p>
<p>This issue was found by security researcher FourOne.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-0740</cvename>
<url>https://github.com/python-pillow/Pillow/commit/6dcbf5bd96b717c58d7b642949da8d323099928e</url>
</references>
<dates>
<discovery>2016-02-04</discovery>
<entry>2016-02-09</entry>
</dates>
</vuln>
<vuln vid="6ac79ed8-ccc2-11e5-932b-5404a68ad561">
<topic>ffmpeg -- remote denial of service in JPEG2000 decoder</topic>
<affects>
<package>
<name>ffmpeg</name>
<range><lt>2.8.6,1</lt></range>
</package>
<package>
<name>mplayer</name>
<name>mencoder</name>
<range>
<lt>1.2.r20151219_3</lt>
</range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>FFmpeg security reports:</p>
<blockquote cite="https://www.ffmpeg.org/security.html">
<p>FFmpeg 2.8.6 fixes the following vulnerabilities:
CVE-2016-2213</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2213</cvename>
<url>https://www.ffmpeg.org/security.html</url>
</references>
<dates>
<discovery>2016-01-27</discovery>
<entry>2016-02-06</entry>
</dates>
</vuln>
<vuln vid="448047e9-030e-4ce4-910b-f21a3ad5d9a0">
<topic>shotwell -- not verifying certificates</topic>
<affects>
<package>
<name>shotwell</name>
<range><lt>0.22.0.99</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Michael Catanzaro reports:</p>
<blockquote cite="https://mail.gnome.org/archives/distributor-list/2016-January/msg00000.html">
<p>Shotwell has a serious security issue ("Shotwell does not
verify TLS certificates"). Upstream is no longer active and
I do not expect any further upstream releases unless someone
from the community steps up to maintain it.</p>
<p>What is the impact of the issue? If you ever used any of
the publish functionality (publish to Facebook, publish to
Flickr, etc.), your passwords may have been stolen; changing
them is not a bad idea.</p>
<p>What is the risk of the update? Regressions. The easiest
way to validate TLS certificates was to upgrade WebKit; it
seems to work but I don't have accounts with the online
services it supports, so I don't know if photo publishing
still works properly on all the services.</p>
</blockquote>
</body>
</description>
<references>
<url>https://mail.gnome.org/archives/distributor-list/2016-January/msg00000.html</url>
</references>
<dates>
<discovery>2016-01-06</discovery>
<entry>2016-02-05</entry>
</dates>
</vuln>
<vuln vid="1091d2d1-cb2e-11e5-b14b-bcaec565249c">
<topic>webkit -- UI spoof</topic>
<affects>
<package>
<name>webkit-gtk2</name>
<name>webkit-gtk3</name>
<range><lt>2.4.9_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>webkit reports:</p>
<blockquote cite="http://webkitgtk.org/security/WSA-2015-0002.html">
<p>The ScrollView::paint function in platform/scroll/ScrollView.cpp
in Blink, as used in Google Chrome before 35.0.1916.114, allows
remote attackers to spoof the UI by extending scrollbar painting
into the parent frame.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-1748</cvename>
<url>http://webkitgtk.org/security/WSA-2015-0002.html</url>
</references>
<dates>
<discovery>2015-12-28</discovery>
<entry>2016-02-04</entry>
</dates>
</vuln>
<vuln vid="e78bfc9d-cb1e-11e5-b251-0050562a4d7b">
<topic>py-rsa -- Bleichenbacher'06 signature forgery vulnerability</topic>
<affects>
<package>
<name>py27-rsa</name>
<name>py32-rsa</name>
<name>py33-rsa</name>
<name>py34-rsa</name>
<name>py35-rsa</name>
<range><lt>3.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Filippo Valsorda reports:</p>
<blockquote cite="https://blog.filippo.io/bleichenbacher-06-signature-forgery-in-python-rsa/">
<p>
python-rsa is vulnerable to a straightforward variant of the
Bleichenbacher'06 attack against RSA signature verification
with low public exponent.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1494</cvename>
<url>https://blog.filippo.io/bleichenbacher-06-signature-forgery-in-python-rsa/</url>
<url>https://bitbucket.org/sybren/python-rsa/pull-requests/14/security-fix-bb06-attack-in-verify-by</url>
<url>https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1494</url>
<url>http://www.openwall.com/lists/oss-security/2016/01/05/3</url>
<url>http://www.openwall.com/lists/oss-security/2016/01/05/1</url>
</references>
<dates>
<discovery>2016-01-05</discovery>
<entry>2016-02-04</entry>
</dates>
</vuln>
<vuln vid="559f3d1b-cb1d-11e5-80a4-001999f8d30b">
<topic>asterisk -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>asterisk</name>
<range><lt>1.8.32.3_5</lt></range>
</package>
<package>
<name>asterisk11</name>
<range><lt>11.21.1</lt></range>
</package>
<package>
<name>asterisk13</name>
<range><lt>13.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>AST-2016-001 - BEAST vulnerability in HTTP server</p>
<p>AST-2016-002 - File descriptor exhaustion in chan_sip</p>
<p>AST-2016-003 - Remote crash vulnerability when receiving UDPTL FAX data</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2016-001.html</url>
<cvename>CVE-2011-3389</cvename>
<url>http://downloads.asterisk.org/pub/security/AST-2016-002.html</url>
<cvename>CVE-2016-2316</cvename>
<url>http://downloads.asterisk.org/pub/security/AST-2016-003.html</url>
<cvename>CVE-2016-2232</cvename>
</references>
<dates>
<discovery>2016-02-03</discovery>
<entry>2016-02-04</entry>
<modified>2016-03-07</modified>
</dates>
</vuln>
<vuln vid="0652005e-ca96-11e5-96d6-14dae9d210b8">
<topic>salt -- code execution</topic>
<affects>
<package>
<name>py27-salt</name>
<name>py32-salt</name>
<name>py33-salt</name>
<name>py34-salt</name>
<name>py35-salt</name>
<range><ge>2015.8.0</ge><lt>2015.8.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SaltStack reports:</p>
<blockquote cite="https://docs.saltstack.com/en/latest/topics/releases/2015.8.4.html">
<p>Improper handling of clear messages on the minion, which
could result in executing commands not sent by the master.</p>
</blockquote>
</body>
</description>
<references>
<url>https://docs.saltstack.com/en/latest/topics/releases/2015.8.4.html</url>
<url>https://github.com/saltstack/salt/pull/30613/files</url>
<cvename>CVE-2016-1866</cvename>
</references>
<dates>
<discovery>2016-01-25</discovery>
<entry>2016-02-03</entry>
</dates>
</vuln>
<vuln vid="bb0ef21d-0e1b-461b-bc3d-9cba39948888">
<topic>rails -- multiple vulnerabilities</topic>
<affects>
<package>
<name>rubygem-actionpack</name>
<range><lt>3.2.22.1</lt></range>
</package>
<package>
<name>rubygem-actionpack4</name>
<range><lt>4.2.5.1</lt></range>
</package>
<package>
<name>rubygem-actionview</name>
<range><lt>4.2.5.1</lt></range>
</package>
<package>
<name>rubygem-activemodel4</name>
<range><lt>4.2.5.1</lt></range>
</package>
<package>
<name>rubygem-activerecord</name>
<range><lt>3.2.22.1</lt></range>
</package>
<package>
<name>rubygem-activerecord4</name>
<range><lt>4.2.5.1</lt></range>
</package>
<package>
<name>rubygem-rails</name>
<range><lt>3.2.22.1</lt></range>
</package>
<package>
<name>rubygem-rails-html-sanitizer</name>
<range><lt>1.0.3</lt></range>
</package>
<package>
<name>rubygem-rails4</name>
<range><lt>4.2.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby on Rails blog:</p>
<blockquote cite="http://weblog.rubyonrails.org/2016/1/25/Rails-5-0-0-beta1-1-4-2-5-1-4-1-14-1-3-2-22-1-and-rails-html-sanitizer-1-0-3-have-been-released/">
<p>Rails 5.0.0.beta1.1, 4.2.5.1, 4.1.14.1, and 3.2.22.1 have been
released! These contain important security fixes, and it is
recommended that users upgrade as soon as possible.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7576</cvename>
<cvename>CVE-2015-7577</cvename>
<cvename>CVE-2015-7581</cvename>
<cvename>CVE-2016-0751</cvename>
<cvename>CVE-2016-0752</cvename>
<cvename>CVE-2016-0753</cvename>
<url>https://groups.google.com/d/msg/rubyonrails-security/ANv0HDHEC3k/mt7wNGxbFQAJ</url>
<url>https://groups.google.com/d/msg/rubyonrails-security/cawsWcQ6c8g/tegZtYdbFQAJ</url>
<url>https://groups.google.com/d/msg/rubyonrails-security/dthJ5wL69JE/YzPnFelbFQAJ</url>
<url>https://groups.google.com/d/msg/rubyonrails-security/9oLY_FCzvoc/w9oI9XxbFQAJ</url>
<url>https://groups.google.com/d/msg/rubyonrails-security/335P1DcLG00/OfB9_LhbFQAJ</url>
<url>https://groups.google.com/d/msg/rubyonrails-security/6jQVC1geukQ/8oYETcxbFQAJ</url>
<url>http://weblog.rubyonrails.org/2016/1/25/Rails-5-0-0-beta1-1-4-2-5-1-4-1-14-1-3-2-22-1-and-rails-html-sanitizer-1-0-3-have-been-released/</url>
</references>
<dates>
<discovery>2016-01-25</discovery>
<entry>2016-02-02</entry>
</dates>
</vuln>
<vuln vid="a52a7172-c92e-11e5-96d6-14dae9d210b8">
<topic>socat -- diffie hellman parameter was not prime</topic>
<affects>
<package>
<name>socat</name>
<range><ge>1.7.2.5</ge><lt>1.7.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>socat reports:</p>
<blockquote cite="http://www.dest-unreach.org/socat/contrib/socat-secadv7.html">
<p>In the OpenSSL address implementation the hard coded 1024
bit DH p parameter was not prime. The effective cryptographic strength
of a key exchange using these parameters was weaker than the one one
could get by using a prime p. Moreover, since there is no indication of
how these parameters were chosen, the existence of a trapdoor that makes
possible for an eavesdropper to recover the shared secret from a key
exchange that uses them cannot be ruled out.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.dest-unreach.org/socat/contrib/socat-secadv7.html</url>
</references>
<dates>
<discovery>2016-02-01</discovery>
<entry>2016-02-01</entry>
</dates>
</vuln>
<vuln vid="4f00dac0-1e18-4481-95af-7aaad63fd303">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<name>linux-firefox</name>
<range><lt>44.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.41</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>38.6.0,1</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>38.6.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firefox44">
<p>MFSA 2016-01 Miscellaneous memory safety hazards (rv:44.0
/ rv:38.6)</p>
<p>MFSA 2016-02 Out of Memory crash when parsing GIF format
images</p>
<p>MFSA 2016-03 Buffer overflow in WebGL after out of memory
allocation</p>
<p>MFSA 2016-04 Firefox allows for control characters to be
set in cookie names</p>
<p>MFSA 2016-06 Missing delay following user click events in
protocol handler dialog</p>
<p>MFSA 2016-09 Addressbar spoofing attacks</p>
<p>MFSA 2016-10 Unsafe memory manipulation found through
code inspection</p>
<p>MFSA 2016-11 Application Reputation service disabled in
Firefox 43</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7208</cvename>
<cvename>CVE-2016-1930</cvename>
<cvename>CVE-2016-1931</cvename>
<cvename>CVE-2016-1933</cvename>
<cvename>CVE-2016-1935</cvename>
<cvename>CVE-2016-1937</cvename>
<cvename>CVE-2016-1939</cvename>
<cvename>CVE-2016-1942</cvename>
<cvename>CVE-2016-1943</cvename>
<cvename>CVE-2016-1944</cvename>
<cvename>CVE-2016-1945</cvename>
<cvename>CVE-2016-1946</cvename>
<cvename>CVE-2016-1947</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2016-01/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-02/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-03/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-04/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-06/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-09/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-10/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-11/</url>
</references>
<dates>
<discovery>2016-01-26</discovery>
<entry>2016-02-01</entry>
<modified>2016-03-08</modified>
</dates>
</vuln>
<vuln vid="e00d8b94-c88a-11e5-b5fe-002590263bf5">
<topic>gdcm -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gdcm</name>
<range><lt>2.6.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CENSUS S.A. reports:</p>
<blockquote cite="http://census-labs.com/news/2016/01/11/gdcm-buffer-overflow-imageregionreaderreadintobuffer/">
<p>GDCM versions 2.6.0 and 2.6.1 (and possibly previous versions) are
prone to an integer overflow vulnerability which leads to a buffer
overflow and potentially to remote code execution.</p>
</blockquote>
<blockquote cite="http://census-labs.com/news/2016/01/11/gdcm-out-bounds-read-jpeglscodec-decodeextent/">
<p>GDCM versions 2.6.0 and 2.6.1 (and possibly previous versions) are
prone to an out-of-bounds read vulnerability due to missing checks.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8396</cvename>
<cvename>CVE-2015-8397</cvename>
<url>http://census-labs.com/news/2016/01/11/gdcm-buffer-overflow-imageregionreaderreadintobuffer/</url>
<url>http://census-labs.com/news/2016/01/11/gdcm-out-bounds-read-jpeglscodec-decodeextent/</url>
</references>
<dates>
<discovery>2015-12-23</discovery>
<entry>2016-02-01</entry>
</dates>
</vuln>
<vuln vid="c1c18ee1-c711-11e5-96d6-14dae9d210b8">
<topic>nginx -- multiple vulnerabilities</topic>
<affects>
<package>
<name>nginx</name>
<range><lt>1.8.1,2</lt></range>
</package>
<package>
<name>nginx-devel</name>
<range><lt>1.9.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Maxim Dounin reports:</p>
<blockquote cite="http://mailman.nginx.org/pipermail/nginx/2016-January/049700.html">
<p>Several problems in nginx resolver were identified, which
might allow an attacker to cause worker process crash, or might have
potential other impact if the "resolver" directive
is used in a configuration file.</p>
</blockquote>
</body>
</description>
<references>
<url>http://mailman.nginx.org/pipermail/nginx/2016-January/049700.html</url>
<cvename>CVE-2016-0742</cvename>
<cvename>CVE-2016-0746</cvename>
<cvename>CVE-2016-0747</cvename>
</references>
<dates>
<discovery>2016-01-26</discovery>
<entry>2016-01-30</entry>
</dates>
</vuln>
<vuln vid="a0d77bc8-c6a7-11e5-96d6-14dae9d210b8">
<topic>typo3 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>typo3</name>
<range><lt>7.6.1</lt></range>
</package>
<package>
<name>typo3-lts</name>
<range><lt>6.2.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>TYPO3 Security Team reports:</p>
<blockquote cite="http://lists.typo3.org/pipermail/typo3-announce/2015/000351.html">
<p>It has been discovered that TYPO3 CMS is susceptible to
Cross-Site Scripting and Cross-Site Flashing.</p>
</blockquote>
</body>
</description>
<references>
<url>http://lists.typo3.org/pipermail/typo3-announce/2015/000351.html</url>
<url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-010/</url>
<url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-011/</url>
<url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-012/</url>
<url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-013/</url>
<url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-014/</url>
<url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-015/</url>
</references>
<dates>
<discovery>2015-12-15</discovery>
<entry>2016-01-29</entry>
</dates>
</vuln>
<vuln vid="93eadedb-c6a6-11e5-96d6-14dae9d210b8">
<topic>nghttp2 -- use after free</topic>
<affects>
<package>
<name>nghttp2</name>
<range><lt>1.6.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>nghttp2 reports:</p>
<blockquote cite="https://nghttp2.org/blog/2015/12/23/nghttp2-v1-6-0/">
<p>This release fixes heap-use-after-free bug in idle stream
handling code. We strongly recommend to upgrade the older installation
to this latest version as soon as possible.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nghttp2.org/blog/2015/12/23/nghttp2-v1-6-0/</url>
<cvename>CVE-2015-8659</cvename>
</references>
<dates>
<discovery>2015-12-23</discovery>
<entry>2016-01-29</entry>
</dates>
</vuln>
<vuln vid="3166222b-c6a4-11e5-96d6-14dae9d210b8">
<topic>owncloud -- multiple vulnerabilities</topic>
<affects>
<package>
<name>owncloud</name>
<range><lt>8.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Owncloud reports:</p>
<blockquote cite="https://owncloud.org/blog/owncloud-8-2-2-8-1-5-8-0-10-and-7-0-12-here-with-sharing-ldap-fixes/">
<ul>
<li><p>Reflected XSS in OCS provider discovery
(oC-SA-2016-001)</p></li>
<li><p>Information Exposure Through Directory Listing in the
file scanner (oC-SA-2016-002)</p></li>
<li><p>Disclosure of files that begin with ".v" due to
unchecked return value (oC-SA-2016-003)</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://owncloud.org/blog/owncloud-8-2-2-8-1-5-8-0-10-and-7-0-12-here-with-sharing-ldap-fixes/</url>
<url>https://owncloud.org/security/advisory/?id=oc-sa-2016-001</url>
<url>https://owncloud.org/security/advisory/?id=oc-sa-2016-002</url>
<url>https://owncloud.org/security/advisory/?id=oc-sa-2016-003</url>
<cvename>CVE-2016-1498</cvename>
<cvename>CVE-2016-1499</cvename>
<cvename>CVE-2016-1500</cvename>
</references>
<dates>
<discovery>2015-12-23</discovery>
<entry>2016-01-29</entry>
</dates>
</vuln>
<vuln vid="ff824eea-c69c-11e5-96d6-14dae9d210b8">
<topic>radicale -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py27-radicale</name>
<name>py32-radicale</name>
<name>py33-radicale</name>
<name>py34-radicale</name>
<range><lt>1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Radicale reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2016/01/06/4">
<p>The multifilesystem backend allows access to arbitrary
files on all platforms.</p>
<p>Prevent regex injection in rights management.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2016/01/06/4</url>
<cvename>CVE-2015-8747</cvename>
<cvename>CVE-2015-8748</cvename>
</references>
<dates>
<discovery>2015-12-24</discovery>
<entry>2016-01-29</entry>
</dates>
</vuln>
<vuln vid="7a59e283-c60b-11e5-bf36-6805ca0b3d42">
<topic>phpmyadmin -- XSS vulnerability in SQL editor</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><ge>4.5.0</ge><lt>4.5.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-9/">
<p>With a crafted SQL query, it is possible to trigger an
XSS attack in the SQL editor.</p>
<p>We consider this vulnerability to be non-critical.</p>
<p>This vulnerability can be triggered only by someone who is
logged in to phpMyAdmin, as the usual token protection
prevents non-logged-in users from accessing the required
pages.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2016-9/</url>
<cvename>CVE-2016-2045</cvename>
</references>
<dates>
<discovery>2016-01-28</discovery>
<entry>2016-01-28</entry>
</dates>
</vuln>
<vuln vid="78b4ebfb-c60b-11e5-bf36-6805ca0b3d42">
<topic>phpmyadmin -- Full path disclosure vulnerability in SQL parser</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><ge>4.5.0</ge><lt>4.5.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-8/">
<p>By calling a particular script that is part of phpMyAdmin
in an unexpected way, it is possible to trigger phpMyAdmin
to display a PHP error message which contains the full path
of the directory where phpMyAdmin is installed.</p>
<p>We consider this vulnerability to be non-critical.</p>
<p>This path disclosure is possible on servers where the
recommended setting of the PHP configuration directive
display_errors is set to on, which is against the
recommendations given in the PHP manual for a production
server.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2016-8/</url>
<cvename>CVE-2016-2044</cvename>
</references>
<dates>
<discovery>2016-01-28</discovery>
<entry>2016-01-28</entry>
</dates>
</vuln>
<vuln vid="7694927f-c60b-11e5-bf36-6805ca0b3d42">
<topic>phpmyadmin -- XSS vulnerability in normalization page</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><ge>4.5.0</ge><lt>4.5.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-7/">
<p>With a crafted table name it is possible to trigger an
XSS attack in the database normalization page.</p>
<p>We consider this vulnerability to be non-critical.</p>
<p>This vulnerability can be triggered only by someone who is
logged in to phpMyAdmin, as the usual token protection
prevents non-logged-in users from accessing the required page.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2016-7/</url>
<cvename>CVE-2016-2043</cvename>
</references>
<dates>
<discovery>2016-01-28</discovery>
<entry>2016-01-28</entry>
</dates>
</vuln>
<vuln vid="740badcb-c60b-11e5-bf36-6805ca0b3d42">
<topic>phpmyadmin -- Multiple full path disclosure vulnerabilities</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><ge>4.5.0</ge><lt>4.5.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-6/">
<p>By calling some scripts that are part of phpMyAdmin in an
unexpected way, it is possible to trigger phpMyAdmin to
display a PHP error message which contains the full path of
the directory where phpMyAdmin is installed.</p>
<p>We consider these vulnerabilities to be non-critical.</p>
<p>This path disclosure is possible on servers where the
recommended setting of the PHP configuration directive
display_errors is set to on, which is against the
recommendations given in the PHP manual for a production
server.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2016-6/</url>
<cvename>CVE-2016-2042</cvename>
</references>
<dates>
<discovery>2016-01-28</discovery>
<entry>2016-01-28</entry>
</dates>
</vuln>
<vuln vid="71b24d99-c60b-11e5-bf36-6805ca0b3d42">
<topic>phpmyadmin -- Unsafe comparison of XSRF/CSRF token</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><ge>4.5.0</ge><lt>4.5.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-5/">
<p>The comparison of the XSRF/CSRF token parameter with the
value saved in the session is vulnerable to timing
attacks. Moreover, the comparison could be bypassed if the
XSRF/CSRF token matches a particular pattern.</p>
<p>We consider this vulnerability to be serious.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2016-5/</url>
<cvename>CVE-2016-2041</cvename>
</references>
<dates>
<discovery>2016-01-28</discovery>
<entry>2016-01-28</entry>
</dates>
</vuln>
<vuln vid="6f0c2d1b-c60b-11e5-bf36-6805ca0b3d42">
<topic>phpmyadmin -- Insecure password generation in JavaScript</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><ge>4.5.0</ge><lt>4.5.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-4/">
<p>Password suggestion functionality uses Math.random()
which does not provide cryptographically secure random
numbers.</p>
<p>We consider this vulnerability to be non-critical.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2016-4/</url>
<cvename>CVE-2016-1927</cvename>
</references>
<dates>
<discovery>2016-01-28</discovery>
<entry>2016-01-28</entry>
</dates>
</vuln>
<vuln vid="6cc06eec-c60b-11e5-bf36-6805ca0b3d42">
<topic>phpmyadmin -- Multiple XSS vulnerabilities</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><ge>4.5.0</ge><lt>4.5.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-3/">
<ul>
<li>With a crafted table name it is possible to trigger
an XSS attack in the database search page.</li>
<li>With a crafted SET value or a crafted search query, it
is possible to trigger an XSS attacks in the zoom search
page.</li>
<li>With a crafted hostname header, it is possible to
trigger an XSS attacks in the home page.</li>
</ul>
<p>We consider these vulnerabilities to be non-critical.</p>
<p>These vulnerabilities can be triggered only by someone
who is logged in to phpMyAdmin, as the usual token
protection prevents non-logged-in users from accessing the
required pages.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2016-3/</url>
<cvename>CVE-2016-2040</cvename>
</references>
<dates>
<discovery>2016-01-28</discovery>
<entry>2016-01-28</entry>
</dates>
</vuln>
<vuln vid="60ab0e93-c60b-11e5-bf36-6805ca0b3d42">
<topic>phpmyadmin -- Unsafe generation of XSRF/CSRF token</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><ge>4.5.0</ge><lt>4.5.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-2/">
<p>The XSRF/CSRF token is generated with a weak algorithm
using functions that do not return cryptographically secure
values.</p>
<p>We consider this vulnerability to be non-critical.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2016-2/</url>
<cvename>CVE-2016-2039</cvename>
</references>
<dates>
<discovery>2016-01-28</discovery>
<entry>2016-01-28</entry>
</dates>
</vuln>
<vuln vid="5d6a204f-c60b-11e5-bf36-6805ca0b3d42">
<topic>phpmyadmin -- Multiple full path disclosure vulnerabilities</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><ge>4.5.0</ge><lt>4.5.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-1/">
<p>By calling some scripts that are part of phpMyAdmin in an
unexpected way, it is possible to trigger phpMyAdmin to
display a PHP error message which contains the full path of
the directory where phpMyAdmin is installed.</p>
<p>We consider these vulnerabilities to be non-critical.</p>
<p>This path disclosure is possible on servers where the
recommended setting of the PHP configuration directive
display_errors is set to on, which is against the
recommendations given in the PHP manual for a production
server.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2016-1/</url>
<cvename>CVE-2016-2038</cvename>
</references>
<dates>
<discovery>2016-01-28</discovery>
<entry>2016-01-28</entry>
</dates>
</vuln>
<vuln vid="50394bc9-c5fa-11e5-96a5-d93b343d1ff7">
<topic>prosody -- user impersonation vulnerability</topic>
<affects>
<package>
<name>prosody</name>
<range><lt>0.9.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Prosody team reports:</p>
<blockquote cite="https://prosody.im/security/advisory_20160127/">
<p>Adopt key generation algorithm from XEP-0185, to
prevent impersonation attacks (CVE-2016-0756)</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/206707</freebsdpr>
<cvename>CVE-2016-0756</cvename>
<url>https://prosody.im/security/advisory_20160127/</url>
</references>
<dates>
<discovery>2016-01-27</discovery>
<entry>2016-01-28</entry>
</dates>
</vuln>
<vuln vid="3679fd10-c5d1-11e5-b85f-0018fe623f2b">
<topic>openssl -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.2_7</lt></range>
</package>
<package>
<name>mingw32-openssl</name>
<range><ge>1.0.1</ge><lt>1.0.2f</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20160128.txt">
<ol>
<li>Historically OpenSSL only ever generated DH parameters based on "safe"
primes. More recently (in version 1.0.2) support was provided for
generating X9.42 style parameter files such as those required for RFC 5114
support. The primes used in such files may not be "safe". Where an
application is using DH configured with parameters based on primes that are
not "safe" then an attacker could use this fact to find a peer's private
DH exponent. This attack requires that the attacker complete multiple
handshakes in which the peer uses the same private DH exponent. For example
this could be used to discover a TLS server's private DH exponent if it's
reusing the private DH exponent or it's using a static DH ciphersuite.
OpenSSL provides the option SSL_OP_SINGLE_DH_USE for ephemeral DH (DHE) in
TLS. It is not on by default. If the option is not set then the server
reuses the same private DH exponent for the life of the server process and
would be vulnerable to this attack. It is believed that many popular
applications do set this option and would therefore not be at risk.
(CVE-2016-0701)</li>
<li>A malicious client can negotiate SSLv2 ciphers that have been disabled on
the server and complete SSLv2 handshakes even if all SSLv2 ciphers have
been disabled, provided that the SSLv2 protocol was not also disabled via
SSL_OP_NO_SSLv2.
(CVE-2015-3197)</li>
</ol>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-0701</cvename>
<cvename>CVE-2015-3197</cvename>
<url>https://www.openssl.org/news/secadv/20160128.txt</url>
</references>
<dates>
<discovery>2016-01-22</discovery>
<entry>2016-01-28</entry>
</dates>
</vuln>
<vuln vid="8b27f1bc-c509-11e5-a95f-b499baebfeaf">
<topic>curl -- Credentials not checked</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.10.0</ge><lt>7.47.0</lt></range>
</package>
<package>
<name>linux-c6-curl</name>
<name>linux-c6_64-curl</name>
<range><ge>7.10.0</ge></range>
</package>
<package>
<name>linux-f10-curl</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The cURL project reports:</p>
<blockquote cite="http://curl.haxx.se/docs/adv_20160127A.html">
<p>libcurl will reuse NTLM-authenticated proxy connections
without properly making sure that the connection was
authenticated with the same credentials as set for this
transfer.</p>
</blockquote>
</body>
</description>
<references>
<url>http://curl.haxx.se/docs/adv_20160127A.html</url>
<cvename>CVE-2016-0755</cvename>
</references>
<dates>
<discovery>2016-01-27</discovery>
<entry>2016-01-27</entry>
<modified>2016-02-02</modified>
</dates>
</vuln>
<vuln vid="fb754341-c3e2-11e5-b5fe-002590263bf5">
<topic>wordpress -- XSS vulnerability</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>4.4.1,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<name>zh-wordpress-zh_CN</name>
<name>zh-wordpress-zh_TW</name>
<range><lt>4.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Aaron Jorbin reports:</p>
<blockquote cite="https://wordpress.org/news/2016/01/wordpress-4-4-1-security-and-maintenance-release/">
<p>WordPress 4.4.1 is now available. This is a security release for
all previous versions and we strongly encourage you to update your
sites immediately.</p>
<p>WordPress versions 4.4 and earlier are affected by a cross-site
scripting vulnerability that could allow a site to be compromised.
This was reported by Crtc4L.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1564</cvename>
<url>http://www.openwall.com/lists/oss-security/2016/01/08/3</url>
<url>https://wordpress.org/news/2016/01/wordpress-4-4-1-security-and-maintenance-release/</url>
</references>
<dates>
<discovery>2016-01-06</discovery>
<entry>2016-01-26</entry>
<modified>2016-03-08</modified>
</dates>
</vuln>
<vuln vid="a763a0e7-c3d9-11e5-b5fe-002590263bf5">
<topic>privoxy -- multiple vulnerabilities</topic>
<affects>
<package>
<name>privoxy</name>
<range><lt>3.0.24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Privoxy Developers reports:</p>
<blockquote cite="http://www.privoxy.org/3.0.24/user-manual/whatsnew.html">
<p>Prevent invalid reads in case of corrupt chunk-encoded content.
CVE-2016-1982. Bug discovered with afl-fuzz and AddressSanitizer.
</p>
<p>Remove empty Host headers in client requests. Previously they
would result in invalid reads. CVE-2016-1983. Bug discovered with
afl-fuzz and AddressSanitizer.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1982</cvename>
<cvename>CVE-2016-1983</cvename>
<freebsdpr>ports/206504</freebsdpr>
<url>http://www.privoxy.org/3.0.24/user-manual/whatsnew.html</url>
<url>http://www.openwall.com/lists/oss-security/2016/01/21/4</url>
</references>
<dates>
<discovery>2016-01-22</discovery>
<entry>2016-01-26</entry>
</dates>
</vuln>
<vuln vid="d9e1b569-c3d8-11e5-b5fe-002590263bf5">
<topic>privoxy -- multiple vulnerabilities</topic>
<affects>
<package>
<name>privoxy</name>
<range><lt>3.0.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Privoxy Developers reports:</p>
<blockquote cite="http://www.privoxy.org/3.0.23/user-manual/whatsnew.html">
<p>Fixed a DoS issue in case of client requests with incorrect
chunk-encoded body. When compiled with assertions enabled (the
default) they could previously cause Privoxy to abort(). Reported
by Matthew Daley. CVE-2015-1380.</p>
<p>Fixed multiple segmentation faults and memory leaks in the pcrs
code. This fix also increases the chances that an invalid pcrs
command is rejected as such. Previously some invalid commands would
be loaded without error. Note that Privoxy's pcrs sources (action
and filter files) are considered trustworthy input and should not be
writable by untrusted third-parties. CVE-2015-1381.</p>
<p>Fixed an 'invalid read' bug which could at least theoretically
cause Privoxy to crash. So far, no crashes have been observed.
CVE-2015-1382.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1380</cvename>
<cvename>CVE-2015-1381</cvename>
<cvename>CVE-2015-1382</cvename>
<freebsdpr>ports/197089</freebsdpr>
<url>http://www.privoxy.org/3.0.23/user-manual/whatsnew.html</url>
<url>http://www.openwall.com/lists/oss-security/2015/01/26/4</url>
</references>
<dates>
<discovery>2015-01-26</discovery>
<entry>2016-01-26</entry>
</dates>
</vuln>
<vuln vid="89d4ed09-c3d7-11e5-b5fe-002590263bf5">
<topic>privoxy -- multiple vulnerabilities</topic>
<affects>
<package>
<name>privoxy</name>
<range><lt>3.0.22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Privoxy Developers reports:</p>
<blockquote cite="http://www.privoxy.org/3.0.22/user-manual/whatsnew.html">
<p>Fixed a memory leak when rejecting client connections due to the
socket limit being reached (CID 66382). This affected Privoxy 3.0.21
when compiled with IPv6 support (on most platforms this is the
default).</p>
<p>Fixed an immediate-use-after-free bug (CID 66394) and two
additional unconfirmed use-after-free complaints made by Coverity
scan (CID 66391, CID 66376).</p>
</blockquote>
<p>MITRE reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1201">
<p>Privoxy before 3.0.22 allows remote attackers to cause a denial
of service (file descriptor consumption) via unspecified vectors.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1030</cvename>
<cvename>CVE-2015-1031</cvename>
<cvename>CVE-2015-1201</cvename>
<freebsdpr>ports/195468</freebsdpr>
<url>http://www.privoxy.org/3.0.22/user-manual/whatsnew.html</url>
<url>http://www.openwall.com/lists/oss-security/2015/01/11/1</url>
</references>
<dates>
<discovery>2015-01-10</discovery>
<entry>2016-01-26</entry>
</dates>
</vuln>
<vuln vid="ad82b0e9-c3d6-11e5-b5fe-002590263bf5">
<topic>privoxy -- malicious server spoofing as proxy vulnerability</topic>
<affects>
<package>
<name>privoxy</name>
<range><lt>3.0.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Privoxy Developers reports:</p>
<blockquote cite="http://www.privoxy.org/3.0.21/user-manual/whatsnew.html">
<p>Proxy authentication headers are removed unless the new directive
enable-proxy-authentication-forwarding is used. Forwarding the
headers potentially allows malicious sites to trick the user into
providing them with login information. Reported by Chris John Riley.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2503</cvename>
<freebsdpr>ports/176813</freebsdpr>
<url>http://www.privoxy.org/3.0.21/user-manual/whatsnew.html</url>
</references>
<dates>
<discovery>2013-03-07</discovery>
<entry>2016-01-26</entry>
</dates>
</vuln>
<vuln vid="2e8cdd36-c3cc-11e5-b5fe-002590263bf5">
<topic>sudo -- potential privilege escalation via symlink misconfiguration</topic>
<affects>
<package>
<name>sudo</name>
<range><lt>1.8.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5602">
<p>sudoedit in Sudo before 1.8.15 allows local users to gain
privileges via a symlink attack on a file whose full path is defined
using multiple wildcards in /etc/sudoers, as demonstrated by
"/home/*/*/file.txt."</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5602</cvename>
<freebsdpr>ports/206590</freebsdpr>
<url>https://www.exploit-db.com/exploits/37710/</url>
<url>https://bugzilla.sudo.ws/show_bug.cgi?id=707</url>
<url>http://www.sudo.ws/stable.html#1.8.15</url>
</references>
<dates>
<discovery>2015-11-17</discovery>
<entry>2016-01-26</entry>
</dates>
</vuln>
<vuln vid="99d3a8a5-c13c-11e5-96d6-14dae9d210b8">
<topic>imlib2 -- denial of service vulnerabilities</topic>
<affects>
<package>
<name>imlib2</name>
<range><lt>1.4.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Enlightenment reports:</p>
<blockquote cite="https://git.enlightenment.org/legacy/imlib2.git/tree/ChangeLog">
<p>GIF loader: Fix segv on images without colormap</p>
<p>Prevent division-by-zero crashes.</p>
<p>Fix segfault when opening input/queue/id:000007,src:000000,op:flip1,pos:51 with feh</p>
</blockquote>
</body>
</description>
<references>
<url>https://git.enlightenment.org/legacy/imlib2.git/tree/ChangeLog</url>
<url>http://seclists.org/oss-sec/2016/q1/162</url>
<cvename>CVE-2014-9762</cvename>
<cvename>CVE-2014-9763</cvename>
<cvename>CVE-2014-9764</cvename>
</references>
<dates>
<discovery>2013-12-21</discovery>
<entry>2016-01-22</entry>
</dates>
</vuln>
<vuln vid="b4578647-c12b-11e5-96d6-14dae9d210b8">
<topic>bind -- denial of service vulnerability</topic>
<affects>
<package>
<name>bind99</name>
<range><lt>9.9.8P3</lt></range>
</package>
<package>
<name>bind910</name>
<range><lt>9.10.3P3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01335">
<p>Specific APL data could trigger an INSIST in apl_42.c</p>
</blockquote>
</body>
</description>
<references>
<url>https://kb.isc.org/article/AA-01335</url>
<cvename>CVE-2015-8704</cvename>
</references>
<dates>
<discovery>2016-01-19</discovery>
<entry>2016-01-22</entry>
</dates>
</vuln>
<vuln vid="371bbea9-3836-4832-9e70-e8e928727f8c">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>48.0.2564.82</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.de/2016/01/stable-channel-update_20.html">
<p>This update includes 37 security fixes, including:</p>
<ul>
<li>[497632] High CVE-2016-1612: Bad cast in V8.</li>
<li>[572871] High CVE-2016-1613: Use-after-free in PDFium.</li>
<li>[544691] Medium CVE-2016-1614: Information leak in Blink.</li>
<li>[468179] Medium CVE-2016-1615: Origin confusion in Omnibox.</li>
<li>[541415] Medium CVE-2016-1616: URL Spoofing.</li>
<li>[544765] Medium CVE-2016-1617: History sniffing with HSTS and
CSP.</li>
<li>[552749] Medium CVE-2016-1618: Weak random number generator in
Blink.</li>
<li>[557223] Medium CVE-2016-1619: Out-of-bounds read in
PDFium.</li>
<li>[579625] CVE-2016-1620: Various fixes from internal audits,
fuzzing and other initiatives.</li>
<li>Multiple vulnerabilities in V8 fixed at the tip of the 4.8
branch.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1612</cvename>
<cvename>CVE-2016-1613</cvename>
<cvename>CVE-2016-1614</cvename>
<cvename>CVE-2016-1615</cvename>
<cvename>CVE-2016-1616</cvename>
<cvename>CVE-2016-1617</cvename>
<cvename>CVE-2016-1618</cvename>
<cvename>CVE-2016-1619</cvename>
<cvename>CVE-2016-1620</cvename>
<url>http://googlechromereleases.blogspot.de/2016/01/stable-channel-update_20.html</url>
</references>
<dates>
<discovery>2016-01-20</discovery>
<entry>2016-01-21</entry>
</dates>
</vuln>
<vuln vid="5237f5d7-c020-11e5-b397-d050996490d0">
<topic>ntp -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ntp</name>
<range><lt>4.2.8p6</lt></range>
</package>
<package>
<name>ntp-devel</name>
<range><lt>4.3.90</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Network Time Foundation reports:</p>
<blockquote cite="http://support.ntp.org/bin/view/Main/SecurityNotice#January_2016_NTP_4_2_8p6_Securit">
<p>NTF's NTP Project has been notified of the following low-
and medium-severity vulnerabilities that are fixed in
ntp-4.2.8p6, released on Tuesday, 19 January 2016:</p>
<ul>
<li>Bug 2948 / CVE-2015-8158: Potential Infinite Loop
in ntpq. Reported by Cisco ASIG.</li>
<li>Bug 2945 / CVE-2015-8138: origin: Zero Origin
Timestamp Bypass. Reported by Cisco ASIG.</li>
<li>Bug 2942 / CVE-2015-7979: Off-path Denial of
Service (DoS) attack on authenticated broadcast
mode. Reported by Cisco ASIG.</li>
<li>Bug 2940 / CVE-2015-7978: Stack exhaustion in
recursive traversal of restriction list.
Reported by Cisco ASIG.</li>
<li>Bug 2939 / CVE-2015-7977: reslist NULL pointer
dereference. Reported by Cisco ASIG.</li>
<li>Bug 2938 / CVE-2015-7976: ntpq saveconfig command
allows dangerous characters in filenames.
Reported by Cisco ASIG.</li>
<li>Bug 2937 / CVE-2015-7975: nextvar() missing length
check. Reported by Cisco ASIG.</li>
<li>Bug 2936 / CVE-2015-7974: Skeleton Key: Missing
key check allows impersonation between authenticated
peers. Reported by Cisco ASIG.</li>
<li>Bug 2935 / CVE-2015-7973: Deja Vu: Replay attack on
authenticated broadcast mode. Reported by Cisco ASIG.</li>
</ul>
<p>Additionally, mitigations are published for the following
two issues:</p>
<ul>
<li>Bug 2947 / CVE-2015-8140: ntpq vulnerable to replay
attacks. Reported by Cisco ASIG.</li>
<li>Bug 2946 / CVE-2015-8139: Origin Leak: ntpq and ntpdc,
disclose origin. Reported by Cisco ASIG.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7973</cvename>
<cvename>CVE-2015-7974</cvename>
<cvename>CVE-2015-7975</cvename>
<cvename>CVE-2015-7976</cvename>
<cvename>CVE-2015-7977</cvename>
<cvename>CVE-2015-7978</cvename>
<cvename>CVE-2015-7979</cvename>
<cvename>CVE-2015-8138</cvename>
<cvename>CVE-2015-8139</cvename>
<cvename>CVE-2015-8140</cvename>
<cvename>CVE-2015-8158</cvename>
<url>http://support.ntp.org/bin/view/Main/SecurityNotice#January_2016_NTP_4_2_8p6_Securit</url>
</references>
<dates>
<discovery>2016-01-20</discovery>
<entry>2016-01-21</entry>
</dates>
</vuln>
<vuln vid="62c0dbbd-bfce-11e5-b5fe-002590263bf5">
<topic>cgit -- multiple vulnerabilities</topic>
<affects>
<package>
<name>cgit</name>
<range><lt>0.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jason A. Donenfeld reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2016/01/14/6">
<p>Reflected Cross Site Scripting and Header Injection in Mimetype
Query String.</p>
<p>Stored Cross Site Scripting and Header Injection in Filename
Parameter.</p>
<p>Integer Overflow resulting in Buffer Overflow.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1899</cvename>
<cvename>CVE-2016-1900</cvename>
<cvename>CVE-2016-1901</cvename>
<freebsdpr>ports/206417</freebsdpr>
<url>http://lists.zx2c4.com/pipermail/cgit/2016-January/002817.html</url>
<url>http://www.openwall.com/lists/oss-security/2016/01/14/6</url>
</references>
<dates>
<discovery>2016-01-14</discovery>
<entry>2016-01-20</entry>
</dates>
</vuln>
<vuln vid="314830d8-bf91-11e5-96d6-14dae9d210b8">
<topic>bind -- denial of service vulnerability</topic>
<affects>
<package>
<name>bind910</name>
<range><lt>9.10.3P3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01336">
<p>Problems converting OPT resource records and ECS options to
text format can cause BIND to terminate</p>
</blockquote>
</body>
</description>
<references>
<url>https://kb.isc.org/article/AA-01336</url>
<cvename>CVE-2015-8705</cvename>
</references>
<dates>
<discovery>2016-01-19</discovery>
<entry>2016-01-20</entry>
<modified>2016-01-22</modified>
</dates>
</vuln>
<vuln vid="51358314-bec8-11e5-82cd-bcaec524bf84">
<topic>claws-mail -- no bounds checking on the output buffer in conv_jistoeuc, conv_euctojis, conv_sjistoeuc</topic>
<affects>
<package>
<name>claws-mail</name>
<range><lt>3.13.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>DrWhax reports:</p>
<blockquote cite="http://www.thewildbeast.co.uk/claws-mail/bugzilla/show_bug.cgi?id=3557">
<p>So in codeconv.c there is a function for japanese character set
conversion called conv_jistoeuc(). There is no bounds checking on
the output buffer, which is created on the stack with alloca()
Bug can be triggered by sending an email to TAILS_luser@riseup.net
or whatever.
Since my C is completely rusty, you might be able to make a better
judgement on the severity of this issue. Marking critical for now.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8614</cvename>
<url>https://security-tracker.debian.org/tracker/CVE-2015-8614</url>
</references>
<dates>
<discovery>2015-11-04</discovery>
<entry>2016-01-19</entry>
</dates>
</vuln>
<vuln vid="7c63775e-be31-11e5-b5fe-002590263bf5">
<topic>libarchive -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libarchive</name>
<range><lt>3.1.2_5,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0211">
<p>Integer signedness error in the archive_write_zip_data function in
archive_write_set_format_zip.c in libarchive 3.1.2 and earlier, when
running on 64-bit machines, allows context-dependent attackers to
cause a denial of service (crash) via unspecified vectors, which
triggers an improper conversion between unsigned and signed types,
leading to a buffer overflow.</p>
</blockquote>
<blockquote cite="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2304">
<p>Absolute path traversal vulnerability in bsdcpio in libarchive
3.1.2 and earlier allows remote attackers to write to arbitrary
files via a full pathname in an archive.</p>
</blockquote>
<p>Libarchive issue tracker reports:</p>
<blockquote cite="https://github.com/libarchive/libarchive/issues/502">
<p>Using a crafted tar file bsdtar can perform an out-of-bounds memory
read which will lead to a SEGFAULT. The issue exists when the
executable skips data in the archive. The amount of data to skip is
defined in byte offset [16-19] If ASLR is disabled, the issue can
lead to an infinite loop.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-0211</cvename>
<cvename>CVE-2015-2304</cvename>
<freebsdpr>ports/200176</freebsdpr>
<url>https://github.com/libarchive/libarchive/pull/110</url>
<url>https://github.com/libarchive/libarchive/commit/5935715</url>
<url>https://github.com/libarchive/libarchive/commit/2253154</url>
<url>https://github.com/libarchive/libarchive/issues/502</url>
<url>https://github.com/libarchive/libarchive/commit/3865cf2</url>
<url>https://github.com/libarchive/libarchive/commit/e6c9668</url>
<url>https://github.com/libarchive/libarchive/commit/24f5de6</url>
</references>
<dates>
<discovery>2012-12-06</discovery>
<entry>2016-01-18</entry>
</dates>
</vuln>
<vuln vid="6809c6db-bdeb-11e5-b5fe-002590263bf5">
<topic>go -- information disclosure vulnerability</topic>
<affects>
<package>
<name>go</name>
<range><ge>1.5,1</ge><lt>1.5.3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jason Buberel reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2016/01/13/7">
<p>A security-related issue has been reported in Go's math/big
package. The issue was introduced in Go 1.5. We recommend that all
users upgrade to Go 1.5.3, which fixes the issue. Go programs must
be recompiled with Go 1.5.3 in order to receive the fix.</p>
<p>The Go team would like to thank Nick Craig-Wood for identifying the
issue.</p>
<p>This issue can affect RSA computations in crypto/rsa, which is used
by crypto/tls. TLS servers on 32-bit systems could plausibly leak
their RSA private key due to this issue. Other protocol
implementations that create many RSA signatures could also be
impacted in the same way.</p>
<p>Specifically, incorrect results in one part of the RSA Chinese
Remainder computation can cause the result to be incorrect in such a
way that it leaks one of the primes. While RSA blinding should
prevent an attacker from crafting specific inputs that trigger the
bug, on 32-bit systems the bug can be expected to occur at random
around one in 2^26 times. Thus collecting around 64 million
signatures (of known data) from an affected server should be enough
to extract the private key used.</p>
<p>On 64-bit systems, the frequency of the bug is so low (less than
one in 2^50) that it would be very difficult to exploit.
Nonetheless, everyone is strongly encouraged to upgrade.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8618</cvename>
<url>http://www.openwall.com/lists/oss-security/2016/01/13/7</url>
<url>https://go-review.googlesource.com/#/c/17672/</url>
<url>https://go-review.googlesource.com/#/c/18491/</url>
</references>
<dates>
<discovery>2016-01-13</discovery>
<entry>2016-01-18</entry>
</dates>
</vuln>
<vuln vid="05eeb7e9-b987-11e5-83ef-14dae9d210b8">
<topic>isc-dhcpd -- Denial of Service</topic>
<affects>
<package>
<name>isc-dhcp41-server</name>
<range><lt>4.1.e_10,2</lt></range>
</package>
<package>
<name>isc-dhcp41-client</name>
<range><lt>4.1.e_3,2</lt></range>
</package>
<package>
<name>isc-dhcp41-relay</name>
<range><lt>4.1.e_6,2</lt></range>
</package>
<package>
<name>isc-dhcp42-client</name>
<name>isc-dhcp42-server</name>
<name>isc-dhcp42-relay</name>
<range><ge>0</ge></range>
</package>
<package>
<name>isc-dhcp43-client</name>
<name>isc-dhcp43-server</name>
<name>isc-dhcp43-relay</name>
<range><lt>4.3.3.p1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01334">
<p>A badly formed packet with an invalid IPv4 UDP length field
can cause a DHCP server, client, or relay program to terminate
abnormally.</p>
</blockquote>
</body>
</description>
<references>
<url>https://kb.isc.org/article/AA-01334</url>
<cvename>CVE-2015-8605</cvename>
</references>
<dates>
<discovery>2016-01-05</discovery>
<entry>2016-01-12</entry>
</dates>
</vuln>
<vuln vid="3b5c2362-bd07-11e5-b7ef-5453ed2e2b49">
<topic>libproxy -- stack-based buffer overflow</topic>
<affects>
<!-- libproxy-python is not affected. It only installs a .py file that
dlopen()s libproxy.so. -->
<package>
<name>libproxy</name>
<range><ge>0.4.0</ge><lt>0.4.6_1</lt></range>
</package>
<package>
<name>libproxy-gnome</name>
<range><ge>0.4.0</ge><lt>0.4.6_2</lt></range>
</package>
<package>
<name>libproxy-kde</name>
<range><ge>0.4.0</ge><lt>0.4.6_6</lt></range>
</package>
<package>
<name>libproxy-perl</name>
<range><ge>0.4.0</ge><lt>0.4.6_3</lt></range>
</package>
<package>
<name>libproxy-webkit</name>
<range><ge>0.4.0</ge><lt>0.4.6_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tomas Hoger reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=864417#c0">
<p>A buffer overflow flaw was discovered in the libproxy's
url::get_pac() used to download proxy.pac proxy auto-configuration
file. A malicious host hosting proxy.pac, or a man in the middle
attacker, could use this flaw to trigger a stack-based buffer
overflow in an application using libproxy, if proxy configuration
instructed it to download proxy.pac file from a remote HTTP
server.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-4504</cvename>
<url>https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-4504</url>
<mlist>http://www.openwall.com/lists/oss-security/2012/10/12/1</mlist>
<url>https://github.com/libproxy/libproxy/commit/c440553c12836664afd24a24fb3a4d10a2facd2c</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=864417</url>
<mlist>https://groups.google.com/forum/?fromgroups=#!topic/libproxy/VxZ8No7mT0E</mlist>
</references>
<dates>
<discovery>2012-10-10</discovery>
<entry>2016-01-17</entry>
<modified>2016-01-18</modified>
</dates>
</vuln>
<vuln vid="046fedd1-bd01-11e5-bbf4-5404a68ad561">
<topic>ffmpeg -- remote attacker can access local files</topic>
<affects>
<package>
<name>ffmpeg</name>
<range>
<gt>2.0,1</gt>
<lt>2.8.5,1</lt>
</range>
</package>
<package>
<name>mplayer</name>
<name>mencoder</name>
<range>
<lt>1.2.r20151219_2</lt>
</range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Arch Linux reports:</p>
<blockquote cite="https://bugs.archlinux.org/task/47738">
<p>ffmpeg has a vulnerability in the current version that allows the
attacker to create a specially crafted video file, downloading which
will send files from a user PC to a remote attacker server. The
attack does not even require the user to open that file — for
example, KDE Dolphin thumbnail generation is enough.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1897</cvename>
<cvename>CVE-2016-1898</cvename>
<freebsdpr>ports/206282</freebsdpr>
<url>https://www.ffmpeg.org/security.html</url>
</references>
<dates>
<discovery>2016-01-13</discovery>
<entry>2016-01-17</entry>
</dates>
</vuln>
<vuln vid="6c808811-bb9a-11e5-a65c-485d605f4717">
<topic>h2o -- directory traversal vulnerability</topic>
<affects>
<package>
<name>h2o</name>
<range><lt>1.6.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Yakuzo OKU reports:</p>
<blockquote cite="http://h2o.examp1e.net/vulnerabilities.html">
<p>When redirect directive is used, this flaw allows a remote
attacker to inject response headers into an HTTP redirect response.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1133</cvename>
<url>https://h2o.examp1e.net/vulnerabilities.html</url>
</references>
<dates>
<discovery>2016-01-13</discovery>
<entry>2016-01-15</entry>
</dates>
</vuln>
<vuln vid="dfe0cdc1-baf2-11e5-863a-b499baebfeaf">
<topic>openssh -- information disclosure</topic>
<affects>
<package>
<name>openssh-portable</name>
<range>
<gt>5.4.p0,1</gt>
<lt>7.1.p2,1</lt>
</range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSSH reports:</p>
<blockquote cite="http://www.openssh.com/security.html">
<p>OpenSSH clients between versions 5.4 and 7.1 are vulnerable to
information disclosure that may allow a malicious server to retrieve
information including under some circumstances, user's private keys.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openssh.com/security.html</url>
<cvename>CVE-2016-0777</cvename>
<cvename>CVE-2016-0778</cvename>
</references>
<dates>
<discovery>2016-01-14</discovery>
<entry>2016-01-14</entry>
<modified>2016-01-15</modified>
</dates>
</vuln>
<vuln vid="842cd117-ba54-11e5-9728-002590263bf5">
<topic>prosody -- multiple vulnerabilities</topic>
<affects>
<package>
<name>prosody</name>
<range><lt>0.9.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Prosody Team reports:</p>
<blockquote cite="http://blog.prosody.im/prosody-0-9-9-security-release/">
<p>Fix path traversal vulnerability in mod_http_files
(CVE-2016-1231)</p>
<p>Fix use of weak PRNG in generation of dialback secrets
(CVE-2016-1232)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1231</cvename>
<cvename>CVE-2016-1232</cvename>
<freebsdpr>ports/206150</freebsdpr>
<url>http://blog.prosody.im/prosody-0-9-9-security-release/</url>
</references>
<dates>
<discovery>2016-01-08</discovery>
<entry>2016-01-14</entry>
</dates>
</vuln>
<vuln vid="a7a4e96c-ba50-11e5-9728-002590263bf5">
<topic>kibana4 -- XSS vulnerability</topic>
<affects>
<package>
<name>kibana4</name>
<name>kibana41</name>
<range><lt>4.1.4</lt></range>
</package>
<package>
<name>kibana42</name>
<range><lt>4.2.2</lt></range>
</package>
<package>
<name>kibana43</name>
<range><lt>4.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Elastic reports:</p>
<blockquote cite="https://www.elastic.co/blog/kibana-4-3-1-and-4-2-2-and-4-1-4">
<p>Fixes XSS vulnerability (CVE pending) - Thanks to Vladimir Ivanov
for responsibly reporting.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/205961</freebsdpr>
<freebsdpr>ports/205962</freebsdpr>
<freebsdpr>ports/205963</freebsdpr>
<url>https://www.elastic.co/blog/kibana-4-3-1-and-4-2-2-and-4-1-4</url>
</references>
<dates>
<discovery>2015-12-17</discovery>
<entry>2016-01-13</entry>
</dates>
</vuln>
<vuln vid="333f655a-b93a-11e5-9efa-5453ed2e2b49">
<topic>p5-PathTools -- File::Spec::canonpath loses taint</topic>
<affects>
<package>
<name>p5-PathTools</name>
<range>
<gt>3.4000</gt>
<lt>3.6200</lt>
</range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ricardo Signes reports:</p>
<blockquote>
<p>Beginning in PathTools 3.47 and/or perl 5.20.0, the
File::Spec::canonpath() routine returned untained strings even if
passed tainted input. This defect undermines the guarantee of taint
propagation, which is sometimes used to ensure that unvalidated
user input does not reach sensitive code.</p>
<p>This defect was found and reported by David Golden of MongoDB.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8607</cvename>
<url>https://rt.perl.org/Public/Bug/Display.html?id=126862</url>
</references>
<dates>
<discovery>2016-01-11</discovery>
<entry>2016-01-12</entry>
</dates>
</vuln>
<vuln vid="6b771fe2-b84e-11e5-92f9-485d605f4717">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php55</name>
<name>php55-gd</name>
<name>php55-wddx</name>
<name>php55-xmlrpc</name>
<range><lt>5.5.31</lt></range>
</package>
<package>
<name>php56</name>
<name>php56-gd</name>
<name>php56-soap</name>
<name>php56-wddx</name>
<name>php56-xmlrpc</name>
<range><lt>5.6.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PHP reports:</p>
<blockquote cite="http://www.php.net/ChangeLog-5.php#5.5.31">
<ul><li>Core:
<ul>
<li>Fixed bug #70755 (fpm_log.c memory leak and buffer overflow).</li>
</ul></li>
<li>GD:
<ul>
<li>Fixed bug #70976 (Memory Read via gdImageRotateInterpolated Array
Index Out of Bounds).</li>
</ul></li>
<li>SOAP:
<ul>
<li>Fixed bug #70900 (SoapClient systematic out of memory error).</li>
</ul></li>
<li>Wddx
<ul>
<li>Fixed bug #70661 (Use After Free Vulnerability in WDDX Packet
Deserialization).</li>
<li>Fixed bug #70741 (Session WDDX Packet Deserialization Type
Confusion Vulnerability).</li>
</ul></li>
<li>XMLRPC:
<ul>
<li>Fixed bug #70728 (Type Confusion Vulnerability in
PHP_to_XMLRPC_worker()).</li>
</ul></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://www.php.net/ChangeLog-5.php#5.5.31</url>
<url>http://www.php.net/ChangeLog-5.php#5.6.17</url>
</references>
<dates>
<discovery>2016-01-07</discovery>
<entry>2016-01-11</entry>
</dates>
</vuln>
<vuln vid="5f276780-b6ce-11e5-9731-5453ed2e2b49">
<topic>pygments -- shell injection vulnerability</topic>
<affects>
<package>
<name>py27-pygments</name>
<name>py32-pygments</name>
<name>py33-pygments</name>
<name>py34-pygments</name>
<name>py35-pygments</name>
<range><lt>2.0.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8557">
<p>The FontManager._get_nix_font_path function in formatters/img.py
in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute
arbitrary commands via shell metacharacters in a font name.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8557</cvename>
<mlist>http://seclists.org/fulldisclosure/2015/Oct/4</mlist>
<url>https://bitbucket.org/birkenfeld/pygments-main/commits/0036ab1c99e256298094505e5e92fdacdfc5b0a8</url>
</references>
<dates>
<discovery>2015-09-28</discovery>
<entry>2016-01-09</entry>
</dates>
</vuln>
<vuln vid="631fc042-b636-11e5-83ef-14dae9d210b8">
<topic>polkit -- multiple vulnerabilities</topic>
<affects>
<package>
<name>polkit</name>
<range><lt>0.113</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Colin Walters reports:</p>
<blockquote cite="http://lists.freedesktop.org/archives/polkit-devel/2015-June/000425.html">
<ul>
<li><p>Integer overflow in the
authentication_agent_new_cookie function in PolicyKit (aka polkit)
before 0.113 allows local users to gain privileges by creating a large
number of connections, which triggers the issuance of a duplicate cookie
value.</p></li>
<li><p>The authentication_agent_new function in
polkitbackend/polkitbackendinteractiveauthority.c in PolicyKit (aka
polkit) before 0.113 allows local users to cause a denial of service
(NULL pointer dereference and polkitd daemon crash) by calling
RegisterAuthenticationAgent with an invalid object path.</p></li>
<li><p>The polkit_backend_action_pool_init function in
polkitbackend/polkitbackendactionpool.c in PolicyKit (aka polkit) before
0.113 might allow local users to gain privileges via duplicate action
IDs in action descriptions.</p></li>
<li><p>PolicyKit (aka polkit) before 0.113 allows local
users to cause a denial of service (memory corruption and polkitd daemon
crash) and possibly gain privileges via unspecified vectors, related to
"javascript rule evaluation."</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://lists.freedesktop.org/archives/polkit-devel/2015-June/000425.html</url>
<cvename>CVE-2015-4625</cvename>
<cvename>CVE-2015-3218</cvename>
<cvename>CVE-2015-3255</cvename>
<cvename>CVE-2015-3256</cvename>
</references>
<dates>
<discovery>2015-06-03</discovery>
<entry>2016-01-08</entry>
</dates>
</vuln>
<vuln vid="b22b016b-b633-11e5-83ef-14dae9d210b8">
<topic>librsync -- collision vulnerability</topic>
<affects>
<package>
<name>librsync</name>
<range><lt>1.0.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Michael Samuel reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2014/07/28/1">
<p>librsync before 1.0.0 uses a truncated MD4 checksum to
match blocks, which makes it easier for remote attackers to modify
transmitted data via a birthday attack.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2014/07/28/1</url>
<cvename>CVE-2014-8242</cvename>
</references>
<dates>
<discovery>2014-07-28</discovery>
<entry>2016-01-08</entry>
</dates>
</vuln>
<vuln vid="4eae4f46-b5ce-11e5-8a2b-d050996490d0">
<topic>ntp -- denial of service vulnerability</topic>
<affects>
<package>
<name>ntp</name>
<range><lt>4.2.8p5</lt></range>
</package>
<package>
<name>ntp-devel</name>
<range><lt>4.3.78</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Network Time Foundation reports:</p>
<blockquote cite="http://support.ntp.org/bin/view/Main/SecurityNotice#January_2016_NTP_4_2_8p5_Securit">
<p>NTF's NTP Project has been notified of the following
1 medium-severity vulnerability that is fixed in
ntp-4.2.8p5, released on Thursday, 7 January 2016:</p>
<p>NtpBug2956: Small-step/Big-step CVE-2015-5300</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5300</cvename>
<url>https://www.cs.bu.edu/~goldbe/NTPattack.html</url>
<url>http://support.ntp.org/bin/view/Main/NtpBug2956</url>
<url>http://support.ntp.org/bin/view/Main/SecurityNotice#January_2016_NTP_4_2_8p5_Securit</url>
</references>
<dates>
<discovery>2015-10-21</discovery>
<entry>2016-01-08</entry>
</dates>
</vuln>
<vuln vid="df587aa2-b5a5-11e5-9728-002590263bf5">
<topic>dhcpcd -- multiple vulnerabilities</topic>
<affects>
<package>
<name>dhcpcd</name>
<range><lt>6.10.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Nico Golde reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2016/01/07/3">
<p>heap overflow via malformed dhcp responses later in print_option
(via dhcp_envoption1) due to incorrect option length values.
Exploitation is non-trivial, but I'd love to be proven wrong.</p>
<p>invalid read/crash via malformed dhcp responses. not exploitable
beyond DoS as far as I can judge.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1503</cvename>
<cvename>CVE-2016-1504</cvename>
<freebsdpr>ports/206015</freebsdpr>
<url>http://roy.marples.name/projects/dhcpcd/info/76a1609352263bd9def1300d7ba990679571fa30</url>
<url>http://roy.marples.name/projects/dhcpcd/info/595883e2a431f65d8fabf33059aa4689cca17403</url>
<url>http://www.openwall.com/lists/oss-security/2016/01/07/3</url>
</references>
<dates>
<discovery>2016-01-04</discovery>
<entry>2016-01-08</entry>
</dates>
</vuln>
<vuln vid="4084168e-b531-11e5-a98c-0011d823eebd">
<topic>mbedTLS/PolarSSL -- SLOTH attack on TLS 1.2 server authentication</topic>
<affects>
<package>
<name>polarssl13</name>
<range><lt>1.3.16</lt></range>
</package>
<package>
<name>mbedtls</name>
<range><lt>2.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ARM Limited reports:</p>
<blockquote cite="https://tls.mbed.org/tech-updates/releases/mbedtls-2.2.1-2.1.4-1.3.16-and-polarssl.1.2.19-released">
<p>MD5 handshake signatures in TLS 1.2 are vulnerable to the SLOTH attack
on TLS 1.2 server authentication. They have been disabled by default.
Other attacks from the SLOTH paper do not apply to any version of mbed
TLS or PolarSSL.</p>
</blockquote>
</body>
</description>
<references>
<url>https://tls.mbed.org/tech-updates/releases/mbedtls-2.2.1-2.1.4-1.3.16-and-polarssl.1.2.19-released</url>
</references>
<dates>
<discovery>2016-01-04</discovery>
<entry>2016-01-07</entry>
</dates>
</vuln>
<vuln vid="6aa2d135-b40e-11e5-9728-002590263bf5">
<topic>xen-kernel -- ioreq handling possibly susceptible to multiple read issue</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.5.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-166.html">
<p>Single memory accesses in source code can be translated to multiple
ones in machine code by the compiler, requiring special caution when
accessing shared memory. Such precaution was missing from the
hypervisor code inspecting the state of I/O requests sent to the
device model for assistance.</p>
<p>Due to the offending field being a bitfield, it is however believed
that there is no issue in practice, since compilers, at least when
optimizing (which is always the case for non-debug builds), should find
it more expensive to extract the bit field value twice than to keep the
calculated value in a register.</p>
<p>This vulnerability is exposed to malicious device models. In
conventional Xen systems this means the qemu which service an HVM
domain. On such systems this vulnerability can only be exploited if
the attacker has gained control of the device model qemu via another
vulnerability.</p>
<p>Privilege escalation, host crash (Denial of Service), and leaked
information all cannot be excluded.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/205841</freebsdpr>
<url>http://xenbits.xen.org/xsa/advisory-166.html</url>
</references>
<dates>
<discovery>2015-12-17</discovery>
<entry>2016-01-06</entry>
</dates>
</vuln>
<vuln vid="e839ca04-b40d-11e5-9728-002590263bf5">
<topic>xen-kernel -- information leak in legacy x86 FPU/XMM initialization</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.5.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-165.html">
<p>When XSAVE/XRSTOR are not in use by Xen to manage guest extended
register state, the initial values in the FPU stack and XMM
registers seen by the guest upon first use are those left there by
the previous user of those registers.</p>
<p>A malicious domain may be able to leverage this to obtain sensitive
information such as cryptographic keys from another domain.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8555</cvename>
<freebsdpr>ports/205841</freebsdpr>
<url>http://xenbits.xen.org/xsa/advisory-165.html</url>
</references>
<dates>
<discovery>2015-12-17</discovery>
<entry>2016-01-06</entry>
</dates>
</vuln>
<vuln vid="5d1d4473-b40d-11e5-9728-002590263bf5">
<topic>xen-tools -- libxl leak of pv kernel and initrd on error</topic>
<affects>
<package>
<name>xen-tools</name>
<range><ge>4.1</ge><lt>4.5.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-160.html">
<p>When constructing a guest which is configured to use a PV
bootloader which runs as a userspace process in the toolstack domain
(e.g. pygrub) libxl creates a mapping of the files to be used as
kernel and initial ramdisk when building the guest domain.</p>
<p>However if building the domain subsequently fails these mappings
would not be released leading to a leak of virtual address space in
the calling process, as well as preventing the recovery of the
temporary disk files containing the kernel and initial ramdisk.</p>
<p>For toolstacks which manage multiple domains within the same
process, an attacker who is able to repeatedly start a suitable
domain (or many such domains) can cause an out-of-memory condition in the
toolstack process, leading to a denial of service.</p>
<p>Under the same circumstances an attacker can also cause files to
accumulate on the toolstack domain filesystem (usually under /var in
dom0) used to temporarily store the kernel and initial ramdisk,
perhaps leading to a denial of service against arbitrary other
services using that filesystem.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8341</cvename>
<freebsdpr>ports/205841</freebsdpr>
<url>http://xenbits.xen.org/xsa/advisory-160.html</url>
</references>
<dates>
<discovery>2015-12-08</discovery>
<entry>2016-01-06</entry>
</dates>
</vuln>
<vuln vid="bcad3faa-b40c-11e5-9728-002590263bf5">
<topic>xen-kernel -- XENMEM_exchange error handling issues</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.5.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-159.html">
<p>Error handling in the operation may involve handing back pages to
the domain. This operation may fail when in parallel the domain gets
torn down. So far this failure unconditionally resulted in the host
being brought down due to an internal error being assumed. This is
CVE-2015-8339.</p>
<p>Furthermore error handling so far wrongly included the release of a
lock. That lock, however, was either not acquired or already released
on all paths leading to the error handling sequence. This is
CVE-2015-8340.</p>
<p>A malicious guest administrator may be able to deny service by
crashing the host or causing a deadlock.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8339</cvename>
<cvename>CVE-2015-8340</cvename>
<freebsdpr>ports/205841</freebsdpr>
<url>http://xenbits.xen.org/xsa/advisory-159.html</url>
</references>
<dates>
<discovery>2015-12-08</discovery>
<entry>2016-01-06</entry>
</dates>
</vuln>
<vuln vid="b65e4914-b3bc-11e5-8255-5453ed2e2b49">
<topic>tiff -- out-of-bounds read in CIE Lab image format</topic>
<affects>
<package>
<name>tiff</name>
<range><le>4.0.6</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>zzf of Alibaba discovered an out-of-bounds vulnerability in the code
processing the LogLUV and CIE Lab image format files. An attacker
could create a specially-crafted TIFF file that could cause libtiff
to crash.</p>
</body>
</description>
<references>
<cvename>CVE-2015-8683</cvename>
<mlist>http://www.openwall.com/lists/oss-security/2015/12/25/2</mlist>
</references>
<dates>
<discovery>2015-12-25</discovery>
<entry>2016-01-05</entry>
</dates>
</vuln>
<vuln vid="bd349f7a-b3b9-11e5-8255-5453ed2e2b49">
<topic>tiff -- out-of-bounds read in tif_getimage.c</topic>
<affects>
<package>
<name>tiff</name>
<range><le>4.0.6</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>LMX of Qihoo 360 Codesafe Team discovered an out-of-bounds read in
tif_getimage.c. An attacker could create a specially-crafted TIFF
file that could cause libtiff to crash.</p>
</body>
</description>
<references>
<cvename>CVE-2015-8665</cvename>
<mlist>http://www.openwall.com/lists/oss-security/2015/12/24/2</mlist>
</references>
<dates>
<discovery>2015-12-24</discovery>
<entry>2016-01-05</entry>
</dates>
</vuln>
<vuln vid="86c3c66e-b2f5-11e5-863a-b499baebfeaf">
<topic>unzip -- multiple vulnerabilities</topic>
<affects>
<package>
<name>unzip</name>
<range><lt>6.0_7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gustavo Grieco reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/07/4">
<p>Two issues were found in unzip 6.0:</p>
<p> * A heap overflow triggered by unzipping a file with password
(e.g unzip -p -P x sigsegv.zip).</p>
<p> * A denegation of service with a file that never finishes unzipping
(e.g. unzip sigxcpu.zip).</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2015/09/07/4</url>
<freebsdpr>ports/204413</freebsdpr>
<cvename>CVE-2015-7696</cvename>
<cvename>CVE-2015-7697</cvename>
</references>
<dates>
<discovery>2015-09-26</discovery>
<entry>2016-01-04</entry>
</dates>
</vuln>
<vuln vid="bb961ff3-b3a4-11e5-8255-5453ed2e2b49">
<topic>cacti -- SQL injection vulnerabilities</topic>
<affects>
<package>
<name>cacti</name>
<range><le>0.8.8f_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8369">
<p>SQL injection vulnerability in include/top_graph_header.php in
Cacti 0.8.8f and earlier allows remote attackers to execute arbitrary
SQL commands via the rra_id parameter in a properties action to
graph.php.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8369</cvename>
<url>http://bugs.cacti.net/view.php?id=2646</url>
<url>http://svn.cacti.net/viewvc?view=rev&amp;revision=7767</url>
<mlist>http://seclists.org/fulldisclosure/2015/Dec/8</mlist>
</references>
<dates>
<discovery>2015-12-05</discovery>
<entry>2016-01-05</entry>
</dates>
</vuln>
<vuln vid="59e7eb28-b309-11e5-af83-80ee73b5dcf5">
<topic>kea -- unexpected termination while handling a malformed packet</topic>
<affects>
<package>
<name>kea</name>
<range><ge>0.9.2</ge><lt>1.0.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC Support reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01318/0/CVE-2015-8373-ISC-Kea%3A-unexpected-termination-while-handling-a-malformed-packet.html">
<p>ISC Kea may terminate unexpectedly (crash) while handling
a malformed client packet. Related defects in the kea-dhcp4
and kea-dhcp6 servers can cause the server to crash during
option processing if a client sends a malformed packet.
An attacker sending a crafted malformed packet can cause
an ISC Kea server providing DHCP services to IPv4 or IPv6
clients to exit unexpectedly.</p>
<ul>
<li><p>The kea-dhcp4 server is vulnerable only in versions
0.9.2 and 1.0.0-beta, and furthermore only when logging
at debug level 40 or higher. Servers running kea-dhcp4
versions 0.9.1 or lower, and servers which are not
logging or are logging at debug level 39 or below are
not vulnerable.</p></li>
<li><p>The kea-dhcp6 server is vulnerable only in versions
0.9.2 and 1.0.0-beta, and furthermore only when
logging at debug level 45 or higher. Servers running
kea-dhcp6 versions 0.9.1 or lower, and servers
which are not logging or are logging at debug level 44
or below are not vulnerable.</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8373</cvename>
<url>https://kb.isc.org/article/AA-01318/0/CVE-2015-8373-ISC-Kea%3A-unexpected-termination-while-handling-a-malformed-packet.html</url>
</references>
<dates>
<discovery>2015-12-15</discovery>
<entry>2016-01-04</entry>
<modified>2016-01-05</modified>
</dates>
</vuln>
<vuln vid="84dc49b0-b267-11e5-8a5b-00262d5ed8ee">
<topic>mini_httpd -- buffer overflow via snprintf</topic>
<affects>
<package>
<name>mini_httpd</name>
<range><lt>1.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ACME Updates reports:</p>
<blockquote cite="https://cxsecurity.com/acveshow/CVE-2015-1548">
<p>mini_httpd 1.21 and earlier allows remote attackers to obtain
sensitive information from process memory via an HTTP request with
a long protocol string, which triggers an incorrect response size
calculation and an out-of-bounds read.</p>
<p>(rene) ACME, the author, claims that the vulnerability is fixed
*after* version 1.22, released on 2015-12-28</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1548</cvename>
<url>https://cxsecurity.com/cveshow/CVE-2015-1548</url>
<url>http://acme.com/updates/archive/192.html</url>
</references>
<dates>
<discovery>2015-02-10</discovery>
<entry>2016-01-03</entry>
</dates>
</vuln>
<vuln vid="1384f2fd-b1be-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerability in Rocker switch emulation</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><ge>0</ge></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20160213</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/28/6">
<p>Qemu emulator built with the Rocker switch emulation support is
vulnerable to an off-by-one error. It happens while processing
transmit(tx) descriptors in 'tx_consume' routine, if a descriptor
was to have more than allowed (ROCKER_TX_FRAGS_MAX=16) fragments.
</p>
<p>A privileged user inside guest could use this flaw to cause memory
leakage on the host or crash the Qemu process instance resulting in
DoS issue.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8701</cvename>
<freebsdpr>ports/205813</freebsdpr>
<freebsdpr>ports/205814</freebsdpr>
<url>http://www.openwall.com/lists/oss-security/2015/12/28/6</url>
<url>https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg04629.html</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=007cd223de527b5f41278f2d886c1a4beb3e67aa</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/007cd223de527b5f41278f2d886c1a4beb3e67aa</url>
</references>
<dates>
<discovery>2015-12-28</discovery>
<entry>2016-01-03</entry>
<modified>2016-02-13</modified>
</dates>
</vuln>
<vuln vid="152acff3-b1bd-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerability in Q35 chipset emulation</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.5.0</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20151224</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/24/1">
<p>Qemu emulator built with the Q35 chipset based pc system emulator
is vulnerable to a heap based buffer overflow. It occurs during VM
guest migration, as more(16 bytes) data is moved into allocated
(8 bytes) memory area.</p>
<p>A privileged guest user could use this issue to corrupt the VM
guest image, potentially leading to a DoS. This issue affects q35
machine types.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8666</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/12/24/1</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=d9a3b33d2c9f996537b7f1d0246dee2d0120cefb</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/d9a3b33d2c9f996537b7f1d0246dee2d0120cefb</url>
</references>
<dates>
<discovery>2015-11-19</discovery>
<entry>2016-01-03</entry>
</dates>
</vuln>
<vuln vid="62ab8707-b1bc-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerability in Human Monitor Interface support</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><ge>0</ge></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20160213</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/22/8">
<p>Qemu emulator built with the Human Monitor Interface(HMP) support
is vulnerable to an OOB write issue. It occurs while processing
'sendkey' command in hmp_sendkey routine, if the command argument is
longer than the 'keyname_buf' buffer size.</p>
<p>A user/process could use this flaw to crash the Qemu process
instance resulting in DoS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8619</cvename>
<freebsdpr>ports/205813</freebsdpr>
<freebsdpr>ports/205814</freebsdpr>
<url>http://www.openwall.com/lists/oss-security/2015/12/22/8</url>
<url>https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg02930.html</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=64ffbe04eaafebf4045a3ace52a360c14959d196</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/64ffbe04eaafebf4045a3ace52a360c14959d196</url>
</references>
<dates>
<discovery>2015-12-23</discovery>
<entry>2016-01-03</entry>
<modified>2016-02-13</modified>
</dates>
</vuln>
<vuln vid="b3f9f8ef-b1bb-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerability in MegaRAID SAS HBA emulation</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><ge>0</ge></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20160213</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/21/7">
<p>Qemu emulator built with the SCSI MegaRAID SAS HBA emulation
support is vulnerable to a stack buffer overflow issue. It occurs
while processing the SCSI controller's CTRL_GET_INFO command. A
privileged guest user could use this flaw to crash the Qemu process
instance resulting in DoS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8613</cvename>
<freebsdpr>ports/205813</freebsdpr>
<freebsdpr>ports/205814</freebsdpr>
<url>http://www.openwall.com/lists/oss-security/2015/12/21/7</url>
<url>https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg03737.html</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=36fef36b91f7ec0435215860f1458b5342ce2811</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/36fef36b91f7ec0435215860f1458b5342ce2811</url>
</references>
<dates>
<discovery>2015-12-21</discovery>
<entry>2016-01-03</entry>
<modified>2016-02-13</modified>
</dates>
</vuln>
<vuln vid="9ad8993e-b1ba-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerability in VMWARE VMXNET3 NIC support</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><ge>0</ge></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20160213</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/15/4">
<p>Qemu emulator built with a VMWARE VMXNET3 paravirtual NIC emulator
support is vulnerable to a memory leakage flaw. It occurs when a
guest repeatedly tries to activate the vmxnet3 device.</p>
<p>A privileged guest user could use this flaw to leak host memory,
resulting in DoS on the host.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8567</cvename>
<cvename>CVE-2015-8568</cvename>
<freebsdpr>ports/205813</freebsdpr>
<freebsdpr>ports/205814</freebsdpr>
<url>http://www.openwall.com/lists/oss-security/2015/12/15/4</url>
<url>https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg02299.html</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=aa4a3dce1c88ed51b616806b8214b7c8428b7470</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/aa4a3dce1c88ed51b616806b8214b7c8428b7470</url>
</references>
<dates>
<discovery>2015-12-15</discovery>
<entry>2016-01-03</entry>
<modified>2016-02-13</modified>
</dates>
</vuln>
<vuln vid="60cb2055-b1b8-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerability in USB EHCI emulation support</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><ge>0</ge></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20151224</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/14/9">
<p>Qemu emulator built with the USB EHCI emulation support is
vulnerable to an infinite loop issue. It occurs during communication
between host controller interface(EHCI) and a respective device
driver. These two communicate via a isochronous transfer descriptor
list(iTD) and an infinite loop unfolds if there is a closed loop in
this list.</p>
<p>A privileges user inside guest could use this flaw to consume
excessive CPU cycles &amp; resources on the host.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8558</cvename>
<freebsdpr>ports/205814</freebsdpr>
<url>http://www.openwall.com/lists/oss-security/2015/12/14/9</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=156a2e4dbffa85997636a7a39ef12da6f1b40254</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/156a2e4dbffa85997636a7a39ef12da6f1b40254</url>
</references>
<dates>
<discovery>2015-12-14</discovery>
<entry>2016-01-03</entry>
</dates>
</vuln>
<vuln vid="3fb06284-b1b7-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerability in MSI-X support</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.5.0</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20151224</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/14/2">
<p>Qemu emulator built with the PCI MSI-X support is vulnerable to
null pointer dereference issue. It occurs when the controller
attempts to write to the pending bit array(PBA) memory region.
Because the MSI-X MMIO support did not define the .write method.</p>
<p>A privileges used inside guest could use this flaw to crash the
Qemu process resulting in DoS issue.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7549</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/12/14/2</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=43b11a91dd861a946b231b89b7542856ade23d1b</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/43b11a91dd861a946b231b89b7542856ade23d1b</url>
</references>
<dates>
<discovery>2015-06-26</discovery>
<entry>2016-01-03</entry>
</dates>
</vuln>
<vuln vid="67feba97-b1b5-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerability in VNC</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.5.0</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20151224</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/08/4">
<p>Qemu emulator built with the VNC display driver support is
vulnerable to an arithmetic exception flaw. It occurs on the VNC
server side while processing the 'SetPixelFormat' messages from a
client.</p>
<p>A privileged remote client could use this flaw to crash the guest
resulting in DoS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8504</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/12/08/4</url>
<url>http://git.qemu.org/?p=qemu.git;a=commitdiff;h=4c65fed8bdf96780735dbdb92a8bd0d6b6526cc3</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/4c65fed8bdf96780735dbdb92a8bd0d6b6526cc3</url>
</references>
<dates>
<discovery>2015-12-08</discovery>
<entry>2016-01-03</entry>
</dates>
</vuln>
<vuln vid="405446f4-b1b3-11e5-9728-002590263bf5">
<topic>qemu and xen-tools -- denial of service vulnerabilities in AMD PC-Net II NIC support</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.5.0</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20151224</lt></range>
</package>
<package>
<name>xen-tools</name>
<range><lt>4.5.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/11/30/2">
<p>Qemu emulator built with the AMD PC-Net II Ethernet Controller
support is vulnerable to a heap buffer overflow flaw. While
receiving packets in the loopback mode, it appends CRC code to the
receive buffer. If the data size given is same as the receive buffer
size, the appended CRC code overwrites 4 bytes beyond this
's-&gt;buffer' array.</p>
<p>A privileged(CAP_SYS_RAWIO) user inside guest could use this flaw
to crash the Qemu instance resulting in DoS or potentially execute
arbitrary code with privileges of the Qemu process on the host.</p>
</blockquote>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/11/30/3">
<p>The AMD PC-Net II emulator(hw/net/pcnet.c), while receiving packets
from a remote host(non-loopback mode), fails to validate the
received data size, thus resulting in a buffer overflow issue. It
could potentially lead to arbitrary code execution on the host, with
privileges of the Qemu process. It requires the guest NIC to have
larger MTU limit.</p>
<p>A remote user could use this flaw to crash the guest instance
resulting in DoS or potentially execute arbitrary code on a remote
host with privileges of the Qemu process.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7504</cvename>
<cvename>CVE-2015-7512</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/11/30/2</url>
<url>http://www.openwall.com/lists/oss-security/2015/11/30/3</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=837f21aacf5a714c23ddaadbbc5212f9b661e3f7</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=8b98a2f07175d46c3f7217639bd5e03f2ec56343</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/837f21aacf5a714c23ddaadbbc5212f9b661e3f7</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/8b98a2f07175d46c3f7217639bd5e03f2ec56343</url>
<url>http://xenbits.xen.org/xsa/advisory-162.html</url>
</references>
<dates>
<discovery>2015-11-30</discovery>
<entry>2016-01-03</entry>
<modified>2016-01-06</modified>
</dates>
</vuln>
<vuln vid="b56fe6bb-b1b1-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerabilities in eepro100 NIC support</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><ge>0</ge></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20160213</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/11/25/3">
<p>Qemu emulator built with the i8255x (PRO100) emulation support is
vulnerable to an infinite loop issue. It could occur while
processing a chain of commands located in the Command Block List
(CBL). Each Command Block(CB) points to the next command in the
list. An infinite loop unfolds if the link to the next CB points
to the same block or there is a closed loop in the chain.</p>
<p>A privileged(CAP_SYS_RAWIO) user inside guest could use this flaw
to crash the Qemu instance resulting in DoS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8345</cvename>
<freebsdpr>ports/205813</freebsdpr>
<freebsdpr>ports/205814</freebsdpr>
<url>http://www.openwall.com/lists/oss-security/2015/11/25/3</url>
<url>https://lists.gnu.org/archive/html/qemu-devel/2015-10/msg03911.html</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=00837731d254908a841d69298a4f9f077babaf24</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/00837731d254908a841d69298a4f9f077babaf24</url>
</references>
<dates>
<discovery>2015-10-16</discovery>
<entry>2016-01-03</entry>
<modified>2016-02-13</modified>
</dates>
</vuln>
<vuln vid="42cbd1e8-b152-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerability in virtio-net support</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.4.1</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20151224</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/18/5">
<p>Qemu emulator built with the Virtual Network Device(virtio-net)
support is vulnerable to a DoS issue. It could occur while receiving
large packets over the tuntap/macvtap interfaces and when guest's
virtio-net driver did not support big/mergeable receive buffers.</p>
<p>An attacker on the local network could use this flaw to disable
guest's networking by sending a large number of jumbo frames to the
guest, exhausting all receive buffers and thus leading to a DoS
situation.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7295</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/09/18/5</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=696317f1895e836d53b670c7b77b7be93302ba08</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/0cf33fb6b49a19de32859e2cdc6021334f448fb3</url>
</references>
<dates>
<discovery>2015-09-18</discovery>
<entry>2016-01-02</entry>
</dates>
</vuln>
<vuln vid="6aa3322f-b150-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerabilities in NE2000 NIC support</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.4.0.1</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20151224</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/15/2">
<p>Qemu emulator built with the NE2000 NIC emulation support is
vulnerable to an infinite loop issue. It could occur when receiving
packets over the network.</p>
<p>A privileged user inside guest could use this flaw to crash the
Qemu instance resulting in DoS.</p>
</blockquote>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/15/3">
<p>Qemu emulator built with the NE2000 NIC emulation support is
vulnerable to a heap buffer overflow issue. It could occur when
receiving packets over the network.</p>
<p>A privileged user inside guest could use this flaw to crash the
Qemu instance or potentially execute arbitrary code on the host.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5278</cvename>
<cvename>CVE-2015-5279</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/09/15/2</url>
<url>http://www.openwall.com/lists/oss-security/2015/09/15/3</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=5a1ccdfe44946e726b4c6fda8a4493b3931a68c1</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/737d2b3c41d59eb8f94ab7eb419b957938f24943</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=7aa2bcad0ca837dd6d4bf4fa38a80314b4a6b755</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/9bbdbc66e5765068dce76e9269dce4547afd8ad4</url>
</references>
<dates>
<discovery>2015-09-15</discovery>
<entry>2016-01-02</entry>
</dates>
</vuln>
<vuln vid="bbc97005-b14e-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerability in IDE disk/CD/DVD-ROM emulation</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.4.1</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20151224</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/10/1">
<p>Qemu emulator built with the IDE disk and CD/DVD-ROM emulation
support is vulnerable to a divide by zero issue. It could occur
while executing an IDE command WIN_READ_NATIVE_MAX to determine
the maximum size of a drive.</p>
<p>A privileged user inside guest could use this flaw to crash the
Qemu instance resulting in DoS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-6855</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/09/10/1</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=63d761388d6fea994ca498c6e7a210851a99ad93</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/d9033e1d3aa666c5071580617a57bd853c5d794a</url>
</references>
<dates>
<discovery>2015-09-09</discovery>
<entry>2016-01-02</entry>
</dates>
</vuln>
<vuln vid="10bf8eed-b14d-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerability in e1000 NIC support</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.4.0.1</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20151224</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/04/4">
<p>Qemu emulator built with the e1000 NIC emulation support is
vulnerable to an infinite loop issue. It could occur while
processing transmit descriptor data when sending a network packet.
</p>
<p>A privileged user inside guest could use this flaw to crash the
Qemu instance resulting in DoS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-6815</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/09/04/4</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=3a56af1fbc17ff453f6e90fb08ce0c0e6fd0b61b</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/b947ac2bf26479e710489739c465c8af336599e7</url>
</references>
<dates>
<discovery>2015-09-04</discovery>
<entry>2016-01-02</entry>
</dates>
</vuln>
<vuln vid="8a560bcf-b14b-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerability in VNC</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.1.0</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.2.50.g20141230</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/02/7">
<p>Qemu emulator built with the VNC display driver is vulnerable to an
infinite loop issue. It could occur while processing a
CLIENT_CUT_TEXT message with specially crafted payload message.</p>
<p>A privileged guest user could use this flaw to crash the Qemu
process on the host, resulting in DoS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5239</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/09/02/7</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=f9a70e79391f6d7c2a912d785239ee8effc1922d</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/f9a70e79391f6d7c2a912d785239ee8effc1922d</url>
</references>
<dates>
<discovery>2014-06-30</discovery>
<entry>2016-01-02</entry>
</dates>
</vuln>
<vuln vid="2b3b4c27-b0c7-11e5-8d13-bc5ff45d0f28">
<topic>qemu -- buffer overflow vulnerability in VNC</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.4.0.1</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.4.50.g20151011</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/08/21/6">
<p>Qemu emulator built with the VNC display driver support is
vulnerable to a buffer overflow flaw leading to a heap memory
corruption issue. It could occur while refreshing the server
display surface via routine vnc_refresh_server_surface().</p>
<p>A privileged guest user could use this flaw to corrupt the heap
memory and crash the Qemu process instance OR potentially use it
to execute arbitrary code on the host.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5225</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/08/21/6</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=efec4dcd2552e85ed57f276b58f09fc385727450</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/eb8934b0418b3b1d125edddc4fc334a54334a49b</url>
</references>
<dates>
<discovery>2015-08-17</discovery>
<entry>2016-01-01</entry>
</dates>
</vuln>
<vuln vid="21e5abe3-b0c6-11e5-8d13-bc5ff45d0f28">
<topic>qemu -- buffer overflow vulnerability in virtio-serial message exchanges</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.4.0</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.4.50.g20150814</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/08/06/3">
<p>Qemu emulator built with the virtio-serial vmchannel support is
vulnerable to a buffer overflow issue. It could occur while
exchanging virtio control messages between guest and the host.</p>
<p>A malicious guest could use this flaw to corrupt few bytes of Qemu
memory area, potentially crashing the Qemu process.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5745</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/08/06/5</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=7882080388be5088e72c425b02223c02e6cb4295</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/7882080388be5088e72c425b02223c02e6cb4295</url>
</references>
<dates>
<discovery>2015-08-06</discovery>
<entry>2016-01-01</entry>
</dates>
</vuln>
<vuln vid="a267cd6c-b0c4-11e5-8d13-bc5ff45d0f28">
<topic>qemu -- stack buffer overflow while parsing SCSI commands</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.4.0</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.4.50.g20150814</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://openwall.com/lists/oss-security/2015/07/23/6">
<p>Qemu emulator built with the SCSI device emulation support is
vulnerable to a stack buffer overflow issue. It could occur while
parsing SCSI command descriptor block with an invalid operation
code.</p>
<p>A privileged(CAP_SYS_RAWIO) user inside guest could use this flaw
to crash the Qemu instance resulting in DoS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5158</cvename>
<url>http://openwall.com/lists/oss-security/2015/07/23/6</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=c170aad8b057223b1139d72e5ce7acceafab4fa9</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/c170aad8b057223b1139d72e5ce7acceafab4fa9</url>
</references>
<dates>
<discovery>2015-07-23</discovery>
<entry>2016-01-01</entry>
</dates>
</vuln>
<vuln vid="aea8d90e-b0c1-11e5-8d13-bc5ff45d0f28">
<topic>qemu -- code execution on host machine</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.4.0</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.4.50.g20150814</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Petr Matousek of Red Hat Inc. reports:</p>
<blockquote cite="http://openwall.com/lists/oss-security/2015/06/17/5">
<p>Due converting PIO to the new memory read/write api we no longer
provide separate I/O region lenghts for read and write operations.
As a result, reading from PIT Mode/Command register will end with
accessing pit-&gt;channels with invalid index and potentially cause
memory corruption and/or minor information leak.</p>
<p>A privileged guest user in a guest with QEMU PIT emulation enabled
could potentially (tough unlikely) use this flaw to execute
arbitrary code on the host with the privileges of the hosting QEMU
process.</p>
<p>Please note that by default QEMU/KVM guests use in-kernel (KVM) PIT
emulation and are thus not vulnerable to this issue.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3214</cvename>
<url>http://openwall.com/lists/oss-security/2015/06/17/5</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=d4862a87e31a51de9eb260f25c9e99a75efe3235</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/d4862a87e31a51de9eb260f25c9e99a75efe3235</url>
</references>
<dates>
<discovery>2015-06-17</discovery>
<entry>2016-01-01</entry>
</dates>
</vuln>
<vuln vid="4b3a7e70-afce-11e5-b864-14dae9d210b8">
<topic>mono -- DoS and code execution</topic>
<affects>
<package>
<name>mono</name>
<range><lt>4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NCC Group reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q4/543">
<p>An attacker who can cause a carefully-chosen string to be
converted to a floating-point number can cause a crash and potentially
induce arbitrary code execution.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2015/q4/543</url>
<cvename>CVE-2009-0689</cvename>
</references>
<dates>
<discovery>2015-12-19</discovery>
<entry>2015-12-31</entry>
</dates>
</vuln>
<vuln vid="84c7ea88-bf04-4bdc-973b-36744bf540ab">
<topic>flash -- multiple vulnabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<name>linux-f10-flashplugin</name>
<name>linux-c6_64-flashplugin</name>
<range><lt>11.2r202.559</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb16-01.html">
<p>These updates resolve a type confusion vulnerability that
could lead to code execution (CVE-2015-8644).</p>
<p>These updates resolve an integer overflow vulnerability
that could lead to code execution (CVE-2015-8651).</p>
<p>These updates resolve use-after-free vulnerabilities that
could lead to code execution (CVE-2015-8634, CVE-2015-8635,
CVE-2015-8638, CVE-2015-8639, CVE-2015-8640, CVE-2015-8641,
CVE-2015-8642, CVE-2015-8643, CVE-2015-8646, CVE-2015-8647,
CVE-2015-8648, CVE-2015-8649, CVE-2015-8650).</p>
<p>These updates resolve memory corruption vulnerabilities
that could lead to code execution (CVE-2015-8459,
CVE-2015-8460, CVE-2015-8636, CVE-2015-8645).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8459</cvename>
<cvename>CVE-2015-8460</cvename>
<cvename>CVE-2015-8634</cvename>
<cvename>CVE-2015-8636</cvename>
<cvename>CVE-2015-8638</cvename>
<cvename>CVE-2015-8639</cvename>
<cvename>CVE-2015-8640</cvename>
<cvename>CVE-2015-8641</cvename>
<cvename>CVE-2015-8642</cvename>
<cvename>CVE-2015-8643</cvename>
<cvename>CVE-2015-8644</cvename>
<cvename>CVE-2015-8645</cvename>
<cvename>CVE-2015-8646</cvename>
<cvename>CVE-2015-8647</cvename>
<cvename>CVE-2015-8648</cvename>
<cvename>CVE-2015-8649</cvename>
<cvename>CVE-2015-8650</cvename>
<cvename>CVE-2015-8651</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb16-01.html</url>
</references>
<dates>
<discovery>2015-12-28</discovery>
<entry>2015-12-29</entry>
</dates>
</vuln>
<vuln vid="b808c3a8-ae30-11e5-b864-14dae9d210b8">
<topic>inspircd -- DoS</topic>
<affects>
<package>
<name>inspircd</name>
<range><lt>2.0.19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Inspircd reports:</p>
<blockquote cite="http://www.inspircd.org/2015/04/16/v2019-released.html">
<p>This release fixes the issues discovered since 2.0.18,
containing multiple important stability and correctness related
improvements, including a fix for a bug which allowed malformed DNS
records to cause netsplits on a network.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.inspircd.org/2015/04/16/v2019-released.html</url>
<url>https://github.com/inspircd/inspircd/commit/6058483d9fbc1b904d5ae7cfea47bfcde5c5b559</url>
<url>http://comments.gmane.org/gmane.comp.security.oss.general/18464</url>
<cvename>CVE-2015-8702</cvename>
</references>
<dates>
<discovery>2015-04-16</discovery>
<entry>2015-12-29</entry>
<modified>2015-12-29</modified>
</dates>
</vuln>
<vuln vid="4bae544d-06a3-4352-938c-b3bcbca89298">
<topic>ffmpeg -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libav</name>
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>gstreamer-ffmpeg</name>
<!-- gst-ffmpeg-0.10.13 has libav-0.7.2 (0.7.7 in freebsd port) -->
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>handbrake</name>
<!-- handbrake-0.10.2 has libav-10.1 -->
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>ffmpeg</name>
<range><ge>2.8,1</ge><lt>2.8.4,1</lt></range>
<range><lt>2.7.4,1</lt></range>
</package>
<package>
<name>ffmpeg26</name>
<range><lt>2.6.6</lt></range>
</package>
<package>
<name>ffmpeg25</name>
<range><lt>2.5.9</lt></range>
</package>
<package>
<name>ffmpeg24</name>
<range><lt>2.4.12</lt></range>
</package>
<package>
<name>ffmpeg-devel</name>
<name>ffmpeg23</name>
<name>ffmpeg2</name>
<name>ffmpeg1</name>
<name>ffmpeg-011</name>
<name>ffmpeg0</name>
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>avidemux</name>
<name>avidemux2</name>
<name>avidemux26</name>
<!-- avidemux-2.6.10 has ffmpeg-2.6.1 -->
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>kodi</name>
<!-- kodi-15.2 has ffmpeg-2.6.4 -->
<range><lt>16.0</lt></range>
</package>
<package>
<name>mplayer</name>
<name>mencoder</name>
<!-- mplayer-1.2.r20151219 has ffmpeg-2.8.3 -->
<range><lt>1.2.r20151219_1</lt></range>
</package>
<package>
<name>mythtv</name>
<name>mythtv-frontend</name>
<!-- mythtv-0.27.0.20140121 has ffmpeg-1.2.2+ (snapshot, f9c8726) -->
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>plexhometheater</name>
<!-- plexhometheater-1.4.1 has ffmpeg-0.10.2 fork -->
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8662">
<p>The ff_dwt_decode function in libavcodec/jpeg2000dwt.c in
FFmpeg before 2.8.4 does not validate the number of
decomposition levels before proceeding with Discrete Wavelet
Transform decoding, which allows remote attackers to cause a
denial of service (out-of-bounds array access) or possibly
have unspecified other impact via crafted JPEG 2000
data.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8663">
<p>The ff_get_buffer function in libavcodec/utils.c in
FFmpeg before 2.8.4 preserves width and height values after
a failure, which allows remote attackers to cause a denial
of service (out-of-bounds array access) or possibly have
unspecified other impact via a crafted .mov file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8662</cvename>
<cvename>CVE-2015-8663</cvename>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=75422280fbcdfbe9dc56bde5525b4d8b280f1bc5</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=abee0a1c60612e8638640a8a3738fffb65e16dbf</url>
<url>https://ffmpeg.org/security.html</url>
</references>
<dates>
<discovery>2015-12-20</discovery>
<entry>2015-12-28</entry>
</dates>
</vuln>
<vuln vid="10f7bc76-0335-4a88-b391-0b05b3a8ce1c">
<topic>NSS -- MD5 downgrade in TLS 1.2 signatures</topic>
<affects>
<package>
<name>nss</name>
<name>linux-c6-nss</name>
<range><ge>3.20</ge><lt>3.20.2</lt></range>
<range><lt>3.19.2.2</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>43.0.2,1</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>38.5.1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.40</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2015-150/">
<p>Security researcher Karthikeyan Bhargavan reported an
issue in Network Security Services (NSS) where MD5
signatures in the server signature within the TLS 1.2
ServerKeyExchange message are still accepted. This is an
issue since NSS has officially disallowed the accepting MD5
as a hash algorithm in signatures since 2011. This issues
exposes NSS based clients such as Firefox to theoretical
collision-based forgery attacks.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7575</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2015-150/</url>
<url>https://hg.mozilla.org/projects/nss/rev/94e1157f3fbb</url>
</references>
<dates>
<discovery>2015-12-22</discovery>
<entry>2015-12-28</entry>
</dates>
</vuln>
<vuln vid="88f75070-abcf-11e5-83d3-6805ca0b3d42">
<topic>phpMyAdmin -- path disclosure vulnerability</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>4.5.0</ge><lt>4.5.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2015-6/">
<p>By calling some scripts that are part of phpMyAdmin in an
unexpected way, it is possible to trigger phpMyAdmin to
display a PHP error message which contains the full path of
the directory where phpMyAdmin is installed.</p>
<p>We consider these vulnerabilities to be non-critical.</p>
<p>This path disclosure is possible on servers where the
recommended setting of the PHP configuration directive
display_errors is set to on, which is against the
recommendations given in the PHP manual for a production
server.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2015-6/</url>
<cvename>CVE-2015-8669</cvename>
</references>
<dates>
<discovery>2015-12-25</discovery>
<entry>2015-12-26</entry>
</dates>
</vuln>
<vuln vid="876768aa-ab1e-11e5-8a30-5453ed2e2b49">
<topic>dpkg -- stack-based buffer overflow</topic>
<affects>
<package>
<name>dpkg</name>
<range><lt>1.16.17</lt></range>
<range><lt>1.17.26</lt></range>
<range><lt>1.18.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Salvatore Bonaccorso reports:</p>
<blockquote cite="https://lists.debian.org/debian-security-announce/2015/msg00312.html">
<p>Hanno Boeck discovered a stack-based buffer overflow in the
dpkg-deb component of dpkg, the Debian package management system.
This flaw could potentially lead to arbitrary code execution if a
user or an automated system were tricked into processing a specially
crafted Debian binary package (.deb) in the old style Debian binary
package format.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0860</cvename>
<url>http://openwall.com/lists/oss-security/2015/11/26/3</url>
<url>https://anonscm.debian.org/cgit/dpkg/dpkg.git/commit/?id=f1aac7d933819569bf6f347c3c0d5a64a90bbce0</url>
</references>
<dates>
<discovery>2015-11-26</discovery>
<entry>2015-12-25</entry>
</dates>
</vuln>
<vuln vid="e1b5318c-aa4d-11e5-8f5c-002590263bf5">
<topic>mantis -- information disclosure vulnerability</topic>
<affects>
<package>
<name>mantis</name>
<range><lt>1.2.19_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mantis reports:</p>
<blockquote cite="https://mantisbt.org/bugs/view.php?id=19873">
<p>CVE-2015-5059: documentation in private projects can be seen by
every user</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5059</cvename>
<freebsdpr>ports/201106</freebsdpr>
<url>https://mantisbt.org/bugs/view.php?id=19873</url>
<url>http://openwall.com/lists/oss-security/2015/06/25/3</url>
</references>
<dates>
<discovery>2015-06-23</discovery>
<entry>2015-12-24</entry>
</dates>
</vuln>
<vuln vid="f36bbd66-aa44-11e5-8f5c-002590263bf5">
<topic>mediawiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mediawiki123</name>
<range><lt>1.23.12</lt></range>
</package>
<package>
<name>mediawiki124</name>
<range><lt>1.24.5</lt></range>
</package>
<package>
<name>mediawiki125</name>
<range><lt>1.25.4</lt></range>
</package>
<package>
<name>mediawiki126</name>
<range><lt>1.26.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MediaWiki reports:</p>
<blockquote cite="https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-December/000186.html">
<p>(T117899) SECURITY: $wgArticlePath can no longer be set to relative
paths that do not begin with a slash. This enabled trivial XSS
attacks. Configuration values such as "http://my.wiki.com/wiki/$1"
are fine, as are "/wiki/$1". A value such as "$1" or "wiki/$1" is
not and will now throw an error.</p>
<p>(T119309) SECURITY: Use hash_compare() for edit token comparison.
</p>
<p>(T118032) SECURITY: Don't allow cURL to interpret POST parameters
starting with '@' as file uploads.</p>
<p>(T115522) SECURITY: Passwords generated by User::randomPassword()
can no longer be shorter than $wgMinimalPasswordLength.</p>
<p>(T97897) SECURITY: Improve IP parsing and trimming. Previous
behavior could result in improper blocks being issued.</p>
<p>(T109724) SECURITY: Special:MyPage, Special:MyTalk,
Special:MyContributions and related pages no longer use HTTP
redirects and are now redirected by MediaWiki.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8622</cvename>
<cvename>CVE-2015-8623</cvename>
<cvename>CVE-2015-8624</cvename>
<cvename>CVE-2015-8625</cvename>
<cvename>CVE-2015-8626</cvename>
<cvename>CVE-2015-8627</cvename>
<cvename>CVE-2015-8628</cvename>
<url>https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-December/000186.html</url>
<url>https://phabricator.wikimedia.org/T117899</url>
<url>https://phabricator.wikimedia.org/T119309</url>
<url>https://phabricator.wikimedia.org/T118032</url>
<url>https://phabricator.wikimedia.org/T115522</url>
<url>https://phabricator.wikimedia.org/T97897</url>
<url>https://phabricator.wikimedia.org/T109724</url>
<url>http://www.openwall.com/lists/oss-security/2015/12/23/7</url>
</references>
<dates>
<discovery>2015-12-18</discovery>
<entry>2015-12-24</entry>
</dates>
</vuln>
<vuln vid="3b50881d-1860-4721-aab1-503290e23f6c">
<topic>Ruby -- unsafe tainted string vulnerability</topic>
<affects>
<package>
<name>ruby</name>
<range><ge>2.0.0,1</ge><lt>2.0.0.648,1</lt></range>
<range><ge>2.1.0,1</ge><lt>2.1.8,1</lt></range>
<range><ge>2.2.0,1</ge><lt>2.2.4,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby developer reports:</p>
<blockquote cite="https://www.ruby-lang.org/en/news/2015/12/16/unsafe-tainted-string-usage-in-fiddle-and-dl-cve-2015-7551/">
<p>There is an unsafe tainted string vulnerability in Fiddle and DL.
This issue was originally reported and fixed with CVE-2009-5147 in
DL, but reappeared after DL was reimplemented using Fiddle and
libffi.</p>
<p>And, about DL, CVE-2009-5147 was fixed at Ruby 1.9.1, but not
fixed at other branches, then rubies which bundled DL except Ruby
1.9.1 are still vulnerable.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.ruby-lang.org/en/news/2015/12/16/unsafe-tainted-string-usage-in-fiddle-and-dl-cve-2015-7551/</url>
<cvename>CVE-2015-7551</cvename>
</references>
<dates>
<discovery>2015-12-16</discovery>
<entry>2015-12-23</entry>
</dates>
</vuln>
<vuln vid="54075861-a95a-11e5-8b40-20cf30e32f6d">
<topic>Bugzilla security issues</topic>
<affects>
<package>
<name>bugzilla44</name>
<range><lt>4.4.11</lt></range>
</package>
<package>
<name>bugzilla50</name>
<range><lt>5.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Bugzilla Security Advisory</p>
<blockquote cite="https://www.bugzilla.org/security/4.2.15/">
<p>During the generation of a dependency graph, the code for
the HTML image map is generated locally if a local dot
installation is used. With escaped HTML characters in a bug
summary, it is possible to inject unfiltered HTML code in
the map file which the CreateImagemap function generates.
This could be used for a cross-site scripting attack.</p>
<p>If an external HTML page contains a &lt;script&gt; element with
its src attribute pointing to a buglist in CSV format, some
web browsers incorrectly try to parse the CSV file as valid
JavaScript code. As the buglist is generated based on the
privileges of the user logged into Bugzilla, the external
page could collect confidential data contained in the CSV
file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8508</cvename>
<cvename>CVE-2015-8509</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=1221518</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=1232785</url>
</references>
<dates>
<discovery>2015-12-22</discovery>
<entry>2015-12-23</entry>
</dates>
</vuln>
<vuln vid="d6c51737-a84b-11e5-8f5c-002590263bf5">
<topic>librsvg2 -- denial of service vulnerability</topic>
<affects>
<package>
<name>librsvg2</name>
<range><lt>2.40.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adam Maris, Red Hat Product Security, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/21/5">
<p>CVE-2015-7558: Stack exhaustion due to cyclic dependency causing to
crash an application was found in librsvg2 while parsing SVG file.
It has been fixed in 2.40.12 by many commits that has rewritten the
checks for cyclic references.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7558</cvename>
<freebsdpr>ports/205502</freebsdpr>
<url>http://www.openwall.com/lists/oss-security/2015/12/21/5</url>
<url>https://bugzilla.redhat.com/1268243</url>
</references>
<dates>
<discovery>2015-10-02</discovery>
<entry>2015-12-22</entry>
</dates>
</vuln>
<vuln vid="da634091-a84a-11e5-8f5c-002590263bf5">
<topic>librsvg2 -- denial of service vulnerability</topic>
<affects>
<package>
<name>librsvg2</name>
<range><lt>2.40.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adam Maris, Red Hat Product Security, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/21/5">
<p>CVE-2015-7557: Out-of-bounds heap read in librsvg2 was found when
parsing SVG file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7557</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/12/21/5</url>
<url>https://git.gnome.org/browse/librsvg/commit/rsvg-shapes.c?id=40af93e6eb1c94b90c3b9a0b87e0840e126bb8df</url>
</references>
<dates>
<discovery>2015-02-06</discovery>
<entry>2015-12-22</entry>
</dates>
</vuln>
<vuln vid="9e7306b9-a5c3-11e5-b864-14dae9d210b8">
<topic>quassel -- remote denial of service</topic>
<affects>
<package>
<name>quassel</name>
<range><lt>0.12.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Pierre Schweitzer reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/12/1">
<p>Any client sending the command "/op *" in a query will
cause the Quassel core to crash.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2015/12/12/1</url>
<cvename>CVE-2015-8547</cvename>
</references>
<dates>
<discovery>2015-11-22</discovery>
<entry>2015-12-18</entry>
</dates>
</vuln>
<vuln vid="f714b4c9-a6c1-11e5-88d7-047d7b492d07">
<topic>libvirt -- ACL bypass using ../ to access beyond storage pool</topic>
<affects>
<package>
<name>libvirt</name>
<range><ge>1.1.0</ge><lt>1.2.19_2</lt></range>
<range><ge>1.2.20</ge><lt>1.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Libvit development team reports:</p>
<blockquote cite="http://security.libvirt.org/2015/0004.html">
<p>Various virStorageVol* API operate on user-supplied volume names by
concatenating the volume name to the pool location. Note that the
virStoragePoolListVolumes API, when used on a storage pool backed by
a directory in a file system, will only list volumes immediately in
that directory (there is no traversal into subdirectories). However,
other APIs such as virStorageVolCreateXML were not checking if a
potential volume name represented one of the volumes that could be
returned by virStoragePoolListVolumes; because they were not rejecting
the use of '/' in a volume name.</p>
<p>Because no checking was done on volume names, a user could supply
a potential volume name of something like '../../../etc/passwd' to
attempt to access a file not belonging to the storage pool. When
fine-grained Access Control Lists (ACL) are in effect, a user with
storage_vol:create ACL permission but lacking domain:write permssion
could thus abuse virStorageVolCreateXML and similar APIs to gain
access to files not normally permitted to that user. Fortunately, it
appears that the only APIs that could leak information or corrupt
files require read-write connection to libvirtd; and when ACLs are not
in use (the default without any further configuration), a user with
read-write access can already be considered to have full access to the
machine, and without an escalation of privilege there is no security
problem.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5313</cvename>
<url>http://security.libvirt.org/2015/0004.html</url>
</references>
<dates>
<discovery>2015-10-30</discovery>
<entry>2015-12-20</entry>
</dates>
</vuln>
<vuln vid="ef434839-a6a4-11e5-8275-000c292e4fd8">
<topic>samba -- multiple vulnerabilities</topic>
<affects>
<package>
<name>samba36</name>
<range><ge>3.6.0</ge><lt>3.6.25_2</lt></range>
</package>
<package>
<name>samba4</name>
<range><ge>4.0.0</ge><le>4.0.26</le></range>
</package>
<package>
<name>samba41</name>
<range><ge>4.1.0</ge><lt>4.1.22</lt></range>
</package>
<package>
<name>samba42</name>
<range><ge>4.2.0</ge><lt>4.2.7</lt></range>
</package>
<package>
<name>samba43</name>
<range><ge>4.3.0</ge><lt>4.3.3</lt></range>
</package>
<package>
<name>ldb</name>
<range><ge>1.0.0</ge><lt>1.1.24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Samba team reports:</p>
<blockquote cite="https://www.samba.org/samba/latest_news.html#4.3.3">
<p>[CVE-2015-3223] Malicious request can cause Samba LDAP server to hang, spinning using CPU.</p>
<p>[CVE-2015-5330] Malicious request can cause Samba LDAP server
to return uninitialized memory that should not be part of the reply.</p>
<p>[CVE-2015-5296] Requesting encryption should also request
signing when setting up the connection to protect against man-in-the-middle attacks.</p>
<p>[CVE-2015-5299] A missing access control check in the VFS
shadow_copy2 module could allow unauthorized users to access snapshots.</p>
<p>[CVE-2015-7540] Malicious request can cause Samba LDAP server to return crash.</p>
<p>[CVE-2015-8467] Samba can expose Windows DCs to MS15-096
Denial of service via the creation of multiple machine accounts(The Microsoft issue is CVE-2015-2535).</p>
<p>[CVE-2015-5252] Insufficient symlink verification could allow data access outside share path.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3223</cvename>
<url>https://www.samba.org/samba/security/CVE-2015-3223.html</url>
<cvename>CVE-2015-5252</cvename>
<url>https://www.samba.org/samba/security/CVE-2015-5252.html</url>
<cvename>CVE-2015-5296</cvename>
<url>https://www.samba.org/samba/security/CVE-2015-5296.html</url>
<cvename>CVE-2015-5299</cvename>
<url>https://www.samba.org/samba/security/CVE-2015-5299.html</url>
<cvename>CVE-2015-5330</cvename>
<url>https://www.samba.org/samba/security/CVE-2015-5330.html</url>
<cvename>CVE-2015-7540</cvename>
<url>https://www.samba.org/samba/security/CVE-2015-7540.html</url>
<cvename>CVE-2015-8467</cvename>
<url>https://www.samba.org/samba/security/CVE-2015-8467.html</url>
</references>
<dates>
<discovery>2015-12-16</discovery>
<entry>2015-12-19</entry>
<modified>2016-02-05</modified>
</dates>
</vuln>
<vuln vid="bb7d4791-a5bf-11e5-a0e5-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>47.0.2526.106</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2015/12/stable-channel-update_15.html">
<p>2 security fixes in this release, including:</p>
<ul>
<li>[569486] CVE-2015-6792: Fixes from internal audits and
fuzzing.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-6792</cvename>
<url>http://googlechromereleases.blogspot.nl/2015/12/stable-channel-update_15.html</url>
</references>
<dates>
<discovery>2015-12-16</discovery>
<entry>2015-12-18</entry>
</dates>
</vuln>
<vuln vid="7329938b-a4e6-11e5-b864-14dae9d210b8">
<topic>cups-filters -- code execution</topic>
<affects>
<package>
<name>cups-filters</name>
<range><lt>1.4.0</lt></range>
</package>
<package>
<name>foomatic-filters</name>
<range><lt>4.0.17_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Till Kamppeter reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/14/13">
<p>Cups Filters/Foomatic Filters does not consider semicolon
as an illegal escape character.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2015/12/14/13</url>
<cvename>CVE-2015-8560</cvename>
</references>
<dates>
<discovery>2015-12-12</discovery>
<entry>2015-12-17</entry>
</dates>
</vuln>
<vuln vid="6dbae1a8-a4e6-11e5-b864-14dae9d210b8">
<topic>cups-filters -- code execution</topic>
<affects>
<package>
<name>cups-filters</name>
<range><lt>1.2.0</lt></range>
</package>
<package>
<name>foomatic-filters</name>
<range><lt>4.0.17_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Salvatore Bonaccorso reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/13/2">
<p>Cups Filters/Foomatic Filters does not consider backtick
as an illegal escape character.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2015/12/13/2</url>
<cvename>CVE-2015-8327</cvename>
</references>
<dates>
<discovery>2015-10-30</discovery>
<entry>2015-12-17</entry>
</dates>
</vuln>
<vuln vid="1fbd6db1-a4e4-11e5-b864-14dae9d210b8">
<topic>py-amf -- input sanitization errors</topic>
<affects>
<package>
<name>py27-amf</name>
<name>py32-amf</name>
<name>py33-amf</name>
<name>py34-amf</name>
<range><lt>0.8.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>oCERT reports:</p>
<blockquote cite="http://www.ocert.org/advisories/ocert-2015-011.html">
<p>A specially crafted AMF payload, containing malicious
references to XML external entities, can be used to trigger Denial of
Service (DoS) conditions or arbitrarily return the contents of files
that are accessible with the running application privileges.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.ocert.org/advisories/ocert-2015-011.html</url>
<cvename>CVE-2015-8549</cvename>
</references>
<dates>
<discovery>2015-12-01</discovery>
<entry>2015-12-17</entry>
</dates>
</vuln>
<vuln vid="a9f60ce8-a4e0-11e5-b864-14dae9d210b8">
<topic>joomla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>joomla3</name>
<range><lt>3.4.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Joomla! reports:</p>
<blockquote cite="https://www.joomla.org/announcements/release-news/5641-joomla-3-4-6-released.html">
<p>Joomla! 3.4.6 is now available. This is a security release
for the 3.x series of Joomla which addresses a critical security
vulnerability and 4 low level security vulnerabilities. We strongly
recommend that you update your sites immediately.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.joomla.org/announcements/release-news/5641-joomla-3-4-6-released.html</url>
<cvename>CVE-2015-8562</cvename>
<cvename>CVE-2015-8563</cvename>
<cvename>CVE-2015-8564</cvename>
<cvename>CVE-2015-8565</cvename>
</references>
<dates>
<discovery>2015-12-14</discovery>
<entry>2015-12-17</entry>
</dates>
</vuln>
<vuln vid="a8ec4db7-a398-11e5-85e9-14dae9d210b8">
<topic>bind -- multiple vulnerabilities</topic>
<affects>
<package>
<name>bind99</name>
<range><lt>9.9.8P2</lt></range>
</package>
<package>
<name>bind910</name>
<range><lt>9.10.3P2</lt></range>
</package>
<package>
<name>bind9-devel</name>
<range><lt>9.11.0.a20151215</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01328/0/BIND-9.10.3-P2-Release-Notes.html">
<p>Named is potentially vulnerable to the OpenSSL vulnerabilty described in CVE-2015-3193.</p>
<p>Incorrect reference counting could result in an INSIST
failure if a socket error occurred while performing a lookup. This flaw
is disclosed in CVE-2015-8461. [RT#40945]</p>
<p>Insufficient testing when parsing a message allowed records
with an incorrect class to be be accepted, triggering a REQUIRE failure
when those records were subsequently cached. This flaw is disclosed in
CVE-2015-8000. [RT #40987]</p>
</blockquote>
</body>
</description>
<references>
<url>https://kb.isc.org/article/AA-01328/0/BIND-9.10.3-P2-Release-Notes.html</url>
<url>https://kb.isc.org/article/AA-01317/0/CVE-2015-8000%3A-Responses-with-a-malformed-class-attribute-can-trigger-an-assertion-failure-in-db.c.html</url>
<url>https://kb.isc.org/article/AA-01319/0/CVE-2015-8461%3A-A-race-condition-when-handling-socket-errors-can-lead-to-an-assertion-failure-in-resolver.c.html</url>
<cvename>CVE-2015-3193</cvename>
<cvename>CVE-2015-8000</cvename>
<cvename>CVE-2015-8461</cvename>
</references>
<dates>
<discovery>2015-11-24</discovery>
<entry>2015-12-16</entry>
</dates>
</vuln>
<vuln vid="2c2d1c39-1396-459a-91f5-ca03ee7c64c6">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>43.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>43.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.40</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.40</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>38.5.0,1</lt></range>
</package>
<package>
<name>libxul</name>
<range><lt>38.5.0</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>38.5.0</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>38.5.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/">
<p>MFSA 2015-134 Miscellaneous memory safety hazards
(rv:43.0 / rv:38.5)</p>
<p>MFSA 2015-135 Crash with JavaScript variable assignment
with unboxed objects</p>
<p>MFSA 2015-136 Same-origin policy violation using
perfomance.getEntries and history navigation</p>
<p>MFSA 2015-137 Firefox allows for control characters to be
set in cookies</p>
<p>MFSA 2015-138 Use-after-free in WebRTC when datachannel
is used after being destroyed</p>
<p>MFSA 2015-139 Integer overflow allocating extremely large
textures</p>
<p>MFSA 2015-140 Cross-origin information leak through web
workers error events</p>
<p>MFSA 2015-141 Hash in data URI is incorrectly parsed</p>
<p>MFSA 2015-142 DOS due to malformed frames in HTTP/2</p>
<p>MFSA 2015-143 Linux file chooser crashes on malformed
images due to flaws in Jasper library</p>
<p>MFSA 2015-144 Buffer overflows found through code
inspection</p>
<p>MFSA 2015-145 Underflow through code inspection</p>
<p>MFSA 2015-146 Integer overflow in MP4 playback in 64-bit
versions</p>
<p>MFSA 2015-147 Integer underflow and buffer overflow
processing MP4 metadata in libstagefright</p>
<p>MFSA 2015-148 Privilege escalation vulnerabilities in
WebExtension APIs</p>
<p>MFSA 2015-149 Cross-site reading attack through data and
view-source URIs</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7201</cvename>
<cvename>CVE-2015-7202</cvename>
<cvename>CVE-2015-7203</cvename>
<cvename>CVE-2015-7204</cvename>
<cvename>CVE-2015-7205</cvename>
<cvename>CVE-2015-7207</cvename>
<cvename>CVE-2015-7208</cvename>
<cvename>CVE-2015-7210</cvename>
<cvename>CVE-2015-7211</cvename>
<cvename>CVE-2015-7212</cvename>
<cvename>CVE-2015-7213</cvename>
<cvename>CVE-2015-7214</cvename>
<cvename>CVE-2015-7215</cvename>
<cvename>CVE-2015-7216</cvename>
<cvename>CVE-2015-7217</cvename>
<cvename>CVE-2015-7218</cvename>
<cvename>CVE-2015-7219</cvename>
<cvename>CVE-2015-7220</cvename>
<cvename>CVE-2015-7221</cvename>
<cvename>CVE-2015-7222</cvename>
<cvename>CVE-2015-7223</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2015-134/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-135/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-136/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-137/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-138/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-139/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-140/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-141/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-142/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-143/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-144/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-145/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-146/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-147/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-148/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-149/</url>
</references>
<dates>
<discovery>2015-12-15</discovery>
<entry>2015-12-15</entry>
</dates>
</vuln>
<vuln vid="a5934ba8-a376-11e5-85e9-14dae9d210b8">
<topic>java -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openjdk8</name>
<name>openjdk8-jre</name>
<range><lt>8.66.17</lt></range>
</package>
<package>
<name>openjdk7</name>
<name>openjdk7-jre</name>
<range><lt>7.91.02,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html#AppendixJAVA">
<p>This Critical Patch Update contains 25 new security fixes
for Oracle Java SE. 24 of these vulnerabilities may be remotely
exploitable without authentication, i.e., may be exploited over a
network without the need for a username and password.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html#AppendixJAVA</url>
<cvename>CVE-2015-4835</cvename>
<cvename>CVE-2015-4881</cvename>
<cvename>CVE-2015-4843</cvename>
<cvename>CVE-2015-4883</cvename>
<cvename>CVE-2015-4860</cvename>
<cvename>CVE-2015-4805</cvename>
<cvename>CVE-2015-4844</cvename>
<cvename>CVE-2015-4901</cvename>
<cvename>CVE-2015-4868</cvename>
<cvename>CVE-2015-4810</cvename>
<cvename>CVE-2015-4806</cvename>
<cvename>CVE-2015-4871</cvename>
<cvename>CVE-2015-4902</cvename>
<cvename>CVE-2015-4840</cvename>
<cvename>CVE-2015-4882</cvename>
<cvename>CVE-2015-4842</cvename>
<cvename>CVE-2015-4734</cvename>
<cvename>CVE-2015-4903</cvename>
<cvename>CVE-2015-4803</cvename>
<cvename>CVE-2015-4893</cvename>
<cvename>CVE-2015-4911</cvename>
<cvename>CVE-2015-4872</cvename>
<cvename>CVE-2015-4906</cvename>
<cvename>CVE-2015-4916</cvename>
<cvename>CVE-2015-4908</cvename>
</references>
<dates>
<discovery>2015-10-20</discovery>
<entry>2015-12-15</entry>
<modified>2016-01-08</modified>
</dates>
</vuln>
<vuln vid="daadef86-a366-11e5-8b40-20cf30e32f6d">
<topic>subversion -- multiple vulnerabilities</topic>
<affects>
<package>
<name>subversion17</name>
<range><ge>1.7.0</ge><lt>1.7.22_1</lt></range>
</package>
<package>
<name>subversion18</name>
<range><ge>1.8.0</ge><lt>1.8.15</lt></range>
</package>
<package>
<name>subversion</name>
<range><ge>1.9.0</ge><lt>1.9.3</lt></range>
</package>
<package>
<name>mod_dav_svn</name>
<range><ge>1.7.0</ge><lt>1.7.22_1</lt></range>
<range><ge>1.8.0</ge><lt>1.8.15</lt></range>
<range><ge>1.9.0</ge><lt>1.9.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Subversion Project reports:</p>
<blockquote cite="http://subversion.apache.org/security/">
<p>Remotely triggerable heap overflow and out-of-bounds read caused
by integer overflow in the svn:// protocol parser.</p>
<p>Remotely triggerable heap overflow and out-of-bounds read in
mod_dav_svn caused by integer overflow when parsing skel-encoded
request bodies.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5343</cvename>
<url>http://subversion.apache.org/security/CVE-2015-5343-advisory.txt</url>
<cvename>CVE-2015-5259</cvename>
<url>http://subversion.apache.org/security/CVE-2015-5259-advisory.txt</url>
</references>
<dates>
<discovery>2015-11-14</discovery>
<entry>2015-12-15</entry>
</dates>
</vuln>
<vuln vid="72c145df-a1e0-11e5-8ad0-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<!--pcbsd-->
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>47.0.2526.80</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2015/12/stable-channel-update_8.html">
<p>7 security fixes in this release, including:</p>
<ul>
<li>[548273] High CVE-2015-6788: Type confusion in extensions.
Credit to anonymous.</li>
<li>[557981] High CVE-2015-6789: Use-after-free in Blink. Credit to
cloudfuzzer.</li>
<li>[542054] Medium CVE-2015-6790: Escaping issue in saved pages.
Credit to Inti De Ceukelaire.</li>
<li>[567513] CVE-2015-6791: Various fixes from internal audits,
fuzzing and other initiatives.</li>
<li>Multiple vulnerabilities in V8 fixed at the tip of the 4.7
branch (currently 4.7.80.23).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-6788</cvename>
<cvename>CVE-2015-6789</cvename>
<cvename>CVE-2015-6790</cvename>
<cvename>CVE-2015-6791</cvename>
<url>http://googlechromereleases.blogspot.nl/2015/12/stable-channel-update_8.html</url>
</references>
<dates>
<discovery>2015-12-08</discovery>
<entry>2015-12-13</entry>
</dates>
</vuln>
<vuln vid="33459061-a1d6-11e5-8794-bcaec565249c">
<topic>freeimage -- multiple integer overflows</topic>
<affects>
<package>
<name>freeimage</name>
<range><lt>3.16.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Pcheng pcheng reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/08/28/1">
<p>An integer overflow issue in the FreeImage project was
reported and fixed recently.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0852</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/08/28/1</url>
</references>
<dates>
<discovery>2015-08-28</discovery>
<entry>2015-12-13</entry>
</dates>
</vuln>
<vuln vid="21bc4d71-9ed8-11e5-8f5c-002590263bf5">
<topic>redmine -- information leak vulnerability</topic>
<affects>
<package>
<name>redmine</name>
<range><lt>2.6.9</lt></range>
<range><ge>3.0.0</ge><lt>3.0.7</lt></range>
<range><ge>3.1.0</ge><lt>3.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Redmine reports:</p>
<blockquote cite="http://www.redmine.org/projects/redmine/wiki/Security_Advisories">
<p>Data disclosure in atom feed.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8537</cvename>
<url>http://www.redmine.org/projects/redmine/wiki/Security_Advisories</url>
</references>
<dates>
<discovery>2015-12-05</discovery>
<entry>2015-12-10</entry>
<modified>2015-12-11</modified>
</dates>
</vuln>
<vuln vid="be63533c-9ed7-11e5-8f5c-002590263bf5">
<topic>redmine -- multiple vulnerabilities</topic>
<affects>
<package>
<name>redmine</name>
<range><lt>2.6.8</lt></range>
<range><ge>3.0.0</ge><lt>3.0.6</lt></range>
<range><ge>3.1.0</ge><lt>3.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Redmine reports:</p>
<blockquote cite="http://www.redmine.org/projects/redmine/wiki/Security_Advisories">
<p>Potential changeset message disclosure in issues API.</p>
<p>Data disclosure on the time logging form</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8346</cvename>
<cvename>CVE-2015-8473</cvename>
<url>http://www.redmine.org/projects/redmine/wiki/Security_Advisories</url>
<url>http://www.openwall.com/lists/oss-security/2015/11/25/12</url>
<url>http://www.openwall.com/lists/oss-security/2015/12/03/7</url>
</references>
<dates>
<discovery>2015-11-14</discovery>
<entry>2015-12-10</entry>
</dates>
</vuln>
<vuln vid="3ec2e0bc-9ed7-11e5-8f5c-002590263bf5">
<topic>redmine -- open redirect vulnerability</topic>
<affects>
<package>
<name>redmine</name>
<range><ge>2.5.1</ge><lt>2.6.7</lt></range>
<range><ge>3.0.0</ge><lt>3.0.5</lt></range>
<range><eq>3.1.0</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Redmine reports:</p>
<blockquote cite="http://www.redmine.org/projects/redmine/wiki/Security_Advisories">
<p>Open Redirect vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8474</cvename>
<url>http://www.redmine.org/projects/redmine/wiki/Security_Advisories</url>
<url>http://www.openwall.com/lists/oss-security/2015/12/04/1</url>
</references>
<dates>
<discovery>2015-09-20</discovery>
<entry>2015-12-10</entry>
</dates>
</vuln>
<vuln vid="939a7086-9ed6-11e5-8f5c-002590263bf5">
<topic>redmine -- potential XSS vulnerability</topic>
<affects>
<package>
<name>redmine</name>
<range><lt>2.6.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Redmine reports:</p>
<blockquote cite="http://www.redmine.org/projects/redmine/wiki/Security_Advisories">
<p>Potential XSS vulnerability when rendering some flash messages.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8477</cvename>
<url>http://www.redmine.org/projects/redmine/wiki/Security_Advisories</url>
<url>http://www.openwall.com/lists/oss-security/2015/12/05/6</url>
</references>
<dates>
<discovery>2015-02-19</discovery>
<entry>2015-12-10</entry>
</dates>
</vuln>
<vuln vid="49def4b7-9ed6-11e5-8f5c-002590263bf5">
<topic>redmine -- information leak vulnerability</topic>
<affects>
<package>
<name>redmine</name>
<range><lt>2.4.6</lt></range>
<range><ge>2.5.0</ge><lt>2.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Redmine reports:</p>
<blockquote cite="http://www.redmine.org/projects/redmine/wiki/Security_Advisories">
<p>Potential data leak (project names) in the invalid form
authenticity token error screen.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.redmine.org/projects/redmine/wiki/Security_Advisories</url>
</references>
<dates>
<discovery>2014-07-06</discovery>
<entry>2015-12-10</entry>
</dates>
</vuln>
<vuln vid="c2efcd46-9ed5-11e5-8f5c-002590263bf5">
<topic>redmine -- open redirect vulnerability</topic>
<affects>
<package>
<name>redmine</name>
<range><lt>2.4.5</lt></range>
<range><eq>2.5.0</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Redmine reports:</p>
<blockquote cite="http://www.redmine.org/projects/redmine/wiki/Security_Advisories">
<p>Open Redirect vulnerability</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-1985</cvename>
<url>http://www.redmine.org/projects/redmine/wiki/Security_Advisories</url>
<url>https://jvn.jp/en/jp/JVN93004610/index.html</url>
</references>
<dates>
<discovery>2014-03-29</discovery>
<entry>2015-12-10</entry>
</dates>
</vuln>
<vuln vid="66ba5931-9ed5-11e5-8f5c-002590263bf5">
<topic>redmine -- XSS vulnerability</topic>
<affects>
<package>
<name>redmine</name>
<range><ge>2.1.0</ge><lt>2.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Redmine reports:</p>
<blockquote cite="http://www.redmine.org/projects/redmine/wiki/Security_Advisories">
<p>XSS vulnerability</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.redmine.org/projects/redmine/wiki/Security_Advisories</url>
</references>
<dates>
<discovery>2012-09-30</discovery>
<entry>2015-12-10</entry>
</dates>
</vuln>
<vuln vid="0e0385d1-9ed5-11e5-8f5c-002590263bf5">
<topic>redmine -- multiple vulnerabilities</topic>
<affects>
<package>
<name>redmine</name>
<range><lt>1.3.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Redmine reports:</p>
<blockquote cite="http://www.redmine.org/projects/redmine/wiki/Security_Advisories">
<p>Mass-assignemnt vulnerability that would allow an attacker to
bypass part of the security checks.</p>
<p>Persistent XSS vulnerability</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0327</cvename>
<url>http://www.redmine.org/projects/redmine/wiki/Security_Advisories</url>
<url>http://jvn.jp/en/jp/JVN93406632/</url>
</references>
<dates>
<discovery>2012-03-11</discovery>
<entry>2015-12-10</entry>
</dates>
</vuln>
<vuln vid="ae377aeb-9ed4-11e5-8f5c-002590263bf5">
<topic>redmine -- CSRF protection bypass</topic>
<affects>
<package>
<name>redmine</name>
<range><lt>1.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Redmine reports:</p>
<blockquote cite="http://www.redmine.org/projects/redmine/wiki/Security_Advisories">
<p>Vulnerability that would allow an attacker to bypass the CSRF
protection.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.redmine.org/projects/redmine/wiki/Security_Advisories</url>
</references>
<dates>
<discovery>2011-12-10</discovery>
<entry>2015-12-10</entry>
</dates>
</vuln>
<vuln vid="23af0425-9eac-11e5-b937-00e0814cab4e">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><le>1.641</le></range>
</package>
<package>
<name>jenkins-lts</name>
<range><le>1.625.3</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-12-09">
<h1>Description</h1>
<h5>SECURITY-95 / CVE-2015-7536 (Stored XSS vulnerability through workspace files and archived artifacts)</h5>
<p>In certain configurations, low privilege users were able to
create e.g. HTML files in workspaces and archived artifacts that
could result in XSS when accessed by other users. Jenkins now sends
Content-Security-Policy headers that enables sandboxing and
prohibits script execution by default.</p>
<h5>SECURITY-225 / CVE-2015-7537 (CSRF vulnerability in some administrative actions)</h5>
<p>Several administration/configuration related URLs could be
accessed using GET, which allowed attackers to circumvent CSRF
protection.</p>
<h5>SECURITY-233 / CVE-2015-7538 (CSRF protection ineffective)</h5>
<p>Malicious users were able to circumvent CSRF protection on any
URL by sending specially crafted POST requests.</p>
<h5>SECURITY-234 / CVE-2015-7539 (Jenkins plugin manager vulnerable to MITM attacks)</h5>
<p>While the Jenkins update site data is digitally signed, and the
signature verified by Jenkins, Jenkins did not verify the provided
SHA-1 checksums for the plugin files referenced in the update site
data. This enabled MITM attacks on the plugin manager, resulting
in installation of attacker-provided plugins.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-12-09</url>
</references>
<dates>
<discovery>2015-12-09</discovery>
<entry>2015-12-09</entry>
</dates>
</vuln>
<vuln vid="c8842a84-9ddd-11e5-8c2f-c485083ca99c">
<topic>flash -- multiple vulnabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<name>linux-f10-flashplugin</name>
<name>linux-c6_64-flashplugin</name>
<range><lt>11.2r202.554</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-32.html">
<p>
These updates resolve heap buffer overflow vulnerabilities that
could lead to code execution (CVE-2015-8438, CVE-2015-8446).</p>
<p>
These updates resolve memory corruption vulnerabilities that
could lead to code execution (CVE-2015-8444, CVE-2015-8443,
CVE-2015-8417, CVE-2015-8416, CVE-2015-8451, CVE-2015-8047,
CVE-2015-8053, CVE-2015-8045, CVE-2015-8051, CVE-2015-8060,
CVE-2015-8419, CVE-2015-8408).</p>
<p>
These updates resolve security bypass vulnerabilities
(CVE-2015-8453, CVE-2015-8440, CVE-2015-8409).</p>
<p>
These updates resolve a stack overflow vulnerability that
could lead to code execution (CVE-2015-8407).</p>
<p>
These updates resolve a type confusion vulnerability that
could lead to code execution (CVE-2015-8439).</p>
<p>
These updates resolve an integer overflow vulnerability
that could lead to code execution (CVE-2015-8445).</p>
<p>
These updates resolve a buffer overflow vulnerability that
could lead to code execution (CVE-2015-8415).</p>
<p>
These updates resolve use-after-free vulnerabilities that
could lead to code execution (CVE-2015-8050, CVE-2015-8049,
CVE-2015-8437, CVE-2015-8450, CVE-2015-8449, CVE-2015-8448,
CVE-2015-8436, CVE-2015-8452, CVE-2015-8048, CVE-2015-8413,
CVE-2015-8412, CVE-2015-8410, CVE-2015-8411, CVE-2015-8424,
CVE-2015-8422, CVE-2015-8420, CVE-2015-8421, CVE-2015-8423,
CVE-2015-8425, CVE-2015-8433, CVE-2015-8432, CVE-2015-8431,
CVE-2015-8426, CVE-2015-8430, CVE-2015-8427, CVE-2015-8428,
CVE-2015-8429, CVE-2015-8434, CVE-2015-8435, CVE-2015-8414,
CVE-2015-8052, CVE-2015-8059, CVE-2015-8058, CVE-2015-8055,
CVE-2015-8057, CVE-2015-8056, CVE-2015-8061, CVE-2015-8067,
CVE-2015-8066, CVE-2015-8062, CVE-2015-8068, CVE-2015-8064,
CVE-2015-8065, CVE-2015-8063, CVE-2015-8405, CVE-2015-8404,
CVE-2015-8402, CVE-2015-8403, CVE-2015-8071, CVE-2015-8401,
CVE-2015-8406, CVE-2015-8069, CVE-2015-8070, CVE-2015-8441,
CVE-2015-8442, CVE-2015-8447).</p>
</blockquote>
</body>
</description>
<references>
<url>https://helpx.adobe.com/security/products/flash-player/apsb15-32.html</url>
<cvename>CVE-2015-8045</cvename>
<cvename>CVE-2015-8047</cvename>
<cvename>CVE-2015-8048</cvename>
<cvename>CVE-2015-8049</cvename>
<cvename>CVE-2015-8050</cvename>
<cvename>CVE-2015-8051</cvename>
<cvename>CVE-2015-8052</cvename>
<cvename>CVE-2015-8053</cvename>
<cvename>CVE-2015-8054</cvename>
<cvename>CVE-2015-8055</cvename>
<cvename>CVE-2015-8056</cvename>
<cvename>CVE-2015-8057</cvename>
<cvename>CVE-2015-8058</cvename>
<cvename>CVE-2015-8059</cvename>
<cvename>CVE-2015-8060</cvename>
<cvename>CVE-2015-8061</cvename>
<cvename>CVE-2015-8062</cvename>
<cvename>CVE-2015-8063</cvename>
<cvename>CVE-2015-8064</cvename>
<cvename>CVE-2015-8065</cvename>
<cvename>CVE-2015-8066</cvename>
<cvename>CVE-2015-8067</cvename>
<cvename>CVE-2015-8068</cvename>
<cvename>CVE-2015-8069</cvename>
<cvename>CVE-2015-8070</cvename>
<cvename>CVE-2015-8071</cvename>
<cvename>CVE-2015-8401</cvename>
<cvename>CVE-2015-8402</cvename>
<cvename>CVE-2015-8403</cvename>
<cvename>CVE-2015-8404</cvename>
<cvename>CVE-2015-8405</cvename>
<cvename>CVE-2015-8406</cvename>
<cvename>CVE-2015-8407</cvename>
<cvename>CVE-2015-8408</cvename>
<cvename>CVE-2015-8409</cvename>
<cvename>CVE-2015-8410</cvename>
<cvename>CVE-2015-8411</cvename>
<cvename>CVE-2015-8412</cvename>
<cvename>CVE-2015-8413</cvename>
<cvename>CVE-2015-8414</cvename>
<cvename>CVE-2015-8415</cvename>
<cvename>CVE-2015-8416</cvename>
<cvename>CVE-2015-8417</cvename>
<cvename>CVE-2015-8419</cvename>
<cvename>CVE-2015-8420</cvename>
<cvename>CVE-2015-8421</cvename>
<cvename>CVE-2015-8422</cvename>
<cvename>CVE-2015-8423</cvename>
<cvename>CVE-2015-8424</cvename>
<cvename>CVE-2015-8425</cvename>
<cvename>CVE-2015-8426</cvename>
<cvename>CVE-2015-8427</cvename>
<cvename>CVE-2015-8428</cvename>
<cvename>CVE-2015-8429</cvename>
<cvename>CVE-2015-8430</cvename>
<cvename>CVE-2015-8431</cvename>
<cvename>CVE-2015-8432</cvename>
<cvename>CVE-2015-8433</cvename>
<cvename>CVE-2015-8434</cvename>
<cvename>CVE-2015-8435</cvename>
<cvename>CVE-2015-8436</cvename>
<cvename>CVE-2015-8437</cvename>
<cvename>CVE-2015-8438</cvename>
<cvename>CVE-2015-8439</cvename>
<cvename>CVE-2015-8440</cvename>
<cvename>CVE-2015-8441</cvename>
<cvename>CVE-2015-8442</cvename>
<cvename>CVE-2015-8443</cvename>
<cvename>CVE-2015-8444</cvename>
<cvename>CVE-2015-8445</cvename>
<cvename>CVE-2015-8446</cvename>
<cvename>CVE-2015-8447</cvename>
<cvename>CVE-2015-8448</cvename>
<cvename>CVE-2015-8449</cvename>
<cvename>CVE-2015-8450</cvename>
<cvename>CVE-2015-8451</cvename>
<cvename>CVE-2015-8452</cvename>
<cvename>CVE-2015-8453</cvename>
</references>
<dates>
<discovery>2015-12-08</discovery>
<entry>2015-12-08</entry>
</dates>
</vuln>
<vuln vid="215e740e-9c56-11e5-90e7-b499baebfeaf">
<topic>libressl -- NULL pointer dereference</topic>
<affects>
<package>
<name>libressl</name>
<range><lt>2.2.5</lt></range>
<range><ge>2.3.0</ge><lt>2.3.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenBSD project reports:</p>
<blockquote cite="https://marc.info/?l=openbsd-announce&amp;t=144920914600002">
<p>A NULL pointer deference could be triggered by a crafted
certificate sent to services configured to verify client
certificates on TLS/SSL connections.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://marc.info/?l=openbsd-announce&amp;t=144920914600002</url>
<cvename>CVE-2015-3194</cvename>
</references>
<dates>
<discovery>2015-12-03</discovery>
<entry>2015-12-08</entry>
</dates>
</vuln>
<vuln vid="918a5d1f-9d40-11e5-8f5c-002590263bf5">
<topic>KeePassX -- information disclosure</topic>
<affects>
<package>
<name>KeePassX</name>
<range><lt>0.4.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Yves-Alexis Perez reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/11/30/4">
<p>Starting an export (using File / Export to / KeepassX XML file) and
cancelling it leads to KeepassX saving a cleartext XML file in
~/.xml without any warning.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8378</cvename>
<freebsdpr>ports/205105</freebsdpr>
<url>http://www.openwall.com/lists/oss-security/2015/11/30/4</url>
</references>
<dates>
<discovery>2015-07-08</discovery>
<entry>2015-12-08</entry>
</dates>
</vuln>
<vuln vid="84fdd1bb-9d37-11e5-8f5c-002590263bf5">
<topic>passenger -- client controlled header overwriting</topic>
<affects>
<package>
<name>rubygem-passenger</name>
<range><ge>5.0.0</ge><lt>5.0.22</lt></range>
<range><lt>4.0.60</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Daniel Knoppel reports:</p>
<blockquote cite="https://blog.phusion.nl/2015/12/07/cve-2015-7519/">
<p>It was discovered by the SUSE security team that it was possible,
in some cases, for clients to overwrite headers set by the server,
resulting in a medium level security issue. CVE-2015-7519 has been
assigned to this issue.</p>
<p>Affected use-cases:</p>
<p>Header overwriting may occur if all of the following conditions are met:</p>
<ul>
<li>Apache integration mode, or standalone+builtin engine without
a filtering proxy</li>
<li>Ruby or Python applications only (Passenger 5); or any
application (Passenger 4)</li>
<li>The app depends on a request header containing a dash (-)</li>
<li>The header is supposed to be trusted (set by the server)</li>
<li>The client correctly guesses the header name</li>
</ul>
<p>This vulnerability has been fixed by filtering out client headers
that do not consist of alphanumeric/dash characters (Nginx already
did this, so Passenger+Nginx was not affected). If your application
depends on headers that don't conform to this, you can add a
workaround in Apache specifically for those to convert them to a
dash-based format.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7519</cvename>
<url>https://blog.phusion.nl/2015/12/07/cve-2015-7519/</url>
</references>
<dates>
<discovery>2015-12-07</discovery>
<entry>2015-12-07</entry>
</dates>
</vuln>
<vuln vid="e6b974ab-9d35-11e5-8f5c-002590263bf5">
<topic>Salt -- information disclosure</topic>
<affects>
<package>
<name>py27-salt</name>
<range><lt>2015.8.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Salt release notes report:</p>
<blockquote cite="https://docs.saltstack.com/en/latest/topics/releases/2015.8.3.html">
<p>CVE-2015-8034: Saving state.sls cache data to disk with insecure
permissions</p>
<p>This affects users of the state.sls function. The state run cache
on the minion was being created with incorrect permissions. This
file could potentially contain sensitive data that was inserted via
jinja into the state SLS files. The permissions for this file are
now being set correctly. Thanks to @zmalone for bringing this issue
to our attention.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8034</cvename>
<url>https://docs.saltstack.com/en/latest/topics/releases/2015.8.3.html</url>
</references>
<dates>
<discovery>2015-11-25</discovery>
<entry>2015-12-07</entry>
</dates>
</vuln>
<vuln vid="6bc6eed2-9cca-11e5-8c2b-c335fa8985d7">
<topic>libraw -- memory objects not properly initialized</topic>
<affects>
<package>
<name>libraw</name>
<range><lt>0.17.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ChenQin reports:</p>
<blockquote cite="http://seclists.org/fulldisclosure/2015/Nov/108">
<p>The LibRaw raw image decoder has multiple vulnerabilities that can
cause memory errors which may lead to code execution or other
problems.</p>
<p>In CVE-2015-8367, LibRaw's phase_one_correct function does not
handle memory initialization correctly, which may cause other
problems.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.libraw.org/news/libraw-0-17-1</url>
<url>https://github.com/LibRaw/LibRaw/commit/490ef94d1796f730180039e80997efe5c58db780</url>
<mlist>http://seclists.org/fulldisclosure/2015/Nov/108</mlist>
<cvename>CVE-2015-8367</cvename>
</references>
<dates>
<discovery>2015-11-30</discovery>
<entry>2015-12-07</entry>
</dates>
</vuln>
<vuln vid="db04bf07-9cc8-11e5-8c2b-c335fa8985d7">
<topic>libraw -- index overflow in smal_decode_segment</topic>
<affects>
<package>
<name>libraw</name>
<range><lt>0.17.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ChenQin reports:</p>
<blockquote cite="http://seclists.org/fulldisclosure/2015/Nov/108">
<p>The LibRaw raw image decoder has multiple vulnerabilities that can
cause memory errors which may lead to code execution or other
problems.</p>
<p>In CVE-2015-8366, LibRaw's smal_decode_segment function does not
handle indexes carefully, which can cause an index overflow.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.libraw.org/news/libraw-0-17-1</url>
<url>https://github.com/LibRaw/LibRaw/commit/89d065424f09b788f443734d44857289489ca9e2</url>
<mlist>http://seclists.org/fulldisclosure/2015/Nov/108</mlist>
<cvename>CVE-2015-8366</cvename>
</references>
<dates>
<discovery>2015-11-30</discovery>
<entry>2015-12-07</entry>
</dates>
</vuln>
<vuln vid="4c8d1d72-9b38-11e5-aece-d050996490d0">
<topic>openssl -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.2_5</lt></range>
</package>
<package>
<name>mingw32-openssl</name>
<range><ge>1.0.1</ge><lt>1.0.2e</lt></range>
</package>
<package>
<name>linux-c6-openssl</name>
<range><lt>1.0.1e_7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20151203.txt">
<ol>
<li>BN_mod_exp may produce incorrect results on x86_64
(CVE-2015-3193)</li>
<li>Certificate verify crash with missing PSS parameter
(CVE-2015-3194)</li>
<li>X509_ATTRIBUTE memory leak (CVE-2015-3195)</li>
<li>Race condition handling PSK identify hint
(CVE-2015-3196)</li>
<li>Anon DH ServerKeyExchange with 0 p parameter
(CVE-2015-1794)</li>
</ol>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1794</cvename>
<cvename>CVE-2015-3193</cvename>
<cvename>CVE-2015-3194</cvename>
<cvename>CVE-2015-3195</cvename>
<cvename>CVE-2015-3196</cvename>
<url>https://www.openssl.org/news/secadv/20151203.txt</url>
</references>
<dates>
<discovery>2015-12-03</discovery>
<entry>2015-12-05</entry>
<modified>2016-01-31</modified>
</dates>
</vuln>
<vuln vid="8a90dc87-89f9-11e5-a408-00248c0c745d">
<topic>PHPmailer -- SMTP injection vulnerability</topic>
<affects>
<package>
<name>phpmailer</name>
<range><lt>5.2.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PHPMailer changelog reports:</p>
<blockquote cite="https://github.com/PHPMailer/PHPMailer/blob/v5.2.14/changelog.md">
<p>Fix vulnerability that allowed email addresses with
line breaks (valid in RFC5322) to pass to SMTP, permitting
message injection at the SMTP level. Mitigated in both
the address validator and in the lower-level SMTP class.
Thanks to Takeshi Terada.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/PHPMailer/PHPMailer/blob/v5.2.14/changelog.md</url>
</references>
<dates>
<discovery>2015-11-05</discovery>
<entry>2015-12-03</entry>
</dates>
</vuln>
<vuln vid="b0da85af-21a3-4c15-a137-fe9e4bc86002">
<topic>ffmpeg -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libav</name>
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>gstreamer-ffmpeg</name>
<!-- gst-ffmpeg-0.10.13 has libav-0.7.2 (0.7.7 in freebsd port) -->
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>handbrake</name>
<!-- handbrake-0.10.2 has libav-10.1 -->
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>ffmpeg</name>
<range><ge>2.8,1</ge><lt>2.8.3,1</lt></range>
<range><lt>2.7.3,1</lt></range>
</package>
<package>
<name>ffmpeg26</name>
<range><lt>2.6.5</lt></range>
</package>
<package>
<name>ffmpeg25</name>
<range><lt>2.5.9</lt></range>
</package>
<package>
<name>ffmpeg24</name>
<range><lt>2.4.12</lt></range>
</package>
<package>
<name>ffmpeg-devel</name>
<name>ffmpeg23</name>
<name>ffmpeg2</name>
<name>ffmpeg1</name>
<name>ffmpeg-011</name>
<name>ffmpeg0</name>
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>avidemux</name>
<name>avidemux2</name>
<name>avidemux26</name>
<!-- avidemux-2.6.10 has ffmpeg-2.6.1 -->
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>kodi</name>
<!-- kodi-15.2 has ffmpeg-2.6.4 -->
<range><lt>16.0</lt></range>
</package>
<package>
<name>mplayer</name>
<name>mencoder</name>
<!-- mplayer-1.1.r20150822_6 has ffmpeg-2.8.2 -->
<range><lt>1.1.r20150822_7</lt></range>
</package>
<package>
<name>mythtv</name>
<name>mythtv-frontend</name>
<!-- mythtv-0.27.0.20140121 has ffmpeg-1.2.2+ (snapshot, f9c8726) -->
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>plexhometheater</name>
<!-- plexhometheater-1.4.1 has ffmpeg-0.10.2 fork -->
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6761">
<p>The update_dimensions function in libavcodec/vp8.c in
FFmpeg through 2.8.1, as used in Google Chrome before
46.0.2490.71 and other products, relies on a
coefficient-partition count during multi-threaded operation,
which allows remote attackers to cause a denial of service
(race condition and memory corruption) or possibly have
unspecified other impact via a crafted WebM file.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8216">
<p>The ljpeg_decode_yuv_scan function in
libavcodec/mjpegdec.c in FFmpeg before 2.8.2 omits certain
width and height checks, which allows remote attackers to
cause a denial of service (out-of-bounds array access) or
possibly have unspecified other impact via crafted MJPEG
data.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8217">
<p>The ff_hevc_parse_sps function in libavcodec/hevc_ps.c in
FFmpeg before 2.8.2 does not validate the Chroma Format
Indicator, which allows remote attackers to cause a denial
of service (out-of-bounds array access) or possibly have
unspecified other impact via crafted High Efficiency Video
Coding (HEVC) data.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8218">
<p>The decode_uncompressed function in libavcodec/faxcompr.c
in FFmpeg before 2.8.2 does not validate uncompressed runs,
which allows remote attackers to cause a denial of service
(out-of-bounds array access) or possibly have unspecified
other impact via crafted CCITT FAX data.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8219">
<p>The init_tile function in libavcodec/jpeg2000dec.c in
FFmpeg before 2.8.2 does not enforce minimum-value and
maximum-value constraints on tile coordinates, which allows
remote attackers to cause a denial of service (out-of-bounds
array access) or possibly have unspecified other impact via
crafted JPEG 2000 data.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8363">
<p>The jpeg2000_read_main_headers function in
libavcodec/jpeg2000dec.c in FFmpeg before 2.6.5, 2.7.x
before 2.7.3, and 2.8.x through 2.8.2 does not enforce
uniqueness of the SIZ marker in a JPEG 2000 image, which
allows remote attackers to cause a denial of service
(out-of-bounds heap-memory access) or possibly have
unspecified other impact via a crafted image with two or
more of these markers.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8364">
<p>Integer overflow in the ff_ivi_init_planes function in
libavcodec/ivi.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3,
and 2.8.x through 2.8.2 allows remote attackers to cause a
denial of service (out-of-bounds heap-memory access) or
possibly have unspecified other impact via crafted image
dimensions in Indeo Video Interactive data.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8365">
<p>The smka_decode_frame function in libavcodec/smacker.c in
FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8.x through
2.8.2 does not verify that the data size is consistent with
the number of channels, which allows remote attackers to
cause a denial of service (out-of-bounds array access) or
possibly have unspecified other impact via crafted Smacker
data.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-6761</cvename>
<cvename>CVE-2015-8216</cvename>
<cvename>CVE-2015-8217</cvename>
<cvename>CVE-2015-8218</cvename>
<cvename>CVE-2015-8219</cvename>
<cvename>CVE-2015-8363</cvename>
<cvename>CVE-2015-8364</cvename>
<cvename>CVE-2015-8365</cvename>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=dabea74d0e82ea80cd344f630497cafcb3ef872c</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=d24888ef19ba38b787b11d1ee091a3d94920c76a</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=93f30f825c08477fe8f76be00539e96014cc83c8</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=d4a731b84a08f0f3839eaaaf82e97d8d9c67da46</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=43492ff3ab68a343c1264801baa1d5a02de10167</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=44a7f17d0b20e6f8d836b2957e3e357b639f19a2</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=df91aa034b82b77a3c4e01791f4a2b2ff6c82066</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=4a9af07a49295e014b059c1ab624c40345af5892</url>
<url>https://ffmpeg.org/security.html</url>
</references>
<dates>
<discovery>2015-11-27</discovery>
<entry>2015-12-02</entry>
<modified>2015-12-28</modified>
</dates>
</vuln>
<vuln vid="548f74bd-993c-11e5-956b-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<!--pcbsd-->
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>47.0.2526.73</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2015/12/stable-channel-update.html">
<p>41 security fixes in this release, inclduding:</p>
<ul>
<li>[558589] Critical CVE-2015-6765: Use-after-free in AppCache.
Credit to anonymous.</li>
<li>[551044] High CVE-2015-6766: Use-after-free in AppCache.
Credit to anonymous.</li>
<li>[554908] High CVE-2015-6767: Use-after-free in AppCache.
Credit to anonymous.</li>
<li>[556724] High CVE-2015-6768: Cross-origin bypass in DOM.
Credit to Mariusz Mlynski.</li>
<li>[534923] High CVE-2015-6769: Cross-origin bypass in core.
Credit to Mariusz Mlynski.</li>
<li>[541206] High CVE-2015-6770: Cross-origin bypass in DOM.
Credit to Mariusz Mlynski.</li>
<li>[544991] High CVE-2015-6771: Out of bounds access in v8.
Credit to anonymous.</li>
<li>[546545] High CVE-2015-6772: Cross-origin bypass in DOM.
Credit to Mariusz Mlynski.</li>
<li>[554946] High CVE-2015-6764: Out of bounds access in v8.
Credit to Guang Gong of Qihoo 360 via pwn2own.</li>
<li>[491660] High CVE-2015-6773: Out of bounds access in Skia.
Credit to cloudfuzzer.</li>
<li>[549251] High CVE-2015-6774: Use-after-free in Extensions.
Credit to anonymous.</li>
<li>[529012] High CVE-2015-6775: Type confusion in PDFium.
Credit to Atte Kettunen of OUSPG.</li>
<li>[457480] High CVE-2015-6776: Out of bounds access in PDFium.
Credit to Hanno Böck.</li>
<li>[544020] High CVE-2015-6777: Use-after-free in DOM.
Credit to Long Liu of Qihoo 360Vulcan Team.</li>
<li>[514891] Medium CVE-2015-6778: Out of bounds access in PDFium.
Credit to Karl Skomski.</li>
<li>[528505] Medium CVE-2015-6779: Scheme bypass in PDFium.
Credit to Til Jasper Ullrich.</li>
<li>[490492] Medium CVE-2015-6780: Use-after-free in Infobars.
Credit to Khalil Zhani.</li>
<li>[497302] Medium CVE-2015-6781: Integer overflow in Sfntly.
Credit to miaubiz.</li>
<li>[536652] Medium CVE-2015-6782: Content spoofing in Omnibox.
Credit to Luan Herrera.</li>
<li>[537205] Medium CVE-2015-6783: Signature validation issue in
Android Crazy Linker. Credit to Michal Bednarski.</li>
<li>[503217] Low CVE-2015-6784: Escaping issue in saved pages.
Credit to Inti De Ceukelaire.</li>
<li>[534542] Low CVE-2015-6785: Wildcard matching issue in CSP.
Credit to Michael Ficarra / Shape Security.</li>
<li>[534570] Low CVE-2015-6786: Scheme bypass in CSP. Credit to
Michael Ficarra / Shape Security.</li>
<li>[563930] CVE-2015-6787: Various fixes from internal audits,
fuzzing and other initiatives.</li>
<li> Multiple vulnerabilities in V8 fixed at the tip of the 4.7
branch (currently 4.7.80.23).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-6765</cvename>
<cvename>CVE-2015-6766</cvename>
<cvename>CVE-2015-6767</cvename>
<cvename>CVE-2015-6768</cvename>
<cvename>CVE-2015-6769</cvename>
<cvename>CVE-2015-6770</cvename>
<cvename>CVE-2015-6771</cvename>
<cvename>CVE-2015-6772</cvename>
<cvename>CVE-2015-6773</cvename>
<cvename>CVE-2015-6774</cvename>
<cvename>CVE-2015-6775</cvename>
<cvename>CVE-2015-6776</cvename>
<cvename>CVE-2015-6777</cvename>
<cvename>CVE-2015-6778</cvename>
<cvename>CVE-2015-6779</cvename>
<cvename>CVE-2015-6780</cvename>
<cvename>CVE-2015-6781</cvename>
<cvename>CVE-2015-6782</cvename>
<cvename>CVE-2015-6783</cvename>
<cvename>CVE-2015-6784</cvename>
<cvename>CVE-2015-6785</cvename>
<cvename>CVE-2015-6786</cvename>
<cvename>CVE-2015-6787</cvename>
<url>http://googlechromereleases.blogspot.nl/2015/12/stable-channel-update.html</url>
</references>
<dates>
<discovery>2015-12-01</discovery>
<entry>2015-12-02</entry>
</dates>
</vuln>
<vuln vid="11351c82-9909-11e5-a9c8-14dae9d5a9d2">
<topic>piwik -- multiple vulnerabilities</topic>
<affects>
<package>
<name>piwik</name>
<range><lt>2.15.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Piwik changelog reports:</p>
<blockquote cite="http://piwik.org/changelog/piwik-2-15-0/">
<p>This release is rated critical.
We are grateful for Security researchers who disclosed
security issues privately to the Piwik Security Response
team: Elamaran Venkatraman, Egidio Romano and Dmitriy
Shcherbatov. The following vulnerabilities were fixed:
XSS, CSRF, possible file inclusion in older PHP versions
(low impact), possible Object Injection Vulnerability
(low impact).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7815</cvename>
<cvename>CVE-2015-7816</cvename>
<url>http://piwik.org/changelog/piwik-2-15-0/</url>
</references>
<dates>
<discovery>2015-11-17</discovery>
<entry>2015-12-02</entry>
</dates>
</vuln>
<vuln vid="d62ec98e-97d8-11e5-8c0e-080027b00c2e">
<topic>cyrus-imapd -- integer overflow in the start_octet addition</topic>
<affects>
<package>
<name>cyrus-imapd25</name>
<range><ge>2.5.0</ge><lt>2.5.7</lt></range>
</package>
<package>
<name>cyrus-imapd24</name>
<range><ge>2.4.0</ge><lt>2.4.18_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cyrus IMAP 2.5.7 Release Note states:</p>
<blockquote cite="https://docs.cyrus.foundation/imap/release-notes/2.5/x/2.5.7.html">
<p>CVE-2015-8077, CVE-2015-8078: protect against integer overflow in urlfetch range checks</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8078</cvename>
<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8078</url>
<url>http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-8078.html</url>
<url>https://security-tracker.debian.org/tracker/CVE-2015-8078</url>
<cvename>CVE-2015-8077</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8077</url>
<url>http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-8077.html</url>
<url>https://security-tracker.debian.org/tracker/CVE-2015-8077</url>
</references>
<dates>
<discovery>2015-11-04</discovery>
<entry>2015-12-01</entry>
</dates>
</vuln>
<vuln vid="11c52bc6-97aa-11e5-b8df-14dae9d210b8">
<topic>django -- information leak vulnerability</topic>
<affects>
<package>
<name>py27-django</name>
<name>py32-django</name>
<name>py33-django</name>
<name>py34-django</name>
<range><lt>1.8.7</lt></range>
</package>
<package>
<name>py27-django18</name>
<name>py32-django18</name>
<name>py33-django18</name>
<name>py34-django18</name>
<range><lt>1.8.7</lt></range>
</package>
<package>
<name>py27-django17</name>
<name>py32-django17</name>
<name>py33-django17</name>
<name>py34-django17</name>
<range><lt>1.7.11</lt></range>
</package>
<package>
<name>py27-django-devel</name>
<name>py32-django-devel</name>
<name>py33-django-devel</name>
<name>py34-django-devel</name>
<range><le>20150709,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tim Graham reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/">
<p>If an application allows users to specify an unvalidated
format for dates and passes this format to the date filter, e.g. {{
last_updated|date:user_date_format }}, then a malicious user could
obtain any secret in the application's settings by specifying a settings
key instead of a date format. e.g. "SECRET_KEY" instead of "j/m/Y".</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/</url>
<cvename>CVE-2015-8213</cvename>
</references>
<dates>
<discovery>2015-11-24</discovery>
<entry>2015-11-30</entry>
<modified>2015-12-24</modified>
</dates>
</vuln>
<vuln vid="fb2475c2-9125-11e5-bd18-002590263bf5">
<topic>kibana4 -- CSRF vulnerability</topic>
<affects>
<package>
<name>kibana4</name>
<name>kibana41</name>
<range><ge>4.0.0</ge><lt>4.1.3</lt></range>
</package>
<package>
<name>kibana42</name>
<range><ge>4.2.0</ge><lt>4.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Elastic reports:</p>
<blockquote cite="https://www.elastic.co/community/security/">
<p>Vulnerability Summary: Kibana versions prior to 4.1.3 and 4.2.1
are vulnerable to a CSRF attack.</p>
<p>Remediation Summary: Users should upgrade to 4.1.3 or 4.2.1.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8131</cvename>
<url>https://www.elastic.co/community/security/</url>
</references>
<dates>
<discovery>2015-11-17</discovery>
<entry>2015-11-22</entry>
</dates>
</vuln>
<vuln vid="e359051d-90bd-11e5-bd18-002590263bf5">
<topic>a2ps -- format string vulnerability</topic>
<affects>
<package>
<name>a2ps</name>
<range><lt>4.13b_8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jong-Gwon Kim reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/11/16/4">
<p>When user runs a2ps with malicious crafted pro(a2ps prologue) file,
an attacker can execute arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8107</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/11/16/4</url>
</references>
<dates>
<discovery>2015-11-16</discovery>
<entry>2015-11-22</entry>
</dates>
</vuln>
<vuln vid="ecc268f2-8fc2-11e5-918c-bcaec565249c">
<topic>libxslt -- DoS vulnability due to type confusing error</topic>
<affects>
<package>
<name>libsxlt</name>
<range><lt>1.1.28_8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libxslt maintainer reports:</p>
<blockquote cite="https://git.gnome.org/browse/libxslt/commit/?id=7ca19df892ca22d9314e95d59ce2abdeff46b617">
<p>CVE-2015-7995:
http://www.openwall.com/lists/oss-security/2015/10/27/10
We need to check that the parent node is an element before
dereferencing its namespace.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7995</cvename>
<url>https://git.gnome.org/browse/libxslt/commit/?id=7ca19df892ca22d9314e95d59ce2abdeff46b617</url>
</references>
<dates>
<discovery>2015-10-29</discovery>
<entry>2015-11-20</entry>
</dates>
</vuln>
<vuln vid="e5423caf-8fb8-11e5-918c-bcaec565249c">
<topic>libxml2 -- multiple vulnabilities</topic>
<affects>
<package>
<name>libxml2</name>
<range><lt>2.9.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>reports:</p>
<blockquote cite="http://xmlsoft.org/news.html">
<p>CVE-2015-5312 Another entity expansion issue (David Drysdale).</p>
<p>CVE-2015-7497 Avoid an heap buffer overflow in
xmlDictComputeFastQKey (David Drysdale).</p>
<p>CVE-2015-7498 Avoid processing entities after encoding
conversion failures (Daniel Veillard).</p>
<p>CVE-2015-7499 (1) Add xmlHaltParser() to stop the parser
(Daniel Veillard).</p>
<p>CVE-2015-7499 (2) Detect incoherency on GROW (Daniel
Veillard).</p>
<p>CVE-2015-7500 Fix memory access error due to incorrect
entities boundaries (Daniel Veillard).</p>
<p>CVE-2015-7941 (1) Stop parsing on entities boundaries
errors (Daniel Veillard).</p>
<p>CVE-2015-7941 (2) Cleanup conditional section error
handling (Daniel Veillard).</p>
<p>CVE-2015-7942 Another variation of overflow in
Conditional sections (Daniel Veillard).</p>
<p>CVE-2015-7942 (2) Fix an error in previous Conditional
section patch (Daniel Veillard).</p>
<p>CVE-2015-8035 Fix XZ compression support loop
(Daniel Veillard).</p>
<p>CVE-2015-8242 Buffer overead with HTML parser in push
mode (Hugh Davenport)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5312</cvename>
<cvename>CVE-2015-7497</cvename>
<cvename>CVE-2015-7498</cvename>
<cvename>CVE-2015-7499</cvename>
<cvename>CVE-2015-7500</cvename>
<cvename>CVE-2015-7941</cvename>
<cvename>CVE-2015-7942</cvename>
<cvename>CVE-2015-8035</cvename>
<cvename>CVE-2015-8241</cvename>
<cvename>CVE-2015-8242</cvename>
<url>http://xmlsoft.org/news.html</url>
<url>http://www.openwall.com/lists/oss-security/2015/11/18/23</url>
</references>
<dates>
<discovery>2015-11-20</discovery>
<entry>2015-11-20</entry>
</dates>
</vuln>
<vuln vid="9d04936c-75f1-4a2c-9ade-4c1708be5df9">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>nspr</name>
<range><lt>4.10.10</lt></range>
</package>
<package>
<name>linux-c6-nspr</name>
<range><lt>4.10.10</lt></range>
</package>
<package>
<name>nss</name>
<range><ge>3.20</ge><lt>3.20.1</lt></range>
<range><ge>3.19.3</ge><lt>3.19.4</lt></range>
<range><lt>3.19.2.1</lt></range>
</package>
<package>
<name>firefox</name>
<range><lt>42.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>42.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.39</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.39</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>38.4.0,1</lt></range>
</package>
<package>
<name>libxul</name>
<range><lt>38.4.0</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>38.4.0</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>38.4.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/">
<p>MFSA 2015-133 NSS and NSPR memory corruption issues</p>
<p>MFSA 2015-132 Mixed content WebSocket policy bypass
through workers</p>
<p>MFSA 2015-131 Vulnerabilities found through code
inspection</p>
<p>MFSA 2015-130 JavaScript garbage collection crash with
Java applet</p>
<p>MFSA 2015-129 Certain escaped characters in host of
Location-header are being treated as non-escaped</p>
<p>MFSA 2015-128 Memory corruption in libjar through zip
files</p>
<p>MFSA 2015-127 CORS preflight is bypassed when
non-standard Content-Type headers are received</p>
<p>MFSA 2015-126 Crash when accessing HTML tables with
accessibility tools on OS X</p>
<p>MFSA 2015-125 XSS attack through intents on Firefox for
Android</p>
<p>MFSA 2015-124 Android intents can be used on Firefox for
Android to open privileged files</p>
<p>MFSA 2015-123 Buffer overflow during image interactions
in canvas</p>
<p>MFSA 2015-122 Trailing whitespace in IP address hostnames
can bypass same-origin policy</p>
<p>MFSA 2015-121 Disabling scripts in Add-on SDK panels has
no effect</p>
<p>MFSA 2015-120 Reading sensitive profile files through
local HTML file on Android</p>
<p>MFSA 2015-119 Firefox for Android addressbar can be
removed after fullscreen mode</p>
<p>MFSA 2015-118 CSP bypass due to permissive Reader mode
whitelist</p>
<p>MFSA 2015-117 Information disclosure through NTLM
authentication</p>
<p>MFSA 2015-116 Miscellaneous memory safety hazards
(rv:42.0 / rv:38.4)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4513</cvename>
<cvename>CVE-2015-4514</cvename>
<cvename>CVE-2015-4515</cvename>
<cvename>CVE-2015-4518</cvename>
<cvename>CVE-2015-7181</cvename>
<cvename>CVE-2015-7182</cvename>
<cvename>CVE-2015-7183</cvename>
<cvename>CVE-2015-7185</cvename>
<cvename>CVE-2015-7186</cvename>
<cvename>CVE-2015-7187</cvename>
<cvename>CVE-2015-7188</cvename>
<cvename>CVE-2015-7189</cvename>
<cvename>CVE-2015-7190</cvename>
<cvename>CVE-2015-7191</cvename>
<cvename>CVE-2015-7192</cvename>
<cvename>CVE-2015-7193</cvename>
<cvename>CVE-2015-7194</cvename>
<cvename>CVE-2015-7195</cvename>
<cvename>CVE-2015-7196</cvename>
<cvename>CVE-2015-7197</cvename>
<cvename>CVE-2015-7198</cvename>
<cvename>CVE-2015-7199</cvename>
<cvename>CVE-2015-7200</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2015-116/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-117/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-118/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-119/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-120/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-121/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-122/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-123/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-124/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-125/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-126/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-127/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-128/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-129/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-130/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-131/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-132/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-133/</url>
</references>
<dates>
<discovery>2015-11-03</discovery>
<entry>2015-11-19</entry>
<modified>2016-04-13</modified>
</dates>
</vuln>
<vuln vid="68847b20-8ddc-11e5-b69c-c86000169601">
<topic>gdm -- lock screen bypass when holding escape key</topic>
<affects>
<package>
<name>gdm</name>
<range><lt>3.16.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ray Strode reports:</p>
<blockquote cite="https://mail.gnome.org/archives/ftp-release-list/2015-November/msg00074.html">
<p>CVE-2015-7496 - lock screen bypass when holding escape key.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7496</cvename>
<url>https://mail.gnome.org/archives/ftp-release-list/2015-November/msg00074.html</url>
<url>https://bugzilla.gnome.org/show_bug.cgi?id=758032</url>
</references>
<dates>
<discovery>2015-11-12</discovery>
<entry>2015-11-18</entry>
</dates>
</vuln>
<vuln vid="3eb0ccc2-8c6a-11e5-8519-005056ac623e">
<topic>strongswan -- authentication bypass vulnerability in the eap-mschapv2 plugin</topic>
<affects>
<package>
<name>strongswan</name>
<range><lt>5.3.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Strongswan Release Notes reports:</p>
<blockquote cite="https://github.com/strongswan/strongswan/blob/master/NEWS">
<p>Fixed an authentication bypass vulnerability in the eap-mschapv2 plugin that
was caused by insufficient verification of the internal state when handling
MSCHAPv2 Success messages received by the client.
This vulnerability has been registered as CVE-2015-8023.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8023</cvename>
<url>https://github.com/strongswan/strongswan/commit/453e204ac40dfff2e0978e8f84a5f8ff0cbc45e2</url>
</references>
<dates>
<discovery>2015-11-16</discovery>
<entry>2015-11-16</entry>
</dates>
</vuln>
<vuln vid="82b3ca2a-8c07-11e5-bd18-002590263bf5">
<topic>moodle -- multiple vulnerabilities</topic>
<affects>
<package>
<name>moodle27</name>
<range><lt>2.7.11</lt></range>
</package>
<package>
<name>moodle28</name>
<range><lt>2.8.9</lt></range>
</package>
<package>
<name>moodle29</name>
<range><lt>2.9.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Moodle Release Notes report:</p>
<blockquote cite="https://docs.moodle.org/dev/Moodle_2.9.3_release_notes">
<p>MSA-15-0037 Possible to send a message to a user who blocked
messages from non contacts</p>
<p>MSA-15-0038 DDoS possibility in Atto</p>
<p>MSA-15-0039 CSRF in site registration form</p>
<p>MSA-15-0040 Student XSS in survey</p>
<p>MSA-15-0041 XSS in flash video player</p>
<p>MSA-15-0042 CSRF in lesson login form</p>
<p>MSA-15-0043 Web service core_enrol_get_enrolled_users does not
respect course group mode</p>
<p>MSA-15-0044 Capability to view available badges is not
respected</p>
<p>MSA-15-0045 SCORM module allows to bypass access restrictions based
on date</p>
<p>MSA-15-0046 Choice module closing date can be bypassed</p>
</blockquote>
</body>
</description>
<references>
<url>https://docs.moodle.org/dev/Moodle_2.7.11_release_notes</url>
<url>https://docs.moodle.org/dev/Moodle_2.8.9_release_notes</url>
<url>https://docs.moodle.org/dev/Moodle_2.9.3_release_notes</url>
</references>
<dates>
<discovery>2015-11-09</discovery>
<entry>2015-11-16</entry>
<modified>2015-12-21</modified>
</dates>
</vuln>
<vuln vid="2cabfbab-8bfb-11e5-bd18-002590263bf5">
<topic>xen-kernel -- CPU lockup during exception delivery</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-156.html">
<p>A malicious HVM guest administrator can cause a denial of service.
Specifically, prevent use of a physical CPU for a significant,
perhaps indefinite period. If a host watchdog (Xen or dom0) is in
use, this can lead to a watchdog timeout and consequently a reboot
of the host. If another, innocent, guest, is configured with a
watchdog, this issue can lead to a reboot of such a guest.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5307</cvename>
<cvename>CVE-2015-8104</cvename>
<url>http://xenbits.xen.org/xsa/advisory-156.html</url>
</references>
<dates>
<discovery>2015-11-10</discovery>
<entry>2015-11-16</entry>
</dates>
</vuln>
<vuln vid="1886e195-8b87-11e5-90e7-b499baebfeaf">
<topic>libpng buffer overflow in png_set_PLTE</topic>
<affects>
<package>
<name>png</name>
<range><lt>1.6.20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libpng reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/11/12/2">
<p>CVE for a vulnerability in libpng, all versions, in the
png_set_PLTE/png_get_PLTE functions. These functions failed to check for
an out-of-range palette when reading or writing PNG files with a bit_depth
less than 8. Some applications might read the bit depth from the IHDR
chunk and allocate memory for a 2^N entry palette, while libpng can return
a palette with up to 256 entries even when the bit depth is less than 8.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2015/11/12/2</url>
<url>http://www.openwall.com/lists/oss-security/2015/12/03/6</url>
<cvename>CVE-2015-8126</cvename>
<cvename>CVE-2015-8472</cvename>
</references>
<dates>
<discovery>2015-11-15</discovery>
<entry>2015-11-15</entry>
<modified>2015-12-08</modified>
</dates>
</vuln>
<vuln vid="547fbd98-8b1f-11e5-b48b-bcaec565249c">
<topic>flash -- multiple vulnabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<name>linux-f10-flashplugin</name>
<name>linux-c6_64-flashplugin</name>
<range><lt>11.2r202.548</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-28.html">
<p>These updates resolve a type confusion vulnerability that
could lead to code execution (CVE-2015-7659).</p>
<p>These updates resolve a security bypass vulnerability that
could be exploited to write arbitrary data to the file
system under user permissions (CVE-2015-7662).</p>
<p>These updates resolve use-after-free vulnerabilities that
could lead to code execution (CVE-2015-7651, CVE-2015-7652,
CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656,
CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661,
CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044,
CVE-2015-8046).</p>
</blockquote>
</body>
</description>
<references>
<url>https://helpx.adobe.com/security/products/flash-player/apsb15-28.html</url>
<cvename>CVE-2015-7651</cvename>
<cvename>CVE-2015-7652</cvename>
<cvename>CVE-2015-7653</cvename>
<cvename>CVE-2015-7654</cvename>
<cvename>CVE-2015-7655</cvename>
<cvename>CVE-2015-7656</cvename>
<cvename>CVE-2015-7657</cvename>
<cvename>CVE-2015-7658</cvename>
<cvename>CVE-2015-7659</cvename>
<cvename>CVE-2015-7660</cvename>
<cvename>CVE-2015-7661</cvename>
<cvename>CVE-2015-7662</cvename>
<cvename>CVE-2015-7663</cvename>
<cvename>CVE-2015-8043</cvename>
<cvename>CVE-2015-8044</cvename>
<cvename>CVE-2015-8046</cvename>
</references>
<dates>
<discovery>2015-11-10</discovery>
<entry>2015-11-14</entry>
</dates>
</vuln>
<vuln vid="f0b9049f-88c4-11e5-aed7-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<!--pcbsd-->
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>46.0.2490.86</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2015/11/stable-channel-update.html">
<p>[520422] High CVE-2015-1302: Information leak in PDF viewer.
Credit to Rob Wu.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1302</cvename>
<url>http://googlechromereleases.blogspot.nl/2015/11/stable-channel-update.html</url>
</references>
<dates>
<discovery>2015-11-10</discovery>
<entry>2015-11-11</entry>
</dates>
</vuln>
<vuln vid="851a0eea-88aa-11e5-90e7-b499baebfeaf">
<topic>MySQL - Multiple vulnerabilities</topic>
<affects>
<package>
<name>mariadb-client</name>
<range><lt>5.3.13</lt></range>
</package>
<package>
<name>mariadb-server</name>
<range><lt>5.3.13</lt></range>
</package>
<package>
<name>mariadb55-client</name>
<range><lt>5.5.46</lt></range>
</package>
<package>
<name>mariadb55-server</name>
<range><lt>5.5.46</lt></range>
</package>
<package>
<name>mariadb100-client</name>
<range><lt>10.0.22</lt></range>
</package>
<package>
<name>mariadb100-server</name>
<range><lt>10.0.22</lt></range>
</package>
<package>
<name>mysql55-client</name>
<range><lt>5.5.46</lt></range>
</package>
<package>
<name>mysql55-server</name>
<range><lt>5.5.46</lt></range>
</package>
<package>
<name>mysql56-client</name>
<range><lt>5.6.27</lt></range>
</package>
<package>
<name>mysql56-server</name>
<range><lt>5.6.27</lt></range>
</package>
<package>
<name>percona55-client</name>
<range><lt>5.5.46</lt></range>
</package>
<package>
<name>percona55-server</name>
<range><lt>5.5.46</lt></range>
</package>
<package>
<name>percona56-client</name>
<range><lt>5.6.27</lt></range>
</package>
<package>
<name>percona56-server</name>
<range><lt>5.6.27</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html">
<p>Critical Patch Update: MySQL Server, version(s) 5.5.45 and prior, 5.6.26 and prior</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html</url>
<cvename>CVE-2015-4802</cvename>
<cvename>CVE-2015-4807</cvename>
<cvename>CVE-2015-4815</cvename>
<cvename>CVE-2015-4826</cvename>
<cvename>CVE-2015-4830</cvename>
<cvename>CVE-2015-4836</cvename>
<cvename>CVE-2015-4858</cvename>
<cvename>CVE-2015-4861</cvename>
<cvename>CVE-2015-4870</cvename>
<cvename>CVE-2015-4913</cvename>
<cvename>CVE-2015-4792</cvename>
<url>https://mariadb.com/kb/en/mariadb/mariadb-5546-release-notes/</url>
<url>https://mariadb.com/kb/en/mariadb/mariadb-10022-release-notes/</url>
<url>https://www.percona.com/doc/percona-server/5.5/release-notes/Percona-Server-5.5.46-37.5.html</url>
<url>https://www.percona.com/doc/percona-server/5.6/release-notes/Percona-Server-5.6.27-75.0.html</url>
</references>
<dates>
<discovery>2015-11-10</discovery>
<entry>2015-11-11</entry>
</dates>
</vuln>
<vuln vid="b665668a-91db-4f13-8113-9e4b5b0e47f7">
<topic>jenkins -- remote code execution via unsafe deserialization</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>1.638</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>1.625.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Developers report:</p>
<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11">
<p>Unsafe deserialization allows unauthenticated remote attackers to
run arbitrary code on the Jenkins master.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11</url>
<url>https://jenkins-ci.org/content/mitigating-unauthenticated-remote-code-execution-0-day-jenkins-cli</url>
<url>http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/#thefix</url>
</references>
<dates>
<discovery>2015-11-06</discovery>
<entry>2015-11-11</entry>
</dates>
</vuln>
<vuln vid="71af4ded-8864-11e5-af1b-001999f8d30b">
<topic>owncloudclient -- Improper validation of certificates when using self-signed certificates</topic>
<affects>
<package>
<name>owncloudclient</name>
<range><lt>2.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>owncloud.org reports:</p>
<blockquote cite="https://owncloud.org/security/advisory/?id=oc-sa-2015-016">
<p>The ownCloud Desktop Client was vulnerable against MITM attacks until version 2.0.0 in combination with self-signed certificates.</p>
</blockquote>
</body>
</description>
<references>
<url>https://owncloud.org/security/advisory/?id=oc-sa-2015-016</url>
<cvename>CVE-2015-7298</cvename>
</references>
<dates>
<discovery>2015-09-21</discovery>
<entry>2015-11-11</entry>
</dates>
</vuln>
<vuln vid="c0e76d33-8821-11e5-ab94-002590263bf5">
<topic>xen-tools -- populate-on-demand balloon size inaccuracy can crash guests</topic>
<affects>
<package>
<name>xen-tools</name>
<range><ge>3.4</ge><lt>4.5.1_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-153.html">
<p>Guests configured with PoD might be unstable, especially under
load. In an affected guest, an unprivileged guest user might be
able to cause a guest crash, perhaps simply by applying load so
as to cause heavy memory pressure within the guest.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7972</cvename>
<url>http://xenbits.xen.org/xsa/advisory-153.html</url>
</references>
<dates>
<discovery>2015-10-29</discovery>
<entry>2015-11-11</entry>
</dates>
</vuln>
<vuln vid="e4848ca4-8820-11e5-ab94-002590263bf5">
<topic>xen-kernel -- some pmu and profiling hypercalls log without rate limiting</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><ge>3.2</ge><lt>4.5.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-152.html">
<p>HYPERCALL_xenoprof_op and HYPERVISOR_xenpmu_op log some errors and
attempts at invalid operations. These log messages are not
rate-limited, even though they can be triggered by guests.</p>
<p>A malicious guest could cause repeated logging to the hypervisor
console, leading to a Denial of Service attack.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7971</cvename>
<url>http://xenbits.xen.org/xsa/advisory-152.html</url>
</references>
<dates>
<discovery>2015-10-29</discovery>
<entry>2015-11-11</entry>
</dates>
</vuln>
<vuln vid="e3792855-881f-11e5-ab94-002590263bf5">
<topic>xen-kernel -- leak of per-domain profiling-related vcpu pointer array</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><ge>4.0</ge><lt>4.5.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-151.html">
<p>A domain's xenoprofile state contains an array of per-vcpu
information... This array is leaked on domain teardown. This memory
leak could -- over time -- exhaust the host's memory.</p>
<p>The following parties can mount a denial of service attack
affecting the whole system:</p>
<ul>
<li>A malicious guest administrator via XENOPROF_get_buffer.</li>
<li>A domain given suitable privilege over another domain via
XENOPROF_set_passive (this would usually be a domain being
used to profile another domain, eg with the xenoprof tool).</li>
</ul>
<p>The ability to also restart or create suitable domains is also
required to fully exploit the issue. Without this the leak is
limited to a small multiple of the maximum number of vcpus for the
domain.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7969</cvename>
<url>http://xenbits.xen.org/xsa/advisory-151.html</url>
</references>
<dates>
<discovery>2015-10-29</discovery>
<entry>2015-11-11</entry>
</dates>
</vuln>
<vuln vid="83350009-881e-11e5-ab94-002590263bf5">
<topic>xen-kernel -- Long latency populate-on-demand operation is not preemptible</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><ge>3.4</ge><lt>4.5.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-150.html">
<p>When running an HVM domain in Populate-on-Demand mode, Xen would
sometimes search the domain for memory to reclaim, in response to
demands for population of other pages in the same domain. This
search runs without preemption. The guest can, by suitable
arrangement of its memory contents, create a situation where this
search is a time-consuming linear scan of the guest's address
space.</p>
<p>A malicious HVM guest administrator can cause a denial of service.
Specifically, prevent use of a physical CPU for a significant
period.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7970</cvename>
<url>http://xenbits.xen.org/xsa/advisory-150.html</url>
</references>
<dates>
<discovery>2015-10-29</discovery>
<entry>2015-11-11</entry>
</dates>
</vuln>
<vuln vid="fc1f8795-881d-11e5-ab94-002590263bf5">
<topic>xen-kernel -- leak of main per-domain vcpu pointer array</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.5.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-149.html">
<p>A domain's primary array of vcpu pointers can be allocated by a
toolstack exactly once in the lifetime of a domain via the
XEN_DOMCTL_max_vcpus hypercall. This array is leaked on domain
teardown. This memory leak could -- over time -- exhaust the host's
memory.</p>
<p>A domain given partial management control via XEN_DOMCTL_max_vcpus
can mount a denial of service attack affecting the whole system. The
ability to also restart or create suitable domains is also required
to fully exploit the issue. Without this the leak is limited to a
small multiple of the maximum number of vcpus for the domain. The
maximum leak is 64kbytes per domain (re)boot (less on ARM).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7969</cvename>
<url>http://xenbits.xen.org/xsa/advisory-149.html</url>
</references>
<dates>
<discovery>2015-10-29</discovery>
<entry>2015-11-11</entry>
</dates>
</vuln>
<vuln vid="3d9f6260-881d-11e5-ab94-002590263bf5">
<topic>xen-kernel -- Uncontrolled creation of large page mappings by PV guests</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><ge>3.4</ge><lt>4.5.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-148.html">
<p>The code to validate level 2 page table entries is bypassed when
certain conditions are satisfied. This means that a PV guest can
create writeable mappings using super page mappings. Such writeable
mappings can violate Xen intended invariants for pages which Xen is
supposed to keep read-only. This is possible even if the
"allowsuperpage" command line option is not used.</p>
<p>Malicious PV guest administrators can escalate privilege so as to
control the whole system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7835</cvename>
<url>http://xenbits.xen.org/xsa/advisory-148.html</url>
</references>
<dates>
<discovery>2015-10-29</discovery>
<entry>2015-11-11</entry>
</dates>
</vuln>
<vuln vid="301b04d7-881c-11e5-ab94-002590263bf5">
<topic>xen-tools -- libxl fails to honour readonly flag on disks with qemu-xen</topic>
<affects>
<package>
<name>xen-tools</name>
<range><ge>4.1</ge><lt>4.5.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-142.html">
<p>Callers of libxl can specify that a disk should be read-only to the
guest. However, there is no code in libxl to pass this information
to qemu-xen (the upstream-based qemu); and indeed there is no way in
qemu to make a disk read-only.</p>
<p>The vulnerability is exploitable only via devices emulated by the
device model, not the parallel PV devices for supporting PVHVM.
Normally the PVHVM device unplug protocol renders the emulated
devices inaccessible early in boot.</p>
<p>Malicious guest administrators or (in some situations) users may be
able to write to supposedly read-only disk images.</p>
<p>CDROM devices (that is, devices specified to be presented to the
guest as CDROMs, regardless of the nature of the backing storage on
the host) are not affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7311</cvename>
<url>http://xenbits.xen.org/xsa/advisory-142.html</url>
</references>
<dates>
<discovery>2015-09-22</discovery>
<entry>2015-11-11</entry>
</dates>
</vuln>
<vuln vid="2f7f4db2-8819-11e5-ab94-002590263bf5">
<topic>p5-HTML-Scrubber -- XSS vulnerability</topic>
<affects>
<package>
<name>p5-HTML-Scrubber</name>
<range><lt>0.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5667">
<p>Cross-site scripting (XSS) vulnerability in the HTML-Scrubber
module before 0.15 for Perl, when the comment feature is enabled,
allows remote attackers to inject arbitrary web script or HTML via
a crafted comment.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5667</cvename>
<url>https://metacpan.org/release/HTML-Scrubber</url>
<url>http://jvndb.jvn.jp/jvndb/JVNDB-2015-000171</url>
<url>http://jvn.jp/en/jp/JVN53973084/index.html</url>
</references>
<dates>
<discovery>2015-10-10</discovery>
<entry>2015-11-11</entry>
</dates>
</vuln>
<vuln vid="6ca7eddd-d436-486a-b169-b948436bcf14">
<topic>libvpx -- buffer overflow in vp9_init_context_buffers</topic>
<affects>
<package>
<name>libvpx</name>
<range><lt>1.4.0.488_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/security/advisories/mfsa2015-101/">
<p>Security researcher Khalil Zhani reported that a
maliciously crafted vp9 format video could be used to
trigger a buffer overflow while parsing the file. This leads
to a potentially exploitable crash due to a flaw in the
libvpx library.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4506</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2015-101/</url>
</references>
<dates>
<discovery>2015-09-22</discovery>
<entry>2015-11-10</entry>
</dates>
</vuln>
<vuln vid="56665ccb-8723-11e5-9b13-14dae9d210b8">
<topic>powerdns -- Denial of Service</topic>
<affects>
<package>
<name>powerdns</name>
<range><ge>3.4.4</ge><lt>3.4.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PowerDNS reports:</p>
<blockquote cite="https://doc.powerdns.com/md/security/powerdns-advisory-2015-03/">
<p>A bug was found using afl-fuzz in our packet parsing code.
This bug, when exploited, causes an assertion error and consequent
termination of the the pdns_server process, causing a Denial of Service.</p>
</blockquote>
</body>
</description>
<references>
<url>https://doc.powerdns.com/md/security/powerdns-advisory-2015-03/</url>
<cvename>CVE-2015-5311</cvename>
</references>
<dates>
<discovery>2015-11-03</discovery>
<entry>2015-11-09</entry>
</dates>
</vuln>
<vuln vid="0cb0afd9-86b8-11e5-bf60-080027ef73ec">
<topic>PuTTY -- memory corruption in terminal emulator's erase character handling</topic>
<affects>
<package>
<name>putty</name>
<range><ge>0.54</ge><lt>0.66</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ben Harris reports:</p>
<blockquote cite="http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-ech-overflow.html">
<p>Versions of PuTTY and pterm between 0.54 and 0.65 inclusive have a
potentially memory-corrupting integer overflow in the handling of
the ECH (erase characters) control sequence in the terminal
emulator.</p>
<p>To exploit a vulnerability in the terminal emulator, an attacker
must be able to insert a carefully crafted escape sequence into the
terminal stream. For a PuTTY SSH session, this must be before
encryption, so the attacker likely needs access to the server you're
connecting to. For instance, an attacker on a multi-user machine
that you connect to could trick you into running cat on a file they
control containing a malicious escape sequence. (Unix write(1) is
not a vector for this, if implemented correctly.)</p>
<p>Only PuTTY, PuTTYtel, and pterm are affected; other PuTTY tools do
not include the terminal emulator, so cannot be exploited this
way.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-ech-overflow.html</url>
<cvename>CVE-2015-5309</cvename>
</references>
<dates>
<discovery>2015-11-06</discovery>
<entry>2015-11-09</entry>
</dates>
</vuln>
<vuln vid="18b3c61b-83de-11e5-905b-ac9e174be3af">
<topic>OpenOffice 4.1.1 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>apache-openoffice</name>
<range><lt>4.1.2</lt></range>
</package>
<package>
<name>apache-openoffice-devel</name>
<range><lt>4.2.1705368,3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache OpenOffice Project reports:</p>
<blockquote cite="http://www.openoffice.org/security/cves/CVE-2015-4551.html">
<p>A vulnerability in OpenOffice settings of OpenDocument Format
files and templates allows silent access to files that are
readable from an user account, over-riding the user's default
configuration settings. Once these files are imported into a
maliciously-crafted document, the data can be silently hidden
in the document and possibly exported to an external party
without being observed. </p>
</blockquote>
<p>The Apache OpenOffice Project reports:</p>
<blockquote cite="http://www.openoffice.org/security/cves/CVE-2015-5212.html">
<p>A crafted ODF document can be used to create a buffer that is
too small for the amount of data loaded into it, allowing an
attacker to cause denial of service (memory corruption and
application crash) and possible execution of arbitrary code.</p>
</blockquote>
<p>The Apache OpenOffice Project reports:</p>
<blockquote cite="http://www.openoffice.org/security/cves/CVE-2015-5213.html">
<p>A crafted Microsoft Word DOC file can be used to specify a
document buffer that is too small for the amount of data
provided for it. Failure to detect the discrepancy allows an
attacker to cause denial of service (memory corruption and
application crash) and possible execution of arbitrary code.</p>
</blockquote>
<p>The Apache OpenOffice Project reports:</p>
<blockquote cite="http://www.openoffice.org/security/cves/CVE-2015-5214.html">
<p>A crafted Microsoft Word DOC can contain invalid bookmark
positions leading to memory corruption when the document is
loaded or bookmarks are manipulated. The defect allows an
attacker to cause denial of service (memory corruption and
application crash) and possible execution of arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4551</cvename>
<url>http://www.openoffice.org/security/cves/CVE-2015-4551.html</url>
<cvename>CVE-2015-5212</cvename>
<url>http://www.openoffice.org/security/cves/CVE-2015-5212.html</url>
<cvename>CVE-2015-5213</cvename>
<url>http://www.openoffice.org/security/cves/CVE-2015-5213.html</url>
<cvename>CVE-2015-5214</cvename>
<url>http://www.openoffice.org/security/cves/CVE-2015-5214.html</url>
</references>
<dates>
<discovery>2015-11-04</discovery>
<entry>2015-11-05</entry>
<modified>2015-11-05</modified>
</dates>
</vuln>
<vuln vid="698403a7-803d-11e5-ab94-002590263bf5">
<topic>codeigniter -- multiple vulnerabilities</topic>
<affects>
<package>
<name>codeigniter</name>
<range><lt>2.2.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The CodeIgniter changelog reports:</p>
<blockquote cite="https://codeigniter.com/userguide2/changelog.html">
<p>Fixed an XSS attack vector in Security Library method
xss_clean().</p>
<p>Changed Config Library method base_url() to fallback to
``$_SERVER['SERVER_ADDR']`` in order to avoid Host header
injections.</p>
<p>Changed CAPTCHA Helper to try to use the operating system's PRNG
first.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/203403</freebsdpr>
<url>https://codeigniter.com/userguide2/changelog.html</url>
</references>
<dates>
<discovery>2015-10-31</discovery>
<entry>2015-11-01</entry>
</dates>
</vuln>
<vuln vid="017a493f-7db6-11e5-a762-14dae9d210b8">
<topic>openafs -- information disclosure</topic>
<affects>
<package>
<name>openafs</name>
<range><lt>1.6.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenAFS development team reports:</p>
<blockquote cite="http://openafs.org/pages/security/OPENAFS-SA-2015-007.txt">
<p>When constructing an Rx acknowledgment (ACK) packet, Andrew-derived Rx
implementations do not initialize three octets of data that are padding
in the C language structure and were inadvertently included in the wire
protocol (CVE-2015-7762). Additionally, OpenAFS Rx in versions 1.5.75
through 1.5.78, 1.6.0 through 1.6.14, and 1.7.0 through 1.7.32 include
a variable-length padding at the end of the ACK packet, in an attempt to
detect the path MTU, but only four octets of the additional padding are
initialized (CVE-2015-7763).</p>
</blockquote>
</body>
</description>
<references>
<url>http://openafs.org/pages/security/OPENAFS-SA-2015-007.txt</url>
<cvename>CVE-2015-7762</cvename>
<cvename>CVE-2015-7763</cvename>
</references>
<dates>
<discovery>2015-10-28</discovery>
<entry>2015-10-28</entry>
</dates>
</vuln>
<vuln vid="4b9393b8-7c0c-11e5-a010-080027ddead3">
<topic>xscreensaver - lock bypass</topic>
<affects>
<package>
<name>xscreensaver</name>
<name>xscreensaver-gnome</name>
<name>xscreensaver-gnome-hacks</name>
<range><lt>5.34</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>RedHat bugzilla reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=1274452">
<p>In dual screen configurations, unplugging one screen will cause
xscreensaver to crash, leaving the screen unlocked.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.jwz.org/xscreensaver/changelog.html</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1274452</url>
<cvename>CVE-2015-8025</cvename>
</references>
<dates>
<discovery>2015-10-24</discovery>
<entry>2015-10-27</entry>
<modified>2015-11-04</modified>
</dates>
</vuln>
<vuln vid="2a4a112a-7c1b-11e5-bd77-0800275369e2">
<topic>lldpd -- Buffer overflow/Denial of service</topic>
<affects>
<package>
<name>lldpd</name>
<range><ge>0.5.6</ge><lt>0.7.19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The lldpd developer Vincent Bernat reports:</p>
<blockquote cite="https://github.com/vincentbernat/lldpd/raw/0.7.19/NEWS">
<p>A buffer overflow may allow arbitrary code execution
only if hardening was disabled.</p>
</blockquote>
<blockquote cite="https://github.com/vincentbernat/lldpd/commit/793526f8884455f43daecd0a2c46772388417a00">
<p>Malformed packets should not make lldpd crash. Ensure we can
handle them by not using assert() in this part.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8011</cvename>
<cvename>CVE-2015-8012</cvename>
<url>https://github.com/vincentbernat/lldpd/raw/0.7.19/NEWS</url>
<url>http://www.openwall.com/lists/oss-security/2015/10/30/2</url>
</references>
<dates>
<discovery>2015-10-04</discovery>
<entry>2015-10-26</entry>
<modified>2015-11-10</modified>
</dates>
</vuln>
<vuln vid="24e4d383-7b3e-11e5-a250-68b599b52a02">
<topic>wireshark -- Pcapng file parser crash</topic>
<affects>
<package>
<name>wireshark</name>
<name>wireshark-lite</name>
<name>wireshark-qt5</name>
<name>tshark</name>
<name>tshark-lite</name>
<range><lt>1.12.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Wireshark development team reports:</p>
<blockquote cite="https://www.wireshark.org/docs/relnotes/wireshark-1.12.8.html">
<p>The following vulnerability has been fixed.</p>
<ul>
<li><p>wnpa-sec-2015-30</p>
<p>Pcapng file parser crash. (Bug 11455)</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.wireshark.org/docs/relnotes/wireshark-1.12.8.html</url>
<cvename>CVE-2015-7830</cvename>
</references>
<dates>
<discovery>2015-10-14</discovery>
<entry>2015-10-25</entry>
</dates>
</vuln>
<vuln vid="0ebc6e78-7ac6-11e5-b35a-002590263bf5">
<topic>Joomla! -- Core - SQL Injection/ACL Violation vulnerabilities</topic>
<affects>
<package>
<name>joomla3</name>
<range><ge>3.2.0</ge><lt>3.4.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The JSST and the Joomla! Security Center report:</p>
<blockquote cite="http://developer.joomla.org/security-centre/628-20151001-core-sql-injection.html">
<h2>[20151001] - Core - SQL Injection</h2>
<p>Inadequate filtering of request data leads to a SQL Injection
vulnerability.</p>
</blockquote>
<blockquote cite="http://developer.joomla.org/security-centre/629-20151002-core-acl-violations.html">
<h2>[20151002] - Core - ACL Violations</h2>
<p>Inadequate ACL checks in com_contenthistory provide potential read
access to data which should be access restricted.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7297</cvename>
<cvename>CVE-2015-7857</cvename>
<cvename>CVE-2015-7858</cvename>
<cvename>CVE-2015-7859</cvename>
<url>http://developer.joomla.org/security-centre/628-20151001-core-sql-injection.html</url>
<url>http://developer.joomla.org/security-centre/629-20151002-core-acl-violations.html</url>
<url>https://www.joomla.org/announcements/release-news/5634-joomla-3-4-5-released.html</url>
</references>
<dates>
<discovery>2015-10-22</discovery>
<entry>2015-10-25</entry>
</dates>
</vuln>
<vuln vid="03e54e42-7ac6-11e5-b35a-002590263bf5">
<topic>Joomla! -- Core - ACL Violation vulnerabilities</topic>
<affects>
<package>
<name>joomla3</name>
<range><ge>3.0.0</ge><lt>3.4.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The JSST and the Joomla! Security Center report:</p>
<blockquote cite="http://developer.joomla.org/security-centre/630-20151003-core-acl-violations.html">
<h2>[20151003] - Core - ACL Violations</h2>
<p>Inadequate ACL checks in com_content provide potential read access
to data which should be access restricted.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7899</cvename>
<url>http://developer.joomla.org/security-centre/630-20151003-core-acl-violations.html</url>
<url>https://www.joomla.org/announcements/release-news/5634-joomla-3-4-5-released.html</url>
</references>
<dates>
<discovery>2015-10-22</discovery>
<entry>2015-10-25</entry>
</dates>
</vuln>
<vuln vid="f8c37915-7ac5-11e5-b35a-002590263bf5">
<topic>Joomla! -- Core - XSS Vulnerability</topic>
<affects>
<package>
<name>joomla3</name>
<range><ge>3.4.0</ge><lt>3.4.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The JSST and the Joomla! Security Center report:</p>
<blockquote cite="http://developer.joomla.org/security-centre/626-20150908-core-xss-vulnerability.html">
<h2>[20150908] - Core - XSS Vulnerability</h2>
<p>Inadequate escaping leads to XSS vulnerability in login module.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-6939</cvename>
<url>http://developer.joomla.org/security-centre/626-20150908-core-xss-vulnerability.html</url>
<url>https://www.joomla.org/announcements/release-news/5628-joomla-3-4-4-released.html</url>
</references>
<dates>
<discovery>2015-09-08</discovery>
<entry>2015-10-25</entry>
</dates>
</vuln>
<vuln vid="ec2d1cfd-7ac5-11e5-b35a-002590263bf5">
<topic>Joomla! -- Core - CSRF Protection vulnerabilities</topic>
<affects>
<package>
<name>joomla3</name>
<range><ge>3.2.0</ge><lt>3.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The JSST and the Joomla! Security Center report:</p>
<blockquote cite="http://developer.joomla.org/security-centre/618-20150602-core-remote-code-execution.html">
<h2>[20150602] - Core - CSRF Protection</h2>
<p>Lack of CSRF checks potentially enabled uploading malicious code.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5397</cvename>
<url>http://developer.joomla.org/security-centre/618-20150602-core-remote-code-execution.html</url>
<url>https://www.joomla.org/announcements/release-news/5589-joomla-3-4-2-released.html</url>
</references>
<dates>
<discovery>2015-06-30</discovery>
<entry>2015-10-25</entry>
</dates>
</vuln>
<vuln vid="deaba148-7ac5-11e5-b35a-002590263bf5">
<topic>Joomla! -- Core - Open Redirect vulnerability</topic>
<affects>
<package>
<name>joomla3</name>
<range><ge>3.0.0</ge><lt>3.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The JSST and the Joomla! Security Center report:</p>
<blockquote cite="http://developer.joomla.org/security-centre/617-20150601-core-open-redirect.html">
<h2>[20150601] - Core - Open Redirect</h2>
<p>Inadequate checking of the return value allowed to redirect to an
external page.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5608</cvename>
<url>http://developer.joomla.org/security-centre/617-20150601-core-open-redirect.html</url>
<url>https://www.joomla.org/announcements/release-news/5589-joomla-3-4-2-released.html</url>
</references>
<dates>
<discovery>2015-06-30</discovery>
<entry>2015-10-25</entry>
</dates>
</vuln>
<vuln vid="cec4d01a-7ac5-11e5-b35a-002590263bf5">
<topic>Joomla! -- Core - Remote File Execution/Denial of Service vulnerabilities</topic>
<affects>
<package>
<name>joomla3</name>
<range><lt>3.2.6</lt></range>
<range><ge>3.3.0</ge><lt>3.3.5</lt></range>
</package>
<package>
<name>joomla2</name>
<range><ge>2.5.4</ge><lt>2.5.26</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The JSST and the Joomla! Security Center report:</p>
<blockquote cite="http://developer.joomla.org/security-centre/595-20140903-core-remote-file-inclusion.html">
<h2>[20140903] - Core - Remote File Inclusion</h2>
<p>Inadequate checking allowed the potential for remote files to be
executed.</p>
</blockquote>
<blockquote cite="http://developer.joomla.org/security-centre/596-20140904-core-denial-of-service.html">
<h2>[20140904] - Core - Denial of Service</h2>
<p>Inadequate checking allowed the potential for a denial of service
attack.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-7228</cvename>
<cvename>CVE-2014-7229</cvename>
<url>http://developer.joomla.org/security-centre/595-20140903-core-remote-file-inclusion.html</url>
<url>http://developer.joomla.org/security-centre/596-20140904-core-denial-of-service.html</url>
<url>https://www.joomla.org/announcements/release-news/5567-joomla-3-3-5-released.html</url>
<url>https://www.joomla.org/announcements/release-news/5566-joomla-2-5-26-released.html</url>
</references>
<dates>
<discovery>2014-09-30</discovery>
<entry>2015-10-25</entry>
</dates>
</vuln>
<vuln vid="beb3d5fc-7ac5-11e5-b35a-002590263bf5">
<topic>Joomla! -- Core - Unauthorised Login vulnerability</topic>
<affects>
<package>
<name>joomla3</name>
<range><lt>3.2.5</lt></range>
<range><ge>3.3.0</ge><lt>3.3.4</lt></range>
</package>
<package>
<name>joomla2</name>
<range><lt>2.5.25</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The JSST and the Joomla! Security Center report:</p>
<blockquote cite="http://developer.joomla.org/security-centre/594-20140902-core-unauthorised-logins.html">
<h2>[20140902] - Core - Unauthorised Logins</h2>
<p>Inadequate checking allowed unauthorised logins via LDAP
authentication.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-6632</cvename>
<url>http://developer.joomla.org/security-centre/594-20140902-core-unauthorised-logins.html</url>
<url>https://www.joomla.org/announcements/release-news/5564-joomla-3-3-4-released.html</url>
<url>https://www.joomla.org/announcements/release-news/5563-joomla-2-5-25-released.html</url>
</references>
<dates>
<discovery>2014-09-23</discovery>
<entry>2015-10-25</entry>
</dates>
</vuln>
<vuln vid="adbb32d9-7ac5-11e5-b35a-002590263bf5">
<topic>Joomla! -- Core - XSS Vulnerability</topic>
<affects>
<package>
<name>joomla3</name>
<range><ge>3.2.0</ge><lt>3.2.5</lt></range>
<range><ge>3.3.0</ge><lt>3.3.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The JSST and the Joomla! Security Center report:</p>
<blockquote cite="http://developer.joomla.org/security-centre/593-20140901-core-xss-vulnerability.html">
<h2>[20140901] - Core - XSS Vulnerability</h2>
<p>Inadequate escaping leads to XSS vulnerability in com_media.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-6631</cvename>
<url>http://developer.joomla.org/security-centre/593-20140901-core-xss-vulnerability.html</url>
<url>https://www.joomla.org/announcements/release-news/5564-joomla-3-3-4-released.html</url>
</references>
<dates>
<discovery>2014-09-23</discovery>
<entry>2015-10-25</entry>
</dates>
</vuln>
<vuln vid="75f39413-7a00-11e5-a2a1-002590263bf5">
<topic>drupal -- open redirect vulnerability</topic>
<affects>
<package>
<name>drupal7</name>
<range><lt>7.41</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal development team reports:</p>
<blockquote cite="https://www.drupal.org/SA-CORE-2015-004">
<p>The Overlay module in Drupal core displays administrative pages
as a layer over the current page (using JavaScript), rather than
replacing the page in the browser window. The Overlay module does
not sufficiently validate URLs prior to displaying their contents,
leading to an open redirect vulnerability.</p>
<p>This vulnerability is mitigated by the fact that it can only be
used against site users who have the "Access the administrative
overlay" permission, and that the Overlay module must be enabled.
</p>
<p>An incomplete fix for this issue was released as part of
SA-CORE-2015-002.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7943</cvename>
<url>https://www.drupal.org/SA-CORE-2015-004</url>
<url>http://www.openwall.com/lists/oss-security/2015/10/23/6</url>
</references>
<dates>
<discovery>2015-10-21</discovery>
<entry>2015-10-24</entry>
</dates>
</vuln>
<vuln vid="08d11134-79c5-11e5-8987-6805ca0b3d42">
<topic>phpMyAdmin -- Content spoofing vulnerability</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>4.4.0</ge><lt>4.4.15.1</lt></range>
<range><ge>4.5.0</ge><lt>4.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2015-5/">
<p>This vulnerability allows an attacker to perform a
content spoofing attack using the phpMyAdmin's redirection
mechanism to external sites.</p>
<p>We consider this vulnerability to be non critical since
the spoofed content is escaped and no HTML injection is
possible.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2015-5/</url>
<cvename>CVE-2015-7873</cvename>
</references>
<dates>
<discovery>2015-10-23</discovery>
<entry>2015-10-23</entry>
</dates>
</vuln>
<vuln vid="b973a763-7936-11e5-a2a1-002590263bf5">
<topic>mediawiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mediawiki123</name>
<range><lt>1.23.11</lt></range>
</package>
<package>
<name>mediawiki124</name>
<range><lt>1.24.4</lt></range>
</package>
<package>
<name>mediawiki125</name>
<range><lt>1.25.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MediaWiki reports:</p>
<blockquote cite="https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-October/000181.html">
<p>Wikipedia user RobinHood70 reported two issues in the chunked
upload API. The API failed to correctly stop adding new chunks to
the upload when the reported size was exceeded (T91203), allowing
a malicious users to upload add an infinite number of chunks for a
single file upload. Additionally, a malicious user could upload
chunks of 1 byte for very large files, potentially creating a very
large number of files on the server's filesystem (T91205).</p>
<p>Internal review discovered that it is not possible to throttle file
uploads.</p>
<p>Internal review discovered a missing authorization check when
removing suppression from a revision. This allowed users with the
'viewsuppressed' user right but not the appropriate
'suppressrevision' user right to unsuppress revisions.</p>
<p>Richard Stanway from teamliquid.net reported that thumbnails of PNG
files generated with ImageMagick contained the local file path in
the image metadata.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8001</cvename>
<cvename>CVE-2015-8002</cvename>
<cvename>CVE-2015-8003</cvename>
<cvename>CVE-2015-8004</cvename>
<cvename>CVE-2015-8005</cvename>
<cvename>CVE-2015-8006</cvename>
<cvename>CVE-2015-8007</cvename>
<cvename>CVE-2015-8008</cvename>
<cvename>CVE-2015-8009</cvename>
<url>https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-October/000181.html</url>
<url>https://phabricator.wikimedia.org/T91203</url>
<url>https://phabricator.wikimedia.org/T91205</url>
<url>https://phabricator.wikimedia.org/T91850</url>
<url>https://phabricator.wikimedia.org/T95589</url>
<url>https://phabricator.wikimedia.org/T108616</url>
<url>http://www.openwall.com/lists/oss-security/2015/10/29/14</url>
</references>
<dates>
<discovery>2015-10-16</discovery>
<entry>2015-10-23</entry>
<modified>2015-12-24</modified>
</dates>
</vuln>
<vuln vid="c4a18a12-77fc-11e5-a687-206a8a720317">
<topic>ntp -- 13 low- and medium-severity vulnerabilities</topic>
<affects>
<package>
<name>ntp</name>
<range><lt>4.2.8p4</lt></range>
</package>
<package>
<name>ntp-devel</name>
<range><lt>4.3.76</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ntp.org reports:</p>
<blockquote cite="http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities">
<p>NTF's NTP Project has been notified of the following 13 low-
and medium-severity vulnerabilities that are fixed in
ntp-4.2.8p4, released on Wednesday, 21 October 2015:</p>
<ul>
<li>Bug 2941 CVE-2015-7871 NAK to the Future: Symmetric
association authentication bypass via crypto-NAK
(Cisco ASIG)</li>
<li>Bug 2922 CVE-2015-7855 decodenetnum() will ASSERT botch
instead of returning FAIL on some bogus values (IDA)</li>
<li>Bug 2921 CVE-2015-7854 Password Length Memory Corruption
Vulnerability. (Cisco TALOS)</li>
<li>Bug 2920 CVE-2015-7853 Invalid length data provided by a
custom refclock driver could cause a buffer overflow.
(Cisco TALOS)</li>
<li>Bug 2919 CVE-2015-7852 ntpq atoascii() Memory Corruption
Vulnerability. (Cisco TALOS)</li>
<li>Bug 2918 CVE-2015-7851 saveconfig Directory Traversal
Vulnerability. (OpenVMS) (Cisco TALOS)</li>
<li>Bug 2917 CVE-2015-7850 remote config logfile-keyfile.
(Cisco TALOS)</li>
<li>Bug 2916 CVE-2015-7849 trusted key use-after-free.
(Cisco TALOS)</li>
<li>Bug 2913 CVE-2015-7848 mode 7 loop counter underrun.
(Cisco TALOS)</li>
<li>Bug 2909 CVE-2015-7701 Slow memory leak in CRYPTO_ASSOC.
(Tenable)</li>
<li>Bug 2902 : CVE-2015-7703 configuration directives "pidfile"
and "driftfile" should only be allowed locally. (RedHat)</li>
<li>Bug 2901 : CVE-2015-7704, CVE-2015-7705 Clients that
receive a KoD should validate the origin timestamp field.
(Boston University)</li>
<li>Bug 2899 : CVE-2015-7691, CVE-2015-7692, CVE-2015-7702
Incomplete autokey data packet length checks. (Tenable)</li>
</ul>
<p>The only generally-exploitable bug in the above list is the
crypto-NAK bug, which has a CVSS2 score of 6.4.</p>
<p>Additionally, three bugs that have already been fixed in
ntp-4.2.8 but were not fixed in ntp-4.2.6 as it was EOL'd
have a security component, but are all below 1.8 CVSS score,
so we're reporting them here:</p>
<ul>
<li>Bug 2382 : Peer precision &lt; -31 gives division by zero</li>
<li>Bug 1774 : Segfaults if cryptostats enabled when built
without OpenSSL</li>
<li>Bug 1593 : ntpd abort in free() with logconfig syntax error</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7691</cvename>
<cvename>CVE-2015-7692</cvename>
<cvename>CVE-2015-7701</cvename>
<cvename>CVE-2015-7702</cvename>
<cvename>CVE-2015-7703</cvename>
<cvename>CVE-2015-7704</cvename>
<cvename>CVE-2015-7705</cvename>
<cvename>CVE-2015-7848</cvename>
<cvename>CVE-2015-7849</cvename>
<cvename>CVE-2015-7850</cvename>
<cvename>CVE-2015-7851</cvename>
<cvename>CVE-2015-7852</cvename>
<cvename>CVE-2015-7853</cvename>
<cvename>CVE-2015-7854</cvename>
<cvename>CVE-2015-7855</cvename>
<cvename>CVE-2015-7871</cvename>
<url>http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities</url>
</references>
<dates>
<discovery>2015-10-21</discovery>
<entry>2015-10-21</entry>
<modified>2015-10-23</modified>
</dates>
</vuln>
<vuln vid="95602550-76cf-11e5-a2a1-002590263bf5">
<topic>codeigniter -- multiple XSS vulnerabilities</topic>
<affects>
<package>
<name>codeigniter</name>
<range><lt>2.2.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The CodeIgniter changelog reports:</p>
<blockquote cite="https://codeigniter.com/userguide2/changelog.html">
<p>Fixed a number of XSS attack vectors in Security Library method
xss_clean (thanks to Frans Rosén from Detectify.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/203403</freebsdpr>
<url>https://codeigniter.com/userguide2/changelog.html</url>
</references>
<dates>
<discovery>2015-10-08</discovery>
<entry>2015-10-20</entry>
</dates>
</vuln>
<vuln vid="7f645ee5-7681-11e5-8519-005056ac623e">
<topic>Git -- Execute arbitrary code</topic>
<affects>
<package>
<name>git</name>
<range><lt>2.6.1</lt></range>
</package>
<package>
<name>git-gui</name>
<range><lt>2.6.1</lt></range>
</package>
<package>
<name>git-lite</name>
<range><lt>2.6.1</lt></range>
</package>
<package>
<name>git-subversion</name>
<range><lt>2.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Git release notes:</p>
<blockquote cite="https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.6.1.txt">
<p>Some protocols (like git-remote-ext) can execute arbitrary code
found in the URL. The URLs that submodules use may come from
arbitrary sources (e.g., .gitmodules files in a remote
repository), and can hurt those who blindly enable recursive
fetch. Restrict the allowed protocols to well known and safe
ones.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7545</cvename>
<url>https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.6.1.txt</url>
<url>http://www.openwall.com/lists/oss-security/2015/12/11/7</url>
</references>
<dates>
<discovery>2015-09-23</discovery>
<entry>2015-10-19</entry>
<modified>2015-12-12</modified>
</dates>
</vuln>
<vuln vid="3934cc60-f0fa-4eca-be09-c8bd7ae42871">
<topic>Salt -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py27-salt</name>
<range><lt>2015.8.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Salt release notes:</p>
<blockquote cite="https://docs.saltstack.com/en/latest/topics/releases/2015.8.1.html">
<p>CVE-2015-6918 - Git modules leaking HTTPS auth credentials to debug log</p>
<p>Updated the Git state and execution modules to no longer display HTTPS basic
authentication credentials in loglevel debug output on the Salt master. These
credentials are now replaced with REDACTED in the debug output. Thanks to
Andreas Stieger for bringing this to our attention.</p>
<p>CVE-2015-6941 - win_useradd module and salt-cloud display passwords in debug
log</p>
<p>Updated the win_useradd module return data to no longer include the password
of the newly created user. The password is now replaced with the string
XXX-REDACTED-XXX. Updated the Salt Cloud debug output to no longer display
win_password and sudo_password authentication credentials. Also updated the
Linode driver to no longer display authentication credentials in debug logs.
These credentials are now replaced with REDACTED in the debug output.</p>
</blockquote>
</body>
</description>
<references>
<url>https://docs.saltstack.com/en/latest/topics/releases/2015.8.1.html</url>
<cvename>CVE-2015-6918</cvename>
<cvename>CVE-2015-6941</cvename>
</references>
<dates>
<discovery>2015-10-16</discovery>
<entry>2015-10-17</entry>
</dates>
</vuln>
<vuln vid="79c68ef7-c8ae-4ade-91b4-4b8221b7c72a">
<topic>firefox -- Cross-origin restriction bypass using Fetch</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>41.0.2,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>41.0.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Firefox Developers report:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2015-115/">
<p>Security researcher Abdulrahman Alqabandi reported that the fetch()
API did not correctly implement the Cross-Origin Resource Sharing
(CORS) specification, allowing a malicious page to access private
data from other origins. Mozilla developer Ben Kelly independently reported the
same issue.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-115/</url>
<cvename>CVE-2015-7184</cvename>
</references>
<dates>
<discovery>2015-10-15</discovery>
<entry>2015-10-16</entry>
</dates>
</vuln>
<vuln vid="84147b46-e876-486d-b746-339ee45a8bb9">
<topic>flash -- remote code execution</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<name>linux-f10-flashplugin</name>
<name>linux-c6_64-flashplugin</name>
<range><lt>11.2r202.540</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-27.html">
<p>These updates resolve type confusion vulnerabilities that
could lead to code execution (CVE-2015-7645, CVE-2015-7647,
CVE-2015-7648).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7645</cvename>
<cvename>CVE-2015-7647</cvename>
<cvename>CVE-2015-7648</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb15-27.html</url>
</references>
<dates>
<discovery>2015-10-16</discovery>
<entry>2015-10-16</entry>
</dates>
</vuln>
<vuln vid="e75a96df-73ca-11e5-9b45-b499baebfeaf">
<topic>LibreSSL -- Memory leak and buffer overflow</topic>
<affects>
<package>
<name>libressl</name>
<range><lt>2.2.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Qualys reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/10/16/1">
<p>During the code review of OpenSMTPD a memory leak and buffer overflow
(an off-by-one, usually stack-based) were discovered in LibreSSL's
OBJ_obj2txt() function. This function is called automatically during
a TLS handshake (both client-side, unless an anonymous mode is used,
and server-side, if client authentication is requested).</p>
</blockquote>
</body>
</description>
<references>
<url>http://marc.info/?l=openbsd-announce&amp;m=144495690528446</url>
<cvename>CVE-2015-5333</cvename>
<cvename>CVE-2015-5334</cvename>
</references>
<dates>
<discovery>2015-10-15</discovery>
<entry>2015-10-16</entry>
<modified>2015-10-26</modified>
</dates>
</vuln>
<vuln vid="07a1a76c-734b-11e5-ae81-14dae9d210b8">
<topic>mbedTLS/PolarSSL -- DoS and possible remote code execution</topic>
<affects>
<package>
<name>polarssl</name>
<range><ge>1.2.0</ge><lt>1.2.17</lt></range>
</package>
<package>
<name>polarssl13</name>
<range><ge>1.3.0</ge><lt>1.3.14</lt></range>
</package>
<package>
<name>mbedtls</name>
<range><lt>2.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ARM Limited reports:</p>
<blockquote cite="https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2015-01">
<p>When the client creates its ClientHello message, due to
insufficient bounds checking it can overflow the heap-based buffer
containing the message while writing some extensions. Two extensions in
particular could be used by a remote attacker to trigger the overflow:
the session ticket extension and the server name indication (SNI)
extension.</p>
</blockquote>
</body>
</description>
<references>
<url>https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2015-01</url>
<cvename>CVE-2015-5291</cvename>
</references>
<dates>
<discovery>2015-10-05</discovery>
<entry>2015-10-15</entry>
</dates>
</vuln>
<vuln vid="ea1d2530-72ce-11e5-a2a1-002590263bf5">
<topic>magento -- multiple vulnerabilities</topic>
<affects>
<package>
<name>magento</name>
<range><lt>1.9.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Magento, Inc. reports:</p>
<blockquote cite="https://www.magentocommerce.com/download">
<p>SUPEE-6482 - This patch addresses two issues related to APIs and
two cross-site scripting risks.</p>
<p>SUPEE-6285 - This patch provides protection against several types
of security-related issues, including information leaks, request
forgeries, and cross-site scripting.</p>
<p>SUPEE-5994 - This patch addresses multiple security
vulnerabilities in Magento Community Edition software, including
issues that can put customer information at risk.</p>
<p>SUPEE-5344 - Addresses a potential remote code execution
exploit.</p>
<p>SUPEE-1533 - Addresses two potential remote code execution
exploits.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/201709</freebsdpr>
<url>https://www.magentocommerce.com/download</url>
<url>http://merch.docs.magento.com/ce/user_guide/Magento_Community_Edition_User_Guide.html#magento/release-notes-ce-1.9.2.html</url>
<url>http://merch.docs.magento.com/ce/user_guide/Magento_Community_Edition_User_Guide.html#magento/release-notes-ce-1.9.2.1.html</url>
</references>
<dates>
<discovery>2014-10-03</discovery>
<entry>2015-10-14</entry>
</dates>
</vuln>
<vuln vid="705b759c-7293-11e5-a371-14dae9d210b8">
<topic>pear-twig -- remote code execution</topic>
<affects>
<package>
<name>pear-twig-twig</name>
<range><lt>1.20.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Fabien Potencier reports:</p>
<blockquote cite="http://symfony.com/blog/security-release-twig-1-20-0">
<p>End users can craft valid Twig code that allows them to
execute arbitrary code (RCEs) via the _self variable, which is always
available, even in sandboxed templates.</p>
</blockquote>
</body>
</description>
<references>
<url>http://symfony.com/blog/security-release-twig-1-20-0</url>
<cvename>CVE-2015-7809</cvename>
</references>
<dates>
<discovery>2015-08-12</discovery>
<entry>2015-10-14</entry>
</dates>
</vuln>
<vuln vid="06fefd2f-728f-11e5-a371-14dae9d210b8">
<topic>miniupnpc -- buffer overflow</topic>
<affects>
<package>
<name>miniupnpc</name>
<range><ge>1.9.1</ge><lt>1.9.20150917</lt></range>
<range><lt>1.9_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Talos reports:</p>
<blockquote cite="http://talosintel.com/reports/TALOS-2015-0035/">
<p>An exploitable buffer overflow vulnerability exists in the
XML parser functionality of the MiniUPnP library. A specially crafted
XML response can lead to a buffer overflow on the stack resulting in
remote code execution. An attacker can set up a server on the local
network to trigger this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-6031</cvename>
<url>http://talosintel.com/reports/TALOS-2015-0035/</url>
<url>https://github.com/miniupnp/miniupnp/commit/79cca974a4c2ab1199786732a67ff6d898051b78</url>
</references>
<dates>
<discovery>2015-09-15</discovery>
<entry>2015-10-14</entry>
<modified>2015-10-14</modified>
</dates>
</vuln>
<vuln vid="a63f2c06-726b-11e5-a12b-bcaec565249c">
<topic>flash -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<name>linux-f10-flashplugin</name>
<name>linux-c6_64-flashplugin</name>
<range><lt>11.2r202.535</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-25.html">
<p>These updates resolve a vulnerability that could be exploited
to bypass the same-origin-policy and lead to information
disclosure (CVE-2015-7628).</p>
<p>These updates include a defense-in-depth feature in the Flash
broker API (CVE-2015-5569).</p>
<p>These updates resolve use-after-free vulnerabilities that
could lead to code execution (CVE-2015-7629, CVE-2015-7631,
CVE-2015-7643, CVE-2015-7644).</p>
<p>These updates resolve a buffer overflow vulnerability that
could lead to code execution (CVE-2015-7632).</p>
<p>These updates resolve memory corruption vulnerabilities that
could lead to code execution (CVE-2015-7625, CVE-2015-7626,
CVE-2015-7627, CVE-2015-7630, CVE-2015-7633, CVE-2015-7634).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5569</cvename>
<cvename>CVE-2015-7625</cvename>
<cvename>CVE-2015-7626</cvename>
<cvename>CVE-2015-7627</cvename>
<cvename>CVE-2015-7628</cvename>
<cvename>CVE-2015-7629</cvename>
<cvename>CVE-2015-7630</cvename>
<cvename>CVE-2015-7631</cvename>
<cvename>CVE-2015-7632</cvename>
<cvename>CVE-2015-7633</cvename>
<cvename>CVE-2015-7634</cvename>
<cvename>CVE-2015-7643</cvename>
<cvename>CVE-2015-7644</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb15-25.html</url>
</references>
<dates>
<discovery>2015-10-13</discovery>
<entry>2015-10-14</entry>
</dates>
</vuln>
<vuln vid="8301c04d-71df-11e5-9fcb-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<!--pcbsd-->
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>46.0.2490.71</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2015/10/stable-channel-update.html">
<p>24 security fixes in this release, including:</p>
<ul>
<li>[519558] High CVE-2015-6755: Cross-origin bypass in Blink.
Credit to Mariusz Mlynski.</li>
<li>[507316] High CVE-2015-6756: Use-after-free in PDFium. Credit
to anonymous.</li>
<li>[529520] High CVE-2015-6757: Use-after-free in ServiceWorker.
Credit to Collin Payne.</li>
<li>[522131] High CVE-2015-6758: Bad-cast in PDFium. Credit to Atte
Kettunen of OUSPG.</li>
<li>[514076] Medium CVE-2015-6759: Information leakage in
LocalStorage. Credit to Muneaki Nishimura (nishimunea).</li>
<li>[519642] Medium CVE-2015-6760: Improper error handling in
libANGLE. Credit to lastland.net.</li>
<li>[447860,532967] Medium CVE-2015-6761: Memory corruption in
FFMpeg. Credit to Aki Helin of OUSPG and anonymous.</li>
<li>[512678] Low CVE-2015-6762: CORS bypass via CSS fonts. Credit
to Muneaki Nishimura (nishimunea).</li>
<li> [542517] CVE-2015-6763: Various fixes from internal audits,
fuzzing and other initiatives.</li>
<li>Multiple vulnerabilities in V8 fixed at the tip of the 4.6
branch (currently 4.6.85.23).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-6755</cvename>
<cvename>CVE-2015-6756</cvename>
<cvename>CVE-2015-6757</cvename>
<cvename>CVE-2015-6758</cvename>
<cvename>CVE-2015-6759</cvename>
<cvename>CVE-2015-6760</cvename>
<cvename>CVE-2015-6761</cvename>
<cvename>CVE-2015-6762</cvename>
<cvename>CVE-2015-6763</cvename>
<url>http://googlechromereleases.blogspot.nl/2015/10/stable-channel-update.html</url>
</references>
<dates>
<discovery>2015-10-13</discovery>
<entry>2015-10-13</entry>
</dates>
</vuln>
<vuln vid="00dadbf0-6f61-11e5-a2a1-002590263bf5">
<topic>p5-UI-Dialog -- shell command execution vulnerability</topic>
<affects>
<package>
<name>p5-UI-Dialog</name>
<range><lt>1.09_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matthijs Kooijman reports:</p>
<blockquote cite="https://rt.cpan.org/Public/Bug/Display.html?id=107364">
<p>It seems that the whiptail, cdialog and kdialog backends apply
some improper escaping in their shell commands, causing special
characters present in menu item titles to be interpreted by the
shell. This includes the backtick evaluation operator, so this
constitutues a security issue, allowing execution of arbitrary
commands if an attacker has control over the text displayed in
a menu.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-7315</cvename>
<freebsdpr>ports/203667</freebsdpr>
<url>https://rt.cpan.org/Public/Bug/Display.html?id=107364</url>
<url>https://bugs.debian.org/496448</url>
<url>https://github.com/kckrinke/UI-Dialog/commit/6adc44cc636c615d76297d86835e1a997681eb61</url>
</references>
<dates>
<discovery>2008-08-24</discovery>
<entry>2015-10-10</entry>
</dates>
</vuln>
<vuln vid="290351c9-6f5c-11e5-a2a1-002590263bf5">
<topic>devel/ipython -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ipython</name>
<range><lt>3.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matthias Bussonnier reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/02/3">
<p>Summary: Local folder name was used in HTML templates without
escaping, allowing XSS in said pages by carefully crafting folder
name and URL to access it.</p>
<p>URI with issues:</p>
<ul>
<li>GET /tree/**</li>
</ul>
</blockquote>
<p>Benjamin RK reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/16/3">
<p>Vulnerability: A maliciously forged file opened for editing can
execute javascript, specifically by being redirected to /files/ due
to a failure to treat the file as plain text.</p>
<p>URI with issues:</p>
<ul>
<li>GET /edit/**</li>
</ul>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/203668</freebsdpr>
<cvename>CVE-2015-6938</cvename>
<cvename>CVE-2015-7337</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/09/02/3</url>
<url>https://github.com/ipython/ipython/commit/3ab41641cf6fce3860c73d5cf4645aa12e1e5892</url>
<url>http://www.openwall.com/lists/oss-security/2015/09/16/3</url>
<url>https://github.com/ipython/ipython/commit/0a8096adf165e2465550bd5893d7e352544e5967</url>
</references>
<dates>
<discovery>2015-09-01</discovery>
<entry>2015-10-10</entry>
</dates>
</vuln>
<vuln vid="a0182578-6e00-11e5-a90c-0026551a22dc">
<topic>PostgreSQL -- minor security problems.</topic>
<affects>
<package>
<name>postgresql90-server</name>
<range><ge>9.0.0</ge><lt>9.0.22</lt></range>
</package>
<package>
<name>postgresql91-server</name>
<range><ge>9.1.0</ge><lt>9.1.18</lt></range>
</package>
<package>
<name>postgresql92-server</name>
<range><ge>9.2.0</ge><lt>9.2.13</lt></range>
</package>
<package>
<name>postgresql93-server</name>
<range><ge>9.3.0</ge><lt>9.3.9</lt></range>
</package>
<package>
<name>postgresql94-server</name>
<range><ge>9.4.0</ge><lt>9.4.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PostgreSQL project reports:</p>
<blockquote cite="http://www.postgresql.org/about/news/1615/">
<p>
Two security issues have been fixed in this release which affect
users of specific PostgreSQL features.
</p>
<ul>
<li>CVE-2015-5289 json or jsonb input values constructed from
arbitrary user input can crash the PostgreSQL server and cause a denial of
service.
</li>
<li>CVE-2015-5288: The crypt() function included with the optional pgCrypto
extension could be exploited to read a few additional bytes of memory.
No working exploit for this issue has been developed.
</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5289</cvename>
<cvename>CVE-2015-5288</cvename>
</references>
<dates>
<discovery>2015-10-08</discovery>
<entry>2015-10-08</entry>
</dates>
</vuln>
<vuln vid="d3324fdb-6bf0-11e5-bc5e-00505699053e">
<topic>ZendFramework1 -- SQL injection vulnerability</topic>
<affects>
<package>
<name>ZendFramework1</name>
<range><lt>1.12.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Zend Framework developers report:</p>
<blockquote cite="http://framework.zend.com/security/advisory/ZF2015-08">
<p>The PDO adapters of Zend Framework 1 do not filter null bytes values
in SQL statements. A PDO adapter can treat null bytes in a query as a
string terminator, allowing an attacker to add arbitrary SQL
following a null byte, and thus create a SQL injection.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7695</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/09/30/6</url>
<url>http://framework.zend.com/security/advisory/ZF2015-08</url>
</references>
<dates>
<discovery>2015-09-15</discovery>
<entry>2015-10-06</entry>
<modified>2015-10-12</modified>
</dates>
</vuln>
<vuln vid="42852f72-6bd3-11e5-9909-002590263bf5">
<topic>OpenSMTPD -- multiple vulnerabilities</topic>
<affects>
<package>
<name>opensmtpd</name>
<range><lt>5.7.3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSMTPD developers report:</p>
<blockquote cite="https://www.opensmtpd.org/announces/release-5.7.3.txt">
<p>fix an mda buffer truncation bug which allows a user to create
forward files that pass session checks but fail delivery later down
the chain, within the user mda</p>
<p>fix remote buffer overflow in unprivileged pony process</p>
<p>reworked offline enqueue to better protect against hardlink
attacks</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2015/10/04/2</url>
<url>https://www.opensmtpd.org/announces/release-5.7.3.txt</url>
</references>
<dates>
<discovery>2015-10-04</discovery>
<entry>2015-10-06</entry>
</dates>
</vuln>
<vuln vid="5d280761-6bcf-11e5-9909-002590263bf5">
<topic>mbedTLS/PolarSSL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>polarssl</name>
<range><ge>1.2.0</ge><lt>1.2.16</lt></range>
</package>
<package>
<name>polarssl13</name>
<range><ge>1.3.0</ge><lt>1.3.13</lt></range>
</package>
<package>
<name>mbedtls</name>
<range><lt>2.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ARM Limited reports:</p>
<blockquote cite="https://tls.mbed.org/tech-updates/releases/mbedtls-2.1.1-and-1.3.13-and-polarssl-1.2.16-released">
<p>Florian Weimar from Red Hat published on Lenstra's RSA-CRT attach
for PKCS#1 v1.5 signatures. These releases include countermeasures
against that attack.</p>
<p>Fabian Foerg of Gotham Digital Science found a possible client-side
NULL pointer dereference, using the AFL Fuzzer. This dereference can
only occur when misusing the API, although a fix has still been
implemented.</p>
</blockquote>
</body>
</description>
<references>
<url>https://tls.mbed.org/tech-updates/releases/mbedtls-2.1.1-and-1.3.13-and-polarssl-1.2.16-released</url>
</references>
<dates>
<discovery>2015-09-18</discovery>
<entry>2015-10-06</entry>
</dates>
</vuln>
<vuln vid="953aaa57-6bce-11e5-9909-002590263bf5">
<topic>mbedTLS/PolarSSL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>polarssl</name>
<range><ge>1.2.0</ge><lt>1.2.15</lt></range>
</package>
<package>
<name>polarssl13</name>
<range><ge>1.3.0</ge><lt>1.3.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ARM Limited reports:</p>
<blockquote cite="https://tls.mbed.org/tech-updates/releases/polarssl-1.2.15-and-mbedtls-1.3.12-released">
<p>In order to strengthen the minimum requirements for connections and
to protect against the Logjam attack, the minimum size of
Diffie-Hellman parameters accepted by the client has been increased
to 1024 bits.</p>
<p>In addition the default size for the Diffie-Hellman parameters on
the server are increased to 2048 bits. This can be changed with
ssl_set_dh_params() in case this is necessary.</p>
</blockquote>
</body>
</description>
<references>
<url>https://tls.mbed.org/tech-updates/releases/polarssl-1.2.15-and-mbedtls-1.3.12-released</url>
</references>
<dates>
<discovery>2015-08-11</discovery>
<entry>2015-10-06</entry>
</dates>
</vuln>
<vuln vid="9272a5b0-6b40-11e5-bd7f-bcaec565249c">
<topic>gdk-pixbuf2 -- head overflow and DoS</topic>
<affects>
<package>
<name>gdk-pixbuf2</name>
<range><lt>2.32.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/10/02/9">
<p>We found a heap overflow and a DoS in the gdk-pixbuf
implementation triggered by the scaling of tga file.</p>
</blockquote>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/10/02/10">
<p>We found a heap overflow in the gdk-pixbuf implementation
triggered by the scaling of gif file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7673</cvename>
<cvename>CVE-2015-7674</cvename>
<url>https://mail.gnome.org/archives/ftp-release-list/2015-September/msg00201.html</url>
<url>https://mail.gnome.org/archives/ftp-release-list/2015-September/msg00287.html</url>
<url>http://www.openwall.com/lists/oss-security/2015/10/02/9</url>
<url>http://www.openwall.com/lists/oss-security/2015/10/02/10</url>
</references>
<dates>
<discovery>2015-10-02</discovery>
<entry>2015-10-05</entry>
</dates>
</vuln>
<vuln vid="6b3374d4-6b0b-11e5-9909-002590263bf5">
<topic>plone -- multiple vulnerabilities</topic>
<affects>
<package>
<name>plone</name>
<range><lt>4.3.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Plone.org reports:</p>
<blockquote cite="https://plone.org/products/plone/security/advisories/20150910-announcement">
<p>Versions Affected: All current Plone versions.</p>
<p>Versions Not Affected: None.</p>
<p>Nature of vulnerability: Allows creation of members by anonymous
users on sites that have self-registration enabled, allowing bypass
of CAPTCHA and similar protections against scripted attacks.</p>
<p>The patch can be added to buildouts as Products.PloneHotfix20150910
(available from PyPI) or downloaded from Plone.org.</p>
<p>Immediate Measures You Should Take: Disable self-registration until
you have applied the patch.</p>
</blockquote>
<blockquote cite="https://plone.org/security/20150910/non-persistent-xss-in-plone">
<p>Plone's URL checking infrastructure includes a method for checking
if URLs valid and located in the Plone site. By passing HTML into
this specially crafted url, XSS can be achieved.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/203255</freebsdpr>
<url>https://plone.org/products/plone-hotfix/releases/20150910</url>
<url>https://plone.org/products/plone/security/advisories/20150910-announcement</url>
<url>https://plone.org/security/20150910/non-persistent-xss-in-plone</url>
<url>https://github.com/plone/Products.CMFPlone/commit/3da710a2cd68587f0bf34f2e7ea1167d6eeee087</url>
</references>
<dates>
<discovery>2015-09-10</discovery>
<entry>2015-10-05</entry>
</dates>
</vuln>
<vuln vid="c1da8b75-6aef-11e5-9909-002590263bf5">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php5-phar</name>
<range><le>5.4.45</le></range>
</package>
<package>
<name>php55-phar</name>
<range><lt>5.5.30</lt></range>
</package>
<package>
<name>php56-phar</name>
<range><lt>5.6.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PHP reports:</p>
<blockquote cite="http://php.net/ChangeLog-5.php#5.5.30">
<p>Phar:</p>
<ul>
<li>Fixed bug #69720 (Null pointer dereference in
phar_get_fp_offset()).</li>
<li>Fixed bug #70433 (Uninitialized pointer in phar_make_dirstream
when zip entry filename is "/").</li>
</ul>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/203541</freebsdpr>
<cvename>CVE-2015-7803</cvename>
<cvename>CVE-2015-7804</cvename>
<url>http://php.net/ChangeLog-5.php#5.5.30</url>
<url>http://php.net/ChangeLog-5.php#5.6.14</url>
</references>
<dates>
<discovery>2015-10-01</discovery>
<entry>2015-10-04</entry>
<modified>2015-10-12</modified>
</dates>
</vuln>
<vuln vid="ee7bdf7f-11bb-4eea-b054-c692ab848c20">
<topic>OpenSMTPD -- multiple vulnerabilities</topic>
<affects>
<package>
<name>opensmtpd</name>
<range><lt>5.7.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSMTPD developers report:</p>
<blockquote cite="https://www.opensmtpd.org/announces/release-5.7.2.txt">
<p>an oversight in the portable version of fgetln() that allows
attackers to read and write out-of-bounds memory</p>
<p>multiple denial-of-service vulnerabilities that allow local users
to kill or hang OpenSMTPD</p>
<p>a stack-based buffer overflow that allows local users to crash
OpenSMTPD, or execute arbitrary code as the non-chrooted _smtpd
user</p>
<p>a hardlink attack (or race-conditioned symlink attack) that allows
local users to unset the chflags() of arbitrary files</p>
<p>a hardlink attack that allows local users to read the first line of
arbitrary files (for example, root's hash from /etc/master.passwd)
</p>
<p>a denial-of-service vulnerability that allows remote attackers to
fill OpenSMTPD's queue or mailbox hard-disk partition</p>
<p>an out-of-bounds memory read that allows remote attackers to crash
OpenSMTPD, or leak information and defeat the ASLR protection</p>
<p>a use-after-free vulnerability that allows remote attackers to
crash OpenSMTPD, or execute arbitrary code as the non-chrooted
_smtpd user</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.opensmtpd.org/announces/release-5.7.2.txt</url>
<cvename>CVE-2015-7687</cvename>
</references>
<dates>
<discovery>2015-10-02</discovery>
<entry>2015-10-04</entry>
<modified>2015-10-06</modified>
</dates>
</vuln>
<vuln vid="be3069c9-67e7-11e5-9909-002590263bf5">
<topic>james -- multiple vulnerabilities</topic>
<affects>
<package>
<name>james</name>
<range><lt>2.3.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache James Project reports:</p>
<blockquote cite="http://james.apache.org/download.cgi#Apache_James_Server">
<p>This release has many enhancements and bug fixes over the previous
release. See the Release Notes for a detailed list of changes. Some
of the earlier defects could turn a James mail server into an Open
Relay and allow files to be written on disk. All users of James
Server are urged to upgrade to version v2.3.2.1 as soon as
possible.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/203461</freebsdpr>
<certvu>988628</certvu>
<cvename>CVE-2015-7611</cvename>
<url>http://james.apache.org/download.cgi#Apache_James_Server</url>
<url>https://blogs.apache.org/james/entry/apache_james_server_2_3</url>
</references>
<dates>
<discovery>2015-09-30</discovery>
<entry>2015-10-01</entry>
<modified>2015-10-04</modified>
</dates>
</vuln>
<vuln vid="1e7f0c11-673a-11e5-98c8-60a44c524f57">
<topic>otrs -- Scheduler Process ID File Access</topic>
<affects>
<package>
<name>otrs</name>
<range><gt>3.2.*</gt><lt>3.2.18</lt></range>
<range><gt>3.3.*</gt><lt>3.3.15</lt></range>
<range><gt>4.0.*</gt><lt>4.0.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OTRS project reports:</p>
<blockquote cite="https://www.otrs.com/security-advisory-2015-02-scheduler-process-id-file-access/">
<p>An attacker with valid LOCAL credentials could access and
manipulate the process ID file for bin/otrs.schduler.pl from the
CLI.</p>
<p>The Proc::Daemon module 0.14 for Perl uses world-writable
permissions for a file that stores a process ID, which allows local
users to have an unspecified impact by modifying this file.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.otrs.com/security-advisory-2015-02-scheduler-process-id-file-access/</url>
<cvename>CVE-2015-6842</cvename>
<cvename>CVE-2013-7135</cvename>
</references>
<dates>
<discovery>2015-09-17</discovery>
<entry>2015-09-30</entry>
</dates>
</vuln>
<vuln vid="4e3e8a50-65c1-11e5-948e-bcaec565249c">
<topic>flash -- multiple vulnabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<name>linux-f10-flashplugin</name>
<name>linux-c6_64-flashplugin</name>
<range><lt>11.2r202.521</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-23.html">
<p>These updates resolve a type confusion vulnerability that could
lead to code execution (CVE-2015-5573).</p>
<p>These updates resolve use-after-free vulnerabilities that could
lead to code execution (CVE-2015-5570, CVE-2015-5574, CVE-2015-5581, CVE-2015-5584, CVE-2015-6682).</p>
<p>These updates resolve buffer overflow vulnerabilities that could
lead to code execution (CVE-2015-6676, CVE-2015-6678).</p>
<p>These updates resolve memory corruption vulnerabilities that
could lead to code execution (CVE-2015-5575, CVE-2015-5577,
CVE-2015-5578, CVE-2015-5580, CVE-2015-5582, CVE-2015-5588,
CVE-2015-6677).</p>
<p>These updates include additional validation checks to ensure
that Flash Player rejects malicious content from vulnerable
JSONP callback APIs (CVE-2015-5571).</p>
<p>These updates resolve a memory leak vulnerability
(CVE-2015-5576).</p>
<p>These updates include further hardening to a mitigation to
defend against vector length corruptions (CVE-2015-5568).</p>
<p>These updates resolve stack corruption vulnerabilities that
could lead to code execution (CVE-2015-5567, CVE-2015-5579).</p>
<p>These updates resolve a stack overflow vulnerability that could
lead to code execution (CVE-2015-5587).</p>
<p>These updates resolve a security bypass vulnerability that could
lead to information disclosure (CVE-2015-5572).</p>
<p>These updates resolve a vulnerability that could be exploited to
bypass the same-origin-policy and lead to information disclosure
(CVE-2015-6679).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5567</cvename>
<cvename>CVE-2015-5568</cvename>
<cvename>CVE-2015-5570</cvename>
<cvename>CVE-2015-5571</cvename>
<cvename>CVE-2015-5572</cvename>
<cvename>CVE-2015-5573</cvename>
<cvename>CVE-2015-5574</cvename>
<cvename>CVE-2015-5575</cvename>
<cvename>CVE-2015-5576</cvename>
<cvename>CVE-2015-5577</cvename>
<cvename>CVE-2015-5578</cvename>
<cvename>CVE-2015-5588</cvename>
<cvename>CVE-2015-6676</cvename>
<cvename>CVE-2015-6677</cvename>
<cvename>CVE-2015-6678</cvename>
<cvename>CVE-2015-6679</cvename>
<cvename>CVE-2015-6682</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb15-23.html</url>
</references>
<dates>
<discovery>2015-09-21</discovery>
<entry>2015-09-28</entry>
</dates>
</vuln>
<vuln vid="5114cd11-6571-11e5-9909-002590263bf5">
<topic>codeigniter -- SQL injection vulnerability</topic>
<affects>
<package>
<name>codeigniter</name>
<range><lt>2.2.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The CodeIgniter changelog reports:</p>
<blockquote cite="https://codeigniter.com/userguide2/changelog.html">
<p>Security: Fixed an SQL injection vulnerability in Active Record
method offset().</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/203401</freebsdpr>
<url>https://codeigniter.com/userguide2/changelog.html</url>
</references>
<dates>
<discovery>2015-08-20</discovery>
<entry>2015-09-28</entry>
</dates>
</vuln>
<vuln vid="01bce4c6-6571-11e5-9909-002590263bf5">
<topic>codeigniter -- mysql database driver vulnerability</topic>
<affects>
<package>
<name>codeigniter</name>
<range><lt>2.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The CodeIgniter changelog reports:</p>
<blockquote cite="https://codeigniter.com/userguide2/changelog.html">
<p>Security: Removed a fallback to mysql_escape_string() in the mysql
database driver (escape_str() method) when there's no active database
connection.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/203401</freebsdpr>
<url>https://codeigniter.com/userguide2/changelog.html</url>
</references>
<dates>
<discovery>2015-07-15</discovery>
<entry>2015-09-28</entry>
</dates>
</vuln>
<vuln vid="c21f4e61-6570-11e5-9909-002590263bf5">
<topic>codeigniter -- multiple vulnerabilities</topic>
<affects>
<package>
<name>codeigniter</name>
<range><lt>2.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The CodeIgniter changelog reports:</p>
<blockquote cite="https://codeigniter.com/userguide2/changelog.html">
<p>Security: Added HTTP "Host" header character validation to prevent
cache poisoning attacks when base_url auto-detection is used.</p>
<p>Security: Added FSCommand and seekSegmentTime to the "evil
attributes" list in CI_Security::xss_clean().</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/203401</freebsdpr>
<url>https://codeigniter.com/userguide2/changelog.html</url>
</references>
<dates>
<discovery>2015-04-15</discovery>
<entry>2015-09-28</entry>
</dates>
</vuln>
<vuln vid="f838dcb4-656f-11e5-9909-002590263bf5">
<topic>codeigniter -- multiple vulnerabilities</topic>
<affects>
<package>
<name>codeigniter</name>
<range><lt>2.2.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The CodeIgniter changelog reports:</p>
<blockquote cite="https://codeigniter.com/userguide2/changelog.html">
<p>Security: The xor_encode() method in the Encrypt Class has been
removed. The Encrypt Class now requires the Mcrypt extension to be
installed.</p>
<p>Security: The Session Library now uses HMAC authentication instead
of a simple MD5 checksum.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/203401</freebsdpr>
<url>https://codeigniter.com/userguide2/changelog.html</url>
</references>
<dates>
<discovery>2014-06-05</discovery>
<entry>2015-09-28</entry>
</dates>
</vuln>
<vuln vid="b7d785ea-656d-11e5-9909-002590263bf5">
<topic>codeigniter -- SQL injection vulnerability</topic>
<affects>
<package>
<name>codeigniter</name>
<range><lt>2.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The CodeIgniter changelog reports:</p>
<blockquote cite="https://codeigniter.com/userguide2/changelog.html">
<p>An improvement was made to the MySQL and MySQLi drivers to prevent
exposing a potential vector for SQL injection on sites using
multi-byte character sets in the database client connection.</p>
<p>An incompatibility in PHP versions &lt; 5.2.3 and MySQL &gt; 5.0.7
with mysql_set_charset() creates a situation where using multi-byte
character sets on these environments may potentially expose a SQL
injection attack vector. Latin-1, UTF-8, and other "low ASCII"
character sets are unaffected on all environments.</p>
<p>If you are running or considering running a multi-byte character
set for your database connection, please pay close attention to the
server environment you are deploying on to ensure you are not
vulnerable.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/156486</freebsdpr>
<url>https://codeigniter.com/userguide2/changelog.html</url>
</references>
<dates>
<discovery>2011-08-20</discovery>
<entry>2015-09-28</entry>
</dates>
</vuln>
<vuln vid="0e425bb7-64f2-11e5-b2fd-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>45.0.2454.101</lt></range>
</package>
<package>
<!-- pcbsd -->
<name>chromium-npapi</name>
<range><lt>45.0.2454.101</lt></range>
</package>
<package>
<!-- pcbsd -->
<name>chromium-pulse</name>
<range><lt>45.0.2454.101</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2015/09/stable-channel-update_24.html">
<p>Two vulnerabilities were fixed in this release:</p>
<ul>
<li>[530301] High CVE-2015-1303: Cross-origin bypass in DOM. Credit
to Mariusz Mlynski.</li>
<li>[531891] High CVE-2015-1304: Cross-origin bypass in V8. Credit
to Mariusz Mlynski.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1303</cvename>
<cvename>CVE-2015-1304</cvename>
<url>http://googlechromereleases.blogspot.nl/2015/09/stable-channel-update_24.html</url>
</references>
<dates>
<discovery>2015-09-24</discovery>
<entry>2015-09-27</entry>
</dates>
</vuln>
<vuln vid="9770d6ac-614d-11e5-b379-14dae9d210b8">
<topic>libssh2 -- denial of service vulnerability</topic>
<affects>
<package>
<name>libssh2</name>
<range><lt>1.5.0,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mariusz Ziulek reports:</p>
<blockquote cite="http://www.libssh2.org/adv_20150311.html">
<p>A malicious attacker could man in the middle a real server
and cause libssh2 using clients to crash (denial of service) or
otherwise read and use completely unintended memory areas in this
process.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.libssh2.org/adv_20150311.html</url>
<url>https://trac.libssh2.org/ticket/294</url>
<cvename>CVE-2015-1782</cvename>
</references>
<dates>
<discovery>2015-01-25</discovery>
<entry>2015-09-22</entry>
<modified>2015-09-22</modified>
</dates>
</vuln>
<vuln vid="2d56c7f4-b354-428f-8f48-38150c607a05">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>41.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>41.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.38</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.38</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>38.3.0,1</lt></range>
</package>
<package>
<name>libxul</name>
<range><lt>38.3.0</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>38.3.0</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>38.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/">
<p>MFSA 2015-96 Miscellaneous memory safety hazards (rv:41.0
/ rv:38.3)</p>
<p>MFSA 2015-97 Memory leak in mozTCPSocket to servers</p>
<p>MFSA 2015-98 Out of bounds read in QCMS library with ICC
V4 profile attributes</p>
<p>MFSA 2015-99 Site attribute spoofing on Android by
pasting URL with unknown scheme</p>
<p>MFSA 2015-100 Arbitrary file manipulation by local user
through Mozilla updater</p>
<p>MFSA 2015-101 Buffer overflow in libvpx while parsing vp9
format video</p>
<p>MFSA 2015-102 Crash when using debugger with SavedStacks
in JavaScript</p>
<p>MFSA 2015-103 URL spoofing in reader mode</p>
<p>MFSA 2015-104 Use-after-free with shared workers and
IndexedDB</p>
<p>MFSA 2015-105 Buffer overflow while decoding WebM
video</p>
<p>MFSA 2015-106 Use-after-free while manipulating HTML
media content</p>
<p>MFSA 2015-107 Out-of-bounds read during 2D canvas display
on Linux 16-bit color depth systems</p>
<p>MFSA 2015-108 Scripted proxies can access inner
window</p>
<p>MFSA 2015-109 JavaScript immutable property enforcement
can be bypassed</p>
<p>MFSA 2015-110 Dragging and dropping images exposes final
URL after redirects</p>
<p>MFSA 2015-111 Errors in the handling of CORS preflight
request headers</p>
<p>MFSA 2015-112 Vulnerabilities found through code
inspection</p>
<p>MFSA 2015-113 Memory safety errors in libGLES in the
ANGLE graphics library</p>
<p>MFSA 2015-114 Information disclosure via the High
Resolution Time API</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4476</cvename>
<cvename>CVE-2015-4500</cvename>
<cvename>CVE-2015-4501</cvename>
<cvename>CVE-2015-4502</cvename>
<cvename>CVE-2015-4503</cvename>
<cvename>CVE-2015-4504</cvename>
<cvename>CVE-2015-4505</cvename>
<cvename>CVE-2015-4506</cvename>
<cvename>CVE-2015-4507</cvename>
<cvename>CVE-2015-4508</cvename>
<cvename>CVE-2015-4509</cvename>
<cvename>CVE-2015-4510</cvename>
<cvename>CVE-2015-4512</cvename>
<cvename>CVE-2015-4516</cvename>
<cvename>CVE-2015-4517</cvename>
<cvename>CVE-2015-4519</cvename>
<cvename>CVE-2015-4520</cvename>
<cvename>CVE-2015-4521</cvename>
<cvename>CVE-2015-4522</cvename>
<cvename>CVE-2015-7174</cvename>
<cvename>CVE-2015-7175</cvename>
<cvename>CVE-2015-7176</cvename>
<cvename>CVE-2015-7177</cvename>
<cvename>CVE-2015-7178</cvename>
<cvename>CVE-2015-7179</cvename>
<cvename>CVE-2015-7180</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2015-96/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-97/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-98/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-99/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-100/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-101/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-102/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-103/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-104/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-105/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-106/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-107/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-108/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-109/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-110/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-111/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-112/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-113/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-114/</url>
</references>
<dates>
<discovery>2015-09-22</discovery>
<entry>2015-09-22</entry>
</dates>
</vuln>
<vuln vid="3d950687-b4c9-4a86-8478-c56743547af8">
<topic>ffmpeg -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libav</name>
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>gstreamer1-libav</name>
<!-- gst-libav-1.4.5 has libav-10.5 -->
<range><lt>1.5.90</lt></range>
</package>
<package>
<name>gstreamer-ffmpeg</name>
<!-- gst-ffmpeg-0.10.13 has libav-0.7.2 (0.7.7 in freebsd port) -->
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>handbrake</name>
<!-- handbrake-0.10.2 has libav-10.1 -->
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>ffmpeg</name>
<range><lt>2.7.2,1</lt></range>
</package>
<package>
<name>ffmpeg26</name>
<range><lt>2.6.4</lt></range>
</package>
<package>
<name>ffmpeg25</name>
<range><lt>2.5.8</lt></range>
</package>
<package>
<name>ffmpeg24</name>
<range><lt>2.4.11</lt></range>
</package>
<package>
<name>ffmpeg-devel</name>
<name>ffmpeg23</name>
<name>ffmpeg2</name>
<name>ffmpeg1</name>
<name>ffmpeg-011</name>
<name>ffmpeg0</name>
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>avidemux</name>
<name>avidemux2</name>
<name>avidemux26</name>
<!-- avidemux-2.6.10 has ffmpeg-2.6.1 -->
<range><lt>2.6.11</lt></range>
</package>
<package>
<name>kodi</name>
<!-- kodi-14.2 has ffmpeg-2.4.6 -->
<range><lt>15.1</lt></range>
</package>
<package>
<name>mplayer</name>
<name>mencoder</name>
<!-- mplayer-1.1.r20150403 has ffmpeg-2.7.0+ (snapshot, c299fbb) -->
<range><lt>1.1.r20150822</lt></range>
</package>
<package>
<name>mythtv</name>
<name>mythtv-frontend</name>
<!-- mythtv-0.27.0.20140121 has ffmpeg-1.2.2+ (snapshot, f9c8726) -->
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>plexhometheater</name>
<!-- plexhometheater-1.4.1 has ffmpeg-0.10.2 fork -->
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6818">
<p>The decode_ihdr_chunk function in libavcodec/pngdec.c in
FFmpeg before 2.7.2 does not enforce uniqueness of the IHDR
(aka image header) chunk in a PNG image, which allows remote
attackers to cause a denial of service (out-of-bounds array
access) or possibly have unspecified other impact via a
crafted image with two or more of these chunks.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6819">
<p>Multiple integer underflows in the ff_mjpeg_decode_frame
function in libavcodec/mjpegdec.c in FFmpeg before 2.7.2
allow remote attackers to cause a denial of service
(out-of-bounds array access) or possibly have unspecified
other impact via crafted MJPEG data.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6820">
<p>The ff_sbr_apply function in libavcodec/aacsbr.c in
FFmpeg before 2.7.2 does not check for a matching AAC frame
syntax element before proceeding with Spectral Band
Replication calculations, which allows remote attackers to
cause a denial of service (out-of-bounds array access) or
possibly have unspecified other impact via crafted AAC
data.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6821">
<p>The ff_mpv_common_init function in libavcodec/mpegvideo.c
in FFmpeg before 2.7.2 does not properly maintain the
encoding context, which allows remote attackers to cause a
denial of service (invalid pointer access) or possibly have
unspecified other impact via crafted MPEG data.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6822">
<p>The destroy_buffers function in libavcodec/sanm.c in
FFmpeg before 2.7.2 does not properly maintain height and
width values in the video context, which allows remote
attackers to cause a denial of service (segmentation
violation and application crash) or possibly have
unspecified other impact via crafted LucasArts Smush video
data.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6823">
<p>The allocate_buffers function in libavcodec/alac.c in
FFmpeg before 2.7.2 does not initialize certain context
data, which allows remote attackers to cause a denial of
service (segmentation violation) or possibly have
unspecified other impact via crafted Apple Lossless Audio
Codec (ALAC) data.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6824">
<p>The sws_init_context function in libswscale/utils.c in
FFmpeg before 2.7.2 does not initialize certain pixbuf data
structures, which allows remote attackers to cause a denial
of service (segmentation violation) or possibly have
unspecified other impact via crafted video data.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6825">
<p>The ff_frame_thread_init function in
libavcodec/pthread_frame.c in FFmpeg before 2.7.2 mishandles
certain memory-allocation failures, which allows remote
attackers to cause a denial of service (invalid pointer
access) or possibly have unspecified other impact via a
crafted file, as demonstrated by an AVI file.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6826">
<p>The ff_rv34_decode_init_thread_copy function in
libavcodec/rv34.c in FFmpeg before 2.7.2 does not initialize
certain structure members, which allows remote attackers to
cause a denial of service (invalid pointer access) or
possibly have unspecified other impact via crafted (1) RV30
or (2) RV40 RealVideo data.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-6818</cvename>
<cvename>CVE-2015-6819</cvename>
<cvename>CVE-2015-6820</cvename>
<cvename>CVE-2015-6821</cvename>
<cvename>CVE-2015-6822</cvename>
<cvename>CVE-2015-6823</cvename>
<cvename>CVE-2015-6824</cvename>
<cvename>CVE-2015-6825</cvename>
<cvename>CVE-2015-6826</cvename>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=47f4e2d8960ca756ca153ab8e3e93d80449b8c91</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=84afc6b70d24fc0bf686e43138c96cf60a9445fe</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=79a98294da6cd85f8c86b34764c5e0c43b09eea3</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=b160fc290cf49b516c5b6ee0730fd9da7fc623b1</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=39bbdebb1ed8eb9c9b0cd6db85afde6ba89d86e4</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=f7068bf277a37479aecde2832208d820682b35e6</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=a5d44d5c220e12ca0cb7a4eceb0f74759cb13111</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=f1a38264f20382731cf2cc75fdd98f4c9a84a626</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=3197c0aa87a3b7190e17d49e6fbc7b554e4b3f0a</url>
<url>https://ffmpeg.org/security.html</url>
</references>
<dates>
<discovery>2015-09-05</discovery>
<entry>2015-09-20</entry>
<modified>2015-09-20</modified>
</dates>
</vuln>
<vuln vid="c2fcbec2-5daa-11e5-9909-002590263bf5">
<topic>moodle -- multiple vulnerabilities</topic>
<affects>
<package>
<name>moodle27</name>
<range><lt>2.7.10</lt></range>
</package>
<package>
<name>moodle28</name>
<range><lt>2.8.8</lt></range>
</package>
<package>
<name>moodle29</name>
<range><lt>2.9.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Moodle Release Notes report:</p>
<blockquote cite="https://docs.moodle.org/dev/Moodle_2.7.10_release_notes">
<p>MSA-15-0030: Students can re-attempt answering questions in the
lesson (CVE-2015-5264)</p>
<p>MSA-15-0031: Teacher in forum can still post to "all participants"
and groups they are not members of (CVE-2015-5272 - 2.7.10 only)</p>
<p>MSA-15-0032: Users can delete files uploaded by other users in wiki
(CVE-2015-5265)</p>
<p>MSA-15-0033: Meta course synchronization enrolls suspended students
as managers for a short period of time (CVE-2015-5266)</p>
<p>MSA-15-0034: Vulnerability in password recovery mechanism
(CVE-2015-5267)</p>
<p>MSA-15-0035: Rating component does not check separate groups
(CVE-2015-5268)</p>
<p>MSA-15-0036: XSS in grouping description (CVE-2015-5269)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5264</cvename>
<cvename>CVE-2015-5272</cvename>
<cvename>CVE-2015-5265</cvename>
<cvename>CVE-2015-5266</cvename>
<cvename>CVE-2015-5267</cvename>
<cvename>CVE-2015-5268</cvename>
<cvename>CVE-2015-5269</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/09/21/1</url>
<url>https://docs.moodle.org/dev/Moodle_2.7.10_release_notes</url>
<url>https://docs.moodle.org/dev/Moodle_2.8.8_release_notes</url>
<url>https://docs.moodle.org/dev/Moodle_2.9.2_release_notes</url>
</references>
<dates>
<discovery>2015-09-14</discovery>
<entry>2015-09-18</entry>
<modified>2015-09-24</modified>
</dates>
</vuln>
<vuln vid="d3a98c2d-5da1-11e5-9909-002590263bf5">
<topic>squid -- TLS/SSL parser denial of service vulnerability</topic>
<affects>
<package>
<name>squid</name>
<range><ge>3.5.0.1</ge><lt>3.5.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Amos Jeffries, release manager of the Squid-3 series, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/18/1">
<p>Vulnerable versions are 3.5.0.1 to 3.5.8 (inclusive), which are
built with OpenSSL and configured for "SSL-Bump" decryption.</p>
<p>Integer overflows can lead to invalid pointer math reading from
random memory on some CPU architectures. In the best case this leads
to wrong TLS extensiosn being used for the client, worst-case a
crash of the proxy terminating all active transactions.</p>
<p>Incorrect message size checks and assumptions about the existence
of TLS extensions in the SSL/TLS handshake message can lead to very
high CPU consumption (up to and including 'infinite loop'
behaviour).</p>
<p>The above can be triggered remotely. Though there is one layer of
authorization applied before this processing to check that the
client is allowed to use the proxy, that check is generally weak. MS
Skype on Windows XP is known to trigger some of these.</p>
</blockquote>
<p>The FreeBSD port does not use SSL by default and is not vulnerable
in the default configuration.</p>
</body>
</description>
<references>
<freebsdpr>ports/203186</freebsdpr>
<url>http://www.squid-cache.org/Advisories/SQUID-2015_3.txt</url>
<url>http://www.openwall.com/lists/oss-security/2015/09/18/1</url>
</references>
<dates>
<discovery>2015-09-18</discovery>
<entry>2015-09-18</entry>
<modified>2016-02-18</modified>
</dates>
</vuln>
<vuln vid="b55ecf12-5d98-11e5-9909-002590263bf5">
<topic>remind -- buffer overflow with malicious reminder file input</topic>
<affects>
<package>
<name>remind</name>
<range><lt>3.1.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Dianne Skoll reports:</p>
<blockquote cite="http://lists.roaringpenguin.com/pipermail/remind-fans/2015/003172.html">
<p>BUG FIX: Fix a buffer overflow found by Alexander Keller.</p>
</blockquote>
<p>The bug can be manifested by an extended DUMP command using a system
variable (that is a special variable whose name begins with '$')</p>
</body>
</description>
<references>
<cvename>CVE-2015-5957</cvename>
<freebsdpr>ports/202942</freebsdpr>
<url>http://lists.roaringpenguin.com/pipermail/remind-fans/2015/003172.html</url>
<url>http://www.openwall.com/lists/oss-security/2015/08/07/1</url>
</references>
<dates>
<discovery>2015-07-27</discovery>
<entry>2015-09-18</entry>
</dates>
</vuln>
<vuln vid="d45ad7ae-5d56-11e5-9ad8-14dae9d210b8">
<topic>shutter -- arbitrary code execution</topic>
<affects>
<package>
<name>shutter</name>
<range><ge>0.80</ge><lt>0.93.1_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Luke Farone reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q3/541">
<p>In the "Shutter" screenshot application, I discovered that using the
"Show in folder" menu option while viewing a file with a
specially-crafted path allows for arbitrary code execution with the
permissions of the user running Shutter.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2015/q3/541</url>
<url>https://bugs.launchpad.net/shutter/+bug/1495163</url>
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=798862</url>
<cvename>CVE-2015-0854</cvename>
</references>
<dates>
<discovery>2015-09-13</discovery>
<entry>2015-09-17</entry>
</dates>
</vuln>
<vuln vid="a233d51f-5d4c-11e5-9ad8-14dae9d210b8">
<topic>openjpeg -- use-after-free vulnerability</topic>
<affects>
<package>
<name>openjpeg</name>
<range><lt>2.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Feist Josselin reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q3/550">
<p>Use-after-free was found in openjpeg. The vuln is fixed in
version 2.1.1 and was located in opj_j2k_write_mco function.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2015/q3/550</url>
<url>https://github.com/uclouvain/openjpeg/issues/563</url>
</references>
<dates>
<discovery>2015-08-14</discovery>
<entry>2015-09-17</entry>
</dates>
</vuln>
<vuln vid="bab05188-5d4b-11e5-9ad8-14dae9d210b8">
<topic>optipng -- use-after-free vulnerability</topic>
<affects>
<package>
<name>optipng</name>
<range><le>0.6.5</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gustavo Grieco reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q3/556">
<p>We found a use-after-free causing an invalid/double free in
optipng 0.6.4.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2015/q3/556</url>
<cvename>CVE-2015-7801</cvename>
</references>
<dates>
<discovery>2015-09-16</discovery>
<entry>2015-09-17</entry>
<modified>2015-10-14</modified>
</dates>
</vuln>
<vuln vid="3c259621-5d4a-11e5-9ad8-14dae9d210b8">
<topic>openslp -- denial of service vulnerability</topic>
<affects>
<package>
<name>openslp</name>
<range><lt>2.0.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Qinghao Tang reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q3/559">
<p>The function ParseExtension() in openslp 1.2.1 exists a
vulnerability , an attacher can cause a denial of service
(infinite loop) via a packet with crafted "nextoffset"
value and "extid" value.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2015/q3/559</url>
<cvename>CVE-2015-5155</cvename>
</references>
<dates>
<discovery>2015-09-16</discovery>
<entry>2015-09-17</entry>
</dates>
</vuln>
<vuln vid="8f5c9dd6-5cac-11e5-9ad8-14dae9d210b8">
<topic>p7zip -- directory traversal vulnerability</topic>
<affects>
<package>
<name>p7zip</name>
<range><lt>9.38.1_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Alexander Cherepanov reports:</p>
<blockquote cite="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774660">
<p>7z (and 7zr) is susceptible to a directory traversal vulnerability.
While extracting an archive, it will extract symlinks and then follow
them if they are referenced in further entries. This can be exploited by
a rogue archive to write files outside the current directory.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774660</url>
<url>http://www.openwall.com/lists/oss-security/2015/01/11/2</url>
<url>http://sourceforge.net/p/p7zip/bugs/147/</url>
<cvename>CVE-2015-1038</cvename>
</references>
<dates>
<discovery>2015-01-05</discovery>
<entry>2015-09-16</entry>
</dates>
</vuln>
<vuln vid="31ea7f73-5c55-11e5-8607-74d02b9a84d5">
<topic>h2o -- directory traversal vulnerability</topic>
<affects>
<package>
<name>h2o</name>
<range><lt>1.4.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Yakuzo reports:</p>
<blockquote cite="https://h2o.examp1e.net/vulnerabilities.html">
<p>H2O (up to version 1.4.4 / 1.5.0-beta1) contains a flaw in its URL
normalization logic.</p>
<p>When file.dir directive is used, this flaw
allows a remote attacker to retrieve arbitrary files that exist
outside the directory specified by the directive.</p>
<p>H2O version 1.4.5 and version 1.5.0-beta2 have been released
to address this vulnerability.</p>
<p>Users are advised to upgrade their servers immediately.</p>
<p>The vulnerability was reported by: Yusuke OSUMI.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5638</cvename>
<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5638</url>
</references>
<dates>
<discovery>2015-09-14</discovery>
<entry>2015-09-16</entry>
</dates>
</vuln>
<vuln vid="f4ce64c2-5bd4-11e5-9040-3c970e169bc2">
<topic>wordpress -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>4.3.1,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<name>zh-wordpress-zh_CN</name>
<name>zh-wordpress-zh_TW</name>
<range><lt>4.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Samuel Sidler reports:</p>
<blockquote cite="https://wordpress.org/news/2015/09/wordpress-4-3-1/">
<p>WordPress 4.3.1 is now available. This is a security
release for all previous versions and we strongly
encourage you to update your sites immediately.</p>
<ul>
<li>WordPress versions 4.3 and earlier are vulnerable
to a cross-site scripting vulnerability when processing
shortcode tags (CVE-2015-5714). Reported by Shahar Tal
and Netanel Rubin of <a href="http://checkpoint.com/">Check Point</a>.</li>
<li>A separate cross-site scripting vulnerability was found
in the user list table. Reported by Ben Bidner of the
WordPress security team.</li>
<li>Finally, in certain cases, users without proper
permissions could publish private posts and make
them sticky (CVE-2015-5715). Reported by Shahar Tal
and Netanel Rubin of <a href="http://checkpoint.com/">Check Point</a>.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5714</cvename>
<cvename>CVE-2015-5715</cvename>
<cvename>CVE-2015-7989</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/10/28/1</url>
<url>https://wordpress.org/news/2015/09/wordpress-4-3-1/</url>
</references>
<dates>
<discovery>2015-09-15</discovery>
<entry>2015-09-15</entry>
<modified>2015-10-29</modified>
</dates>
</vuln>
<vuln vid="ea893f06-5a92-11e5-98c0-20cf30e32f6d">
<topic>Bugzilla security issues</topic>
<affects>
<package>
<name>bugzilla44</name>
<range><lt>4.4.10</lt></range>
</package>
<package>
<name>bugzilla50</name>
<range><lt>5.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Bugzilla Security Advisory</p>
<blockquote cite="https://www.bugzilla.org/security/4.2.14/">
<p>Login names (usually an email address) longer than 127
characters are silently truncated in MySQL which could
cause the domain name of the email address to be
corrupted. An attacker could use this vulnerability to
create an account with an email address different from the
one originally requested. The login name could then be
automatically added to groups based on the group's regular
expression setting.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4499</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=1202447</url>
</references>
<dates>
<discovery>2015-09-10</discovery>
<entry>2015-09-14</entry>
</dates>
</vuln>
<vuln vid="4910d161-58a4-11e5-9ad8-14dae9d210b8">
<topic>openldap -- denial of service vulnerability</topic>
<affects>
<package>
<name>openldap-server</name>
<range><lt>2.4.42_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Denis Andzakovic reports:</p>
<blockquote cite="http://www.openldap.org/its/index.cgi/Software%20Bugs?id=8240">
<p>By sending a crafted packet, an attacker may cause the
OpenLDAP server to reach an assert(9 9 statement, crashing the daemon.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openldap.org/its/index.cgi/Software%20Bugs?id=8240</url>
<url>http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=commit;h=6fe51a9ab04fd28bbc171da3cf12f1c1040d6629</url>
<cvename>CVE-2015-6908</cvename>
</references>
<dates>
<discovery>2015-09-09</discovery>
<entry>2015-09-12</entry>
<modified>2015-09-13</modified>
</dates>
</vuln>
<vuln vid="a35f415d-572a-11e5-b0a4-f8b156b6dcc8">
<topic>vorbis-tools, opus-tools -- multiple vulnerabilities</topic>
<affects>
<package>
<name>vorbis-tools</name>
<range><lt>1.4.0_10,3</lt></range>
</package>
<package>
<name>opus-tools</name>
<range><lt>0.1.9_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Paris Zoumpouloglou reports:</p>
<blockquote cite="https://trac.xiph.org/ticket/2136">
<p>I discovered an integer overflow issue in oggenc,
related to the number of channels in the input WAV file.
The issue triggers an out-of-bounds memory access which
causes oggenc to crash.</p>
</blockquote>
<p>Paris Zoumpouloglou reports:</p>
<blockquote cite="https://trac.xiph.org/ticket/2136">
<p>A crafted WAV file with number of channels set to 0
will cause oggenc to crash due to a division by zero
issue.</p>
</blockquote>
<p>pengsu reports:</p>
<blockquote cite="https://trac.xiph.org/ticket/2212">
<p>I discovered an buffer overflow issue in oggenc/audio.c
when it tries to open invalid aiff file.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/202941</freebsdpr>
<url>https://trac.xiph.org/ticket/2136</url>
<cvename>CVE-2014-9639</cvename>
<url>https://trac.xiph.org/ticket/2137</url>
<cvename>CVE-2014-9638</cvename>
<url>https://trac.xiph.org/ticket/2212</url>
<cvename>CVE-2015-6749</cvename>
</references>
<dates>
<discovery>2015-08-08</discovery>
<entry>2015-09-09</entry>
<modified>2015-09-09</modified>
</dates>
</vuln>
<vuln vid="d76961da-56f6-11e5-934b-002590263bf5">
<topic>pgbouncer -- failed auth_query lookup leads to connection as auth_user</topic>
<affects>
<package>
<name>pgbouncer</name>
<range><eq>1.6.0</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PgBouncer reports:</p>
<blockquote cite="http://pgbouncer.github.io/2015/09/pgbouncer-1-6-1/">
<p>New auth_user functionality introduced in 1.6 allows login as
auth_user when client presents unknown username. It's quite likely
auth_user is superuser. Affects only setups that have enabled
auth_user in their config.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-6817</cvename>
<url>https://pgbouncer.github.io/2015/09/pgbouncer-1-6-1/</url>
<url>https://github.com/pgbouncer/pgbouncer/issues/69</url>
<url>http://www.openwall.com/lists/oss-security/2015/09/04/3</url>
</references>
<dates>
<discovery>2015-09-03</discovery>
<entry>2015-09-09</entry>
</dates>
</vuln>
<vuln vid="3904f759-5659-11e5-a207-6805ca0b3d42">
<topic>phpMyAdmin -- reCaptcha bypass</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>4.4.0</ge><lt>4.4.14.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2015-4/">
<p>This vulnerability allows to complete the reCaptcha test
and subsequently perform a brute force attack to guess user
credentials without having to complete further reCaptcha
tests.</p>
<p>We consider this vulnerability to be non critical since
reCaptcha is an additional opt-in security measure.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2015-4/</url>
<cvename>CVE-2015-6830</cvename>
</references>
<dates>
<discovery>2015-09-08</discovery>
<entry>2015-09-08</entry>
</dates>
</vuln>
<vuln vid="3d675519-5654-11e5-9ad8-14dae9d210b8">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php5</name>
<name>php5-soap</name>
<name>php5-xsl</name>
<range><lt>5.4.45</lt></range>
</package>
<package>
<name>php55</name>
<name>php55-soap</name>
<name>php55-xsl</name>
<range><lt>5.5.29</lt></range>
</package>
<package>
<name>php56</name>
<name>php56-soap</name>
<name>php56-xsl</name>
<range><lt>5.6.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PHP reports:</p>
<blockquote cite="http://php.net/ChangeLog-5.php#5.4.45">
<ul><li>Core:
<ul>
<li>Fixed bug #70172 (Use After Free Vulnerability in unserialize()).</li>
<li>Fixed bug #70219 (Use after free vulnerability in session deserializer).</li>
</ul></li>
<li>EXIF:
<ul>
<li>Fixed bug #70385 (Buffer over-read in exif_read_data with TIFF IFD tag byte value of 32 bytes).</li>
</ul></li>
<li>hash:
<ul>
<li>Fixed bug #70312 (HAVAL gives wrong hashes in specific cases).</li>
</ul></li>
<li>PCRE:
<ul>
<li>Fixed bug #70345 (Multiple vulnerabilities related to PCRE functions).</li>
</ul></li>
<li>SOAP:
<ul>
<li>Fixed bug #70388 (SOAP serialize_function_call() type confusion / RCE).</li>
</ul></li>
<li>SPL:
<ul>
<li>Fixed bug #70365 (Use-after-free vulnerability in unserialize() with SplObjectStorage).</li>
<li>Fixed bug #70366 (Use-after-free vulnerability in unserialize() with SplDoublyLinkedList).</li>
</ul></li>
<li>XSLT:
<ul>
<li>Fixed bug #69782 (NULL pointer dereference).</li>
</ul></li>
<li>ZIP:
<ul>
<li>Fixed bug #70350 (ZipArchive::extractTo allows for directory traversal when creating directories).</li>
</ul></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://php.net/ChangeLog-5.php#5.4.45</url>
<url>http://php.net/ChangeLog-5.php#5.5.29</url>
<url>http://php.net/ChangeLog-5.php#5.6.13</url>
<cvename>CVE-2015-6834</cvename>
<cvename>CVE-2015-6835</cvename>
<cvename>CVE-2015-6836</cvename>
<cvename>CVE-2015-6837</cvename>
<cvename>CVE-2015-6838</cvename>
</references>
<dates>
<discovery>2015-09-03</discovery>
<entry>2015-09-08</entry>
<modified>2015-09-08</modified>
</dates>
</vuln>
<vuln vid="d68df01b-564e-11e5-9ad8-14dae9d210b8">
<topic>ganglia-webfrontend -- auth bypass</topic>
<affects>
<package>
<name>ganglia-webfrontend</name>
<range><lt>3.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ivan Novikov reports:</p>
<blockquote cite="https://github.com/ganglia/ganglia-web/issues/267">
<p>It's easy to bypass auth by using boolean serialization...</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/ganglia/ganglia-web/issues/267</url>
<cvename>CVE-2015-6816</cvename>
</references>
<dates>
<discovery>2015-09-04</discovery>
<entry>2015-09-08</entry>
<modified>2015-09-08</modified>
</dates>
</vuln>
<vuln vid="9bdd8eb5-564a-11e5-9ad8-14dae9d210b8">
<topic>wireshark -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wireshark</name>
<name>wireshark-lite</name>
<name>wireshark-qt5</name>
<name>tshark</name>
<name>tshark-lite</name>
<range><lt>1.12.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Wireshark development team reports:</p>
<blockquote cite="https://www.wireshark.org/docs/relnotes/wireshark-1.12.7.html">
<p>The following vulnerabilities have been fixed.</p>
<ul>
<li><p>wnpa-sec-2015-21</p>
<p>Protocol tree crash. (Bug 11309)</p></li>
<li><p>wnpa-sec-2015-22</p>
<p>Memory manager crash. (Bug 11373)</p></li>
<li><p>wnpa-sec-2015-23</p>
<p>Dissector table crash. (Bug 11381)</p></li>
<li><p>wnpa-sec-2015-24</p>
<p>ZigBee crash. (Bug 11389)</p></li>
<li><p>wnpa-sec-2015-25</p>
<p>GSM RLC/MAC infinite loop. (Bug 11358)</p></li>
<li><p>wnpa-sec-2015-26</p>
<p>WaveAgent crash. (Bug 11358)</p></li>
<li><p>wnpa-sec-2015-27</p>
<p>OpenFlow infinite loop. (Bug 11358)</p></li>
<li><p>wnpa-sec-2015-28</p>
<p>Ptvcursor crash. (Bug 11358)</p></li>
<li><p>wnpa-sec-2015-29</p>
<p>WCCP crash. (Bug 11358)</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.wireshark.org/docs/relnotes/wireshark-1.12.7.html</url>
<cvename>CVE-2015-6241</cvename>
<cvename>CVE-2015-6242</cvename>
<cvename>CVE-2015-6243</cvename>
<cvename>CVE-2015-6244</cvename>
<cvename>CVE-2015-6245</cvename>
<cvename>CVE-2015-6246</cvename>
<cvename>CVE-2015-6247</cvename>
<cvename>CVE-2015-6248</cvename>
<cvename>CVE-2015-6249</cvename>
</references>
<dates>
<discovery>2015-08-12</discovery>
<entry>2015-09-08</entry>
<modified>2015-09-08</modified>
</dates>
</vuln>
<vuln vid="98092444-5645-11e5-9ad8-14dae9d210b8">
<topic>screen -- stack overflow</topic>
<affects>
<package>
<name>screen</name>
<range><lt>4.3.1_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Kuang-che Wu reports:</p>
<blockquote cite="https://savannah.gnu.org/bugs/?45713">
<p>screen will recursively call MScrollV to depth n/256. This
is time consuming and will overflow stack if n is huge.</p>
</blockquote>
</body>
</description>
<references>
<url>https://savannah.gnu.org/bugs/?45713</url>
<cvename>CVE-2015-6806</cvename>
</references>
<dates>
<discovery>2015-08-07</discovery>
<entry>2015-09-08</entry>
</dates>
</vuln>
<vuln vid="b5e654c3-5644-11e5-9ad8-14dae9d210b8">
<topic>libvncserver -- memory corruption</topic>
<affects>
<package>
<name>libvncserver</name>
<range><lt>0.9.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Petr Pisar reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=706087">
<p>libvncserver/tight.c:rfbTightCleanup() frees a buffer without zeroing freed pointer.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=706087</url>
<url>https://github.com/LibVNC/libvncserver/commit/804335f9d296440bb708ca844f5d89b58b50b0c6</url>
</references>
<dates>
<discovery>2011-05-19</discovery>
<entry>2015-09-08</entry>
</dates>
</vuln>
<vuln vid="ed0ecad5-531d-11e5-9850-bcaec565249c">
<topic>gdk-pixbuf2 -- integer overflows</topic>
<affects>
<package>
<name>gdk-pixbuf2</name>
<range><lt>2.31.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matthias Clasen reports:</p>
<blockquote cite="https://mail.gnome.org/archives/ftp-release-list/2015-September/msg00013.html">
<p>Fix several integer overflows.</p>
</blockquote>
</body>
</description>
<references>
<url>https://mail.gnome.org/archives/ftp-release-list/2015-September/msg00013.html</url>
</references>
<dates>
<discovery>2015-09-01</discovery>
<entry>2015-09-04</entry>
</dates>
</vuln>
<vuln vid="2c5e7e23-5248-11e5-9ad8-14dae9d210b8">
<topic>bind -- denial of service vulnerability</topic>
<affects>
<package>
<name>bind99</name>
<range><ge>9.9.7</ge><lt>9.9.7P3</lt></range>
</package>
<package>
<name>bind910</name>
<range><lt>9.10.2P4</lt></range>
</package>
<package>
<name>bind910-base</name>
<name>bind99-base</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://www.isc.org/blogs/cve-2015-5986-an-incorrect-boundary-check-can-trigger-a-require-assertion-failure-in-openpgpkey_61-c/">
<p>An incorrect boundary check in openpgpkey_61.c can cause
named to terminate due to a REQUIRE assertion failure. This defect can
be deliberately exploited by an attacker who can provide a maliciously
constructed response in answer to a query.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.isc.org/blogs/cve-2015-5986-an-incorrect-boundary-check-can-trigger-a-require-assertion-failure-in-openpgpkey_61-c/</url>
<cvename>CVE-2015-5986</cvename>
</references>
<dates>
<discovery>2015-08-19</discovery>
<entry>2015-09-03</entry>
</dates>
</vuln>
<vuln vid="eaf3b255-5245-11e5-9ad8-14dae9d210b8">
<topic>bind -- denial of service vulnerability</topic>
<affects>
<package>
<name>bind99</name>
<range><lt>9.9.7P3</lt></range>
</package>
<package>
<name>bind910</name>
<range><ge>9.10.2</ge><lt>9.10.2P4</lt></range>
</package>
<package>
<name>bind910-base</name>
<name>bind99-base</name>
<range><gt>0</gt></range>
</package>
<package>
<name>FreeBSD</name>
<range><gt>9.3</gt><le>9.3_25</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://www.isc.org/blogs/cve-2015-5722-parsing-malformed-keys-may-cause-bind-to-exit-due-to-a-failed-assertion-in-buffer-c/">
<p>Parsing a malformed DNSSEC key can cause a validating
resolver to exit due to a failed assertion in buffer.c. It is possible
for a remote attacker to deliberately trigger this condition, for
example by using a query which requires a response from a zone
containing a deliberately malformed key.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.isc.org/blogs/cve-2015-5722-parsing-malformed-keys-may-cause-bind-to-exit-due-to-a-failed-assertion-in-buffer-c/</url>
<cvename>CVE-2015-5722</cvename>
</references>
<dates>
<discovery>2015-08-19</discovery>
<entry>2015-09-03</entry>
</dates>
</vuln>
<vuln vid="a9350df8-5157-11e5-b5c1-e8e0b747a45a">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>45.0.2454.85</lt></range>
</package>
<package>
<!--pcbsd-->
<name>chromium-npapi</name>
<range><lt>45.0.2454.85</lt></range>
</package>
<package>
<!--pcbsd-->
<name>chromium-pulse</name>
<range><lt>45.0.2454.85</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl">
<p>29 security fixes in this release, including:</p>
<ul>
<li>[516377] High CVE-2015-1291: Cross-origin bypass in DOM. Credit
to anonymous.</li>
<li>[522791] High CVE-2015-1292: Cross-origin bypass in
ServiceWorker. Credit to Mariusz Mlynski.</li>
<li>[524074] High CVE-2015-1293: Cross-origin bypass in DOM. Credit
to Mariusz Mlynski.</li>
<li>[492263] High CVE-2015-1294: Use-after-free in Skia. Credit
to cloudfuzzer.</li>
<li>[502562] High CVE-2015-1295: Use-after-free in Printing. Credit
to anonymous.</li>
<li>[421332] High CVE-2015-1296: Character spoofing in omnibox.
Credit to zcorpan.</li>
<li>[510802] Medium CVE-2015-1297: Permission scoping error in
Webrequest. Credit to Alexander Kashev.</li>
<li>[518827] Medium CVE-2015-1298: URL validation error in
extensions. Credit to Rob Wu.</li>
<li>[416362] Medium CVE-2015-1299: Use-after-free in Blink. Credit
to taro.suzuki.dev.</li>
<li>[511616] Medium CVE-2015-1300: Information leak in Blink. Credit
to cgvwzq.</li>
<li>[526825] CVE-2015-1301: Various fixes from internal audits,
fuzzing and other initiatives.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1291</cvename>
<cvename>CVE-2015-1292</cvename>
<cvename>CVE-2015-1293</cvename>
<cvename>CVE-2015-1294</cvename>
<cvename>CVE-2015-1295</cvename>
<cvename>CVE-2015-1296</cvename>
<cvename>CVE-2015-1297</cvename>
<cvename>CVE-2015-1298</cvename>
<cvename>CVE-2015-1299</cvename>
<cvename>CVE-2015-1300</cvename>
<cvename>CVE-2015-1301</cvename>
<url>http://googlechromereleases.blogspot.nl</url>
</references>
<dates>
<discovery>2015-09-01</discovery>
<entry>2015-09-02</entry>
</dates>
</vuln>
<vuln vid="55c43f5b-5190-11e5-9ad8-14dae9d210b8">
<topic>powerdns -- denial of service</topic>
<affects>
<package>
<name>powerdns</name>
<range><ge>3.4.0</ge><lt>3.4.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PowerDNS reports:</p>
<blockquote cite="https://doc.powerdns.com/md/security/powerdns-advisory-2015-02/">
<p>A bug was found in our DNS packet parsing/generation code,
which, when exploited, can cause individual threads (disabling service)
or whole processes (allowing a supervisor to restart them) to crash with
just one or a few query packets.</p>
</blockquote>
</body>
</description>
<references>
<url>https://doc.powerdns.com/md/security/powerdns-advisory-2015-02/</url>
<cvename>CVE-2015-5230</cvename>
</references>
<dates>
<discovery>2015-09-02</discovery>
<entry>2015-09-02</entry>
</dates>
</vuln>
<vuln vid="fc1f6658-4f53-11e5-934b-002590263bf5">
<topic>ghostscript -- denial of service (crash) via crafted Postscript files</topic>
<affects>
<package>
<name>ghostscript7</name>
<name>ghostscript7-nox11</name>
<name>ghostscript7-base</name>
<name>ghostscript7-x11</name>
<range><lt>7.07_32</lt></range>
</package>
<package>
<name>ghostscript8</name>
<name>ghostscript8-nox11</name>
<name>ghostscript8-base</name>
<name>ghostscript8-x11</name>
<range><lt>8.71_19</lt></range>
</package>
<package>
<name>ghostscript9</name>
<name>ghostscript9-nox11</name>
<name>ghostscript9-base</name>
<name>ghostscript9-x11</name>
<range><lt>9.06_11</lt></range>
</package>
<package>
<name>ghostscript9-agpl</name>
<name>ghostscript9-agpl-nox11</name>
<range><lt>9.15_2</lt></range>
</package>
<package>
<name>ghostscript9-agpl-base</name>
<name>ghostscript9-agpl-x11</name>
<range><lt>9.16_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3228">
<p>Integer overflow in the gs_heap_alloc_bytes function in
base/gsmalloc.c in Ghostscript 9.15 and earlier allows remote
attackers to cause a denial of service (crash) via a crafted
Postscript (ps) file, as demonstrated by using the ps2pdf command,
which triggers an out-of-bounds read or write.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3228</cvename>
<url>http://bugs.ghostscript.com/show_bug.cgi?id=696041</url>
<url>http://bugs.ghostscript.com/show_bug.cgi?id=696070</url>
<url>http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=0c0b0859</url>
</references>
<dates>
<discovery>2015-06-17</discovery>
<entry>2015-09-01</entry>
<modified>2015-09-02</modified>
</dates>
</vuln>
<vuln vid="80c66af0-d1c5-449e-bd31-63b12525ff88">
<topic>ffmpeg -- out-of-bounds array access</topic>
<affects>
<package>
<name>libav</name>
<range><ge>11.0</ge><lt>11.4</lt></range>
<range><lt>10.7</lt></range>
</package>
<package>
<name>gstreamer1-libav</name>
<!-- gst-libav-1.4.5 has libav-10.5 -->
<range><lt>1.5.1</lt></range>
</package>
<package>
<name>handbrake</name>
<!-- handbrake-0.10.2 has libav-10.1 -->
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>ffmpeg</name>
<range><ge>2.2.0,1</ge><lt>2.2.15,1</lt></range>
<range><lt>2.0.7,1</lt></range>
</package>
<package>
<name>ffmpeg26</name>
<range><lt>2.6.2</lt></range>
</package>
<package>
<name>ffmpeg25</name>
<range><lt>2.5.6</lt></range>
</package>
<package>
<name>ffmpeg24</name>
<range><lt>2.4.8</lt></range>
</package>
<package>
<name>ffmpeg23</name>
<!-- just in case: f7e1367 wasn't cherry-picked -->
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>ffmpeg1</name>
<!-- just in case: f7e1367 wasn't cherry-picked -->
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>avidemux</name>
<name>avidemux26</name>
<!-- avidemux-2.6.10 has ffmpeg-2.6.1 -->
<range><lt>2.6.11</lt></range>
</package>
<package>
<name>kodi</name>
<!-- kodi-14.2 has ffmpeg-2.4.6 -->
<range><lt>15.1</lt></range>
</package>
<package>
<name>mplayer</name>
<name>mencoder</name>
<!-- mplayer-1.1.r20141223 has ffmpeg-2.5.1+ (snapshot, 03b84f2) -->
<range><lt>1.1.r20150403</lt></range>
</package>
<package>
<name>mythtv</name>
<name>mythtv-frontend</name>
<!-- mythtv-0.27.0.20140121 has ffmpeg-1.2.2+ (snapshot, f9c8726) -->
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3395">
<p>The msrle_decode_pal4 function in msrledec.c in Libav
before 10.7 and 11.x before 11.4 and FFmpeg before 2.0.7,
2.2.x before 2.2.15, 2.4.x before 2.4.8, 2.5.x before 2.5.6,
and 2.6.x before 2.6.2 allows remote attackers to have
unspecified impact via a crafted image, related to a pixel
pointer, which triggers an out-of-bounds array access.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3395</cvename>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=f7e1367f58263593e6cee3c282f7277d7ee9d553</url>
<url>https://git.libav.org/?p=libav.git;a=commit;h=5ecabd3c54b7c802522dc338838c9a4c2dc42948</url>
<url>https://ffmpeg.org/security.html</url>
<url>https://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v11.4</url>
</references>
<dates>
<discovery>2015-04-12</discovery>
<entry>2015-09-01</entry>
<modified>2015-09-20</modified>
</dates>
</vuln>
<vuln vid="da434a78-e342-4d9a-87e2-7497e5f117ba">
<topic>ffmpeg -- use-after-free</topic>
<affects>
<package>
<name>libav</name>
<range><ge>11.0</ge><lt>11.4</lt></range>
<range><lt>10.7</lt></range>
</package>
<package>
<name>gstreamer1-libav</name>
<!-- gst-libav-1.4.5 has libav-10.5 -->
<range><lt>1.5.0</lt></range>
</package>
<package>
<name>handbrake</name>
<!-- handbrake-0.10.2 has libav-10.1 -->
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>ffmpeg</name>
<range><ge>2.2.0,1</ge><lt>2.2.12,1</lt></range>
<range><ge>2.1.0,1</ge><lt>2.1.7,1</lt></range>
<range><lt>2.0.7,1</lt></range>
</package>
<package>
<name>ffmpeg25</name>
<range><lt>2.5.2</lt></range>
</package>
<package>
<name>ffmpeg24</name>
<range><lt>2.4.5</lt></range>
</package>
<package>
<name>ffmpeg23</name>
<range><lt>2.3.6</lt></range>
</package>
<package>
<name>ffmpeg1</name>
<range><lt>1.2.11</lt></range>
</package>
<package>
<name>mythtv</name>
<name>mythtv-frontend</name>
<!-- mythtv-0.27.0.20140121 has ffmpeg-1.2.2+ (snapshot, f9c8726) -->
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3417">
<p>Use-after-free vulnerability in the ff_h264_free_tables
function in libavcodec/h264.c in FFmpeg before 2.3.6 allows
remote attackers to cause a denial of service or possibly
have unspecified other impact via crafted H.264 data in an
MP4 file, as demonstrated by an HTML VIDEO element that
references H.264 data.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3417</cvename>
<!-- ffmpeg and libav fixes are different -->
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=e8714f6f93d1a32f4e4655209960afcf4c185214</url>
<url>https://git.libav.org/?p=libav.git;a=commitdiff;h=3b69f245dbe6e2016659a45c4bfe284f6c5ac57e</url>
<url>https://ffmpeg.org/security.html</url>
<url>https://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v11.4</url>
</references>
<dates>
<discovery>2014-12-19</discovery>
<entry>2015-09-01</entry>
</dates>
</vuln>
<vuln vid="5300711b-4e61-11e5-9ad8-14dae9d210b8">
<topic>graphviz -- format string vulnerability</topic>
<affects>
<package>
<name>graphviz</name>
<range><lt>2.38.0_7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Joshua Rogers reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2014/q4/784">
<p>A format string vulnerability has been found in `graphviz'.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2014/q4/784</url>
<url>https://github.com/ellson/graphviz/commit/99eda421f7ddc27b14e4ac1d2126e5fe41719081</url>
</references>
<dates>
<discovery>2014-11-24</discovery>
<entry>2015-08-29</entry>
</dates>
</vuln>
<vuln vid="237a201c-888b-487f-84d3-7d92266381d6">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>40.0.3,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>40.0.3,1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>38.2.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/">
<p>MFSA 2015-95 Add-on notification bypass through data URLs</p>
<p>MFSA 2015-94 Use-after-free when resizing canvas element
during restyling</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4497</cvename>
<cvename>CVE-2015-4498</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2015-94/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-95/</url>
</references>
<dates>
<discovery>2015-08-27</discovery>
<entry>2015-08-28</entry>
</dates>
</vuln>
<vuln vid="4464212e-4acd-11e5-934b-002590263bf5">
<topic>go -- multiple vulnerabilities</topic>
<affects>
<package>
<name>go</name>
<range><lt>1.4.3,1</lt></range>
</package>
<package>
<name>go14</name>
<range><lt>1.4.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jason Buberel, Go Product Manager, reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q3/237">
<p>CVE-2015-5739 - "Content Length" treated as valid header</p>
<p>CVE-2015-5740 - Double content-length headers does not return 400
error</p>
<p>CVE-2015-5741 - Additional hardening, not sending Content-Length
w/Transfer-Encoding, Closing connections</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5739</cvename>
<cvename>CVE-2015-5740</cvename>
<cvename>CVE-2015-5741</cvename>
<url>https://github.com/golang/go/commit/117ddcb83d7f42d6aa72241240af99ded81118e9</url>
<url>https://github.com/golang/go/commit/143822585e32449860e624cace9d2e521deee62e</url>
<url>https://github.com/golang/go/commit/300d9a21583e7cf0149a778a0611e76ff7c6680f</url>
<url>http://seclists.org/oss-sec/2015/q3/237</url>
</references>
<dates>
<discovery>2015-07-29</discovery>
<entry>2015-08-25</entry>
</dates>
</vuln>
<vuln vid="40497e81-fee3-4e54-9d5f-175a5c633b73">
<topic>libtremor -- memory corruption</topic>
<affects>
<package>
<name>libtremor</name>
<range><lt>1.2.0.s20120120</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2012-07/">
<p>Security researcher regenrecht reported via
TippingPoint's Zero Day Initiative the possibility of memory
corruption during the decoding of Ogg Vorbis files. This can
cause a crash during decoding and has the potential for
remote code execution.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0444</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=719612</url>
<url>https://git.xiph.org/?p=tremor.git;a=commitdiff;h=3daa274</url>
</references>
<dates>
<discovery>2012-01-31</discovery>
<entry>2015-08-25</entry>
<modified>2015-08-25</modified>
</dates>
</vuln>
<vuln vid="3dac84c9-bce1-4199-9784-d68af1eb7b2e">
<topic>libtremor -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libtremor</name>
<range><lt>1.2.0.s20101013</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The RedHat Project reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=438125">
<p>Will Drewry of the Google Security Team reported multiple
issues in OGG Vorbis and Tremor libraries, that could cause
application using those libraries to crash (NULL pointer
dereference or divide by zero), enter an infinite loop or
cause heap overflow caused by integer overflow.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-1418</cvename>
<cvename>CVE-2008-1419</cvename>
<cvename>CVE-2008-1420</cvename>
<cvename>CVE-2008-1423</cvename>
<cvename>CVE-2008-2009</cvename>
<url>http://redpig.dataspill.org/2008/05/multiple-vulnerabilities-in-ogg-tremor.html</url>
<url>https://git.xiph.org/?p=tremor.git;a=commitdiff;h=7e94eea</url>
<url>https://git.xiph.org/?p=tremor.git;a=commitdiff;h=1d1f93e</url>
<url>https://git.xiph.org/?p=tremor.git;a=commitdiff;h=159efc4</url>
</references>
<dates>
<discovery>2008-03-19</discovery>
<entry>2015-08-25</entry>
<modified>2015-08-25</modified>
</dates>
</vuln>
<vuln vid="6900e6f1-4a79-11e5-9ad8-14dae9d210b8">
<topic>pcre -- heap overflow vulnerability</topic>
<affects>
<package>
<name>pcre</name>
<range><lt>8.37_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Guanxing Wen reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q3/295">
<p>PCRE library is prone to a vulnerability which leads to
Heap Overflow.
During the compilation of a malformed regular expression, more data is
written on the malloced block than the expected size output by
compile_regex().
The Heap Overflow vulnerability is caused by the following regular
expression.</p>
<p>/(?J:(?|(:(?|(?'R')(\z(?|(?'R')(\k'R')|((?'R')))k'R')|((?'R')))H'Ak'Rf)|s(?'R')))/</p>
<p>A dry run of this particular regular expression with pcretest will
reports "double free or corruption (!prev)".
But it is actually a heap overflow problem.
The overflow only affects pcre 8.x branch, pcre2 branch is not affected.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2015/q3/295</url>
<url>https://bugs.exim.org/show_bug.cgi?id=1672</url>
</references>
<dates>
<discovery>2015-08-21</discovery>
<entry>2015-08-24</entry>
</dates>
</vuln>
<vuln vid="9393213d-489b-11e5-b8c7-d050996490d0">
<topic>drupal -- multiple vulnerabilities</topic>
<affects>
<package>
<name>drupal6</name>
<range><lt>6.37</lt></range>
</package>
<package>
<name>drupal7</name>
<range><lt>7.39</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal development team reports:</p>
<blockquote cite="https://www.drupal.org/SA-CORE-2015-003">
<p>This security advisory fixes multiple vulnerabilities.
See below for a list.</p>
<h3>Cross-site Scripting - Ajax system - Drupal 7</h3>
<p>A vulnerability was found that allows a malicious
user to perform a cross-site scripting attack by
invoking Drupal.ajax() on a whitelisted HTML element.</p>
<p>This vulnerability is mitigated on sites that do not
allow untrusted users to enter HTML.</p>
<h3>Cross-site Scripting - Autocomplete system - Drupal 6 and 7</h3>
<p>A cross-site scripting vulnerability was found in
the autocomplete functionality of forms. The
requested URL is not sufficiently sanitized.</p>
<p>This vulnerability is mitigated by the fact that
the malicious user must be allowed to upload files.</p>
<h3>SQL Injection - Database API - Drupal 7</h3>
<p>A vulnerability was found in the SQL comment
filtering system which could allow a user with
elevated permissions to inject malicious code in
SQL comments.</p>
<p>This vulnerability is mitigated by the fact that
only one contributed module that the security team
found uses the comment filtering system in a way
that would trigger the vulnerability. That module
requires you to have a very high level of access
in order to perform the attack.</p>
<h3>Cross-site Request Forgery - Form API - Drupal 6 and 7</h3>
<p>A vulnerability was discovered in Drupal's form API
that could allow file upload value callbacks to run
with untrusted input, due to form token validation
not being performed early enough. This vulnerability
could allow a malicious user to upload files to the
site under another user's account.</p>
<p>This vulnerability is mitigated by the fact that
the uploaded files would be temporary, and Drupal
normally deletes temporary files automatically
after 6 hours.</p>
<h3>Information Disclosure in Menu Links - Access system - Drupal 6 and 7</h3>
<p>Users without the "access content" permission
can see the titles of nodes that they do not have
access to, if the nodes are added to a menu on the
site that the users have access to.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.drupal.org/SA-CORE-2015-003</url>
</references>
<dates>
<discovery>2015-08-19</discovery>
<entry>2015-08-22</entry>
</dates>
</vuln>
<vuln vid="2920c449-4850-11e5-825f-c80aa9043978">
<topic>OpenSSH -- PAM vulnerabilities</topic>
<affects>
<package>
<name>openssh-portable</name>
<range><lt>7.0.p1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="http://www.openssh.com/txt/release-7.0">
<p>OpenSSH 6.8 and 6.9 incorrectly set TTYs to be world-writable.
Local attackers may be able to write arbitrary messages to
logged-in users, including terminal escape sequences. Reported
by Nikolay Edigaryev.</p>
<p>Fixed a privilege separation
weakness related to PAM support. Attackers who could successfully
compromise the pre-authentication process for remote code
execution and who had valid credentials on the host could
impersonate other users.</p>
<p>Fixed a use-after-free bug
related to PAM support that was reachable by attackers who could
compromise the pre-authentication process for remote code
execution.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openssh.com/txt/release-7.0</url>
<cvename>CVE-2015-6563</cvename>
<cvename>CVE-2015-6564</cvename>
<cvename>CVE-2015-6565</cvename>
</references>
<dates>
<discovery>2015-08-11</discovery>
<entry>2015-08-21</entry>
<modified>2016-02-14</modified>
</dates>
</vuln>
<vuln vid="27fed73e-484f-11e5-825f-c80aa9043978">
<topic>OpenSSH -- PermitRootLogin may allow password connections with 'without-password'</topic>
<affects>
<package>
<name>openssh-portable</name>
<range><eq>7.0.p1,1</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="http://www.openssh.com/txt/release-7.1">
<p>OpenSSH 7.0 contained a logic error in PermitRootLogin=
prohibit-password/without-password that could, depending on
compile-time configuration, permit password authentication to
root while preventing other forms of authentication. This problem
was reported by Mantas Mikulenas.
</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openssh.com/txt/release-7.1</url>
</references>
<dates>
<discovery>2015-08-20</discovery>
<entry>2015-08-21</entry>
</dates>
</vuln>
<vuln vid="2fe40238-480f-11e5-adde-14dae9d210b8">
<topic>tarsnap -- buffer overflow and local DoS</topic>
<affects>
<package>
<name>tarsnap</name>
<range><lt>1.0.36</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Colin Percival reports:</p>
<blockquote cite="http://mail.tarsnap.com/tarsnap-announce/msg00032.html">
<p>1. SECURITY FIX: When constructing paths of objects being archived, a buffer
could overflow by one byte upon encountering 1024, 2048, 4096, etc. byte
paths. Theoretically this could be exploited by an unprivileged user whose
files are being archived; I do not believe it is exploitable in practice,
but I am offering a $1000 bounty for the first person who can prove me wrong:
http://www.daemonology.net/blog/2015-08-21-tarsnap-1000-exploit-bounty.html</p>
<p>2. SECURITY FIX: An attacker with a machine's write keys, or with read keys
and control of the tarsnap service, could make tarsnap allocate a large
amount of memory upon listing archives or reading an archive the attacker
created; on 32-bit machines, tarsnap can be caused to crash under the
aforementioned conditions.</p>
</blockquote>
</body>
</description>
<references>
<url>http://mail.tarsnap.com/tarsnap-announce/msg00032.html</url>
<url>http://www.daemonology.net/blog/2015-08-21-tarsnap-1000-exploit-bounty.html</url>
</references>
<dates>
<discovery>2015-08-21</discovery>
<entry>2015-08-21</entry>
</dates>
</vuln>
<vuln vid="a0a4e24c-4760-11e5-9391-3c970e169bc2">
<topic>vlc -- arbitrary pointer dereference vulnerability</topic>
<affects>
<package>
<name>vlc</name>
<range><lt>2.2.1_5,4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>oCERT reports:</p>
<blockquote cite="https://www.ocert.org/advisories/ocert-2015-009.html">
<p>The stable VLC version suffers from an arbitrary pointer
dereference vulnerability.</p>
<p>The vulnerability affects the 3GP file format parser,
insufficient restrictions on a writable buffer can be
exploited to execute arbitrary code via the heap memory.
A specific 3GP file can be crafted to trigger the
vulnerability.</p>
<p>Credit: vulnerability reported by Loren Maggiore of
Trail of Bits.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5949</cvename>
<url>https://git.videolan.org/?p=vlc/vlc-2.2.git;a=commitdiff;h=ce91452460a75d7424b165c4dc8db98114c3cbd9;hp=9e12195d3e4316278af1fa4bcb6a705ff27456fd</url>
<url>https://www.ocert.org/advisories/ocert-2015-009.html</url>
</references>
<dates>
<discovery>2015-08-20</discovery>
<entry>2015-08-20</entry>
</dates>
</vuln>
<vuln vid="9a71953a-474a-11e5-adde-14dae9d210b8">
<topic>libpgf -- use-after-free</topic>
<affects>
<package>
<name>libpgf</name>
<range><le>6.14.12</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Pengsu Cheng reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q3/404">
<p>An use-after-free issue in Decoder.cpp was reported to
upstream. The problem is due to lack of validation of ColorTableSize.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2015/q3/404</url>
<url>https://sourceforge.net/p/libpgf/code/147/</url>
<url>https://sourceforge.net/p/libpgf/code/148/</url>
<cvename>CVE-2015-6673</cvename>
</references>
<dates>
<discovery>2015-08-08</discovery>
<entry>2015-08-20</entry>
<modified>2015-08-26</modified>
</dates>
</vuln>
<vuln vid="f5b8b670-465c-11e5-a49d-bcaec565249c">
<topic>gdk-pixbuf2 -- heap overflow and DoS</topic>
<affects>
<package>
<name>gdk-pixbuf2</name>
<range><lt>2.31.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gustavo Grieco reports:</p>
<blockquote cite="https://bugzilla.gnome.org/show_bug.cgi?id=752297">
<p>We found a heap overflow and a DoS in the gdk-pixbuf
implementation triggered by the scaling of a malformed bmp.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4491</cvename>
<url>https://bugzilla.gnome.org/show_bug.cgi?id=752297</url>
</references>
<dates>
<discovery>2015-07-12</discovery>
<entry>2015-08-19</entry>
</dates>
</vuln>
<vuln vid="b0e54dc1-45d2-11e5-adde-14dae9d210b8">
<topic>django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py27-django</name>
<name>py32-django</name>
<name>py33-django</name>
<name>py34-django</name>
<range><lt>1.8.4</lt></range>
</package>
<package>
<name>py27-django17</name>
<name>py32-django17</name>
<name>py33-django17</name>
<name>py34-django17</name>
<range><lt>1.7.10</lt></range>
</package>
<package>
<name>py27-django14</name>
<name>py32-django14</name>
<name>py33-django14</name>
<name>py34-django14</name>
<range><lt>1.4.22</lt></range>
</package>
<package>
<name>py27-django-devel</name>
<name>py32-django-devel</name>
<name>py33-django-devel</name>
<name>py34-django-devel</name>
<range><le>20150709,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tim Graham reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2015/aug/18/security-releases/">
<p>Denial-of-service possibility in logout() view by filling
session store</p>
<p>Previously, a session could be created when anonymously
accessing the django.contrib.auth.views.logout view
(provided it wasn't decorated with django.contrib.auth.decorators.login_required
as done in the admin). This could allow an attacker to
easily create many new session records by sending repeated
requests, potentially filling up the session store or
causing other users' session records to be evicted.</p>
<p>The django.contrib.sessions.middleware.SessionMiddleware
has been modified to no longer create empty session records.</p>
<p>This portion of the fix has been assigned CVE-2015-5963.</p>
<p>Additionally, on the 1.4 and 1.7 series only, the
contrib.sessions.backends.base.SessionBase.flush() and
cache_db.SessionStore.flush() methods have been modified
to avoid creating a new empty session. Maintainers of
third-party session backends should check if the same
vulnerability is present in their backend and correct
it if so.</p>
<p>This portion of the fix has been assigned CVE-2015-5964.
Anyone reporting a similar vulnerability in a third-party
session backend should not use this CVE ID.</p>
<p>Thanks Lin Hua Cheng for reporting the issue.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.djangoproject.com/weblog/2015/aug/18/security-releases/</url>
<cvename>CVE-2015-5963</cvename>
<cvename>CVE-2015-5964</cvename>
</references>
<dates>
<discovery>2015-08-18</discovery>
<entry>2015-08-18</entry>
</dates>
</vuln>
<vuln vid="0ecc1f55-45d0-11e5-adde-14dae9d210b8">
<topic>unreal -- denial of service</topic>
<affects>
<package>
<name>Unreal</name>
<range><ge>3.2.10</ge><lt>3.2.10.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Unreal reports:</p>
<blockquote cite="https://www.unrealircd.org/txt/unrealsecadvisory.20150816.txt">
<p>Summary: If SASL support is enabled in UnrealIRCd (this is
not the default) and is also enabled in your services
package then a malicious user with a services account can cause
UnrealIRCd to crash.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.unrealircd.org/txt/unrealsecadvisory.20150816.txt</url>
<url>http://seclists.org/oss-sec/2015/q3/367</url>
</references>
<dates>
<discovery>2015-08-13</discovery>
<entry>2015-08-18</entry>
</dates>
</vuln>
<vuln vid="f1692469-45ce-11e5-adde-14dae9d210b8">
<topic>jasper -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jasper</name>
<range><lt>1.900.1_16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Martin Prpic reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=1254242#c0">
<p>A double free flaw was found in the way JasPer's
jasper_image_stop_load() function parsed certain JPEG 2000 image files.
A specially crafted file could cause an application using JasPer to
crash.</p>
</blockquote>
<p>Feist Josselin reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q3/408">
<p>A new use-after-free was found in Jasper JPEG-200. The
use-after-free appears in the function mif_process_cmpt of the
src/libjasper/mif/mif_cod.c file.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1254242#c0</url>
<url>http://seclists.org/oss-sec/2015/q3/366</url>
<url>http://seclists.org/oss-sec/2015/q3/408</url>
<cvename>CVE-2015-5203</cvename>
<cvename>CVE-2015-5221</cvename>
</references>
<dates>
<discovery>2015-08-17</discovery>
<entry>2015-08-18</entry>
<modified>2016-02-24</modified>
</dates>
</vuln>
<vuln vid="a59e263a-45cd-11e5-adde-14dae9d210b8">
<topic>freexl -- integer overflow</topic>
<affects>
<package>
<name>freexl</name>
<range><lt>1.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Stefan Cornelius reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/07/06/7">
<p>There's an integer overflow in the allocate_cells() function
when trying to allocate the memory for worksheet with specially
crafted row/column dimensions. This can be exploited to cause a
heap memory corruption. The most likely outcome of this is a crash
when trying to initialize the cells later in the function.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2015/07/06/7</url>
</references>
<dates>
<discovery>2015-07-06</discovery>
<entry>2015-08-18</entry>
</dates>
</vuln>
<vuln vid="ac98d090-45cc-11e5-adde-14dae9d210b8">
<topic>freexl -- multiple vulnerabilities</topic>
<affects>
<package>
<name>freexl</name>
<range><lt>1.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jodie Cunningham reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/03/25/1">
<p>#1: A flaw was found in the way FreeXL reads sectors from
the input file. A specially crafted file could possibly
result in stack corruption near freexl.c:3752.</p>
<p>#2: A flaw was found in the function allocate_cells(). A
specially crafted file with invalid workbook dimensions
could possibly result in stack corruption near freexl.c:1074</p>
<p>#3: A flaw was found in the way FreeXL handles a premature EOF. A
specially crafted input file could possibly result in stack corruption
near freexl.c:1131</p>
<p>#4: FreeXL 1.0.0g did not properly check requests for workbook memory
allocation. A specially crafted input file could cause a Denial of
Service, or possibly write onto the stack.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2015/03/25/1</url>
<cvename>CVE-2015-2776</cvename>
</references>
<dates>
<discovery>2015-03-24</discovery>
<entry>2015-08-18</entry>
</dates>
</vuln>
<vuln vid="47aa4343-44fa-11e5-9daa-14dae9d210b8">
<topic>mod_jk -- information disclosure</topic>
<affects>
<package>
<name>ap22-mod_jk</name>
<name>ap24-mod_jk</name>
<range><lt>1.2.41,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NIST reports:</p>
<blockquote cite="http://www.cvedetails.com/cve/CVE-2014-8111/">
<p>Apache Tomcat Connectors (mod_jk) before 1.2.41 ignores
JkUnmount rules for subtrees of previous JkMount rules, which allows
remote attackers to access otherwise restricted artifacts via
unspecified vectors. </p>
</blockquote>
</body>
</description>
<references>
<url>https://www.mail-archive.com/users@tomcat.apache.org/msg118949.html</url>
<url>http://readlist.com/lists/tomcat.apache.org/users/27/135512.html</url>
<url>http://www.cvedetails.com/cve/CVE-2014-8111/</url>
<cvename>CVE-2014-8111</cvename>
</references>
<dates>
<discovery>2015-01-15</discovery>
<entry>2015-08-17</entry>
</dates>
</vuln>
<vuln vid="f06f20dc-4347-11e5-93ad-002590263bf5">
<topic>qemu, xen-tools -- QEMU leak of uninitialized heap memory in rtl8139 device model</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><le>0.11.1_20</le></range>
<range><ge>0.12</ge><le>2.3.0_2</le></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.4.50.g20150814</lt></range>
</package>
<package>
<name>xen-tools</name>
<range><lt>4.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-140.html">
<p>The QEMU model of the RTL8139 network card did not sufficiently
validate inputs in the C+ mode offload emulation. This results in
uninitialised memory from the QEMU process's heap being leaked to
the domain as well as to the network.</p>
<p>A guest may be able to read sensitive host-level data relating to
itself which resides in the QEMU process.</p>
<p>Such information may include things such as information relating to
real devices backing emulated devices or passwords which the host
administrator does not intend to share with the guest admin.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5165</cvename>
<url>http://xenbits.xen.org/xsa/advisory-140.html</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=2a3612ccc1fa9cea77bd193afbfe21c77e7e91ef</url>
</references>
<dates>
<discovery>2015-08-03</discovery>
<entry>2015-08-17</entry>
<modified>2015-08-19</modified>
</dates>
</vuln>
<vuln vid="ee99899d-4347-11e5-93ad-002590263bf5">
<topic>qemu, xen-tools -- use-after-free in QEMU/Xen block unplug protocol</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><le>0.11.1_20</le></range>
<range><ge>0.12</ge><le>2.3.0_2</le></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.4.50.g20150814</lt></range>
</package>
<package>
<name>xen-tools</name>
<range><lt>4.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-139.html">
<p>When unplugging an emulated block device the device was not fully
unplugged, meaning a second unplug attempt would attempt to unplug
the device a second time using a previously freed pointer.</p>
<p>An HVM guest which has access to an emulated IDE disk device may be
able to exploit this vulnerability in order to take over the qemu
process elevating its privilege to that of the qemu process.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5166</cvename>
<url>http://xenbits.xen.org/xsa/advisory-139.html</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=260425ab405ea76c44dd59744d05176d4f579a52</url>
</references>
<dates>
<discovery>2015-08-03</discovery>
<entry>2015-08-17</entry>
<modified>2015-08-19</modified>
</dates>
</vuln>
<vuln vid="787ef75e-44da-11e5-93ad-002590263bf5">
<topic>php5 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php5</name>
<name>php5-openssl</name>
<name>php5-phar</name>
<name>php5-soap</name>
<range><lt>5.4.44</lt></range>
</package>
<package>
<name>php55</name>
<name>php55-openssl</name>
<name>php55-phar</name>
<name>php55-soap</name>
<range><lt>5.5.28</lt></range>
</package>
<package>
<name>php56</name>
<name>php56-openssl</name>
<name>php56-phar</name>
<name>php56-soap</name>
<range><lt>5.6.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP project reports:</p>
<blockquote cite="http://php.net/ChangeLog-5.php">
<p>Core:</p>
<ul>
<li>Fixed bug #69793 (Remotely triggerable stack exhaustion via
recursive method calls).</li>
<li>Fixed bug #70121 (unserialize() could lead to unexpected methods
execution / NULL pointer deref).</li>
</ul>
<p>OpenSSL:</p>
<ul>
<li>Fixed bug #70014 (openssl_random_pseudo_bytes() is not
cryptographically secure).</li>
</ul>
<p>Phar:</p>
<ul>
<li>Improved fix for bug #69441.</li>
<li>Fixed bug #70019 (Files extracted from archive may be placed
outside of destination directory).</li>
</ul>
<p>SOAP:</p>
<ul>
<li>Fixed bug #70081 (SoapClient info leak / null pointer
dereference via multiple type confusions).</li>
</ul>
<p>SPL:</p>
<ul>
<li>Fixed bug #70068 (Dangling pointer in the unserialization of
ArrayObject items).</li>
<li>Fixed bug #70166 (Use After Free Vulnerability in unserialize()
with SPLArrayObject).</li>
<li>Fixed bug #70168 (Use After Free Vulnerability in unserialize()
with SplObjectStorage).</li>
<li>Fixed bug #70169 (Use After Free Vulnerability in unserialize()
with SplDoublyLinkedList).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://php.net/ChangeLog-5.php#5.4.44</url>
<url>http://php.net/ChangeLog-5.php#5.5.28</url>
<url>http://php.net/ChangeLog-5.php#5.6.12</url>
<cvename>CVE-2015-6831</cvename>
<cvename>CVE-2015-6832</cvename>
<cvename>CVE-2015-6833</cvename>
</references>
<dates>
<discovery>2015-08-06</discovery>
<entry>2015-08-17</entry>
<modified>2015-09-08</modified>
</dates>
</vuln>
<vuln vid="6241b5df-42a1-11e5-93ad-002590263bf5">
<topic>mediawiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mediawiki123</name>
<range><lt>1.23.10</lt></range>
</package>
<package>
<name>mediawiki124</name>
<range><lt>1.24.3</lt></range>
</package>
<package>
<name>mediawiki125</name>
<range><lt>1.25.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MediaWiki reports:</p>
<blockquote cite="https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-August/000179.html">
<p>Internal review discovered that Special:DeletedContributions did
not properly protect the IP of autoblocked users. This fix makes
the functionality of Special:DeletedContributions consistent with
Special:Contributions and Special:BlockList.</p>
<p>Internal review discovered that watchlist anti-csrf tokens were not
being compared in constant time, which could allow various timing
attacks. This could allow an attacker to modify a user's watchlist
via csrf</p>
<p>John Menerick reported that MediaWiki's thumb.php failed to sanitize
various error messages, resulting in xss.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-6727</cvename>
<cvename>CVE-2013-7444</cvename>
<cvename>CVE-2015-6728</cvename>
<cvename>CVE-2015-6729</cvename>
<cvename>CVE-2015-6730</cvename>
<cvename>CVE-2015-6731</cvename>
<cvename>CVE-2015-6733</cvename>
<cvename>CVE-2015-6734</cvename>
<cvename>CVE-2015-6735</cvename>
<cvename>CVE-2015-6736</cvename>
<cvename>CVE-2015-6737</cvename>
<url>https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-August/000179.html</url>
<url>https://phabricator.wikimedia.org/T106893</url>
<url>https://phabricator.wikimedia.org/T94116</url>
<url>https://phabricator.wikimedia.org/T97391</url>
<url>http://www.openwall.com/lists/oss-security/2015/08/27/6</url>
</references>
<dates>
<discovery>2015-08-10</discovery>
<entry>2015-08-14</entry>
<modified>2015-12-24</modified>
</dates>
</vuln>
<vuln vid="0c2c4d84-42a2-11e5-9daa-14dae9d210b8">
<topic>freeradius3 -- insufficient validation on packets</topic>
<affects>
<package>
<name>freeradius3</name>
<range><lt>3.0.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jouni Malinen reports:</p>
<blockquote cite="http://freeradius.org/security.html#eap-pwd-2015">
<p>The EAP-PWD module performed insufficient validation on
packets received from an EAP peer. This module is not enabled in the
default configuration. Administrators must manually enable it for their
server to be vulnerable. Only versions 3.0 up to 3.0.8 are affected.</p>
</blockquote>
</body>
</description>
<references>
<url>http://freeradius.org/security.html#eap-pwd-2015</url>
</references>
<dates>
<discovery>2015-04-04</discovery>
<entry>2015-08-14</entry>
</dates>
</vuln>
<vuln vid="ec6a2a1e-429d-11e5-9daa-14dae9d210b8">
<topic>gnutls -- double free in certificate DN decoding</topic>
<affects>
<package>
<name>gnutls</name>
<range><lt>3.3.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>gnutls.org reports:</p>
<blockquote cite="http://www.gnutls.org/security.html#GNUTLS-SA-2015-3">
<p>Kurt Roeckx reported that decoding a specific certificate with very
long DistinguishedName (DN) entries leads to double free, which may
result to a denial of service. Since the DN decoding occurs in almost
all applications using certificates it is recommended to upgrade the
latest GnuTLS version fixing the issue. Recommendation: Upgrade to
GnuTLS 3.4.4, or 3.3.17.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.gnutls.org/security.html#GNUTLS-SA-2015-3</url>
<mlist>http://seclists.org/oss-sec/2015/q3/308</mlist>
<url>https://gitlab.com/gnutls/gnutls/commit/272854367efc130fbd4f1a51840d80c630214e12</url>
<cvename>CVE-2015-6251</cvename>
</references>
<dates>
<discovery>2015-07-20</discovery>
<entry>2015-08-14</entry>
<modified>2015-08-18</modified>
</dates>
</vuln>
<vuln vid="3de36a19-429d-11e5-9daa-14dae9d210b8">
<topic>gnutls -- MD5 downgrade in TLS signatures</topic>
<affects>
<package>
<name>gnutls</name>
<range><lt>3.3.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Karthikeyan Bhargavan reports:</p>
<blockquote cite="http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/8132">
<p>GnuTLS does not by default support MD5 signatures. Indeed the RSA-MD5
signature-hash algorithm needs to be explicitly enabled using the
priority option VERIFY_ALLOW_SIGN_RSA_MD5. In the NORMAL and SECURE
profiles, GnuTLS clients do not offer RSA-MD5 in the signature
algorithms extension. However, we find that all GnuTLS clients still
accept RSA-MD5 in the ServerKeyExchange and GnuTLS servers still
accept RSA-MD5 in the ClientCertificateVerify.</p>
</blockquote>
</body>
</description>
<references>
<mlist>http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/8132</mlist>
<url>http://www.gnutls.org/security.html#GNUTLS-SA-2015-2</url>
<mlist>http://seclists.org/oss-sec/2015/q2/367</mlist>
</references>
<dates>
<discovery>2015-04-25</discovery>
<entry>2015-08-14</entry>
</dates>
</vuln>
<vuln vid="9ee72858-4159-11e5-93ad-002590263bf5">
<topic>froxlor -- database password information leak</topic>
<affects>
<package>
<name>froxlor</name>
<range><lt>0.9.33.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>oss-security-list@demlak.de reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q3/238">
<p>An unauthenticated remote attacker is able to get the database
password via webaccess due to wrong file permissions of the /logs/
folder in froxlor version 0.9.33.1 and earlier. The plain SQL
password and username may be stored in the /logs/sql-error.log file.
This directory is publicly reachable under the default
configuration/setup.</p>
</blockquote>
<p>Note that froxlor 0.9.33.2 prevents future logging of passwords but
does not retroactively remove passwords already logged. Michael
Kaufmann, the Froxlor lead developer reports:</p>
<blockquote cite="http://forum.froxlor.org/index.php/topic/13054-important-bugfix-release-09332/#entry30025">
<p>Removing all .log files from the directory should do the job,
alternatively just use the class.ConfigIO.php from Github</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5959</cvename>
<freebsdpr>ports/202262</freebsdpr>
<url>http://seclists.org/oss-sec/2015/q3/238</url>
<url>https://forum.froxlor.org/index.php/topic/13054-important-bugfix-release-09332/</url>
</references>
<dates>
<discovery>2015-07-29</discovery>
<entry>2015-08-13</entry>
</dates>
</vuln>
<vuln vid="83b38a2c-413e-11e5-bfcf-6805ca0b3d42">
<topic>RT -- two XSS vulnerabilities</topic>
<affects>
<package>
<name>rt42</name>
<range><ge>4.2.0</ge><lt>4.2.12</lt></range>
</package>
<package>
<name>rt40</name>
<range><ge>4.0.0</ge><lt>4.0.24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Best Practical reports:</p>
<blockquote cite="http://blog.bestpractical.com/2015/08/security-vulnerabilities-in-rt.html">
<p>RT 4.0.0 and above are vulnerable to a cross-site
scripting (XSS) attack via the user and group rights
management pages. This vulnerability is assigned
CVE-2015-5475. It was discovered and reported by Marcin
Kopec at Data Reliance Shared Service Center.</p>
<p>RT 4.2.0 and above are vulnerable to a cross-site
scripting (XSS) attack via the cryptography interface.
This vulnerability could allow an attacker with a
carefully-crafted key to inject JavaScript into RT's user
interface. Installations which use neither GnuPG nor
S/MIME are unaffected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5475</cvename>
<cvename>CVE-2015-6506</cvename>
<url>http://blog.bestpractical.com/2015/08/security-vulnerabilities-in-rt.html</url>
</references>
<dates>
<discovery>2015-08-12</discovery>
<entry>2015-08-12</entry>
<modified>2015-08-18</modified>
</dates>
</vuln>
<vuln vid="09fff0d9-4126-11e5-9f01-14dae9d210b8">
<topic>py-foolscap -- local file inclusion</topic>
<affects>
<package>
<name>py27-foolscap</name>
<name>py32-foolscap</name>
<name>py33-foolscap</name>
<name>py34-foolscap</name>
<range><lt>0.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Brian Warner reports:</p>
<blockquote cite="https://github.com/warner/foolscap/blob/a17218e18e01c05a9655863cd507b80561692c14/NEWS">
<p>The "flappserver" feature was found to have a vulnerability in the
service-lookup code which, when combined with an attacker who has the ability
to write files to a location where the flappserver process could read them,
would allow that attacker to obtain control of the flappserver process.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/warner/foolscap/blob/a17218e18e01c05a9655863cd507b80561692c14/NEWS</url>
<url>http://foolscap.lothar.com/trac/ticket/226</url>
</references>
<dates>
<discovery>2014-09-23</discovery>
<entry>2015-08-12</entry>
</dates>
</vuln>
<vuln vid="42c98cef-62b1-4b8b-9065-f4621e08d526">
<topic>libvpx -- out-of-bounds write</topic>
<affects>
<package>
<name>libvpx</name>
<range><lt>1.4.0</lt></range>
</package>
<package>
<name>firefox</name>
<range><lt>33.0,1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>31.1.2,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>33.0,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.30</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>31.1.2</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.30</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>31.1.2</lt></range>
</package>
<package>
<name>libxul</name>
<range><lt>31.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2014-77/">
<p>Using the Address Sanitizer tool, security researcher
Abhishek Arya (Inferno) of the Google Chrome Security Team
found an out-of-bounds write when buffering WebM format
video containing frames with invalid tile sizes. This can
lead to a potentially exploitable crash during WebM video
playback.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-1578</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2014-77/</url>
<url>https://hg.mozilla.org/releases/mozilla-esr31/rev/6023f0b4f8ba</url>
</references>
<dates>
<discovery>2014-10-14</discovery>
<entry>2015-08-12</entry>
</dates>
</vuln>
<vuln vid="f3778328-d288-4b39-86a4-65877331eaf7">
<topic>Adobe Flash Player -- critical vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<name>linux-c6_64-flashplugin</name>
<range><lt>11.2r202.508</lt></range>
</package>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.508</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-19.html">
<p>Adobe has released security updates for Adobe Flash Player.
These updates address critical vulnerabilities that could
potentially allow an attacker to take control of the affected
system.</p>
<p>These updates resolve type confusion vulnerabilities that could
lead to code execution (CVE-2015-5128, CVE-2015-5554,
CVE-2015-5555, CVE-2015-5558, CVE-2015-5562).</p>
<p>These updates include further hardening to a mitigation
introduced in version 18.0.0.209 to defend against vector
length corruptions (CVE-2015-5125).</p>
<p>These updates resolve use-after-free vulnerabilities that could
lead to code execution (CVE-2015-5550, CVE-2015-5551,
CVE-2015-3107, CVE-2015-5556, CVE-2015-5130, CVE-2015-5134,
CVE-2015-5539, CVE-2015-5540, CVE-2015-5557, CVE-2015-5559,
CVE-2015-5127, CVE-2015-5563, CVE-2015-5561, CVE-2015-5124,
CVE-2015-5564).</p>
<p>These updates resolve heap buffer overflow vulnerabilities
that could lead to code execution (CVE-2015-5129,
CVE-2015-5541).</p>
<p>These updates resolve buffer overflow vulnerabilities that
could lead to code execution (CVE-2015-5131, CVE-2015-5132,
CVE-2015-5133).</p>
<p>These updates resolve memory corruption vulnerabilities that
could lead to code execution (CVE-2015-5544, CVE-2015-5545,
CVE-2015-5546, CVE-2015-5547, CVE-2015-5548, CVE-2015-5549,
CVE-2015-5552, CVE-2015-5553).</p>
<p>These updates resolve an integer overflow vulnerability that
could lead to code execution (CVE-2015-5560).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3107</cvename>
<cvename>CVE-2015-5124</cvename>
<cvename>CVE-2015-5125</cvename>
<cvename>CVE-2015-5127</cvename>
<cvename>CVE-2015-5128</cvename>
<cvename>CVE-2015-5129</cvename>
<cvename>CVE-2015-5130</cvename>
<cvename>CVE-2015-5131</cvename>
<cvename>CVE-2015-5132</cvename>
<cvename>CVE-2015-5133</cvename>
<cvename>CVE-2015-5134</cvename>
<cvename>CVE-2015-5539</cvename>
<cvename>CVE-2015-5540</cvename>
<cvename>CVE-2015-5541</cvename>
<cvename>CVE-2015-5544</cvename>
<cvename>CVE-2015-5545</cvename>
<cvename>CVE-2015-5546</cvename>
<cvename>CVE-2015-5547</cvename>
<cvename>CVE-2015-5548</cvename>
<cvename>CVE-2015-5549</cvename>
<cvename>CVE-2015-5550</cvename>
<cvename>CVE-2015-5551</cvename>
<cvename>CVE-2015-5552</cvename>
<cvename>CVE-2015-5553</cvename>
<cvename>CVE-2015-5554</cvename>
<cvename>CVE-2015-5555</cvename>
<cvename>CVE-2015-5556</cvename>
<cvename>CVE-2015-5557</cvename>
<cvename>CVE-2015-5558</cvename>
<cvename>CVE-2015-5559</cvename>
<cvename>CVE-2015-5560</cvename>
<cvename>CVE-2015-5561</cvename>
<cvename>CVE-2015-5562</cvename>
<cvename>CVE-2015-5563</cvename>
<cvename>CVE-2015-5564</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb15-19.html</url>
</references>
<dates>
<discovery>2015-08-11</discovery>
<entry>2015-08-12</entry>
</dates>
</vuln>
<vuln vid="34e60332-2448-4ed6-93f0-12713749f250">
<topic>libvpx -- multiple buffer overflows</topic>
<affects>
<package>
<name>libvpx</name>
<range><lt>1.4.0.488</lt></range>
</package>
<package>
<name>firefox</name>
<range><lt>40.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>40.0,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/security/advisories/mfsa2015-89/">
<p>Security researcher Abhishek Arya (Inferno) of the Google
Chrome Security Team used the Address Sanitizer tool to
discover two buffer overflow issues in the Libvpx library
used for WebM video when decoding a malformed WebM video
file. These buffer overflows result in potentially
exploitable crashes.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4485</cvename>
<cvename>CVE-2015-4486</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2015-89/</url>
</references>
<dates>
<discovery>2015-08-11</discovery>
<entry>2015-08-11</entry>
<modified>2015-08-14</modified>
</dates>
</vuln>
<vuln vid="c66a5632-708a-4727-8236-d65b2d5b2739">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>40.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>40.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><ge>2.36</ge><lt>2.37</lt></range>
<!-- seamonkey-2.35 milestone.txt: 38.2.0esrpre -->
<range><lt>2.35</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><ge>2.36</ge><lt>2.37</lt></range>
<!-- seamonkey-2.35 milestone.txt: 38.2.0esrpre -->
<range><lt>2.35</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>38.2.0,1</lt></range>
</package>
<package>
<name>libxul</name>
<range><lt>38.2.0</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>38.2.0</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>38.2.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/">
<p>MFSA 2015-79 Miscellaneous memory safety hazards (rv:40.0
/ rv:38.2)</p>
<p>MFSA 2015-80 Out-of-bounds read with malformed MP3
file</p>
<p>MFSA 2015-81 Use-after-free in MediaStream playback</p>
<p>MFSA 2015-82 Redefinition of non-configurable JavaScript object properties</p>
<p>MFSA 2015-83 Overflow issues in libstagefright</p>
<p>MFSA 2015-84 Arbitrary file overwriting through Mozilla
Maintenance Service with hard links</p>
<p>MFSA 2015-85 Out-of-bounds write with Updater and
malicious MAR file</p>
<p>MFSA 2015-86 Feed protocol with POST bypasses mixed
content protections</p>
<p>MFSA 2015-87 Crash when using shared memory in
JavaScript</p>
<p>MFSA 2015-88 Heap overflow in gdk-pixbuf when scaling
bitmap images</p>
<p>MFSA 2015-90 Vulnerabilities found through code
inspection</p>
<p>MFSA 2015-91 Mozilla Content Security Policy allows for
asterisk wildcards in violation of CSP specification</p>
<p>MFSA 2015-92 Use-after-free in XMLHttpRequest with shared
workers</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4473</cvename>
<cvename>CVE-2015-4474</cvename>
<cvename>CVE-2015-4475</cvename>
<cvename>CVE-2015-4477</cvename>
<cvename>CVE-2015-4478</cvename>
<cvename>CVE-2015-4479</cvename>
<cvename>CVE-2015-4480</cvename>
<cvename>CVE-2015-4481</cvename>
<cvename>CVE-2015-4482</cvename>
<cvename>CVE-2015-4483</cvename>
<cvename>CVE-2015-4484</cvename>
<cvename>CVE-2015-4487</cvename>
<cvename>CVE-2015-4488</cvename>
<cvename>CVE-2015-4489</cvename>
<cvename>CVE-2015-4490</cvename>
<cvename>CVE-2015-4491</cvename>
<cvename>CVE-2015-4492</cvename>
<cvename>CVE-2015-4493</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2015-79/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-80/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-81/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-82/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-83/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-84/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-85/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-86/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-87/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-88/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-90/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-91/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-92/</url>
</references>
<dates>
<discovery>2015-08-11</discovery>
<entry>2015-08-11</entry>
<modified>2015-08-22</modified>
</dates>
</vuln>
<vuln vid="dd7f29cc-3ee9-11e5-93ad-002590263bf5">
<topic>lighttpd -- Log injection vulnerability in mod_auth</topic>
<affects>
<package>
<name>lighttpd</name>
<range><lt>1.4.36</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3200">
<p>mod_auth in lighttpd before 1.4.36 allows remote attackers to
inject arbitrary log entries via a basic HTTP authentication string
without a colon character, as demonstrated by a string containing a
NULL and new line character.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3200</cvename>
<url>http://redmine.lighttpd.net/issues/2646</url>
</references>
<dates>
<discovery>2015-05-25</discovery>
<entry>2015-08-10</entry>
</dates>
</vuln>
<vuln vid="ff0acfb4-3efa-11e5-93ad-002590263bf5">
<topic>pcre -- heap overflow vulnerability in '(?|' situations</topic>
<affects>
<package>
<name>pcre</name>
<range><le>8.37_2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Venustech ADLAB reports:</p>
<blockquote cite="https://bugs.exim.org/show_bug.cgi?id=1667">
<p>PCRE library is prone to a vulnerability which leads to Heap
Overflow. During the compilation of a malformed regular expression,
more data is written on the malloced block than the expected size
output by compile_regex. Exploits with advanced Heap Fengshui
techniques may allow an attacker to execute arbitrary code in the
context of the user running the affected application.</p>
<p>Latest version of PCRE is prone to a Heap Overflow vulnerability
which could caused by the following regular expression.</p>
<p>/(?J:(?|(:(?|(?'R')(\k'R')|((?'R')))H'Rk'Rf)|s(?'R'))))/</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/202209</freebsdpr>
<url>https://bugs.exim.org/show_bug.cgi?id=1667</url>
</references>
<dates>
<discovery>2015-08-05</discovery>
<entry>2015-08-10</entry>
</dates>
</vuln>
<vuln vid="8eee06d4-c21d-4f07-a669-455151ff426f">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>39.0.3,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>39.0.3,1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>38.1.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/">
<p>MFSA 2015-78 Same origin violation and local file
stealing via PDF reader</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4495</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2015-78/</url>
</references>
<dates>
<discovery>2015-08-06</discovery>
<entry>2015-08-07</entry>
</dates>
</vuln>
<vuln vid="ac5ec8e3-3c6c-11e5-b921-00a0986f28c4">
<topic>wordpress -- Multiple vulnerability</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>4.2.4,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<name>zh-wordpress-zh_CN</name>
<name>zh-wordpress-zh_TW</name>
<range><lt>4.2.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gary Pendergast reports:</p>
<blockquote cite="https://wordpress.org/news/2015/08/wordpress-4-2-4-security-and-maintenance-release/">
<p>WordPress 4.2.4 fixes three cross-site scripting vulnerabilities
and a potential SQL injection that could be used to compromise a
site.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wordpress.org/news/2015/08/wordpress-4-2-4-security-and-maintenance-release/</url>
<cvename>CVE-2015-2213</cvename>
<cvename>CVE-2015-5730</cvename>
<cvename>CVE-2015-5731</cvename>
<cvename>CVE-2015-5732</cvename>
<cvename>CVE-2015-5733</cvename>
<cvename>CVE-2015-5734</cvename>
</references>
<dates>
<discovery>2015-08-04</discovery>
<entry>2015-08-06</entry>
<modified>2015-09-15</modified>
</dates>
</vuln>
<vuln vid="57bb5e3d-3c4f-11e5-a4d4-001e8c75030d">
<topic>subversion -- multiple vulnerabilities</topic>
<affects>
<package>
<name>subversion</name>
<range><ge>1.8.0</ge><lt>1.8.14</lt></range>
<range><ge>1.7.0</ge><lt>1.7.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Subversion reports:</p>
<blockquote cite="http://svn.haxx.se/dev/archive-2015-08/0024.shtml">
<p>CVE-2015-3184:<br/>
Subversion's mod_authz_svn does not properly restrict anonymous access
in some mixed anonymous/authenticated environments when
using Apache httpd 2.4.</p>
<p>CVE-2015-3187:<br/>
Subversion servers, both httpd and svnserve, will reveal some
paths that should be hidden by path-based authz.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3184</cvename>
<url>http://subversion.apache.org/security/CVE-2015-3184-advisory.txt</url>
<cvename>CVE-2015-3187</cvename>
<url>http://subversion.apache.org/security/CVE-2015-3187-advisory.txt</url>
</references>
<dates>
<discovery>2015-07-27</discovery>
<entry>2015-08-06</entry>
</dates>
</vuln>
<vuln vid="ae8c09cb-32da-11e5-a4a5-002590263bf5">
<topic>elasticsearch -- directory traversal attack via snapshot API</topic>
<affects>
<package>
<name>elasticsearch</name>
<range><ge>1.0.0</ge><lt>1.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Elastic reports:</p>
<blockquote cite="https://www.elastic.co/community/security">
<p>Vulnerability Summary: Elasticsearch versions from 1.0.0 to 1.6.0
are vulnerable to a directory traversal attack.</p>
<p>Remediation Summary: Users should upgrade to 1.6.1 or later, or
constrain access to the snapshot API to trusted sources.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5531</cvename>
<freebsdpr>ports/201834</freebsdpr>
<url>https://www.elastic.co/community/security</url>
</references>
<dates>
<discovery>2015-07-16</discovery>
<entry>2015-08-05</entry>
</dates>
</vuln>
<vuln vid="fb3668df-32d7-11e5-a4a5-002590263bf5">
<topic>elasticsearch -- remote code execution via transport protocol</topic>
<affects>
<package>
<name>elasticsearch</name>
<range><lt>1.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Elastic reports:</p>
<blockquote cite="https://www.elastic.co/community/security">
<p>Vulnerability Summary: Elasticsearch versions prior to 1.6.1 are
vulnerable to an attack that can result in remote code execution.</p>
<p>Remediation Summary: Users should upgrade to 1.6.1 or 1.7.0.
Alternately, ensure that only trusted applications have access to
the transport protocol port.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5377</cvename>
<freebsdpr>ports/201834</freebsdpr>
<url>https://www.elastic.co/community/security</url>
</references>
<dates>
<discovery>2015-07-16</discovery>
<entry>2015-08-05</entry>
</dates>
</vuln>
<vuln vid="da451130-365d-11e5-a4a5-002590263bf5">
<topic>qemu, xen-tools -- QEMU heap overflow flaw with certain ATAPI commands</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><le>0.11.1_20</le></range>
<range><ge>0.12</ge><le>2.3.0_2</le></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.4.50.g20150814</lt></range>
</package>
<package>
<name>xen-tools</name>
<range><lt>4.5.0_9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-138.html">
<p>A heap overflow flaw was found in the way QEMU's IDE subsystem
handled I/O buffer access while processing certain ATAPI
commands.</p>
<p>A privileged guest user in a guest with CDROM drive enabled could
potentially use this flaw to execute arbitrary code on the host
with the privileges of the host's QEMU process corresponding to
the guest.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5154</cvename>
<url>http://xenbits.xen.org/xsa/advisory-138.html</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=e40db4c6d391419c0039fe274c74df32a6ca1a28</url>
</references>
<dates>
<discovery>2015-07-27</discovery>
<entry>2015-08-04</entry>
<modified>2015-08-19</modified>
</dates>
</vuln>
<vuln vid="4622635f-37a1-11e5-9970-14dae9d210b8">
<topic>net-snmp -- snmptrapd crash</topic>
<affects>
<package>
<name>net-snmp</name>
<range><ge>5.7.0</ge><le>5.7.2.1</le></range>
<range><ge>5.6.0</ge><le>5.6.2.1</le></range>
<range><ge>5.5.0</ge><le>5.5.2.1</le></range>
<range><ge>5.4.0</ge><le>5.4.4</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Murray McAllister reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2014/q3/473">
<p>A remote denial-of-service flaw was found in the way
snmptrapd handled certain SNMP traps when started with the
"-OQ" option. If an attacker sent an SNMP trap containing a
variable with a NULL type where an integer variable type was
expected, it would cause snmptrapd to crash.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2014/q3/473</url>
<url>http://sourceforge.net/p/net-snmp/code/ci/7f4a7b891332899cea26e95be0337aae01648742/</url>
<url>https://sourceforge.net/p/net-snmp/official-patches/48/</url>
<cvename>CVE-2014-3565</cvename>
</references>
<dates>
<discovery>2014-07-31</discovery>
<entry>2015-07-31</entry>
</dates>
</vuln>
<vuln vid="381183e8-3798-11e5-9970-14dae9d210b8">
<topic>net-snmp -- snmp_pdu_parse() function incomplete initialization</topic>
<affects>
<package>
<name>net-snmp</name>
<range><le>5.7.3_7</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Qinghao Tang reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q2/116">
<p>Incompletely initialized vulnerability exists in the function
‘snmp_pdu_parse()’ of ‘snmp_api.c', and remote attackers can cause memory
leak, DOS and possible command executions by sending malicious packets.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2015/q2/116</url>
<url>http://sourceforge.net/p/net-snmp/code/ci/f23bcd3ac6ddee5d0a48f9703007ccc738914791/</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1212408</url>
<cvename>CVE-2015-5621</cvename>
</references>
<dates>
<discovery>2015-04-11</discovery>
<entry>2015-07-31</entry>
</dates>
</vuln>
<vuln vid="731cdeaa-3564-11e5-9970-14dae9d210b8">
<topic>bind -- denial of service vulnerability</topic>
<affects>
<package>
<name>bind910</name>
<range><lt>9.10.2P3</lt></range>
</package>
<package>
<name>bind99</name>
<range><lt>9.9.7P2</lt></range>
</package>
<package>
<name>bind910-base</name>
<name>bind99-base</name>
<range><gt>0</gt></range>
</package>
<package>
<name>FreeBSD</name>
<range><gt>9.3</gt><le>9.3_20</le></range>
<range><gt>8.4</gt><le>8.4_34</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01272/">
<p>An error in the handling of TKEY queries can be exploited
by an attacker for use as a denial-of-service vector, as a constructed
packet can use the defect to trigger a REQUIRE assertion failure,
causing BIND to exit.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5477</cvename>
<url>https://kb.isc.org/article/AA-01272/</url>
</references>
<dates>
<discovery>2015-07-21</discovery>
<entry>2015-07-28</entry>
</dates>
</vuln>
<vuln vid="5b74a5bc-348f-11e5-ba05-c80aa9043978">
<topic>OpenSSH -- MaxAuthTries limit bypass via duplicates in KbdInteractiveDevices</topic>
<affects>
<package>
<name>openssh-portable</name>
<range><lt>6.9.p1_2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://access.redhat.com/security/cve/CVE-2015-5600">
<p>It was discovered that the OpenSSH sshd daemon did not check the
list of keyboard-interactive authentication methods for duplicates.
A remote attacker could use this flaw to bypass the MaxAuthTries
limit, making it easier to perform password guessing attacks.</p>
</blockquote>
</body>
</description>
<references>
<url>https://access.redhat.com/security/cve/CVE-2015-5600</url>
<cvename>CVE-2015-5600</cvename>
</references>
<dates>
<discovery>2015-07-21</discovery>
<entry>2015-07-27</entry>
</dates>
</vuln>
<vuln vid="c470bcc7-33fe-11e5-a4a5-002590263bf5">
<topic>logstash -- SSL/TLS vulnerability with Lumberjack input</topic>
<affects>
<package>
<name>logstash</name>
<range><lt>1.4.4</lt></range>
<range><ge>1.5.0</ge><lt>1.5.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Elastic reports:</p>
<blockquote cite="https://www.elastic.co/community/security">
<p>Vulnerability Summary: All Logstash versions prior to 1.5.2 that
use Lumberjack input (in combination with Logstash Forwarder agent)
are vulnerable to a SSL/TLS security issue called the FREAK attack.
This allows an attacker to intercept communication and access secure
data. Users should upgrade to 1.5.3 or 1.4.4.</p>
<p>Remediation Summary: Users that do not want to upgrade can address
the vulnerability by disabling the Lumberjack input.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5378</cvename>
<url>https://www.elastic.co/community/security</url>
</references>
<dates>
<discovery>2015-07-22</discovery>
<entry>2015-07-27</entry>
</dates>
</vuln>
<vuln vid="9d732078-32c7-11e5-b263-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>44.0.2403.89</lt></range>
</package>
<package>
<!-- pcbsd -->
<name>chromium-npapi</name>
<range><lt>44.0.2403.89</lt></range>
</package>
<package>
<!-- pcbsd -->
<name>chromium-pulse</name>
<range><lt>44.0.2403.89</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/">
<p>43 security fixes in this release, including:</p>
<ul>
<li>[446032] High CVE-2015-1271: Heap-buffer-overflow in pdfium.
Credit to cloudfuzzer.</li>
<li>[459215] High CVE-2015-1273: Heap-buffer-overflow in pdfium.
Credit to makosoft.</li>
<li>[461858] High CVE-2015-1274: Settings allowed executable files
to run immediately after download. Credit to andrewm.bpi.</li>
<li>[462843] High CVE-2015-1275: UXSS in Chrome for Android. Credit
to WangTao(neobyte) of Baidu X-Team.</li>
<li>[472614] High CVE-2015-1276: Use-after-free in IndexedDB.
Credit to Collin Payne.</li>
<li>[483981] High CVE-2015-1279: Heap-buffer-overflow in pdfium.
Credit to mlafon.</li>
<li>[486947] High CVE-2015-1280: Memory corruption in skia. Credit
to cloudfuzzer.</li>
<li>[487155] High CVE-2015-1281: CSP bypass. Credit to Masato
Kinugawa.</li>
<li>[487928] High CVE-2015-1282: Use-after-free in pdfium. Credit
to Chamal de Silva.</li>
<li>[492052] High CVE-2015-1283: Heap-buffer-overflow in expat.
Credit to sidhpurwala.huzaifa.</li>
<li>[493243] High CVE-2015-1284: Use-after-free in blink. Credit to
Atte Kettunen of OUSPG.</li>
<li>[504011] High CVE-2015-1286: UXSS in blink. Credit to
anonymous.</li>
<li>[505374] High CVE-2015-1290: Memory corruption in V8. Credit to
Yongjun Liu of NSFOCUS Security Team.</li>
<li>[419383] Medium CVE-2015-1287: SOP bypass with CSS. Credit to
filedescriptor.</li>
<li>[444573] Medium CVE-2015-1270: Uninitialized memory read in
ICU. Credit to Atte Kettunen of OUSPG.</li>
<li>[451456] Medium CVE-2015-1272: Use-after-free related to
unexpected GPU process termination. Credit to Chamal de
Silva.</li>
<li>[479743] Medium CVE-2015-1277: Use-after-free in accessibility.
Credit to SkyLined.</li>
<li>[482380] Medium CVE-2015-1278: URL spoofing using pdf files.
Credit to Chamal de Silva.</li>
<li>[498982] Medium CVE-2015-1285: Information leak in XSS auditor.
Credit to gazheyes.</li>
<li>[479162] Low CVE-2015-1288: Spell checking dictionaries fetched
over HTTP. Credit to mike@michaelruddy.com.</li>
<li>[512110] CVE-2015-1289: Various fixes from internal audits,
fuzzing and other initiatives.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1270</cvename>
<cvename>CVE-2015-1271</cvename>
<cvename>CVE-2015-1272</cvename>
<cvename>CVE-2015-1273</cvename>
<cvename>CVE-2015-1274</cvename>
<cvename>CVE-2015-1275</cvename>
<cvename>CVE-2015-1276</cvename>
<cvename>CVE-2015-1277</cvename>
<cvename>CVE-2015-1278</cvename>
<cvename>CVE-2015-1279</cvename>
<cvename>CVE-2015-1280</cvename>
<cvename>CVE-2015-1281</cvename>
<cvename>CVE-2015-1282</cvename>
<cvename>CVE-2015-1283</cvename>
<cvename>CVE-2015-1284</cvename>
<cvename>CVE-2015-1285</cvename>
<cvename>CVE-2015-1286</cvename>
<cvename>CVE-2015-1287</cvename>
<cvename>CVE-2015-1288</cvename>
<cvename>CVE-2015-1289</cvename>
<cvename>CVE-2015-1290</cvename>
<url>http://googlechromereleases.blogspot.nl/</url>
</references>
<dates>
<discovery>2015-07-21</discovery>
<entry>2015-07-25</entry>
</dates>
</vuln>
<vuln vid="b202e4ce-3114-11e5-aa32-0026551a22dc">
<topic>shibboleth-sp -- DoS vulnerability</topic>
<affects>
<package>
<name>xmltooling</name>
<range><lt>1.5.5</lt></range>
</package>
<package>
<name>opensaml2</name>
<range><lt>2.5.5</lt></range>
</package>
<package>
<name>shibboleth-sp</name>
<range><lt>2.5.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Shibboleth consortium reports:</p>
<blockquote cite="http://shibboleth.net/community/advisories/secadv_20150721.txt">
<p>
Shibboleth SP software crashes on well-formed but invalid XML.
</p>
<p>
The Service Provider software contains a code path with an uncaught
exception that can be triggered by an unauthenticated attacker by
supplying well-formed but schema-invalid XML in the form of SAML
metadata or SAML protocol messages. The result is a crash and so
causes a denial of service.
</p>
<p>
You must rebuild opensaml and shibboleth with xmltooling-1.5.5 or
later. The easiest way to do so is to update the whole chain including
shibboleth-2.5.5 an opensaml2.5.5.
</p>
</blockquote>
</body>
</description>
<references>
<url>http://shibboleth.net/community/advisories/secadv_20150721.txt</url>
<cvename>CVE-2015-2684</cvename>
</references>
<dates>
<discovery>2015-07-21</discovery>
<entry>2015-07-23</entry>
</dates>
</vuln>
<vuln vid="c80b27a2-3165-11e5-8a1d-14dae9d210b8">
<topic>wordpress -- XSS vulnerability</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>4.2.3,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<name>zh-wordpress-zh_CN</name>
<name>zh-wordpress-zh_TW</name>
<range><lt>4.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gary Pendergast reports:</p>
<blockquote cite="https://wordpress.org/news/2015/07/wordpress-4-2-3/">
<p>WordPress versions 4.2.2 and earlier are affected by a
cross-site scripting vulnerability, which could allow users with the
Contributor or Author role to compromise a site. This was reported by
Jon Cave and fixed by Robert Chapin, both of the WordPress security
team.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wordpress.org/news/2015/07/wordpress-4-2-3/</url>
<cvename>CVE-2015-5622</cvename>
<cvename>CVE-2015-5623</cvename>
</references>
<dates>
<discovery>2015-07-23</discovery>
<entry>2015-07-23</entry>
<modified>2015-09-15</modified>
</dates>
</vuln>
<vuln vid="4caf01e2-30e6-11e5-a4a5-002590263bf5">
<topic>libidn -- out-of-bounds read issue with invalid UTF-8 input</topic>
<affects>
<package>
<name>libidn</name>
<range><lt>1.31</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon Josefsson reports:</p>
<blockquote cite="http://git.savannah.gnu.org/cgit/libidn.git/plain/NEWS?id=libidn-1-31">
<p>stringprep_utf8_to_ucs4 now rejects invalid UTF-8. This function
has always been documented to not validate that the input UTF-8
string is actually valid UTF-8...
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-2059</cvename>
<url>http://git.savannah.gnu.org/cgit/libidn.git/plain/NEWS?id=libidn-1-31</url>
</references>
<dates>
<discovery>2015-02-09</discovery>
<entry>2015-07-23</entry>
<modified>2015-08-03</modified>
</dates>
</vuln>
<vuln vid="9dd761ff-30cb-11e5-a4a5-002590263bf5">
<topic>sox -- memory corruption vulnerabilities</topic>
<affects>
<package>
<name>sox</name>
<range><le>14.4.2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Michele Spagnuolo, Google Security Team, reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q3/167">
<p>The write heap buffer overflows are related to ADPCM handling in
WAV files, while the read heap buffer overflow is while opening a
.VOC.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2015/q3/167</url>
</references>
<dates>
<discovery>2015-07-22</discovery>
<entry>2015-07-23</entry>
</dates>
</vuln>
<vuln vid="92cda470-30cb-11e5-a4a5-002590263bf5">
<topic>sox -- input sanitization errors</topic>
<affects>
<package>
<name>sox</name>
<range><lt>14.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>oCERT reports:</p>
<blockquote cite="http://www.ocert.org/advisories/ocert-2014-010.html">
<p>The sox command line tool is affected by two heap-based buffer
overflows, respectively located in functions start_read() and
AdpcmReadBlock().</p>
<p>A specially crafted wav file can be used to trigger the
vulnerabilities.</p>
</blockquote>
</body>
</description>
<references>
<bid>71774</bid>
<cvename>CVE-2014-8145</cvename>
<url>http://www.ocert.org/advisories/ocert-2014-010.html</url>
</references>
<dates>
<discovery>2014-11-20</discovery>
<entry>2015-07-23</entry>
</dates>
</vuln>
<vuln vid="95eee71d-3068-11e5-a9b5-bcaec565249c">
<topic>gdk-pixbuf2 -- heap overflow and DoS affecting Firefox and other programs</topic>
<affects>
<package>
<name>gdk-pixbuf2</name>
<range><lt>2.31.2_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>gustavo.grieco@imag.fr reports:</p>
<blockquote cite="https://bugzilla.gnome.org/show_bug.cgi?id=752297">
<p>We found a heap overflow and a DoS in the gdk-pixbuf
implementation triggered by the scaling of a malformed bmp.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugzilla.gnome.org/show_bug.cgi?id=752297</url>
</references>
<dates>
<discovery>2015-07-12</discovery>
<entry>2015-07-22</entry>
</dates>
</vuln>
<vuln vid="8a1d0e63-1e07-11e5-b43d-002590263bf5">
<topic>pcre -- Heap Overflow Vulnerability in find_fixedlength()</topic>
<affects>
<package>
<name>pcre</name>
<range><le>8.37_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Venustech ADLAB reports:</p>
<blockquote cite="https://bugs.exim.org/show_bug.cgi?id=1651">
<p>PCRE library is prone to a vulnerability which leads to Heap
Overflow. During subpattern calculation of a malformed regular
expression, an offset that is used as an array index is fully
controlled and can be large enough so that unexpected heap
memory regions are accessed.</p>
<p>One could at least exploit this issue to read objects nearby of
the affected application's memory.</p>
<p>Such information disclosure may also be used to bypass memory
protection method such as ASLR.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5073</cvename>
<url>https://bugs.exim.org/show_bug.cgi?id=1651</url>
<url>http://vcs.pcre.org/pcre?view=revision&amp;revision=1571</url>
<mlist>http://www.openwall.com/lists/oss-security/2015/06/26/1</mlist>
</references>
<dates>
<discovery>2015-06-23</discovery>
<entry>2015-06-29</entry>
</dates>
</vuln>
<vuln vid="0bfda05f-2e6f-11e5-a4a5-002590263bf5">
<topic>cacti -- Multiple XSS and SQL injection vulnerabilities</topic>
<affects>
<package>
<name>cacti</name>
<range><lt>0.8.8e</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Cacti Group, Inc. reports:</p>
<blockquote cite="http://www.cacti.net/release_notes_0_8_8e.php">
<p>Important Security Fixes</p>
<ul>
<li>Multiple XSS and SQL injection vulnerabilities</li>
<li>CVE-2015-4634 - SQL injection in graphs.php</li>
</ul>
<p>Changelog</p>
<ul>
<li>bug: Fixed various SQL Injection vectors</li>
<li>bug#0002574: SQL Injection Vulnerabilities in graph items and
graph template items</li>
<li>bug#0002577: CVE-2015-4634 - SQL injection in graphs.php</li>
<li>bug#0002579: SQL Injection Vulnerabilities in data sources</li>
<li>bug#0002580: SQL Injection in cdef.php</li>
<li>bug#0002582: SQL Injection in data_templates.php</li>
<li>bug#0002583: SQL Injection in graph_templates.php</li>
<li>bug#0002584: SQL Injection in host_templates.php</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4634</cvename>
<freebsdpr>ports/201702</freebsdpr>
<url>http://www.cacti.net/release_notes_0_8_8e.php</url>
<mlist>http://seclists.org/oss-sec/2015/q3/150</mlist>
</references>
<dates>
<discovery>2015-07-12</discovery>
<entry>2015-07-20</entry>
</dates>
</vuln>
<vuln vid="8b1f53f3-2da5-11e5-86ff-14dae9d210b8">
<topic>php-phar -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php56-phar</name>
<range><lt>5.6.11</lt></range>
</package>
<package>
<name>php55-phar</name>
<range><lt>5.5.27</lt></range>
</package>
<package>
<name>php5-phar</name>
<range><lt>5.4.43</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p> reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q3/141">
<p>Segfault in Phar::convertToData on invalid file.</p>
<p>Buffer overflow and stack smashing error in phar_fix_filepath.</p>
</blockquote>
</body>
</description>
<references>
<mlist>http://seclists.org/oss-sec/2015/q3/141</mlist>
<url>https://bugs.php.net/bug.php?id=69958</url>
<url>http://git.php.net/?p=php-src.git;a=commit;h=bf58162ddf970f63502837f366930e44d6a992cf</url>
<url>https://bugs.php.net/bug.php?id=69923</url>
<url>http://git.php.net/?p=php-src.git;a=commit;h=6dedeb40db13971af45276f80b5375030aa7e76f</url>
<cvename>CVE-2015-5589</cvename>
<cvename>CVE-2015-5590</cvename>
</references>
<dates>
<discovery>2015-06-24</discovery>
<entry>2015-07-18</entry>
<modified>2015-12-18</modified>
</dates>
</vuln>
<vuln vid="43891162-2d5e-11e5-a4a5-002590263bf5">
<topic>moodle -- multiple vulnerabilities</topic>
<affects>
<package>
<name>moodle27</name>
<range><lt>2.7.9</lt></range>
</package>
<package>
<name>moodle28</name>
<range><lt>2.8.7</lt></range>
</package>
<package>
<name>moodle29</name>
<range><lt>2.9.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Marina Glancy reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q3/94">
<p>MSA-15-0026: Possible phishing when redirecting to external site
using referer header. (CVE-2015-3272)</p>
<p>MSA-15-0027: Capability 'mod/forum:canposttomygroups' is not
respected when using 'Post a copy to all groups' in forum
(CVE-2015-3273)</p>
<p>MSA-15-0028: Possible XSS through custom text profile fields in Web
Services (CVE-2015-3274)</p>
<p>MSA-15-0029: Javascript injection in SCORM module (CVE-2015-3275)
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3272</cvename>
<cvename>CVE-2015-3273</cvename>
<cvename>CVE-2015-3274</cvename>
<cvename>CVE-2015-3275</cvename>
<mlist>http://seclists.org/oss-sec/2015/q3/94</mlist>
<url>https://docs.moodle.org/dev/Moodle_2.7.9_release_notes</url>
<url>https://docs.moodle.org/dev/Moodle_2.8.7_release_notes</url>
<url>https://docs.moodle.org/dev/Moodle_2.9.1_release_notes</url>
</references>
<dates>
<discovery>2015-07-06</discovery>
<entry>2015-07-18</entry>
<modified>2015-07-19</modified>
</dates>
</vuln>
<vuln vid="29083f8e-2ca8-11e5-86ff-14dae9d210b8">
<topic>apache22 -- chunk header parsing defect</topic>
<affects>
<package>
<name>apache22</name>
<name>apache22-event-mpm</name>
<name>apache22-itk-mpm</name>
<name>apache22-peruser-mpm</name>
<name>apache22-worker-mpm</name>
<range><le>2.2.29_5</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache Foundation reports:</p>
<blockquote cite="http://www.apache.org/dist/httpd/Announcement2.2.html">
<p>CVE-2015-3183 core: Fix chunk header parsing defect. Remove
apr_brigade_flatten(), buffering and duplicated code from the HTTP_IN
filter, parse chunks in a single pass with zero copy. Limit accepted
chunk-size to 2^63-1 and be strict about chunk-ext authorized
characters.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.apache.org/dist/httpd/Announcement2.2.html</url>
<url>https://github.com/apache/httpd/commit/29779fd08c18b18efc5e640d74cbe297c7ec007e</url>
<cvename>CVE-2015-3183</cvename>
</references>
<dates>
<discovery>2015-06-24</discovery>
<entry>2015-07-17</entry>
</dates>
</vuln>
<vuln vid="5c399624-2bef-11e5-86ff-14dae9d210b8">
<topic>zenphoto -- multiple vulnerabilities</topic>
<affects>
<package>
<name>zenphoto</name>
<range><lt>1.4.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>zenphoto reports:</p>
<blockquote cite="http://www.zenphoto.org/news/zenphoto-1.4.9">
<p>Fixes several SQL Injection, XSS and path traversal
security issues</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.zenphoto.org/news/zenphoto-1.4.9</url>
<mlist>http://seclists.org/oss-sec/2015/q3/123</mlist>
<url>https://github.com/zenphoto/zenphoto/pull/935</url>
<cvename>CVE-2015-5591</cvename>
<cvename>CVE-2015-5592</cvename>
<cvename>CVE-2015-5593</cvename>
<cvename>CVE-2015-5594</cvename>
<cvename>CVE-2015-5595</cvename>
</references>
<dates>
<discovery>2015-05-24</discovery>
<entry>2015-07-16</entry>
<modified>2015-07-18</modified>
</dates>
</vuln>
<vuln vid="67b3fef2-2bea-11e5-86ff-14dae9d210b8">
<topic>groovy -- remote execution of untrusted code</topic>
<affects>
<package>
<name>groovy</name>
<range><ge>1.7.0</ge><lt>2.4.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cédric Champeau reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q3/121">
<p>Description</p>
<p>When an application has Groovy on the classpath and that
it uses standard Java serialization mechanim to communicate
between servers, or to store local data, it is possible for
an attacker to bake a special serialized object that will
execute code directly when deserialized. All applications
which rely on serialization and do not isolate the code which
deserializes objects are subject to this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<mlist>http://seclists.org/oss-sec/2015/q3/121</mlist>
<url>http://groovy-lang.org/security.html</url>
<url>https://issues.apache.org/jira/browse/GROOVY-7504</url>
<cvename>CVE-2015-3253</cvename>
</references>
<dates>
<discovery>2015-07-09</discovery>
<entry>2015-07-16</entry>
</dates>
</vuln>
<vuln vid="a928960a-2bdc-11e5-86ff-14dae9d210b8">
<topic>libav -- divide by zero</topic>
<affects>
<package>
<name>libav</name>
<range><le>11.3_2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Agostino Sarubbo reports:</p>
<blockquote cite="https://blogs.gentoo.org/ago/2015/07/16/libav-divide-by-zero-in-ff_h263_decode_mba/">
<p>libav: divide-by-zero in ff_h263_decode_mba()</p>
</blockquote>
</body>
</description>
<references>
<url>https://blogs.gentoo.org/ago/2015/07/16/libav-divide-by-zero-in-ff_h263_decode_mba/</url>
<url>https://git.libav.org/?p=libav.git;a=commitdiff;h=0a49a62f998747cfa564d98d36a459fe70d3299b;hp=6f4cd33efb5a9ec75db1677d5f7846c60337129f</url>
<cvename>CVE-2015-5479</cvename>
</references>
<dates>
<discovery>2015-06-21</discovery>
<entry>2015-07-16</entry>
</dates>
</vuln>
<vuln vid="44d9daee-940c-4179-86bb-6e3ffd617869">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>39.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>39.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<!-- seamonkey-2.35 milestone.txt: 38.2.0esrpre -->
<range><lt>2.35</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<!-- seamonkey-2.35 milestone.txt: 38.2.0esrpre -->
<range><lt>2.35</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>31.8.0,1</lt></range>
<range><ge>38.0,1</ge><lt>38.1.0,1</lt></range>
</package>
<package>
<name>libxul</name>
<range><lt>31.8.0</lt></range>
<range><ge>38.0</ge><lt>38.1.0</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>31.8.0</lt></range>
<range><ge>38.0</ge><lt>38.1.0</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>31.8.0</lt></range>
<range><ge>38.0</ge><lt>38.1.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/">
<p>MFSA 2015-59 Miscellaneous memory safety hazards (rv:39.0
/ rv:31.8 / rv:38.1)</p>
<p>MFSA 2015-60 Local files or privileged URLs in pages can
be opened into new tabs</p>
<p>MFSA 2015-61 Type confusion in Indexed Database
Manager</p>
<p>MFSA 2015-62 Out-of-bound read while computing an
oscillator rendering range in Web Audio</p>
<p>MFSA 2015-63 Use-after-free in Content Policy due to
microtask execution error</p>
<p>MFSA 2015-64 ECDSA signature validation fails to handle
some signatures correctly</p>
<p>MFSA 2015-65 Use-after-free in workers while using
XMLHttpRequest</p>
<p>MFSA 2015-66 Vulnerabilities found through code
inspection</p>
<p>MFSA 2015-67 Key pinning is ignored when overridable
errors are encountered</p>
<p>MFSA 2015-68 OS X crash reports may contain entered key
press information</p>
<p>MFSA 2015-69 Privilege escalation through internal
workers</p>
<p>MFSA 2015-70 NSS accepts export-length DHE keys with
regular DHE cipher suites</p>
<p>MFSA 2015-71 NSS incorrectly permits skipping of
ServerKeyExchange</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-2721</cvename>
<cvename>CVE-2015-2722</cvename>
<cvename>CVE-2015-2724</cvename>
<cvename>CVE-2015-2725</cvename>
<cvename>CVE-2015-2726</cvename>
<cvename>CVE-2015-2727</cvename>
<cvename>CVE-2015-2728</cvename>
<cvename>CVE-2015-2729</cvename>
<cvename>CVE-2015-2730</cvename>
<cvename>CVE-2015-2731</cvename>
<cvename>CVE-2015-2733</cvename>
<cvename>CVE-2015-2734</cvename>
<cvename>CVE-2015-2735</cvename>
<cvename>CVE-2015-2736</cvename>
<cvename>CVE-2015-2737</cvename>
<cvename>CVE-2015-2738</cvename>
<cvename>CVE-2015-2739</cvename>
<cvename>CVE-2015-2740</cvename>
<cvename>CVE-2015-2741</cvename>
<cvename>CVE-2015-2742</cvename>
<cvename>CVE-2015-2743</cvename>
<cvename>CVE-2015-4000</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2015-59/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-60/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-61/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-62/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-63/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-64/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-65/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-66/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-67/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-68/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-69/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-70/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-71/</url>
</references>
<dates>
<discovery>2015-07-02</discovery>
<entry>2015-07-16</entry>
<modified>2015-09-22</modified>
</dates>
</vuln>
<vuln vid="d3216606-2b47-11e5-a668-080027ef73ec">
<topic>PolarSSL -- Security Fix Backports</topic>
<affects>
<package>
<name>polarssl</name>
<range><lt>1.2.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Paul Bakker reports:</p>
<blockquote cite="https://tls.mbed.org/tech-updates/releases/polarssl-1.2.14-released">
<p>PolarSSL 1.2.14 fixes one remotely-triggerable issues that was
found by the Codenomicon Defensics tool, one potential remote crash
and countermeasures against the "Lucky 13 strikes back" cache-based
attack.</p>
</blockquote>
</body>
</description>
<references>
<url>https://tls.mbed.org/tech-updates/releases/polarssl-1.2.14-released</url>
</references>
<dates>
<discovery>2015-06-26</discovery>
<entry>2015-07-15</entry>
</dates>
</vuln>
<vuln vid="ca139c7f-2a8c-11e5-a4a5-002590263bf5">
<topic>libwmf -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libwmf</name>
<range><lt>0.2.8.4_14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0941">
<p>Multiple buffer overflows in the gd graphics library (libgd) 2.0.21
and earlier may allow remote attackers to execute arbitrary code via
malformed image files that trigger the overflows due to improper
calls to the gdMalloc function, a different set of vulnerabilities
than CVE-2004-0990.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0455">
<p>Buffer overflow in the gdImageStringFTEx function in gdft.c in GD
Graphics Library 2.0.33 and earlier allows remote attackers to cause
a denial of service (application crash) and possibly execute
arbitrary code via a crafted string with a JIS encoded font.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2756">
<p>The gdPngReadData function in libgd 2.0.34 allows user-assisted
attackers to cause a denial of service (CPU consumption) via a
crafted PNG image with truncated data, which causes an infinite loop
in the png_read_info function in libpng.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3472">
<p>Integer overflow in gdImageCreateTrueColor function in the GD
Graphics Library (libgd) before 2.0.35 allows user-assisted remote
attackers to have unspecified attack vectors and impact.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3473">
<p>The gdImageCreateXbm function in the GD Graphics Library (libgd)
before 2.0.35 allows user-assisted remote attackers to cause a
denial of service (crash) via unspecified vectors involving a
gdImageCreate failure.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3477">
<p>The (a) imagearc and (b) imagefilledarc functions in GD Graphics
Library (libgd) before 2.0.35 allow attackers to cause a denial of
service (CPU consumption) via a large (1) start or (2) end angle
degree value.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3546">
<p>The _gdGetColors function in gd_gd.c in PHP 5.2.11 and 5.3.x before
5.3.1, and the GD Graphics Library 2.x, does not properly verify a
certain colorsTotal structure member, which might allow remote
attackers to conduct buffer overflow or buffer over-read attacks via
a crafted GD file, a different vulnerability than CVE-2009-3293.
NOTE: some of these details are obtained from third party
information.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0848">
<p>Heap-based buffer overflow in libwmf 0.2.8.4 allows remote
attackers to cause a denial of service (crash) or possibly execute
arbitrary code via a crafted BMP image.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4695">
<p>meta.h in libwmf 0.2.8.4 allows remote attackers to cause a denial
of service (out-of-bounds read) via a crafted WMF file.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4696">
<p>Use-after-free vulnerability in libwmf 0.2.8.4 allows remote
attackers to cause a denial of service (crash) via a crafted WMF
file to the (1) wmf2gd or (2) wmf2eps command.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4588">
<p>Heap-based buffer overflow in the DecodeImage function in libwmf
0.2.8.4 allows remote attackers to cause a denial of service (crash)
or possibly execute arbitrary code via a crafted "run-length count"
in an image in a WMF file.</p>
</blockquote>
</body>
</description>
<references>
<bid>11663</bid>
<bid>22289</bid>
<bid>24089</bid>
<bid>24651</bid>
<bid>36712</bid>
<freebsdpr>ports/201513</freebsdpr>
<cvename>CVE-2004-0941</cvename>
<cvename>CVE-2007-0455</cvename>
<cvename>CVE-2007-2756</cvename>
<cvename>CVE-2007-3472</cvename>
<cvename>CVE-2007-3473</cvename>
<cvename>CVE-2007-3477</cvename>
<cvename>CVE-2009-3546</cvename>
<cvename>CVE-2015-0848</cvename>
<cvename>CVE-2015-4695</cvename>
<cvename>CVE-2015-4696</cvename>
<cvename>CVE-2015-4588</cvename>
</references>
<dates>
<discovery>2004-10-12</discovery>
<entry>2015-07-15</entry>
</dates>
</vuln>
<vuln vid="a12494c1-2af4-11e5-86ff-14dae9d210b8">
<topic>apache24 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>apache24</name>
<range><lt>2.4.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jim Jagielski reports:</p>
<blockquote cite="https://mail-archives.apache.org/mod_mbox/www-announce/201507.mbox/%3CAA5C882C-A9C3-46B9-9320-5040A2152E83@apache.org%3E">
<p>CVE-2015-3183 (cve.mitre.org)
core: Fix chunk header parsing defect.
Remove apr_brigade_flatten(), buffering and duplicated code from
the HTTP_IN filter, parse chunks in a single pass with zero copy.
Limit accepted chunk-size to 2^63-1 and be strict about chunk-ext
authorized characters.</p>
<p>CVE-2015-3185 (cve.mitre.org)
Replacement of ap_some_auth_required (unusable in Apache httpd 2.4)
with new ap_some_authn_required and ap_force_authn hook.</p>
<p>CVE-2015-0253 (cve.mitre.org)
core: Fix a crash with ErrorDocument 400 pointing to a local URL-path
with the INCLUDES filter active, introduced in 2.4.11. PR 57531.</p>
<p>CVE-2015-0228 (cve.mitre.org)
mod_lua: A maliciously crafted websockets PING after a script
calls r:wsupgrade() can cause a child process crash.</p>
</blockquote>
</body>
</description>
<references>
<mlist>https://mail-archives.apache.org/mod_mbox/www-announce/201507.mbox/%3CAA5C882C-A9C3-46B9-9320-5040A2152E83@apache.org%3E</mlist>
<cvename>CVE-2015-3183</cvename>
<cvename>CVE-2015-3185</cvename>
<cvename>CVE-2015-0253</cvename>
<cvename>CVE-2015-0228</cvename>
</references>
<dates>
<discovery>2015-02-04</discovery>
<entry>2015-07-15</entry>
</dates>
</vuln>
<vuln vid="8d2d6bbd-2a02-11e5-a0af-bcaec565249c">
<topic>Adobe Flash Player -- critical vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<range><lt>11.2r202.491</lt></range>
</package>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.491</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-18.html">
<p>Critical vulnerabilities (CVE-2015-5122, CVE-2015-5123) have
been identified. Successful exploitation could cause a crash
and potentially allow an attacker to take control of the
affected system. Adobe is aware of reports that exploits
targeting these vulnerabilities have been published publicly.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5122</cvename>
<cvename>CVE-2015-5123</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb15-18.html</url>
</references>
<dates>
<discovery>2015-07-10</discovery>
<entry>2015-07-14</entry>
<modified>2015-07-16</modified>
</dates>
</vuln>
<vuln vid="3d39e927-29a2-11e5-86ff-14dae9d210b8">
<topic>php -- use-after-free vulnerability</topic>
<affects>
<package>
<name>php56-sqlite3</name>
<range><lt>5.6.11</lt></range>
</package>
<package>
<name>php55-sqlite3</name>
<range><lt>5.5.27</lt></range>
</package>
<package>
<name>php5-sqlite3</name>
<range><lt>5.4.43</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Symeon Paraschoudis reports:</p>
<blockquote cite="https://bugs.php.net/bug.php?id=69972">
<p>Use-after-free vulnerability in sqlite3SafetyCheckSickOrOk()</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.php.net/bug.php?id=69972</url>
</references>
<dates>
<discovery>2015-06-30</discovery>
<entry>2015-07-13</entry>
</dates>
</vuln>
<vuln vid="af7fbd91-29a1-11e5-86ff-14dae9d210b8">
<topic>php -- use-after-free vulnerability</topic>
<affects>
<package>
<name>php56</name>
<range><lt>5.6.11</lt></range>
</package>
<package>
<name>php55</name>
<range><lt>5.5.27</lt></range>
</package>
<package>
<name>php5</name>
<range><lt>5.4.43</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Symeon Paraschoudis reports:</p>
<blockquote cite="https://bugs.php.net/bug.php?id=69970">
<p>Use-after-free vulnerability in spl_recursive_it_move_forward_ex()</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.php.net/bug.php?id=69970</url>
</references>
<dates>
<discovery>2015-06-30</discovery>
<entry>2015-07-13</entry>
</dates>
</vuln>
<vuln vid="5a1d5d74-29a0-11e5-86ff-14dae9d210b8">
<topic>php -- arbitrary code execution</topic>
<affects>
<package>
<name>php56</name>
<range><lt>5.6.11</lt></range>
</package>
<package>
<name>php55</name>
<range><lt>5.5.27</lt></range>
</package>
<package>
<name>php5</name>
<range><lt>5.4.43</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cmb reports:</p>
<blockquote cite="https://bugs.php.net/bug.php?id=69768">
<p>When delayed variable substitution is enabled (can be set in the
Registry, for instance), !ENV! works similar to %ENV%, and the
value of the environment variable ENV will be subsituted.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.php.net/bug.php?id=69768</url>
</references>
<dates>
<discovery>2015-06-07</discovery>
<entry>2015-07-13</entry>
</dates>
</vuln>
<vuln vid="36bd352d-299b-11e5-86ff-14dae9d210b8">
<topic>mysql -- SSL Downgrade</topic>
<affects>
<package>
<name>php56-mysql</name>
<name>php56-mysqli</name>
<range><lt>5.6.11</lt></range>
</package>
<package>
<name>php55-mysql</name>
<name>php55-mysqli</name>
<range><lt>5.5.27</lt></range>
</package>
<package>
<name>php5-mysql</name>
<name>php5-mysqli</name>
<range><lt>5.4.43</lt></range>
</package>
<package>
<name>mariadb55-client</name>
<range><lt>5.5.44</lt></range>
</package>
<package>
<name>mariadb100-client</name>
<range><lt>10.0.20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Duo Security reports:</p>
<blockquote cite="https://www.duosecurity.com/blog/backronym-mysql-vulnerability">
<p>Researchers have identified a serious vulnerability in some
versions of Oracle’s MySQL database product that allows an attacker to
strip SSL/TLS connections of their security wrapping transparently.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.php.net/bug.php?id=69669</url>
<url>https://www.duosecurity.com/blog/backronym-mysql-vulnerability</url>
<url>http://www.ocert.org/advisories/ocert-2015-003.html</url>
<url>https://mariadb.atlassian.net/browse/MDEV-7937</url>
<url>https://mariadb.com/kb/en/mariadb/mariadb-10020-changelog/</url>
<url>https://mariadb.com/kb/en/mariadb/mariadb-5544-changelog/</url>
<cvename>CVE-2015-3152</cvename>
</references>
<dates>
<discovery>2015-03-20</discovery>
<entry>2015-07-13</entry>
<modified>2015-07-18</modified>
</dates>
</vuln>
<vuln vid="81326883-2905-11e5-a4a5-002590263bf5">
<topic>devel/ipython -- CSRF possible remote execution vulnerability</topic>
<affects>
<package>
<name>ipython</name>
<range><ge>0.12</ge><lt>3.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Kyle Kelley reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q3/92">
<p>Summary: POST requests exposed via the IPython REST API are
vulnerable to cross-site request forgery (CSRF). Web pages on
different domains can make non-AJAX POST requests to known IPython
URLs, and IPython will honor them. The user's browser will
automatically send IPython cookies along with the requests. The
response is blocked by the Same-Origin Policy, but the request
isn't.</p>
<p>API paths with issues:</p>
<ul>
<li>POST /api/contents/&lt;path&gt;/&lt;file&gt;</li>
<li>POST /api/contents/&lt;path&gt;/&lt;file&gt;/checkpoints</li>
<li>POST /api/contents/&lt;path&gt;/&lt;file&gt;/checkpoints/&lt;checkpoint_id&gt;</li>
<li>POST /api/kernels</li>
<li>POST /api/kernels/&lt;kernel_id&gt;/&lt;action&gt;</li>
<li>POST /api/sessions</li>
<li>POST /api/clusters/&lt;cluster_id&gt;/&lt;action&gt;</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5607</cvename>
<url>http://seclists.org/oss-sec/2015/q3/92</url>
<url>http://ipython.org/ipython-doc/3/whatsnew/version3.html#ipython-3-2-1</url>
</references>
<dates>
<discovery>2015-07-12</discovery>
<entry>2015-07-13</entry>
<modified>2015-07-22</modified>
</dates>
</vuln>
<vuln vid="379788f3-2900-11e5-a4a5-002590263bf5">
<topic>freeradius -- insufficent CRL application vulnerability</topic>
<affects>
<package>
<name>freeradius2</name>
<range><lt>2.2.8</lt></range>
</package>
<package>
<name>freeradius3</name>
<range><lt>3.0.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>oCERT reports:</p>
<blockquote cite="http://www.ocert.org/advisories/ocert-2015-008.html">
<p>The FreeRADIUS server relies on OpenSSL to perform certificate
validation, including Certificate Revocation List (CRL) checks. The
FreeRADIUS usage of OpenSSL, in CRL application, limits the checks
to leaf certificates, therefore not detecting revocation of
intermediate CA certificates.</p>
<p>An unexpired client certificate, issued by an intermediate CA with
a revoked certificate, is therefore accepted by FreeRADIUS.</p>
<p>Specifically sets the X509_V_FLAG_CRL_CHECK flag for leaf
certificate CRL checks, but does not use X509_V_FLAG_CRL_CHECK_ALL
for CRL checks on the complete trust chain.</p>
<p>The FreeRADIUS project advises that the recommended configuration
is to use self-signed CAs for all EAP-TLS methods.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4680</cvename>
<freebsdpr>ports/201058</freebsdpr>
<freebsdpr>ports/201059</freebsdpr>
<url>http://www.ocert.org/advisories/ocert-2015-008.html</url>
<url>http://freeradius.org/security.html</url>
</references>
<dates>
<discovery>2015-06-22</discovery>
<entry>2015-07-13</entry>
</dates>
</vuln>
<vuln vid="f1deed23-27ec-11e5-a4a5-002590263bf5">
<topic>xen-tools -- xl command line config handling stack overflow</topic>
<affects>
<package>
<name>xen-tools</name>
<range><ge>4.1</ge><lt>4.5.0_8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-137.html">
<p>The xl command line utility mishandles long configuration values
when passed as command line arguments, with a buffer overrun.</p>
<p>A semi-trusted guest administrator or controller, who is intended
to be able to partially control the configuration settings for a
domain, can escalate their privileges to that of the whole host.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3259</cvename>
<url>http://xenbits.xen.org/xsa/advisory-137.html</url>
</references>
<dates>
<discovery>2015-07-07</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="8c31b288-27ec-11e5-a4a5-002590263bf5">
<topic>xen-kernel -- vulnerability in the iret hypercall handler</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><ge>3.1</ge><lt>4.5.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-136.html">
<p>A buggy loop in Xen's compat_iret() function iterates the wrong way
around a 32-bit index. Any 32-bit PV guest kernel can trigger this
vulnerability by attempting a hypercall_iret with EFLAGS.VM set.</p>
<p>Given the use of __get/put_user(), and that the virtual addresses
in question are contained within the lower canonical half, the guest
cannot clobber any hypervisor data. Instead, Xen will take up to
2^33 pagefaults, in sequence, effectively hanging the host.</p>
<p>Malicious guest administrators can cause a denial of service
affecting the whole system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4164</cvename>
<url>http://xenbits.xen.org/xsa/advisory-136.html</url>
</references>
<dates>
<discovery>2015-06-11</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="80e846ff-27eb-11e5-a4a5-002590263bf5">
<topic>xen-kernel -- GNTTABOP_swap_grant_ref operation misbehavior</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><ge>4.2</ge><lt>4.5.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-134.html">
<p>With the introduction of version 2 grant table operations, a
version check became necessary for most grant table related
hypercalls. The GNTTABOP_swap_grant_ref call was lacking such a
check. As a result, the subsequent code behaved as if version 2 was
in use, when a guest issued this hypercall without a prior
GNTTABOP_setup_table or GNTTABOP_set_version.</p>
<p>The effect is a possible NULL pointer dereferences. However, this
cannot be exploited to elevate privileges of the attacking domain,
as the maximum memory address that can be wrongly accessed this way
is bounded to far below the start of hypervisor memory.</p>
<p>Malicious or buggy guest domain kernels can mount a denial of
service attack which, if successful, can affect the whole system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4163</cvename>
<url>http://xenbits.xen.org/xsa/advisory-134.html</url>
</references>
<dates>
<discovery>2015-06-11</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="ce658051-27ea-11e5-a4a5-002590263bf5">
<topic>xen-kernel -- Information leak through XEN_DOMCTL_gettscinfo</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><ge>4.0</ge><lt>4.5.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-132.html">
<p>The handler for XEN_DOMCTL_gettscinfo failed to initialize a
padding field subsequently copied to guest memory.</p>
<p>A similar leak existed in XEN_SYSCTL_getdomaininfolist, which is
being addressed here regardless of that operation being declared
unsafe for disaggregation by XSA-77.</p>
<p>Malicious or buggy stub domain kernels or tool stacks otherwise
living outside of Domain0 may be able to read sensitive data
relating to the hypervisor or other guests not under the control of
that domain.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3340</cvename>
<url>http://xenbits.xen.org/xsa/advisory-132.html</url>
</references>
<dates>
<discovery>2015-04-20</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="3d657340-27ea-11e5-a4a5-002590263bf5">
<topic>xen-tools -- Unmediated PCI register access in qemu</topic>
<affects>
<package>
<name>xen-tools</name>
<range><ge>3.3</ge><lt>4.5.0_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-131.html">
<p>Qemu allows guests to not only read, but also write all parts of
the PCI config space (but not extended config space) of passed
through PCI devices not explicitly dealt with for (partial)
emulation purposes.</p>
<p>Since the effect depends on the specific purpose of the the config
space field, it's not possbile to give a general statement about the
exact impact on the host or other guests. Privilege escalation,
host crash (Denial of Service), and leaked information all cannot be
excluded.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4106</cvename>
<url>http://xenbits.xen.org/xsa/advisory-131.html</url>
</references>
<dates>
<discovery>2015-06-02</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="cbe1a0f9-27e9-11e5-a4a5-002590263bf5">
<topic>xen-tools -- Guest triggerable qemu MSI-X pass-through error messages</topic>
<affects>
<package>
<name>xen-tools</name>
<range><ge>3.3</ge><lt>4.5.0_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-130.html">
<p>Device model code dealing with guest PCI MSI-X interrupt management
activities logs messages on certain (supposedly) invalid guest
operations.</p>
<p>A buggy or malicious guest repeatedly invoking such operations may
result in the host disk to fill up, possibly leading to a Denial of
Service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4105</cvename>
<url>http://xenbits.xen.org/xsa/advisory-130.html</url>
</references>
<dates>
<discovery>2015-06-02</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="4db8a0f4-27e9-11e5-a4a5-002590263bf5">
<topic>xen-tools -- PCI MSI mask bits inadvertently exposed to guests</topic>
<affects>
<package>
<name>xen-tools</name>
<range><ge>3.3</ge><lt>4.5.0_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-129.html">
<p>The mask bits optionally available in the PCI MSI capability
structure are used by the hypervisor to occasionally suppress
interrupt delivery. Unprivileged guests were, however, nevertheless
allowed direct control of these bits.</p>
<p>Interrupts may be observed by Xen at unexpected times, which may
lead to a host crash and therefore a Denial of Service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4104</cvename>
<url>http://xenbits.xen.org/xsa/advisory-129.html</url>
</references>
<dates>
<discovery>2015-06-02</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="af38cfec-27e7-11e5-a4a5-002590263bf5">
<topic>xen-tools -- Potential unintended writes to host MSI message data field via qemu</topic>
<affects>
<package>
<name>xen-tools</name>
<range><ge>3.3</ge><lt>4.5.0_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-128.html">
<p>Logic is in place to avoid writes to certain host config space
fields when the guest must nevertheless be able to access their
virtual counterparts. A bug in how this logic deals with accesses
spanning multiple fields allows the guest to write to the host MSI
message data field.</p>
<p>While generally the writes write back the values previously read,
their value in config space may have got changed by the host between
the qemu read and write. In such a case host side interrupt handling
could become confused, possibly losing interrupts or allowing
spurious interrupt injection into other guests.</p>
<p>Certain untrusted guest administrators may be able to confuse host
side interrupt handling, leading to a Denial of Service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4103</cvename>
<url>http://xenbits.xen.org/xsa/advisory-128.html</url>
</references>
<dates>
<discovery>2015-06-02</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="103a47d5-27e7-11e5-a4a5-002590263bf5">
<topic>xen-kernel -- Certain domctl operations may be abused to lock up the host</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><ge>4.3</ge><lt>4.5.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-127.html">
<p>XSA-77 put the majority of the domctl operations on a list
excepting them from having security advisories issued for them if
any effects their use might have could hamper security. Subsequently
some of them got declared disaggregation safe, but for a small
subset this was not really correct: Their (mis-)use may result in
host lockups.</p>
<p>As a result, the potential security benefits of toolstack
disaggregation are not always fully realised.</p>
<p>Domains deliberately given partial management control may be able
to deny service to the entire host.</p>
<p>As a result, in a system designed to enhance security by radically
disaggregating the management, the security may be reduced. But,
the security will be no worse than a non-disaggregated design.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-2751</cvename>
<url>http://xenbits.xen.org/xsa/advisory-127.html</url>
</references>
<dates>
<discovery>2015-03-31</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="79f401cd-27e6-11e5-a4a5-002590263bf5">
<topic>xen-tools -- Unmediated PCI command register access in qemu</topic>
<affects>
<package>
<name>xen-tools</name>
<range><ge>3.3</ge><lt>4.5.0_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-126.html">
<p>HVM guests are currently permitted to modify the memory and I/O
decode bits in the PCI command register of devices passed through to
them. Unless the device is an SR-IOV virtual function, after
disabling one or both of these bits subsequent accesses to the MMIO
or I/O port ranges would - on PCI Express devices - lead to
Unsupported Request responses. The treatment of such errors is
platform specific.</p>
<p>Furthermore (at least) devices under control of the Linux pciback
driver in the host are handed to guests with the aforementioned bits
turned off. This means that such accesses can similarly lead to
Unsupported Request responses until these flags are set as needed by
the guest.</p>
<p>In the event that the platform surfaces aforementioned UR responses
as Non-Maskable Interrupts, and either the OS is configured to treat
NMIs as fatal or (e.g. via ACPI's APEI) the platform tells the OS to
treat these errors as fatal, the host would crash, leading to a
Denial of Service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-2756</cvename>
<url>http://xenbits.xen.org/xsa/advisory-126.html</url>
</references>
<dates>
<discovery>2015-03-31</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="d40c66cb-27e4-11e5-a4a5-002590263bf5">
<topic>xen-kernel and xen-tools -- Long latency MMIO mapping operations are not preemptible</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.5.0_3</lt></range>
</package>
<package>
<name>xen-tools</name>
<range><lt>4.5.0_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-125.html">
<p>The XEN_DOMCTL_memory_mapping hypercall allows long running
operations without implementing preemption.</p>
<p>This hypercall is used by the device model as part of the emulation
associated with configuration of PCI devices passed through to HVM
guests and is therefore indirectly exposed to those guests.</p>
<p>This can cause a physical CPU to become busy for a significant
period, leading to a host denial of service in some cases.</p>
<p>If a host denial of service is not triggered then it may instead be
possible to deny service to the domain running the device model,
e.g. domain 0.</p>
<p>This hypercall is also exposed more generally to all toolstacks.
However the uses of it in libxl based toolstacks are not believed
to open up any avenue of attack from an untrusted guest. Other
toolstacks may be vulnerable however.</p>
<p>The vulnerability is exposed via HVM guests which have a PCI device
assigned to them. A malicious HVM guest in such a configuration can
mount a denial of service attack affecting the whole system via its
associated device model (qemu-dm).</p>
<p>A guest is able to trigger this hypercall via operations which it
is legitimately expected to perform, therefore running the device
model as a stub domain does not offer protection against the host
denial of service issue. However it does offer some protection
against secondary issues such as denial of service against dom0.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-2752</cvename>
<url>http://xenbits.xen.org/xsa/advisory-125.html</url>
</references>
<dates>
<discovery>2015-03-31</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="83a28417-27e3-11e5-a4a5-002590263bf5">
<topic>xen-kernel -- Hypervisor memory corruption due to x86 emulator flaw</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.5.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-123.html">
<p>Instructions with register operands ignore eventual segment
overrides encoded for them. Due to an insufficiently conditional
assignment such a bogus segment override can, however, corrupt a
pointer used subsequently to store the result of the instruction.</p>
<p>A malicious guest might be able to read sensitive data relating to
other guests, or to cause denial of service on the host. Arbitrary
code execution, and therefore privilege escalation, cannot be
excluded.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-2151</cvename>
<url>http://xenbits.xen.org/xsa/advisory-123.html</url>
</references>
<dates>
<discovery>2015-03-10</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="ef9d041e-27e2-11e5-a4a5-002590263bf5">
<topic>xen-kernel -- Information leak through version information hypercall</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.5.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-122.html">
<p>The code handling certain sub-operations of the
HYPERVISOR_xen_version hypercall fails to fully initialize all
fields of structures subsequently copied back to guest memory. Due
to this hypervisor stack contents are copied into the destination of
the operation, thus becoming visible to the guest.</p>
<p>A malicious guest might be able to read sensitive data relating to
other guests.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-2045</cvename>
<url>http://xenbits.xen.org/xsa/advisory-122.html</url>
</references>
<dates>
<discovery>2015-03-05</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="5023f559-27e2-11e5-a4a5-002590263bf5">
<topic>xen-kernel -- Information leak via internal x86 system device emulation</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.5.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-121.html">
<p>Emulation routines in the hypervisor dealing with certain system
devices check whether the access size by the guest is a supported
one. When the access size is unsupported these routines failed to
set the data to be returned to the guest for read accesses, so that
hypervisor stack contents are copied into the destination of the
operation, thus becoming visible to the guest.</p>
<p>A malicious HVM guest might be able to read sensitive data relating
to other guests.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-2044</cvename>
<url>http://xenbits.xen.org/xsa/advisory-121.html</url>
</references>
<dates>
<discovery>2015-03-05</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="0d732fd1-27e0-11e5-a4a5-002590263bf5">
<topic>xen-tools -- HVM qemu unexpectedly enabling emulated VGA graphics backends</topic>
<affects>
<package>
<name>xen-tools</name>
<range><lt>4.5.0_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-119.html">
<p>When instantiating an emulated VGA device for an x86 HVM guest qemu
will by default enable a backend to expose that device, either SDL
or VNC depending on the version of qemu and the build time
configuration.</p>
<p>The libxl toolstack library does not explicitly disable these
default backends when they are not enabled, leading to an unexpected
backend running.</p>
<p>If either SDL or VNC is explicitly enabled in the guest
configuration then only the expected backends will be enabled.</p>
<p>This affects qemu-xen and qemu-xen-traditional differently.</p>
<p>If qemu-xen was compiled with SDL support then this would result in
an SDL window being opened if $DISPLAY is valid, or a failure to
start the guest if not.</p>
<p>If qemu-xen was compiled without SDL support then qemu would
instead start a VNC server listening on ::1 (IPv6 localhost) or
127.0.0.1 (IPv4 localhost) with IPv6 preferred if available. A VNC
password will not be configured even if one is present in the guest
configuration.</p>
<p>qemu-xen-traditional will never start a vnc backend unless
explicitly configured. However by default it will start an SDL
backend if it was built with SDL support and $DISPLAY is valid.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-2152</cvename>
<url>http://xenbits.xen.org/xsa/advisory-119.html</url>
</references>
<dates>
<discovery>2015-03-13</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="912cb7f7-27df-11e5-a4a5-002590263bf5">
<topic>xen-kernel -- arm: vgic: incorrect rate limiting of guest triggered logging</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><ge>4.4</ge><lt>4.5.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-118.html">
<p>On ARM systems the code which deals with virtualising the GIC
distributor would, under various circumstances, log messages on a
guest accessible code path without appropriate rate limiting.</p>
<p>A malicious guest could cause repeated logging to the hypervisor
console, leading to a Denial of Service attack.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1563</cvename>
<url>http://xenbits.xen.org/xsa/advisory-118.html</url>
</references>
<dates>
<discovery>2015-01-29</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="785c86b1-27d6-11e5-a4a5-002590263bf5">
<topic>xen-kernel -- arm: vgic-v2: GICD_SGIR is not properly emulated</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><ge>4.5</ge><lt>4.5.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-117.html">
<p>When decoding a guest write to a specific register in the virtual
interrupt controller Xen would treat an invalid value as a critical
error and crash the host.</p>
<p>By writing an invalid value to the GICD.SGIR register a guest can
crash the host, resulting in a Denial of Service attack.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0268</cvename>
<url>http://xenbits.xen.org/xsa/advisory-117.html</url>
</references>
<dates>
<discovery>2015-02-12</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="7313b0e3-27b4-11e5-a15a-50af736ef1c0">
<topic>pivotx -- Multiple unrestricted file upload vulnerabilities</topic>
<affects>
<package>
<name>pivotx</name>
<range><lt>2.3.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Pivotx reports:</p>
<blockquote cite="http://pivotx.net/page/security">
<p>Multiple unrestricted file upload vulnerabilities in fileupload.php
in PivotX before 2.3.9 allow remote authenticated users to execute
arbitrary PHP code by uploading a file with a (1) .php or (2) .php#
extension, and then accessing it via unspecified vectors.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0341</cvename>
</references>
<dates>
<discovery>2014-04-15</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="14d846d6-27b3-11e5-a15a-50af736ef1c0">
<topic>pivotx -- cross-site scripting (XSS) vulnerability</topic>
<affects>
<package>
<name>pivotx</name>
<range><lt>2.3.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>pivotx reports:</p>
<blockquote cite="http://pivotx.net/page/security">
<p>cross-site scripting (XSS) vulnerability in the nickname (and
possibly the email) field. Mitigated by the fact that an attacker
must have a PivotX account.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0341</cvename>
</references>
<dates>
<discovery>2014-04-15</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="c93c9395-25e1-11e5-a4a5-002590263bf5">
<topic>wpa_supplicant -- WPS_NFC option payload length validation vulnerability</topic>
<affects>
<package>
<name>wpa_supplicant</name>
<range><lt>2.4_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jouni Malinen reports:</p>
<blockquote cite="http://w1.fi/security/2015-5/incomplete-wps-and-p2p-nfc-ndef-record-payload-length-validation.txt">
<p>Incomplete WPS and P2P NFC NDEF record payload length
validation. (2015-5)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8041</cvename>
<url>http://w1.fi/security/2015-5/incomplete-wps-and-p2p-nfc-ndef-record-payload-length-validation.txt</url>
</references>
<dates>
<discovery>2015-07-08</discovery>
<entry>2015-07-09</entry>
<modified>2015-11-10</modified>
</dates>
</vuln>
<vuln vid="075952fe-267e-11e5-9d03-3c970e169bc2">
<topic>openssl -- alternate chains certificate forgery vulnerability</topic>
<affects>
<package>
<name>openssl</name>
<range><ge>1.0.2_2</ge><lt>1.0.2_4</lt></range>
</package>
<package>
<name>mingw32-openssl</name>
<range><ge>1.0.2b</ge><lt>1.0.2d</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSSL reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv_20150709.txt">
<p>During certificate verification, OpenSSL (starting from version
1.0.1n and 1.0.2b) will attempt to find an alternative certificate
chain if the first attempt to build such a chain fails. An error
in the implementation of this logic can mean that an attacker could
cause certain checks on untrusted certificates to be bypassed,
such as the CA flag, enabling them to use a valid leaf certificate
to act as a CA and "issue" an invalid certificate.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1793</cvename>
<url>https://www.openssl.org/news/secadv_20150709.txt</url>
</references>
<dates>
<discovery>2015-07-09</discovery>
<entry>2015-07-09</entry>
</dates>
</vuln>
<vuln vid="37ed8e9c-2651-11e5-86ff-14dae9d210b8">
<topic>django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py27-django</name>
<range><ge>1.4.0</ge><lt>1.4.21</lt></range>
</package>
<package>
<name>py32-django</name>
<range><ge>1.4.0</ge><lt>1.4.21</lt></range>
</package>
<package>
<name>py33-django</name>
<range><ge>1.4.0</ge><lt>1.4.21</lt></range>
</package>
<package>
<name>py34-django</name>
<range><ge>1.4.0</ge><lt>1.4.21</lt></range>
</package>
<package>
<name>py27-django</name>
<range><ge>1.7.0</ge><lt>1.7.9</lt></range>
</package>
<package>
<name>py32-django</name>
<range><ge>1.7.0</ge><lt>1.7.9</lt></range>
</package>
<package>
<name>py33-django</name>
<range><ge>1.7.0</ge><lt>1.7.9</lt></range>
</package>
<package>
<name>py34-django</name>
<range><ge>1.7.0</ge><lt>1.7.9</lt></range>
</package>
<package>
<name>py27-django</name>
<range><ge>1.8.0</ge><lt>1.8.3</lt></range>
</package>
<package>
<name>py32-django</name>
<range><ge>1.8.0</ge><lt>1.8.3</lt></range>
</package>
<package>
<name>py33-django</name>
<range><ge>1.8.0</ge><lt>1.8.3</lt></range>
</package>
<package>
<name>py34-django</name>
<range><ge>1.8.0</ge><lt>1.8.3</lt></range>
</package>
<package>
<name>py27-django-devel</name>
<range><le>20150531,1</le></range>
</package>
<package>
<name>py32-django-devel</name>
<range><le>20150531,1</le></range>
</package>
<package>
<name>py33-django-devel</name>
<range><le>20150531,1</le></range>
</package>
<package>
<name>py34-django-devel</name>
<range><le>20150531,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tim Graham reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2015/jul/08/security-releases/">
<p>In accordance with our security release policy, the Django
team is issuing multiple releases -- Django 1.4.21, 1.7.9, and 1.8.3.
These releases are now available on PyPI and our download page. These
releases address several security issues detailed below. We encourage
all users of Django to upgrade as soon as possible. The Django master
branch has also been updated.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.djangoproject.com/weblog/2015/jul/08/security-releases/</url>
<url>https://github.com/django/django/commit/df049ed77a4db67e45db5679bfc76a85d2a26680</url>
<url>https://github.com/django/django/commit/014247ad1922931a2f17beaf6249247298e9dc44</url>
<url>https://github.com/django/django/commit/17d3a6d8044752f482453f5906026eaf12c39e8e</url>
<cvename>CVE-2015-5143</cvename>
<cvename>CVE-2015-5144</cvename>
<cvename>CVE-2015-5145</cvename>
</references>
<dates>
<discovery>2015-06-10</discovery>
<entry>2015-07-09</entry>
</dates>
</vuln>
<vuln vid="348bfa69-25a2-11e5-ade1-0011d823eebd">
<topic>Adobe Flash Player -- critical vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<range><lt>11.2r202.481</lt></range>
</package>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.481</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-16.html">
<p>
Adobe has released security updates for Adobe Flash Player. These
updates address critical vulnerabilities that could potentially
allow an attacker to take control of the affected system. Adobe is
aware of a report that an exploit targeting CVE-2015-5119 has been
publicly published.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://helpx.adobe.com/security/products/flash-player/apsb15-16.html</url>
<cvename>CVE-2015-5119</cvename>
</references>
<dates>
<discovery>2015-07-07</discovery>
<entry>2015-07-08</entry>
</dates>
</vuln>
<vuln vid="c93533a3-24f1-11e5-8b74-3c970e169bc2">
<topic>bind -- denial of service vulnerability</topic>
<affects>
<package>
<name>bind910</name>
<range><lt>9.10.2P2</lt></range>
</package>
<package>
<name>bind99</name>
<range><lt>9.9.7P1</lt></range>
</package>
<package>
<name>bind910-base</name>
<name>bind99-base</name>
<range><gt>0</gt></range>
</package>
<package>
<name>FreeBSD</name>
<range><gt>9.3</gt><lt>9.3_19</lt></range>
<range><gt>8.4</gt><lt>8.4_33</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01267/">
<p>A very uncommon combination of zone data has been found
that triggers a bug in BIND, with the result that named
will exit with a "REQUIRE" failure in name.c when validating
the data returned in answer to a recursive query.</p>
<p>A recursive resolver that is performing DNSSEC validation
can be deliberately terminated by any attacker who can
cause a query to be performed against a maliciously
constructed zone. This will result in a denial of
service to clients who rely on that resolver.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4620</cvename>
<url>https://kb.isc.org/article/AA-01267/</url>
</references>
<dates>
<discovery>2015-07-07</discovery>
<entry>2015-07-07</entry>
<modified>2015-07-07</modified>
</dates>
</vuln>
<vuln vid="cbfa8bd7-24b6-11e5-86ff-14dae9d210b8">
<topic>haproxy -- information leak vulnerability</topic>
<affects>
<package>
<name>haproxy</name>
<range><ge>1.5.0</ge><lt>1.5.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>HAProxy reports:</p>
<blockquote cite="http://www.haproxy.org/news.html">
<p>A vulnerability was found when HTTP pipelining is used. In
some cases, a client might be able to cause a buffer alignment issue and
retrieve uninitialized memory contents that exhibit data from a past
request or session. I want to address sincere congratulations to Charlie
Smurthwaite of aTech Media for the really detailed traces he provided
which made it possible to find the cause of this bug. Every user of
1.5-dev, 1.5.x or 1.6-dev must upgrade to 1.5.14 or latest 1.6-dev
snapshot to fix this issue, or use the backport of the fix provided by
their operating system vendors. CVE-2015-3281 was assigned to this bug.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.haproxy.org/news.html</url>
<url>http://git.haproxy.org/?p=haproxy-1.5.git;a=commit;h=7ec765568883b2d4e5a2796adbeb492a22ec9bd4</url>
<mlist>http://seclists.org/oss-sec/2015/q3/61</mlist>
<cvename>CVE-2015-3281</cvename>
</references>
<dates>
<discovery>2015-07-02</discovery>
<entry>2015-07-07</entry>
</dates>
</vuln>
<vuln vid="038a5808-24b3-11e5-b0c8-bf4d8935d4fa">
<topic>roundcube -- multiple vulnerabilities</topic>
<affects>
<package>
<name>roundcube</name>
<range><ge>1.1.0,1</ge><lt>1.1.2,1</lt></range>
<range><lt>1.0.6,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Roundcube reports:</p>
<blockquote cite="https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released/">
<p>We just published updates to both stable versions 1.0 and
1.1 after fixing many minor bugs and adding some security improvements
to the 1.1 release branch. Version 1.0.6 comes with cherry-picked fixes
from the more recent version to ensure proper long term support
especially in regards of security and compatibility.<br/>
<br/>
The security-related fixes in particular are:<br/>
<br/>
* XSS vulnerability in _mbox argument<br/>
* security improvement in contact photo handling<br/>
* potential info disclosure from temp directory</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5381</cvename>
<cvename>CVE-2015-5383</cvename>
<mlist>http://openwall.com/lists/oss-security/2015/07/06/10</mlist>
<url>https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released/</url>
</references>
<dates>
<discovery>2015-05-30</discovery>
<entry>2015-07-07</entry>
</dates>
</vuln>
<vuln vid="543b5939-2067-11e5-a4a5-002590263bf5">
<topic>turnserver -- SQL injection vulnerability</topic>
<affects>
<package>
<name>turnserver</name>
<range><lt>4.4.5.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oleg Moskalenko reports:</p>
<blockquote cite="http://turnserver.open-sys.org/downloads/v4.4.5.3/ChangeLog">
<p>SQL injection security hole fixed.</p>
</blockquote>
</body>
</description>
<references>
<url>http://turnserver.open-sys.org/downloads/v4.4.5.3/ChangeLog</url>
<mlist>https://groups.google.com/d/msg/turn-server-project-rfc5766-turn-server/Dj3MmgyZX1o/ZaFo3zvxIw0J</mlist>
</references>
<dates>
<discovery>2015-06-20</discovery>
<entry>2015-07-02</entry>
</dates>
</vuln>
<vuln vid="150d1538-23fa-11e5-a4a5-002590263bf5">
<topic>squid -- Improper Protection of Alternate Path with CONNECT requests</topic>
<affects>
<package>
<name>squid</name>
<range><lt>3.5.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Squid security advisory 2015:2 reports:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2015_2.txt">
<p>Squid configured with cache_peer and operating on explicit proxy
traffic does not correctly handle CONNECT method peer responses.</p>
<p>The bug is important because it allows remote clients to bypass
security in an explicit gateway proxy.</p>
<p>However, the bug is exploitable only if you have configured
cache_peer to receive CONNECT requests.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.squid-cache.org/Advisories/SQUID-2015_2.txt</url>
<cvename>CVE-2015-5400</cvename>
</references>
<dates>
<discovery>2015-07-06</discovery>
<entry>2015-07-06</entry>
<modified>2015-07-17</modified>
</dates>
</vuln>
<vuln vid="b6da24da-23f7-11e5-a4a5-002590263bf5">
<topic>squid -- client-first SSL-bump does not correctly validate X509 server certificate</topic>
<affects>
<package>
<name>squid</name>
<range><ge>3.5</ge><lt>3.5.4</lt></range>
<range><ge>3.4</ge><lt>3.4.13</lt></range>
</package>
<package>
<name>squid33</name>
<range><ge>3.3</ge><lt>3.3.14</lt></range>
</package>
<package>
<name>squid32</name>
<range><ge>3.2</ge><lt>3.2.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Squid security advisory 2015:1 reports:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2015_1.txt">
<p>Squid configured with client-first SSL-bump does not correctly
validate X509 server certificate domain / hostname fields.</p>
<p>The bug is important because it allows remote servers to bypass
client certificate validation. Some attackers may also be able
to use valid certificates for one domain signed by a global
Certificate Authority to abuse an unrelated domain.</p>
<p>However, the bug is exploitable only if you have configured
Squid to perform SSL Bumping with the "client-first" or "bump"
mode of operation.</p>
<p>Sites that do not use SSL-Bump are not vulnerable.</p>
<p>All Squid built without SSL support are not vulnerable to the
problem.</p>
</blockquote>
<p>The FreeBSD port does not use SSL by default and is not vulnerable
in the default configuration.</p>
</body>
</description>
<references>
<cvename>CVE-2015-3455</cvename>
<url>http://www.squid-cache.org/Advisories/SQUID-2015_1.txt</url>
</references>
<dates>
<discovery>2015-05-01</discovery>
<entry>2015-07-06</entry>
</dates>
</vuln>
<vuln vid="72fccfdf-2061-11e5-a4a5-002590263bf5">
<topic>ansible -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ansible</name>
<range><lt>1.9.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ansible, Inc. reports:</p>
<blockquote cite="http://www.ansible.com/security">
<p>Ensure that hostnames match certificate names when using HTTPS -
resolved in Ansible 1.9.2</p>
<p>Improper symlink handling in zone, jail, and chroot connection
plugins could lead to escape from confined environment - resolved
in Ansible 1.9.2</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3908</cvename>
<cvename>CVE-2015-6240</cvename>
<url>http://www.ansible.com/security</url>
<url>https://raw.githubusercontent.com/ansible/ansible/v1.9.2-1/CHANGELOG.md</url>
</references>
<dates>
<discovery>2015-06-25</discovery>
<entry>2015-07-02</entry>
<modified>2015-08-18</modified>
</dates>
</vuln>
<vuln vid="e308c61a-2060-11e5-a4a5-002590263bf5">
<topic>ansible -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ansible</name>
<range><lt>1.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ansible, Inc. reports:</p>
<blockquote cite="http://www.ansible.com/security">
<p>Arbitrary execution from data from compromised remote hosts or
local data when using a legacy Ansible syntax - resolved in
Ansible 1.7</p>
<p>ansible-galaxy command when used on local tarballs (and not
galaxy.ansible.com) can install a malformed tarball if so provided
- resolved in Ansible 1.7</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.ansible.com/security</url>
<url>https://raw.githubusercontent.com/ansible/ansible/devel/CHANGELOG.md</url>
</references>
<dates>
<discovery>2014-08-06</discovery>
<entry>2015-07-02</entry>
</dates>
</vuln>
<vuln vid="9dae9d62-205f-11e5-a4a5-002590263bf5">
<topic>ansible -- code execution from compromised remote host data or untrusted local data</topic>
<affects>
<package>
<name>ansible</name>
<range><lt>1.6.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ansible, Inc. reports:</p>
<blockquote cite="http://www.ansible.com/security">
<p>Arbitrary execution from data from compromised remote hosts or
untrusted local data - resolved in Ansible 1.6.7</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-4966</cvename>
<bid>68794</bid>
<url>http://www.ansible.com/security</url>
<url>https://raw.githubusercontent.com/ansible/ansible/devel/CHANGELOG.md</url>
</references>
<dates>
<discovery>2014-07-21</discovery>
<entry>2015-07-02</entry>
</dates>
</vuln>
<vuln vid="2c493ac8-205e-11e5-a4a5-002590263bf5">
<topic>ansible -- remote code execution vulnerability</topic>
<affects>
<package>
<name>ansible</name>
<range><lt>1.6.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ansible, Inc. reports:</p>
<blockquote cite="http://www.ansible.com/security">
<p>Incomplete Fix Remote Code Execution Vulnerability - Fixed in
Ansible 1.6.4</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-4678</cvename>
<bid>68335</bid>
<url>http://www.ansible.com/security</url>
<url>https://raw.githubusercontent.com/ansible/ansible/devel/CHANGELOG.md</url>
</references>
<dates>
<discovery>2014-06-25</discovery>
<entry>2015-07-02</entry>
</dates>
</vuln>
<vuln vid="a6a9f9d5-205c-11e5-a4a5-002590263bf5">
<topic>ansible -- local symlink exploits</topic>
<affects>
<package>
<name>ansible</name>
<range><lt>1.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4259">
<p>runner/connection_plugins/ssh.py in Ansible before 1.2.3, when
using ControlPersist, allows local users to redirect a ssh session
via a symlink attack on a socket file with a predictable name in
/tmp/.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4260">
<p>lib/ansible/playbook/__init__.py in Ansible 1.2.x before 1.2.3,
when playbook does not run due to an error, allows local users to
overwrite arbitrary files via a symlink attack on a retry file with
a predictable name in /var/tmp/ansible/.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4259</cvename>
<cvename>CVE-2013-4260</cvename>
<url>http://www.ansible.com/security</url>
<url>https://groups.google.com/forum/#!topic/ansible-project/UVDYW0HGcNg</url>
</references>
<dates>
<discovery>2013-08-21</discovery>
<entry>2015-07-02</entry>
</dates>
</vuln>
<vuln vid="a478421e-2059-11e5-a4a5-002590263bf5">
<topic>ansible -- enable host key checking in paramiko connection type</topic>
<affects>
<package>
<name>ansible</name>
<range><lt>1.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ansible changelog reports:</p>
<blockquote cite="https://raw.githubusercontent.com/ansible/ansible/devel/CHANGELOG.md">
<p>Host key checking is on by default. Disable it if you like by
adding host_key_checking=False in the [default] section of
/etc/ansible/ansible.cfg or ~/ansible.cfg or by exporting
ANSIBLE_HOST_KEY_CHECKING=False.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2233</cvename>
<url>https://raw.githubusercontent.com/ansible/ansible/devel/CHANGELOG.md</url>
<url>http://www.ansible.com/security</url>
<url>https://github.com/ansible/ansible/issues/857</url>
</references>
<dates>
<discovery>2012-08-13</discovery>
<entry>2015-07-02</entry>
</dates>
</vuln>
<vuln vid="d7b9a28d-238c-11e5-86ff-14dae9d210b8">
<topic>bitcoin -- denial of service</topic>
<affects>
<package>
<name>bitcoin</name>
<range><lt>0.10.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gregory Maxwell reports:</p>
<blockquote cite="http://bitcoin-development.narkive.com/tO8M0R0j/upcoming-dos-vulnerability-announcements-for-bitcoin-core">
<p>On July 7th I will be making public details of several
serious denial of service vulnerabilities which have fixed in recent
versions of Bitcoin Core, including including CVE-2015-3641.
I strongly recommend anyone running production nodes exposed to inbound
connections from the internet upgrade to 0.10.2 as soon as possible.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3641</cvename>
<url>http://bitcoin-development.narkive.com/tO8M0R0j/upcoming-dos-vulnerability-announcements-for-bitcoin-core</url>
<url>https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures</url>
</references>
<dates>
<discovery>2015-06-27</discovery>
<entry>2015-07-06</entry>
</dates>
</vuln>
<vuln vid="864e6f75-2372-11e5-86ff-14dae9d210b8">
<topic>node, iojs, and v8 -- denial of service</topic>
<affects>
<package>
<name>node</name>
<range><lt>0.12.6</lt></range>
</package>
<package>
<name>node-devel</name>
<range><lt>0.12.6</lt></range>
</package>
<package>
<name>iojs</name>
<range><lt>2.3.3</lt></range>
</package>
<package>
<name>v8</name>
<range><le>3.18.5</le></range>
</package>
<package>
<name>v8-devel</name>
<range><le>3.27.7_2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>node reports:</p>
<blockquote cite="http://blog.nodejs.org/2015/07/03/node-v0-12-6-stable/">
<p>This release of Node.js fixes a bug that triggers an
out-of-band write in V8's utf-8 decoder. This bug impacts all Buffer to
String conversions. This is an important security update as this bug can
be used to cause a denial of service attack.</p>
</blockquote>
</body>
</description>
<references>
<url>http://blog.nodejs.org/2015/07/03/node-v0-12-6-stable/</url>
<url>https://github.com/joyent/node/commit/78b0e30954111cfaba0edbeee85450d8cbc6fdf6</url>
<url>https://github.com/nodejs/io.js/commit/030f8045c706a8c3925ec7cb3184fdfae4ba8676</url>
<url>https://codereview.chromium.org/1226493003</url>
<cvename>CVE-2015-5380</cvename>
</references>
<dates>
<discovery>2015-07-03</discovery>
<entry>2015-07-06</entry>
<modified>2015-07-10</modified>
</dates>
</vuln>
<vuln vid="bf1d9331-21b6-11e5-86ff-14dae9d210b8">
<topic>cups-filters -- texttopdf integer overflow</topic>
<affects>
<package>
<name>cups-filters</name>
<range><lt>1.0.71</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Stefan Cornelius from Red Hat reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/07/03/2">
<p>An integer overflow flaw leading to a heap-based buffer overflow was
discovered in the way the texttopdf utility of cups-filter processed
print jobs with a specially crafted line size. An attacker being able
to submit print jobs could exploit this flaw to crash texttopdf or,
possibly, execute arbitrary code with the privileges of the 'lp' user.</p>
</blockquote>
<p>Tim Waugh reports:</p>
<blockquote cite="http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7365">
<p>The Page allocation is moved into textcommon.c, where it does all the
necessary checking: lower-bounds for CVE-2015-3258 and upper-bounds
for CVE-2015-3259 due to integer overflows for the calloc() call
initialising Page[0] and the memset() call in texttopdf.c's
WritePage() function zeroing the entire array.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3279</cvename>
<url>https://access.redhat.com/security/cve/CVE-2015-3279</url>
<url>http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7365</url>
<mlist>http://osdir.com/ml/opensource-software-security/2015-07/msg00021.html</mlist>
</references>
<dates>
<discovery>2015-07-03</discovery>
<entry>2015-07-03</entry>
<modified>2015-07-07</modified>
</dates>
</vuln>
<vuln vid="9c7177ff-1fe1-11e5-9a01-bcaec565249c">
<topic>libxml2 -- Enforce the reader to run in constant memory</topic>
<affects>
<package>
<name>libxml2</name>
<range><lt>2.9.2_3</lt></range>
</package>
<package>
<name>linux-c6-libxml2</name>
<range><lt>2.7.6_5</lt></range>
</package>
<package>
<name>linux-f10-libxml2</name>
<range><ge>*</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Daniel Veilland reports:</p>
<blockquote cite="https://git.gnome.org/browse/libxml2/commit/?id=213f1fe0d76d30eaed6e5853057defc43e6df2c9">
<p>Enforce the reader to run in constant memory. One of the
operation on the reader could resolve entities leading to
the classic expansion issue. Make sure the buffer used for
xmlreader operation is bounded. Introduce a new allocation
type for the buffers for this effect.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1819</cvename>
<url>https://git.gnome.org/browse/libxml2/commit/?id=213f1fe0d76d30eaed6e5853057defc43e6df2c9</url>
</references>
<dates>
<discovery>2015-04-14</discovery>
<entry>2015-07-01</entry>
<modified>2016-01-31</modified>
</dates>
</vuln>
<vuln vid="2a8b7d21-1ecc-11e5-a4a5-002590263bf5">
<topic>wesnoth -- disclosure of .pbl files with lowercase, uppercase, and mixed-case extension</topic>
<affects>
<package>
<name>wesnoth</name>
<range><lt>1.12.4,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ignacio R. Morelle reports:</p>
<blockquote cite="http://forums.wesnoth.org/viewtopic.php?t=42776">
<p>As mentioned in the Wesnoth 1.12.4 and Wesnoth 1.13.1 release
announcements, a security vulnerability targeting add-on authors
was found (bug #23504) which allowed a malicious user to obtain
add-on server passphrases from the client's .pbl files and transmit
them over the network, or store them in saved game files intended
to be shared by the victim. This vulnerability affects all existing
releases up to and including versions 1.12.2 and 1.13.0.
Additionally, version 1.12.3 included only a partial fix that failed
to guard users against attempts to read from .pbl files with an
uppercase or mixed-case extension. CVE-2015-5069 and CVE-2015-5070
have been assigned to the vulnerability affecting .pbl files with a
lowercase extension, and .pbl files with an uppercase or mixed-case
extension, respectively.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5069</cvename>
<cvename>CVE-2015-5070</cvename>
<url>http://forums.wesnoth.org/viewtopic.php?t=42776</url>
<url>http://forums.wesnoth.org/viewtopic.php?t=42775</url>
</references>
<dates>
<discovery>2015-06-28</discovery>
<entry>2015-07-01</entry>
</dates>
</vuln>
<vuln vid="b19da422-1e02-11e5-b43d-002590263bf5">
<topic>cups-filters -- buffer overflow in texttopdf size allocation</topic>
<affects>
<package>
<name>cups-filters</name>
<range><lt>1.0.70</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Stefan Cornelius from Red Hat reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/06/26/4">
<p>A heap-based buffer overflow was discovered in the way the
texttopdf utility of cups-filters processed print jobs with a
specially crafted line size. An attacker being able to submit
print jobs could exploit this flaw to crash texttopdf or,
possibly, execute arbitrary code.</p>
</blockquote>
<p>Till Kamppeter reports:</p>
<blockquote cite="http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7363">
<p>texttopdf: Fixed buffer overflow on size allocation of texttopdf
when working with extremely small line sizes, which causes the size
calculation to result in 0 (CVE-2015-3258, thanks to Stefan
Cornelius from Red Hat for the patch).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3258</cvename>
<mlist>http://www.openwall.com/lists/oss-security/2015/06/26/4</mlist>
<url>http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7363</url>
</references>
<dates>
<discovery>2015-06-26</discovery>
<entry>2015-06-29</entry>
</dates>
</vuln>
<vuln vid="0d0f3050-1f69-11e5-9ba9-d050996490d0">
<topic>ntp -- control message remote Deinal of Service vulnerability</topic>
<affects>
<package>
<name>ntp</name>
<range><lt>4.2.8p3</lt></range>
</package>
<package>
<name>ntp-devel</name>
<range><lt>4.3.25</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ntp.org reports:</p>
<blockquote cite="http://support.ntp.org/bin/view/Main/SecurityNotice#June_2015_NTP_Security_Vulnerabi">
<p>Under limited and specific circumstances an attacker can send a
crafted packet to cause a vulnerable ntpd instance to crash.
This requires each of the following to be true:</p>
<ul>
<li>ntpd set up to allow for remote configuration (not
allowed by default), and</li>
<li>knowledge of the configuration password, and</li>
<li>access to a computer entrusted to perform remote
configuration.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://bugs.ntp.org/show_bug.cgi?id=2853</url>
<url>https://www.kb.cert.org/vuls/id/668167</url>
<url>http://support.ntp.org/bin/view/Main/SecurityNotice#June_2015_NTP_Security_Vulnerabi</url>
</references>
<dates>
<discovery>2015-06-29</discovery>
<entry>2015-06-30</entry>
</dates>
</vuln>
<vuln vid="acd5d037-1c33-11e5-be9c-6805ca1d3bb1">
<topic>qemu -- Heap overflow in QEMU PCNET controller, allowing guest to host escape (CVE-2015-3209)</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>0.11.1_20</lt></range>
<range><ge>0.12</ge><lt>2.3.0_2</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<range><lt>2.3.50.g20150618_1</lt></range>
</package>
<package>
<name>xen-tools</name>
<range><lt>4.5.0_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The QEMU security team reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-135.html">
<p>A guest which has access to an emulated PCNET network
device (e.g. with "model=pcnet" in their VIF configuration)
can exploit this vulnerability to take over the qemu
process elevating its privilege to that of the qemu
process.</p>
</blockquote>
</body>
</description>
<references>
<url>http://xenbits.xen.org/xsa/advisory-135.html</url>
<cvename>CVE-2015-3209</cvename>
</references>
<dates>
<discovery>2015-04-10</discovery>
<entry>2015-06-26</entry>
<modified>2015-07-11</modified>
</dates>
</vuln>
<vuln vid="23232028-1ba4-11e5-b43d-002590263bf5">
<topic>elasticsearch -- security fix for shared file-system repositories</topic>
<affects>
<package>
<name>elasticsearch</name>
<range><ge>1.0.0</ge><lt>1.6.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Elastic reports:</p>
<blockquote cite="https://www.elastic.co/community/security">
<p>Vulnerability Summary: All Elasticsearch versions from 1.0.0 to
1.5.2 are vulnerable to an attack that uses Elasticsearch to modify
files read and executed by certain other applications.</p>
<p>Remediation Summary: Users should upgrade to 1.6.0. Alternately,
ensure that other applications are not present on the system, or
that Elasticsearch cannot write into areas where these applications
would read.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4165</cvename>
<freebsdpr>ports/201008</freebsdpr>
<url>https://www.elastic.co/community/security</url>
<url>https://www.elastic.co/blog/elasticsearch-1-6-0-released</url>
</references>
<dates>
<discovery>2015-06-09</discovery>
<entry>2015-06-26</entry>
</dates>
</vuln>
<vuln vid="a71e7440-1ba3-11e5-b43d-002590263bf5">
<topic>elasticsearch -- directory traversal attack with site plugins</topic>
<affects>
<package>
<name>elasticsearch</name>
<range><lt>1.4.5</lt></range>
<range><ge>1.5.0</ge><lt>1.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Elastic reports:</p>
<blockquote cite="https://www.elastic.co/community/security">
<p>Vulnerability Summary: All Elasticsearch versions prior to 1.5.2
and 1.4.5 are vulnerable to a directory traversal attack that allows
an attacker to retrieve files from the server running Elasticsearch
when one or more site plugins are installed, or when Windows is the
server OS.</p>
<p>Remediation Summary: Users should upgrade to 1.4.5 or 1.5.2. Users
that do not want to upgrade can address the vulnerability by
disabling site plugins. See the CVE description for additional
options.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3337</cvename>
<bid>74353</bid>
<url>https://www.elastic.co/community/security</url>
<url>https://www.elastic.co/blog/elasticsearch-1-5-2-and-1-4-5-released</url>
<url>https://www.exploit-db.com/exploits/37054/</url>
<url>https://packetstormsecurity.com/files/131646/Elasticsearch-Directory-Traversal.html</url>
<url>http://www.securityfocus.com/archive/1/535385</url>
</references>
<dates>
<discovery>2015-04-27</discovery>
<entry>2015-06-26</entry>
</dates>
</vuln>
<vuln vid="026759e0-1ba3-11e5-b43d-002590263bf5">
<topic>elasticsearch -- remote OS command execution via Groovy scripting engine</topic>
<affects>
<package>
<name>elasticsearch</name>
<range><ge>1.3.0</ge><lt>1.3.8</lt></range>
<range><ge>1.4.0</ge><lt>1.4.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Elastic reports:</p>
<blockquote cite="https://www.elastic.co/community/security">
<p>Vulnerability Summary: Elasticsearch versions 1.3.0-1.3.7 and
1.4.0-1.4.2 have vulnerabilities in the Groovy scripting engine that
were introduced in 1.3.0. The vulnerability allows an attacker to
construct Groovy scripts that escape the sandbox and execute shell
commands as the user running the Elasticsearch Java VM.</p>
<p>Remediation Summary: Users should upgrade to 1.3.8 or 1.4.3. Users
that do not want to upgrade can address the vulnerability by setting
script.groovy.sandbox.enabled to false in elasticsearch.yml and
restarting the node.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1427</cvename>
<bid>72585</bid>
<url>https://www.elastic.co/community/security</url>
<url>https://www.elastic.co/blog/elasticsearch-1-4-3-and-1-3-8-released</url>
<url>http://www.securityfocus.com/archive/1/archive/1/534689/100/0/threaded</url>
<url>https://packetstormsecurity.com/files/130368/Elasticsearch-1.3.7-1.4.2-Sandbox-Escape-Command-Execution.html</url>
<url>https://packetstormsecurity.com/files/130784/ElasticSearch-Unauthenticated-Remote-Code-Execution.html</url>
</references>
<dates>
<discovery>2015-02-11</discovery>
<entry>2015-06-26</entry>
</dates>
</vuln>
<vuln vid="5951fb49-1ba2-11e5-b43d-002590263bf5">
<topic>elasticsearch -- cross site scripting vulnerability in the CORS functionality</topic>
<affects>
<package>
<name>elasticsearch</name>
<range><lt>1.4.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Elastic reports:</p>
<blockquote cite="https://www.elastic.co/community/security">
<p>Vulnerability Summary: Elasticsearch versions 1.3.x and prior have
a default configuration for CORS that allows an attacker to craft
links that could cause a user's browser to send requests to
Elasticsearch instances on their local network. These requests could
cause data loss or compromise.</p>
<p>Remediation Summary: Users should either set "http.cors.enabled" to
false, or set "http.cors.allow-origin" to the value of the server
that should be allowed access, such as localhost or a server hosting
Kibana. Disabling CORS entirely with the former setting is more
secure, but may not be suitable for all use cases.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-6439</cvename>
<bid>70233</bid>
<url>https://www.elastic.co/community/security</url>
<url>https://www.elastic.co/blog/elasticsearch-1-4-0-beta-released</url>
<url>https://packetstormsecurity.com/files/128556/Elasticsearch-1.3.x-CORS-Issue.html</url>
<url>http://www.securityfocus.com/archive/1/archive/1/533602/100/0/threaded</url>
</references>
<dates>
<discovery>2014-10-01</discovery>
<entry>2015-06-26</entry>
</dates>
</vuln>
<vuln vid="43ac9d42-1b9a-11e5-b43d-002590263bf5">
<topic>elasticsearch and logstash -- remote OS command execution via dynamic scripting</topic>
<affects>
<package>
<name>elasticsearch</name>
<range><lt>1.2.0</lt></range>
</package>
<package>
<name>logstash</name>
<range><lt>1.4.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Elastic reports:</p>
<blockquote cite="https://www.elastic.co/community/security">
<p>Vulnerability Summary: In Elasticsearch versions 1.1.x and prior,
dynamic scripting is enabled by default. This could allow an
attacker to execute OS commands.</p>
<p>Remediation Summary: Disable dynamic scripting.</p>
</blockquote>
<blockquote cite="https://www.elastic.co/blog/logstash-1-4-3-released">
<p>Logstash 1.4.2 was bundled with Elasticsearch 1.1.1, which is
vulnerable to CVE-2014-3120. These binaries are used in
Elasticsearch output specifically when using the node protocol.
Since a node client joins the Elasticsearch cluster, the attackers
could use scripts to execute commands on the host OS using the node
client's URL endpoint. With 1.4.3 release, we are packaging Logstash
with Elasticsearch 1.5.2 binaries which by default disables the
ability to run scripts. This also affects users who are using the
configuration option embedded=&gt;true in the Elasticsearch output
which starts a local embedded Elasticsearch cluster. This is
typically used in development environment and proof of concept
deployments. Regardless of this vulnerability, we strongly recommend
not using embedded in production.</p>
<p>Note that users of transport and http protocol are not vulnerable
to this attack.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3120</cvename>
<bid>67731</bid>
<url>https://www.elastic.co/community/security</url>
<url>https://www.elastic.co/blog/elasticsearch-1-2-0-released</url>
<url>https://www.elastic.co/blog/logstash-1-4-3-released</url>
<url>https://www.exploit-db.com/exploits/33370/</url>
<url>http://bouk.co/blog/elasticsearch-rce/</url>
<url>http://www.rapid7.com/db/modules/exploit/multi/elasticsearch/script_mvel_rce</url>
<url>https://www.found.no/foundation/elasticsearch-security/#staying-safe-while-developing-with-elasticsearch</url>
</references>
<dates>
<discovery>2014-05-22</discovery>
<entry>2015-06-26</entry>
</dates>
</vuln>
<vuln vid="24bde04f-1a10-11e5-b43d-002590263bf5">
<topic>logstash -- Directory traversal vulnerability in the file output plugin</topic>
<affects>
<package>
<name>logstash</name>
<range><lt>1.4.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Elastic reports:</p>
<blockquote cite="https://www.elastic.co/blog/logstash-1-4-3-released">
<p>An attacker could use the File output plugin with dynamic field
references in the path option to traverse paths outside of Logstash
directory. This technique could also be used to overwrite any files
which can be accessed with permissions associated with Logstash
user. This release sandboxes the paths which can be traversed using
the configuration. We have also disallowed use of dynamic field
references if the path options is pointing to an absolute path.</p>
<p>We have added this vulnerability to our CVE page and are working
on filling out the CVE. We would like to thank Colin Coghill for
reporting the issue and working with us on the resolution.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4152</cvename>
<url>https://www.elastic.co/blog/logstash-1-4-3-released</url>
<url>https://www.elastic.co/community/security</url>
</references>
<dates>
<discovery>2015-06-09</discovery>
<entry>2015-06-24</entry>
</dates>
</vuln>
<vuln vid="2184ccad-1a10-11e5-b43d-002590263bf5">
<topic>logstash -- Remote command execution in Logstash zabbix and nagios_nsca outputs</topic>
<affects>
<package>
<name>logstash</name>
<range><lt>1.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Elastic reports:</p>
<blockquote cite="https://www.elastic.co/blog/logstash-1-4-2">
<p>The vulnerability impacts deployments that use the either the
zabbix or the nagios_nsca outputs. In these cases, an attacker
with an ability to send crafted events to any source of data for
Logstash could execute operating system commands with the
permissions of the Logstash process.</p>
<p>Deployments that do not use the zabbix or the nagios_nsca outputs
are not vulnerable and do not need to upgrade for this reason.</p>
<p>We have added this vulnerability to our CVE page and are working
on filling out the CVE.</p>
<p>We would like to thank Jan Karwowski and Danila Borisiuk for
reporting the issue and working with us on the resolution.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-4326</cvename>
<url>https://www.elastic.co/blog/logstash-1-4-2</url>
<url>https://www.elastic.co/community/security</url>
</references>
<dates>
<discovery>2014-06-24</discovery>
<entry>2015-06-24</entry>
</dates>
</vuln>
<vuln vid="ad4d3871-1a0d-11e5-b43d-002590263bf5">
<topic>logstash-forwarder and logstash -- susceptibility to POODLE vulnerability</topic>
<affects>
<package>
<name>logstash-forwarder</name>
<range><lt>0.4.0.20150507</lt></range>
</package>
<package>
<name>logstash</name>
<range><lt>1.4.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Elastic reports:</p>
<blockquote cite="https://www.elastic.co/blog/logstash-1-4-3-released">
<p>The combination of Logstash Forwarder and Lumberjack input (and
output) was vulnerable to the POODLE attack in SSLv3 protocol. We
have disabled SSLv3 for this combination and set the minimum version
to be TLSv1.0. We have added this vulnerability to our CVE page and
are working on filling out the CVE.</p>
<p>Thanks to Tray Torrance, Marc Chadwick, and David Arena for
reporting this.</p>
</blockquote>
<blockquote cite="https://www.elastic.co/blog/logstash-forwarder-0-4-0-released">
<p>SSLv3 is no longer supported; TLS 1.0+ is required (compatible
with Logstash 1.4.2+).</p>
</blockquote>
</body>
</description>
<references>
<!-- POODLE CVE pending -->
<freebsdpr>ports/201065</freebsdpr>
<freebsdpr>ports/201065</freebsdpr>
<url>https://www.elastic.co/blog/logstash-1-4-3-released</url>
<url>https://www.elastic.co/blog/logstash-forwarder-0-4-0-released</url>
</references>
<dates>
<discovery>2015-06-09</discovery>
<entry>2015-06-24</entry>
<modified>2015-06-24</modified>
</dates>
</vuln>
<vuln vid="d02f6b01-1a3f-11e5-8bd6-c485083ca99c">
<topic>Adobe Flash Player -- critical vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<range><lt>11.2r202.466</lt></range>
</package>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.466</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-14.html">
<p>
Adobe has released security updates for Adobe Flash Player for
Windows, Macintosh and Linux. These updates address a critical
vulnerability (CVE-2015-3113) that could potentially allow an
attacker to take control of the affected system.
</p>
<p>
Adobe is aware of reports that CVE-2015-3113 is being actively
exploited in the wild via limited, targeted attacks. Systems running
Internet Explorer for Windows 7 and below, as well as Firefox on
Windows XP, are known targets.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://helpx.adobe.com/security/products/flash-player/apsb15-14.html</url>
<cvename>CVE-2015-3113</cvename>
</references>
<dates>
<discovery>2015-06-23</discovery>
<entry>2015-06-24</entry>
</dates>
</vuln>
<vuln vid="f5225b23-192d-11e5-a1cf-002590263bf5">
<topic>rubygem-bson -- DoS and possible injection</topic>
<affects>
<package>
<name>rubygem-bson</name>
<range><lt>3.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Phill MV reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/06/06/1">
<p>By submitting a specially crafted string to a service relying on
the bson rubygem, an attacker may trigger denials of service or even
inject data into victim's MongoDB instances.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4412</cvename>
<mlist>http://www.openwall.com/lists/oss-security/2015/06/06/1</mlist>
<url>http://sakurity.com/blog/2015/06/04/mongo_ruby_regexp.html</url>
<url>https://github.com/mongodb/bson-ruby/commit/976da329ff03ecdfca3030eb6efe3c85e6db9999</url>
</references>
<dates>
<discovery>2015-06-04</discovery>
<entry>2015-06-23</entry>
</dates>
</vuln>
<vuln vid="cdff0af2-1492-11e5-a1cf-002590263bf5">
<topic>php5 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php5-dom</name>
<name>php5-ftp</name>
<name>php5-gd</name>
<name>php5-pgsql</name>
<range><lt>5.4.42</lt></range>
</package>
<package>
<name>php55-dom</name>
<name>php55-ftp</name>
<name>php55-gd</name>
<name>php55-pgsql</name>
<range><lt>5.5.26</lt></range>
</package>
<package>
<name>php56-dom</name>
<name>php56-ftp</name>
<name>php56-gd</name>
<name>php56-psql</name>
<range><lt>5.6.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP project reports:</p>
<blockquote cite="http://www.php.net/ChangeLog-5.php">
<p>DOM and GD:</p>
<ul>
<li>Fixed bug #69719 (Incorrect handling of paths with NULs).</li>
</ul>
<p>FTP:</p>
<ul>
<li>Improved fix for bug #69545 (Integer overflow in ftp_genlist()
resulting in heap overflow). (CVE-2015-4643)</li>
</ul>
<p>Postgres:</p>
<ul>
<li>Fixed bug #69667 (segfault in php_pgsql_meta_data).
(CVE-2015-4644)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4643</cvename>
<cvename>CVE-2015-4644</cvename>
<url>http://www.php.net/ChangeLog-5.php#5.4.42</url>
<url>http://www.php.net/ChangeLog-5.php#5.5.26</url>
<url>http://www.php.net/ChangeLog-5.php#5.6.10</url>
<mlist>http://openwall.com/lists/oss-security/2015/06/18/3</mlist>
</references>
<dates>
<discovery>2015-06-11</discovery>
<entry>2015-06-23</entry>
</dates>
</vuln>
<vuln vid="a4460ac7-192c-11e5-9c01-bcaec55be5e5">
<topic>devel/ipython -- remote execution</topic>
<affects>
<package>
<name>ipython</name>
<range><lt>3.2.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Kyle Kelley reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q2/779">
<p>Summary: JSON error responses from the IPython notebook REST API
contained URL parameters and were incorrectly reported as text/html
instead of application/json. The error messages included some of these
URL params, resulting in a cross site scripting attack. This affects
users on Mozilla Firefox but not Chromium/Google Chrome.</p>
<p>API paths with issues:</p>
<ul>
<li>/api/contents (3.0-3.1)</li>
<li>/api/notebooks (2.0-2.4, 3.0-3.1)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4706</cvename>
<cvename>CVE-2015-4707</cvename>
<url>http://seclists.org/oss-sec/2015/q2/779</url>
</references>
<dates>
<discovery>2015-06-22</discovery>
<entry>2015-06-22</entry>
</dates>
</vuln>
<vuln vid="d46ed7b8-1912-11e5-9fdf-00262d5ed8ee">
<topic>www/chromium -- mulitple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>43.0.2357.130</lt></range>
</package>
<package>
<!-- pcbsd -->
<name>chromium-npapi</name>
<range><lt>43.0.2357.130</lt></range>
</package>
<package>
<!-- pcbsd -->
<name>chromium-pulse</name>
<range><lt>43.0.2357.130</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2015/06/chrome-stable-update.html">
<p>4 security fixes in this release:</p>
<ul>
<li>[464922] High CVE-2015-1266: Scheme validation error in WebUI.
Credit to anonymous.</li>
<li>[494640] High CVE-2015-1268: Cross-origin bypass in Blink.
Credit to Mariusz Mlynski.</li>
<li>[497507] Medium CVE-2015-1267: Cross-origin bypass in Blink.
Credit to anonymous.</li>
<li>[461481] Medium CVE-2015-1269: Normalization error in HSTS/HPKP
preload list. Credit to Mike Ruddy.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1266</cvename>
<cvename>CVE-2015-1267</cvename>
<cvename>CVE-2015-1268</cvename>
<cvename>CVE-2015-1269</cvename>
<url>http://googlechromereleases.blogspot.nl/2015/06/chrome-stable-update.html</url>
</references>
<dates>
<discovery>2015-06-22</discovery>
<entry>2015-06-22</entry>
</dates>
</vuln>
<vuln vid="0f154810-16e4-11e5-a1cf-002590263bf5">
<topic>rubygem-paperclip -- validation bypass vulnerabilitiy</topic>
<affects>
<package>
<name>rubygem-paperclip</name>
<range><lt>4.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jon Yurek reports:</p>
<blockquote cite="https://github.com/thoughtbot/paperclip/commit/9aee4112f36058cd28d5fe4a006d6981bd1eda57">
<p>Thanks to MORI Shingo of DeNA Co., Ltd. for reporting this.</p>
<p>There is an issue where if an HTML file is uploaded with a .html
extension, but the content type is listed as being `image/jpeg`,
this will bypass a validation checking for images. But it will also
pass the spoof check, because a file named .html and containing
actual HTML passes the spoof check.</p>
<p>This change makes it so that we also check the supplied content
type. So even if the file contains HTML and ends with .html, it
doesn't match the content type of `image/jpeg` and so it fails.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-2963</cvename>
<url>https://github.com/thoughtbot/paperclip/commit/9aee4112f36058cd28d5fe4a006d6981bd1eda57</url>
<url>https://robots.thoughtbot.com/paperclip-security-release</url>
<url>http://jvn.jp/en/jp/JVN83881261/index.html</url>
</references>
<dates>
<discovery>2015-06-05</discovery>
<entry>2015-06-22</entry>
</dates>
</vuln>
<vuln vid="0da404ad-1891-11e5-a1cf-002590263bf5">
<topic>chicken -- Potential buffer overrun in string-translate*</topic>
<affects>
<package>
<name>chicken</name>
<range><lt>4.10.0.r2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>chicken developer Peter Bex reports:</p>
<blockquote cite="http://lists.nongnu.org/archive/html/chicken-announce/2015-06/msg00010.html">
<p>Using gcc's Address Sanitizer, it was discovered that the string-translate*
procedure from the data-structures unit can scan beyond the input string's
length up to the length of the source strings in the map that's passed to
string-translate*. This issue was fixed in master 8a46020, and it will
make its way into CHICKEN 4.10.</p>
<p>This bug is present in all released versions of CHICKEN.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4556</cvename>
<freebsdpr>ports/200980</freebsdpr>
<mlist>http://lists.nongnu.org/archive/html/chicken-announce/2015-06/msg00010.html</mlist>
<mlist>http://lists.nongnu.org/archive/html/chicken-hackers/2015-06/msg00037.html</mlist>
<mlist>http://lists.nongnu.org/archive/html/chicken-announce/2015-07/msg00001.html</mlist>
</references>
<dates>
<discovery>2015-06-15</discovery>
<entry>2015-06-22</entry>
<modified>2015-07-31</modified>
</dates>
</vuln>
<vuln vid="e7b7f2b5-177a-11e5-ad33-f8d111029e6a">
<topic>chicken -- buffer overrun in substring-index[-ci]</topic>
<affects>
<package>
<name>chicken</name>
<range><lt>4.10.0.r1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>chicken developer Moritz Heidkamp reports:</p>
<blockquote cite="http://lists.gnu.org/archive/html/chicken-users/2015-01/msg00048.html">
<p>The substring-index[-ci] procedures of the data-structures unit are
vulnerable to a buffer overrun attack when passed an integer greater
than zero as the optional START argument.</p>
<p>As a work-around you can switch to SRFI 13's
string-contains procedure which also returns the substring's index in
case it is found.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-9651</cvename>
<mlist>http://lists.gnu.org/archive/html/chicken-users/2015-01/msg00048.html</mlist>
<mlist>http://lists.nongnu.org/archive/html/chicken-hackers/2014-12/txt2UqAS9CtvH.txt</mlist>
</references>
<dates>
<discovery>2015-01-12</discovery>
<entry>2015-06-22</entry>
<modified>2015-06-23</modified>
</dates>
</vuln>
<vuln vid="a3929112-181b-11e5-a1cf-002590263bf5">
<topic>cacti -- Multiple XSS and SQL injection vulerabilities</topic>
<affects>
<package>
<name>cacti</name>
<range><lt>0.8.8d</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Cacti Group, Inc. reports:</p>
<blockquote cite="http://www.cacti.net/release_notes_0_8_8d.php">
<p>Important Security Fixes</p>
<ul>
<li>Multiple XSS and SQL injection vulerabilities</li>
</ul>
<p>Changelog</p>
<ul>
<li>bug: Fixed SQL injection VN: JVN#78187936 /
TN:JPCERT#98968540</li>
<li>bug#0002542: [FG-VD-15-017] Cacti Cross-Site Scripting
Vulnerability Notification</li>
<li>bug#0002571: SQL Injection and Location header injection from
cdef id CVE-2015-4342</li>
<li>bug#0002572: SQL injection in graph template</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4342</cvename>
<freebsdpr>ports/200963</freebsdpr>
<url>http://www.cacti.net/release_notes_0_8_8d.php</url>
<mlist>http://seclists.org/fulldisclosure/2015/Jun/19</mlist>
</references>
<dates>
<discovery>2015-06-09</discovery>
<entry>2015-06-21</entry>
</dates>
</vuln>
<vuln vid="a0e74731-181b-11e5-a1cf-002590263bf5">
<topic>cacti -- multiple security vulnerabilities</topic>
<affects>
<package>
<name>cacti</name>
<range><lt>0.8.8c</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Cacti Group, Inc. reports:</p>
<blockquote cite="http://www.cacti.net/release_notes_0_8_8c.php">
<p>Important Security Fixes</p>
<ul>
<li>CVE-2013-5588 - XSS issue via installer or device editing</li>
<li>CVE-2013-5589 - SQL injection vulnerability in device editing</li>
<li>CVE-2014-2326 - XSS issue via CDEF editing</li>
<li>CVE-2014-2327 - Cross-site request forgery (CSRF) vulnerability</li>
<li>CVE-2014-2328 - Remote Command Execution Vulnerability in graph export</li>
<li>CVE-2014-4002 - XSS issues in multiple files</li>
<li>CVE-2014-5025 - XSS issue via data source editing</li>
<li>CVE-2014-5026 - XSS issues in multiple files</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-5588</cvename>
<cvename>CVE-2013-5589</cvename>
<cvename>CVE-2014-2326</cvename>
<cvename>CVE-2014-2327</cvename>
<cvename>CVE-2014-2328</cvename>
<cvename>CVE-2014-4002</cvename>
<cvename>CVE-2014-5025</cvename>
<cvename>CVE-2014-5026</cvename>
<freebsdpr>ports/198586</freebsdpr>
<mlist>http://sourceforge.net/p/cacti/mailman/message/33072838/</mlist>
<url>http://www.cacti.net/release_notes_0_8_8c.php</url>
</references>
<dates>
<discovery>2014-11-23</discovery>
<entry>2015-06-21</entry>
</dates>
</vuln>
<vuln vid="968d1e74-1740-11e5-a643-40a8f0757fb4">
<topic>p5-Dancer -- possible to abuse session cookie values</topic>
<affects>
<package>
<name>p5-Dancer</name>
<range><lt>1.3138</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Russell Jenkins reports:</p>
<blockquote cite="INSERT URL HERE">
<p>It was possible to abuse session cookie values so that
file-based session stores such as Dancer::Session::YAML or
Dancer2::Session::YAML would attempt to read/write from
any file on the filesystem with the same extension the
file-based store uses, such as '*.yml' for the YAML
stores.</p>
</blockquote>
</body>
</description>
<references>
<url>http://lists.preshweb.co.uk/pipermail/dancer-users/2015-June/004621.html</url>
</references>
<dates>
<discovery>2015-06-12</discovery>
<entry>2015-06-20</entry>
</dates>
</vuln>
<vuln vid="d605edb1-1616-11e5-a000-d050996490d0">
<topic>drupal -- multiple vulnerabilities</topic>
<affects>
<package>
<name>drupal6</name>
<range><lt>6.36</lt></range>
</package>
<package>
<name>drupal7</name>
<range><lt>7.38</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal development team reports:</p>
<blockquote cite="https://www.drupal.org/SA-CORE-2015-002">
<h3>Impersonation (OpenID module - Drupal 6 and 7 - Critical)</h3>
<p>A vulnerability was found in the OpenID module that allows
a malicious user to log in as other users on the site,
including administrators, and hijack their accounts.</p>
<p>This vulnerability is mitigated by the fact that the victim
must have an account with an associated OpenID identity from
a particular set of OpenID providers (including, but not
limited to, Verisign, LiveJournal, or StackExchange).</p>
<h3>Open redirect (Field UI module - Drupal 7 - Less critical)</h3>
<p>The Field UI module uses a "destinations" query string parameter
in URLs to redirect users to new destinations after completing
an action on a few administration pages. Under certain
circumstances, malicious users can use this parameter to
construct a URL that will trick users into being redirected
to a 3rd party website, thereby exposing the users to potential
social engineering attacks.</p>
<p>This vulnerability is mitigated by the fact that only sites
with the Field UI module enabled are affected.</p>
<p>Drupal 6 core is not affected, but see the similar advisory
for the Drupal 6 contributed CCK module:
<a href="https://www.drupal.org/node/2507753">SA-CONTRIB-2015-126</a></p>
<h3>Open redirect (Overlay module - Drupal 7 - Less critical)</h3>
<p>The Overlay module displays administrative pages as a layer
over the current page (using JavaScript), rather than replacing
the page in the browser window. The Overlay module does not
sufficiently validate URLs prior to displaying their contents,
leading to an open redirect vulnerability.</p>
<p>This vulnerability is mitigated by the fact that it can only
be used against site users who have the "Access the administrative
overlay" permission, and that the Overlay module must be enabled.</p>
<h3>Information disclosure (Render cache system - Drupal 7
- Less critical)</h3>
<p>On sites utilizing Drupal 7's render cache system to cache
content on the site by user role, private content viewed by
user 1 may be included in the cache and exposed to non-privileged
users.</p>
<p>This vulnerability is mitigated by the fact that render caching
is not used in Drupal 7 core itself (it requires custom code or
the contributed <a href="https://www.drupal.org/project/render_cache">Render
Cache</a> module to enable) and that it only affects sites that
have user 1 browsing the live site. Exposure is also limited if an
administrative role has been assigned to the user 1 account (which
is done, for example, by the Standard install profile that ships
with Drupal core).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3231</cvename>
<cvename>CVE-2015-3232</cvename>
<cvename>CVE-2015-3233</cvename>
<cvename>CVE-2015-3234</cvename>
<url>https://www.drupal.org/SA-CORE-2015-002</url>
</references>
<dates>
<discovery>2015-06-17</discovery>
<entry>2015-06-19</entry>
</dates>
</vuln>
<vuln vid="2438d4af-1538-11e5-a106-3c970e169bc2">
<topic>cURL -- Multiple Vulnerability</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.40</ge><lt>7.43</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cURL reports:</p>
<blockquote cite="http://curl.haxx.se/docs/adv_20150617A.html">
<p>libcurl can wrongly send HTTP credentials when re-using
connections.</p>
<p>libcurl allows applications to set credentials for the
upcoming transfer with HTTP Basic authentication, like
with CURLOPT_USERPWD for example. Name and password.
Just like all other libcurl options the credentials
are sticky and are kept associated with the "handle"
until something is made to change the situation.</p>
<p>Further, libcurl offers a curl_easy_reset() function
that resets a handle back to its pristine state in
terms of all settable options. A reset is of course
also supposed to clear the credentials. A reset is
typically used to clear up the handle and prepare
it for a new, possibly unrelated, transfer.</p>
<p>Within such a handle, libcurl can also store a
set of previous connections in case a second transfer
is requested to a host name for which an existing
connection is already kept alive.</p>
<p>With this flaw present, using the handle even
after a reset would make libcurl accidentally use
those credentials in a subseqent request if done
to the same host name and connection as was
previously accessed.</p>
<p>An example case would be first requesting a password
protected resource from one section of a web site, and
then do a second request of a public resource from a
completely different part of the site without
authentication. This flaw would then inadvertently
leak the credentials in the second request.</p>
</blockquote>
<blockquote cite="http://curl.haxx.se/docs/adv_20150617B.html">
<p>libcurl can get tricked by a malicious SMB server to
send off data it did not intend to.</p>
<p>In libcurl's state machine function handling the SMB
protocol (smb_request_state()), two length and offset
values are extracted from data that has arrived over
the network, and those values are subsequently used
to figure out what data range to send back.</p>
<p>The values are used and trusted without boundary
checks and are just assumed to be valid. This allows
carefully handicrafted packages to trick libcurl
into responding and sending off data that was not
intended. Or just crash if the values cause libcurl
to access invalid memory.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3236</cvename>
<cvename>CVE-2015-3237</cvename>
<url>http://curl.haxx.se/docs/adv_20150617A.html</url>
<url>http://curl.haxx.se/docs/adv_20150617B.html</url>
</references>
<dates>
<discovery>2015-06-17</discovery>
<entry>2015-06-17</entry>
</dates>
</vuln>
<vuln vid="eb8a8978-8dd5-49ce-87f4-49667b2166dd">
<topic>rubygem-rails -- multiple vulnerabilities</topic>
<affects>
<package>
<name>rubygem-activesupport</name>
<range><lt>3.2.22</lt></range>
</package>
<package>
<name>rubygem-activesupport4</name>
<range><lt>4.2.2</lt></range>
</package>
<package>
<name>rubygem-jquery-rails</name>
<range><lt>3.1.3</lt></range>
</package>
<package>
<name>rubygem-jquery-rails4</name>
<range><lt>4.0.4</lt></range>
</package>
<package>
<name>rubygem-rack</name>
<range><lt>1.4.6</lt></range>
</package>
<package>
<name>rubygem-rack15</name>
<range><lt>1.5.4</lt></range>
</package>
<package>
<name>rubygem-rack16</name>
<range><lt>1.6.2</lt></range>
</package>
<package>
<name>rubygem-rails</name>
<range><lt>3.2.22</lt></range>
</package>
<package>
<name>rubygem-rails4</name>
<range><lt>4.2.2</lt></range>
</package>
<package>
<name>rubygem-web-console</name>
<range><lt>2.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby on Rails blog:</p>
<blockquote cite="http://weblog.rubyonrails.org/2015/6/16/Rails-3-2-22-4-1-11-and-4-2-2-have-been-released-and-more/">
<p>Rails 3.2.22, 4.1.11 and 4.2.2 have been released, along with web
console and jquery-rails plugins and Rack 1.5.4 and 1.6.2.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1840</cvename>
<cvename>CVE-2015-3224</cvename>
<cvename>CVE-2015-3225</cvename>
<cvename>CVE-2015-3226</cvename>
<cvename>CVE-2015-3227</cvename>
<url>http://weblog.rubyonrails.org/2015/6/16/Rails-3-2-22-4-1-11-and-4-2-2-have-been-released-and-more/</url>
</references>
<dates>
<discovery>2015-06-16</discovery>
<entry>2015-06-17</entry>
</dates>
</vuln>
<vuln vid="c67069dc-0986-11e5-bb90-002590263bf5">
<topic>testdisk -- buffer overflow with malicious disk image</topic>
<affects>
<package>
<name>testdisk</name>
<range><lt>7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CGSecurity TestDisk Changelog reports:</p>
<blockquote cite="http://www.cgsecurity.org/wiki/TestDisk_7.0_Release">
<p>Various fix including security fix, thanks to:</p>
<ul>
<li><p>Coverity scan (Static Analysis of source code)</p></li>
<li><p>afl-fuzz (security-oriented fuzzer).</p></li>
<li><p>Denis Andzakovic from Security Assessment for reporting an
exploitable Stack Buffer Overflow.</p></li>
</ul>
</blockquote>
<p>Denis Andzakovic reports:</p>
<blockquote cite="http://www.security-assessment.com/files/documents/advisory/Testdisk%20Check_OS2MB%20Stack%20Buffer%20Overflow%20-%20Release.pdf">
<p>A buffer overflow is triggered within the software when a malicious
disk image is attempted to be recovered. This may be leveraged by an
attacker to crash TestDisk and gain control of program execution. An
attacker would have to coerce the victim to run TestDisk against
their malicious image.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.cgsecurity.org/wiki/TestDisk_7.0_Release</url>
<url>http://www.security-assessment.com/files/documents/advisory/Testdisk%20Check_OS2MB%20Stack%20Buffer%20Overflow%20-%20Release.pdf</url>
</references>
<dates>
<discovery>2015-04-30</discovery>
<entry>2015-06-16</entry>
</dates>
</vuln>
<vuln vid="25e0593d-13c0-11e5-9afb-3c970e169bc2">
<topic>tomcat -- multiple vulnerabilities</topic>
<affects>
<package>
<name>tomcat6</name>
<range><lt>6.0.44</lt></range>
</package>
<package>
<name>tomcat7</name>
<range><lt>7.0.55</lt></range>
</package>
<package>
<name>tomcat8</name>
<range><lt>8.0.9</lt></range>
</package>
<package>
<name>hadoop2</name>
<range><le>2.6.0</le></range>
</package>
<package>
<name>oozie</name>
<range><le>4.1.0</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache Software Foundation reports:</p>
<blockquote cite="https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.44">
<p>Low: Denial of Service CVE-2014-0230</p>
<p>When a response for a request with a request body is
returned to the user agent before the request body is
fully read, by default Tomcat swallows the remaining
request body so that the next request on the connection
may be processed. There was no limit to the size of
request body that Tomcat would swallow. This permitted
a limited Denial of Service as Tomcat would never close
the connection and a processing thread would remain
allocated to the connection.</p>
<p>Moderate: Security Manager bypass CVE-2014-7810</p>
<p>Malicious web applications could use expression
language to bypass the protections of a Security
Manager as expressions were evaluated within a
privileged code section.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0230</cvename>
<cvename>CVE-2014-7810</cvename>
<url>https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.44</url>
</references>
<dates>
<discovery>2015-05-12</discovery>
<entry>2015-06-16</entry>
<modified>2015-07-13</modified>
</dates>
</vuln>
<vuln vid="c470db07-1098-11e5-b6a8-002590263bf5">
<topic>security/ossec-hids-* -- root escalation via syscheck feature</topic>
<affects>
<package>
<name>ossec-hids-server</name>
<name>ossec-hids-client</name>
<name>ossec-hids-local</name>
<range><ge>2.7</ge><lt>2.8.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OSSEC reports:</p>
<blockquote cite="http://www.ossec.net/?p=1198">
<p>The CVE-2015-3222 vulnerability, which allows for root escalation
via sys check has been fixed in OSSEC 2.8.2. This issue does not
affect agents.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3222</cvename>
<freebsdpr>ports/200801</freebsdpr>
<url>http://www.ossec.net/?p=1198</url>
<url>https://github.com/ossec/ossec-hids/releases/tag/2.8.2</url>
</references>
<dates>
<discovery>2015-06-11</discovery>
<entry>2015-06-12</entry>
</dates>
</vuln>
<vuln vid="8305e215-1080-11e5-8ba2-000c2980a9f3">
<topic>openssl -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.2_2</lt></range>
</package>
<package>
<name>mingw32-openssl</name>
<range><ge>1.0.1</ge><lt>1.0.2b</lt></range>
</package>
<package>
<name>linux-c6-openssl</name>
<range><lt>1.0.1e_6</lt></range>
</package>
<package>
<name>libressl</name>
<range><lt>2.1.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL team reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv_20150611.txt">
<ul>
<li>Missing DHE man-in-the-middle protection (Logjam)
(CVE-2015-4000)</li>
<li>Malformed ECParameters causes infinite loop (CVE-2015-1788)</li>
<li>Exploitable out-of-bounds read in X509_cmp_time
(CVE-2015-1789)</li>
<li>iPKCS7 crash with missing EnvelopedContent (CVE-2015-1790)</li>
<li>CMS verify infinite loop with unknown hash function
(CVE-2015-1792)</li>
<li>Race condition handling NewSessionTicket (CVE-2015-1791)</li>
<li>Invalid free in DTLS (CVE-2014-8176)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-8176</cvename>
<cvename>CVE-2015-1788</cvename>
<cvename>CVE-2015-1789</cvename>
<cvename>CVE-2015-1790</cvename>
<cvename>CVE-2015-1791</cvename>
<cvename>CVE-2015-1792</cvename>
<url>https://www.openssl.org/news/secadv_20150611.txt</url>
</references>
<dates>
<discovery>2015-06-11</discovery>
<entry>2015-06-11</entry>
<modified>2015-07-03</modified>
</dates>
</vuln>
<vuln vid="1e63db88-1050-11e5-a4df-c485083ca99c">
<topic>Adobe Flash Player -- critical vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<range><lt>11.2r202.466</lt></range>
</package>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.466</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-11.html">
<p>
Adobe has released security updates for Adobe Flash Player for
Windows, Macintosh and Linux. These updates address vulnerabilities
that could potentially allow an attacker to take control of the
affected system.
</p>
<p>
These updates resolve a vulnerability (CVE-2015-3096) that could be
exploited to bypass the fix for CVE-2014-5333.
</p>
<p>
These updates improve memory address randomization of the Flash heap
for the Window 7 64-bit platform (CVE-2015-3097).
</p>
<p>
These updates resolve vulnerabilities that could be exploited to
bypass the same-origin-policy and lead to information disclosure
(CVE-2015-3098, CVE-2015-3099, CVE-2015-3102).
</p>
<p>
These updates resolve a stack overflow vulnerability that could lead
to code execution (CVE-2015-3100).
</p>
<p>
These updates resolve a permission issue in the Flash broker for
Internet Explorer that could be exploited to perform privilege
escalation from low to medium integrity level (CVE-2015-3101).
</p>
<p>
These updates resolve an integer overflow vulnerability that could
lead to code execution (CVE-2015-3104).
</p>
<p>
These updates resolve a memory corruption vulnerability that could
lead to code execution (CVE-2015-3105).
</p>
<p>
These updates resolve use-after-free vulnerabilities that could lead
to code execution (CVE-2015-3103, CVE-2015-3106, CVE-2015-3107).
</p>
<p>
These updates resolve a memory leak vulnerability that could be used
to bypass ASLR (CVE-2015-3108).
</p>
</blockquote>
</body>
</description>
<references>
<url>https://helpx.adobe.com/security/products/flash-player/apsb15-11.html</url>
<cvename>CVE-2015-3096</cvename>
<cvename>CVE-2015-3097</cvename>
<cvename>CVE-2015-3098</cvename>
<cvename>CVE-2015-3099</cvename>
<cvename>CVE-2015-3100</cvename>
<cvename>CVE-2015-3101</cvename>
<cvename>CVE-2015-3102</cvename>
<cvename>CVE-2015-3103</cvename>
<cvename>CVE-2015-3104</cvename>
<cvename>CVE-2015-3105</cvename>
<cvename>CVE-2015-3106</cvename>
<cvename>CVE-2015-3107</cvename>
<cvename>CVE-2015-3108</cvename>
</references>
<dates>
<discovery>2015-06-09</discovery>
<entry>2015-06-11</entry>
</dates>
</vuln>
<vuln vid="10a6d0aa-0b1c-11e5-bb90-002590263bf5">
<topic>libzmq4 -- V3 protocol handler vulnerable to downgrade attacks</topic>
<affects>
<package>
<name>libzmq4</name>
<range><ge>4.0.0</ge><lt>4.0.6</lt></range>
<range><ge>4.1.0</ge><lt>4.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Pieter Hintjens reports:</p>
<blockquote cite="https://github.com/zeromq/libzmq/issues/1273">
<p>It is easy to bypass the security mechanism in 4.1.0 and 4.0.5 by
sending a ZMTP v2 or earlier header. The library accepts such
connections without applying its security mechanism.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-9721</cvename>
<url>https://github.com/zeromq/libzmq/issues/1273</url>
<mlist>http://www.openwall.com/lists/oss-security/2015/05/07/8</mlist>
<freebsdpr>ports/200502</freebsdpr>
</references>
<dates>
<discovery>2014-12-04</discovery>
<entry>2015-06-10</entry>
<modified>2015-09-28</modified>
</dates>
</vuln>
<vuln vid="8fbd4187-0f18-11e5-b6a8-002590263bf5">
<topic>pgbouncer -- remote denial of service</topic>
<affects>
<package>
<name>pgbouncer</name>
<range><lt>1.5.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PgBouncer reports:</p>
<blockquote cite="https://pgbouncer.github.io/2015/04/pgbouncer-1-5-5/">
<p>Fix remote crash - invalid packet order causes lookup of NULL pointer. Not
exploitable, just DoS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4054</cvename>
<url>https://pgbouncer.github.io/2015/04/pgbouncer-1-5-5/</url>
<mlist>http://www.openwall.com/lists/oss-security/2015/05/21/2</mlist>
<freebsdpr>ports/200507</freebsdpr>
</references>
<dates>
<discovery>2015-04-08</discovery>
<entry>2015-06-10</entry>
<modified>2015-09-28</modified>
</dates>
</vuln>
<vuln vid="a40ec970-0efa-11e5-90e4-d050996490d0">
<topic>cups -- multiple vulnerabilities</topic>
<affects>
<package>
<name>cups-base</name>
<range><lt>2.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CUPS development team reports:</p>
<blockquote cite="https://cups.org/blog.php?L1082">
<p>The new release addresses two security vulnerabilities,
add localizations for German and Russian, and includes
several general bug fixes. Changes include:</p>
<p>Security: Fixed CERT VU #810572/CVE-2015-1158/CVE-2015-1159
exploiting the dynamic linker (STR #4609)</p>
<p>Security: The scheduler could hang with malformed
gzip data (STR #4602)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1158</cvename>
<cvename>CVE-2015-1159</cvename>
<url>https://cups.org/blog.php?L1082</url>
<url>https://www.kb.cert.org/vuls/id/810572</url>
</references>
<dates>
<discovery>2015-06-09</discovery>
<entry>2015-06-09</entry>
</dates>
</vuln>
<vuln vid="55363e65-0e71-11e5-8027-00167671dd1d">
<topic>strongswan -- Denial-of-service and potential remote code execution vulnerability</topic>
<affects>
<package>
<name>strongswan</name>
<range><ge>5.2.2</ge><lt>5.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>StrongSwan Project reports</p>
<blockquote cite="https://www.strongswan.org/blog/2015/06/01/strongswan-vulnerability-(cve-2015-3991).html">
<p>A denial-of-service and potential remote code execution vulnerability
triggered by crafted IKE messages was discovered in strongSwan. Versions
5.2.2 and 5.3.0 are affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3991</cvename>
<url>https://www.strongswan.org/blog/2015/06/01/strongswan-vulnerability-(cve-2015-3991).html</url>
</references>
<dates>
<discovery>2015-05-15</discovery>
<entry>2015-06-09</entry>
<modified>2015-09-28</modified>
</dates>
</vuln>
<vuln vid="10d14955-0e45-11e5-b6a8-002590263bf5">
<topic>strongswan -- Information Leak Vulnerability</topic>
<affects>
<package>
<name>strongswan</name>
<range><ge>4.3.0</ge><lt>5.3.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>strongSwan Project reports:</p>
<blockquote cite="http://www.strongswan.org/blog/2015/06/08/strongswan-5.3.2-released.html">
<p>An information leak vulnerability was fixed that, in certain IKEv2
setups, allowed rogue servers with a valid certificate accepted by
the client to trick it into disclosing user credentials (even plain
passwords if the client accepts EAP-GTC). This was caused because
constraints against the server's authentication were enforced too
late. All versions since 4.3.0 are affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4171</cvename>
<url>http://www.strongswan.org/blog/2015/06/08/strongswan-5.3.2-released.html</url>
</references>
<dates>
<discovery>2015-06-08</discovery>
<entry>2015-06-09</entry>
</dates>
</vuln>
<vuln vid="838fa84a-0e25-11e5-90e4-d050996490d0">
<topic>redis -- EVAL Lua Sandbox Escape</topic>
<affects>
<package>
<name>redis</name>
<name>redis-devel</name>
<range><ge>2.6.0</ge><lt>2.8.21</lt></range>
<range><ge>3.0</ge><lt>3.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ben Murphy reports:</p>
<blockquote cite="http://benmmurphy.github.io/blog/2015/06/04/redis-eval-lua-sandbox-escape/">
<p>It is possible to break out of the Lua sandbox in
Redis and execute arbitrary code.</p>
<p>This shouldn’t pose a threat to users under the
trusted Redis security model where only trusted
users can connect to the database. However, in real
deployments there could be databases that can be
accessed by untrusted users. The main deployments
that are vulnerable are developers machines, places
where redis servers can be reached via SSRF attacks
and cloud hosting.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4335</cvename>
<url>http://benmmurphy.github.io/blog/2015/06/04/redis-eval-lua-sandbox-escape/</url>
</references>
<dates>
<discovery>2015-06-04</discovery>
<entry>2015-06-08</entry>
</dates>
</vuln>
<vuln vid="bd1ab7a5-0e01-11e5-9976-a0f3c100ae18">
<topic>tidy -- heap-buffer-overflow</topic>
<affects>
<package>
<name>tidy4</name>
<range><le>20000804_3</le></range>
</package>
<package>
<name>tidy-devel</name>
<range><le>090315.c_2</le></range>
</package>
<package>
<name>tidy-lib</name>
<range><le>090315.c_2</le></range>
</package>
<package>
<name>tidy-html5</name>
<range><lt>4.9.31</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Geoff McLane reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q2/633">
<p>tidy is affected by a write out of bounds when processing malformed html files.</p>
<p>This issue could be abused on server side applications that use php-tidy extension with user input.</p>
<p>The issue was confirmed, analysed and fixed by the tidy5 maintainer.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/htacg/tidy-html5/issues/217</url>
<url>http://seclists.org/oss-sec/2015/q2/633</url>
<url>http://seclists.org/oss-sec/2015/q3/116</url>
<cvename>CVE-2015-5522</cvename>
<cvename>CVE-2015-5523</cvename>
</references>
<dates>
<discovery>2015-06-03</discovery>
<entry>2015-06-08</entry>
<modified>2015-07-15</modified>
</dates>
</vuln>
<vuln vid="e69af246-0ae2-11e5-90e4-d050996490d0">
<topic>pcre -- multiple vulnerabilities</topic>
<affects>
<package>
<name>pcre</name>
<range><lt>8.37_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Venustech ADLAB reports:</p>
<blockquote cite="https://bugs.exim.org/show_bug.cgi?id=1636">
<p>PCRE library is prone to a vulnerability which leads
to Heap Overflow. During the compilation of a malformed
regular expression, more data is written on the malloced
block than the expected size output by compile_regex.</p>
</blockquote>
<blockquote cite="https://bugs.exim.org/show_bug.cgi?id=1638">
<p>PCRE library is prone to a vulnerability which leads to
Stack Overflow. Without enough bound checking inside
match(), the stack memory could be overflowed via a
crafted regular expression.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3210</cvename>
<cvename>CVE-2015-3217</cvename>
<url>https://bugs.exim.org/show_bug.cgi?id=1636</url>
<url>https://bugs.exim.org/show_bug.cgi?id=1638</url>
</references>
<dates>
<discovery>2015-05-29</discovery>
<entry>2015-06-04</entry>
<modified>2015-06-07</modified>
</dates>
</vuln>
<vuln vid="bbc0db92-084c-11e5-bb90-002590263bf5">
<topic>hostapd and wpa_supplicant -- multiple vulnerabilities</topic>
<affects>
<package>
<name>hostapd</name>
<range><lt>2.4_1</lt></range>
</package>
<package>
<name>wpa_supplicant</name>
<range><lt>2.4_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jouni Malinen reports:</p>
<blockquote cite="http://w1.fi/security/2015-2/wps-upnp-http-chunked-transfer-encoding.txt">
<p>WPS UPnP vulnerability with HTTP chunked transfer encoding. (2015-2
- CVE-2015-4141)</p>
</blockquote>
<blockquote cite="http://w1.fi/security/2015-3/integer-underflow-in-ap-mode-wmm-action-frame.txt">
<p>Integer underflow in AP mode WMM Action frame processing. (2015-3 -
CVE-2015-4142)</p>
</blockquote>
<blockquote cite="http://w1.fi/security/2015-4/eap-pwd-missing-payload-length-validation.txt">
<p>EAP-pwd missing payload length validation. (2015-4 - CVE-2015-4143,
CVE-2015-4144, CVE-2015-4145, CVE-2015-4146)</p>
</blockquote>
</body>
</description>
<references>
<url>http://w1.fi/security/2015-2/wps-upnp-http-chunked-transfer-encoding.txt</url>
<url>http://w1.fi/security/2015-3/integer-underflow-in-ap-mode-wmm-action-frame.txt</url>
<url>http://w1.fi/security/2015-4/eap-pwd-missing-payload-length-validation.txt</url>
<cvename>CVE-2015-4141</cvename>
<cvename>CVE-2015-4142</cvename>
<cvename>CVE-2015-4143</cvename>
<cvename>CVE-2015-4144</cvename>
<cvename>CVE-2015-4145</cvename>
<cvename>CVE-2015-4146</cvename>
<mlist>http://openwall.com/lists/oss-security/2015/05/31/6</mlist>
</references>
<dates>
<discovery>2015-05-04</discovery>
<entry>2015-06-01</entry>
</dates>
</vuln>
<vuln vid="65b14d39-d01f-419c-b0b8-5df60b929973">
<topic>ffmpeg -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ffmpeg</name>
<name>ffmpeg0</name>
<range><lt>0.7.17,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD and Vigilance report:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-5150">
<p>Use-after-free vulnerability in Google Chrome before
24.0.1312.52 allows remote attackers to cause a denial of
service or possibly have unspecified other impact via vectors
involving seek operations on video data.</p>
</blockquote>
<blockquote cite="http://vigilance.fr/vulnerability/Libav-integer-overflow-of-av-lzo1x-decode-14944">
<p> An attacker can generate an integer overflow in the
av_lzo1x_decode() function of Libav, in order to trigger a
denial of service, and possibly to execute code.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8541">
<p>libavcodec/mjpegdec.c in FFmpeg before 2.4.2 considers only
dimension differences, and not bits-per-pixel differences, when
determining whether an image size has changed, which allows
remote attackers to cause a denial of service (out-of-bounds
access) or possibly have unspecified other impact via crafted
MJPEG data.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8542">
<p>libavcodec/utils.c in FFmpeg before 2.4.2 omits a certain
codec ID during enforcement of alignment, which allows remote
attackers to cause a denial of service (out-of-bounds access) or
possibly have unspecified other impact via crafted JV data.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8543">
<p>libavcodec/mmvideo.c in FFmpeg before 2.4.2 does not consider
all lines of HHV Intra blocks during validation of image height,
which allows remote attackers to cause a denial of service
(out-of-bounds access) or possibly have unspecified other impact
via crafted MM video data.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8545">
<p>libavcodec/pngdec.c in FFmpeg before 2.4.2 accepts the
monochrome-black format without verifying that the
bits-per-pixel value is 1, which allows remote attackers to
cause a denial of service (out-of-bounds access) or possibly
have unspecified other impact via crafted PNG data.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8547">
<p>libavcodec/gifdec.c in FFmpeg before 2.4.2 does not properly
compute image heights, which allows remote attackers to cause a
denial of service (out-of-bounds access) or possibly have
unspecified other impact via crafted GIF data.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8548">
<p>Off-by-one error in libavcodec/smc.c in FFmpeg before 2.4.2
allows remote attackers to cause a denial of service
(out-of-bounds access) or possibly have unspecified other impact
via crafted Quicktime Graphics (aka SMC) video data.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9316">
<p>The mjpeg_decode_app function in libavcodec/mjpegdec.c in
FFMpeg before 2.1.6, 2.2.x through 2.3.x, and 2.4.x before 2.4.4
allows remote attackers to cause a denial of service
(out-of-bounds heap access) and possibly have other unspecified
impact via vectors related to LJIF tags in an MJPEG file.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9317">
<p>The decode_ihdr_chunk function in libavcodec/pngdec.c in
FFMpeg before 2.1.6, 2.2.x through 2.3.x, and 2.4.x before 2.4.4
allows remote attackers to cause a denial of service
(out-of-bounds heap access) and possibly have other unspecified
impact via an IDAT before an IHDR in a PNG file.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9603">
<p>The vmd_decode function in libavcodec/vmdvideo.c in FFmpeg
before 2.5.2 does not validate the relationship between a
certain length value and the frame width, which allows remote
attackers to cause a denial of service (out-of-bounds array
access) or possibly have unspecified other impact via crafted
Sierra VMD video data.</p>
</blockquote>
<blockquote cite="http://vigilance.fr/vulnerability/FFmpeg-unreachable-memory-reading-via-mjpegdec-c-16213">
<p>An attacker can force a read at an invalid address in
mjpegdec.c of FFmpeg, in order to trigger a denial of
service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-5150</cvename>
<cvename>CVE-2014-4609</cvename>
<cvename>CVE-2014-8541</cvename>
<cvename>CVE-2014-8542</cvename>
<cvename>CVE-2014-8543</cvename>
<cvename>CVE-2014-8545</cvename>
<cvename>CVE-2014-8547</cvename>
<cvename>CVE-2014-8548</cvename>
<cvename>CVE-2014-9316</cvename>
<cvename>CVE-2014-9317</cvename>
<cvename>CVE-2014-9603</cvename>
<cvename>CVE-2015-1872</cvename>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=c3ece52decafc4923aebe7fd74b274e9ebb1962e</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=1b291e0466308b341bc2e8c2a49d44862400f014</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=b5e661bcd2bb4fe771cb2c1e21215c68e6a17665</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=cd3c4d8c55222337b0b59af4ea1fecfb46606e5e</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=73962e677d871fa0dde5385ee04ea07c048d8864</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=7a5590ef4282e19d48d70cba0bc4628c13ec6fd8</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=ef32bc8dde52439afd13988f56012a9f4dd55a83</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=5b2097626d0e4ccb432d7d8ab040aa8dbde9eb3a</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=30e8a375901f8802853fd6d478b77a127d208bd6</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=cb1db92cca98f963e91f421ee0c84f8866325a73</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=fac6f744d8170585f05e098ce9c9f27eeffa818e</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=75b0cfcf105c8720a47a2ee80a70ba16799d71b7</url>
<url>https://ffmpeg.org/security.html</url>
</references>
<dates>
<discovery>2015-03-12</discovery>
<entry>2015-06-02</entry>
</dates>
</vuln>
<vuln vid="022255be-0895-11e5-a242-5404a68ad561">
<topic>avidemux26 -- multiple vulnerabilities in bundled FFmpeg</topic>
<affects>
<package>
<name>avidemux2</name>
<range><lt>2.6.8</lt></range>
</package>
<package>
<name>avidemux26</name>
<range><lt>2.6.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mageia project reports:</p>
<blockquote cite="http://advisories.mageia.org/MGASA-2015-0233.html">
<p>Avidemux is built with a bundled set of FFmpeg libraries.
The bundled FFmpeg version has been updated from 1.2.10
to 1.2.12 to fix these security issues and other bugs
fixed upstream in FFmpeg.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-9316</cvename>
<cvename>CVE-2014-9317</cvename>
<cvename>CVE-2014-9603</cvename>
<cvename>CVE-2014-9604</cvename>
<cvename>CVE-2015-1872</cvename>
<cvename>CVE-2015-3417</cvename>
<freebsdpr>ports/200507</freebsdpr>
<url>http://advisories.mageia.org/MGASA-2015-0233.html</url>
</references>
<dates>
<discovery>2015-05-18</discovery>
<entry>2015-06-01</entry>
<modified>2015-09-28</modified>
</dates>
</vuln>
<vuln vid="ffe2d86c-07d9-11e5-9a28-001e67150279">
<topic>rest-client -- plaintext password disclosure</topic>
<affects>
<package>
<name>rubygem-rest-client</name>
<range><lt>1.6.7_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The open sourced vulnerability database reports:</p>
<blockquote cite="http://osvdb.org/show/osvdb/117461">
<p>REST Client for Ruby contains a flaw that is due to the application
logging password information in plaintext. This may allow a local
attacker to gain access to password information.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3448</cvename>
<freebsdpr>ports/200504</freebsdpr>
<url>https://github.com/rest-client/rest-client/issues/349</url>
<url>http://osvdb.org/show/osvdb/117461</url>
</references>
<dates>
<discovery>2015-01-12</discovery>
<entry>2015-05-31</entry>
<modified>2015-09-28</modified>
</dates>
</vuln>
<vuln vid="83a7a720-07d8-11e5-9a28-001e67150279">
<topic>rest-client -- session fixation vulnerability</topic>
<affects>
<package>
<name>rubygem-rest-client</name>
<range><lt>1.6.7_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Andy Brody reports:</p>
<blockquote cite="https://github.com/rest-client/rest-client/issues/369">
<p>When Ruby rest-client processes an HTTP redirection response,
it blindly passes along the values from any Set-Cookie headers to the
redirection target, regardless of domain, path, or expiration.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1820</cvename>
<freebsdpr>ports/200504</freebsdpr>
<url>https://github.com/rest-client/rest-client/issues/369</url>
</references>
<dates>
<discovery>2015-03-24</discovery>
<entry>2015-05-31</entry>
<modified>2015-09-28</modified>
</dates>
</vuln>
<vuln vid="cfb12f02-06e1-11e5-8fda-002590263bf5">
<topic>cabextract -- directory traversal with UTF-8 symbols in filenames</topic>
<affects>
<package>
<name>cabextract</name>
<range><lt>1.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cabextract ChangeLog reports:</p>
<blockquote cite="http://www.cabextract.org.uk/#changes">
<p>It was possible for cabinet files to extract to absolute file
locations, and it was possible on Cygwin to get around cabextract's
absolute and relative path protections by using backslashes.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.cabextract.org.uk/#changes</url>
<mlist>http://www.openwall.com/lists/oss-security/2015/02/18/3</mlist>
<cvename>CVE-2015-2060</cvename>
</references>
<dates>
<discovery>2015-02-18</discovery>
<entry>2015-05-31</entry>
</dates>
</vuln>
<vuln vid="cc7548ef-06e1-11e5-8fda-002590263bf5">
<topic>libmspack -- frame_end overflow which could cause infinite loop</topic>
<affects>
<package>
<name>libmspack</name>
<range><lt>0.5</lt></range>
</package>
<package>
<name>cabextract</name>
<range><lt>1.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>There is a denial of service vulnerability in libmspack. The
libmspack code is built into cabextract, so it is also
vulnerable.</p>
<p>MITRE reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9556">
<p>Integer overflow in the qtmd_decompress function in libmspack 0.4
allows remote attackers to cause a denial of service (hang) via a
crafted CAB file, which triggers an infinite loop.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-9556</cvename>
<url>https://bugs.debian.org/773041</url>
<mlist>http://www.openwall.com/lists/oss-security/2015/01/07/2</mlist>
</references>
<dates>
<discovery>2014-12-11</discovery>
<entry>2015-05-31</entry>
</dates>
</vuln>
<vuln vid="48504af7-07ad-11e5-879c-00e0814cab4e">
<topic>django -- Fixed session flushing in the cached_db backend</topic>
<affects>
<package>
<name>py27-django</name>
<range><ge>1.8</ge><lt>1.8.2</lt></range>
</package>
<package>
<name>py32-django</name>
<range><ge>1.8</ge><lt>1.8.2</lt></range>
</package>
<package>
<name>py33-django</name>
<range><ge>1.8</ge><lt>1.8.2</lt></range>
</package>
<package>
<name>py34-django</name>
<range><ge>1.8</ge><lt>1.8.2</lt></range>
</package>
<package>
<name>py27-django-devel</name>
<range><lt>20150531,1</lt></range>
</package>
<package>
<name>py32-django-devel</name>
<range><lt>20150531,1</lt></range>
</package>
<package>
<name>py33-django-devel</name>
<range><lt>20150531,1</lt></range>
</package>
<package>
<name>py34-django-devel</name>
<range><lt>20150531,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Django project reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2015/may/20/security-release/">
<p>A change to session.flush() in the cached_db session backend in
Django 1.8 mistakenly sets the session key to an empty string
rather than None. An empty string is treated as a valid session key
and the session cookie is set accordingly. Any users with an empty
string in their session cookie will use the same session store.
session.flush() is called by django.contrib.auth.logout() and, more
seriously, by django.contrib.auth.login() when a user switches accounts.
If a user is logged in and logs in again to a different account
(without logging out) the session is flushed to avoid reuse.
After the session is flushed (and its session key becomes '') the
account details are set on the session and the session is saved.
Any users with an empty string in their session cookie will now be
logged into that account.</p>
<p>Thanks to Sam Cooke for reporting the issue.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.djangoproject.com/weblog/2015/may/20/security-release/</url>
<cvename>CVE-2015-3982</cvename>
</references>
<dates>
<discovery>2015-05-20</discovery>
<entry>2015-05-31</entry>
</dates>
</vuln>
<vuln vid="9471ec47-05a2-11e5-8fda-002590263bf5">
<topic>proxychains-ng -- current path as the first directory for the library search path</topic>
<affects>
<package>
<name>proxychains-ng</name>
<range><lt>4.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mamoru TASAKA reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q2/430">
<p>proxychains4 sets LD_PRELOAD to dlopen libproxychains4.so
and execvp() the arbitrary command user has specified.
proxychains4 sets the current directory as the first path
to search libproxychains4.so</p>
</blockquote>
</body>
</description>
<references>
<mlist>http://openwall.com/lists/oss-security/2015/05/12/6</mlist>
<mlist>http://seclists.org/oss-sec/2015/q2/430</mlist>
<cvename>CVE-2015-3887</cvename>
</references>
<dates>
<discovery>2015-05-11</discovery>
<entry>2015-05-29</entry>
</dates>
</vuln>
<vuln vid="a13500d0-0570-11e5-aab1-d050996490d0">
<topic>wireshark -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wireshark</name>
<name>wireshark-lite</name>
<name>tshark</name>
<name>tshark-lite</name>
<range><lt>1.12.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Wireshark development team reports:</p>
<blockquote cite="https://www.wireshark.org/docs/relnotes/wireshark-1.12.5.html">
<p>The following vulnerabilities have been fixed.</p>
<ul>
<li><p>wnpa-sec-2015-12</p>
<p>The LBMR dissector could go into an infinite loop.
(Bug 11036) CVE-2015-3808, CVE-2015-3809</p></li>
<li><p>wnpa-sec-2015-13</p>
<p>The WebSocket dissector could recurse excessively.
(Bug 10989) CVE-2015-3810</p></li>
<li><p>wnpa-sec-2015-14</p>
<p>The WCP dissector could crash while decompressing data.
(Bug 10978) CVE-2015-3811</p></li>
<li><p>wnpa-sec-2015-15</p>
<p>The X11 dissector could leak memory. (Bug 11088)
CVE-2015-3812</p></li>
<li><p>wnpa-sec-2015-16</p>
<p>The packet reassembly code could leak memory.
(Bug 11129) CVE-2015-3813</p></li>
<li><p>wnpa-sec-2015-17</p>
<p>The IEEE 802.11 dissector could go into an infinite loop.
(Bug 11110) CVE-2015-3814</p></li>
<li><p>wnpa-sec-2015-18</p>
<p>The Android Logcat file parser could crash. Discovered by
Hanno Böck. (Bug 11188) CVE-2015-3815</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3808</cvename>
<cvename>CVE-2015-3809</cvename>
<cvename>CVE-2015-3810</cvename>
<cvename>CVE-2015-3811</cvename>
<cvename>CVE-2015-3812</cvename>
<cvename>CVE-2015-3813</cvename>
<cvename>CVE-2015-3814</cvename>
<cvename>CVE-2015-3815</cvename>
<url>https://www.wireshark.org/docs/relnotes/wireshark-1.12.5.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2015-12.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2015-13.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2015-14.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2015-15.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2015-16.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2015-17.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2015-18.html</url>
</references>
<dates>
<discovery>2015-05-12</discovery>
<entry>2015-05-28</entry>
</dates>
</vuln>
<vuln vid="406636fe-055d-11e5-aab1-d050996490d0">
<topic>krb5 -- requires_preauth bypass in PKINIT-enabled KDC</topic>
<affects>
<package>
<name>krb5</name>
<range><lt>1.13.2</lt></range>
</package>
<package>
<name>krb5-112</name>
<range><lt>1.12.3_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MIT reports:</p>
<blockquote cite="http://krbdev.mit.edu/rt/Ticket/Display.html?id=8160">
<p>In MIT krb5 1.12 and later, when the KDC is configured
with PKINIT support, an unauthenticated remote attacker
can bypass the requires_preauth flag on a client principal
and obtain a ciphertext encrypted in the principal's
long-term key. This ciphertext could be used to conduct
an off-line dictionary attack against the user's password.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-2694</cvename>
<url>http://krbdev.mit.edu/rt/Ticket/Display.html?id=8160</url>
</references>
<dates>
<discovery>2015-05-25</discovery>
<entry>2015-05-28</entry>
</dates>
</vuln>
<vuln vid="27f742f6-03f4-11e5-aab1-d050996490d0">
<topic>cURL -- sensitive HTTP server headers also sent to proxies</topic>
<affects>
<package>
<name>curl</name>
<range><lt>7.42.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cURL reports:</p>
<blockquote cite="http://curl.haxx.se/docs/adv_20150429.html">
<p>libcurl provides applications a way to set custom HTTP
headers to be sent to the server by using CURLOPT_HTTPHEADER.
A similar option is available for the curl command-line
tool with the '--header' option.</p>
<p>When the connection passes through an HTTP proxy the
same set of headers is sent to the proxy as well by default.
While this is by design, it has not necessarily been clear
nor understood by application programmers.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3153</cvename>
<url>http://curl.haxx.se/docs/adv_20150429.html</url>
</references>
<dates>
<discovery>2015-04-29</discovery>
<entry>2015-05-26</entry>
</dates>
</vuln>
<vuln vid="6294f75f-03f2-11e5-aab1-d050996490d0">
<topic>cURL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>curl</name>
<range><lt>7.42.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cURL reports:</p>
<blockquote cite="http://curl.haxx.se/docs/adv_20150422A.html">
<p>libcurl keeps a pool of its last few connections around
after use to fascilitate easy, conventient and completely
transparent connection re-use for applications.</p>
<p>When doing HTTP requests NTLM authenticated, the entire
connnection becomes authenticated and not just the
specific HTTP request which is otherwise how HTTP works.
This makes NTLM special and a subject for special
treatment in the code. With NTLM, once the connection is
authenticated, no further authentication is necessary until
the connection gets closed.</p>
</blockquote>
<blockquote cite="http://curl.haxx.se/docs/adv_20150422B.html">
<p>When doing HTTP requests Negotiate authenticated, the
entire connnection may become authenticated and not just
the specific HTTP request which is otherwise how HTTP
works, as Negotiate can basically use NTLM under the hood.
curl was not adhering to this fact but would assume that
such requests would also be authenticated per request.</p>
</blockquote>
<blockquote cite="http://curl.haxx.se/docs/adv_20150422C.html">
<p>libcurl supports HTTP "cookies" as documented in RFC 6265.
Together with each individual cookie there are several
different properties, but for this vulnerability we
focus on the associated "path" element. It tells
information about for which path on a given host the
cookies is valid.</p>
<p>The internal libcurl function called sanitize_cookie_path()
that cleans up the path element as given to it from a
remote site or when read from a file, did not properly
validate the input. If given a path that consisted of a
single double-quote, libcurl would index a newly
allocated memory area with index -1 and assign a zero
to it, thus destroying heap memory it wasn't supposed to.</p>
</blockquote>
<blockquote cite="http://curl.haxx.se/docs/adv_20150422D.html">
<p>There is a private function in libcurl called fix_hostname()
that removes a trailing dot from the host name if there is
one. The function is called after the host name has been
extracted from the URL libcurl has been told to act on.</p>
<p>If a URL is given with a zero-length host name, like in
"http://:80" or just ":80", fix_hostname() will index the
host name pointer with a -1 offset (as it blindly assumes
a non-zero length) and both read and assign that address.</p>
</blockquote>
</body>
</description>
<references>
<url>http://curl.haxx.se/docs/adv_20150422A.html</url>
<url>http://curl.haxx.se/docs/adv_20150422B.html</url>
<url>http://curl.haxx.se/docs/adv_20150422C.html</url>
<url>http://curl.haxx.se/docs/adv_20150422D.html</url>
<cvename>CVE-2014-3143</cvename>
<cvename>CVE-2014-3144</cvename>
<cvename>CVE-2014-3145</cvename>
<cvename>CVE-2014-3148</cvename>
</references>
<dates>
<discovery>2015-04-22</discovery>
<entry>2015-05-26</entry>
</dates>
</vuln>
<vuln vid="607f4d44-0158-11e5-8fda-002590263bf5">
<topic>cassandra -- remote execution of arbitrary code</topic>
<affects>
<package>
<name>cassandra</name>
<range><ge>1.2.0</ge><le>1.2.19</le></range>
</package>
<package>
<name>cassandra2</name>
<range><ge>2.0.0</ge><lt>2.0.14</lt></range>
<range><ge>2.1.0</ge><lt>2.1.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jake Luciani reports:</p>
<blockquote cite="http://mail-archives.apache.org/mod_mbox/cassandra-dev/201504.mbox/raw/%3CCALamADJu4yo=cO8HgA6NpgFc1wQN_VNqpkMn-3SZwhPq9foLBw@mail.gmail.com%3E/">
<p>Under its default configuration, Cassandra binds an unauthenticated
JMX/RMI interface to all network interfaces. As RMI is an API for the
transport and remote execution of serialized Java, anyone with access
to this interface can execute arbitrary code as the running user.</p>
<p>Mitigation:</p>
<p>1.2.x has reached EOL, so users of &lt;= 1.2.x are recommended to upgrade
to a supported version of Cassandra, or manually configure encryption
and authentication of JMX,
(see https://wiki.apache.org/cassandra/JmxSecurity).</p>
<p>2.0.x users should upgrade to 2.0.14</p>
<p>2.1.x users should upgrade to 2.1.4</p>
<p>Alternately, users of any version not wishing to upgrade can
reconfigure JMX/RMI to enable encryption and authentication according
to https://wiki.apache.org/cassandra/JmxSecurityor
http://docs.oracle.com/javase/7/docs/technotes/guides/management/agent.html</p>
<p>Credit:</p>
<p>This issue was discovered by Georgi Geshev of MWR InfoSecurity</p>
</blockquote>
</body>
</description>
<references>
<url>http://mail-archives.apache.org/mod_mbox/cassandra-dev/201504.mbox/raw/%3CCALamADJu4yo=cO8HgA6NpgFc1wQN_VNqpkMn-3SZwhPq9foLBw@mail.gmail.com%3E/</url>
<cvename>CVE-2015-0225</cvename>
</references>
<dates>
<discovery>2015-04-01</discovery>
<entry>2015-05-24</entry>
</dates>
</vuln>
<vuln vid="865863af-fb5e-11e4-8fda-002590263bf5">
<topic>py-salt -- potential shell injection vulnerabilities</topic>
<affects>
<package>
<name>py27-salt</name>
<range><lt>2015.5.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Colton Myers reports:</p>
<blockquote cite="http://docs.saltstack.com/en/latest/topics/releases/2015.5.0.html">
<p>In order to fix potential shell injection vulnerabilities in salt
modules, a change has been made to the various cmd module functions.
These functions now default to python_shell=False, which means that
the commands will not be sent to an actual shell.</p>
<p>The largest side effect of this change is that "shellisms", such as
pipes, will not work by default. The modules shipped with salt have
been audited to fix any issues that might have arisen from this
change. Additionally, the cmd state module has been unaffected, and
use of cmd.run in jinja is also unaffected. cmd.run calls on the
CLI will also allow shellisms.</p>
<p>However, custom execution modules which use shellisms in cmd calls
will break, unless you pass python_shell=True to these calls.</p>
<p>As a temporary workaround, you can set cmd_safe: False in your
minion and master configs. This will revert the default, but is
also less secure, as it will allow shell injection vulnerabilities
to be written in custom code. We recommend you only set this
setting for as long as it takes to resolve these issues in your
custom code, then remove the override.</p>
</blockquote>
</body>
</description>
<references>
<url>http://docs.saltstack.com/en/latest/topics/releases/2015.5.0.html</url>
</references>
<dates>
<discovery>2015-05-11</discovery>
<entry>2015-05-24</entry>
</dates>
</vuln>
<vuln vid="384fc0b2-0144-11e5-8fda-002590263bf5">
<topic>davmail -- fix potential CVE-2014-3566 vulnerability (POODLE)</topic>
<affects>
<package>
<name>davmail</name>
<range><lt>4.6.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mickaël Guessant reports:</p>
<blockquote cite="http://sourceforge.net/p/davmail/mailman/message/33279118/">
<p>DavMail 4.6.0 released</p>
<p>Enhancements: Fix potential CVE-2014-3566 vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>http://sourceforge.net/p/davmail/mailman/message/33279118/</url>
<url>http://sourceforge.net/p/davmail/code/2322/</url>
<cvename>CVE-2014-3566</cvename>
</references>
<dates>
<discovery>2014-10-27</discovery>
<entry>2015-05-23</entry>
</dates>
</vuln>
<vuln vid="7927165a-0126-11e5-9d98-080027ef73ec">
<topic>dnsmasq -- remotely exploitable buffer overflow in release candidate</topic>
<affects>
<package>
<name>dnsmasq-devel</name>
<range><ge>2.73rc6</ge><lt>2.73rc8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon Kelley reports:</p>
<blockquote cite="http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2015q2/009529.html">
<p>Anyone running 2.[73]rc6 or 2.[73]rc7 should be aware that there's a
remotely exploitable buffer overflow in those trees. I just tagged
2.[73]rc8, which includes the fix.
</p>
</blockquote>
<p>(Corrections from second URL.)</p>
</body>
</description>
<references>
<url>http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2015q2/009529.html</url>
<url>http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2015q2/009535.html</url>
</references>
<dates>
<discovery>2015-05-15</discovery>
<entry>2015-05-23</entry>
</dates>
</vuln>
<vuln vid="37569eb7-0125-11e5-9d98-080027ef73ec">
<topic>dnsmasq -- data exposure and denial of service</topic>
<affects>
<package>
<name>dnsmasq</name>
<range><lt>2.72_1</lt></range>
</package>
<package>
<name>dnsmasq-devel</name>
<range><lt>2.73rc4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Nick Sampanis reported a potential memory exposure and denial of service vulnerability against dnsmasq 2.72. The CVE entry summarizes this as:
</p>
<blockquote cite="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3294"><p>The tcp_request function in Dnsmasq before 2.73rc4
does not properly handle the return value of the setup_reply function,
which allows remote attackers to read process memory and cause a
denial of service (out-of-bounds read and crash) via a malformed DNS
request."</p>
</blockquote>
</body>
</description>
<references>
<url>http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2015q2/009382.html</url>
<cvename>CVE-2015-3294</cvename>
<url>http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commitdiff;h=ad4a8ff7d9097008d7623df8543df435bfddeac8</url>
</references>
<dates>
<discovery>2015-04-07</discovery>
<entry>2015-05-23</entry>
</dates>
</vuln>
<vuln vid="4a88e3ed-00d3-11e5-a072-d050996490d0">
<topic>pcre -- multiple vulnerabilities</topic>
<affects>
<package>
<name>pcre</name>
<range><lt>8.37</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PCRE development team reports:</p>
<blockquote cite="http://www.pcre.org/original/changelog.txt">
<p>A pattern such as "((?2){0,1999}())?", which has a group
containing a forward reference repeated a large (but limited)
number of times within a repeated outer group that has a zero
minimum quantifier, caused incorrect code to be compiled,
leading to the error "internal error: previously-checked
referenced subpattern not found" when an incorrect memory
address was read. This bug was reported as "heap overflow",
discovered by Kai Lu of Fortinet's FortiGuard Labs and given
the CVE number CVE-2015-2325.</p>
<p>A pattern such as "((?+1)(\1))/" containing a forward
reference subroutine call within a group that also contained
a recursive back reference caused incorrect code to be
compiled. This bug was reported as "heap overflow",
discovered by Kai Lu of Fortinet's FortiGuard Labs,
and given the CVE number CVE-2015-2326.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-2325</cvename>
<cvename>CVE-2015-2326</cvename>
<url>http://www.pcre.org/original/changelog.txt</url>
</references>
<dates>
<discovery>2015-04-28</discovery>
<entry>2015-05-22</entry>
<modified>2015-06-07</modified>
</dates>
</vuln>
<vuln vid="31de2e13-00d2-11e5-a072-d050996490d0">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php5</name>
<range><lt>5.4.41</lt></range>
</package>
<package>
<name>php55</name>
<range><lt>5.5.25</lt></range>
</package>
<package>
<name>php56</name>
<range><lt>5.6.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PHP development team reports:</p>
<blockquote cite="https://php.net/ChangeLog-5.php#5.6.9">
<p>Fixed bug #69364 (PHP Multipart/form-data remote DoS
Vulnerability). (CVE-2015-4024)</p>
<p>Fixed bug #69418 (CVE-2006-7243 fix regressions in
5.4+). (CVE-2015-4025)</p>
<p>Fixed bug #69545 (Integer overflow in ftp_genlist()
resulting in heap overflow). (CVE-2015-4022)</p>
<p>Fixed bug #68598 (pcntl_exec() should not allow null
char). (CVE-2015-4026)</p>
<p>Fixed bug #69453 (Memory Corruption in phar_parse_tarfile
when entry filename starts with null). (CVE-2015-4021)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4021</cvename>
<cvename>CVE-2015-4022</cvename>
<cvename>CVE-2015-4024</cvename>
<cvename>CVE-2015-4025</cvename>
<cvename>CVE-2015-4026</cvename>
<url>https://php.net/ChangeLog-5.php#5.6.9</url>
</references>
<dates>
<discovery>2015-05-14</discovery>
<entry>2015-05-22</entry>
</dates>
</vuln>
<vuln vid="fc38cd83-00b3-11e5-8ebd-0026551a22dc">
<topic>PostgreSQL -- minor security problems.</topic>
<affects>
<package>
<name>postgresql90-server</name>
<range><ge>9.0.0</ge><lt>9.0.20</lt></range>
</package>
<package>
<name>postgresql91-server</name>
<range><ge>9.1.0</ge><lt>9.1.16</lt></range>
</package>
<package>
<name>postgresql92-server</name>
<range><ge>9.2.0</ge><lt>9.2.11</lt></range>
</package>
<package>
<name>postgresql93-server</name>
<range><ge>9.3.0</ge><lt>9.3.7</lt></range>
</package>
<package>
<name>postgresql94-server</name>
<range><ge>9.4.0</ge><lt>9.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PostgreSQL project reports:</p>
<blockquote cite="http://www.postgresql.org/about/news/1587/">
<p>
This update fixes three security vulnerabilities reported in
PostgreSQL over the past few months. Nether of these issues is seen as
particularly urgent. However, users should examine them in case their
installations are vulnerable:.
</p>
<ul>
<li>CVE-2015-3165 Double "free" after authentication timeout.</li>
<li>CVE-2015-3166 Unanticipated errors from the standard library.</li>
<li>CVE-2015-3167 pgcrypto has multiple error messages for decryption with an incorrect key.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3165</cvename>
<cvename>CVE-2015-3166</cvename>
<cvename>CVE-2015-3167</cvename>
</references>
<dates>
<discovery>2015-04-10</discovery>
<entry>2015-05-22</entry>
</dates>
</vuln>
<vuln vid="d0034536-ff24-11e4-a072-d050996490d0">
<topic>proftpd -- arbitrary code execution vulnerability with chroot</topic>
<affects>
<package>
<name>proftpd</name>
<range><lt>1.3.5_7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ProFTPd development team reports:</p>
<blockquote cite="http://bugs.proftpd.org/show_bug.cgi?id=4169">
<p>Vadim Melihow reported a critical issue with proftpd
installations that use the mod_copy module's SITE CPFR/SITE
CPTO commands; mod_copy allows these commands to be used by
*unauthenticated clients*.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3306</cvename>
<url>http://bugs.proftpd.org/show_bug.cgi?id=4169</url>
</references>
<dates>
<discovery>2015-04-15</discovery>
<entry>2015-05-20</entry>
</dates>
</vuln>
<vuln vid="35431f79-fe3e-11e4-ba63-000c292ee6b8">
<topic>ipsec-tools -- Memory leak leading to denial of service</topic>
<affects>
<package>
<name>ipsec-tools</name>
<range><lt>0.8.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Javantea reports:</p>
<blockquote cite="https://www.altsci.com/ipsec/">
<p>It is a null dereference crash, leading to denial of
service against the IKE daemon.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.altsci.com/ipsec/</url>
</references>
<dates>
<discovery>2015-05-18</discovery>
<entry>2015-05-19</entry>
</dates>
</vuln>
<vuln vid="a9d456b4-fe4c-11e4-ad15-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>43.0.2357.65</lt></range>
</package>
<package>
<!-- pcbsd -->
<name>chromium-npapi</name>
<range><lt>43.0.2357.65</lt></range>
</package>
<package>
<!-- pcbsd -->
<name>chromium-pulse</name>
<range><lt>43.0.2357.65</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2015/05/stable-channel-update_19.html">
<p>37 security fixes in this release, including:</p>
<ul>
<li>[474029] High CVE-2015-1252: Sandbox escape in Chrome. Credit
to anonymous.</li>
<li>[464552] High CVE-2015-1253: Cross-origin bypass in DOM. Credit
to anonymous.</li>
<li>[444927] High CVE-2015-1254: Cross-origin bypass in Editing.
Credit to armin@rawsec.net.</li>
<li>[473253] High CVE-2015-1255: Use-after-free in WebAudio. Credit
to Khalil Zhani.</li>
<li>[478549] High CVE-2015-1256: Use-after-free in SVG. Credit to
Atte Kettunen of OUSPG.</li>
<li>[481015] High CVE-2015-1251: Use-after-free in Speech. Credit
to SkyLined working with HP's Zero Day Initiative.</li>
<li>[468519] Medium CVE-2015-1257: Container-overflow in SVG.
Credit to miaubiz.</li>
<li>[450939] Medium CVE-2015-1258: Negative-size parameter in
libvpx. Credit to cloudfuzzer</li>
<li>[468167] Medium CVE-2015-1259: Uninitialized value in PDFium.
Credit to Atte Kettunen of OUSPG</li>
<li>[474370] Medium CVE-2015-1260: Use-after-free in WebRTC. Credit
to Khalil Zhani.</li>
<li>[466351] Medium CVE-2015-1261: URL bar spoofing. Credit to Juho
Nurminen.</li>
<li>[476647] Medium CVE-2015-1262: Uninitialized value in Blink.
Credit to miaubiz.</li>
<li>[479162] Low CVE-2015-1263: Insecure download of spellcheck
dictionary. Credit to Mike Ruddy.</li>
<li>[481015] Low CVE-2015-1264: Cross-site scripting in bookmarks.
Credit to K0r3Ph1L.</li>
<li>[489518] CVE-2015-1265: Various fixes from internal audits,
fuzzing and other initiatives.</li>
<li>Multiple vulnerabilities in V8 fixed at the tip of the 4.3
branch (currently 4.3.61.21).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://googlechromereleases.blogspot.nl/2015/05/stable-channel-update_19.html</url>
<cvename>CVE-2015-1251</cvename>
<cvename>CVE-2015-1252</cvename>
<cvename>CVE-2015-1253</cvename>
<cvename>CVE-2015-1254</cvename>
<cvename>CVE-2015-1255</cvename>
<cvename>CVE-2015-1256</cvename>
<cvename>CVE-2015-1257</cvename>
<cvename>CVE-2015-1258</cvename>
<cvename>CVE-2015-1259</cvename>
<cvename>CVE-2015-1260</cvename>
<cvename>CVE-2015-1261</cvename>
<cvename>CVE-2015-1262</cvename>
<cvename>CVE-2015-1263</cvename>
<cvename>CVE-2015-1264</cvename>
<cvename>CVE-2015-1265</cvename>
</references>
<dates>
<discovery>2015-05-19</discovery>
<entry>2015-05-19</entry>
</dates>
</vuln>
<vuln vid="3d0428b2-fdfb-11e4-894f-d050996490d0">
<topic>clamav -- multiple vulnerabilities</topic>
<affects>
<package>
<name>clamav</name>
<range><lt>0.98.7</lt></range>
</package>
<package>
<name>clamav-devel</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ClamAV project reports:</p>
<blockquote cite="http://blog.clamav.net/2015/04/clamav-0987-has-been-released.html">
<p>ClamAV 0.98.7 is here! This release contains new
scanning features and bug fixes.</p>
<p>Fix infinite loop condition on crafted y0da cryptor file.
Identified and patch suggested by Sebastian Andrzej Siewior.
CVE-2015-2221.</p>
<p>Fix crash on crafted petite packed file. Reported and patch
supplied by Sebastian Andrzej Siewior. CVE-2015-2222.</p>
<p>Fix an infinite loop condition on a crafted "xz" archive
file. This was reported by Dimitri Kirchner and Goulven
Guiheux. CVE-2015-2668.</p>
<p>Apply upstream patch for possible heap overflow in Henry
Spencer's regex library. CVE-2015-2305.</p>
<p>Fix crash in upx decoder with crafted file. Discovered and
patch supplied by Sebastian Andrzej Siewior. CVE-2015-2170.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-2170</cvename>
<cvename>CVE-2015-2221</cvename>
<cvename>CVE-2015-2222</cvename>
<cvename>CVE-2015-2305</cvename>
<cvename>CVE-2015-2668</cvename>
<url>http://blog.clamav.net/2015/04/clamav-0987-has-been-released.html</url>
</references>
<dates>
<discovery>2015-04-29</discovery>
<entry>2015-05-19</entry>
</dates>
</vuln>
<vuln vid="a0089e18-fc9e-11e4-bc58-001e67150279">
<topic>rubygems -- request hijacking vulnerability</topic>
<affects>
<package>
<name>ruby20-gems</name>
<range><lt>2.4.7</lt></range>
</package>
<package>
<name>ruby21-gems</name>
<range><lt>2.4.7</lt></range>
</package>
<package>
<name>ruby22-gems</name>
<range><lt>2.4.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jonathan Claudius reports:</p>
<blockquote cite="http://blog.rubygems.org/2015/05/14/CVE-2015-3900.html">
<p>RubyGems provides the ability of a domain to direct clients to a
separate host that is used to fetch gems and make API calls against.
This mechanism is implemented via DNS, specificly a SRV record
_rubygems._tcp under the original requested domain.</p>
<p>RubyGems did not validate the hostname returned in the SRV record
before sending requests to it. This left clients open to a DNS
hijack attack, whereby an attacker could return a SRV of their
choosing and get the client to use it.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/200264</freebsdpr>
<cvename>CVE-2015-3900</cvename>
<url>http://blog.rubygems.org/2015/05/14/CVE-2015-3900.html</url>
</references>
<dates>
<discovery>2015-05-14</discovery>
<entry>2015-05-17</entry>
</dates>
</vuln>
<vuln vid="2780e442-fc59-11e4-b18b-6805ca1d3bb1">
<topic>qemu, xen and VirtualBox OSE -- possible VM escape and code execution ("VENOM")</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>0.11.1_19</lt></range>
<range><ge>0.12</ge><lt>2.3.0_1</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<range><lt>2.3.50.g20150501_1</lt></range>
</package>
<package>
<name>virtualbox-ose</name>
<range><lt>4.3.28</lt></range>
</package>
<package>
<name>xen-tools</name>
<range><ge>4.5.0</ge><lt>4.5.0_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jason Geffner, CrowdStrike Senior Security Researcher reports:</p>
<blockquote cite="http://venom.crowdstrike.com/">
<p>VENOM, CVE-2015-3456, is a security vulnerability in
the virtual floppy drive code used by many computer
virtualization platforms. This vulnerability may allow
an attacker to escape from the confines of an affected
virtual machine (VM) guest and potentially obtain
code-execution access to the host. Absent mitigation,
this VM escape could open access to the host system and
all other VMs running on that host, potentially giving
adversaries significant elevated access to the host's
local network and adjacent systems.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3456</cvename>
<freebsdpr>ports/200255</freebsdpr>
<freebsdpr>ports/200256</freebsdpr>
<freebsdpr>ports/200257</freebsdpr>
<url>http://venom.crowdstrike.com/</url>
<url>http://www.oracle.com/technetwork/topics/security/alert-cve-2015-3456-2542656.html</url>
<url>http://xenbits.xen.org/xsa/advisory-133.html</url>
</references>
<dates>
<discovery>2015-04-29</discovery>
<entry>2015-05-17</entry>
<modified>2015-09-28</modified>
</dates>
</vuln>
<vuln vid="49d9c28c-fbad-11e4-b0fb-00269ee29e57">
<topic>Quassel IRC -- SQL injection vulnerability</topic>
<affects>
<package>
<name>quassel</name>
<range><lt>0.11.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Quassel IRC developers report:</p>
<blockquote cite="http://www.quassel-irc.org/node/127">
<p>Restarting a PostgreSQL database while Quassel Core is running
would not properly re-initialize the database session inside Quassel,
bringing back an old security issue (CVE-2013-4422).</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/quassel/quassel/commit/6605882f41331c80f7ac3a6992650a702ec71283</url>
<cvename>CVE-2015-3427</cvename>
</references>
<dates>
<discovery>2015-04-23</discovery>
<entry>2015-05-16</entry>
</dates>
</vuln>
<vuln vid="c368155a-fa83-11e4-bc58-001e67150279">
<topic>rubygem-redcarpet -- XSS vulnerability</topic>
<affects>
<package>
<name>rubygem-redcarpet</name>
<range><lt>3.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Daniel LeCheminant reports:</p>
<blockquote cite="https://hackerone.com/reports/46916">
<p>When markdown is being presented as HTML, there seems to be a
strange interaction between _ and @ that lets an attacker insert
malicious tags.</p>
</blockquote>
</body>
</description>
<references>
<mlist>http://openwall.com/lists/oss-security/2015/04/07/11</mlist>
<url>https://hackerone.com/reports/46916</url>
<url>http://danlec.com/blog/bug-in-sundown-and-redcarpet</url>
</references>
<dates>
<discovery>2015-04-07</discovery>
<entry>2015-05-14</entry>
</dates>
</vuln>
<vuln vid="57325ecf-facc-11e4-968f-b888e347c638">
<topic>dcraw -- integer overflow condition</topic>
<affects>
<package>
<name>cinepaint</name>
<!-- no known fixed version -->
<range><ge>0.22.0</ge></range>
</package>
<package>
<name>darktable</name>
<range><lt>1.6.7</lt></range>
</package>
<package>
<name>dcraw</name>
<range><ge>7.00</ge><lt>9.26</lt></range>
</package>
<package>
<name>dcraw-m</name>
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>exact-image</name>
<range><lt>0.9.1</lt></range>
</package>
<package>
<name>flphoto</name>
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>freeimage</name>
<range><ge>3.13.0</ge><lt>3.16.0_1</lt></range>
</package>
<package>
<name>kodi</name>
<range><lt>14.2_1</lt></range>
</package>
<package>
<name>libraw</name>
<range><lt>0.16.1</lt></range>
</package>
<package>
<name>lightzone</name>
<range><lt>4.1.2</lt></range>
</package>
<package>
<name>netpbm</name>
<range><lt>10.35.96</lt></range>
</package>
<package>
<name>opengtl</name>
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>rawstudio</name>
<range><lt>2.0_11</lt></range>
</package>
<package>
<name>ufraw</name>
<range><lt>0.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ocert reports:</p>
<blockquote cite="http://www.ocert.org/advisories/ocert-2015-006.html">
<p>The dcraw tool, as well as several other projects re-using its
code, suffers from an integer overflow condition which lead to a
buffer overflow.</p>
<p>The vulnerability concerns the 'len' variable, parsed without
validation from opened images, used in the ljpeg_start()
function.</p>
<p>A maliciously crafted raw image file can be used to trigger the
vulnerability, causing a Denial of Service condition.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3885</cvename>
<url>http://www.ocert.org/advisories/ocert-2015-006.html</url>
<url>https://github.com/rawstudio/rawstudio/commit/983bda1f0fa5fa86884381208274198a620f006e</url>
<url>https://github.com/LibRaw/LibRaw/commit/4606c28f494a750892c5c1ac7903e62dd1c6fdb5</url>
<url>https://sourceforge.net/p/netpbm/code/2512/</url>
</references>
<dates>
<discovery>2015-04-24</discovery>
<entry>2015-05-15</entry>
<modified>2016-01-08</modified>
</dates>
</vuln>
<vuln vid="c6e31869-f99f-11e4-9f91-6805ca0b3d42">
<topic>phpMyAdmin -- XSRF and man-in-the-middle vulnerabilities</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>4.4.0</ge><lt>4.4.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2015-2.php">
<p>XSRF/CSRF vulnerability in phpMyAdmin setup.</p>
<p>By deceiving a user to click on a crafted URL, it is
possible to alter the configuration file being generated
with phpMyAdmin setup.</p>
<p>This vulnerability only affects the configuration file
generation process and does not affect the effective
configuration file. Moreover, the configuration file being
generated is at risk only during the period when it's
writable.</p>
</blockquote>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2015-3.php">
<p> Vulnerability allowing man-in-the-middle attack on API
call to GitHub.</p>
<p>A vulnerability in the API call to GitHub can be
exploited to perform a man-in-the-middle attack.</p>
<p>We consider this vulnerability to be serious.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2015-2.php</url>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2015-3.php</url>
<cvename>CVE-2015-3902</cvename>
<cvename>CVE-2015-3903</cvename>
</references>
<dates>
<discovery>2015-05-13</discovery>
<entry>2015-05-13</entry>
</dates>
</vuln>
<vuln vid="e206df57-f97b-11e4-b799-c485083ca99c">
<topic>Adobe Flash Player -- critical vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<range><le>11.2r202.457</le></range>
</package>
<package>
<name>linux-f10-flashplugin</name>
<range><le>11.2r202.457</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-09.html">
<p>
Adobe has released security updates for Adobe Flash Player for
Windows, Macintosh and Linux. These updates address vulnerabilities
that could potentially allow an attacker to take control of the
affected system. Adobe recommends users update their product
installations to the latest versions.
</p>
<p>
These updates resolve memory corruption vulnerabilities that could
lead to code execution (CVE-2015-3078, CVE-2015-3089, CVE-2015-3090,
CVE-2015-3093).
</p>
<p>
These updates resolve a heap overflow vulnerability that could lead
to code execution (CVE-2015-3088).
</p>
<p>
These updates resolve a time-of-check time-of-use (TOCTOU) race
condition that could be exploited to bypass Protected Mode in
Internet Explorer (CVE-2015-3081).
</p>
<p>
These updates resolve validation bypass issues that could be
exploited to write arbitrary data to the file system under user
permissions (CVE-2015-3082, CVE-2015-3083, CVE-2015-3085).
</p>
<p>
These updates resolve an integer overflow vulnerability that could
lead to code execution (CVE-2015-3087).
</p>
<p>
These updates resolve a type confusion vulnerability that could lead
to code execution (CVE-2015-3077, CVE-2015-3084, CVE-2015-3086).
</p>
<p>
These updates resolve a use-after-free vulnerability that could lead
to code execution (CVE-2015-3080).
</p>
<p>
These updates resolve memory leak vulnerabilities that could be used
to bypass ASLR (CVE-2015-3091, CVE-2015-3092).
</p>
<p>
These updates resolve a security bypass vulnerability that could lead
to information disclosure (CVE-2015-3079), and provide additional
hardening to protect against CVE-2015-3044.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3044</cvename>
<cvename>CVE-2015-3077</cvename>
<cvename>CVE-2015-3078</cvename>
<cvename>CVE-2015-3079</cvename>
<cvename>CVE-2015-3080</cvename>
<cvename>CVE-2015-3081</cvename>
<cvename>CVE-2015-3082</cvename>
<cvename>CVE-2015-3083</cvename>
<cvename>CVE-2015-3084</cvename>
<cvename>CVE-2015-3085</cvename>
<cvename>CVE-2015-3086</cvename>
<cvename>CVE-2015-3087</cvename>
<cvename>CVE-2015-3088</cvename>
<cvename>CVE-2015-3089</cvename>
<cvename>CVE-2015-3090</cvename>
<cvename>CVE-2015-3091</cvename>
<cvename>CVE-2015-3092</cvename>
<cvename>CVE-2015-3093</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb15-09.html</url>
</references>
<dates>
<discovery>2015-05-12</discovery>
<entry>2015-05-13</entry>
</dates>
</vuln>
<vuln vid="d9b43004-f5fd-4807-b1d7-dbf66455b244">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>38.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>38.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.35</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.35</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>31.7.0,1</lt></range>
</package>
<package>
<name>libxul</name>
<range><lt>31.7.0</lt></range>
<range><ge>32.0</ge><lt>38.0</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>31.7.0</lt></range>
<range><ge>32.0</ge><lt>38.0</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>31.7.0</lt></range>
<range><ge>32.0</ge><lt>38.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/">
<p>MFSA-2015-46 Miscellaneous memory safety hazards (rv:38.0
/ rv:31.7)</p>
<p>MFSA-2015-47 Buffer overflow parsing H.264 video with
Linux Gstreamer</p>
<p>MFSA-2015-48 Buffer overflow with SVG content and CSS</p>
<p>MFSA-2015-49 Referrer policy ignored when links opened by
middle-click and context menu</p>
<p>MFSA-2015-50 Out-of-bounds read and write in asm.js validation</p>
<p>MFSA-2015-51 Use-after-free during text processing with
vertical text enabled</p>
<p>MFSA-2015-52 Sensitive URL encoded information written to
Android logcat</p>
<p>MFSA-2015-53 Use-after-free due to Media Decoder Thread creation
during shutdown</p>
<p>MFSA-2015-54 Buffer overflow when parsing compressed XML</p>
<p>MFSA-2015-55 Buffer overflow and out-of-bounds read while
parsing MP4 video metadata</p>
<p>MFSA-2015-56 Untrusted site hosting trusted page can
intercept webchannel responses</p>
<p>MFSA-2015-57 Privilege escalation through IPC channel messages</p>
<p>MFSA-2015-58 Mozilla Windows updater can be run outside
of application directory</p>
<p>MFSA 2015-93 Integer overflows in libstagefright while processing
MP4 video metadata</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3079</cvename>
<cvename>CVE-2015-0797</cvename>
<cvename>CVE-2015-0833</cvename>
<cvename>CVE-2015-2708</cvename>
<cvename>CVE-2015-2709</cvename>
<cvename>CVE-2015-2710</cvename>
<cvename>CVE-2015-2711</cvename>
<cvename>CVE-2015-2712</cvename>
<cvename>CVE-2015-2713</cvename>
<cvename>CVE-2015-2714</cvename>
<cvename>CVE-2015-2715</cvename>
<cvename>CVE-2015-2716</cvename>
<cvename>CVE-2015-2717</cvename>
<cvename>CVE-2015-2718</cvename>
<cvename>CVE-2015-2720</cvename>
<cvename>CVE-2015-4496</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2015-46/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-47/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-48/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-49/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-50/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-51/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-52/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-53/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-54/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-55/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-56/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-57/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-58/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-93/</url>
</references>
<dates>
<discovery>2015-05-12</discovery>
<entry>2015-05-12</entry>
<modified>2015-08-28</modified>
</dates>
</vuln>
<vuln vid="fe910ed6-f88d-11e4-9ae3-0050562a4d7b">
<topic>suricata -- TLS/DER Parser Bug (DoS)</topic>
<affects>
<package>
<name>suricata</name>
<range><lt>2.0.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OISF Development Team reports:</p>
<blockquote cite="https://lists.openinfosecfoundation.org/pipermail/oisf-devel/2015-May/003406.html">
<p>The OISF development team is pleased to announce Suricata 2.0.8.
This release fixes a number of issues in the 2.0 series.</p>
<p>The most important issue is a bug in the DER parser which is used to
decode SSL/TLS certificates could crash Suricata. This issue was
reported by Kostya Kortchinsky of the Google Security Team and was fixed
by Pierre Chifflier of ANSSI.</p>
<p>Those processing large numbers of (untrusted) pcap files need to update
as a malformed pcap could crash Suricata. Again, credits go to Kostya
Kortchinsky.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0971</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0971</url>
<url>https://github.com/inliniac/suricata/commit/fa73a0bb8f312fd0a95cc70f6b3ee4e4997bdba7</url>
</references>
<dates>
<discovery>2015-05-06</discovery>
<entry>2015-05-12</entry>
</dates>
</vuln>
<vuln vid="0b040e24-f751-11e4-b24d-5453ed2e2b49">
<topic>libssh -- null pointer dereference</topic>
<affects>
<package>
<name>libssh</name>
<range><lt>0.6.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Andreas Schneider reports:</p>
<blockquote cite="https://www.libssh.org/2015/04/30/libssh-0-6-5-security-and-bugfix-release/">
<p>libssh versions 0.5.1 and above have a logical error in the
handling of a SSH_MSG_NEWKEYS and SSH_MSG_KEXDH_REPLY package. A
detected error did not set the session into the error state
correctly and further processed the packet which leads to a null
pointer dereference. This is the packet after the initial key
exchange and doesn’t require authentication.</p>
<p>This could be used for a Denial of Service (DoS) attack.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3146</cvename>
<url>https://www.libssh.org/2015/04/30/libssh-0-6-5-security-and-bugfix-release</url>
</references>
<dates>
<discovery>2015-04-30</discovery>
<entry>2015-05-10</entry>
</dates>
</vuln>
<vuln vid="b13af778-f4fc-11e4-a95d-ac9e174be3af">
<topic>Vulnerablitiy in HWP document filter</topic>
<affects>
<package>
<name>libreoffice</name>
<range><lt>4.3.7</lt></range>
</package>
<package>
<name>apache-openoffice</name>
<range><lt>4.1.1_9</lt></range>
</package>
<package>
<name>apache-openoffice-devel</name>
<range><lt>4.2.1677190,3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>US-CERT/NIST reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1774">
<p>The HWP filter in LibreOffice before 4.3.7 and 4.4.x before
4.4.2 and Apache OpenOffice before 4.1.2 allows remote
attackers to cause a denial of service (crash) or possibly
execute arbitrary code via a crafted HWP document, which
triggers an out-of-bounds write.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1774</cvename>
<url>http://www.openoffice.org/security/cves/CVE-2015-1774.html</url>
<url>https://www.libreoffice.org/about-us/security/advisories/cve-2015-1774/</url>
</references>
<dates>
<discovery>2015-04-27</discovery>
<entry>2015-05-07</entry>
</dates>
</vuln>
<vuln vid="d86890da-f498-11e4-99aa-bcaec565249c">
<topic>wordpress -- 2 cross-site scripting vulnerabilities</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>4.2.2,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<range><lt>4.2.2</lt></range>
</package>
<package>
<name>ja-wordpress</name>
<range><lt>4.2.2</lt></range>
</package>
<package>
<name>ru-wordpress</name>
<range><lt>4.2.2</lt></range>
</package>
<package>
<name>zh-wordpress-zh_CN</name>
<range><lt>4.2.2</lt></range>
</package>
<package>
<name>zh-wordpress-zh_TW</name>
<range><lt>4.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Samuel Sidler reports:</p>
<blockquote cite="https://wordpress.org/news/2015/05/wordpress-4-2-2/">
<p>The Genericons icon font package, which is used in a number of
popular themes and plugins, contained an HTML file vulnerable to
a cross-site scripting attack. All affected themes and plugins
hosted on WordPress.org (including the Twenty Fifteen default
theme) have been updated today by the WordPress security team
to address this issue by removing this nonessential file. To
help protect other Genericons usage, WordPress 4.2.2
proactively scans the wp-content directory for this HTML
file and removes it. Reported by Robert Abela of Netsparker.</p>
<p>WordPress versions 4.2 and earlier are affected by a critical
cross-site scripting vulnerability, which could enable anonymous
users to compromise a site. WordPress 4.2.2 includes a
comprehensive fix for this issue.</p>
<p>The release also includes hardening for a potential cross-site
scripting vulnerability when using the visual editor. This issue
was reported by Mahadev Subedi.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wordpress.org/news/2015/05/wordpress-4-2-2/</url>
</references>
<dates>
<discovery>2015-05-07</discovery>
<entry>2015-05-07</entry>
<modified>2015-09-15</modified>
</dates>
</vuln>
<vuln vid="ba4f9b19-ed9d-11e4-9118-bcaec565249c">
<topic>wordpress -- cross-site scripting vulnerability</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>4.2.1,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<range><lt>4.2.1</lt></range>
</package>
<package>
<name>ja-wordpress</name>
<range><lt>4.2.1</lt></range>
</package>
<package>
<name>ru-wordpress</name>
<range><lt>4.2.1</lt></range>
</package>
<package>
<name>zh-wordpress-zh_CN</name>
<range><lt>4.2.1</lt></range>
</package>
<package>
<name>zh-wordpress-zh_TW</name>
<range><lt>4.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gary Pendergast reports:</p>
<blockquote cite="https://wordpress.org/news/2015/04/wordpress-4-2-1/">
<p>WordPress 4.2.1 is now available. This is a critical security
release for all previous versions and we strongly encourage you
to update your sites immediately.</p>
<p>A few hours ago, the WordPress team was made aware of a
cross-site scripting vulnerability, which could enable commenters
to compromise a site. The vulnerability was discovered by Jouko
Pynnöne.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wordpress.org/news/2015/04/wordpress-4-2-1/</url>
</references>
<dates>
<discovery>2015-04-27</discovery>
<entry>2015-05-07</entry>
<modified>2015-09-15</modified>
</dates>
</vuln>
<vuln vid="64e6006e-f009-11e4-98c6-000c292ee6b8">
<topic>powerdns -- Label decompression bug can cause crashes or CPU spikes</topic>
<affects>
<package>
<name>powerdns</name>
<range><lt>3.4.5</lt></range>
</package>
<package>
<name>powerdns-recursor</name>
<range><lt>3.7.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PowerDNS project reports:</p>
<blockquote cite="https://doc.powerdns.com/md/security/powerdns-advisory-2015-01/">
<p>A bug was discovered in our label decompression code, making it
possible for names to refer to themselves, thus causing a loop during
decompression. On some platforms, this bug can be abused to cause
crashes. On all platforms, this bug can be abused to cause
service-affecting CPU spikes.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1868</cvename>
<cvename>CVE-2015-5470</cvename>
<url>https://doc.powerdns.com/md/security/powerdns-advisory-2015-01/</url>
<mlist>http://www.openwall.com/lists/oss-security/2015/07/10/8</mlist>
</references>
<dates>
<discovery>2015-04-23</discovery>
<entry>2015-05-01</entry>
<modified>2015-07-12</modified>
</dates>
</vuln>
<vuln vid="210f80b9-ede4-11e4-81c4-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>42.0.2311.135</lt></range>
</package>
<package>
<!-- pcbsd -->
<name>chromium-npapi</name>
<range><lt>42.0.2311.135</lt></range>
</package>
<package>
<!-- pcbsd -->
<name>chromium-pulse</name>
<range><lt>42.0.2311.135</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2015/04/stable-channel-update_28.html">
<p>5 security fixes in this release, including:</p>
<ul>
<li>[453279] High CVE-2015-1243: Use-after-free in DOM. Credit to
Saif El-Sherei.</li>
<li>[481777] CVE-2015-1250: Various fixes from internal audits,
fuzzing and other initiatives.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1243</cvename>
<cvename>CVE-2015-1250</cvename>
<url>http://googlechromereleases.blogspot.nl/2015/04/stable-channel-update_28.html</url>
</references>
<dates>
<discovery>2015-04-28</discovery>
<entry>2015-04-28</entry>
</dates>
</vuln>
<vuln vid="b57f690e-ecc9-11e4-876c-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>42.0.2311.90</lt></range>
</package>
<package>
<!-- pcbsd -->
<name>chromium-npapi</name>
<range><lt>42.0.2311.90</lt></range>
</package>
<package>
<!-- pcbsd -->
<name>chromium-pulse</name>
<range><lt>42.0.2311.90</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2015/04/stable-channel-update_14.html">
<p>45 new security fixes, including:</p>
<ul>
<li>[456518] High CVE-2015-1235: Cross-origin-bypass in HTML
parser. Credit to anonymous.</li>
<li>[313939] Medium CVE-2015-1236: Cross-origin-bypass in Blink.
Credit to Amitay Dobo.</li>
<li>[461191] High CVE-2015-1237: Use-after-free in IPC. Credit to
Khalil Zhani.</li>
<li>[445808] High CVE-2015-1238: Out-of-bounds write in Skia.
Credit to cloudfuzzer.</li>
<li>[463599] Medium CVE-2015-1240: Out-of-bounds read in WebGL.
Credit to w3bd3vil.</li>
<li>[418402] Medium CVE-2015-1241: Tap-Jacking. Credit to Phillip
Moon and Matt Weston of Sandfield Information Systems.</li>
<li>[460917] High CVE-2015-1242: Type confusion in V8. Credit to
fcole@onshape.com.</li>
<li>[455215] Medium CVE-2015-1244: HSTS bypass in WebSockets.
Credit to Mike Ruddy.</li>
<li>[444957] Medium CVE-2015-1245: Use-after-free in PDFium. Credit
to Khalil Zhani.</li>
<li>[437399] Medium CVE-2015-1246: Out-of-bounds read in Blink.
Credit to Atte Kettunen of OUSPG.</li>
<li>[429838] Medium CVE-2015-1247: Scheme issues in OpenSearch.
Credit to Jann Horn.</li>
<li>[380663] Medium CVE-2015-1248: SafeBrowsing bypass. Credit to
Vittorio Gambaletta (VittGam).</li>
<li>[476786] CVE-2015-1249: Various fixes from internal audits,
fuzzing and other initiatives. Multiple vulnerabilities in V8
fixed at the tip of the 4.2 branch (currently 4.2.77.14).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://googlechromereleases.blogspot.nl/2015/04/stable-channel-update_14.html</url>
<cvename>CVE-2015-1235</cvename>
<cvename>CVE-2015-1236</cvename>
<cvename>CVE-2015-1237</cvename>
<cvename>CVE-2015-1238</cvename>
<cvename>CVE-2015-1240</cvename>
<cvename>CVE-2015-1241</cvename>
<cvename>CVE-2015-1242</cvename>
<cvename>CVE-2015-1244</cvename>
<cvename>CVE-2015-1245</cvename>
<cvename>CVE-2015-1246</cvename>
<cvename>CVE-2015-1247</cvename>
<cvename>CVE-2015-1248</cvename>
<cvename>CVE-2015-1249</cvename>
</references>
<dates>
<discovery>2015-04-14</discovery>
<entry>2015-04-27</entry>
</dates>
</vuln>
<vuln vid="cb9d2fcd-eb47-11e4-b03e-002590263bf5">
<topic>wpa_supplicant -- P2P SSID processing vulnerability</topic>
<affects>
<package>
<name>wpa_supplicant</name>
<range><lt>2.4_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jouni Malinen reports:</p>
<blockquote cite="http://w1.fi/security/2015-1/wpa_supplicant-p2p-ssid-overflow.txt">
<p>A vulnerability was found in how wpa_supplicant uses SSID information
parsed from management frames that create or update P2P peer entries
(e.g., Probe Response frame or number of P2P Public Action frames). SSID
field has valid length range of 0-32 octets. However, it is transmitted
in an element that has a 8-bit length field and potential maximum
payload length of 255 octets. wpa_supplicant was not sufficiently
verifying the payload length on one of the code paths using the SSID
received from a peer device.</p>
<p>This can result in copying arbitrary data from an attacker to a fixed
length buffer of 32 bytes (i.e., a possible overflow of up to 223
bytes). The SSID buffer is within struct p2p_device that is allocated
from heap. The overflow can override couple of variables in the struct,
including a pointer that gets freed. In addition about 150 bytes (the
exact length depending on architecture) can be written beyond the end of
the heap allocation.</p>
<p>This could result in corrupted state in heap, unexpected program
behavior due to corrupted P2P peer device information, denial of service
due to wpa_supplicant process crash, exposure of memory contents during
GO Negotiation, and potentially arbitrary code execution.</p>
<p>Vulnerable versions/configurations</p>
<p>wpa_supplicant v1.0-v2.4 with CONFIG_P2P build option enabled
(which is not compiled by default).</p>
<p>Attacker (or a system controlled by the attacker) needs to be within
radio range of the vulnerable system to send a suitably constructed
management frame that triggers a P2P peer device information to be
created or updated.</p>
<p>The vulnerability is easiest to exploit while the device has started an
active P2P operation (e.g., has ongoing P2P_FIND or P2P_LISTEN control
interface command in progress). However, it may be possible, though
significantly more difficult, to trigger this even without any active
P2P operation in progress.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1863</cvename>
<url>http://w1.fi/security/2015-1/wpa_supplicant-p2p-ssid-overflow.txt</url>
</references>
<dates>
<discovery>2015-04-22</discovery>
<entry>2015-04-25</entry>
</dates>
</vuln>
<vuln vid="1e232a0c-eb57-11e4-b595-4061861086c1">
<topic>Several vulnerabilities found in PHP</topic>
<affects>
<package>
<name>php5</name>
<range><lt>5.4.40</lt></range>
</package>
<package>
<name>php55</name>
<range><lt>5.5.24</lt></range>
</package>
<package>
<name>php56</name>
<range><lt>5.6.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP project reports:</p>
<blockquote cite="http://php.net/archive/2015.php#id2015-04-16-2">
<p>The PHP development team announces the immediate
availability of PHP 5.4.40. 14 security-related
bugs were fixed in this release, including
CVE-2014-9709, CVE-2015-2301, CVE-2015-2783,
CVE-2015-1352. All PHP 5.4 users are encouraged to
upgrade to this version.</p>
<p>The PHP development team announces the immediate
availability of PHP 5.5.24. Several bugs have been
fixed some of them beeing security related, like
CVE-2015-1351 and CVE-2015-1352. All PHP 5.5 users
are encouraged to upgrade to this version.</p>
<p>The PHP development team announces the immediate
availability of PHP 5.6.8. Several bugs have been
fixed some of them beeing security related, like
CVE-2015-1351 and CVE-2015-1352. All PHP 5.6 users
are encouraged to upgrade to this version.</p>
</blockquote>
</body>
</description>
<references>
<url>http://php.net/archive/2015.php#id2015-04-16-2</url>
<cvename>CVE-2014-9709</cvename>
<cvename>CVE-2015-2301</cvename>
<cvename>CVE-2015-2783</cvename>
<cvename>CVE-2015-1351</cvename>
<cvename>CVE-2015-1352</cvename>
<freebsdpr>ports/199585</freebsdpr>
</references>
<dates>
<discovery>2015-04-16</discovery>
<entry>2015-04-25</entry>
<modified>2015-05-22</modified>
</dates>
</vuln>
<vuln vid="505904d3-ea95-11e4-beaf-bcaec565249c">
<topic>wordpress -- multiple vulnabilities</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>4.1.2</lt></range>
</package>
<package>
<name>de-wordpress</name>
<range><lt>4.1.2</lt></range>
</package>
<package>
<name>ja-wordpress</name>
<range><lt>4.1.2</lt></range>
</package>
<package>
<name>ru-wordpress</name>
<range><lt>4.1.2</lt></range>
</package>
<package>
<name>zh-wordpress-zh_CN</name>
<range><lt>4.1.2</lt></range>
</package>
<package>
<name>zh-wordpress-zh_TW</name>
<range><lt>4.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gary Pendergast reports:</p>
<blockquote cite="https://wordpress.org/news/2015/04/wordpress-4-1-2/">
<p>WordPress 4.1.2 is now available. This is a critical security
release for all previous versions and we strongly encourage you
to update your sites immediately.</p>
<p>WordPress versions 4.1.1 and earlier are affected by a critical
cross-site scripting vulnerability, which could enable anonymous
users to compromise a site. This was reported by Cedric Van
Bockhaven and fixed by Gary Pendergast, Mike Adams, and Andrew
Nacin of the WordPress security team.</p>
<p>We also fixed three other security issues:</p>
<ul>
<li>In WordPress 4.1 and higher, files with invalid or unsafe
names could be uploaded. Discovered by Michael Kapfer and
Sebastian Kraemer of HSASec.</li>
<li>In WordPress 3.9 and higher, a very limited cross-site
scripting vulnerability could be used as part of a social
engineering attack. Discovered by Jakub Zoczek.</li>
<li>Some plugins were vulnerable to an SQL injection
vulnerability. Discovered by Ben Bidner of the WordPress
security team.</li>
</ul>
<p>We also made four hardening changes, discovered by J.D. Grimes,
Divyesh Prajapati, Allan Collins, Marc-Alexandre Montpas and
Jeff Bowen.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wordpress.org/news/2015/04/wordpress-4-1-2/</url>
</references>
<dates>
<discovery>2015-04-21</discovery>
<entry>2015-04-24</entry>
<modified>2015-04-24</modified>
</dates>
</vuln>
<vuln vid="82595123-e8b8-11e4-a008-047d7b492d07">
<topic>libtasn1 -- stack-based buffer overflow in asn1_der_decoding</topic>
<affects>
<package>
<name>libtasn1</name>
<range><lt>4.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Debian reports:</p>
<blockquote cite="https://www.debian.org/security/2015/dsa-3220.en.html">
<p>Hanno Boeck discovered a stack-based buffer overflow in
the asn1_der_decoding function in Libtasn1, a library to
manage ASN.1 structures. A remote attacker could take advantage
of this flaw to cause an application using the Libtasn1 library
to crash, or potentially to execute arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-2806</cvename>
<url>https://www.debian.org/security/2015/dsa-3220.en.html</url>
</references>
<dates>
<discovery>2015-04-11</discovery>
<entry>2015-04-22</entry>
</dates>
</vuln>
<vuln vid="738fc80d-5f13-4ccb-aa9a-7965699e5a10">
<topic>mozilla -- use-after-free</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>37.0.2,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>37.0.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/">
<p>MFSA 2015-45 Memory corruption during failed plugin
initialization</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-2706</cvename>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-45/</url>
</references>
<dates>
<discovery>2015-04-20</discovery>
<entry>2015-04-21</entry>
</dates>
</vuln>
<vuln vid="dec3164f-3121-45ef-af18-bb113ac5082f">
<topic>sqlite -- multiple vulnerabilities</topic>
<affects>
<package>
<name>sqlite3</name>
<range><lt>3.8.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3414">
<p>SQLite before 3.8.9 does not properly implement the
dequoting of collation-sequence names, which allows
context-dependent attackers to cause a denial of service
(uninitialized memory access and application crash) or
possibly have unspecified other impact via a crafted
COLLATE clause, as demonstrated by COLLATE"""""""" at the
end of a SELECT statement.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3415">
<p>The sqlite3VdbeExec function in vdbe.c in SQLite before
3.8.9 does not properly implement comparison operators,
which allows context-dependent attackers to cause a denial
of service (invalid free operation) or possibly have
unspecified other impact via a crafted CHECK clause, as
demonstrated by CHECK(0&amp;O&gt;O) in a CREATE TABLE statement.
</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3416">
<p>The sqlite3VXPrintf function in printf.c in SQLite before
3.8.9 does not properly handle precision and width values
during floating-point conversions, which allows
context-dependent attackers to cause a denial of service
(integer overflow and stack-based buffer overflow) or
possibly have unspecified other impact via large integers
in a crafted printf function call in a SELECT statement.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3414</cvename>
<cvename>CVE-2015-3415</cvename>
<cvename>CVE-2015-3416</cvename>
<url>https://www.sqlite.org/src/info/eddc05e7bb31fae7</url>
<url>https://www.sqlite.org/src/info/02e3c88fbf6abdcf</url>
<url>https://www.sqlite.org/src/info/c494171f77dc2e5e</url>
<mlist>http://seclists.org/fulldisclosure/2015/Apr/31</mlist>
</references>
<dates>
<discovery>2015-04-14</discovery>
<entry>2015-04-18</entry>
<modified>2015-05-08</modified>
</dates>
</vuln>
<vuln vid="c4571ca8-053d-44c9-ab3c-89b1372ad0a5">
<topic>chrony -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chrony</name>
<range><lt>1.31.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrony News reports:</p>
<blockquote cite="http://chrony.tuxfamily.org/News.html">
<p>CVE-2015-1853: DoS attack on authenticated symmetric NTP
associations</p>
<p>CVE-2015-1821: Heap-based buffer overflow in access
configuration</p>
<p>CVE-2015-1822: Use of uninitialized pointer in command
processing</p>
</blockquote>
</body>
</description>
<references>
<url>http://chrony.tuxfamily.org/News.html</url>
<cvename>CVE-2015-1821</cvename>
<cvename>CVE-2015-1822</cvename>
<cvename>CVE-2015-1853</cvename>
</references>
<dates>
<discovery>2015-02-17</discovery>
<entry>2015-04-18</entry>
</dates>
</vuln>
<vuln vid="e426eda9-dae1-11e4-8107-94de806b0af9">
<topic>Dulwich -- Remote code execution</topic>
<affects>
<package>
<name>py27-dulwich</name>
<range><lt>0.9.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0838">
<p>Buffer overflow in the C implementation of the apply_delta
function in _pack.c in Dulwich before 0.9.9 allows remote
attackers to execute arbitrary code via a crafted pack file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0838</cvename>
</references>
<dates>
<discovery>2015-01-07</discovery>
<entry>2015-04-17</entry>
</dates>
</vuln>
<vuln vid="3364d497-e4e6-11e4-a265-c485083ca99c">
<topic>Adobe Flash Player -- critical vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<range><le>11.2r202.451</le></range>
</package>
<package>
<name>linux-f10-flashplugin</name>
<range><le>11.2r202.451</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-06.html">
<p>
Adobe has released security updates for Adobe Flash Player for
Windows, Macintosh and Linux. These updates address vulnerabilities
that could potentially allow an attacker to take control of the
affected system. Adobe is aware of a report that an exploit for
CVE-2015-3043 exists in the wild, and recommends users update their
product installations to the latest versions.
</p>
<ul>
<li>
These updates resolve memory corruption vulnerabilities that could
lead to code execution (CVE-2015-0347, CVE-2015-0350, CVE-2015-0352,
CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360,
CVE-2015-3038, CVE-2015-3041, CVE-2015-3042, CVE-2015-3043).
</li>
<li>
These updates resolve a type confusion vulnerability that could lead
to code execution (CVE-2015-0356).
</li>
<li>
These updates resolve a buffer overflow vulnerability that could
lead to code execution (CVE-2015-0348).
</li>
<li>
These updates resolve use-after-free vulnerabilities that could lead
to code execution (CVE-2015-0349, CVE-2015-0351, CVE-2015-0358,
CVE-2015-3039).
</li>
<li>
These updates resolve double-free vulnerabilities that could lead to
code execution (CVE-2015-0346, CVE-2015-0359).
</li>
<li>
These updates resolve memory leak vulnerabilities that could be used
to bypass ASLR (CVE-2015-0357, CVE-2015-3040).
</li>
<li>
These updates resolve a security bypass vulnerability that could
lead to information disclosure (CVE-2015-3044).
</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://helpx.adobe.com/security/products/flash-player/apsb15-06.html</url>
<cvename>CVE-2015-3038</cvename>
<cvename>CVE-2015-3039</cvename>
<cvename>CVE-2015-3040</cvename>
<cvename>CVE-2015-3041</cvename>
<cvename>CVE-2015-3042</cvename>
<cvename>CVE-2015-3043</cvename>
<cvename>CVE-2015-3044</cvename>
<cvename>CVE-2015-0346</cvename>
<cvename>CVE-2015-0347</cvename>
<cvename>CVE-2015-0348</cvename>
<cvename>CVE-2015-0349</cvename>
<cvename>CVE-2015-0350</cvename>
<cvename>CVE-2015-0351</cvename>
<cvename>CVE-2015-0352</cvename>
<cvename>CVE-2015-0353</cvename>
<cvename>CVE-2015-0354</cvename>
<cvename>CVE-2015-0355</cvename>
<cvename>CVE-2015-0356</cvename>
<cvename>CVE-2015-0357</cvename>
<cvename>CVE-2015-0358</cvename>
<cvename>CVE-2015-0359</cvename>
<cvename>CVE-2015-0360</cvename>
</references>
<dates>
<discovery>2015-04-14</discovery>
<entry>2015-04-17</entry>
</dates>
</vuln>
<vuln vid="ba326a36-5f02-452d-a215-31e7b06d5edf">
<topic>Wesnoth -- Remote information disclosure</topic>
<affects>
<package>
<name>wesnoth</name>
<name>wesnoth-devel</name>
<range><ge>1.7.0</ge><lt>1.12.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>US-CERT/NIST reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0844">
<p>The WML/Lua API in Battle for Wesnoth 1.7.x through
1.11.x and 1.12.x before 1.12.2 allows remote attackers to
read arbitrary files via a crafted (1) campaign or (2) map
file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0844</cvename>
</references>
<dates>
<discovery>2015-04-11</discovery>
<entry>2015-04-17</entry>
</dates>
</vuln>
<vuln vid="5713bfda-e27d-11e4-b2ce-5453ed2e2b49">
<topic>qt4-imageformats, qt4-gui, qt5-gui -- Multiple Vulnerabilities in Qt Image Format Handling</topic>
<affects>
<package>
<name>qt4-imageformats</name>
<range><lt>4.8.6_3</lt></range>
</package>
<package>
<name>qt4-gui</name>
<range><lt>4.8.6_5</lt></range>
</package>
<package>
<name>qt5-gui</name>
<range><lt>5.4.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Richard J. Moore reports:</p>
<blockquote cite="http://lists.qt-project.org/pipermail/announce/2015-April/000067.html">
<p>Due to two recent vulnerabilities identified in the built-in image
format handling code, it was decided that this area required further
testing to determine if further issues remained. Fuzzing using
afl-fuzz located a number of issues in the handling of BMP, ICO and
GIF files. The issues exposed included denial of service and buffer
overflows leading to heap corruption. It is possible the latter could
be used to perform remote code execution.</p>
</blockquote>
</body>
</description>
<references>
<mlist>http://lists.qt-project.org/pipermail/announce/2015-April/000067.html</mlist>
<cvename>CVE-2015-1858</cvename>
<cvename>CVE-2015-1859</cvename>
<cvename>CVE-2015-1860</cvename>
</references>
<dates>
<discovery>2015-04-12</discovery>
<entry>2015-04-14</entry>
</dates>
</vuln>
<vuln vid="d4379f59-3e9b-49eb-933b-61de4d0b0fdb">
<topic>Ruby -- OpenSSL Hostname Verification Vulnerability</topic>
<affects>
<package>
<name>ruby</name>
<name>ruby20</name>
<range><ge>2.0,1</ge><lt>2.0.0.645,1</lt></range>
</package>
<package>
<name>ruby</name>
<name>ruby21</name>
<range><ge>2.1,1</ge><lt>2.1.6,1</lt></range>
</package>
<package>
<name>ruby</name>
<name>ruby22</name>
<range><ge>2.2,1</ge><lt>2.2.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby Developers report:</p>
<blockquote cite="https://www.ruby-lang.org/en/news/2015/04/13/ruby-openssl-hostname-matching-vulnerability/">
<p>After reviewing RFC 6125 and RFC 5280, we found multiple violations
of matching hostnames and particularly wildcard certificates.</p>
<p>Ruby’s OpenSSL extension will now provide a string-based matching
algorithm which follows more strict behavior, as recommended by
these RFCs. In particular, matching of more than one wildcard per
subject/SAN is no-longer allowed. As well, comparison of these
values are now case-insensitive.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.ruby-lang.org/en/news/2015/04/13/ruby-openssl-hostname-matching-vulnerability/</url>
<cvename>CVE-2015-1855</cvename>
</references>
<dates>
<discovery>2015-04-13</discovery>
<entry>2015-04-14</entry>
<modified>2015-09-23</modified>
</dates>
</vuln>
<vuln vid="a5f160fa-deee-11e4-99f8-080027ef73ec">
<topic>mailman -- path traversal vulnerability</topic>
<affects>
<package>
<name>mailman</name>
<range><lt>2.1.20</lt></range>
</package>
<package>
<name>mailman-with-htdig</name>
<range><lt>2.1.20</lt></range>
</package>
<package>
<name>ja-mailman</name>
<range><lt>2.1.14.j7_2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mark Sapiro reports:</p>
<blockquote cite="https://mail.python.org/pipermail/mailman-announce/2015-March/000209.html">
<p>A path traversal vulnerability has been discovered and fixed. This
vulnerability is only exploitable by a local user on a Mailman
server where the suggested Exim transport, the Postfix
postfix_to_mailman.py transport or some other programmatic MTA
delivery not using aliases is employed.</p>
</blockquote>
</body>
</description>
<references>
<url>https://mail.python.org/pipermail/mailman-announce/2015-March/000209.html</url>
<url>https://bugs.launchpad.net/mailman/+bug/1437145</url>
<cvename>CVE-2015-2775</cvename>
</references>
<dates>
<discovery>2015-03-27</discovery>
<entry>2015-04-09</entry>
<modified>2015-06-17</modified>
</dates>
</vuln>
<vuln vid="5fee3f02-de37-11e4-b7c3-001999f8d30b">
<topic>asterisk -- TLS Certificate Common name NULL byte exploit</topic>
<affects>
<package>
<name>asterisk</name>
<range><lt>1.8.32.3</lt></range>
</package>
<package>
<name>asterisk11</name>
<range><lt>11.17.1</lt></range>
</package>
<package>
<name>asterisk13</name>
<range><lt>13.3.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>When Asterisk registers to a SIP TLS device and and
verifies the server, Asterisk will accept signed certificates
that match a common name other than the one Asterisk is
expecting if the signed certificate has a common name
containing a null byte after the portion of the common
name that Asterisk expected. For example, if Asterisk is
trying to register to www.domain.com, Asterisk will accept
certificates of the form
www.domain.com\x00www.someotherdomain.com</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2015-003.html</url>
<cvename>CVE-2015-3008</cvename>
</references>
<dates>
<discovery>2015-04-04</discovery>
<entry>2015-04-08</entry>
</dates>
</vuln>
<vuln vid="ebd84c96-dd7e-11e4-854e-3c970e169bc2">
<topic>ntp -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ntp</name>
<range><lt>4.2.8p2</lt></range>
</package>
<package>
<name>ntp-devel</name>
<range><lt>4.3.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ntp.org reports:</p>
<blockquote cite="http://archive.ntp.org/ntp4/ChangeLog-stable">
<ul>
<li>[Sec 2779] ntpd accepts unauthenticated packets
with symmetric key crypto.</li>
<li>[Sec 2781] Authentication doesn't protect symmetric
associations against DoS attacks.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1798</cvename>
<cvename>CVE-2015-1799</cvename>
<url>http://archive.ntp.org/ntp4/ChangeLog-stable</url>
</references>
<dates>
<discovery>2015-04-07</discovery>
<entry>2015-04-07</entry>
</dates>
</vuln>
<vuln vid="b8321d76-24e7-4b72-a01d-d12c4445d826">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>37.0.1,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>37.0.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/">
<p>MFSA 2015-44 Certificate verification bypass through the
HTTP/2 Alt-Svc header</p>
<p>MFSA 2015-43 Loading privileged content through Reader
mode</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0798</cvename>
<cvename>CVE-2015-0799</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2015-43/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-44/</url>
<url>https://www.mozilla.org/security/advisories/</url>
</references>
<dates>
<discovery>2015-04-03</discovery>
<entry>2015-04-04</entry>
</dates>
</vuln>
<vuln vid="2f75141c-da1d-11e4-8d32-5404a68ad561">
<topic>Several vulnerabilities in libav</topic>
<affects>
<package>
<name>libav</name>
<range><lt>11.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The libav project reports:</p>
<blockquote cite="https://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v11.3">
<p>utvideodec: Handle slice_height being zero (CVE-2014-9604)</p>
<p>tiff: Check that there is no aliasing in pixel format selection (CVE-2014-8544)</p>
</blockquote>
</body>
</description>
<references>
<url>https://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v11.3</url>
<cvename>CVE-2014-8544</cvename>
<cvename>CVE-2014-9604</cvename>
</references>
<dates>
<discovery>2015-03-24</discovery>
<entry>2015-04-03</entry>
</dates>
</vuln>
<vuln vid="742563d4-d776-11e4-b595-4061861086c1">
<topic>Several vulnerabilities found in PHP</topic>
<affects>
<package>
<name>php53</name>
<range><le>5.3.29_5</le></range>
</package>
<package>
<name>php5</name>
<range><lt>5.4.39</lt></range>
</package>
<package>
<name>php55</name>
<range><lt>5.5.23</lt></range>
</package>
<package>
<name>php56</name>
<range><lt>5.6.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP project reports:</p>
<blockquote cite="http://php.net/archive/2015.php#id2015-03-20-2">
<p>The PHP development team announces the immediate
availability of PHP 5.6.7. Several bugs have been
fixed as well as CVE-2015-0231, CVE-2015-2305 and
CVE-2015-2331. All PHP 5.6 users are encouraged to
upgrade to this version.</p>
<p>The PHP development team announces the immediate
availability of PHP 5.5.23. Several bugs have been
fixed as well as CVE-2015-0231, CVE-2015-2305 and
CVE-2015-2331. All PHP 5.5 users are encouraged
to upgrade to this version.</p>
<p>The PHP development team announces the immediate
availability of PHP 5.4.39. Six security-related
bugs were fixed in this release, including
CVE-2015-0231, CVE-2015-2305 and CVE-2015-2331.
All PHP 5.4 users are encouraged to upgrade to
this version.</p>
</blockquote>
</body>
</description>
<references>
<url>http://php.net/archive/2015.php#id2015-03-20-2</url>
<cvename>CVE-2015-0231</cvename>
<cvename>CVE-2015-2305</cvename>
<cvename>CVE-2015-2311</cvename>
<freebsdpr>ports/198739</freebsdpr>
</references>
<dates>
<discovery>2015-03-19</discovery>
<entry>2015-04-01</entry>
</dates>
</vuln>
<vuln vid="8e887b71-d769-11e4-b1c2-20cf30e32f6d">
<topic>subversion -- DoS vulnerabilities</topic>
<affects>
<package>
<name>mod_dav_svn</name>
<range><ge>1.5.0</ge><lt>1.7.20</lt></range>
<range><ge>1.8.0</ge><lt>1.8.13</lt></range>
</package>
<package>
<name>subversion16</name>
<range><ge>1.0.0</ge><lt>1.7.20</lt></range>
</package>
<package>
<name>subversion17</name>
<range><ge>1.0.0</ge><lt>1.7.20</lt></range>
</package>
<package>
<name>subversion</name>
<range><ge>1.0.0</ge><lt>1.7.20</lt></range>
<range><ge>1.8.0</ge><lt>1.8.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Subversion Project reports:</p>
<blockquote cite="http://subversion.apache.org/security/">
<p>Subversion HTTP servers with FSFS repositories are vulnerable to a remotely
triggerable excessive memory use with certain REPORT requests.</p>
<p>Subversion mod_dav_svn and svnserve are vulnerable to a remotely triggerable
assertion DoS vulnerability for certain requests with dynamically evaluated
revision numbers.</p>
<p>Subversion HTTP servers allow spoofing svn:author property values for new
revisions.</p>
</blockquote>
</body>
</description>
<references>
<url>http://subversion.apache.org/security/</url>
<cvename>CVE-2015-0202</cvename>
<cvename>CVE-2015-0248</cvename>
<cvename>CVE-2015-0251</cvename>
<url>http://subversion.apache.org/security/CVE-2015-0202-advisory.txt</url>
<url>http://subversion.apache.org/security/CVE-2015-0248-advisory.txt</url>
<url>http://subversion.apache.org/security/CVE-2015-0251-advisory.txt</url>
</references>
<dates>
<discovery>2015-03-31</discovery>
<entry>2015-03-31</entry>
</dates>
</vuln>
<vuln vid="d0c97697-df2c-4b8b-bff2-cec24dc35af8">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>37.0,1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>31.6.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>37.0,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.34</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>31.6.0</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.34</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>31.6.0</lt></range>
</package>
<package>
<name>libxul</name>
<range><lt>31.6.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/">
<p>MFSA-2015-30 Miscellaneous memory safety hazards (rv:37.0
/ rv:31.6)</p>
<p>MFSA-2015-31 Use-after-free when using the Fluendo MP3
GStreamer plugin</p>
<p>MFSA-2015-32 Add-on lightweight theme installation
approval bypassed through MITM attack</p>
<p>MFSA-2015-33 resource:// documents can load privileged
pages</p>
<p>MFSA-2015-34 Out of bounds read in QCMS library</p>
<p>MFSA-2015-35 Cursor clickjacking with flash and images</p>
<p>MFSA-2015-36 Incorrect memory management for simple-type
arrays in WebRTC</p>
<p>MFSA-2015-37 CORS requests should not follow 30x
redirections after preflight</p>
<p>MFSA-2015-38 Memory corruption crashes in Off Main Thread
Compositing</p>
<p>MFSA-2015-39 Use-after-free due to type confusion flaws</p>
<p>MFSA-2015-40 Same-origin bypass through anchor navigation</p>
<p>MFSA-2015-41 PRNG weakness allows for DNS poisoning on
Android</p>
<p>MFSA-2015-42 Windows can retain access to privileged
content on navigation to unprivileged pages</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2808</cvename>
<cvename>CVE-2015-0800</cvename>
<cvename>CVE-2015-0801</cvename>
<cvename>CVE-2015-0802</cvename>
<cvename>CVE-2015-0803</cvename>
<cvename>CVE-2015-0804</cvename>
<cvename>CVE-2015-0805</cvename>
<cvename>CVE-2015-0806</cvename>
<cvename>CVE-2015-0807</cvename>
<cvename>CVE-2015-0808</cvename>
<cvename>CVE-2015-0810</cvename>
<cvename>CVE-2015-0811</cvename>
<cvename>CVE-2015-0812</cvename>
<cvename>CVE-2015-0813</cvename>
<cvename>CVE-2015-0814</cvename>
<cvename>CVE-2015-0815</cvename>
<cvename>CVE-2015-0816</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2015-30/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-31/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-32/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-33/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-34/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-35/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-36/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-37/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-38/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-39/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-40/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-41/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-42/</url>
<url>https://www.mozilla.org/security/advisories/</url>
</references>
<dates>
<discovery>2015-03-31</discovery>
<entry>2015-03-31</entry>
</dates>
</vuln>
<vuln vid="f450587b-d7bd-11e4-b5a4-14dae9d5a9d2">
<topic>osc -- shell command injection via crafted _service files</topic>
<affects>
<package>
<name>osc</name>
<range><lt>0.151.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SUSE Security Update reports:</p>
<blockquote cite="https://www.suse.com/security/cve/CVE-2015-0778.html">
<p>osc before 0.151.0 allows remote attackers to execute
arbitrary commands via shell metacharacters in a _service
file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0778</cvename>
<url>https://www.suse.com/security/cve/CVE-2015-0778.html</url>
<url>https://bugzilla.suse.com/show_bug.cgi?id=901643</url>
<url>http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00012.html</url>
</references>
<dates>
<discovery>2015-03-16</discovery>
<entry>2015-03-31</entry>
</dates>
</vuln>
<vuln vid="72ee9707-d7b2-11e4-8d8e-f8b156b6dcc8">
<topic>cpio -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gcpio</name>
<range><lt>2.11_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>From the Debian Security Team:</p>
<blockquote cite="https://security-tracker.debian.org/tracker/CVE-2014-9112">
<p>Heap-based buffer overflow in the process_copy_in
function in GNU Cpio 2.11 allows remote attackers to cause
a denial of service via a large block value in a cpio
archive.</p>
</blockquote>
<blockquote cite="https://security-tracker.debian.org/tracker/CVE-2015-1197">
<p>cpio 2.11, when using the --no-absolute-filenames
option, allows local users to write to arbitrary files
via a symlink attack on a file in an archive.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-9112</cvename>
<url>https://security-tracker.debian.org/tracker/CVE-2014-9112</url>
<cvename>CVE-2015-1197</cvename>
<url>https://bugzilla.suse.com/show_bug.cgi?id=658010</url>
</references>
<dates>
<discovery>2015-03-27</discovery>
<entry>2015-03-31</entry>
</dates>
</vuln>
<vuln vid="264749ae-d565-11e4-b545-00269ee29e57">
<topic>libzip -- integer overflow</topic>
<affects>
<package>
<name>libzip</name>
<range><lt>0.11.2_2</lt></range>
</package>
<package>
<name>ppsspp</name>
<range><lt>1.0.1_5</lt></range>
</package>
<package>
<name>ppsspp-devel</name>
<range><lt>1.0.1.2668_1</lt></range>
</package>
<package>
<name>radare2</name>
<range><lt>0.9.8_1</lt></range>
</package>
<package>
<name>openlierox</name>
<range><lt>0.58.r3_5,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libzip developers report:</p>
<blockquote cite="http://hg.nih.at/libzip/rev/9f11d54f692e">
<p>Avoid integer overflow. Fixed similarly to patch used in PHP copy of libzip.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.php.net/bug.php?id=69253</url>
<url>https://github.com/php/php-src/commit/ef8fc4b53d92fbfcd8ef1abbd6f2f5fe2c4a11e5</url>
<url>http://hg.nih.at/libzip/rev/9f11d54f692e</url>
<cvename>CVE-2015-2331</cvename>
</references>
<dates>
<discovery>2015-03-18</discovery>
<entry>2015-03-28</entry>
<modified>2015-09-20</modified>
</dates>
</vuln>
<vuln vid="62287f51-d43d-11e4-879c-00e0814cab4e">
<topic>django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py27-django</name>
<range><ge>1.4</ge><lt>1.4.20</lt></range>
<range><ge>1.6</ge><lt>1.6.11</lt></range>
<range><ge>1.7</ge><lt>1.7.7</lt></range>
</package>
<package>
<name>py32-django</name>
<range><ge>1.4</ge><lt>1.4.20</lt></range>
<range><ge>1.6</ge><lt>1.6.11</lt></range>
<range><ge>1.7</ge><lt>1.7.7</lt></range>
</package>
<package>
<name>py33-django</name>
<range><ge>1.4</ge><lt>1.4.20</lt></range>
<range><ge>1.6</ge><lt>1.6.11</lt></range>
<range><ge>1.7</ge><lt>1.7.7</lt></range>
</package>
<package>
<name>py34-django</name>
<range><ge>1.4</ge><lt>1.4.20</lt></range>
<range><ge>1.6</ge><lt>1.6.11</lt></range>
<range><ge>1.7</ge><lt>1.7.7</lt></range>
</package>
<package>
<name>py27-django-devel</name>
<range><lt>20150326,1</lt></range>
</package>
<package>
<name>py32-django-devel</name>
<range><lt>20150326,1</lt></range>
</package>
<package>
<name>py33-django-devel</name>
<range><lt>20150326,1</lt></range>
</package>
<package>
<name>py34-django-devel</name>
<range><lt>20150326,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Django project reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2015/mar/18/security-releases/">
<p>In accordance with our security release policy, the Django team
is issuing multiple releases -- Django 1.4.20, 1.6.11, 1.7.7 and
1.8c1. These releases are now available on PyPI and our download
page. These releases address several security issues detailed
below. We encourage all users of Django to upgrade as soon as
possible. The Django master branch has also been updated.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.djangoproject.com/weblog/2015/mar/18/security-releases/</url>
<cvename>CVE-2015-2316</cvename>
<cvename>CVE-2015-2317</cvename>
</references>
<dates>
<discovery>2015-03-18</discovery>
<entry>2015-03-27</entry>
</dates>
</vuln>
<vuln vid="f6a014cd-d268-11e4-8339-001e679db764">
<topic>GNU binutils -- multiple vulnerabilities</topic>
<affects>
<package>
<name>cross-binutils</name>
<range><lt>2.25</lt></range>
</package>
<package>
<name>x86_64-pc-mingw32-binutils</name>
<range><lt>2.25</lt></range>
</package>
<package>
<name>m6811-binutils</name>
<range><lt>2.25</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>US-CERT/NIST reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8501">
<p>The _bfd_XXi_swap_aouthdr_in function in bfd/peXXigen.c in GNU
binutils 2.24 and earlier allows remote attackers to cause a
denial of service (out-of-bounds write) and possibly have other
unspecified impact via a crafted NumberOfRvaAndSizes field in the
AOUT header in a PE executable.</p>
</blockquote>
<p>US-CERT/NIST reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8502">
<p>Heap-based buffer overflow in the pe_print_edata function in
bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remote
attackers to cause a denial of service (crash) and possibly have
other unspecified impact via a truncated export table in a PE
file.</p>
</blockquote>
<p>US-CERT/NIST reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8503">
<p>Stack-based buffer overflow in the ihex_scan function in
bfd/ihex.c in GNU binutils 2.24 and earlier allows remote
attackers to cause a denial of service (crash) and possibly have
other unspecified impact via a crafted ihex file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-8501</cvename>
<cvename>CVE-2014-8502</cvename>
<cvename>CVE-2014-8503</cvename>
<url>https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8501</url>
<url>https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8502</url>
<url>https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8503</url>
</references>
<dates>
<discovery>2014-12-09</discovery>
<entry>2015-03-24</entry>
<modified>2016-01-08</modified>
</dates>
</vuln>
<vuln vid="996bce94-d23d-11e4-9463-9cb654ea3e1c">
<topic>libuv -- incorrect revocation order while relinquishing privileges</topic>
<affects>
<package>
<name>node010</name>
<range><lt>0.10.36</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Nodejs releases reports:</p>
<blockquote cite="http://blog.nodejs.org/2015/03/14/node-v0-10-37-stable">
<h5>CVE-2015-0278</h5>
<p>This may potentially allow an attacker to gain elevated privileges.</p>
</blockquote>
</body>
</description>
<references>
<url>http://blog.nodejs.org/2015/03/14/node-v0-10-37-stable</url>
<freebsdpr>ports/198861</freebsdpr>
<cvename>CVE-2015-0278</cvename>
</references>
<dates>
<discovery>2015-03-14</discovery>
<entry>2015-03-24</entry>
</dates>
</vuln>
<vuln vid="22dc4a22-d1e5-11e4-879c-00e0814cab4e">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><le>1.605</le></range>
</package>
<package>
<name>jenkins-lts</name>
<range><le>1.596.1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-03-23">
<h1>Description</h1>
<h5>SECURITY-171, SECURITY-177 (Reflective XSS vulnerability)</h5>
<p>An attacker without any access to Jenkins can navigate the user
to a carefully crafted URL and have the user execute unintended
actions. This vulnerability can be used to attack Jenkins inside
firewalls from outside so long as the location of Jenkins is known
to the attacker.</p>
<h5>SECURITY-180 (forced API token change)</h5>
<p>The part of Jenkins that issues a new API token was not
adequately protected against anonymous attackers. This allows an
attacker to escalate privileges on Jenkins.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-03-23</url>
</references>
<dates>
<discovery>2015-03-23</discovery>
<entry>2015-03-24</entry>
</dates>
</vuln>
<vuln vid="76ff65f4-17ca-4d3f-864a-a3d6026194fb">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>36.0.4,1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>31.5.3,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>36.0.4,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.33.1</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.33.1</lt></range>
</package>
<package>
<name>libxul</name>
<range><lt>31.5.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/">
<p>MFSA-2015-28 Privilege escalation through SVG navigation</p>
<p>MFSA-2015-29 Code execution through incorrect JavaScript
bounds checking elimination</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0817</cvename>
<cvename>CVE-2015-0818</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2015-28/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-29/</url>
<url>https://www.mozilla.org/security/advisories/</url>
</references>
<dates>
<discovery>2015-03-20</discovery>
<entry>2015-03-22</entry>
</dates>
</vuln>
<vuln vid="9d15355b-ce7c-11e4-9db0-d050992ecde8">
<topic>OpenSSL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><ge>1.0.1</ge><lt>1.0.1_19</lt></range>
</package>
<package>
<name>mingw32-openssl</name>
<range><ge>1.0.1</ge><lt>1.0.1m</lt></range>
</package>
<package>
<name>linux-c6-openssl</name>
<range><lt>1.0.1e_4</lt></range>
</package>
<package>
<name>libressl</name>
<range><le>2.1.5_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv_20150319.txt">
<ul>
<li>Reclassified: RSA silently downgrades to EXPORT_RSA
[Client] (CVE-2015-0204). OpenSSL only.</li>
<li>Segmentation fault in ASN1_TYPE_cmp (CVE-2015-0286)</li>
<li>ASN.1 structure reuse memory corruption (CVE-2015-0287)</li>
<li>PKCS7 NULL pointer dereferences (CVE-2015-0289)</li>
<li>Base64 decode (CVE-2015-0292). OpenSSL only.</li>
<li>DoS via reachable assert in SSLv2 servers
(CVE-2015-0293). OpenSSL only.</li>
<li>Use After Free following d2i_ECPrivatekey error
(CVE-2015-0209)</li>
<li>X509_to_X509_REQ NULL pointer deref (CVE-2015-0288)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/198681</freebsdpr>
<cvename>CVE-2015-0204</cvename>
<cvename>CVE-2015-0286</cvename>
<cvename>CVE-2015-0287</cvename>
<cvename>CVE-2015-0289</cvename>
<cvename>CVE-2015-0292</cvename>
<cvename>CVE-2015-0293</cvename>
<cvename>CVE-2015-0209</cvename>
<cvename>CVE-2015-0288</cvename>
<url>https://www.openssl.org/news/secadv_20150319.txt</url>
</references>
<dates>
<discovery>2015-03-19</discovery>
<entry>2015-03-19</entry>
<modified>2015-03-24</modified>
</dates>
</vuln>
<vuln vid="f7d79fac-cd49-11e4-898f-bcaec565249c">
<topic>libXfont -- BDF parsing issues</topic>
<affects>
<package>
<name>libXfont</name>
<range><lt>1.5.1</lt></range>
</package>
<package>
<name>linux-c6-xorg-libs</name>
<range><lt>7.4_4</lt></range>
</package>
<package>
<name>linux-f10-xorg-libs</name>
<range><lt>7.4_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Alan Coopersmith reports:</p>
<blockquote cite="http://lists.x.org/archives/xorg-announce/2015-March/002550.html">
<p>Ilja van Sprundel, a security researcher with IOActive, has
discovered an issue in the parsing of BDF font files by libXfont.
Additional testing by Alan Coopersmith and William Robinet with
the American Fuzzy Lop (afl) tool uncovered two more issues in
the parsing of BDF font files.</p>
<p>As libXfont is used by the X server to read font files, and an
unprivileged user with access to the X server can tell the X
server to read a given font file from a path of their choosing,
these vulnerabilities have the potential to allow unprivileged
users to run code with the privileges of the X server
(often root access).</p>
</blockquote>
</body>
</description>
<references>
<url>http://lists.x.org/archives/xorg-announce/2015-March/002550.html</url>
<cvename>CVE-2015-1802</cvename>
<cvename>CVE-2015-1803</cvename>
<cvename>CVE-2015-1804</cvename>
</references>
<dates>
<discovery>2015-03-17</discovery>
<entry>2015-03-18</entry>
<modified>2016-01-31</modified>
</dates>
</vuln>
<vuln vid="8b3ecff5-c9b2-11e4-b71f-00bd5af88c00">
<topic>Adobe Flash Player -- critical vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<range><le>11.2r202.442</le></range>
</package>
<package>
<name>linux-f10-flashplugin</name>
<range><le>11.2r202.442</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-05.html">
<p>
Adobe has released security updates for Adobe Flash Player for
Windows, Macintosh and Linux. These updates address vulnerabilities
that could potentially allow an attacker to take control of the
affected system.
These updates resolve memory corruption vulnerabilities that could
lead to code execution (CVE-2015-0332, CVE-2015-0333, CVE-2015-0335,
CVE-2015-0339).
These updates resolve type confusion vulnerabilities that could lead
to code execution (CVE-2015-0334, CVE-2015-0336).
These updates resolve a vulnerability that could lead to a
cross-domain policy bypass (CVE-2015-0337).
These updates resolve a vulnerability that could lead to a file
upload restriction bypass (CVE-2015-0340).
These updates resolve an integer overflow vulnerability that could
lead to code execution (CVE-2015-0338).
These updates resolve use-after-free vulnerabilities that could lead
to code execution (CVE-2015-0341, CVE-2015-0342).
</p>
</blockquote>
</body>
</description>
<references>
<url>https://helpx.adobe.com/security/products/flash-player/apsb15-05.html</url>
<cvename>CVE-2015-0332</cvename>
<cvename>CVE-2015-0333</cvename>
<cvename>CVE-2015-0334</cvename>
<cvename>CVE-2015-0335</cvename>
<cvename>CVE-2015-0336</cvename>
<cvename>CVE-2015-0337</cvename>
<cvename>CVE-2015-0338</cvename>
<cvename>CVE-2015-0339</cvename>
<cvename>CVE-2015-0340</cvename>
<cvename>CVE-2015-0341</cvename>
<cvename>CVE-2015-0342</cvename>
</references>
<dates>
<discovery>2015-03-12</discovery>
<entry>2015-03-13</entry>
</dates>
</vuln>
<vuln vid="451a6c79-c92b-11e4-a835-000c292ee6b8">
<topic>sympa -- Remote attackers can read arbitrary files</topic>
<affects>
<package>
<name>sympa</name>
<range><lt>6.1.24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Sympa Project reports:</p>
<blockquote cite="https://www.sympa.org/security_advisories">
<p>The newsletter posting area in the web interface in Sympa 6.0.x before 6.0.10 and 6.1.x before 6.1.24 allows remote attackers to read arbitrary files via unspecified vectors.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.sympa.org/security_advisories</url>
<cvename>CVE-2015-1306</cvename>
</references>
<dates>
<discovery>2015-01-13</discovery>
<entry>2015-03-13</entry>
</dates>
</vuln>
<vuln vid="d08f6002-c588-11e4-8495-6805ca0b3d42">
<topic>rt -- Remote DoS, Information disclosure and Session Hijackingvulnerabilities</topic>
<affects>
<package>
<name>rt42</name>
<range><ge>4.2.0</ge><lt>4.2.10</lt></range>
</package>
<package>
<name>rt40</name>
<range><ge>4.0.0</ge><lt>4.0.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Best Practical reports:</p>
<blockquote cite="http://blog.bestpractical.com/2015/02/security-vulnerabilities-in-rt.html">
<p>RT 3.0.0 and above, if running on Perl 5.14.0 or higher,
are vulnerable to a remote denial-of-service via the email
gateway; any installation which accepts mail from untrusted
sources is vulnerable, regardless of the permissions
configuration inside RT. This denial-of-service may
encompass both CPU and disk usage, depending on RT's logging
configuration. This vulnerability is assigned
CVE-2014-9472.</p>
<p>RT 3.8.8 and above are vulnerable to an information
disclosure attack which may reveal RSS feeds URLs, and thus
ticket data; this vulnerability is assigned
CVE-2015-1165. RSS feed URLs can also be leveraged to
perform session hijacking, allowing a user with the URL to
log in as the user that created the feed; this vulnerability
is assigned CVE-2015-1464.</p>
</blockquote>
</body>
</description>
<references>
<url>http://blog.bestpractical.com/2015/02/security-vulnerabilities-in-rt.html</url>
<cvename>CVE-2014-9472</cvename>
<cvename>CVE-2015-1165</cvename>
<cvename>CVE-2015-1464</cvename>
</references>
<dates>
<discovery>2015-02-26</discovery>
<entry>2015-03-08</entry>
</dates>
</vuln>
<vuln vid="81b4c118-c586-11e4-8495-6805ca0b3d42">
<topic>phpMyAdmin -- Risk of BREACH attack due to reflected parameter</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>4.3.0</ge><lt>4.3.11.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2015-1.php">
<p>Risk of BREACH attack due to reflected parameter.</p>
<p>With a large number of crafted requests it was possible to infer
the CSRF token by a BREACH attack.</p>
<p>Mitigation factor: this vulnerability can only be exploited in
the presence of another vulnerability that allows the attacker to
inject JavaScript into victim's browser.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2015-1.php</url>
<cvename>CVE-2015-2206</cvename>
</references>
<dates>
<discovery>2015-03-04</discovery>
<entry>2015-03-08</entry>
</dates>
</vuln>
<vuln vid="c0cae920-c4e9-11e4-898e-90e6ba741e35">
<topic>mono -- TLS bugs</topic>
<affects>
<package>
<name>mono</name>
<range><lt>3.10.1</lt></range>
<range><ge>3.12</ge><lt>3.12.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mono project reports:</p>
<blockquote cite="http://www.mono-project.com/docs/about-mono/vulnerabilities/#tls-bugs">
<p>Mono’s implementation of the SSL/TLS stack failed to check the order of the handshake messages. Which would allow various attacks on the protocol to succeed. Details of this vulnerability are discussed in <a href="https://www.smacktls.com/#skip">SKIP-TLS post</a>.</p>
<p>Mono’s implementation of SSL/TLS also contained support for the weak EXPORT cyphers and was susceptible to the <a href="https://www.smacktls.com/#freak">FREAK</a> attack.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.mono-project.com/docs/about-mono/vulnerabilities/#tls-bugs</url>
</references>
<dates>
<discovery>2015-03-06</discovery>
<entry>2015-03-07</entry>
</dates>
</vuln>
<vuln vid="92fc2e2b-c383-11e4-8ef7-080027ef73ec">
<topic>PuTTY -- fails to scrub private keys from memory after use</topic>
<affects>
<package>
<name>putty</name>
<range><lt>0.64</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon Tatham reports:</p>
<blockquote cite="http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-wiped-2.html">
<p>When PuTTY has sensitive data in memory and has no further need for
it, it should wipe the data out of its memory, in case malware later
gains access to the PuTTY process or the memory is swapped out to
disk or written into a crash dump file. An obvious example of this
is the password typed during SSH login; other examples include
obsolete session keys, public-key passphrases, and the private
halves of public keys.</p>
<p>PuTTY 0.63 and earlier versions, after loading a private key
from a disk file, mistakenly leak a memory buffer containing a
copy of the private key, in the function ssh2_load_userkey. The
companion function ssh2_save_userkey (only called by PuTTYgen) can
also leak a copy, but only in the case where the file it tried to
save to could not be created.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-wiped-2.html</url>
<cvename>CVE-2015-2157</cvename>
</references>
<dates>
<discovery>2015-02-28</discovery>
<entry>2015-03-05</entry>
</dates>
</vuln>
<vuln vid="8505e013-c2b3-11e4-875d-000c6e25e3e9">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>41.0.2272.76</lt></range>
</package>
<package>
<name>chromium-npapi</name>
<range><lt>41.0.2272.76</lt></range>
</package>
<package>
<name>chromium-pulse</name>
<range><lt>41.0.2272.76</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl">
<p>51 security fixes in this release, including:</p>
<ul>
<li>[456516] High CVE-2015-1212: Out-of-bounds write in media.
Credit to anonymous.</li>
<li>[448423] High CVE-2015-1213: Out-of-bounds write in skia
filters. Credit to cloudfuzzer.</li>
<li>[445810] High CVE-2015-1214: Out-of-bounds write in skia
filters. Credit to cloudfuzzer.</li>
<li>[445809] High CVE-2015-1215: Out-of-bounds write in skia
filters. Credit to cloudfuzzer.</li>
<li>[454954] High CVE-2015-1216: Use-after-free in v8 bindings.
Credit to anonymous.</li>
<li>[456192] High CVE-2015-1217: Type confusion in v8 bindings.
Credit to anonymous.</li>
<li>[456059] High CVE-2015-1218: Use-after-free in dom.
Credit to cloudfuzzer.</li>
<li>[446164] High CVE-2015-1219: Integer overflow in webgl.
Credit to Chen Zhang (demi6od) of NSFOCUS Security Team.</li>
<li>[437651] High CVE-2015-1220: Use-after-free in gif decoder.
Credit to Aki Helin of OUSPG.</li>
<li>[455368] High CVE-2015-1221: Use-after-free in web databases.
Credit to Collin Payne.</li>
<li>[448082] High CVE-2015-1222: Use-after-free in service workers.
Credit to Collin Payne.</li>
<li>[454231] High CVE-2015-1223: Use-after-free in dom.
Credit to Maksymillian Motyl.</li>
<li>High CVE-2015-1230: Type confusion in v8.
Credit to Skylined working with HP's Zero Day Initiative.</li>
<li>[449958] Medium CVE-2015-1224: Out-of-bounds read in vpxdecoder.
Credit to Aki Helin of OUSPG.</li>
<li>[446033] Medium CVE-2015-1225: Out-of-bounds read in pdfium.
Credit to cloudfuzzer.</li>
<li>[456841] Medium CVE-2015-1226: Validation issue in debugger.
Credit to Rob Wu.</li>
<li>[450389] Medium CVE-2015-1227: Uninitialized value in blink.
Credit to Christoph Diehl.</li>
<li>[444707] Medium CVE-2015-1228: Uninitialized value in rendering.
Credit to miaubiz.</li>
<li>[431504] Medium CVE-2015-1229: Cookie injection via proxies.
Credit to iliwoy.</li>
<li>[463349] CVE-2015-1231: Various fixes from internal audits,
fuzzing, and other initiatives.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1212</cvename>
<cvename>CVE-2015-1213</cvename>
<cvename>CVE-2015-1214</cvename>
<cvename>CVE-2015-1215</cvename>
<cvename>CVE-2015-1216</cvename>
<cvename>CVE-2015-1217</cvename>
<cvename>CVE-2015-1218</cvename>
<cvename>CVE-2015-1219</cvename>
<cvename>CVE-2015-1220</cvename>
<cvename>CVE-2015-1221</cvename>
<cvename>CVE-2015-1222</cvename>
<cvename>CVE-2015-1223</cvename>
<cvename>CVE-2015-1224</cvename>
<cvename>CVE-2015-1225</cvename>
<cvename>CVE-2015-1226</cvename>
<cvename>CVE-2015-1227</cvename>
<cvename>CVE-2015-1228</cvename>
<cvename>CVE-2015-1229</cvename>
<cvename>CVE-2015-1230</cvename>
<cvename>CVE-2015-1231</cvename>
<url>http://googlechromereleases.blogspot.nl</url>
</references>
<dates>
<discovery>2015-03-03</discovery>
<entry>2015-03-04</entry>
</dates>
</vuln>
<vuln vid="c9c3374d-c2c1-11e4-b236-5453ed2e2b49">
<topic>qt4-gui, qt5-gui -- DoS vulnerability in the BMP image handler</topic>
<affects>
<package>
<name>qt4-gui</name>
<range><lt>4.8.6_4</lt></range>
</package>
<package>
<name>qt5-gui</name>
<range><lt>5.3.2_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Richard J. Moore reports:</p>
<blockquote cite="http://lists.qt-project.org/pipermail/announce/2015-February/000059.html">
<p>The builtin BMP decoder in QtGui prior to Qt 5.5 contained a bug
that would lead to a divsion by zero when loading certain corrupt
BMP files. This in turn would cause the application loading these
hand crafted BMPs to crash.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0295</cvename>
<mlist>http://lists.qt-project.org/pipermail/announce/2015-February/000059.html</mlist>
</references>
<dates>
<discovery>2015-02-22</discovery>
<entry>2015-03-05</entry>
</dates>
</vuln>
<vuln vid="7480b6ac-adf1-443e-a33c-3a3c0becba1e">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><le>1.600</le></range>
</package>
<package>
<name>jenkins-lts</name>
<range><le>1.580.3</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Kohsuke Kawaguchi from Jenkins team reports:</p>
<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27">
<h1>Description</h1>
<h5>SECURITY-125 (Combination filter Groovy script unsecured)</h5>
<p>This vulnerability allows users with the job configuration
privilege to escalate his privileges, resulting in arbitrary code
execution to the master.</p>
<h5>SECURITY-162 (directory traversal from artifacts via symlink)</h5>
<p>This vulnerability allows users with the job configuration
privilege or users with commit access to the build script to
access arbitrary files/directories on the master, resulting in
the exposure of sensitive information, such as encryption keys.</p>
<h5>SECURITY-163 (update center metadata retrieval DoS attack)</h5>
<p>This vulnerability allows authenticated users to disrupt the
operation of Jenkins by feeding malicious update center data into
Jenkins, affecting plugin installation and tool installation.</p>
<h5>SECURITY-165 (external entity injection via XPath)</h5>
<p>This vulnerability allows users with the read access to Jenkins
to retrieve arbitrary XML document on the server, resulting in
the exposure of sensitive information inside/outside Jenkins.</p>
<h5>SECURITY-166 (HudsonPrivateSecurityRealm allows creation of
reserved names)</h5>
<p>For users using "Jenkins' own user database" setting, Jenkins
doesn't refuse reserved names, thus allowing privilege escalation.</p>
<h5>SECURITY-167 (External entity processing in XML can reveal
sensitive local files)</h5>
<p>This vulnerability allows attackers to create malicious XML
documents and feed that into Jenkins, which causes Jenkins to
retrieve arbitrary XML document on the server, resulting in the
exposure of sensitive information inside/outside Jenkins.</p>
<h1>Severity</h1>
<p>SECURITY-125 is rated <strong>critical</strong>. This attack can be
only mounted by users with some trust, but it results in arbitrary
code execution on the master.</p>
<p>SECURITY-162 is rated <strong>critical</strong>. This attack can be
only mounted by users with some trust, but it results in the
exposure of sensitive information.</p>
<p>SECURITY-163 is rated <strong>medium</strong>, as it results in the
loss of functionality.</p>
<p>SECURITY-165 is rated <strong>critical</strong>. This attack is
easy to mount, and it results in the exposure of sensitive
information.</p>
<p>SECURITY-166 is rated <strong>critical</strong>. For users who use
the affected feature, this attack results in arbitrary code
execution on the master.</p>
<p>SECURITY-167 is rated <strong>critical</strong>. This attack is
easy to mount, and it results in the exposure of sensitive information.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27</url>
</references>
<dates>
<discovery>2015-03-01</discovery>
<entry>2015-03-01</entry>
</dates>
</vuln>
<vuln vid="99029172-8253-407d-9d8b-2cfeab9abf81">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>36.0,1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>31.5.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>36.0,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.33</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>31.5.0</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.33</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>31.5.0</lt></range>
</package>
<package>
<name>libxul</name>
<range><lt>31.5.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/">
<p>MFSA-2015-11 Miscellaneous memory safety hazards (rv:36.0
/ rv:31.5)</p>
<p>MFSA-2015-12 Invoking Mozilla updater will load locally
stored DLL files</p>
<p>MFSA-2015-13 Appended period to hostnames can bypass HPKP
and HSTS protections</p>
<p>MFSA-2015-14 Malicious WebGL content crash when writing
strings</p>
<p>MFSA-2015-15 TLS TURN and STUN connections silently fail
to simple TCP connections</p>
<p>MFSA-2015-16 Use-after-free in IndexedDB</p>
<p>MFSA-2015-17 Buffer overflow in libstagefright during MP4
video playback</p>
<p>MFSA-2015-18 Double-free when using non-default memory
allocators with a zero-length XHR</p>
<p>MFSA-2015-19 Out-of-bounds read and write while rendering
SVG content</p>
<p>MFSA-2015-20 Buffer overflow during CSS restyling</p>
<p>MFSA-2015-21 Buffer underflow during MP3 playback</p>
<p>MFSA-2015-22 Crash using DrawTarget in Cairo graphics
library</p>
<p>MFSA-2015-23 Use-after-free in Developer Console date
with OpenType Sanitiser</p>
<p>MFSA-2015-24 Reading of local files through manipulation
of form autocomplete</p>
<p>MFSA-2015-25 Local files or privileged URLs in pages can
be opened into new tabs</p>
<p>MFSA-2015-26 UI Tour whitelisted sites in background tab
can spoof foreground tabs</p>
<p>MFSA-2015-27 Caja Compiler JavaScript sandbox bypass</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0819</cvename>
<cvename>CVE-2015-0820</cvename>
<cvename>CVE-2015-0821</cvename>
<cvename>CVE-2015-0822</cvename>
<cvename>CVE-2015-0823</cvename>
<cvename>CVE-2015-0824</cvename>
<cvename>CVE-2015-0825</cvename>
<cvename>CVE-2015-0826</cvename>
<cvename>CVE-2015-0827</cvename>
<cvename>CVE-2015-0828</cvename>
<cvename>CVE-2015-0829</cvename>
<cvename>CVE-2015-0830</cvename>
<cvename>CVE-2015-0831</cvename>
<cvename>CVE-2015-0832</cvename>
<cvename>CVE-2015-0833</cvename>
<cvename>CVE-2015-0834</cvename>
<cvename>CVE-2015-0835</cvename>
<cvename>CVE-2015-0836</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2015-11/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-12/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-13/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-14/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-15/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-16/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-17/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-18/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-19/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-20/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-21/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-22/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-23/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-24/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-25/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-26/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-27/</url>
<url>https://www.mozilla.org/security/advisories/</url>
</references>
<dates>
<discovery>2015-02-24</discovery>
<entry>2015-02-27</entry>
</dates>
</vuln>
<vuln vid="f7a9e415-bdca-11e4-970c-000c292ee6b8">
<topic>php5 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php5</name>
<range><lt>5.4.38</lt></range>
</package>
<package>
<name>php55</name>
<range><lt>5.5.22</lt></range>
</package>
<package>
<name>php56</name>
<range><lt>5.6.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP Project reports:</p>
<blockquote cite="http://www.php.net/ChangeLog-5.php">
<p>Use after free vulnerability in unserialize() with DateTimeZone.</p>
<p>Mitigation for CVE-2015-0235 -- GHOST: glibc gethostbyname buffer
overflow.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0235</cvename>
<cvename>CVE-2015-0273</cvename>
<url>http://php.net/ChangeLog-5.php#5.4.38</url>
<url>http://php.net/ChangeLog-5.php#5.5.22</url>
<url>http://php.net/ChangeLog-5.php#5.6.6</url>
</references>
<dates>
<discovery>2015-02-18</discovery>
<entry>2015-02-26</entry>
</dates>
</vuln>
<vuln vid="dbf9e66c-bd50-11e4-a7ba-206a8a720317">
<topic>krb5 1.11 -- New release/fix multiple vulnerabilities</topic>
<affects>
<package>
<name>krb5-111</name>
<range><lt>1.11.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The MIT Kerberos team announces the availability of MIT Kerberos 5 Release 1.11.6:</p>
<blockquote cite="http://web.mit.edu/kerberos/krb5-1.11/README-1.11.6.txt">
<p>Handle certain invalid RFC 1964 GSS tokens correctly to avoid
invalid memory reference vulnerabilities. [CVE-2014-4341</p>
<p>Fix memory management vulnerabilities in GSSAPI SPNEGO.
[CVE-2014-4343 CVE-2014-4344]</p>
<p>Fix buffer overflow vulnerability in LDAP KDB back end.
[CVE-2014-4345]</p>
<p>Fix multiple vulnerabilities in the LDAP KDC back end.
[CVE-2014-5354 CVE-2014-5353]</p>
<p>Fix multiple kadmind vulnerabilities, some of which are based
in the gssrpc library. [CVE-2014-5352 CVE-2014-9421
CVE-2014-9422 CVE-2014-9423]</p>
</blockquote>
</body>
</description>
<references>
<url>http://web.mit.edu/kerberos/krb5-1.11/README-1.11.6.txt</url>
</references>
<dates>
<discovery>2015-02-25</discovery>
<entry>2015-02-25</entry>
</dates>
</vuln>
<vuln vid="996c219c-bbb1-11e4-88ae-d050992ecde8">
<topic>samba -- Unexpected code execution in smbd</topic>
<affects>
<package>
<name>samba4</name>
<range><ge>4.0.0</ge><lt>4.0.25</lt></range>
</package>
<package>
<name>samba41</name>
<range><ge>4.1.0</ge><lt>4.1.17</lt></range>
</package>
<package>
<name>samba36</name>
<range><ge>3.6.0</ge><lt>3.6.25</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Samba developement team reports:</p>
<blockquote cite="https://www.samba.org/samba/security/CVE-2015-0240">
<p>All versions of Samba from 3.5.0 to 4.2.0rc4 are
vulnerable to an unexpected code execution vulnerability
in the smbd file server daemon.</p>
<p>A malicious client could send packets that may set up the
stack in such a way that the freeing of memory in a
subsequent anonymous netlogon packet could allow execution
of arbitrary code. This code would execute with root
privileges.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0240</cvename>
<url>https://www.samba.org/samba/security/CVE-2015-0240</url>
</references>
<dates>
<discovery>2015-02-23</discovery>
<entry>2015-02-23</entry>
</dates>
</vuln>
<vuln vid="0f488b7b-bbb9-11e4-903c-080027ef73ec">
<topic>e2fsprogs -- buffer overflow if s_first_meta_bg too big</topic>
<affects>
<package>
<name>e2fsprogs</name>
<range><lt>1.42.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Theodore Ts'o reports:</p>
<blockquote cite="http://git.kernel.org/cgit/fs/ext2/e2fsprogs.git/commit/?id=f66e6ce4">
<p>If s_first_meta_bg is greater than the of number block group descriptor blocks, then reading or writing the block group descriptors will end up overruning the memory buffer allocated for the descriptors.</p>
<p>The finding is credited to a vulnerability report from Jose Duart of Google Security Team &lt;jduart AT google.com&gt; and was reported through oCERT-2015-002.</p>
</blockquote>
</body>
</description>
<references>
<url>http://git.kernel.org/cgit/fs/ext2/e2fsprogs.git/commit/?id=f66e6ce4</url>
<url>http://www.ocert.org/advisories/ocert-2015-002.html</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1187032</url>
<cvename>CVE-2015-0247</cvename>
</references>
<dates>
<discovery>2014-08-09</discovery>
<entry>2015-02-24</entry>
</dates>
</vuln>
<vuln vid="2a4bcd7d-bbb8-11e4-903c-080027ef73ec">
<topic>e2fsprogs -- potential buffer overflow in closefs()</topic>
<affects>
<package>
<name>e2fsprogs</name>
<range><lt>1.42.12_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Theodore Ts'o reports:</p>
<blockquote cite="http://git.kernel.org/cgit/fs/ext2/e2fsprogs.git/commit/?h=maint&amp;id=49d0fe2a14f2a23da2fe299643379b8c1d37df73">
<p>On a carefully crafted filesystem that gets modified through
tune2fs or debugfs, it is possible to trigger a buffer overrun when
the file system is closed via closefs().</p>
</blockquote>
</body>
</description>
<references>
<url>http://git.kernel.org/cgit/fs/ext2/e2fsprogs.git/commit/?h=maint&amp;id=49d0fe2a14f2a23da2fe299643379b8c1d37df73</url>
<cvename>CVE-2015-1572</cvename>
</references>
<dates>
<discovery>2015-02-06</discovery>
<entry>2015-02-24</entry>
</dates>
</vuln>
<vuln vid="58033a95-bba8-11e4-88ae-d050992ecde8">
<topic>bind -- denial of service vulnerability</topic>
<affects>
<package>
<name>bind910</name>
<name>bind910-base</name>
<range><lt>9.10.1P2</lt></range>
</package>
<package>
<name>bind99</name>
<name>bind99-base</name>
<range><lt>9.9.6P2</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><gt>9.3</gt><lt>9.3_10</lt></range>
<range><gt>8.4</gt><lt>8.4_24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01235">
<p>When configured to perform DNSSEC validation, named can
crash when encountering a rare set of conditions in the
managed trust anchors.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1349</cvename>
<url>https://kb.isc.org/article/AA-01235</url>
</references>
<dates>
<discovery>2015-02-18</discovery>
<entry>2015-02-23</entry>
</dates>
</vuln>
<vuln vid="63527d0d-b9de-11e4-8a48-206a8a720317">
<topic>krb5 1.12 -- New release/fix multiple vulnerabilities</topic>
<affects>
<package>
<name>krb5-112</name>
<range><lt>1.12.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The MIT Kerberos team announces the availability of MIT Kerberos 5 Release 1.12.3:</p>
<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt">
<p>Fix multiple vulnerabilities in the LDAP KDC back end.
[CVE-2014-5354] [CVE-2014-5353]</p>
<p>Fix multiple kadmind vulnerabilities, some of which are based
in the gssrpc library. [CVE-2014-5352 CVE-2014-5352
CVE-2014-9421 CVE-2014-9422 CVE-2014-9423]</p>
</blockquote>
</body>
</description>
<references>
<url>http://web.mit.edu/kerberos/krb5-1.12/README-1.12.3.txt</url>
</references>
<dates>
<discovery>2015-02-20</discovery>
<entry>2015-02-21</entry>
</dates>
</vuln>
<vuln vid="3680b234-b6f0-11e4-b7cc-d050992ecde8">
<topic>unzip -- heap based buffer overflow in iconv patch</topic>
<affects>
<package>
<name>unzip</name>
<range><lt>6.0_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ubuntu Security Notice USN-2502-1 reports:</p>
<blockquote cite="http://www.ubuntu.com/usn/usn-2502-1/">
<p>unzip could be made to run programs if it opened a specially crafted file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1315</cvename>
<url>http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-1315.html</url>
<url>https://security-tracker.debian.org/tracker/CVE-2015-1315</url>
<url>http://www.ubuntu.com/usn/usn-2502-1/</url>
</references>
<dates>
<discovery>2015-02-17</discovery>
<entry>2015-02-17</entry>
</dates>
</vuln>
<vuln vid="3a888a1e-b321-11e4-83b2-206a8a720317">
<topic>krb5 -- Vulnerabilities in kadmind, libgssrpc, gss_process_context_token VU#540092</topic>
<affects>
<package>
<name>krb5</name>
<range><lt>1.13.1</lt></range>
</package>
<package>
<name>krb5-112</name>
<range><lt>1.12.2_2</lt></range>
</package>
<package>
<name>krb5-111</name>
<range><lt>1.11.5_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The MIT Kerberos team reports:</p>
<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt">
<p>CVE-2014-5353: The krb5_ldap_get_password_policy_from_dn
function in plugins/kdb/ldap/libkdb_ldap/ldap_pwd_policy.c in
MIT Kerberos 5 (aka krb5) before 1.13.1, when the KDC uses LDAP,
allows remote authenticated users to cause a denial of service
(daemon crash) via a successful LDAP query with no results, as
demonstrated by using an incorrect object type for a password
policy.</p>
<p>CVE-2014-5354: plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in
MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.1, when
the KDC uses LDAP, allows remote authenticated users to cause a
denial of service (NULL pointer dereference and daemon crash) by
creating a database entry for a keyless principal, as
demonstrated by a kadmin "add_principal -nokey" or "purgekeys
-all" command.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-5353</cvename>
<cvename>CVE-2014-5354</cvename>
<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt</url>
</references>
<dates>
<discovery>2015-02-12</discovery>
<entry>2015-02-12</entry>
<modified>2015-02-13</modified>
</dates>
</vuln>
<vuln vid="54a69cf7-b2ef-11e4-b1f1-bcaec565249c">
<topic>xorg-server -- Information leak in the XkbSetGeometry request of X servers.</topic>
<affects>
<package>
<name>xorg-server</name>
<range><lt>1.14.7_2,1</lt></range>
</package>
<package>
<name>xorg-server</name>
<range><ge>1.15.0,1</ge><lt>1.16.4,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Peter Hutterer reports:</p>
<blockquote cite="http://lists.freedesktop.org/archives/xorg/2015-February/057158.html">
<p>Olivier Fourdan from Red Hat has discovered a protocol handling
issue in the way the X server code base handles the XkbSetGeometry
request.</p>
<p>The issue stems from the server trusting the client to send valid
string lengths in the request data. A malicious client with string
lengths exceeding the request length can cause the server to copy
adjacent memory data into the XKB structs. This data is then
available to the client via the XkbGetGeometry request. The
data length is at least up to 64k, it is possible to obtain
more data by chaining strings, each string length is then
determined by whatever happens to be in that 16-bit region of
memory.</p>
<p>A similarly crafted request can likely cause the X server
to crash.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0255</cvename>
<url>http://lists.freedesktop.org/archives/xorg/2015-February/057158.html</url>
</references>
<dates>
<discovery>2015-02-10</discovery>
<entry>2015-02-12</entry>
</dates>
</vuln>
<vuln vid="a0c45e53-ae51-11e4-8ac7-d050992ecde8">
<topic>openldap -- two remote denial of service vulnerabilities</topic>
<affects>
<package>
<name>openldap-server</name>
<range><lt>2.4.40_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ryan Tandy reports:</p>
<blockquote cite="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776988">
<p>With the deref overlay enabled, ldapsearch with '-E deref=member:'
causes slapd to crash.</p>
</blockquote>
<blockquote cite="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776991">
<p>Bill MacAllister discovered that certain queries cause slapd
to crash while freeing operation controls. This is a 2.4.40 regression.
Earlier releases are not affected.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776988</url>
<url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776991</url>
</references>
<dates>
<discovery>2015-02-02</discovery>
<entry>2015-02-06</entry>
</dates>
</vuln>
<vuln vid="a6eb239f-adbe-11e4-9fce-080027593b9a">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>40.0.2214.111</lt></range>
</package>
<package>
<name>chromium-pulse</name>
<range><lt>40.0.2214.111</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl">
<p>11 security fixes in this release, including:</p>
<ul>
<li>[447906] High CVE-2015-1209: Use-after-free in DOM. Credit to
Maksymillian.</li>
<li>[453979] High CVE-2015-1210: Cross-origin-bypass in V8
bindings. Credit to anonymous.</li>
<li>[453982] High CVE-2015-1211: Privilege escalation using service
workers. Credit to anonymous.</li>
<li>[455225] CVE-2015-1212: Various fixes from internal audits,
fuzzing and other initiatives.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1209</cvename>
<cvename>CVE-2015-1210</cvename>
<cvename>CVE-2015-1211</cvename>
<cvename>CVE-2015-1212</cvename>
<url>http://googlechromereleases.blogspot.nl</url>
</references>
<dates>
<discovery>2015-02-05</discovery>
<entry>2015-02-06</entry>
</dates>
</vuln>
<vuln vid="3b40bf2c-ad83-11e4-a2b2-0026551a22dc">
<topic>PostgreSQL -- multiple buffer overflows and memory issues</topic>
<affects>
<package>
<name>postgresql90-server</name>
<range><ge>9.0.0</ge><lt>9.0.19</lt></range>
</package>
<package>
<name>postgresql91-server</name>
<range><ge>9.1.0</ge><lt>9.1.15</lt></range>
</package>
<package>
<name>postgresql92-server</name>
<range><ge>9.2.0</ge><lt>9.2.10</lt></range>
</package>
<package>
<name>postgresql93-server</name>
<range><ge>9.3.0</ge><lt>9.3.6</lt></range>
</package>
<package>
<name>postgresql94-server</name>
<range><ge>9.4.0</ge><lt>9.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PostgreSQL Project reports:</p>
<blockquote cite="http://www.postgresql.org/about/news/1569/">
<p>This update fixes multiple security issues reported in PostgreSQL
over the past few months. All of these issues require prior
authentication, and some require additional conditions, and as such
are not considered generally urgent. However, users should examine
the list of security holes patched below in case they are particularly
vulnerable.</p>
<ol>
<li>CVE-2015-0241 Buffer overruns in "to_char" functions.</li>
<li>CVE-2015-0242 Buffer overrun in replacement printf family of
functions.</li>
<li>CVE-2015-0243 Memory errors in functions in the pgcrypto extension.</li>
<li>CVE-2015-0244 An error in extended protocol message reading.</li>
<li>CVE-2014-8161 Constraint violation errors can cause display of values in columns
which the user would not normally have rights to see.</li>
</ol>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0241</cvename>
<cvename>CVE-2015-0242</cvename>
<cvename>CVE-2015-0243</cvename>
<cvename>CVE-2015-0244</cvename>
<cvename>CVE-2014-8161</cvename>
</references>
<dates>
<discovery>2015-02-05</discovery>
<entry>2015-02-05</entry>
</dates>
</vuln>
<vuln vid="24ce5597-acab-11e4-a847-206a8a720317">
<topic>krb5 -- Vulnerabilities in kadmind, libgssrpc, gss_process_context_token VU#540092</topic>
<affects>
<package>
<name>krb5</name>
<range><lt>1.13_1</lt></range>
</package>
<package>
<name>krb5-112</name>
<range><lt>1.12.2_1</lt></range>
</package>
<package>
<name>krb5-111</name>
<range><lt>1.11.5_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SO-AND-SO reports:</p>
<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt">
<p>CVE-2014-5352: In the MIT krb5 libgssapi_krb5 library, after
gss_process_context_token() is used to process a valid context
deletion token, the caller is left with a security context handle
containing a dangling pointer. Further uses of this handle will
result in use-after-free and double-free memory access violations.
libgssrpc server applications such as kadmind are vulnerable as
they can be instructed to call gss_process_context_token().</p>
<p>CVE-2014-9421: If the MIT krb5 kadmind daemon receives invalid XDR
data from an authenticated user, it may perform use-after-free and
double-free memory access violations while cleaning up the partial
deserialization results. Other libgssrpc server applications may
also be vulnerable if they contain insufficiently defensive XDR
functions.</p>
<p>CVE-2014-9422: The MIT krb5 kadmind daemon incorrectly accepts
authentications to two-component server principals whose first
component is a left substring of "kadmin" or whose realm is a left
prefix of the default realm.</p>
<p>CVE-2014-9423: libgssrpc applications including kadmind output
four or eight bytes of uninitialized memory to the network as
part of an unused "handle" field in replies to clients.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-5352</cvename>
<cvename>CVE-2014-9421</cvename>
<cvename>CVE-2014-9422</cvename>
<cvename>CVE-2014-9423</cvename>
<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt</url>
</references>
<dates>
<discovery>2015-02-03</discovery>
<entry>2015-02-04</entry>
</dates>
</vuln>
<vuln vid="e543c6f8-abf2-11e4-8ac7-d050992ecde8">
<topic>unzip -- out of boundary access issues in test_compr_eb</topic>
<affects>
<package>
<name>unzip</name>
<range><lt>6.0_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ubuntu Security Notice USN-2489-1 reports:</p>
<blockquote cite="http://www.ubuntu.com/usn/usn-2489-1/">
<p>Michal Zalewski discovered that unzip incorrectly handled
certain malformed zip archives. If a user or automated system
were tricked into processing a specially crafted zip archive,
an attacker could possibly execute arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-9636</cvename>
<url>http://www.ubuntu.com/usn/usn-2489-1/</url>
<url>http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-9636.html</url>
<url>http://seclists.org/oss-sec/2014/q4/489</url>
<url>http://www.info-zip.org/phpBB3/viewtopic.php?f=7&amp;t=450</url>
</references>
<dates>
<discovery>2014-11-02</discovery>
<entry>2015-02-03</entry>
</dates>
</vuln>
<vuln vid="1c7cfd05-aaee-11e4-83b4-14dae9d210b8">
<topic>Xymon -- buffer overrun</topic>
<affects>
<package>
<name>xymon-server</name>
<range><ge>4.3.4</ge><lt>4.3.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Debian reports:</p>
<blockquote cite="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776007">
<p>web/acknowledge.c uses a string twice in a format string, but only
allocates memory for one copy.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2015/01/31/4</url>
<url>https://security-tracker.debian.org/tracker/CVE-2015-1430</url>
<cvename>CVE-2015-1430</cvename>
</references>
<dates>
<discovery>2014-09-28</discovery>
<entry>2015-02-02</entry>
</dates>
</vuln>
<vuln vid="8469d41c-a960-11e4-b18e-bcaec55be5e5">
<topic>rabbitmq -- Security issues in management plugin</topic>
<affects>
<package>
<name>rabbitmq</name>
<range><lt>3.4.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The RabbitMQ project reports:</p>
<blockquote cite="http://www.rabbitmq.com/news.html#2015-01-08T10:14:05+0100">
<p>Some user-controllable content was not properly HTML-escaped
before being presented to a user in the management web UI:</p>
<ul>
<li>When a user unqueued a message from the management UI,
message details (header names, arguments, etc.) were displayed
unescaped. An attacker could publish a specially crafted
message to add content or execute arbitrary Javascript code on
behalf of a user, if this user unqueued the message from the
management UI.</li>
<li>When viewing policies, their name was displayed unescaped.
An attacker could create a policy with a specially crafted name
to add content or execute arbitrary Javascript code on behalf
of a user who is viewing policies.</li>
<li>When listing connected AMQP network clients, client details
such as its version were displayed unescaped. An attacker could
use a client with a specially crafted version field to add
content or execute arbitrary Javascript code on behalf of a
user who is viewing connected clients.</li>
</ul>
<p>In all cases, the attacker needs a valid user account on the
targetted RabbitMQ cluster.</p>
<p>Furthermore, some admin-controllable content was not properly
escaped:</p>
<ul>
<li>user names;</li>
<li>the cluster name.</li>
</ul>
<p>Likewise, an attacker could add content or execute arbitrary
Javascript code on behalf of a user using the management web UI.
However, the attacker must be an administrator on the RabbitMQ
cluster, thus a trusted user.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.rabbitmq.com/news.html#2015-01-08T10:14:05+0100</url>
<url>http://www.rabbitmq.com/release-notes/README-3.4.3.txt</url>
<cvename>CVE-2015-0862</cvename>
</references>
<dates>
<discovery>2015-01-08</discovery>
<entry>2015-01-31</entry>
</dates>
</vuln>
<vuln vid="5804b9d4-a959-11e4-9363-20cf30e32f6d">
<topic>apache24 -- several vulnerabilities</topic>
<affects>
<package>
<name>apache24</name>
<range><lt>2.4.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Apache HTTP SERVER PROJECT reports:</h1>
<blockquote cite="http://www.apache.org/dist/httpd/Announcement2.4.html">
<p>mod_proxy_fcgi: Fix a potential crash due to buffer over-read,
with response headers' size above 8K.</p>
<p>mod_cache: Avoid a crash when Content-Type has an empty value. PR 56924.</p>
<p>mod_lua: Fix handling of the Require line when a LuaAuthzProvider is used
in multiple Require directives with different arguments. PR57204.</p>
<p>core: HTTP trailers could be used to replace HTTP headers late during
request processing, potentially undoing or otherwise confusing modules
that examined or modified request headers earlier. Adds "MergeTrailers"
directive to restore legacy behavior.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3583</cvename>
<cvename>CVE-2014-3581</cvename>
<cvename>CVE-2014-8109</cvename>
<cvename>CVE-2013-5704</cvename>
</references>
<dates>
<discovery>2015-01-29</discovery>
<entry>2015-01-31</entry>
</dates>
</vuln>
<vuln vid="7656fc62-a7a7-11e4-96ba-001999f8d30b">
<topic>asterisk -- Mitigation for libcURL HTTP request injection vulnerability</topic>
<affects>
<package>
<name>asterisk</name>
<range><lt>1.8.32.2</lt></range>
</package>
<package>
<name>asterisk11</name>
<range><lt>11.15.1</lt></range>
</package>
<package>
<name>asterisk13</name>
<range><lt>13.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>CVE-2014-8150 reported an HTTP request injection
vulnerability in libcURL. Asterisk uses libcURL in its
func_curl.so module (the CURL() dialplan function), as
well as its res_config_curl.so (cURL realtime backend)
modules.</p>
<p>Since Asterisk may be configured to allow for user-supplied
URLs to be passed to libcURL, it is possible that an
attacker could use Asterisk as an attack vector to inject
unauthorized HTTP requests if the version of libcURL
installed on the Asterisk server is affected by
CVE-2014-8150.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2015-002.html</url>
</references>
<dates>
<discovery>2015-01-12</discovery>
<entry>2015-01-29</entry>
</dates>
</vuln>
<vuln vid="2eeb6652-a7a6-11e4-96ba-001999f8d30b">
<topic>asterisk -- File descriptor leak when incompatible codecs are offered</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>Asterisk may be configured to only allow specific audio
or video codecs to be used when communicating with a
particular endpoint. When an endpoint sends an SDP offer
that only lists codecs not allowed by Asterisk, the offer
is rejected. However, in this case, RTP ports that are
allocated in the process are not reclaimed.</p>
<p>This issue only affects the PJSIP channel driver in
Asterisk. Users of the chan_sip channel driver are not
affected.</p>
<p>As the resources are allocated after authentication,
this issue only affects communications with authenticated
endpoints.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2015-001.html</url>
<cvename>CVE-2015-1558</cvename>
</references>
<dates>
<discovery>2015-01-06</discovery>
<entry>2015-01-29</entry>
<modified>2015-02-17</modified>
</dates>
</vuln>
<vuln vid="0765de84-a6c1-11e4-a0c1-c485083ca99c">
<topic>glibc -- gethostbyname buffer overflow</topic>
<affects>
<package>
<name>linux_base-c6</name>
<range><lt>6.6_2</lt></range>
</package>
<package>
<name>linux_base-f10</name>
<range><ge>0</ge></range>
</package>
<package>
<name>linux-c6-devtools</name>
<range><lt>6.6_3</lt></range>
</package>
<package>
<name>linux-f10-devtools</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Robert Krátký reports:</p>
<blockquote cite="https://access.redhat.com/discussions/1332403">
<p>
GHOST is a 'buffer overflow' bug affecting the gethostbyname() and
gethostbyname2() function calls in the glibc library. This
vulnerability allows a remote attacker that is able to make an
application call to either of these functions to execute arbitrary
code with the permissions of the user running the application.
The gethostbyname() function calls are used for DNS resolving, which
is a very common event. To exploit this vulnerability, an attacker
must trigger a buffer overflow by supplying an invalid hostname
argument to an application that performs a DNS resolution.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0235</cvename>
<url>https://access.redhat.com/articles/1332213</url>
<url>http://www.openwall.com/lists/oss-security/2015/01/27/9</url>
</references>
<dates>
<discovery>2015-01-27</discovery>
<entry>2015-01-28</entry>
<modified>2015-02-02</modified>
</dates>
</vuln>
<vuln vid="37a87ade-a59f-11e4-958e-0011d823eebd">
<topic>Adobe Flash Player -- critical vulnerability</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<range><le>11.2r202.438</le></range>
</package>
<package>
<name>linux-f10-flashplugin</name>
<range><le>11.2r202.438</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsa15-01.html">
<p>Successful exploitation could cause a crash and potentially allow
an attacker to take control of the affected system. We are aware
of reports that this vulnerability is being actively exploited in
the wild via drive-by-download attacks against systems running
Internet Explorer and Firefox on Windows 8.1 and below.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0311</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsa15-01.html</url>
</references>
<dates>
<discovery>2015-01-22</discovery>
<entry>2015-01-26</entry>
</dates>
</vuln>
<vuln vid="dc2d76df-a595-11e4-9363-20cf30e32f6d">
<topic>Bugzilla multiple security issues</topic>
<affects>
<package>
<name>bugzilla44</name>
<range><lt>4.4.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Bugzilla Security Advisory</p>
<blockquote cite="http://www.bugzilla.org/security/4.0.15/">
<h5>Command Injection</h5>
<p>Some code in Bugzilla does not properly utilize 3 arguments form
for open() and it is possible for an account with editcomponents
permissions to inject commands into product names and other
attributes.</p>
<h5>Information Leak</h5>
<p>Using the WebServices API, a user can possibly execute imported
functions from other non-WebService modules. A whitelist has now
been added that lists explicit methods that can be executed via the
API.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-8630</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=1079065</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=1090275</url>
</references>
<dates>
<discovery>2015-01-21</discovery>
<entry>2015-01-26</entry>
</dates>
</vuln>
<vuln vid="9c7b6c20-a324-11e4-879c-00e0814cab4e">
<topic>django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py27-django</name>
<range><ge>1.4</ge><lt>1.4.18</lt></range>
<range><ge>1.5</ge><le>1.5.12</le></range>
<range><ge>1.6</ge><lt>1.6.10</lt></range>
<range><ge>1.7</ge><lt>1.7.3</lt></range>
</package>
<package>
<name>py32-django</name>
<range><ge>1.4</ge><lt>1.4.18</lt></range>
<range><ge>1.5</ge><le>1.5.12</le></range>
<range><ge>1.6</ge><lt>1.6.10</lt></range>
<range><ge>1.7</ge><lt>1.7.3</lt></range>
</package>
<package>
<name>py33-django</name>
<range><ge>1.4</ge><lt>1.4.18</lt></range>
<range><ge>1.5</ge><le>1.5.12</le></range>
<range><ge>1.6</ge><lt>1.6.10</lt></range>
<range><ge>1.7</ge><lt>1.7.3</lt></range>
</package>
<package>
<name>py34-django</name>
<range><ge>1.4</ge><lt>1.4.18</lt></range>
<range><ge>1.5</ge><le>1.5.12</le></range>
<range><ge>1.6</ge><lt>1.6.10</lt></range>
<range><ge>1.7</ge><lt>1.7.3</lt></range>
</package>
<package>
<name>py27-django-devel</name>
<range><lt>20150124,1</lt></range>
</package>
<package>
<name>py32-django-devel</name>
<range><lt>20150124,1</lt></range>
</package>
<package>
<name>py33-django-devel</name>
<range><lt>20150124,1</lt></range>
</package>
<package>
<name>py34-django-devel</name>
<range><lt>20150124,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Django project reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2015/jan/13/security/">
<p>Today the Django team is issuing multiple releases --
Django 1.4.18, Django 1.6.10, and Django 1.7.3 -- as part of our
security process. These releases are now available on PyPI and our
download page.</p>
<p>These releases address several security issues. We encourage all
users of Django to upgrade as soon as possible.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.djangoproject.com/weblog/2015/jan/13/security/</url>
<cvename>CVE-2015-0219</cvename>
<cvename>CVE-2015-0220</cvename>
<cvename>CVE-2015-0221</cvename>
<cvename>CVE-2015-0222</cvename>
</references>
<dates>
<discovery>2015-01-13</discovery>
<entry>2015-01-23</entry>
<modified>2015-01-24</modified>
</dates>
</vuln>
<vuln vid="0523fb7e-8444-4e86-812d-8de05f6f0dce">
<topic>libutp -- remote denial of service or arbitrary code execution</topic>
<affects>
<package>
<name>bittorrent-libutp</name>
<range><lt>0.20130514_1</lt></range>
</package>
<package>
<name>transmission-cli</name>
<name>transmission-deamon</name>
<name>transmission-gtk</name>
<name>transmission-qt4</name>
<range><lt>2.74</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-6129">
<p>Stack-based buffer overflow in utp.cpp in libutp, as used
in Transmission before 2.74 and possibly other products,
allows remote attackers to cause a denial of service (crash)
and possibly execute arbitrary code via crafted "micro
transport protocol packets."</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-6129</cvename>
<url>https://github.com/bittorrent/libutp/issues/38</url>
<url>https://trac.transmissionbt.com/ticket/5002</url>
</references>
<dates>
<discovery>2012-08-01</discovery>
<entry>2014-12-29</entry>
</dates>
</vuln>
<vuln vid="f9c388c5-a256-11e4-992a-7b2a515a1247">
<topic>LibreSSL -- DTLS vulnerability</topic>
<affects>
<package>
<name>libressl</name>
<range><lt>2.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSSL Security Advisory:</p>
<blockquote cite="https://www.openssl.org/news/secadv_20150108.txt">
<p>
A memory leak can occur in the dtls1_buffer_record function under certain
conditions. In particular this could occur if an attacker sent repeated DTLS
records with the same sequence number but for the next epoch. The memory leak
could be exploited by an attacker in a Denial of Service attack through memory
exhaustion.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0206</cvename>
<url>https://www.openssl.org/news/secadv_20150108.txt</url>
</references>
<dates>
<discovery>2015-01-08</discovery>
<entry>2015-01-22</entry>
</dates>
</vuln>
<vuln vid="cc294a2c-a232-11e4-8e9f-0011d823eebd">
<topic>Adobe Flash Player -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<range><lt>11.2r202.429</lt></range>
</package>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.429</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="http://helpx.adobe.com/security/products/flash-player/apsb15-01.html">
<p>These updates address vulnerabilities that could potentially allow
an attacker to take control of the affected system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0301</cvename>
<cvename>CVE-2015-0302</cvename>
<cvename>CVE-2015-0303</cvename>
<cvename>CVE-2015-0304</cvename>
<cvename>CVE-2015-0305</cvename>
<cvename>CVE-2015-0306</cvename>
<cvename>CVE-2015-0307</cvename>
<cvename>CVE-2015-0308</cvename>
<cvename>CVE-2015-0309</cvename>
<url>http://helpx.adobe.com/security/products/flash-player/apsb15-01.html</url>
</references>
<dates>
<discovery>2015-01-13</discovery>
<entry>2015-01-22</entry>
</dates>
</vuln>
<vuln vid="e30e0c99-a1b7-11e4-b85c-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>40.0.2214.91</lt></range>
</package>
<package>
<name>chromium-pulse</name>
<range><lt>40.0.2214.91</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/">
<p>62 security fixes in this release, including:</p>
<ul>
<li>[430353] High CVE-2014-7923: Memory corruption in ICU. Credit
to yangdingning.</li>
<li>[435880] High CVE-2014-7924: Use-after-free in IndexedDB.
Credit to Collin Payne.</li>
<li>[434136] High CVE-2014-7925: Use-after-free in WebAudio. Credit
to mark.buer.</li>
<li>[422824] High CVE-2014-7926: Memory corruption in ICU. Credit
to yangdingning.</li>
<li>[444695] High CVE-2014-7927: Memory corruption in V8. Credit to
Christian Holler.</li>
<li>[435073] High CVE-2014-7928: Memory corruption in V8. Credit to
Christian Holler.</li>
<li>[442806] High CVE-2014-7930: Use-after-free in DOM. Credit to
cloudfuzzer.</li>
<li>[442710] High CVE-2014-7931: Memory corruption in V8. Credit to
cloudfuzzer.</li>
<li>[443115] High CVE-2014-7929: Use-after-free in DOM. Credit to
cloudfuzzer.</li>
<li>[429666] High CVE-2014-7932: Use-after-free in DOM. Credit to
Atte Kettunen of OUSPG.</li>
<li>[427266] High CVE-2014-7933: Use-after-free in FFmpeg. Credit
to aohelin.</li>
<li>[427249] High CVE-2014-7934: Use-after-free in DOM. Credit to
cloudfuzzer.</li>
<li>[402957] High CVE-2014-7935: Use-after-free in Speech. Credit
to Khalil Zhani.</li>
<li>[428561] High CVE-2014-7936: Use-after-free in Views. Credit
to Christoph Diehl.</li>
<li>[419060] High CVE-2014-7937: Use-after-free in FFmpeg. Credit
to Atte Kettunen of OUSPG.</li>
<li>[416323] High CVE-2014-7938: Memory corruption in Fonts. Credit
to Atte Kettunen of OUSPG.</li>
<li>[399951] High CVE-2014-7939: Same-origin-bypass in V8. Credit
to Takeshi Terada.</li>
<li>[433866] Medium CVE-2014-7940: Uninitialized-value in ICU.
Credit to miaubiz.</li>
<li>[428557] Medium CVE-2014-7941: Out-of-bounds read in UI. Credit
to Atte Kettunen of OUSPG and Christoph Diehl.</li>
<li>[426762] Medium CVE-2014-7942: Uninitialized-value in Fonts.
Credit to miaubiz.</li>
<li>[422492] Medium CVE-2014-7943: Out-of-bounds read in Skia.
Credit to Atte Kettunen of OUSPG.</li>
<li>[418881] Medium CVE-2014-7944: Out-of-bounds read in PDFium.
Credit to cloudfuzzer.</li>
<li>[414310] Medium CVE-2014-7945: Out-of-bounds read in PDFium.
Credit to cloudfuzzer.</li>
<li>[414109] Medium CVE-2014-7946: Out-of-bounds read in Fonts.
Credit to miaubiz.</li>
<li>[430566] Medium CVE-2014-7947: Out-of-bounds read in PDFium.
Credit to fuzztercluck.</li>
<li>[414026] Medium CVE-2014-7948: Caching error in AppCache.
Credit to jiayaoqijia.</li>
<li>[449894] CVE-2015-1205: Various fixes from internal audits,
fuzzing and other initiatives.</li>
<li>Multiple vulnerabilities in V8 fixed at the tip of the 3.30
branch (currently 3.30.33.15).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-7923</cvename>
<cvename>CVE-2014-7924</cvename>
<cvename>CVE-2014-7925</cvename>
<cvename>CVE-2014-7926</cvename>
<cvename>CVE-2014-7927</cvename>
<cvename>CVE-2014-7928</cvename>
<cvename>CVE-2014-7929</cvename>
<cvename>CVE-2014-7930</cvename>
<cvename>CVE-2014-7931</cvename>
<cvename>CVE-2014-7932</cvename>
<cvename>CVE-2014-7933</cvename>
<cvename>CVE-2014-7934</cvename>
<cvename>CVE-2014-7935</cvename>
<cvename>CVE-2014-7936</cvename>
<cvename>CVE-2014-7937</cvename>
<cvename>CVE-2014-7938</cvename>
<cvename>CVE-2014-7939</cvename>
<cvename>CVE-2014-7940</cvename>
<cvename>CVE-2014-7941</cvename>
<cvename>CVE-2014-7942</cvename>
<cvename>CVE-2014-7943</cvename>
<cvename>CVE-2014-7944</cvename>
<cvename>CVE-2014-7945</cvename>
<cvename>CVE-2014-7946</cvename>
<cvename>CVE-2014-7947</cvename>
<cvename>CVE-2014-7948</cvename>
<cvename>CVE-2015-1205</cvename>
<url>http://googlechromereleases.blogspot.nl</url>
</references>
<dates>
<discovery>2015-01-21</discovery>
<entry>2015-01-21</entry>
</dates>
</vuln>
<vuln vid="a5856eba-a015-11e4-a680-1c6f65c3c4ff">
<topic>polarssl -- Remote attack using crafted certificates</topic>
<affects>
<package>
<name>polarssl</name>
<range><ge>1.2.0</ge><lt>1.2.12_1</lt></range>
</package>
<package>
<name>polarssl13</name>
<range><ge>1.3.0</ge><lt>1.3.9_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PolarSSL team reports:</p>
<blockquote cite="https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2014-04">
<p>During the parsing of a ASN.1 sequence, a pointer in the linked list of asn1_sequence is not
initialized by asn1_get_sequence_of(). In case an error occurs during parsing of the list, a
situation is created where the uninitialized pointer is passed to polarssl_free().</p>
<p>This sequence can be triggered when a PolarSSL entity is parsing a certificate. So practically this
means clients when receiving a certificate from the server or servers in case they are actively
asking for a client certificate.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1182</cvename>
<url>https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2014-04</url>
<url>https://www.certifiedsecure.com/polarssl-advisory/</url>
</references>
<dates>
<discovery>2015-01-14</discovery>
<entry>2015-01-19</entry>
</dates>
</vuln>
<vuln vid="d9360908-9d52-11e4-87fd-10bf48e1088e">
<topic>unzip -- input sanitization errors</topic>
<affects>
<package>
<name>unzip</name>
<range><le>6.0_2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>oCERT reports:</p>
<blockquote cite="http://www.ocert.org/advisories/ocert-2014-011.html">
<p>The UnZip tool is an open source extraction utility for archives
compressed in the zip format.</p>
<p>The unzip command line tool is affected by heap-based buffer
overflows within the CRC32 verification, the test_compr_eb() and
the getZip64Data() functions. The input errors may result in
arbitrary code execution.</p>
<p>A specially crafted zip file, passed to unzip -t, can be used to
trigger the vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-8139</cvename>
<cvename>CVE-2014-8140</cvename>
<cvename>CVE-2014-8141</cvename>
<url>http://www.info-zip.org/UnZip.html</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1174844</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-8140</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1174856</url>
</references>
<dates>
<discovery>2014-12-03</discovery>
<entry>2015-01-16</entry>
</dates>
</vuln>
<vuln vid="d4f45676-9d33-11e4-8275-000c292e4fd8">
<topic>samba -- Elevation of privilege to Active Directory Domain Controller</topic>
<affects>
<package>
<name>samba4</name>
<range><ge>4.0.0</ge><lt>4.0.23</lt></range>
</package>
<package>
<name>samba41</name>
<range><ge>4.1.0</ge><lt>4.1.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Samba team reports:</p>
<blockquote cite="https://www.samba.org/samba/security/CVE-2014-8143">
<p>In Samba's AD DC we neglected to ensure that
attempted modifications of the userAccountControl attribute
did not allow the UF_SERVER_TRUST_ACCOUNT bit to be set.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-8143</cvename>
<url>https://www.samba.org/samba/security/CVE-2014-8143</url>
</references>
<dates>
<discovery>2015-01-15</discovery>
<entry>2015-01-16</entry>
</dates>
</vuln>
<vuln vid="7a8a74d1-9c34-11e4-a40b-5453ed2e2b49">
<topic>kde-runtime -- incorrect CBC encryption handling</topic>
<affects>
<package>
<name>kde-runtime</name>
<range><lt>4.12_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Valentin Rusu reports:</p>
<blockquote cite="https://www.kde.org/info/security/advisory-20150109-1.txt">
<p>Until KDE Applications 14.12.0, kwalletd incorrectly handled CBC
encryption blocks when encrypting secrets in kwl files. The secrets
were still encrypted, but the result binary data corresponded to an
ECB encrypted block instead of CBC.</p>
<p>The ECB encryption algorithm, even if it'll scramble user data,
will produce same encrypted byte sequence for the same input text.
As a result, attackers may eventually find-out the encrypted
text.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-7252</cvename>
<url>https://www.kde.org/info/security/advisory-20150109-1.txt</url>
</references>
<dates>
<discovery>2015-01-09</discovery>
<entry>2015-01-14</entry>
</dates>
</vuln>
<vuln vid="bd62c640-9bb9-11e4-a5ad-000c297fb80f">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>35.0,1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>31.4.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>35.0,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.32</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>31.4.0</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.32</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>31.4.0</lt></range>
</package>
<package>
<name>libxul</name>
<range><lt>31.4.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/">
<p>MFSA-2015-01 Miscellaneous memory safety hazards (rv:35.0
/ rv:31.4)</p>
<p>MFSA-2015-02 Uninitialized memory use during bitmap
rendering</p>
<p>MFSA-2015-03 sendBeacon requests lack an Origin header</p>
<p>MFSA-2015-04 Cookie injection through Proxy Authenticate
responses</p>
<p>MFSA-2015-05 Read of uninitialized memory in Web Audio</p>
<p>MFSA-2015-06 Read-after-free in WebRTC</p>
<p>MFSA-2015-07 Gecko Media Plugin sandbox escape</p>
<p>MFSA-2015-08 Delegated OCSP responder certificates failure
with id-pkix-ocsp-nocheck extension</p>
<p>MFSA-2015-09 XrayWrapper bypass through DOM objects</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-8634</cvename>
<cvename>CVE-2014-8635</cvename>
<cvename>CVE-2014-8637</cvename>
<cvename>CVE-2014-8638</cvename>
<cvename>CVE-2014-8639</cvename>
<cvename>CVE-2014-8640</cvename>
<cvename>CVE-2014-8641</cvename>
<cvename>CVE-2014-8642</cvename>
<cvename>CVE-2014-8643</cvename>
<cvename>CVE-2014-8636</cvename>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-01/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-02/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-03/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-04/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-05/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-06/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-07/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-08/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-09/</url>
<url>https://www.mozilla.org/security/advisories/</url>
</references>
<dates>
<discovery>2015-01-13</discovery>
<entry>2015-01-14</entry>
</dates>
</vuln>
<vuln vid="daa8a49b-99b9-11e4-8f66-3085a9a4510d">
<topic>libevent -- integer overflow in evbuffers</topic>
<affects>
<package>
<name>libevent</name>
<range><lt>1.4.15</lt></range>
</package>
<package>
<name>libevent2</name>
<range><lt>2.0.22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Debian Security Team reports:</p>
<blockquote cite="https://www.debian.org/security/2015/dsa-3119">
<p>Andrew Bartlett of Catalyst reported a defect affecting certain
applications using the Libevent evbuffer API. This defect leaves
applications which pass insanely large inputs to evbuffers open
to a possible heap overflow or infinite loop. In order to exploit
this flaw, an attacker needs to be able to find a way to provoke
the program into trying to make a buffer chunk larger than what
will fit into a single size_t or off_t.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-6272</cvename>
<url>https://www.debian.org/security/2015/dsa-3119</url>
</references>
<dates>
<discovery>2015-01-05</discovery>
<entry>2015-01-11</entry>
</dates>
</vuln>
<vuln vid="caa98ffd-0a92-40d0-b234-fd79b429157e">
<topic>cURL -- URL request injection vulnerability</topic>
<affects>
<package>
<name>curl</name>
<range><lt>7.40.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cURL reports:</p>
<blockquote cite="http://curl.haxx.se/docs/adv_20150108B.html">
<p>When libcurl sends a request to a server via a HTTP proxy, it
copies the entire URL into the request and sends if off.
If the given URL contains line feeds and carriage returns those will
be sent along to the proxy too, which allows the program to for
example send a separate HTTP request injected embedded in the URL.
Many programs allow some kind of external sources to set the URL or
provide partial pieces for the URL to ask for, and if the URL as
received from the user is not stripped good enough this flaw allows
malicious users to do additional requests in a way that was not
intended, or just to insert request headers into the request that
the program didn't intend.
We are not aware of any exploit of this flaw.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-8150</cvename>
<url>http://curl.haxx.se/docs/adv_20150108B.html</url>
</references>
<dates>
<discovery>2014-12-25</discovery>
<entry>2015-01-09</entry>
</dates>
</vuln>
<vuln vid="e9ccdb28-9802-11e4-9d9c-bcaec565249c">
<topic>WebKit-gtk -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>webkit-gtk2</name>
<range><lt>1.4.8</lt></range>
</package>
<package>
<name>webkit-gtk3</name>
<range><lt>1.4.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Webkit release team reports:</p>
<blockquote cite="http://webkitgtk.org/2015/01/07/webkitgtk2.4.8-released.html">
<p>This release fixes the following security issues:
CVE-2014-1344, CVE-2014-1384, CVE-2014-1385, CVE-2014-1386,
CVE-2014-1387, CVE-2014-1388, CVE-2014-1389, CVE-2014-1390.</p>
</blockquote>
</body>
</description>
<references>
<url>http://webkitgtk.org/2015/01/07/webkitgtk2.4.8-released.html</url>
<cvename>CVE-2014-1344</cvename>
<cvename>CVE-2014-1384</cvename>
<cvename>CVE-2014-1385</cvename>
<cvename>CVE-2014-1386</cvename>
<cvename>CVE-2014-1387</cvename>
<cvename>CVE-2014-1388</cvename>
<cvename>CVE-2014-1389</cvename>
<cvename>CVE-2014-1390</cvename>
</references>
<dates>
<discovery>2015-01-07</discovery>
<entry>2015-01-09</entry>
</dates>
</vuln>
<vuln vid="4e536c14-9791-11e4-977d-d050992ecde8">
<topic>OpenSSL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><ge>1.0.1</ge><lt>1.0.1_17</lt></range>
</package>
<package>
<name>mingw32-openssl</name>
<range><ge>1.0.1</ge><lt>1.0.1k</lt></range>
</package>
<package>
<name>linux-c6-openssl</name>
<range><lt>1.0.1e_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv_20150108.txt">
<p>DTLS segmentation fault in dtls1_get_record (CVE-2014-3571)</p>
<p>DTLS memory leak in dtls1_buffer_record (CVE-2015-0206)</p>
<p>no-ssl3 configuration sets method to NULL (CVE-2014-3569)</p>
<p>ECDHE silently downgrades to ECDH [Client] (CVE-2014-3572)</p>
<p>RSA silently downgrades to EXPORT_RSA [Client] (CVE-2015-0204)</p>
<p>DH client certificates accepted without verification [Server] (CVE-2015-0205)</p>
<p>Certificate fingerprints can be modified (CVE-2014-8275)</p>
<p>Bignum squaring may produce incorrect results (CVE-2014-3570)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3569</cvename>
<cvename>CVE-2014-3570</cvename>
<cvename>CVE-2014-3571</cvename>
<cvename>CVE-2014-3572</cvename>
<cvename>CVE-2014-8275</cvename>
<cvename>CVE-2015-0204</cvename>
<cvename>CVE-2015-0205</cvename>
<cvename>CVE-2015-0206</cvename>
<url>https://www.openssl.org/news/secadv_20150108.txt</url>
</references>
<dates>
<discovery>2015-01-08</discovery>
<entry>2015-01-08</entry>
<modified>2015-01-22</modified>
</dates>
</vuln>
<vuln vid="5e135178-8aeb-11e4-801f-0022156e8794">
<topic>wordpress -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>3.7.5,1</lt></range>
<range><ge>3.8,1</ge><lt>3.8.5,1</lt></range>
<range><ge>3.9,1</ge><lt>3.9.3,1</lt></range>
<range><ge>4.0,1</ge><lt>4.0.1,1</lt></range>
</package>
<package>
<name>zh-wordpress</name>
<range><lt>3.7.5</lt></range>
<range><ge>3.8</ge><lt>3.8.5</lt></range>
<range><ge>3.9</ge><lt>3.9.3</lt></range>
<range><ge>4.0</ge><lt>4.0.1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<range><lt>3.7.5</lt></range>
<range><ge>3.8</ge><lt>3.8.5</lt></range>
<range><ge>3.9</ge><lt>3.9.3</lt></range>
<range><ge>4.0</ge><lt>4.0.1</lt></range>
</package>
<package>
<name>ja-wordpress</name>
<range><lt>3.7.5</lt></range>
<range><ge>3.8</ge><lt>3.8.5</lt></range>
<range><ge>3.9</ge><lt>3.9.3</lt></range>
<range><ge>4.0</ge><lt>4.0.1</lt></range>
</package>
<package>
<name>ru-wordpress</name>
<range><lt>3.7.5</lt></range>
<range><ge>3.8</ge><lt>3.8.5</lt></range>
<range><ge>3.9</ge><lt>3.9.3</lt></range>
<range><ge>4.0</ge><lt>4.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9039">
<p>wp-login.php in WordPress before 3.7.5, 3.8.x before
3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow
remote attackers to reset passwords by leveraging access to
an e-mail account that received a password-reset message.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9038">
<p>wp-includes/http.php in WordPress before 3.7.5, 3.8.x
before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1
allows remote attackers to conduct server-side request
forgery (SSRF) attacks by referring to a 127.0.0.0/8
resource.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9037">
<p>WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before
3.9.3, and 4.x before 4.0.1 might allow remote attackers to
obtain access to an account idle since 2008 by leveraging an
improper PHP dynamic type comparison for an MD5 hash.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9036">
<p>Cross-site scripting (XSS) vulnerability in WordPress
before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and
4.x before 4.0.1 allows remote attackers to inject arbitrary
web script or HTML via a crafted Cascading Style Sheets
(CSS) token sequence in a post.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9035">
<p>Cross-site scripting (XSS) vulnerability in Press This in
WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before
3.9.3, and 4.x before 4.0.1 allows remote attackers to
inject arbitrary web script or HTML via unspecified
vectors</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9034">
<p>wp-includes/class-phpass.php in WordPress before 3.7.5,
3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1
allows remote attackers to cause a denial of service (CPU
consumption) via a long password that is improperly handled
during hashing, a similar issue to CVE-2014-9016.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9033">
<p>Cross-site request forgery (CSRF) vulnerability in
wp-login.php in WordPress 3.7.4, 3.8.4, 3.9.2, and 4.0
allows remote attackers to hijack the authentication of
arbitrary users for requests that reset passwords.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-9033</cvename>
<cvename>CVE-2014-9034</cvename>
<cvename>CVE-2014-9035</cvename>
<cvename>CVE-2014-9036</cvename>
<cvename>CVE-2014-9037</cvename>
<cvename>CVE-2014-9038</cvename>
<cvename>CVE-2014-9039</cvename>
</references>
<dates>
<discovery>2014-11-25</discovery>
<entry>2015-01-05</entry>
</dates>
</vuln>
<vuln vid="c564f9bd-8ba7-11e4-801f-0022156e8794">
<topic>png -- heap overflow for 32-bit builds</topic>
<affects>
<package>
<name>png</name>
<range><ge>1.2.6</ge><lt>1.5.21</lt></range>
<range><ge>1.6</ge><lt>1.6.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>32-bit builds of PNG library are vulnerable to an unsigned
integer overflow that is triggered by a crafted wide
interlaced images.
Overflow results in a heap corruption that will crash the
application and may lead to the controlled overwrite of a
selected portions of process address space.</p>
</body>
</description>
<references>
<url>http://tfpwn.com/files/libpng_heap_overflow_1.6.15.txt</url>
<url>http://codelabs.ru/security/vulns/analysis/libpng/2014-dec-libpng-1.6.15/</url>
</references>
<dates>
<discovery>2014-12-23</discovery>
<entry>2015-01-05</entry>
</dates>
</vuln>
<vuln vid="9575259a-92d5-11e4-bce6-d050992ecde8">
<topic>file -- multiple vulnerabilities</topic>
<affects>
<package>
<name>file</name>
<range><lt>5.21</lt></range>
</package>
<system>
<name>FreeBSD</name>
<range><ge>8.4</ge><lt>8.4_20</lt></range>
<range><ge>9.1</ge><lt>9.1_23</lt></range>
<range><ge>9.2</ge><lt>9.2_16</lt></range>
<range><ge>9.3</ge><lt>9.3_6</lt></range>
<range><ge>10.0</ge><lt>10.0_13</lt></range>
<range><ge>10.1</ge><lt>10.1_1</lt></range>
</system>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>RedHat reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2014/q4/1056">
<p>Thomas Jarosch of Intra2net AG reported a number of
denial of service issues (resource consumption) in
the ELF parser used by file(1). These issues were
fixed in the 5.21 release of file(1), but by mistake
are missing from the changelog.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3710</cvename>
<cvename>CVE-2014-8116</cvename>
<cvename>CVE-2014-8117</cvename>
<freebsdsa>SA-14:28.file</freebsdsa>
<url>http://seclists.org/oss-sec/2014/q4/1056</url>
</references>
<dates>
<discovery>2014-12-16</discovery>
<entry>2015-01-02</entry>
</dates>
</vuln>
<vuln vid="c3d43001-8064-11e4-801f-0022156e8794">
<topic>mutt -- denial of service via crafted mail message</topic>
<affects>
<package>
<name>mutt</name>
<range><ge>1.5.22</ge><lt>1.5.23_7</lt></range>
</package>
<package>
<name>ja-mutt</name>
<range><ge>1.5.22</ge><lt>1.5.23_7</lt></range>
</package>
<package>
<name>zh-mutt</name>
<range><ge>1.5.22</ge><lt>1.5.23_7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9116">
<p>The write_one_header function in mutt 1.5.23 does not
properly handle newline characters at the beginning of a
header, which allows remote attackers to cause a denial of
service (crash) via a header with an empty body, which
triggers a heap-based buffer overflow in the mutt_substrdup
function.</p>
</blockquote>
</body>
</description>
<references>
<bid>71334</bid>
<cvename>CVE-2014-9116</cvename>
<url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=771125</url>
<url>http://dev.mutt.org/trac/ticket/3716</url>
</references>
<dates>
<discovery>2014-11-26</discovery>
<entry>2014-12-23</entry>
</dates>
</vuln>
<vuln vid="4033d826-87dd-11e4-9079-3c970e169bc2">
<topic>ntp -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ntp</name>
<name>ntp-devel</name>
<range><lt>4.2.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CERT reports:</p>
<blockquote cite="http://www.kb.cert.org/vuls/id/852879">
<p>The Network Time Protocol (NTP) provides networked
systems with a way to synchronize time for various
services and applications. ntpd version 4.2.7 and
pervious versions allow attackers to overflow several
buffers in a way that may allow malicious code to
be executed. ntp-keygen prior to version 4.2.7p230
also uses a non-cryptographic random number generator
when generating symmetric keys.</p>
<p>The buffer overflow vulnerabilities in ntpd may
allow a remote unauthenticated attacker to execute
arbitrary malicious code with the privilege level
of the ntpd process. The weak default key and
non-cryptographic random number generator in
ntp-keygen may allow an attacker to gain
information regarding the integrity checking
and authentication encryption schemes.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-9293</cvename>
<cvename>CVE-2014-9294</cvename>
<cvename>CVE-2014-9295</cvename>
<cvename>CVE-2014-9296</cvename>
<url>http://www.kb.cert.org/vuls/id/852879</url>
</references>
<dates>
<discovery>2014-12-19</discovery>
<entry>2014-12-20</entry>
</dates>
</vuln>
<vuln vid="1d567278-87a5-11e4-879c-000c292ee6b8">
<topic>git -- Arbitrary command execution on case-insensitive filesystems</topic>
<affects>
<package>
<name>git</name>
<range><lt>2.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Git Project reports:</p>
<blockquote cite="http://article.gmane.org/gmane.linux.kernel/1853266">
<p>When using a case-insensitive filesystem an attacker can
craft a malicious Git tree that will cause Git to overwrite
its own .git/config file when cloning or checking out a
repository, leading to arbitrary command execution in the
client machine. If you are a hosting service whose users
may fetch from your service to Windows or Mac OS X machines,
you are strongly encouraged to update to protect such users
who use existing versions of Git.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-9390</cvename>
<url>https://github.com/blog/1938-git-client-vulnerability-announced</url>
<url>http://article.gmane.org/gmane.linux.kernel/1853266</url>
</references>
<dates>
<discovery>2014-12-19</discovery>
<entry>2014-12-19</entry>
</dates>
</vuln>
<vuln vid="0c5cf7c4-856e-11e4-a089-60a44c524f57">
<topic>otrs -- Incomplete Access Control</topic>
<affects>
<package>
<name>otrs</name>
<range><gt>3.2.*</gt><lt>3.2.17</lt></range>
<range><gt>3.3.*</gt><lt>3.3.11</lt></range>
<range><gt>4.0.*</gt><lt>4.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OTRS project reports:</p>
<blockquote cite="http://www.otrs.com/security-advisory-2014-06-incomplete-access-control/">
<p>An attacker with valid OTRS credentials could access and manipulate ticket data
of other users via the GenericInterface, if a ticket webservice is configured
and not additionally secured.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.otrs.com/security-advisory-2014-06-incomplete-access-control/</url>
<cvename>CVE-2014-9324</cvename>
</references>
<dates>
<discovery>2014-12-16</discovery>
<entry>2014-12-16</entry>
</dates>
</vuln>
<vuln vid="f5561ade-846c-11e4-b7a7-20cf30e32f6d">
<topic>subversion -- DoS vulnerabilities</topic>
<affects>
<package>
<name>mod_dav_svn</name>
<range><ge>1.8.0</ge><lt>1.8.11</lt></range>
</package>
<package>
<name>subversion16</name>
<range><ge>1.0.0</ge><lt>1.7.19</lt></range>
</package>
<package>
<name>subversion17</name>
<range><ge>1.0.0</ge><lt>1.7.19</lt></range>
</package>
<package>
<name>subversion</name>
<range><ge>1.0.0</ge><lt>1.7.19</lt></range>
<range><ge>1.8.0</ge><lt>1.8.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Subversion Project reports:</p>
<blockquote cite="http://subversion.apache.org/security/">
<p>Subversion's mod_dav_svn Apache HTTPD server module will crash when it
receives a REPORT request for some invalid formatted special URIs.</p>
<p>Subversion's mod_dav_svn Apache HTTPD server module will crash when it
receives a request for some invalid formatted special URIs.</p>
<p>We consider this to be a medium risk vulnerability. Repositories which
allow for anonymous reads will be vulnerable without authentication.
Unfortunately, no special configuration is required and all mod_dav_svn
servers are vulnerable.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3580</cvename>
<cvename>CVE-2014-8108</cvename>
<url>http://subversion.apache.org/security/CVE-2014-3580-advisory.txt</url>
<url>http://subversion.apache.org/security/CVE-2014-8108-advisory.txt</url>
</references>
<dates>
<discovery>2014-12-13</discovery>
<entry>2014-12-15</entry>
</dates>
</vuln>
<vuln vid="fdf72a0e-8371-11e4-bc20-001636d274f3">
<topic>NVIDIA UNIX driver -- remote denial of service or arbitrary code execution</topic>
<affects>
<package>
<name>nvidia-driver</name>
<range><lt>340.65</lt></range>
</package>
<package>
<name>nvidia-driver-304</name>
<range><lt>304.125</lt></range>
</package>
<package>
<name>nvidia-driver-173</name>
<range><le>173.14.35_3</le></range>
</package>
<package>
<name>nvidia-driver-96</name>
<range><le>96.43.23_2</le></range>
</package>
<package>
<name>nvidia-driver-71</name>
<range><le>71.86.15_4</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVIDIA Unix security team reports:</p>
<blockquote cite="http://nvidia.custhelp.com/app/answers/detail/a_id/3610">
<p>The GLX indirect rendering support supplied on NVIDIA products
is subject to the recently disclosed X.Org vulnerabilities
(CVE-2014-8093, CVE-2014-8098) as well as internally identified
vulnerabilities (CVE-2014-8298).</p>
<p>Depending on how it is configured, the X server typically runs
with raised privileges, and listens for GLX indirect rendering
protocol requests from a local socket and potentially a TCP/IP
port. The vulnerabilities could be exploited in a way that
causes the X server to access uninitialized memory or overwrite
arbitrary memory in the X server process. This can cause a
denial of service (e.g., an X server segmentation fault), or
could be exploited to achieve arbitrary code execution.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-8298</cvename>
<cvename>CVE-2014-8093</cvename>
<cvename>CVE-2014-8098</cvename>
</references>
<dates>
<discovery>2014-12-03</discovery>
<entry>2014-12-14</entry>
</dates>
</vuln>
<vuln vid="ab3e98d9-8175-11e4-907d-d050992ecde8">
<topic>bind -- denial of service vulnerability</topic>
<affects>
<package>
<name>bind99</name>
<name>bind99-base</name>
<range><lt>9.9.6</lt></range>
</package>
<package>
<name>bind98</name>
<name>bind98-base</name>
<name>bind96</name>
<name>bind96-base</name>
<range><gt>0</gt></range>
</package>
<package>
<name>FreeBSD</name>
<range><gt>9.3</gt><lt>9.3_6</lt></range>
<range><gt>9.2</gt><lt>9.2_16</lt></range>
<range><gt>9.1</gt><lt>9.1_23</lt></range>
<range><gt>8.4</gt><lt>8.4_20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://www.isc.org/blogs/important-security-advisory-posted/">
<p>We have today posted updated versions of 9.9.6 and 9.10.1
to address a significant security vulnerability in DNS
resolution. The flaw was discovered by Florian Maury of
ANSSI, and applies to any recursive resolver that does not
support a limit on the number of recursions. [<a href="http://cert.ssi.gouv.fr/site/CERTFR-2014-AVI-512/index.html">CERTFR-2014-AVI-512</a>],
[USCERT <a href="www.kb.cert.org/vuls/id/264212">VU#264212</a>]</p>
<p>A flaw in delegation handling could be exploited to put named
into an infinite loop, in which each lookup of a name server
triggered additional lookups of more name servers. This has
been addressed by placing limits on the number of levels of
recursion named will allow (default 7), and on the number of
queries that it will send before terminating a recursive query
(default 50). The recursion depth limit is configured via the
max-recursion-depth option, and the query limit via the
max-recursion-queries option. For more information, see the
security advisory at <a href="https://kb.isc.org/article/AA-01216/">https://kb.isc.org/article/AA-01216/</a>.
<a href="https://kb.isc.org/article/AA-01216/">[CVE-2014-8500]</a>
[RT #37580]</p>
<p>In addition, we have also corrected a potential security
vulnerability in the GeoIP feature in the 9.10.1 release only.
For more information on this issue, see the security advisory
at <a href="https://kb.isc.org/article/AA-01217">https://kb.isc.org/article/AA-01217</a>.
<a href="https://kb.isc.org/article/AA-01217">[CVE-2014-8680]</a></p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-8500</cvename>
<cvename>CVE-2014-8680</cvename>
<url>https://www.isc.org/blogs/important-security-advisory-posted/</url>
</references>
<dates>
<discovery>2014-12-08</discovery>
<entry>2014-12-11</entry>
</dates>
</vuln>
<vuln vid="94268da0-8118-11e4-a180-001999f8d30b">
<topic>asterisk -- Remote Crash Vulnerability in WebSocket Server</topic>
<affects>
<package>
<name>asterisk11</name>
<range><lt>11.14.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>When handling a WebSocket frame the res_http_websocket
module dynamically changes the size of the memory used
to allow the provided payload to fit. If a payload length
of zero was received the code would incorrectly attempt
to resize to zero. This operation would succeed and end
up freeing the memory but be treated as a failure. When
the session was subsequently torn down this memory would
get freed yet again causing a crash.</p>
<p>Users of the WebSocket functionality also did not take
into account that provided text frames are not guaranteed
to be NULL terminated. This has been fixed in chan_sip
and chan_pjsip in the applicable versions.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2014-019.html</url>
<cvename>CVE-2014-9374</cvename>
</references>
<dates>
<discovery>2014-10-30</discovery>
<entry>2014-12-11</entry>
<modified>2015-01-29</modified>
</dates>
</vuln>
<vuln vid="27b9b2f0-8081-11e4-b4ca-bcaec565249c">
<topic>xserver -- multiple issue with X client request handling</topic>
<affects>
<package>
<name>xorg-server</name>
<range><lt>1.12.4_10,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Alan Coopersmith reports:</p>
<blockquote cite="http://lists.x.org/archives/xorg-announce/2014-December/002500.html">
<p>Ilja van Sprundel, a security researcher with IOActive, has
discovered a large number of issues in the way the X server
code base handles requests from X clients, and has worked
with X.Org's security team to analyze, confirm, and fix
these issues.</p>
<p>The vulnerabilities could be exploited to cause the X server
to access uninitialized memory or overwrite arbitrary memory
in the X server process. This can cause a denial of service
(e.g., an X server segmentation fault), or could be exploited
to achieve arbitrary code execution.</p>
<p>The GLX extension to the X Window System allows an X client
to send X protocol to the X server, to request that the X
server perform OpenGL rendering on behalf of the X client.
This is known as "GLX indirect rendering", as opposed to
"GLX direct rendering" where the X client submits OpenGL
rendering commands directly to the GPU, bypassing the X
server and avoiding the X server code for GLX protocol
handling.</p>
<p>Most GLX indirect rendering implementations share some
common ancestry, dating back to "Sample Implementation"
code from Silicon Graphics, Inc (SGI), which SGI
originally commercially licensed to other Unix workstation
and graphics vendors, and later released as open source, so
those vulnerabilities may affect other licensees of SGI's
code base beyond those running code from the X.Org Foundation
or the XFree86 Project.</p>
</blockquote>
</body>
</description>
<references>
<url>http://lists.x.org/archives/xorg-announce/2014-December/002500.html</url>
<cvename>CVE-2014-8091</cvename>
<cvename>CVE-2014-8092</cvename>
<cvename>CVE-2014-8093</cvename>
<cvename>CVE-2014-8094</cvename>
<cvename>CVE-2014-8095</cvename>
<cvename>CVE-2014-8096</cvename>
<cvename>CVE-2014-8097</cvename>
<cvename>CVE-2014-8098</cvename>
<cvename>CVE-2014-8099</cvename>
<cvename>CVE-2014-8100</cvename>
<cvename>CVE-2014-8101</cvename>
<cvename>CVE-2014-8102</cvename>
</references>
<dates>
<discovery>2014-12-09</discovery>
<entry>2014-12-10</entry>
</dates>
</vuln>
<vuln vid="10d73529-7f4b-11e4-af66-00215af774f0">
<topic>unbound -- can be tricked into following an endless series of delegations, this consumes a lot of resources</topic>
<affects>
<package>
<name>unbound</name>
<range><lt>1.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Unbound developer reports:</p>
<blockquote cite="http://unbound.net/downloads/CVE-2014-8602.txt">
<p>The resolver can be tricked into following an endless series of
delegations, this consumes a lot of resources.</p>
</blockquote>
</body>
</description>
<references>
<url>http://unbound.net/downloads/CVE-2014-8602.txt</url>
<cvename>CVE-2014-8602</cvename>
</references>
<dates>
<discovery>2014-12-08</discovery>
<entry>2014-12-09</entry>
</dates>
</vuln>
<vuln vid="567beb1e-7e0a-11e4-b9cc-bcaec565249c">
<topic>freetype -- Out of bounds stack-based read/write</topic>
<affects>
<package>
<name>freetype2</name>
<range><lt>2.5.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Werner LEMBERG reports:</p>
<blockquote cite="http://lists.nongnu.org/archive/html/freetype-announce/2014-12/msg00000.html">
<p>The fix for CVE-2014-2240 was not 100% complete to fix the issue
from the CVE completly.</p>
</blockquote>
</body>
</description>
<references>
<url>http://lists.nongnu.org/archive/html/freetype-announce/2014-12/msg00000.html</url>
<cvename>CVE-2014-2240</cvename>
</references>
<dates>
<discovery>2014-12-07</discovery>
<entry>2014-12-07</entry>
</dates>
</vuln>
<vuln vid="c9c46fbf-7b83-11e4-a96e-6805ca0b3d42">
<topic>phpMyAdmin -- XSS and DoS vulnerabilities</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>4.2.0</ge><lt>4.2.13.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-17.php">
<p>DoS vulnerability with long passwords.</p>
<p>With very long passwords it was possible to initiate a
denial of service attack on phpMyAdmin.</p>
<p>We consider this vulnerability to be serious.</p>
<p>This vulnerability can be mitigated by configuring
throttling in the webserver.</p>
</blockquote>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-18.php">
<p>XSS vulnerability in redirection mechanism.</p>
<p>With a crafted URL it was possible to trigger an XSS in
the redirection mechanism in phpMyAdmin.</p>
<p>We consider this vulnerability to be non critical.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-17.php</url>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-18.php</url>
<cvename>CVE-2014-9218</cvename>
<cvename>CVE-2014-9219</cvename>
</references>
<dates>
<discovery>2014-12-03</discovery>
<entry>2014-12-04</entry>
</dates>
</vuln>
<vuln vid="7ae61870-9dd2-4884-a2f2-f19bb5784d09">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>34.0,1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>31.3.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>34.0,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.31</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>31.3.0</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.31</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>31.3.0</lt></range>
</package>
<package>
<name>libxul</name>
<range><lt>31.3.0</lt></range>
</package>
<package>
<name>nss</name>
<range><lt>3.17.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>ASN.1 DER decoding of lengths is too permissive, allowing
undetected smuggling of arbitrary data</p>
<p>MFSA-2014-90 Apple CoreGraphics framework on OS X 10.10
logging input data to /tmp directory</p>
<p>MFSA-2014-89 Bad casting from the BasicThebesLayer to
BasicContainerLayer</p>
<p>MFSA-2014-88 Buffer overflow while parsing media content</p>
<p>MFSA-2014-87 Use-after-free during HTML5 parsing</p>
<p>MFSA-2014-86 CSP leaks redirect data via violation reports</p>
<p>MFSA-2014-85 XMLHttpRequest crashes with some input streams</p>
<p>MFSA-2014-84 XBL bindings accessible via improper CSS
declarations</p>
<p>MFSA-2014-83 Miscellaneous memory safety hazards (rv:34.0
/ rv:31.3)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-1587</cvename>
<cvename>CVE-2014-1588</cvename>
<cvename>CVE-2014-1589</cvename>
<cvename>CVE-2014-1590</cvename>
<cvename>CVE-2014-1591</cvename>
<cvename>CVE-2014-1592</cvename>
<cvename>CVE-2014-1593</cvename>
<cvename>CVE-2014-1594</cvename>
<cvename>CVE-2014-1595</cvename>
<cvename>CVE-2014-1569</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2014-83</url>
<url>https://www.mozilla.org/security/advisories/mfsa2014-84</url>
<url>https://www.mozilla.org/security/advisories/mfsa2014-85</url>
<url>https://www.mozilla.org/security/advisories/mfsa2014-86</url>
<url>https://www.mozilla.org/security/advisories/mfsa2014-87</url>
<url>https://www.mozilla.org/security/advisories/mfsa2014-88</url>
<url>https://www.mozilla.org/security/advisories/mfsa2014-89</url>
<url>https://www.mozilla.org/security/advisories/mfsa2014-90</url>
<url>https://www.mozilla.org/security/advisories/</url>
</references>
<dates>
<discovery>2014-12-01</discovery>
<entry>2014-12-02</entry>
</dates>
</vuln>
<vuln vid="23ab5c3e-79c3-11e4-8b1e-d050992ecde8">
<topic>OpenVPN -- denial of service security vulnerability</topic>
<affects>
<package>
<name>openvpn</name>
<range><lt>2.0.11</lt></range>
<range><ge>2.1.0</ge><lt>2.2.3</lt></range>
<range><ge>2.3.0</ge><lt>2.3.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenVPN project reports:</p>
<blockquote cite="https://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-97597e732b">
<p>In late November 2014 Dragana Damjanovic notified OpenVPN
developers of a critical denial of service security vulnerability
(CVE-2014-8104). The vulnerability allows an tls-authenticated
client to crash the server by sending a too-short control channel
packet to the server. In other words this vulnerability is denial
of service only.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-8104</cvename>
<url>https://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-97597e732b</url>
</references>
<dates>
<discovery>2014-12-01</discovery>
<entry>2014-12-02</entry>
</dates>
</vuln>
<vuln vid="a33addf6-74e6-11e4-a615-f8b156b6dcc8">
<topic>flac -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>flac</name>
<range><lt>1.3.0_3</lt></range>
</package>
<package>
<name>linux-c6-flac</name>
<range><lt>1.2.1_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Erik de Castro Lopo reports:</p>
<blockquote cite="http://lists.xiph.org/pipermail/flac-dev/2014-November/005226.html">
<p>Google Security Team member, Michele Spagnuolo, recently
found two potential problems in the FLAC code base. They are:</p>
<ul>
<li>CVE-2014-9028: Heap buffer write overflow.</li>
<li>CVE-2014-8962: Heap buffer read overflow.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://git.xiph.org/?p=flac.git;a=commit;h=5b3033a2b355068c11fe637e14ac742d273f076e</url>
<cvename>CVE-2014-8962</cvename>
<url>https://git.xiph.org/?p=flac.git;a=commit;h=fcf0ba06ae12ccd7c67cee3c8d948df15f946b85</url>
<cvename>CVE-2014-9028</cvename>
</references>
<dates>
<discovery>2014-11-25</discovery>
<entry>2014-11-25</entry>
<modified>2015-07-15</modified>
</dates>
</vuln>
<vuln vid="7bfd797c-716d-11e4-b008-001999f8d30b">
<topic>asterisk -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>asterisk11</name>
<range><lt>11.14.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>AST-2014-014 - High call load may result in hung
channels in ConfBridge.</p>
<p>AST-2014-017 - Permission escalation through ConfBridge
actions/dialplan functions.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2014-014.html</url>
<cvename>CVE-2014-8414</cvename>
<url>http://downloads.asterisk.org/pub/security/AST-2014-017.html</url>
<cvename>CVE-2014-8417</cvename>
</references>
<dates>
<discovery>2014-11-21</discovery>
<entry>2014-11-21</entry>
</dates>
</vuln>
<vuln vid="a92ed304-716c-11e4-b008-001999f8d30b">
<topic>asterisk -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>asterisk</name>
<range><lt>1.8.32.1</lt></range>
</package>
<package>
<name>asterisk11</name>
<range><lt>11.14.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/security">
<p>AST-2014-012 - Mixed IP address families in access
control lists may permit unwanted traffic.</p>
<p>AST-2014-018 - AMI permission escalation through DB
dialplan function.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2014-012.html</url>
<cvename>CVE-2014-8412</cvename>
<url>http://downloads.asterisk.org/pub/security/AST-2014-018.html</url>
<cvename>CVE-2014-8418</cvename>
</references>
<dates>
<discovery>2014-11-21</discovery>
<entry>2014-11-21</entry>
</dates>
</vuln>
<vuln vid="a5d4a82a-7153-11e4-88c7-6805ca0b3d42">
<topic>phpMyAdmin -- XSS and information disclosure vulnerabilities</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>4.2.0</ge><lt>4.2.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-13.php">
<ul>
<li>With a crafted database, table or column name it is
possible to trigger an XSS attack in the table browse
page.</li>
<li>With a crafted ENUM value it is possible to trigger
XSS attacks in the table print view and zoom search
pages.</li>
<li>With a crafted value for font size it is possible to
trigger an XSS attack in the home page.</li>
</ul>
<p>These vulnerabilities can be triggered only by someone
who is logged in to phpMyAdmin, as the usual token
protection prevents non-logged-in users from accessing the
required pages. Moreover, exploitation of the XSS
vulnerability related to the font size requires forgery of
the pma_fontsize cookie.</p>
</blockquote>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-14.php">
<p> In the GIS editor feature, a parameter specifying the
geometry type was not correcly validated, opening the door
to a local file inclusion attack.</p>
<p>This vulnerability can be triggered only by someone who
is logged in to phpMyAdmin, as the usual token protection
prevents non-logged-in users from accessing the required
page.</p>
</blockquote>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-15.php">
<p>With a crafted file name it is possible to trigger an
XSS in the error reporting page.</p>
<p>This vulnerability can be triggered only by someone who
is logged in to phpMyAdmin, as the usual token protection
prevents non-logged-in users from accessing the required
page.</p>
</blockquote>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-16.php">
<p>In the error reporting feature, a parameter specifying
the file was not correctly validated, allowing the
attacker to derive the line count of an arbitrary file</p>
<p>This vulnerability can be triggered only by someone who
is logged in to phpMyAdmin, as the usual token protection
prevents non-logged-in users from accessing the required
page.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-13.php</url>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-14.php</url>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-15.php</url>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-16.php</url>
<cvename>CVE-2014-8958</cvename>
<cvename>CVE-2014-8959</cvename>
<cvename>CVE-2014-8960</cvename>
<cvename>CVE-2014-8961</cvename>
</references>
<dates>
<discovery>2014-11-20</discovery>
<entry>2014-11-21</entry>
</dates>
</vuln>
<vuln vid="890b6b22-70fa-11e4-91ae-5453ed2e2b49">
<topic>kwebkitpart, kde-runtime -- insufficient input validation</topic>
<affects>
<package>
<name>kde-runtime</name>
<range><lt>4.14.2_2</lt></range>
</package>
<package>
<name>kwebkitpart</name>
<range><lt>1.3.2_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Albert Aastals Cid reports:</p>
<blockquote cite="https://www.kde.org/info/security/advisory-20141113-1.txt">
<p>kwebkitpart and the bookmarks:// io slave were not sanitizing
input correctly allowing to some javascript being executed on the
context of the referenced hostname.</p>
<p>Whilst in most cases, the JavaScript will be executed in an
untrusted context, with the bookmarks IO slave, it will be executed
in the context of the referenced hostname. It should however be
noted that KDE mitigates this risk by attempting to ensure that
such URLs cannot be embedded directly into Internet hosted
content.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.kde.org/info/security/advisory-20141113-1.txt</url>
<cvename>CVE-2014-8600</cvename>
</references>
<dates>
<discovery>2014-11-13</discovery>
<entry>2014-11-20</entry>
</dates>
</vuln>
<vuln vid="5a35bc56-7027-11e4-a4a3-001999f8d30b">
<topic>yii -- Remote arbitrary PHP code execution</topic>
<affects>
<package>
<name>yii</name>
<range><lt>1.1.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Yii PHP Framework developers report:</p>
<blockquote cite="http://www.yiiframework.com/news/78/yii-1-1-15-is-released-security-fix/">
<p>We are releasing Yii 1.1.15 to fix a security issue
found in 1.1.14. We urge all 1.1.14 users to upgrade their
Yii to this latest release. Note that the issue only
affects 1.1.14. All previous releases are not affected.
Upgrading to this release from 1.1.14 is very safe and
will not break your existing code.</p>
<p>The vulnerability is in the CDetailView widget. When
a Yii application uses this widget and configures the
"value" property of a CDetailView attribute using end
user inputs, it may allow attackers to potentially execute
arbitrary PHP scripts on the server. We are not showing
how to exploit it here to allow users to upgrade before
details about the exploit become publicly known. To our
knowledge the details of this issue are only known to
core team members.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-4672</cvename>
<url>http://www.yiiframework.com/news/78/yii-1-1-15-is-released-security-fix</url>
</references>
<dates>
<discovery>2014-07-03</discovery>
<entry>2014-11-19</entry>
</dates>
</vuln>
<vuln vid="d395e44f-6f4f-11e4-a444-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>39.0.2171.65</lt></range>
</package>
<package>
<name>chromium-pulse</name>
<range><lt>39.0.2171.65</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2014/11/stable-channel-update_18.html">
<p>42 security fixes in this release, including:</p>
<ul>
<li>[389734] High CVE-2014-7899: Address bar spoofing. Credit to
Eli Grey.</li>
<li>[406868] High CVE-2014-7900: Use-after-free in pdfium. Credit
to Atte Kettunen from OUSPG.</li>
<li>[413375] High CVE-2014-7901: Integer overflow in pdfium. Credit
to cloudfuzzer.</li>
<li>[414504] High CVE-2014-7902: Use-after-free in pdfium. Credit
to cloudfuzzer.</li>
<li>[414525] High CVE-2014-7903: Buffer overflow in pdfium. Credit
to cloudfuzzer.</li>
<li>[418161] High CVE-2014-7904: Buffer overflow in Skia. Credit to
Atte Kettunen from OUSPG.</li>
<li>[421817] High CVE-2014-7905: Flaw allowing navigation to
intents that do not have the BROWSABLE category. Credit to
WangTao(neobyte) of Baidu X-Team.</li>
<li>[423030] High CVE-2014-7906: Use-after-free in pepper plugins.
Credit to Chen Zhang (demi6od) of the NSFOCUS Security Team.</li>
<li>[423703] High CVE-2014-0574: Double-free in Flash. Credit to
biloulehibou.</li>
<li>[424453] High CVE-2014-7907: Use-after-free in blink. Credit to
Chen Zhang (demi6od) of the NSFOCUS Security Team.</li>
<li>[425980] High CVE-2014-7908: Integer overflow in media. Credit
to Christoph Diehl.</li>
<li>[391001] Medium CVE-2014-7909: Uninitialized memory read in
Skia. Credit to miaubiz.</li>
<li>CVE-2014-7910: Various fixes from internal audits, fuzzing and
other initiatives.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0574</cvename>
<cvename>CVE-2014-7899</cvename>
<cvename>CVE-2014-7900</cvename>
<cvename>CVE-2014-7901</cvename>
<cvename>CVE-2014-7902</cvename>
<cvename>CVE-2014-7903</cvename>
<cvename>CVE-2014-7904</cvename>
<cvename>CVE-2014-7905</cvename>
<cvename>CVE-2014-7906</cvename>
<cvename>CVE-2014-7907</cvename>
<cvename>CVE-2014-7908</cvename>
<cvename>CVE-2014-7909</cvename>
<cvename>CVE-2014-7910</cvename>
<url>http://googlechromereleases.blogspot.nl/2014/11/stable-channel-update_18.html</url>
</references>
<dates>
<discovery>2014-11-18</discovery>
<entry>2014-11-18</entry>
</dates>
</vuln>
<vuln vid="dafa13a8-6e9b-11e4-8ef7-5453ed2e2b49">
<topic>kde-workspace -- privilege escalation</topic>
<affects>
<package>
<name>kde-workspace</name>
<range><lt>4.11.13_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>David Edmundson reports:</p>
<blockquote cite="https://www.kde.org/info/security/advisory-20141106-1.txt">
<p>KDE workspace configuration module for setting the date and time
has a helper program which runs as root for performing actions.
This is secured with polkit.</p>
<p>This helper takes the name of the ntp utility to run as an
argument. This allows a hacker to run any arbitrary command as root
under the guise of updating the time.</p>
<p>An application can gain root priveledges from an admin user with
either misleading information or no interaction.</p>
<p>On some systems the user will be shown a prompt to change the
time. However, if the system has policykit-desktop-privileges
installed, the datetime helper will be invoked by an admin user
without any prompts.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-8651</cvename>
<mlist>http://seclists.org/oss-sec/2014/q4/520</mlist>
</references>
<dates>
<discovery>2014-11-06</discovery>
<entry>2014-11-17</entry>
</dates>
</vuln>
<vuln vid="c1930f45-6982-11e4-80e1-bcaec565249c">
<topic>dbus -- incomplete fix for CVE-2014-3636 part A</topic>
<affects>
<package>
<name>dbus</name>
<range><lt>1.8.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon McVittie reports:</p>
<blockquote cite="http://lists.freedesktop.org/archives/dbus/2014-November/016395.html">
<p>The patch issued by the D-Bus maintainers for CVE-2014-3636
was based on incorrect reasoning, and does not fully prevent
the attack described as "CVE-2014-3636 part A", which is
repeated below. Preventing that attack requires raising the
system dbus-daemon's RLIMIT_NOFILE (ulimit -n) to a higher
value. CVE-2014-7824 has been allocated for this
vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-7824</cvename>
<url>http://lists.freedesktop.org/archives/dbus/2014-November/016395.html</url>
</references>
<dates>
<discovery>2014-11-10</discovery>
<entry>2014-11-11</entry>
</dates>
</vuln>
<vuln vid="ee7b4f9d-66c8-11e4-9ae1-e8e0b722a85e">
<topic>wget -- path traversal vulnerability in recursive FTP mode</topic>
<affects>
<package>
<name>wget</name>
<range><lt>1.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4877">
<p>Absolute path traversal vulnerability in GNU Wget before
1.16, when recursion is enabled, allows remote FTP servers
to write to arbitrary files, and consequently execute
arbitrary code, via a LIST response that references the same
filename within two entries, one of which indicates that the
filename is for a symlink. </p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-4877</cvename>
<certvu>685996</certvu>
</references>
<dates>
<discovery>2014-10-27</discovery>
<entry>2014-11-08</entry>
</dates>
</vuln>
<vuln vid="0167f5ad-64ea-11e4-98c1-00269ee29e57">
<topic>Konversation -- out-of-bounds read on a heap-allocated array</topic>
<affects>
<package>
<name>konversation</name>
<range><lt>1.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Konversation developers report:</p>
<blockquote cite="https://www.kde.org/info/security/advisory-20141104-1.txt">
<p>Konversation's Blowfish ECB encryption support assumes incoming blocks
to be the expected 12 bytes. The lack of a sanity-check for the actual
size can cause a denial of service and an information leak to the local
user.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-8483</cvename>
<url>https://www.kde.org/info/security/advisory-20141104-1.txt</url>
</references>
<dates>
<discovery>2014-11-04</discovery>
<entry>2014-11-05</entry>
</dates>
</vuln>
<vuln vid="21ce1840-6107-11e4-9e84-0022156e8794">
<topic>twiki -- remote Perl code execution</topic>
<affects>
<package>
<name>twiki</name>
<range><lt>5.1.4_1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>TWiki developers report:</p>
<blockquote cite="http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2014-7236">
<p>The debugenableplugins request parameter allows arbitrary
Perl code execution.</p>
<p>Using an HTTP GET request towards a TWiki server,
add a specially crafted debugenableplugins request parameter
to TWiki's view script (typically port 80/TCP).
Prior authentication may or may not be necessary.</p>
<p>A remote attacker can execute arbitrary Perl code
to view and modify any file the webserver user has access to.</p>
<p>Example: http://www.example.com/do/view/Main/WebHome?debugenableplugins=BackupRestorePlugin%3bprint("Content-Type:text/html\r\n\r\nVulnerable!")%3bexit</p>
<p>The TWiki site is vulnerable if you see a page with text
"Vulnerable!".</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-7236</cvename>
<url>http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2014-7236</url>
</references>
<dates>
<discovery>2014-10-09</discovery>
<entry>2014-10-31</entry>
</dates>
</vuln>
<vuln vid="0dad9114-60cc-11e4-9e84-0022156e8794">
<topic>jenkins -- slave-originated arbitrary code execution on master servers</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>1.587</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>1.580.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Kohsuke Kawaguchi from Jenkins team reports:</p>
<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-30">
<p>Historically, Jenkins master and slaves behaved as if
they altogether form a single distributed process. This
means a slave can ask a master to do just about anything
within the confinement of the operating system, such as
accessing files on the master or trigger other jobs on
Jenkins.</p>
<p>This has increasingly become problematic, as larger
enterprise deployments have developed more sophisticated
trust separation model, where the administators of a master
might take slaves owned by other teams. In such an
environment, slaves are less trusted than the master.
Yet the "single distributed process" assumption was not
communicated well to the users, resulting in vulnerabilities
in some deployments.</p>
<p>SECURITY-144 (CVE-2014-3665) introduces a new subsystem
to address this problem. This feature is off by default for
compatibility reasons. See Wiki for more details, who should
turn this on, and implications.</p>
<p>CVE-2014-3566 is rated high. It only affects
installations that accept slaves from less trusted
computers, but this will allow an owner of of such slave to
mount a remote code execution attack on Jenkins.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3665</cvename>
<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-30</url>
<url>https://wiki.jenkins-ci.org/display/JENKINS/Slave+To+Master+Access+Control</url>
<url>http://www.cloudbees.com/jenkins-security-advisory-2014-10-30</url>
</references>
<dates>
<discovery>2014-10-30</discovery>
<entry>2014-10-31</entry>
</dates>
</vuln>
<vuln vid="f8c88d50-5fb3-11e4-81bd-5453ed2e2b49">
<topic>libssh -- PRNG state reuse on forking servers</topic>
<affects>
<package>
<name>libssh</name>
<range><lt>0.6.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Aris Adamantiadis reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2014/03/05/1">
<p>When accepting a new connection, the server forks and the
child process handles the request. The RAND_bytes() function
of openssl doesn't reset its state after the fork, but
simply adds the current process id (getpid) to the PRNG
state, which is not guaranteed to be unique.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0017</cvename>
<mlist>http://www.openwall.com/lists/oss-security/2014/03/05/1</mlist>
<url>http://secunia.com/advisories/57407</url>
</references>
<dates>
<discovery>2014-03-05</discovery>
<entry>2014-10-29</entry>
</dates>
</vuln>
<vuln vid="d057c5e6-5b20-11e4-bebd-000c2980a9f3">
<topic>libpurple/pidgin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libpurple</name>
<range><lt>2.10.10</lt></range>
</package>
<package>
<name>pidgin</name>
<range><lt>2.10.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The pidgin development team reports:</p>
<blockquote cite="https://developer.pidgin.im/wiki/ChangeLog">
<p>.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3694</cvename>
<cvename>CVE-2014-3697</cvename>
<cvename>CVE-2014-3696</cvename>
<cvename>CVE-2014-3695</cvename>
<cvename>CVE-2014-3698</cvename>
<url>https://developer.pidgin.im/wiki/ChangeLog</url>
</references>
<dates>
<discovery>2014-10-22</discovery>
<entry>2014-10-24</entry>
</dates>
</vuln>
<vuln vid="25b78f04-59c8-11e4-b711-6805ca0b3d42">
<topic>phpMyAdmin -- XSS vulnerabilities in SQL debug output and server monitor page.</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>4.2.0</ge><lt>4.2.10.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-12.php">
<p>With a crafted database or table name it is possible to
trigger an XSS in SQL debug output when enabled and in
server monitor page when viewing and analysing executed
queries.</p>
<p>This vulnerability can be triggered only by someone who
is logged in to phpMyAdmin, as the usual token protection
prevents non-logged-in users from accessing the required
pages. Moreover, debugging SQL is a developer option which
is disabled by default and expected to be disabled in
production environments.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-12.php</url>
<cvename>CVE-2014-8326</cvename>
</references>
<dates>
<discovery>2014-10-21</discovery>
<entry>2014-10-22</entry>
</dates>
</vuln>
<vuln vid="76c7a0f5-5928-11e4-adc7-001999f8d30b">
<topic>asterisk -- Asterisk Susceptibility to POODLE Vulnerability</topic>
<affects>
<package>
<name>asterisk</name>
<range><lt>1.8.31.1</lt></range>
</package>
<package>
<name>asterisk11</name>
<range><lt>11.13.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>The POODLE vulnerability is described under CVE-2014-3566.
This advisory describes the Asterisk's project susceptibility
to this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2014-011.html</url>
<cvename>CVE-2014-3566</cvename>
</references>
<dates>
<discovery>2014-10-20</discovery>
<entry>2014-10-21</entry>
</dates>
</vuln>
<vuln vid="0642b064-56c4-11e4-8b87-bcaec565249c">
<topic>libxml2 -- Denial of service</topic>
<affects>
<package>
<name>libxml2</name>
<range><lt>2.9.2</lt></range>
</package>
<package>
<name>linux-c6-libxml2</name>
<range><lt>2.7.6_2</lt></range>
</package>
<package>
<name>linux-f10-libxml2</name>
<range><ge>*</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>RedHat reports:</p>
<blockquote cite="https://rhn.redhat.com/errata/RHSA-2014-1655.html">
<p>A denial of service flaw was found in libxml2, a library
providing support to read, modify and write XML and HTML
files. A remote attacker could provide a specially crafted
XML file that, when processed by an application using
libxml2, would lead to excessive CPU consumption (denial of
service) based on excessive entity substitutions, even if
entity substitution was disabled, which is the parser default
behavior.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3660</cvename>
<url>https://rhn.redhat.com/errata/RHSA-2014-1655.html</url>
</references>
<dates>
<discovery>2014-10-16</discovery>
<entry>2014-10-18</entry>
<modified>2015-07-15</modified>
</dates>
</vuln>
<vuln vid="6f825fa4-5560-11e4-a4c3-00a0986f28c4">
<topic>drupal7 -- SQL injection</topic>
<affects>
<package>
<name>drupal7</name>
<range><lt>7.32</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team reports:</p>
<blockquote cite="https://drupal.org/SA-CORE-2013-003">
<p>Drupal 7 includes a database abstraction API to ensure that
queries executed against the database are sanitized to prevent
SQL injection attacks.
A vulnerability in this API allows an attacker to send
specially crafted requests resulting in arbitrary SQL execution.
Depending on the content of the requests this can lead to
privilege escalation, arbitrary PHP execution, or other attacks.
This vulnerability can be exploited by anonymous users.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3704</cvename>
<url>https://www.drupal.org/SA-CORE-2014-005</url>
<url>https://www.sektioneins.de/en/blog/14-10-15-drupal-sql-injection-vulnerability.html</url>
</references>
<dates>
<discovery>2014-10-15</discovery>
<entry>2014-10-16</entry>
</dates>
</vuln>
<vuln vid="03175e62-5494-11e4-9cc1-bc5ff4fb5e7b">
<topic>OpenSSL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><ge>1.0.1</ge><lt>1.0.1_16</lt></range>
</package>
<package>
<name>mingw32-openssl</name>
<range><ge>1.0.1</ge><lt>1.0.1j</lt></range>
</package>
<package>
<name>linux-c6-openssl</name>
<range><lt>1.0.1e_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL Project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv_20141015.txt">
<p>A flaw in the DTLS SRTP extension parsing code allows an
attacker, who sends a carefully crafted handshake message,
to cause OpenSSL to fail to free up to 64k of memory causing
a memory leak. This could be exploited in a Denial Of Service
attack. This issue affects OpenSSL 1.0.1 server implementations
for both SSL/TLS and DTLS regardless of whether SRTP is used
or configured. Implementations of OpenSSL that have been
compiled with OPENSSL_NO_SRTP defined are not affected.
[CVE-2014-3513].</p>
<p>When an OpenSSL SSL/TLS/DTLS server receives a session
ticket the integrity of that ticket is first verified.
In the event of a session ticket integrity check failing,
OpenSSL will fail to free memory causing a memory leak.
By sending a large number of invalid session tickets an
attacker could exploit this issue in a Denial Of Service
attack. [CVE-2014-3567].</p>
<p>OpenSSL has added support for TLS_FALLBACK_SCSV to allow
applications to block the ability for a MITM attacker to
force a protocol downgrade.</p>
<p>Some client applications (such as browsers) will reconnect
using a downgraded protocol to work around interoperability
bugs in older servers. This could be exploited by an active
man-in-the-middle to downgrade connections to SSL 3.0 even
if both sides of the connection support higher protocols.
SSL 3.0 contains a number of weaknesses including POODLE
[CVE-2014-3566].</p>
<p>When OpenSSL is configured with "no-ssl3" as a build option,
servers could accept and complete a SSL 3.0 handshake, and
clients could be configured to send them. [CVE-2014-3568].</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3513</cvename>
<cvename>CVE-2014-3566</cvename>
<cvename>CVE-2014-3567</cvename>
<cvename>CVE-2014-3568</cvename>
<url>https://www.openssl.org/news/secadv_20141015.txt</url>
</references>
<dates>
<discovery>2014-10-15</discovery>
<entry>2014-10-15</entry>
</dates>
</vuln>
<vuln vid="9c1495ac-8d8c-4789-a0f3-8ca6b476619c">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>33.0,1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>31.2.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>33.0,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.30</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>31.2.0</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.30</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>31.2.0</lt></range>
</package>
<package>
<name>libxul</name>
<range><lt>31.2.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2014-74 Miscellaneous memory safety hazards
(rv:33.0 / rv:31.2)</p>
<p>MFSA 2014-75 Buffer overflow during CSS manipulation</p>
<p>MFSA 2014-76 Web Audio memory corruption issues with
custom waveforms</p>
<p>MFSA 2014-78 Further uninitialized memory use during GIF</p>
<p>MFSA 2014-79 Use-after-free interacting with text
directionality</p>
<p>MFSA 2014-80 Key pinning bypasses</p>
<p>MFSA 2014-81 Inconsistent video sharing within iframe</p>
<p>MFSA 2014-82 Accessing cross-origin objects via the
Alarms API</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-1574</cvename>
<cvename>CVE-2014-1575</cvename>
<cvename>CVE-2014-1576</cvename>
<cvename>CVE-2014-1577</cvename>
<cvename>CVE-2014-1580</cvename>
<cvename>CVE-2014-1581</cvename>
<cvename>CVE-2014-1582</cvename>
<cvename>CVE-2014-1583</cvename>
<cvename>CVE-2014-1584</cvename>
<cvename>CVE-2014-1585</cvename>
<cvename>CVE-2014-1586</cvename>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-74.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-75.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-76.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-78.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-79.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-80.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-81.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-82.html</url>
<url>https://www.mozilla.org/security/announce/</url>
</references>
<dates>
<discovery>2014-10-14</discovery>
<entry>2014-10-14</entry>
<modified>2015-08-12</modified>
</dates>
</vuln>
<vuln vid="c30c3a2e-4fb1-11e4-b275-14dae9d210b8">
<topic>foreman-proxy SSL verification issue</topic>
<affects>
<package>
<name>foreman-proxy</name>
<range><lt>1.6.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Foreman Security reports:</p>
<blockquote cite="http://projects.theforeman.org/issues/7822">
<p>The smart proxy when running in an SSL-secured mode permits incoming
API calls to any endpoint without requiring, or performing any
verification of an SSL client certificate. This permits any client
with access to the API to make requests and perform actions
permitting control of Puppet CA, DHCP, DNS etc.)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3691</cvename>
<url>https://groups.google.com/forum/#!topic/foreman-announce/LcjZx25Bl7U</url>
</references>
<dates>
<discovery>2014-05-09</discovery>
<entry>2014-10-09</entry>
</dates>
</vuln>
<vuln vid="d2bbcc01-4ec3-11e4-ab3f-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-pulse</name> <!-- pcbsd only -->
<range><lt>38.0.2125.101</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2014/10/stable-channel-update.html">
<p>159 security fixes in this release, including 113 found using
MemorySanitizer:</p>
<ul>
<li>[416449] Critical CVE-2014-3188: A special thanks to Jüri Aedla
for a combination of V8 and IPC bugs that can lead to remote code
execution outside of the sandbox.</li>
<li>[398384] High CVE-2014-3189: Out-of-bounds read in PDFium.
Credit to cloudfuzzer.</li>
<li>[400476] High CVE-2014-3190: Use-after-free in Events. Credit
to cloudfuzzer.</li>
<li>[402407] High CVE-2014-3191: Use-after-free in Rendering.
Credit to cloudfuzzer.</li>
<li>[403276] High CVE-2014-3192: Use-after-free in DOM. Credit to
cloudfuzzer.</li>
<li>[399655] High CVE-2014-3193: Type confusion in Session Management.
Credit to miaubiz.</li>
<li>[401115] High CVE-2014-3194: Use-after-free in Web Workers.
Credit to Collin Payne.</li>
<li>[403409] Medium CVE-2014-3195: Information Leak in V8. Credit
to Jüri Aedla.</li>
<li>[338538] Medium CVE-2014-3196: Permissions bypass in Windows
Sandbox. Credit to James Forshaw.</li>
<li>[396544] Medium CVE-2014-3197: Information Leak in XSS Auditor.
Credit to Takeshi Terada.</li>
<li>[415307] Medium CVE-2014-3198: Out-of-bounds read in PDFium.
Credit to Atte Kettunen of OUSPG.</li>
<li>[395411] Low CVE-2014-3199: Release Assert in V8 bindings.
Credit to Collin Payne.</li>
<li>[420899] CVE-2014-3200: Various fixes from internal audits,
fuzzing and other initiatives (Chrome 38).</li>
<li>Multiple vulnerabilities in V8 fixed at the tip of the 3.28
branch (currently 3.28.71.15).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3188</cvename>
<cvename>CVE-2014-3189</cvename>
<cvename>CVE-2014-3190</cvename>
<cvename>CVE-2014-3191</cvename>
<cvename>CVE-2014-3192</cvename>
<cvename>CVE-2014-3193</cvename>
<cvename>CVE-2014-3194</cvename>
<cvename>CVE-2014-3195</cvename>
<cvename>CVE-2014-3196</cvename>
<cvename>CVE-2014-3197</cvename>
<cvename>CVE-2014-3198</cvename>
<cvename>CVE-2014-3199</cvename>
<cvename>CVE-2014-3200</cvename>
<url>http://googlechromereleases.blogspot.nl/2014/10/stable-channel-update.html</url>
</references>
<dates>
<discovery>2014-10-07</discovery>
<entry>2014-10-08</entry>
</dates>
</vuln>
<vuln vid="b6587341-4d88-11e4-aef9-20cf30e32f6d">
<topic>Bugzilla multiple security issues</topic>
<affects>
<package>
<name>bugzilla44</name>
<range><lt>4.4.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Bugzilla Security Advisory</p>
<blockquote cite="http://www.bugzilla.org/security/4.0.14/">
<h5>Unauthorized Account Creation</h5>
<p>An attacker creating a new Bugzilla account can override certain
parameters when finalizing the account creation that can lead to the
user being created with a different email address than originally
requested. The overridden login name could be automatically added
to groups based on the group's regular expression setting.</p>
<h5>Cross-Site Scripting</h5>
<p>During an audit of the Bugzilla code base, several places
were found where cross-site scripting exploits could occur which
could allow an attacker to access sensitive information.</p>
<h5>Information Leak</h5>
<p>If a new comment was marked private to the insider group, and a flag
was set in the same transaction, the comment would be visible to
flag recipients even if they were not in the insider group.</p>
<h5>Social Engineering</h5>
<p>Search results can be exported as a CSV file which can then be
imported into external spreadsheet programs. Specially formatted
field values can be interpreted as formulas which can be executed
and used to attack a user's computer.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-1572</cvename>
<cvename>CVE-2014-1573</cvename>
<cvename>CVE-2014-1571</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=1074812</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=1075578</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=1064140</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=1054702</url>
</references>
<dates>
<discovery>2014-10-06</discovery>
<entry>2014-10-06</entry>
</dates>
</vuln>
<vuln vid="81e2b308-4a6c-11e4-b711-6805ca0b3d42">
<topic>rt42 -- vulnerabilities related to shellshock</topic>
<affects>
<package>
<name>rt42</name>
<range><ge>4.2.0</ge><lt>4.2.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Best Practical reports:</p>
<blockquote cite="http://blog.bestpractical.com/2014/10/security-vulnerability-in-rt-42x-cve-2014-7227.html">
<p>RT 4.2.0 and above may be vulnerable to arbitrary
execution of code by way of CVE-2014-7169, CVE-2014-7186,
CVE-2014-7187, CVE-2014-6277, or CVE-2014-6271 --
collectively known as "Shellshock." This vulnerability
requires a privileged user with access to an RT instance
running with SMIME integration enabled; it applies to both
mod_perl and fastcgi deployments. If you have already
taken upgrades to bash to resolve "Shellshock," you are
protected from this vulnerability in RT, and there is no
need to apply this patch. This vulnerability has been
assigned CVE-2014-7227.</p>
</blockquote>
</body>
</description>
<references>
<url>http://blog.bestpractical.com/2014/10/security-vulnerability-in-rt-42x-cve-2014-7227.html</url>
<cvename>CVE-2014-7227</cvename>
</references>
<dates>
<discovery>2014-10-02</discovery>
<entry>2014-10-02</entry>
</dates>
</vuln>
<vuln vid="549a2771-49cc-11e4-ae2c-c80aa9043978">
<topic>jenkins -- remote execution, privilege escalation, XSS, password exposure, ACL hole, DoS</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>1.583</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>1.565.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01">
<h1>Description</h1>
<h5>SECURITY-87/CVE-2014-3661 (anonymous DoS attack through CLI
handshake)</h5>
<p>This vulnerability allows unauthenticated users
with access to Jenkins' HTTP/HTTPS port to mount a DoS attack on
Jenkins through thread exhaustion.</p>
<h5>SECURITY-110/CVE-2014-3662 (User name discovery)</h5>
<p>Anonymous users can test if the user of a specific name exists or
not through login attempts.</p>
<h5>SECURITY-127&amp;128/CVE-2014-3663 (privilege escalation in job
configuration permission)</h5>
<p>An user with a permission limited
to Job/CONFIGURE can exploit this vulnerability to effectively
create a new job, which should have been only possible for users
with Job/CREATE permission, or to destroy jobs that he/she does not
have access otherwise.</p>
<h5>SECURITY-131/CVE-2014-3664 (directory traversal attack)</h5>
<p>Users with Overall/READ permission can access arbitrary files in
the file system readable by the Jenkins process, resulting in the
exposure of sensitive information, such as encryption keys.</p>
<h5>SECURITY-138/CVE-2014-3680 (Password exposure in DOM)</h5>
<p>If a parameterized job has a default value in a password field,
that default value gets exposed to users with Job/READ permission.
</p>
<h5>SECURITY-143/CVE-2014-3681 (XSS vulnerability in Jenkins
core)</h5>
<p>Reflected cross-site scripting vulnerability in Jenkins
core. An attacker can navigate the user to a carefully crafted URL
and have the user execute unintended actions.</p>
<h5>SECURITY-150/CVE-2014-3666 (remote code execution from CLI)</h5>
<p>Unauthenticated user can execute arbitrary code on Jenkins master
by sending carefully crafted packets over the CLI channel.</p>
<h5>SECURITY-155/CVE-2014-3667 (exposure of plugin code)</h5>
<p>Programs that constitute plugins can be downloaded by anyone with
the Overall/READ permission, resulting in the exposure of otherwise
sensitive information, such as hard-coded keys in plugins, if
any.</p>
<h5>SECURITY-159/CVE-2013-2186 (arbitrary file system write)</h5>
<p>Security vulnerability in commons fileupload allows
unauthenticated attacker to upload arbitrary files to Jenkins
master.</p>
<h5>SECURITY-149/CVE-2014-1869 (XSS vulnerabilities in
ZeroClipboard)</h5>
<p>reflective XSS vulnerability in one of the
library dependencies of Jenkins.</p>
<h5>SECURITY-113/CVE-2014-3678 (XSS vulnerabilities in monitoring
plugin)</h5> <p>Monitoring plugin allows an attacker to cause a
victim into executing unwanted actions on Jenkins instance.</p>
<h5>SECURITY-113/CVE-2014-3679 (hole in access control)</h5>
<p>Certain pages in monitoring plugin are visible to anonymous users,
allowing them to gain information that they are not supposed to.
</p>
<h1>Severity</h1>
<p>SECURITY-87 is rated <strong>medium</strong>, as it results in the
loss of functionality.</p>
<p>SECURITY-110 is rated <strong>medium</strong>, as it results in a
limited amount of information exposure.</p>
<p>SECURITY-127 and SECURITY-128 are rated <strong>high</strong>. The
formed can be used to further escalate privileges, and the latter
results inloss of data.</p>
<p>SECURITY-131 and SECURITY-138 is rated <strong>critical</strong>.
This vulnerabilities results in exposure of sensitie information
and is easily exploitable.</p>
<p>SECURITY-143 is rated <strong>high</strong>. It is a passive
attack, but it can result in a compromise of Jenkins master or loss
of data.</p>
<p>SECURITY-150 is rated <strong>critical</strong>. This attack can
be mounted by any unauthenticated anonymous user with HTTP
reachability to Jenkins instance, and results in remote code
execution on Jenkins.</p>
<p>SECURITY-155 is rated <strong>medium</strong>. This only affects
users who have installed proprietary plugins on publicly accessible
instances, which is relatively uncommon.</p>
<p>SECURITY-159 is rated <strong>critical</strong>. This attack can
be mounted by any unauthenticated anonymous user with HTTP
reachability to Jenkins instance.</p>
<p>SECURITY-113 is rated <strong>high</strong>. It is a passive
attack, but it can result in a compromise of Jenkins master or loss
of data.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01</url>
<cvename>CVE-2014-3661</cvename>
<cvename>CVE-2014-3662</cvename>
<cvename>CVE-2014-3663</cvename>
<cvename>CVE-2014-3664</cvename>
<cvename>CVE-2014-3680</cvename>
<cvename>CVE-2014-3681</cvename>
<cvename>CVE-2014-3666</cvename>
<cvename>CVE-2014-3667</cvename>
<cvename>CVE-2013-2186</cvename>
<cvename>CVE-2014-1869</cvename>
<cvename>CVE-2014-3678</cvename>
<cvename>CVE-2014-3679</cvename>
</references>
<dates>
<discovery>2014-10-01</discovery>
<entry>2014-10-01</entry>
</dates>
</vuln>
<vuln vid="512d1301-49b9-11e4-ae2c-c80aa9043978">
<topic>bash -- remote code execution</topic>
<affects>
<package>
<name>bash</name>
<name>bash-static</name>
<range><lt>4.3.25_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Note that this is different than the public "Shellshock"
issue.</p>
<p>Specially crafted environment variables could lead to remote
arbitrary code execution. This was fixed in bash 4.3.27, however
the port was patched with a mitigation in 4.3.25_2.</p>
</body>
</description>
<references>
<url>http://lcamtuf.blogspot.com/2014/09/bash-bug-apply-unofficial-patch-now.html</url>
<cvename>CVE-2014-6277</cvename>
<cvename>CVE-2014-6278</cvename>
</references>
<dates>
<discovery>2014-09-27</discovery>
<entry>2014-10-01</entry>
</dates>
</vuln>
<vuln vid="3e8b7f8a-49b0-11e4-b711-6805ca0b3d42">
<topic>phpMyAdmin -- XSS vulnerabilities</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>4.2.0</ge><lt>4.2.9.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-11.php">
<p>With a crafted ENUM value it is possible to trigger an
XSS in table search and table structure pages. This
vulnerability can be triggered only by someone who is
logged in to phpMyAdmin, as the usual token protection
prevents non-logged-in users from accessing the required
pages.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-11.php</url>
<cvename>CVE-2014-7217</cvename>
</references>
<dates>
<discovery>2014-10-01</discovery>
<entry>2014-10-01</entry>
</dates>
</vuln>
<vuln vid="4a4e9f88-491c-11e4-ae2c-c80aa9043978">
<topic>bash -- out-of-bounds memory access in parser</topic>
<affects>
<package>
<name>bash</name>
<name>bash-static</name>
<range><lt>4.3.27_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>RedHat security team reports:</p>
<blockquote cite="https://access.redhat.com/security/cve/CVE-2014-7186">
<p>It was discovered that the fixed-sized redir_stack could be forced
to overflow in the Bash parser, resulting in memory corruption, and
possibly leading to arbitrary code execution when evaluating
untrusted input that would not otherwise be run as code.</p>
</blockquote>
<blockquote cite="https://access.redhat.com/security/cve/CVE-2014-7187">
<p>An off-by-one error was discovered in the way Bash was handling
deeply nested flow control constructs. Depending on the layout of
the .bss segment, this could allow arbitrary execution of code that
would not otherwise be executed by Bash.</p>
</blockquote>
</body>
</description>
<references>
<url>https://access.redhat.com/security/cve/CVE-2014-7186</url>
<cvename>CVE-2014-7186</cvename>
<cvename>CVE-2014-7187</cvename>
</references>
<dates>
<discovery>2014-09-25</discovery>
<entry>2014-10-01</entry>
</dates>
</vuln>
<vuln vid="8e0e86ff-48b5-11e4-ab80-000c29f6ae42">
<topic>rsyslog -- remote syslog PRI vulnerability</topic>
<affects>
<package>
<name>rsyslog</name>
<range><lt>7.6.7</lt></range>
</package>
<package>
<name>rsyslog8</name>
<range><lt>8.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The rsyslog project reports:</p>
<blockquote cite="http://www.rsyslog.com/remote-syslog-pri-vulnerability/">
<p>potential abort when a message with PRI &gt; 191 was processed
if the "pri-text" property was used in active templates,
this could be abused to a remote denial of service from
permitted senders</p>
<p>The original fix for CVE-2014-3634 was not adequate.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.rsyslog.com/remote-syslog-pri-vulnerability/</url>
<cvename>CVE-2014-3634</cvename>
</references>
<dates>
<discovery>2014-09-30</discovery>
<entry>2014-09-30</entry>
<modified>2014-10-02</modified>
</dates>
</vuln>
<vuln vid="6c083cf8-4830-11e4-ae2c-c80aa9043978">
<topic>fish -- local privilege escalation and remote code execution</topic>
<affects>
<package>
<name>fish</name>
<range><ge>1.6.0</ge><lt>2.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Fish developer David Adam reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2014/09/28/8">
<p>This release fixes a number of local privilege escalation
vulnerability and one remote code execution vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2014/09/28/8</url>
<cvename>CVE-2014-2905</cvename>
<url>https://github.com/fish-shell/fish-shell/issues/1436</url>
<cvename>CVE-2014-2906</cvename>
<cvename>CVE-2014-3856</cvename>
<url>https://github.com/fish-shell/fish-shell/issues/1437</url>
<cvename>CVE-2014-2914</cvename>
<url>https://github.com/fish-shell/fish-shell/issues/1438</url>
<cvename>CVE-2014-3219</cvename>
<url>https://github.com/fish-shell/fish-shell/issues/1440</url>
</references>
<dates>
<discovery>2014-09-28</discovery>
<entry>2014-09-29</entry>
</dates>
</vuln>
<vuln vid="ca44b64c-4453-11e4-9ea1-c485083ca99c">
<topic>Flash player -- Multiple security vulnerabilities in www/linux-*-flashplugin11</topic>
<affects>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.400</lt></range>
</package>
<package>
<name>linux-c6-flashplugin</name>
<range><lt>11.2r202.400</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb14-21.html">
<p>These updates address vulnerabilities that could cause a crash
and potentially allow an attacker to take control of the affected system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0547</cvename>
<cvename>CVE-2014-0548</cvename>
<cvename>CVE-2014-0549</cvename>
<cvename>CVE-2014-0550</cvename>
<cvename>CVE-2014-0551</cvename>
<cvename>CVE-2014-0552</cvename>
<cvename>CVE-2014-0553</cvename>
<cvename>CVE-2014-0554</cvename>
<cvename>CVE-2014-0555</cvename>
<cvename>CVE-2014-0556</cvename>
<cvename>CVE-2014-0557</cvename>
<cvename>CVE-2014-0559</cvename>
<url>http://helpx.adobe.com/security/products/flash-player/apsb14-21.html</url>
</references>
<dates>
<discovery>2014-09-09</discovery>
<entry>2014-09-25</entry>
</dates>
</vuln>
<vuln vid="48108fb0-751c-4cbb-8f33-09239ead4b55">
<topic>NSS -- RSA Signature Forgery</topic>
<affects>
<package>
<name>linux-firefox</name>
<range><lt>32.0.3,1</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>31.1.2</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.29.1</lt></range>
</package>
<package>
<name>nss</name>
<range><lt>3.17.1</lt></range>
</package>
<package>
<name>linux-c6-nss</name>
<range><lt>3.16.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/security/announce/2014/mfsa2014-73.html">
<p>Antoine Delignat-Lavaud discovered that NSS is vulnerable
to a variant of a signature forgery attack previously
published by Daniel Bleichenbacher. This is due to lenient
parsing of ASN.1 values involved in a signature and could
lead to the forging of RSA certificates.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-1568</cvename>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-73.html</url>
</references>
<dates>
<discovery>2014-09-23</discovery>
<entry>2014-09-25</entry>
</dates>
</vuln>
<vuln vid="bd2ef267-4485-11e4-b0b7-00262d5ed8ee">
<topic>chromium -- RSA signature malleability in NSS</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>37.0.2062.124</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/">
<p>[414124] RSA signature malleability in NSS (CVE-2014-1568).
Thanks to Antoine Delignat-Lavaud of Prosecco/INRIA, Brian Smith
and Advanced Threat Research team at Intel Security</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-1568</cvename>
<url>http://googlechromereleases.blogspot.nl/</url>
</references>
<dates>
<discovery>2014-09-24</discovery>
<entry>2014-09-25</entry>
</dates>
</vuln>
<vuln vid="fb25333d-442f-11e4-98f3-5453ed2e2b49">
<topic>krfb -- Multiple security issues in bundled libvncserver</topic>
<affects>
<package>
<name>krfb</name>
<range><lt>4.12.5_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Martin Sandsmark reports:</p>
<blockquote cite="http://lists.kde.org/?l=kde-announce&amp;m=141153917319769&amp;w=2">
<p>krfb 4.14 [and earlier] embeds libvncserver which has had
several security issues.</p>
<p>Several remotely exploitable security issues have been
uncovered in libvncserver, some of which might allow a
remote authenticated user code execution or application
crashes.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-6055</cvename>
<mlist>http://lists.kde.org/?l=kde-announce&amp;m=141153917319769&amp;w=2</mlist>
</references>
<dates>
<discovery>2014-09-23</discovery>
<entry>2014-09-25</entry>
</dates>
</vuln>
<vuln vid="71ad81da-4414-11e4-a33e-3c970e169bc2">
<topic>bash -- remote code execution vulnerability</topic>
<affects>
<package>
<name>bash</name>
<name>bash-static</name>
<range><gt>3.0</gt><le>3.0.17</le></range>
<range><gt>3.1</gt><le>3.1.18</le></range>
<range><gt>3.2</gt><le>3.2.52</le></range>
<range><gt>4.0</gt><le>4.0.39</le></range>
<range><gt>4.1</gt><le>4.1.12</le></range>
<range><gt>4.2</gt><le>4.2.48</le></range>
<range><gt>4.3</gt><lt>4.3.25_1</lt></range>
</package>
<package>
<name>linux_base-c6</name>
<range><lt>6.5_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chet Ramey reports:</p>
<blockquote cite="https://lists.gnu.org/archive/html/bug-bash/2014-09/msg00081.html">
<p>Under certain circumstances, bash will execute user code
while processing the environment for exported function
definitions.</p>
</blockquote>
<p>The original fix released for CVE-2014-6271 was not adequate. A
similar vulnerability was discovered and tagged as CVE-2014-7169.</p>
</body>
</description>
<references>
<cvename>CVE-2014-6271</cvename>
<cvename>CVE-2014-7169</cvename>
<url>https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/</url>
<url>https://lists.gnu.org/archive/html/bug-bash/2014-09/msg00081.html</url>
<url>http://seclists.org/oss-sec/2014/q3/690</url>
</references>
<dates>
<discovery>2014-09-24</discovery>
<entry>2014-09-24</entry>
<modified>2014-09-25</modified>
</dates>
</vuln>
<vuln vid="e60d9e65-3f6b-11e4-ad16-001999f8d30b">
<topic>asterisk -- Remotely triggered crash</topic>
<affects>
<package>
<name>asterisk11</name>
<range><lt>11.12.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/security">
<p>When an out of call message - delivered by either the
SIP or PJSIP channel driver or the XMPP stack - is handled
in Asterisk, a crash can occur if the channel servicing
the message is sent into the ReceiveFax dialplan application
while using the res_fax_spandsp module.</p>
<p>Note that this crash does not occur when using the
res_fax_digium module. While this crash technically
occurs due to a configuration issue, as attempting to
receive a fax from a channel driver that only contains
textual information will never succeed, the likelihood
of having it occur is sufficiently high as to warrant
this advisory.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2014-010.pdf</url>
<url>https://issues.asterisk.org/jira/browse/ASTERISK-24301</url>
<url>https://www.asterisk.org/security</url>
</references>
<dates>
<discovery>2014-09-05</discovery>
<entry>2014-09-18</entry>
</dates>
</vuln>
<vuln vid="d3324c55-3f11-11e4-ad16-001999f8d30b">
<topic>squid -- Buffer overflow in SNMP processing</topic>
<affects>
<package>
<name>squid</name>
<range><lt>3.4.8</lt></range>
</package>
<package>
<name>squid32</name>
<range><gt>0</gt></range>
</package>
<package>
<name>squid33</name>
<range><lt>3.3.13_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The squid-cache project reports:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2014_3.txt">
<p>Due to incorrect buffer management Squid can be caused
by an attacker to write outside its allocated SNMP buffer.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.squid-cache.org/Advisories/SQUID-2014_3.txt</url>
<cvename>CVE-2014-6270</cvename>
</references>
<dates>
<discovery>2014-09-15</discovery>
<entry>2014-09-18</entry>
</dates>
</vuln>
<vuln vid="38242d51-3e58-11e4-ac2f-bcaec565249c">
<topic>dbus -- multiple vulnerabilities</topic>
<affects>
<package>
<name>dbus</name>
<range><lt>1.8.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon McVittie reports:</p>
<blockquote cite="http://lists.freedesktop.org/archives/dbus/2014-September/016343.html">
<p>Do not accept an extra fd in the padding of a cmsg message,
which could lead to a 4-byte heap buffer overrun
(CVE-2014-3635).</p>
<p>Reduce default for maximum Unix file descriptors passed per
message from 1024 to 16, preventing a uid with the default
maximum number of connections from exhausting the system
bus' file descriptors under Linux's default rlimit
(CVE-2014-3636).</p>
<p>Disconnect connections that still have a fd pending
unmarshalling after a new configurable limit,
pending_fd_timeout (defaulting to 150 seconds), removing
the possibility of creating an abusive connection that
cannot be disconnected by setting up a circular reference
to a connection's file descriptor (CVE-2014-3637).</p>
<p>Reduce default for maximum pending replies per connection
from 8192 to 128, mitigating an algorithmic complexity
denial-of-service attack (CVE-2014-3638).</p>
<p>Reduce default for authentication timeout on the system
bus from 30 seconds to 5 seconds, avoiding denial of service
by using up all unauthenticated connection slots; and when
all unauthenticated connection slots are used up, make new
connection attempts block instead of disconnecting them
(CVE-2014-3639).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3635</cvename>
<cvename>CVE-2014-3636</cvename>
<cvename>CVE-2014-3637</cvename>
<cvename>CVE-2014-3638</cvename>
<cvename>CVE-2014-3639</cvename>
<url>http://lists.freedesktop.org/archives/dbus/2014-September/016343.html</url>
</references>
<dates>
<discovery>2014-09-16</discovery>
<entry>2014-09-17</entry>
</dates>
</vuln>
<vuln vid="77b784bb-3dc6-11e4-b191-f0def16c5c1b">
<topic>nginx -- inject commands into SSL session vulnerability</topic>
<affects>
<package>
<name>nginx</name>
<range><ge>0.6.0</ge><lt>1.6.2,2</lt></range>
</package>
<package>
<name>nginx-devel</name>
<range><ge>0.5.6</ge><lt>1.7.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The nginx project reports:</p>
<blockquote cite="http://mailman.nginx.org/pipermail/nginx-announce/2014/000147.html">
<p>Security: it was possible to reuse SSL sessions in unrelated contexts
if a shared SSL session cache or the same TLS session ticket key was
used for multiple "server" blocks (CVE-2014-3616).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3616</cvename>
<url>http://mailman.nginx.org/pipermail/nginx-announce/2014/000147.html</url>
</references>
<dates>
<discovery>2014-09-16</discovery>
<entry>2014-09-16</entry>
</dates>
</vuln>
<vuln vid="cc627e6c-3b89-11e4-b629-6805ca0b3d42">
<topic>phpMyAdmin -- XSRF/CSRF due to DOM based XSS in the micro history feature</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>4.2.0</ge><lt>4.2.8.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-10.php">
<p>XSRF/CSRF due to DOM based XSS in the micro history feature.</p>
<p>By deceiving a logged-in user to click on a crafted URL,
it is possible to perform remote code execution and in some
cases, create a root account due to a DOM based XSS
vulnerability in the micro history feature.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-10.php</url>
<cvename>CVE-2014-6300</cvename>
</references>
<dates>
<discovery>2014-09-13</discovery>
<entry>2014-09-13</entry>
</dates>
</vuln>
<vuln vid="36858e78-3963-11e4-ad84-000c29f6ae42">
<topic>security/ossec-hids-* -- root escalation via temp files</topic>
<affects>
<package>
<name>ossec-hids-server</name>
<name>ossec-hids-client</name>
<name>ossec-hids-local</name>
<range><lt>2.8.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OSSEC reports:</p>
<blockquote cite="http://www.ossec.net/?p=1135">
<p>This correction will create the temp file for the hosts deny file
in /var/ossec and will use mktemp where available to create
NON-predictable temp file name. In cases where mktemp is not
available we have written a BAD version of mktemp, but should be a
little better then just process id.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-5284</cvename>
<url>http://www.ossec.net/?p=1135</url>
</references>
<dates>
<discovery>2014-09-09</discovery>
<entry>2014-09-11</entry>
</dates>
</vuln>
<vuln vid="36a415c8-3867-11e4-b522-00262d5ed8ee">
<topic>www/chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>37.0.2062.120</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/">
<p>4 security fixes in this release, including:</p>
<ul>
<li>[401362] High CVE-2014-3178: Use-after-free in rendering.
Credit to miaubiz.</li>
<li>[411014] CVE-2014-3179: Various fixes from internal audits,
fuzzing and other initiatives.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3178</cvename>
<cvename>CVE-2014-3179</cvename>
<url>http://googlechromereleases.blogspot.nl/</url>
</references>
<dates>
<discovery>2014-09-09</discovery>
<entry>2014-09-09</entry>
</dates>
</vuln>
<vuln vid="6318b303-3507-11e4-b76c-0011d823eebd">
<topic>trafficserver -- unspecified vulnerability</topic>
<affects>
<package>
<name>trafficserver</name>
<range><lt>5.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Bryan Call reports:</p>
<blockquote cite="http://mail-archives.apache.org/mod_mbox/trafficserver-users/201407.mbox/%3CBFCEC9C8-1BE9-4DCA-AF9C-B8FE798EEC07@yahoo-inc.com%3E">
<p>Below is our announcement for the security issue reported to us
from Yahoo! Japan. All versions of Apache Traffic Server are
vulnerable. We urge users to upgrade to either 4.2.1.1 or 5.0.1
immediately.</p>
<p>This fixes CVE-2014-3525 and limits access to how the health
checks are performed.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3525</cvename>
<url>http://mail-archives.apache.org/mod_mbox/trafficserver-users/201407.mbox/%3CBFCEC9C8-1BE9-4DCA-AF9C-B8FE798EEC07@yahoo-inc.com%3E</url>
</references>
<dates>
<discovery>2014-07-23</discovery>
<entry>2014-09-05</entry>
</dates>
</vuln>
<vuln vid="fd5f305d-2d3d-11e4-aa3d-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>37.0.2062.94</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/">
<p>50 security fixes in this release, including:</p>
<ul>
<li>[386988] Critical CVE-2014-3176, CVE-2014-3177: A special reward
to lokihardt@asrt for a combination of bugs in V8, IPC, sync, and
extensions that can lead to remote code execution outside of the
sandbox.</li>
<li>[369860] High CVE-2014-3168: Use-after-free in SVG. Credit to
cloudfuzzer.</li>
<li>[387389] High CVE-2014-3169: Use-after-free in DOM. Credit to
Andrzej Dyjak.</li>
<li>[390624] High CVE-2014-3170: Extension permission dialog spoofing.
Credit to Rob Wu.</li>
<li>[390928] High CVE-2014-3171: Use-after-free in bindings. Credit to
cloudfuzzer.</li>
<li>[367567] Medium CVE-2014-3172: Issue related to extension debugging.
Credit to Eli Grey.</li>
<li>[376951] Medium CVE-2014-3173: Uninitialized memory read in WebGL.
Credit to jmuizelaar.</li>
<li>[389219] Medium CVE-2014-3174: Uninitialized memory read in Web
Audio. Credit to Atte Kettunen from OUSPG.</li>
<li>[406143] CVE-2014-3175: Various fixes from internal audits, fuzzing
and other initiatives (Chrome 37).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3168</cvename>
<cvename>CVE-2014-3169</cvename>
<cvename>CVE-2014-3170</cvename>
<cvename>CVE-2014-3171</cvename>
<cvename>CVE-2014-3172</cvename>
<cvename>CVE-2014-3173</cvename>
<cvename>CVE-2014-3174</cvename>
<cvename>CVE-2014-3175</cvename>
<cvename>CVE-2014-3176</cvename>
<cvename>CVE-2014-3177</cvename>
<url>http://googlechromereleases.blogspot.nl/</url>
</references>
<dates>
<discovery>2014-08-26</discovery>
<entry>2014-08-26</entry>
</dates>
</vuln>
<vuln vid="84203724-296b-11e4-bebd-000c2980a9f3">
<topic>file -- buffer overruns and missing buffer size tests</topic>
<affects>
<package>
<name>file</name>
<range><lt>5.19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Christos Zoulas reports:</p>
<blockquote cite="http://mx.gw.com/pipermail/file/2014/001553.html">
<p>A specially crafted file can cause a segmentation fault.</p>
</blockquote>
</body>
</description>
<references>
<url>http://mx.gw.com/pipermail/file/2014/001553.html</url>
</references>
<dates>
<discovery>2014-06-09</discovery>
<entry>2014-08-21</entry>
</dates>
</vuln>
<vuln vid="3c5579f7-294a-11e4-99f6-00e0814cab4e">
<topic>django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py27-django</name>
<range><ge>1.6</ge><lt>1.6.6</lt></range>
</package>
<package>
<name>py27-django15</name>
<range><ge>1.5</ge><lt>1.5.9</lt></range>
</package>
<package>
<name>py27-django14</name>
<range><ge>1.4</ge><lt>1.4.14</lt></range>
</package>
<package>
<name>py32-django</name>
<range><ge>1.6</ge><lt>1.6.6</lt></range>
</package>
<package>
<name>py32-django15</name>
<range><ge>1.5</ge><lt>1.5.9</lt></range>
</package>
<package>
<name>py33-django</name>
<range><ge>1.6</ge><lt>1.6.6</lt></range>
</package>
<package>
<name>py33-django15</name>
<range><ge>1.5</ge><lt>1.5.9</lt></range>
</package>
<package>
<name>py34-django</name>
<range><ge>1.6</ge><lt>1.6.6</lt></range>
</package>
<package>
<name>py34-django15</name>
<range><ge>1.5</ge><lt>1.5.9</lt></range>
</package>
<package>
<name>py27-django-devel</name>
<range><lt>20140821,1</lt></range>
</package>
<package>
<name>py32-django-devel</name>
<range><lt>20140821,1</lt></range>
</package>
<package>
<name>py33-django-devel</name>
<range><lt>20140821,1</lt></range>
</package>
<package>
<name>py34-django-devel</name>
<range><lt>20140821,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Django project reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2014/aug/20/security/">
<p>These releases address an issue with reverse() generating external
URLs; a denial of service involving file uploads; a potential
session hijacking issue in the remote-user middleware; and a data
leak in the administrative interface. We encourage all users of
Django to upgrade as soon as possible.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.djangoproject.com/weblog/2014/aug/20/security/</url>
<cvename>CVE-2014-0480</cvename>
<cvename>CVE-2014-0481</cvename>
<cvename>CVE-2014-0482</cvename>
<cvename>CVE-2014-0483</cvename>
</references>
<dates>
<discovery>2014-08-20</discovery>
<entry>2014-08-21</entry>
</dates>
</vuln>
<vuln vid="d2a892b9-2605-11e4-9da0-00a0986f28c4">
<topic>PHP multiple vulnerabilities</topic>
<affects>
<package>
<name>php53</name>
<range><lt>5.3.29</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP Team reports:</p>
<blockquote cite="http://php.net/ChangeLog-5.php#5.3.29">
<p>insecure temporary file use in the configure script</p>
<p>unserialize() SPL ArrayObject / SPLObjectStorage Type Confusion
</p>
<p>Heap buffer over-read in DateInterval</p>
<p>fileinfo: cdf_read_short_sector insufficient boundary check</p>
<p>fileinfo: CDF infinite loop in nelements DoS</p>
<p>fileinfo: fileinfo: numerous file_printf calls resulting in
performance degradation)</p>
<p>Fix potential segfault in dns_check_record()</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-6712</cvename>
<cvename>CVE-2014-0207</cvename>
<cvename>CVE-2014-0237</cvename>
<cvename>CVE-2014-0238</cvename>
<cvename>CVE-2014-3515</cvename>
<cvename>CVE-2014-3981</cvename>
<cvename>CVE-2014-4049</cvename>
<url>http://php.net/ChangeLog-5.php#5.3.29</url>
<url>https://www.sektioneins.de/en/blog/14-07-04-phpinfo-infoleak.html</url>
</references>
<dates>
<discovery>2014-08-14</discovery>
<entry>2014-08-18</entry>
</dates>
</vuln>
<vuln vid="fbb01289-2645-11e4-bc44-6805ca0b3d42">
<topic>phpMyAdmin -- XSS vulnerabilities</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>4.2.0</ge><lt>4.2.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-8.php">
<p>Multiple XSS vulnerabilities in browse table, ENUM
editor, monitor, query charts and table relations pages.</p>
<p> With a crafted database, table or a primary/unique key
column name it is possible to trigger an XSS when dropping
a row from the table. With a crafted column name it is
possible to trigger an XSS in the ENUM editor dialog. With
a crafted variable name or a crafted value for unit field
it is possible to trigger a self-XSS when adding a new
chart in the monitor page. With a crafted value for x-axis
label it is possible to trigger a self-XSS in the query
chart page. With a crafted relation name it is possible to
trigger an XSS in table relations page.</p>
</blockquote>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-9.php">
<p>XSS in view operations page.</p>
<p>With a crafted view name it is possible to trigger an
XSS when dropping the view in view operation page.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-8.php</url>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-9.php</url>
<cvename>CVE-2014-5273</cvename>
<cvename>CVE-2014-5274</cvename>
</references>
<dates>
<discovery>2014-08-17</discovery>
<entry>2014-08-17</entry>
</dates>
</vuln>
<vuln vid="df7754c0-2294-11e4-b505-000c6e25e3e9">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>36.0.1985.143</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl">
<p>12 security fixes in this release, including</p>
<ul>
<li>[390174] High CVE-2014-3165: Use-after-free in web sockets.
Credit to Collin Payne.</li>
<li>[398925] High CVE-2014-3166: Information disclosure in SPDY.
Credit to Antoine Delignat-Lavaud.</li>
<li>[400950] CVE-2014-3167: Various fixes from internal audits,
fuzzing and other initiatives.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3165</cvename>
<cvename>CVE-2014-3166</cvename>
<cvename>CVE-2014-3167</cvename>
<url>http://googlechromereleases.blogspot.nl</url>
</references>
<dates>
<discovery>2014-08-12</discovery>
<entry>2014-08-13</entry>
</dates>
</vuln>
<vuln vid="69048656-2187-11e4-802c-20cf30e32f6d">
<topic>serf -- SSL Certificate Null Byte Poisoning</topic>
<affects>
<package>
<name>serf</name>
<range><lt>1.3.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>serf Development list reports:</p>
<blockquote cite="https://groups.google.com/forum/#!topic/serf-dev/NvgPoK6sFsc">
<p>Serf provides APIs to retrieve information about a certificate. These
APIs return the information as NUL terminated strings (commonly called C
strings). X.509 uses counted length strings which may include a NUL byte.
This means that a library user will interpret any information as ending
upon seeing this NUL byte and will only see a partial value for that field.
</p>
<p>Attackers could exploit this vulnerability to create a certificate that a
client will accept for a different hostname than the full certificate is
actually for by embedding a NUL byte in the certificate.</p>
<p>This can lead to a man-in-the-middle attack. There are no known instances
of this problem being exploited in the wild and in practice it should be
difficult to actually exploit this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3504</cvename>
</references>
<dates>
<discovery>2014-08-06</discovery>
<entry>2014-08-11</entry>
</dates>
</vuln>
<vuln vid="83a418cc-2182-11e4-802c-20cf30e32f6d">
<topic>subversion -- several vulnerabilities</topic>
<affects>
<package>
<name>subversion16</name>
<range><ge>1.0.0</ge><lt>1.7.18</lt></range>
</package>
<package>
<name>subversion17</name>
<range><ge>1.0.0</ge><lt>1.7.18</lt></range>
</package>
<package>
<name>subversion</name>
<range><ge>1.0.0</ge><lt>1.7.18</lt></range>
<range><ge>1.8.0</ge><lt>1.8.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Subversion Project reports:</p>
<blockquote cite="http://subversion.apache.org/security/CVE-2014-3522-advisory.txt">
<p>Using the Serf RA layer of Subversion for HTTPS uses the apr_fnmatch API
to handle matching wildcards in certificate Common Names and Subject
Alternate Names. However, apr_fnmatch is not designed for this purpose.
Instead it is designed to behave like common shell globbing. In particular
this means that '*' is not limited to a single label within a hostname
(i.e. it will match '.'). But even further apr_fnmatch supports '?' and
character classes (neither of which are part of the RFCs defining how
certificate validation works).</p>
<p>Subversion stores cached credentials by an MD5 hash based on the URL and
the authentication realm of the server the credentials are cached for.
MD5 has been shown to be subject to chosen plaintext hash collisions.
This means it may be possible to generate an authentication realm which
results in the same MD5 hash for a different URL.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3522</cvename>
<cvename>CVE-2014-3528</cvename>
<url>http://subversion.apache.org/security/CVE-2014-3522-advisory.txt</url>
<url>http://subversion.apache.org/security/CVE-2014-3528-advisory.txt</url>
</references>
<dates>
<discovery>2014-08-06</discovery>
<entry>2014-08-11</entry>
</dates>
</vuln>
<vuln vid="ad747a01-1fee-11e4-8ff1-f0def16c5c1b">
<topic>nginx -- inject commands into SSL session vulnerability</topic>
<affects>
<package>
<name>nginx</name>
<range><ge>1.6.0,2</ge><lt>1.6.1,2</lt></range>
</package>
<package>
<name>nginx-devel</name>
<range><ge>1.5.6</ge><lt>1.7.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The nginx project reports:</p>
<blockquote cite="http://mailman.nginx.org/pipermail/nginx-announce/2014/000144.html">
<p>Security: pipelined commands were not discarded after STARTTLS
command in SMTP proxy (CVE-2014-3556); the bug had appeared in 1.5.6.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3556</cvename>
<url>http://mailman.nginx.org/pipermail/nginx-announce/2014/000144.html</url>
</references>
<dates>
<discovery>2014-08-05</discovery>
<entry>2014-08-09</entry>
</dates>
</vuln>
<vuln vid="8aff07eb-1dbd-11e4-b6ba-3c970e169bc2">
<topic>OpenSSL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><ge>1.0.1</ge><lt>1.0.1_14</lt></range>
</package>
<package>
<name>mingw32-openssl</name>
<range><ge>1.0.1</ge><lt>1.0.1i</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL Project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv_20140806.txt">
<p>A flaw in OBJ_obj2txt may cause pretty printing functions
such as X509_name_oneline, X509_name_print_ex et al. to leak
some information from the stack. [CVE-2014-3508]</p>
<p>The issue affects OpenSSL clients and allows a malicious
server to crash the client with a null pointer dereference
(read) by specifying an SRP ciphersuite even though it was
not properly negotiated with the client. [CVE-2014-5139]</p>
<p>If a multithreaded client connects to a malicious server
using a resumed session and the server sends an ec point
format extension it could write up to 255 bytes to freed
memory. [CVE-2014-3509]</p>
<p>An attacker can force an error condition which causes
openssl to crash whilst processing DTLS packets due to
memory being freed twice. This can be exploited through
a Denial of Service attack. [CVE-2014-3505]</p>
<p>An attacker can force openssl to consume large amounts
of memory whilst processing DTLS handshake messages.
This can be exploited through a Denial of Service
attack. [CVE-2014-3506]</p>
<p>By sending carefully crafted DTLS packets an attacker
could cause openssl to leak memory. This can be exploited
through a Denial of Service attack. [CVE-2014-3507]</p>
<p>OpenSSL DTLS clients enabling anonymous (EC)DH
ciphersuites are subject to a denial of service attack.
A malicious server can crash the client with a null pointer
dereference (read) by specifying an anonymous (EC)DH
ciphersuite and sending carefully crafted handshake
messages. [CVE-2014-3510]</p>
<p>A flaw in the OpenSSL SSL/TLS server code causes the
server to negotiate TLS 1.0 instead of higher protocol
versions when the ClientHello message is badly
fragmented. This allows a man-in-the-middle attacker
to force a downgrade to TLS 1.0 even if both the server
and the client support a higher protocol version, by
modifying the client's TLS records. [CVE-2014-3511]</p>
<p>A malicious client or server can send invalid SRP
parameters and overrun an internal buffer. Only
applications which are explicitly set up for SRP
use are affected. [CVE-2014-3512]</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.openssl.org/news/secadv_20140806.txt</url>
<cvename>CVE-2014-3505</cvename>
<cvename>CVE-2014-3506</cvename>
<cvename>CVE-2014-3507</cvename>
<cvename>CVE-2014-3508</cvename>
<cvename>CVE-2014-3509</cvename>
<cvename>CVE-2014-3510</cvename>
<cvename>CVE-2014-3511</cvename>
<cvename>CVE-2014-3512</cvename>
<cvename>CVE-2014-5139</cvename>
</references>
<dates>
<discovery>2014-08-06</discovery>
<entry>2014-08-06</entry>
</dates>
</vuln>
<vuln vid="be5421ab-1b56-11e4-a767-5453ed2e2b49">
<topic>krfb -- Possible Denial of Service or code execution via integer overflow</topic>
<affects>
<package>
<name>krfb</name>
<range><lt>4.12.5_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Albert Aastals Cid reports:</p>
<blockquote cite="http://lists.kde.org/?l=kde-announce&amp;m=140709940701878&amp;w=2">
<p>krfb embeds libvncserver which embeds liblzo2, it contains various
flaws that result in integer overflow problems.</p>
<p>This potentially allows a malicious application to create a
possible denial of service or code execution. Due to the need to
exploit precise details of the target architecture and threading it
is unlikely that remote code execution can be achieved in
practice.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-4607</cvename>
<mlist>http://lists.kde.org/?l=kde-announce&amp;m=140709940701878&amp;w=2</mlist>
</references>
<dates>
<discovery>2014-08-03</discovery>
<entry>2014-08-03</entry>
</dates>
</vuln>
<vuln vid="89ff45e3-1a57-11e4-bebd-000c2980a9f3">
<topic>samba -- remote code execution</topic>
<affects>
<package>
<name>samba4</name>
<range><ge>4.0.0</ge><lt>4.0.21</lt></range>
</package>
<package>
<name>samba41</name>
<range><ge>4.1.0</ge><lt>4.1.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Samba developers report:</p>
<blockquote cite="http://www.samba.org/samba/security/CVE-2014-3560">
<p>A malicious browser can send packets that may overwrite the heap of
the target nmbd NetBIOS name services daemon. It may be possible to
use this to generate a remote code execution vulnerability as the
superuser (root).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3560</cvename>
<url>http://www.samba.org/samba/security/CVE-2014-3560</url>
</references>
<dates>
<discovery>2014-07-31</discovery>
<entry>2014-08-02</entry>
</dates>
</vuln>
<vuln vid="90ca3ba5-19e6-11e4-8616-001b3856973b">
<topic>gpgme -- heap-based buffer overflow in gpgsm status handler</topic>
<affects>
<package>
<name>gpgme</name>
<range><lt>1.5.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tomas Trnka reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=1113267">
<p>Gpgme contains a buffer overflow in the gpgsm status handler
that could possibly be exploited using a specially crafted certificate.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3564</cvename>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1113267</url>
</references>
<dates>
<discovery>2014-06-25</discovery>
<entry>2014-08-02</entry>
</dates>
</vuln>
<vuln vid="2f90556f-18c6-11e4-9cc4-5453ed2e2b49">
<topic>kdelibs -- KAuth PID Reuse Flaw</topic>
<affects>
<package>
<name>kdelibs</name>
<range><lt>4.12.5_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Martin Sandsmark reports:</p>
<blockquote cite="http://lists.kde.org/?l=kde-announce&amp;m=140674898412923&amp;w=2">
<p>The KAuth framework uses polkit-1 API which tries to authenticate
using the requestors PID. This is prone to PID reuse race
conditions.</p>
<p>This potentially allows a malicious application to pose as another
for authentication purposes when executing privileged actions.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-5033</cvename>
<mlist>http://lists.kde.org/?l=kde-announce&amp;m=140674898412923&amp;w=2</mlist>
</references>
<dates>
<discovery>2014-07-30</discovery>
<entry>2014-07-31</entry>
</dates>
</vuln>
<vuln vid="31c09848-1829-11e4-bf04-60a44c524f57">
<topic>tor -- traffic confirmation attack</topic>
<affects>
<package>
<name>tor</name>
<range><lt>0.2.4.23</lt></range>
</package>
<package>
<name>tor-devel</name>
<range><lt>0.2.5.6.a</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Tor Project reports:</p>
<blockquote cite="https://lists.torproject.org/pipermail/tor-announce/2014-July/000094.html">
<p>Tor before 0.2.4.23 and 0.2.5 before 0.2.5.6-alpha maintains a
circuit after an inbound RELAY_EARLY cell is received by a client,
which makes it easier for remote attackers to conduct
traffic-confirmation attacks by using the pattern of RELAY and
RELAY_EARLY cells as a means of communicating information about
hidden service names.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.torproject.org/pipermail/tor-announce/2014-July/000094.html</url>
<url>https://blog.torproject.org/blog/tor-security-advisory-relay-early-traffic-confirmation-attack</url>
<cvename>CVE-2014-5117</cvename>
</references>
<dates>
<discovery>2014-07-30</discovery>
<entry>2014-07-30</entry>
</dates>
</vuln>
<vuln vid="13419364-1685-11e4-bf04-60a44c524f57">
<topic>i2p -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>i2p</name>
<range><lt>0.9.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The i2p project reports:</p>
<blockquote cite="http://geti2p.net/en/blog/post/2014/07/26/0.9.14-Release">
<p>XSS and remote execution vulnerabilities reported by Exodus Intelligence.</p>
</blockquote>
<p>Exodus Intelligence reports:</p>
<blockquote cite="http://blog.exodusintel.com/2014/07/23/silverbullets_and_fairytails/">
<p>The vulnerability we have found is able to perform remote code
execution with a specially crafted payload. This payload can be
customized to unmask a user and show the public IP address in
which the user connected from within 'a couple of seconds.'</p>
</blockquote>
</body>
</description>
<references>
<url>http://blog.exodusintel.com/2014/07/23/silverbullets_and_fairytails/</url>
<url>http://geti2p.net/en/blog/post/2014/07/26/0.9.14-Release</url>
</references>
<dates>
<discovery>2014-07-24</discovery>
<entry>2014-07-28</entry>
</dates>
</vuln>
<vuln vid="9defb2d6-1404-11e4-8cae-20cf30e32f6d">
<topic>bugzilla -- Cross Site Request Forgery</topic>
<affects>
<package>
<name>bugzilla44</name>
<range><lt>4.4.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>A Bugzilla Security Advisory reports:</h1>
<blockquote cite="http://www.bugzilla.org/security/4.0.13/">
<p>Adobe does not properly restrict the SWF file format,
which allows remote attackers to conduct cross-site
request forgery (CSRF) attacks against Bugzilla's JSONP
endpoint, possibly obtaining sensitive bug information,
via a crafted OBJECT element with SWF content satisfying
the character-set requirements of a callback API.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-1546</cvename>
</references>
<dates>
<discovery>2014-07-24</discovery>
<entry>2014-07-25</entry>
</dates>
</vuln>
<vuln vid="f927e06c-1109-11e4-b090-20cf30e32f6d">
<topic>apache22 -- several vulnerabilities</topic>
<affects>
<package>
<name>apache22</name>
<range><gt>2.2.0</gt><lt>2.2.29</lt></range>
</package>
<package>
<name>apache22-event-mpm</name>
<range><gt>2.2.0</gt><lt>2.2.29</lt></range>
</package>
<package>
<name>apache22-itk-mpm</name>
<range><gt>2.2.0</gt><lt>2.2.29</lt></range>
</package>
<package>
<name>apache22-peruser-mpm</name>
<range><gt>2.2.0</gt><lt>2.2.29</lt></range>
</package>
<package>
<name>apache22-worker-mpm</name>
<range><gt>2.2.0</gt><lt>2.2.29</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache HTTP SERVER PROJECT reports:</p>
<blockquote cite="http://www.apache.org/dist/httpd/CHANGES_2.2.29">
<p> mod_deflate: The DEFLATE input filter (inflates request bodies) now
limits the length and compression ratio of inflated request bodies to
avoid denial of service via highly compressed bodies. See directives
DeflateInflateLimitRequestBody, DeflateInflateRatioLimit, and
DeflateInflateRatioBurst.</p>
<p>mod_cgid: Fix a denial of service against CGI scripts that do not consume
stdin that could lead to lingering HTTPD child processes filling up the
scoreboard and eventually hanging the server. By default, the client I/O
timeout (Timeout directive) now applies to communication with scripts. The
CGIDScriptTimeout directive can be used to set a different timeout for
communication with scripts.</p>
<p>Fix a race condition in scoreboard handling, which could lead to a heap
buffer overflow.</p>
<p>core: HTTP trailers could be used to replace HTTP headers late during
request processing, potentially undoing or otherwise confusing modules
that examined or modified request headers earlier. Adds "MergeTrailers"
directive to restore legacy behavior.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0118</cvename>
<cvename>CVE-2014-0231</cvename>
<cvename>CVE-2014-0226</cvename>
<cvename>CVE-2013-5704</cvename>
</references>
<dates>
<discovery>2014-07-19</discovery>
<entry>2014-07-24</entry>
<modified>2014-09-03</modified>
</dates>
</vuln>
<vuln vid="81fc1076-1286-11e4-bebd-000c2980a9f3">
<topic>tomcat -- multiple vulnerabilities</topic>
<affects>
<package>
<name>tomcat6</name>
<range><lt>6.0.40</lt></range>
</package>
<package>
<name>tomcat7</name>
<range><lt>7.0.53</lt></range>
</package>
<package>
<name>tomcat8</name>
<range><lt>8.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tomcat Security Team reports:</p>
<blockquote cite="https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.54">
<p>Tomcat does not properly restrict XSLT stylesheets, which allows
remote attackers to bypass security-manager restrictions and read
arbitrary files via a crafted web application that provides an XML
external entity declaration in conjunction with an entity
reference, related to an XML External Entity (XXE) issue.</p>
<p>An integer overflow, when operated behind a reverse proxy, allows
remote attackers to conduct HTTP request smuggling attacks via a
crafted Content-Length HTTP header.</p>
<p>An integer overflow in parseChunkHeader allows remote attackers
to cause a denial of service (resource consumption) via a malformed
chunk size in chunked transfer coding of a request during the
streaming of data.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0096</cvename>
<cvename>CVE-2014-0099</cvename>
<cvename>CVE-2014-0075</cvename>
<url>https://tomcat.apache.org/security-6.html</url>
<url>https://tomcat.apache.org/security-7.html</url>
<url>https://tomcat.apache.org/security-8.html</url>
</references>
<dates>
<discovery>2014-05-23</discovery>
<entry>2014-07-23</entry>
</dates>
</vuln>
<vuln vid="978b0f76-122d-11e4-afe3-bc5ff4fb5e7b">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>31.0,1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>24.7.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>31.0,1</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>24.7.0</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>24.7.0</lt></range>
</package>
<package>
<name>nss</name>
<range><lt>3.16.1_2</lt></range>
<!-- CVE-2014-1544/Bug 963150 -->
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2014-66 IFRAME sandbox same-origin access through
redirect</p>
<p>MFSA 2014-65 Certificate parsing broken by non-standard
character encoding</p>
<p>MFSA 2014-64 Crash in Skia library when scaling high
quality images</p>
<p>MFSA 2014-63 Use-after-free while when manipulating
certificates in the trusted cache</p>
<p>MFSA 2014-62 Exploitable WebGL crash with Cesium
JavaScript library</p>
<p>MFSA 2014-61 Use-after-free with FireOnStateChange
event</p>
<p>MFSA 2014-60 Toolbar dialog customization event
spoofing</p>
<p>MFSA 2014-59 Use-after-free in DirectWrite font
handling</p>
<p>MFSA 2014-58 Use-after-free in Web Audio due to
incorrect control message ordering</p>
<p>MFSA 2014-57 Buffer overflow during Web Audio
buffering for playback</p>
<p>MFSA 2014-56 Miscellaneous memory safety hazards
(rv:31.0 / rv:24.7)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-1544</cvename>
<cvename>CVE-2014-1547</cvename>
<cvename>CVE-2014-1548</cvename>
<cvename>CVE-2014-1549</cvename>
<cvename>CVE-2014-1550</cvename>
<cvename>CVE-2014-1551</cvename>
<cvename>CVE-2014-1552</cvename>
<cvename>CVE-2014-1555</cvename>
<cvename>CVE-2014-1556</cvename>
<cvename>CVE-2014-1557</cvename>
<cvename>CVE-2014-1558</cvename>
<cvename>CVE-2014-1559</cvename>
<cvename>CVE-2014-1560</cvename>
<cvename>CVE-2014-1561</cvename>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-56.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-57.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-58.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-59.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-60.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-61.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-62.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-63.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-64.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-65.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-66.html</url>
<url>https://www.mozilla.org/security/announce/</url>
</references>
<dates>
<discovery>2014-07-22</discovery>
<entry>2014-07-23</entry>
</dates>
</vuln>
<vuln vid="ecea9e92-0be5-4931-88da-8772d044972a">
<topic>mcollective -- cert valication issue</topic>
<affects>
<package>
<name>mcollective</name>
<range><lt>2.5.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Melissa Stone reports:</p>
<blockquote cite="https://groups.google.com/forum/#!topic/puppet-announce/cPykqUXMmK4">
<p>The MCollective aes_security public key plugin does not correctly
validate certs against the CA. By exploiting this vulnerability
within a race/initialization window, an attacker with local access
could initiate an unauthorized MCollective client connection with a
server, and thus control the mcollective plugins running on that
server. This vulnerability requires a collective be configured to
use the aes_security plugin. Puppet Enterprise and open source
MCollective are not configured to use the plugin and are not
vulnerable by default.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3251</cvename>
<url>https://groups.google.com/forum/#!topic/puppet-announce/cPykqUXMmK4</url>
</references>
<dates>
<discovery>2014-07-09</discovery>
<entry>2014-07-21</entry>
</dates>
</vuln>
<vuln vid="904d78b8-0f7e-11e4-8b71-5453ed2e2b49">
<topic>qt4-imageformats, qt5-gui -- DoS vulnerability in the GIF image handler</topic>
<affects>
<package>
<name>qt4-imageformats</name>
<range><lt>4.8.6_1</lt></range>
</package>
<package>
<name>qt5-gui</name>
<range><lt>5.2.1_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Richard J. Moore reports:</p>
<blockquote cite="http://lists.qt-project.org/pipermail/announce/2014-April/000045.html">
<p>The builtin GIF decoder in QtGui prior to Qt 5.3 contained a bug
that would lead to a null pointer dereference when loading certain
hand crafted corrupt GIF files. This in turn would cause the
application loading these hand crafted GIFs to crash.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0190</cvename>
<bid>67087</bid>
<mlist>http://lists.qt-project.org/pipermail/announce/2014-April/000045.html</mlist>
</references>
<dates>
<discovery>2014-04-24</discovery>
<entry>2014-07-19</entry>
<modified>2014-07-21</modified>
</dates>
</vuln>
<vuln vid="4364e1f1-0f44-11e4-b090-20cf30e32f6d">
<topic>apache24 -- several vulnerabilities</topic>
<affects>
<package>
<name>apache24</name>
<range><lt>2.4.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Apache HTTP SERVER PROJECT reports:</h1>
<blockquote cite="http://svn.apache.org/viewvc/httpd/httpd/branches/2.4.x/CHANGES?view=markup&amp;pathrev=1610737">
<p>mod_proxy: Fix crash in Connection header handling which allowed a
denial of service attack against a reverse proxy with a threaded MPM.</p>
<p>Fix a race condition in scoreboard handling, which could lead to a
heap buffer overflow.</p>
<p>mod_deflate: The DEFLATE input filter (inflates request bodies) now
limits the length and compression ratio of inflated request bodies to avoid
denial of sevice via highly compressed bodies. See directives
DeflateInflateLimitRequestBody, DeflateInflateRatioLimit,
and DeflateInflateRatioBurst.</p>
<p>mod_cgid: Fix a denial of service against CGI scripts that do
not consume stdin that could lead to lingering HTTPD child processes
filling up the scoreboard and eventually hanging the server. By
default, the client I/O timeout (Timeout directive) now applies to
communication with scripts. The CGIDScriptTimeout directive can be
used to set a different timeout for communication with scripts.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0117</cvename>
<cvename>CVE-2014-3523</cvename>
<cvename>CVE-2014-0226</cvename>
<cvename>CVE-2014-0118</cvename>
<cvename>CVE-2014-0231</cvename>
</references>
<dates>
<discovery>2014-07-15</discovery>
<entry>2014-07-19</entry>
</dates>
</vuln>
<vuln vid="3f09ca29-0e48-11e4-b17a-6805ca0b3d42">
<topic>phpMyAdmin -- multiple XSS vulnerabilities, missing validation</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>4.2.0</ge><lt>4.2.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-4.php">
<p>Self-XSS due to unescaped HTML output in database
structure page.</p>
<p>With a crafted table comment, it is possible to trigger
an XSS in database structure page.</p>
</blockquote>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-5.php">
<p>Self-XSS due to unescaped HTML output in database
triggers page.</p>
<p>When navigating into the database triggers page, it is
possible to trigger an XSS with a crafted trigger
name.</p>
</blockquote>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-6.php">
<p>Multiple XSS in AJAX confirmation messages.</p>
<p>With a crafted column name it is possible to trigger an
XSS when dropping the column in table structure page. With
a crafted table name it is possible to trigger an XSS when
dropping or truncating the table in table operations
page.</p>
</blockquote>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-7.php">
<p>Access for an unprivileged user to MySQL user list.</p>
<p>An unpriviledged user could view the MySQL user list and
manipulate the tabs displayed in phpMyAdmin for them.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-4954</cvename>
<cvename>CVE-2014-4955</cvename>
<cvename>CVE-2014-4986</cvename>
<cvename>CVE-2014-4987</cvename>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-4.php</url>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-5.php</url>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-6.php</url>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-7.php</url>
</references>
<dates>
<discovery>2014-07-18</discovery>
<entry>2014-07-18</entry>
<modified>2014-07-20</modified>
</dates>
</vuln>
<vuln vid="3718833e-0d27-11e4-89db-000c6e25e3e9">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>36.0.1985.125</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl">
<p>26 security fixes in this release, including</p>
<ul>
<li>[380885] Medium CVE-2014-3160: Same-Origin-Policy bypass in SVG. Credit
to Christian Schneider.</li>
<li>[393765] CVE-2014-3162: Various fixes from internal audits, fuzzing and
other initiatives.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3160</cvename>
<cvename>CVE-2014-3162</cvename>
<url>http://googlechromereleases.blogspot.nl</url>
</references>
<dates>
<discovery>2014-07-16</discovery>
<entry>2014-07-16</entry>
</dates>
</vuln>
<vuln vid="4a114331-0d24-11e4-8dd2-5453ed2e2b49">
<topic>kdelibs4 -- KMail/KIO POP3 SSL Man-in-the-middle Flaw</topic>
<affects>
<package>
<name>kdelibs</name>
<range><ge>4.10.95</ge><lt>4.12.5_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Richard J. Moore reports:</p>
<blockquote cite="http://www.kde.org/info/security/advisory-20140618-1.txt">
<p>The POP3 kioslave used by KMail will accept invalid
certificates without presenting a dialog to the user due a
bug that leads to an inability to display the dialog
combined with an error in the way the result is checked.</p>
<p>This flaw allows an active attacker to perform MITM
attacks against the ioslave which could result in the leakage of
sensitive data such as the authentication details and the contents of
emails.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3494</cvename>
<bid>68113</bid>
<mlist>http://lists.kde.org/?l=kde-announce&amp;m=140312275318160&amp;w=2</mlist>
</references>
<dates>
<discovery>2014-06-17</discovery>
<entry>2014-07-16</entry>
</dates>
</vuln>
<vuln vid="ff98087f-0a8f-11e4-b00b-5453ed2e2b49">
<topic>postfixadmin -- SQL injection vulnerability</topic>
<affects>
<package>
<name>postfixadmin</name>
<range><lt>2.3.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Thijs Kinkhorst reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2014/03/26/6">
<p>Postfixadmin has an SQL injection vulnerability. This
vulnerability is only exploitable by authenticated users able to
create new aliases.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-2655</cvename>
<bid>66455</bid>
<freebsdpr>ports/189248</freebsdpr>
<mlist>http://www.openwall.com/lists/oss-security/2014/03/26/6</mlist>
<url>https://www.debian.org/security/2014/dsa-2889</url>
</references>
<dates>
<discovery>2014-03-28</discovery>
<entry>2014-07-13</entry>
<modified>2015-09-28</modified>
</dates>
</vuln>
<vuln vid="e6a7636a-02d0-11e4-88b6-080027671656">
<topic>dbus -- multiple vulnerabilities</topic>
<affects>
<package>
<name>dbus</name>
<range><lt>1.8.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon McVittie reports:</p>
<blockquote cite="http://lists.freedesktop.org/archives/dbus/2014-July/016235.html">
<p>Alban Crequy at Collabora Ltd. discovered a bug in dbus-daemon's
support for file descriptor passing. A malicious process could
force system services or user applications to be disconnected
from the D-Bus system bus by sending them a message containing
a file descriptor, then causing that file descriptor to exceed
the kernel's maximum recursion depth (itself introduced to fix
a DoS) before dbus-daemon forwards the message to the victim
process. Most services and applications exit when disconnected
from the system bus, leading to a denial of service.</p>
<p>Additionally, Alban discovered that bug fd.o#79694, a bug
previously reported by Alejandro Martínez Suárez which was n
believed to be security flaw, could be used for a similar denial
of service, by causing dbus-daemon to attempt to forward invalid
file descriptors to a victim process when file descriptors become
associated with the wrong message.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3532</cvename>
<cvename>CVE-2014-3533</cvename>
<url>http://lists.freedesktop.org/archives/dbus/2014-July/016235.html</url>
</references>
<dates>
<discovery>2014-07-02</discovery>
<entry>2014-07-03</entry>
</dates>
</vuln>
<vuln vid="17dfd984-feba-11e3-b938-5404a68ad561">
<topic>mencoder -- potential buffer overrun when processing malicious lzo compressed input</topic>
<affects>
<package>
<name>mencoder</name>
<range><lt>1.1.r20140418_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Michael Niedermayer and Luca Barbato report in upstream ffmpeg:</p>
<blockquote>
<p>avutil/lzo: Fix integer overflow</p>
</blockquote>
</body>
</description>
<references>
<url>http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=ccda51b14c0fcae2fad73a24872dce75a7964996</url>
<url>http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=d6af26c55c1ea30f85a7d9edbc373f53be1743ee</url>
<cvename>CVE-2014-4610</cvename>
</references>
<dates>
<discovery>2014-06-24</discovery>
<entry>2014-06-28</entry>
</dates>
</vuln>
<vuln vid="9ab3a22c-feb8-11e3-b938-5404a68ad561">
<topic>mplayer -- potential buffer overrun when processing malicious lzo compressed input</topic>
<affects>
<package>
<name>mplayer</name>
<range><lt>1.1.r20140418_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Michael Niedermayer and Luca Barbato report in upstream ffmpeg:</p>
<blockquote>
<p>avutil/lzo: Fix integer overflow</p>
</blockquote>
</body>
</description>
<references>
<url>http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=ccda51b14c0fcae2fad73a24872dce75a7964996</url>
<url>http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=d6af26c55c1ea30f85a7d9edbc373f53be1743ee</url>
<cvename>CVE-2014-4610</cvename>
</references>
<dates>
<discovery>2014-06-24</discovery>
<entry>2014-06-28</entry>
</dates>
</vuln>
<vuln vid="d1f5e12a-fd5a-11e3-a108-080027ef73ec">
<topic>LZO -- potential buffer overrun when processing malicious input data</topic>
<affects>
<package>
<name>lzo2</name>
<range><lt>2.07</lt></range>
</package>
<package>
<name>busybox</name>
<range><lt>1.22.1_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Markus Franz Xaver Johannes Oberhumer reports, in the package's NEWS file:</p>
<blockquote>
<p>Fixed a potential integer overflow condition in the "safe"
decompressor variants which could result in a possible buffer
overrun when processing maliciously crafted compressed input
data.</p>
<p>As this issue only affects 32-bit systems and also can only happen
if you use uncommonly huge buffer sizes where you have to decompress
more than 16 MiB (2^24 bytes) compressed bytes within a single
function call, the practical implications are limited.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.oberhumer.com/opensource/lzo/download/lzo-2.07.tar.gz</url>
<cvename>CVE-2014-4608</cvename>
</references>
<dates>
<discovery>2014-06-25</discovery>
<entry>2014-06-26</entry>
<modified>2015-01-06</modified>
</dates>
</vuln>
<vuln vid="1c840eb9-fb32-11e3-866e-b499baab0cbe">
<topic>gnupg -- possible DoS using garbled compressed data packets</topic>
<affects>
<package>
<name>gnupg1</name>
<range><lt>1.4.17</lt></range>
</package>
<package>
<name>gnupg</name>
<range><lt>2.0.24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Werner Koch reports:</p>
<blockquote cite="http://lists.gnupg.org/pipermail/gnupg-announce/2014q2/000344.html">
<p>This release includes a *security fix* to stop
a possible DoS using garbled compressed data packets which can be used
to put gpg into an infinite loop.</p>
</blockquote>
</body>
</description>
<references>
<url>http://lists.gnupg.org/pipermail/gnupg-announce/2014q2/000344.html</url>
<url>http://lists.gnupg.org/pipermail/gnupg-announce/2014q2/000345.html</url>
</references>
<dates>
<discovery>2014-06-23</discovery>
<entry>2014-06-23</entry>
</dates>
</vuln>
<vuln vid="6ad309d9-fb03-11e3-bebd-000c2980a9f3">
<topic>samba -- multiple vulnerabilities</topic>
<affects>
<package>
<name>samba36</name>
<range><lt>3.6.24</lt></range>
</package>
<package>
<name>samba4</name>
<range><lt>4.0.19</lt></range>
</package>
<package>
<name>samba41</name>
<range><lt>4.1.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The samba project reports:</p>
<blockquote cite="https://www.samba.org/samba/history/">
<p>A malformed packet can cause the nmbd server to loop the CPU and
prevent any further NetBIOS name service.</p>
<p>Valid unicode path names stored on disk can cause smbd to
crash if an authenticated client attempts to read them
using a non-unicode request.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0244</cvename>
<cvename>CVE-2014-3493</cvename>
<url>https://www.samba.org/samba/security/CVE-2014-0244</url>
<url>https://www.samba.org/samba/security/CVE-2014-3493</url>
</references>
<dates>
<discovery>2014-06-23</discovery>
<entry>2014-06-23</entry>
</dates>
</vuln>
<vuln vid="c4892644-f8c6-11e3-9f45-6805ca0b3d42">
<topic>phpMyAdmin -- two XSS vulnerabilities due to unescaped db/table names</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>4.1.0</ge><lt>4.2.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-2.php">
<p>Self-XSS due to unescaped HTML output in recent/favorite
tables navigation.</p>
<p>When marking a crafted database or table name as
favorite or having it in recent tables, it is possible to
trigger an XSS.</p>
<p>This vulnerability can be triggered only by someone who
logged in to phpMyAdmin, as the usual token protection
prevents non-logged-in users from accessing the required
form.</p>
</blockquote>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-3.php">
<p>Self-XSS due to unescaped HTML output in navigation items
hiding feature.</p>
<p>When hiding or unhiding a crafted table name in the
navigation, it is possible to trigger an XSS.</p>
<p>This vulnerability can be triggered only by someone who
logged in to phpMyAdmin, as the usual token protection
prevents non-logged-in users from accessing the required
form.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-4348</cvename>
<cvename>CVE-2014-4349</cvename>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-2.php</url>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-3.php</url>
</references>
<dates>
<discovery>2014-06-20</discovery>
<entry>2014-06-20</entry>
<modified>2014-06-24</modified>
</dates>
</vuln>
<vuln vid="0981958a-f733-11e3-8276-071f1604ef8a">
<topic>iodined -- authentication bypass</topic>
<affects>
<package>
<name>iodine</name>
<range><lt>0.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Erik Ekman of the iodine project reports:</p>
<blockquote cite="https://github.com/yarrick/iodine/commit/b715be5cf3978fbe589b03b09c9398d0d791f850">
<p>The client could bypass the password check by continuing after
getting error from the server and guessing the network parameters.
The server would still accept the rest of the setup and also network
traffic.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/yarrick/iodine/commit/b715be5cf3978fbe589b03b09c9398d0d791f850</url>
</references>
<dates>
<discovery>2014-06-16</discovery>
<entry>2014-06-18</entry>
</dates>
</vuln>
<vuln vid="f109b02f-f5a4-11e3-82e9-00a098b18457">
<topic>asterisk -- multiple vulnerabilities</topic>
<affects>
<package>
<name>asterisk11</name>
<range><lt>11.10.1</lt></range>
</package>
<package>
<name>asterisk18</name>
<range><lt>1.8.28.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/security">
<p>Asterisk Manager User Unauthorized Shell Access. Manager users can
execute arbitrary shell commands with the MixMonitor manager action.
Asterisk does not require system class authorization for a manager
user to use the MixMonitor action, so any manager user who is
permitted to use manager commands can potentially execute shell
commands as the user executing the Asterisk process.</p>
<p>Exhaustion of Allowed Concurrent HTTP Connections. Establishing a
TCP or TLS connection to the configured HTTP or HTTPS port
respectively in http.conf and then not sending or completing a HTTP
request will tie up a HTTP session. By doing this repeatedly until the
maximum number of open HTTP sessions is reached, legitimate requests
are blocked.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-4046</cvename>
<cvename>CVE-2014-4047</cvename>
<url>http://downloads.asterisk.org/pub/security/AST-2014-006.pdf</url>
<url>http://downloads.asterisk.org/pub/security/AST-2014-007.pdf</url>
<url>https://www.asterisk.org/security</url>
</references>
<dates>
<discovery>2014-06-12</discovery>
<entry>2014-06-17</entry>
</dates>
</vuln>
<vuln vid="52bbc7e8-f13c-11e3-bc09-bcaec565249c">
<topic>dbus -- local DoS</topic>
<affects>
<package>
<name>dbus</name>
<range><ge>1.8.0</ge><lt>1.8.4</lt></range>
<range><lt>1.6.20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon MvVittie reports:</p>
<blockquote cite="http://lists.freedesktop.org/archives/dbus/2014-June/016220.html">
<p>Alban Crequy at Collabora Ltd. discovered and fixed a
denial-of-service flaw in dbus-daemon, part of the reference
implementation of D-Bus. Additionally, in highly unusual
environments the same flaw could lead to a side channel between
processes that should not be able to communicate.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3477</cvename>
<url>http://lists.freedesktop.org/archives/dbus/2014-June/016220.html</url>
</references>
<dates>
<discovery>2014-06-10</discovery>
<entry>2014-06-14</entry>
</dates>
</vuln>
<vuln vid="0b0fb9b0-f0fb-11e3-9bcd-000c6e25e3e9">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>35.0.1916.153</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl">
<p>4 security fixes in this release, including:</p>
<ul>
<li>[369525] High CVE-2014-3154: Use-after-free in filesystem api. Credit
to Collin Payne.</li>
<li>[369539] High CVE-2014-3155: Out-if-bounds read in SPDY. Credit
to James March, Daniel Sommermann and Alan Frindell of Facebook.</li>
<li>[369621] Medium CVE-2014-3156: Buffer overflow in clipboard. Credit
to Atte Kettunen of OUSPG.</li>
<li>[368980] CVE-2014-3157: Heap overflow in media.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3154</cvename>
<cvename>CVE-2014-3155</cvename>
<cvename>CVE-2014-3156</cvename>
<cvename>CVE-2014-3157</cvename>
<url>http://googlechromereleases.blogspot.nl</url>
</references>
<dates>
<discovery>2014-06-10</discovery>
<entry>2014-06-10</entry>
</dates>
</vuln>
<vuln vid="888a0262-f0d9-11e3-ba0c-b4b52fce4ce8">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>30.0,1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>24.6.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.26.1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>30.0,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.26.1</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>24.6.0</lt></range>
</package>
<package>
<name>nspr</name>
<range><lt>4.10.6</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>24.6.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2014-48 Miscellaneous memory safety hazards
(rv:30.0 / rv:24.6)</p>
<p>MFSA 2014-49 Use-after-free and out of bounds
issues found using Address Sanitizer</p>
<p>MFSA 2014-51 Use-after-free in Event Listener
Manager</p>
<p>MFSA 2014-52 Use-after-free with SMIL Animation
Controller</p>
<p>MFSA 2014-53 Buffer overflow in Web Audio Speex
resampler</p>
<p>MFSA 2014-54 Buffer overflow in Gamepad API</p>
<p>MFSA 2014-55 Out of bounds write in NSPR</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-1533</cvename>
<cvename>CVE-2014-1534</cvename>
<cvename>CVE-2014-1536</cvename>
<cvename>CVE-2014-1537</cvename>
<cvename>CVE-2014-1540</cvename>
<cvename>CVE-2014-1541</cvename>
<cvename>CVE-2014-1542</cvename>
<cvename>CVE-2014-1543</cvename>
<cvename>CVE-2014-1545</cvename>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-48.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-49.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-51.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-52.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-53.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-54.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-55.html</url>
</references>
<dates>
<discovery>2014-06-10</discovery>
<entry>2014-06-10</entry>
</dates>
</vuln>
<vuln vid="5ac53801-ec2e-11e3-9cf3-3c970e169bc2">
<topic>OpenSSL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><ge>1.0.1</ge><lt>1.0.1_13</lt></range>
</package>
<package>
<name>mingw32-openssl</name>
<range><ge>1.0.1</ge><lt>1.0.1h</lt></range>
</package>
<system>
<name>FreeBSD</name>
<range><ge>8.0</ge><lt>8.4_12</lt></range>
<range><ge>9.1</ge><lt>9.1_15</lt></range>
<range><ge>9.2</ge><lt>9.2_8</lt></range>
<range><ge>10.0</ge><lt>10.0_5</lt></range>
</system>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL Project reports:</p>
<blockquote cite="http://www.openssl.org/news/secadv_20140605.txt">
<p>An attacker using a carefully crafted handshake can force
the use of weak keying material in OpenSSL SSL/TLS clients
and servers. This can be exploited by a Man-in-the-middle
(MITM) attack where the attacker can decrypt and modify
traffic from the attacked client and server. [CVE-2014-0224]</p>
<p>By sending an invalid DTLS handshake to an OpenSSL DTLS
client the code can be made to recurse eventually crashing
in a DoS attack. [CVE-2014-0221]</p>
<p>A buffer overrun attack can be triggered by sending invalid
DTLS fragments to an OpenSSL DTLS client or server. This is
potentially exploitable to run arbitrary code on a vulnerable
client or server. [CVE-2014-0195]</p>
<p>OpenSSL TLS clients enabling anonymous ECDH ciphersuites are
subject to a denial of service attack. [CVE-2014-3470]</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0195</cvename>
<cvename>CVE-2014-0221</cvename>
<cvename>CVE-2014-0224</cvename>
<cvename>CVE-2014-3470</cvename>
<freebsdsa>SA-14:14.openssl</freebsdsa>
<url>http://www.openssl.org/news/secadv_20140605.txt</url>
</references>
<dates>
<discovery>2014-06-05</discovery>
<entry>2014-06-05</entry>
</dates>
</vuln>
<vuln vid="9733c480-ebff-11e3-970b-206a8a720317">
<topic>gnutls -- client-side memory corruption</topic>
<affects>
<package>
<name>gnutls</name>
<range><lt>2.12.23_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GnuTLS project reports:</p>
<blockquote cite="www.gnutls.org/security.html#GNUTLS-SA-2014-3">
<p>This vulnerability affects the client side of the gnutls library.
A server that sends a specially crafted ServerHello could corrupt
the memory of a requesting client.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3466</cvename>
<url>http://www.gnutls.org/security.html#GNUTLS-SA-2014-3</url>
</references>
<dates>
<discovery>2014-05-14</discovery>
<entry>2014-06-04</entry>
</dates>
</vuln>
<vuln vid="027af74d-eb56-11e3-9032-000c2980a9f3">
<topic>gnutls -- client-side memory corruption</topic>
<affects>
<package>
<name>gnutls3</name>
<range><ge>3.1</ge><lt>3.1.25</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GnuTLS project reports:</p>
<blockquote cite="www.gnutls.org/security.html#GNUTLS-SA-2014-3">
<p>This vulnerability affects the client side of the gnutls library.
A server that sends a specially crafted ServerHello could corrupt
the memory of a requesting client.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3466</cvename>
<url>http://www.gnutls.org/security.html#GNUTLS-SA-2014-3</url>
</references>
<dates>
<discovery>2014-05-14</discovery>
<entry>2014-06-03</entry>
</dates>
</vuln>
<vuln vid="77e2e631-e742-11e3-9a25-5404a6a6412c">
<topic>mumble -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mumble</name>
<range><ge>1.2.0</ge><lt>1.2.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mumble reports:</p>
<blockquote cite="http://blog.mumble.info/mumble-1-2-6/">
<p>SVG images with local file references could trigger client DoS</p>
<p>The Mumble client did not properly HTML-escape some external strings
before using them in a rich-text (HTML) context.</p>
</blockquote>
</body>
</description>
<references>
<url>http://mumble.info/security/Mumble-SA-2014-005.txt</url>
<url>http://mumble.info/security/Mumble-SA-2014-006.txt</url>
</references>
<dates>
<discovery>2014-04-16</discovery>
<entry>2014-05-29</entry>
</dates>
</vuln>
<vuln vid="c2c8c84b-e734-11e3-9a25-5404a6a6412c">
<topic>mumble -- NULL pointer dereference and heap-based buffer overflow</topic>
<affects>
<package>
<name>mumble</name>
<range><ge>1.2.4</ge><le>1.2.4_6</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mumble reports:</p>
<blockquote cite="http://blog.mumble.info/mumble-1-2-5/">
<p>A malformed Opus voice packet sent to a Mumble client could trigger
a NULL pointer dereference or an out-of-bounds array access.</p>
<p>A malformed Opus voice packet sent to a Mumble client could trigger a
heap-based buffer overflow.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0044</cvename>
<cvename>CVE-2014-0045</cvename>
<url>http://mumble.info/security/Mumble-SA-2014-001.txt</url>
<url>http://mumble.info/security/Mumble-SA-2014-002.txt</url>
</references>
<dates>
<discovery>2014-01-25</discovery>
<entry>2014-05-29</entry>
</dates>
</vuln>
<vuln vid="f99a4686-e694-11e3-9032-000c2980a9f3">
<cancelled/>
</vuln>
<vuln vid="688e73a2-e514-11e3-a52a-98fc11cdc4f5">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.359</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb14-14.html">
<p>These updates address vulnerabilities that could cause a crash
and potentially allow an attacker to take control of the affected system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0510</cvename>
<cvename>CVE-2014-0516</cvename>
<cvename>CVE-2014-0517</cvename>
<cvename>CVE-2014-0518</cvename>
<cvename>CVE-2014-0519</cvename>
<cvename>CVE-2014-0520</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb14-14.html</url>
</references>
<dates>
<discovery>2014-03-13</discovery>
<entry>2014-05-26</entry>
</dates>
</vuln>
<vuln vid="02db20d7-e34a-11e3-bd92-bcaec565249c">
<topic>openjpeg -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>openjpeg</name>
<range><lt>1.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Openjpeg release notes report:</p>
<blockquote cite="http://openjpeg.googlecode.com/svn/tags/version.1.5.1/NEWS">
<p>That CVE-2012-3535 and CVE-2012-3358 are fixed in the 1.5.1
release.</p>
</blockquote>
<blockquote cite="http://openjpeg.googlecode.com/svn/tags/version.1.5.2/NEWS">
<p>That CVE-2013-4289, CVE-2013-4290, CVE-2013-1447, CVE-2013-6045,
CVE-2013-6052, CVE-2013-6054, CVE-2013-6053, CVE-2013-6887,
where fixed in the 1.5.2 release.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3358</cvename>
<cvename>CVE-2012-3535</cvename>
<cvename>CVE-2013-1447</cvename>
<cvename>CVE-2013-4289</cvename>
<cvename>CVE-2013-4290</cvename>
<cvename>CVE-2013-6045</cvename>
<cvename>CVE-2013-6052</cvename>
<cvename>CVE-2013-6053</cvename>
<cvename>CVE-2013-6054</cvename>
<cvename>CVE-2013-6887</cvename>
<url>http://openjpeg.googlecode.com/svn/tags/version.1.5.1/NEWS</url>
<url>http://openjpeg.googlecode.com/svn/tags/version.1.5.2/NEWS</url>
</references>
<dates>
<discovery>2012-05-13</discovery>
<entry>2014-05-24</entry>
</dates>
</vuln>
<vuln vid="64f3872b-e05d-11e3-9dd4-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>35.0.1916.114</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/">
<p>23 security fixes in this release, including:</p>
<ul>
<li>[356653] High CVE-2014-1743: Use-after-free in styles. Credit
to cloudfuzzer.</li>
<li>[359454] High CVE-2014-1744: Integer overflow in audio. Credit
to Aaron Staple.</li>
<li>[346192] High CVE-2014-1745: Use-after-free in SVG. Credit to
Atte Kettunen of OUSPG.</li>
<li>[364065] Medium CVE-2014-1746: Out-of-bounds read in media
filters. Credit to Holger Fuhrmannek.</li>
<li>[330663] Medium CVE-2014-1747: UXSS with local MHTML file.
Credit to packagesu.</li>
<li>[331168] Medium CVE-2014-1748: UI spoofing with scrollbar.
Credit to Jordan Milne.</li>
<li>[374649] CVE-2014-1749: Various fixes from internal audits,
fuzzing and other initiatives.</li>
<li>[358057] CVE-2014-3152: Integer underflow in V8 fixed in
version 3.25.28.16.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-1743</cvename>
<cvename>CVE-2014-1744</cvename>
<cvename>CVE-2014-1745</cvename>
<cvename>CVE-2014-1746</cvename>
<cvename>CVE-2014-1747</cvename>
<cvename>CVE-2014-1748</cvename>
<cvename>CVE-2014-1749</cvename>
<cvename>CVE-2014-3152</cvename>
<url>http://googlechromereleases.blogspot.nl/</url>
</references>
<dates>
<discovery>2014-05-20</discovery>
<entry>2014-05-20</entry>
</dates>
</vuln>
<vuln vid="cdf450fc-db52-11e3-a9fc-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>34.0.1847.137</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/">
<p>3 security fixes in this release:</p>
<ul>
<li>[358038] High CVE-2014-1740: Use-after-free in WebSockets.
Credit to Collin Payne.</li>
<li>[349898] High CVE-2014-1741: Integer overflow in DOM ranges.
Credit to John Butler.</li>
<li>[356690] High CVE-2014-1742: Use-after-free in editing. Credit
to cloudfuzzer.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-1740</cvename>
<cvename>CVE-2014-1741</cvename>
<cvename>CVE-2014-1742</cvename>
<url>http://googlechromereleases.blogspot.nl/</url>
</references>
<dates>
<discovery>2014-05-13</discovery>
<entry>2014-05-14</entry>
</dates>
</vuln>
<vuln vid="b060ee50-daba-11e3-99f2-bcaec565249c">
<topic>libXfont -- X Font Service Protocol and Font metadata file handling issues</topic>
<affects>
<package>
<name>libXfont</name>
<range><lt>1.4.7_3</lt></range>
</package>
<package>
<name>linux-c6-xorg-libs</name>
<range><lt>7.4_2</lt></range>
</package>
<package>
<name>linux-f10-xorg-libs</name>
<range><ge>*</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Alan Coopersmith reports:</p>
<blockquote cite="http://lists.x.org/archives/xorg-announce/2014-May/002431.html">
<p>Ilja van Sprundel, a security researcher with IOActive, has
discovered several issues in the way the libXfont library
handles the responses it receives from xfs servers, and has
worked with X.Org's security team to analyze, confirm, and fix
these issues.</p>
<p>Most of these issues stem from libXfont trusting the font server
to send valid protocol data, and not verifying that the values
will not overflow or cause other damage. This code is commonly
called from the X server when an X Font Server is active in the
font path, so may be running in a setuid-root process depending
on the X server in use. Exploits of this path could be used by
a local, authenticated user to attempt to raise privileges; or
by a remote attacker who can control the font server to attempt
to execute code with the privileges of the X server.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0209</cvename>
<cvename>CVE-2014-0210</cvename>
<cvename>CVE-2014-0211</cvename>
<url>http://lists.x.org/archives/xorg-announce/2014-May/002431.html</url>
</references>
<dates>
<discovery>2014-05-13</discovery>
<entry>2014-05-13</entry>
<modified>2015-07-15</modified>
</dates>
</vuln>
<vuln vid="e7bb3885-da40-11e3-9ecb-2c4138874f7d">
<topic>libxml2 -- lack of end-of-document check DoS</topic>
<affects>
<package>
<name>libxml2</name>
<range><lt>2.9.1</lt></range>
</package>
<package>
<name>linux-c6-libxml2</name>
<range><lt>2.7.6_2</lt></range>
</package>
<package>
<name>linux-f10-libxml2</name>
<range><ge>*</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CVE MITRE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2877">
<p>parser.c in libxml2 before 2.9.0, as used in Google
Chrome before 28.0.1500.71 and other products, allows remote
attackers to cause a denial of service (out-of-bounds read)
via a document that ends abruptly, related to the lack of
certain checks for the XML_PARSER_EOF state.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2877</cvename>
<url>https://git.gnome.org/browse/libxml2/tag/?id=CVE-2013-2877</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2877</url>
<url>https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-2877</url>
</references>
<dates>
<discovery>2013-04-11</discovery>
<entry>2013-07-10</entry>
<modified>2015-07-15</modified>
</dates>
</vuln>
<vuln vid="efdd0edc-da3d-11e3-9ecb-2c4138874f7d">
<topic>libxml2 -- entity substitution DoS</topic>
<affects>
<package>
<name>libxml2</name>
<range><lt>2.9.1</lt></range>
</package>
<package>
<name>linux-c6-libxml2</name>
<range><lt>2.7.6_2</lt></range>
</package>
<package>
<name>linux-f10-libxml2</name>
<range><ge>*</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Stefan Cornelius reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2014/05/06/4">
<p>It was discovered that libxml2, a library providing
support to read, modify and write XML files, incorrectly
performs entity substitution in the doctype prolog, even if
the application using libxml2 disabled any entity
substitution. A remote attacker could provide a
specially-crafted XML file that, when processed, would lead
to the exhaustion of CPU and memory resources or file
descriptors.</p>
<p>This issue was discovered by Daniel Berrange of Red Hat.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0191</cvename>
<url>http://www.openwall.com/lists/oss-security/2014/05/06/4</url>
<url>https://git.gnome.org/browse/libxml2/tag/?id=CVE-2014-0191</url>
<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0191</url>
</references>
<dates>
<discovery>2013-12-03</discovery>
<entry>2014-05-06</entry>
<modified>2015-07-15</modified>
</dates>
</vuln>
<vuln vid="1959e847-d4f0-11e3-84b0-0018fe623f2b">
<topic>OpenSSL -- NULL pointer dereference / DoS</topic>
<affects>
<package>
<name>openssl</name>
<range><ge>1.0.1</ge><lt>1.0.1_12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenBSD and David Ramos reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2014/05/02/5">
<p>Applications that use SSL_MODE_RELEASE_BUFFERS, such as nginx/apache,
are prone to a race condition which may allow a remote attacker to
crash the current service.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2014/05/02/5</url>
<url>https://rt.openssl.org/Ticket/Display.html?user=guest&amp;pass=guest&amp;id=3321</url>
<cvename>CVE-2014-0198</cvename>
</references>
<dates>
<discovery>2014-05-02</discovery>
<entry>2014-05-03</entry>
</dates>
</vuln>
<vuln vid="89709e58-d497-11e3-a3d5-5453ed2e2b49">
<topic>qt4-xml -- XML Entity Expansion Denial of Service</topic>
<affects>
<package>
<name>qt4-xml</name>
<range><lt>4.8.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Richard J. Moore reports:</p>
<blockquote cite="http://lists.qt-project.org/pipermail/announce/2013-December/000036.html">
<p>QXmlSimpleReader in Qt versions prior to 5.2 supports
expansion of internal entities in XML documents without
placing restrictions to ensure the document does not cause
excessive memory usage. If an application using this API
processes untrusted data then the application may use
unexpected amounts of memory if a malicious document is
processed.</p>
<p>It is possible to construct XML documents using internal
entities that consume large amounts of memory and other
resources to process, this is known as the 'Billion Laughs'
attack. Qt versions prior to 5.2 did not offer protection
against this issue.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4549</cvename>
<url>http://lists.qt-project.org/pipermail/announce/2013-December/000036.html</url>
</references>
<dates>
<discovery>2013-12-05</discovery>
<entry>2014-05-05</entry>
</dates>
</vuln>
<vuln vid="6fb521b0-d388-11e3-a790-000c2980a9f3">
<topic>strongswan -- Remote Authentication Bypass</topic>
<affects>
<package>
<name>strongswan</name>
<range><lt>5.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>strongSwan developers report:</p>
<blockquote cite="www.strongswan.org/blog/2014/04/14/strongswan-authentication-bypass-vulnerability-(cve-2014-2338).html">
<p>Remote attackers are able to bypass authentication by rekeying an
IKE_SA during (1) initiation or (2) re-authentication, which
triggers the IKE_SA state to be set to established.</p>
<p>Only installations that actively initiate or re-authenticate IKEv2
IKE_SAs are affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-2338</cvename>
<url>http://www.strongswan.org/blog/2014/04/14/strongswan-authentication-bypass-vulnerability-%28cve-2014-2338%29.html</url>
</references>
<dates>
<discovery>2014-03-12</discovery>
<entry>2014-05-04</entry>
</dates>
</vuln>
<vuln vid="670d732a-cdd4-11e3-aac2-0022fb6fcf92">
<topic>mohawk -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mohawk</name>
<range><lt>2.0.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The mohawk project reports:</p>
<blockquote cite="http://fossil.bsdsx.fr/mohawk/tktview?name=1707f0e351">
<p>Segfault when parsing malformed / unescaped url, coredump when setting syslog facility.</p>
</blockquote>
</body>
</description>
<references>
<url>http://fossil.bsdsx.fr/mohawk/tktview?name=1707f0e351</url>
<url>http://fossil.bsdsx.fr/mohawk/tktview?name=1c7565019e</url>
</references>
<dates>
<discovery>2014-04-10</discovery>
<entry>2014-04-30</entry>
</dates>
</vuln>
<vuln vid="7cf25a0c-d031-11e3-947b-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>34.0.1847.132</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports (belatedly):</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/">
<p>9 security fixes in this release, including:</p>
<ul>
<li>[354967] High CVE-2014-1730: Type confusion in V8. Credit to
Anonymous.</li>
<li>[349903] High CVE-2014-1731: Type confusion in DOM. Credit to
John Butler.</li>
<li>[359802] High CVE-2014-1736: Integer overflow in V8. Credit to
SkyLined working with HP's Zero Day Initiative.</li>
<li>[352851] Medium CVE-2014-1732: Use-after-free in Speech
Recognition. Credit to Khalil Zhani.</li>
<li>[351103] Medium CVE-2014-1733: Compiler bug in Seccomp-BPF.
Credit to Jed Davis.</li>
<li>[367314] CVE-2014-1734: Various fixes from internal audits,
fuzzing and other initiatives.</li>
<li>[359130, 359525, 360429] CVE-2014-1735: Multiple
vulnerabilities in V8 fixed in version 3.24.35.33.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-1730</cvename>
<cvename>CVE-2014-1731</cvename>
<cvename>CVE-2014-1732</cvename>
<cvename>CVE-2014-1733</cvename>
<cvename>CVE-2014-1734</cvename>
<cvename>CVE-2014-1735</cvename>
<cvename>CVE-2014-1736</cvename>
<url>http://googlechromereleases.blogspot.nl/</url>
</references>
<dates>
<discovery>2014-04-24</discovery>
<entry>2014-04-30</entry>
</dates>
</vuln>
<vuln vid="985d4d6c-cfbd-11e3-a003-b4b52fce4ce8">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>29.0,1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>24.5.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>29.0,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.26</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>24.5.0</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.26</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>24.5.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2014-34 Miscellaneous memory safety hazards
(rv:29.0 / rv:24.5)</p>
<p>MFSA 2014-35 Privilege escalation through Mozilla Maintenance
Service Installer</p>
<p>MFSA 2014-36 Web Audio memory corruption issues</p>
<p>MFSA 2014-37 Out of bounds read while decoding JPG images</p>
<p>MFSA 2014-38 Buffer overflow when using non-XBL object as
XBL</p>
<p>MFSA 2014-39 Use-after-free in the Text Track Manager
for HTML video</p>
<p>MFSA 2014-41 Out-of-bounds write in Cairo</p>
<p>MFSA 2014-42 Privilege escalation through Web Notification
API</p>
<p>MFSA 2014-43 Cross-site scripting (XSS) using history
navigations</p>
<p>MFSA 2014-44 Use-after-free in imgLoader while resizing
images</p>
<p>MFSA 2014-45 Incorrect IDNA domain name matching for
wildcard certificates</p>
<p>MFSA 2014-46 Use-after-free in nsHostResolve</p>
<p>MFSA 2014-47 Debugger can bypass XrayWrappers
with JavaScript</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-1492</cvename>
<cvename>CVE-2014-1518</cvename>
<cvename>CVE-2014-1519</cvename>
<cvename>CVE-2014-1520</cvename>
<cvename>CVE-2014-1522</cvename>
<cvename>CVE-2014-1523</cvename>
<cvename>CVE-2014-1524</cvename>
<cvename>CVE-2014-1525</cvename>
<cvename>CVE-2014-1526</cvename>
<cvename>CVE-2014-1527</cvename>
<cvename>CVE-2014-1528</cvename>
<cvename>CVE-2014-1529</cvename>
<cvename>CVE-2014-1530</cvename>
<cvename>CVE-2014-1531</cvename>
<cvename>CVE-2014-1532</cvename>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-34.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-35.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-36.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-37.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-38.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-39.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-41.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-42.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-43.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-44.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-45.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-46.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-47.html</url>
<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
</references>
<dates>
<discovery>2014-04-29</discovery>
<entry>2014-04-29</entry>
</dates>
</vuln>
<vuln vid="59e72db2-cae6-11e3-8420-00e0814cab4e">
<topic>django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py26-django</name>
<range><ge>1.6</ge><lt>1.6.3</lt></range>
</package>
<package>
<name>py27-django</name>
<range><ge>1.6</ge><lt>1.6.3</lt></range>
</package>
<package>
<name>py31-django</name>
<range><ge>1.6</ge><lt>1.6.3</lt></range>
</package>
<package>
<name>py32-django</name>
<range><ge>1.6</ge><lt>1.6.3</lt></range>
</package>
<package>
<name>py33-django</name>
<range><ge>1.6</ge><lt>1.6.3</lt></range>
</package>
<package>
<name>py34-django</name>
<range><ge>1.6</ge><lt>1.6.3</lt></range>
</package>
<package>
<name>py26-django15</name>
<range><ge>1.5</ge><lt>1.5.6</lt></range>
</package>
<package>
<name>py27-django15</name>
<range><ge>1.5</ge><lt>1.5.6</lt></range>
</package>
<package>
<name>py31-django15</name>
<range><ge>1.5</ge><lt>1.5.6</lt></range>
</package>
<package>
<name>py32-django15</name>
<range><ge>1.5</ge><lt>1.5.6</lt></range>
</package>
<package>
<name>py33-django15</name>
<range><ge>1.5</ge><lt>1.5.6</lt></range>
</package>
<package>
<name>py34-django15</name>
<range><ge>1.5</ge><lt>1.5.6</lt></range>
</package>
<package>
<name>py26-django14</name>
<range><ge>1.4</ge><lt>1.4.11</lt></range>
</package>
<package>
<name>py27-django14</name>
<range><ge>1.4</ge><lt>1.4.11</lt></range>
</package>
<package>
<name>py31-django14</name>
<range><ge>1.4</ge><lt>1.4.11</lt></range>
</package>
<package>
<name>py32-django14</name>
<range><ge>1.4</ge><lt>1.4.11</lt></range>
</package>
<package>
<name>py33-django14</name>
<range><ge>1.4</ge><lt>1.4.11</lt></range>
</package>
<package>
<name>py34-django14</name>
<range><ge>1.4</ge><lt>1.4.11</lt></range>
</package>
<package>
<name>py26-django-devel</name>
<range><lt>20140423,1</lt></range>
</package>
<package>
<name>py27-django-devel</name>
<range><lt>20140423,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Django project reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2014/apr/21/security/">
<p>These releases address an unexpected code-execution issue, a
caching issue which can expose CSRF tokens and a MySQL typecasting
issue. While these issues present limited risk and may not affect
all Django users, we encourage all users to evaluate their own
risk and upgrade as soon as possible.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.djangoproject.com/weblog/2014/apr/21/security/</url>
<cvename>CVE-2014-0472</cvename>
<cvename>CVE-2014-0473</cvename>
<cvename>CVE-2014-0474</cvename>
</references>
<dates>
<discovery>2014-04-21</discovery>
<entry>2014-04-23</entry>
<modified>2014-04-30</modified>
</dates>
</vuln>
<vuln vid="0b8d7194-ca88-11e3-9d8d-c80aa9043978">
<topic>OpenSSL -- Remote Data Injection / DoS</topic>
<affects>
<package>
<name>openssl</name>
<range><ge>1.0.1</ge><lt>1.0.1_11</lt></range>
</package>
<package>
<name>mingw32-openssl</name>
<range><ge>1.0.1</ge><le>1.0.1g</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Applications that use SSL_MODE_RELEASE_BUFFERS, such as nginx, are
prone to a race condition which may allow a remote attacker to
inject random data into other connections.</p>
</body>
</description>
<references>
<url>https://rt.openssl.org/Ticket/Display.html?id=2167</url>
<url>http://www.tedunangst.com/flak/post/analysis-of-openssl-freelist-reuse</url>
<cvename>CVE-2010-5298</cvename>
</references>
<dates>
<discovery>2010-02-09</discovery>
<entry>2014-04-23</entry>
</dates>
</vuln>
<vuln vid="608ed765-c700-11e3-848c-20cf30e32f6d">
<topic>bugzilla -- Cross-Site Request Forgery</topic>
<affects>
<package>
<name>bugzilla40</name>
<range><ge>2.0.0</ge><lt>4.4.3</lt></range>
</package>
<package>
<name>bugzilla42</name>
<range><ge>2.0.0</ge><lt>4.4.3</lt></range>
</package>
<package>
<name>bugzilla44</name>
<range><ge>2.0.0</ge><lt>4.4.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>A Bugzilla Security Advisory reports:</h1>
<blockquote cite="http://www.bugzilla.org/security/4.0.11/">
<p>The login form had no CSRF protection, meaning that
an attacker could force the victim to log in using the
attacker's credentials. If the victim then reports a new
security sensitive bug, the attacker would get immediate
access to this bug.</p>
<p>
Due to changes involved in the Bugzilla API, this fix is
not backported to the 4.0 and 4.2 branches, meaning that
Bugzilla 4.0.12 and older, and 4.2.8 and older, will
remain vulnerable to this issue.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-1517</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=713926</url>
</references>
<dates>
<discovery>2014-04-17</discovery>
<entry>2014-04-18</entry>
<modified>2014-04-18</modified>
</dates>
</vuln>
<vuln vid="60bfa396-c702-11e3-848c-20cf30e32f6d">
<topic>bugzilla -- Social Engineering</topic>
<affects>
<package>
<name>bugzilla40</name>
<range><ge>2.0.0</ge><lt>4.0.12</lt></range>
</package>
<package>
<name>bugzilla42</name>
<range><ge>4.1.1</ge><lt>4.2.8</lt></range>
</package>
<package>
<name>bugzilla44</name>
<range><ge>4.4.0</ge><lt>4.4.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>A Bugzilla Security Advisory reports:</h1>
<blockquote cite="http://www.bugzilla.org/security/4.0.11/">
<p>Dangerous control characters can be inserted into
Bugzilla, notably into bug comments. If the text, which
may look safe, is copied into a terminal such as xterm or
gnome-terminal, then unexpected commands could be executed
on the local machine.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=968576</url>
</references>
<dates>
<discovery>2014-04-17</discovery>
<entry>2014-04-18</entry>
<modified>2014-04-18</modified>
</dates>
</vuln>
<vuln vid="abad20bf-c1b4-11e3-a5ac-001b21614864">
<topic>OpenLDAP -- incorrect handling of NULL in certificate Common Name</topic>
<affects>
<package>
<name>openldap24-client</name>
<range><lt>2.4.18</lt></range>
</package>
<package>
<name>linux-f10-openldap</name>
<range><lt>2.4.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jan Lieskovsky reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-3767">
<p>OpenLDAP does not properly handle a '\0' character in a domain name
in the subject's Common Name (CN) field of an X.509 certificate,
which allows man-in-the-middle attackers to spoof arbitrary SSL
servers via a crafted certificate issued by a legitimate
Certification Authority</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-3767</cvename>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-3767</url>
</references>
<dates>
<discovery>2009-08-07</discovery>
<entry>2014-04-11</entry>
</dates>
</vuln>
<vuln vid="9aecb94c-c1ad-11e3-a5ac-001b21614864">
<topic>cURL -- inappropriate GSSAPI delegation</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.10.6</ge><le>7.21.6</le></range>
</package>
<package>
<name>linux-f10-curl</name>
<range><ge>7.10.6</ge><le>7.21.6</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cURL reports:</p>
<blockquote cite="http://curl.haxx.se/docs/adv_20110623.html">
<p>When doing GSSAPI authentication, libcurl unconditionally performs
credential delegation. This hands the server a copy of the client's
security credentials, allowing the server to impersonate the client
to any other using the same GSSAPI mechanism.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-2192</cvename>
<url>http://curl.haxx.se/docs/adv_20110623.html</url>
</references>
<dates>
<discovery>2011-06-23</discovery>
<entry>2014-04-11</entry>
<modified>2014-04-30</modified>
</dates>
</vuln>
<vuln vid="77bb0541-c1aa-11e3-a5ac-001b21614864">
<topic>dbus-glib -- privledge escalation</topic>
<affects>
<package>
<name>dbus-glib</name>
<range><lt>0.100.1</lt></range>
</package>
<package>
<name>linux-f10-dbus-glib</name>
<range><lt>0.100.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sebastian Krahmer reports:</p>
<blockquote cite="https://bugs.freedesktop.org/show_bug.cgi?id=60916">
<p>A privilege escalation flaw was found in the way dbus-glib, the
D-Bus add-on library to integrate the standard D-Bus library with
the GLib thread abstraction and main loop, performed filtering of
the message sender (message source subject), when the
NameOwnerChanged signal was received. A local attacker could use
this flaw to escalate their privileges.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-0292</cvename>
<url>https://bugs.freedesktop.org/show_bug.cgi?id=60916</url>
</references>
<dates>
<discovery>2013-02-15</discovery>
<entry>2014-04-11</entry>
<modified>2014-04-30</modified>
</dates>
</vuln>
<vuln vid="bf7912f5-c1a8-11e3-a5ac-001b21614864">
<topic>nas -- multiple vulnerabilities</topic>
<affects>
<package>
<name>nas</name>
<range><lt>1.9.4</lt></range>
</package>
<package>
<name>linux-f10-nas-libs</name>
<range><lt>1.9.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Hamid Zamani reports:</p>
<blockquote cite="http://radscan.com/pipermail/nas/2013-August/001270.html">
<p>multiple security problems (buffer overflows, format string
vulnerabilities and missing input sanitising), which could lead to
the execution of arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4256</cvename>
<cvename>CVE-2013-4257</cvename>
<cvename>CVE-2013-4258</cvename>
<url>http://radscan.com/pipermail/nas/2013-August/001270.html</url>
</references>
<dates>
<discovery>2013-08-07</discovery>
<entry>2014-04-11</entry>
</dates>
</vuln>
<vuln vid="09f47c51-c1a6-11e3-a5ac-001b21614864">
<topic>libaudiofile -- heap-based overflow in Microsoft ADPCM compression module</topic>
<affects>
<package>
<name>libaudiofile</name>
<range><lt>0.2.7</lt></range>
</package>
<package>
<name>linux-f10-libaudiofile</name>
<range><lt>0.2.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Debian reports:</p>
<blockquote cite="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=510205">
<p>Heap-based buffer overflow in msadpcm.c in libaudiofile in audiofile
0.2.6 allows context-dependent attackers to cause a denial of service
(application crash) or possibly execute arbitrary code via a crafted
WAV file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0159</cvename>
<url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=510205</url>
</references>
<dates>
<discovery>2008-12-30</discovery>
<entry>2014-04-11</entry>
<modified>2014-04-30</modified>
</dates>
</vuln>
<vuln vid="972837fc-c304-11e3-8758-00262d5ed8ee">
<topic>ChaSen -- buffer overflow</topic>
<affects>
<package>
<name>chasen-base</name>
<range><lt>2.4.5</lt></range>
</package>
<package>
<name>chasen</name>
<range><lt>2.4.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>JVN iPedia reports:</p>
<blockquote cite="http://jvn.jp/en/jp/JVN16901583/index.html">
<p>ChaSen provided by Nara Institute of Science and Technology is a
software for morphologically analyzing Japanese. ChaSen contains an
issue when reading in strings, which may lead to a buffer
overflow.</p>
<p>An arbitrary script may be executed by an attacker with access to
a system that is running a product listed in "Products
Affected."</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-4000</cvename>
<url>http://jvn.jp/en/jp/JVN16901583/index.html</url>
</references>
<dates>
<discovery>2011-11-08</discovery>
<entry>2014-04-13</entry>
</dates>
</vuln>
<vuln vid="7ccd4def-c1be-11e3-9d09-000c2980a9f3">
<topic>OpenSSL -- Local Information Disclosure</topic>
<affects>
<package>
<name>openssl</name>
<range><ge>1.0.1</ge><lt>1.0.1_10</lt></range>
</package>
<package>
<name>mingw32-openssl</name>
<range><ge>1.0.1</ge><lt>1.0.1g</lt></range>
</package>
<system>
<name>FreeBSD</name>
<range><ge>8.3</ge><lt>8.3_15</lt></range>
<range><ge>8.4</ge><lt>8.4_8</lt></range>
<range><ge>9.1</ge><lt>9.1_11</lt></range>
<range><ge>9.2</ge><lt>9.2_4</lt></range>
<range><ge>10.0</ge><lt>10.0_1</lt></range>
</system>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSSL reports:</p>
<blockquote cite="https://www.openssl.org/news/vulnerabilities.html#2014-0076">
<p>A flaw in the implementation of Montgomery Ladder Approach would
create a side-channel that leaks sensitive timing information.</p>
<p>A local attacker might be able to snoop a signing process and
might recover the signing key from it.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0076</cvename>
<freebsdsa>SA-14:06.openssl</freebsdsa>
<url>https://www.openssl.org/news/vulnerabilities.html#2014-0076</url>
</references>
<dates>
<discovery>2014-04-07</discovery>
<entry>2014-04-11</entry>
</dates>
</vuln>
<vuln vid="c0c31b27-bff3-11e3-9d09-000c2980a9f3">
<topic>openafs -- Denial of Service</topic>
<affects>
<package>
<name>openafs</name>
<range><ge>1.4.8</ge><lt>1.6.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenAFS development team reports:</p>
<blockquote cite="http://openafs.org/security/OPENAFS-SA-2014-001.txt">
<p>An attacker with the ability to connect to an OpenAFS fileserver can
trigger a buffer overflow, crashing the server.</p>
<p>The buffer overflow can be triggered by sending an unauthenticated
request for file server statistical information.</p>
<p>Clients are not affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0159</cvename>
<url>http://openafs.org/security/OPENAFS-SA-2014-001.txt</url>
</references>
<dates>
<discovery>2014-04-09</discovery>
<entry>2014-04-09</entry>
</dates>
</vuln>
<vuln vid="963413a5-bf50-11e3-a2d6-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>34.0.1847.116</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/">
<p>31 vulnerabilities fixed in this release, including:</p>
<ul>
<li>[354123] High CVE-2014-1716: UXSS in V8. Credit to
Anonymous.</li>
<li>[353004] High CVE-2014-1717: OOB access in V8. Credit to
Anonymous.</li>
<li>[348332] High CVE-2014-1718: Integer overflow in compositor.
Credit to Aaron Staple.</li>
<li>[343661] High CVE-2014-1719: Use-after-free in web workers.
Credit to Collin Payne.</li>
<li>[356095] High CVE-2014-1720: Use-after-free in DOM. Credit to
cloudfuzzer.</li>
<li>[350434] High CVE-2014-1721: Memory corruption in V8. Credit to
Christian Holler.</li>
<li>[330626] High CVE-2014-1722: Use-after-free in rendering.
Credit to miaubiz.</li>
<li>[337746] High CVE-2014-1723: Url confusion with RTL characters.
Credit to George McBay.</li>
<li>[327295] High CVE-2014-1724: Use-after-free in speech. Credit
to Atte Kettunen of OUSPG.</li>
<li>[357332] Medium CVE-2014-1725: OOB read with window property.
Credit to Anonymous</li>
<li>[346135] Medium CVE-2014-1726: Local cross-origin bypass.
Credit to Jann Horn.</li>
<li>[342735] Medium CVE-2014-1727: Use-after-free in forms. Credit
to Khalil Zhani.</li>
<li>[360298] CVE-2014-1728: Various fixes from internal audits,
fuzzing and other initiatives.</li>
<li>[345820, 347262, 348319, 350863, 352982, 355586, 358059]
CVE-2014-1729: Multiple vulnerabilities in V8 fixed in version
3.24.35.22.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-1716</cvename>
<cvename>CVE-2014-1717</cvename>
<cvename>CVE-2014-1718</cvename>
<cvename>CVE-2014-1719</cvename>
<cvename>CVE-2014-1720</cvename>
<cvename>CVE-2014-1721</cvename>
<cvename>CVE-2014-1722</cvename>
<cvename>CVE-2014-1723</cvename>
<cvename>CVE-2014-1724</cvename>
<cvename>CVE-2014-1725</cvename>
<cvename>CVE-2014-1726</cvename>
<cvename>CVE-2014-1727</cvename>
<cvename>CVE-2014-1728</cvename>
<cvename>CVE-2014-1729</cvename>
<url>http://googlechromereleases.blogspot.nl/</url>
</references>
<dates>
<discovery>2014-04-08</discovery>
<entry>2014-04-08</entry>
</dates>
</vuln>
<vuln vid="5631ae98-be9e-11e3-b5e3-c80aa9043978">
<topic>OpenSSL -- Remote Information Disclosure</topic>
<affects>
<package>
<name>openssl</name>
<range><ge>1.0.1</ge><lt>1.0.1_10</lt></range>
</package>
<package>
<name>mingw32-openssl</name>
<range><ge>1.0.1</ge><lt>1.0.1g</lt></range>
</package>
<system>
<name>FreeBSD</name>
<range><ge>10.0</ge><lt>10.0_1</lt></range>
</system>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSSL Reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv_20140407.txt">
<p>A missing bounds check in the handling of the TLS heartbeat extension can be
used to reveal up to 64k of memory to a connected client or server.</p>
<p>Affected users should upgrade to OpenSSL 1.0.1g. Users unable to immediately
upgrade can alternatively recompile OpenSSL with -DOPENSSL_NO_HEARTBEATS.</p>
</blockquote>
<blockquote cite="http://www.heartbleed.com">
<p>The bug allows anyone on the Internet to read the memory of the
systems protected by the vulnerable versions of the OpenSSL software.
This compromises the secret keys used to identify the service
providers and to encrypt the traffic, the names and passwords of the
users and the actual content. This allows attackers to eavesdrop
communications, steal data directly from the services and users and
to impersonate services and users.</p>
</blockquote>
<blockquote cite="http://www.freebsd.org/security/advisories/FreeBSD-SA-14:06.openssl.asc">
<p>The code used to handle the Heartbeat Extension does not do
sufficient boundary checks on record length, which allows reading
beyond the actual payload.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0160</cvename>
<freebsdsa>FreeBSD-SA-14:06.openssl</freebsdsa>
<url>https://www.openssl.org/news/secadv_20140407.txt</url>
<url>https://www.openssl.org/news/vulnerabilities.html#2014-0076</url>
<url>http://www.heartbleed.com</url>
</references>
<dates>
<discovery>2014-04-07</discovery>
<entry>2014-04-07</entry>
<modified>2014-04-11</modified>
</dates>
</vuln>
<vuln vid="ffa7c6e4-bb29-11e3-8136-60a44c524f57">
<topic>otrs -- Clickjacking issue</topic>
<affects>
<package>
<name>otrs</name>
<range><lt>3.1.21</lt></range>
<range><gt>3.2.*</gt><lt>3.2.16</lt></range>
<range><gt>3.3.*</gt><lt>3.3.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OTRS Project reports:</p>
<blockquote cite="http://www.otrs.com/security-advisory-2014-05-clickjacking-issue/">
<p>An attacker could embed OTRS in a hidden iframe tag of another
page, tricking the user into clicking links in OTRS.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.w3.org/1999/xhtml</url>
<cvename>CVE-2014-2554</cvename>
</references>
<dates>
<discovery>2014-04-01</discovery>
<entry>2014-04-03</entry>
</dates>
</vuln>
<vuln vid="580cc46b-bb1e-11e3-b144-2c4138874f7d">
<topic>LibYAML input sanitization errors</topic>
<affects>
<package>
<name>libyaml</name>
<range><lt>0.1.6</lt></range>
</package>
<package>
<name>mingw32-libyaml</name>
<range><lt>0.1.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>oCERT reports:</p>
<blockquote cite="http://www.ocert.org/advisories/ocert-2014-003.html">
<p>The LibYAML project is an open source YAML 1.1 parser and
emitter written in C.</p>
<p>The library is affected by a heap-based buffer overflow
which can lead to arbitrary code execution. The
vulnerability is caused by lack of proper expansion for the
string passed to the yaml_parser_scan_uri_escapes()
function.</p>
<p>A specially crafted YAML file, with a long sequence of
percent-encoded characters in a URL, can be used to trigger
the overflow.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-2525</cvename>
<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2525</url>
</references>
<dates>
<discovery>2014-03-11</discovery>
<entry>2014-03-26</entry>
</dates>
</vuln>
<vuln vid="4e95eb4e-b737-11e3-87cd-f0def10dca57">
<topic>Icinga -- buffer overflow in classic web interface</topic>
<affects>
<package>
<name>icinga</name>
<range><lt>1.11.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Icinga Team reports:</p>
<blockquote cite="https://git.icinga.org/?p=icinga-core.git;a=commitdiff;h=73285093b71a5551abdaab0a042d3d6bae093b0d">
<p>Wrong strlen check against MAX_INPUT_BUFFER without taking '\0' into account [...]</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-2386</cvename>
<url>http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-2386</url>
</references>
<dates>
<discovery>2014-02-18</discovery>
<entry>2014-03-29</entry>
</dates>
</vuln>
<vuln vid="7e61a839-b714-11e3-8195-001966155bea">
<topic>file -- out-of-bounds access in search rules with offsets from input file</topic>
<affects>
<package>
<name>file</name>
<range><lt>5.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Aaron Reffett reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2270">
<p>softmagic.c in file ... and libmagic allows context-dependent
attackers to cause a denial of service (out-of-bounds memory access and
crash) via crafted offsets in the softmagic of a PE executable.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-2270</cvename>
<url>http://bugs.gw.com/view.php?id=31</url>
</references>
<dates>
<discovery>2013-12-20</discovery>
<entry>2014-03-29</entry>
</dates>
</vuln>
<vuln vid="9fa1a0ac-b2e0-11e3-bb07-6cf0490a8c18">
<topic>Joomla! -- Core - Multiple Vulnerabilities</topic>
<affects>
<package>
<name>joomla2</name>
<range><ge>2.5.*</ge><le>2.5.18</le></range>
</package>
<package>
<name>joomla3</name>
<range><ge>3.0.*</ge><le>3.2.2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The JSST and the Joomla! Security Center report:</p>
<blockquote cite="http://developer.joomla.org/security/578-20140301-core-sql-injection.html">
<h2>[20140301] - Core - SQL Injection</h2>
<p>Inadequate escaping leads to SQL injection vulnerability.</p>
</blockquote>
<blockquote cite="http://developer.joomla.org/security/579-20140302-core-xss-vulnerability.html">
<h2>[20140302] - Core - XSS Vulnerability</h2>
<p>Inadequate escaping leads to XSS vulnerability in com_contact.</p>
</blockquote>
<blockquote cite="http://developer.joomla.org/security/580-20140303-core-xss-vulnerability.html">
<h2>[20140303] - Core - XSS Vulnerability</h2>
<p>Inadequate escaping leads to XSS vulnerability.</p>
</blockquote>
<blockquote cite="http://developer.joomla.org/security/581-20140304-core-unauthorised-logins.html">
<h2>[20140304] - Core - Unauthorised Logins</h2>
<p>Inadequate checking allowed unauthorised logins via GMail authentication.</p>
</blockquote>
</body>
</description>
<references>
<url>http://developer.joomla.org/security/578-20140301-core-sql-injection.html</url>
<url>http://developer.joomla.org/security/579-20140302-core-xss-vulnerability.html</url>
<url>http://developer.joomla.org/security/580-20140303-core-xss-vulnerability.html</url>
<url>http://developer.joomla.org/security/581-20140304-core-unauthorised-logins.html</url>
</references>
<dates>
<discovery>2014-03-01</discovery>
<entry>2014-03-23</entry>
<modified>2014-04-30</modified>
</dates>
</vuln>
<vuln vid="36f9ac43-b2ac-11e3-8752-080027ef73ec">
<topic>mail/trojita -- may leak mail contents (not user credentials) over unencrypted connection</topic>
<affects>
<package>
<name>trojita</name>
<range><lt>0.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jan Kundrát reports:</p>
<blockquote cite="http://jkt.flaska.net/blog/Trojita_0_4_1__a_security_update_for_CVE_2014_2567.html">
<p>An SSL stripping vulnerability was discovered in Trojitá, a fast Qt
IMAP e-mail client. User's credentials are never leaked, but if a
user tries to send an e-mail, the automatic saving into the "sent"
or "draft" folders could happen over a plaintext connection even if
the user's preferences specify STARTTLS as a requirement.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-2567</cvename>
<url>http://jkt.flaska.net/blog/Trojita_0_4_1__a_security_update_for_CVE_2014_2567.html</url>
</references>
<dates>
<discovery>2014-03-20</discovery>
<entry>2014-03-23</entry>
</dates>
</vuln>
<vuln vid="da4b89ad-b28f-11e3-99ca-f0def16c5c1b">
<topic>nginx-devel -- SPDY heap buffer overflow</topic>
<affects>
<package>
<name>nginx-devel</name>
<range><ge>1.3.15</ge><lt>1.5.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The nginx project reports:</p>
<blockquote cite="http://mailman.nginx.org/pipermail/nginx-announce/2014/000135.html">
<p>A bug in the experimental SPDY implementation in nginx was found, which
might allow an attacker to cause a heap memory buffer overflow in a
worker process by using a specially crafted request, potentially
resulting in arbitrary code execution (CVE-2014-0133).</p>
<p>The problem affects nginx 1.3.15 - 1.5.11, compiled with the
ngx_http_spdy_module module (which is not compiled by default) and
without --with-debug configure option, if the "spdy" option of the
"listen" directive is used in a configuration file.</p>
<p>The problem is fixed in nginx 1.5.12, 1.4.7.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0133</cvename>
<url>http://mailman.nginx.org/pipermail/nginx-announce/2014/000135.html</url>
</references>
<dates>
<discovery>2014-03-18</discovery>
<entry>2014-03-23</entry>
</dates>
</vuln>
<vuln vid="fc28df92-b233-11e3-99ca-f0def16c5c1b">
<topic>nginx -- SPDY heap buffer overflow</topic>
<affects>
<package>
<name>nginx</name>
<range><lt>1.4.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The nginx project reports:</p>
<blockquote cite="http://mailman.nginx.org/pipermail/nginx-announce/2014/000135.html">
<p>A bug in the experimental SPDY implementation in nginx was found, which
might allow an attacker to cause a heap memory buffer overflow in a
worker process by using a specially crafted request, potentially
resulting in arbitrary code execution (CVE-2014-0133).</p>
<p>The problem affects nginx 1.3.15 - 1.5.11, compiled with the
ngx_http_spdy_module module (which is not compiled by default) and
without --with-debug configure option, if the "spdy" option of the
"listen" directive is used in a configuration file.</p>
<p>The problem is fixed in nginx 1.5.12, 1.4.7.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0133</cvename>
<url>http://mailman.nginx.org/pipermail/nginx-announce/2014/000135.html</url>
</references>
<dates>
<discovery>2014-03-18</discovery>
<entry>2014-03-23</entry>
</dates>
</vuln>
<vuln vid="91ecb546-b1e6-11e3-980f-20cf30e32f6d">
<topic>apache -- several vulnerabilities</topic>
<affects>
<package>
<name>apache24</name>
<range><gt>2.4.0</gt><lt>2.4.9</lt></range>
</package>
<package>
<name>apache22</name>
<range><gt>2.2.0</gt><lt>2.2.27</lt></range>
</package>
<package>
<name>apache22-event-mpm</name>
<range><gt>2.2.0</gt><lt>2.2.27</lt></range>
</package>
<package>
<name>apache22-itk-mpm</name>
<range><gt>2.2.0</gt><lt>2.2.27</lt></range>
</package>
<package>
<name>apache22-peruser-mpm</name>
<range><gt>2.2.0</gt><lt>2.2.27</lt></range>
</package>
<package>
<name>apache22-worker-mpm</name>
<range><gt>2.2.0</gt><lt>2.2.27</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Apache HTTP SERVER PROJECT reports:</h1>
<blockquote cite="http://www.apache.org/dist/httpd/CHANGES_2.2.27">
<p>Clean up cookie logging with fewer redundant string parsing passes.
Log only cookies with a value assignment. Prevents segfaults when
logging truncated cookies.</p>
<p>mod_dav: Keep track of length of cdata properly when removing leading
spaces. Eliminates a potential denial of service from specifically
crafted DAV WRITE requests.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0098</cvename>
<cvename>CVE-2013-6438</cvename>
</references>
<dates>
<discovery>2014-02-25</discovery>
<entry>2014-03-22</entry>
</dates>
</vuln>
<vuln vid="610de647-af8d-11e3-a25b-b4b52fce4ce8">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>28.0,1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>24.4.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>28.0,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.25</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>24.4.0</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.25</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>24.4.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2014-15 Miscellaneous memory safety hazards
(rv:28.0 / rv:24.4)</p>
<p>MFSA 2014-16 Files extracted during updates are not always
read only</p>
<p>MFSA 2014-17 Out of bounds read during WAV file decoding</p>
<p>MFSA 2014-18 crypto.generateCRMFRequest does not validate
type of key</p>
<p>MFSA 2014-19 Spoofing attack on WebRTC permission prompt</p>
<p>MFSA 2014-20 onbeforeunload and Javascript navigation DOS</p>
<p>MFSA 2014-21 Local file access via Open Link in new tab</p>
<p>MFSA 2014-22 WebGL content injection from one domain to
rendering in another</p>
<p>MFSA 2014-23 Content Security Policy for data: documents
not preserved by session restore</p>
<p>MFSA 2014-24 Android Crash Reporter open to manipulation</p>
<p>MFSA 2014-25 Firefox OS DeviceStorageFile object vulnerable
to relative path escape</p>
<p>MFSA 2014-26 Information disclosure through polygon
rendering in MathML</p>
<p>MFSA 2014-27 Memory corruption in Cairo during PDF font
rendering</p>
<p>MFSA 2014-28 SVG filters information disclosure through
feDisplacementMap</p>
<p>MFSA 2014-29 Privilege escalation using WebIDL-implemented
APIs</p>
<p>MFSA 2014-30 Use-after-free in TypeObject</p>
<p>MFSA 2014-31 Out-of-bounds read/write through neutering
ArrayBuffer objects</p>
<p>MFSA 2014-32 Out-of-bounds write through TypedArrayObject
after neutering</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-1493</cvename>
<cvename>CVE-2014-1494</cvename>
<cvename>CVE-2014-1496</cvename>
<cvename>CVE-2014-1497</cvename>
<cvename>CVE-2014-1498</cvename>
<cvename>CVE-2014-1499</cvename>
<cvename>CVE-2014-1500</cvename>
<cvename>CVE-2014-1501</cvename>
<cvename>CVE-2014-1502</cvename>
<cvename>CVE-2014-1504</cvename>
<cvename>CVE-2014-1505</cvename>
<cvename>CVE-2014-1506</cvename>
<cvename>CVE-2014-1507</cvename>
<cvename>CVE-2014-1508</cvename>
<cvename>CVE-2014-1509</cvename>
<cvename>CVE-2014-1510</cvename>
<cvename>CVE-2014-1511</cvename>
<cvename>CVE-2014-1512</cvename>
<cvename>CVE-2014-1513</cvename>
<cvename>CVE-2014-1514</cvename>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-15.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-16.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-17.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-18.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-19.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-20.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-21.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-22.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-23.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-24.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-25.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-26.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-27.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-28.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-29.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-30.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-31.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-32.html</url>
<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
</references>
<dates>
<discovery>2014-03-19</discovery>
<entry>2014-03-19</entry>
<modified>2014-03-20</modified>
</dates>
</vuln>
<vuln vid="a70966a1-ac22-11e3-8d04-00262d5ed8ee">
<topic>www/chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>33.0.1750.152</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/">
<p>New vulnerabilities after the Pwn2Own competition:</p>
<ul>
<li>[352369] Code execution outside sandbox. Credit to VUPEN.
<ul>
<li>[352374] High CVE-2014-1713: Use-after-free in Blink
bindings</li>
<li>[352395] High CVE-2014-1714: Windows clipboard
vulnerability</li>
</ul>
</li>
<li> [352420] Code execution outside sandbox. Credit to Anonymous.
<ul>
<li>[351787] High CVE-2014-1705: Memory corruption in V8</li>
<li>[352429] High CVE-2014-1715: Directory traversal issue</li>
</ul>
</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-1705</cvename>
<cvename>CVE-2014-1713</cvename>
<cvename>CVE-2014-1714</cvename>
<cvename>CVE-2014-1715</cvename>
<url>http://googlechromereleases.blogspot.nl/</url>
</references>
<dates>
<discovery>2014-03-14</discovery>
<entry>2014-03-15</entry>
</dates>
</vuln>
<vuln vid="eb426e82-ab68-11e3-9d09-000c2980a9f3">
<topic>mutt -- denial of service, potential remote code execution</topic>
<affects>
<package>
<name>mutt</name>
<range><lt>1.5.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Beatrice Torracca and Evgeni Golov report:</p>
<blockquote cite="http://www.securityfocus.com/archive/1/531431">
<p>A buffer overflow has been discovered that could result in
denial of service or potential execution of arbitrary code.</p>
<p>This condition can be triggered by malformed RFC2047 header
lines</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0467</cvename>
<url>http://packetstormsecurity.com/files/cve/CVE-2014-0467</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0467</url>
</references>
<dates>
<discovery>2014-03-12</discovery>
<entry>2014-03-14</entry>
</dates>
</vuln>
<vuln vid="777d7b9e-ab02-11e3-841e-60a44c524f57">
<topic>wemux -- read-only can be bypassed</topic>
<affects>
<package>
<name>wemux</name>
<range><lt>3.2.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>JonApps reports:</p>
<blockquote cite="https://github.com/zolrath/wemux/issues/36">
<p>The read-only mode can be bypassed and any command sent to bash session</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/zolrath/wemux/issues/36</url>
</references>
<dates>
<discovery>2013-12-24</discovery>
<entry>2014-03-13</entry>
</dates>
</vuln>
<vuln vid="03e48bf5-a96d-11e3-a556-3c970e169bc2">
<topic>samba -- multiple vulnerabilities</topic>
<affects>
<package>
<name>samba34</name>
<range><gt>0</gt></range>
</package>
<package>
<name>samba35</name>
<range><gt>0</gt></range>
</package>
<package>
<name>samba36</name>
<range><gt>3.6.*</gt><lt>3.6.23</lt></range>
</package>
<package>
<name>samba4</name>
<range><gt>4.0.*</gt><lt>4.0.16</lt></range>
</package>
<package>
<name>samba41</name>
<range><gt>4.1.*</gt><lt>4.1.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Samba project reports:</p>
<blockquote cite="http://www.samba.org/samba/security/CVE-2013-4496">
<p>In Samba's SAMR server we neglect to ensure that attempted
password changes will update the bad password count, nor set
the lockout flags. This would allow a user unlimited attempts
against the password by simply calling ChangePasswordUser2
repeatedly.</p>
<p>This is available without any other authentication.</p>
</blockquote>
<blockquote cite="http://www.samba.org/samba/security/CVE-2013-6442">
<p>smbcacls can remove a file or directory ACL by mistake.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4496</cvename>
<cvename>CVE-2013-6442</cvename>
<url>http://www.samba.org/samba/security/CVE-2013-4496</url>
<url>http://www.samba.org/samba/security/CVE-2013-6442</url>
</references>
<dates>
<discovery>2014-03-11</discovery>
<entry>2014-03-11</entry>
</dates>
</vuln>
<vuln vid="03159886-a8a3-11e3-8f36-0025905a4771">
<topic>asterisk -- multiple vulnerabilities</topic>
<affects>
<package>
<name>asterisk11</name>
<range><lt>11.8.1</lt></range>
</package>
<package>
<name>asterisk18</name>
<range><lt>1.8.26.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/security">
<p>Stack Overflow in HTTP Processing of Cookie Headers. Sending a HTTP
request that is handled by Asterisk with a large number of Cookie
headers could overflow the stack. You could even exhaust memory if you
sent an unlimited number of headers in the request.</p>
<p>Denial of Service Through File Descriptor Exhaustion with chan_sip
Session-Timers. An attacker can use all available file descriptors
using SIP INVITE requests. Asterisk will respond with code 400, 420,
or 422 for INVITEs meeting this criteria.
Each INVITE meeting these conditions will leak a channel and several
file descriptors. The file descriptors cannot be released without
restarting Asterisk which may allow intrusion detection systems to be
bypassed by sending the requests slowly.</p>
<p>Remote Crash Vulnerability in PJSIP channel driver. A remotely
exploitable crash vulnerability exists in the PJSIP channel driver if
the "qualify_frequency" configuration option is enabled on an AOR and
the remote SIP server challenges for authentication of the resulting
OPTIONS request. The response handling code wrongly assumes that a
PJSIP endpoint will always be associated with an outgoing request which
is incorrect.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-2286</cvename>
<cvename>CVE-2014-2287</cvename>
<cvename>CVE-2014-2288</cvename>
<url>http://downloads.asterisk.org/pub/security/AST-2014-001.pdf</url>
<url>http://downloads.asterisk.org/pub/security/AST-2014-002.pdf</url>
<url>http://downloads.asterisk.org/pub/security/AST-2014-003.pdf</url>
<url>https://www.asterisk.org/security</url>
</references>
<dates>
<discovery>2014-03-10</discovery>
<entry>2014-03-10</entry>
</dates>
</vuln>
<vuln vid="24cefa4b-a940-11e3-91f2-00262d5ed8ee">
<topic>www/chromium --multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>33.0.1750.149</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/">
<p>7 vulnerabilities fixed in this release, including:</p>
<ul>
<li>[344881] High CVE-2014-1700: Use-after-free in speech. Credit
to Chamal de Silva.</li>
<li>[342618] High CVE-2014-1701: UXSS in events. Credit to
aidanhs.</li>
<li>[333058] High CVE-2014-1702: Use-after-free in web database.
Credit to Collin Payne.</li>
<li>[338354] High CVE-2014-1703: Potential sandbox escape due to a
use-after-free in web sockets.</li>
<li>[328202, 349079, 345715] CVE-2014-1704: Multiple
vulnerabilities in V8 fixed in version 3.23.17.18.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-1700</cvename>
<cvename>CVE-2014-1701</cvename>
<cvename>CVE-2014-1702</cvename>
<cvename>CVE-2014-1703</cvename>
<cvename>CVE-2014-1704</cvename>
<url>http://googlechromereleases.blogspot.nl/</url>
</references>
<dates>
<discovery>2014-03-11</discovery>
<entry>2014-03-11</entry>
</dates>
</vuln>
<vuln vid="1a0de610-a761-11e3-95fe-bcaec565249c">
<topic>freetype2 -- Out of bounds read/write</topic>
<affects>
<package>
<name>freetype2</name>
<range><lt>2.5.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mateusz Jurczyk reports:</p>
<blockquote cite="http://savannah.nongnu.org/bugs/?41697">
<p>Out of bounds stack-based read/write in
cf2_hintmap_build.</p>
<p>This is a critical vulnerability in the CFF Rasterizer
code recently contributed by Adobe, leading to potential
arbitrary code execution in the context of the FreeType2
library client.</p>
</blockquote>
</body>
</description>
<references>
<url>http://savannah.nongnu.org/bugs/?41697</url>
</references>
<dates>
<discovery>2014-02-25</discovery>
<entry>2014-03-09</entry>
</dates>
</vuln>
<vuln vid="20e23b65-a52e-11e3-ae3a-00224d7c32a2">
<topic>xmms -- Integer Overflow And Underflow Vulnerabilities</topic>
<affects>
<package>
<name>xmms</name>
<range><le>1.2.11_20</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/secunia_research/2007-47/advisory/">
<p>Secunia Research has discovered two vulnerabilities in XMMS, which can
be exploited by malicious people to compromise a user's system.</p>
<p>1) An integer underflow error exists in the processing of skin bitmap
images. This can be exploited to cause a stack-based buffer overflow
via specially crafted skin images containing manipulated header
information.</p>
<p>Successful exploitation allows execution of arbitrary code.</p>
<p>2) An integer overflow error exists in the processing of skin bitmap
images. This can be exploited to cause memory corruption via specially
crafted skin images containing manipulated header information.</p>
<p>Successful exploitation may allow the execution of arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-0653</cvename>
<cvename>CVE-2007-0654</cvename>
</references>
<dates>
<discovery>2007-02-06</discovery>
<entry>2014-03-06</entry>
</dates>
</vuln>
<vuln vid="89db3b31-a4c3-11e3-978f-f0def16c5c1b">
<topic>nginx -- SPDY memory corruption</topic>
<affects>
<package>
<name>nginx-devel</name>
<range><eq>1.5.10</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The nginx project reports:</p>
<blockquote cite="http://mailman.nginx.org/pipermail/nginx-announce/2014/000132.html">
<p>A bug in the experimental SPDY implementation in nginx 1.5.10 was found,
which might allow an attacker to corrupt worker process memory by using
a specially crafted request, potentially resulting in arbitrary code
execution (CVE-2014-0088).</p>
<p>The problem only affects nginx 1.5.10 on 32-bit platforms, compiled with
the ngx_http_spdy_module module (which is not compiled by default), if
the "spdy" option of the "listen" directive is used in a configuration
file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0088</cvename>
<url>http://mailman.nginx.org/pipermail/nginx-announce/2014/000132.html</url>
</references>
<dates>
<discovery>2014-03-04</discovery>
<entry>2014-03-06</entry>
</dates>
</vuln>
<vuln vid="b4023753-a4ba-11e3-bec2-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>33.0.1750.146</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/">
<p>19 vulnerabilities fixed in this release, including:</p>
<ul>
<li>[344492] High CVE-2013-6663: Use-after-free in svg images.
Credit to Atte Kettunen of OUSPG.</li>
<li>[326854] High CVE-2013-6664: Use-after-free in speech
recognition. Credit to Khalil Zhani.</li>
<li>[337882] High CVE-2013-6665: Heap buffer overflow in software
rendering. Credit to cloudfuzzer.</li>
<li>[332023] Medium CVE-2013-6666: Chrome allows requests in flash
header request. Credit to netfuzzerr.</li>
<li>[348175] CVE-2013-6667: Various fixes from internal audits,
fuzzing and other initiatives.</li>
<li>[343964, 344186, 347909] CVE-2013-6668: Multiple
vulnerabilities in V8 fixed in version 3.24.35.10.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-6663</cvename>
<cvename>CVE-2013-6664</cvename>
<cvename>CVE-2013-6665</cvename>
<cvename>CVE-2013-6666</cvename>
<cvename>CVE-2013-6667</cvename>
<cvename>CVE-2013-6668</cvename>
<url>http://googlechromereleases.blogspot.nl/</url>
</references>
<dates>
<discovery>2014-03-03</discovery>
<entry>2014-03-05</entry>
</dates>
</vuln>
<vuln vid="f645aa90-a3e8-11e3-a422-3c970e169bc2">
<topic>gnutls -- multiple certificate verification issues</topic>
<affects>
<package>
<name>gnutls</name>
<range><lt>2.12.23_4</lt></range>
</package>
<package>
<name>linux-f10-gnutls</name>
<range><lt>2.12.23_4</lt></range>
</package>
<package>
<name>gnutls-devel</name>
<range><lt>3.1.22</lt></range>
<range><gt>3.2.0</gt><lt>3.2.12</lt></range>
</package>
<package>
<name>gnutls3</name>
<range><lt>3.1.22</lt></range>
<range><gt>3.2.0</gt><lt>3.2.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GnuTLS project reports:</p>
<blockquote cite="http://www.gnutls.org/security.html#GNUTLS-SA-2014-2">
<p>A vulnerability was discovered that affects the
certificate verification functions of all gnutls
versions. A specially crafted certificate could
bypass certificate validation checks. The
vulnerability was discovered during an audit of
GnuTLS for Red Hat.</p>
</blockquote>
<blockquote cite="http://www.gnutls.org/security.html#GNUTLS-SA-2014-1">
<p>Suman Jana reported a vulnerability that affects
the certificate verification functions of
gnutls 2.11.5 and later versions. A version 1
intermediate certificate will be considered as
a CA certificate by default (something that
deviates from the documented behavior).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0092</cvename>
<cvename>CVE-2014-1959</cvename>
<url>http://www.gnutls.org/security.html#GNUTLS-SA-2014-1</url>
<url>http://www.gnutls.org/security.html#GNUTLS-SA-2014-2</url>
</references>
<dates>
<discovery>2014-03-03</discovery>
<entry>2014-03-04</entry>
<modified>2014-04-30</modified>
</dates>
</vuln>
<vuln vid="815dbcf9-a2d6-11e3-8088-002590860428">
<topic>file -- denial of service</topic>
<affects>
<package>
<name>file</name>
<range><lt>5.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Fine Free file project reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1943">
<p>file before 5.17 allows context-dependent attackers to
cause a denial of service (infinite recursion, CPU consumption, and
crash) via a crafted indirect offset value in the magic of a file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-1943</cvename>
<mlist>http://mx.gw.com/pipermail/file/2014/001327.html</mlist>
</references>
<dates>
<discovery>2014-02-16</discovery>
<entry>2014-03-03</entry>
</dates>
</vuln>
<vuln vid="8e5e6d42-a0fa-11e3-b09a-080027f2d077">
<topic>Python -- buffer overflow in socket.recvfrom_into()</topic>
<affects>
<package>
<name>python27</name>
<range><le>2.7.6_3</le></range>
</package>
<package>
<name>python31</name>
<range><le>3.1.5_10</le></range>
</package>
<package>
<name>python32</name>
<range><le>3.2.5_7</le></range>
</package>
<package>
<name>python33</name>
<range><le>3.3.3_2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Vincent Danen via Red Hat Issue Tracker reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=1062370">
<p>A vulnerability was reported in Python's socket module, due to a
boundary error within the sock_recvfrom_into() function, which could be
exploited to cause a buffer overflow. This could be used to crash a
Python application that uses the socket.recvfrom_info() function or,
possibly, execute arbitrary code with the permissions of the user
running vulnerable Python code.</p>
<p>This vulnerable function, socket.recvfrom_into(), was introduced in
Python 2.5. Earlier versions are not affected by this flaw.</p>
</blockquote>
</body>
</description>
<references>
<bid>65379</bid>
<cvename>CVE-2014-1912</cvename>
<mlist>https://mail.python.org/pipermail/python-dev/2014-February/132758.html</mlist>
<url>http://bugs.python.org/issue20246</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1062370</url>
</references>
<dates>
<discovery>2014-01-14</discovery>
<entry>2014-03-01</entry>
</dates>
</vuln>
<vuln vid="1839f78c-9f2b-11e3-980f-20cf30e32f6d">
<topic>subversion -- mod_dav_svn vulnerability</topic>
<affects>
<package>
<name>subversion</name>
<range><ge>1.3.0</ge><lt>1.7.16</lt></range>
<range><ge>1.8.0</ge><lt>1.8.8</lt></range>
</package>
<package>
<name>subversion16</name>
<range><ge>1.3.0</ge><lt>1.7.16</lt></range>
</package>
<package>
<name>subversion17</name>
<range><ge>1.3.0</ge><lt>1.7.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Subversion Project reports:</p>
<blockquote cite="http://subversion.apache.org/security/">
<p>Subversion's mod_dav_svn Apache HTTPD server module will crash when it
receives an OPTIONS request against the server root and Subversion is
configured to handle the server root and SVNListParentPath is on.
This can lead to a DoS. There are no known instances of this
problem being exploited in the wild, but the details of how to exploit
it have been disclosed on the Subversion development mailing list.</p>
</blockquote>
</body>
</description>
<references>
<url>CVE-2014-0032</url>
<url>https://subversion.apache.org/security/CVE-2014-0032-advisory.txt</url>
</references>
<dates>
<discovery>2014-01-10</discovery>
<entry>2014-02-26</entry>
<modified>2014-04-30</modified>
</dates>
</vuln>
<vuln vid="70b72a52-9e54-11e3-babe-60a44c524f57">
<topic>otrs -- XSS Issue</topic>
<affects>
<package>
<name>otrs</name>
<range><lt>3.1.20</lt></range>
<range><gt>3.2.*</gt><lt>3.2.15</lt></range>
<range><gt>3.3.*</gt><lt>3.3.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OTRS Project reports:</p>
<blockquote cite="https://www.otrs.com/security-advisory-2014-03-xss-issue/">
<p>An attacker could send a specially prepared HTML email to OTRS. If
he can then trick an agent into following a special link to display this email,
JavaScript code would be executed.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.otrs.com/security-advisory-2014-03-xss-issue/</url>
<cvename>CVE-2014-1695</cvename>
</references>
<dates>
<discovery>2014-02-25</discovery>
<entry>2014-02-25</entry>
</dates>
</vuln>
<vuln vid="9dd47fa3-9d53-11e3-b20f-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>33.0.1750.117</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/">
<p>28 security fixes in this release, including:</p>
<ul>
<li>[334897] High CVE-2013-6652: Issue with relative paths in
Windows sandbox named pipe policy. Credit to tyranid.</li>
<li>[331790] High CVE-2013-6653: Use-after-free related to web
contents. Credit to Khalil Zhani.</li>
<li>[333176] High CVE-2013-6654: Bad cast in SVG. Credit to
TheShow3511.</li>
<li>[293534] High CVE-2013-6655: Use-after-free in layout. Credit
to cloudfuzzer.</li>
<li>[331725] High CVE-2013-6656: Information leak in XSS auditor.
Credit to NeexEmil.</li>
<li>[331060] Medium CVE-2013-6657: Information leak in XSS auditor.
Credit to NeexEmil.</li>
<li>[322891] Medium CVE-2013-6658: Use-after-free in layout. Credit
to cloudfuzzer.</li>
<li>[306959] Medium CVE-2013-6659: Issue with certificates
validation in TLS handshake. Credit to Antoine Delignat-Lavaud
and Karthikeyan Bhargavan from Prosecco, Inria Paris.</li>
<li>[332579] Low CVE-2013-6660: Information leak in drag and drop.
Credit to bishopjeffreys.</li>
<li>[344876] Low-High CVE-2013-6661: Various fixes from internal
audits, fuzzing and other initiatives. Of these, seven are fixes
for issues that could have allowed for sandbox escapes from
compromised renderers.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-6652</cvename>
<cvename>CVE-2013-6653</cvename>
<cvename>CVE-2013-6654</cvename>
<cvename>CVE-2013-6655</cvename>
<cvename>CVE-2013-6656</cvename>
<cvename>CVE-2013-6657</cvename>
<cvename>CVE-2013-6658</cvename>
<cvename>CVE-2013-6659</cvename>
<cvename>CVE-2013-6660</cvename>
<cvename>CVE-2013-6661</cvename>
<url>http://googlechromereleases.blogspot.nl/</url>
</references>
<dates>
<discovery>2014-02-20</discovery>
<entry>2014-02-24</entry>
</dates>
</vuln>
<vuln vid="42d42090-9a4d-11e3-b029-08002798f6ff">
<topic>PostgreSQL -- multiple privilege issues</topic>
<affects>
<package>
<name>postgresql-server</name>
<range><lt>8.4.20</lt></range>
<range><ge>9.0.0</ge><lt>9.0.16</lt></range>
<range><ge>9.1.0</ge><lt>9.1.12</lt></range>
<range><ge>9.2.0</ge><lt>9.2.7</lt></range>
<range><ge>9.3.0</ge><lt>9.3.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PostgreSQL Project reports:</p>
<blockquote cite="http://www.postgresql.org/about/news/1506/">
<p>This update fixes CVE-2014-0060, in which PostgreSQL did not
properly enforce the WITH ADMIN OPTION permission for ROLE management.
Before this fix, any member of a ROLE was able to grant others access
to the same ROLE regardless if the member was given the WITH ADMIN
OPTION permission. It also fixes multiple privilege escalation issues,
including: CVE-2014-0061, CVE-2014-0062, CVE-2014-0063, CVE-2014-0064,
CVE-2014-0065, and CVE-2014-0066. More information on these issues can
be found on our security page and the security issue detail wiki page.
</p>
<p>
With this release, we are also alerting users to a known security hole
that allows other users on the same machine to gain access to an
operating system account while it is doing "make check":
CVE-2014-0067. "Make check" is normally part of building PostgreSQL
from source code. As it is not possible to fix this issue without
causing significant issues to our testing infrastructure, a patch will
be released separately and publicly. Until then, users are strongly
advised not to run "make check" on machines where untrusted users have
accounts.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0060</cvename>
<cvename>CVE-2014-0061</cvename>
<cvename>CVE-2014-0062</cvename>
<cvename>CVE-2014-0063</cvename>
<cvename>CVE-2014-0064</cvename>
<cvename>CVE-2014-0065</cvename>
<cvename>CVE-2014-0066</cvename>
<cvename>CVE-2014-0067</cvename>
</references>
<dates>
<discovery>2014-02-20</discovery>
<entry>2014-02-20</entry>
</dates>
</vuln>
<vuln vid="0871d18b-9638-11e3-a371-6805ca0b3d42">
<topic>phpMyAdmin -- Self-XSS due to unescaped HTML output in import.</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>3.3.1</ge><lt>4.1.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-1.php">
<p> When importing a file with crafted filename, it is
possible to trigger an XSS. We consider this vulnerability
to be non critical.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-1.php</url>
<cvename>CVE-2014-1879</cvename>
</references>
<dates>
<discovery>2014-02-15</discovery>
<entry>2014-02-15</entry>
</dates>
</vuln>
<vuln vid="3e0507c6-9614-11e3-b3a5-00e0814cab4e">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>1.551</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>1.532.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory reports:</p>
<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14">
<p>This advisory announces multiple security vulnerabilities that
were found in Jenkins core.</p>
<ol>
<li>
<p>iSECURITY-105</p>
<p>In some places, Jenkins XML API uses XStream to deserialize
arbitrary content, which is affected by CVE-2013-7285 reported
against XStream. This allows malicious users of Jenkins with
a limited set of permissions to execute arbitrary code inside
Jenkins master.</p>
</li>
<li>
<p>SECURITY-76 &amp; SECURITY-88 / CVE-2013-5573</p>
<p>Restrictions of HTML tags for user-editable contents are too
lax. This allows malicious users of Jenkins to trick other
unsuspecting users into providing sensitive information.</p>
</li>
<li>
<p>SECURITY-109</p>
<p>Plugging a hole in the earlier fix to SECURITY-55. Under some
circimstances, a malicious user of Jenkins can configure job
X to trigger another job Y that the user has no access to.</p>
</li>
<li>
<p>SECURITY-108</p>
<p>CLI job creation had a directory traversal vulnerability. This
allows a malicious user of Jenkins with a limited set of
permissions to overwrite files in the Jenkins master and
escalate privileges.</p>
</li>
<li>
<p>SECURITY-106</p>
<p>The embedded Winstone servlet container is susceptive to
session hijacking attack.</p>
</li>
<li>
<p>SECURITY-93</p>
<p>The password input control in the password parameter
definition in the Jenkins UI was serving the actual value of
the password in HTML, not an encrypted one. If a sensitive
value is set as the default value of such a parameter
definition, it can be exposed to unintended audience.</p>
</li>
<li>
<p>SECURITY-89</p>
<p>Deleting the user was not invalidating the API token,
allowing users to access Jenkins when they shouldn't be
allowed to do so.</p>
</li>
<li>
<p>SECURITY-80</p>
<p>Jenkins UI was vulnerable to click jacking attacks.</p>
</li>
<li>
<p>SECURITY-79</p>
<p>"Jenkins' own user database" was revealing the
presence/absence of users when login attempts fail.</p>
</li>
<li>
<p>SECURITY-77</p>
<p>Jenkins had a cross-site scripting vulnerability in one of its
cookies. If Jenkins is deployed in an environment that allows
an attacker to override Jenkins cookies in victim's browser,
this vulnerability can be exploited.</p>
</li>
<li>
<p>SECURITY-75</p>
<p>Jenkins was vulnerable to session fixation attack. If Jenkins
is deployed in an environment that allows an attacker to
override Jenkins cookies in victim's browser, this
vulnerability can be exploited.</p>
</li>
<li>
<p>SECURITY-74</p>
<p>Stored XSS vulnerability. A malicious user of Jenkins with a
certain set of permissions can cause Jenkins to store
arbitrary HTML fragment.</p>
</li>
<li>
<p>SECURITY-73</p>
<p>Some of the system diagnostic functionalities were checking a
lesser permission than it should have. In a very limited
circumstances, this can cause an attacker to gain information
that he shouldn't have access to.</p>
</li>
</ol>
<p>Severity</p>
<ol>
<li>SECURITY-106, and SECURITY-80 are rated <strong>high</strong>. An attacker only
needs direct HTTP access to the server to mount this attack.</li>
<li>SECURITY-105, SECURITY-109, SECURITY-108, and SECURITY-74 are
rated <strong>high</strong>. These vulnerabilities allow attackes with valid
Jenkins user accounts to escalate privileges in various ways.</li>
<li>SECURITY-76, SECURIT-88, and SECURITY-89 are rated <strong>medium.</strong>
These vulnerabilities requires an attacker to be an user of
Jenkins, and the mode of the attack is limited.</li>
<li>SECURITY-93, and SECURITY-79 are <strong>rated</strong> low. These
vulnerabilities only affect a small part of Jenkins and has
limited impact.</li>
<li>SECURITY-77, SECURITY-75, and SECURITY-73 are <strong>rated</strong> low. These
vulnerabilities are hard to exploit unless combined with other
exploit in the network.</li>
</ol>
</blockquote>
</body>
</description>
<references>
<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14</url>
<cvename>CVE-2013-5573</cvename>
<cvename>CVE-2013-7285</cvename>
</references>
<dates>
<discovery>2014-02-14</discovery>
<entry>2014-02-15</entry>
</dates>
</vuln>
<vuln vid="90b27045-9530-11e3-9d09-000c2980a9f3">
<topic>lighttpd -- multiple vulnerabilities</topic>
<affects>
<package>
<name>lighttpd</name>
<range><lt>1.4.34</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>lighttpd security advisories report:</p>
<blockquote cite="http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_01.txt">
<p>It is possible to inadvertantly enable vulnerable ciphers when using
ssl.cipher-list.</p>
</blockquote>
<blockquote cite="http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_02.txt">
<p>In certain cases setuid() and similar can fail, potentially triggering
lighttpd to restart running as root.</p>
</blockquote>
<blockquote cite="http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_03.txt">
<p>If FAMMonitorDirectory fails, the memory intended to store the context is
released; some lines below the "version" compoment of that context is read.
Reading invalid data doesn't matter, but the memory access could trigger a
segfault.</p>
</blockquote>
</body>
</description>
<references>
<url>http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_01.txt</url>
<url>http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_02.txt</url>
<url>http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_03.txt</url>
<cvename>CVE-2013-4508</cvename>
<cvename>CVE-2013-4559</cvename>
<cvename>CVE-2013-4560</cvename>
</references>
<dates>
<discovery>2013-11-28</discovery>
<entry>2014-02-14</entry>
</dates>
</vuln>
<vuln vid="4dd575b8-8f82-11e3-bb11-0025905a4771">
<topic>phpmyfaq -- multiple vulnerabilities</topic>
<affects>
<package>
<name>phpmyfaq</name>
<range><lt>2.8.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyFAQ team reports:</p>
<blockquote cite="http://www.phpmyfaq.de/advisory_2014-02-04.php">
<p> An arbitrary script may be executed on the user's Internet
Explorer when using an older version of the browser. If a user views
a malicious page while logged in, settings may be changed
unintentionally.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0813</cvename>
<cvename>CVE-2014-0814</cvename>
<url>http://www.phpmyfaq.de/advisory_2014-02-04.php</url>
</references>
<dates>
<discovery>2014-02-04</discovery>
<entry>2014-02-06</entry>
</dates>
</vuln>
<vuln vid="b7a7576d-8e0a-11e3-9976-9c4e36909cc0">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.336</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb14-04.html">
<p>These updates address vulnerabilities that could cause a crash
and potentially allow an attacker to take control of the affected system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0497</cvename>
<url>http://www.adobe.com/support/security/bulletins/apsb14-04.html</url>
</references>
<dates>
<discovery>2014-02-04</discovery>
<entry>2014-02-04</entry>
<modified>2014-02-05</modified>
</dates>
</vuln>
<vuln vid="1753f0ff-8dd5-11e3-9b45-b4b52fce4ce8">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>25.0,1</gt><lt>27.0,1</lt></range>
<range><lt>24.3.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>27.0,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.24</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>24.3.0</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.24</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>24.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2014-01 Miscellaneous memory safety hazards
(rv:27.0 / rv:24.3)</p>
<p>MFSA 2014-02 Clone protected content with XBL scopes</p>
<p>MFSA 2014-03 UI selection timeout missing on download
prompts</p>
<p>MFSA 2014-04 Incorrect use of discarded images by
RasterImage</p>
<p>MFSA 2014-05 Information disclosure with *FromPoint on
iframes</p>
<p>MFSA 2014-06 Profile path leaks to Android system log</p>
<p>MFSA 2014-07 XSLT stylesheets treated as styles in Content
Security Policy</p>
<p>MFSA 2014-08 Use-after-free with imgRequestProxy and image
proccessing</p>
<p>MFSA 2014-09 Cross-origin information leak through web
workers</p>
<p>MFSA 2014-10 Firefox default start page UI content invokable
by script</p>
<p>MFSA 2014-11 Crash when using web workers with asm.js</p>
<p>MFSA 2014-12 NSS ticket handling issues</p>
<p>MFSA 2014-13 Inconsistent JavaScript handling of access to
Window objects</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-1477</cvename>
<cvename>CVE-2014-1478</cvename>
<cvename>CVE-2014-1479</cvename>
<cvename>CVE-2014-1480</cvename>
<cvename>CVE-2014-1481</cvename>
<cvename>CVE-2014-1482</cvename>
<cvename>CVE-2014-1483</cvename>
<cvename>CVE-2014-1484</cvename>
<cvename>CVE-2014-1485</cvename>
<cvename>CVE-2014-1486</cvename>
<cvename>CVE-2014-1487</cvename>
<cvename>CVE-2014-1488</cvename>
<cvename>CVE-2014-1489</cvename>
<cvename>CVE-2014-1490</cvename>
<cvename>CVE-2014-1491</cvename>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-01.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-02.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-03.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-04.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-05.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-06.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-07.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-08.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-09.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-10.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-11.html</url>
<url>https://www.mozilla.org/security/announce/2014/mfsa2014-12.html</url>
<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
</references>
<dates>
<discovery>2014-02-04</discovery>
<entry>2014-02-04</entry>
</dates>
</vuln>
<vuln vid="111f1f84-1d14-4ff2-a9ea-cf07119c0d3b">
<topic>libyaml heap overflow resulting in possible code execution</topic>
<affects>
<package>
<name>libyaml</name>
<range><lt>0.1.4_3</lt></range>
</package>
<package>
<name>pkg</name>
<range><lt>1.2.6</lt></range>
</package>
<package>
<name>pkg-devel</name>
<range><lt>1.2.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libyaml was prone to a heap overflow that could result in
arbitrary code execution. Pkg uses libyaml to parse
the package manifests in some cases. Pkg also used libyaml
to parse the remote repository until 1.2.</p>
<p>RedHat Product Security Team reports on libyaml:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=1033990">
<p>A heap-based buffer overflow flaw was found in the way libyaml
parsed YAML tags. A remote attacker could provide a
specially-crafted YAML document that, when parsed by an application
using libyaml, would cause the application to crash or, potentially,
execute arbitrary code with the privileges of the user running the
application.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-6393</cvename>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1033990</url>
</references>
<dates>
<discovery>2013-11-24</discovery>
<entry>2014-02-01</entry>
<modified>2014-02-01</modified>
</dates>
</vuln>
<vuln vid="a4c9e12d-88b7-11e3-8ada-10bf48e1088e">
<topic>socat -- buffer overflow with data from command line</topic>
<affects>
<package>
<name>socat</name>
<range><lt>1.7.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Florian Weimer of the Red Hat Product Security Team reports:</p>
<blockquote cite="http://www.dest-unreach.org/socat/contrib/socat-secadv5.txt">
<p>Due to a missing check during assembly of the HTTP request line a long
target server name in the PROXY-CONNECT address can cause a stack buffer
overrun. Exploitation requires that the attacker is able to provide the
target server name to the PROXY-CONNECT address in the command line.
This can happen for example in scripts that receive data from untrusted
sources.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0019</cvename>
<url>http://www.dest-unreach.org/socat/contrib/socat-secadv5.txt</url>
</references>
<dates>
<discovery>2014-01-24</discovery>
<entry>2014-01-29</entry>
</dates>
</vuln>
<vuln vid="c7b5d72b-886a-11e3-9533-60a44c524f57">
<topic>otrs -- multiple vulnerabilities</topic>
<affects>
<package>
<name>otrs</name>
<range><lt>3.1.19</lt></range>
<range><gt>3.2.*</gt><lt>3.2.14</lt></range>
<range><gt>3.3.*</gt><lt>3.3.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OTRS Project reports:</p>
<blockquote cite="https://www.otrs.com/security-advisory-2014-02-sql-injection-issue/">
<p>SQL injection issue</p>
</blockquote>
<blockquote cite="https://www.otrs.com/security-advisory-2014-01-csrf-issue-customer-web-interface/">
<p>An attacker that managed to take over the session of a logged in customer
could create tickets and/or send follow-ups to existing tickets due to
missing challenge token checks.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-1471</cvename>
<url>https://www.otrs.com/security-advisory-2014-02-sql-injection-issue/</url>
<url>https://www.otrs.com/security-advisory-2014-01-csrf-issue-customer-web-interface/</url>
</references>
<dates>
<discovery>2014-01-28</discovery>
<entry>2014-01-28</entry>
<modified>2014-02-06</modified>
</dates>
</vuln>
<vuln vid="080c5370-886a-11e3-9533-60a44c524f57">
<cancelled superseded="c7b5d72b-886a-11e3-9533-60a44c524f57"/>
</vuln>
<vuln vid="f9810c43-87a5-11e3-9214-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>32.0.1700.102</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/">
<p>14 security fixes in this release, including:</p>
<ul>
<li>[330420] High CVE-2013-6649: Use-after-free in SVG images.
Credit to Atte Kettunen of OUSPG.</li>
<li>[331444] High CVE-2013-6650: Memory corruption in V8. This
issue was fixed in v8 version 3.22.24.16. Credit to Christian
Holler.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-6649</cvename>
<cvename>CVE-2013-6650</cvename>
<url>http://googlechromereleases.blogspot.nl/</url>
</references>
<dates>
<discovery>2014-01-27</discovery>
<entry>2014-01-27</entry>
</dates>
</vuln>
<vuln vid="d1dfc4c7-8791-11e3-a371-6805ca0b3d42">
<topic>rt42 -- denial-of-service attack via the email gateway</topic>
<affects>
<package>
<name>rt42</name>
<range><ge>4.2</ge><lt>4.2.1_3</lt></range>
<range><ge>4.2.2</ge><lt>4.2.2_2</lt></range>
</package>
<package>
<name>p5-Email-Address-List</name>
<range><lt>0.02</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The RT development team reports:</p>
<blockquote cite="http://blog.bestpractical.com/2014/01/security-vulnerability-in-rt-42.html">
<p>Versions of RT between 4.2.0 and 4.2.2 (inclusive) are
vulnerable to a denial-of-service attack via the email
gateway; any installation which accepts mail from untrusted
sources is vulnerable, regardless of the permissions
configuration inside RT. This vulnerability is assigned
CVE-2014-1474.</p>
<p>This vulnerability is caused by poor parsing performance
in the Email::Address::List module, which RT depends on. We
recommend that affected users upgrade their version of
Email::Address::List to v0.02 or above, which resolves the
issue. Due to a communications mishap, the release on CPAN
will temporarily appear as "unauthorized," and the
command-line cpan client will hence not install it. We
expect this to be resolved shortly; in the meantime, the
release is also available from our server.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-1474</cvename>
<url>http://blog.bestpractical.com/2014/01/security-vulnerability-in-rt-42.html</url>
</references>
<dates>
<discovery>2014-01-27</discovery>
<entry>2014-01-27</entry>
</dates>
</vuln>
<vuln vid="efa663eb-8754-11e3-9a47-00163e1ed244">
<topic>strongswan -- multiple DoS vulnerabilities</topic>
<affects>
<package>
<name>strongswan</name>
<range><lt>5.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>strongSwan Project reports:</p>
<blockquote cite="http://www.strongswan.org/blog/2013/11/01/strongswan-denial-of-service-vulnerability-%28cve-2013-6076%29.html">
<p>A DoS vulnerability triggered by crafted IKEv1 fragmentation
payloads was discovered in strongSwan's IKE daemon charon. All
versions since 5.0.2 are affected.</p>
</blockquote>
<blockquote cite="http://www.strongswan.org/blog/2013/11/01/strongswan-denial-of-service-vulnerability-%28cve-2013-6075%29.html">
<p>A DoS vulnerability and potential authorization bypass triggered
by a crafted ID_DER_ASN1_DN ID payload was discovered in strongSwan.
All versions since 4.3.3 are affected.</p>
</blockquote>
<blockquote cite="http://www.strongswan.org/blog/2013/08/01/strongswan-denial-of-service-vulnerability-%28cve-2013-5018%29.html">
<p>A DoS vulnerability in strongSwan was discovered, which is
triggered by XAuth usernames and EAP identities in versions
5.0.3 and 5.0.4.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-5018</cvename>
<cvename>CVE-2013-6075</cvename>
<cvename>CVE-2013-6076</cvename>
<url>http://www.strongswan.org/blog/2013/08/01/strongswan-denial-of-service-vulnerability-%28cve-2013-5018%29.html</url>
<url>http://www.strongswan.org/blog/2013/11/01/strongswan-denial-of-service-vulnerability-%28cve-2013-6075%29.html</url>
<url>http://www.strongswan.org/blog/2013/11/01/strongswan-denial-of-service-vulnerability-%28cve-2013-6076%29.html</url>
</references>
<dates>
<discovery>2013-11-01</discovery>
<entry>2014-01-27</entry>
</dates>
</vuln>
<vuln vid="d9dbe6e8-84da-11e3-98bd-080027f2d077">
<topic>varnish -- DoS vulnerability in Varnish HTTP cache</topic>
<affects>
<package>
<name>varnish</name>
<range><lt>3.0.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Varnish Cache Project reports:</p>
<blockquote cite="https://www.varnish-cache.org/lists/pipermail/varnish-announce/2013-October/000686.html">
<p>If Varnish receives a certain illegal request, and the subroutine
'vcl_error{}' restarts the request, the varnishd worker process
will crash with an assert.
</p>
<p>The varnishd management process will restart the worker process, but
there will be a brief interruption of service and the cache will be
emptied, causing more traffic to go to the backend.
</p>
<p>We are releasing this advisory because restarting from vcl_error{} is
both fairly common and documented.</p>
<p>This is purely a denial of service vulnerability, there is no risk of
privilege escalation.</p>
<p>Workaround</p>
<p>Insert this at the top of your VCL file:</p>
<pre>
sub vcl_error {
if (obj.status == 400 || obj.status == 413) {
return(deliver);
}
}
Or add this test at the top of your existing vcl_error{}.
</pre>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4484</cvename>
<mlist>https://www.varnish-cache.org/lists/pipermail/varnish-announce/2013-October/000686.html</mlist>
</references>
<dates>
<discovery>2013-10-30</discovery>
<entry>2014-01-25</entry>
</dates>
</vuln>
<vuln vid="c0ef849e-84ac-11e3-bec4-9c4e36909cc0">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.335</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="http://helpx.adobe.com/security/products/flash-player/apsb14-02.html">
<p>These updates address vulnerabilities that could cause a crash
and potentially allow an attacker to take control of the affected system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0491</cvename>
<cvename>CVE-2014-0492</cvename>
<url>http://helpx.adobe.com/security/products/flash-player/apsb14-02.html</url>
</references>
<dates>
<discovery>2014-01-14</discovery>
<entry>2014-01-24</entry>
</dates>
</vuln>
<vuln vid="6d08fa63-83bf-11e3-bdba-080027ef73ec">
<topic>HTMLDOC -- buffer overflow issues when reading AFM files and parsing page sizes</topic>
<affects>
<package>
<name>htmldoc</name>
<range><lt>1.8.28</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Michael Sweet reports:</p>
<blockquote cite="http://www.msweet.org/projects.php?Z1">
<p>HTMLDOC 1.8.28 fixes some known security issues and
formatting bugs. Changes include:</p>
<ul>
<li>SECURITY: Fixed three buffer overflow issues when
reading AFM files and parsing page sizes.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://www.msweet.org/projects.php?Z1</url>
</references>
<dates>
<discovery>2014-01-06</discovery>
<entry>2014-01-22</entry>
<modified>2014-01-23</modified>
</dates>
</vuln>
<vuln vid="81f1fdc2-7ec7-11e3-a6c6-00163e1ed244">
<topic>virtualbox-ose -- local vulnerability</topic>
<affects>
<package>
<name>virtualbox-ose</name>
<range><lt>4.2.22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html">
<p>Unspecified vulnerability in the Oracle VM VirtualBox
component in Oracle Virtualization VirtualBox prior to
3.2.20, 4.0.22, 4.1.30, 4.2.22, and 4.3.6 allows local
users to affect confidentiality, integrity, and availability
via unknown vectors related to Core.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-5892</cvename>
<url>http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</url>
</references>
<dates>
<discovery>2014-01-15</discovery>
<entry>2014-01-16</entry>
</dates>
</vuln>
<vuln vid="5acf4638-7e2c-11e3-9fba-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>32.0.1700.77</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/">
<p>11 security fixes in this release, including:</p>
<ul>
<li>[249502] High CVE-2013-6646: Use-after-free in web workers.
Credit to Collin Payne.</li>
<li>[326854] High CVE-2013-6641: Use-after-free related to forms.
Credit to Atte Kettunen of OUSPG.</li>
<li>[324969] High CVE-2013-6642: Address bar spoofing in Chrome for
Android. Credit to lpilorz.</li>
<li>[321940] High CVE-2013-6643: Unprompted sync with an attacker’s
Google account. Credit to Joao Lucas Melo Brasio.</li>
<li>[318791] Medium CVE-2013-6645 Use-after-free related to speech
input elements. Credit to Khalil Zhani.</li>
<li>[333036] CVE-2013-6644: Various fixes from internal audits,
fuzzing and other initiatives.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-6641</cvename>
<cvename>CVE-2013-6642</cvename>
<cvename>CVE-2013-6643</cvename>
<cvename>CVE-2013-6644</cvename>
<cvename>CVE-2013-6645</cvename>
<cvename>CVE-2013-6646</cvename>
<url>http://googlechromereleases.blogspot.nl/</url>
</references>
<dates>
<discovery>2014-01-14</discovery>
<entry>2014-01-15</entry>
</dates>
</vuln>
<vuln vid="3d95c9a7-7d5c-11e3-a8c1-206a8a720317">
<topic>ntpd DRDoS / Amplification Attack using ntpdc monlist command</topic>
<affects>
<package>
<name>ntp</name>
<range><lt>4.2.7p26</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ntp.org reports:</p>
<blockquote cite="http://support.ntp.org/bin/view/Main/SecurityNotice#DRDoS_Amplification_Attack_using">
<p>Unrestricted access to the monlist feature in
ntp_request.c in ntpd in NTP before 4.2.7p26 allows remote
attackers to cause a denial of service (traffic
amplification) via forged (1) REQ_MON_GETLIST or (2)
REQ_MON_GETLIST_1 requests, as exploited in the wild in
December 2013</p>
<p>Use noquery to your default restrictions to block all
status queries.</p>
<p>Use disable monitor to disable the ``ntpdc -c monlist''
command while still allowing other status queries.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-5211</cvename>
<freebsdsa>SA-14:02.ntpd</freebsdsa>
<url>http://support.ntp.org/bin/view/Main/SecurityNotice#DRDoS_Amplification_Attack_using</url>
</references>
<dates>
<discovery>2014-01-01</discovery>
<entry>2014-01-14</entry>
</dates>
</vuln>
<vuln vid="ba04a373-7d20-11e3-8992-00132034b086">
<topic>nagios -- denial of service vulnerability</topic>
<affects>
<package>
<name>nagios</name>
<range><lt>3.5.1_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Eric Stanley reports:</p>
<blockquote cite="http://sourceforge.net/p/nagios/nagioscore/ci/d97e03f32741a7d851826b03ed73ff4c9612a866/">
<p>Most CGIs previously incremented the input variable counter twice
when it encountered a long key value. This could cause the CGI to
read past the end of the list of CGI variables.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-7108</cvename>
<cvename>CVE-2013-7205</cvename>
<url>http://sourceforge.net/p/nagios/nagioscore/ci/d97e03f32741a7d851826b03ed73ff4c9612a866/</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1046113</url>
</references>
<dates>
<discovery>2013-12-20</discovery>
<entry>2014-01-14</entry>
</dates>
</vuln>
<vuln vid="cb252f01-7c43-11e3-b0a6-005056a37f68">
<topic>bind -- denial of service vulnerability</topic>
<affects>
<package>
<name>bind99</name>
<range><lt>9.9.4.2</lt></range>
</package>
<package>
<name>bind99-base</name>
<range><lt>9.9.4.2</lt></range>
</package>
<package>
<name>bind98</name>
<range><lt>9.8.6.2</lt></range>
</package>
<package>
<name>bind98-base</name>
<range><lt>9.8.6.2</lt></range>
</package>
<package>
<name>bind96</name>
<range><lt>9.6.3.2.ESV.R10.2</lt></range>
</package>
<package>
<name>bind96-base</name>
<range><lt>9.6.3.2.ESV.R10.2</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><gt>9.2</gt><lt>9.2_3</lt></range>
<range><gt>9.1</gt><lt>9.1_10</lt></range>
<range><gt>8.4</gt><lt>8.4_7</lt></range>
<range><gt>8.3</gt><lt>8.3_14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01078/74/">
<p>Because of a defect in handling queries for NSEC3-signed zones,
BIND can crash with an "INSIST" failure in name.c when processing
queries possessing certain properties. By exploiting this defect
an attacker deliberately constructing a query with the right
properties could achieve denial of service against an authoritative
nameserver serving NSEC3-signed zones.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0591</cvename>
<freebsdsa>SA-13:07.bind</freebsdsa>
<url>https://kb.isc.org/article/AA-01078/74/</url>
</references>
<dates>
<discovery>2014-01-08</discovery>
<entry>2014-01-13</entry>
<modified>2014-04-30</modified>
</dates>
</vuln>
<vuln vid="28c575fa-784e-11e3-8249-001cc0380077">
<topic>libXfont -- Stack buffer overflow in parsing of BDF font files in libXfont</topic>
<affects>
<package>
<name>libXfont</name>
<range><lt>1.4.7,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>freedesktop.org reports:</p>
<blockquote cite="http://lists.x.org/archives/xorg-announce/2014-January/002389.html">
<p>A BDF font file containing a longer than expected string can cause
a buffer overflow on the stack. Testing in X servers built with
Stack Protector restulted in an immediate crash when reading a
user-proveded specially crafted font.</p>
<p>As libXfont is used to read user-specified font files in all X
servers distributed by X.Org, including the Xorg server which is
often run with root privileges or as setuid-root in order to access
hardware, this bug may lead to an unprivileged user acquiring root
privileges in some systems.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-6462</cvename>
<url>http://lists.x.org/archives/xorg-announce/2014-January/002389.html</url>
</references>
<dates>
<discovery>2013-12-24</discovery>
<entry>2014-01-08</entry>
</dates>
</vuln>
<vuln vid="5aaa257e-772d-11e3-a65a-3c970e169bc2">
<topic>openssl -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.1_9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSSL development team reports:</p>
<blockquote cite="http://www.openssl.org/news/openssl-1.0.1-notes.html">
<p>Major changes between OpenSSL 1.0.1e and OpenSSL 1.0.1f [6 Jan 2014]:</p>
<ul>
<li>Fix for TLS record tampering bug [CVE-2013-4353]</li>
<li>Fix for TLS version checking bug [CVE-2013-6449]</li>
<li>Fix for DTLS retransmission bug [CVE-2013-6450]</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4353</cvename>
<cvename>CVE-2013-6449</cvename>
<cvename>CVE-2013-6450</cvename>
<url>http://www.openssl.org/news/openssl-1.0.1-notes.html</url>
</references>
<dates>
<discovery>2014-01-06</discovery>
<entry>2014-01-06</entry>
</dates>
</vuln>
<vuln vid="3e33a0bb-6b2f-11e3-b042-20cf30e32f6d">
<topic>OpenX -- SQL injection vulnerability</topic>
<affects>
<package>
<name>openx</name>
<range><lt>3.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Revive reports:</p>
<blockquote cite="http://www.revive-adserver.com/security/revive-sa-2013-001/">
<p>An SQL-injection vulnerability was recently discovered and reported
to the Revive Adserver team by Florian Sander. The vulnerability is
known to be already exploited to gain unauthorised access to the
application using brute force mechanisms, however other kind of
attacks might be possible and/or already in use. The risk is rated
to be critical as the most common end goal of the attackers is to
spread malware to the visitors of all the websites and ad networks
that the ad server is being used on.</p>
<p>The vulnerability is also present and exploitable in OpenX Source
2.8.11 and earlier versions, potentially back to phpAdsNew 2.0.x.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.revive-adserver.com/security/revive-sa-2013-001/</url>
<url>http://www.kreativrauschen.com/blog/2013/12/18/zero-day-vulnerability-in-openx-source-2-8-11-and-revive-adserver-3-0-1/</url>
<cvename>CVE-2013-7149</cvename>
</references>
<dates>
<discovery>2013-12-20</discovery>
<entry>2013-12-22</entry>
</dates>
</vuln>
<vuln vid="4e1f4abc-6837-11e3-9cda-3c970e169bc2">
<topic>cURL library -- cert name check ignore with GnuTLS</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.21.4</ge><lt>7.33.0_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cURL project reports:</p>
<blockquote cite="http://curl.haxx.se/docs/adv_20131217.html">
<p>libcurl is vulnerable to a case of missing out the checking
of the certificate CN or SAN name field when the digital
signature verification is turned off.</p>
<p>libcurl offers two separate and independent options for
verifying a server's TLS certificate. CURLOPT_SSL_VERIFYPEER
and CURLOPT_SSL_VERIFYHOST. The first one tells libcurl to
verify the trust chain using a CA cert bundle, while the
second tells libcurl to make sure that the name fields in
the server certificate meets the criteria. Both options are
enabled by default.</p>
<p>This flaw had the effect that when an application disabled
CURLOPT_SSL_VERIFYPEER, libcurl mistakenly also skipped the
CURLOPT_SSL_VERIFYHOST check. Applications can disable
CURLOPT_SSL_VERIFYPEER and still achieve security by doing
the check on its own using other means.</p>
<p>The curl command line tool is not affected by this problem
as it either enables both options or disables both at the
same time.</p>
</blockquote>
</body>
</description>
<references>
<url>http://curl.haxx.se/docs/adv_20131217.html</url>
<cvename>CVE-2013-6422</cvename>
</references>
<dates>
<discovery>2013-12-17</discovery>
<entry>2013-12-18</entry>
</dates>
</vuln>
<vuln vid="2e5715f8-67f7-11e3-9811-b499baab0cbe">
<topic>gnupg -- RSA Key Extraction via Low-Bandwidth Acoustic Cryptanalysis attack</topic>
<affects>
<package>
<name>gnupg</name>
<range><lt>1.4.16</lt></range>
</package>
<package>
<name>gnupg1</name>
<range><lt>1.4.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Werner Koch reports:</p>
<blockquote cite="http://lists.gnupg.org/pipermail/gnupg-announce/2013q4/000337.html">
<p>CVE-2013-4576 has been assigned to this security bug.</p>
<p>The paper describes two attacks. The first attack allows
to distinguish keys: An attacker is able to notice which key is
currently used for decryption. This is in general not a problem but
may be used to reveal the information that a message, encrypted to a
commonly not used key, has been received by the targeted machine. We
do not have a software solution to mitigate this attack.</p>
<p>The second attack is more serious. It is an adaptive
chosen ciphertext attack to reveal the private key. A possible
scenario is that the attacker places a sensor (for example a standard
smartphone) in the vicinity of the targeted machine. That machine is
assumed to do unattended RSA decryption of received mails, for example
by using a mail client which speeds up browsing by opportunistically
decrypting mails expected to be read soon. While listening to the
acoustic emanations of the targeted machine, the smartphone will send
new encrypted messages to that machine and re-construct the private
key bit by bit. A 4096 bit RSA key used on a laptop can be revealed
within an hour.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4576</cvename>
<url>http://lists.gnupg.org/pipermail/gnupg-announce/2013q4/000337.html</url>
</references>
<dates>
<discovery>2013-12-18</discovery>
<entry>2013-12-18</entry>
<modified>2014-04-30</modified>
</dates>
</vuln>
<vuln vid="0c39bafc-6771-11e3-868f-0025905a4771">
<topic>asterisk -- multiple vulnerabilities</topic>
<affects>
<package>
<name>asterisk10</name>
<range><lt>10.12.4</lt></range>
</package>
<package>
<name>asterisk11</name>
<range><lt>11.6.1</lt></range>
</package>
<package>
<name>asterisk18</name>
<range><lt>1.8.24.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/security">
<p>A 16 bit SMS message that contains an odd message length value will
cause the message decoding loop to run forever. The message buffer is
not on the stack but will be overflowed resulting in corrupted memory
and an immediate crash.</p>
<p>External control protocols, such as the Asterisk Manager Interface,
often have the ability to get and set channel variables; this allows
the execution of dialplan functions. Dialplan functions within
Asterisk are incredibly powerful, which is wonderful for building
applications using Asterisk. But during the read or write execution,
certain diaplan functions do much more. For example, reading the SHELL()
function can execute arbitrary commands on the system Asterisk is
running on. Writing to the FILE() function can change any file that
Asterisk has write access to. When these functions are executed from an
external protocol, that execution could result in a privilege escalation.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-7100</cvename>
<url>http://downloads.asterisk.org/pub/security/AST-2013-006.pdf</url>
<url>http://downloads.asterisk.org/pub/security/AST-2013-007.pdf</url>
<url>https://www.asterisk.org/security</url>
</references>
<dates>
<discovery>2013-12-16</discovery>
<entry>2013-12-17</entry>
</dates>
</vuln>
<vuln vid="3b86583a-66a7-11e3-868f-0025905a4771">
<topic>phpmyfaq -- arbitrary PHP code execution vulnerability</topic>
<affects>
<package>
<name>phpmyfaq</name>
<range><lt>2.8.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyFAQ team reports:</p>
<blockquote cite="http://www.phpmyfaq.de/advisory_2013-11-26.php">
<p>Secunia noticed while analysing the advisory that authenticated
users with "Right to add attachments" are able to exploit an already
publicly known issue in the bundled Ajax File Manager of phpMyFAQ version
2.8.3, which leads to arbitrary PHP code execution for authenticated
users with the permission "Right to add attachments".</p>
</blockquote>
</body>
</description>
<references>
<url>http://en.securitylab.ru/lab/PT-2013-41</url>
<url>http://www.phpmyfaq.de/advisory_2013-11-26.php</url>
</references>
<dates>
<discovery>2013-11-26</discovery>
<entry>2013-12-16</entry>
<modified>2013-12-17</modified>
</dates>
</vuln>
<vuln vid="44d0f8dc-6607-11e3-bb11-0025900931f8">
<topic>zabbix -- shell command injection vulnerability</topic>
<affects>
<package>
<name>zabbix2-agent</name>
<range><lt>2.0.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Recurity Labs Team project reports:</p>
<blockquote cite="https://support.zabbix.com/browse/ZBX-7479">
<p>Zabbix agent is vulnerable to remote command execution
from the Zabbix server in some cases.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-6824</cvename>
<url>https://support.zabbix.com/browse/ZBX-7479</url>
</references>
<dates>
<discovery>2013-12-03</discovery>
<entry>2013-12-16</entry>
</dates>
</vuln>
<vuln vid="47b4e713-6513-11e3-868f-0025905a4771">
<topic>PHP5 -- memory corruption in openssl_x509_parse()</topic>
<affects>
<package>
<name>php5</name>
<range><ge>5.4.0</ge><lt>5.4.23</lt></range>
</package>
<package>
<name>php53</name>
<range><lt>5.3.28</lt></range>
</package>
<package>
<name>php55</name>
<range><ge>5.5.0</ge><lt>5.5.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Stefan Esser reports:</p>
<blockquote cite="https://www.sektioneins.de/advisories/advisory-012013-php-openssl_x509_parse-memory-corruption-vulnerability.html">
<p>The PHP function openssl_x509_parse() uses a helper function
called asn1_time_to_time_t() to convert timestamps from ASN1
string format into integer timestamp values. The parser within
this helper function is not binary safe and can therefore be
tricked to write up to five NUL bytes outside of an allocated
buffer.</p>
<p>This problem can be triggered by x509 certificates that contain
NUL bytes in their notBefore and notAfter timestamp fields and
leads to a memory corruption that might result in arbitrary
code execution.</p>
<p>Depending on how openssl_x509_parse() is used within a PHP
application the attack requires either a malicious cert signed
by a compromised/malicious CA or can be carried out with a
self-signed cert.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-6420</cvename>
<url>https://www.sektioneins.de/advisories/advisory-012013-php-openssl_x509_parse-memory-corruption-vulnerability.html</url>
</references>
<dates>
<discovery>2013-12-13</discovery>
<entry>2013-12-14</entry>
</dates>
</vuln>
<vuln vid="dd116b19-64b3-11e3-868f-0025905a4771">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>25.0,1</gt><lt>26.0,1</lt></range>
<range><lt>24.2.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>26.0,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.23</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>24.2.0</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.23</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>24.2.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2013-116 JPEG information leak</p>
<p>MFSA 2013-105 Application Installation doorhanger persists on
navigation</p>
<p>MFSA 2013-106 Character encoding cross-origin XSS attack</p>
<p>MFSA 2013-107 Sandbox restrictions not applied to nested object
elements</p>
<p>MFSA 2013-108 Use-after-free in event listeners</p>
<p>MFSA 2013-109 Use-after-free during Table Editing</p>
<p>MFSA 2013-110 Potential overflow in JavaScript binary search
algorithms</p>
<p>MFSA 2013-111 Segmentation violation when replacing ordered list
elements</p>
<p>MFSA 2013-112 Linux clipboard information disclosure though
selection paste</p>
<p>MFSA 2013-113 Trust settings for built-in roots ignored during EV
certificate validation</p>
<p>MFSA 2013-114 Use-after-free in synthetic mouse movement</p>
<p>MFSA 2013-115 GetElementIC typed array stubs can be generated
outside observed typesets</p>
<p>MFSA 2013-116 JPEG information leak</p>
<p>MFSA 2013-117 Mis-issued ANSSI/DCSSI certificate</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-5609</cvename>
<cvename>CVE-2013-5610</cvename>
<cvename>CVE-2013-5611</cvename>
<cvename>CVE-2013-5612</cvename>
<cvename>CVE-2013-5613</cvename>
<cvename>CVE-2013-5614</cvename>
<cvename>CVE-2013-5615</cvename>
<cvename>CVE-2013-5616</cvename>
<cvename>CVE-2013-5618</cvename>
<cvename>CVE-2013-5619</cvename>
<cvename>CVE-2013-6629</cvename>
<cvename>CVE-2013-6630</cvename>
<cvename>CVE-2013-6671</cvename>
<cvename>CVE-2013-6672</cvename>
<cvename>CVE-2013-6673</cvename>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-104.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-105.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-106.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-107.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-108.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-109.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-110.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-111.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-112.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-113.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-114.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-115.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-116.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-117.html</url>
<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
</references>
<dates>
<discovery>2013-12-09</discovery>
<entry>2013-12-14</entry>
</dates>
</vuln>
<vuln vid="613e45d1-6154-11e3-9b62-000c292e4fd8">
<topic>samba -- multiple vulnerabilities</topic>
<affects>
<package>
<name>samba34</name>
<range><gt>0</gt></range>
</package>
<package>
<name>samba35</name>
<range><gt>0</gt></range>
</package>
<package>
<name>samba36</name>
<range><gt>3.6.*</gt><lt>3.6.22</lt></range>
</package>
<package>
<name>samba4</name>
<range><gt>4.0.*</gt><lt>4.0.13</lt></range>
</package>
<package>
<name>samba41</name>
<range><gt>4.1.*</gt><lt>4.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Samba project reports:</p>
<blockquote cite="http://www.samba.org/samba/latest_news.html#4.1.3">
<p>These are security releases in order to address CVE-2013-4408
(DCE-RPC fragment length field is incorrectly checked) and CVE-2012-6150
(pam_winbind login without require_membership_of restrictions).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-6150</cvename>
<cvename>CVE-2013-4408</cvename>
<url>http://www.samba.org/samba/security/CVE-2012-6150</url>
<url>http://www.samba.org/samba/security/CVE-2013-4408</url>
</references>
<dates>
<discovery>2012-06-12</discovery>
<entry>2013-12-11</entry>
</dates>
</vuln>
<vuln vid="6a806960-3016-44ed-8575-8614a7cb57c7">
<topic>rails -- multiple vulnerabilities</topic>
<affects>
<package>
<name>rubygem-actionmailer</name>
<range><lt>3.2.16</lt></range>
</package>
<package>
<name>rubygem-actionpack</name>
<range><lt>3.2.16</lt></range>
</package>
<package>
<name>rubygem-activemodel</name>
<range><lt>3.2.16</lt></range>
</package>
<package>
<name>rubygem-activerecord</name>
<range><lt>3.2.16</lt></range>
</package>
<package>
<name>rubygem-activeresource</name>
<range><lt>3.2.16</lt></range>
</package>
<package>
<name>rubygem-activesupport</name>
<range><lt>3.2.16</lt></range>
</package>
<package>
<name>rubygem-rails</name>
<range><lt>3.2.16</lt></range>
</package>
<package>
<name>rubygem-railties</name>
<range><lt>3.2.16</lt></range>
</package>
<package>
<name>rubygem-actionpack4</name>
<range><lt>4.0.2</lt></range>
</package>
<package>
<name>rubygem-activesupport4</name>
<range><lt>4.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Rails weblog:</p>
<blockquote cite="http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released/">
<p>Rails 3.2.16 and 4.0.2 have been released! These two
releases contain important security fixes, so please upgrade
as soon as possible! In order to make upgrading as smooth as
possible, we've only included commits directly related to
each security issue.</p>
<p>The security fixes in 3.2.16 are:</p>
<ul>
<li>CVE-2013-4491</li>
<li>CVE-2013-6414</li>
<li>CVE-2013-6415</li>
<li>CVE-2013-6417</li>
</ul>
<p>The security fixes in 4.0.2 are:</p>
<ul>
<li>CVE-2013-4491</li>
<li>CVE-2013-6414</li>
<li>CVE-2013-6415</li>
<li>CVE-2013-6416</li>
<li>CVE-2013-6417</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4491</cvename>
<cvename>CVE-2013-6414</cvename>
<cvename>CVE-2013-6415</cvename>
<cvename>CVE-2013-6416</cvename>
<cvename>CVE-2013-6417</cvename>
<url>http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released/</url>
</references>
<dates>
<discovery>2013-12-03</discovery>
<entry>2013-12-08</entry>
<modified>2014-04-23</modified>
</dates>
</vuln>
<vuln vid="d9649816-5e0d-11e3-8d23-3c970e169bc2">
<topic>drupal -- multiple vulnerabilities</topic>
<affects>
<package>
<name>drupal6</name>
<range><lt>6.29</lt></range>
</package>
<package>
<name>drupal7</name>
<range><lt>7.24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team reports:</p>
<blockquote cite="https://drupal.org/SA-CORE-2013-003">
<p>Multiple vulnerabilities were fixed in the supported Drupal
core versions 6 and 7.</p>
<ul>
<li>Multiple vulnerabilities due to optimistic cross-site
request forgery protection (Form API validation - Drupal 6
and 7)</li>
<li>Multiple vulnerabilities due to weakness in pseudorandom
number generation using mt_rand() (Form API, OpenID and
random password generation - Drupal 6 and 7)</li>
<li>Code execution prevention (Files directory .htaccess for
Apache - Drupal 6 and 7)</li>
<li>Access bypass (Security token validation - Drupal 6 and 7)</li>
<li>Cross-site scripting (Image module - Drupal 7)</li>
<li>Cross-site scripting (Color module - Drupal 7)</li>
<li>Open redirect (Overlay module - Drupal 7)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://drupal.org/SA-CORE-2013-003</url>
</references>
<dates>
<discovery>2013-11-20</discovery>
<entry>2013-12-06</entry>
</dates>
</vuln>
<vuln vid="79356040-5da4-11e3-829e-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>31.0.1650.63</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/">
<p>15 security fixes in this release, including:</p>
<ul>
<li>[307159] Medium CVE-2013-6634: Session fixation in sync related
to 302 redirects. Credit to Andrey Labunets.</li>
<li>[314469] High CVE-2013-6635: Use-after-free in editing. Credit
to cloudfuzzer.</li>
<li>[322959] Medium CVE-2013-6636: Address bar spoofing related to
modal dialogs. Credit to Bas Venis.</li>
<li>[325501] CVE-2013-6637: Various fixes from internal audits,
fuzzing and other initiatives.</li>
<li>[319722] Medium CVE-2013-6638: Buffer overflow in v8. This
issue was fixed in v8 version 3.22.24.7. Credit to Jakob Kummerow
of the Chromium project.</li>
<li>[319835] High CVE-2013-6639: Out of bounds write in v8. This
issue was fixed in v8 version 3.22.24.7. Credit to Jakob Kummerow
of the Chromium project.</li>
<li>[319860] Medium CVE-2013-6640: Out of bounds read in v8. This
issue was fixed in v8 version 3.22.24.7. Credit to Jakob Kummerow
of the Chromium project.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-6634</cvename>
<cvename>CVE-2013-6635</cvename>
<cvename>CVE-2013-6636</cvename>
<cvename>CVE-2013-6637</cvename>
<cvename>CVE-2013-6638</cvename>
<cvename>CVE-2013-6639</cvename>
<cvename>CVE-2013-6640</cvename>
<url>http://googlechromereleases.blogspot.nl/</url>
</references>
<dates>
<discovery>2013-12-04</discovery>
<entry>2013-12-05</entry>
</dates>
</vuln>
<vuln vid="4158c57e-5d39-11e3-bc1e-6cf0490a8c18">
<topic>Joomla! -- Core XSS Vulnerabilities</topic>
<affects>
<package>
<name>joomla2</name>
<range><ge>2.5.*</ge><le>2.5.14</le></range>
</package>
<package>
<name>joomla3</name>
<range><ge>3.0.*</ge><le>3.1.5</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The JSST and the Joomla! Security Center report:</p>
<blockquote cite="http://developer.joomla.org/security/570-core-xss-20131101.html">
<h2>[20131101] Core XSS Vulnerability</h2>
<p>Inadequate filtering leads to XSS vulnerability in com_contact.</p>
</blockquote>
<blockquote cite="http://developer.joomla.org/security/571-core-xss-20131102.html">
<h2>[20131102] Core XSS Vulnerability</h2>
<p>Inadequate filtering leads to XSS vulnerability in com_contact, com_weblinks, com_newsfeeds.</p>
</blockquote>
<blockquote cite="http://developer.joomla.org/security/572-core-xss-20131103.html">
<h2>[20131103] Core XSS Vulnerability</h2>
<p>Inadequate filtering leads to XSS vulnerability in com_contact.</p>
</blockquote>
</body>
</description>
<references>
<url>http://developer.joomla.org/security/570-core-xss-20131101.html</url>
<url>http://developer.joomla.org/security/571-core-xss-20131102.html</url>
<url>http://developer.joomla.org/security/572-core-xss-20131103.html</url>
</references>
<dates>
<discovery>2013-11-01</discovery>
<entry>2013-12-04</entry>
<modified>2014-04-23</modified>
</dates>
</vuln>
<vuln vid="d2073237-5b52-11e3-80f7-c86000cbc6ec">
<topic>OpenTTD -- Denial of service using forcefully crashed aircrafts</topic>
<affects>
<package>
<name>openttd</name>
<range><ge>0.3.6</ge><lt>1.3.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenTTD Team reports:</p>
<blockquote cite="https://security.openttd.org/en/CVE-2013-6411">
<p>The problem is caused by incorrectly handling the fact that
the aircraft circling the corner airport will be outside of the
bounds of the map. In the 'out of fuel' crash code the height
of the tile under the aircraft is determined. In this case
that means a tile outside of the allocated map array, which
could occasionally trigger invalid reads.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-6411</cvename>
<url>https://security.openttd.org/en/CVE-2013-6411</url>
<url>http://bugs.openttd.org/task/5820</url>
<url>http://vcs.openttd.org/svn/changeset/26134</url>
</references>
<dates>
<discovery>2013-11-28</discovery>
<entry>2013-11-28</entry>
</dates>
</vuln>
<vuln vid="620cf713-5a99-11e3-878d-20cf30e32f6d">
<topic>monitorix -- serious bug in the built-in HTTP server</topic>
<affects>
<package>
<name>monitorix</name>
<range><lt>3.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Monitorix Project reports:</p>
<blockquote cite="http://www.monitorix.org/news.html#N331">
<p>A serious bug in the built-in HTTP server. It was discovered that the
handle_request() routine did not properly perform input sanitization
which led into a number of security vulnerabilities. An unauthenticated,
remote attacker could exploit this flaw to execute arbitrary commands on
the remote host. All users still using older versions are advised to
upgrade to this version, which resolves this issue.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.monitorix.org/news.html#N331</url>
<url>https://github.com/mikaku/Monitorix/issues/30</url>
</references>
<dates>
<discovery>2013-11-21</discovery>
<entry>2013-12-01</entry>
</dates>
</vuln>
<vuln vid="e3244a7b-5603-11e3-878d-20cf30e32f6d">
<topic>subversion -- multiple vulnerabilities</topic>
<affects>
<package>
<name>subversion</name>
<range><ge>1.4.0</ge><lt>1.7.14</lt></range>
<range><ge>1.8.0</ge><lt>1.8.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Subversion Project reports:</p>
<blockquote cite="http://subversion.apache.org/security/">
<p>mod_dontdothat does not restrict requests from serf based clients</p>
<p>mod_dontdothat allows you to block update REPORT requests against certain
paths in the repository. It expects the paths in the REPORT request
to be absolute URLs. Serf based clients send relative URLs instead
of absolute URLs in many cases. As a result these clients are not blocked
as configured by mod_dontdothat.</p>
<p>mod_dav_svn assertion triggered by non-canonical URLs in autoversioning commits</p>
<p>When SVNAutoversioning is enabled via SVNAutoversioning on
commits can be made by single HTTP requests such as MKCOL and
PUT. If Subversion is built with assertions enabled any such
requests that have non-canonical URLs, such as URLs with a
trailing /, may trigger an assert. An assert will cause the
Apache process to abort.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4505</cvename>
<cvename>CVE-2013-4558</cvename>
<url>http://subversion.apache.org/security/CVE-2013-4505-advisory.txt</url>
<url>http://subversion.apache.org/security/CVE-2013-4558-advisory.txt</url>
</references>
<dates>
<discovery>2013-11-15</discovery>
<entry>2013-11-25</entry>
</dates>
</vuln>
<vuln vid="742eb9e4-e3cb-4f5a-b94e-0e9a39420600">
<topic>ruby-gems -- Algorithmic Complexity Vulnerability</topic>
<affects>
<package>
<name>ruby19-gems</name>
<range><lt>1.8.27</lt></range>
</package>
<package>
<name>ruby20-gems</name>
<range><lt>1.8.27</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby Gem developers report:</p>
<blockquote cite="http://blog.rubygems.org/2013/09/24/CVE-2013-4363.html">
<p>The patch for CVE-2013-4363 was insufficiently verified so the
combined regular expression for verifying gem version remains
vulnerable following CVE-2013-4363.</p>
<p>RubyGems validates versions with a regular expression that is
vulnerable to denial of service due to backtracking. For specially
crafted RubyGems versions attackers can cause denial of service
through CPU consumption.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4363</cvename>
</references>
<dates>
<discovery>2013-09-24</discovery>
<entry>2013-11-24</entry>
</dates>
</vuln>
<vuln vid="54237182-9635-4a8b-92d7-33bfaeed84cd">
<topic>ruby-gems -- Algorithmic Complexity Vulnerability</topic>
<affects>
<package>
<name>ruby19-gems</name>
<range><lt>1.8.26</lt></range>
</package>
<package>
<name>ruby20-gems</name>
<range><lt>1.8.26</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby Gem developers report:</p>
<blockquote cite="http://blog.rubygems.org/2013/09/09/CVE-2013-4287.html">
<p>RubyGems validates versions with a regular expression that is
vulnerable to denial of service due to backtracking. For specially
crafted RubyGems versions attackers can cause denial of service
through CPU consumption.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4287</cvename>
</references>
<dates>
<discovery>2013-09-09</discovery>
<entry>2013-11-24</entry>
</dates>
</vuln>
<vuln vid="cc9043cf-7f7a-426e-b2cc-8d1980618113">
<topic>ruby -- Heap Overflow in Floating Point Parsing</topic>
<affects>
<package>
<name>ruby19</name>
<range><lt>1.9.3.484,1</lt></range>
</package>
<package>
<name>ruby20</name>
<range><lt>2.0.0.353,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby developers report:</p>
<blockquote cite="https://www.ruby-lang.org/en/news/2013/11/22/heap-overflow-in-floating-point-parsing-cve-2013-4164/">
<p>Any time a string is converted to a floating point value, a
specially crafted string can cause a heap overflow. This can lead
to a denial of service attack via segmentation faults and possibly
arbitrary code execution. Any program that converts input of
unknown origin to floating point values (especially common when
accepting JSON) are vulnerable.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.ruby-lang.org/en/news/2013/11/22/ruby-1-9-3-p484-is-released/</url>
<url>https://www.ruby-lang.org/en/news/2013/11/22/ruby-2-0-0-p353-is-released/</url>
<cvename>CVE-2013-4164</cvename>
</references>
<dates>
<discovery>2013-11-22</discovery>
<entry>2013-11-23</entry>
</dates>
</vuln>
<vuln vid="479efd57-516e-11e3-9b62-000c292e4fd8">
<topic>samba -- Private key in key.pem world readable</topic>
<affects>
<package>
<name>samba4</name>
<range><gt>4.0.*</gt><lt>4.0.11</lt></range>
</package>
<package>
<name>samba41</name>
<range><gt>4.1.*</gt><lt>4.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Samba project reports:</p>
<blockquote cite="http://www.samba.org/samba/security/CVE-2013-4476">
<p>Samba 4.0.x before 4.0.11 and 4.1.x before 4.1.1, when LDAP or HTTP is
provided over SSL, uses world-readable permissions for a private key,
which allows local users to obtain sensitive information by reading the
key file, as demonstrated by access to the local filesystem on an AD
domain controller.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4476</cvename>
<url>http://www.samba.org/samba/security/CVE-2013-4476</url>
</references>
<dates>
<discovery>2013-06-12</discovery>
<entry>2013-11-19</entry>
</dates>
</vuln>
<vuln vid="a4f08579-516c-11e3-9b62-000c292e4fd8">
<topic>samba -- ACLs are not checked on opening an alternate data stream on a file or directory</topic>
<affects>
<package>
<name>samba34</name>
<range><gt>0</gt></range>
</package>
<package>
<name>samba35</name>
<range><gt>0</gt></range>
</package>
<package>
<name>samba36</name>
<range><gt>3.6.*</gt><lt>3.6.20</lt></range>
</package>
<package>
<name>samba4</name>
<range><gt>4.0.*</gt><lt>4.0.11</lt></range>
</package>
<package>
<name>samba41</name>
<range><gt>4.1.*</gt><lt>4.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Samba project reports:</p>
<blockquote cite="http://www.samba.org/samba/security/CVE-2013-4475">
<p>Samba versions 3.2.0 and above (all versions of 3.2.x, 3.3.x,
3.4.x, 3.5.x, 3.6.x, 4.0.x and 4.1.x) do not check the underlying
file or directory ACL when opening an alternate data stream.</p>
<p>According to the SMB1 and SMB2+ protocols the ACL on an underlying
file or directory should control what access is allowed to alternate
data streams that are associated with the file or directory.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4475</cvename>
<url>http://www.samba.org/samba/security/CVE-2013-4475</url>
</references>
<dates>
<discovery>2013-06-12</discovery>
<entry>2013-11-19</entry>
</dates>
</vuln>
<vuln vid="94b6264a-5140-11e3-8b22-f0def16c5c1b">
<topic>nginx -- Request line parsing vulnerability</topic>
<affects>
<package>
<name>nginx</name>
<range><ge>0.8.41</ge><lt>1.4.4,1</lt></range>
</package>
<package>
<name>nginx-devel</name>
<range><ge>0.8.41</ge><lt>1.5.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The nginx project reports:</p>
<blockquote cite="http://mailman.nginx.org/pipermail/nginx-announce/2013/000125.html">
<p>Ivan Fratric of the Google Security Team discovered a bug in nginx, which might
allow an attacker to bypass security restrictions in certain configurations by
using a specially crafted request, or might have potential other impact
(CVE-2013-4547).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4547</cvename>
<url>http://mailman.nginx.org/pipermail/nginx-announce/2013/000125.html</url>
</references>
<dates>
<discovery>2013-11-19</discovery>
<entry>2013-11-19</entry>
</dates>
</vuln>
<vuln vid="e62ab2af-4df4-11e3-b0cf-00262d5ed8ee">
<topic>chromium -- multiple memory corruption issues</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>31.0.1650.57</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/">
<p>[319117] [319125] Critical CVE-2013-6632: Multiple memory
corruption issues. Credit to Pinkie Pie.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-6632</cvename>
<url>http://googlechromereleases.blogspot.nl/</url>
</references>
<dates>
<discovery>2013-11-14</discovery>
<entry>2013-11-15</entry>
</dates>
</vuln>
<vuln vid="adcbdba2-4c27-11e3-9848-98fc11cdc4f5">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.327</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb13-26.html">
<p>These updates address vulnerabilities that could cause a crash
and potentially allow an attacker to take control of the affected system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-5329</cvename>
<cvename>CVE-2013-5330</cvename>
<url>http://www.adobe.com/support/security/bulletins/apsb13-26.html</url>
</references>
<dates>
<discovery>2013-11-12</discovery>
<entry>2013-11-12</entry>
</dates>
</vuln>
<vuln vid="3bfc7016-4bcc-11e3-b0cf-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>31.0.1650.48</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/">
<p>25 security fixes in this release, including:</p>
<ul>
<li>[268565] Medium CVE-2013-6621: Use after free related to speech input elements.
Credit to Khalil Zhani.</li>
<li>[272786] High CVE-2013-6622: Use after free related to media elements. Credit
to cloudfuzzer.</li>
<li>[282925] High CVE-2013-6623: Out of bounds read in SVG. Credit to miaubiz.</li>
<li>[290566] High CVE-2013-6624: Use after free related to “id” attribute strings.
Credit to Jon Butler.</li>
<li>[295010] High CVE-2013-6625: Use after free in DOM ranges. Credit to
cloudfuzzer.</li>
<li>[295695] Low CVE-2013-6626: Address bar spoofing related to interstitial
warnings. Credit to Chamal de Silva.</li>
<li>[299892] High CVE-2013-6627: Out of bounds read in HTTP parsing. Credit to
skylined.</li>
<li>[306959] Medium CVE-2013-6628: Issue with certificates not being checked
during TLS renegotiation. Credit to Antoine Delignat-Lavaud and Karthikeyan
Bhargavan from Prosecco of INRIA Paris.</li>
<li>[315823] Medium-Critical CVE-2013-2931: Various fixes from internal audits,
fuzzing and other initiatives.</li>
<li>[258723] Medium CVE-2013-6629: Read of uninitialized memory in libjpeg and
libjpeg-turbo. Credit to Michal Zalewski of Google.</li>
<li>[299835] Medium CVE-2013-6630: Read of uninitialized memory in libjpeg-turbo.
Credit to Michal Zalewski of Google.</li>
<li>[296804] High CVE-2013-6631: Use after free in libjingle. Credit to Patrik
Höglund of the Chromium project.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2931</cvename>
<cvename>CVE-2013-6621</cvename>
<cvename>CVE-2013-6622</cvename>
<cvename>CVE-2013-6623</cvename>
<cvename>CVE-2013-6624</cvename>
<cvename>CVE-2013-6625</cvename>
<cvename>CVE-2013-6626</cvename>
<cvename>CVE-2013-6627</cvename>
<cvename>CVE-2013-6628</cvename>
<cvename>CVE-2013-6629</cvename>
<cvename>CVE-2013-6630</cvename>
<cvename>CVE-2013-6631</cvename>
<url>http://googlechromereleases.blogspot.nl/</url>
</references>
<dates>
<discovery>2013-11-12</discovery>
<entry>2013-11-12</entry>
</dates>
</vuln>
<vuln vid="5709d244-4873-11e3-8a46-000d601460a4">
<topic>OpenSSH -- Memory corruption in sshd</topic>
<affects>
<package>
<name>openssh-portable</name>
<range><ge>6.2.p2,1</ge><lt>6.4.p1,1</lt></range>
</package>
<package>
<name>openssh-portable-base</name>
<range><ge>6.2.p2,1</ge><lt>6.4.p1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSH development team reports:</p>
<blockquote cite="http://www.openssh.com/txt/gcmrekey.adv">
<p>A memory corruption vulnerability exists in the post-
authentication sshd process when an AES-GCM cipher
(aes128-gcm@openssh.com or aes256-gcm@openssh.com) is
selected during kex exchange.</p>
<p>If exploited, this vulnerability might permit code execution
with the privileges of the authenticated user and may
therefore allow bypassing restricted shell/command
configurations.</p>
<p>Either upgrade to 6.4 or disable AES-GCM in the server
configuration. The following sshd_config option will disable
AES-GCM while leaving other ciphers active:</p>
<p>Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openssh.com/txt/gcmrekey.adv</url>
</references>
<dates>
<discovery>2013-11-07</discovery>
<entry>2013-11-08</entry>
<modified>2013-11-13</modified>
</dates>
</vuln>
<vuln vid="f969bad7-46fc-11e3-b6ee-00269ee29e57">
<topic>Quassel IRC -- SQL injection vulnerability</topic>
<affects>
<package>
<name>quassel</name>
<range><lt>0.9.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Quassel IRC developers report:</p>
<blockquote cite="http://www.quassel-irc.org/node/120">
<p>SQL injection vulnerability in Quassel IRC before 0.9.1,
when Qt 4.8.5 or later and PostgreSQL 8.2 or later are used,
allows remote attackers to execute arbitrary SQL commands via
a \ (backslash) in a message.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4422</cvename>
</references>
<dates>
<discovery>2013-10-07</discovery>
<entry>2013-11-06</entry>
</dates>
</vuln>
<vuln vid="81f866ad-41a4-11e3-a4af-0025905a4771">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>24.1.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>25.0,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.22</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>24.1.0</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.22</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>24.1.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p> MFSA 2013-93 Miscellaneous memory safety hazards (rv:25.0 /
rv:24.1 / rv:17.0.10)</p>
<p> MFSA 2013-94 Spoofing addressbar though SELECT element</p>
<p> MFSA 2013-95 Access violation with XSLT and uninitialized data</p>
<p> MFSA 2013-96 Improperly initialized memory and overflows in some
JavaScript functions</p>
<p> MFSA 2013-97 Writing to cycle collected object during image
decoding</p>
<p> MFSA 2013-98 Use-after-free when updating offline cache</p>
<p> MFSA 2013-99 Security bypass of PDF.js checks using iframes</p>
<p> MFSA 2013-100 Miscellaneous use-after-free issues found through
ASAN fuzzing</p>
<p> MFSA 2013-101 Memory corruption in workers</p>
<p> MFSA 2013-102 Use-after-free in HTML document templates</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1739</cvename>
<cvename>CVE-2013-5590</cvename>
<cvename>CVE-2013-5591</cvename>
<cvename>CVE-2013-5592</cvename>
<cvename>CVE-2013-5593</cvename>
<cvename>CVE-2013-5595</cvename>
<cvename>CVE-2013-5596</cvename>
<cvename>CVE-2013-5597</cvename>
<cvename>CVE-2013-5598</cvename>
<cvename>CVE-2013-5599</cvename>
<cvename>CVE-2013-5600</cvename>
<cvename>CVE-2013-5601</cvename>
<cvename>CVE-2013-5602</cvename>
<cvename>CVE-2013-5603</cvename>
<cvename>CVE-2013-5604</cvename>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-93.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-94.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-95.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-96.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-97.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-98.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-99.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-100.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-101.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-102.html</url>
<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
</references>
<dates>
<discovery>2013-10-29</discovery>
<entry>2013-10-30</entry>
<modified>2013-10-31</modified>
</dates>
</vuln>
<vuln vid="4e23644c-cb93-4f83-9e20-5bc07ad9b39f">
<topic>mod_pagespeed -- critical cross-site scripting (XSS) vulnerability</topic>
<affects>
<package>
<name>mod_pagespeed</name>
<range><lt>1.2.24.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mod_pagespeed developers report:</p>
<blockquote cite="https://groups.google.com/forum/#!msg/mod-pagespeed-announce/oo015UHRxMc/JcAuf1hE8L8J">
<p>Various versions of mod_pagespeed are subject to critical
cross-site scripting (XSS) vulnerability, CVE-2013-6111. This
permits a hostile third party to execute JavaScript in users'
browsers in context of the domain running mod_pagespeed, which
could permit theft of users' cookies or data on the site.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-6111</cvename>
</references>
<dates>
<discovery>2013-10-04</discovery>
<entry>2013-10-28</entry>
</dates>
</vuln>
<vuln vid="cd082cc6-1548-4b8d-a3aa-a007be611a29">
<cancelled/>
</vuln>
<vuln vid="9065b930-3d8b-11e3-bd1a-e840f2096bd0">
<topic>gnutls -- denial of service</topic>
<affects>
<package>
<name>gnutls3</name>
<range><lt>3.1.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Salvatore Bonaccorso reports:</p>
<blockquote cite="http://www.gnutls.org/security.html#GNUTLS-SA-2013-3">
<p>This vulnerability affects the DANE library of gnutls 3.1.x and
gnutls 3.2.x. A server that returns more 4 DANE entries could
corrupt the memory of a requesting client.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4466</cvename>
<url>http://www.gnutls.org/security.html#GNUTLS-SA-2013-3</url>
</references>
<dates>
<discovery>2013-10-25</discovery>
<entry>2013-10-25</entry>
<modified>2013-11-01</modified>
</dates>
</vuln>
<vuln vid="9a57c607-3cab-11e3-b4d9-bcaec565249c">
<topic>xorg-server -- use-after-free</topic>
<affects>
<package>
<name>xorg-server</name>
<range><ge>1.7.0</ge><lt>1.7.7_11</lt></range>
<range><ge>1.12.0</ge><lt>1.12.4_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Alan Coopersmith reports:</p>
<blockquote cite="http://lists.x.org/archives/xorg-announce/2013-October/002332.html">
<p>Pedro Ribeiro (pedrib at gmail.com) reported an issue to the X.Org
security team in which an authenticated X client can cause an X
server to use memory after it was freed, potentially leading to
crash and/or memory corruption.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4396</cvename>
<url>http://lists.x.org/archives/xorg-announce/2013-October/002332.html</url>
</references>
<dates>
<discovery>2013-10-08</discovery>
<entry>2013-10-24</entry>
</dates>
</vuln>
<vuln vid="c0f122e2-3897-11e3-a084-3c970e169bc2">
<topic>pycrypto -- PRNG reseed race condition</topic>
<affects>
<package>
<name>py26-pycrypto</name>
<range><lt>2.6.1</lt></range>
</package>
<package>
<name>py27-pycrypto</name>
<range><lt>2.6.1</lt></range>
</package>
<package>
<name>py31-pycrypto</name>
<range><lt>2.6.1</lt></range>
</package>
<package>
<name>py32-pycrypto</name>
<range><lt>2.6.1</lt></range>
</package>
<package>
<name>py33-pycrypto</name>
<range><lt>2.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Dwayne Litzenberger reports:</p>
<blockquote cite="http://lists.dlitz.net/pipermail/pycrypto/2013q4/000702.html">
<p>In PyCrypto before v2.6.1, the Crypto.Random pseudo-random
number generator (PRNG) exhibits a race condition that may cause
it to generate the same 'random' output in multiple processes that
are forked from each other. Depending on the application, this
could reveal sensitive information or cryptographic keys to remote
attackers.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1445</cvename>
<url>http://lists.dlitz.net/pipermail/pycrypto/2013q4/000702.html</url>
</references>
<dates>
<discovery>2013-10-17</discovery>
<entry>2013-10-19</entry>
<modified>2014-04-30</modified>
</dates>
</vuln>
<vuln vid="043d3a78-f245-4938-9bc7-3d0d35dd94bf">
<topic>wordpress -- multiple vulnerabilities</topic>
<affects>
<package>
<name>zh-wordpress-zh_CN</name>
<range><lt>3.6.1</lt></range>
</package>
<package>
<name>zh-wordpress-zh_TW</name>
<range><lt>3.6.1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<range><lt>3.6.1</lt></range>
</package>
<package>
<name>ja-wordpress</name>
<range><lt>3.6.1</lt></range>
</package>
<package>
<name>ru-wordpress</name>
<range><lt>3.6.1</lt></range>
</package>
<package>
<name>wordpress</name>
<range><lt>3.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The wordpress development team reports:</p>
<blockquote cite="http://wordpress.org/news/2013/09/wordpress-3-6-1/">
<ul>
<li>Block unsafe PHP unserialization that could occur in limited
situations and setups, which can lead to remote code
execution.</li>
<li>Prevent a user with an Author role, using a specially crafted
request, from being able to create a post "written by" another
user.</li>
<li>Fix insufficient input validation that could result in
redirecting or leading a user to another website.</li>
</ul>
<p>Additionally, we've adjusted security restrictions around file
uploads to mitigate the potential for cross-site scripting.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4338</cvename>
<cvename>CVE-2013-4339</cvename>
<cvename>CVE-2013-4340</cvename>
<cvename>CVE-2013-5738</cvename>
<cvename>CVE-2013-5739</cvename>
<url>http://wordpress.org/news/2013/09/wordpress-3-6-1/</url>
</references>
<dates>
<discovery>2013-09-11</discovery>
<entry>2013-10-19</entry>
<modified>2014-04-30</modified>
</dates>
</vuln>
<vuln vid="206f9826-a06d-4927-9a85-771c37010b32">
<topic>node.js -- DoS Vulnerability</topic>
<affects>
<package>
<name>node</name>
<range><lt>0.10.21</lt></range>
</package>
<package>
<name>node-devel</name>
<range><lt>0.11.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>node.js developers report</p>
<blockquote cite="http://blog.nodejs.org/2013/10/18/node-v0-10-21-stable/">
<p>This release contains a security fix for the http server implementation, please upgrade as soon as possible.</p>
</blockquote>
</body>
</description>
<references>
<url>http://blog.nodejs.org/2013/10/18/node-v0-10-21-stable/</url>
</references>
<dates>
<discovery>2013-10-19</discovery>
<entry>2013-10-19</entry>
</dates>
</vuln>
<vuln vid="e135f0c9-375f-11e3-80b7-20cf30e32f6d">
<topic>bugzilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>bugzilla</name>
<range><ge>4.0.0</ge><lt>4.0.11</lt></range>
</package>
<package>
<name>bugzilla40</name>
<range><ge>4.0.0</ge><lt>4.0.11</lt></range>
</package>
<package>
<name>bugzilla42</name>
<range><ge>4.2.0</ge><lt>4.2.7</lt></range>
</package>
<package>
<name>bugzilla44</name>
<range><ge>4.4</ge><lt>4.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>A Bugzilla Security Advisory reports:</h1>
<blockquote cite="http://www.bugzilla.org/security/4.0.10/">
<h1>Cross-Site Request Forgery</h1>
<p>When a user submits changes to a bug right after another
user did, a midair collision page is displayed to inform
the user about changes recently made. This page contains
a token which can be used to validate the changes if the
user decides to submit his changes anyway. A regression
in Bugzilla 4.4 caused this token to be recreated if a
crafted URL was given, even when no midair collision page
was going to be displayed, allowing an attacker to bypass
the token check and abuse a user to commit changes on his
behalf.</p>
<h1>Cross-Site Request Forgery</h1>
<p>When an attachment is edited, a token is generated to
validate changes made by the user. Using a crafted URL,
an attacker could force the token to be recreated,
allowing him to bypass the token check and abuse a user
to commit changes on his behalf.</p>
<h1>Cross-Site Scripting</h1>
<p>Some parameters passed to editflagtypes.cgi were not
correctly filtered in the HTML page, which could lead
to XSS.</p>
<h1>Cross-Site Scripting</h1>
<p>Due to an incomplete fix for CVE-2012-4189, some
incorrectly filtered field values in tabular reports
could lead to XSS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1733</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=911593</url>
<cvename>CVE-2013-1734</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=913904</url>
<cvename>CVE-2013-1742</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=924802</url>
<cvename>CVE-2013-1743</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=924932</url>
</references>
<dates>
<discovery>2013-10-16</discovery>
<entry>2013-10-17</entry>
<modified>2014-04-30</modified>
</dates>
</vuln>
<vuln vid="8c9b48d1-3715-11e3-a624-00262d8b701d">
<topic>dropbear -- exposure of sensitive information, DoS</topic>
<affects>
<package>
<name>dropbear</name>
<range><ge>2012.55</ge><lt>2013.59</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Dropbear project reports:</p>
<blockquote cite="http://secunia.com/advisories/55173/">
<p>A weakness and a vulnerability have been reported in Dropbear
SSH Server, which can be exploited by malicious people to disclose
certain sensitive information and cause a DoS.</p>
</blockquote>
</body>
</description>
<references>
<bid>62958</bid>
<bid>62993</bid>
<cvename>CVE-2013-4421</cvename>
<cvename>CVE-2013-4434</cvename>
<url>http://secunia.com/advisories/55173</url>
</references>
<dates>
<discovery>2013-05-08</discovery>
<!-- discovery>2013-10-03</discovery -->
<entry>2013-10-17</entry>
</dates>
</vuln>
<vuln vid="710cd5d5-35cb-11e3-85f9-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>30.0.1599.101</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/">
<p>5 security fixes in this release, including:</p>
<ul>
<li>[292422] High CVE-2013-2925: Use after free in XHR. Credit to
Atte Kettunen of OUSPG.</li>
<li>[294456] High CVE-2013-2926: Use after free in editing. Credit
to cloudfuzzer.</li>
<li>[297478] High CVE-2013-2927: Use after free in forms. Credit
to cloudfuzzer.</li>
<li>[305790] High CVE-2013-2928: Various fixes from internal
audits, fuzzing and other initiatives.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2925</cvename>
<cvename>CVE-2013-2926</cvename>
<cvename>CVE-2013-2927</cvename>
<cvename>CVE-2013-2928</cvename>
<url>http://googlechromereleases.blogspot.nl/</url>
</references>
<dates>
<discovery>2013-10-15</discovery>
<entry>2013-10-15</entry>
</dates>
</vuln>
<vuln vid="9003b500-31e3-11e3-b0d0-20cf30e32f6d">
<topic>mod_fcgid -- possible heap buffer overwrite</topic>
<affects>
<package>
<name>ap22-mod_fcgid</name>
<range><lt>2.3.9</lt></range>
</package>
<package>
<name>ap24-mod_fcgid</name>
<range><lt>2.3.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache Project reports:</p>
<blockquote cite="https://mail-archives.apache.org/mod_mbox/httpd-cvs/201309.mbox/%3C20130929174048.13B962388831@eris.apache.org%3E">
<p>Fix possible heap buffer overwrite.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4365</cvename>
</references>
<dates>
<discovery>2013-09-29</discovery>
<entry>2013-10-10</entry>
</dates>
</vuln>
<vuln vid="749b5587-2da1-11e3-b1a9-b499baab0cbe">
<topic>gnupg -- possible infinite recursion in the compressed packet parser</topic>
<affects>
<package>
<name>gnupg</name>
<range><lt>1.4.15</lt></range>
<range><ge>2.0.0</ge><lt>2.0.22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Werner Koch reports:</p>
<blockquote cite="http://lists.gnupg.org/pipermail/gnupg-announce/2013q4/000333.html">
<p>Special crafted input data may be used to cause a denial of service
against GPG (GnuPG's OpenPGP part) and some other OpenPGP
implementations. All systems using GPG to process incoming data are
affected..</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4402</cvename>
</references>
<dates>
<discovery>2013-10-05</discovery>
<entry>2013-10-05</entry>
</dates>
</vuln>
<vuln vid="5c34664f-2c2b-11e3-87c2-00215af774f0">
<topic>xinetd -- ignores user and group directives for TCPMUX services</topic>
<affects>
<package>
<name>xinetd</name>
<range><lt>2.3.15_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>xinetd would execute configured TCPMUX services without dropping
privilege to match the service configuration allowing the service to
run with same privilege as the xinetd process (root).</p>
</body>
</description>
<references>
<cvename>CVE-2013-4342</cvename>
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=324678</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1006100</url>
</references>
<dates>
<discovery>2005-08-23</discovery>
<entry>2013-10-03</entry>
</dates>
</vuln>
<vuln vid="ccefac3e-2aed-11e3-af10-000c29789cb5">
<topic>polarssl -- Timing attack against protected RSA-CRT implementation</topic>
<affects>
<package>
<name>polarssl</name>
<range><lt>1.2.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PolarSSL Project reports:</p>
<blockquote cite="https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2013-05">
<p>The researchers Cyril Arnaud and Pierre-Alain Fouque
investigated the PolarSSL RSA implementation and discovered
a bias in the implementation of the Montgomery multiplication
that we used. For which they then show that it can be used to
mount an attack on the RSA key. Although their test attack is
done on a local system, there seems to be enough indication
that this can properly be performed from a remote system as
well.</p>
<p>All versions prior to PolarSSL 1.2.9 and 1.3.0 are affected
if a third party can send arbitrary handshake messages to your
server.</p>
<p>If correctly executed, this attack reveals the entire private
RSA key after a large number of attack messages (&gt; 600.000 on
a local machine) are sent to show the timing differences.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-5915</cvename>
<url>https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2013-05</url>
<url>https://polarssl.org/tech-updates/releases/polarssl-1.2.9-released</url>
</references>
<dates>
<discovery>2013-10-01</discovery>
<entry>2013-10-02</entry>
</dates>
</vuln>
<vuln vid="e5414d0c-2ade-11e3-821d-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>30.0.1599.66</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/">
<p>50 security fixes in this release, including:</p>
<ul>
<li>[223962][270758][271161][284785][284786] Medium CVE-2013-2906:
Races in Web Audio. Credit to Atte Kettunen of OUSPG.</li>
<li>[260667] Medium CVE-2013-2907: Out of bounds read in
Window.prototype object. Credit to Boris Zbarsky.</li>
<li>[265221] Medium CVE-2013-2908: Address bar spoofing related to
the “204 No Content” status code. Credit to Chamal de Silva.</li>
<li>[265838][279277] High CVE-2013-2909: Use after free in
inline-block rendering. Credit to Atte Kettunen of OUSPG.</li>
<li>[269753] Medium CVE-2013-2910: Use-after-free in Web Audio.
Credit to Byoungyoung Lee of Georgia Tech Information Security
Center (GTISC).</li>
<li>[271939] High CVE-2013-2911: Use-after-free in XSLT. Credit to
Atte Kettunen of OUSPG.</li>
<li>[276368] High CVE-2013-2912: Use-after-free in PPAPI. Credit to
Chamal de Silva and 41.w4r10r(at)garage4hackers.com.</li>
<li>[278908] High CVE-2013-2913: Use-after-free in XML document
parsing. Credit to cloudfuzzer.</li>
<li>[279263] High CVE-2013-2914: Use after free in the Windows
color chooser dialog. Credit to Khalil Zhani.</li>
<li>[280512] Low CVE-2013-2915: Address bar spoofing via a
malformed scheme. Credit to Wander Groeneveld. </li>
<li>[281256] High CVE-2013-2916: Address bar spoofing related to
the “204 No Content” status code. Credit to Masato Kinugawa.</li>
<li>[281480] Medium CVE-2013-2917: Out of bounds read in Web Audio.
Credit to Byoungyoung Lee and Tielei Wang of Georgia Tech
Information Security Center (GTISC).</li>
<li>[282088] High CVE-2013-2918: Use-after-free in DOM. Credit to
Byoungyoung Lee of Georgia Tech Information Security Center
(GTISC).</li>
<li>[282736] High CVE-2013-2919: Memory corruption in V8. Credit to
Adam Haile of Concrete Data.</li>
<li>[285742] Medium CVE-2013-2920: Out of bounds read in URL
parsing. Credit to Atte Kettunen of OUSPG.</li>
<li>[286414] High CVE-2013-2921: Use-after-free in resource loader.
Credit to Byoungyoung Lee and Tielei Wang of Georgia Tech
Information Security Center (GTISC).</li>
<li>[286975] High CVE-2013-2922: Use-after-free in template
element. Credit to Jon Butler.</li>
<li>[299016] CVE-2013-2923: Various fixes from internal audits,
fuzzing and other initiatives (Chrome 30).</li>
<li>[275803] Medium CVE-2013-2924: Use-after-free in ICU. Upstream
bug here.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2906</cvename>
<cvename>CVE-2013-2907</cvename>
<cvename>CVE-2013-2908</cvename>
<cvename>CVE-2013-2909</cvename>
<cvename>CVE-2013-2910</cvename>
<cvename>CVE-2013-2911</cvename>
<cvename>CVE-2013-2912</cvename>
<cvename>CVE-2013-2913</cvename>
<cvename>CVE-2013-2914</cvename>
<cvename>CVE-2013-2915</cvename>
<cvename>CVE-2013-2916</cvename>
<cvename>CVE-2013-2917</cvename>
<cvename>CVE-2013-2918</cvename>
<cvename>CVE-2013-2919</cvename>
<cvename>CVE-2013-2920</cvename>
<cvename>CVE-2013-2921</cvename>
<cvename>CVE-2013-2922</cvename>
<cvename>CVE-2013-2923</cvename>
<cvename>CVE-2013-2924</cvename>
<url>http://googlechromereleases.blogspot.nl/</url>
</references>
<dates>
<discovery>2013-10-01</discovery>
<entry>2013-10-01</entry>
</dates>
</vuln>
<vuln vid="e1f99d59-81aa-4662-bf62-c1076f5016c8">
<topic>py-graphite-web -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>py26-graphite-web</name>
<range><ge>0.9.5</ge><lt>0.9.11</lt></range>
</package>
<package>
<name>py27-graphite-web</name>
<range><ge>0.9.5</ge><lt>0.9.11</lt></range>
</package>
<package>
<name>py31-graphite-web</name>
<range><ge>0.9.5</ge><lt>0.9.11</lt></range>
</package>
<package>
<name>py32-graphite-web</name>
<range><ge>0.9.5</ge><lt>0.9.11</lt></range>
</package>
<package>
<name>py33-graphite-web</name>
<range><ge>0.9.5</ge><lt>0.9.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Graphite developers report:</p>
<blockquote cite="http://graphite.readthedocs.org/en/0.9.11/releases/0_9_11.html">
<p>This release contains several security fixes for cross-site
scripting (XSS) as well as a fix for a remote-execution exploit in
graphite-web (CVE-2013-5903).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-5093</cvename>
<url>https://github.com/rapid7/metasploit-framework/pull/2260</url>
</references>
<dates>
<discovery>2013-08-21</discovery>
<entry>2013-09-30</entry>
<modified>2014-04-30</modified>
</dates>
</vuln>
<vuln vid="05dc6efa-2370-11e3-95b7-00e0814cab4e">
<topic>django -- denial-of-service via large passwords</topic>
<affects>
<package>
<name>py26-django</name>
<range><ge>1.5</ge><lt>1.5.4</lt></range>
<range><ge>1.4</ge><lt>1.4.8</lt></range>
</package>
<package>
<name>py27-django</name>
<range><ge>1.5</ge><lt>1.5.4</lt></range>
<range><ge>1.4</ge><lt>1.4.8</lt></range>
</package>
<package>
<name>py26-django-devel</name>
<range><lt>20130922,1</lt></range>
</package>
<package>
<name>py27-django-devel</name>
<range><lt>20130922,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Django project reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2013/sep/15/security/">
<p>These releases address a denial-of-service attack against Django's
authentication framework. All users of Django are encouraged to
upgrade immediately.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1443</cvename>
<url>https://www.djangoproject.com/weblog/2013/sep/15/security/</url>
</references>
<dates>
<discovery>2013-09-15</discovery>
<entry>2013-09-22</entry>
<modified>2014-04-30</modified>
</dates>
</vuln>
<vuln vid="b72bad1c-20ed-11e3-be06-000c29ee3065">
<topic>FreeBSD -- Cross-mount links between nullfs(5) mounts</topic>
<affects>
<system>
<name>FreeBSD</name>
<range><gt>9.1</gt><lt>9.1_7</lt></range>
<range><gt>8.4</gt><lt>8.4_4</lt></range>
<range><gt>8.3</gt><lt>8.3_11</lt></range>
</system>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem Description:</p>
<p>The nullfs(5) implementation of the VOP_LINK(9) VFS
operation does not check whether the source and target of
the link are both in the same nullfs instance. It is
therefore possible to create a hardlink from a location in
one nullfs instance to a file in another, as long as the
underlying (source) filesystem is the same.</p>
<p>Impact:</p>
<p>If multiple nullfs views into the same filesystem are
mounted in different locations, a user with read access to
one of these views and write access to another will be able
to create a hard link from the latter to a file in the
former, even though they are, from the user's perspective,
different filesystems. The user may thereby gain write
access to files which are nominally on a read-only
filesystem.</p>
</body>
</description>
<references>
<cvename>CVE-2013-5710</cvename>
<freebsdsa>SA-13:13.nullfs</freebsdsa>
</references>
<dates>
<discovery>2013-09-10</discovery>
<entry>2013-09-19</entry>
</dates>
</vuln>
<vuln vid="4d87d357-202c-11e3-be06-000c29ee3065">
<topic>FreeBSD -- Insufficient credential checks in network ioctl(2)</topic>
<affects>
<system>
<name>FreeBSD</name>
<range><gt>9.1</gt><lt>9.1_7</lt></range>
<range><gt>8.4</gt><lt>8.4_4</lt></range>
<range><gt>8.3</gt><lt>8.3_11</lt></range>
</system>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem Description:</p>
<p>As is commonly the case, the IPv6 and ATM network layer
ioctl request handlers are written in such a way that an
unrecognized request is passed on unmodified to the link
layer, which will either handle it or return an error
code.</p>
<p>Network interface drivers, however, assume that the
SIOCSIFADDR, SIOCSIFBRDADDR, SIOCSIFDSTADDR and
SIOCSIFNETMASK requests have been handled at the network
layer, and therefore do not perform input validation or
verify the caller's credentials. Typical link-layer actions
for these requests may include marking the interface as "up"
and resetting the underlying hardware.</p>
<p>Impact:</p>
<p>An unprivileged user with the ability to run arbitrary code
can cause any network interface in the system to perform the
link layer actions associated with a SIOCSIFADDR,
SIOCSIFBRDADDR, SIOCSIFDSTADDR or SIOCSIFNETMASK ioctl
request; or trigger a kernel panic by passing a specially
crafted address structure which causes a network interface
driver to dereference an invalid pointer.</p>
<p>Although this has not been confirmed, the possibility that
an attacker may be able to execute arbitrary code in kernel
context can not be ruled out.</p>
</body>
</description>
<references>
<cvename>CVE-2013-5691</cvename>
<freebsdsa>SA-13:12.ifioctl</freebsdsa>
</references>
<dates>
<discovery>2013-09-10</discovery>
<entry>2013-09-19</entry>
</dates>
</vuln>
<vuln vid="7dfed67b-20aa-11e3-b8d8-0025905a4771">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>18.0,1</gt><lt>24.0,1</lt></range>
<range><lt>17.0.9,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>17.0.9,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.21</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>17.0.9</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.21</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>24.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p> MFSA 2013-76 Miscellaneous memory safety hazards (rv:24.0 /
rv:17.0.9)</p>
<p> MFSA 2013-77 Improper state in HTML5 Tree Builder with templates</p>
<p> MFSA 2013-78 Integer overflow in ANGLE library</p>
<p> MFSA 2013-79 Use-after-free in Animation Manager during stylesheet
cloning</p>
<p> MFSA 2013-80 NativeKey continues handling key messages after
widget is destroyed</p>
<p> MFSA 2013-81 Use-after-free with select element</p>
<p> MFSA 2013-82 Calling scope for new Javascript objects can lead to
memory corruption</p>
<p> MFSA 2013-83 Mozilla Updater does not lock MAR file after
signature verification</p>
<p> MFSA 2013-84 Same-origin bypass through symbolic links</p>
<p> MFSA 2013-85 Uninitialized data in IonMonkey</p>
<p> MFSA 2013-86 WebGL Information disclosure through OS X NVIDIA
graphic drivers</p>
<p> MFSA 2013-87 Shared object library loading from writable location</p>
<p> MFSA 2013-88 compartment mismatch re-attaching XBL-backed nodes</p>
<p> MFSA 2013-89 Buffer overflow with multi-column, lists, and floats</p>
<p> MFSA 2013-90 Memory corruption involving scrolling</p>
<p> MFSA 2013-91 User-defined properties on DOM proxies get the wrong
"this" object</p>
<p> MFSA 2013-92 GC hazard with default compartments and frame chain
restoration</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1718</cvename>
<cvename>CVE-2013-1719</cvename>
<cvename>CVE-2013-1720</cvename>
<cvename>CVE-2013-1721</cvename>
<cvename>CVE-2013-1722</cvename>
<cvename>CVE-2013-1723</cvename>
<cvename>CVE-2013-1724</cvename>
<cvename>CVE-2013-1725</cvename>
<cvename>CVE-2013-1726</cvename>
<cvename>CVE-2013-1727</cvename>
<cvename>CVE-2013-1728</cvename>
<cvename>CVE-2013-1729</cvename>
<cvename>CVE-2013-1730</cvename>
<cvename>CVE-2013-1731</cvename>
<cvename>CVE-2013-1732</cvename>
<cvename>CVE-2013-1735</cvename>
<cvename>CVE-2013-1736</cvename>
<cvename>CVE-2013-1737</cvename>
<cvename>CVE-2013-1738</cvename>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-76.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-77.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-78.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-79.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-80.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-81.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-82.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-83.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-84.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-85.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-86.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-87.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-88.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-89.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-90.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-91.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-92.html</url>
<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
</references>
<dates>
<discovery>2013-08-17</discovery>
<entry>2013-08-18</entry>
<modified>2013-09-19</modified>
</dates>
</vuln>
<vuln vid="5bd6811f-1c75-11e3-ba72-98fc11cdc4f5">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.310</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb13-21.html">
<p>These updates address vulnerabilities that could cause a crash
and potentially allow an attacker to take control of the affected system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-3361</cvename>
<cvename>CVE-2013-3362</cvename>
<cvename>CVE-2013-3363</cvename>
<cvename>CVE-2013-5324</cvename>
<url>http://www.adobe.com/support/security/bulletins/apsb13-21.html</url>
</references>
<dates>
<discovery>2013-09-10</discovery>
<entry>2013-09-13</entry>
</dates>
</vuln>
<vuln vid="a851b305-1bc3-11e3-95b7-00e0814cab4e">
<topic>django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py26-django</name>
<range><ge>1.5</ge><lt>1.5.3</lt></range>
<range><ge>1.4</ge><lt>1.4.7</lt></range>
</package>
<package>
<name>py27-django</name>
<range><ge>1.5</ge><lt>1.5.3</lt></range>
<range><ge>1.4</ge><lt>1.4.7</lt></range>
</package>
<package>
<name>py26-django-devel</name>
<range><lt>20130912,1</lt></range>
</package>
<package>
<name>py27-django-devel</name>
<range><lt>20130912,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Django project reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2013/sep/10/security-releases-issued/">
<p>These releases address a directory-traversal vulnerability in one
of Django's built-in template tags. While this issue requires some
fairly specific factors to be exploitable, we encourage all users
of Django to upgrade promptly.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4315</cvename>
<url>https://www.djangoproject.com/weblog/2013/sep/10/security-releases-issued/</url>
</references>
<dates>
<discovery>2013-09-10</discovery>
<entry>2013-09-12</entry>
<modified>2014-04-30</modified>
</dates>
</vuln>
<vuln vid="f8a913cc-1322-11e3-8ffa-20cf30e32f6d">
<topic>svnserve is vulnerable to a local privilege escalation vulnerability via symlink attack.</topic>
<affects>
<package>
<name>subversion</name>
<range><ge>1.4.0</ge><lt>1.6.23_2</lt></range>
<range><ge>1.7.0</ge><lt>1.7.13</lt></range>
<range><ge>1.8.0</ge><lt>1.8.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Subversion Project reports:</p>
<blockquote cite="http://subversion.apache.org/security/CVE-2013-4277-advisory.txt">
<p>svnserve takes a --pid-file option which creates a file containing the
process id it is running as. It does not take steps to ensure that the file
it has been directed at is not a symlink. If the pid file is in a directory
writeable by unprivileged users, the destination could be replaced by a
symlink allowing for privilege escalation. svnserve does not create a pid
file by default.</p>
<p>All versions are only vulnerable when the --pid-file=ARG option is used.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4277</cvename>
<url>http://subversion.apache.org/security/CVE-2013-4277-advisory.txt</url>
</references>
<dates>
<discovery>2013-08-30</discovery>
<entry>2013-09-02</entry>
</dates>
</vuln>
<vuln vid="b3b8d491-0fbb-11e3-8c50-1c6f65c11ee6">
<topic>cacti -- allow remote attackers to execute arbitrary SQL commands</topic>
<affects>
<package>
<name>cacti</name>
<range><lt>0.8.8b</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cacti release reports:</p>
<blockquote cite="http://www.cacti.net/release_notes_0_8_8b.php">
<p>Multiple security vulnerabilities have been fixed:</p>
<ul>
<li>SQL injection vulnerabilities</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1434</cvename>
<cvename>CVE-2013-1435</cvename>
<url>http://www.cacti.net/release_notes_0_8_8b.php</url>
</references>
<dates>
<discovery>2013-08-06</discovery>
<entry>2013-08-29</entry>
</dates>
</vuln>
<vuln vid="fd2bf3b5-1001-11e3-ba94-0025905a4771">
<topic>asterisk -- multiple vulnerabilities</topic>
<affects>
<package>
<name>asterisk11</name>
<range><gt>11.*</gt><lt>11.5.1</lt></range>
</package>
<package>
<name>asterisk10</name>
<range><gt>10.*</gt><lt>10.12.3</lt></range>
</package>
<package>
<name>asterisk18</name>
<range><gt>1.8.*</gt><lt>1.8.21.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/security">
<p>Remote Crash From Late Arriving SIP ACK With SDP</p>
<p>Remote Crash when Invalid SDP is sent in SIP Request</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-5641</cvename>
<cvename>CVE-2013-5642</cvename>
<url>http://downloads.asterisk.org/pub/security/AST-2013-004.html</url>
<url>http://downloads.asterisk.org/pub/security/AST-2013-005.html</url>
<url>https://www.asterisk.org/security</url>
</references>
<dates>
<discovery>2013-08-27</discovery>
<entry>2013-08-28</entry>
<modified>2013-08-29</modified>
</dates>
</vuln>
<vuln vid="ae651a4b-0a42-11e3-ba52-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>29.0.1547.57</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/">
<p>25 security fixes in this release, including:</p>
<ul>
<li>[181617] High CVE-2013-2900: Incomplete path sanitization in
file handling. Credit to Krystian Bigaj.</li>
<li> [254159] Low CVE-2013-2905: Information leak via overly broad
permissions on shared memory files. Credit to Christian
Jaeger.</li>
<li>[257363] High CVE-2013-2901: Integer overflow in ANGLE. Credit
to Alex Chapman.</li>
<li>[260105] High CVE-2013-2902: Use after free in XSLT. Credit to
cloudfuzzer.</li>
<li>[260156] High CVE-2013-2903: Use after free in media element.
Credit to cloudfuzzer.</li>
<li>[260428] High CVE-2013-2904: Use after free in document
parsing. Credit to cloudfuzzer.</li>
<li>[274602] CVE-2013-2887: Various fixes from internal audits,
fuzzing and other initiatives (Chrome 29).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2887</cvename>
<cvename>CVE-2013-2900</cvename>
<cvename>CVE-2013-2901</cvename>
<cvename>CVE-2013-2902</cvename>
<cvename>CVE-2013-2903</cvename>
<cvename>CVE-2013-2904</cvename>
<cvename>CVE-2013-2905</cvename>
<url>http://googlechromereleases.blogspot.nl/</url>
</references>
<dates>
<discovery>2013-08-20</discovery>
<entry>2013-08-21</entry>
</dates>
</vuln>
<vuln vid="4d087b35-0990-11e3-a9f4-bcaec565249c">
<topic>gstreamer-ffmpeg -- Multiple vulnerabilities in bundled libav</topic>
<affects>
<package>
<name>gstreamer-ffmpeg</name>
<range><lt>0.10.13_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="http://libav.org/releases/libav-0.7.7.changelog">
<p>Bundled version of libav in gstreamer-ffmpeg contains a number of
vulnerabilities.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3892</cvename>
<cvename>CVE-2011-3893</cvename>
<cvename>CVE-2011-3895</cvename>
<cvename>CVE-2011-3929</cvename>
<cvename>CVE-2011-3936</cvename>
<cvename>CVE-2011-3937</cvename>
<cvename>CVE-2011-3940</cvename>
<cvename>CVE-2011-3945</cvename>
<cvename>CVE-2011-3947</cvename>
<cvename>CVE-2011-3951</cvename>
<cvename>CVE-2011-3952</cvename>
<cvename>CVE-2011-4031</cvename>
<cvename>CVE-2011-4351</cvename>
<cvename>CVE-2011-4352</cvename>
<cvename>CVE-2011-4353</cvename>
<cvename>CVE-2011-4364</cvename>
<cvename>CVE-2011-4579</cvename>
<cvename>CVE-2012-0848</cvename>
<cvename>CVE-2012-0850</cvename>
<cvename>CVE-2012-0851</cvename>
<cvename>CVE-2012-0852</cvename>
<cvename>CVE-2012-0853</cvename>
<cvename>CVE-2012-0858</cvename>
<cvename>CVE-2012-0947</cvename>
<cvename>CVE-2012-2772</cvename>
<cvename>CVE-2012-2775</cvename>
<cvename>CVE-2012-2777</cvename>
<cvename>CVE-2012-2779</cvename>
<cvename>CVE-2012-2783</cvename>
<cvename>CVE-2012-2784</cvename>
<cvename>CVE-2012-2786</cvename>
<cvename>CVE-2012-2787</cvename>
<cvename>CVE-2012-2788</cvename>
<cvename>CVE-2012-2790</cvename>
<cvename>CVE-2012-2791</cvename>
<cvename>CVE-2012-2793</cvename>
<cvename>CVE-2012-2794</cvename>
<cvename>CVE-2012-2798</cvename>
<cvename>CVE-2012-2800</cvename>
<cvename>CVE-2012-2801</cvename>
<cvename>CVE-2012-2803</cvename>
<cvename>CVE-2012-5144</cvename>
<url>http://libav.org/releases/libav-0.7.7.changelog</url>
</references>
<dates>
<discovery>2013-08-20</discovery>
<entry>2013-08-20</entry>
</dates>
</vuln>
<vuln vid="689c2bf7-0701-11e3-9a25-002590860428">
<topic>GnuPG and Libgcrypt -- side-channel attack vulnerability</topic>
<affects>
<package>
<name>libgcrypt</name>
<range><lt>1.5.3</lt></range>
</package>
<package>
<name>linux-f10-libgcrypt</name>
<range><lt>1.5.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Werner Koch of the GNU project reports:</p>
<blockquote cite="http://lists.gnupg.org/pipermail/gnupg-announce/2013q3/000329.html">
<p>Noteworthy changes in version 1.5.3:</p>
<p>Mitigate the Yarom/Falkner flush+reload side-channel attack on RSA secret keys...</p>
<p>Note that Libgcrypt is used by GnuPG 2.x and thus this release fixes the above
problem. The fix for GnuPG less than 2.0 can be found in the just released GnuPG
1.4.14.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4242</cvename>
<url>http://eprint.iacr.org/2013/448</url>
<url>http://lists.gnupg.org/pipermail/gnupg-announce/2013q3/000329.html</url>
<url>http://lists.gnupg.org/pipermail/gnupg-announce/2013q3/000330.html</url>
</references>
<dates>
<discovery>2013-07-18</discovery>
<entry>2013-08-17</entry>
</dates>
</vuln>
<vuln vid="2b2f6092-0694-11e3-9e8e-000c29f6ae42">
<topic>puppet -- multiple vulnerabilities</topic>
<affects>
<package>
<name>puppet</name>
<range><ge>2.7</ge><lt>2.7.23</lt></range>
<range><ge>3.0</ge><lt>3.2.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Puppet Labs reports:</p>
<blockquote cite="http://puppetlabs.com/security/cve/cve-2013-4761/">
<p>By using the `resource_type` service, an attacker could
cause puppet to load arbitrary Ruby files from the puppet
master node's file system. While this behavior is not
enabled by default, `auth.conf` settings could be modified
to allow it. The exploit requires local file system access
to the Puppet Master.</p>
<p>Puppet Module Tool (PMT) did not correctly control
permissions of modules it installed, instead transferring
permissions that existed when the module was built.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4761</cvename>
<cvename>CVE-2013-4956</cvename>
<url>http://puppetlabs.com/security/cve/cve-2013-4761/</url>
<url>http://puppetlabs.com/security/cve/cve-2013-4956/</url>
</references>
<dates>
<discovery>2013-07-05</discovery>
<entry>2013-08-16</entry>
</dates>
</vuln>
<vuln vid="9a0a892e-05d8-11e3-ba09-000c29784fd1">
<topic>lcms2 -- Null Pointer Dereference Denial of Service Vulnerability</topic>
<affects>
<package>
<name>lcms2</name>
<range><lt>2.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mageia security team reports:</p>
<blockquote cite="http://advisories.mageia.org/MGASA-2013-0240.html">
<p>It was discovered that Little CMS did not properly verify certain
memory allocations. If a user or automated system using Little CMS
were tricked into opening a specially crafted file, an attacker
could cause Little CMS to crash (CVE-2013-4160).
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4160</cvename>
<url>http://advisories.mageia.org/MGASA-2013-0240.html</url>
<url>https://bugs.mageia.org/show_bug.cgi?id=10816</url>
</references>
<dates>
<discovery>2013-07-22</discovery>
<entry>2013-08-15</entry>
<modified>2013-08-19</modified>
</dates>
</vuln>
<vuln vid="72bf9e21-03df-11e3-bd8d-080027ef73ec">
<topic>polarssl -- denial of service vulnerability</topic>
<affects>
<package>
<name>polarssl</name>
<range><lt>1.2.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Paul Bakker reports:</p>
<blockquote cite="https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2013-03">
<p>A bug in the logic of the parsing of PEM encoded certificates in
x509parse_crt() can result in an infinite loop, thus hogging processing
power.</p>
<p>While parsing a Certificate message during the SSL/TLS handshake,
PolarSSL extracts the presented certificates and sends them on to
be parsed. As the RFC specifies that the certificates in the
Certificate message are always X.509 certificates in DER format,
bugs in the decoding of PEM certificates should normally not be
triggerable via the SSL/TLS handshake.</p>
<p>Versions of PolarSSL prior to 1.1.7 in the 1.1 branch and prior
to 1.2.8 in the 1.2 branch call the generic x509parse_crt()
function for parsing during the handshake. x509parse_crt() is a
generic functions that wraps parsing of both PEM-encoded and
DER-formatted certificates. As a result it is possible to craft
a Certificate message that includes a PEM encoded certificate in
the Certificate message that triggers the infinite loop.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4623</cvename>
<url>https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2013-03</url>
</references>
<dates>
<discovery>2013-06-21</discovery>
<entry>2013-08-13</entry>
<modified>2013-08-15</modified>
</dates>
</vuln>
<vuln vid="e21c7c7a-0116-11e3-9e83-3c970e169bc2">
<topic>samba -- denial of service vulnerability</topic>
<affects>
<package>
<name>samba34</name>
<range><gt>0</gt></range>
</package>
<package>
<name>samba35</name>
<range><gt>0</gt></range>
</package>
<package>
<name>samba36</name>
<range><gt>3.6.*</gt><lt>3.6.17</lt></range>
</package>
<package>
<name>samba4</name>
<range><gt>4.0.*</gt><lt>4.0.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Samba project reports:</p>
<blockquote cite="http://www.samba.org/samba/security/CVE-2013-4124">
<p>All current released versions of Samba are vulnerable to
a denial of service on an authenticated or guest connection.
A malformed packet can cause the smbd server to loop the CPU
performing memory allocations and preventing any further service.</p>
<p>A connection to a file share, or a local account is needed
to exploit this problem, either authenticated or unauthenticated
if guest connections are allowed.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4124</cvename>
<url>http://www.samba.org/samba/security/CVE-2013-4124</url>
</references>
<dates>
<discovery>2013-08-05</discovery>
<entry>2013-08-09</entry>
<modified>2013-08-09</modified>
</dates>
</vuln>
<vuln vid="0998e79d-0055-11e3-905b-0025905a4771">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>18.0,1</gt><lt>23.0,1</lt></range>
<range><lt>17.0.8,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>17.0.8,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.20</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>17.0.8</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.20</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><gt>11.0</gt><lt>17.0.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2013-63 Miscellaneous memory safety hazards (rv:23.0 /
rv:17.0.8)</p>
<p>MFSA 2013-64 Use after free mutating DOM during SetBody</p>
<p>MFSA 2013-65 Buffer underflow when generating CRMF requests</p>
<p>MFSA 2013-66 Buffer overflow in Mozilla Maintenance Service and
Mozilla Updater</p>
<p>MFSA 2013-67 Crash during WAV audio file decoding</p>
<p>MFSA 2013-68 Document URI misrepresentation and masquerading</p>
<p>MFSA 2013-69 CRMF requests allow for code execution and XSS
attacks</p>
<p>MFSA 2013-70 Bypass of XrayWrappers using XBL Scopes</p>
<p>MFSA 2013-71 Further Privilege escalation through Mozilla Updater</p>
<p>MFSA 2013-72 Wrong principal used for validating URI for some
Javascript components</p>
<p>MFSA 2013-73 Same-origin bypass with web workers and
XMLHttpRequest</p>
<p>MFSA 2013-74 Firefox full and stub installer DLL hijacking</p>
<p>MFSA 2013-75 Local Java applets may read contents of local file
system</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1701</cvename>
<cvename>CVE-2013-1702</cvename>
<cvename>CVE-2013-1704</cvename>
<cvename>CVE-2013-1705</cvename>
<cvename>CVE-2013-1706</cvename>
<cvename>CVE-2013-1707</cvename>
<cvename>CVE-2013-1708</cvename>
<cvename>CVE-2013-1709</cvename>
<cvename>CVE-2013-1710</cvename>
<cvename>CVE-2013-1711</cvename>
<cvename>CVE-2013-1712</cvename>
<cvename>CVE-2013-1713</cvename>
<cvename>CVE-2013-1714</cvename>
<cvename>CVE-2013-1715</cvename>
<cvename>CVE-2013-1717</cvename>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-63.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-64.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-65.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-66.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-67.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-68.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-69.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-70.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-71.html</url>
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-72.html</url>
<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
</references>
<dates>
<discovery>2013-08-06</discovery>
<entry>2013-08-08</entry>
</dates>
</vuln>
<vuln vid="4b448a96-ff73-11e2-b28d-080027ef73ec">
<topic>PuTTY -- Four security holes in versions before 0.63</topic>
<affects>
<package>
<name>putty</name>
<range><lt>0.63</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon Tatham reports:</p>
<blockquote cite="http://lists.tartarus.org/pipermail/putty-announce/2013/000018.html">
<p>This [0.63] release fixes multiple security holes in previous versions of
PuTTY, which can allow an SSH-2 server to make PuTTY overrun or
underrun buffers and crash. [...]
</p><p>
These vulnerabilities can be triggered before host key verification,
which means that you are not even safe if you trust the server you
<em>think</em> you're connecting to, since it could be spoofed over the
network and the host key check would not detect this before the attack
could take place.
</p><p>
Additionally, when PuTTY authenticated with a user's private key, the
private key or information equivalent to it was accidentally kept in
PuTTY's memory for the rest of its run, where it could be retrieved by
other processes reading PuTTY's memory, or written out to swap files
or crash dumps. This release fixes that as well.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4206</cvename>
<cvename>CVE-2013-4207</cvename>
<cvename>CVE-2013-4208</cvename>
<cvename>CVE-2013-4852</cvename>
<mlist msgid="E1V6lUs-0007kP-40@atreus.tartarus.org">http://lists.tartarus.org/pipermail/putty-announce/2013/000018.html</mlist>
<url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-modmul.html</url>
<url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-bignum-division-by-zero.html</url>
<url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-wiped.html</url>
<url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-signature-stringlen.html</url>
</references>
<dates>
<discovery>2013-07-08</discovery>
<entry>2013-08-07</entry>
</dates>
</vuln>
<vuln vid="e6839625-fdfa-11e2-9430-20cf30e32f6d">
<topic>typo3 -- Multiple vulnerabilities in TYPO3 Core</topic>
<affects>
<package>
<name>typo3</name>
<range><ge>4.5.0</ge><lt>4.5.29</lt></range>
<range><ge>4.7.0</ge><lt>4.7.14</lt></range>
<range><ge>6.1.0</ge><lt>6.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Typo Security Team reports:</p>
<blockquote cite="http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-002/">
<p>It has been discovered that TYPO3 Core is vulnerable to
Cross-Site Scripting and Remote Code Execution.</p>
<p>TYPO3 bundles flash files for video and audio playback. Old
versions of FlowPlayer and flashmedia are susceptible to
Cross-Site Scripting. No authentication is required to exploit
this vulnerability.</p>
<p>The file upload component and the File Abstraction Layer are
failing to check for denied file extensions, which allows
authenticated editors (even with limited permissions) to
upload php files with arbitrary code, which can then be
executed in web server's context.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3642</cvename>
<cvename>CVE-2013-1464</cvename>
</references>
<dates>
<discovery>2013-07-30</discovery>
<entry>2013-08-05</entry>
</dates>
</vuln>
<vuln vid="17326fd5-fcfb-11e2-9bb9-6805ca0b3d42">
<topic>phpMyAdmin -- clickJacking protection can be bypassed</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><lt>4.0.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-10.php">
<p> phpMyAdmin has a number of mechanisms to avoid a
clickjacking attack, however these mechanisms either work
only in modern browser versions, or can be bypassed.</p>
<p>"We have no solution for 3.5.x, due to the proposed
solution requiring JavaScript. We don't want to introduce a
dependency to JavaScript in the 3.5.x family."</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2013-10.php</url>
</references>
<dates>
<discovery>2013-08-04</discovery>
<entry>2013-08-04</entry>
</dates>
</vuln>
<vuln vid="69098c5c-fc4b-11e2-8ad0-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>28.0.1500.95</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/">
<p>Eleven vulnerabilities, including:</p>
<p>[257748] Medium CVE-2013-2881: Origin bypass in frame handling.
Credit to Karthik Bhargavan.</p>
<p>[260106] High CVE-2013-2882: Type confusion in V8. Credit to
Cloudfuzzer.</p>
<p>[260165] High CVE-2013-2883: Use-after-free in MutationObserver.
Credit to Cloudfuzzer.</p>
<p>[248950] High CVE-2013-2884: Use-after-free in DOM. Credit to Ivan
Fratric of Google Security Team.</p>
<p>[249640] [257353] High CVE-2013-2885: Use-after-free in input
handling. Credit to Ivan Fratric of Google Security Team.</p>
<p>[261701] High CVE-2013-2886: Various fixes from internal audits,
fuzzing and other initiatives.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2881</cvename>
<cvename>CVE-2013-2882</cvename>
<cvename>CVE-2013-2883</cvename>
<cvename>CVE-2013-2884</cvename>
<cvename>CVE-2013-2885</cvename>
<cvename>CVE-2013-2886</cvename>
<url>http://www.googlechromereleases.blogspot.nl/</url>
</references>
<dates>
<discovery>2013-07-30</discovery>
<entry>2013-08-03</entry>
</dates>
</vuln>
<vuln vid="f4a0212f-f797-11e2-9bb9-6805ca0b3d42">
<topic>phpMyAdmin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>4.0</ge><lt>4.0.4.2</lt></range>
</package>
<package>
<name>phpMyAdmin35</name>
<range><ge>3.5</ge><lt>3.5.8.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-8.php">
<p>XSS due to unescaped HTML Output when executing a SQL query.</p>
<p>Using a crafted SQL query, it was possible to produce an
XSS on the SQL query form.</p>
<p>This vulnerability can be triggered only by someone who
logged in to phpMyAdmin, as the usual token protection
prevents non-logged-in users from accessing the required
form.</p>
</blockquote>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-9.php">
<p>5 XSS vulnerabilities in setup, chart display, process
list, and logo link.</p>
<ul>
<li>In the setup/index.php, using a crafted # hash with a
Javascript event, untrusted JS code could be
executed.</li>
<li>In the Display chart view, a chart title containing
HTML code was rendered unescaped, leading to possible
JavaScript code execution via events.</li>
<li>A malicious user with permission to create databases
or users having HTML tags in their name, could trigger an
XSS vulnerability by issuing a sleep query with a long
delay. In the server status monitor, the query parameters
were shown unescaped.</li>
<li>By configuring a malicious URL for the phpMyAdmin logo
link in the navigation sidebar, untrusted script code
could be executed when a user clicked the logo.</li>
<li>The setup field for "List of trusted proxies for IP
allow/deny" Ajax validation code returned the unescaped
input on errors, leading to possible JavaScript execution
by entering arbitrary HTML.</li>
</ul>
</blockquote>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-11.php">
<p>If a crafted version.json would be presented, an XSS
could be introduced.</p>
<p>Due to not properly validating the version.json file,
which is fetched from the phpMyAdmin.net website, could lead
to an XSS attack, if a crafted version.json file would be
presented.</p>
<p>This vulnerability can only be exploited with a
combination of complicated techniques and tricking the user
to visit a page.</p>
</blockquote>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-12.php">
<p>Full path disclosure vulnerabilities.</p>
<p>By calling some scripts that are part of phpMyAdmin in an
unexpected way, it is possible to trigger phpMyAdmin to
display a PHP error message which contains the full path of
the directory where phpMyAdmin is installed.</p>
<p>This path disclosure is possible on servers where the
recommended setting of the PHP configuration directive
display_errors is set to on, which is against the
recommendations given in the PHP manual.</p>
</blockquote>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-13.php">
<p> XSS vulnerability when a text to link transformation is
used.</p>
<p>When the TextLinkTransformationPlugin is used to create a
link to an object when displaying the contents of a table,
the object name is not properly escaped, which could lead to
an XSS, if the object name has a crafted value.</p>
<p>The stored XSS vulnerabilities can be triggered only by
someone who logged in to phpMyAdmin, as the usual token
protection prevents non-logged-in users from accessing the
required forms.</p>
</blockquote>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-14.php">
<p>Self-XSS due to unescaped HTML output in schema
export.</p>
<p>When calling schema_export.php with crafted parameters,
it is possible to trigger an XSS.</p>
<p>This vulnerability can be triggered only by someone who
logged in to phpMyAdmin, as the usual token protection
prevents non-logged-in users from accessing the required
form.</p>
</blockquote>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-15.php">
<p>SQL injection vulnerabilities, producing a privilege
escalation (control user).</p>
<p>Due to a missing validation of parameters passed to
schema_export.php and pmd_pdf.php, it was possible to inject
SQL statements that would run with the privileges of the
control user. This gives read and write access to the tables
of the configuration storage database, and if the control
user has the necessary privileges, read access to some
tables of the mysql database.</p>
<p>These vulnerabilities can be triggered only by someone
who logged in to phpMyAdmin, as the usual token protection
prevents non-logged-in users from accessing the required
form. Moreover, a control user must have been created and
configured as part of the phpMyAdmin configuration storage
installation.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2013-8.php</url>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2013-9.php</url>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2013-11.php</url>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2013-12.php</url>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2013-13.php</url>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2013-14.php</url>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2013-15.php</url>
<url>http://sourceforge.net/projects/phpmyadmin/files/phpMyAdmin/3.5.8.2/phpMyAdmin-3.5.8.2-notes.html/view</url>
<url>http://sourceforge.net/projects/phpmyadmin/files/phpMyAdmin/4.0.4.2/phpMyAdmin-4.0.4.2-notes.html/view</url>
</references>
<dates>
<discovery>2013-07-28</discovery>
<entry>2013-07-28</entry>
<modified>2013-07-29</modified>
</dates>
</vuln>
<vuln vid="049332d2-f6e1-11e2-82f3-000c29ee3065">
<topic>wordpress -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>3.5.2,1</lt></range>
</package>
<package>
<name>zh-wordpress-zh_CN</name>
<range><lt>3.5.2</lt></range>
</package>
<package>
<name>zh-wordpress-zh_TW</name>
<range><lt>3.5.2</lt></range>
</package>
<package>
<name>de-wordpress</name>
<range><lt>3.5.2</lt></range>
</package>
<package>
<name>ja-wordpress</name>
<range><lt>3.5.2</lt></range>
</package>
<package>
<name>ru-wordpress</name>
<range><lt>3.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The wordpress development team reports:</p>
<blockquote cite="https://wordpress.org/news/2013/06/wordpress-3-5-2/">
<ul>
<li>Blocking server-side request forgery attacks, which could
potentially enable an attacker to gain access to a site</li>
<li>Disallow contributors from improperly publishing posts</li>
<li>An update to the SWFUpload external library to fix cross-site
scripting vulnerabilities</li>
<li>Prevention of a denial of service attack, affecting sites
using password-protected posts</li>
<li>An update to an external TinyMCE library to fix a cross-site
scripting vulnerability</li>
<li>Multiple fixes for cross-site scripting</li>
<li>Avoid disclosing a full file path when a upload fails</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2199</cvename>
<cvename>CVE-2013-2200</cvename>
<cvename>CVE-2013-2201</cvename>
<cvename>CVE-2013-2202</cvename>
<cvename>CVE-2013-2203</cvename>
<cvename>CVE-2013-2204</cvename>
<cvename>CVE-2013-2205</cvename>
<url>https://wordpress.org/news/2013/06/wordpress-3-5-2/</url>
</references>
<dates>
<discovery>2013-06-21</discovery>
<entry>2013-07-27</entry>
<modified>2014-04-30</modified>
</dates>
</vuln>
<vuln vid="7943e521-f648-11e2-8607-3c970e169bc2">
<topic>bind -- denial of service vulnerability</topic>
<affects>
<package>
<name>bind99</name>
<range><gt>9.9.3</gt><lt>9.9.3.2</lt></range>
</package>
<package>
<name>bind99-base</name>
<range><gt>9.9.3</gt><lt>9.9.3.2</lt></range>
</package>
<package>
<name>bind98</name>
<range><gt>9.8.5</gt><lt>9.8.5.2</lt></range>
</package>
<package>
<name>bind98-base</name>
<range><gt>9.8.5</gt><lt>9.8.5.2</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><gt>9.0</gt><lt>9.1_5</lt></range>
<range><gt>8.4</gt><lt>8.4_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01015/0">
<p>A specially crafted query that includes malformed
rdata can cause named to terminate with an assertion
failure while rejecting the malformed query.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4854</cvename>
<freebsdsa>SA-13:07.bind</freebsdsa>
<url>https://kb.isc.org/article/AA-01015/0</url>
</references>
<dates>
<discovery>2013-07-26</discovery>
<entry>2013-07-26</entry>
<modified>2013-07-27</modified>
</dates>
</vuln>
<vuln vid="80771b89-f57b-11e2-bf21-b499baab0cbe">
<topic>gnupg -- side channel attack on RSA secret keys</topic>
<affects>
<package>
<name>gnupg</name>
<range><lt>1.4.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Yarom and Falkner paper reports:</p>
<blockquote cite="http://lists.gnupg.org/pipermail/gnupg-announce/2013q3/000330.html">
<p>Flush+Reload is a cache side-channel attack that monitors access to
data in shared pages. In this paper we demonstrate how to use the
attack to extract private encryption keys from GnuPG. The high
resolution and low noise of the Flush+Reload attack enables a spy
program to recover over 98% of the bits of the private key in a
single decryption or signing round. Unlike previous attacks, the
attack targets the last level L3 cache. Consequently, the spy
program and the victim do not need to share the execution core of
the CPU. The attack is not limited to a traditional OS and can be
used in a virtualised environment, where it can attack programs
executing in a different VM.</p>
</blockquote>
</body>
</description>
<references>
<url>http://eprint.iacr.org/2013/448</url>
<url>http://lists.gnupg.org/pipermail/gnupg-announce/2013q3/000330.html</url>
</references>
<dates>
<discovery>2013-07-18</discovery>
<entry>2013-07-25</entry>
<modified>2013-07-26</modified>
</dates>
</vuln>
<vuln vid="c4d412c8-f4d1-11e2-b86c-000c295229d5">
<topic>openafs -- single-DES cell-wide key brute force vulnerability</topic>
<affects>
<package>
<name>openafs</name>
<range><lt>1.6.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenAFS Project reports:</p>
<blockquote cite="http://openafs.org/pages/security/OPENAFS-SA-2013-003.txt">
<p>The small size of the DES key space permits an attacker to brute
force a cell's service key and then forge traffic from any user
within the cell. The key space search can be performed in under 1
day at a cost of around $100 using publicly available services.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4134</cvename>
<url>http://openafs.org/pages/security/OPENAFS-SA-2013-003.txt</url>
<url>http://openafs.org/pages/security/how-to-rekey.txt</url>
<url>http://openafs.org/pages/security/install-rxkad-k5-1.6.txt</url>
</references>
<dates>
<discovery>2013-07-24</discovery>
<entry>2013-07-25</entry>
</dates>
</vuln>
<vuln vid="2ae24334-f2e6-11e2-8346-001e8c75030d">
<topic>subversion -- remotely triggerable "Assertion failed" DoS vulnerability or read overflow.</topic>
<affects>
<package>
<name>subversion</name>
<range><ge>1.8.0</ge><lt>1.8.1</lt></range>
<range><ge>1.7.0</ge><lt>1.7.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Subversion Project reports:</p>
<blockquote cite="http://subversion.apache.org/security/CVE-2013-4131-advisory.txt">
<p>Subversion's mod_dav_svn Apache HTTPD server module will trigger an assertion
on some requests made against a revision root. This can lead to a DoS.
If assertions are disabled it will trigger a read overflow which may cause a
SEGFAULT (or equivalent) or undefined behavior.</p>
<p>Commit access is required to exploit this.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4131</cvename>
<url>http://subversion.apache.org/security/CVE-2013-4131-advisory.txt</url>
</references>
<dates>
<discovery>2013-07-19</discovery>
<entry>2013-07-24</entry>
<modified>2013-07-25</modified>
</dates>
</vuln>
<vuln vid="2fbfd455-f2d0-11e2-8a46-000d601460a4">
<topic>suPHP -- Privilege escalation</topic>
<affects>
<package>
<name>suphp</name>
<range><lt>0.7.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>suPHP developer Sebastian Marsching reports:</p>
<blockquote cite="https://lists.marsching.com/pipermail/suphp/2013-May/002552.html">
<p>When the suPHP_PHPPath was set, mod_suphp would use the specified PHP
executable to pretty-print PHP source files (MIME type
x-httpd-php-source or application/x-httpd-php-source).</p>
<p>However, it would not sanitize the environment. Thus a user that was
allowed to use the SetEnv directive in a .htaccess file (AllowOverride
FileInfo) could make PHP load a malicious configuration file (e.g.
loading malicious extensions).</p>
<p>As the PHP process for highlighting the source file was run with the
privileges of the user Apache HTTPd was running as, a local attacker
could probably execute arbitrary code with the privileges of this user.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.marsching.com/pipermail/suphp/2013-May/002552.html</url>
</references>
<dates>
<discovery>2013-05-20</discovery>
<entry>2013-07-22</entry>
</dates>
</vuln>
<vuln vid="ca4d63fb-f15c-11e2-b183-20cf30e32f6d">
<topic>apache24 -- several vulnerabilities</topic>
<affects>
<package>
<name>apache24</name>
<range><lt>2.4.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache HTTP SERVER PROJECT reports:</p>
<blockquote cite="http://www.apache.org/dist/httpd/Announcement2.4.html">
<p>mod_dav: Sending a MERGE request against a URI handled by mod_dav_svn
with the source href (sent as part of the request body as XML) pointing
to a URI that is not configured for DAV will trigger a segfault.</p>
<p>mod_session_dbd: Make sure that dirty flag is respected when saving
sessions, and ensure the session ID is changed each time the session
changes. This changes the format of the updatesession SQL statement.
Existing configurations must be changed.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1896</cvename>
<cvename>CVE-2013-2249</cvename>
<url>http://www.apache.org/dist/httpd/Announcement2.4.html</url>
</references>
<dates>
<discovery>2013-07-11</discovery>
<entry>2013-07-20</entry>
<modified>2013-07-21</modified>
</dates>
</vuln>
<vuln vid="9b037a0d-ef2c-11e2-b4a0-8c705af55518">
<topic>gallery -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gallery3</name>
<range><lt>3.0.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Red Hat Security Response Team reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2013/07/04/7">
<p>Gallery upstream has released 3.0.9 version, correcting two
security flaws:</p>
<p>Issue #1 - Improper stripping of URL fragments in flowplayer
SWF file might lead to reply attacks (a different flaw than
CVE-2013-2138).</p>
<p>Issue #2 - gallery3: Multiple information exposure flaws in
data rest core module.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2240</cvename>
<cvename>CVE-2013-2241</cvename>
<url>http://sourceforge.net/apps/trac/gallery/ticket/2073</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=981197</url>
<url>http://sourceforge.net/apps/trac/gallery/ticket/2074</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=981198</url>
<url>http://galleryproject.org/gallery_3_0_9</url>
</references>
<dates>
<discovery>2013-06-28</discovery>
<entry>2013-07-17</entry>
</dates>
</vuln>
<vuln vid="31b145f2-d9d3-49a9-8023-11cf742205dc">
<topic>PHP5 -- Heap corruption in XML parser</topic>
<affects>
<package>
<name>php53</name>
<range><lt>5.3.27</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP development team reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4113">
<p>ext/xml/xml.c in PHP before 5.3.27 does not properly
consider parsing depth, which allows remote attackers to
cause a denial of service (heap memory corruption) or
possibly have unspecified other impact via a crafted
document that is processed by the xml_parse_into_struct
function.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4113</cvename>
<url>https://bugs.php.net/bug.php?id=65236</url>
</references>
<dates>
<discovery>2013-07-10</discovery>
<entry>2013-07-16</entry>
</dates>
</vuln>
<vuln vid="5def3175-f3f9-4476-ba40-b46627cc638c">
<topic>PHP5 -- Integer overflow in Calendar module</topic>
<affects>
<package>
<name>php5</name>
<range><ge>5.4.0</ge><lt>5.4.16</lt></range>
</package>
<package>
<name>php53</name>
<range><lt>5.3.26</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP development team reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4635">
<p>Integer overflow in the SdnToJewish function in jewish.c
in the Calendar component in PHP before 5.3.26 and 5.4.x
before 5.4.16 allows context-dependent attackers to cause a
denial of service (application hang) via a large argument to
the jdtojewish function.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4635</cvename>
<url>https://bugs.php.net/bug.php?id=64895</url>
</references>
<dates>
<discovery>2013-05-22</discovery>
<entry>2013-07-16</entry>
</dates>
</vuln>
<vuln vid="df428c01-ed91-11e2-9466-98fc11cdc4f5">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.297</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb13-17.html">
<p>These updates address vulnerabilities that could cause a crash
and potentially allow an attacker to take control of the affected system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-3344</cvename>
<cvename>CVE-2013-3345</cvename>
<cvename>CVE-2013-3347</cvename>
<url>http://www.adobe.com/support/security/bulletins/apsb13-17.html</url>
</references>
<dates>
<discovery>2013-07-09</discovery>
<entry>2013-07-15</entry>
<modified>2013-07-18</modified>
</dates>
</vuln>
<vuln vid="30a04ab4-ed7b-11e2-8643-8c705af55518">
<topic>squid -- denial of service</topic>
<affects>
<package>
<name>squid</name>
<range><ge>3.2</ge><lt>3.2.12</lt></range>
<range><ge>3.3</ge><lt>3.3.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Squid project reports:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2013_3.txt">
<p>Due to incorrect data validation Squid is vulnerable to a
denial of service attack when processing specially crafted
HTTP requests</p>
<p>This problem allows any client who can generate HTTP requests
to perform a denial of service attack on the Squid service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4123</cvename>
<url>http://www.squid-cache.org/Advisories/SQUID-2013_3.txt</url>
</references>
<dates>
<discovery>2013-07-13</discovery>
<entry>2013-07-15</entry>
</dates>
</vuln>
<vuln vid="04320e7d-ea66-11e2-a96e-60a44c524f57">
<topic>libzrtpcpp -- multiple security vulnerabilities</topic>
<affects>
<package>
<name>libzrtpcpp</name>
<range><lt>2.3.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mark Dowd reports:</p>
<blockquote cite="http://blog.azimuthsecurity.com/2013/06/attacking-crypto-phones-weaknesses-in.html">
<p>Vulnerability 1. Remote Heap Overflow: If an attacker sends a
packet larger than 1024 bytes that gets stored temporarily (which
occurs many times - such as when sending a ZRTP Hello packet), a
heap overflow will occur, leading to potential arbitrary code
execution on the vulnerable host.</p>
<p>Vulnerability 2. Multiple Stack Overflows: ZRTPCPP contains
multiple stack overflows that arise when preparing a response
to a client's ZRTP Hello packet.</p>
<p>Vulnerability 3. Information Leaking / Out of Bounds Reads:
The ZRTPCPP library performs very little validation regarding the
expected size of a packet versus the actual amount of data
received. This can lead to both information leaking and out
of bounds data reads (usually resulting in a crash).
Information leaking can be performed for example by sending
a malformed ZRTP Ping packet.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2221</cvename>
<cvename>CVE-2013-2222</cvename>
<cvename>CVE-2013-2223</cvename>
</references>
<dates>
<discovery>2013-06-27</discovery>
<entry>2013-07-11</entry>
</dates>
</vuln>
<vuln vid="ebd877b9-7ef4-4375-b1fd-c67780581898">
<topic>ruby -- Hostname check bypassing vulnerability in SSL client</topic>
<affects>
<package>
<name>ruby19</name>
<range><lt>1.9.3.448,1</lt></range>
</package>
<package>
<name>ruby18</name>
<range><lt>1.8.7.374,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby Developers report:</p>
<blockquote cite="http://www.ruby-lang.org/en/news/2013/06/27/hostname-check-bypassing-vulnerability-in-openssl-client-cve-2013-4073/">
<p>Ruby's SSL client implements hostname identity check but it does
not properly handle hostnames in the certificate that contain null
bytes.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4073</cvename>
<url>http://www.ruby-lang.org/en/news/2013/06/27/hostname-check-bypassing-vulnerability-in-openssl-client-cve-2013-4073/</url>
</references>
<dates>
<discovery>2013-06-27</discovery>
<entry>2013-07-11</entry>
<modified>2013-09-24</modified>
</dates>
</vuln>
<vuln vid="e3e788aa-e9fd-11e2-a96e-60a44c524f57">
<topic>otrs -- Sql Injection + Xss Issue</topic>
<affects>
<package>
<name>otrs</name>
<range><lt>3.2.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OTRS Project reports:</p>
<blockquote cite="http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-05/">
<p>An attacker with a valid agent login could manipulate URLs leading to SQL injection. An attacker with a valid agent login could manipulate URLs in the ITSM ConfigItem search, leading to a JavaScript code injection (XSS) problem.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4717</cvename>
<cvename>CVE-2013-4718</cvename>
<url>http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-05/</url>
</references>
<dates>
<discovery>2013-07-09</discovery>
<entry>2013-07-11</entry>
</dates>
</vuln>
<vuln vid="3b80104f-e96c-11e2-8bac-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>28.0.1500.71</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/">
<p>A special reward for Andrey Labunets for his combination of
CVE-2013-2879 and CVE-2013-2868 along with some (since fixed)
server-side bugs.</p>
<p>[252216] Low CVE-2013-2867: Block pop-unders in various
scenarios.</p>
<p>[252062] High CVE-2013-2879: Confusion setting up sign-in and sync.
Credit to Andrey Labunets.</p>
<p>[252034] Medium CVE-2013-2868: Incorrect sync of NPAPI extension
component. Credit to Andrey Labunets.</p>
<p>[245153] Medium CVE-2013-2869: Out-of-bounds read in JPEG2000
handling. Credit to Felix Groebert of Google Security Team.</p>
<p>[244746] [242762] Critical CVE-2013-2870: Use-after-free with
network sockets. Credit to Collin Payne.</p>
<p>[244260] Medium CVE-2013-2853: Man-in-the-middle attack against
HTTP in SSL. Credit to Antoine Delignat-Lavaud and Karthikeyan
Bhargavan from Prosecco at INRIA Paris.</p>
<p>[243991] [243818] High CVE-2013-2871: Use-after-free in input
handling. Credit to miaubiz.</p>
<p>[Mac only] [242702] Low CVE-2013-2872: Possible lack of entropy in
renderers. Credit to Eric Rescorla.</p>
<p>[241139] High CVE-2013-2873: Use-after-free in resource loading.
Credit to miaubiz.</p>
<p>[233848] Medium CVE-2013-2875: Out-of-bounds-read in SVG. Credit
to miaubiz.</p>
<p>[229504] Medium CVE-2013-2876: Extensions permissions confusion
with interstitials. Credit to Dev Akhawe.</p>
<p>[229019] Low CVE-2013-2877: Out-of-bounds read in XML parsing.
Credit to Aki Helin of OUSPG.</p>
<p>[196636] None: Remove the "viewsource" attribute on iframes.
Credit to Collin Jackson.</p>
<p>[177197] Medium CVE-2013-2878: Out-of-bounds read in text
handling. Credit to Atte Kettunen of OUSPG.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2853</cvename>
<cvename>CVE-2013-2867</cvename>
<cvename>CVE-2013-2868</cvename>
<cvename>CVE-2013-2869</cvename>
<cvename>CVE-2013-2870</cvename>
<cvename>CVE-2013-2871</cvename>
<cvename>CVE-2013-2872</cvename>
<cvename>CVE-2013-2873</cvename>
<cvename>CVE-2013-2875</cvename>
<cvename>CVE-2013-2876</cvename>
<cvename>CVE-2013-2877</cvename>
<cvename>CVE-2013-2878</cvename>
<cvename>CVE-2013-2879</cvename>
<url>http://googlechromereleases.blogspot.nl/</url>
</references>
<dates>
<discovery>2013-07-09</discovery>
<entry>2013-07-10</entry>
</dates>
</vuln>
<vuln vid="f3d24aee-e5ad-11e2-b183-20cf30e32f6d">
<topic>apache22 -- several vulnerabilities</topic>
<affects>
<package>
<name>apache22</name>
<range><gt>2.2.0</gt><lt>2.2.25</lt></range>
</package>
<package>
<name>apache22-event-mpm</name>
<range><gt>2.2.0</gt><lt>2.2.25</lt></range>
</package>
<package>
<name>apache22-itk-mpm</name>
<range><gt>2.2.0</gt><lt>2.2.25</lt></range>
</package>
<package>
<name>apache22-peruser-mpm</name>
<range><gt>2.2.0</gt><lt>2.2.25</lt></range>
</package>
<package>
<name>apache22-worker-mpm</name>
<range><gt>2.2.0</gt><lt>2.2.25</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Apache HTTP SERVER PROJECT reports:</h1>
<blockquote cite="http://www.apache.org/dist/httpd/CHANGES_2.2.25">
<p>The mod_rewrite module in the Apache HTTP Server 2.2.x before
2.2.25 writes data to a log file without sanitizing
non-printable characters, which might allow remote attackers to
execute arbitrary commands via an HTTP request containing an
escape sequence for a terminal emulator.</p>
<p>mod_dav: Sending a MERGE request against a URI handled by
mod_dav_svn with the source href (sent as part of the request
body as XML) pointing to a URI that is not configured for DAV
will trigger a segfault.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1862</cvename>
<cvename>CVE-2013-1896</cvename>
</references>
<dates>
<discovery>2013-06-21</discovery>
<entry>2013-07-05</entry>
<modified>2013-07-10</modified>
</dates>
</vuln>
<vuln vid="1b93f6fe-e1c1-11e2-948d-6805ca0b3d42">
<topic>phpMyAdmin -- Global variable scope injection</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>4.0</ge><lt>4.0.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-7.php">
<p>The import.php script was vulnerable to GLOBALS variable
injection. Therefore, an attacker could manipulate any
configuration parameter.</p>
<p>This vulnerability can be triggered only by someone who
logged in to phpMyAdmin, as the usual token protection
prevents non-logged-in users from accessing the required
form.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2013-7.php</url>
<cvename>CVE-2013-4729</cvename>
</references>
<dates>
<discovery>2013-06-30</discovery>
<entry>2013-06-30</entry>
</dates>
</vuln>
<vuln vid="81da673e-dfe1-11e2-9389-08002798f6ff">
<topic>apache-xml-security-c -- heap overflow during XPointer evaluation</topic>
<affects>
<package>
<name>apache-xml-security-c</name>
<range><lt>1.7.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Software Foundation reports:</p>
<blockquote cite="http://santuario.apache.org/secadv.data/CVE-2013-2210.txt">
<p>The attempted fix to address CVE-2013-2154 introduced the
possibility of a heap overflow, possibly leading to arbitrary code
execution, in the processing of malformed XPointer expressions in the
XML Signature Reference processing code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2210</cvename>
<url>http://santuario.apache.org/secadv.data/CVE-2013-2210.txt</url>
</references>
<dates>
<discovery>2013-06-27</discovery>
<entry>2013-06-28</entry>
</dates>
</vuln>
<vuln vid="b3fcb387-de4b-11e2-b1c6-0025905a4771">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>18.0,1</gt><lt>22.0,1</lt></range>
<range><lt>17.0.7,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>17.0.7,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.19</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>17.0.7</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.19</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><gt>11.0</gt><lt>17.0.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>Miscellaneous memory safety hazards (rv:22.0 / rv:17.0.7)</p>
<p>Title: Memory corruption found using Address Sanitizer</p>
<p>Privileged content access and execution via XBL</p>
<p>Arbitrary code execution within Profiler</p>
<p>Execution of unmapped memory through onreadystatechange</p>
<p>Data in the body of XHR HEAD requests leads to CSRF attacks</p>
<p>SVG filters can lead to information disclosure</p>
<p>PreserveWrapper has inconsistent behavior</p>
<p>Sandbox restrictions not applied to nested frame elements</p>
<p>X-Frame-Options ignored when using server push with multi-part
responses</p>
<p>XrayWrappers can be bypassed to run user defined methods in a
privileged context</p>
<p>getUserMedia permission dialog incorrectly displays location</p>
<p>Homograph domain spoofing in .com, .net and .name</p>
<p>Inaccessible updater can lead to local privilege escalation</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1682</cvename>
<cvename>CVE-2013-1683</cvename>
<cvename>CVE-2013-1684</cvename>
<cvename>CVE-2013-1685</cvename>
<cvename>CVE-2013-1686</cvename>
<cvename>CVE-2013-1687</cvename>
<cvename>CVE-2013-1688</cvename>
<cvename>CVE-2013-1690</cvename>
<cvename>CVE-2013-1692</cvename>
<cvename>CVE-2013-1693</cvename>
<cvename>CVE-2013-1694</cvename>
<cvename>CVE-2013-1695</cvename>
<cvename>CVE-2013-1696</cvename>
<cvename>CVE-2013-1697</cvename>
<cvename>CVE-2013-1698</cvename>
<cvename>CVE-2013-1699</cvename>
<cvename>CVE-2013-1700</cvename>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-49.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-50.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-51.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-52.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-53.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-54.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-55.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-56.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-57.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-58.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-59.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-60.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-61.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-62.html</url>
<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
</references>
<dates>
<discovery>2013-06-25</discovery>
<entry>2013-06-26</entry>
</dates>
</vuln>
<vuln vid="01cf67b3-dc3b-11e2-a6cd-c48508086173">
<topic>cURL library -- heap corruption in curl_easy_unescape</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.7</ge><lt>7.24.0_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cURL developers report:</p>
<blockquote cite="http://curl.haxx.se/docs/adv_20130622.html">
<p>libcurl is vulnerable to a case of bad checking of the
input data which may lead to heap corruption.</p>
<p>The function curl_easy_unescape() decodes URL-encoded
strings to raw binary data. URL-encoded octets are
represented with %HH combinations where HH is a two-digit
hexadecimal number. The decoded string is written to an
allocated memory area that the function returns to the
caller.</p>
<p>The function takes a source string and a length
parameter, and if the length provided is 0 the function will
instead use strlen() to figure out how much data to
parse.</p>
<p>The "%HH" parser wrongly only considered the case where a
zero byte would terminate the input. If a length-limited
buffer was passed in which ended with a '%' character which
was followed by two hexadecimal digits outside of the buffer
libcurl was allowed to parse alas without a terminating
zero, libcurl would still parse that sequence as well. The
counter for remaining data to handle would then be decreased
too much and wrap to become a very large integer and the
copying would go on too long and the destination buffer that
is allocated on the heap would get overwritten.</p>
<p>We consider it unlikely that programs allow user-provided
strings unfiltered into this function. Also, only the not
zero-terminated input string use case is affected by this
flaw. Exploiting this flaw for gain is probably possible for
specific circumstances but we consider the general risk for
this to be low.</p>
<p>The curl command line tool is not affected by this
problem as it doesn't use this function.</p>
<p>There are no known exploits available at this time.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2174</cvename>
<url>http://curl.haxx.se/docs/adv_20130622.html</url>
</references>
<dates>
<discovery>2013-06-22</discovery>
<entry>2013-06-23</entry>
<modified>2013-07-01</modified>
</dates>
</vuln>
<vuln vid="b162b218-c547-4ba2-ae31-6fdcb61bc763">
<topic>puppet -- Unauthenticated Remote Code Execution Vulnerability</topic>
<affects>
<package>
<name>puppet</name>
<range><ge>2.7</ge><lt>2.7.22</lt></range>
<range><ge>3.0</ge><lt>3.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Puppet Developers report:</p>
<blockquote cite="http://puppetlabs.com/security/cve/cve-2013-3567/">
<p>When making REST api calls, the puppet master takes YAML from an
untrusted client, deserializes it, and then calls methods on the
resulting object. A YAML payload can be crafted to cause the
deserialization to construct an instance of any class available in
the ruby process, which allows an attacker to execute code
contained in the payload.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-3567</cvename>
</references>
<dates>
<discovery>2013-06-13</discovery>
<entry>2013-06-22</entry>
<modified>2013-08-01</modified>
</dates>
</vuln>
<vuln vid="8b97d289-d8cf-11e2-a1f5-60a44c524f57">
<topic>otrs -- information disclosure</topic>
<affects>
<package>
<name>otrs</name>
<range><lt>3.2.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OTRS Project reports:</p>
<blockquote cite="http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-04/">
<p>An attacker with a valid agent login could manipulate URLs in the ticket
watch mechanism to see contents of tickets they are not permitted to see.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4088</cvename>
<url>http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-04/</url>
</references>
<dates>
<discovery>2013-06-18</discovery>
<entry>2013-06-19</entry>
</dates>
</vuln>
<vuln vid="abef280d-d829-11e2-b71c-8c705af55518">
<topic>FreeBSD -- Privilege escalation via mmap</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><gt>9.0</gt><lt>9.1_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="http://www.freebsd.org/security/advisories/FreeBSD-SA-13%3a06.mmap.asc">
<p>Due to insufficient permission checks in the virtual memory
system, a tracing process (such as a debugger) may be able to
modify portions of the traced process's address space to which
the traced process itself does not have write access.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2171</cvename>
<freebsdsa>SA-13:06.mmap</freebsdsa>
</references>
<dates>
<discovery>2013-06-18</discovery>
<entry>2013-06-18</entry>
</dates>
</vuln>
<vuln vid="279e5f4b-d823-11e2-928e-08002798f6ff">
<topic>apache-xml-security-c -- heap overflow</topic>
<affects>
<package>
<name>apache-xml-security-c</name>
<range><lt>1.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Software Foundation reports:</p>
<blockquote cite="http://santuario.apache.org/secadv.data/CVE-2013-2156.txt">
<p>A heap overflow exists in the processing of the PrefixList
attribute optionally used in conjunction with Exclusive
Canonicalization, potentially allowing arbitary code execution.
If verification of the signature occurs prior to actual evaluation of a
signing key, this could be exploited by an unauthenticated attacker.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2156</cvename>
<url>http://santuario.apache.org/secadv.data/CVE-2013-2156.txt</url>
</references>
<dates>
<discovery>2013-06-18</discovery>
<entry>2013-06-18</entry>
</dates>
</vuln>
<vuln vid="80af2677-d6c0-11e2-8f5e-001966155bea">
<topic>tor -- guard discovery</topic>
<affects>
<package>
<name>tor-devel</name>
<range><lt>0.2.4.13.a_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Tor Project reports:</p>
<blockquote cite="https://gitweb.torproject.org/tor.git/commit/2a95f3171681ee53c97ccba9d80f4454b462aaa7">
<p>Disable middle relay queue overfill detection code due to possible guard discovery attack</p>
</blockquote>
</body>
</description>
<references>
<url>https://trac.torproject.org/projects/tor/ticket/9072</url>
</references>
<dates>
<discovery>2013-06-15</discovery>
<entry>2013-06-16</entry>
</dates>
</vuln>
<vuln vid="4e9e410b-d462-11e2-8d57-080027019be0">
<topic>dbus -- local dos</topic>
<affects>
<package>
<name>dbus</name>
<range><lt>1.6.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon McVittie reports:</p>
<blockquote cite="http://lists.freedesktop.org/archives/dbus/2013-June/015696.html">
<p>Alexandru Cornea discovered a vulnerability in libdbus caused
by an implementation bug in _dbus_printf_string_upper_bound().
This vulnerability can be exploited by a local user to crash
system services that use libdbus, causing denial of service.
It is platform-specific: x86-64 Linux is known to be affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2168</cvename>
<url>http://lists.freedesktop.org/archives/dbus/2013-June/015696.html</url>
</references>
<dates>
<discovery>2013-06-13</discovery>
<entry>2013-06-13</entry>
</dates>
</vuln>
<vuln vid="fce67546-d2e7-11e2-a9bf-98fc11cdc4f5">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.291</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb13-16.html">
<p>These updates address vulnerabilities that could cause a crash
and potentially allow an attacker to take control of the affected system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-3343</cvename>
</references>
<dates>
<discovery>2013-06-11</discovery>
<entry>2013-06-14</entry>
<modified>2013-06-18</modified>
</dates>
</vuln>
<vuln vid="d7a43ee6-d2d5-11e2-9894-002590082ac6">
<topic>owncloud -- Multiple security vulnerabilities</topic>
<affects>
<package>
<name>owncloud</name>
<range><lt>5.0.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The ownCloud development team reports:</p>
<blockquote cite="http://owncloud.org/about/security/advisories/">
<p>oC-SA-2013-019 / CVE-2013-2045: Multiple SQL Injections.
Credit to Mateusz Goik (aliantsoft.pl).</p>
<p>oC-SA-2013-020 / CVE-2013-[2039,2085]: Multiple directory traversals.
Credit to Mateusz Goik (aliantsoft.pl).</p>
<p>oC-SQ-2013-021 / CVE-2013-[2040-2042]: Multiple XSS vulnerabilities.
Credit to Mateusz Goik (aliantsoft.pl) and Kacper R. (http://devilteam.pl).</p>
<p>oC-SA-2013-022 / CVE-2013-2044: Open redirector.
Credit to Mateusz Goik (aliantsoft.pl).</p>
<p>oC-SA-2013-023 / CVE-2013-2047: Password autocompletion.</p>
<p>oC-SA-2013-024 / CVE-2013-2043: Privilege escalation in the calendar application.
Credit to Mateusz Goik (aliantsoft.pl).</p>
<p>oC-SA-2013-025 / CVE-2013-2048: Privilege escalation and CSRF in the API.</p>
<p>oC-SA-2013-026 / CVE-2013-2089: Incomplete blacklist vulnerability.</p>
<p>oC-SA-2013-027 / CVE-2013-2086: CSRF token leakage.</p>
<p>oC-SA-2013-028 / CVE-2013-[2149-2150]: Multiple XSS vulnerabilities.</p>
</blockquote>
</body>
</description>
<references>
<url>http://owncloud.org/about/security/advisories/oC-SA-2013-019/</url>
<url>http://owncloud.org/about/security/advisories/oC-SA-2013-020/</url>
<url>http://owncloud.org/about/security/advisories/oC-SA-2013-021/</url>
<url>http://owncloud.org/about/security/advisories/oC-SA-2013-022/</url>
<url>http://owncloud.org/about/security/advisories/oC-SA-2013-023/</url>
<url>http://owncloud.org/about/security/advisories/oC-SA-2013-024/</url>
<url>http://owncloud.org/about/security/advisories/oC-SA-2013-025/</url>
<url>http://owncloud.org/about/security/advisories/oC-SA-2013-026/</url>
<url>http://owncloud.org/about/security/advisories/oC-SA-2013-027/</url>
<url>http://owncloud.org/about/security/advisories/oC-SA-2013-028/</url>
<cvename>CVE-2013-2039</cvename>
<cvename>CVE-2013-2040</cvename>
<cvename>CVE-2013-2041</cvename>
<cvename>CVE-2013-2042</cvename>
<cvename>CVE-2013-2043</cvename>
<cvename>CVE-2013-2044</cvename>
<cvename>CVE-2013-2045</cvename>
<cvename>CVE-2013-2047</cvename>
<cvename>CVE-2013-2048</cvename>
<cvename>CVE-2013-2085</cvename>
<cvename>CVE-2013-2086</cvename>
<cvename>CVE-2013-2089</cvename>
<cvename>CVE-2013-2149</cvename>
<cvename>CVE-2013-2150</cvename>
</references>
<dates>
<discovery>2013-05-14</discovery>
<entry>2013-06-11</entry>
</dates>
</vuln>
<vuln vid="59e7163c-cf84-11e2-907b-0025905a4770">
<topic>php5 -- Heap based buffer overflow in quoted_printable_encode</topic>
<affects>
<package>
<name>php5</name>
<range><lt>5.4.16</lt></range>
</package>
<package>
<name>php53</name>
<range><lt>5.3.26</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP development team reports:</p>
<blockquote cite="http://www.php.net/ChangeLog-5.php">
<p>A Heap-based buffer overflow flaw was found in the php
quoted_printable_encode() function. A remote attacker could use
this flaw to cause php to crash or execute arbirary code with the
permission of the user running php</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2110</cvename>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=964969</url>
</references>
<dates>
<discovery>2013-06-06</discovery>
<entry>2013-06-07</entry>
</dates>
</vuln>
<vuln vid="72f35727-ce83-11e2-be04-005056a37f68">
<topic>dns/bind9* -- A recursive resolver can be crashed by a query for a malformed zone</topic>
<affects>
<package>
<name>bind99</name>
<range><gt>9.9.3</gt><lt>9.9.3.1</lt></range>
</package>
<package>
<name>bind99-base</name>
<range><gt>9.9.3</gt><lt>9.9.3.1</lt></range>
</package>
<package>
<name>bind98</name>
<range><gt>9.8.5</gt><lt>9.8.5.1</lt></range>
</package>
<package>
<name>bind98-base</name>
<range><gt>9.8.5</gt><lt>9.8.5.1</lt></range>
</package>
<package>
<name>bind96</name>
<range><gt>9.6.3.1.ESV.R9</gt><lt>9.6.3.2.ESV.R9</lt></range>
</package>
<package>
<name>bind96-base</name>
<range><gt>9.6.3.1.ESV.R9</gt><lt>9.6.3.2.ESV.R9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-00967">
<p>A bug has been discovered in the most recent releases of
BIND 9 which has the potential for deliberate exploitation
as a denial-of-service attack. By sending a recursive
resolver a query for a record in a specially malformed zone,
an attacker can cause BIND 9 to exit with a fatal
"RUNTIME_CHECK" error in resolver.c.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-3919</cvename>
</references>
<dates>
<discovery>2013-06-04</discovery>
<entry>2013-06-06</entry>
<modified>2013-06-07</modified>
</dates>
</vuln>
<vuln vid="6b97436c-ce1e-11e2-9cb2-6805ca0b3d42">
<topic>phpMyAdmin -- XSS due to unescaped HTML output in Create View page</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>4.0</ge><lt>4.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-6.php">
<p>When creating a view with a crafted name and an incorrect
CREATE statement, it is possible to trigger an XSS.</p>
<p>This vulnerability can be triggered only by someone who
logged in to phpMyAdmin, as the usual token protection
prevents non-logged-in users from accessing the required
form.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2013-6.php</url>
<cvename>CVE-2013-3742</cvename>
</references>
<dates>
<discovery>2013-06-05</discovery>
<entry>2013-06-05</entry>
</dates>
</vuln>
<vuln vid="a3c2dee5-cdb9-11e2-b9ce-080027019be0">
<topic>telepathy-gabble -- TLS verification bypass</topic>
<affects>
<package>
<name>telepathy-gabble</name>
<range><lt>0.16.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon McVittie reports:</p>
<blockquote cite="http://lists.freedesktop.org/archives/telepathy/2013-May/006449.html">
<p>This release fixes a man-in-the-middle attack.</p>
<p>If you use an unencrypted connection to a "legacy Jabber"
(pre-XMPP) server, this version of Gabble will not connect
until you make one of these configuration changes:</p>
<p>. upgrade the server software to something that supports XMPP 1.0; or</p>
<p>. use an encrypted "old SSL" connection, typically on port 5223
(old-ssl); or</p>
<p>. turn off "Encryption required (TLS/SSL)" (require-encryption).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1431</cvename>
<url>http://lists.freedesktop.org/archives/telepathy/2013-May/006449.html</url>
</references>
<dates>
<discovery>2013-05-27</discovery>
<entry>2013-06-05</entry>
</dates>
</vuln>
<vuln vid="4865d189-cd62-11e2-ae11-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>27.0.1453.110</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/">
<p>[242322] Medium CVE-2013-2855: Memory corruption in dev tools API.
Credit to "daniel.zulla".</p>
<p>[242224] High CVE-2013-2856: Use-after-free in input handling.
Credit to miaubiz.</p>
<p>[240124] High CVE-2013-2857: Use-after-free in image handling.
Credit to miaubiz.</p>
<p>[239897] High CVE-2013-2858: Use-after-free in HTML5 Audio. Credit
to "cdel921".</p>
<p>[237022] High CVE-2013-2859: Cross-origin namespace pollution.
to "bobbyholley".</p>
<p>[225546] High CVE-2013-2860: Use-after-free with workers accessing
database APIs. Credit to Collin Payne.</p>
<p>[209604] High CVE-2013-2861: Use-after-free with SVG. Credit to
miaubiz.</p>
<p>[161077] High CVE-2013-2862: Memory corruption in Skia GPU
handling. Credit to Atte Kettunen of OUSPG.</p>
<p>[232633] Critical CVE-2013-2863: Memory corruption in SSL socket
handling. Credit to Sebastian Marchand of the Chromium development
community.</p>
<p>[239134] High CVE-2013-2864: Bad free in PDF viewer. Credit to
Mateusz Jurczyk, with contributions by Gynvael Coldwind, both from
Google Security Team.</p>
<p>[246389] High CVE-2013-2865: Various fixes from internal audits,
fuzzing and other initiatives.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2855</cvename>
<cvename>CVE-2013-2856</cvename>
<cvename>CVE-2013-2857</cvename>
<cvename>CVE-2013-2858</cvename>
<cvename>CVE-2013-2859</cvename>
<cvename>CVE-2013-2860</cvename>
<cvename>CVE-2013-2861</cvename>
<cvename>CVE-2013-2862</cvename>
<cvename>CVE-2013-2863</cvename>
<cvename>CVE-2013-2864</cvename>
<cvename>CVE-2013-2865</cvename>
<url>http://googlechromereleases.blogspot.nl/</url>
</references>
<dates>
<discovery>2013-06-04</discovery>
<entry>2013-06-04</entry>
</dates>
</vuln>
<vuln vid="2eebebff-cd3b-11e2-8f09-001b38c3836c">
<topic>xorg -- protocol handling issues in X Window System client libraries</topic>
<affects>
<package>
<name>libX11</name>
<range><lt>1.6.0</lt></range>
</package>
<package>
<name>libXext</name>
<range><lt>1.3.2</lt></range>
</package>
<package>
<name>libXfixes</name>
<range><lt>5.0.1</lt></range>
</package>
<package>
<name>libXi</name>
<range><lt>1.7_1</lt></range>
</package>
<package>
<name>libXinerama</name>
<range><lt>1.1.3</lt></range>
</package>
<package>
<name>libXp</name>
<range><lt>1.0.2</lt></range>
</package>
<package>
<name>libXrandr</name>
<range><lt>1.4.1</lt></range>
</package>
<package>
<name>libXrender</name>
<range><lt>0.9.7_1</lt></range>
</package>
<package>
<name>libXres</name>
<range><lt>1.0.7</lt></range>
</package>
<package>
<name>libXtst</name>
<range><lt>1.2.2</lt></range>
</package>
<package>
<name>libXv</name>
<range><lt>1.0.8</lt></range>
</package>
<package>
<name>libXvMC</name>
<range><lt>1.0.7_1</lt></range>
</package>
<package>
<name>libXxf86dga</name>
<range><lt>1.1.4</lt></range>
</package>
<package>
<name>libdmx</name>
<range><lt>1.1.3</lt></range>
</package>
<package>
<name>libxcb</name>
<range><lt>1.9.1</lt></range>
</package>
<package>
<name>libGL</name>
<range><lt>7.6.1_4</lt></range>
<range><gt>7.8.0</gt><lt>8.0.5_4</lt></range>
</package>
<package>
<name>xf86-video-openchrome</name>
<range><lt>0.3.3</lt></range>
</package>
<package>
<name>libFS</name>
<range><lt>1.0.5</lt></range>
</package>
<package>
<name>libXxf86vm</name>
<range><lt>1.1.3</lt></range>
</package>
<package>
<name>libXt</name>
<range><lt>1.1.4</lt></range>
</package>
<package>
<name>libXcursor</name>
<range><lt>1.1.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>freedesktop.org reports:</p>
<blockquote cite="http://www.x.org/wiki/Development/Security/Advisory-2013-05-23">
<p>Ilja van Sprundel, a security researcher with IOActive, has
discovered a large number of issues in the way various X client
libraries handle the responses they receive from servers, and has
worked with X.Org's security team to analyze, confirm, and fix
these issues.</p>
<p>Most of these issues stem from the client libraries trusting the
server to send correct protocol data, and not verifying that the
values will not overflow or cause other damage. Most of the time X
clients &amp; servers are run by the same user, with the server
more privileged from the clients, so this is not a problem, but
there are scenarios in which a privileged client can be connected
to an unprivileged server, for instance, connecting a setuid X
client (such as a screen lock program) to a virtual X server (such
as Xvfb or Xephyr) which the user has modified to return invalid
data, potentially allowing the user to escalate their privileges.</p>
<p>The vulnerabilities include:</p>
<p>Integer overflows calculating memory needs for replies.</p>
<p>Sign extension issues calculating memory needs for replies.</p>
<p>Buffer overflows due to not validating length or offset values in
replies.</p>
<p>Integer overflows parsing user-specified files.</p>
<p>Unbounded recursion parsing user-specified files.</p>
<p>Memory corruption due to unchecked return values.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1981</cvename>
<cvename>CVE-2013-1982</cvename>
<cvename>CVE-2013-1983</cvename>
<cvename>CVE-2013-1984</cvename>
<cvename>CVE-2013-1985</cvename>
<cvename>CVE-2013-1986</cvename>
<cvename>CVE-2013-1987</cvename>
<cvename>CVE-2013-1988</cvename>
<cvename>CVE-2013-1989</cvename>
<cvename>CVE-2013-1990</cvename>
<cvename>CVE-2013-1991</cvename>
<cvename>CVE-2013-1992</cvename>
<cvename>CVE-2013-1993</cvename>
<cvename>CVE-2013-1994</cvename>
<cvename>CVE-2013-1995</cvename>
<cvename>CVE-2013-1996</cvename>
<cvename>CVE-2013-1997</cvename>
<cvename>CVE-2013-1998</cvename>
<cvename>CVE-2013-1999</cvename>
<cvename>CVE-2013-2000</cvename>
<cvename>CVE-2013-2001</cvename>
<cvename>CVE-2013-2002</cvename>
<cvename>CVE-2013-2003</cvename>
<cvename>CVE-2013-2004</cvename>
<cvename>CVE-2013-2005</cvename>
<cvename>CVE-2013-2062</cvename>
<cvename>CVE-2013-2063</cvename>
<cvename>CVE-2013-2064</cvename>
<cvename>CVE-2013-2066</cvename>
</references>
<dates>
<discovery>2013-05-23</discovery>
<entry>2013-06-04</entry>
</dates>
</vuln>
<vuln vid="e3f64457-cccd-11e2-af76-206a8a720317">
<topic>krb5 -- UDP ping-pong vulnerability in the kpasswd (password changing) service. [CVE-2002-2443]</topic>
<affects>
<package>
<name>krb5</name>
<range><le>1.11.2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>No advisory has been released yet.</p>
<blockquote cite="http://web.mit.edu/kerberos/www/krb5-1.11/">
<p>schpw.c in the kpasswd service in kadmind in MIT Kerberos 5
(aka krb5) before 1.11.3 does not properly validate UDP packets
before sending responses, which allows remote attackers to cause
a denial of service (CPU and bandwidth consumption) via a forged
packet that triggers a communication loop, as demonstrated by
krb_pingpong.nasl, a related issue to CVE-1999-0103.
[CVE-2002-2443].</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2002-2443</cvename>
<url>http://web.mit.edu/kerberos/www/krb5-1.11/</url>
</references>
<dates>
<discovery>2013-05-10</discovery>
<entry>2013-06-03</entry>
</dates>
</vuln>
<vuln vid="0bf376b7-cc6b-11e2-a424-14dae938ec40">
<topic>net/openafs -- buffer overflow</topic>
<affects>
<package>
<name>openafs</name>
<range><lt>1.6.2.*</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Nickolai Zeldovich reports:</p>
<blockquote cite="http://www.openafs.org/pages/security/OPENAFS-SA-2013-001.txt">
<p>An attacker with the ability to manipulate AFS directory ACLs may
crash the fileserver hosting that volume.
In addition, once a corrupt ACL is placed on a fileserver, its
existence may crash client utilities manipulating ACLs
on that server.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openafs.org/pages/security/OPENAFS-SA-2013-001.txt</url>
<cvename>CVE-2013-1794</cvename>
</references>
<dates>
<discovery>2013-02-27</discovery>
<entry>2013-06-03</entry>
</dates>
</vuln>
<vuln vid="9dfb63b8-8f36-11e2-b34d-000c2957946c">
<topic>www/mod_security -- NULL pointer dereference DoS</topic>
<affects>
<package>
<name>mod_security</name>
<range><lt>2.7.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SecurityFocus reports:</p>
<blockquote cite="http://www.securityfocus.com/archive/1/526746">
<p>When ModSecurity receives a request body with a size bigger than the
value set by the "SecRequestBodyInMemoryLimit" and with a "Content-Type"
that has no request body processor mapped to it, ModSecurity will
systematically crash on every call to "forceRequestBodyVariable".</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2765</cvename>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-2765</url>
</references>
<dates>
<discovery>2013-05-27</discovery>
<entry>2013-06-03</entry>
</dates>
</vuln>
<vuln vid="1225549f-ca91-11e2-b3b8-f0def16c5c1b">
<topic>passenger -- security vulnerability</topic>
<affects>
<package>
<name>rubygem-passenger</name>
<range><lt>4.0.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Phusion reports:</p>
<blockquote cite="http://blog.phusion.nl/2013/05/29/phusion-passenger-4-0-5-released/">
<p>A denial of service and arbitrary code execution by hijacking temp files. [CVE-2013-2119]</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2119</cvename>
<url>http://blog.phusion.nl/2013/05/29/phusion-passenger-4-0-5-released/</url>
</references>
<dates>
<discovery>2013-05-29</discovery>
<entry>2013-06-01</entry>
</dates>
</vuln>
<vuln vid="ce502902-ca39-11e2-9673-001e8c75030d">
<topic>devel/subversion -- svnserve remotely triggerable DoS</topic>
<affects>
<package>
<name>subversion</name>
<range><ge>1.7.0</ge><lt>1.7.10</lt></range>
<range><ge>1.0.0</ge><lt>1.6.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Subversion team reports:</p>
<blockquote cite="http://subversion.apache.org/security/CVE-2013-2112-advisory.txt">
<p>Subversion's svnserve server process may exit when an incoming TCP connection
is closed early in the connection process.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2112</cvename>
</references>
<dates>
<discovery>2013-05-31</discovery>
<entry>2013-05-31</entry>
</dates>
</vuln>
<vuln vid="6d0bf320-ca39-11e2-9673-001e8c75030d">
<topic>devel/subversion -- contrib hook-scripts can allow arbitrary code execution</topic>
<affects>
<package>
<name>subversion</name>
<range><ge>1.7.0</ge><lt>1.7.10</lt></range>
<range><ge>1.2.0</ge><lt>1.6.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Subversion team reports:</p>
<blockquote cite="http://subversion.apache.org/security/CVE-2013-2088-advisory.txt">
<p>The script contrib/hook-scripts/check-mime-type.pl does not escape
argv arguments to 'svnlook' that start with a hyphen. This could be
used to cause 'svnlook', and hence check-mime-type.pl, to error out.</p>
<p>The script contrib/hook-scripts/svn-keyword-check.pl parses filenames
from the output of 'svnlook changed' and passes them to a further
shell command (equivalent to the 'system()' call of the C standard
library) without escaping them. This could be used to run arbitrary
shell commands in the context of the user whom the pre-commit script
runs as (the user who owns the repository).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2088</cvename>
</references>
<dates>
<discovery>2013-05-31</discovery>
<entry>2013-05-31</entry>
</dates>
</vuln>
<vuln vid="787d21b9-ca38-11e2-9673-001e8c75030d">
<topic>devel/subversion -- fsfs repositories can be corrupted by newline characters in filenames</topic>
<affects>
<package>
<name>subversion</name>
<range><ge>1.7.0</ge><lt>1.7.10</lt></range>
<range><ge>1.1.0</ge><lt>1.6.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Subversion team reports:</p>
<blockquote cite="http://subversion.apache.org/security/CVE-2013-1968-advisory.txt">
<p>If a filename which contains a newline character (ASCII 0x0a) is
committed to a repository using the FSFS format, the resulting
revision is corrupt.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1968</cvename>
</references>
<dates>
<discovery>2013-05-31</discovery>
<entry>2013-05-31</entry>
</dates>
</vuln>
<vuln vid="0a799a8e-c9d4-11e2-a424-14dae938ec40">
<topic>irc/bitchx -- multiple vulnerabilities</topic>
<affects>
<package>
<name>BitchX</name>
<range><lt>1.2.*,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>bannedit reports:</p>
<blockquote cite="http://www.cvedetails.com/cve/CVE-2007-4584/">
<p>Stack-based buffer overflow in BitchX 1.1 Final allows remote IRC
servers to execute arbitrary code via a long string in a MODE
command, related to the p_mode variable.</p>
</blockquote>
<p>Nico Golde reports:</p>
<blockquote cite="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=449149">
<p>There is a security issue in ircii-pana in bitchx' hostname
command. The e_hostname function (commands.c) uses tmpnam to
create a temporary file which is known to be insecure.</p>
</blockquote>
<p>Chris reports:</p>
<blockquote cite="http://secunia.com/advisories/27556">
<p>Chris has reported a vulnerability in the Cypress script for
BitchX, which can be exploited by malicious people to disclose
potentially sensitive information or to compromise a vulnerable
system.</p>
<p>The vulnerability is caused due to malicious code being present
in the modules/mdop.m file. This can be exploited to disclose the
content of various system files or to execute arbitrary shell
commands.</p>
<p>Successful exploitation allows execution of arbitrary code, but
requires the control of the "lsyn.webhop.net" domain.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-4584</cvename>
<cvename>CVE-2007-5839</cvename>
<cvename>CVE-2007-5922</cvename>
</references>
<dates>
<discovery>2007-08-28</discovery>
<entry>2013-05-31</entry>
</dates>
</vuln>
<vuln vid="19751e06-c798-11e2-a373-000c29833058">
<topic>znc -- null pointer dereference in webadmin module</topic>
<affects>
<package>
<name>znc</name>
<range><lt>1.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>No advisory has been released yet.</p>
<blockquote cite="https://github.com/znc/znc/commit/2bd410ee5570cea127233f1133ea22f25174eb28">
<p>Fix NULL pointer dereference in webadmin.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/znc/znc/commit/2bd410ee5570cea127233f1133ea22f25174eb28</url>
</references>
<dates>
<discovery>2013-05-27</discovery>
<entry>2013-05-28</entry>
</dates>
</vuln>
<vuln vid="6d87c2e9-c64d-11e2-9c22-50465d9ff992">
<topic>socat -- FD leak</topic>
<affects>
<package>
<name>socat</name>
<range><lt>1.7.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gerhard Rieger reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2013/q2/411">
<p>Under certain circumstances an FD leak occurs and can be misused for
denial of service attacks against socat running in server mode.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-3571</cvename>
<url>http://seclists.org/oss-sec/2013/q2/411</url>
</references>
<dates>
<discovery>2013-05-26</discovery>
<entry>2013-05-26</entry>
</dates>
</vuln>
<vuln vid="79789daa-8af8-4e21-a47f-e8a645752bdb">
<topic>ruby -- Object taint bypassing in DL and Fiddle in Ruby</topic>
<affects>
<package>
<name>ruby19</name>
<range><lt>1.9.3.429,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby Developers report:</p>
<blockquote cite="http://www.ruby-lang.org/en/news/2013/05/14/taint-bypass-dl-fiddle-cve-2013-2065/">
<p>There is a vulnerability in DL and Fiddle in Ruby where tainted
strings can be used by system calls regardless of the $SAFE level
set in Ruby.
</p>
<p>Native functions exposed to Ruby with DL or Fiddle do not check the
taint values set on the objects passed in. This can result in
tainted objects being accepted as input when a SecurityError
exception should be raised.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2065</cvename>
<url>http://www.ruby-lang.org/en/news/2013/05/14/taint-bypass-dl-fiddle-cve-2013-2065/</url>
</references>
<dates>
<discovery>2013-05-14</discovery>
<entry>2013-05-26</entry>
</dates>
</vuln>
<vuln vid="4fb45a1c-c5d0-11e2-8400-001b216147b0">
<topic>couchdb -- DOM based Cross-Site Scripting via Futon UI</topic>
<affects>
<package>
<name>couchdb</name>
<range><lt>1.2.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jan Lehnardt reports:</p>
<blockquote cite="http://mail-archives.apache.org/mod_mbox/couchdb-user/201301.mbox/%3C2FFF2FD7-8EAF-4EBF-AFDA-5AEB6EAC853F@apache.org%3E">
<p>Query parameters passed into the browser-based test suite
are not sanitised, and can be used to load external resources.
An attacker may execute JavaScript code in the browser, using
the context of the remote user.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-5650</cvename>
<url>http://mail-archives.apache.org/mod_mbox/couchdb-user/201301.mbox/%3C2FFF2FD7-8EAF-4EBF-AFDA-5AEB6EAC853F@apache.org%3E</url>
</references>
<dates>
<discovery>2012-01-14</discovery>
<entry>2013-05-26</entry>
</dates>
</vuln>
<vuln vid="a5b24a6b-c37c-11e2-addb-60a44c524f57">
<topic>otrs -- information disclosure</topic>
<affects>
<package>
<name>otrs</name>
<range><lt>3.2.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OTRS Project reports:</p>
<blockquote cite="http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-03/">
<p>An attacker with a valid agent login could manipulate URLs in the ticket split mechanism to see contents of tickets and they are not permitted to see.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-3551</cvename>
<url>http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-03/</url>
</references>
<dates>
<discovery>2013-05-22</discovery>
<entry>2013-05-23</entry>
</dates>
</vuln>
<vuln vid="661bd031-c37d-11e2-addb-60a44c524f57">
<topic>otrs -- XSS vulnerability</topic>
<affects>
<package>
<name>otrs</name>
<range><lt>3.1.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OTRS Project reports:</p>
<blockquote cite="http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-02/">
<p>An attacker with permission to write changes, workorder items or FAQ articles could inject JavaScript code into the articles which would be executed by the browser of other users reading the article.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2637</cvename>
<url>http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-02/</url>
</references>
<dates>
<discovery>2013-04-02</discovery>
<entry>2013-05-23</entry>
</dates>
</vuln>
<vuln vid="3a429192-c36a-11e2-97a9-6805ca0b3d42">
<topic>RT -- multiple vulnerabilities</topic>
<affects>
<package>
<name>rt38</name>
<range><ge>3.8</ge><lt>3.8.17</lt></range>
</package>
<package>
<name>rt40</name>
<range><ge>4.0</ge><lt>4.0.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Thomas Sibley reports:</p>
<blockquote cite="http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html">
<p>We discovered a number of security vulnerabilities which
affect both RT 3.8.x and RT 4.0.x. We are releasing RT
versions 3.8.17 and 4.0.13 to resolve these vulnerabilities,
as well as patches which apply atop all released versions of
3.8 and 4.0.</p>
<p>The vulnerabilities addressed by 3.8.17, 4.0.13, and the
below patches include the following:</p>
<p>RT 4.0.0 and above are vulnerable to a limited privilege
escalation leading to unauthorized modification of ticket
data. The DeleteTicket right and any custom lifecycle
transition rights may be bypassed by any user with
ModifyTicket. This vulnerability is assigned
CVE-2012-4733.</p>
<p>RT 3.8.0 and above include a version of bin/rt that uses
semi-predictable names when creating tempfiles. This could
possibly be exploited by a malicious user to overwrite files
with permissions of the user running bin/rt. This
vulnerability is assigned CVE-2013-3368.</p>
<p>RT 3.8.0 and above allow calling of arbitrary Mason
components (without control of arguments) for users who can
see administration pages. This could be used by a malicious
user to run private components which may have negative
side-effects. This vulnerability is assigned
CVE-2013-3369.</p>
<p>RT 3.8.0 and above allow direct requests to private
callback components. Though no callback components ship
with RT, this could be used to exploit an extension or local
callback which uses the arguments passed to it insecurely.
This vulnerability is assigned CVE-2013-3370.</p>
<p>RT 3.8.3 and above are vulnerable to cross-site scripting
(XSS) via attachment filenames. The vector is difficult to
exploit due to parsing requirements. Additionally, RT 4.0.0
and above are vulnerable to XSS via maliciously-crafted
"URLs" in ticket content when RT's "MakeClicky" feature is
configured. Although not believed to be exploitable in the
stock configuration, a patch is also included for RTIR 2.6.x
to add bulletproofing. These vulnerabilities are assigned
CVE-2013-3371.</p>
<p>RT 3.8.0 and above are vulnerable to an HTTP header
injection limited to the value of the Content-Disposition
header. Injection of other arbitrary response headers is
not possible. Some (especially older) browsers may allow
multiple Content-Disposition values which could lead to XSS.
Newer browsers contain security measures to prevent this.
Thank you to Dominic Hargreaves for reporting this
vulnerability. This vulnerability is assigned
CVE-2013-3372.</p>
<p>RT 3.8.0 and above are vulnerable to a MIME header
injection in outgoing email generated by RT. The vectors
via RT's stock templates are resolved by this patchset, but
any custom email templates should be updated to ensure that
values interpolated into mail headers do not contain
newlines. This vulnerability is assigned CVE-2013-3373.</p>
<p>RT 3.8.0 and above are vulnerable to limited session
re-use when using the file-based session store,
Apache::Session::File. RT's default session configuration
only uses Apache::Session::File for Oracle. RT instances
using Oracle may be locally configured to use the
database-backed Apache::Session::Oracle, in which case
sessions are never re-used. The extent of session re-use is
limited to information leaks of certain user preferences and
caches, such as queue names available for ticket creation.
Thank you to Jenny Martin for reporting the problem that
lead to discovery of this vulnerability. This vulnerability
is assigned CVE-2013-3374.</p>
</blockquote>
</body>
</description>
<references>
<url>http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html</url>
<url>http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html</url>
<url>http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html</url>
<cvename>CVE-2012-4733</cvename>
<cvename>CVE-2013-3368</cvename>
<cvename>CVE-2013-3369</cvename>
<cvename>CVE-2013-3370</cvename>
<cvename>CVE-2013-3371</cvename>
<cvename>CVE-2013-3372</cvename>
<cvename>CVE-2013-3373</cvename>
<cvename>CVE-2013-3374</cvename>
</references>
<dates>
<discovery>2013-05-22</discovery>
<entry>2013-05-23</entry>
</dates>
</vuln>
<vuln vid="358133b5-c2b9-11e2-a738-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>27.0.1453.93</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/search/Stable%20Updates">
<p>[235638] High CVE-2013-2837: Use-after-free in SVG. Credit to
Slawomir Blazek.</p>
<p>[235311] Medium CVE-2013-2838: Out-of-bounds read in v8. Credit to
Christian Holler.</p>
<p>[230176] High CVE-2013-2839: Bad cast in clipboard handling.
Credit to Jon of MWR InfoSecurity.</p>
<p>[230117] High CVE-2013-2840: Use-after-free in media loader.
Credit to Nils of MWR InfoSecurity.</p>
<p>[227350] High CVE-2013-2841: Use-after-free in Pepper resource
handling. Credit to Chamal de Silva.</p>
<p>[226696] High CVE-2013-2842: Use-after-free in widget handling.
Credit to Cyril Cattiaux.</p>
<p>[222000] High CVE-2013-2843: Use-after-free in speech handling.
Credit to Khalil Zhani.</p>
<p>[196393] High CVE-2013-2844: Use-after-free in style resolution.
Credit to Sachin Shinde (@cons0ul).</p>
<p>[188092] [179522] [222136] [188092] High CVE-2013-2845: Memory
safety issues in Web Audio. Credit to Atte Kettunen of OUSPG.</p>
<p>[177620] High CVE-2013-2846: Use-after-free in media loader.
Credit to Chamal de Silva.</p>
<p>[176692] High CVE-2013-2847: Use-after-free race condition with
workers. Credit to Collin Payne.</p>
<p>[176137] Medium CVE-2013-2848: Possible data extraction with XSS
Auditor. Credit to Egor Homakov.</p>
<p>[171392] Low CVE-2013-2849: Possible XSS with drag+drop or
copy+paste. Credit to Mario Heiderich.</p>
<p>[241595] High CVE-2013-2836: Various fixes from internal audits,
fuzzing and other initiatives.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2836</cvename>
<cvename>CVE-2013-2837</cvename>
<cvename>CVE-2013-2838</cvename>
<cvename>CVE-2013-2839</cvename>
<cvename>CVE-2013-2840</cvename>
<cvename>CVE-2013-2841</cvename>
<cvename>CVE-2013-2842</cvename>
<cvename>CVE-2013-2843</cvename>
<cvename>CVE-2013-2844</cvename>
<cvename>CVE-2013-2845</cvename>
<cvename>CVE-2013-2846</cvename>
<cvename>CVE-2013-2847</cvename>
<cvename>CVE-2013-2848</cvename>
<cvename>CVE-2013-2849</cvename>
<url>http://googlechromereleases.blogspot.nl/search/Stable%20Updates</url>
</references>
<dates>
<discovery>2013-05-21</discovery>
<entry>2013-05-22</entry>
</dates>
</vuln>
<vuln vid="c72a2494-c08b-11e2-bb21-083e8ed0f47b">
<topic>plib -- stack-based buffer overflow</topic>
<affects>
<package>
<name>plib</name>
<range><lt>1.8.5_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CVE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=2012-4552">
<p>Stack-based buffer overflow in the error function in
ssg/ssgParser.cxx in PLIB 1.8.5 allows remote attackers to
execute arbitrary code via a crafted 3d model file that
triggers a long error message, as demonstrated by a .ase
file.</p>
</blockquote>
</body>
</description>
<references>
<bid>55839</bid>
<cvename>CVE-2012-4552</cvename>
<mlist>http://www.openwall.com/lists/oss-security/2012/10/29/8</mlist>
</references>
<dates>
<discovery>2012-10-09</discovery>
<entry>2013-05-19</entry>
</dates>
</vuln>
<vuln vid="13bf0602-c08a-11e2-bb21-083e8ed0f47b">
<topic>plib -- buffer overflow</topic>
<affects>
<package>
<name>plib</name>
<range><lt>1.8.5_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="https://secunia.com/advisories/47297">
<p>A vulnerability has been discovered in PLIB, which can be
exploited by malicious people to compromise an application
using the library. The vulnerability is caused due to a
boundary error within the "ulSetError()" function
(src/util/ulError.cxx) when creating the error message,
which can be exploited to overflow a static buffer.</p>
<p>Successful exploitation allows the execution of arbitrary
code but requires that the attacker can e.g. control the
content of an overly long error message passed to the
"ulSetError()" function.</p>
<p>The vulnerability is confirmed in version 1.8.5. Other
versions may also be affected.</p>
<p>Originally reported in TORCS by Andres Gomez.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-4620</cvename>
<mlist>http://openwall.com/lists/oss-security/2011/12/21/2</mlist>
</references>
<dates>
<discovery>2011-12-21</discovery>
<entry>2013-05-19</entry>
</dates>
</vuln>
<vuln vid="a0c65049-bddd-11e2-a0f6-001060e06fd4">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.285</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb13-14.html">
<p>These updates address vulnerabilities that could cause a crash
and potentially allow an attacker to take control of the affected system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2728</cvename>
<cvename>CVE-2013-3324</cvename>
<cvename>CVE-2013-3325</cvename>
<cvename>CVE-2013-3326</cvename>
<cvename>CVE-2013-3327</cvename>
<cvename>CVE-2013-3328</cvename>
<cvename>CVE-2013-3329</cvename>
<cvename>CVE-2013-3330</cvename>
<cvename>CVE-2013-3331</cvename>
<cvename>CVE-2013-3332</cvename>
<cvename>CVE-2013-3333</cvename>
<cvename>CVE-2013-3334</cvename>
<cvename>CVE-2013-3335</cvename>
</references>
<dates>
<discovery>2013-05-14</discovery>
<entry>2013-05-16</entry>
</dates>
</vuln>
<vuln vid="4a1ca8a4-bd82-11e2-b7a0-d43d7e0c7c02">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>18.0,1</gt><lt>21.0,1</lt></range>
<range><lt>17.0.6,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>17.0.6,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.17.1</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>17.0.6</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.17.1</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><gt>11.0</gt><lt>17.0.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2013-41 Miscellaneous memory safety hazards (rv:21.0
/ rv:17.0.6)</p>
<p>MFSA 2013-42 Privileged access for content level constructor</p>
<p>MFSA 2013-43 File input control has access to full path</p>
<p>MFSA 2013-44 Local privilege escalation through Mozilla
Maintenance Service</p>
<p>MFSA 2013-45 Mozilla Updater fails to update some Windows Registry
entries</p>
<p>MFSA 2013-46 Use-after-free with video and onresize event</p>
<p>MFSA 2013-47 Uninitialized functions in DOMSVGZoomEvent</p>
<p>MFSA 2013-48 Memory corruption found using Address Sanitizer</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-1942</cvename>
<cvename>CVE-2013-0801</cvename>
<cvename>CVE-2013-1669</cvename>
<cvename>CVE-2013-1670</cvename>
<cvename>CVE-2013-1671</cvename>
<cvename>CVE-2013-1672</cvename>
<cvename>CVE-2013-1674</cvename>
<cvename>CVE-2013-1675</cvename>
<cvename>CVE-2013-1676</cvename>
<cvename>CVE-2013-1677</cvename>
<cvename>CVE-2013-1678</cvename>
<cvename>CVE-2013-1679</cvename>
<cvename>CVE-2013-1680</cvename>
<cvename>CVE-2013-1681</cvename>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-40.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-41.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-42.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-43.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-44.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-45.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-46.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-47.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-48.html</url>
<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
</references>
<dates>
<discovery>2013-05-14</discovery>
<entry>2013-05-15</entry>
<modified>2013-05-21</modified>
</dates>
</vuln>
<vuln vid="efaa4071-b700-11e2-b1b9-f0def16c5c1b">
<topic>nginx -- multiple vulnerabilities</topic>
<affects>
<package>
<name>nginx</name>
<range><ge>1.2.0,1</ge><le>1.2.8,1</le></range>
<range><ge>1.3.0,1</ge><lt>1.4.1,1</lt></range>
</package>
<package>
<name>nginx-devel</name>
<range><ge>1.1.4</ge><le>1.2.8</le></range>
<range><ge>1.3.0</ge><lt>1.5.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The nginx project reports:</p>
<blockquote cite="http://nginx.org/en/security_advisories.html">
<p>A stack-based buffer overflow might occur in a worker process
process while handling a specially crafted request, potentially
resulting in arbitrary code execution. [CVE-2013-2028]</p>
<p>A security problem related to CVE-2013-2028 was identified,
affecting some previous nginx versions if proxy_pass to
untrusted upstream HTTP servers is used.</p>
<p>The problem may lead to a denial of service or a disclosure of a
worker process memory on a specially crafted response from an
upstream proxied server. [CVE-2013-2070]</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2028</cvename>
<cvename>CVE-2013-2070</cvename>
<url>http://mailman.nginx.org/pipermail/nginx-announce/2013/000114.html</url>
<url>http://mailman.nginx.org/pipermail/nginx-announce/2013/000112.html</url>
</references>
<dates>
<discovery>2013-05-07</discovery>
<entry>2013-05-07</entry>
<modified>2013-05-16</modified>
</dates>
</vuln>
<vuln vid="6ff570cb-b418-11e2-b279-20cf30e32f6d">
<topic>strongSwan -- ECDSA signature verification issue</topic>
<affects>
<package>
<name>strongswan</name>
<range><lt>5.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>strongSwan security team reports:</p>
<blockquote cite="http://www.strongswan.org/blog/2013/04/30/strongswan-5.0.4-released-%28cve-2013-2944%29.html">
<p>If the openssl plugin is used for ECDSA signature verification an empty,
zeroed or otherwise invalid signature is handled as a legitimate one.
Both IKEv1 and IKEv2 are affected.</p>
<p>Affected are only installations that have enabled and loaded the OpenSSL
crypto backend (--enable-openssl). Builds using the default crypto backends
are not affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2944</cvename>
</references>
<dates>
<discovery>2013-04-30</discovery>
<entry>2013-05-03</entry>
</dates>
</vuln>
<vuln vid="622e14b1-b40c-11e2-8441-00e0814cab4e">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>1.514</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory reports:</p>
<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-05-02">
<p>This advisory announces multiple security vulnerabilities that
were found in Jenkins core.</p>
<ol>
<li>
<p>SECURITY-63 / CVE-2013-2034</p>
<p>This creates a cross-site request forgery (CSRF) vulnerability
on Jenkins master, where an anonymous attacker can trick an
administrator to execute arbitrary code on Jenkins master by
having him open a specifically crafted attack URL.</p>
<p>There's also a related vulnerability where the permission
check on this ability is done imprecisely, which may affect
those who are running Jenkins instances with a custom
authorization strategy plugin.</p>
</li>
<li>
<p>SECURITY-67 / CVE-2013-2033</p>
<p>This creates a cross-site scripting (XSS) vulnerability, where
an attacker with a valid user account on Jenkins can execute
JavaScript in the browser of other users, if those users are
using certain browsers.</p>
</li>
<li>
<p>SECURITY-69 / CVE-2013-2034</p>
<p>This is another CSRF vulnerability that allows an attacker to
cause a deployment of binaries to Maven repositories. This
vulnerability has the same CVE ID as SEUCRITY-63.</p>
</li>
<li>
<p>SECURITY-71 / CVE-2013-1808</p>
<p>This creates a cross-site scripting (XSS) vulnerability.</p>
</li>
</ol>
</blockquote>
</body>
</description>
<references>
<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-05-02</url>
<cvename>CVE-2013-2034</cvename>
<cvename>CVE-2013-2033</cvename>
<cvename>CVE-2013-2034</cvename>
<cvename>CVE-2013-1808</cvename>
</references>
<dates>
<discovery>2013-05-02</discovery>
<entry>2013-05-03</entry>
</dates>
</vuln>
<vuln vid="e66a6e2f-b0d5-11e2-9164-0016e6dcb562">
<topic>FreeBSD -- NFS remote denial of service</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><gt>8.3</gt><lt>8.3_8</lt></range>
<range><gt>9.1</gt><lt>9.1_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="http://www.freebsd.org/security/advisories/FreeBSD-SA-13:05.nfsserver.asc">
<p>Insufficient input validation in the NFS server allows an
attacker to cause the underlying file system to treat a
regular file as a directory.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-3266</cvename>
<freebsdsa>SA-13:05.nfsserver</freebsdsa>
</references>
<dates>
<discovery>2013-04-21</discovery>
<entry>2013-04-29</entry>
</dates>
</vuln>
<vuln vid="57df803e-af34-11e2-8d62-6cf0490a8c18">
<topic>Joomla! -- XXS and DDoS vulnerabilities</topic>
<affects>
<package>
<name>joomla</name>
<range><ge>2.0.*</ge><lt>2.5.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The JSST and the Joomla! Security Center report:</p>
<blockquote cite="http://developer.joomla.org/security/80-20130405-core-xss-vulnerability.html">
<h2>[20130405] - Core - XSS Vulnerability</h2>
<p>Inadequate filtering leads to XSS vulnerability in Voting plugin.</p>
</blockquote>
<blockquote cite="http://developer.joomla.org/security/81-20130403-core-xss-vulnerability.html">
<h2>[20130403] - Core - XSS Vulnerability</h2>
<p>Inadequate filtering allows possibility of XSS exploit in some
circumstances.</p>
</blockquote>
<blockquote cite="http://developer.joomla.org/security/82-20130402-core-information-disclosure.html">
<h2>[20130402] - Core - Information Disclosure</h2>
<p>Inadequate permission checking allows unauthorised user to see
permission settings in some circumstances.</p>
</blockquote>
<blockquote cite="http://developer.joomla.org/security/83-20130404-core-xss-vulnerability.html">
<h2>[20130404] - Core - XSS Vulnerability</h2>
<p>Use of old version of Flash-based file uploader leads to XSS
vulnerability.</p>
</blockquote>
<blockquote cite="http://developer.joomla.org/security/84-20130401-core-privilege-escalation.html">
<h2>[20130401] - Core - Privilege Escalation</h2>
<p>Inadequate permission checking allows unauthorised user to delete
private messages.</p>
</blockquote>
<blockquote cite="http://developer.joomla.org/security/85-20130406-core-dos-vulnerability.html">
<h2>[20130406] - Core - DOS Vulnerability</h2>
<p>Object unserialize method leads to possible denial of service
vulnerability.</p>
</blockquote>
<blockquote cite="http://developer.joomla.org/security/86-20130407-core-xss-vulnerability.html">
<h2>[20130407] - Core - XSS Vulnerability</h2>
<p>Inadequate filtering leads to XSS vulnerability in highlighter
plugin</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-3059</cvename>
<cvename>CVE-2013-3058</cvename>
<cvename>CVE-2013-3057</cvename>
<url>http://developer.joomla.org/security/83-20130404-core-xss-vulnerability.html</url>
<cvename>CVE-2013-3056</cvename>
<cvename>CVE-2013-3242</cvename>
<cvename>CVE-2013-3267</cvename>
</references>
<dates>
<discovery>2013-04-24</discovery>
<entry>2013-04-27</entry>
</dates>
</vuln>
<vuln vid="8c8fa44d-ad15-11e2-8cea-6805ca0b3d42">
<topic>phpMyAdmin -- Multiple security vulnerabilities</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>3.5</ge><lt>3.5.8.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-2.php">
<p>In some PHP versions, the preg_replace() function can be
tricked into executing arbitrary PHP code on the
server. This is done by passing a crafted argument as the
regular expression, containing a null byte. phpMyAdmin does
not correctly sanitize an argument passed to preg_replace()
when using the "Replace table prefix" feature, opening the
way to this vulnerability..</p>
<p>This vulnerability can be triggered only by someone who
logged in to phpMyAdmin, as the usual token protection
prevents non-logged-in users to access the required
form.</p>
</blockquote>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-3.php">
<p>phpMyAdmin can be configured to save an export file on
the web server, via its SaveDir directive. With this in
place, it's possible, either via a crafted filename template
or a crafted table name, to save a double extension file
like foobar.php.sql. In turn, an Apache webserver on which
there is no definition for the MIME type "sql" (the default)
will treat this saved file as a ".php" script, leading to
remote code execution.</p>
<p>This vulnerability can be triggered only by someone who
logged in to phpMyAdmin, as the usual token protection
prevents non-logged-in users to access the required
form. Moreover, the SaveDir directive is empty by default,
so a default configuration is not vulnerable. The
$cfg['SaveDir'] directive must be configured, and the server
must be running Apache with mod_mime to be exploitable.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-3238</cvename>
<cvename>CVE-2013-3239</cvename>
</references>
<dates>
<discovery>2013-04-24</discovery>
<entry>2013-04-24</entry>
</dates>
</vuln>
<vuln vid="aeb962f6-ab8d-11e2-b3f5-003067c2616f">
<topic>tinc -- Buffer overflow</topic>
<affects>
<package>
<name>tinc</name>
<range><lt>1.0.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>tinc-vpn.org reports:</p>
<blockquote cite="http://www.tinc-vpn.org/news/">
<p>Drop packets forwarded via TCP if they are too big.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1428</cvename>
</references>
<dates>
<discovery>2013-01-26</discovery>
<entry>2013-04-22</entry>
</dates>
</vuln>
<vuln vid="7280c3f6-a99a-11e2-8cef-6805ca0b3d42">
<topic>phpMyAdmin -- XSS due to unescaped HTML output in GIS visualisation page</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>3.5</ge><lt>3.5.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-1.php">
<p> When modifying a URL parameter with a crafted value it
is possible to trigger an XSS.</p>
<p>These XSS can only be triggered when a valid database is
known and when a valid cookie token is used.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1937</cvename>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2013-1.php</url>
</references>
<dates>
<discovery>2013-04-18</discovery>
<entry>2013-04-20</entry>
</dates>
</vuln>
<vuln vid="a592e991-a919-11e2-ade0-8c705af55518">
<topic>roundcube -- arbitrary file disclosure vulnerability</topic>
<affects>
<package>
<name>roundcube</name>
<range><lt>0.8.6,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>RoundCube development team reports:</p>
<blockquote cite="http://lists.roundcube.net/pipermail/dev/2013-March/022337.html">
<p>After getting reports about a possible vulnerability
of Roundcube which allows an attacker to modify its
users preferences in a way that he/she can then read
files from the server, we now published updated packages
as well as patches that fix this security issue.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1904</cvename>
<url>https://secunia.com/advisories/52806/</url>
</references>
<dates>
<discovery>2013-03-27</discovery>
<entry>2013-04-19</entry>
</dates>
</vuln>
<vuln vid="8ff84335-a7da-11e2-b3f5-003067c2616f">
<topic>jasper -- buffer overflow</topic>
<affects>
<package>
<name>jasper</name>
<range><lt>1.900.1_12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Fedora reports:</p>
<blockquote cite="http://www.kb.cert.org/vuls/id/887409">
<p>JasPer fails to properly decode marker segments and other
sections in malformed JPEG2000 files. Malformed inputs can
cause heap buffer overflows which in turn may result in
execution of attacker-controlled code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-3520</cvename>
<cvename>CVE-2008-3522</cvename>
<cvename>CVE-2011-4516</cvename>
<cvename>CVE-2011-4517</cvename>
<url>http://www.kb.cert.org/vuls/id/887409</url>
</references>
<dates>
<discovery>2011-12-09</discovery>
<entry>2013-04-18</entry>
</dates>
</vuln>
<vuln vid="2070c79a-8e1e-11e2-b34d-000c2957946c">
<topic>ModSecurity -- XML External Entity Processing Vulnerability</topic>
<affects>
<package>
<name>mod_security</name>
<range><gt>2.*</gt><lt>2.7.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Positive Technologies has reported a vulnerability in ModSecurity,
which can be exploited by malicious people to disclose potentially
sensitive information or cause a DoS (Denial Of Serice).</p>
<p>The vulnerability is caused due to an error when parsing external
XML entities and can be exploited to e.g. disclose local files or
cause excessive memory and CPU consumption.</p>
<blockquote cite="https://secunia.com/advisories/52847/">
<p>.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1915</cvename>
<url>https://secunia.com/advisories/52847/</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-1915</url>
<url>https://bugs.gentoo.org/show_bug.cgi?id=464188</url>
</references>
<dates>
<discovery>2013-04-02</discovery>
<entry>2013-04-16</entry>
</dates>
</vuln>
<vuln vid="a2ff483f-a5c6-11e2-9601-000d601460a4">
<topic>sieve-connect -- TLS hostname verification was not occurring</topic>
<affects>
<package>
<name>sieve-connect</name>
<range><lt>0.85</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>sieve-connect developer Phil Pennock reports:</p>
<blockquote cite="http://mail.globnix.net/pipermail/sieve-connect-announce/2013/000005.html">
<p>sieve-connect was not actually verifying TLS certificate identities
matched the expected hostname.</p>
</blockquote>
</body>
</description>
<references>
<url>http://mail.globnix.net/pipermail/sieve-connect-announce/2013/000005.html</url>
</references>
<dates>
<discovery>2013-04-14</discovery>
<entry>2013-04-15</entry>
</dates>
</vuln>
<vuln vid="15236023-a21b-11e2-a460-208984377b34">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.280</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb13-12.html">
<p>These updates address vulnerabilities that could cause a crash
and potentially allow an attacker to take control of the affected system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1383</cvename>
<cvename>CVE-2013-1384</cvename>
<cvename>CVE-2013-1385</cvename>
<cvename>CVE-2013-1386</cvename>
</references>
<dates>
<discovery>2013-04-09</discovery>
<entry>2013-04-10</entry>
</dates>
</vuln>
<vuln vid="db0c4b00-a24c-11e2-9601-000d601460a4">
<topic>rubygem-rails -- multiple vulnerabilities</topic>
<affects>
<package>
<name>rubygem-rails</name>
<range><lt>3.2.13</lt></range>
</package>
<package>
<name>rubygem-actionpack</name>
<range><lt>3.2.13</lt></range>
</package>
<package>
<name>rubygem-activerecord</name>
<range><lt>3.2.13</lt></range>
</package>
<package>
<name>rubygem-activesupport</name>
<range><lt>3.2.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby on Rails team reports:</p>
<blockquote cite="http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-3-2-13-3-1-12-and-2-3-18-have-been-released/">
<p>Rails versions 3.2.13 has been released. This release
contains important security fixes. It is recommended
users upgrade as soon as possible.</p>
<p>Four vulnerabilities have been discovered and fixed:</p>
<ol>
<li>(CVE-2013-1854) Symbol DoS vulnerability in Active Record</li>
<li>(CVE-2013-1855) XSS vulnerability in sanitize_css in Action Pack</li>
<li>(CVE-2013-1856) XML Parsing Vulnerability affecting JRuby users</li>
<li>(CVE-2013-1857) XSS Vulnerability in the `sanitize` helper of Ruby on Rails</li>
</ol>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1854</cvename>
<cvename>CVE-2013-1856</cvename>
<cvename>CVE-2013-1856</cvename>
<cvename>CVE-2013-1857</cvename>
<url>http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-3-2-13-3-1-12-and-2-3-18-have-been-released/</url>
<url>https://groups.google.com/forum/#!topic/ruby-security-ann/o0Dsdk2WrQ0</url>
<url>https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/4_QHo4BqnN8</url>
<url>https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/KZwsQbYsOiI</url>
<url>https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/zAAU7vGTPvI</url>
</references>
<dates>
<discovery>2013-03-18</discovery>
<entry>2013-04-10</entry>
</dates>
</vuln>
<vuln vid="1431f2d6-a06e-11e2-b9e0-001636d274f3">
<topic>NVIDIA UNIX driver -- ARGB cursor buffer overflow in "NoScanout" mode</topic>
<affects>
<package>
<name>nvidia-driver</name>
<range><ge>310.14</ge><lt>310.44</lt></range>
<range><ge>195.22</ge><lt>304.88</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVIDIA Unix security team reports:</p>
<blockquote cite="http://nvidia.custhelp.com/app/answers/detail/a_id/3290">
<p>When the NVIDIA driver for the X Window System is operated in
"NoScanout" mode, and an X client installs an ARGB cursor that
is larger than the expected size (64x64 or 256x256, depending on
the driver version), the driver will overflow a buffer. This
can cause a denial of service (e.g., an X server segmentation
fault), or could be exploited to achieve arbitrary code
execution. Because the X server runs as setuid root in many
configurations, an attacker could potentially use this
vulnerability in those configurations to gain root privileges.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-0131</cvename>
<url>http://nvidia.custhelp.com/app/answers/detail/a_id/3290</url>
</references>
<dates>
<discovery>2013-03-27</discovery>
<entry>2013-04-08</entry>
</dates>
</vuln>
<vuln vid="cebed39d-9e6f-11e2-b3f5-003067c2616f">
<topic>opera -- moderately severe issue</topic>
<affects>
<package>
<name>opera</name>
<range><lt>12.15</lt></range>
</package>
<package>
<name>opera-devel</name>
<range><lt>12.15</lt></range>
</package>
<package>
<name>linux-opera</name>
<range><lt>12.15</lt></range>
</package>
<package>
<name>linux-opera-devel</name>
<range><lt>12.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Opera reports:</p>
<blockquote cite="http://www.opera.com/support/kb/view/1042/">
<p>Fixed a moderately severe issue, as reported by Attila Suszte.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.opera.com/docs/changelogs/unified/1215/</url>
<url>http://www.opera.com/support/kb/view/1046/</url>
<url>http://www.opera.com/support/kb/view/1047/</url>
</references>
<dates>
<discovery>2013-04-04</discovery>
<entry>2014-04-30</entry>
</dates>
</vuln>
<vuln vid="b6beb137-9dc0-11e2-882f-20cf30e32f6d">
<topic>Subversion -- multiple vulnerabilities</topic>
<affects>
<package>
<name>subversion</name>
<range><ge>1.7.0</ge><lt>1.7.9</lt></range>
<range><ge>1.0.0</ge><lt>1.6.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Subversion team reports:</p>
<blockquote cite="http://subversion.apache.org/security/CVE-2013-1845-advisory.txt">
<p>Subversion's mod_dav_svn Apache HTTPD server module will use excessive
amounts of memory when a large number of properties are set or deleted
on a node.</p>
</blockquote>
<blockquote cite="http://subversion.apache.org/security/CVE-2013-1846-advisory.txt">
<p>Subversion's mod_dav_svn Apache HTTPD server module will crash when
a LOCK request is made against activity URLs.</p>
</blockquote>
<blockquote cite="http://subversion.apache.org/security/CVE-2013-1847-advisory.txt">
<p>Subversion's mod_dav_svn Apache HTTPD server module will crash in some
circumstances when a LOCK request is made against a non-existent URL.</p>
</blockquote>
<blockquote cite="http://subversion.apache.org/security/CVE-2013-1849-advisory.txt">
<p>Subversion's mod_dav_svn Apache HTTPD server module will crash when a
PROPFIND request is made against activity URLs.</p>
</blockquote>
<blockquote cite="http://subversion.apache.org/security/CVE-2013-1884-advisory.txt">
<p>Subversion's mod_dav_svn Apache HTTPD server module will crash when a
log REPORT request receives a limit that is out of the allowed range.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1845</cvename>
<cvename>CVE-2013-1846</cvename>
<cvename>CVE-2013-1847</cvename>
<cvename>CVE-2013-1849</cvename>
<cvename>CVE-2013-1884</cvename>
</references>
<dates>
<discovery>2013-04-05</discovery>
<entry>2013-04-05</entry>
</dates>
</vuln>
<vuln vid="eae8e3cf-9dfe-11e2-ac7f-001fd056c417">
<topic>otrs -- Information disclosure and Data manipulation</topic>
<affects>
<package>
<name>otrs</name>
<range><lt>3.1.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OTRS Project reports:</p>
<blockquote cite="http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-01/">
<p>An attacker with a valid agent login could manipulate URLs in the
object linking mechanism to see titles of tickets and other objects
that are not obliged to be seen. Furthermore, links to objects without
permission can be placed and removed.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2625</cvename>
<url>http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-01/</url>
</references>
<dates>
<discovery>2013-04-02</discovery>
<entry>2013-04-05</entry>
</dates>
</vuln>
<vuln vid="3f332f16-9b6b-11e2-8fe9-08002798f6ff">
<topic>PostgreSQL -- anonymous remote access data corruption vulnerability</topic>
<affects>
<package>
<name>postgresql-server</name>
<range><ge>8.3.0</ge><lt>8.3.21_1</lt></range>
<range><ge>8.4.0</ge><lt>8.4.17</lt></range>
<range><ge>9.0.0</ge><lt>9.0.13</lt></range>
<range><ge>9.1.0</ge><lt>9.1.9</lt></range>
<range><ge>9.2.0</ge><lt>9.2.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PostgreSQL project reports:</p>
<blockquote cite="http://www.postgresql.org/about/news/1456/">
<p>
The PostgreSQL Global Development Group has released a security
update to all current versions of the PostgreSQL database system,
including versions 9.2.4, 9.1.9, 9.0.13, and 8.4.17. This update
fixes a high-exposure security vulnerability in versions 9.0 and
later. All users of the affected versions are strongly urged to apply
the update *immediately*.
</p>
<p>
A major security issue (for versions 9.x only) fixed in this release,
[CVE-2013-1899](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1899),
makes it possible for a connection request containing a database name
that begins with "-" to be crafted that can damage or destroy files
within a server's data directory. Anyone with access to the port the
PostgreSQL server listens on can initiate this request. This issue was
discovered by Mitsumasa Kondo and Kyotaro Horiguchi of NTT Open Source
Software Center.
</p>
<p>
Two lesser security fixes are also included in this release:
[CVE-2013-1900](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1900),
wherein random numbers generated by contrib/pgcrypto functions may be
easy for another database user to guess (all versions), and
[CVE-2013-1901](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1901),
which mistakenly allows an unprivileged user to run commands that
could interfere with in-progress backups (for versions 9.x only).
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1899</cvename>
<cvename>CVE-2013-1900</cvename>
<cvename>CVE-2013-1901</cvename>
</references>
<dates>
<discovery>2013-04-04</discovery>
<entry>2013-04-04</entry>
</dates>
</vuln>
<vuln vid="94976433-9c74-11e2-a9fc-d43d7e0c7c02">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>18.0,1</gt><lt>20.0,1</lt></range>
<range><lt>17.0.5,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>17.0.5,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.17</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>17.0.5</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.17</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><gt>11.0</gt><lt>17.0.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2013-30 Miscellaneous memory safety hazards (rv:20.0 /
rv:17.0.5)</p>
<p>MFSA 2013-31 Out-of-bounds write in Cairo library</p>
<p>MFSA 2013-32 Privilege escalation through Mozilla Maintenance
Service</p>
<p>MFSA 2013-33 World read and write access to app_tmp directory on
Android</p>
<p>MFSA 2013-34 Privilege escalation through Mozilla Updater</p>
<p>MFSA 2013-35 WebGL crash with Mesa graphics driver on Linux</p>
<p>MFSA 2013-36 Bypass of SOW protections allows cloning of protected
nodes</p>
<p>MFSA 2013-37 Bypass of tab-modal dialog origin disclosure</p>
<p>MFSA 2013-38 Cross-site scripting (XSS) using timed history
navigations</p>
<p>MFSA 2013-39 Memory corruption while rendering grayscale PNG
images</p>
<p>MFSA 2013-40 Out-of-bounds array read in CERT_DecodeCertPackage</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-0788</cvename>
<cvename>CVE-2013-0789</cvename>
<cvename>CVE-2013-0790</cvename>
<cvename>CVE-2013-0791</cvename>
<cvename>CVE-2013-0792</cvename>
<cvename>CVE-2013-0793</cvename>
<cvename>CVE-2013-0794</cvename>
<cvename>CVE-2013-0795</cvename>
<cvename>CVE-2013-0796</cvename>
<cvename>CVE-2013-0797</cvename>
<cvename>CVE-2013-0798</cvename>
<cvename>CVE-2013-0799</cvename>
<cvename>CVE-2013-0800</cvename>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-30.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-31.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-32.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-33.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-34.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-35.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-36.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-37.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-38.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-39.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-40.html</url>
<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
</references>
<dates>
<discovery>2013-04-02</discovery>
<entry>2013-04-03</entry>
<modified>2013-04-08</modified>
</dates>
</vuln>
<vuln vid="13031d98-9bd1-11e2-a7be-8c705af55518">
<topic>FreeBSD -- BIND remote denial of service</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><gt>9.0</gt><lt>9.0_7</lt></range>
<range><gt>9.1</gt><lt>9.1_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="http://www.freebsd.org/security/advisories/FreeBSD-SA-13:04.bind.asc">
<p>A flaw in a library used by BIND allows an
attacker to deliberately cause excessive memory
consumption by the named(8) process. This
affects both recursive and authoritative
servers.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2266</cvename>
<freebsdsa>SA-13:04.bind</freebsdsa>
<url>https://kb.isc.org/article/AA-00871</url>
</references>
<dates>
<discovery>2013-04-02</discovery>
<entry>2013-04-02</entry>
</dates>
</vuln>
<vuln vid="69bfc852-9bd0-11e2-a7be-8c705af55518">
<topic>FreeBSD -- OpenSSL multiple vulnerabilities</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><gt>8.3</gt><lt>8.3_7</lt></range>
<range><gt>9.0</gt><lt>9.0_7</lt></range>
<range><gt>9.1</gt><lt>9.1_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="http://www.freebsd.org/security/advisories/FreeBSD-SA-13:03.openssl.asc">
<p>A flaw in the OpenSSL handling of OCSP response
verification could be exploited to cause a denial of
service attack.</p>
<p>OpenSSL has a weakness in the handling of CBC
ciphersuites in SSL, TLS and DTLS. The weakness could reveal
plaintext in a timing attack.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-0166</cvename>
<cvename>CVE-2013-0169</cvename>
<freebsdsa>SA-13:04.openssl</freebsdsa>
<url>http://www.openssl.org/news/secadv_20130205.txt</url>
</references>
<dates>
<discovery>2013-04-02</discovery>
<entry>2013-04-02</entry>
</dates>
</vuln>
<vuln vid="92f30415-9935-11e2-ad4c-080027ef73ec">
<topic>OpenVPN -- potential side-channel/timing attack when comparing HMACs</topic>
<affects>
<package>
<name>openvpn</name>
<range><lt>2.0.9_4</lt></range>
<range><ge>2.1.0</ge><lt>2.2.2_2</lt></range>
<range><ge>2.3.0</ge><lt>2.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenVPN project reports:</p>
<blockquote cite="https://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-f375aa67cc">
<p>OpenVPN 2.3.0 and earlier running in UDP mode are subject
to chosen ciphertext injection due to a non-constant-time
HMAC comparison function.</p>
</blockquote>
</body>
</description>
<references>
<url>https://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-f375aa67cc</url>
<cvename>CVE-2013-2061</cvename>
<url>http://www.openwall.com/lists/oss-security/2013/05/06/6</url>
<url>https://github.com/OpenVPN/openvpn/commit/11d21349a4e7e38a025849479b36ace7c2eec2ee</url>
</references>
<dates>
<discovery>2013-03-19</discovery>
<entry>2013-03-31</entry>
<modified>2013-06-01</modified>
</dates>
</vuln>
<vuln vid="843a4641-9816-11e2-9c51-080027019be0">
<topic>libxml2 -- cpu consumption Dos</topic>
<affects>
<package>
<name>libxml2</name>
<range><lt>2.8.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Kurt Seifried reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2013/q1/391">
<p>libxml2 is affected by the expansion of internal entities
(which can be used to consume resources) and external entities
(which can cause a denial of service against other services,
be used to port scan, etc.)..</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-0338</cvename>
<cvename>CVE-2013-0339</cvename>
<url>http://seclists.org/oss-sec/2013/q1/391</url>
<url>https://security-tracker.debian.org/tracker/CVE-2013-0338</url>
<url>https://security-tracker.debian.org/tracker/CVE-2013-0339</url>
</references>
<dates>
<discovery>2013-02-21</discovery>
<entry>2013-03-29</entry>
</dates>
</vuln>
<vuln vid="daf0a339-9850-11e2-879e-d43d7e0c7c02">
<topic>asterisk -- multiple vulnerabilities</topic>
<affects>
<package>
<name>asterisk11</name>
<range><gt>11.*</gt><lt>11.2.2</lt></range>
</package>
<package>
<name>asterisk10</name>
<range><gt>10.*</gt><lt>10.12.2</lt></range>
</package>
<package>
<name>asterisk18</name>
<range><gt>1.8.*</gt><lt>1.8.20.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/security">
<p>Buffer Overflow Exploit Through SIP SDP Header</p>
<p>Username disclosure in SIP channel driver</p>
<p>Denial of Service in HTTP server</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2685</cvename>
<cvename>CVE-2013-2686</cvename>
<cvename>CVE-2013-2264</cvename>
<url>http://downloads.asterisk.org/pub/security/AST-2013-001.html</url>
<url>http://downloads.asterisk.org/pub/security/AST-2013-002.html</url>
<url>http://downloads.asterisk.org/pub/security/AST-2013-003.html</url>
<url>https://www.asterisk.org/security</url>
</references>
<dates>
<discovery>2013-03-27</discovery>
<entry>2013-03-29</entry>
</dates>
</vuln>
<vuln vid="7a282e49-95b6-11e2-8433-0800273fe665">
<topic>dns/bind9* -- Malicious Regex Can Cause Memory Exhaustion</topic>
<affects>
<package>
<name>bind99</name>
<range><lt>9.9.2.2</lt></range>
</package>
<package>
<name>bind99-base</name>
<range><lt>9.9.2.2</lt></range>
</package>
<package>
<name>bind98</name>
<range><lt>9.8.4.2</lt></range>
</package>
<package>
<name>bind98-base</name>
<range><lt>9.8.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-00871">
<p>A critical defect in BIND 9 allows an attacker to cause
excessive memory consumption in named or other programs
linked to libdns.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2266</cvename>
</references>
<dates>
<discovery>2013-03-11</discovery>
<entry>2013-03-27</entry>
</dates>
</vuln>
<vuln vid="bdd48858-9656-11e2-a9a8-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>26.0.1410.43</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/search/Stable%20Updates">
<p>[172342] High CVE-2013-0916: Use-after-free in Web Audio. Credit
to Atte Kettunen of OUSPG.</p>
<p>[180909] Low CVE-2013-0917: Out-of-bounds read in URL loader.
Credit to Google Chrome Security Team (Cris Neckar).</p>
<p>[180555] Low CVE-2013-0918: Do not navigate dev tools upon drag
and drop. Credit to Vsevolod Vlasov of the Chromium development
community.</p>
<p>[Linux only] [178760] Medium CVE-2013-0919: Use-after-free with
pop-up windows in extensions. Credit to Google Chrome Security Team
(Mustafa Emre Acer).</p>
<p>[177410] Medium CVE-2013-0920: Use-after-free in extension
bookmarks API. Credit to Google Chrome Security Team (Mustafa Emre
Acer).</p>
<p>[174943] High CVE-2013-0921: Ensure isolated web sites run in
their own processes.</p>
<p>[174129] Low CVE-2013-0922: Avoid HTTP basic auth brute force
attempts. Credit to "t3553r".</p>
<p>[169981] [169972] [169765] Medium CVE-2013-0923: Memory safety
issues in the USB Apps API. Credit to Google Chrome Security Team
(Mustafa Emre Acer).</p>
<p>[169632] Low CVE-2013-0924: Check an extension's permissions API
usage again file permissions. Credit to Benjamin Kalman of the
Chromium development community.</p>
<p>[168442] Low CVE-2013-0925: Avoid leaking URLs to extensions
without the tabs permissions. Credit to Michael Vrable of
Google.</p>
<p>[112325] Medium CVE-2013-0926: Avoid pasting active tags in
certain situations. Credit to Subho Halder, Aditya Gupta, and Dev
Kar of xys3c (xysec.com).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-0916</cvename>
<cvename>CVE-2013-0917</cvename>
<cvename>CVE-2013-0918</cvename>
<cvename>CVE-2013-0919</cvename>
<cvename>CVE-2013-0920</cvename>
<cvename>CVE-2013-0921</cvename>
<cvename>CVE-2013-0922</cvename>
<cvename>CVE-2013-0923</cvename>
<cvename>CVE-2013-0924</cvename>
<cvename>CVE-2013-0925</cvename>
<cvename>CVE-2013-0926</cvename>
<url>http://googlechromereleases.blogspot.nl/search/Stable%20Updates</url>
</references>
<dates>
<discovery>2013-03-26</discovery>
<entry>2013-03-26</entry>
</dates>
</vuln>
<vuln vid="6adca5e9-95d2-11e2-8549-68b599b52a02">
<topic>firebird -- Remote Stack Buffer Overflow</topic>
<affects>
<package>
<name>firebird25-server</name>
<range><ge>2.5.0</ge><le>2.5.2</le></range>
</package>
<package>
<name>firebird21-server</name>
<range><ge>2.1.0</ge><le>2.1.5</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Firebird Project reports:</p>
<blockquote cite="http://tracker.firebirdsql.org/browse/CORE-4058">
<p>The FirebirdSQL server is vulnerable to a stack buffer overflow
that can be triggered when an unauthenticated user sends a
specially crafted packet. The result can lead to remote code
execution as the user which runs the FirebirdSQL server.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2492</cvename>
<url>https://gist.github.com/zeroSteiner/85daef257831d904479c</url>
</references>
<dates>
<discovery>2013-01-31</discovery>
<entry>2013-03-06</entry>
</dates>
</vuln>
<vuln vid="a8818f7f-9182-11e2-9bdf-d48564727302">
<topic>optipng -- use-after-free vulnerability</topic>
<affects>
<package>
<name>optipng</name>
<range><ge>0.7</ge><lt>0.7.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="https://secunia.com/advisories/50654">
<p>A vulnerability has been reported in OptiPNG, which can be
exploited by malicious people to potentially compromise a user's
system.</p>
<p>The vulnerability is caused due to a use-after-free error related
to the palette reduction functionality. No further information is
currently available.</p>
<p>Success exploitation may allow execution of arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-4432</cvename>
<url>https://secunia.com/advisories/50654</url>
</references>
<dates>
<discovery>2012-09-16</discovery>
<entry>2013-03-21</entry>
</dates>
</vuln>
<vuln vid="1d23109a-9005-11e2-9602-d43d7e0c7c02">
<topic>php5 -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>php5</name>
<range><lt>5.4.13</lt></range>
</package>
<package>
<name>php53</name>
<range><lt>5.3.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP development team reports:</p>
<blockquote cite="http://www.php.net/ChangeLog-5.php">
<p>PHP does not validate the relationship between the soap.wsdl_cache_dir
directive and the open_basedir directive, which allows remote attackers to
bypass intended access restrictions by triggering the creation of cached
SOAP WSDL files in an arbitrary directory.</p>
<p>The SOAP parser in PHP allows remote attackers to read arbitrary files
via a SOAP WSDL file containing an XML external entity declaration in
conjunction with an entity reference, related to an XML External Entity
(XXE) issue in the soap_xmlParseFile and soap_xmlParseMemory functions.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1635</cvename>
<cvename>CVE-2013-1643</cvename>
</references>
<dates>
<discovery>2013-03-04</discovery>
<entry>2013-03-18</entry>
</dates>
</vuln>
<vuln vid="edd201a5-8fc3-11e2-b131-000c299b62e1">
<topic>piwigo -- CSRF/Path Traversal</topic>
<affects>
<package>
<name>piwigo</name>
<range><lt>2.4.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>High-Tech Bridge Security Research Lab reports:</p>
<blockquote cite="http://piwigo.org/releases/2.4.7">
<p>The CSRF vulnerability exists due to insufficient verification of the
HTTP request origin in "/admin.php" script. A remote attacker can trick
a logged-in administrator to visit a specially crafted webpage and
create arbitrary PHP file on the remote server.</p>
<p>The path traversal vulnerability exists due to insufficient filtration
of user-supplied input in "dl" HTTP GET parameter passed to
"/install.php" script. The script is present on the system after
installation by default, and can be accessed by attacker without any
restrictions.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1468</cvename>
<cvename>CVE-2013-1469</cvename>
<url>http://piwigo.org/bugs/view.php?id=0002843</url>
<url>http://piwigo.org/bugs/view.php?id=0002844</url>
<url>http://dl.packetstormsecurity.net/1302-exploits/piwigo246-traversalxsrf.txt</url>
</references>
<dates>
<discovery>2013-02-06</discovery>
<entry>2013-03-18</entry>
</dates>
</vuln>
<vuln vid="d881d254-70c6-11e2-862d-080027a5ec9a">
<topic>libexif -- multiple remote vulnerabilities</topic>
<affects>
<package>
<name>libexif</name>
<range><lt>0.6.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libexif project security advisory:</p>
<blockquote cite="http://sourceforge.net/mailarchive/message.php?msg_id=29534027">
<p>A number of remotely exploitable issues were discovered in libexif
and exif, with effects ranging from information leakage to potential
remote code execution.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2812</cvename>
<cvename>CVE-2012-2813</cvename>
<cvename>CVE-2012-2814</cvename>
<cvename>CVE-2012-2836</cvename>
<cvename>CVE-2012-2837</cvename>
<cvename>CVE-2012-2840</cvename>
<cvename>CVE-2012-2841</cvename>
<cvename>CVE-2012-2845</cvename>
<bid>54437</bid>
</references>
<dates>
<discovery>2012-07-12</discovery>
<entry>2013-03-13</entry>
</dates>
</vuln>
<vuln vid="5ff40cb4-8b92-11e2-bdb6-001060e06fd4">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.275</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb13-09.html">
<p>These updates address vulnerabilities that could cause a crash
and potentially allow an attacker to take control of the affected system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-0646</cvename>
<cvename>CVE-2013-0650</cvename>
<cvename>CVE-2013-1371</cvename>
<cvename>CVE-2013-1375</cvename>
</references>
<dates>
<discovery>2013-03-12</discovery>
<entry>2013-03-12</entry>
</dates>
</vuln>
<vuln vid="cda566a0-2df0-4eb0-b70e-ed7a6fb0ab3c">
<topic>puppet27 and puppet -- multiple vulnerabilities</topic>
<affects>
<package>
<name>puppet</name>
<range><ge>3.0</ge><lt>3.1.1</lt></range>
</package>
<package>
<name>puppet27</name>
<range><ge>2.7</ge><lt>2.7.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Moses Mendoza reports:</p>
<blockquote cite="https://puppetlabs.com/blog/security-updates-new-releases-of-puppet-and-puppet-enterprise/">
<p>A vulnerability found in Puppet could allow an authenticated client
to cause the master to execute arbitrary code while responding to a
catalog request. Specifically, in order to exploit the
vulnerability, the puppet master must be made to invoke the
'template' or 'inline_template' functions during catalog compilation.
</p>
<p>A vulnerability found in Puppet could allow an authenticated client
to connect to a puppet master and perform unauthorized actions.
Specifically, given a valid certificate and private key, an agent
could retrieve catalogs from the master that it is not authorized
to access or it could poison the puppet master's caches for any
puppet-generated data that supports caching such as catalogs,
nodes, facts, and resources. The extent and severity of this
vulnerability varies depending on the specific configuration of the
master: for example, whether it is using storeconfigs or not, which
version, whether it has access to the cache or not, etc.
</p>
<p>A vulnerability has been found in Puppet which could allow
authenticated clients to execute arbitrary code on agents that have
been configured to accept kick connections. This vulnerability is
not present in the default configuration of puppet agents, but if
they have been configured to listen for incoming connections
('listen=true'), and the agent's auth.conf has been configured to
allow access to the `run` REST endpoint, then a client could
construct an HTTP request which could execute arbitrary code. The
severity of this issue is exacerbated by the fact that puppet
agents typically run as root.
</p>
<p>A vulnerability has been found in Puppet that could allow a client
negotiating a connection to a master to downgrade the master's
SSL protocol to SSLv2. This protocol has been found to contain
design weaknesses. This issue only affects systems running older
versions (pre 1.0.0) of openSSL. Newer versions explicitly disable
SSLv2.
</p>
<p>A vulnerability found in Puppet could allow unauthenticated clients
to send requests to the puppet master which would cause it to load
code unsafely. While there are no reported exploits, this
vulnerability could cause issues like those described in Rails
CVE-2013-0156. This vulnerability only affects puppet masters
running Ruby 1.9.3 and higher.
</p>
<p>This vulnerability affects puppet masters 0.25.0 and above. By
default, auth.conf allows any authenticated node to submit a report
for any other node. This can cause issues with compliance. The
defaults in auth.conf have been changed.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1640</cvename>
<cvename>CVE-2013-1652</cvename>
<cvename>CVE-2013-1653</cvename>
<cvename>CVE-2013-1654</cvename>
<cvename>CVE-2013-1655</cvename>
<cvename>CVE-2013-2275</cvename>
<url>https://puppetlabs.com/security/cve/cve-2013-1640/</url>
<url>https://puppetlabs.com/security/cve/cve-2013-1652/</url>
<url>https://puppetlabs.com/security/cve/cve-2013-1653/</url>
<url>https://puppetlabs.com/security/cve/cve-2013-1654/</url>
<url>https://puppetlabs.com/security/cve/cve-2013-1655/</url>
<url>https://puppetlabs.com/security/cve/cve-2013-2275/</url>
<url>https://groups.google.com/forum/?fromgroups=#!topic/puppet-announce/f_gybceSV6E</url>
<url>https://groups.google.com/forum/?fromgroups=#!topic/puppet-announce/kgDyaPhHniw</url>
</references>
<dates>
<discovery>2013-03-13</discovery>
<entry>2013-03-13</entry>
</dates>
</vuln>
<vuln vid="04042f95-14b8-4382-a8b9-b30e365776cf">
<topic>puppet26 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>puppet26</name>
<range><ge>2.6</ge><lt>2.6.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Moses Mendoza reports:</p>
<blockquote cite="https://puppetlabs.com/blog/security-updates-new-releases-of-puppet-and-puppet-enterprise/">
<p>A vulnerability found in Puppet could allow an authenticated client
to cause the master to execute arbitrary code while responding to a
catalog request. Specifically, in order to exploit the
vulnerability, the puppet master must be made to invoke the
'template' or 'inline_template' functions during catalog compilation.
</p>
<p>A vulnerability found in Puppet could allow an authenticated client
to connect to a puppet master and perform unauthorized actions.
Specifically, given a valid certificate and private key, an agent
could retrieve catalogs from the master that it is not authorized
to access or it could poison the puppet master's caches for any
puppet-generated data that supports caching such as catalogs,
nodes, facts, and resources. The extent and severity of this
vulnerability varies depending on the specific configuration of the
master: for example, whether it is using storeconfigs or not, which
version, whether it has access to the cache or not, etc.
</p>
<p>A vulnerability has been found in Puppet that could allow a client
negotiating a connection to a master to downgrade the master's
SSL protocol to SSLv2. This protocol has been found to contain
design weaknesses. This issue only affects systems running older
versions (pre 1.0.0) of openSSL. Newer versions explicitly disable
SSLv2.
</p>
<p>A vulnerability found in Puppet could allow an authenticated client
to execute arbitrary code on a puppet master that is running in the
default configuration, or an agent with `puppet kick` enabled.
Specifically, a properly authenticated and connected puppet agent
could be made to construct an HTTP PUT request for an authorized
report that actually causes the execution of arbitrary code on the
master.
</p>
<p>This vulnerability affects puppet masters 0.25.0 and above. By
default, auth.conf allows any authenticated node to submit a report
for any other node. This can cause issues with compliance. The
defaults in auth.conf have been changed.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1640</cvename>
<cvename>CVE-2013-1652</cvename>
<cvename>CVE-2013-1654</cvename>
<cvename>CVE-2013-2274</cvename>
<cvename>CVE-2013-2275</cvename>
<url>https://puppetlabs.com/security/cve/cve-2013-1640/</url>
<url>https://puppetlabs.com/security/cve/cve-2013-1652/</url>
<url>https://puppetlabs.com/security/cve/cve-2013-1654/</url>
<url>https://puppetlabs.com/security/cve/cve-2013-2274/</url>
<url>https://puppetlabs.com/security/cve/cve-2013-2275/</url>
</references>
<dates>
<discovery>2013-03-13</discovery>
<entry>2013-03-13</entry>
</dates>
</vuln>
<vuln vid="68c1f75b-8824-11e2-9996-c48508086173">
<topic>perl -- denial of service via algorithmic complexity attack on hashing routines</topic>
<affects>
<package>
<name>perl</name>
<range><lt>5.12.4_5</lt></range>
<range><ge>5.14.0</ge><lt>5.14.2_3</lt></range>
<range><ge>5.16.0</ge><lt>5.16.2_1</lt></range>
</package>
<package>
<name>perl-threaded</name>
<range><lt>5.12.4_5</lt></range>
<range><ge>5.14.0</ge><lt>5.14.2_3</lt></range>
<range><ge>5.16.0</ge><lt>5.16.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Perl developers report:</p>
<blockquote cite="http://www.nntp.perl.org/group/perl.perl5.porters/2013/03/msg199755.html">
<p>In order to prevent an algorithmic complexity attack
against its hashing mechanism, perl will sometimes
recalculate keys and redistribute the contents of a hash.
This mechanism has made perl robust against attacks that
have been demonstrated against other systems.</p>
<p>Research by Yves Orton has recently uncovered a flaw in
the rehashing code which can result in pathological
behavior. This flaw could be exploited to carry out a
denial of service attack against code that uses arbitrary
user input as hash keys.</p>
<p>Because using user-provided strings as hash keys is a
very common operation, we urge users of perl to update their
perl executable as soon as possible.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1667</cvename>
<url>http://www.nntp.perl.org/group/perl.perl5.porters/2013/03/msg199755.html</url>
</references>
<dates>
<discovery>2013-03-04</discovery>
<entry>2013-03-10</entry>
</dates>
</vuln>
<vuln vid="549787c1-8916-11e2-8549-68b599b52a02">
<topic>libpurple -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libpurple</name>
<range><lt>2.10.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Pidgin reports:</p>
<blockquote cite="https://developer.pidgin.im/wiki/ChangeLog">
<p>libpurple</p>
<p>Fix a crash when receiving UPnP responses with abnormally long values.</p>
<p>MXit</p>
<p>Fix two bugs where a remote MXit user could possibly specify a local file
path to be written to.</p>
<p>Fix a bug where the MXit server or a man-in-the-middle could potentially
send specially crafted data that could overflow a buffer and lead to a crash
or remote code execution.</p>
<p>Sametime</p>
<p>Fix a crash in Sametime when a malicious server sends us an abnormally long
user ID.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-0274</cvename>
<cvename>CVE-2013-0271</cvename>
<cvename>CVE-2013-0272</cvename>
<cvename>CVE-2013-0273</cvename>
<url>https://developer.pidgin.im/wiki/ChangeLog</url>
</references>
<dates>
<discovery>2013-02-13</discovery>
<entry>2013-03-10</entry>
<modified>2013-03-16</modified>
</dates>
</vuln>
<vuln vid="630c8c08-880f-11e2-807f-d43d7e0c7c02">
<topic>mozilla -- use-after-free in HTML Editor</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>18.0,1</gt><lt>19.0.2,1</lt></range>
<range><lt>17.0.3,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>17.0.4,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.16.1</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>17.0.4</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.16.1</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><gt>11.0</gt><lt>17.0.4</lt></range>
<range><lt>10.0.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2013-29 Use-after-free in HTML Editor</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-0787</cvename>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-29.html</url>
<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
</references>
<dates>
<discovery>2013-03-07</discovery>
<entry>2013-03-08</entry>
</dates>
</vuln>
<vuln vid="54bed676-87ce-11e2-b528-00262d5ed8ee">
<topic>chromium -- WebKit vulnerability</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>25.0.1364.160</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/search/Stable%20Updates">
<p>[180763] High CVE-2013-0912: Type confusion in WebKit. Credit to
Nils and Jon of MWR Labs.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-0912</cvename>
<url>http://googlechromereleases.blogspot.nl/search/Stable%20Updates</url>
</references>
<dates>
<discovery>2013-03-07</discovery>
<entry>2013-03-08</entry>
</dates>
</vuln>
<vuln vid="b9a347ac-8671-11e2-b73c-0019d18c446a">
<topic>typo3 -- Multiple vulnerabilities in TYPO3 Core</topic>
<affects>
<package>
<name>typo3</name>
<range><ge>4.5.0</ge><lt>4.5.23</lt></range>
<range><ge>4.6.0</ge><lt>4.6.16</lt></range>
<range><ge>4.7.0</ge><lt>4.7.8</lt></range>
<range><ge>6.0.0</ge><lt>6.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Typo Security Team reports:</p>
<blockquote cite="http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-001/">
<p>Extbase Framework - Failing to sanitize user input, the Extbase
database abstraction layer is susceptible to SQL Injection. TYPO3
sites which have no Extbase extensions installed are not affected.
Extbase extensions are affected if they use the Query Object Model
and relation values are user generated input. Credits go to Helmut
Hummel and Markus Opahle who discovered and reported the issue.</p>
<p>Access tracking mechanism - Failing to validate user provided
input, the access tracking mechanism allows redirects to arbitrary
URLs. To fix this vulnerability, we had to break existing
behaviour of TYPO3 sites that use the access tracking mechanism
(jumpurl feature) to transform links to external sites. The link
generation has been changed to include a hash that is checked
before redirecting to an external URL. This means that old links
that have been distributed (e.g. by a newsletter) will not work
any more.</p>
</blockquote>
</body>
</description>
<references>
<url>http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-001/</url>
</references>
<dates>
<discovery>2013-03-06</discovery>
<entry>2013-03-06</entry>
</dates>
</vuln>
<vuln vid="40d5ab37-85f2-11e2-b528-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>25.0.1364.152</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/search/Stable%20Updates">
<p>[176882] High CVE-2013-0902: Use-after-free in frame loader.
Credit to Chamal de Silva.</p>
<p>[176252] High CVE-2013-0903: Use-after-free in browser navigation
handling. Credit to "chromium.khalil".</p>
<p>[172926] [172331] High CVE-2013-0904: Memory corruption in Web
Audio. Credit to Atte Kettunen of OUSPG.</p>
<p>[168982] High CVE-2013-0905: Use-after-free with SVG animations.
Credit to Atte Kettunen of OUSPG.</p>
<p>[174895] High CVE-2013-0906: Memory corruption in Indexed DB.
Credit to Google Chrome Security Team (Juri Aedla).</p>
<p>[174150] Medium CVE-2013-0907: Race condition in media thread
handling. Credit to Andrew Scherkus of the Chromium development
community.</p>
<p>[174059] Medium CVE-2013-0908: Incorrect handling of bindings for
extension processes.</p>
<p>[173906] Low CVE-2013-0909: Referer leakage with XSS Auditor.
Credit to Egor Homakov.</p>
<p>[172573] Medium CVE-2013-0910: Mediate renderer -&gt; browser
plug-in loads more strictly. Credit to Google Chrome Security Team
(Chris Evans).</p>
<p>[172264] High CVE-2013-0911: Possible path traversal in database
handling. Credit to Google Chrome Security Team (Juri Aedla).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-0902</cvename>
<cvename>CVE-2013-0903</cvename>
<cvename>CVE-2013-0904</cvename>
<cvename>CVE-2013-0905</cvename>
<cvename>CVE-2013-0906</cvename>
<cvename>CVE-2013-0907</cvename>
<cvename>CVE-2013-0908</cvename>
<cvename>CVE-2013-0909</cvename>
<cvename>CVE-2013-0910</cvename>
<cvename>CVE-2013-0911</cvename>
<url>http://googlechromereleases.blogspot.nl/search/Stable%20Updates</url>
</references>
<dates>
<discovery>2013-03-04</discovery>
<entry>2013-03-06</entry>
</dates>
</vuln>
<vuln vid="c97219b6-843d-11e2-b131-000c299b62e1">
<topic>stunnel -- Remote Code Execution</topic>
<affects>
<package>
<name>stunnel</name>
<range><ge>4.21</ge><lt>4.55</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Michal Trojnara reports:</p>
<blockquote cite="https://www.stunnel.org/CVE-2013-1762.html">
<p>64-bit versions of stunnel with the following conditions:
* NTLM authentication enabled
* CONNECT protocol negotiation enabled
* Configured in SSL client mode
* An attacker that can either control the proxy server specified in
the "connect" option or execute MITM attacks on the TCP session
between stunnel and the proxy</p>
<p>Can be exploited for remote code execution. The code is executed
within the configured chroot directory, with privileges of the
configured user and group.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1762</cvename>
<url>https://www.stunnel.org/CVE-2013-1762.html</url>
</references>
<dates>
<discovery>2013-03-03</discovery>
<entry>2013-03-03</entry>
</dates>
</vuln>
<vuln vid="9c88d8a8-8372-11e2-a010-20cf30e32f6d">
<topic>apache22 -- several vulnerabilities</topic>
<affects>
<package>
<name>apache22</name>
<range><gt>2.2.0</gt><lt>2.2.24</lt></range>
</package>
<package>
<name>apache22-event-mpm</name>
<range><gt>2.2.0</gt><lt>2.2.24</lt></range>
</package>
<package>
<name>apache22-itk-mpm</name>
<range><gt>2.2.0</gt><lt>2.2.24</lt></range>
</package>
<package>
<name>apache22-peruser-mpm</name>
<range><gt>2.2.0</gt><lt>2.2.24</lt></range>
</package>
<package>
<name>apache22-worker-mpm</name>
<range><gt>2.2.0</gt><lt>2.2.24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Apache HTTP SERVER PROJECT reports:</h1>
<blockquote cite="http://httpd.apache.org/security/vulnerabilities_22.html">
<h1>low: XSS due to unescaped hostnames CVE-2012-3499</h1>
<p>Various XSS flaws due to unescaped hostnames and URIs HTML output in
mod_info, mod_status, mod_imagemap, mod_ldap, and mod_proxy_ftp.</p>
<h1>moderate: XSS in mod_proxy_balancer CVE-2012-4558</h1>
<p>A XSS flaw affected the mod_proxy_balancer manager interface.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3499</cvename>
<cvename>CVE-2012-4558</cvename>
</references>
<dates>
<discovery>2012-10-07</discovery>
<entry>2013-03-02</entry>
</dates>
</vuln>
<vuln vid="764344fb-8214-11e2-9273-902b343deec9">
<topic>sudo -- Authentication bypass when clock is reset</topic>
<affects>
<package>
<name>sudo</name>
<range><lt>1.8.6.p7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Todd Miller reports:</p>
<blockquote cite="http://www.sudo.ws/sudo/alerts/epoch_ticket.html">
<p>The flaw may allow someone with physical access to a machine that
is not password-protected to run sudo commands without knowing the
logged in user's password. On systems where sudo is the principal
way of running commands as root, such as on Ubuntu and Mac OS X,
there is a greater chance that the logged in user has run sudo
before and thus that an attack would succeed.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1775</cvename>
<url>http://www.sudo.ws/sudo/alerts/epoch_ticket.html</url>
</references>
<dates>
<discovery>2013-02-27</discovery>
<entry>2013-03-01</entry>
</dates>
</vuln>
<vuln vid="82cfd919-8213-11e2-9273-902b343deec9">
<topic>sudo -- Potential bypass of tty_tickets constraints</topic>
<affects>
<package>
<name>sudo</name>
<range><lt>1.8.6.p7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Todd Miller reports:</p>
<blockquote cite="http://www.sudo.ws/sudo/alerts/tty_tickets.html">
<p>A (potentially malicious) program run by a user with sudo access
may be able to bypass the "tty_ticket" constraints. In order for
this to succeed there must exist on the machine a terminal device
that the user has previously authenticated themselves on via sudo
within the last time stamp timeout (5 minutes by default).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1776</cvename>
<url>http://www.sudo.ws/sudo/alerts/tty_tickets.html</url>
</references>
<dates>
<discovery>2013-02-27</discovery>
<entry>2013-03-01</entry>
</dates>
</vuln>
<vuln vid="aa7764af-0b5e-4ddc-bc65-38ad697a484f">
<topic>rubygem-dragonfly -- arbitrary code execution</topic>
<affects>
<package>
<name>rubygem18-dragonfly</name>
<name>rubygem19-dragonfly</name>
<name>rubygem20-dragonfly</name>
<range><lt>0.9.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mark Evans reports:</p>
<blockquote cite="https://groups.google.com/forum/?fromgroups=#!topic/dragonfly-users/3c3WIU3VQTo">
<p>Unfortnately there is a security vulnerability in Dragonfly when
used with Rails which would potentially allow an attacker to run
arbitrary code on a host machine using carefully crafted
requests.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1756</cvename>
</references>
<dates>
<discovery>2013-02-19</discovery>
<entry>2013-02-28</entry>
</dates>
</vuln>
<vuln vid="dbdac023-80e1-11e2-9a29-001060e06fd4">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.273</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://www.adobe.com/support/security/bulletins/apsb13-08.html">
<p>These updates address vulnerabilities that could cause a crash
and potentially allow an attacker to take control of the affected system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-0504</cvename>
<cvename>CVE-2013-0643</cvename>
<cvename>CVE-2013-0648</cvename>
</references>
<dates>
<discovery>2013-02-26</discovery>
<entry>2013-02-27</entry>
</dates>
</vuln>
<vuln vid="84065569-7fb4-11e2-9c5a-000d601460a4">
<topic>otrs -- XSS vulnerability could lead to remote code execution</topic>
<affects>
<package>
<name>otrs</name>
<range><ge>3.1.*</ge><lt>3.1.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OTRS Project reports:</p>
<blockquote cite="http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-03">
<p>This advisory covers vulnerabilities discovered in the OTRS core
system. This is a variance of the XSS vulnerability, where an attacker
could send a specially prepared HTML email to OTRS which would cause
JavaScript code to be executed in your browser while displaying the
email. In this case this is achieved by using javascript source
attributes with whitespaces.</p>
<p>Affected by this vulnerability are all releases of OTRS 2.4.x up to
and including 2.4.14, 3.0.x up to and including 3.0.16 and 3.1.x up to
and including 3.1.10.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-4751</cvename>
<url>http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-03</url>
</references>
<dates>
<discovery>2012-10-16</discovery>
<entry>2013-02-25</entry>
</dates>
</vuln>
<vuln vid="d60199df-7fb3-11e2-9c5a-000d601460a4">
<topic>otrs -- XSS vulnerability in Firefox and Opera could lead to remote code execution</topic>
<affects>
<package>
<name>otrs</name>
<range><ge>3.1.*</ge><lt>3.1.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OTRS Project reports:</p>
<blockquote cite="http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-02/">
<p>This advisory covers vulnerabilities discovered in the OTRS core
system. This is a variance of the XSS vulnerability, where an attacker
could send a specially prepared HTML email to OTRS which would cause
JavaScript code to be executed in your browser while displaying the
email in Firefox and Opera. In this case this is achieved with an
invalid HTML structure with nested tags.</p>
<p>Affected by this
vulnerability are all releases of OTRS 2.4.x up to and including
2.4.13, 3.0.x up to and including 3.0.15 and 3.1.x up to and including
3.1.9 in combination with Firefox and Opera.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-4600</cvename>
<url>http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-02</url>
</references>
<dates>
<discovery>2012-08-30</discovery>
<entry>2013-02-25</entry>
</dates>
</vuln>
<vuln vid="b50cbbc0-7fb2-11e2-9c5a-000d601460a4">
<topic>otrs -- XSS vulnerability in Internet Explorer could lead to remote code execution</topic>
<affects>
<package>
<name>otrs</name>
<range><ge>3.1.*</ge><lt>3.1.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OTRS Project reports:</p>
<blockquote cite="http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-01">
<p>This advisory covers vulnerabilities discovered in the OTRS core
system. Due to the XSS vulnerability in Internet Explorer an attacker
could send a specially prepared HTML email to OTRS which would cause
JavaScript code to be executed in your Internet Explorer while
displaying the email.</p>
<p>Affected by this vulnerability are all releases of OTRS 2.4.x up to
and including 2.4.12, 3.0.x up to and including 3.0.14 and 3.1.x up to
and including 3.1.8 in combination with Internet Explorer.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2582</cvename>
<url>http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-01</url>
</references>
<dates>
<discovery>2012-08-22</discovery>
<entry>2013-02-25</entry>
</dates>
</vuln>
<vuln vid="844cf3f5-9259-4b3e-ac9e-13ca17333ed7">
<topic>ruby -- DoS vulnerability in REXML</topic>
<affects>
<package>
<name>ruby</name>
<range><ge>1.9,1</ge><lt>1.9.3.392,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby developers report:</p>
<blockquote cite="http://www.ruby-lang.org/en/news/2013/02/22/rexml-dos-2013-02-22/">
<p>Unrestricted entity expansion can lead to a DoS vulnerability in
REXML. (The CVE identifier will be assigned later.) We strongly
recommend to upgrade ruby.
</p>
<p>When reading text nodes from an XML document, the REXML parser can
be coerced in to allocating extremely large string objects which
can consume all of the memory on a machine, causing a denial of
service.
</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.ruby-lang.org/en/news/2013/02/22/rexml-dos-2013-02-22/</url>
</references>
<dates>
<discovery>2013-02-22</discovery>
<entry>2013-02-24</entry>
</dates>
</vuln>
<vuln vid="e1aa3bdd-839a-4a77-8617-cca439a8f9fc">
<topic>rubygem-ruby_parser -- insecure tmp file usage</topic>
<affects>
<package>
<name>rubygem18-ruby_parser</name>
<name>rubygem19-ruby_parser</name>
<name>rubygem20-ruby_parser</name>
<range><lt>3.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Michael Scherer reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2013/q1/393">
<p>This is a relatively minor tmp file usage issue.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-0162</cvename>
</references>
<dates>
<discovery>2013-02-24</discovery>
<entry>2013-02-24</entry>
</dates>
</vuln>
<vuln vid="21c59f5e-7cc5-11e2-9c11-080027a5ec9a">
<topic>django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py26-django</name>
<name>py27-django</name>
<range><ge>1.3</ge><lt>1.3.6</lt></range>
<range><ge>1.4</ge><lt>1.4.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Django Project reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2013/feb/19/security/">
<p>These security releases fix four issues: one potential phishing
vector, one denial-of-service vector, an information leakage issue,
and a range of XML vulnerabilities.</p>
<ol>
<li>
<p>Host header poisoning</p>
<p>an attacker could cause Django to generate and display URLs that
link to arbitrary domains. This could be used as part of a phishing
attack. These releases fix this problem by introducing a new
setting, ALLOWED_HOSTS, which specifies a whitelist of domains your
site is known to respond to.</p>
<p>Important: by default Django 1.3.6 and 1.4.4 set ALLOWED_HOSTS to
allow all hosts. This means that to actually fix the security
vulnerability you should define this setting yourself immediately
after upgrading.</p>
</li>
<li>
<p>Formset denial-of-service</p>
<p>an attacker can abuse Django's tracking of the number of forms in
a formset to cause a denial-of-service attack. This has been fixed
by adding a default maximum number of forms of 1,000. You can still
manually specify a bigger max_num, if you wish, but 1,000 should be
enough for anyone.</p>
</li>
<li>
<p>XML attacks</p>
<p>Django's serialization framework was vulnerable to attacks via XML
entity expansion and external references; this is now fixed.
However, if you're parsing arbitrary XML in other parts of your
application, we recommend you look into the defusedxml Python
packages which remedy this anywhere you parse XML, not just via
Django's serialization framework.</p>
</li>
<li>
<p>Data leakage via admin history log</p>
<p>Django's admin interface could expose supposedly-hidden
information via its history log. This has been fixed.</p>
</li>
</ol>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1664</cvename>
<cvename>CVE-2013-1665</cvename>
<cvename>CVE-2013-0305</cvename>
<cvename>CVE-2013-0306</cvename>
<bid>58022</bid>
<bid>58061</bid>
</references>
<dates>
<discovery>2013-02-21</discovery>
<entry>2013-02-24</entry>
</dates>
</vuln>
<vuln vid="dfd92cb2-7d48-11e2-ad48-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>25.0.1364.97</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/search/label/Stable%20updates">
<p>[172243] High CVE-2013-0879: Memory corruption with web audio
node. Credit to Atte Kettunen of OUSPG.</p>
<p>[171951] High CVE-2013-0880: Use-after-free in database handling.
Credit to Chamal de Silva.</p>
<p>[167069] Medium CVE-2013-0881: Bad read in Matroska handling.
Credit to Atte Kettunen of OUSPG.</p>
<p>[165432] High CVE-2013-0882: Bad memory access with excessive SVG
parameters. Credit to Renata Hodovan.</p>
<p>[142169] Medium CVE-2013-0883: Bad read in Skia. Credit to Atte
Kettunen of OUSPG.</p>
<p>[172984] Low CVE-2013-0884: Inappropriate load of NaCl. Credit to
Google Chrome Security Team (Chris Evans).</p>
<p>[172369] Medium CVE-2013-0885: Too many API permissions granted to
web store.</p>
<p>[171065] [170836] Low CVE-2013-0887: Developer tools process has
too many permissions and places too much trust in the connected
server.</p>
<p>[170666] Medium CVE-2013-0888: Out-of-bounds read in Skia. Credit
to Google Chrome Security Team (Inferno).</p>
<p>[170569] Low CVE-2013-0889: Tighten user gesture check for
dangerous file downloads.</p>
<p>[169973] [169966] High CVE-2013-0890: Memory safety issues across
the IPC layer. Credit to Google Chrome Security Team (Chris
Evans).</p>
<p>[169685] High CVE-2013-0891: Integer overflow in blob handling.
Credit to Google Chrome Security Team (Jüri Aedla).</p>
<p>[169295] [168710] [166493] [165836] [165747] [164958] [164946]
Medium CVE-2013-0892: Lower severity issues across the IPC layer.
Credit to Google Chrome Security Team (Chris Evans).</p>
<p>[168570] Medium CVE-2013-0893: Race condition in media handling.
Credit to Andrew Scherkus of the Chromium development community.</p>
<p>[168473] High CVE-2013-0894: Buffer overflow in vorbis decoding.
Credit to Google Chrome Security Team (Inferno).</p>
<p>[Linux / Mac] [167840] High CVE-2013-0895: Incorrect path handling
in file copying. Credit to Google Chrome Security Team (Jüri
Aedla).</p>
<p>[166708] High CVE-2013-0896: Memory management issues in plug-in
message handling. Credit to Google Chrome Security Team (Cris
Neckar).</p>
<p>[165537] Low CVE-2013-0897: Off-by-one read in PDF. Credit to
Mateusz Jurczyk, with contributions by Gynvael Coldwind, both from
Google Security Team.</p>
<p>[164643] High CVE-2013-0898: Use-after-free in URL handling.
Credit to Alexander Potapenko of the Chromium development
community.</p>
<p>[160480] Low CVE-2013-0899: Integer overflow in Opus handling.
Credit to Google Chrome Security Team (Jüri Aedla).</p>
<p>[152442] Medium CVE-2013-0900: Race condition in ICU. Credit to
Google Chrome Security Team (Inferno).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-0879</cvename>
<cvename>CVE-2013-0880</cvename>
<cvename>CVE-2013-0881</cvename>
<cvename>CVE-2013-0882</cvename>
<cvename>CVE-2013-0883</cvename>
<cvename>CVE-2013-0884</cvename>
<cvename>CVE-2013-0885</cvename>
<cvename>CVE-2013-0887</cvename>
<cvename>CVE-2013-0888</cvename>
<cvename>CVE-2013-0889</cvename>
<cvename>CVE-2013-0890</cvename>
<cvename>CVE-2013-0891</cvename>
<cvename>CVE-2013-0892</cvename>
<cvename>CVE-2013-0893</cvename>
<cvename>CVE-2013-0894</cvename>
<cvename>CVE-2013-0895</cvename>
<cvename>CVE-2013-0896</cvename>
<cvename>CVE-2013-0897</cvename>
<cvename>CVE-2013-0898</cvename>
<cvename>CVE-2013-0899</cvename>
<cvename>CVE-2013-0900</cvename>
<url>http://googlechromereleases.blogspot.nl/search/label/Stable%20updates</url>
</references>
<dates>
<discovery>2013-02-21</discovery>
<entry>2013-02-22</entry>
</dates>
</vuln>
<vuln vid="f54584bc-7d2b-11e2-9bd1-206a8a720317">
<topic>krb5 -- null pointer dereference in the KDC PKINIT code [CVE-2013-1415]</topic>
<affects>
<package>
<name>krb5</name>
<range><le>1.11</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>No advisory has been released yet.</p>
<blockquote cite="http://web.mit.edu/kerberos/www/krb5-1.11/">
<p>Fix a null pointer dereference in the KDC PKINIT code [CVE-2013-1415].</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-1415</cvename>
<url>http://web.mit.edu/kerberos/www/krb5-1.11/</url>
</references>
<dates>
<discovery>2013-02-21</discovery>
<entry>2013-02-22</entry>
</dates>
</vuln>
<vuln vid="3c90e093-7c6e-11e2-809b-6c626d99876c">
<topic>FreeBSD -- glob(3) related resource exhaustion</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><gt>7.4</gt><lt>7.4_12</lt></range>
<range><gt>8.3</gt><lt>8.3_6</lt></range>
<range><gt>9.0</gt><lt>9.0_6</lt></range>
<range><gt>9.1</gt><lt>9.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem description:</p>
<blockquote cite="http://www.freebsd.org/security/advisories/FreeBSD-SA-13:02.libc.asc">
<p>GLOB_LIMIT is supposed to limit the number of paths to prevent against
memory or CPU attacks. The implementation however is insufficient.</p>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-13:02.libc</freebsdsa>
<cvename>CVE-2010-2632</cvename>
</references>
<dates>
<discovery>2013-02-19</discovery>
<entry>2013-02-21</entry>
</dates>
</vuln>
<vuln vid="4671cdc9-7c6d-11e2-809b-6c626d99876c">
<topic>FreeBSD -- BIND remote DoS with deliberately crafted DNS64 query</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>9.0</ge><lt>9.0_6</lt></range>
<range><ge>9.1</ge><lt>9.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem description:</p>
<blockquote cite="http://www.freebsd.org/security/advisories/FreeBSD-SA-13:01.bind.asc">
<p>Due to a software defect a crafted query can cause named(8) to crash
with an assertion failure.</p>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-13:01.bind</freebsdsa>
<cvename>CVE-2012-5688</cvename>
</references>
<dates>
<discovery>2013-02-19</discovery>
<entry>2013-02-21</entry>
</dates>
</vuln>
<vuln vid="a4d71e4c-7bf4-11e2-84cd-d43d7e0c7c02">
<topic>drupal7 -- Denial of service</topic>
<affects>
<package>
<name>drupal7</name>
<range><lt>7.19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team reports:</p>
<blockquote cite="https://drupal.org/SA-CORE-2013-002">
<p>Drupal core's Image module allows for the on-demand generation
of image derivatives. This capability can be abused by requesting
a large number of new derivatives which can fill up the server disk
space, and which can cause a very high CPU load. Either of these
effects may lead to the site becoming unavailable or unresponsive.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-0316</cvename>
<url>https://drupal.org/SA-CORE-2013-002</url>
</references>
<dates>
<discovery>2013-02-20</discovery>
<entry>2013-02-21</entry>
</dates>
</vuln>
<vuln vid="58c15292-7b61-11e2-95da-001e8c1a8a0e">
<topic>nss-pam-ldapd -- file descriptor buffer overflow</topic>
<affects>
<package>
<name>nss-pam-ldapd</name>
<range><lt>0.8.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Garth Mollett reports:</p>
<blockquote cite="http://arthurdejong.org/nss-pam-ldapd/CVE-2013-0288">
<p>A file descriptor overflow issue in the use of FD_SET()
in nss-pam-ldapd can lead to a stack-based buffer overflow.
An attacker could, under some circumstances, use this flaw
to cause a process that has the NSS or PAM module loaded to
crash or potentially execute arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-0288</cvename>
</references>
<dates>
<discovery>2013-02-18</discovery>
<entry>2013-02-20</entry>
</dates>
</vuln>
<vuln vid="1c8a039b-7b23-11e2-b17b-20cf30e32f6d">
<topic>bugzilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>bugzilla</name>
<name>de-bugzilla</name>
<name>ru-bugzilla</name>
<name>ja-bugzilla</name>
<range><ge>3.6.0</ge><lt>3.6.13</lt></range>
<range><ge>4.0.0</ge><lt>4.0.10</lt></range>
<range><ge>4.2.0</ge><lt>4.2.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>A Bugzilla Security Advisory reports:</h1>
<blockquote cite="http://www.bugzilla.org/security/3.6.12/">
<h1>Cross-Site Scripting</h1>
<p>When viewing a single bug report, which is the default,
the bug ID is validated and rejected if it is invalid.
But when viewing several bug reports at once, which is
specified by the format=multiple parameter, invalid bug
IDs can go through and are sanitized in the HTML page
itself. But when an invalid page format is passed to the
CGI script, the wrong HTML page is called and data are not
correctly sanitized, which can lead to XSS.</p>
<h1>Information Leak</h1>
<p>When running a query in debug mode, the generated SQL
query used to collect the data is displayed. The way this
SQL query is built permits the user to determine if some
confidential field value (such as a product name) exists.
This problem only affects Bugzilla 4.0.9 and older. Newer
releases are not affected by this issue.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-0785</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=842038</url>
<cvename>CVE-2013-0786</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=824399</url>
</references>
<dates>
<discovery>2013-02-19</discovery>
<entry>2013-02-20</entry>
<modified>2013-03-31</modified>
</dates>
</vuln>
<vuln vid="e3f0374a-7ad6-11e2-84cd-d43d7e0c7c02">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>18.0,1</gt><lt>19.0,1</lt></range>
<range><lt>17.0.3,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>17.0.3,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.16</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>17.0.3</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.16</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><gt>11.0</gt><lt>17.0.3</lt></range>
<range><lt>10.0.12</lt></range>
</package>
<package>
<name>libxul</name>
<range><gt>1.9.2.*</gt><lt>10.0.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2013-21 Miscellaneous memory safety hazards (rv:19.0 /
rv:17.0.3)</p>
<p>MFSA 2013-22 Out-of-bounds read in image rendering</p>
<p>MFSA 2013-23 Wrapped WebIDL objects can be wrapped again</p>
<p>MFSA 2013-24 Web content bypass of COW and SOW security wrappers</p>
<p>MFSA 2013-25 Privacy leak in JavaScript Workers</p>
<p>MFSA 2013-26 Use-after-free in nsImageLoadingContent</p>
<p>MFSA 2013-27 Phishing on HTTPS connection through malicious proxy</p>
<p>MFSA 2013-28 Use-after-free, out of bounds read, and buffer
overflow issues found using Address Sanitizer</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-0765</cvename>
<cvename>CVE-2013-0772</cvename>
<cvename>CVE-2013-0773</cvename>
<cvename>CVE-2013-0774</cvename>
<cvename>CVE-2013-0775</cvename>
<cvename>CVE-2013-0776</cvename>
<cvename>CVE-2013-0783</cvename>
<cvename>CVE-2013-0784</cvename>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-20.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-21.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-22.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-23.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-24.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-25.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-26.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-27.html</url>
<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
</references>
<dates>
<discovery>2013-02-19</discovery>
<entry>2013-02-19</entry>
<modified>2013-02-20</modified>
</dates>
</vuln>
<vuln vid="fcfdabb7-f14d-4e61-a7d5-cfefb4b99b15">
<topic>Ruby Rack Gem -- Multiple Issues</topic>
<affects>
<package>
<name>rubygem18-rack</name>
<range><lt>1.4.5</lt></range>
</package>
<package>
<name>rubygem19-rack</name>
<range><lt>1.4.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Rack developers report:</p>
<blockquote cite="http://www.ruby-forum.com/topic/4410659">
<p>Today we are proud to announce the release of Rack 1.4.5.</p>
<p>Fix CVE-2013-0263, timing attack against Rack::Session::Cookie</p>
<p>Fix CVE-2013-0262, symlink path traversal in Rack::File</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-0262</cvename>
<cvename>CVE-2013-0263</cvename>
</references>
<dates>
<discovery>2013-02-08</discovery>
<entry>2013-02-17</entry>
</dates>
</vuln>
<vuln vid="beab40bf-c1ca-4d2b-ad46-2f14bac8a968">
<topic>Ruby Activemodel Gem -- Circumvention of attr_protected</topic>
<affects>
<package>
<name>rubygem18-activemodel</name>
<range><lt>3.2.12</lt></range>
</package>
<package>
<name>rubygem19-activemodel</name>
<range><lt>3.2.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Aaron Patterson reports:</p>
<blockquote cite="https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/AFBKNY7VSH8">
<p>The attr_protected method allows developers to specify a blacklist
of model attributes which users should not be allowed to assign to.
By using a specially crafted request, attackers could circumvent
this protection and alter values that were meant to be protected.</p>
<p>All users running an affected release should either upgrade or use
one of the work arounds immediately. Users should also consider
switching from attr_protected to the whitelist method
attr_accessible which is not vulnerable to this attack.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-0276</cvename>
</references>
<dates>
<discovery>2013-02-11</discovery>
<entry>2013-02-17</entry>
</dates>
</vuln>
<vuln vid="7fe5b84a-78eb-11e2-8441-00e0814cab4e">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>1.501</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory reports:</p>
<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-02-16">
<p>This advisory announces multiple security vulnerabilities that
were found in Jenkins core.</p>
<ol>
<li>One of the vulnerabilities allows cross-site request
forgery (CSRF) attacks on Jenkins master, which causes an user
to make unwanted actions on Jenkins. Another vulnerability
enables cross-site scripting (XSS) attacks, which has the similar
consequence. Another vulnerability allowed an attacker to bypass
the CSRF protection mechanism in place, thereby mounting more CSRF
attackes. These attacks allow an attacker without direct access to
Jenkins to mount an attack.</li>
<li>In the fourth vulnerability, a malicious user of Jenkins can trick
Jenkins into building jobs that he does not have direct access to.</li>
<li>And lastly, a vulnerability allows a malicious user of Jenkins to
mount a denial of service attack by feeding a carefully crafted
payload to Jenkins.</li>
</ol>
</blockquote>
</body>
</description>
<references>
<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-02-16</url>
</references>
<dates>
<discovery>2013-02-16</discovery>
<entry>2013-02-17</entry>
</dates>
</vuln>
<vuln vid="f7809d9e-6af0-11e2-8e32-080027d768d3">
<topic>poweradmin -- multiple XSS vulnerabilities</topic>
<affects>
<package>
<name>poweradmin</name>
<range><lt>2.1.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Multiple cross-site scripting (XSS) vulnerabilities</p>
<blockquote cite="https://www.poweradmin.org/trac/ticket/468">
<p>Multiple scripts are vulnerable to XSS attacks.</p>
</blockquote>
</body>
</description>
<references>
<bid>55619</bid>
<url>http://packetstormsecurity.com/files/116698/Poweradmin-Cross-Site-Scripting.html</url>
</references>
<dates>
<discovery>2012-01-12</discovery>
<entry>2013-02-16</entry>
</dates>
</vuln>
<vuln vid="c79eb109-a754-45d7-b552-a42099eb2265">
<topic>Ruby -- Denial of Service and Unsafe Object Creation Vulnerability in JSON</topic>
<affects>
<package>
<name>ruby</name>
<range><ge>1.9,1</ge><lt>1.9.3.385,1</lt></range>
</package>
<package>
<name>rubygem18-json</name>
<range><lt>1.7.7</lt></range>
</package>
<package>
<name>rubygem19-json</name>
<range><lt>1.7.7</lt></range>
</package>
<package>
<name>rubygem18-json_pure</name>
<range><lt>1.7.7</lt></range>
</package>
<package>
<name>rubygem19-json_pure</name>
<range><lt>1.7.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Aaron Patterson reports:</p>
<blockquote cite="https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/4_YvCpLzL58">
<p>When parsing certain JSON documents, the JSON gem can be coerced in
to creating Ruby symbols in a target system. Since Ruby symbols
are not garbage collected, this can result in a denial of service
attack.</p>
<p>The same technique can be used to create objects in a target system
that act like internal objects. These "act alike" objects can be
used to bypass certain security mechanisms and can be used as a
spring board for SQL injection attacks in Ruby on Rails.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-0269</cvename>
</references>
<dates>
<discovery>2013-02-11</discovery>
<entry>2013-02-16</entry>
</dates>
</vuln>
<vuln vid="d3e96508-056b-4259-88ad-50dc8d1978a6">
<topic>Ruby -- XSS exploit of RDoc documentation generated by rdoc</topic>
<affects>
<package>
<name>ruby</name>
<range><ge>1.9,1</ge><lt>1.9.3.385,1</lt></range>
</package>
<package>
<name>rubygem18-rdoc</name>
<range><lt>3.12.1</lt></range>
</package>
<package>
<name>rubygem19-rdoc</name>
<range><lt>3.12.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby developers report:</p>
<blockquote cite="http://www.ruby-lang.org/en/news/2013/02/06/rdoc-xss-cve-2013-0256/">
<p>RDoc documentation generated by rdoc bundled with ruby are
vulnerable to an XSS exploit. All ruby users are recommended to
update ruby to newer version which includes security-fixed RDoc. If
you are publishing RDoc documentation generated by rdoc, you are
recommended to apply a patch for the documentaion or re-generate it
with security-fixed RDoc.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-0256</cvename>
</references>
<dates>
<discovery>2013-02-06</discovery>
<entry>2013-02-16</entry>
</dates>
</vuln>
<vuln vid="414e6a41-7204-11e2-8599-001060e06fd4">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.262</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://www.adobe.com/support/security/bulletins/apsb13-04.html">
<p>These updates address vulnerabilities that could cause a crash
and potentially allow an attacker to take control of the affected system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-0633</cvename>
<cvename>CVE-2013-0634</cvename>
<url>https://www.adobe.com/support/security/bulletins/apsb13-04.html</url>
</references>
<dates>
<discovery>2013-02-07</discovery>
<entry>2013-02-08</entry>
</dates>
</vuln>
<vuln vid="00b0d8cd-7097-11e2-98d9-003067c2616f">
<topic>OpenSSL -- TLS 1.1, 1.2 denial of service</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.1_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSSL security team reports:</p>
<blockquote cite="http://www.openssl.org/news/secadv_20130205.txt">
<p>A flaw in the OpenSSL handling of CBC mode ciphersuites in TLS 1.1
and TLS 1.2 on AES-NI supporting platforms can be exploited in a
DoS attack.</p>
<p>A flaw in the OpenSSL handling of OCSP response verification can
be exploited in a denial of service attack.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2686</cvename>
<cvename>CVE-2013-0166</cvename>
<cvename>CVE-2013-0169</cvename>
<url>http://www.openssl.org/news/secadv_20120510.txt</url>
</references>
<dates>
<discovery>2013-02-05</discovery>
<entry>2013-02-06</entry>
</dates>
</vuln>
<vuln vid="8c773d7f-6cbb-11e2-b242-c8600054b392">
<topic>mysql/mariadb/percona server -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mysql-server</name>
<range><ge>5.1</ge><lt>5.1.67</lt></range>
<range><ge>5.5</ge><lt>5.5.29</lt></range>
</package>
<package>
<name>mariadb-server</name>
<range><ge>5.3</ge><lt>5.3.12</lt></range>
<range><ge>5.5</ge><lt>5.5.29</lt></range>
</package>
<package>
<name>percona-server</name>
<range><ge>5.5</ge><lt>5.5.29.29.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ORACLE reports:</p>
<blockquote cite="http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html">
<p>Multiple SQL injection vulnerabilities in the replication code</p>
<p>Stack-based buffer overflow</p>
<p>Heap-based buffer overflow</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-4414</cvename>
<cvename>CVE-2012-5611</cvename>
<cvename>CVE-2012-5612</cvename>
<cvename>CVE-2012-5615</cvename>
<cvename>CVE-2012-5627</cvename>
<url>https://mariadb.atlassian.net/browse/MDEV-4029</url>
<url>https://mariadb.atlassian.net/browse/MDEV-MDEV-729</url>
<url>https://mariadb.atlassian.net/browse/MDEV-MDEV-729</url>
<url>http://www.mysqlperformanceblog.com/2013/01/23/announcing-percona-server-5-5-29-29-4/</url>
</references>
<dates>
<discovery>2012-12-01</discovery>
<entry>2013-02-01</entry>
</dates>
</vuln>
<vuln vid="ea0f45e2-6c4b-11e2-98d9-003067c2616f">
<topic>opera -- execution of arbitrary code</topic>
<affects>
<package>
<name>opera</name>
<name>opera-devel</name>
<name>linux-opera</name>
<name>linux-opera-devel</name>
<range><lt>12.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Opera reports:</p>
<blockquote cite="http://www.opera.com/support/kb/view/1042/">
<p>Particular DOM event manipulations can cause Opera to crash. In
some cases, this crash might occur in a way that allows execution
of arbitrary code. To inject code, additional techniques would
have to be employed.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.opera.com/support/kb/view/1042/</url>
<url>http://www.opera.com/support/kb/view/1043/</url>
</references>
<dates>
<discovery>2013-01-30</discovery>
<entry>2013-02-01</entry>
</dates>
</vuln>
<vuln vid="2ea6ce3d-6afd-11e2-9d4e-bcaec524bf84">
<topic>upnp -- multiple vulnerabilities</topic>
<affects>
<package>
<name>upnp</name>
<range><lt>1.6.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Project changelog reports:</p>
<blockquote cite="http://pupnp.sourceforge.net/ChangeLog">
<p>This patch addresses three possible buffer overflows in
function unique_service_name().The three issues have the
folowing CVE numbers:</p>
<ul>
<li>CVE-2012-5958 Issue #2: Stack buffer overflow of Tempbuf</li>
<li>CVE-2012-5959 Issue #4: Stack buffer overflow of Event-&gt;UDN</li>
<li>CVE-2012-5960 Issue #8: Stack buffer overflow of Event-&gt;UDN</li>
</ul>
<p>Notice that the following issues have already been dealt by
previous work:</p>
<ul>
<li>CVE-2012-5961 Issue #1: Stack buffer overflow of Evt-&gt;UDN</li>
<li>CVE-2012-5962 Issue #3: Stack buffer overflow of Evt-&gt;DeviceType</li>
<li>CVE-2012-5963 Issue #5: Stack buffer overflow of Event-&gt;UDN</li>
<li>CVE-2012-5964 Issue #6: Stack buffer overflow of Event-&gt;DeviceType</li>
<li>CVE-2012-5965 Issue #7: Stack buffer overflow of Event-&gt;DeviceType</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-5958</cvename>
<cvename>CVE-2012-5959</cvename>
<cvename>CVE-2012-5960</cvename>
<cvename>CVE-2012-5961</cvename>
<cvename>CVE-2012-5962</cvename>
<cvename>CVE-2012-5963</cvename>
<cvename>CVE-2012-5964</cvename>
<cvename>CVE-2012-5965</cvename>
</references>
<dates>
<discovery>2012-11-21</discovery>
<entry>2013-01-30</entry>
</dates>
</vuln>
<vuln vid="559e00b7-6a4d-11e2-b6b0-10bf48230856">
<topic>wordpress -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>3.5.1,1</lt></range>
</package>
<package>
<name>zh-wordpress-zh_CN</name>
<range><lt>3.5.1</lt></range>
</package>
<package>
<name>zh-wordpress-zh_TW</name>
<range><lt>3.5.1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<range><lt>3.5.1</lt></range>
</package>
<package>
<name>ja-wordpress</name>
<range><lt>3.5.1</lt></range>
</package>
<package>
<name>ru-wordpress</name>
<range><lt>3.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Wordpress reports:</p>
<blockquote cite="http://wordpress.org/news/2013/01/wordpress-3-5-1/">
<p>WordPress 3.5.1 also addresses the following security issues:</p>
<ul>
<li>A server-side request forgery vulnerability and remote port
scanning using pingbacks. This vulnerability, which could
potentially be used to expose information and compromise a
site, affects all previous WordPress versions. This was fixed
by the WordPress security team. We'd like to thank security
researchers <a href="http://codeseekah.com/">Gennady
Kovshenin</a> and <a href="http://www.ethicalhack3r.co.uk/">Ryan
Dewhurst</a> for reviewing our work.</li>
<li>Two instances of cross-site scripting via shortcodes and post
content. These issues were discovered by Jon Cave of the WordPress
security team.</li>
<li>A cross-site scripting vulnerability in the external library
Plupload. Thanks to the Moxiecode team for working with us on
this, and for releasing Plupload 1.5.5 to address this issue.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-0235</cvename>
<cvename>CVE-2013-0236</cvename>
<cvename>CVE-2013-0237</cvename>
</references>
<dates>
<discovery>2013-01-24</discovery>
<entry>2013-01-29</entry>
<modified>2014-04-30</modified>
</dates>
</vuln>
<vuln vid="3886cafe-668c-11e2-94b8-1c4bd681f0cf">
<topic>django-cms -- XSS Vulnerability</topic>
<affects>
<package>
<name>py-django-cms</name>
<range><lt>2.3.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cross-site scripting (XSS) vulnerability</p>
<blockquote cite="https://www.django-cms.org/en/blog/2012/12/04/2-3-5-security-release/">
<p>Jonas Obrist reports: The security issue allows users with limited
admin access to elevate their privileges through XSS injection
using the page_attribute template tag. Only users with admin access
and the permission to edit at least one django CMS page object
could exploit this vulnerability. Websites that do not use the
page_attribute template tag are not affected.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.django-cms.org/en/blog/2012/12/04/2-3-5-security-release/</url>
</references>
<dates>
<discovery>2012-12-04</discovery>
<entry>2013-01-25</entry>
</dates>
</vuln>
<vuln vid="8d03202c-6559-11e2-a389-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>24.0.1312.56</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/search/label/Stable%20updates">
<p>[151008] High CVE-2013-0839: Use-after-free in canvas font
handling. Credit to Atte Kettunen of OUSPG.</p>
<p>[170532] Medium CVE-2013-0840: Missing URL validation when opening
new windows.</p>
<p>[169770] High CVE-2013-0841: Unchecked array index in content
blocking. Credit to Google Chrome Security Team (Chris Evans).</p>
<p>[166867] Medium CVE-2013-0842: Problems with NULL characters
embedded in paths. Credit to Google Chrome Security Team (Jüri
Aedla).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-0839</cvename>
<cvename>CVE-2013-0840</cvename>
<cvename>CVE-2013-0841</cvename>
<cvename>CVE-2013-0842</cvename>
<url>http://googlechromereleases.blogspot.nl/search/label/Stable%20updates</url>
</references>
<dates>
<discovery>2013-01-22</discovery>
<entry>2013-01-23</entry>
</dates>
</vuln>
<vuln vid="1827f213-633e-11e2-8d93-c8600054b392">
<topic>drupal -- multiple vulnerabilities</topic>
<affects>
<package>
<name>drupal6</name>
<range><lt>6.28</lt></range>
</package>
<package>
<name>drupal7</name>
<range><lt>7.19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team reports:</p>
<blockquote cite="https://drupal.org/SA-CORE-2013-001">
<p>Cross-site scripting (Various core and contributed modules)</p>
<p>Access bypass (Book module printer friendly version)</p>
<p>Access bypass (Image module)</p>
</blockquote>
</body>
</description>
<references>
<url>https://drupal.org/SA-CORE-2013-001</url>
</references>
<dates>
<discovery>2013-01-16</discovery>
<entry>2013-01-20</entry>
</dates>
</vuln>
<vuln vid="1b9b199f-5efd-11e2-a1ee-c48508086173">
<topic>ettercap -- buffer overflow in target list parsing</topic>
<affects>
<package>
<name>ettercap</name>
<range><lt>0.7.4.1</lt></range>
<range><ge>0.7.5</ge><lt>0.7.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Host target list parsing routine in ettercap
0.7.4-series prior to 0.7.4.1 and 0.7.5-series
is prone to the stack-based buffer overflow that
may lead to the code execution with the privileges
of the ettercap process.</p>
<p>In order to trigger this vulnerability, user or service
that use ettercap should be tricked to pass the crafted list
of targets via the "-j" option.</p>
</body>
</description>
<references>
<cvename>CVE-2013-0722</cvename>
<url>http://www.exploit-db.com/exploits/23945/</url>
<url>https://secunia.com/advisories/51731/</url>
</references>
<dates>
<discovery>2013-01-07</discovery>
<entry>2013-01-16</entry>
</dates>
</vuln>
<vuln vid="d5e0317e-5e45-11e2-a113-c48508086173">
<topic>java 7.x -- security manager bypass</topic>
<affects>
<package>
<name>openjdk7</name>
<range><gt>0</gt></range>
</package>
<package>
<name>linux-sun-jdk</name>
<range><ge>7.0</ge><lt>7.11</lt></range>
</package>
<package>
<name>linux-sun-jre</name>
<range><ge>7.0</ge><lt>7.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>US CERT reports:</p>
<blockquote cite="http://www.kb.cert.org/vuls/id/625617">
<p>Java 7 Update 10 and earlier versions of Java 7 contain a
vulnerability that can allow a remote, unauthenticated
attacker to execute arbitrary code on a vulnerable
system.</p>
<p>The Java JRE plug-in provides its own Security Manager.
Typically, a web applet runs with a security manager
provided by the browser or Java Web Start plugin. Oracle's
document states, "If there is a security manager already
installed, this method first calls the security manager's
checkPermission method with a
RuntimePermission("setSecurityManager") permission to ensure
it's safe to replace the existing security manager. This may
result in throwing a SecurityException".</p>
<p>By leveraging the vulnerability in the Java Management
Extensions (JMX) MBean components, unprivileged Java code
can access restricted classes. By using that vulnerability
in conjunction with a second vulnerability involving the
Reflection API and the invokeWithArguments method of the
MethodHandle class, an untrusted Java applet can escalate
its privileges by calling the the setSecurityManager()
function to allow full privileges, without requiring code
signing. Oracle Java 7 update 10 and earlier Java 7 versions
are affected. The invokeWithArguments method was introduced
with Java 7, so therefore Java 6 is not affected.</p>
<p>This vulnerability is being attacked in the wild, and is
reported to be incorporated into exploit kits. Exploit code
for this vulnerability is also publicly available.</p>
</blockquote>
<p>Esteban Guillardoy from Immunity Inc. additionally clarifies
on the recursive reflection exploitation technique:</p>
<blockquote cite="https://partners.immunityinc.com/idocs/Java%20MBeanInstantiator.findClass%200day%20Analysis.pdf">
<p>The real issue is in the native
sun.reflect.Reflection.getCallerClass method.</p>
<p>We can see the following information in the Reflection
source code:</p>
<p>Returns the class of the method realFramesToSkip frames
up the stack (zero-based), ignoring frames associated with
java.lang.reflect.Method.invoke() and its
implementation.</p>
<p>So what is happening here is that they forgot to skip the
frames related to the new Reflection API and only the old
reflection API is taken into account.</p>
</blockquote>
<p>This exploit does not only affect Java applets, but every
piece of software that relies on the Java Security Manager for
sandboxing executable code is affected: malicious code can
totally disable Security Manager.</p>
<p>For users who are running native Web browsers with enabled
Java plugin, the workaround is to remove the java/icedtea-web
port and restart all browser instances.</p>
<p>For users who are running Linux Web browser flavors, the
workaround is either to disable the Java plugin in browser
or to upgrade linux-sun-* packages to the non-vulnerable
version.</p>
<p>It is not recommended to run untrusted applets using
appletviewer, since this may lead to the execution of the
malicious code on vulnerable versions on JDK/JRE.</p>
</body>
</description>
<references>
<cvename>CVE-2013-0433</cvename>
<certvu>625617</certvu>
<url>http://www.oracle.com/technetwork/topics/security/alert-cve-2013-0422-1896849.html</url>
<url>https://partners.immunityinc.com/idocs/Java%20MBeanInstantiator.findClass%200day%20Analysis.pdf</url>
</references>
<dates>
<discovery>2013-01-10</discovery>
<entry>2013-01-14</entry>
</dates>
</vuln>
<vuln vid="97c22a94-5b8b-11e2-b131-000c299b62e1">
<topic>nagios -- buffer overflow in history.cgi</topic>
<affects>
<package>
<name>nagios</name>
<range><lt>3.4.3_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>full disclosure reports:</p>
<blockquote cite="http://archives.neohapsis.com/archives/fulldisclosure/2012-12/0108.html">
<p>history.cgi is vulnerable to a buffer overflow due to the use of
sprintf with user supplied data that has not been restricted in size.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-6096</cvename>
<url>http://archives.neohapsis.com/archives/fulldisclosure/2012-12/0108.html</url>
<url>http://nagios.svn.sourceforge.net/viewvc/nagios?view=revision&amp;revision=2547</url>
</references>
<dates>
<discovery>2012-12-21</discovery>
<entry>2013-01-10</entry>
</dates>
</vuln>
<vuln vid="46bd747b-5b84-11e2-b06d-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>24.0.1312.52</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/search/label/Stable%20updates">
<p>[162494] High CVE-2012-5145: Use-after-free in SVG layout. Credit
to Atte Kettunen of OUSPG.</p>
<p>[165622] High CVE-2012-5146: Same origin policy bypass with
malformed URL. Credit to Erling A Ellingsen and Subodh Iyengar,
both of Facebook.</p>
<p>[165864] High CVE-2012-5147: Use-after-free in DOM handling.
Credit to José A. Vázquez.</p>
<p>[167122] Medium CVE-2012-5148: Missing filename sanitization in
hyphenation support. Credit to Google Chrome Security Team (Justin
Schuh).</p>
<p>[166795] High CVE-2012-5149: Integer overflow in audio IPC
handling. Credit to Google Chrome Security Team (Chris Evans).</p>
<p>[165601] High CVE-2012-5150: Use-after-free when seeking video.
Credit to Google Chrome Security Team (Inferno).</p>
<p>[165538] High CVE-2012-5151: Integer overflow in PDF JavaScript.
Credit to Mateusz Jurczyk, with contribution from Gynvael Coldwind,
both of Google Security Team.</p>
<p>[165430] Medium CVE-2012-5152: Out-of-bounds read when seeking
video. Credit to Google Chrome Security Team (Inferno).</p>
<p>[164565] High CVE-2012-5153: Out-of-bounds stack access in v8.
Credit to Andreas Rossberg of the Chromium development
community.</p>
<p>[Mac only] [163208] Medium CVE-2012-5155: Missing Mac sandbox for
worker processes. Credit to Google Chrome Security Team (Julien
Tinnes).</p>
<p>[162778] High CVE-2012-5156: Use-after-free in PDF fields. Credit
to Mateusz Jurczyk, with contribution from Gynvael Coldwind, both
of Google Security Team.</p>
<p>[162776] [162156] Medium CVE-2012-5157: Out-of-bounds reads in PDF
image handling. Credit to Mateusz Jurczyk, with contribution from
Gynvael Coldwind, both of Google Security Team.</p>
<p>[162153] High CVE-2013-0828: Bad cast in PDF root handling. Credit
to Mateusz Jurczyk, with contribution from Gynvael Coldwind, both
of Google Security Team.</p>
<p>[162114] High CVE-2013-0829: Corruption of database metadata
leading to incorrect file access. Credit to Google Chrome Security
Team (Jüri Aedla).</p>
<p>[161836] Low CVE-2013-0831: Possible path traversal from extension
process. Credit to Google Chrome Security Team (Tom Sepez).</p>
<p>[160380] Medium CVE-2013-0832: Use-after-free with printing.
Credit to Google Chrome Security Team (Cris Neckar).</p>
<p>[154485] Medium CVE-2013-0833: Out-of-bounds read with printing.
Credit to Google Chrome Security Team (Cris Neckar).</p>
<p>[154283] Medium CVE-2013-0834: Out-of-bounds read with glyph
handling. Credit to Google Chrome Security Team (Cris Neckar).</p>
<p>[152921] Low CVE-2013-0835: Browser crash with geolocation. Credit
to Arthur Gerkis.</p>
<p>[150545] High CVE-2013-0836: Crash in v8 garbage collection.
Credit to Google Chrome Security Team (Cris Neckar).</p>
<p>[145363] Medium CVE-2013-0837: Crash in extension tab handling.
Credit to Tom Nielsen.</p>
<p>[Linux only] [143859] Low CVE-2013-0838: Tighten permissions on
shared memory segments. Credit to Google Chrome Security Team
(Chris Palmer).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-5145</cvename>
<cvename>CVE-2012-5146</cvename>
<cvename>CVE-2012-5147</cvename>
<cvename>CVE-2012-5148</cvename>
<cvename>CVE-2012-5149</cvename>
<cvename>CVE-2012-5150</cvename>
<cvename>CVE-2012-5151</cvename>
<cvename>CVE-2012-5152</cvename>
<cvename>CVE-2012-5153</cvename>
<cvename>CVE-2012-5155</cvename>
<cvename>CVE-2012-5156</cvename>
<cvename>CVE-2012-5157</cvename>
<cvename>CVE-2013-0828</cvename>
<cvename>CVE-2013-0829</cvename>
<cvename>CVE-2013-0831</cvename>
<cvename>CVE-2013-0832</cvename>
<cvename>CVE-2013-0833</cvename>
<cvename>CVE-2013-0834</cvename>
<cvename>CVE-2013-0835</cvename>
<cvename>CVE-2013-0836</cvename>
<cvename>CVE-2013-0837</cvename>
<cvename>CVE-2013-0838</cvename>
<url>http://googlechromereleases.blogspot.nl/search/label/Stable%20updates</url>
</references>
<dates>
<discovery>2013-01-10</discovery>
<entry>2013-01-11</entry>
</dates>
</vuln>
<vuln vid="a4ed6632-5aa9-11e2-8fcb-c8600054b392">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>11.0,1</gt><lt>17.0.2,1</lt></range>
<range><lt>10.0.12,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>17.0.2,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.15</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>17.0.2</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.15</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><gt>11.0</gt><lt>17.0.2</lt></range>
<range><lt>10.0.12</lt></range>
</package>
<package>
<name>libxul</name>
<range><gt>1.9.2.*</gt><lt>10.0.12</lt></range>
</package>
<package>
<name>ca_root_nss</name>
<range><lt>3.14.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2013-01 Miscellaneous memory safety hazards (rv:18.0/
rv:10.0.12 / rv:17.0.2)</p>
<p>MFSA 2013-02 Use-after-free and buffer overflow issues found using
Address Sanitizer</p>
<p>MFSA 2013-03 Buffer Overflow in Canvas</p>
<p>MFSA 2013-04 URL spoofing in addressbar during page loads</p>
<p>MFSA 2013-05 Use-after-free when displaying table with many
columns and column groups</p>
<p>MFSA 2013-06 Touch events are shared across iframes</p>
<p>MFSA 2013-07 Crash due to handling of SSL on threads</p>
<p>MFSA 2013-08 AutoWrapperChanger fails to keep objects alive during
garbage collection</p>
<p>MFSA 2013-09 Compartment mismatch with quickstubs returned values</p>
<p>MFSA 2013-10 Event manipulation in plugin handler to bypass
same-origin policy</p>
<p>MFSA 2013-11 Address space layout leaked in XBL objects</p>
<p>MFSA 2013-12 Buffer overflow in Javascript string concatenation</p>
<p>MFSA 2013-13 Memory corruption in XBL with XML bindings containing
SVG</p>
<p>MFSA 2013-14 Chrome Object Wrapper (COW) bypass through changing
prototype</p>
<p>MFSA 2013-15 Privilege escalation through plugin objects</p>
<p>MFSA 2013-16 Use-after-free in serializeToStream</p>
<p>MFSA 2013-17 Use-after-free in ListenerManager</p>
<p>MFSA 2013-18 Use-after-free in Vibrate</p>
<p>MFSA 2013-19 Use-after-free in Javascript Proxy objects</p>
<p>MFSA 2013-20 Mis-issued TURKTRUST certificates</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-5829</cvename>
<cvename>CVE-2013-0743</cvename>
<cvename>CVE-2013-0744</cvename>
<cvename>CVE-2013-0745</cvename>
<cvename>CVE-2013-0746</cvename>
<cvename>CVE-2013-0747</cvename>
<cvename>CVE-2013-0748</cvename>
<cvename>CVE-2013-0749</cvename>
<cvename>CVE-2013-0750</cvename>
<cvename>CVE-2013-0751</cvename>
<cvename>CVE-2013-0752</cvename>
<cvename>CVE-2013-0753</cvename>
<cvename>CVE-2013-0754</cvename>
<cvename>CVE-2013-0755</cvename>
<cvename>CVE-2013-0756</cvename>
<cvename>CVE-2013-0757</cvename>
<cvename>CVE-2013-0758</cvename>
<cvename>CVE-2013-0759</cvename>
<cvename>CVE-2013-0760</cvename>
<cvename>CVE-2013-0761</cvename>
<cvename>CVE-2013-0762</cvename>
<cvename>CVE-2013-0763</cvename>
<cvename>CVE-2013-0764</cvename>
<cvename>CVE-2013-0766</cvename>
<cvename>CVE-2013-0767</cvename>
<cvename>CVE-2013-0768</cvename>
<cvename>CVE-2013-0769</cvename>
<cvename>CVE-2013-0770</cvename>
<cvename>CVE-2013-0771</cvename>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-01.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-02.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-03.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-04.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-05.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-06.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-07.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-08.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-09.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-10.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-11.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-12.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-13.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-14.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-15.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-16.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-17.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-18.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-19.html</url>
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-20.html</url>
<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
</references>
<dates>
<discovery>2013-01-08</discovery>
<entry>2013-01-09</entry>
</dates>
</vuln>
<vuln vid="ca5d3272-59e3-11e2-853b-00262d5ed8ee">
<topic>rubygem-rails -- multiple vulnerabilities</topic>
<affects>
<package>
<name>rubygem-rails</name>
<range><lt>3.2.11</lt></range>
</package>
<package>
<name>rubygem-actionpack</name>
<range><lt>3.2.11</lt></range>
</package>
<package>
<name>rubygem-activerecord</name>
<range><lt>3.2.11</lt></range>
</package>
<package>
<name>rubygem-activesupport</name>
<range><lt>3.2.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby on Rails team reports:</p>
<blockquote cite="http://weblog.rubyonrails.org/2013/1/8/Rails-3-2-11-3-1-10-3-0-19-and-2-3-15-have-been-released/">
<p>Two high-risk vulnerabilities have been discovered:</p>
<p>(CVE-2013-0155) There is a vulnerability when Active Record is
used in conjunction with JSON parameter parsing.</p>
<p>Due to the way Active Record interprets parameters in combination
with the way that JSON parameters are parsed, it is possible for an
attacker to issue unexpected database queries with "IS NULL" or
empty "WHERE" clauses. This issue does not let an attacker insert
arbitrary values into an SQL query, however they can cause the
query to check for NULL or eliminate a WHERE clause when most users
would not expect it.</p>
<p>(CVE-2013-0156) There are multiple weaknesses in the parameter
parsing code for Ruby on Rails which allows attackers to bypass
authentication systems, inject arbitrary SQL, inject and execute
arbitrary code, or perform a DoS attack on a Rails application.</p>
<p>The parameter parsing code of Ruby on Rails allows applications to
automatically cast values from strings to certain data types.
Unfortunately the type casting code supported certain conversions
which were not suitable for performing on user-provided data
including creating Symbols and parsing YAML. These unsuitable
conversions can be used by an attacker to compromise a Rails
application.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-0155</cvename>
<cvename>CVE-2013-0156</cvename>
<url>http://weblog.rubyonrails.org/2013/1/8/Rails-3-2-11-3-1-10-3-0-19-and-2-3-15-have-been-released/</url>
<url>https://groups.google.com/forum/?fromgroups#!topic/rubyonrails-security/t1WFuuQyavI</url>
<url>https://groups.google.com/forum/?fromgroups#!topic/rubyonrails-security/61bkgvnSGTQ</url>
</references>
<dates>
<discovery>2013-01-08</discovery>
<entry>2013-01-08</entry>
</dates>
</vuln>
<vuln vid="b4051b52-58fa-11e2-853b-00262d5ed8ee">
<topic>rubygem-rails -- SQL injection vulnerability</topic>
<affects>
<package>
<name>rubygem-rails</name>
<range><lt>3.2.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby on Rails team reports:</p>
<blockquote cite="https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/DCNTNp_qjFM">
<p>There is a SQL injection vulnerability in Active Record in ALL
versions. Due to the way dynamic finders in Active Record extract
options from method parameters, a method parameter can mistakenly
be used as a scope. Carefully crafted requests can use the scope
to inject arbitrary SQL.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-5664</cvename>
<url>https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/DCNTNp_qjFM</url>
</references>
<dates>
<discovery>2013-01-02</discovery>
<entry>2013-01-07</entry>
</dates>
</vuln>
<vuln vid="3a65d33b-5950-11e2-b66b-00e0814cab4e">
<topic>jenkins -- HTTP access to the server to retrieve the master cryptographic key</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>1.498</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory reports:</p>
<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-01-04">
<p>This advisory announces a security vulnerability that was found
in Jenkins core.</p>
<p>An attacker can then use this master cryptographic key to mount
remote code execution attack against the Jenkins master, or
impersonate arbitrary users in making REST API calls.</p>
<p>There are several factors that mitigate some of these problems
that may apply to specific installations.</p>
<ul>
<li>The particular attack vector is only applicable on Jenkins
instances that have slaves attached to them, and allow
anonymous read access.</li>
<li>Jenkins allows users to re-generate the API tokens. Those
re-generated API tokens cannot be impersonated by the
attacker.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-01-04</url>
</references>
<dates>
<discovery>2013-01-04</discovery>
<entry>2013-01-08</entry>
</dates>
</vuln>
<vuln vid="1b769b72-582b-11e2-b66b-00e0814cab4e">
<topic>django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>django</name>
<range><lt>1.4.3</lt></range>
</package>
<package>
<name>django13</name>
<range><lt>1.3.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Django Project reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2012/dec/10/security/">
<ol>
<li>
<p>Host header poisoning</p>
<p>Several earlier Django security releases focused on the issue of
poisoning the HTTP Host header, causing Django to generate URLs
pointing to arbitrary, potentially-malicious domains.</p>
<p>In response to further input received and reports of continuing
issues following the previous release, we're taking additional
steps to tighten Host header validation. Rather than attempt to
accommodate all features HTTP supports here, Django's Host header
validation attempts to support a smaller, but far more common, subset:</p>
<ul>
<li>Hostnames must consist of characters [A-Za-z0-9] plus hyphen
('-') or dot ('.').</li>
<li>IP addresses -- both IPv4 and IPv6 -- are permitted.</li>
<li>Port, if specified, is numeric.</li>
</ul>
<p>Any deviation from this will now be rejected, raising the exception
django.core.exceptions.SuspiciousOperation.</p>
</li>
<li>
<p>Redirect poisoning</p>
<p>Also following up on a previous issue: in July of this year, we made
changes to Django's HTTP redirect classes, performing additional
validation of the scheme of the URL to redirect to (since, both
within Django's own supplied applications and many third-party
applications, accepting a user-supplied redirect target is a common
pattern).</p>
<p>Since then, two independent audits of the code turned up further
potential problems. So, similar to the Host-header issue, we are
taking steps to provide tighter validation in response to reported
problems (primarily with third-party applications, but to a certain
extent also within Django itself). This comes in two parts:</p>
<ol>
<li>A new utility function, django.utils.http.is_safe_url, is
added; this function takes a URL and a hostname, and checks
that the URL is either relative, or if absolute matches the
supplied hostname. This function is intended for use whenever
user-supplied redirect targets are accepted, to ensure that
such redirects cannot lead to arbitrary third-party sites.</li>
<li>All of Django's own built-in views -- primarily in the
authentication system -- which allow user-supplied redirect
targets now use is_safe_url to validate the supplied URL.</li>
</ol>
</li>
</ol>
</blockquote>
</body>
</description>
<references>
<url>https://www.djangoproject.com/weblog/2012/dec/10/security/</url>
</references>
<dates>
<discovery>2012-12-10</discovery>
<entry>2013-01-06</entry>
</dates>
</vuln>
<vuln vid="1ae613c3-5728-11e2-9483-14dae938ec40">
<topic>freetype -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>freetype2</name>
<range><lt>2.4.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The FreeType Project reports:</p>
<blockquote cite="http://sourceforge.net/projects/freetype/files/freetype2/2.4.11/README/view">
<p>Some vulnerabilities in the BDF implementation have been fixed.
Users of this font format should upgrade.</p>
</blockquote>
</body>
</description>
<references>
<url>http://sourceforge.net/projects/freetype/files/freetype2/2.4.11/README/view</url>
</references>
<dates>
<discovery>2012-12-20</discovery>
<entry>2013-01-05</entry>
</dates>
</vuln>
<vuln vid="a264b1b0-5726-11e2-9483-14dae938ec40">
<topic>moinmoin -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>moinmoin</name>
<range><lt>1.9.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MoinMoin developers report the following vulnerabilities
as fixed in version 1.9.6:</p>
<blockquote cite="http://hg.moinmo.in/moin/1.9/raw-file/1.9.6/docs/CHANGES">
<ul>
<li>remote code execution vulnerability in
twikidraw/anywikidraw action,</li>
<li>path traversal vulnerability in AttachFile action,</li>
<li>XSS issue, escape page name in rss link.</li>
</ul>
</blockquote>
<p>CVE entries at MITRE furher clarify:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2012-6081">
<p>Multiple unrestricted file upload vulnerabilities in the
(1) twikidraw (action/twikidraw.py) and (2) anywikidraw
(action/anywikidraw.py) actions in MoinMoin before 1.9.6
allow remote authenticated users with write permissions to
execute arbitrary code by uploading a file with an
executable extension, then accessing it via a direct request
to the file in an unspecified directory, as exploited in the
wild in July 2012.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2012-6080">
<p>Directory traversal vulnerability in the
_do_attachment_move function in the AttachFile action
(action/AttachFile.py) in MoinMoin 1.9.3 through 1.9.5
allows remote attackers to overwrite arbitrary files via a
.. (dot dot) in a file name.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2012-6082">
<p>Cross-site scripting (XSS) vulnerability in the rsslink
function in theme/__init__.py in MoinMoin 1.9.5 allows
remote attackers to inject arbitrary web script or HTML
via the page name in a rss link.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-6081</cvename>
<cvename>CVE-2012-6080</cvename>
<cvename>CVE-2012-6082</cvename>
<url>http://hg.moinmo.in/moin/1.9/raw-file/1.9.6/docs/CHANGES</url>
<url>http://www.debian.org/security/2012/dsa-2593</url>
</references>
<dates>
<discovery>2012-12-29</discovery>
<entry>2013-01-05</entry>
<modified>2013-01-06</modified>
</dates>
</vuln>
<vuln vid="f7c87a8a-55d5-11e2-a255-c8600054b392">
<topic>asterisk -- multiple vulnerabilities</topic>
<affects>
<package>
<name>asterisk11</name>
<range><gt>11.*</gt><lt>11.1.2</lt></range>
</package>
<package>
<name>asterisk10</name>
<range><gt>10.*</gt><lt>10.11.1</lt></range>
</package>
<package>
<name>asterisk18</name>
<range><gt>1.8.*</gt><lt>1.8.19.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/security">
<p>Crashes due to large stack allocations when using TCP</p>
<p>Denial of Service Through Exploitation of Device State Caching</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-5976</cvename>
<cvename>CVE-2012-5977</cvename>
<url>http://downloads.digium.com/pub/security/AST-2012-014.html</url>
<url>http://downloads.digium.com/pub/security/AST-2012-015.html</url>
<url>https://www.asterisk.org/security</url>
</references>
<dates>
<discovery>2013-01-02</discovery>
<entry>2013-01-03</entry>
</dates>
</vuln>
<vuln vid="4108cc57-54d7-11e2-9483-14dae938ec40">
<topic>ircd-ratbox and charybdis -- remote DoS vulnerability</topic>
<affects>
<package>
<name>ircd-ratbox</name>
<range><gt>2.*</gt><lt>3.0.8</lt></range>
</package>
<package>
<name>charybdis</name>
<range><lt>3.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>atheme.org reports:</p>
<blockquote cite="http://www.ratbox.org/ASA-2012-12-31.txt">
<p>All versions of Charybdis are vulnerable to a remotely-triggered
crash bug caused by code originating from ircd-ratbox 2.0.
(Incidentally, this means all versions since ircd-ratbox 2.0 are
also vulnerable.)</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.ratbox.org/ASA-2012-12-31.txt</url>
</references>
<dates>
<discovery>2012-12-31</discovery>
<entry>2013-01-02</entry>
</dates>
</vuln>
<vuln vid="101f0aae-52d1-11e2-87fe-f4ce46b9ace8">
<topic>puppet -- multiple vulnerabilities</topic>
<affects>
<package>
<name>puppet</name>
<range><gt>2.6.*</gt><lt>2.6.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>puppet -- multiple vulnerabilities</p>
<blockquote cite="http://projects.puppetlabs.com/projects/puppet/wiki/Release_Notes#2.6.17">
<p>Arbitrary file read on the puppet master from authenticated clients (high). It is possible to construct an HTTP get request from an authenticated client with a valid certificate that will return the contents of an arbitrary file on the Puppet master that the master has read-access to.</p>
<p>Arbitrary file delete/D.O.S on Puppet Master from authenticated clients (high). Given a Puppet master with the "Delete" directive allowed in auth.conf for an authenticated host, an attacker on that host can send a specially crafted Delete request that can cause an arbitrary file deletion on the Puppet master, potentially causing a denial of service attack. Note that this vulnerability does *not* exist in Puppet as configured by default.</p>
<p>Insufficient input validation for agent hostnames (low). An attacker could trick the administrator into signing an attacker's certificate rather than the intended one by constructing specially crafted certificate requests containing specific ANSI control sequences. It is possible to use the sequences to rewrite the order of text displayed to an administrator such that display of an invalid certificate and valid certificate are transposed. If the administrator signs the attacker's certificate, the attacker can then man-in-the-middle the agent.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3864</cvename>
<cvename>CVE-2012-3865</cvename>
<cvename>CVE-2012-3867</cvename>
<url>http://projects.puppetlabs.com/projects/puppet/wiki/Release_Notes#2.6.17</url>
<url>http://puppetlabs.com/security/cve/cve-2012-3864/</url>
<url>http://puppetlabs.com/security/cve/cve-2012-3865/</url>
<url>http://puppetlabs.com/security/cve/cve-2012-3867/</url>
</references>
<dates>
<discovery>2012-07-10</discovery>
<entry>2012-12-30</entry>
</dates>
</vuln>
<vuln vid="13320091-52a6-11e2-a289-1c4bd681f0cf">
<topic>otrs -- XSS vulnerability</topic>
<affects>
<package>
<name>otrs</name>
<range><lt>3.1.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OTRS Security Advisory reports:</p>
<blockquote cite="http://www.otrs.com/open-source/community-news/security-advisories/security-advisory-2012-03/">
<p>This advisory covers vulnerabilities discovered in the OTRS core
system. This is a variance of the XSS vulnerability, where an attacker could
send a specially prepared HTML email to OTRS which would cause JavaScript code
to be executed in your browser while displaying the email. In this case this is
achieved by using javascript source attributes with whitespaces.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-4751</cvename>
<url>http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-03/</url>
<url>http://www.kb.cert.org/vuls/id/603276</url>
</references>
<dates>
<discovery>2012-10-16</discovery>
<entry>2012-12-30</entry>
</dates>
</vuln>
<vuln vid="95a69d1a-52a5-11e2-a289-1c4bd681f0cf">
<topic>otrs -- XSS vulnerability in Firefox and Opera</topic>
<affects>
<package>
<name>otrs</name>
<range><lt>3.1.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OTRS Security Advisory reports:</p>
<blockquote cite="http://www.otrs.com/open-source/community-news/security-advisories/security-advisory-2012-02/">
<p>This advisory covers vulnerabilities discovered in the OTRS core
system. This is a variance of the XSS vulnerability, where an attacker could
send a specially prepared HTML email to OTRS which would cause JavaScript code
to be executed in your browser while displaying the email in Firefox and Opera.
In this case this is achieved with an invalid HTML structure with nested tags.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-4600</cvename>
<url>http://www.otrs.com/open-source/community-news/security-advisories/security-advisory-2012-02/</url>
</references>
<dates>
<discovery>2012-08-30</discovery>
<entry>2012-12-30</entry>
</dates>
</vuln>
<vuln vid="49a6026a-52a3-11e2-a289-1c4bd681f0cf">
<topic>otrs -- XSS vulnerability in Internet Explorer</topic>
<affects>
<package>
<name>otrs</name>
<range><lt>3.1.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OTRS Security Advisory reports:</p>
<blockquote cite="http://www.otrs.com/open-source/community-news/security-advisories/security-advisory-2012-01/">
<p>This advisory covers vulnerabilities discovered in the OTRS core
system. Due to the XSS vulnerability in Internet Explorer an attacker could send
a specially prepared HTML email to OTRS which would cause JavaScript code to be
executed in your Internet Explorer while displaying the email.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2582</cvename>
<url>http://www.otrs.com/open-source/community-news/security-advisories/security-advisory-2012-01/</url>
</references>
<dates>
<discovery>2012-08-22</discovery>
<entry>2012-12-30</entry>
</dates>
</vuln>
<vuln vid="c37de843-488e-11e2-a5c9-0019996bc1f7">
<topic>squid -- denial of service</topic>
<affects>
<package>
<name>squid</name>
<range><lt>2.7.9_4</lt></range>
<range><ge>3.1</ge><lt>3.1.23</lt></range>
<range><ge>3.2</ge><lt>3.2.6</lt></range>
<range><ge>3.3</ge><lt>3.3.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Squid developers report:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2012_1.txt">
<p>Due to missing input validation Squid cachemgr.cgi tool
is vulnerable to a denial of service attack when processing
specially crafted requests.</p>
<p>This problem allows any client able to reach the
cachemgr.cgi to perform a denial of service attack on the
service host.</p>
<p>The nature of the attack may cause secondary effects
through resource consumption on the host server.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-5643</cvename>
<cvename>CVE-2013-0189</cvename>
<url>http://www.squid-cache.org/Advisories/SQUID-2012_1.txt</url>
</references>
<dates>
<discovery>2012-12-17</discovery>
<entry>2012-12-28</entry>
<modified>2013-05-02</modified>
</dates>
</vuln>
<vuln vid="85f33a8d-492f-11e2-aa75-003067c2616f">
<topic>opera -- execution of arbitrary code</topic>
<affects>
<package>
<name>opera</name>
<range><lt>12.12</lt></range>
</package>
<package>
<name>opera-devel</name>
<range><lt>12.12</lt></range>
</package>
<package>
<name>linux-opera</name>
<range><lt>12.12</lt></range>
</package>
<package>
<name>linux-opera-devel</name>
<range><lt>12.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Opera reports:</p>
<blockquote cite="http://www.opera.com/support/kb/view/1038/">
<p>When loading GIF images into memory, Opera should allocate the
correct amount of memory to store that image. Specially crafted
image files can cause Opera to allocate the wrong amount of memory.
Subsequent data may then overwrite unrelated memory with
attacker-controlled data. This can lead to a crash, which may also
execute that data as code.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.opera.com/support/kb/view/1038/</url>
<url>http://www.opera.com/support/kb/view/1039/</url>
</references>
<dates>
<discovery>2012-12-18</discovery>
<entry>2012-12-18</entry>
<modified>2014-04-30</modified>
</dates>
</vuln>
<vuln vid="1657a3e6-4585-11e2-a396-10bf48230856">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.258</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://www.adobe.com/support/security/bulletins/apsb12-27.html">
<p>These updates address vulnerabilities that could cause a crash
and potentially allow an attacker to take control of the affected system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-5676</cvename>
<cvename>CVE-2012-5677</cvename>
<cvename>CVE-2012-5678</cvename>
<url>https://www.adobe.com/support/security/bulletins/apsb12-27.html</url>
</references>
<dates>
<discovery>2012-12-11</discovery>
<entry>2012-12-14</entry>
</dates>
</vuln>
<vuln vid="51f84e28-444e-11e2-8306-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>23.0.1271.97</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/search/label/Stable%20updates">
<p>[158204] High CVE-2012-5139: Use-after-free with visibility
events. Credit to Chamal de Silva.</p>
<p>[159429] High CVE-2012-5140: Use-after-free in URL loader. Credit
to Chamal de Silva.</p>
<p>[160456] Medium CVE-2012-5141: Limit Chromoting client plug-in
instantiation. Credit to Google Chrome Security Team (Jüri
Aedla).</p>
<p>[160803] Critical CVE-2012-5142: Crash in history navigation.
Credit to Michal Zalewski of Google Security Team.</p>
<p>[160926] Medium CVE-2012-5143: Integer overflow in PPAPI image
buffers. Credit to Google Chrome Security Team (Cris Neckar).</p>
<p>[161639] High CVE-2012-5144: Stack corruption in AAC decoding.
Credit to pawlkt.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-5139</cvename>
<cvename>CVE-2012-5140</cvename>
<cvename>CVE-2012-5141</cvename>
<cvename>CVE-2012-5142</cvename>
<cvename>CVE-2012-5143</cvename>
<cvename>CVE-2012-5144</cvename>
<url>http://googlechromereleases.blogspot.nl/search/label/Stable%20updates</url>
</references>
<dates>
<discovery>2012-12-11</discovery>
<entry>2012-12-12</entry>
</dates>
</vuln>
<vuln vid="953911fe-51ef-11e2-8e34-0022156e8794">
<topic>tomcat -- bypass of CSRF prevention filter</topic>
<affects>
<package>
<name>tomcat6</name>
<range><ge>6.0.0</ge><le>6.0.35</le></range>
</package>
<package>
<name>tomcat7</name>
<range><ge>7.0.0</ge><le>7.0.31</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Software Foundation reports:</p>
<blockquote cite="http://tomcat.apache.org/security-7.html">
<p>The CSRF prevention filter could be bypassed if a request was made to a
protected resource without a session identifier present in the request.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-4431</cvename>
<url>http://tomcat.apache.org/security-6.html</url>
<url>http://tomcat.apache.org/security-7.html</url>
</references>
<dates>
<discovery>2012-12-04</discovery>
<entry>2012-12-04</entry>
</dates>
</vuln>
<vuln vid="134acaa2-51ef-11e2-8e34-0022156e8794">
<topic>tomcat -- denial of service</topic>
<affects>
<package>
<name>tomcat6</name>
<range><ge>6.0.0</ge><le>6.0.35</le></range>
</package>
<package>
<name>tomcat7</name>
<range><ge>7.0.0</ge><le>7.0.27</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Software Foundation reports:</p>
<blockquote cite="http://tomcat.apache.org/security-7.html">
<p>When using the NIO connector with sendfile and HTTPS enabled, if a
client breaks the connection while reading the response an infinite loop
is entered leading to a denial of service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-4534</cvename>
<url>http://tomcat.apache.org/security-6.html</url>
<url>http://tomcat.apache.org/security-7.html</url>
</references>
<dates>
<discovery>2012-12-04</discovery>
<entry>2012-12-04</entry>
</dates>
</vuln>
<vuln vid="f599dfc4-3ec2-11e2-8ae1-001a8056d0b5">
<topic>tomcat -- bypass of security constraints</topic>
<affects>
<package>
<name>tomcat6</name>
<range><ge>6.0.0</ge><le>6.0.35</le></range>
</package>
<package>
<name>tomcat7</name>
<range><ge>7.0.0</ge><le>7.0.29</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Software Foundation reports:</p>
<blockquote cite="http://tomcat.apache.org/security-7.html">
<p>When using FORM authentication it was possible to bypass the security
constraint checks in the FORM authenticator by appending
"/j_security_check" to the end of the URL if some other component
(such as the Single-Sign-On valve) had called request.setUserPrincipal()
before the call to FormAuthenticator#authenticate().</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3546</cvename>
<url>http://tomcat.apache.org/security-6.html</url>
<url>http://tomcat.apache.org/security-7.html</url>
</references>
<dates>
<discovery>2012-12-04</discovery>
<entry>2012-12-04</entry>
<modified>2012-12-29</modified>
</dates>
</vuln>
<vuln vid="2892a8e2-3d68-11e2-8e01-0800273fe665">
<topic>dns/bind9* -- servers using DNS64 can be crashed by a crafted query</topic>
<affects>
<package>
<name>bind99</name>
<range><lt>9.9.2.1</lt></range>
</package>
<package>
<name>bind99-base</name>
<range><lt>9.9.2.1</lt></range>
</package>
<package>
<name>bind98</name>
<range><lt>9.8.4.1</lt></range>
</package>
<package>
<name>bind98-base</name>
<range><lt>9.8.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-00828">
<p>BIND 9 nameservers using the DNS64 IPv6 transition mechanism are
vulnerable to a software defect that allows a crafted query to
crash the server with a REQUIRE assertion failure. Remote
exploitation of this defect can be achieved without extensive
effort, resulting in a denial-of-service (DoS) vector against
affected servers.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-5688</cvename>
</references>
<dates>
<discovery>2012-11-27</discovery>
<entry>2012-12-04</entry>
</dates>
</vuln>
<vuln vid="f524d8e0-3d83-11e2-807a-080027ef73ec">
<topic>bogofilter -- heap corruption by invalid base64 input</topic>
<affects>
<package> <name>bogofilter</name> <range><lt>1.2.3</lt></range> </package>
<package> <name>bogofilter-sqlite</name> <range><lt>1.2.3</lt></range> </package>
<package> <name>bogofilter-tc</name> <range><lt>1.2.3</lt></range> </package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>David Relson reports:</p>
<blockquote cite="https://bogofilter.svn.sourceforge.net/svnroot/bogofilter/trunk/bogofilter/NEWS">
<p>Fix a heap corruption in base64 decoder on invalid input.
Analysis and patch by Julius Plenz, [FU Berlin, Germany].</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-5468</cvename>
<url>http://bogofilter.sourceforge.net/security/bogofilter-SA-2012-01</url>
</references>
<dates>
<discovery>2012-10-17</discovery>
<entry>2012-12-03</entry>
</dates>
</vuln>
<vuln vid="5af51ae9-3acd-11e2-a4eb-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>23.0.1271.95</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/search/label/Stable%20updates">
<p>[161564] High CVE-2012-5138: Incorrect file path handling. Credit
to Google Chrome Security Team (Jüri Aedla).</p>
<p>[162835] High CVE-2012-5137: Use-after-free in media source
handling. Credit to Pinkie Pie.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-5137</cvename>
<cvename>CVE-2012-5138</cvename>
<url>http://googlechromereleases.blogspot.nl/search/label/Stable%20updates</url>
</references>
<dates>
<discovery>2012-11-29</discovery>
<entry>2012-11-30</entry>
</dates>
</vuln>
<vuln vid="aa4f86af-3172-11e2-ad21-20cf30e32f6d">
<topic>YUI JavaScript library -- JavaScript injection exploits in Flash components</topic>
<affects>
<package>
<name>yahoo-ui</name>
<range><le>2.8.2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The YUI team reports:</p>
<blockquote cite="http://yuilibrary.com/support/20121030-vulnerability/">
<h1>Vulnerability in YUI 2.4.0 through YUI 2.9.0</h1>
<p>A XSS vulnerability has been discovered in some YUI 2 .swf files
from versions 2.4.0 through 2.9.0. This defect allows JavaScript
injection exploits to be created against domains that host affected
YUI .swf files.</p>
<p>If your site loads YUI 2 from a CDN (yui.yahooapis.com,
ajax.googleapis.com, etc.) and not from your own domain, you
are not affected. YUI 3 is not affected by this issue.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-5881</cvename>
<cvename>CVE-2012-5882</cvename>
<url>http://yuilibrary.com/support/20121030-vulnerability/</url>
</references>
<dates>
<discovery>2012-10-30</discovery>
<entry>2012-11-27</entry>
<modified>2012-11-29</modified>
</dates>
</vuln>
<vuln vid="4d64fc61-3878-11e2-a4eb-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>23.0.1271.91</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/search/label/Stable%20updates">
<p>[156567] High CVE-2012-5133: Use-after-free in SVG filters. Credit
to miaubiz.</p>
<p>[148638] Medium CVE-2012-5130: Out-of-bounds read in Skia. Credit
to Atte Kettunen of OUSPG.</p>
<p>[155711] Low CVE-2012-5132: Browser crash with chunked encoding.
Credit to Attila Szász.</p>
<p>[158249] High CVE-2012-5134: Buffer underflow in libxml. Credit to
Google Chrome Security Team (Jüri Aedla).</p>
<p>[159165] Medium CVE-2012-5135: Use-after-free with printing.
Credit to Fermin Serna of Google Security Team.</p>
<p>[159829] Medium CVE-2012-5136: Bad cast in input element handling.
Credit to Google Chrome Security Team (Inferno).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-5130</cvename>
<cvename>CVE-2012-5132</cvename>
<cvename>CVE-2012-5133</cvename>
<cvename>CVE-2012-5134</cvename>
<cvename>CVE-2012-5135</cvename>
<cvename>CVE-2012-5136</cvename>
<url>http://googlechromereleases.blogspot.nl/search/label/Stable%20updates</url>
</references>
<dates>
<discovery>2012-11-26</discovery>
<entry>2012-11-27</entry>
</dates>
</vuln>
<vuln vid="5536c8e4-36b3-11e2-a633-902b343deec9">
<topic>FreeBSD -- Linux compatibility layer input validation error</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>7.4</ge><lt>7.4_11</lt></range>
<range><ge>8.3</ge><lt>8.3_5</lt></range>
<range><ge>9.0</ge><lt>9.0_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem description:</p>
<blockquote cite="http://www.freebsd.org/security/advisories/FreeBSD-SA-12:08.linux.asc">
<p>A programming error in the handling of some Linux system calls
may result in memory locations being accessed without proper
validation.</p>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-12:08.linux</freebsdsa>
<cvename>CVE-2012-4576</cvename>
</references>
<dates>
<discovery>2012-11-22</discovery>
<entry>2012-11-24</entry>
</dates>
</vuln>
<vuln vid="f115f693-36b2-11e2-a633-902b343deec9">
<topic>FreeBSD -- Insufficient message length validation for EAP-TLS messages</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>8.3</ge><lt>8.3_5</lt></range>
<range><ge>9.0</ge><lt>9.0_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem description:</p>
<blockquote cite="http://www.freebsd.org/security/advisories/FreeBSD-SA-12:07.hostapd.asc">
<p>The internal authentication server of hostapd does not
sufficiently validate the message length field of EAP-TLS
messages.</p>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-12:07.hostapd</freebsdsa>
<cvename>CVE-2012-4445</cvename>
</references>
<dates>
<discovery>2012-11-22</discovery>
<entry>2012-11-24</entry>
</dates>
</vuln>
<vuln vid="4b79538b-a450-11e2-9898-001060e06fd4">
<topic>FreeBSD -- Multiple Denial of Service vulnerabilities with named(8)</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>7.4</ge><lt>7.4_11</lt></range>
<range><ge>8.3</ge><lt>8.3_5</lt></range>
<range><ge>9.0</ge><lt>9.0_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem description:</p>
<blockquote cite="http://www.freebsd.org/security/advisories/FreeBSD-SA-12:06.bind.asc">
<p>The BIND daemon would crash when a query is made on a resource
record with RDATA that exceeds 65535 bytes.</p>
<p>The BIND daemon would lock up when a query is made on specific
combinations of RDATA.</p>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-12:06.bind</freebsdsa>
<cvename>CVE-2012-4244</cvename>
<cvename>CVE-2012-5166</cvename>
</references>
<dates>
<discovery>2012-11-22</discovery>
<entry>2012-11-24</entry>
</dates>
</vuln>
<vuln vid="0925716f-34e2-11e2-aa75-003067c2616f">
<topic>opera -- execution of arbitrary code</topic>
<affects>
<package>
<name>opera</name>
<range><lt>12.11</lt></range>
</package>
<package>
<name>opera-devel</name>
<range><lt>12.11</lt></range>
</package>
<package>
<name>linux-opera</name>
<range><lt>12.11</lt></range>
</package>
<package>
<name>linux-opera-devel</name>
<range><lt>12.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Opera reports:</p>
<blockquote cite="http://www.opera.com/support/kb/view/1036/">
<p>When requesting pages using HTTP, Opera temporarily stores the
response in a buffer. In some cases, Opera may incorrectly allocate
too little space for a buffer, and may then store too much of the
response in that buffer. This causes a buffer overflow, which in
turn can lead to a memory corruption and crash. It is possible to
use this crash to execute the overflowing data as code, which may
be controlled by an attacking site.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.opera.com/support/kb/view/1036/</url>
</references>
<dates>
<discovery>2012-11-19</discovery>
<entry>2012-11-22</entry>
<modified>2014-04-30</modified>
</dates>
</vuln>
<vuln vid="1cd3ca42-33e6-11e2-a255-5404a67eef98">
<topic>lighttpd -- remote DoS in header parsing</topic>
<affects>
<package>
<name>lighttpd</name>
<range><gt>1.4.30</gt><lt>1.4.32</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Lighttpd security advisory reports:</p>
<blockquote cite="http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2012_01.txt">
<p>Certain Connection header values will trigger an endless loop, for example:
"Connection: TE,,Keep-Alive"</p>
<p>On receiving such value, lighttpd will enter an endless loop,
detecting an empty token but not incrementing the current string
position, and keep reading the ',' again and again.</p>
<p>This bug was introduced in 1.4.31, when we fixed an "invalid read"
bug (it would try to read the byte before the string if it started
with ',', although the value wasn't actually used).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-5533</cvename>
</references>
<dates>
<discovery>2012-11-17</discovery>
<entry>2012-11-21</entry>
</dates>
</vuln>
<vuln vid="d23119df-335d-11e2-b64c-c8600054b392">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>11.0,1</gt><lt>17.0,1</lt></range>
<range><lt>10.0.11,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>10.0.11,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.14</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>10.0.11</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.14</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><gt>11.0</gt><lt>17.0</lt></range>
<range><lt>10.0.11</lt></range>
</package>
<package>
<name>libxul</name>
<range><gt>1.9.2.*</gt><lt>10.0.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2012-91 Miscellaneous memory safety hazards (rv:17.0/
rv:10.0.11)</p>
<p>MFSA 2012-92 Buffer overflow while rendering GIF images</p>
<p>MFSA 2012-93 evalInSanbox location context incorrectly applied</p>
<p>MFSA 2012-94 Crash when combining SVG text on path with CSS</p>
<p>MFSA 2012-95 Javascript: URLs run in privileged context on New Tab
page</p>
<p>MFSA 2012-96 Memory corruption in str_unescape</p>
<p>MFSA 2012-97 XMLHttpRequest inherits incorrect principal within
sandbox</p>
<p>MFSA 2012-98 Firefox installer DLL hijacking</p>
<p>MFSA 2012-99 XrayWrappers exposes chrome-only properties when not
in chrome compartment</p>
<p>MFSA 2012-100 Improper security filtering for cross-origin
wrappers</p>
<p>MFSA 2012-101 Improper character decoding in HZ-GB-2312 charset</p>
<p>MFSA 2012-102 Script entered into Developer Toolbar runs with
chrome privileges</p>
<p>MFSA 2012-103 Frames can shadow top.location</p>
<p>MFSA 2012-104 CSS and HTML injection through Style Inspector</p>
<p>MFSA 2012-105 Use-after-free and buffer overflow issues found</p>
<p>MFSA 2012-106 Use-after-free, buffer overflow, and memory
corruption issues found using Address Sanitizer</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-4201</cvename>
<cvename>CVE-2012-4202</cvename>
<cvename>CVE-2012-4203</cvename>
<cvename>CVE-2012-4204</cvename>
<cvename>CVE-2012-4205</cvename>
<cvename>CVE-2012-4206</cvename>
<cvename>CVE-2012-4207</cvename>
<cvename>CVE-2012-4208</cvename>
<cvename>CVE-2012-4209</cvename>
<cvename>CVE-2012-4210</cvename>
<cvename>CVE-2012-4212</cvename>
<cvename>CVE-2012-4213</cvename>
<cvename>CVE-2012-4214</cvename>
<cvename>CVE-2012-4215</cvename>
<cvename>CVE-2012-4216</cvename>
<cvename>CVE-2012-4217</cvename>
<cvename>CVE-2012-4218</cvename>
<cvename>CVE-2012-5829</cvename>
<cvename>CVE-2012-5830</cvename>
<cvename>CVE-2012-5833</cvename>
<cvename>CVE-2012-5835</cvename>
<cvename>CVE-2012-5836</cvename>
<cvename>CVE-2012-5837</cvename>
<cvename>CVE-2012-5838</cvename>
<cvename>CVE-2012-5839</cvename>
<cvename>CVE-2012-5840</cvename>
<cvename>CVE-2012-5841</cvename>
<cvename>CVE-2012-5842</cvename>
<cvename>CVE-2012-5843</cvename>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-90.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-91.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-92.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-93.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-94.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-95.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-96.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-97.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-98.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-99.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-100.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-101.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-102.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-103.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-104.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-105.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-106.html</url>
<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
</references>
<dates>
<discovery>2012-11-20</discovery>
<entry>2012-11-20</entry>
</dates>
</vuln>
<vuln vid="81826d12-317a-11e2-9186-406186f3d89d">
<topic>weechat -- Arbitrary shell command execution via scripts</topic>
<affects>
<package>
<name>weechat</name>
<range><ge>0.3.0</ge><lt>0.3.9.2</lt></range>
</package>
<package>
<name>weechat-devel</name>
<range><lt>20121118</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sebastien Helleu reports:</p>
<blockquote cite="http://weechat.org/security/">
<p>Untrusted command for function hook_process could lead to
execution of commands, because of shell expansions.</p>
<p>Workaround with a non-patched version: remove/unload all scripts
calling function hook_process (for maximum safety).</p>
</blockquote>
</body>
</description>
<references>
<url>http://weechat.org/security/</url>
<url>https://savannah.nongnu.org/bugs/?37764</url>
</references>
<dates>
<discovery>2012-11-15</discovery>
<entry>2012-11-18</entry>
<modified>2012-11-18</modified>
</dates>
</vuln>
<vuln vid="2b841f88-2e8d-11e2-ad21-20cf30e32f6d">
<topic>bugzilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>bugzilla</name>
<range><ge>3.6.0</ge><lt>3.6.12</lt></range>
<range><ge>4.0.0</ge><lt>4.0.9</lt></range>
<range><ge>4.2.0</ge><lt>4.2.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>A Bugzilla Security Advisory reports:</h1>
<blockquote cite="http://www.bugzilla.org/security/3.6.11/">
<p>The following security issues have been discovered in
Bugzilla:</p>
<h1>Information Leak</h1>
<p>If the visibility of a custom field is controlled by a product
or a component of a product you cannot see, their names are
disclosed in the JavaScript code generated for this custom field
despite they should remain confidential.</p>
<p>Calling the User.get method with a 'groups' argument leaks the
existence of the groups depending on whether an error is thrown
or not. This method now also throws an error if the user calling
this method does not belong to these groups (independently of
whether the groups exist or not).</p>
<p>Trying to mark an attachment in a bug you cannot see as obsolete
discloses its description in the error message. The description
of the attachment is now removed from the error message.</p>
<h1>Cross-Site Scripting</h1>
<p>Due to incorrectly filtered field values in tabular reports,
it is possible to inject code leading to XSS.</p>
<p>A vulnerability in swfstore.swf from YUI2 allows JavaScript
injection exploits to be created against domains that host this
affected YUI .swf file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-4199</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=731178</url>
<cvename>CVE-2012-4198</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=781850</url>
<cvename>CVE-2012-4197</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=802204</url>
<cvename>CVE-2012-4189</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=790296</url>
<cvename>CVE-2012-5881</cvename>
<cvename>CVE-2012-5882</cvename>
<cvename>CVE-2012-5883</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=808845</url>
<url>http://yuilibrary.com/support/20121030-vulnerability/</url>
</references>
<dates>
<discovery>2012-11-13</discovery>
<entry>2012-11-14</entry>
<modified>2012-11-27</modified>
</dates>
</vuln>
<vuln vid="79818ef9-2d10-11e2-9160-00262d5ed8ee">
<topic>typo3 -- Multiple vulnerabilities in TYPO3 Core</topic>
<affects>
<package>
<name>typo3</name>
<range><ge>4.5.0</ge><lt>4.5.21</lt></range>
<range><ge>4.6.0</ge><lt>4.6.14</lt></range>
<range><ge>4.7.0</ge><lt>4.7.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Typo Security Team reports:</p>
<blockquote cite="http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-005/">
<p>TYPO3 Backend History Module - Due to missing encoding of user
input, the history module is susceptible to SQL Injection and
Cross-Site Scripting. A valid backend login is required to exploit
this vulnerability. Credits go to Thomas Worm who discovered and
reported the issue.</p>
<p>TYPO3 Backend API - Failing to properly HTML-encode user input the
tree render API (TCA-Tree) is susceptible to Cross-Site Scripting.
TYPO3 Versions below 6.0 does not make us of this API, thus is not
exploitable, if no third party extension is installed which uses
this API. A valid backend login is required to exploit this
vulnerability. Credits go to Richard Brain who discovered and
reported the issue.</p>
</blockquote>
</body>
</description>
<references>
<url>http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-005/</url>
</references>
<dates>
<discovery>2012-11-08</discovery>
<entry>2012-11-12</entry>
</dates>
</vuln>
<vuln vid="a537b449-2b19-11e2-b339-90e6ba652cce">
<topic>DomainKeys Identified Mail (DKIM) Verifiers may inappropriately convey message trust</topic>
<affects>
<package>
<name>opendkim</name>
<range><lt>2.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>US-CERT reports:</p>
<blockquote cite="http://www.kb.cert.org/vuls/id/268267">
<p>DomainKeys Identified Mail (DKIM) Verifiers may
inappropriately convey message trust when messages are
signed using test or small bit signing keys.</p>
</blockquote>
</body>
</description>
<references>
<certvu>268267</certvu>
</references>
<dates>
<discovery>2012-10-24</discovery>
<entry>2012-11-12</entry>
</dates>
</vuln>
<vuln vid="e02c572f-2af0-11e2-bb44-003067b2972c">
<topic>weechat -- Crash or freeze when decoding IRC colors in strings</topic>
<affects>
<package>
<name>weechat</name>
<range><ge>0.3.6</ge><lt>0.3.9.1</lt></range>
</package>
<package>
<name>weechat-devel</name>
<range><ge>20110614</ge><lt>20121110</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sebastien Helleu reports:</p>
<blockquote cite="https://savannah.nongnu.org/bugs/?37704">
<p>A buffer overflow is causing a crash or freeze of WeeChat when
decoding IRC colors in strings.</p>
<p>Workaround for a non-patched version:
/set irc.network.colors_receive off</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-5854</cvename>
<freebsdpr>ports/173513</freebsdpr>
<url>http://weechat.org/security/</url>
<url>https://savannah.nongnu.org/bugs/?37704</url>
</references>
<dates>
<discovery>2012-11-09</discovery>
<entry>2012-11-10</entry>
<modified>2012-11-13</modified>
</dates>
</vuln>
<vuln vid="5e647ca3-2aea-11e2-b745-001fd0af1a4c">
<topic>ruby -- Hash-flooding DoS vulnerability for ruby 1.9</topic>
<affects>
<package>
<name>ruby</name>
<range><ge>1.9</ge><lt>1.9.3.327</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The official ruby site reports:</p>
<blockquote cite="http://www.ruby-lang.org/en/news/2012/11/09/ruby19-hashdos-cve-2012-5371/">
<p>Carefully crafted sequence of strings can cause a denial of service
attack on the service that parses the sequence to create a Hash
object by using the strings as keys. For instance, this
vulnerability affects web application that parses the JSON data
sent from untrusted entity.</p>
<p>This vulnerability is similar to CVS-2011-4815 for ruby 1.8.7. ruby
1.9 versions were using modified MurmurHash function but it's
reported that there is a way to create sequence of strings that
collide their hash values each other. This fix changes the Hash
function of String object from the MurmurHash to SipHash 2-4.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-5371</cvename>
<url>http://www.ruby-lang.org/en/news/2012/11/09/ruby19-hashdos-cve-2012-5371/</url>
</references>
<dates>
<discovery>2012-11-10</discovery>
<entry>2012-11-10</entry>
</dates>
</vuln>
<vuln vid="152e4c7e-2a2e-11e2-99c7-00a0d181e71d">
<topic>tomcat -- authentication weaknesses</topic>
<affects>
<package>
<name>tomcat</name>
<range><gt>5.5.0</gt><lt>5.5.36</lt></range>
<range><gt>6.0.0</gt><lt>6.0.36</lt></range>
<range><gt>7.0.0</gt><lt>7.0.30</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Software Foundation reports:</p>
<blockquote cite="http://tomcat.apache.org/security.html">
<p>Three weaknesses in Tomcat's implementation of DIGEST
authentication were identified and resolved:</p>
<ul>
<li> Tomcat tracked client rather than server nonces and nonce count.</li>
<li> When a session ID was present, authentication was bypassed.</li>
<li> The user name and password were not checked before when indicating
that a nonce was stale.</li>
</ul>
<p>These issues reduced the security of DIGEST authentication making
replay attacks possible in some circumstances.</p>
<p>The first issue was identified by Tilmann Kuhn. The second and third
issues were identified by the Tomcat security team during the code
review resulting from the first issue.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3439</cvename>
<url>http://tomcat.apache.org/security.html</url>
<url>http://tomcat.apache.org/security-5.html</url>
<url>http://tomcat.apache.org/security-6.html</url>
<url>http://tomcat.apache.org/security-7.html</url>
</references>
<dates>
<discovery>2012-11-05</discovery>
<entry>2012-11-08</entry>
<modified>2012-11-09</modified>
</dates>
</vuln>
<vuln vid="4ca26574-2a2c-11e2-99c7-00a0d181e71d">
<topic>tomcat -- Denial of Service</topic>
<affects>
<package>
<name>tomcat</name>
<range><gt>6.0.0</gt><lt>6.0.36</lt></range>
<range><gt>7.0.0</gt><lt>7.0.28</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Software Foundation reports:</p>
<blockquote cite="http://tomcat.apache.org/security.html">
<p>The checks that limited the permitted size of request headers were
implemented too late in the request parsing process for the HTTP NIO
connector. This enabled a malicious user to trigger an
OutOfMemoryError by sending a single request with very large
headers. This issue was identified by Josh Spiewak.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2733</cvename>
<url>http://tomcat.apache.org/security.html</url>
<url>http://tomcat.apache.org/security-6.html</url>
<url>http://tomcat.apache.org/security-7.html</url>
</references>
<dates>
<discovery>2012-11-05</discovery>
<entry>2012-11-08</entry>
<modified>2012-11-09</modified>
</dates>
</vuln>
<vuln vid="4b8b748e-2a24-11e2-bb44-003067b2972c">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-f10-flashplugin</name>
<range><le>11.2r202.243</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://www.adobe.com/support/security/bulletins/apsb12-22.html">
<p>These vulnerabilities could cause a crash and potentially allow an attacker to take control of the affected system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-5274</cvename>
<cvename>CVE-2012-5275</cvename>
<cvename>CVE-2012-5276</cvename>
<cvename>CVE-2012-5277</cvename>
<cvename>CVE-2012-5278</cvename>
<cvename>CVE-2012-5279</cvename>
<cvename>CVE-2012-5280</cvename>
<url>https://www.adobe.com/support/security/bulletins/apsb12-24.html</url>
</references>
<dates>
<discovery>2012-10-08</discovery>
<entry>2012-11-02</entry>
</dates>
</vuln>
<vuln vid="209c068d-28be-11e2-9160-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>23.0.1271.64</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/search/label/Stable%20updates">
<p>[157079] Medium CVE-2012-5127: Integer overflow leading to
out-of-bounds read in WebP handling. Credit to Phil Turnbull.</p>
<p>[Linux 64-bit only] [150729] Medium CVE-2012-5120: Out-of-bounds
array access in v8. Credit to Atte Kettunen of OUSPG.</p>
<p>[143761] High CVE-2012-5116: Use-after-free in SVG filter
handling. Credit to miaubiz.</p>
<p>[Mac OS only] [149717] High CVE-2012-5118: Integer bounds check
issue in GPU command buffers. Credit to miaubiz.</p>
<p>[154055] High CVE-2012-5121: Use-after-free in video layout.
Credit to Atte Kettunen of OUSPG.</p>
<p>[145915] Low CVE-2012-5117: Inappropriate load of SVG subresource
in img context. Credit to Felix Gröbert of the Google Security
Team.</p>
<p>[149759] Medium CVE-2012-5119: Race condition in Pepper buffer
handling. Credit to Fermin Serna of the Google Security Team.</p>
<p>[154465] Medium CVE-2012-5122: Bad cast in input handling. Credit
to Google Chrome Security Team (Inferno).</p>
<p>[154590] [156826] Medium CVE-2012-5123: Out-of-bounds reads in
Skia. Credit to Google Chrome Security Team (Inferno).</p>
<p>[155323] High CVE-2012-5124: Memory corruption in texture handling.
Credit to Al Patrick of the Chromium development community.</p>
<p>[156051] Medium CVE-2012-5125: Use-after-free in extension tab
handling. Credit to Alexander Potapenko of the Chromium development
community.</p>
<p>[156366] Medium CVE-2012-5126: Use-after-free in plug-in
placeholder handling. Credit to Google Chrome Security Team
(Inferno).</p>
<p>[157124] High CVE-2012-5128: Bad write in v8. Credit to Google
Chrome Security Team (Cris Neckar).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-5127</cvename>
<cvename>CVE-2012-5120</cvename>
<cvename>CVE-2012-5116</cvename>
<cvename>CVE-2012-5118</cvename>
<cvename>CVE-2012-5121</cvename>
<cvename>CVE-2012-5117</cvename>
<cvename>CVE-2012-5119</cvename>
<cvename>CVE-2012-5122</cvename>
<cvename>CVE-2012-5123</cvename>
<cvename>CVE-2012-5124</cvename>
<cvename>CVE-2012-5125</cvename>
<cvename>CVE-2012-5126</cvename>
<cvename>CVE-2012-5128</cvename>
<url>http://googlechromereleases.blogspot.nl/search/label/Stable%20updates</url>
</references>
<dates>
<discovery>2012-11-06</discovery>
<entry>2012-11-07</entry>
</dates>
</vuln>
<vuln vid="38daea4f-2851-11e2-9483-14dae938ec40">
<topic>opera -- multiple vulnerabilities</topic>
<affects>
<package>
<name>opera</name>
<range><lt>12.10</lt></range>
</package>
<package>
<name>opera-devel</name>
<range><lt>12.10</lt></range>
</package>
<package>
<name>linux-opera</name>
<range><lt>12.10</lt></range>
</package>
<package>
<name>linux-opera-devel</name>
<range><lt>12.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Opera reports:</p>
<blockquote cite="http://www.opera.com/support/kb/view/1030/">
<p>CORS (Cross-Origin Resource Sharing) allows web pages to retrieve
the contents of pages from other sites, with their permission,
as they would appear for the current user.
When requests are made in this way, the browser should only allow
the page content to be retrieved if the target site sends the
correct headers that give permission for their contents to be
used in this way. Specially crafted requests may trick Opera
into thinking that the target site has given permission when it
had not done so. This can result in the contents of any target page
being revealed to untrusted sites, including any
sensitive information or session IDs contained within the
source of those pages.</p>
</blockquote>
<p>Also reported are vulnerabilities involving SVG graphics and XSS.</p>
</body>
</description>
<references>
<url>http://www.opera.com/support/kb/view/1030/</url>
<url>http://www.opera.com/support/kb/view/1031/</url>
<url>http://www.opera.com/support/kb/view/1033/</url>
</references>
<dates>
<discovery>2012-11-06</discovery>
<entry>2012-11-06</entry>
<modified>2014-04-30</modified>
</dates>
</vuln>
<vuln vid="36533a59-2770-11e2-bb44-003067b2972c">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-f10-flashplugin</name>
<range><le>11.2r202.238</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://www.adobe.com/support/security/bulletins/apsb12-22.html">
<p>These vulnerabilities could cause a crash and potentially allow an attacker to take control of the affected system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-5248</cvename>
<cvename>CVE-2012-5249</cvename>
<cvename>CVE-2012-5250</cvename>
<cvename>CVE-2012-5251</cvename>
<cvename>CVE-2012-5252</cvename>
<cvename>CVE-2012-5253</cvename>
<cvename>CVE-2012-5254</cvename>
<cvename>CVE-2012-5255</cvename>
<cvename>CVE-2012-5256</cvename>
<cvename>CVE-2012-5257</cvename>
<cvename>CVE-2012-5258</cvename>
<cvename>CVE-2012-5259</cvename>
<cvename>CVE-2012-5260</cvename>
<cvename>CVE-2012-5261</cvename>
<cvename>CVE-2012-5262</cvename>
<cvename>CVE-2012-5263</cvename>
<cvename>CVE-2012-5264</cvename>
<cvename>CVE-2012-5265</cvename>
<cvename>CVE-2012-5266</cvename>
<cvename>CVE-2012-5267</cvename>
<cvename>CVE-2012-5269</cvename>
<cvename>CVE-2012-5270</cvename>
<cvename>CVE-2012-5271</cvename>
<cvename>CVE-2012-5272</cvename>
<cvename>CVE-2012-5285</cvename>
<cvename>CVE-2012-5286</cvename>
<cvename>CVE-2012-5287</cvename>
<cvename>CVE-2012-5673</cvename>
<cvename>CVE-2012-2034</cvename>
<cvename>CVE-2012-2035</cvename>
<cvename>CVE-2012-2036</cvename>
<cvename>CVE-2012-2037</cvename>
<cvename>CVE-2012-2038</cvename>
<cvename>CVE-2012-2039</cvename>
<cvename>CVE-2012-2040</cvename>
<url>https://www.adobe.com/support/security/bulletins/apsb12-22.html</url>
</references>
<dates>
<discovery>2012-10-08</discovery>
<entry>2012-11-02</entry>
</dates>
</vuln>
<vuln vid="65539c54-2517-11e2-b9d6-20cf30e32f6d">
<topic>apache22 -- several vulnerabilities</topic>
<affects>
<package>
<name>apache22</name>
<range><gt>2.2.0</gt><lt>2.2.23</lt></range>
</package>
<package>
<name>apache22-event-mpm</name>
<range><gt>2.2.0</gt><lt>2.2.23</lt></range>
</package>
<package>
<name>apache22-itk-mpm</name>
<range><gt>2.2.0</gt><lt>2.2.23</lt></range>
</package>
<package>
<name>apache22-peruser-mpm</name>
<range><gt>2.2.0</gt><lt>2.2.23</lt></range>
</package>
<package>
<name>apache22-worker-mpm</name>
<range><gt>2.2.0</gt><lt>2.2.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Apache HTTP SERVER PROJECT reports:</h1>
<blockquote cite="http://httpd.apache.org/security/vulnerabilities_22.html">
<h1>low: XSS in mod_negotiation when untrusted uploads are supported CVE-2012-2687</h1>
<p>Possible XSS for sites which use mod_negotiation and
allow untrusted uploads to locations which have MultiViews enabled.</p>
<h1>low: insecure LD_LIBRARY_PATH handling CVE-2012-0883</h1>
<p>This issue was already fixed in port version 2.2.22_5</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2687</cvename>
<cvename>CVE-2012-0833</cvename><!-- already fixed in r301849 -->
</references>
<dates>
<discovery>2012-09-13</discovery>
<entry>2012-11-02</entry>
</dates>
</vuln>
<vuln vid="ec89dc70-2515-11e2-8eda-000a5e1e33c6">
<topic>webmin -- potential XSS attack via real name field</topic>
<affects>
<package>
<name>webmin</name>
<range><lt>1.600_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The webmin updates site reports</p>
<blockquote cite="http://www.webmin.com/updates.html">
<p>Module: Change Passwords; Version: 1.600; Problem: Fix for potential XSS attack
via real name field; Solution: New module.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.webmin.com/updates.html</url>
</references>
<dates>
<discovery>2012-11-02</discovery>
<entry>2012-11-02</entry>
</dates>
</vuln>
<vuln vid="3decc87d-2498-11e2-b0c7-000d601460a4">
<topic>ruby -- Unintentional file creation caused by inserting an illegal NUL character</topic>
<affects>
<package>
<name>ruby</name>
<range><gt>1.9.3,1</gt><lt>1.9.3.286,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The official ruby site reports:</p>
<blockquote cite="http://www.ruby-lang.org/en/news/2012/10/12/poisoned-NUL-byte-vulnerability/">
<p>A vulnerability was found that file creation routines can create
unintended files by strategically inserting NUL(s) in file paths.
This vulnerability has been reported as CVE-2012-4522.</p>
<p>Ruby can handle arbitrary binary patterns as Strings, including
NUL chars. On the other hand OSes and other libraries tend not.
They usually treat a NUL as an End of String mark. So to interface
them with Ruby, NUL chars should properly be avoided.</p>
<p>However methods like IO#open did not check the filename passed to
them, and just passed those strings to lower layer routines. This
led to create unintentional files.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-4522</cvename>
<url>http://www.ruby-lang.org/en/news/2012/10/12/poisoned-NUL-byte-vulnerability/</url>
<url>https://access.redhat.com/security/cve/CVE-2012-4522/</url>
</references>
<dates>
<discovery>2012-10-12</discovery>
<entry>2012-11-01</entry>
</dates>
</vuln>
<vuln vid="2a093853-2495-11e2-b0c7-000d601460a4">
<topic>ruby -- $SAFE escaping vulnerability about Exception#to_s/NameError#to_s</topic>
<affects>
<package>
<name>ruby</name>
<range><gt>1.8.7,1</gt><lt>1.8.7.371,1</lt></range>
<range><gt>1.9.3,1</gt><lt>1.9.3.286,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The official ruby site reports:</p>
<blockquote cite="http://www.ruby-lang.org/en/news/2012/10/12/cve-2012-4464-cve-2012-4466/">
<p>Vulnerabilities found for Exception#to_s, NameError#to_s, and
name_err_mesg_to_s() which is Ruby interpreter-internal API. A
malicious user code can bypass $SAFE check by utilizing one of
those security holes.</p>
<p>Ruby's $SAFE mechanism enables untrusted user codes to run in
$SAFE &gt;= 4 mode. This is a kind of sandboxing so some operations
are restricted in that mode to protect other data outside the
sandbox.</p>
<p>The problem found was around this mechanism. Exception#to_s,
NameError#to_s, and name_err_mesg_to_s() interpreter-internal API
was not correctly handling the $SAFE bits so a String object which
is not tainted can destructively be marked as tainted using them.
By using this an untrusted code in a sandbox can modify a
formerly-untainted string destructively.</p>
<p>Ruby 1.8 once had a similar security issue. It fixed
Exception#to_s and NameError#to_s, but name_err_mesg_to_str() issue
survived previous security fix</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-4464</cvename>
<cvename>CVE-2012-4466</cvename>
<url>http://www.ruby-lang.org/en/news/2012/10/12/cve-2012-4464-cve-2012-4466/</url>
<url>https://access.redhat.com/security/cve/CVE-2012-4464/</url>
</references>
<dates>
<discovery>2012-08-21</discovery>
<entry>2012-11-01</entry>
</dates>
</vuln>
<vuln vid="4b738d54-2427-11e2-9817-c8600054b392">
<topic>RT -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>rt40</name>
<range><ge>4.0</ge><lt>4.0.8</lt></range>
</package>
<package>
<name>rt38</name>
<range><lt>3.8.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>BestPractical report:</p>
<blockquote cite="http://blog.bestpractical.com/2012/10/security-vulnerabilities-in-rt.html">
<p>All versions of RT are vulnerable to an email header injection
attack. Users with ModifySelf or AdminUser can cause RT to add
arbitrary headers or content to outgoing mail. Depending on the
scrips that are configured, this may be be leveraged for information
leakage or phishing.</p>
<p>RT 4.0.0 and above and RTFM 2.0.0 and above contain a vulnerability
due to lack of proper rights checking, allowing any privileged user
to create Articles in any class.</p>
<p>All versions of RT with cross-site-request forgery (CSRF)
protection (RT 3.8.12 and above, RT 4.0.6 and above, and any
instances running the security patches released 2012-05-22) contain
a vulnerability which incorrectly allows though CSRF requests which
toggle ticket bookmarks.</p>
<p>All versions of RT are vulnerable to a confused deputy attack on
the user. While not strictly a CSRF attack, users who are not logged
in who are tricked into following a malicious link may, after
supplying their credentials, be subject to an attack which leverages
their credentials to modify arbitrary state. While users who were
logged in would have observed the CSRF protection page, users who
were not logged in receive no such warning due to the intervening
login process. RT has been extended to notify users of pending
actions during the login process.</p>
<p>RT 3.8.0 and above are susceptible to a number of vulnerabilities
concerning improper signing or encryption of messages using GnuPG;
if GnuPG is not enabled, none of the following affect you.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-4730</cvename>
<cvename>CVE-2012-4731</cvename>
<cvename>CVE-2012-4732</cvename>
<cvename>CVE-2012-4734</cvename>
<cvename>CVE-2012-4735</cvename>
<cvename>CVE-2012-4884</cvename>
<url>http://blog.bestpractical.com/2012/10/security-vulnerabilities-in-rt.html</url>
</references>
<dates>
<discovery>2012-10-26</discovery>
<entry>2012-11-01</entry>
</dates>
</vuln>
<vuln vid="2adc3e78-22d1-11e2-b9f0-d0df9acfd7e5">
<topic>drupal7 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>drupal7</name>
<range><lt>7.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team reports:</p>
<blockquote cite="http://drupal.org/node/1815912">
<ol>
<li>
<p>Arbitrary PHP code execution</p>
<p>A bug in the installer code was identified that allows an attacker
to re-install Drupal using an external database server under certain
transient conditions. This could allow the attacker to execute
arbitrary PHP code on the original server.</p>
</li>
<li>
<p>Information disclosure - OpenID module</p>
<p>For sites using the core OpenID module, an information disclosure
vulnerability was identified that allows an attacker to read files
on the local filesystem by attempting to log in to the site using a
malicious OpenID server.</p>
</li>
</ol>
</blockquote>
</body>
</description>
<references>
<url>http://drupal.org/node/1815912</url>
</references>
<dates>
<discovery>2012-10-17</discovery>
<entry>2012-10-31</entry>
</dates>
</vuln>
<vuln vid="6b3b1b97-207c-11e2-a03f-c8600054b392">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>11.0,1</gt><lt>16.0.2,1</lt></range>
<range><lt>10.0.10,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>10.0.10,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.13.2</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>10.0.10</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.13.2</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><gt>11.0</gt><lt>16.0.2</lt></range>
<range><lt>10.0.10</lt></range>
</package>
<package>
<name>libxul</name>
<range><gt>1.9.2.*</gt><lt>10.0.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2012-90 Fixes for Location object issues</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-4194</cvename>
<cvename>CVE-2012-4195</cvename>
<cvename>CVE-2012-4196</cvename>
<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-90.html</url>
</references>
<dates>
<discovery>2012-10-26</discovery>
<entry>2012-10-27</entry>
</dates>
</vuln>
<vuln vid="b0f3ab1f-1f3b-11e2-8fe9-0022156e8794">
<topic>Exim -- remote code execution</topic>
<affects>
<package>
<name>exim</name>
<range><ge>4.70</ge><lt>4.80.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>This vulnerability affects Exim instances built with DKIM
enabled (this is the default for FreeBSD Exim port) and running
verification of DKIM signatures on the incoming mail
messages.</p>
<p>Phil Penncock reports:</p>
<blockquote cite="https://lists.exim.org/lurker/message/20121026.080330.74b9147b.en.html">
<p>This is a SECURITY release, addressing a CRITICAL remote
code execution flaw in versions of Exim between 4.70 and
4.80 inclusive, when built with DKIM support (the default).</p>
<p>This security vulnerability can be exploited by anyone
who can send email from a domain for which they control the
DNS.</p>
<p>You are not vulnerable if you built Exim with DISABLE_DKIM
or if you put this at the start of an ACL plumbed into
acl_smtp_connect or acl_smtp_rcpt:</p>
<pre>warn control = dkim_disable_verify</pre>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-5671</cvename>
<url>https://lists.exim.org/lurker/message/20121026.080330.74b9147b.en.html</url>
</references>
<dates>
<discovery>2012-10-25</discovery>
<entry>2012-10-26</entry>
</dates>
</vuln>
<vuln vid="5f326d75-1db9-11e2-bc8f-d0df9acfd7e5">
<topic>django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>django</name>
<range><lt>1.4.2</lt></range>
</package>
<package>
<name>django13</name>
<range><lt>1.3.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Django Project reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2012/oct/17/security/">
<ol>
<li>
<p>Host header poisoning</p>
<p>Some parts of Django -- independent of end-user-written applications
-- make use of full URLs, including domain name, which are generated
from the HTTP Host header. Some attacks against this are beyond Django's
ability to control, and require the web server to be properly configured;
Django's documentation has for some time contained notes advising users
on such configuration.</p>
<p>Django's own built-in parsing of the Host header is, however, still
vulnerable, as was reported to us recently. The Host header parsing
in Django 1.3 and Django 1.4 -- specifically, django.http.HttpRequest.get_host()
-- was incorrectly handling username/password information in the header.
Thus, for example, the following Host header would be accepted by Django when
running on "validsite.com":</p>
<p>Host: validsite.com:random@evilsite.com</p>
<p>Using this, an attacker can cause parts of Django -- particularly the
password-reset mechanism -- to generate and display arbitrary URLs to users.</p>
<p>To remedy this, the parsing in HttpRequest.get_host() is being modified; Host
headers which contain potentially dangerous content (such as username/password
pairs) now raise the exception django.core.exceptions.SuspiciousOperation.</p>
</li>
<li>
<p>Documentation of HttpOnly cookie option</p>
<p>As of Django 1.4, session cookies are always sent with the HttpOnly flag, which
provides some additional protection from cross-site scripting attacks by denying
client-side scripts access to the session cookie.</p>
<p>Though not directly a security issue in Django, it has been reported that the
Django 1.4 documentation incorrectly described this change, by claiming that this
was now the default for all cookies set by the HttpResponse.set_cookie() method.</p>
<p>The Django documentation has been updated to reflect that this only applies to the
session cookie. Users of Django are encouraged to review their use of set_cookie()
to ensure that the HttpOnly flag is being set or unset appropriately.</p>
</li>
</ol>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-4520</cvename>
<url>https://www.djangoproject.com/weblog/2012/oct/17/security/</url>
</references>
<dates>
<discovery>2012-10-17</discovery>
<entry>2012-10-24</entry>
</dates>
</vuln>
<vuln vid="a7706414-1be7-11e2-9aad-902b343deec9">
<topic>Wireshark -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>wireshark</name>
<range><le>1.8.2_1</le></range>
</package>
<package>
<name>wireshark-lite</name>
<range><le>1.8.2_1</le></range>
</package>
<package>
<name>tshark</name>
<range><le>1.8.2_1</le></range>
</package>
<package>
<name>tshark-lite</name>
<range><le>1.8.2_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Wireshark reports:</p>
<blockquote cite="http://www.wireshark.org/docs/relnotes/wireshark-1.8.3.html">
<p>The HSRP dissector could go into an infinite loop.</p>
<p>The PPP dissector could abort.</p>
<p>Martin Wilck discovered an infinite loop in the DRDA
dissector.</p>
<p>Laurent Butti discovered a buffer overflow in the LDP
dissector.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-5237</cvename>
<cvename>CVE-2012-5238</cvename>
<cvename>CVE-2012-5239</cvename>
<cvename>CVE-2012-5240</cvename>
<url>http://www.wireshark.org/security/wnpa-sec-2012-26.html</url>
<url>http://www.wireshark.org/security/wnpa-sec-2012-27.html</url>
<url>http://www.wireshark.org/security/wnpa-sec-2012-28.html</url>
<url>http://www.wireshark.org/security/wnpa-sec-2012-29.html</url>
<url>http://www.wireshark.org/docs/relnotes/wireshark-1.8.3.html</url>
</references>
<dates>
<discovery>2012-10-02</discovery>
<entry>2012-10-22</entry>
<modified>2013-06-19</modified>
</dates>
</vuln>
<vuln vid="57652765-18aa-11e2-8382-00a0d181e71d">
<topic>xlockmore -- local exploit</topic>
<affects>
<package>
<name>xlockmore</name>
<range><lt>5.40_1</lt></range>
</package>
<package>
<name>ja-xlockmore</name>
<range><lt>5.40_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ignatios Souvatzis of NetBSD reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2012/10/17/10">
<p>Due to an error in the dclock screensaver in xlockmore, users who
explicitly use this screensaver or a random mix of screensavers using
something like "xlockmore -mode random" may have their screen unlocked
unexpectedly at a random time.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-4524</cvename>
<mlist>http://www.openwall.com/lists/oss-security/2012/10/17/10</mlist>
</references>
<dates>
<discovery>2012-10-17</discovery>
<entry>2012-10-17</entry>
<modified>2014-04-30</modified>
</dates>
</vuln>
<vuln vid="e11955ca-187c-11e2-be36-00215af774f0">
<topic>xinetd -- attackers can bypass access restrictions if tcpmux-servers service enabled</topic>
<affects>
<package>
<name>xinetd</name>
<range><lt>2.3.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Thomas Swan reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=790940">
<p>xinetd allows for services to be configured with the TCPMUX
or TCPMUXPLUS service types, which makes those services
available on port 1, as per RFC 1078 [1], if the tcpmux-server
service is enabled. When the tcpmux-server service is enabled,
xinetd would expose _all_ enabled services via the tcpmux port,
instead of just the configured service(s). This could allow
a remote attacker to bypass firewall restrictions and access
services via the tcpmux port.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0862</cvename>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=790940</url>
</references>
<dates>
<discovery>2012-02-15</discovery>
<entry>2012-10-17</entry>
</dates>
</vuln>
<vuln vid="ec34d0c2-1799-11e2-b4ab-000c29033c32">
<topic>Zend Framework -- Multiple vulnerabilities via XXE injection</topic>
<affects>
<package>
<name>ZendFramework</name>
<range><lt>1.11.13</lt></range>
</package>
<package>
<name>magento</name>
<range><lt>1.7.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Zend Framework team reports:</p>
<blockquote cite="http://framework.zend.com/security/advisory/ZF2012-01">
<p>The XmlRpc package of Zend Framework is vulnerable to XML
eXternal Entity Injection attacks (both server and client).
The SimpleXMLElement class (SimpleXML PHP extension) is used
in an insecure way to parse XML data. External entities can be
specified by adding a specific DOCTYPE element to XML-RPC
requests. By exploiting this vulnerability an application may be
coerced to open arbitrary files and/or TCP connections.</p>
<p>Additionally, the Zend_Dom, Zend_Feed, Zend_Soap, and
Zend_XmlRpc components are vulnerable to XML Entity Expansion
(XEE) vectors, leading to Denial of Service vectors. XEE attacks
occur when the XML DOCTYPE declaration includes XML entity
definitions that contain either recursive or circular references;
this leads to CPU and memory consumption, making Denial of
Service exploits trivial to implement.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3363</cvename>
<url>https://www.sec-consult.com/files/20120626-0_zend_framework_xxe_injection.txt</url>
<url>http://framework.zend.com/security/advisory/ZF2012-01</url>
<url>http://framework.zend.com/security/advisory/ZF2012-02</url>
<url>http://www.openwall.com/lists/oss-security/2012/06/26/2</url>
<url>https://secunia.com/advisories/49665/</url>
<url>http://www.magentocommerce.com/download/release_notes</url>
</references>
<dates>
<discovery>2012-06-26</discovery>
<entry>2012-10-16</entry>
<modified>2015-10-14</modified>
</dates>
</vuln>
<vuln vid="f94befcd-1289-11e2-a25e-525400272390">
<topic>gitolite -- path traversal vulnerability</topic>
<affects>
<package>
<name>gitolite</name>
<range><ge>3.01</ge><le>3.04</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sitaram Chamarty reports:</p>
<blockquote cite="https://groups.google.com/forum/#!topic/gitolite/K9SnQNhCQ-0/discussion">
<p>I'm sorry to say there is a potential path traversal vulnerability in
v3. Thanks to Stephane Chazelas for finding it and alerting me.</p>
<p>Can it affect you? This can only affect you if you are using wild
card repos, *and* at least one of your patterns allows the string
"../" to match multiple times.</p>
<p>How badly can it affect you? A malicious user who *also* has the
ability to create arbitrary files in, say, /tmp (e.g., he has his own
userid on the same box), can compromise the entire "git" user.
Otherwise the worst he can do is create arbitrary repos in /tmp.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-4506</cvename>
<mlist msgid="CAMK1S_jotna+d_X2C-+es-M28i1aUBcsNeiXxwJ63EshQ8ht6w@mail.gmail.com">https://groups.google.com/forum/#!topic/gitolite/K9SnQNhCQ-0/discussion</mlist>
</references>
<dates>
<discovery>2012-10-09</discovery>
<entry>2012-10-15</entry>
</dates>
</vuln>
<vuln vid="ef417da3-1640-11e2-999b-e0cb4e266481">
<topic>phpMyAdmin -- Multiple XSS due to unescaped HTML output in Trigger, Procedure and Event pages and Fetching the version information from a non-SSL site is vulnerable to a MITM attack</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>3.5</ge><lt>3.5.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2012-6.php">
<p>When creating/modifying a trigger, event or procedure
with a crafted name, it is possible to trigger an XSS.</p>
</blockquote>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2012-7.php">
<p>To display information about the current phpMyAdmin
version on the main page, a piece of JavaScript is fetched
from the phpmyadmin.net website in non-SSL mode. A
man-in-the-middle could modify this script on the wire to
cause mischief.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-5339</cvename>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2012-6.php</url>
<cvename>CVE-2012-5368</cvename>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2012-7.php</url>
</references>
<dates>
<discovery>2012-10-08</discovery>
<entry>2012-10-14</entry>
</dates>
</vuln>
<vuln vid="09e83f7f-1326-11e2-afe3-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>22.0.1229.94</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/search/label/Stable%20updates">
<p>[154983][154987] Critical CVE-2012-5112: SVG use-after-free and
IPC arbitrary file write. Credit to Pinkie Pie.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-5112</cvename>
<url>http://googlechromereleases.blogspot.nl/search/label/Stable%20updates</url>
</references>
<dates>
<discovery>2012-10-10</discovery>
<entry>2012-10-10</entry>
</dates>
</vuln>
<vuln vid="6e5a9afd-12d3-11e2-b47d-c8600054b392">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>11.0,1</gt><lt>16.0.1,1</lt></range>
<range><lt>10.0.9,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>10.0.9,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.13.1</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>10.0.9</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.13.1</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><gt>11.0</gt><lt>16.0.1</lt></range>
<range><lt>10.0.9</lt></range>
</package>
<package>
<name>libxul</name>
<range><gt>1.9.2.*</gt><lt>10.0.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p> MFSA 2012-74 Miscellaneous memory safety hazards (rv:16.0/
rv:10.0.8)</p>
<p>MFSA 2012-75 select element persistance allows for attacks</p>
<p>MFSA 2012-76 Continued access to initial origin after setting
document.domain</p>
<p>MFSA 2012-77 Some DOMWindowUtils methods bypass security checks</p>
<p>MFSA 2012-78 Reader Mode pages have chrome privileges</p>
<p>MFSA 2012-79 DOS and crash with full screen and history navigation</p>
<p>MFSA 2012-80 Crash with invalid cast when using instanceof
operator</p>
<p>MFSA 2012-81 GetProperty function can bypass security checks</p>
<p>MFSA 2012-82 top object and location property accessible by
plugins</p>
<p>MFSA 2012-83 Chrome Object Wrapper (COW) does not disallow acces
to privileged functions or properties</p>
<p>MFSA 2012-84 Spoofing and script injection through location.hash</p>
<p>MFSA 2012-85 Use-after-free, buffer overflow, and out of bounds
read issues found using Address Sanitizer</p>
<p>MFSA 2012-86 Heap memory corruption issues found using Address
Sanitizer</p>
<p>MFSA 2012-87 Use-after-free in the IME State Manager</p>
<p>MFSA 2012-88 Miscellaneous memory safety hazards (rv:16.0.1)</p>
<p>MFSA 2012-89 defaultValue security checks not applied</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3982</cvename>
<cvename>CVE-2012-3983</cvename>
<cvename>CVE-2012-3984</cvename>
<cvename>CVE-2012-3985</cvename>
<cvename>CVE-2012-3986</cvename>
<cvename>CVE-2012-3987</cvename>
<cvename>CVE-2012-3988</cvename>
<cvename>CVE-2012-3989</cvename>
<cvename>CVE-2012-3990</cvename>
<cvename>CVE-2012-3991</cvename>
<cvename>CVE-2012-3992</cvename>
<cvename>CVE-2012-3993</cvename>
<cvename>CVE-2012-3994</cvename>
<cvename>CVE-2012-3995</cvename>
<cvename>CVE-2012-4179</cvename>
<cvename>CVE-2012-4180</cvename>
<cvename>CVE-2012-4181</cvename>
<cvename>CVE-2012-4182</cvename>
<cvename>CVE-2012-4183</cvename>
<cvename>CVE-2012-4184</cvename>
<cvename>CVE-2012-4186</cvename>
<cvename>CVE-2012-4187</cvename>
<cvename>CVE-2012-4188</cvename>
<cvename>CVE-2012-4190</cvename>
<cvename>CVE-2012-4191</cvename>
<cvename>CVE-2012-4192</cvename>
<cvename>CVE-2012-4193</cvename>
<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-74.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-75.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-76.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-77.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-78.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-79.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-80.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-81.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-82.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-83.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-84.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-85.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-86.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-87.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-88.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-89.html</url>
</references>
<dates>
<discovery>2012-10-09</discovery>
<entry>2012-10-10</entry>
<modified>2012-10-11</modified>
</dates>
</vuln>
<vuln vid="57a700f9-12c0-11e2-9f86-001d923933b6">
<topic>dns/bind9* -- crash on deliberately constructed combination of records</topic>
<affects>
<package>
<name>bind99</name>
<range><lt>9.9.1.4</lt></range>
</package>
<package>
<name>bind99-base</name>
<range><lt>9.9.1.4</lt></range>
</package>
<package>
<name>bind98</name>
<range><lt>9.8.3.4</lt></range>
</package>
<package>
<name>bind98-base</name>
<range><lt>9.8.3.4</lt></range>
</package>
<package>
<name>bind97</name>
<range><lt>9.7.6.4</lt></range>
</package>
<package>
<name>bind97-base</name>
<range><lt>9.7.6.4</lt></range>
</package>
<package>
<name>bind96</name>
<range><lt>9.6.3.1.ESV.R7.4</lt></range>
</package>
<package>
<name>bind96-base</name>
<range><lt>9.6.3.1.ESV.R7.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-00801/">
<p>A deliberately constructed combination of records could cause named
to hang while populating the additional section of a response.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-5166</cvename>
</references>
<dates>
<discovery>2012-09-26</discovery>
<entry>2012-10-10</entry>
</dates>
</vuln>
<vuln vid="e6161b65-1187-11e2-afe3-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>22.0.1229.92</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/search/label/Stable%20updates">
<p>[138208] High CVE-2012-2900: Crash in Skia text rendering. Credit
to Atte Kettunen of OUSPG.</p>
<p>[147499] Critical CVE-2012-5108: Race condition in audio device
handling. Credit to Atte Kettunen of OUSPG.</p>
<p>[148692] Medium CVE-2012-5109: OOB read in ICU regex. Credit to
Arthur Gerkis.</p>
<p>[151449] Medium CVE-2012-5110: Out-of-bounds read in compositor.
Credit to Google Chrome Security Team (Inferno).</p>
<p>[151895] Low CVE-2012-5111: Plug-in crash monitoring was missing
for Pepper plug-ins. Credit to Google Chrome Security Team (Chris
Evans).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2900</cvename>
<cvename>CVE-2012-5108</cvename>
<cvename>CVE-2012-5109</cvename>
<cvename>CVE-2012-5110</cvename>
<cvename>CVE-2012-5111</cvename>
<url>http://googlechromereleases.blogspot.nl/search/label/Stable%20updates</url>
</references>
<dates>
<discovery>2012-10-08</discovery>
<entry>2012-10-08</entry>
</dates>
</vuln>
<vuln vid="dee44ba9-08ab-11e2-a044-d0df9acfd7e5">
<topic>OpenX -- SQL injection vulnerability</topic>
<affects>
<package>
<name>openx</name>
<range><lt>2.8.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/50598/">
<p>A vulnerability has been discovered in OpenX, which can be
exploited by malicious people to conduct SQL injection
attacks.</p>
<p>Input passed via the "xajaxargs" parameter to
www/admin/updates-history.php (when "xajax" is set to
"expandOSURow") is not properly sanitised in e.g. the
"queryAuditBackupTablesByUpgradeId()" function
(lib/OA/Upgrade/DB_UpgradeAuditor.php) before being used in SQL
queries. This can be exploited to manipulate SQL queries by
injecting arbitrary SQL code.</p>
<p>The vulnerability is confirmed in version 2.8.9. Prior versions
may also be affected.</p>
</blockquote>
</body>
</description>
<references>
<url>http://secunia.com/advisories/50598/</url>
</references>
<dates>
<discovery>2012-09-14</discovery>
<entry>2012-09-27</entry>
</dates>
</vuln>
<vuln vid="5bae2ab4-0820-11e2-be5f-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>22.0.1229.79</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/search/label/Stable%20updates">
<p>[143439] High CVE-2012-2889: UXSS in frame handling. Credit to
Sergey Glazunov.</p>
<p>[143437] High CVE-2012-2886: UXSS in v8 bindings. Credit to Sergey
Glazunov.</p>
<p>[139814] High CVE-2012-2881: DOM tree corruption with plug-ins.
Credit to Chamal de Silva.</p>
<p>[135432] High CVE-2012-2876: Buffer overflow in SSE2 optimizations.
Credit to Atte Kettunen of OUSPG.</p>
<p>[140803] High CVE-2012-2883: Out-of-bounds write in Skia. Credit to
Atte Kettunen of OUSPG.</p>
<p>[143609] High CVE-2012-2887: Use-after-free in onclick handling.
Credit to Atte Kettunen of OUSPG.</p>
<p>[143656] High CVE-2012-2888: Use-after-free in SVG text references.
Credit to miaubiz.</p>
<p>[144899] High CVE-2012-2894: Crash in graphics context handling.
Credit to Slawomir Blazek.</p>
<p>[137707] Medium CVE-2012-2877: Browser crash with extensions and
modal dialogs. Credit to Nir Moshe.</p>
<p>[139168] Low CVE-2012-2879: DOM topology corruption. Credit to
pawlkt.</p>
<p>[141651] Medium CVE-2012-2884: Out-of-bounds read in Skia. Credit
to Atte Kettunen of OUSPG.</p>
<p>[132398] High CVE-2012-2874: Out-of-bounds write in Skia. Credit to
Google Chrome Security Team (Inferno).</p>
<p>[134955] [135488] [137106] [137288] [137302] [137547] [137556]
[137606] [137635] [137880] [137928] [144579] [145079] [145121]
[145163] [146462] Medium CVE-2012-2875: Various lower severity
issues in the PDF viewer. Credit to Mateusz Jurczyk of Google
Security Team, with contributions by Gynvael Coldwind of Google
Security Team.</p>
<p>[137852] High CVE-2012-2878: Use-after-free in plug-in handling.
Credit to Fermin Serna of Google Security Team.</p>
<p>[139462] Medium CVE-2012-2880: Race condition in plug-in paint
buffer. Credit to Google Chrome Security Team (Cris Neckar).</p>
<p>[140647] High CVE-2012-2882: Wild pointer in OGG container
handling. Credit to Google Chrome Security Team (Inferno).</p>
<p>[142310] Medium CVE-2012-2885: Possible double free on exit. Credit
to the Chromium development community.</p>
<p>[143798] [144072] [147402] High CVE-2012-2890: Use-after-free in
PDF viewer. Credit to Mateusz Jurczyk of Google Security Team, with
contributions by Gynvael Coldwind of Google Security Team.</p>
<p>[144051] Low CVE-2012-2891: Address leak over IPC. Credit to Lei
Zhang of the Chromium development community.</p>
<p>[144704] Low CVE-2012-2892: Pop-up block bypass. Credit to Google
Chrome Security Team (Cris Neckar).</p>
<p>[144799] High CVE-2012-2893: Double free in XSL transforms. Credit
to Google Chrome Security Team (Cris Neckar).</p>
<p>[145029] [145157] [146460] High CVE-2012-2895: Out-of-bounds writes
in PDF viewer. Credit to Mateusz Jurczyk of Google Security Team,
with contributions by Gynvael Coldwind of Google Security Team.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2889</cvename>
<cvename>CVE-2012-2886</cvename>
<cvename>CVE-2012-2881</cvename>
<cvename>CVE-2012-2876</cvename>
<cvename>CVE-2012-2883</cvename>
<cvename>CVE-2012-2887</cvename>
<cvename>CVE-2012-2888</cvename>
<cvename>CVE-2012-2894</cvename>
<cvename>CVE-2012-2877</cvename>
<cvename>CVE-2012-2879</cvename>
<cvename>CVE-2012-2884</cvename>
<cvename>CVE-2012-2874</cvename>
<cvename>CVE-2012-2875</cvename>
<cvename>CVE-2012-2878</cvename>
<cvename>CVE-2012-2880</cvename>
<cvename>CVE-2012-2882</cvename>
<cvename>CVE-2012-2885</cvename>
<cvename>CVE-2012-2890</cvename>
<cvename>CVE-2012-2891</cvename>
<cvename>CVE-2012-2892</cvename>
<cvename>CVE-2012-2893</cvename>
<cvename>CVE-2012-2895</cvename>
<url>http://googlechromereleases.blogspot.nl/search/label/Stable%20updates</url>
</references>
<dates>
<discovery>2012-09-25</discovery>
<entry>2012-09-26</entry>
</dates>
</vuln>
<vuln vid="73efb1b7-07ec-11e2-a391-000c29033c32">
<topic>eperl -- Remote code execution</topic>
<affects>
<package>
<name>eperl</name>
<range><le>2.2.14_4</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>David Madison reports:</p>
<blockquote cite="http://www.shmoo.com/mail/bugtraq/jun01/msg00286.shtml">
<p>ePerl is a multipurpose Perl filter and interpreter program
for Unix systems. The ePerl preprocessor contains an input
validation error. The preprocessor allows foreign data to be
"safely" included using the 'sinclude' directive.</p>
<p>The problem occurs when a file referenced by a 'sinclude'
directive contains a 'include' directive; the contents of
the file referred to by the second directive will be loaded
and executed.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2001-0733</cvename>
<url>http://www.shmoo.com/mail/bugtraq/jun01/msg00286.shtml</url>
<bid>2912</bid>
<url>http://xforce.iss.net/xforce/xfdb/6743</url>
<url>http://osvdb.org/show/osvdb/1880</url>
</references>
<dates>
<discovery>2001-06-21</discovery>
<entry>2012-09-26</entry>
</dates>
</vuln>
<vuln vid="98690c45-0361-11e2-a391-000c29033c32">
<topic>ImageMagick and GraphicsMagick -- DoS via specially crafted PNG file</topic>
<affects>
<package>
<name>ImageMagick</name>
<range><le>6.7.8.6</le></range>
</package>
<package>
<name>ImageMagick-nox11</name>
<range><le>6.7.8.6</le></range>
</package>
<package>
<name>GraphicsMagick</name>
<range><ge>1.3.0</ge><le>1.3.16</le></range>
</package>
<package>
<name>GraphicsMagick-nox11</name>
<range><ge>1.3.0</ge><le>1.3.16</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Kurt Seifried reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=844105">
<p>There is an issue in ImageMagick that is also present in
GraphicsMagick. CVE-2011-3026 deals with libpng memory
allocation, and limitations have been added so that a bad PNG
can't cause the system to allocate a lot of memory and a
denial of service. However on further investigation of
ImageMagick, Tom Lane found that PNG malloc function
(Magick_png_malloc) in turn calls AcquireMagickMemory with an
improper size argument.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3438</cvename>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=844105</url>
<bid>54716</bid>
<url>http://secunia.com/advisories/50090</url>
<url>http://xforce.iss.net/xforce/xfdb/77259</url>
<url>http://osvdb.org/show/osvdb/84323</url>
</references>
<dates>
<discovery>2012-07-28</discovery>
<entry>2012-09-20</entry>
<modified>2014-04-30</modified>
</dates>
</vuln>
<vuln vid="ec255bd8-02c6-11e2-92d1-000d601460a4">
<topic>php5-sqlite -- open_basedir bypass</topic>
<affects>
<package>
<name>php5-sqlite</name>
<range><ge>5.2</ge><lt>5.2.17_11</lt></range>
<range><ge>5.3</ge><lt>5.3.15</lt></range>
</package>
<package>
<name>php52-sqlite</name>
<range><lt>5.2.17_11</lt></range>
</package>
<package>
<name>php53-sqlite</name>
<range><lt>5.3.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE CVE team reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3365">
<p>The SQLite functionality in PHP before 5.3.15 allows remote
attackers to bypass the open_basedir protection mechanism via
unspecified vectors.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3365</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3365</url>
</references>
<dates>
<discovery>2012-06-14</discovery>
<entry>2012-09-19</entry>
</dates>
</vuln>
<vuln vid="9b2a5e88-02b8-11e2-92d1-000d601460a4">
<topic>php5 -- Denial of Service in php_date_parse_tzfile()</topic>
<affects>
<package>
<name>php5</name>
<range><ge>5.2</ge><lt>5.2.17_11</lt></range>
<range><ge>5.3</ge><lt>5.3.9</lt></range>
</package>
<package>
<name>php52</name>
<range><lt>5.2.17_11</lt></range>
</package>
<package>
<name>php53</name>
<range><lt>5.3.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE CVE team reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0789">
<p>Memory leak in the timezone functionality in PHP before 5.3.9
allows remote attackers to cause a denial of service (memory
consumption) by triggering many strtotime function calls, which are
not properly handled by the php_date_parse_tzfile cache.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0789</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0789</url>
<url>https://bugs.php.net/bug.php?id=53502</url>
</references>
<dates>
<discovery>2010-12-08</discovery>
<entry>2012-09-19</entry>
</dates>
</vuln>
<vuln vid="53a0ddef-0208-11e2-8afa-0024e830109b">
<topic>dns/bind9* -- Several vulnerabilities</topic>
<affects>
<package>
<name>bind99</name>
<range><lt>9.9.1.3</lt></range>
</package>
<package>
<name>bind98</name>
<range><lt>9.8.3.3</lt></range>
</package>
<package>
<name>bind97</name>
<range><lt>9.7.6.3</lt></range>
</package>
<package>
<name>bind96</name>
<range><lt>9.6.3.1.ESV.R7.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-00788">
<p>Prevents a crash when queried for a record whose RDATA exceeds
65535 bytes.</p>
<p>Prevents a crash when validating caused by using "Bad cache" data
before it has been initialized.</p>
<p>ISC_QUEUE handling for recursive clients was updated to address
a race condition that could cause a memory leak. This rarely
occurred with UDP clients, but could be a significant problem
for a server handling a steady rate of TCP queries.</p>
<p>A condition has been corrected where improper handling of
zero-length RDATA could cause undesirable behavior, including
termination of the named process.</p>
</blockquote>
</body>
</description>
<references>
<url/>
</references>
<dates>
<discovery>2012-09-12</discovery>
<entry>2012-09-18</entry>
</dates>
</vuln>
<vuln vid="d846af5b-00f4-11e2-b6d0-00e0814cab4e">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>1.482</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory reports:</p>
<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2012-09-17">
<p>This advisory announces security vulnerabilities that were found
in Jenkins core and several plugins.</p>
<ol>
<li>The first vulnerability in Jenkins core allows unprivileged
users to insert data into Jenkins master, which can lead to
remote code execution. For this vulnerability to be exploited,
the attacker must have an HTTP access to a Jenkins master, and
he must have a read access to Jenkins.</li>
<li>The second vulnerability in Jenkins core is a cross-site
scripting vulnerability. This allows an attacker to craft an URL
that points to Jenkins, and if a legitimate user clicks this link,
and the attacker will be able to hijack the user session.</li>
<li>The third vulnerability is a cross-site scripting vulnerability
in the Violations plugin</li>
<li>The fourth vulnerability is a cross-site scripting vulnerability
in The Continuous Integration Game plugin</li>
</ol>
</blockquote>
</body>
</description>
<references>
<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2012-09-17</url>
</references>
<dates>
<discovery>2012-09-17</discovery>
<entry>2012-09-17</entry>
</dates>
</vuln>
<vuln vid="62f36dfd-ff56-11e1-8821-001b2134ef46">
<topic>vlc -- arbitrary code execution in Real RTSP and MMS support</topic>
<affects>
<package>
<name>vlc</name>
<range><lt>2.0.1,3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jean-Baptiste Kempf, on behalf of the VideoLAN project reports:</p>
<blockquote cite="http://www.videolan.org/security/sa1201.html">
<p>If successful, a malicious third party could crash the VLC
media player process. Arbitrary code execution could be possible
on some systems.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.videolan.org/security/sa1201.html</url>
<url>http://www.videolan.org/security/sa1202.html</url>
<cvename>CVE-2012-1775</cvename>
<cvename>CVE-2012-1776</cvename>
</references>
<dates>
<discovery>2012-03-12</discovery>
<entry>2012-09-15</entry>
</dates>
</vuln>
<vuln vid="143f6932-fedb-11e1-ad4a-003067b2972c">
<topic>bacula -- Console ACL Bypass</topic>
<affects>
<package>
<name>bacula</name>
<range><lt>5.2.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://secunia.com/advisories/50535/">
<p>A security issue has been reported in Bacula, which can be
exploited by malicious users to bypass certain security
restrictions.</p>
<p>The security issue is caused due to an error within the implementation
of console ACLs, which can be exploited to gain access to certain
restricted functionality and e.g. dump resources.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-4430</cvename>
<url>http://www.bacula.org/git/cgit.cgi/bacula/commit/?id=67debcecd3d530c429e817e1d778e79dcd1db905</url>
<url>https://secunia.com/advisories/50535/</url>
<url>http://sourceforge.net/projects/bacula/files/bacula/5.2.11/ReleaseNotes/view</url>
</references>
<dates>
<discovery>2012-09-12</discovery>
<entry>2012-09-15</entry>
</dates>
</vuln>
<vuln vid="178ba4ea-fd40-11e1-b2ae-001fd0af1a4c">
<topic>mod_pagespeed -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mod_pagespeed</name>
<range><lt>0.10.22.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Reports:</p>
<blockquote cite="https://developers.google.com/speed/docs/mod_pagespeed/announce-0.10.22.6">
<p>mod_pagespeed 0.10.22.6 is a security update that fixes two
critical issues that affect earlier versions:</p>
<ul>
<li>CVE-2012-4001, a problem with validation of own host name.</li>
<li>CVE-2012-4360, a cross-site scripting attack, which affects versions starting from 0.10.19.1.</li>
</ul>
<p>The effect of the first problem is that it is possible to confuse
mod_pagespeed about its own host name, and to trick it into
fetching resources from other machines. This could be an issue if
the HTTP server has access to machines that are not otherwise
publicly visible.</p>
<p>The second problem would permit a hostile third party to execute
JavaScript in users' browsers in context of the domain running
mod_pagespeed, which could permit interception of users' cookies or
data on the site.</p>
<p>Because of the severity of the two problems, users are strongly
encouraged to update immediately.</p>
<p>Behavior Changes in the Update:</p>
<p>As part of the fix to the first issue, mod_pagespeed will not fetch
resources from machines other than localhost if they are not
explicitly mentioned in the configuration. This means that if you
need resources on the server's domain to be handled by some other
system, you'll need to explicitly use ModPagespeedMapOriginDomain
or ModPagespeedDomain to authorize that.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-4001</cvename>
<cvename>CVE-2012-4360</cvename>
<url>https://developers.google.com/speed/docs/mod_pagespeed/announce-0.10.22.6</url>
</references>
<dates>
<discovery>2012-09-12</discovery>
<entry>2012-09-12</entry>
</dates>
</vuln>
<vuln vid="3bbbe3aa-fbeb-11e1-8bd8-0022156e8794">
<topic>freeradius -- arbitrary code execution for TLS-based authentication</topic>
<affects>
<package>
<name>freeradius</name>
<range><ge>2.1.10</ge><lt>2.1.12_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>freeRADIUS security team reports:</p>
<blockquote cite="http://freeradius.org/security.html">
<p>Overflow in EAP-TLS for 2.1.10, 2.1.11 and 2.1.12.</p>
<p>The issue was found by Timo Warns, and communicated to
security@freeradius.org. A sample exploit for the issue was
included in the notification.</p>
<p>The vulnerability was created in commit a368a6f4f4aaf on
August 18, 2010. Vulnerable versions include 2.1.10, 2.1.11,
and 2.1.12. Also anyone running the git "master" branch
after August 18, 2010 is vulnerable.</p>
<p>All sites using TLS-based EAP methods and the above
versions are vulnerable. The only configuration change which
can avoid the issue is to disable EAP-TLS, EAP-TTLS, and
PEAP.</p>
<p>An external attacker can use this vulnerability to
over-write the stack frame of the RADIUS server, and cause
it to crash. In addition, more sophisticated attacks may
gain additional privileges on the system running the RADIUS
server.</p>
<p>This attack does not require local network access to the
RADIUS server. It can be done by an attacker through a WiFi
Access Point, so long as the Access Point is configured to
use 802.1X authentication with the RADIUS server.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3547</cvename>
<url>http://freeradius.org/security.html</url>
<url>http://www.pre-cert.de/advisories/PRE-SA-2012-06.txt</url>
</references>
<dates>
<discovery>2012-09-10</discovery>
<entry>2012-09-11</entry>
<modified>2012-09-11</modified>
</dates>
</vuln>
<vuln vid="c1e5f35e-f93d-11e1-b07f-00235a5f2c9a">
<topic>emacs -- remote code execution vulnerability</topic>
<affects>
<package>
<name>emacs</name>
<range><gt>24.*</gt><lt>24.2</lt></range>
<range><gt>23.*</gt><le>23.4_2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chong Yidong reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2012/08/13/1">
<p>Paul Ling has found a security flaw in the file-local
variables code in GNU Emacs.</p>
<p>When the Emacs user option `enable-local-variables' is
set to `:safe' (the default value is t), Emacs should
automatically refuse to evaluate `eval' forms in file-local
variable sections. Due to the bug, Emacs instead
automatically evaluates such `eval' forms. Thus, if the user
changes the value of `enable-local-variables' to `:safe',
visiting a malicious file can cause automatic execution of
arbitrary Emacs Lisp code with the permissions of the
user.</p>
<p>The bug is present in Emacs 23.2, 23.3, 23.4, and
24.1.</p>
</blockquote>
</body>
</description>
<references>
<bid>54969</bid>
<cvename>CVE-2012-3479</cvename>
<url>https://lists.gnu.org/archive/html/emacs-devel/2012-08/msg00802.html</url>
<url>http://debbugs.gnu.org/cgi/bugreport.cgi?bug=12155</url>
</references>
<dates>
<discovery>2012-08-13</discovery>
<entry>2012-09-08</entry>
<modified>2013-05-13</modified>
</dates>
</vuln>
<vuln vid="30149157-f926-11e1-95cd-001fd0af1a4c">
<topic>wordpress -- multiple unspecified privilege escalation bugs</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>3.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Wordpress reports:</p>
<blockquote cite="http://wordpress.org/news/2012/09/wordpress-3-4-2/">
<p>Version 3.4.2 also fixes a few security issues and contains some
security hardening. The vulnerabilities included potential
privilege escalation and a bug that affects multisite installs with
untrusted users. These issues were discovered and fixed by the
WordPress security team.</p>
</blockquote>
</body>
</description>
<references>
<url>http://wordpress.org/news/2012/09/wordpress-3-4-2/</url>
</references>
<dates>
<discovery>2012-09-06</discovery>
<entry>2012-09-07</entry>
</dates>
</vuln>
<vuln vid="4a8a98ab-f745-11e1-8bd8-0022156e8794">
<topic>moinmoin -- cross-site scripting via RST parser</topic>
<affects>
<package>
<name>moinmoin</name>
<range><lt>1.9.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE CVE team reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1058">
<p>Cross-site scripting (XSS) vulnerability in the
reStructuredText (rst) parser in parser/text_rst.py in
MoinMoin before 1.9.4, when docutils is installed or when
"format rst" is set, allows remote attackers to inject
arbitrary web script or HTML via a javascript: URL in the
refuri attribute.</p>
</blockquote>
</body>
</description>
<references>
<bid>46476</bid>
<cvename>CVE-2011-1058</cvename>
<url>http://moinmo.in/SecurityFixes</url>
</references>
<dates>
<discovery>2011-02-21</discovery>
<entry>2012-09-05</entry>
</dates>
</vuln>
<vuln vid="4f99e2ef-f725-11e1-8bd8-0022156e8794">
<topic>moinmoin -- wrong processing of group membership</topic>
<affects>
<package>
<name>moinmoin</name>
<range><ge>1.9</ge><lt>1.9.4_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MoinMoin developers report:</p>
<blockquote cite="http://hg.moinmo.in/moin/1.9/rev/7b9f39289e16">
<p>If you have group NAMES containing "All" or "Known" or
"Trusted", they behaved wrong until now (they erroneously
included All/Known/Trusted users even if you did not list
them as members), but will start working correctly with this
changeset.</p>
<p>E.g. AllFriendsGroup:</p>
<ul>
<li>JoeDoe</li>
</ul>
<p>AllFriendsGroup will now (correctly) include only JoeDoe.
It (erroneously) contained all users (including JoeDoe)
before.</p>
<p>E.g. MyTrustedFriendsGroup:</p>
<ul>
<li>JoeDoe</li>
</ul>
<p>MyTrustedFriendsGroup will now (correctly) include only
JoeDoe. It (erroneously) contained all trusted users and
JoeDoe before.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-4404</cvename>
<url>http://hg.moinmo.in/moin/1.9/rev/7b9f39289e16</url>
</references>
<dates>
<discovery>2012-09-03</discovery>
<entry>2012-09-05</entry>
<modified>2012-09-11</modified>
</dates>
</vuln>
<vuln vid="918f38cd-f71e-11e1-8bd8-0022156e8794">
<topic>php5 -- header splitting attack via carriage-return character</topic>
<affects>
<package>
<name>php5</name>
<range><ge>5.2</ge><lt>5.2.17_11</lt></range>
<range><ge>5.3</ge><lt>5.3.11</lt></range>
<range><ge>5.4</ge><lt>5.4.1</lt></range>
</package>
<package>
<name>php52</name>
<range><lt>5.2.17_11</lt></range>
</package>
<package>
<name>php53</name>
<range><lt>5.3.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Rui Hirokawa reports:</p>
<blockquote cite="https://bugs.php.net/bug.php?id=60227">
<p>As of PHP 5.1.2, header() can no longer be used to send
multiple response headers in a single call to prevent the
HTTP Response Splitting Attack. header() only checks the
linefeed (LF, 0x0A) as line-end marker, it doesn't check the
carriage-return (CR, 0x0D).</p>
<p>However, some browsers including Google Chrome, IE also
recognize CR as the line-end.</p>
<p>The current specification of header() still has the
vulnerability against the HTTP header splitting attack.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-1398</cvename>
<url>https://bugs.php.net/bug.php?id=60227</url>
</references>
<dates>
<discovery>2011-11-06</discovery>
<entry>2012-09-05</entry>
<modified>2012-09-19</modified>
</dates>
</vuln>
<vuln vid="b50913ce-f4a7-11e1-b135-003067b2972c">
<topic>bitcoin -- denial of service</topic>
<affects>
<package>
<name>bitcoin</name>
<range><lt>0.6.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://bitcointalk.org/?topic=88734">
<p>A unspecified denial-of-service attack that could cause the
bitcoin process to become unresponsive was found.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3789</cvename>
<url>https://bitcointalk.org/?topic=88734</url>
</references>
<dates>
<discovery>2012-07-20</discovery>
<entry>2012-09-02</entry>
</dates>
</vuln>
<vuln vid="6ad18fe5-f469-11e1-920d-20cf30e32f6d">
<topic>bugzilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>bugzilla</name>
<range><ge>3.6.0</ge><lt>3.6.11</lt></range>
<range><ge>4.0.0</ge><lt>4.0.8</lt></range>
<range><ge>4.2.0</ge><lt>4.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>A Bugzilla Security Advisory reports:</h1>
<blockquote cite="http://www.bugzilla.org/security/3.6.10/">
<p>The following security issues have been discovered in
Bugzilla:</p>
<h1>LDAP Injection</h1>
<p>When the user logs in using LDAP, the username is not
escaped when building the uid=$username filter which is
used to query the LDAP directory. This could potentially
lead to LDAP injection.</p>
<h1>Directory Browsing</h1>
<p>Extensions are not protected against directory browsing
and users can access the source code of the templates
which may contain sensitive data.
Directory browsing is blocked in Bugzilla 4.3.3 only,
because it requires a configuration change in the Apache
httpd.conf file to allow local .htaccess files to use
Options -Indexes. To not break existing installations,
this fix has not been backported to stable branches.
The access to templates is blocked for all supported
branches except the old 3.6 branch, because this branch
doesn't have .htaccess in the bzr repository and cannot
be fixed easily for existing installations without
potentially conflicting with custom changes.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3981</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=785470</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=785522</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=785511</url>
</references>
<dates>
<discovery>2012-08-30</discovery>
<entry>2012-09-01</entry>
</dates>
</vuln>
<vuln vid="342176a8-f464-11e1-8bd8-0022156e8794">
<topic>GNU gatekeeper -- denial of service</topic>
<affects>
<package>
<name>gatekeeper</name>
<range><lt>3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jan Willamowius reports:</p>
<blockquote cite="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-3534">
<p>GNU Gatekeeper before 3.1 does not limit the number
of connections to the status port, which allows remote
attackers to cause a denial of service (connection and
thread consumption) via a large number of connections.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3534</cvename>
<url>http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-3534</url>
<url>http://www.openwall.com/lists/oss-security/2012/08/25/4</url>
<url>http://www.gnugk.org/gnugk-3.1.html</url>
</references>
<dates>
<discovery>2012-08-15</discovery>
<entry>2012-09-01</entry>
</dates>
</vuln>
<vuln vid="7c0fecd6-f42f-11e1-b17b-000c2977ec30">
<topic>mediawiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mediawiki</name>
<range><ge>1.19</ge><lt>1.19.2</lt></range>
<range><ge>1.18</ge><lt>1.18.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mediawiki reports:</p>
<blockquote cite="http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-August/000119.html">
<p>(Bug 39700) Wikipedia administrator Writ Keeper discovered
a stored XSS (HTML injection) vulnerability. This was
possible due to the handling of link text on File: links for
nonexistent files. MediaWiki 1.16 and later is affected.</p>
<p>(Bug 39180) User Fomafix reported several DOM-based XSS
vulnerabilities, made possible by a combination of loose
filtering of the uselang parameter, and JavaScript gadgets
on various language Wikipedias.</p>
<p>(Bug 39180) During internal review, it was discovered that
CSRF tokens, available via the api, were not protected with
X-Frame-Options headers. This could lead to a CSRF vulnerability
if the API response is embedded in an external website using
using an iframe.</p>
<p>(Bug 39824) During internal review, it was discovered extensions
were not always allowed to prevent the account creation action.
This allowed users blocked by the GlobalBlocking extension to
create accounts.</p>
<p>(Bug 39184) During internal review, it was discovered that
password data was always saved to the local MediaWiki database
even if authentication was handled by an extension, such as LDAP.
This could allow a compromised MediaWiki installation to leak
information about user's LDAP passwords. Additionally, in situations
when an authentication plugin returned false in its strict
function, this would allow old passwords to be used for accounts
that did not exist in the external system, indefinitely.</p>
<p>(Bug 39823) During internal review, it was discovered that metadata
about blocks, hidden by a user with suppression rights, was visible
to administrators.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugzilla.wikimedia.org/show_bug.cgi?id=39700</url>
<url>https://bugzilla.wikimedia.org/show_bug.cgi?id=37587</url>
<url>https://bugzilla.wikimedia.org/show_bug.cgi?id=39180</url>
<url>https://bugzilla.wikimedia.org/show_bug.cgi?id=39824</url>
<url>https://bugzilla.wikimedia.org/show_bug.cgi?id=39184</url>
<url>https://bugzilla.wikimedia.org/show_bug.cgi?id=39823</url>
<cvename>CVE-2012-4377</cvename>
<cvename>CVE-2012-4378</cvename>
<cvename>CVE-2012-4379</cvename>
<cvename>CVE-2012-4380</cvename>
<cvename>CVE-2012-4381</cvename>
<cvename>CVE-2012-4382</cvename>
</references>
<dates>
<discovery>2012-08-27</discovery>
<entry>2012-09-01</entry>
</dates>
</vuln>
<vuln vid="5415f1b3-f33d-11e1-8bd8-0022156e8794">
<topic>wireshark -- denial of service in DRDA dissector</topic>
<affects>
<package>
<name>wireshark</name>
<range><ge>1.5</ge><lt>1.8.2_1</lt></range>
</package>
<package>
<name>wireshark-lite</name>
<range><ge>1.5</ge><lt>1.8.2_1</lt></range>
</package>
<package>
<name>tshark</name>
<range><ge>1.5</ge><lt>1.8.2_1</lt></range>
</package>
<package>
<name>tshark-lite</name>
<range><ge>1.5</ge><lt>1.8.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>RedHat security team reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=849926">
<p>A denial of service flaw was found in the way Distributed
Relational Database Architecture (DRDA) dissector of
Wireshark, a network traffic analyzer, performed processing
of certain DRDA packet capture files. A remote attacker
could create a specially-crafted capture file that, when
opened could lead to wireshark executable to consume
excessive amount of CPU time and hang with an infinite
loop.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3548</cvename>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=849926</url>
</references>
<dates>
<discovery>2012-08-21</discovery>
<entry>2012-08-31</entry>
<modified>2012-09-05</modified>
</dates>
</vuln>
<vuln vid="ee68923d-f2f5-11e1-8014-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>21.0.1180.89</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/search/label/Stable%20updates">
<p>[121347] Medium CVE-2012-2865: Out-of-bounds read in line breaking.
Credit to miaubiz.</p>
<p>[134897] High CVE-2012-2866: Bad cast with run-ins. Credit to
miaubiz.</p>
<p>[135485] Low CVE-2012-2867: Browser crash with SPDY.</p>
<p>[136881] Medium CVE-2012-2868: Race condition with workers and XHR.
Credit to miaubiz.</p>
<p>[137778] High CVE-2012-2869: Avoid stale buffer in URL loading.
Credit to Fermin Serna of the Google Security Team.</p>
<p>[138672] [140368] Low CVE-2012-2870: Lower severity memory
management issues in XPath. Credit to Nicolas Gregoire.</p>
<p>[138673] High CVE-2012-2871: Bad cast in XSL transforms. Credit to
Nicolas Gregoire.</p>
<p>[142956] Medium CVE-2012-2872: XSS in SSL interstitial. Credit to
Emmanuel Bronshtein.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2865</cvename>
<cvename>CVE-2012-2866</cvename>
<cvename>CVE-2012-2867</cvename>
<cvename>CVE-2012-2868</cvename>
<cvename>CVE-2012-2869</cvename>
<cvename>CVE-2012-2870</cvename>
<cvename>CVE-2012-2871</cvename>
<cvename>CVE-2012-2872</cvename>
<url>http://googlechromereleases.blogspot.nl/search/label/Stable%20updates</url>
</references>
<dates>
<discovery>2012-08-30</discovery>
<entry>2012-08-30</entry>
</dates>
</vuln>
<vuln vid="4c53f007-f2ed-11e1-a215-14dae9ebcf89">
<topic>asterisk -- multiple vulnerabilities</topic>
<affects>
<package>
<name>asterisk</name>
<range><gt>10.*</gt><lt>10.7.1</lt></range>
</package>
<package>
<name>asterisk18</name>
<range><gt>1.8.*</gt><lt>1.8.15.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/security">
<p>Asterisk Manager User Unauthorized Shell Access</p>
<p>ACL rules ignored when placing outbound calls by certain IAX2
users</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2186</cvename>
<cvename>CVE-2012-4737</cvename>
<url>http://downloads.digium.com/pub/security/AST-2012-012.html</url>
<url>http://downloads.digium.com/pub/security/AST-2012-013.html</url>
<url>https://www.asterisk.org/security</url>
</references>
<dates>
<discovery>2012-08-30</discovery>
<entry>2012-08-30</entry>
</dates>
</vuln>
<vuln vid="2b8cad90-f289-11e1-a215-14dae9ebcf89">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>11.0,1</gt><lt>15.0,1</lt></range>
<range><lt>10.0.7,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>10.0.7,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.12</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>10.0.7</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.12</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><gt>11.0</gt><lt>15.0</lt></range>
<range><lt>10.0.7</lt></range>
</package>
<package>
<name>libxul</name>
<range><gt>1.9.2.*</gt><lt>10.0.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2012-57 Miscellaneous memory safety hazards (rv:15.0/
rv:10.0.7)</p>
<p>MFSA 2012-58 Use-after-free issues found using Address
Sanitizer</p>
<p>MFSA 2012-59 Location object can be shadowed using
Object.defineProperty</p>
<p>MFSA 2012-60 Escalation of privilege through about:newtab</p>
<p>MFSA 2012-61 Memory corruption with bitmap format images with
negative height</p>
<p>MFSA 2012-62 WebGL use-after-free and memory corruption</p>
<p>MFSA 2012-63 SVG buffer overflow and use-after-free issues</p>
<p>MFSA 2012-64 Graphite 2 memory corruption</p>
<p>MFSA 2012-65 Out-of-bounds read in format-number in XSLT</p>
<p>MFSA 2012-66 HTTPMonitor extension allows for remote debugging
without explicit activation</p>
<p>MFSA 2012-67 Installer will launch incorrect executable following
new installation</p>
<p>MFSA 2012-68 DOMParser loads linked resources in extensions when
parsing text/html</p>
<p>MFSA 2012-69 Incorrect site SSL certificate data display</p>
<p>MFSA 2012-70 Location object security checks bypassed by chrome
code</p>
<p>MFSA 2012-71 Insecure use of __android_log_print</p>
<p>MFSA 2012-72 Web console eval capable of executing
chrome-privileged code</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-1956</cvename>
<cvename>CVE-2012-1970</cvename>
<cvename>CVE-2012-1971</cvename>
<cvename>CVE-2012-1972</cvename>
<cvename>CVE-2012-1973</cvename>
<cvename>CVE-2012-1974</cvename>
<cvename>CVE-2012-1975</cvename>
<cvename>CVE-2012-1976</cvename>
<cvename>CVE-2012-3956</cvename>
<cvename>CVE-2012-3957</cvename>
<cvename>CVE-2012-3958</cvename>
<cvename>CVE-2012-3959</cvename>
<cvename>CVE-2012-3960</cvename>
<cvename>CVE-2012-3961</cvename>
<cvename>CVE-2012-3962</cvename>
<cvename>CVE-2012-3963</cvename>
<cvename>CVE-2012-3964</cvename>
<cvename>CVE-2012-3965</cvename>
<cvename>CVE-2012-3966</cvename>
<cvename>CVE-2012-3967</cvename>
<cvename>CVE-2012-3968</cvename>
<cvename>CVE-2012-3969</cvename>
<cvename>CVE-2012-3970</cvename>
<cvename>CVE-2012-3971</cvename>
<cvename>CVE-2012-3972</cvename>
<cvename>CVE-2012-3973</cvename>
<cvename>CVE-2012-3974</cvename>
<cvename>CVE-2012-3975</cvename>
<cvename>CVE-2012-3976</cvename>
<cvename>CVE-2012-3978</cvename>
<cvename>CVE-2012-3979</cvename>
<cvename>CVE-2012-3980</cvename>
<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-57.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-58.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-59.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-60.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-61.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-62.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-63.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-64.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-65.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-66.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-67.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-68.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-69.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-70.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-71.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-72.html</url>
</references>
<dates>
<discovery>2012-08-28</discovery>
<entry>2012-08-30</entry>
</dates>
</vuln>
<vuln vid="6dd5e45c-f084-11e1-8d0f-406186f3d89d">
<topic>coppermine -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>coppermine</name>
<range><lt>1.5.20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Coppermine Team reports:</p>
<blockquote cite="http://forum.coppermine-gallery.net/index.php/topic,74682.0.html">
<p>The release covers several path disclosure vulnerabilities. If
unpatched, it's possible to generate an error that will reveal the
full path of the script. A remote user can determine the full path
to the web root directory and other potentially sensitive
information. Furthermore, the release covers a recently discovered
XSS vulnerability that allows (if unpatched) a malevolent visitor to
include own script routines under certain conditions.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-1613</cvename>
<cvename>CVE-2012-1614</cvename>
<mlist>http://seclists.org/oss-sec/2012/q2/11</mlist>
<url>http://forum.coppermine-gallery.net/index.php/topic,74682.0.html</url>
</references>
<dates>
<discovery>2012-03-29</discovery>
<entry>2012-08-30</entry>
</dates>
</vuln>
<vuln vid="16846d1e-f1de-11e1-8bd8-0022156e8794">
<topic>Java 1.7 -- security manager bypass</topic>
<affects>
<package>
<name>openjdk</name>
<range><ge>7.0</ge><lt>7.6.24_1</lt></range>
</package>
<package>
<name>linux-sun-jdk</name>
<range><ge>7.0</ge><lt>7.7</lt></range>
</package>
<package>
<name>linux-sun-jre</name>
<range><ge>7.0</ge><lt>7.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>US-CERT reports:</p>
<blockquote cite="http://www.kb.cert.org/vuls/id/636312">
<p>Oracle Java Runtime Environment (JRE) 1.7 contains a
vulnerability that may allow an applet to call
setSecurityManager in a way that allows setting of arbitrary
permissions.</p>
<p>By leveraging the public, privileged getField() function,
an untrusted Java applet can escalate its privileges by
calling the setSecurityManager() function to allow full
privileges, without requiring code signing.</p>
<p>This vulnerability is being actively exploited in the
wild, and exploit code is publicly available.</p>
</blockquote>
<p>This exploit does not only affect Java applets, but every
piece of software that relies on the Java Security Manager for
sandboxing executable code is affected: malicious code can
totally disable Security Manager.</p>
</body>
</description>
<references>
<cvename>CVE-2012-4681</cvename>
<certvu>636312</certvu>
<url>http://www.deependresearch.org/2012/08/java-7-vulnerability-analysis.html</url>
<url>http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2012-August/020065.html</url>
<url>http://www.oracle.com/technetwork/topics/security/alert-cve-2012-4681-1835715.html</url>
</references>
<dates>
<discovery>2012-08-27</discovery>
<entry>2012-08-30</entry>
<modified>2012-08-31</modified>
</dates>
</vuln>
<vuln vid="18ce9a90-f269-11e1-be53-080027ef73ec">
<topic>fetchmail -- chosen plaintext attack against SSL CBC initialization vectors</topic>
<affects>
<package>
<name>fetchmail</name>
<range><ge>6.3.9</ge><lt>6.3.22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matthias Andree reports:</p>
<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2012-01.txt">
<p>Fetchmail version 6.3.9 enabled "all SSL workarounds" (SSL_OP_ALL)
which contains a switch to disable a countermeasure against certain
attacks against block ciphers that permit guessing the
initialization vectors, providing that an attacker can make the
application (fetchmail) encrypt some data for him -- which is not
easily the case.</p>
<p>Stream ciphers (such as RC4) are unaffected.</p>
<p>Credits to Apple Product Security for reporting this.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3389</cvename>
</references>
<dates>
<discovery>2012-01-19</discovery>
<entry>2012-08-30</entry>
</dates>
</vuln>
<vuln vid="c906e0a4-efa6-11e1-8fbf-001b77d09812">
<topic>roundcube -- cross-site scripting in HTML email messages</topic>
<affects>
<package>
<name>roundcube</name>
<range><ge>0.8.0,1</ge><lt>0.8.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>RoundCube branch 0.8.x prior to the version 0.8.1 is prone
to the cross-scripting attack (XSS) originating from incoming
HTML e-mails: due to the lack of proper sanitization
of JavaScript code inside the "href" attribute, sender
could launch XSS attack when recipient opens the message
in RoundCube interface.</p>
</body>
</description>
<references>
<cvename>CVE-2012-3508</cvename>
<url>http://trac.roundcube.net/wiki/Changelog</url>
<url>http://trac.roundcube.net/ticket/1488613</url>
</references>
<dates>
<discovery>2012-08-14</discovery>
<entry>2012-08-27</entry>
</dates>
</vuln>
<vuln vid="aa4d3d73-ef17-11e1-b593-00269ef07d24">
<topic>Calligra, KOffice -- input validation failure</topic>
<affects>
<package>
<name>koffice</name>
<range><le>1.6.3_18,2</le></range>
</package>
<package>
<name>koffice-kde4</name>
<range><le>2.3.3_7</le></range>
</package>
<package>
<name>calligra</name>
<range><lt>2.5.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>KDE Security Advisory reports:</p>
<blockquote cite="http://www.kde.org/info/security/advisory-20120810-1.txt">
<p>A flaw has been found which can allow malicious code to take
advantage of an input validation failure in the Microsoft import
filter in Calligra and KOffice. Exploitation can allow the attacker
to gain control of the running process and execute code on its
behalf.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3455</cvename>
<cvename>CVE-2012-3456</cvename>
<url>http://www.kde.org/info/security/advisory-20120810-1.txt</url>
<url>http://media.blackhat.com/bh-us-12/Briefings/C_Miller/BH_US_12_Miller_NFC_attack_surface_WP.pdf</url>
</references>
<dates>
<discovery>2012-08-10</discovery>
<entry>2012-08-26</entry>
</dates>
</vuln>
<vuln vid="ce680f0a-eea6-11e1-8bd8-0022156e8794">
<topic>squidclamav -- cross-site scripting in default virus warning pages</topic>
<affects>
<package>
<name>squidclamav</name>
<range><lt>5.8</lt></range>
<range><ge>6.0</ge><lt>6.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SquidClamav developers report:</p>
<blockquote cite="http://squidclamav.darold.net/news.html">
<p>This release fix several security issues by escaping CGI
parameters.</p>
</blockquote>
<p>Prior to versions 6.7 and 5.8, CGI script clwarn.cgi was not
properly sanitizing input variables, so they could be used to
inject arbitrary strings to the generated page, leading
to the cross-site scripting attacks.</p>
</body>
</description>
<references>
<cvename>CVE-2012-4667</cvename>
<url>http://squidclamav.darold.net/news.html</url>
</references>
<dates>
<discovery>2012-07-24</discovery>
<entry>2012-08-25</entry>
</dates>
</vuln>
<vuln vid="8defa0f9-ee8a-11e1-8bd8-0022156e8794">
<topic>squidclamav -- Denial of Service</topic>
<affects>
<package>
<name>squidclamav</name>
<range><lt>5.7_1</lt></range>
<range><ge>6.0</ge><lt>6.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SquidClamav developers report:</p>
<blockquote cite="http://squidclamav.darold.net/news.html">
<p>Add a workaround for a squidGuard bug that unescape
the URL and send it back unescaped. This result in garbage
staying into pipe of the system command call and could crash
squidclamav on next read or return false information.
This is specially true with URL containing the %0D or %0A
character.</p>
</blockquote>
<p>This vulnerability can be triggered only in configurations
where external chained URL checker is configured via
"squidguard" directive.</p>
</body>
</description>
<references>
<cvename>CVE-2012-3501</cvename>
<url>http://squidclamav.darold.net/news.html</url>
</references>
<dates>
<discovery>2012-07-24</discovery>
<entry>2012-08-25</entry>
<modified>2012-09-04</modified>
</dates>
</vuln>
<vuln vid="a7975581-ee26-11e1-8bd8-0022156e8794">
<topic>inn -- plaintext command injection into encrypted channel</topic>
<affects>
<package>
<name>inn</name>
<range><lt>2.5.2_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>INN developers report:</p>
<blockquote cite="https://www.isc.org/software/inn/2.5.3article">
<p>Fixed a possible plaintext command injection during the
negotiation of a TLS layer. The vulnerability detailed
in CVE-2011-0411 affects the STARTTLS and AUTHINFO SASL
commands. nnrpd now resets its read buffer upon
a successful negotiation of a TLS layer. It prevents
malicious commands, sent unencrypted, from being executed
in the new encrypted state of the session.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3523</cvename>
<cvename>CVE-2011-0411</cvename>
<url>https://www.isc.org/software/inn/2.5.3article</url>
</references>
<dates>
<discovery>2012-08-14</discovery>
<entry>2012-08-25</entry>
</dates>
</vuln>
<vuln vid="4d1d2f6d-ec94-11e1-8bd8-0022156e8794">
<topic>jabberd -- domain spoofing in server dialback protocol</topic>
<affects>
<package>
<name>jabberd</name>
<range><lt>2.2.16_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>XMPP Standards Foundation reports:</p>
<blockquote cite="http://xmpp.org/resources/security-notices/server-dialback/">
<p>Some implementations of the XMPP Server Dialback protocol
(RFC 3920/XEP-0220) have not been checking dialback
responses to ensure that validated results are correlated
with requests.</p>
<p>An attacking server could spoof one or more domains in
communicating with a vulnerable server implementation,
thereby avoiding the protections built into the Server
Dialback protocol.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3525</cvename>
<url>http://xmpp.org/resources/security-notices/server-dialback/</url>
</references>
<dates>
<discovery>2012-08-21</discovery>
<entry>2012-08-23</entry>
</dates>
</vuln>
<vuln vid="a4598875-ec91-11e1-8bd8-0022156e8794">
<topic>rssh -- configuration restrictions bypass</topic>
<affects>
<package>
<name>rssh</name>
<range><lt>2.3.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Derek Martin (rssh maintainer) reports:</p>
<blockquote cite="http://www.pizzashack.org/rssh/security.shtml">
<p>John Barber reported a problem where, if the system
administrator misconfigures rssh by providing too few access
bits in the configuration file, the user will be given
default permissions (scp) to the entire system, potentially
circumventing any configured chroot. Fixing this required a
behavior change: in the past, using rssh without a config
file would give all users default access to use scp on an
unchrooted system. In order to correct the reported bug,
this feature has been eliminated, and you must now have a
valid configuration file. If no config file exists, all
users will be locked out.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.pizzashack.org/rssh/security.shtml</url>
</references>
<dates>
<discovery>2010-08-01</discovery>
<entry>2012-08-22</entry>
</dates>
</vuln>
<vuln vid="65b25acc-e63b-11e1-b81c-001b77d09812">
<topic>rssh -- arbitrary command execution</topic>
<affects>
<package>
<name>rssh</name>
<range><lt>2.3.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Derek Martin (rssh maintainer) reports:</p>
<blockquote cite="http://sourceforge.net/mailarchive/message.php?msg_id=29235647">
<p>Henrik Erkkonen has discovered that, through clever
manipulation of environment variables on the ssh command
line, it is possible to circumvent rssh. As far as I can
tell, there is no way to effect a root compromise, except of
course if the root account is the one you're attempting to
protect with rssh...</p>
</blockquote>
</body>
</description>
<references>
<bid>53430</bid>
<cvename>CVE-2012-3478</cvename>
<url>http://sourceforge.net/mailarchive/message.php?msg_id=29235647</url>
</references>
<dates>
<discovery>2012-05-08</discovery>
<entry>2012-08-22</entry>
</dates>
</vuln>
<vuln vid="c651c898-e90d-11e1-b230-0024e830109b">
<topic>libotr -- buffer overflows</topic>
<affects>
<package>
<name>libotr</name>
<range><lt>3.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OTR developers report:</p>
<blockquote cite="http://lists.cypherpunks.ca/pipermail/otr-dev/2012-July/001347.html">
<p>The otrl_base64_otr_decode() function and similar functions within OTR
suffer from buffer overflows in the case of malformed input;
specifically if a message of the format of "?OTR:===." is received
then a zero-byte allocation is performed without a similar correlation
between the subsequent base64 decoding write, as such it becomes
possible to write between zero and three bytes incorrectly to the
heap, albeit only with a value of '='.</p>
<p>Because this code path is highly utilized, specifically in the
reception of instant messages over pidgin or similar, this
vulnerability is considered severe even though in many platforms and
circumstances the bug would yield an unexploitable state and result
simply in denial of service.</p>
<p>The developers of OTR promptly fixed the errors and users of OTR are
advised to upgrade the software at the next release cycle.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3461</cvename>
<url>http://lists.cypherpunks.ca/pipermail/otr-dev/2012-July/001347.html</url>
</references>
<dates>
<discovery>2012-07-27</discovery>
<entry>2012-08-18</entry>
</dates>
</vuln>
<vuln vid="0f62be39-e8e0-11e1-bea0-002354ed89bc">
<topic>OpenTTD -- Denial of Service</topic>
<affects>
<package>
<name>openttd</name>
<range><le>1.2.1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenTTD Team reports:</p>
<blockquote cite="http://security.openttd.org/en/CVE-2012-3436">
<p>Denial of service (server) using ships on half tiles and
landscaping.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3436</cvename>
<url>http://security.openttd.org/en/CVE-2012-3436</url>
</references>
<dates>
<discovery>2012-07-25</discovery>
<entry>2012-08-18</entry>
</dates>
</vuln>
<vuln vid="4cdfe875-e8d6-11e1-bea0-002354ed89bc">
<topic>Wireshark -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>wireshark</name>
<range><lt>1.8.2</lt></range>
</package>
<package>
<name>wireshark-lite</name>
<range><lt>1.8.2</lt></range>
</package>
<package>
<name>tshark</name>
<range><lt>1.8.2</lt></range>
</package>
<package>
<name>tshark-lite</name>
<range><lt>1.8.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Wireshark reports:</p>
<blockquote cite="http://www.wireshark.org/docs/relnotes/wireshark-1.8.2.html">
<p>It may be possible to make Wireshark crash by injecting a
malformed packet onto the wire or by convincing someone to read a
malformed packet trace file.</p>
<p>It may be possible to make Wireshark consume excessive CPU
resources by injecting a malformed packet onto the wire or by
convincing someone to read a malformed packet trace file.</p>
<p>The PPP dissector could crash.</p>
<p>The NFS dissector could use excessive amounts of CPU.</p>
<p>The DCP ETSI dissector could trigger a zero division.</p>
<p>The MongoDB dissector could go into a large loop.</p>
<p>The XTP dissector could go into an infinite loop.</p>
<p>The ERF dissector could overflow a buffer.</p>
<p>The AFP dissector could go into a large loop.</p>
<p>The RTPS2 dissector could overflow a buffer.</p>
<p>The GSM RLC MAC dissector could overflow a buffer.</p>
<p>The CIP dissector could exhaust system memory.</p>
<p>The STUN dissector could crash.</p>
<p>The EtherCAT Mailbox dissector could abort.</p>
<p>The CTDB dissector could go into a large loop.</p>
<p>The pcap-ng file parser could trigger a zero division.</p>
<p>The Ixia IxVeriWave file parser could overflow a buffer.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-4048</cvename>
<cvename>CVE-2012-4049</cvename>
<cvename>CVE-2012-4285</cvename>
<cvename>CVE-2012-4286</cvename>
<cvename>CVE-2012-4287</cvename>
<cvename>CVE-2012-4288</cvename>
<cvename>CVE-2012-4289</cvename>
<cvename>CVE-2012-4290</cvename>
<cvename>CVE-2012-4291</cvename>
<cvename>CVE-2012-4292</cvename>
<cvename>CVE-2012-4293</cvename>
<cvename>CVE-2012-4294</cvename>
<cvename>CVE-2012-4295</cvename>
<cvename>CVE-2012-4296</cvename>
<cvename>CVE-2012-4297</cvename>
<cvename>CVE-2012-4298</cvename>
<url>http://www.wireshark.org/security/wnpa-sec-2012-11.html</url>
<url>http://www.wireshark.org/security/wnpa-sec-2012-12.html</url>
<url>http://www.wireshark.org/security/wnpa-sec-2012-13.html</url>
<url>http://www.wireshark.org/security/wnpa-sec-2012-14.html</url>
<url>http://www.wireshark.org/security/wnpa-sec-2012-15.html</url>
<url>http://www.wireshark.org/security/wnpa-sec-2012-16.html</url>
<url>http://www.wireshark.org/security/wnpa-sec-2012-17.html</url>
<url>http://www.wireshark.org/security/wnpa-sec-2012-18.html</url>
<url>http://www.wireshark.org/security/wnpa-sec-2012-19.html</url>
<url>http://www.wireshark.org/security/wnpa-sec-2012-20.html</url>
<url>http://www.wireshark.org/security/wnpa-sec-2012-21.html</url>
<url>http://www.wireshark.org/security/wnpa-sec-2012-22.html</url>
<url>http://www.wireshark.org/security/wnpa-sec-2012-23.html</url>
<url>http://www.wireshark.org/security/wnpa-sec-2012-24.html</url>
<url>http://www.wireshark.org/security/wnpa-sec-2012-25.html</url>
</references>
<dates>
<discovery>2012-07-22</discovery>
<entry>2012-08-18</entry>
</dates>
</vuln>
<vuln vid="07234e78-e899-11e1-b38d-0023ae8e59f0">
<topic>databases/postgresql*-server -- multiple vulnerabilities</topic>
<affects>
<package>
<name>postgresql-server</name>
<range><gt>8.3.*</gt><lt>8.3.20</lt></range>
<range><gt>8.4.*</gt><lt>8.4.13</lt></range>
<range><gt>9.0.*</gt><lt>9.0.9</lt></range>
<range><gt>9.1.*</gt><lt>9.1.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PostgreSQL Global Development Group reports:</p>
<blockquote cite="http://www.postgresql.org/about/news/1407/">
<p>The PostgreSQL Global Development Group today released
security updates for all active branches of the PostgreSQL
database system, including versions 9.1.5, 9.0.9, 8.4.13 and
8.3.20. This update patches security holes associated with
libxml2 and libxslt, similar to those affecting other open
source projects. All users are urged to update their
installations at the first available opportunity</p>
<p>Users who are relying on the built-in XML functionality to
validate external DTDs will need to implement a workaround, as
this security patch disables that functionality. Users who are
using xslt_process() to fetch documents or stylesheets from
external URLs will no longer be able to do so. The PostgreSQL
project regrets the need to disable both of these features in
order to maintain our security standards. These security issues
with XML are substantially similar to issues patched recently
by the Webkit (CVE-2011-1774), XMLsec (CVE-2011-1425) and PHP5
(CVE-2012-0057) projects.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3488</cvename>
<cvename>CVE-2012-3489</cvename>
<url>http://www.postgresql.org/about/news/1407/</url>
</references>
<dates>
<discovery>2012-08-17</discovery>
<entry>2012-08-17</entry>
</dates>
</vuln>
<vuln vid="db1d3340-e83b-11e1-999b-e0cb4e266481">
<topic>phpMyAdmin -- Multiple XSS in Table operations, Database structure, Trigger and Visualize GIS data pages</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><lt>3.5.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2012-4.php">
<p>Using a crafted table name, it was possible to produce a
XSS : 1) On the Database Structure page, creating a new
table with a crafted name 2) On the Database Structure page,
using the Empty and Drop links of the crafted table name 3)
On the Table Operations page of a crafted table, using the
'Empty the table (TRUNCATE)' and 'Delete the table (DROP)'
links 4) On the Triggers page of a database containing
tables with a crafted name, when opening the 'Add Trigger'
popup 5) When creating a trigger for a table with a crafted
name, with an invalid definition. Having crafted data in a
database table, it was possible to produce a XSS : 6) When
visualizing GIS data, having a crafted label name.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-4345</cvename>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2012-4.php</url>
</references>
<dates>
<discovery>2012-08-12</discovery>
<entry>2012-08-17</entry>
</dates>
</vuln>
<vuln vid="48bcb4b2-e708-11e1-a59d-000d601460a4">
<topic>typo3 -- Multiple vulernabilities in TYPO3 Core</topic>
<affects>
<package>
<name>typo3</name>
<range><ge>4.5.0</ge><lt>4.5.19</lt></range>
<range><ge>4.6.0</ge><lt>4.6.12</lt></range>
<range><ge>4.7.0</ge><lt>4.7.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Typo Security Team reports:</p>
<blockquote cite="https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-004/">
<p>It has been discovered that TYPO3 Core is vulnerable to Cross-Site
Scripting, Information Disclosure, Insecure Unserialize leading to
Arbitrary Code Execution.</p>
<p>TYPO3 Backend Help System - Due to a missing signature (HMAC) for a
parameter in the view_help.php file, an attacker could unserialize
arbitrary objects within TYPO3. We are aware of a working exploit,
which can lead to arbitrary code execution. A valid backend user
login or multiple successful cross site request forgery attacks are
required to exploit this vulnerability.</p>
<p>TYPO3 Backend - Failing to properly HTML-encode user input in
several places, the TYPO3 backend is susceptible to Cross-Site
Scripting. A valid backend user is required to exploit these
vulnerabilities.</p>
<p>TYPO3 Backend - Accessing the configuration module discloses the
Encryption Key. A valid backend user with access to the
configuration module is required to exploit this vulnerability.</p>
<p>TYPO3 HTML Sanitizing API - By not removing several HTML5
JavaScript events, the API method t3lib_div::RemoveXSS() fails to
filter specially crafted HTML injections, thus is susceptible to
Cross-Site Scripting. Failing to properly encode for JavaScript the
API method t3lib_div::quoteJSvalue(), it is susceptible to Cross-Site
Scripting.</p>
<p>TYPO3 Install Tool - Failing to properly sanitize user input, the
Install Tool is susceptible to Cross-Site Scripting.</p>
</blockquote>
</body>
</description>
<references>
<url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-004/</url>
</references>
<dates>
<discovery>2012-08-15</discovery>
<entry>2012-08-15</entry>
</dates>
</vuln>
<vuln vid="83f9e943-e664-11e1-a66d-080027ef73ec">
<topic>fetchmail -- two vulnerabilities in NTLM authentication</topic>
<affects>
<package>
<name>fetchmail</name>
<range><ge>5.0.8</ge><lt>6.3.21_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matthias Andree reports:</p>
<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2012-02.txt">
<p>With NTLM support enabled, fetchmail might mistake a server-side
error message during NTLM protocol exchange for protocol data,
leading to a SIGSEGV.</p>
<p>Also, with a carefully crafted NTLM challenge, a malicious server
might cause fetchmail to read from a bad memory location, betraying
confidential data. It is deemed hard, although not impossible, to
steal other accounts' data.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3482</cvename>
</references>
<dates>
<discovery>2012-08-12</discovery>
<entry>2012-08-14</entry>
<modified>2012-08-27</modified>
</dates>
</vuln>
<vuln vid="55b498e2-e56c-11e1-bbd5-001c25e46b1d">
<topic>Several vulnerabilities found in IcedTea-Web</topic>
<affects>
<package>
<name>icedtea-web</name>
<range><lt>1.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The IcedTea project team reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=840592">
<p>CVE-2012-3422: Use of uninitialized instance pointers</p>
<p>An uninitialized pointer use flaw was found in IcedTea-Web web
browser plugin. A malicious web page could use this flaw make
IcedTea-Web browser plugin pass invalid pointer to a web browser.
Depending on the browser used, it may cause the browser to crash
or possibly execute arbitrary code.</p>
<p>The get_cookie_info() and get_proxy_info() call
getFirstInTableInstance() with the instance_to_id_map hash as
a parameter. If instance_to_id_map is empty (which can happen
when plugin was recently removed), getFirstInTableInstance()
returns an uninitialized pointer.</p>
</blockquote>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=841345">
<p>CVE-2012-3423: Incorrect handling of non 0-terminated strings</p>
<p>It was discovered that the IcedTea-Web web browser plugin
incorrectly assumed that all strings provided by browser are NUL
terminated, which is not guaranteed by the NPAPI (Netscape Plugin
Application Programming Interface). When used in a browser that
does not NUL terminate NPVariant NPStrings, this could lead to
buffer over-read or over-write, resulting in possible information
leak, crash, or code execution.</p>
<p>Mozilla browsers currently NUL terminate strings, however recent
Chrome versions are known not to provide NUL terminated data.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3422</cvename>
<cvename>CVE-2012-3423</cvename>
<mlist>http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2012-July/019580.html</mlist>
</references>
<dates>
<discovery>2012-07-31</discovery>
<entry>2012-08-13</entry>
</dates>
</vuln>
<vuln vid="a14dee30-e3d7-11e1-a084-50e5492bd3dc">
<topic>libcloud -- possible SSL MITM due to invalid regexp used to validate target server hostname</topic>
<affects>
<package>
<name>py-libcloud</name>
<range><lt>0.11.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The libcloud development team reports:</p>
<blockquote cite="http://libcloud.apache.org/security.html">
<p>When establishing a secure (SSL / TLS) connection to a target server an invalid regular
expression has been used for performing the hostname verification. Subset instead of the
full target server hostname has been marked an an acceptable match for the given hostname.
For example, certificate with a hostname field of "aexample.com" was considered a valid
certificate for domain "example.com".</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3446</cvename>
<url>http://seclists.org/fulldisclosure/2012/Aug/55</url>
</references>
<dates>
<discovery>2012-08-01</discovery>
<entry>2012-08-11</entry>
</dates>
</vuln>
<vuln vid="aca0d7e0-e38a-11e1-999b-e0cb4e266481">
<topic>phpMyAdmin -- Path disclosure due to missing library</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><lt>3.5.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2012-3.php">
<p>The show_config_errors.php script does not include a
library, so an error message shows the full path of this
file, leading to possible further attacks.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-4219</cvename>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2012-3.php</url>
</references>
<dates>
<discovery>2012-08-03</discovery>
<entry>2012-08-11</entry>
</dates>
</vuln>
<vuln vid="60bbe12c-e2c1-11e1-a8ca-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>21.0.1180.75</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/search/label/Stable%20updates">
<p>[136643] [137721] [137957] High CVE-2012-2862: Use-after-free in
PDF viewer. Credit to Mateusz Jurczyk of Google Security Team, with
contributions by Gynvael Coldwind of Google Security Team.</p>
<p>[136968] [137361] High CVE-2012-2863: Out-of-bounds writes in PDF
viewer. Credit to Mateusz Jurczyk of Google Security Team, with
contributions by Gynvael Coldwind of Google Security Team.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2862</cvename>
<cvename>CVE-2012-2863</cvename>
<url>http://googlechromereleases.blogspot.com/search/label/Stable%20updates</url>
</references>
<dates>
<discovery>2012-08-08</discovery>
<entry>2012-08-10</entry>
</dates>
</vuln>
<vuln vid="ce84e136-e2f6-11e1-a8ca-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>21.0.1180.60</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/search/label/Stable%20updates">
<p>[Linux only] [125225] Medium CVE-2012-2846: Cross-process
interference in renderers. Credit to Google Chrome Security Team
(Julien Tinnes).</p>
<p>[127522] Low CVE-2012-2847: Missing re-prompt to user upon
excessive downloads. Credit to Matt Austin of Aspect Security.</p>
<p>[127525] Medium CVE-2012-2848: Overly broad file access granted
after drag+drop. Credit to Matt Austin of Aspect Security.</p>
<p>[128163] Low CVE-2012-2849: Off-by-one read in GIF decoder. Credit
to Atte Kettunen of OUSPG.</p>
<p>[130251] [130592] [130611] [131068] [131237] [131252] [131621]
[131690] [132860] Medium CVE-2012-2850: Various lower severity
issues in the PDF viewer. Credit to Mateusz Jurczyk of Google
Security Team, with contributions by Gynvael Coldwind of Google
Security Team.</p>
<p>[132585] [132694] [132861] High CVE-2012-2851: Integer overflows in
PDF viewer. Credit to Mateusz Jurczyk of Google Security Team, with
contributions by Gynvael Coldwind of Google Security Team.</p>
<p>[134028] High CVE-2012-2852: Use-after-free with bad object linkage
in PDF. Credit to Alexey Samsonov of Google.</p>
<p>[134101] Medium CVE-2012-2853: webRequest can interfere with the
Chrome Web Store. Credit to Trev of Adblock.</p>
<p>[134519] Low CVE-2012-2854: Leak of pointer values to WebUI
renderers. Credit to Nasko Oskov of the Chromium development
community.</p>
<p>[134888] High CVE-2012-2855: Use-after-free in PDF viewer. Credit
to Mateusz Jurczyk of Google Security Team, with contributions by
Gynvael Coldwind of Google Security Team.</p>
<p>[134954] [135264] High CVE-2012-2856: Out-of-bounds writes in PDF
viewer. Credit to Mateusz Jurczyk of Google Security Team, with
contributions by Gynvael Coldwind of Google Security Team.</p>
<p>[136235] High CVE-2012-2857: Use-after-free in CSS DOM. Credit to
Arthur Gerkis.</p>
<p>[136894] High CVE-2012-2858: Buffer overflow in WebP decoder.
Credit to Juri Aedla.</p>
<p>[Linux only] [137541] Critical CVE-2012-2859: Crash in tab
handling. Credit to Jeff Roberts of Google Security Team.</p>
<p>[137671] Medium CVE-2012-2860: Out-of-bounds access when clicking
in date picker. Credit to Chamal de Silva.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2846</cvename>
<cvename>CVE-2012-2847</cvename>
<cvename>CVE-2012-2848</cvename>
<cvename>CVE-2012-2849</cvename>
<cvename>CVE-2012-2850</cvename>
<cvename>CVE-2012-2851</cvename>
<cvename>CVE-2012-2852</cvename>
<cvename>CVE-2012-2853</cvename>
<cvename>CVE-2012-2854</cvename>
<cvename>CVE-2012-2855</cvename>
<cvename>CVE-2012-2856</cvename>
<cvename>CVE-2012-2857</cvename>
<cvename>CVE-2012-2858</cvename>
<cvename>CVE-2012-2859</cvename>
<cvename>CVE-2012-2860</cvename>
<url>http://googlechromereleases.blogspot.com/search/label/Stable%20updates</url>
</references>
<dates>
<discovery>2012-07-31</discovery>
<entry>2012-08-10</entry>
</dates>
</vuln>
<vuln vid="2092a45b-e2f6-11e1-a8ca-00262d5ed8ee">
<topic>www/chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>20.0.1132.57</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/search/label/Stable%20updates">
<p>[129898] High CVE-2012-2842: Use-after-free in counter handling.
Credit to miaubiz.</p>
<p>[130595] High CVE-2012-2843: Use-after-free in layout height
tracking. Credit to miaubiz.</p>
<p>[133450] High CVE-2012-2844: Bad object access with JavaScript in
PDF. Credit to Alexey Samsonov of Google.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2842</cvename>
<cvename>CVE-2012-2843</cvename>
<cvename>CVE-2012-2844</cvename>
<url>http://googlechromereleases.blogspot.com/search/label/Stable%20updates</url>
</references>
<dates>
<discovery>2012-07-11</discovery>
<entry>2012-08-10</entry>
</dates>
</vuln>
<vuln vid="31db9a18-e289-11e1-a57d-080027a27dbf">
<topic>rubygem-rails -- multiple vulnerabilities</topic>
<affects>
<package>
<name>rubygem-rails</name>
<range><lt>3.2.8</lt></range>
</package>
<package>
<name>rubygem-actionpack</name>
<range><lt>3.2.8</lt></range>
</package>
<package>
<name>rubygem-activesupport</name>
<range><lt>3.2.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Rails core team reports:</p>
<blockquote cite="http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released/">
<p>This version contains three important security fixes, please upgrade immediately.</p>
<p>One of security fixes impacts all users and is related to HTML escaping code. The
other two fixes impacts people using select_tag's prompt option and strip_tags
helper from ActionPack.</p>
<p>CVE-2012-3463 Potential XSS Vulnerability in select_tag prompt.</p>
<p>CVE-2012-3464 Potential XSS Vulnerability in the HTML escaping code.</p>
<p>CVE-2012-3465 XSS Vulnerability in strip_tags.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3463</cvename>
<cvename>CVE-2012-3464</cvename>
<cvename>CVE-2012-3465</cvename>
<url>https://groups.google.com/d/msg/rubyonrails-security/fV3QUToSMSw/eHBSFOUYHpYJ</url>
<url>https://groups.google.com/d/msg/rubyonrails-security/kKGNeMrnmiY/r2yM7xy-G48J</url>
<url>https://groups.google.com/d/msg/rubyonrails-security/FgVEtBajcTY/tYLS1JJTu38J</url>
<url>http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released/</url>
</references>
<dates>
<discovery>2012-08-08</discovery>
<entry>2012-08-10</entry>
</dates>
</vuln>
<vuln vid="8675efd5-e22c-11e1-a808-002354ed89bc">
<topic>sudosh -- buffer overflow</topic>
<affects>
<package>
<name>sudosh2</name>
<range><le>1.0.2</le></range>
</package>
<package>
<name>sudosh3</name>
<range><le>3.2.0_2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISS reports:</p>
<blockquote cite="http://xforce.iss.net/xforce/xfdb/55903">
<p>sudosh2 and sudosh3 are vulnerable to a stack-based buffer
overflow, caused by improper bounds checking by the replay()
function. By persuading a victim to replay a specially-crafted
recorded sudo session, a local attacker could overflow a buffer
and execute arbitrary code on the system with elevated privileges
or cause the application to crash.</p>
</blockquote>
</body>
</description>
<references>
<url>http://xforce.iss.net/xforce/xfdb/55903</url>
<url>http://secunia.com/advisories/38349</url>
<url>http://secunia.com/advisories/38292</url>
</references>
<dates>
<discovery>2010-01-17</discovery>
<entry>2012-08-09</entry>
</dates>
</vuln>
<vuln vid="0f020b7b-e033-11e1-90a2-000c299b62e1">
<topic>FreeBSD -- named(8) DNSSEC validation Denial of Service</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>7.4</ge><lt>7.4_10</lt></range>
<range><ge>8.1</ge><lt>8.1_13</lt></range>
<range><ge>8.2</ge><lt>8.2_10</lt></range>
<range><ge>8.3</ge><lt>8.3_4</lt></range>
<range><ge>9.0</ge><lt>9.0_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem description:</p>
<blockquote cite="http://security.freebsd.org/advisories/FreeBSD-SA-12:05.bind.asc">
<p>BIND 9 stores a cache of query names that are known to be failing
due to misconfigured name servers or a broken chain of trust.
Under high query loads, when DNSSEC validation is active, it is
possible for a condition to arise in which data from this cache of
failing queries could be used before it was fully initialized,
triggering an assertion failure.</p>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-12:05.bind</freebsdsa>
<cvename>CVE-2012-3817</cvename>
</references>
<dates>
<discovery>2012-07-24</discovery>
<entry>2012-08-07</entry>
</dates>
</vuln>
<vuln vid="36235c38-e0a8-11e1-9f4d-002354ed89bc">
<topic>automake -- Insecure 'distcheck' recipe granted world-writable distdir</topic>
<affects>
<package>
<name>automake</name>
<range><ge>1.5.0</ge><lt>1.12.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GNU reports:</p>
<blockquote cite="https://lists.gnu.org/archive/html/automake/2012-07/msg00023.html">
<p>The recipe of the 'distcheck' target granted temporary
world-write permissions on the extracted distdir. This introduced
a locally exploitable race condition for those who run "make
distcheck" with a non-restrictive umask (e.g., 022) in a directory
that was accessible by others. A successful exploit would result
in arbitrary code execution with the privileges of the user
running "make distcheck".</p>
<p>It is important to stress that this vulnerability impacts not only
the Automake package itself, but all packages with
Automake-generated makefiles. For an effective fix it is necessary
to regenerate the Makefile.in files with a fixed Automake
version.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3386</cvename>
<url>https://lists.gnu.org/archive/html/automake/2012-07/msg00023.html</url>
</references>
<dates>
<discovery>2012-07-09</discovery>
<entry>2012-08-06</entry>
<modified>2012-08-25</modified>
</dates>
</vuln>
<vuln vid="dbf338d0-dce5-11e1-b655-14dae9ebcf89">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>11.0,1</gt><lt>14.0.1,1</lt></range>
<range><lt>10.0.6,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>10.0.6,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.11</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>10.0.6</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.11</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><gt>11.0</gt><lt>14.0</lt></range>
<range><lt>10.0.6</lt></range>
</package>
<package>
<name>libxul</name>
<range><gt>1.9.2.*</gt><lt>10.0.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2012-42 Miscellaneous memory safety hazards (rv:14.0/
rv:10.0.6)</p>
<p>MFSA 2012-43 Incorrect URL displayed in addressbar through drag and
drop</p>
<p>MFSA 2012-44 Gecko memory corruption</p>
<p>MFSA 2012-45 Spoofing issue with location</p>
<p>MFSA 2012-46 XSS through data: URLs</p>
<p>MFSA 2012-47 Improper filtering of javascript in HTML feed-view</p>
<p>MFSA 2012-48 use-after-free in nsGlobalWindow::PageHidden</p>
<p>MFSA 2012-49 Same-compartment Security Wrappers can be bypassed</p>
<p>MFSA 2012-50 Out of bounds read in QCMS</p>
<p>MFSA 2012-51 X-Frame-Options header ignored when duplicated</p>
<p>MFSA 2012-52 JSDependentString::undepend string conversion results
in memory corruption</p>
<p>MFSA 2012-53 Content Security Policy 1.0 implementation errors
cause data leakage</p>
<p>MFSA 2012-54 Clickjacking of certificate warning page</p>
<p>MFSA 2012-55 feed: URLs with an innerURI inherit security context
of page</p>
<p>MFSA 2012-56 Code execution through javascript: URLs</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-1949</cvename>
<cvename>CVE-2012-1950</cvename>
<cvename>CVE-2012-1951</cvename>
<cvename>CVE-2012-1952</cvename>
<cvename>CVE-2012-1953</cvename>
<cvename>CVE-2012-1954</cvename>
<cvename>CVE-2012-1955</cvename>
<cvename>CVE-2012-1957</cvename>
<cvename>CVE-2012-1958</cvename>
<cvename>CVE-2012-1959</cvename>
<cvename>CVE-2012-1960</cvename>
<cvename>CVE-2012-1961</cvename>
<cvename>CVE-2012-1962</cvename>
<cvename>CVE-2012-1963</cvename>
<cvename>CVE-2012-1964</cvename>
<cvename>CVE-2012-1965</cvename>
<cvename>CVE-2012-1966</cvename>
<cvename>CVE-2012-1967</cvename>
<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-42.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-43.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-44.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-45.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-46.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-47.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-48.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-49.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-50.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-51.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-52.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-53.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-54.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-55.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-56.html</url>
</references>
<dates>
<discovery>2012-07-17</discovery>
<entry>2012-08-02</entry>
</dates>
</vuln>
<vuln vid="de2bc01f-dc44-11e1-9f4d-002354ed89bc">
<topic>Apache -- Insecure LD_LIBRARY_PATH handling</topic>
<affects>
<package>
<name>apache</name>
<range><le>2.2.22_5</le></range>
</package>
<package>
<name>apache-event</name>
<range><le>2.2.22_5</le></range>
</package>
<package>
<name>apache-itk</name>
<range><le>2.2.22_5</le></range>
</package>
<package>
<name>apache-peruser</name>
<range><le>2.2.22_5</le></range>
</package>
<package>
<name>apache-worker</name>
<range><le>2.2.22_5</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache reports:</p>
<blockquote cite="http://httpd.apache.org/security/vulnerabilities_24.html">
<p>Insecure handling of LD_LIBRARY_PATH was found that could lead to
the current working directory to be searched for DSOs. This could
allow a local user to execute code as root if an administrator runs
apachectl from an untrusted directory.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0883</cvename>
<url>http://httpd.apache.org/security/vulnerabilities_24.html</url>
<url>http://www.apache.org/dist/httpd/CHANGES_2.4.2</url>
</references>
<dates>
<discovery>2012-03-02</discovery>
<entry>2012-08-01</entry>
</dates>
</vuln>
<vuln vid="f01292a0-db3c-11e1-a84b-00e0814cab4e">
<topic>django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py26-django</name>
<range><ge>1.4</ge><lt>1.4.1</lt></range>
<range><ge>1.3</ge><lt>1.3.2</lt></range>
</package>
<package>
<name>py27-django</name>
<range><ge>1.4</ge><lt>1.4.1</lt></range>
<range><ge>1.3</ge><lt>1.3.2</lt></range>
</package>
<package>
<name>py26-django-devel</name>
<range><lt>20120731,1</lt></range>
</package>
<package>
<name>py27-django-devel</name>
<range><lt>20120731,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Django project reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2012/jul/30/security-releases-issued/">
<p>Today the Django team is issuing multiple releases --
Django 1.3.2 and Django 1.4.1 -- to remedy security issues
reported to us:</p>
<ul>
<li>Cross-site scripting in authentication views</li>
<li>Denial-of-service in image validation</li>
<li>Denial-of-service via get_image_dimensions()</li>
</ul>
<p>All users are encouraged to upgrade Django immediately.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3442</cvename>
<cvename>CVE-2012-3443</cvename>
<cvename>CVE-2012-3444</cvename>
<url>https://www.djangoproject.com/weblog/2012/jul/30/security-releases-issued/</url>
</references>
<dates>
<discovery>2012-07-30</discovery>
<entry>2012-07-31</entry>
<modified>2014-04-30</modified>
</dates>
</vuln>
<vuln vid="58253655-d82c-11e1-907c-20cf30e32f6d">
<topic>bugzilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>bugzilla</name>
<range><ge>3.6.0</ge><lt>3.6.10</lt></range>
<range><ge>4.0.0</ge><lt>4.0.7</lt></range>
<range><ge>4.2.0</ge><lt>4.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>A Bugzilla Security Advisory reports:</h1>
<blockquote cite="http://www.bugzilla.org/security/3.6.9/">
<p>The following security issues have been discovered in
Bugzilla:</p>
<h1>Information Leak</h1>
<p>Versions: 4.1.1 to 4.2.1, 4.3.1</p>
<p>In HTML bugmails, all bug IDs and attachment IDs are
linkified, and hovering these links displays a tooltip
with the bug summary or the attachment description if
the user is allowed to see the bug or attachment.
But when validating user permissions when generating the
email, the permissions of the user who edited the bug were
taken into account instead of the permissions of the
addressee. This means that confidential information could
be disclosed to the addressee if the other user has more
privileges than the addressee.
Plain text bugmails are not affected as bug and attachment
IDs are not linkified.</p>
<h1>Information Leak</h1>
<p>Versions: 2.17.5 to 3.6.9, 3.7.1 to 4.0.6, 4.1.1 to
4.2.1, 4.3.1</p>
<p>The description of a private attachment could be visible
to a user who hasn't permissions to access this attachment
if the attachment ID is mentioned in a public comment in
a bug that the user can see.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-1968</cvename>
<cvename>CVE-2012-1969</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=777398</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=777586</url>
</references>
<dates>
<discovery>2012-07-26</discovery>
<entry>2012-07-27</entry>
</dates>
</vuln>
<vuln vid="17f369dc-d7e7-11e1-90a2-000c299b62e1">
<topic>nsd -- Denial of Service</topic>
<affects>
<package>
<name>nsd</name>
<range><lt>3.2.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tom Hendrikx reports:</p>
<blockquote cite="http://www.nlnetlabs.nl/downloads/CVE-2012-2979.txt">
<p>It is possible to crash (SIGSEGV) a NSD child server process by
sending it a DNS packet from any host on the internet and the per
zone stats build option is enabled. A crashed child process will
automatically be restarted by the parent process, but an attacker
may keep the NSD server occupied restarting child processes by
sending it a stream of such packets effectively preventing the
NSD server to serve.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2979</cvename>
<url>http://www.nlnetlabs.nl/downloads/CVE-2012-2979.txt</url>
</references>
<dates>
<discovery>2012-07-27</discovery>
<entry>2012-07-27</entry>
</dates>
</vuln>
<vuln vid="ae2fa87c-4bca-4138-8be1-67ce2a19b3a8">
<topic>rubygem-actionpack -- Denial of Service</topic>
<affects>
<package>
<name>rubygem-actionpack</name>
<range><lt>3.2.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://groups.google.com/forum/?fromgroups#!topic/rubyonrails-security/vxJjrc15qYM">
<p>There is a DoS vulnerability in Action Pack digest authentication
handling in authenticate_or_request_with_http_digest.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3424</cvename>
<url>https://groups.google.com/forum/?fromgroups#!topic/rubyonrails-security/vxJjrc15qYM</url>
</references>
<dates>
<discovery>2012-07-26</discovery>
<entry>2012-07-26</entry>
</dates>
</vuln>
<vuln vid="cdc4ff0e-d736-11e1-8221-e0cb4e266481">
<topic>p5-RT-Authen-ExternalAuth -- privilege escalation</topic>
<affects>
<package>
<name>p5-RT-Authen-ExternalAuth</name>
<range><lt>0.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The RT development team reports:</p>
<blockquote cite="http://blog.bestpractical.com/2012/07/security-vulnerabilities-in-three-commonly-deployed-rt-extensions.html">
<p>RT::Authen::ExternalAuth 0.10 and below (for all versions
of RT) are vulnerable to an escalation of privilege attack
where the URL of a RSS feed of the user can be used to
acquire a fully logged-in session as that user.
CVE-2012-2770 has been assigned to this vulnerability.</p>
<p>Users of RT 3.8.2 and above should upgrade to
RT::Authen::ExternalAuth 0.11, which resolves this
vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>http://blog.bestpractical.com/2012/07/security-vulnerabilities-in-three-commonly-deployed-rt-extensions.html</url>
<cvename>CVE-2012-2770</cvename>
</references>
<dates>
<discovery>2012-07-25</discovery>
<entry>2012-07-26</entry>
</dates>
</vuln>
<vuln vid="c7fa3618-d5ff-11e1-90a2-000c299b62e1">
<topic>isc-dhcp -- multiple vulnerabilities</topic>
<affects>
<package>
<name>isc-dhcp41-server</name>
<range><lt>4.1.e_5,2</lt></range>
</package>
<package>
<name>isc-dhcp42-server</name>
<range><lt>4.2.4_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://www.isc.org/announcement/bind-and-dhcp-security-updates-released">
<p>An unexpected client identifier parameter can cause the ISC DHCP
daemon to segmentation fault when running in DHCPv6 mode,
resulting in a denial of service to further client requests. In
order to exploit this condition, an attacker must be able to send
requests to the DHCP server.</p>
<p>An error in the handling of malformed client identifiers can cause
a DHCP server running affected versions (see "Impact") to enter a
state where further client requests are not processed and the
server process loops endlessly, consuming all available CPU
cycles.
Under normal circumstances this condition should not be
triggered, but a non-conforming or malicious client could
deliberately trigger it in a vulnerable server. In order to
exploit this condition an attacker must be able to send requests
to the DHCP server.</p>
<p>Two memory leaks have been found and fixed in ISC DHCP. Both are
reproducible when running in DHCPv6 mode (with the -6 command-line
argument.) The first leak is confirmed to only affect servers
operating in DHCPv6 mode, but based on initial code analysis the
second may theoretically affect DHCPv4 servers (though this has
not been demonstrated.)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3570</cvename>
<cvename>CVE-2012-3571</cvename>
<cvename>CVE-2012-3954</cvename>
<url>https://kb.isc.org/article/AA-00714</url>
<url>https://kb.isc.org/article/AA-00712</url>
<url>https://kb.isc.org/article/AA-00737</url>
</references>
<dates>
<discovery>2012-07-24</discovery>
<entry>2012-07-25</entry>
</dates>
</vuln>
<vuln vid="0bc67930-d5c3-11e1-bef6-0024e81297ae">
<topic>dns/bind9* -- Heavy DNSSEC Validation Load Can Cause a 'Bad Cache' Assertion Failure</topic>
<affects>
<package>
<name>bind99</name>
<range><lt>9.9.1.2</lt></range>
</package>
<package>
<name>bind98</name>
<range><lt>9.8.3.2</lt></range>
</package>
<package>
<name>bind97</name>
<range><lt>9.7.6.2</lt></range>
</package>
<package>
<name>bind96</name>
<range><lt>9.6.3.1.ESV.R7.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-00729">
<p>High numbers of queries with DNSSEC validation enabled can
cause an assertion failure in named, caused by using a 'bad cache'
data structure before it has been initialized.</p>
<p>BIND 9 stores a cache of query names that are known to be failing due
to misconfigured name servers or a broken chain of trust. Under high query
loads when DNSSEC validation is active, it is possible for a condition
to arise in which data from this cache of failing queries could be used
before it was fully initialized, triggering an assertion failure.</p>
<p>This bug cannot be encountered unless your server is doing DNSSEC
validation.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3817</cvename>
<url>https://kb.isc.org/article/AA-00729</url>
</references>
<dates>
<discovery>2012-07-24</discovery>
<entry>2012-07-24</entry>
</dates>
</vuln>
<vuln vid="748aa89f-d529-11e1-82ab-001fd0af1a4c">
<topic>rubygem-activerecord -- multiple vulnerabilities</topic>
<affects>
<package>
<name>rubygem-activemodel</name>
<range><lt>3.2.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>rubygem-activerecord -- multiple vulernabilities</p>
<blockquote>
<p>Due to the way Active Record interprets parameters in
combination with the way that Rack parses query parameters, it
is possible for an attacker to issue unexpected database
queries with "IS NULL" where clauses. This issue does *not*
let an attacker insert arbitrary values into an SQL query,
however they can cause the query to check for NULL where most
users wouldn't expect it.</p>
<p>Due to the way Active Record handles nested query parameters,
an attacker can use a specially crafted request to inject some
forms of SQL into your application's SQL queries.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2660</cvename>
<cvename>CVE-2012-2661</cvename>
<url>https://groups.google.com/forum/?fromgroups#!topic/rubyonrails-security/8SA-M3as7A8</url>
<url>https://groups.google.com/forum/?fromgroups#!topic/rubyonrails-security/dUaiOOGWL1k</url>
</references>
<dates>
<discovery>2012-05-31</discovery>
<entry>2012-07-23</entry>
<modified>2012-07-23</modified>
</dates>
</vuln>
<vuln vid="bdab0acd-d4cd-11e1-8a1c-14dae9ebcf89">
<topic>php -- potential overflow in _php_stream_scandir</topic>
<affects>
<package>
<name>php5</name>
<range><gt>5.4</gt><lt>5.4.5</lt></range>
<range><ge>5.3</ge><lt>5.3.15</lt></range>
<range><ge>5.2</ge><lt>5.2.17_10</lt></range>
</package>
<package>
<name>php53</name>
<range><lt>5.3.15</lt></range>
</package>
<package>
<name>php52</name>
<range><lt>5.2.17_10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP Development Team reports:</p>
<blockquote cite="http://www.php.net/archive/2012.php#id2012-07-19-1">
<p>The release of PHP 5.4.15 and 5.4.5 fix a potential overflow in
_php_stream_scandir</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2688</cvename>
<url>http://www.php.net/archive/2012.php#id2012-07-19-1</url>
</references>
<dates>
<discovery>2012-07-19</discovery>
<entry>2012-07-23</entry>
<modified>2013-01-15</modified>
</dates>
</vuln>
<vuln vid="ce82bfeb-d276-11e1-92c6-14dae938ec40">
<topic>dns/nsd -- DoS vulnerability from non-standard DNS packet</topic>
<affects>
<package>
<name>nsd</name>
<range><lt>3.2.11_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Marek Vavrusa and Lubos Slovak report:</p>
<blockquote cite="http://www.nlnetlabs.nl/downloads/CVE-2012-2978.txt">
<p>It is possible to crash (SIGSEGV) a NSD child server process
by sending it a non-standard DNS packet from any host on the
internet. A crashed child process will automatically be restarted
by the parent process, but an attacker may keep the NSD server
occupied restarting child processes by sending it a stream of
such packets effectively preventing the NSD server to serve.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2978</cvename>
<freebsdpr>ports/170024</freebsdpr>
<url>http://www.nlnetlabs.nl/downloads/CVE-2012-2978.txt</url>
</references>
<dates>
<discovery>2012-07-19</discovery>
<entry>2012-07-20</entry>
<modified>2012-07-21</modified>
</dates>
</vuln>
<vuln vid="a460035e-d111-11e1-aff7-001fd056c417">
<topic>libjpeg-turbo -- heap-based buffer overflow</topic>
<affects>
<package>
<name>libjpeg-turbo</name>
<range><lt>1.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="http://sourceforge.net/projects/libjpeg-turbo/files/1.2.1/README.txt">
<p>The Changelog for version 1.2.1 says: Fixed a regression caused by
1.2.0[6] in which decompressing corrupt JPEG images (specifically,
images in which the component count was erroneously set to a large
value) would cause libjpeg-turbo to segfault.</p>
</blockquote>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=826849">
<p>A Heap-based buffer overflow was found in the way libjpeg-turbo
decompressed certain corrupt JPEG images in which the component count
was erroneously set to a large value. An attacker could create a
specially-crafted JPEG image that, when opened, could cause an
application using libpng to crash or, possibly, execute arbitrary code
with the privileges of the user running the application.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2806</cvename>
<url>http://sourceforge.net/projects/libjpeg-turbo/files/1.2.1/README.txt</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=826849</url>
</references>
<dates>
<discovery>2012-05-31</discovery>
<entry>2012-07-18</entry>
<modified>2012-07-19</modified>
</dates>
</vuln>
<vuln vid="2fe4b57f-d110-11e1-ac76-10bf48230856">
<topic>Dokuwiki -- cross site scripting vulnerability</topic>
<affects>
<package>
<name>dokuwiki</name>
<range><lt>20120125_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia Research reports:</p>
<blockquote cite="http://secunia.com/advisories/49196/">
<p>Secunia Research has discovered a vulnerability in DokuWiki, which can
be exploited by malicious people to conduct cross-site scripting
attacks.</p>
<p>Input passed to the "ns" POST parameter in lib/exe/ajax.php (when "call"
is set to "medialist" and "do" is set to "media") is not properly
sanitised within the "tpl_mediaFileList()" function in inc/template.php
before being returned to the user. This can be exploited to execute
arbitrary HTML and script code in a user's browser session in context
of an affected site.</p>
</blockquote>
</body>
</description>
<references>
<url>http://secunia.com/advisories/49196/</url>
<cvename>CVE-2012-0283</cvename>
</references>
<dates>
<discovery>2012-07-13</discovery>
<entry>2012-07-18</entry>
</dates>
</vuln>
<vuln vid="3a6960ef-c8a8-11e1-9924-001fd0af1a4c">
<topic>puppet -- multiple vulnerabilities</topic>
<affects>
<package>
<name>puppet</name>
<range><gt>2.7.*</gt><lt>2.7.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>puppet -- multiple vulnerabilities</p>
<blockquote cite="http://projects.puppetlabs.com/projects/puppet/wiki/Release_Notes#2.7.18">
<p>Arbitrary file read on the puppet master from authenticated
clients (high). It is possible to construct an HTTP get request
from an authenticated client with a valid certificate that will
return the contents of an arbitrary file on the Puppet master
that the master has read-access to.</p>
<p>Arbitrary file delete/D.O.S on Puppet Master from authenticated
clients (high). Given a Puppet master with the "Delete"
directive allowed in auth.conf for an authenticated host, an
attacker on that host can send a specially crafted Delete
request that can cause an arbitrary file deletion on the Puppet
master, potentially causing a denial of service attack. Note
that this vulnerability does *not* exist in Puppet as
configured by default.</p>
<p>The last_run_report.yaml is world readable (medium). The most
recent Puppet run report is stored on the Puppet master with
world-readable permissions. The report file contains the
context diffs of any changes to configuration on an agent,
which may contain sensitive information that an attacker can
then access. The last run report is overwritten with every
Puppet run.</p>
<p>Arbitrary file read on the Puppet master by an agent (medium).
This vulnerability is dependent upon vulnerability
"last_run_report.yml is world readable" above. By creating a
hard link of a Puppet-managed file to an arbitrary file that
the Puppet master can read, an attacker forces the contents to
be written to the puppet run summary. The context diff is
stored in last_run_report.yaml, which can then be accessed by
the attacker.</p>
<p>Insufficient input validation for agent hostnames (low). An
attacker could trick the administrator into signing an
attacker's certificate rather than the intended one by
constructing specially crafted certificate requests containing
specific ANSI control sequences. It is possible to use the
sequences to rewrite the order of text displayed to an
administrator such that display of an invalid certificate and
valid certificate are transposed. If the administrator signs
the attacker's certificate, the attacker can then
man-in-the-middle the agent.</p>
<p>Agents with certnames of IP addresses can be impersonated
(low). If an authenticated host with a certname of an IP
address changes IP addresses, and a second host assumes the
first host's former IP address, the second host will be treated
by the puppet master as the first one, giving the second host
access to the first host's catalog. Note: This will not be
fixed in Puppet versions prior to the forthcoming 3.x. Instead,
with this announcement IP-based authentication in Puppet &lt; 3.x
is deprecated.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3864</cvename>
<cvename>CVE-2012-3865</cvename>
<cvename>CVE-2012-3866</cvename>
<cvename>CVE-2012-3867</cvename>
<url>http://projects.puppetlabs.com/projects/puppet/wiki/Release_Notes#2.7.18</url>
<url>http://puppetlabs.com/security/cve/cve-2012-3864/</url>
<url>http://puppetlabs.com/security/cve/cve-2012-3865/</url>
<url>http://puppetlabs.com/security/cve/cve-2012-3866/</url>
<url>http://puppetlabs.com/security/cve/cve-2012-3867/</url>
</references>
<dates>
<discovery>2012-07-05</discovery>
<entry>2012-07-10</entry>
</dates>
</vuln>
<vuln vid="4c1ac2dd-c788-11e1-be25-14dae9ebcf89">
<topic>asterisk -- multiple vulnerabilities</topic>
<affects>
<package>
<name>asterisk</name>
<range><gt>10.*</gt><lt>10.5.2</lt></range>
</package>
<package>
<name>asterisk18</name>
<range><gt>1.8.*</gt><lt>1.8.13.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/security">
<p>Possible resource leak on uncompleted re-invite transactions.</p>
<p>Remote crash vulnerability in voice mail application.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3812</cvename>
<url>http://downloads.digium.com/pub/security/AST-2012-010.html</url>
<url>http://downloads.digium.com/pub/security/AST-2012-011.html</url>
<url>https://www.asterisk.org/security</url>
</references>
<dates>
<discovery>2012-07-05</discovery>
<entry>2012-07-06</entry>
<modified>2012-08-30</modified>
</dates>
</vuln>
<vuln vid="c28ee9cd-916e-4dcf-8ed3-e97e5846db6c">
<topic>typo3 -- Cross-Site Scripting Vulnerability in TYPO3 Core</topic>
<affects>
<package>
<name>typo3</name>
<range><ge>4.5</ge><lt>4.5.17</lt></range>
<range><ge>4.6</ge><lt>4.6.10</lt></range>
<range><ge>4.7</ge><lt>4.7.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Typo3 Security Report (TYPO3-CORE-SA-2012-003):</p>
<blockquote cite="https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-003/">
<p>TYPO3 bundles and uses an external JavaScript and Flash Upload Library
called swfupload. TYPO3 can be configured to use this Flash uploader.
Input passed via the "movieName" parameter to swfupload.swf is not
properly sanitised before being used in a call to
"ExternalInterface.call()". This can be exploited to execute arbitrary
script code in a user's browser session in context of an affected site.
The existance of the swfupload library is sufficient to be vulnerable
to the reported problem.</p>
</blockquote>
</body>
</description>
<references>
<url>http://secunia.com/advisories/49780/</url>
<url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-003/</url>
</references>
<dates>
<discovery>2012-07-04</discovery>
<entry>2012-07-06</entry>
</dates>
</vuln>
<vuln vid="fd8bac56-c444-11e1-864b-001cc0877741">
<topic>phpList -- SQL injection and XSS vulnerability</topic>
<affects>
<package>
<name>phplist</name>
<range><le>2.10.17</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Zero Science Lab reports:</p>
<blockquote cite="http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5081.php">
<p>Input passed via the parameter 'sortby' is not properly
sanitised before being returned to the user or used in SQL queries.
This can be exploited to manipulate SQL queries by injecting
arbitrary SQL code. The param 'num' is vulnerable to a XSS issue
where the attacker can execute arbitrary HTML and script code in
a user's browser session in context of an affected site.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2740</cvename>
<cvename>CVE-2012-2741</cvename>
<bid>52657</bid>
<url>https://www.phplist.com/?lid=567</url>
<url>http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5081.php</url>
</references>
<dates>
<discovery>2012-03-21</discovery>
<entry>2012-07-02</entry>
</dates>
</vuln>
<vuln vid="ff922811-c096-11e1-b0f4-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>20.0.1132.43</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/search/label/Stable%20updates">
<p>[118633] Low CVE-2012-2815: Leak of iframe fragment id. Credit to
Elie Bursztein of Google.</p>
<p>[120222] High CVE-2012-2817: Use-after-free in table section
handling. Credit to miaubiz.</p>
<p>[120944] High CVE-2012-2818: Use-after-free in counter layout.
Credit to miaubiz.</p>
<p>[120977] High CVE-2012-2819: Crash in texture handling. Credit to
Ken "gets" Russell of the Chromium development community.</p>
<p>[121926] Medium CVE-2012-2820: Out-of-bounds read in SVG filter
handling. Credit to Atte Kettunen of OUSPG.</p>
<p>[122925] Medium CVE-2012-2821: Autofill display problem. Credit to
"simonbrown60".</p>
<p>[various] Medium CVE-2012-2822: Misc. lower severity OOB read
issues in PDF. Credit to awesome ASAN and various Googlers (Kostya
Serebryany, Evgeniy Stepanov, Mateusz Jurczyk, Gynvael Coldwind).</p>
<p>[124356] High CVE-2012-2823: Use-after-free in SVG resource
handling. Credit to miaubiz.</p>
<p>[125374] High CVE-2012-2824: Use-after-free in SVG painting.
Credit to miaubiz.</p>
<p>[128688] Medium CVE-2012-2826: Out-of-bounds read in texture
conversion. Credit to Google Chrome Security Team (Inferno).</p>
<p>[Mac only] [129826] Low CVE-2012-2827: Use-after-free in Mac UI.
Credit to the Chromium development community (Dharani Govindan).</p>
<p>[129857] High CVE-2012-2828: Integer overflows in PDF. Credit to
Mateusz Jurczyk of Google Security Team and Google Chrome Security
Team (Chris Evans).</p>
<p>[129947] High CVE-2012-2829: Use-after-free in first-letter
handling. Credit to miaubiz.</p>
<p>[129951] High CVE-2012-2830: Wild pointer in array value setting.
Credit to miaubiz.</p>
<p>[130356] High CVE-2012-2831: Use-after-free in SVG reference
handling. Credit to miaubiz.</p>
<p>[131553] High CVE-2012-2832: Uninitialized pointer in PDF image
codec. Credit to Mateusz Jurczyk of Google Security Team.</p>
<p>[132156] High CVE-2012-2833: Buffer overflow in PDF JS API. Credit
to Mateusz Jurczyk of Google Security Team.</p>
<p>[132779] High CVE-2012-2834: Integer overflow in Matroska
container. Credit to Juri Aedla.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2815</cvename>
<cvename>CVE-2012-2817</cvename>
<cvename>CVE-2012-2818</cvename>
<cvename>CVE-2012-2819</cvename>
<cvename>CVE-2012-2820</cvename>
<cvename>CVE-2012-2821</cvename>
<cvename>CVE-2012-2822</cvename>
<cvename>CVE-2012-2823</cvename>
<cvename>CVE-2012-2824</cvename>
<cvename>CVE-2012-2826</cvename>
<cvename>CVE-2012-2827</cvename>
<cvename>CVE-2012-2828</cvename>
<cvename>CVE-2012-2829</cvename>
<cvename>CVE-2012-2830</cvename>
<cvename>CVE-2012-2831</cvename>
<cvename>CVE-2012-2832</cvename>
<cvename>CVE-2012-2833</cvename>
<cvename>CVE-2012-2834</cvename>
<url>http://googlechromereleases.blogspot.com/search/label/Stable%20updates</url>
</references>
<dates>
<discovery>2012-06-26</discovery>
<entry>2012-06-27</entry>
</dates>
</vuln>
<vuln vid="aed44c4e-c067-11e1-b5e0-000c299b62e1">
<topic>FreeBSD -- Privilege escalation when returning from kernel</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>7.4</ge><lt>7.4_9</lt></range>
<range><ge>8.1</ge><lt>8.1_12</lt></range>
<range><ge>8.2</ge><lt>8.2_9</lt></range>
<range><ge>8.3</ge><lt>8.3_3</lt></range>
<range><ge>9.0</ge><lt>9.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem description:</p>
<blockquote cite="http://security.freebsd.org/advisories/FreeBSD-SA-12:04.sysret.asc">
<p>FreeBSD/amd64 runs on CPUs from different vendors. Due to varying
behaviour of CPUs in 64 bit mode a sanity check of the kernel may be
insufficient when returning from a system call.</p>
<p>Successful exploitation of the problem can lead to local kernel privilege
escalation, kernel data corruption and/or crash.
To exploit this vulnerability, an attacker must be able to run code with user
privileges on the target system.</p>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-12:04.sysret</freebsdsa>
<cvename>CVE-2012-0217</cvename>
</references>
<dates>
<discovery>2012-06-12</discovery>
<entry>2012-06-27</entry>
</dates>
</vuln>
<vuln vid="fc5231b6-c066-11e1-b5e0-000c299b62e1">
<topic>FreeBSD -- Incorrect handling of zero-length RDATA fields in named(8)</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>7.4</ge><lt>7.4_9</lt></range>
<range><ge>8.1</ge><lt>8.1_11</lt></range>
<range><ge>8.2</ge><lt>8.2_9</lt></range>
<range><ge>8.3</ge><lt>8.3_3</lt></range>
<range><ge>9.0</ge><lt>9.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem description:</p>
<blockquote cite="http://security.freebsd.org/advisories/FreeBSD-SA-12:03.bind.asc">
<p>The named(8) server does not properly handle DNS resource records where
the RDATA field is zero length, which may cause various issues for the
servers handling them.</p>
<p>Resolving servers may crash or disclose some portion of memory to the
client. Authoritative servers may crash on restart after transferring a
zone containing records with zero-length RDATA fields. These would
result in a denial of service, or leak of sensitive information.</p>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-12:03.bind</freebsdsa>
<cvename>CVE-2012-1667</cvename>
</references>
<dates>
<discovery>2012-06-12</discovery>
<entry>2012-06-27</entry>
</dates>
</vuln>
<vuln vid="185ff22e-c066-11e1-b5e0-000c299b62e1">
<topic>FreeBSD -- Incorrect crypt() hashing</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>7.4</ge><lt>7.4_8</lt></range>
<range><ge>8.1</ge><lt>8.1_10</lt></range>
<range><ge>8.2</ge><lt>8.2_8</lt></range>
<range><ge>8.3</ge><lt>8.3_2</lt></range>
<range><ge>9.0</ge><lt>9.0_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem description:</p>
<blockquote cite="http://security.freebsd.org/advisories/FreeBSD-SA-12:02.crypt.asc">
<p>There is a programming error in the DES implementation used in crypt()
when handling input which contains characters that can not be represented
with 7-bit ASCII.</p>
<p>When the input contains characters with only the most significant bit set
(0x80), that character and all characters after it will be ignored.</p>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-12:02.crypt</freebsdsa>
<cvename>CVE-2012-2143</cvename>
</references>
<dates>
<discovery>2012-05-30</discovery>
<entry>2012-06-27</entry>
</dates>
</vuln>
<vuln vid="2ae114de-c064-11e1-b5e0-000c299b62e1">
<topic>FreeBSD -- OpenSSL multiple vulnerabilities</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>7.4</ge><lt>7.4_8</lt></range>
<range><ge>8.1</ge><lt>8.1_10</lt></range>
<range><ge>8.2</ge><lt>8.2_8</lt></range>
<range><ge>8.3</ge><lt>8.3_2</lt></range>
<range><ge>9.0</ge><lt>9.0_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem description:</p>
<blockquote cite="http://security.freebsd.org/advisories/FreeBSD-SA-12:01.openssl.asc">
<p>OpenSSL fails to clear the bytes used as block cipher padding in SSL 3.0
records when operating as a client or a server that accept SSL 3.0
handshakes. As a result, in each record, up to 15 bytes of uninitialized
memory may be sent, encrypted, to the SSL peer. This could include
sensitive contents of previously freed memory. [CVE-2011-4576]</p>
<p>OpenSSL support for handshake restarts for server gated cryptography (SGC)
can be used in a denial-of-service attack. [CVE-2011-4619]</p>
<p>If an application uses OpenSSL's certificate policy checking when
verifying X509 certificates, by enabling the X509_V_FLAG_POLICY_CHECK
flag, a policy check failure can lead to a double-free. [CVE-2011-4109]</p>
<p>A weakness in the OpenSSL PKCS #7 code can be exploited using
Bleichenbacher's attack on PKCS #1 v1.5 RSA padding also known as the
million message attack (MMA). [CVE-2012-0884]</p>
<p>The asn1_d2i_read_bio() function, used by the d2i_*_bio and d2i_*_fp
functions, in OpenSSL contains multiple integer errors that can cause
memory corruption when parsing encoded ASN.1 data. This error can occur
on systems that parse untrusted ASN.1 data, such as X.509 certificates
or RSA public keys. [CVE-2012-2110]</p>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-12:01.openssl</freebsdsa>
<cvename>CVE-2011-4576</cvename>
<cvename>CVE-2011-4619</cvename>
<cvename>CVE-2011-4109</cvename>
<cvename>CVE-2012-0884</cvename>
<cvename>CVE-2012-2110</cvename>
</references>
<dates>
<discovery>2012-05-03</discovery>
<entry>2012-06-27</entry>
</dates>
</vuln>
<vuln vid="f45c0049-be72-11e1-a284-0023ae8e59f0">
<topic>pycrypto -- vulnerable ElGamal key generation</topic>
<affects>
<package>
<name>py-pycrypto</name>
<range><ge>2.5</ge><lt>2.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Dwayne C. Litzenberger of PyCrypto reports:</p>
<blockquote cite="http://lists.dlitz.net/pipermail/pycrypto/2012q2/000587.html">
<p>In the ElGamal schemes (for both encryption and signatures), g is
supposed to be the generator of the entire Z^*_p group. However, in
PyCrypto 2.5 and earlier, g is more simply the generator of a random
sub-group of Z^*_p.</p>
<p>The result is that the signature space (when the key is used for
signing) or the public key space (when the key is used for encryption)
may be greatly reduced from its expected size of log(p) bits, possibly
down to 1 bit (the worst case if the order of g is 2).</p>
<p>While it has not been confirmed, it has also been suggested that an
attacker might be able to use this fact to determine the private key.</p>
<p>Anyone using ElGamal keys should generate new keys as soon as
practical.</p>
<p>Any additional information about this bug will be tracked at
https://bugs.launchpad.net/pycrypto/+bug/985164</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2417</cvename>
<url>http://lists.dlitz.net/pipermail/pycrypto/2012q2/000587.html</url>
<url>https://bugs.launchpad.net/pycrypto/+bug/985164</url>
</references>
<dates>
<discovery>2012-05-24</discovery>
<entry>2012-06-24</entry>
</dates>
</vuln>
<vuln vid="f46c4c6a-ba25-11e1-806a-001143cd36d8">
<topic>joomla -- Privilege Escalation</topic>
<affects>
<package>
<name>joomla</name>
<range><lt>2.5.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Joomla! reported a Core Privilege Escalation::</p>
<blockquote cite="http://developer.joomla.org/security/news/470-20120601-core-privilege-escalation.html">
<p>Inadequate checking leads to possible user privilege escalation..</p>
</blockquote>
</body>
</description>
<references>
<url>http://developer.joomla.org/security/news/470-20120601-core-privilege-escalation.html</url>
</references>
<dates>
<discovery>2012-04-29</discovery>
<entry>2012-06-19</entry>
</dates>
</vuln>
<vuln vid="eb12ebee-b7af-11e1-b5e0-000c299b62e1">
<topic>clamav -- multiple vulnerabilities</topic>
<affects>
<package>
<name>clamav</name>
<range><lt>0.97.5</lt></range>
</package>
<package>
<name>clamav-devel</name>
<range><lt>20120612</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE Advisories report:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1419">
<p>The TAR parser allows remote attackers to bypass malware detection
via a POSIX TAR file with an initial [aliases] character sequence.</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1457">
<p>The TAR parser allows remote attackers to bypass malware detection
via a TAR archive entry with a length field that exceeds the total
TAR file size.</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1458">
<p>The Microsoft CHM file parser allows remote attackers to bypass
malware detection via a crafted reset interval in the LZXC header
of a CHM file.</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1459">
<p>The TAR file parser allows remote attackers to bypass malware
detection via a TAR archive entry with a length field
corresponding to that entire entry, plus part of the header ofxi
the next entry.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-1419</cvename>
<cvename>CVE-2012-1457</cvename>
<cvename>CVE-2012-1458</cvename>
<cvename>CVE-2012-1459</cvename>
</references>
<dates>
<discovery>2012-03-19</discovery>
<entry>2012-06-16</entry>
</dates>
</vuln>
<vuln vid="3c8d1e5b-b673-11e1-be25-14dae9ebcf89">
<topic>asterisk -- remote crash vulnerability</topic>
<affects>
<package>
<name>asterisk10</name>
<range><gt>10.*</gt><lt>10.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/security">
<p>Skinny Channel Driver Remote Crash Vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-3553</cvename>
<url>http://downloads.digium.com/pub/security/AST-2012-009.html</url>
<url>https://www.asterisk.org/security</url>
</references>
<dates>
<discovery>2012-06-14</discovery>
<entry>2012-06-14</entry>
</dates>
</vuln>
<vuln vid="5140dc69-b65e-11e1-9425-001b21614864">
<topic>ImageMagick -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ImageMagick</name>
<range><lt>6.7.6.4</lt></range>
</package>
<package>
<name>ImageMagick-nox11</name>
<range><lt>6.7.6.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ImageMagick reports:</p>
<blockquote cite="http://www.cert.fi/en/reports/2012/vulnerability635606.html">
<p>Three vulnerabilities have been identified in ImageMagick's
handling of JPEG and TIFF files. With these vulnerabilities, it is
possible to cause a denial of service situation in the target
system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0259</cvename>
<cvename>CVE-2012-0260</cvename>
<cvename>CVE-2012-1798</cvename>
<url>http://www.imagemagick.org/discourse-server/viewtopic.php?f=4&amp;t=20629</url>
<url>http://www.cert.fi/en/reports/2012/vulnerability635606.html</url>
</references>
<dates>
<discovery>2012-03-28</discovery>
<entry>2012-06-14</entry>
<modified>2014-04-30</modified>
</dates>
</vuln>
<vuln vid="55587adb-b49d-11e1-8df1-0004aca374af">
<topic>mantis -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mantis</name>
<range><lt>1.2.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mantis reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2012/06/09/1">
<p>Roland Becker and Damien Regad (MantisBT developers) found that
any user able to report issues via the SOAP interface could also
modify any bugnotes (comments) created by other users. In a
default/typical MantisBT installation, SOAP API is enabled and any
user can sign up to report new issues. This vulnerability therefore
impacts upon many public facing MantisBT installations.</p>
<p>Roland Becker (MantisBT developer) found that the
delete_attachments_threshold permission was not being checked when
a user attempted to delete an attachment from an issue. The more
generic update_bug_threshold permission was being checked instead.
MantisBT administrators may have been under the false impression
that their configuration of the delete_attachments_threshold was
successfully preventing unwanted users from deleting
attachments.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2691</cvename>
<cvename>CVE-2012-2692</cvename>
<mlist>http://www.openwall.com/lists/oss-security/2012/06/09/1</mlist>
<mlist>http://sourceforge.net/mailarchive/forum.php?thread_name=1339229952.28538.22%40d.hx.id.au&amp;forum_name=mantisbt-dev</mlist>
</references>
<dates>
<discovery>2012-06-09</discovery>
<entry>2012-06-12</entry>
<modified>2012-06-13</modified>
</dates>
</vuln>
<vuln vid="38195f00-b215-11e1-8132-003067b2972c">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.236</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb12-14.html">
<p>These vulnerabilities could cause a crash and potentially allow an attacker to take control of the affected system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2034</cvename>
<cvename>CVE-2012-2035</cvename>
<cvename>CVE-2012-2036</cvename>
<cvename>CVE-2012-2037</cvename>
<cvename>CVE-2012-2038</cvename>
<cvename>CVE-2012-2039</cvename>
<cvename>CVE-2012-2040</cvename>
<url>http://www.adobe.com/support/security/bulletins/apsb12-14.html</url>
</references>
<dates>
<discovery>2012-06-08</discovery>
<entry>2012-06-09</entry>
</dates>
</vuln>
<vuln vid="bfecf7c1-af47-11e1-9580-4061862b8c22">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>11.0,1</gt><lt>13.0,1</lt></range>
<range><lt>10.0.5,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>10.0.5,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.10</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>10.0.5</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.10</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><gt>11.0</gt><lt>13.0</lt></range>
<range><lt>10.0.5</lt></range>
</package>
<package>
<name>libxul</name>
<range><gt>1.9.2.*</gt><lt>10.0.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2012-34 Miscellaneous memory safety hazards (rv:13.0/ rv:10.0.5)</p>
<p>MFSA 2012-36 Content Security Policy inline-script bypass</p>
<p>MFSA 2012-37 Information disclosure though Windows file shares and shortcut files</p>
<p>MFSA 2012-38 Use-after-free while replacing/inserting a node in a document</p>
<p>MFSA 2012-39 NSS parsing errors with zero length items</p>
<p>MFSA 2012-40 Buffer overflow and use-after-free issues found using Address Sanitizer</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3101</cvename>
<cvename>CVE-2012-0441</cvename>
<cvename>CVE-2012-1938</cvename>
<cvename>CVE-2012-1939</cvename>
<cvename>CVE-2012-1937</cvename>
<cvename>CVE-2012-1940</cvename>
<cvename>CVE-2012-1941</cvename>
<cvename>CVE-2012-1944</cvename>
<cvename>CVE-2012-1945</cvename>
<cvename>CVE-2012-1946</cvename>
<cvename>CVE-2012-1947</cvename>
<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-34.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-36.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-37.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-38.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-39.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-40.html</url>
</references>
<dates>
<discovery>2012-06-05</discovery>
<entry>2012-06-05</entry>
</dates>
</vuln>
<vuln vid="1e14d46f-af1f-11e1-b242-00215af774f0">
<topic>quagga -- BGP OPEN denial of service vulnerability</topic>
<affects>
<package>
<name>quagga</name>
<range><le>0.99.20.1</le></range>
</package>
<package>
<name>quagga-re</name>
<range><lt>0.99.17.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CERT reports:</p>
<blockquote cite="http://www.kb.cert.org/vuls/id/962587">
<p>If a pre-configured BGP peer sends a specially-crafted OPEN
message with a malformed ORF capability TLV, Quagga bgpd process
will erroneously try to consume extra bytes from the input packet
buffer. The process will detect a buffer overrun attempt before
it happens and immediately terminate with an error message. All
BGP sessions established by the attacked router will be closed
and its BGP routing disrupted.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-1820</cvename>
<url>http://www.kb.cert.org/vuls/id/962587</url>
</references>
<dates>
<discovery>2012-06-04</discovery>
<entry>2012-06-05</entry>
</dates>
</vuln>
<vuln vid="de6d8290-aef7-11e1-898f-14dae938ec40">
<topic>mail/sympa* -- Multiple vulnerabilities in Sympa archive management</topic>
<affects>
<package>
<name>sympa</name>
<range><lt>6.0.7</lt></range>
<range><gt>6.1.*</gt><lt>6.1.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>David Verdin reports:</p>
<blockquote cite="http://www.sympa.org/security_advisories#security_breaches_in_archives_management">
<p>Multiple vulnerabilities have been discovered in Sympa archive
management that allow to skip the scenario-based authorization
mechanisms.</p>
<p>This vulnerability allows the attacker to:</p>
<ul>
<li>display the archives management page ('arc_manage')</li>
<li>download the list's archives</li>
<li>delete the list's archives</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://www.sympa.org/security_advisories#security_breaches_in_archives_management</url>
</references>
<dates>
<discovery>2012-05-15</discovery>
<entry>2012-06-05</entry>
</dates>
</vuln>
<vuln vid="1ecc0d3f-ae8e-11e1-965b-0024e88a8c98">
<topic>dns/bind9* -- zero-length RDATA can cause named to terminate, reveal memory</topic>
<affects>
<package>
<name>bind99</name>
<range><lt>9.9.1.1</lt></range>
</package>
<package>
<name>bind98</name>
<range><lt>9.8.3.1</lt></range>
</package>
<package>
<name>bind97</name>
<range><lt>9.7.6.1</lt></range>
</package>
<package>
<name>bind96</name>
<range><lt>9.6.3.1.ESV.R7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="http://www.isc.org/software/bind/advisories/cve-2012-1667">
<p>Processing of DNS resource records where the rdata field is zero length
may cause various issues for the servers handling them.</p>
<p>Processing of these records may lead to unexpected outcomes. Recursive
servers may crash or disclose some portion of memory to the client.
Secondary servers may crash on restart after transferring a zone
containing these records. Master servers may corrupt zone data if the
zone option "auto-dnssec" is set to "maintain". Other unexpected
problems that are not listed here may also be encountered.</p>
<p>Impact: This issue primarily affects recursive nameservers.
Authoritative nameservers will only be impacted if an administrator
configures experimental record types with no data. If the server is
configured this way, then secondaries can crash on restart after
transferring that zone. Zone data on the master can become corrupted if
the zone with those records has named configured to manage the DNSSEC
key rotation.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-1667</cvename>
<url>http://www.isc.org/software/bind/advisories/cve-2012-1667</url>
</references>
<dates>
<discovery>2012-06-04</discovery>
<entry>2012-06-04</entry>
<modified>2012-06-06</modified>
</dates>
</vuln>
<vuln vid="a8864f8f-aa9e-11e1-a284-0023ae8e59f0">
<topic>databases/postgresql*-server -- crypt vulnerabilities</topic>
<affects>
<package>
<name>postgresql-server</name>
<range><gt>8.3.*</gt><lt>8.3.18_1</lt></range>
<range><gt>8.4.*</gt><lt>8.4.11_1</lt></range>
<range><gt>9.0.*</gt><lt>9.0.7_2</lt></range>
<range><gt>9.1.*</gt><lt>9.1.3_1</lt></range>
<range><gt>9.2.*</gt><lt>9.2.b1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PostgreSQL Global Development Group reports:</p>
<blockquote cite="http://www.postgresql.org/about/news/1397/">
<p>Today the PHP, OpenBSD and FreeBSD communities announced updates to
patch a security hole involving their crypt() hashing algorithms. This
issue is described in CVE-2012-2143. This vulnerability also affects a
minority of PostgreSQL users, and will be fixed in an update release on
June 4, 2012.</p>
<p>Affected users are those who use the crypt(text, text) function
with DES encryption in the optional pg_crypto module. Passwords
affected are those that contain characters that cannot be
represented with 7-bit ASCII. If a password contains a character
that has the most significant bit set (0x80), and DES encryption
is used, that character and all characters after it will be ignored.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2143</cvename>
<url>http://www.postgresql.org/about/news/1397/</url>
<url>http://git.postgresql.org/gitweb/?p=postgresql.git;a=patch;h=932ded2ed51e8333852e370c7a6dad75d9f236f9</url>
</references>
<dates>
<discovery>2012-05-30</discovery>
<entry>2012-05-30</entry>
<modified>2012-05-31</modified>
</dates>
</vuln>
<vuln vid="47f13540-c4cb-4971-8dc6-28d0dabfd9cd">
<topic>nut -- upsd can be remotely crashed</topic>
<affects>
<package>
<name>nut</name>
<range><ge>2.4.0</ge><le>2.6.3</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Networkupstools project reports:</p>
<blockquote cite="http://trac.networkupstools.org/projects/nut/changeset/3633">
<p>NUT server (upsd), from versions 2.4.0 to 2.6.3, are exposed to
crashes when receiving random data from the network.</p>
<p>This issue is related to the way NUT parses characters, especially
from the network. Non printable characters were missed from strings
operation (such as strlen), but still copied to the buffer, causing
an overflow.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2944</cvename>
<url>http://www.mail-archive.com/debian-bugs-dist@lists.debian.org/msg1027934.html</url>
<url>http://trac.networkupstools.org/projects/nut/changeset/3633</url>
</references>
<dates>
<discovery>2012-05-30</discovery>
<entry>2012-05-30</entry>
</dates>
</vuln>
<vuln vid="359f615d-a9e1-11e1-8a66-14dae9ebcf89">
<topic>asterisk -- multiple vulnerabilities</topic>
<affects>
<package>
<name>asterisk16</name>
<range><gt>1.6.*</gt><le>1.6.2.24</le></range>
</package>
<package>
<name>asterisk18</name>
<range><gt>1.8.*</gt><lt>1.8.12.1</lt></range>
</package>
<package>
<name>asterisk10</name>
<range><gt>10.*</gt><lt>10.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/security">
<p>Remote crash vulnerability in IAX2 channel driver.</p>
<p>Skinny Channel Driver Remote Crash Vulnerability</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2947</cvename>
<url>http://downloads.digium.com/pub/security/AST-2012-007.html</url>
<cvename>CVE-2012-2948</cvename>
<url>http://downloads.digium.com/pub/security/AST-2012-008.html</url>
<url>https://www.asterisk.org/security</url>
</references>
<dates>
<discovery>2012-05-29</discovery>
<entry>2012-05-29</entry>
<modified>2012-05-29</modified>
</dates>
</vuln>
<vuln vid="219d0bfd-a915-11e1-b519-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>19.0.1084.52</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.com/search/label/Stable%20updates">
<p>[117409] High CVE-2011-3103: Crashes in v8 garbage collection.
Credit to the Chromium development community (Brett Wilson).</p>
<p>[118018] Medium CVE-2011-3104: Out-of-bounds read in Skia. Credit
to Google Chrome Security Team (Inferno).</p>
<p>[120912] High CVE-2011-3105: Use-after-free in first-letter
handling. Credit to miaubiz.</p>
<p>[122654] Critical CVE-2011-3106: Browser memory corruption with
websockets over SSL. Credit to the Chromium development community
(Dharani Govindan).</p>
<p>[124625] High CVE-2011-3107: Crashes in the plug-in JavaScript
bindings. Credit to the Chromium development community (Dharani
Govindan).</p>
<p>[125159] Critical CVE-2011-3108: Use-after-free in browser cache.
Credit to "efbiaiinzinz".</p>
<p>[Linux only] [126296] High CVE-2011-3109: Bad cast in GTK UI.
Credit to Micha Bartholome.</p>
<p>[126337] [126343] [126378] [127349] [127819] [127868] High
CVE-2011-3110: Out of bounds writes in PDF. Credit to Mateusz
Jurczyk of the Google Security Team, with contributions by Gynvael
Coldwind of the Google Security Team.</p>
<p>[126414] Medium CVE-2011-3111: Invalid read in v8. Credit to
Christian Holler.</p>
<p>[127331] High CVE-2011-3112: Use-after-free with invalid encrypted
PDF. Credit to Mateusz Jurczyk of the Google Security Team, with
contributions by Gynvael Coldwind of the Google Security Team.</p>
<p>[127883] High CVE-2011-3113: Invalid cast with colorspace handling
in PDF. Credit to Mateusz Jurczyk of the Google Security Team, with
contributions by Gynvael Coldwind of the Google Security Team.</p>
<p>[128014] High CVE-2011-3114: Buffer overflows with PDF functions.
Credit to Google Chrome Security Team (scarybeasts).</p>
<p>[128018] High CVE-2011-3115: Type corruption in v8. Credit to
Christian Holler.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3103</cvename>
<cvename>CVE-2011-3104</cvename>
<cvename>CVE-2011-3105</cvename>
<cvename>CVE-2011-3106</cvename>
<cvename>CVE-2011-3107</cvename>
<cvename>CVE-2011-3108</cvename>
<cvename>CVE-2011-3110</cvename>
<cvename>CVE-2011-3111</cvename>
<cvename>CVE-2011-3112</cvename>
<cvename>CVE-2011-3113</cvename>
<cvename>CVE-2011-3114</cvename>
<cvename>CVE-2011-3115</cvename>
<url>http://googlechromereleases.blogspot.com/search/label/Stable%20updates</url>
</references>
<dates>
<discovery>2012-05-23</discovery>
<entry>2012-05-28</entry>
</dates>
</vuln>
<vuln vid="617959ce-a5f6-11e1-a284-0023ae8e59f0">
<topic>haproxy -- buffer overflow</topic>
<affects>
<package>
<name>haproxy</name>
<range><lt>1.4.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>HAProxy reports:</p>
<blockquote cite="http://haproxy.1wt.eu/news.html">
<p>A flaw was reported in HAProxy where, due to a boundary error
when copying data into the trash buffer, an external attacker could
cause a buffer overflow. Exploiting this flaw could lead to the
execution of arbitrary code, however it requires non-default settings
for the global.tune.bufsize configuration option (must be set to a
value greater than the default), and also that header rewriting is
enabled (via, for example, the regrep or rsprep directives).
This flaw is reported against 1.4.20, prior versions may also be
affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2391</cvename>
<url>https://secunia.com/advisories/49261/</url>
<url>http://haproxy.1wt.eu/download/1.4/src/CHANGELOG</url>
<url>http://haproxy.1wt.eu/git?p=haproxy-1.4.git;a=commit;h=30297cb17147a8d339eb160226bcc08c91d9530b</url>
<url>http://haproxy.1wt.eu/news.html</url>
</references>
<dates>
<discovery>2012-05-21</discovery>
<entry>2012-05-24</entry>
<modified>2012-05-29</modified>
</dates>
</vuln>
<vuln vid="e0a969e4-a512-11e1-90b4-e0cb4e266481">
<topic>RT -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>rt40</name>
<range><ge>4.0</ge><lt>4.0.6</lt></range>
</package>
<package>
<name>rt38</name>
<range><lt>3.8.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>BestPractical report:</p>
<blockquote cite="http://blog.bestpractical.com/2012/05/security-vulnerabilities-in-rt.html">
<p>Internal audits of the RT codebase have uncovered a
number of security vulnerabilities in RT. We are releasing
versions 3.8.12 and 4.0.6 to resolve these vulnerabilities,
as well as patches which apply atop all released versions of
3.8 and 4.0.</p>
<p>The vulnerabilities addressed by 3.8.12, 4.0.6, and the
below patches include the following:</p>
<p>The previously released tool to upgrade weak password
hashes as part of CVE-2011-0009 was an incomplete fix and
failed to upgrade passwords of disabled users.</p>
<p>RT versions 3.0 and above contain a number of cross-site
scripting (XSS) vulnerabilities which allow an attacker to
run JavaScript with the user's credentials. CVE-2011-2083 is
assigned to this vulnerability.</p>
<p>RT versions 3.0 and above are vulnerable to multiple
information disclosure vulnerabilities. This includes the
ability for privileged users to expose users' previous
password hashes -- this vulnerability is particularly
dangerous given RT's weak hashing previous to the fix in
CVE-2011-0009. A separate vulnerability allows privileged
users to obtain correspondence history for any ticket in
RT. CVE-2011-2084 is assigned to this vulnerability.</p>
<p>All publicly released versions of RT are vulnerable to
cross-site request forgery (CSRF). CVE-2011-2085 is assigned
to this vulnerability.</p>
<p>We have also added a separate configuration option
($RestrictLoginReferrer) to prevent login CSRF, a different
class of CSRF attack.</p>
<p>RT versions 3.6.1 and above are vulnerable to a remote
execution of code vulnerability if the optional VERP
configuration options ($VERPPrefix and $VERPDomain) are
enabled. RT 3.8.0 and higher are vulnerable to a limited
remote execution of code which can be leveraged for
privilege escalation. RT 4.0.0 and above contain a
vulnerability in the global $DisallowExecuteCode option,
allowing sufficiently privileged users to still execute code
even if RT was configured to not allow it. CVE-2011-4458 is
assigned to this set of vulnerabilities.</p>
<p>RT versions 3.0 and above may, under some circumstances,
still respect rights that a user only has by way of a
currently-disabled group. CVE-2011-4459 is assigned to this
vulnerability.</p>
<p>RT versions 2.0 and above are vulnerable to a SQL
injection attack, which allow privileged users to obtain
arbitrary information from the database. CVE-2011-4460 is
assigned to this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-0009</cvename>
<cvename>CVE-2011-2082</cvename>
<cvename>CVE-2011-2083</cvename>
<cvename>CVE-2011-2084</cvename>
<cvename>CVE-2011-2085</cvename>
<cvename>CVE-2011-4458</cvename>
<cvename>CVE-2011-4459</cvename>
<cvename>CVE-2011-4460</cvename>
<url>http://blog.bestpractical.com/2012/05/security-vulnerabilities-in-rt.html</url>
</references>
<dates>
<discovery>2012-05-22</discovery>
<entry>2012-05-23</entry>
</dates>
</vuln>
<vuln vid="78c39232-a345-11e1-9d81-d0df9acfd7e5">
<topic>sympa -- Multiple Security Bypass Vulnerabilities</topic>
<affects>
<package>
<name>sympa</name>
<range><lt>6.1.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia team reports:</p>
<blockquote cite="http://secunia.com/advisories/49045/">
<p>Multiple vulnerabilities have been reported in Sympa, which can be
exploited by malicious people to bypass certain security
restrictions.</p>
<p>The vulnerabilities are caused due to the application allowing
access to archive functions without checking credentials. This can
be exploited to create, download, and delete an archive.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2352</cvename>
<url>http://secunia.com/advisories/49045/</url>
</references>
<dates>
<discovery>2012-05-14</discovery>
<entry>2012-05-21</entry>
</dates>
</vuln>
<vuln vid="495b46fd-a30f-11e1-82c9-d0df9acfd7e5">
<topic>foswiki -- Script Insertion Vulnerability via unchecked user registration fields</topic>
<affects>
<package>
<name>foswiki</name>
<range><lt>1.1.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Foswiki team reports:</p>
<blockquote cite="http://foswiki.org/Support/SecurityAlert-CVE-2012-1004">
<p>When a new user registers, the new user can add arbitrary HTML and
script code into the user topic which is generated by the
RegistrationAgent via standard registration fields such as
"FirstName" or "OrganisationName".</p>
<p>By design, Foswiki's normal editing features allow arbitrary HTML
markup, including script code, to be inserted into any topic anyway,
assuming the authenticated user has CHANGE permission - which is the
case on many Foswiki sites. However, the assumption that only
authenticated users with CHANGE permission may create script content
is false if new users exploit the vulnerability detailed in this
alert to manipulate the registration agent into creating that
content for them.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-1004</cvename>
<url>http://foswiki.org/Support/SecurityAlert-CVE-2012-1004</url>
</references>
<dates>
<discovery>2012-04-13</discovery>
<entry>2012-05-21</entry>
</dates>
</vuln>
<vuln vid="b8ae4659-a0da-11e1-a294-bcaec565249c">
<topic>libxml2 -- An off-by-one out-of-bounds write by XPointer</topic>
<affects>
<package>
<name>libxml2</name>
<range><lt>2.7.8_3</lt></range>
</package>
<package>
<name>linux-f10-libxml2</name>
<range><lt>2.7.8_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google chrome team reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.com/2012/05/stable-channel-update.html">
<p>An off-by-one out-of-bounds write flaw was found in the way libxml, a library
for providing XML and HTML support, evaluated certain XPointer parts (XPointer
is used by libxml to include only the part from the returned XML document, that
can be accessed using the XPath expression given with the XPointer). A remote
attacker could provide a specially-crafted XML file, which once opened in an
application, linked against libxml, would lead to that application crash, or,
potentially arbitrary code execution with the privileges of the user running
the application.</p>
<p>Note: The flaw to be exploited requires the particular application, linked
against libxml, to use the XPointer evaluation functionality.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3202</cvename>
<url>http://googlechromereleases.blogspot.com/2012/05/stable-channel-update.html</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3102</url>
</references>
<dates>
<discovery>2012-05-15</discovery>
<entry>2012-05-18</entry>
<modified>2014-04-30</modified>
</dates>
</vuln>
<vuln vid="f5f00804-a03b-11e1-a284-0023ae8e59f0">
<topic>inspircd -- buffer overflow</topic>
<affects>
<package>
<name>inspircd</name>
<range><ge>1.2</ge><lt>1.2.9</lt></range>
<range><ge>2.0</ge><lt>2.0.5_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>InspIRCd reports:</p>
<blockquote cite="http://inspircd.github.com/">
<p>InspIRCd contains a heap corruption vulnerability that exists in the
dns.cpp code. The res[] buffer is allocated on the heap and can be
overflowed. The res[] buffer can be exploited during its deallocation.
The number of overflowed bytes can be controlled with DNS compression
features.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-1836</cvename>
<url>http://inspircd.github.com/</url>
</references>
<dates>
<discovery>2012-03-19</discovery>
<entry>2012-05-17</entry>
<modified>2012-06-21</modified>
</dates>
</vuln>
<vuln vid="aa71daaa-9f8c-11e1-bd0a-0082a0c18826">
<topic>pidgin-otr -- format string vulnerability</topic>
<affects>
<package>
<name>pidgin-otr</name>
<range><lt>3.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The authors report:</p>
<blockquote cite="http://www.cypherpunks.ca/otr/">
<p>Versions 3.2.0 and earlier of the pidgin-otr plugin contain
a format string security flaw. This flaw could potentially be
exploited by a remote attacker to cause arbitrary code to be
executed on the user's machine.</p>
<p>The flaw is in pidgin-otr, not in libotr. Other applications
that use libotr are not affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2369</cvename>
<url>http://www.cypherpunks.ca/otr/</url>
</references>
<dates>
<discovery>2012-05-16</discovery>
<entry>2012-05-16</entry>
</dates>
</vuln>
<vuln vid="b3435b68-9ee8-11e1-997c-002354ed89bc">
<topic>sudo -- netmask vulnerability</topic>
<affects>
<package>
<name>sudo</name>
<range><le>1.8.4_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Todd Miller reports:</p>
<blockquote cite="http://www.sudo.ws/sudo/alerts/netmask.html">
<p>Sudo supports granting access to commands on a per-host basis.
The host specification may be in the form of a host name, a
netgroup, an IP address, or an IP network (an IP address with an
associated netmask).</p>
<p>When IPv6 support was added to sudo, a bug was introduced that
caused the IPv6 network matching code to be called when an IPv4
network address does not match. Depending on the value of the
uninitialized portion of the IPv6 address, it is possible for the
IPv4 network number to match when it should not. This bug only
affects IP network matching and does not affect simple IP address
matching.</p>
<p>The reported configuration that exhibited the bug was an
LDAP-based sudo installation where the sudoRole object contained
multiple sudoHost entries, each containing a different IPv4
network. File-based sudoers should be affected as well as the
same matching code is used.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2337</cvename>
<url>http://www.sudo.ws/sudo/alerts/netmask.html</url>
</references>
<dates>
<discovery>2012-05-16</discovery>
<entry>2012-05-16</entry>
</dates>
</vuln>
<vuln vid="dba5d1c9-9f29-11e1-b511-003067c2616f">
<topic>OpenSSL -- DTLS and TLS 1.1, 1.2 denial of service</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.1_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSSL security team reports:</p>
<blockquote cite="http://www.openssl.org/news/secadv_20120510.txt">
<p>A flaw in the OpenSSL handling of CBC mode ciphersuites in TLS 1.1, 1.2 and
DTLS can be exploited in a denial of service attack on both clients and
servers.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2333</cvename>
<url>http://www.openssl.org/news/secadv_20120510.txt</url>
</references>
<dates>
<discovery>2012-05-10</discovery>
<entry>2012-05-10</entry>
</dates>
</vuln>
<vuln vid="1449af37-9eba-11e1-b9c1-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>19.0.1084.46</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.com/search/label/Stable%20updates">
<p>[112983] Low CVE-2011-3083: Browser crash with video + FTP. Credit
to Aki Helin of OUSPG.</p>
<p>[113496] Low CVE-2011-3084: Load links from internal pages in their
own process. Credit to Brett Wilson of the Chromium development
community.</p>
<p>[118374] Medium CVE-2011-3085: UI corruption with long autofilled
values. Credit to "psaldorn".</p>
<p>[118642] High CVE-2011-3086: Use-after-free with style element.
Credit to Arthur Gerkis.</p>
<p>[118664] Low CVE-2011-3087: Incorrect window navigation. Credit to
Charlie Reis of the Chromium development community.</p>
<p>[120648] Medium CVE-2011-3088: Out-of-bounds read in hairline
drawing. Credit to Aki Helin of OUSPG.</p>
<p>[120711] High CVE-2011-3089: Use-after-free in table handling.
Credit to miaubiz.</p>
<p>[121223] Medium CVE-2011-3090: Race condition with workers. Credit
to Arthur Gerkis.</p>
<p>[121734] High CVE-2011-3091: Use-after-free with indexed DB. Credit
to Google Chrome Security Team (Inferno).</p>
<p>[122337] High CVE-2011-3092: Invalid write in v8 regex. Credit to
Christian Holler.</p>
<p>[122585] Medium CVE-2011-3093: Out-of-bounds read in glyph
handling. Credit to miaubiz.</p>
<p>[122586] Medium CVE-2011-3094: Out-of-bounds read in Tibetan
handling. Credit to miaubiz.</p>
<p>[123481] High CVE-2011-3095: Out-of-bounds write in OGG container.
Credit to Hannu Heikkinen.</p>
<p>[Linux only] [123530] Low CVE-2011-3096: Use-after-free in GTK
omnibox handling. Credit to Arthur Gerkis.</p>
<p>[123733] [124182] High CVE-2011-3097: Out-of-bounds write in
sampled functions with PDF. Credit to Kostya Serebryany of Google
and Evgeniy Stepanov of Google.</p>
<p>[124479] High CVE-2011-3099: Use-after-free in PDF with corrupt
font encoding name. Credit to Mateusz Jurczyk of Google Security
Team and Gynvael Coldwind of Google Security Team.</p>
<p>[124652] Medium CVE-2011-3100: Out-of-bounds read drawing dash
paths. Credit to Google Chrome Security Team (Inferno).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3083</cvename>
<cvename>CVE-2011-3084</cvename>
<cvename>CVE-2011-3085</cvename>
<cvename>CVE-2011-3086</cvename>
<cvename>CVE-2011-3087</cvename>
<cvename>CVE-2011-3088</cvename>
<cvename>CVE-2011-3089</cvename>
<cvename>CVE-2011-3090</cvename>
<cvename>CVE-2011-3091</cvename>
<cvename>CVE-2011-3092</cvename>
<cvename>CVE-2011-3093</cvename>
<cvename>CVE-2011-3094</cvename>
<cvename>CVE-2011-3095</cvename>
<cvename>CVE-2011-3096</cvename>
<cvename>CVE-2011-3097</cvename>
<cvename>CVE-2011-3099</cvename>
<cvename>CVE-2011-3100</cvename>
<url>http://googlechromereleases.blogspot.com/search/label/Stable%20updates</url>
</references>
<dates>
<discovery>2012-05-15</discovery>
<entry>2012-05-15</entry>
</dates>
</vuln>
<vuln vid="6601127c-9e09-11e1-b5e0-000c299b62e1">
<topic>socat -- Heap-based buffer overflow</topic>
<affects>
<package>
<name>socat</name>
<range><lt>1.7.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The socat development team reports:</p>
<blockquote cite="http://www.dest-unreach.org/socat/contrib/socat-secadv3.html">
<p>This vulnerability can be exploited when socat is invoked with the
READLINE address (this is usually only used interactively) without
option "prompt" and without option "noprompt" and an attacker succeeds
to provide malicious data to the other (arbitrary) address that is then
transferred by socat to the READLINE address for output.</p>
<p>Successful exploitation may allow an attacker to execute arbitrary
code with the privileges of the socat process.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0219</cvename>
<url>www.dest-unreach.org/socat/contrib/socat-secadv3.html</url>
</references>
<dates>
<discovery>2012-05-14</discovery>
<entry>2012-05-14</entry>
</dates>
</vuln>
<vuln vid="59b68b1e-9c78-11e1-b5e0-000c299b62e1">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php5</name>
<range><gt>5.4</gt><lt>5.4.3</lt></range>
<range><lt>5.3.13</lt></range>
</package>
<package>
<name>php53</name>
<range><lt>5.3.13</lt></range>
</package>
<package>
<name>php52</name>
<range><lt>5.2.17_9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP Development Team reports:</p>
<blockquote cite="http://www.php.net/archive/2012.php#id2012-05-08-1">
<p>The release of PHP 5.4.13 and 5.4.3 complete a fix for the
vulnerability in CGI-based setups as originally described in
CVE-2012-1823. (CVE-2012-2311)</p>
<p>Note: mod_php and php-fpm are not vulnerable to this attack.</p>
<p>PHP 5.4.3 fixes a buffer overflow vulnerability in the
apache_request_headers() (CVE-2012-2329).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-1823</cvename>
<cvename>CVE-2012-2311</cvename>
<cvename>CVE-2012-2329</cvename>
</references>
<dates>
<discovery>2012-05-08</discovery>
<entry>2012-05-12</entry>
</dates>
</vuln>
<vuln vid="64f8b72d-9c4e-11e1-9c94-000bcdf0a03b">
<topic>libpurple -- Invalid memory dereference in the XMPP protocol plug-in by processing serie of specially-crafted file transfer requests</topic>
<affects>
<package>
<name>libpurple</name>
<range><lt>2.10.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Pidgin reports:</p>
<blockquote cite="http://pidgin.im/news/security/?id=62">
<p>A series of specially crafted file transfer requests can cause clients to reference invalid memory. The user must have accepted one of the file transfer requests.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2214</cvename>
</references>
<dates>
<discovery>2012-05-06</discovery>
<entry>2012-05-12</entry>
</dates>
</vuln>
<vuln vid="0d3547ab-9b69-11e1-bdb1-525401003090">
<topic>PivotX -- 'ajaxhelper.php' Cross Site Scripting Vulnerability</topic>
<affects>
<package>
<name>pivotx</name>
<range><le>2.3.2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>High-Tech Bridge reports:</p>
<blockquote cite="https://www.htbridge.com/advisory/HTB23087">
<p>Input passed via the "file" GET parameter to
/pivotx/ajaxhelper.php is not properly sanitised before
being returned to the user. This can be exploited to
execute arbitrary HTML and script code in administrator's
browser session in context of the affected website.</p>
</blockquote>
</body>
</description>
<references>
<bid>52159</bid>
<cvename>CVE-2012-2274</cvename>
<url>https://www.htbridge.com/advisory/HTB23087</url>
</references>
<dates>
<discovery>2012-05-09</discovery>
<entry>2012-05-12</entry>
<modified>2012-05-14</modified>
</dates>
</vuln>
<vuln vid="b91234e7-9a8b-11e1-b666-001636d274f3">
<topic>NVIDIA UNIX driver -- access to arbitrary system memory</topic>
<affects>
<package>
<name>nvidia-driver</name>
<range><gt>173.14.35_2</gt><lt>295.71</lt></range>
<range><gt>96.43.20_3</gt><lt>173.14.35</lt></range>
<range><gt>71.86.15_3</gt><lt>96.43.20_2</lt></range>
<range><lt>71.86.15_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVIDIA Unix security team reports:</p>
<blockquote cite="http://nvidia.custhelp.com/app/answers/detail/a_id/3109">
<p>Security vulnerability CVE-2012-0946 in the NVIDIA UNIX driver
was disclosed to NVIDIA on March 20th, 2012. The vulnerability
makes it possible for an attacker who has read and write access
to the GPU device nodes to reconfigure GPUs to gain access to
arbitrary system memory. NVIDIA is not aware of any reports of
this vulnerability, outside of the disclosure which was made
privately to NVIDIA.</p>
<p>NVIDIA has identified the root cause of the vulnerability and
has released updated drivers which close it. [NVIDIA encourages]
all users with Geforce 8 or newer, G80 Quadro or newer, and all
Tesla GPUs to update their drivers to 295.40 or later.</p>
</blockquote>
<p>Later, it was additionally discovered that similar exploit could
be achieved through remapping of VGA window:</p>
<blockquote cite="http://nvidia.custhelp.com/app/answers/detail/a_id/3140">
<p>NVIDIA received notification of a security exploit that uses
NVIDIA UNIX device files to map and program registers to redirect
the VGA window. Through the VGA window, the exploit can access
any region of physical system memory. This arbitrary memory
access can be further exploited, for example, to escalate user
privileges.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0946</cvename>
<cvename>CVE-2012-4225</cvename>
</references>
<dates>
<discovery>2012-03-20</discovery>
<entry>2012-05-10</entry>
<modified>2012-09-12</modified>
</dates>
</vuln>
<vuln vid="3d55b961-9a2e-11e1-a2ef-001fd0af1a4c">
<topic>rubygem-mail -- multiple vulnerabilities</topic>
<affects>
<package>
<name>rubygem-mail</name>
<range><lt>2.4.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>rubygem-mail -- multiple vulnerabilities</p>
<blockquote cite="http://seclists.org/oss-sec/2012/q2/190">
<p>Two issues were fixed. They are a file system traversal in file_delivery method and arbitrary command execution when using exim or sendmail from the command line.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2139</cvename>
<cvename>CVE-2012-2140</cvename>
<url>http://seclists.org/oss-sec/2012/q2/190</url>
</references>
<dates>
<discovery>2012-03-14</discovery>
<entry>2012-05-09</entry>
</dates>
</vuln>
<vuln vid="a1d0911f-987a-11e1-a2ef-001fd0af1a4c">
<topic>node -- private information disclosure</topic>
<affects>
<package>
<name>node</name>
<name>node-devel</name>
<range><lt>0.6.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Private information disclosure</p>
<blockquote cite="http://blog.nodejs.org/2012/05/07/http-server-security-vulnerability-please-upgrade-to-0-6-17/">
<p>An attacker can cause private information disclosure.</p>
</blockquote>
</body>
</description>
<references>
<url>http://blog.nodejs.org/2012/05/07/http-server-security-vulnerability-please-upgrade-to-0-6-17/</url>
</references>
<dates>
<discovery>2012-04-17</discovery>
<entry>2012-05-07</entry>
</dates>
</vuln>
<vuln vid="725ab25a-987b-11e1-a2ef-001fd0af1a4c">
<topic>p5-Config-IniFiles -- unsafe temporary file creation</topic>
<affects>
<package>
<name>p5-Config-IniFiles</name>
<range><lt>2.71</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Unsafe Temporary file creation</p>
<blockquote cite="https://bitbucket.org/shlomif/perl-config-inifiles/changeset/a08fa26f4f59">
<p>Config::IniFiles used a predictable name for its temporary
file without opening it correctly.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2451</cvename>
<url>https://bitbucket.org/shlomif/perl-config-inifiles/changeset/a08fa26f4f59</url>
</references>
<dates>
<discovery>2012-05-02</discovery>
<entry>2012-05-07</entry>
</dates>
</vuln>
<vuln vid="60de13d5-95f0-11e1-806a-001143cd36d8">
<topic>php -- vulnerability in certain CGI-based setups</topic>
<affects>
<package>
<name>php5</name>
<range><gt>5.4</gt><lt>5.4.2</lt></range>
<range><lt>5.3.12</lt></range>
</package>
<package>
<name>php53</name>
<range><lt>5.3.12</lt></range>
</package>
<package>
<name>php4</name>
<range><lt>4.4.10</lt></range>
</package>
<package>
<name>php52</name>
<range><lt>5.2.17_8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>php development team reports:</p>
<blockquote cite="http://www.php.net/archive/2012.php#id2012-05-03-1">
<p>Security Enhancements and Fixes in PHP 5.3.12:</p>
<ul>
<li>Initial fix for cgi-bin ?-s cmdarg parse issue
(CVE-2012-1823)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-1823</cvename>
</references>
<dates>
<discovery>2012-05-03</discovery>
<entry>2012-05-05</entry>
</dates>
</vuln>
<vuln vid="18dffa02-946a-11e1-be9d-000c29cc39d3">
<topic>WebCalendar -- multiple vulnerabilities</topic>
<affects>
<package>
<name>WebCalendar-devel</name>
<range><le>1.2.4</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Hanno Boeck reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2012/04/28/1">
<p>Fixes [are now available] for various security vulnerabilities
including LFI (local file inclusion), XSS (cross site scripting)
and others.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-1495</cvename>
<cvename>CVE-2012-1496</cvename>
<url>http://packetstormsecurity.org/files/112332/WebCalendar-1.2.4-Remote-Code-Execution.html</url>
<url>http://packetstormsecurity.org/files/112323/WebCalendar-1.2.4-Pre-Auth-Remote-Code-Injection.html</url>
<url>http://archives.neohapsis.com/archives/bugtraq/2012-04/0182.html</url>
</references>
<dates>
<discovery>2012-04-28</discovery>
<entry>2012-05-02</entry>
</dates>
</vuln>
<vuln vid="94c0ac4f-9388-11e1-b242-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>18.0.1025.168</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.com/search/label/Stable%20updates">
<p>[106413] High CVE-2011-3078: Use after free in floats handling.
Credit to Google Chrome Security Team (Marty Barbella) and
independent later discovery by miaubiz.</p>
<p>[117627] Medium CVE-2011-3079: IPC validation failure. Credit to
PinkiePie.</p>
<p>[121726] Medium CVE-2011-3080: Race condition in sandbox IPC.
Credit to Willem Pinckaers of Matasano.</p>
<p>[121899] High CVE-2011-3081: Use after free in floats handling.
Credit to miaubiz.</p>
<p>[117110] High CVE-2012-1521: Use after free in xml parser. Credit
to Google Chrome Security Team (SkyLined) and independent later
discovery by wushi of team509 reported through iDefense VCP
(V-874rcfpq7z).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3078</cvename>
<cvename>CVE-2011-3079</cvename>
<cvename>CVE-2011-3080</cvename>
<cvename>CVE-2011-3081</cvename>
<cvename>CVE-2012-1521</cvename>
<url>http://googlechromereleases.blogspot.com/search/label/Stable%20updates</url>
</references>
<dates>
<discovery>2012-04-30</discovery>
<entry>2012-05-01</entry>
</dates>
</vuln>
<vuln vid="2cde1892-913e-11e1-b44c-001fd0af1a4c">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php53</name>
<range><lt>5.3.11</lt></range>
</package>
<package>
<name>php5</name>
<range><lt>5.3.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>php development team reports:</p>
<blockquote cite="http://www.php.net/archive/2012.php#id2012-04-26-1">
<p>Security Enhancements for both PHP 5.3.11 and PHP 5.4.1:</p>
<ul>
<li>Insufficient validating of upload name leading to corrupted $_FILES indices. (CVE-2012-1172) </li>
<li>Add open_basedir checks to readline_write_history and readline_read_history.</li>
</ul>
<p>Security Enhancements for both PHP 5.3.11 only:</p>
<ul>
<li>Regression in magic_quotes_gpc fix for CVE-2012-0831.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0831</cvename>
<cvename>CVE-2012-1172</cvename>
<url>http://www.php.net/archive/2012.php#id2012-04-26-1</url>
</references>
<dates>
<discovery>2012-03-01</discovery>
<entry>2012-04-28</entry>
<modified>2012-05-04</modified>
</dates>
</vuln>
<vuln vid="0fa15e08-92ec-11e1-a94a-00215c6a37bb">
<topic>samba -- incorrect permission checks vulnerability</topic>
<affects>
<package>
<name>samba34</name>
<range><gt>3.4.*</gt><lt>3.4.17</lt></range>
</package>
<package>
<name>samba35</name>
<range><gt>3.5.*</gt><lt>3.5.15</lt></range>
</package>
<package>
<name>samba36</name>
<range><gt>3.6.*</gt><lt>3.6.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Samba project reports:</p>
<blockquote cite="http://www.samba.org/samba/security/CVE-2012-2111">
<p>Samba versions 3.4.x to 3.6.4 inclusive are affected
by a vulnerability that allows arbitrary users to modify
privileges on a file server.</p>
<p>Security checks were incorrectly applied to the Local
Security Authority (LSA) remote proceedure calls (RPC)
CreateAccount, OpenAccount, AddAccountRights and
RemoveAccountRights allowing any authenticated user
to modify the privileges database.</p>
<p>This is a serious error, as it means that authenticated
users can connect to the LSA and grant themselves the
"take ownership" privilege. This privilege is used by the
smbd file server to grant the ability to change ownership
of a file or directory which means users could take ownership
of files or directories they do not own.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2111</cvename>
</references>
<dates>
<discovery>2012-04-30</discovery>
<entry>2012-04-30</entry>
</dates>
</vuln>
<vuln vid="b428e6b3-926c-11e1-8d7b-003067b2972c">
<topic>portupgrade-devel -- lack of distfile checksums</topic>
<affects>
<package>
<name>portupgrade-devel</name>
<range><lt>0,3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ports security team reports:</p>
<p>The portupgrade-devel port fetched directly from a git
respository without checking against a known good
SHA hash. This means that it is possible that packages
built using this port may not match the one vetted
by the maintainer. Users are advised to rebuild
portupgrade-devel from known good sources.</p>
</body>
</description>
<references>
<mlist>http://web.archiveorange.com/archive/v/6ETvLYPz7CfFT9tiHKiI</mlist>
<mlist>http://www.freebsd.org/cgi/getmsg.cgi?fetch=100677+0+/usr/local/www/db/text/2012/cvs-ports/20120506.cvs-ports</mlist>
</references>
<dates>
<discovery>2012-04-30</discovery>
<entry>2012-04-30</entry>
<modified>2012-05-06</modified>
</dates>
</vuln>
<vuln vid="5d85976a-9011-11e1-b5e0-000c299b62e1">
<topic>net-snmp -- Remote DoS</topic>
<affects>
<package>
<name>net-snmp</name>
<range><lt>5.7.1_7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Red Hat Security Response Team reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=815813">
<p>An array index error, leading to out-of heap-based buffer read flaw was
found in the way the net-snmp agent performed lookups in the
extension table. When certain MIB subtrees were handled by the
extend directive, a remote attacker (having read privileges to the
subntree) could use this flaw to cause a denial of service condition
via an SNMP GET request involving a non-existent extension table
entry.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2141</cvename>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=815813</url>
<url>http://www.openwall.com/lists/oss-security/2012/04/26/2</url>
</references>
<dates>
<discovery>2012-04-26</discovery>
<entry>2012-04-27</entry>
</dates>
</vuln>
<vuln vid="380e8c56-8e32-11e1-9580-4061862b8c22">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>11.0,1</gt><lt>12.0,1</lt></range>
<range><lt>10.0.4,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>10.0.4,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.9</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>10.0.4</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.9</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><gt>11.0</gt><lt>12.0</lt></range>
<range><lt>10.0.4</lt></range>
</package>
<package>
<name>libxul</name>
<range><gt>1.9.2.*</gt><lt>10.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2012-20 Miscellaneous memory safety hazards (rv:12.0/ rv:10.0.4)</p>
<p>MFSA 2012-21 Multiple security flaws fixed in FreeType v2.4.9</p>
<p>MFSA 2012-22 use-after-free in IDBKeyRange</p>
<p>MFSA 2012-23 Invalid frees causes heap corruption in gfxImageSurface</p>
<p>MFSA 2012-24 Potential XSS via multibyte content processing errors</p>
<p>MFSA 2012-25 Potential memory corruption during font rendering using cairo-dwrite</p>
<p>MFSA 2012-26 WebGL.drawElements may read illegal video memory due to FindMaxUshortElement error</p>
<p>MFSA 2012-27 Page load short-circuit can lead to XSS</p>
<p>MFSA 2012-28 Ambiguous IPv6 in Origin headers may bypass webserver access restrictions</p>
<p>MFSA 2012-29 Potential XSS through ISO-2022-KR/ISO-2022-CN decoding issues</p>
<p>MFSA 2012-30 Crash with WebGL content using textImage2D</p>
<p>MFSA 2012-31 Off-by-one error in OpenType Sanitizer</p>
<p>MFSA 2012-32 HTTP Redirections and remote content can be read by javascript errors</p>
<p>MFSA 2012-33 Potential site identity spoofing when loading RSS and Atom feeds</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-1187</cvename>
<cvename>CVE-2011-3062</cvename>
<cvename>CVE-2012-0467</cvename>
<cvename>CVE-2012-0468</cvename>
<cvename>CVE-2012-0469</cvename>
<cvename>CVE-2012-0470</cvename>
<cvename>CVE-2012-0471</cvename>
<cvename>CVE-2012-0472</cvename>
<cvename>CVE-2012-0473</cvename>
<cvename>CVE-2012-0474</cvename>
<cvename>CVE-2012-0475</cvename>
<cvename>CVE-2012-0477</cvename>
<cvename>CVE-2012-0478</cvename>
<cvename>CVE-2012-0479</cvename>
<cvename>CVE-2012-1126</cvename>
<cvename>CVE-2012-1127</cvename>
<cvename>CVE-2012-1128</cvename>
<cvename>CVE-2012-1129</cvename>
<cvename>CVE-2012-1130</cvename>
<cvename>CVE-2012-1131</cvename>
<cvename>CVE-2012-1132</cvename>
<cvename>CVE-2012-1133</cvename>
<cvename>CVE-2012-1134</cvename>
<cvename>CVE-2012-1135</cvename>
<cvename>CVE-2012-1136</cvename>
<cvename>CVE-2012-1137</cvename>
<cvename>CVE-2012-1138</cvename>
<cvename>CVE-2012-1139</cvename>
<cvename>CVE-2012-1140</cvename>
<cvename>CVE-2012-1141</cvename>
<cvename>CVE-2012-1142</cvename>
<cvename>CVE-2012-1143</cvename>
<cvename>CVE-2012-1144</cvename>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-20.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-21.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-22.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-23.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-24.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-25.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-26.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-27.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-28.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-29.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-30.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-31.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-32.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-33.html</url>
</references>
<dates>
<discovery>2012-04-24</discovery>
<entry>2012-04-24</entry>
</dates>
</vuln>
<vuln vid="a04247f1-8d9c-11e1-93c7-00215c6a37bb">
<topic>Dokuwiki -- cross site scripting vulnerability</topic>
<affects>
<package>
<name>dokuwiki</name>
<range><lt>20120125_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Andy Webber reports:</p>
<blockquote cite="http://bugs.dokuwiki.org/index.php?do=details&amp;task_id=2487">
<p>Add User appears to be vulnerable to Cross Site Request Forgery (CSRF/XSRF).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2128</cvename>
<cvename>CVE-2012-2129</cvename>
</references>
<dates>
<discovery>2012-04-17</discovery>
<entry>2012-04-23</entry>
</dates>
</vuln>
<vuln vid="1c5abbe2-8d7f-11e1-a374-14dae9ebcf89">
<topic>asterisk -- multiple vulnerabilities</topic>
<affects>
<package>
<name>asterisk16</name>
<range><gt>1.6.*</gt><lt>1.6.2.24</lt></range>
</package>
<package>
<name>asterisk18</name>
<range><gt>1.8.*</gt><lt>1.8.11.1</lt></range>
</package>
<package>
<name>asterisk10</name>
<range><gt>10.*</gt><lt>10.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/security">
<p>Remote Crash Vulnerability in SIP Channel Driver</p>
<p>Heap Buffer Overflow in Skinny Channel Driver</p>
<p>Asterisk Manager User Unauthorized Shell Access</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.digium.com/pub/security/AST-2012-004.html</url>
<cvename>CVE-2012-2414</cvename>
<url>http://downloads.digium.com/pub/security/AST-2012-005.html</url>
<cvename>CVE-2012-2415</cvename>
<url>http://downloads.digium.com/pub/security/AST-2012-006.html</url>
<cvename>CVE-2012-2416</cvename>
</references>
<dates>
<discovery>2012-04-23</discovery>
<entry>2012-04-23</entry>
</dates>
</vuln>
<vuln vid="b384cc5b-8d56-11e1-8d7b-003067b2972c">
<topic>wordpress -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>3.3.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Wordpress reports:</p>
<blockquote cite="https://codex.wordpress.org/Version_3.3.2">
<p>External code has been updated to
non-vulnerable versions.
In addition the following bugs have been fixed:</p>
<ul>
<li>Limited privilege escalation where a site administrator could
deactivate network-wide plugins when running a WordPress network under
particular circumstances.</li>
<li>Cross-site scripting vulnerability when making URLs
clickable.</li>
<li>Cross-site scripting vulnerabilities in redirects after posting
comments in older browsers, and when filtering URLs.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2399</cvename>
<cvename>CVE-2012-2400</cvename>
<cvename>CVE-2012-2401</cvename>
<cvename>CVE-2012-2402</cvename>
<cvename>CVE-2012-2403</cvename>
<cvename>CVE-2012-2404</cvename>
<url>https://codex.wordpress.org/Version_3.3.2</url>
</references>
<dates>
<discovery>2012-04-20</discovery>
<entry>2012-04-23</entry>
</dates>
</vuln>
<vuln vid="7184f92e-8bb8-11e1-8d7b-003067b2972c">
<topic>OpenSSL -- integer conversions result in memory corruption</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSSL security team reports:</p>
<blockquote cite="http://www.openssl.org/news/secadv_20120419.txt">
<p>A potentially exploitable vulnerability has been discovered in the OpenSSL
function asn1_d2i_read_bio.
Any application which uses BIO or FILE based functions to read untrusted DER
format data is vulnerable. Affected functions are of the form d2i_*_bio or
d2i_*_fp, for example d2i_X509_bio or d2i_PKCS12_fp.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2110</cvename>
<mlist msgid="20120419103522.GN30784@cmpxchg8b.com">http://marc.info/?l=full-disclosure&amp;m=133483221408243</mlist>
<url>http://www.openssl.org/news/secadv_20120419.txt</url>
</references>
<dates>
<discovery>2012-04-19</discovery>
<entry>2012-04-21</entry>
</dates>
</vuln>
<vuln vid="09c87973-8b9d-11e1-b393-20cf30e32f6d">
<topic>bugzilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>bugzilla</name>
<range><ge>3.6.0</ge><lt>3.6.9</lt></range>
<range><ge>4.0.0</ge><lt>4.0.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>A Bugzilla Security Advisory reports:</h1>
<blockquote cite="http://www.bugzilla.org/security/3.6.8/">
<p>The following security issues have been discovered in
Bugzilla:</p>
<h1>Unauthorized Access</h1>
<p>Due to a lack of proper validation of the X-FORWARDED-FOR
header of an authentication request, an attacker could bypass
the current lockout policy used for protection against brute-
force password discovery. This vulnerability can only be
exploited if the 'inbound_proxies' parameter is set.</p>
<h1>Cross Site Scripting</h1>
<p>A JavaScript template used by buglist.cgi could be used
by a malicious script to permit an attacker to gain access
to some information about bugs he would not normally be
allowed to see, using the victim's credentials. To be
exploitable, the victim must be logged in when visiting
the attacker's malicious page.</p>
<p>All affected installations are encouraged to upgrade as soon
as possible.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0465</cvename>
<cvename>CVE-2012-0466</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=728639</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=745397</url>
</references>
<dates>
<discovery>2012-04-18</discovery>
<entry>2012-04-21</entry>
</dates>
</vuln>
<vuln vid="67516177-88ec-11e1-9a10-0023ae8e59f0">
<topic>typo -- Cross-Site Scripting</topic>
<affects>
<package>
<name>typo3</name>
<range><ge>4.6.0</ge><le>4.6.7</le></range>
<range><ge>4.5.0</ge><le>4.5.14</le></range>
<range><ge>4.4.0</ge><le>4.4.14</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Typo Security Team reports:</p>
<blockquote cite="https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-002/">
<p>Failing to properly encode the output, the default TYPO3
Exception Handler is susceptible to Cross-Site Scripting. We
are not aware of a possibility to exploit this vulnerability
without third party extensions being installed that put user
input in exception messages. However, it has come to our
attention that extensions using the extbase MVC framework can
be used to exploit this vulnerability if these extensions
accept objects in controller actions.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2112</cvename>
<url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-002/</url>
</references>
<dates>
<discovery>2012-04-17</discovery>
<entry>2012-04-18</entry>
</dates>
</vuln>
<vuln vid="0c14dfa7-879e-11e1-a2a0-00500802d8f7">
<topic>nginx -- Buffer overflow in the ngx_http_mp4_module</topic>
<affects>
<package>
<name>nginx</name>
<range><lt>1.0.15</lt></range>
</package>
<package>
<name>nginx-devel</name>
<range><lt>1.1.19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The nginx project reports:</p>
<blockquote cite="http://nginx.org/en/security_advisories.html">
<p>Buffer overflow in the ngx_http_mp4_module</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2089</cvename>
<url>http://nginx.org/en/security_advisories.html</url>
</references>
<dates>
<discovery>2012-04-12</discovery>
<entry>2012-04-16</entry>
</dates>
</vuln>
<vuln vid="c80a3d93-8632-11e1-a374-14dae9ebcf89">
<topic>phpmyfaq -- Remote PHP Code Execution Vulnerability</topic>
<affects>
<package>
<name>phpmyfaq</name>
<range><lt>2.7.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyFAQ project reports:</p>
<blockquote cite="http://www.phpmyfaq.de/advisory_2011-10-25.php">
<p>The bundled ImageManager library allows injection of arbitrary
PHP code to execute arbitrary PHP code and upload malware and
trojan horses.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.phpmyfaq.de/advisory_2012-04-14.php</url>
</references>
<dates>
<discovery>2012-04-14</discovery>
<entry>2012-04-14</entry>
</dates>
</vuln>
<vuln vid="607d2108-a0e4-423a-bf78-846f2a8f01b0">
<topic>puppet -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>puppet</name>
<range><gt>2.7.*</gt><lt>2.7.12_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="http://puppetlabs.com/security/">
<p>Multiple vulnerabilities exist in puppet that can result in
arbitrary code execution, arbitrary file read access, denial of
service, and arbitrary file write access. Please review the
details in each of the CVEs for additional information.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-1906</cvename>
<cvename>CVE-2012-1986</cvename>
<cvename>CVE-2012-1987</cvename>
<cvename>CVE-2012-1988</cvename>
<cvename>CVE-2012-1989</cvename>
<url>http://puppetlabs.com/security/cve/cve-2012-1906/</url>
<url>http://puppetlabs.com/security/cve/cve-2012-1986/</url>
<url>http://puppetlabs.com/security/cve/cve-2012-1987/</url>
<url>http://puppetlabs.com/security/cve/cve-2012-1988/</url>
<url>http://puppetlabs.com/security/cve/cve-2012-1989/</url>
</references>
<dates>
<discovery>2012-03-26</discovery>
<entry>2012-04-10</entry>
</dates>
</vuln>
<vuln vid="baf37cd2-8351-11e1-894e-00215c6a37bb">
<topic>samba -- "root" credential remote code execution</topic>
<affects>
<package>
<name>samba34</name>
<range><gt>3.4.*</gt><lt>3.4.16</lt></range>
</package>
<package>
<name>samba35</name>
<range><gt>3.5.*</gt><lt>3.5.14</lt></range>
</package>
<package>
<name>samba36</name>
<range><gt>3.6.*</gt><lt>3.6.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Samba development team reports:</p>
<blockquote cite="http://www.samba.org/samba/security/CVE-2012-1182">
<p>Samba versions 3.6.3 and all versions previous to this
are affected by a vulnerability that allows remote code
execution as the "root" user from an anonymous connection.</p>
<p>As this does not require an authenticated connection it
is the most serious vulnerability possible in a program,
and users and vendors are encouraged to patch their Samba
installations immediately.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-1182</cvename>
</references>
<dates>
<discovery>2012-04-10</discovery>
<entry>2012-04-10</entry>
</dates>
</vuln>
<vuln vid="7f448dc1-82ca-11e1-b393-20cf30e32f6d">
<topic>bugzilla Cross-Site Request Forgery</topic>
<affects>
<package>
<name>bugzilla</name>
<range><ge>4.0.0</ge><lt>4.0.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Bugzilla Security Advisory reports:</p>
<blockquote cite="http://www.bugzilla.org/security/4.0.4/">
<p>The following security issues have been discovered in
Bugzilla:</p>
<ul>
<li>Due to a lack of validation of the enctype form attribute
when making POST requests to xmlrpc.cgi, a possible CSRF
vulnerability was discovered. If a user visits an HTML page
with some malicious HTML code in it, an attacker could make
changes to a remote Bugzilla installation on behalf of the
victim's account by using the XML-RPC API on a site running
mod_perl. Sites running under mod_cgi are not affected.
Also, the user would have had to be already logged in to the
target site for the vulnerability to work.</li>
</ul>
<p>All affected installations are encouraged to upgrade as soon
as possible.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0453</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=725663</url>
</references>
<dates>
<discovery>2012-02-22</discovery>
<entry>2012-04-10</entry>
</dates>
</vuln>
<vuln vid="20923a0d-82ba-11e1-8d7b-003067b2972c">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.228</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://www.adobe.com/support/security/bulletins/apsb12-07.html">
<p>Multiple Priority 2 vulnerabilities could cause a crash and
potentially allow an attacker to take control of the affected
system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0724</cvename>
<cvename>CVE-2012-0725</cvename>
<cvename>CVE-2012-0772</cvename>
<cvename>CVE-2012-0773</cvename>
<url>https://www.adobe.com/support/security/bulletins/apsb12-07.html</url>
</references>
<dates>
<discovery>2012-04-05</discovery>
<entry>2012-04-10</entry>
</dates>
</vuln>
<vuln vid="262b92fe-81c8-11e1-8899-001ec9578670">
<topic>png -- memory corruption/possible remote code execution</topic>
<affects>
<package>
<name>png</name>
<name>linux-f10-png</name>
<range><lt>1.4.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PNG project reports:</p>
<blockquote cite="http://www.libpng.org/pub/png/libpng.html">
<p>libpng fails to correctly handle malloc() failures for text
chunks (in png_set_text_2()), which can lead to memory
corruption and the possibility of remote code execution.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3048</cvename>
<url>http://www.libpng.org/pub/png/libpng.html</url>
</references>
<dates>
<discovery>2012-03-29</discovery>
<entry>2012-04-08</entry>
</dates>
</vuln>
<vuln vid="462e2d6c-8017-11e1-a571-bcaec565249c">
<topic>freetype -- multiple vulnerabilities</topic>
<affects>
<package>
<name>freetype2</name>
<range><lt>2.4.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Freetype project reports:</p>
<blockquote cite="https://sourceforge.net/projects/freetype/files/freetype2/2.4.9/README/view">
<p>Multiple vulnerabilities exist in freetype that can result in
application crashes and remote code execution. Please review
the details in each of the CVEs for additional information.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-1126</cvename>
<cvename>CVE-2012-1127</cvename>
<cvename>CVE-2012-1128</cvename>
<cvename>CVE-2012-1129</cvename>
<cvename>CVE-2012-1130</cvename>
<cvename>CVE-2012-1131</cvename>
<cvename>CVE-2012-1132</cvename>
<cvename>CVE-2012-1133</cvename>
<cvename>CVE-2012-1134</cvename>
<cvename>CVE-2012-1135</cvename>
<cvename>CVE-2012-1136</cvename>
<cvename>CVE-2012-1137</cvename>
<cvename>CVE-2012-1138</cvename>
<cvename>CVE-2012-1139</cvename>
<cvename>CVE-2012-1140</cvename>
<cvename>CVE-2012-1141</cvename>
<cvename>CVE-2012-1142</cvename>
<cvename>CVE-2012-1143</cvename>
<cvename>CVE-2012-1144</cvename>
<url>https://sourceforge.net/projects/freetype/files/freetype2/2.4.9/README/view</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=806270</url>
</references>
<dates>
<discovery>2012-03-08</discovery>
<entry>2012-04-06</entry>
</dates>
</vuln>
<vuln vid="49314321-7fd4-11e1-9582-001b2134ef46">
<topic>mutt-devel -- failure to check SMTP TLS server certificate</topic>
<affects>
<package>
<name>mutt-devel</name>
<range><lt>1.5.21_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Dave B reports on Full Disclosure:</p>
<blockquote cite="http://seclists.org/fulldisclosure/2011/Mar/87">
<p>It seems that mutt fails to check the validity of a SMTP
servers certificate during a TLS connection. [...]
This means that an attacker could potentially MITM a
mutt user connecting to their SMTP server even when the
user has forced a TLS connection.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-1429</cvename>
<url>http://seclists.org/fulldisclosure/2011/Mar/87</url>
</references>
<dates>
<discovery>2012-03-08</discovery>
<entry>2012-04-06</entry>
</dates>
</vuln>
<vuln vid="057130e6-7f61-11e1-8a43-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>18.0.1025.151</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.com/search/label/Stable%20updates">
<p>[106577] Medium CVE-2011-3066: Out-of-bounds read in Skia clipping. Credit to miaubiz.</p>
<p>[117583] Medium CVE-2011-3067: Cross-origin iframe replacement.
Credit to Sergey Glazunov.</p>
<p>[117698] High CVE-2011-3068: Use-after-free in run-in handling.
Credit to miaubiz.</p>
<p>[117728] High CVE-2011-3069: Use-after-free in line box handling.
Credit to miaubiz.</p>
<p>[118185] High CVE-2011-3070: Use-after-free in v8 bindings. Credit
to Google Chrome Security Team (SkyLined).</p>
<p>[118273] High CVE-2011-3071: Use-after-free in HTMLMediaElement.
Credit to pa_kt, reporting through HP TippingPoint ZDI
(ZDI-CAN-1528).</p>
<p>[118467] Low CVE-2011-3072: Cross-origin violation parenting pop-up
window. Credit to Sergey Glazunov.</p>
<p>[118593] High CVE-2011-3073: Use-after-free in SVG resource
handling. Credit to Arthur Gerkis.</p>
<p>[119281] Medium CVE-2011-3074: Use-after-free in media handling.
Credit to Slawomir Blazek.</p>
<p>[119525] High CVE-2011-3075: Use-after-free applying style command.
Credit to miaubiz.</p>
<p>[120037] High CVE-2011-3076: Use-after-free in focus handling.
Credit to miaubiz.</p>
<p>[120189] Medium CVE-2011-3077: Read-after-free in script bindings.
Credit to Google Chrome Security Team (Inferno).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3066</cvename>
<cvename>CVE-2011-3067</cvename>
<cvename>CVE-2011-3068</cvename>
<cvename>CVE-2011-3069</cvename>
<cvename>CVE-2011-3070</cvename>
<cvename>CVE-2011-3071</cvename>
<cvename>CVE-2011-3072</cvename>
<cvename>CVE-2011-3073</cvename>
<cvename>CVE-2011-3074</cvename>
<cvename>CVE-2011-3075</cvename>
<cvename>CVE-2011-3076</cvename>
<cvename>CVE-2011-3077</cvename>
<url>http://googlechromereleases.blogspot.com/search/label/Stable%20updates</url>
</references>
<dates>
<discovery>2012-04-05</discovery>
<entry>2012-04-05</entry>
</dates>
</vuln>
<vuln vid="7289214f-7c55-11e1-ab3b-000bcdf0a03b">
<topic>libpurple -- Remote DoS via an MSN OIM message that lacks UTF-8 encoding</topic>
<affects>
<package>
<name>libpurple</name>
<range><lt>2.10.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>US-CERT reports:</p>
<blockquote cite="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-1178">
<p>The msn_oim_report_to_user function in oim.c in the MSN protocol
plugin in libpurple in Pidgin before 2.10.2 allows remote servers
to cause a denial of service (application crash) via an OIM message
that lacks UTF-8 encoding.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-1178</cvename>
</references>
<dates>
<discovery>2012-03-15</discovery>
<entry>2012-04-01</entry>
</dates>
</vuln>
<vuln vid="a81161d2-790f-11e1-ac16-e0cb4e266481">
<topic>phpMyAdmin -- Path disclosure due to missing verification of file presence</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><gt>3.4</gt><lt>3.4.10.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMYAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2012-2.php">
<p>The show_config_errors.php scripts did not validate the presence
of the configuration file, so an error message shows the full path
of this file, leading to possible further attacks. For the error
messages to be displayed, php.ini's error_reporting must be set to
E_ALL and display_errors must be On (these settings are not
recommended on a production server in the PHP manual).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-1902</cvename>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2012-2.php</url>
</references>
<dates>
<discovery>2012-03-28</discovery>
<entry>2012-03-28</entry>
</dates>
</vuln>
<vuln vid="b8f0a391-7910-11e1-8a43-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>18.0.1025.142</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.com/search/label/Stable%20updates">
<p>[109574] Medium CVE-2011-3058: Bad interaction possibly leading to
XSS in EUC-JP. Credit to Masato Kinugawa.</p>
<p>[112317] Medium CVE-2011-3059: Out-of-bounds read in SVG text
handling. Credit to Arthur Gerkis.</p>
<p>[114056] Medium CVE-2011-3060: Out-of-bounds read in text fragment
handling. Credit to miaubiz.</p>
<p>[116398] Medium CVE-2011-3061: SPDY proxy certificate checking
error. Credit to Leonidas Kontothanassis of Google.</p>
<p>[116524] High CVE-2011-3062: Off-by-one in OpenType Sanitizer.
Credit to Mateusz Jurczyk of the Google Security Team.</p>
<p>[117417] Low CVE-2011-3063: Validate navigation requests from the
renderer more carefully. Credit to kuzzcc, Sergey Glazunov,
PinkiePie and scarybeasts (Google Chrome Security Team).</p>
<p>[117471] High CVE-2011-3064: Use-after-free in SVG clipping. Credit to Atte Kettunen of OUSPG.</p>
<p>[117588] High CVE-2011-3065: Memory corruption in Skia. Credit to
Omair.</p>
<p>[117794] Medium CVE-2011-3057: Invalid read in v8. Credit to
Christian Holler.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3057</cvename>
<cvename>CVE-2011-3058</cvename>
<cvename>CVE-2011-3059</cvename>
<cvename>CVE-2011-3060</cvename>
<cvename>CVE-2011-3061</cvename>
<cvename>CVE-2011-3062</cvename>
<cvename>CVE-2011-3063</cvename>
<cvename>CVE-2011-3064</cvename>
<cvename>CVE-2011-3065</cvename>
<url>http://googlechromereleases.blogspot.com/search/label/Stable%20updates</url>
</references>
<dates>
<discovery>2012-03-28</discovery>
<entry>2012-03-28</entry>
</dates>
</vuln>
<vuln vid="60f81af3-7690-11e1-9423-00235a5f2c9a">
<topic>raptor/raptor2 -- XXE in RDF/XML File Interpretation</topic>
<affects>
<package>
<name>raptor2</name>
<range><lt>2.0.7</lt></range>
</package>
<package>
<name>raptor</name>
<range><lt>1.4.21_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Timothy D. Morgan reports:</p>
<blockquote cite="http://www.vsecurity.com/resources/advisory/20120324-1/">
<p>In December 2011, VSR identified a vulnerability in multiple open
source office products (including OpenOffice, LibreOffice, KOffice,
and AbiWord) due to unsafe interpretation of XML files with custom
entity declarations. Deeper analysis revealed that the
vulnerability was caused by acceptance of external entities by the
libraptor library, which is used by librdf and is in turn used by
these office products.</p>
<p>In the context of office applications, these vulnerabilities could
allow for XML External Entity (XXE) attacks resulting in file theft
and a loss of user privacy when opening potentially malicious ODF
documents. For other applications which depend on librdf or
libraptor, potentially serious consequences could result from
accepting RDF/XML content from untrusted sources, though the impact
may vary widely depending on the context.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0037</cvename>
<url>http://seclists.org/fulldisclosure/2012/Mar/281</url>
<url>http://www.vsecurity.com/resources/advisory/20120324-1/</url>
</references>
<dates>
<discovery>2012-03-24</discovery>
<entry>2012-03-25</entry>
</dates>
</vuln>
<vuln vid="42a2c82a-75b9-11e1-89b4-001ec9578670">
<topic>quagga -- multiple vulnerabilities</topic>
<affects>
<package>
<name>quagga</name>
<range><lt>0.99.20.1</lt></range>
</package>
<package>
<name>quagga-re</name>
<range><lt>0.99.17.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CERT reports:</p>
<blockquote cite="http://www.kb.cert.org/vuls/id/551715">
<p>The ospfd implementation of OSPF in Quagga allows a remote
attacker (on a local network segment with OSPF enabled) to cause
a denial of service (daemon aborts due to an assert) with a
malformed OSPF LS-Update message.</p>
<p>The ospfd implementation of OSPF in Quagga allows a remote
attacker (on a local network segment with OSPF enabled) to cause
a denial of service (daemon crash) with a malformed OSPF Network-
LSA message.</p>
<p>The bgpd implementation of BGP in Quagga allows remote attackers
to cause a denial of service (daemon aborts due to an assert) via
BGP Open message with an invalid AS4 capability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0249</cvename>
<cvename>CVE-2012-0250</cvename>
<cvename>CVE-2012-0255</cvename>
<url>http://www.kb.cert.org/vuls/id/551715</url>
</references>
<dates>
<discovery>2012-03-23</discovery>
<entry>2012-03-24</entry>
<modified>2012-03-26</modified>
</dates>
</vuln>
<vuln vid="acab2f88-7490-11e1-865f-00e0814cab4e">
<topic>Apache Traffic Server -- heap overflow vulnerability</topic>
<affects>
<package>
<name>trafficserver</name>
<range><lt>3.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CERT-FI reports:</p>
<blockquote cite="https://www.cert.fi/en/reports/2012/vulnerability612884.html">
<p>A heap overflow vulnerability has been found in the HTTP
(Hypertext Transfer Protocol) protocol handling of Apache
Traffic Server. The vulnerability allows an attacker to cause
a denial of service or potentially to execute his own code by
sending a specially modified HTTP message to an affected
server.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0256</cvename>
</references>
<dates>
<discovery>2012-03-22</discovery>
<entry>2012-03-24</entry>
</dates>
</vuln>
<vuln vid="330106da-7406-11e1-a1d7-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>17.0.963.83</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.com/search/label/Stable%20updates">
<p>[113902] High CVE-2011-3050: Use-after-free with first-letter
handling. Credit to miaubiz.</p>
<p>[116162] High CVE-2011-3045: libpng integer issue from upstream.
Credit to Glenn Randers-Pehrson of the libpng project.</p>
<p>[116461] High CVE-2011-3051: Use-after-free in CSS cross-fade
handling. Credit to Arthur Gerkis.</p>
<p>[116637] High CVE-2011-3052: Memory corruption in WebGL canvas
handling. Credit to Ben Vanik of Google.</p>
<p>[116746] High CVE-2011-3053: Use-after-free in block splitting.
Credit to miaubiz.</p>
<p>[117418] Low CVE-2011-3054: Apply additional isolations to webui
privileges. Credit to Sergey Glazunov.</p>
<p>[117736] Low CVE-2011-3055: Prompt in the browser native UI for
unpacked extension installation. Credit to PinkiePie.</p>
<p>[117550] High CVE-2011-3056: Cross-origin violation with "magic
iframe". Credit to Sergey Glazunov.</p>
<p>[117794] Medium CVE-2011-3057: Invalid read in v8. Credit to
Christian Holler.</p>
<p>[108648] Low CVE-2011-3049: Extension web request API can
interfere with system requests. Credit to Michael Gundlach.
Fixed in an earlier release.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3045</cvename>
<cvename>CVE-2011-3049</cvename>
<cvename>CVE-2011-3050</cvename>
<cvename>CVE-2011-3051</cvename>
<cvename>CVE-2011-3052</cvename>
<cvename>CVE-2011-3053</cvename>
<cvename>CVE-2011-3054</cvename>
<cvename>CVE-2011-3055</cvename>
<cvename>CVE-2011-3056</cvename>
<cvename>CVE-2011-3057</cvename>
<url>http://googlechromereleases.blogspot.com/search/label/Stable%20updates</url>
</references>
<dates>
<discovery>2012-03-21</discovery>
<entry>2012-03-22</entry>
</dates>
</vuln>
<vuln vid="2e7e9072-73a0-11e1-a883-001cc0a36e12">
<topic>libtasn1 -- ASN.1 length decoding vulnerability</topic>
<affects>
<package>
<name>libtasn1</name>
<range><lt>2.12</lt></range>
</package>
<package>
<name>gnutls</name>
<range><lt>2.12.18</lt></range>
</package>
<package>
<name>gnutls-devel</name>
<range><gt>2.99</gt><lt>3.0.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mu Dynamics, Inc. reports:</p>
<blockquote cite="http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/5959">
<p>Various functions using the ASN.1 length decoding logic in
Libtasn1 were incorrectly assuming that the return value from
asn1_get_length_der is always less than the length of the
enclosing ASN.1 structure, which is only true for valid
structures and not for intentionally corrupt or otherwise
buggy structures.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-1569</cvename>
</references>
<dates>
<discovery>2012-03-20</discovery>
<entry>2012-03-21</entry>
<modified>2012-03-24</modified>
</dates>
</vuln>
<vuln vid="aecee357-739e-11e1-a883-001cc0a36e12">
<topic>gnutls -- possible overflow/Denial of service vulnerabilities</topic>
<affects>
<package>
<name>gnutls</name>
<range><lt>2.12.18</lt></range>
</package>
<package>
<name>gnutls-devel</name>
<range><gt>2.99</gt><lt>3.0.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mu Dynamics, Inc. reports:</p>
<blockquote cite="http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/5959">
<p>The block cipher decryption logic in GnuTLS assumed that a
record containing any data which was a multiple of the block
size was valid for further decryption processing, leading to
a heap corruption vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-1573</cvename>
</references>
<dates>
<discovery>2012-03-20</discovery>
<entry>2012-03-21</entry>
<modified>2012-03-24</modified>
</dates>
</vuln>
<vuln vid="0d530174-6eef-11e1-afd6-14dae9ebcf89">
<topic>asterisk -- multiple vulnerabilities</topic>
<affects>
<package>
<name>asterisk14</name>
<range><gt>1.4.*</gt><lt>1.4.44</lt></range>
</package>
<package>
<name>asterisk16</name>
<range><gt>1.6.*</gt><lt>1.6.2.23</lt></range>
</package>
<package>
<name>asterisk18</name>
<range><gt>1.8.*</gt><lt>1.8.10.1</lt></range>
</package>
<package>
<name>asterisk10</name>
<range><gt>10.*</gt><lt>10.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/security">
<p>Stack Buffer Overflow in HTTP Manager</p>
<p>Remote Crash Vulnerability in Milliwatt Application</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2012-002.html</url>
<url>http://downloads.asterisk.org/pub/security/AST-2012-003.html</url>
</references>
<dates>
<discovery>2012-03-15</discovery>
<entry>2012-03-15</entry>
</dates>
</vuln>
<vuln vid="60eb344e-6eb1-11e1-8ad7-00e0815b8da8">
<topic>OpenSSL -- CMS and S/MIME Bleichenbacher attack</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.0_10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL Team reports:</p>
<blockquote cite="http://www.openssl.org/news/secadv_20120312.txt">
<p>A weakness in the OpenSSL CMS and PKCS #7 code can be exploited
using Bleichenbacher's attack on PKCS #1 v1.5 RSA padding
also known as the million message attack (MMA).</p>
<p>Only users of CMS, PKCS #7, or S/MIME decryption operations are
affected. A successful attack needs on average 2^20 messages. In
practice only automated systems will be affected as humans will
not be willing to process this many messages.</p>
<p>SSL/TLS applications are *NOT* affected by this problem since
the SSL/TLS code does not use the PKCS#7 or CMS decryption
code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0884</cvename>
<url>http://www.openssl.org/news/secadv_20120312.txt</url>
</references>
<dates>
<discovery>2012-03-12</discovery>
<entry>2012-03-15</entry>
</dates>
</vuln>
<vuln vid="29194cb8-6e9f-11e1-8376-f0def16c5c1b">
<topic>nginx -- potential information leak</topic>
<affects>
<package>
<name>nginx</name>
<range><lt>1.0.14,1</lt></range>
</package>
<package>
<name>nginx-devel</name>
<range><lt>1.1.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>nginx development team reports:</p>
<blockquote cite="http://nginx.net/CHANGES">
<p>Matthew Daley recently discovered a security problem
which may lead to a disclosure of previously freed memory
on specially crafted response from an upstream server,
potentially resulting in sensitive information leak.</p>
</blockquote>
</body>
</description>
<references>
<url>http://nginx.net/CHANGES</url>
</references>
<dates>
<discovery>2012-03-15</discovery>
<entry>2012-03-15</entry>
</dates>
</vuln>
<vuln vid="a1050b8b-6db3-11e1-8b37-0011856a6e37">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>4.0,1</gt><lt>10.0.3,1</lt></range>
<range><ge>3.6.*,1</ge><lt>3.6.28</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>10.0.3,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.8</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>10.0.3</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.8</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><gt>4.0</gt><lt>10.0.3</lt></range>
<range><gt>3.1.*</gt><lt>3.1.20</lt></range>
</package>
<package>
<name>libxul</name>
<range><gt>1.9.2.*</gt><lt>1.9.2.28</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2012-13 XSS with Drag and Drop and Javascript: URL</p>
<p>MFSA 2012-14 SVG issues found with Address Sanitizer</p>
<p>MFSA 2012-15 XSS with multiple Content Security Policy headers</p>
<p>MFSA 2012-16 Escalation of privilege with Javascript: URL as home page</p>
<p>MFSA 2012-17 Crash when accessing keyframe cssText after dynamic modification</p>
<p>MFSA 2012-18 window.fullScreen writeable by untrusted content</p>
<p>MFSA 2012-19 Miscellaneous memory safety hazards (rv:11.0/ rv:10.0.3 / rv:1.9.2.28)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0451</cvename>
<cvename>CVE-2012-0455</cvename>
<cvename>CVE-2012-0456</cvename>
<cvename>CVE-2012-0457</cvename>
<cvename>CVE-2012-0458</cvename>
<cvename>CVE-2012-0459</cvename>
<cvename>CVE-2012-0460</cvename>
<cvename>CVE-2012-0461</cvename>
<cvename>CVE-2012-0462</cvename>
<cvename>CVE-2012-0463</cvename>
<cvename>CVE-2012-0464</cvename>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-13.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-14.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-15.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-16.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-17.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-18.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-19.html</url>
</references>
<dates>
<discovery>2012-03-13</discovery>
<entry>2012-03-14</entry>
<modified>2012-03-18</modified>
</dates>
</vuln>
<vuln vid="6d329b64-6bbb-11e1-9166-001e4f0fb9b1">
<topic>portaudit -- auditfile remote code execution</topic>
<affects>
<package>
<name>portaudit</name>
<range><lt>0.6.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Michael Gmelin and Jörg Scheinert has reported a remote
command execution vulnerability in portaudit.</p>
<p>An attacker who can get the user to use a specially crafted
audit file will be able to run commands on the users system,
with the privileges of the user running running portaudit
(often root).</p>
<p>The attack could e.g. happen through DNS hijacking or a man
in the middle attack.</p>
<p>Note that if the user has set up portaudit to run from
periodic this attack could happen without direct user
interaction.</p>
<p>In the FreeBSD Ports Collection (bsd.port.mk) the check for
vulnerable ports at install-time directly operates on the
auditfile and has the same vulnerability as portaudit. As
the Ports Collection infrastructure does not have a version
number just be sure to have a Ports Collection new enough to
contain the fix for portaudit. Note that this is <em>only</em>
a problem for users which has portaudit installed, as they will
not have the audit database installed or downloaded
otherwise.</p>
</body>
</description>
<references>
<url>http://cvsweb.FreeBSD.org/ports/ports-mgmt/portaudit/Makefile#rev1.30</url>
<url>http://cvsweb.FreeBSD.org/ports/Mk/bsd.port.mk#rev1.707</url>
</references>
<dates>
<discovery>2012-03-11</discovery>
<entry>2012-03-11</entry>
</dates>
</vuln>
<vuln vid="ab1f515d-6b69-11e1-8288-00262d5ed8ee">
<topic>chromium -- Errant plug-in load and GPU process memory corruption</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>17.0.963.79</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.com/search/label/Stable%20updates">
<p>[117620] [117656] Critical CVE-2011-3047: Errant plug-in load and
GPU process memory corruption. Credit to PinkiePie.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3047</cvename>
<url>http://googlechromereleases.blogspot.com/search/label/Stable%20updates</url>
</references>
<dates>
<discovery>2012-03-10</discovery>
<entry>2012-03-11</entry>
</dates>
</vuln>
<vuln vid="9da3834b-6a50-11e1-91af-003067b2972c">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>11.1r102.63</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://www.adobe.com/support/security/bulletins/apsb12-05.html">
<p>These vulnerabilities could cause a crash and potentially allow
an attacker to take control of the affected system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0768</cvename>
<cvename>CVE-2012-0769</cvename>
<url>https://www.adobe.com/support/security/bulletins/apsb12-05.html</url>
</references>
<dates>
<discovery>2012-03-05</discovery>
<entry>2012-03-09</entry>
</dates>
</vuln>
<vuln vid="1015e1fe-69ce-11e1-8288-00262d5ed8ee">
<topic>chromium -- cross-site scripting vulnerability</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>17.0.963.78</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.com/search/label/Stable%20updates">
<p>[117226] [117230] Critical CVE-2011-3046: UXSS and bad history
navigation. Credit to Sergey Glazunov.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3046</cvename>
<url>http://googlechromereleases.blogspot.com/search/label/Stable%20updates</url>
</references>
<dates>
<discovery>2012-03-08</discovery>
<entry>2012-03-09</entry>
</dates>
</vuln>
<vuln vid="9448a82f-6878-11e1-865f-00e0814cab4e">
<topic>jenkins -- XSS vulnerability</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>1.453</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory reports:</p>
<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2012-03-05">
<p>An XSS vulnerability was found in Jenkins core, which allows an
attacker to inject malicious HTMLs to pages served by Jenkins.
This allows an attacker to escalate his privileges by hijacking
sessions of other users. This vulnerability affects all
versions.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2012-03-05</url>
</references>
<dates>
<discovery>2012-03-05</discovery>
<entry>2012-03-07</entry>
</dates>
</vuln>
<vuln vid="99aef698-66ed-11e1-8288-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>17.0.963.65</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.com/search/label/Stable%20updates">
<p>[105867] High CVE-2011-3031: Use-after-free in v8 element wrapper.
Credit to Chamal de Silva.</p>
<p>[108037] High CVE-2011-3032: Use-after-free in SVG value handling.
Credit to Arthur Gerkis.</p>
<p>[108406] [115471] High CVE-2011-3033: Buffer overflow in the Skia
drawing library. Credit to Aki Helin of OUSPG.</p>
<p>[111748] High CVE-2011-3034: Use-after-free in SVG document
handling. Credit to Arthur Gerkis.</p>
<p>[112212] High CVE-2011-3035: Use-after-free in SVG use handling.
Credit to Arthur Gerkis.</p>
<p>[113258] High CVE-2011-3036: Bad cast in line box handling. Credit
to miaubiz.</p>
<p>[113439] [114924] [115028] High CVE-2011-3037: Bad casts in
anonymous block splitting. Credit to miaubiz.</p>
<p>[113497] High CVE-2011-3038: Use-after-free in multi-column
handling. Credit to miaubiz.</p>
<p>[113707] High CVE-2011-3039: Use-after-free in quote handling.
Credit to miaubiz.</p>
<p>[114054] High CVE-2011-3040: Out-of-bounds read in text handling.
Credit to miaubiz.</p>
<p>[114068] High CVE-2011-3041: Use-after-free in class attribute
handling. Credit to miaubiz.</p>
<p>[114219] High CVE-2011-3042: Use-after-free in table section
handling. Credit to miaubiz.</p>
<p>[115681] High CVE-2011-3043: Use-after-free in flexbox with floats.
Credit to miaubiz.</p>
<p>[116093] High CVE-2011-3044: Use-after-free with SVG animation
elements. Credit to Arthur Gerkis.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3031</cvename>
<cvename>CVE-2011-3032</cvename>
<cvename>CVE-2011-3033</cvename>
<cvename>CVE-2011-3034</cvename>
<cvename>CVE-2011-3035</cvename>
<cvename>CVE-2011-3036</cvename>
<cvename>CVE-2011-3037</cvename>
<cvename>CVE-2011-3038</cvename>
<cvename>CVE-2011-3039</cvename>
<cvename>CVE-2011-3040</cvename>
<cvename>CVE-2011-3041</cvename>
<cvename>CVE-2011-3042</cvename>
<cvename>CVE-2011-3043</cvename>
<cvename>CVE-2011-3044</cvename>
<url>http://googlechromereleases.blogspot.com/search/label/Stable%20updates</url>
</references>
<dates>
<discovery>2012-03-04</discovery>
<entry>2012-03-05</entry>
</dates>
</vuln>
<vuln vid="eba70db4-6640-11e1-98af-00262d8b701d">
<topic>dropbear -- arbitrary code execution</topic>
<affects>
<package>
<name>dropbear</name>
<range><ge>0.51</ge><lt>2012.55</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Dropbear project reports:</p>
<blockquote cite="http://xforce.iss.net/xforce/xfdb/73444">
<p>Dropbear SSH Server could allow a remote authenticated attacker
to execute arbitrary code on the system, caused by a use-after-
free error. If a command restriction is enforced, an attacker
could exploit this vulnerability to execute arbitrary code on
the system with root privileges.</p>
</blockquote>
</body>
</description>
<references>
<bid>52159</bid>
<cvename>CVE-2012-0920</cvename>
<url>http://secunia.com/advisories/48147</url>
<url>http://xforce.iss.net/xforce/xfdb/73444</url>
</references>
<dates>
<discovery>2012-02-22</discovery>
<entry>2012-03-04</entry>
</dates>
</vuln>
<vuln vid="46aeba13-64a1-11e1-bc16-0023ae8e59f0">
<topic>openx -- undisclosed security issue</topic>
<affects>
<package>
<name>openx</name>
<range><lt>2.8.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenX does not provide information about vulnerabilities beyond their
existence.</p>
</body>
</description>
<references>
<url>http://blog.openx.org/12/security-matters-3</url>
</references>
<dates>
<discovery>2011-12-01</discovery>
<entry>2012-03-02</entry>
<modified>2012-07-08</modified>
</dates>
</vuln>
<vuln vid="174b8864-6237-11e1-be18-14dae938ec40">
<topic>databases/postgresql*-client -- multiple vulnerabilities</topic>
<affects>
<package>
<name>postgresql-client</name>
<range><lt>8.3.18</lt></range>
<range><ge>8.4</ge><lt>8.4.11</lt></range>
<range><ge>9</ge><lt>9.0.7</lt></range>
<range><ge>9.1</ge><lt>9.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PostgreSQL Global Development Group reports:</p>
<blockquote cite="http://www.postgresql.org/about/news/1377/">
<p>These vulnerabilities could allow users to define triggers that
execute functions on which the user does not have EXECUTE
permission, allow SSL certificate spoofing and allow line breaks
in object names to be exploited to execute code when loading a
pg_dump file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0866</cvename>
<cvename>CVE-2012-0867</cvename>
<cvename>CVE-2012-0868</cvename>
<url>http://www.postgresql.org/about/news/1377/</url>
</references>
<dates>
<discovery>2012-02-27</discovery>
<entry>2012-02-28</entry>
</dates>
</vuln>
<vuln vid="f63bf080-619d-11e1-91af-003067b2972c">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>11.1r102.62</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://www.adobe.com/support/security/bulletins/apsb12-03.html">
<p>These vulnerabilities could cause a crash and potentially allow
an attacker to take control of the affected system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0751</cvename>
<cvename>CVE-2012-0752</cvename>
<cvename>CVE-2012-0753</cvename>
<cvename>CVE-2012-0754</cvename>
<cvename>CVE-2012-0755</cvename>
<cvename>CVE-2012-0756</cvename>
<cvename>CVE-2012-0767</cvename>
<url>https://www.adobe.com/support/security/bulletins/apsb12-03.html</url>
</references>
<dates>
<discovery>2012-02-15</discovery>
<entry>2012-02-27</entry>
</dates>
</vuln>
<vuln vid="57f1a624-6197-11e1-b98c-bcaec565249c">
<topic>libxml2 -- heap buffer overflow</topic>
<affects>
<package>
<name>libxml2</name>
<name>linux-f10-libxml2</name>
<range><lt>2.7.8_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google chrome team reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.com/2012/01/stable-channel-update.html">
<p>Heap-based buffer overflow in libxml2, allows remote attackers
to cause a denial of service or possibly have unspecified other
impact via unknown vectors.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3919</cvename>
<url>http://googlechromereleases.blogspot.com/2012/01/stable-channel-update.html</url>
</references>
<dates>
<discovery>2012-01-05</discovery>
<entry>2012-02-27</entry>
</dates>
</vuln>
<vuln vid="ba51c2f7-5b43-11e1-8288-00262d5ed8ee">
<topic>plib -- remote code execution via buffer overflow</topic>
<affects>
<package>
<name>torcs</name>
<range><lt>1.3.3</lt></range>
</package>
<package>
<name>plib</name>
<range><le>1.8.5_3</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/47297/">
<p>A vulnerability has been discovered in PLIB, which can be
exploited by malicious people to compromise an application using
the library.</p>
<p>The vulnerability is caused due to a boundary error within the
"ulSetError()" function (src/util/ulError.cxx) when creating the
error message, which can be exploited to overflow a static
buffer.</p>
<p>Successful exploitation allows the execution of arbitrary code
but requires that the attacker can e.g. control the content of
an overly long error message passed to the "ulSetError()"
function.</p>
<p>The vulnerability is confirmed in version 1.8.5. Other versions
may also be affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-4620</cvename>
<url>http://secunia.com/advisories/47297/</url>
<url>http://torcs.sourceforge.net/index.php?name=News&amp;file=article&amp;sid=79</url>
</references>
<dates>
<discovery>2011-12-21</discovery>
<entry>2012-02-19</entry>
</dates>
</vuln>
<vuln vid="fdd1c316-5a3d-11e1-8d3e-e0cb4e266481">
<topic>phpMyAdmin -- XSS in replication setup</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><gt>3.4</gt><lt>3.4.10.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2012-1.php">
<p>It was possible to conduct XSS using a crafted database name.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-1190</cvename>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2012-1.php</url>
</references>
<dates>
<discovery>2012-02-18</discovery>
<entry>2012-02-18</entry>
</dates>
</vuln>
<vuln vid="da317bc9-59a6-11e1-bc16-0023ae8e59f0">
<topic>piwik -- xss and click-jacking issues</topic>
<affects>
<package>
<name>piwik</name>
<range><lt>1.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Piwik Team reports:</p>
<blockquote cite="http://piwik.org/blog/2012/02/7775/">
<p>We would like to thank the following security researchers for
their responsible disclosure of XSS and click-jacking issues:
Piotr Duszynski, Sergey Markov, Mauro Gentile.</p>
</blockquote>
</body>
</description>
<references>
<url>"http://piwik.org/blog/2012/02/7775/"</url>
</references>
<dates>
<discovery>2012-02-16</discovery>
<entry>2012-02-16</entry>
</dates>
</vuln>
<vuln vid="d7dbd2db-599c-11e1-a2fb-14dae9ebcf89">
<topic>mozilla -- heap-buffer overflow</topic>
<affects>
<package>
<name>firefox</name>
<range><ge>10.0,1</ge><lt>10.0.2,1</lt></range>
<range><ge>3.6.*,1</ge><lt>3.6.27</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><ge>10.0,1</ge><lt>10.0.2,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><ge>2.7</ge><lt>2.7.2</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><ge>10.0</ge><lt>10.0.2</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><ge>2.7</ge><lt>2.7.2</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><ge>10.0</ge><lt>10.0.2</lt></range>
<range><gt>3.1.*</gt><lt>3.1.19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2012-11 libpng integer overflow</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3026</cvename>
<url>https://www.mozilla.org/security/announce/2012/mfsa2012-11.html</url>
</references>
<dates>
<discovery>2012-02-16</discovery>
<entry>2012-02-17</entry>
<modified>2012-03-18</modified>
</dates>
</vuln>
<vuln vid="2f5ff968-5829-11e1-8288-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>17.0.963.56</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.com/search/label/Stable%20updates">
<p>[105803] High CVE-2011-3015: Integer overflows in PDF codecs.
Credit to Google Chrome Security Team (scarybeasts).</p>
<p>[106336] Medium CVE-2011-3016: Read-after-free with counter nodes.
Credit to miaubiz.</p>
<p>[108695] High CVE-2011-3017: Possible use-after-free in database
handling. Credit to miaubiz.</p>
<p>[110172] High CVE-2011-3018: Heap overflow in path rendering.
Credit to Aki Helin of OUSPG.</p>
<p>[110849] High CVE-2011-3019: Heap buffer overflow in MKV handling.
Credit to Google Chrome Security Team (scarybeasts) and Mateusz
Jurczyk of the Google Security Team.</p>
<p>[111575] Medium CVE-2011-3020: Native client validator error.
Credit to Nick Bray of the Chromium development community.</p>
<p>[111779] High CVE-2011-3021: Use-after-free in subframe loading.
Credit to Arthur Gerkis.</p>
<p>[112236] Medium CVE-2011-3022: Inappropriate use of http for
translation script. Credit to Google Chrome Security Team (Jorge
Obes).</p>
<p>[112259] Medium CVE-2011-3023: Use-after-free with drag and drop.
Credit to pa_kt.</p>
<p>[112451] Low CVE-2011-3024: Browser crash with empty x509
certificate. Credit to chrometot.</p>
<p>[112670] Medium CVE-2011-3025: Out-of-bounds read in h.264
parsing. Credit to Slawomir Blazek.</p>
<p>[112822] High CVE-2011-3026: Integer overflow / truncation in
libpng. Credit to Juri Aedla.</p>
<p>[112847] Medium CVE-2011-3027: Bad cast in column handling.
Credit to miaubiz.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3015</cvename>
<cvename>CVE-2011-3016</cvename>
<cvename>CVE-2011-3017</cvename>
<cvename>CVE-2011-3018</cvename>
<cvename>CVE-2011-3019</cvename>
<cvename>CVE-2011-3020</cvename>
<cvename>CVE-2011-3021</cvename>
<cvename>CVE-2011-3022</cvename>
<cvename>CVE-2011-3023</cvename>
<cvename>CVE-2011-3024</cvename>
<cvename>CVE-2011-3025</cvename>
<cvename>CVE-2011-3026</cvename>
<cvename>CVE-2011-3027</cvename>
<url>http://googlechromereleases.blogspot.com/search/label/Stable%20updates</url>
</references>
<dates>
<discovery>2012-02-15</discovery>
<entry>2012-02-15</entry>
</dates>
</vuln>
<vuln vid="b4f8be9e-56b2-11e1-9fb7-003067b2972c">
<topic>Python -- DoS via malformed XML-RPC / HTTP POST request</topic>
<affects>
<package>
<name>python32</name>
<range><le>3.2.2_2</le></range>
</package>
<package>
<name>python31</name>
<range><le>3.1.4_2</le></range>
</package>
<package>
<name>python27</name>
<range><le>2.7.2_3</le></range>
</package>
<package>
<name>python26</name>
<range><le>2.6.7_2</le></range>
</package>
<package>
<name>python25</name>
<range><le>2.5.6_2</le></range>
</package>
<package>
<name>python24</name>
<range><le>2.4.5_8</le></range>
</package>
<package>
<name>pypy</name>
<!-- note that it also affects 1.8 but we do not yet have
this version in ports. -->
<range><le>1.7</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jan Lieskovsky reports,</p>
<blockquote cite="http://bugs.python.org/issue14001">
<p>A denial of service flaw was found in the way Simple XML-RPC
Server module of Python processed client connections, that were
closed prior the complete request body has been received. A
remote attacker could use this flaw to cause Python Simple
XML-RPC based server process to consume excessive amount of
CPU.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0845</cvename>
<url>http://bugs.python.org/issue14001</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=789790</url>
<url>https://bugs.pypy.org/issue1047</url>
</references>
<dates>
<discovery>2012-02-13</discovery>
<entry>2012-02-14</entry>
<modified>2012-02-26</modified>
</dates>
</vuln>
<vuln vid="2b20fd5f-552e-11e1-9fb7-003067b2972c">
<topic>WebCalendar -- Persistent XSS</topic>
<affects>
<package>
<name>WebCalendar</name>
<range><le>1.2.4</le></range>
</package>
<package>
<name>WebCalendar-devel</name>
<range><le>1.2.4</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>tom reports,</p>
<blockquote cite="http://seclists.org/bugtraq/2012/Jan/128">
<p>There is no sanitation on the input of the location variable
allowing for persistent XSS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0846</cvename>
<url>http://sourceforge.net/tracker/?func=detail&amp;aid=3472745&amp;group_id=3870&amp;atid=103870</url>
</references>
<dates>
<discovery>2012-01-11</discovery>
<entry>2012-02-12</entry>
<modified>2012-02-13</modified>
</dates>
</vuln>
<vuln vid="eba9aa94-549c-11e1-b6b7-0011856a6e37">
<topic>mozilla -- use-after-free in nsXBLDocumentInfo::ReadPrototypeBindings</topic>
<affects>
<package>
<name>firefox</name>
<range><ge>10.0,1</ge><lt>10.0.1,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><ge>10.0,1</ge><lt>10.0.1,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><ge>2.7</ge><lt>2.7.1</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><ge>10.0</ge><lt>10.0.1</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><ge>2.7</ge><lt>2.7.1</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><ge>10.0</ge><lt>10.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2012-10 use after free in nsXBLDocumentInfo::ReadPrototypeBindings</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0452</cvename>
<url>https://www.mozilla.org/security/announce/2012/mfsa2012-10.html</url>
</references>
<dates>
<discovery>2012-02-10</discovery>
<entry>2012-02-11</entry>
</dates>
</vuln>
<vuln vid="1c4cab30-5468-11e1-9fb7-003067b2972c">
<topic>bip -- buffer overflow</topic>
<affects>
<package>
<name>bip</name>
<range><le>0.8.8</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Julien Tinnes reports,</p>
<blockquote cite="https://projects.duckcorp.org/issues/269">
<p>Bip doesn't check if fd is equal or larger than FD_SETSIZE.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0806</cvename>
<url>https://projects.duckcorp.org/projects/bip/repository/revisions/222a33cb84a2e52ad55a88900b7895bf9dd0262c</url>
<url>https://projects.duckcorp.org/issues/269</url>
</references>
<dates>
<discovery>2012-01-07</discovery>
<entry>2012-02-11</entry>
</dates>
</vuln>
<vuln vid="039d057e-544e-11e1-9fb7-003067b2972c">
<topic>surf -- private information disclosure</topic>
<affects>
<package>
<name>surf</name>
<range><le>0.4.1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>surf does not protect its cookie jar against access read access from
other local users</p>
</body>
</description>
<references>
<cvename>CVE-2012-0842</cvename>
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=659296</url>
</references>
<dates>
<discovery>2012-02-10</discovery>
<entry>2012-02-11</entry>
</dates>
</vuln>
<vuln vid="7c769c89-53c2-11e1-8e52-00163e22ef61">
<topic>glpi -- remote attack via crafted POST request</topic>
<affects>
<package>
<name>glpi</name>
<range><lt>0.80.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The GLPI project reports:</p>
<blockquote cite="http://www.glpi-project.org/spip.php?page=annonce&amp;id_breve=237&amp;lang=en">
<p>The autocompletion functionality in GLPI before 0.80.2 does not
blacklist certain username and password fields, which allows
remote attackers to obtain sensitive information via a crafted
POST request.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.glpi-project.org/spip.php?page=annonce&amp;id_breve=237&amp;lang=en</url>
<url>https://forge.indepnet.net/issues/3017</url>
<cvename>CVE-2011-2720</cvename>
</references>
<dates>
<discovery>2011-07-20</discovery>
<entry>2012-02-10</entry>
<modified>2013-06-19</modified>
</dates>
</vuln>
<vuln vid="fe1976c2-5317-11e1-9e99-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>17.0.963.46</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.com/search/label/Stable%20updates">
<p>[73478] Low CVE-2011-3953: Avoid clipboard monitoring after paste
event. Credit to Daniel Cheng of the Chromium development
community.</p>
<p>[92550] Low CVE-2011-3954: Crash with excessive database usage.
Credit to Collin Payne.</p>
<p>[93106] High CVE-2011-3955: Crash aborting an IndexDB transaction.
Credit to David Grogan of the Chromium development community.</p>
<p>[103630] Low CVE-2011-3956: Incorrect handling of sandboxed origins
inside extensions. Credit to Devdatta Akhawe, UC Berkeley.</p>
<p>[104056] High CVE-2011-3957: Use-after-free in PDF garbage
collection. Credit to Aki Helin of OUSPG.</p>
<p>[105459] High CVE-2011-3958: Bad casts with column spans. Credit
to miaubiz.</p>
<p>[106441] High CVE-2011-3959: Buffer overflow in locale handling.
Credit to Aki Helin of OUSPG.</p>
<p>[108416] Medium CVE-2011-3960: Out-of-bounds read in audio
decoding. Credit to Aki Helin of OUSPG.</p>
<p>[108871] Critical CVE-2011-3961: Race condition after crash of
utility process. Credit to Shawn Goertzen.</p>
<p>[108901] Medium CVE-2011-3962: Out-of-bounds read in path clipping.
Credit to Aki Helin of OUSPG.</p>
<p>[109094] Medium CVE-2011-3963: Out-of-bounds read in PDF fax image
handling. Credit to Atte Kettunen of OUSPG.</p>
<p>[109245] Low CVE-2011-3964: URL bar confusion after drag + drop.
Credit to Code Audit Labs of VulnHunt.com.</p>
<p>[109664] Low CVE-2011-3965: Crash in signature check. Credit to
Slawomir Blazek.</p>
<p>[109716] High CVE-2011-3966: Use-after-free in stylesheet error
handling. Credit to Aki Helin of OUSPG.</p>
<p>[109717] Low CVE-2011-3967: Crash with unusual certificate. Credit
to Ben Carrillo.</p>
<p>[109743] High CVE-2011-3968: Use-after-free in CSS handling.
Credit to Arthur Gerkis.</p>
<p>[110112] High CVE-2011-3969: Use-after-free in SVG layout. Credit
to Arthur Gerkis.</p>
<p>[110277] Medium CVE-2011-3970: Out-of-bounds read in libxslt.
Credit to Aki Helin of OUSPG.</p>
<p>[110374] High CVE-2011-3971: Use-after-free with mousemove events.
Credit to Arthur Gerkis.</p>
<p>[110559] Medium CVE-2011-3972: Out-of-bounds read in shader
translator. Credit to Google Chrome Security Team (Inferno).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3953</cvename>
<cvename>CVE-2011-3954</cvename>
<cvename>CVE-2011-3955</cvename>
<cvename>CVE-2011-3956</cvename>
<cvename>CVE-2011-3957</cvename>
<cvename>CVE-2011-3958</cvename>
<cvename>CVE-2011-3959</cvename>
<cvename>CVE-2011-3960</cvename>
<cvename>CVE-2011-3961</cvename>
<cvename>CVE-2011-3962</cvename>
<cvename>CVE-2011-3963</cvename>
<cvename>CVE-2011-3964</cvename>
<cvename>CVE-2011-3965</cvename>
<cvename>CVE-2011-3966</cvename>
<cvename>CVE-2011-3967</cvename>
<cvename>CVE-2011-3968</cvename>
<cvename>CVE-2011-3969</cvename>
<cvename>CVE-2011-3970</cvename>
<cvename>CVE-2011-3971</cvename>
<cvename>CVE-2011-3972</cvename>
<url>http://googlechromereleases.blogspot.com/search/label/Stable%20updates</url>
</references>
<dates>
<discovery>2012-02-08</discovery>
<entry>2012-02-09</entry>
</dates>
</vuln>
<vuln vid="10720fe8-51e0-11e1-91c1-00215c6a37bb">
<topic>drupal -- multiple vulnerabilities</topic>
<affects>
<package>
<name>drupal6</name>
<range><lt>6.23</lt></range>
</package>
<package>
<name>drupal7</name>
<range><lt>7.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal development team reports:</p>
<blockquote cite="http://drupal.org/node/1425084">
<h3>Cross Site Request Forgery vulnerability in Aggregator
module</h3>
<p>CVE: CVE-2012-0826</p>
<p>An XSRF vulnerability can force an aggregator feed to update.
Since some services are rate-limited (e.g. Twitter limits
requests to 150 per hour) this could lead to a denial of
service.</p>
<p>This issue affects Drupal 6.x and 7.x.</p>
<h3>OpenID not verifying signed attributes in SREG and AX</h3>
<p>CVE: CVE-2012-0825</p>
<p>A group of security researchers identified a flaw in how some
OpenID relying parties implement Attribute Exchange (AX). Not
verifying that attributes being passed through AX have been
signed could allow an attacker to modify users' information.</p>
<p>This issue affects Drupal 6.x and 7.x.</p>
<h3>Access bypass in File module</h3>
<p>CVE: CVE-2012-0827</p>
<p>When using private files in combination with certain field
access modules, the File module will allow users to download
the file even if they do not have access to view the field it
was attached to.</p>
<p>This issue affects Drupal 7.x only.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0825</cvename>
<cvename>CVE-2012-0826</cvename>
<cvename>CVE-2012-0827</cvename>
</references>
<dates>
<discovery>2012-02-01</discovery>
<entry>2012-02-07</entry>
</dates>
</vuln>
<vuln vid="309542b5-50b9-11e1-b0d8-00151735203a">
<topic>bugzilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>bugzilla</name>
<range><ge>2.4.*</ge><lt>3.6.8</lt></range>
<range><ge>4.0.*</ge><lt>4.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Bugzilla Security Advisory reports:</p>
<blockquote cite="http://www.bugzilla.org/security/3.4.12/">
<p>The following security issues have been discovered in
Bugzilla:</p>
<ul>
<li>Account Impersonation:
When a user creates a new account, Bugzilla doesn't correctly
reject email addresses containing non-ASCII characters, which
could be used to impersonate another user account. Such email
addresses could look visually identical to other valid email
addresses, and an attacker could try to confuse other users
and be added to bugs he shouldn't have access to.</li>
<li>Cross-Site Request Forgery:
Due to a lack of validation of the Content-Type head when
making POST requests to jsonrpc.cgi, a possible CSRF
vulnerability was discovered. If a user visits an HTML page
with some malicious JS code in it, an attacker could make
changes to a remote Bugzilla installation on behalf of the
victim's account by using the JSON-RPC API. The user would
have had to be already logged in to the target site for the
vulnerability to work.</li>
</ul>
<p>All affected installations are encouraged to upgrade as soon as
possible.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0448</cvename>
<cvename>CVE-2012-0440</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=714472</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=718319</url>
</references>
<dates>
<discovery>2012-01-31</discovery>
<entry>2012-02-06</entry>
</dates>
</vuln>
<vuln vid="3fd040be-4f0b-11e1-9e32-0025900931f8">
<topic>php -- arbitrary remote code execution vulnerability</topic>
<affects>
<package>
<name>php5</name>
<range><ge>5.3.9</ge><lt>5.3.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/47806/">
<p>A vulnerability has been reported in PHP, which can be exploited
by malicious people to compromise a vulnerable system.</p>
<p>The vulnerability is caused due to a logic error within the
"php_register_variable_ex()" function (php_variables.c) when
hashing form posts and updating a hash table, which can be
exploited to execute arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0830</cvename>
<url>http://www.php.net/archive/2012.php#id2012-02-02-1</url>
<url>http://secunia.com/advisories/47806/</url>
</references>
<dates>
<discovery>2012-02-02</discovery>
<entry>2012-02-04</entry>
<modified>2012-02-06</modified>
</dates>
</vuln>
<vuln vid="6e7ad1d7-4e27-11e1-8e12-90e6ba8a36a2">
<topic>mathopd -- directory traversal vulnerability</topic>
<affects>
<package>
<name>mathopd</name>
<range><lt>1.5p7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Michiel Boland reports:</p>
<blockquote cite="http://www.mathopd.org/security.html">
<p>The software has a vulnerability that could lead to directory
traversal if the '*' construct for mass virtual hosting is
used.</p>
</blockquote>
</body>
</description>
<references>
<mlist msgid="4F2AFEF2.5040708@boland.org">http://www.mail-archive.com/mathopd%40mathopd.org/msg00392.html</mlist>
<url>http://www.mathopd.org/security.html</url>
</references>
<dates>
<discovery>2012-02-02</discovery>
<entry>2012-02-03</entry>
</dates>
</vuln>
<vuln vid="4b7dbfab-4c6b-11e1-bc16-0023ae8e59f0">
<topic>apache -- multiple vulnerabilities</topic>
<affects>
<package>
<name>apache</name>
<range><gt>2.*</gt><lt>2.2.22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CVE MITRE reports:</p>
<blockquote cite="http://httpd.apache.org/security/vulnerabilities_22.html">
<p>An exposure was found when using mod_proxy in reverse proxy
mode. In certain configurations using RewriteRule with proxy
flag or ProxyPassMatch, a remote attacker could cause the reverse
proxy to connect to an arbitrary server, possibly disclosing
sensitive information from internal web servers not directly
accessible to attacker.</p>
<p>Integer overflow in the ap_pregsub function in server/util.c in
the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through
2.2.21, when the mod_setenvif module is enabled, allows local
users to gain privileges via a .htaccess file with a crafted
SetEnvIf directive, in conjunction with a crafted HTTP request
header, leading to a heap-based buffer overflow.</p>
<p>An additional exposure was found when using mod_proxy in
reverse proxy mode. In certain configurations using RewriteRule
with proxy flag or ProxyPassMatch, a remote attacker could cause
the reverse proxy to connect to an arbitrary server, possibly
disclosing sensitive information from internal web servers
not directly accessible to attacker.</p>
<p>A flaw was found in mod_log_config. If the '%{cookiename}C' log
format string is in use, a remote attacker could send a specific
cookie causing a crash. This crash would only be a denial of
service if using a threaded MPM.</p>
<p>A flaw was found in the handling of the scoreboard. An
unprivileged child process could cause the parent process to
crash at shutdown rather than terminate cleanly.</p>
<p>A flaw was found in the default error response for status code
400. This flaw could be used by an attacker to expose
"httpOnly" cookies when no custom ErrorDocument is specified.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3368</cvename>
<cvename>CVE-2011-3607</cvename>
<cvename>CVE-2011-4317</cvename>
<cvename>CVE-2012-0021</cvename>
<cvename>CVE-2012-0031</cvename>
<cvename>CVE-2012-0053</cvename>
</references>
<dates>
<discovery>2011-10-05</discovery>
<entry>2012-01-31</entry>
</dates>
</vuln>
<vuln vid="0a9e2b72-4cb7-11e1-9146-14dae9ebcf89">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>4.0,1</gt><lt>10.0,1</lt></range>
<range><ge>3.6.*,1</ge><lt>3.6.26</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>10.0,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.7</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>10.0</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.7</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><gt>4.0</gt><lt>10.0</lt></range>
<range><gt>3.1.*</gt><lt>3.1.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2012-01 Miscellaneous memory safety hazards (rv:10.0/
rv:1.9.2.26)</p>
<p>MFSA 2012-02 Overly permissive IPv6 literal syntax</p>
<p>MFSA 2012-03 iframe element exposed across domains via name
attribute</p>
<p>MFSA 2012-04 Child nodes from nsDOMAttribute still accessible
after removal of nodes</p>
<p>MFSA 2012-05 Frame scripts calling into untrusted objects bypass
security checks</p>
<p>MFSA 2012-06 Uninitialized memory appended when encoding icon
images may cause information disclosure</p>
<p>MFSA 2012-07 Potential Memory Corruption When Decoding Ogg Vorbis
files</p>
<p>MFSA 2012-08 Crash with malformed embedded XSLT stylesheets</p>
<p>MFSA 2012-09 Firefox Recovery Key.html is saved with unsafe
permission</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0442</cvename>
<cvename>CVE-2012-0443</cvename>
<cvename>CVE-2011-3670</cvename>
<cvename>CVE-2012-0445</cvename>
<cvename>CVE-2011-3659</cvename>
<cvename>CVE-2012-0446</cvename>
<cvename>CVE-2012-0447</cvename>
<cvename>CVE-2012-0449</cvename>
<cvename>CVE-2012-0450</cvename>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-01.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-02.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-03.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-04.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-05.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-06.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-07.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-08.html</url>
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-09.html</url>
</references>
<dates>
<discovery>2012-01-31</discovery>
<entry>2012-02-01</entry>
<modified>2012-03-18</modified>
</dates>
</vuln>
<vuln vid="7c920bb7-4b5f-11e1-9f47-00e0815b8da8">
<topic>sudo -- format string vulnerability</topic>
<affects>
<package>
<name>sudo</name>
<range><ge>1.8.0</ge><lt>1.8.3_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Todd Miller reports:</p>
<blockquote cite="http://www.gratisoft.us/sudo/alerts/sudo_debug.html">
<p>Sudo 1.8.0 introduced simple debugging support that was primarily
intended for use when developing policy or I/O logging plugins.
The sudo_debug() function contains a flaw where the program name
is used as part of the format string passed to the fprintf()
function. The program name can be controlled by the caller,
either via a symbolic link or, on some systems, by setting argv[0]
when executing sudo.</p>
<p>Using standard format string vulnerability exploitation
techniques it is possible to leverage this bug to achieve root
privileges.</p>
<p>Exploitation of the bug does not require that the attacker be
listed in the sudoers file. As such, we strongly suggest that
affected sites upgrade from affected sudo versions as soon as
possible.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0809</cvename>
<url>http://www.gratisoft.us/sudo/alerts/sudo_debug.html</url>
</references>
<dates>
<discovery>2012-01-30</discovery>
<entry>2012-01-30</entry>
<modified>2012-01-31</modified>
</dates>
</vuln>
<vuln vid="e51d5b1a-4638-11e1-9f47-00e0815b8da8">
<topic>FreeBSD -- pam_ssh() does not validate service names</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>7.3</ge><lt>7.3_9</lt></range>
<range><ge>7.4</ge><lt>7.4_5</lt></range>
<range><ge>8.1</ge><lt>8.1_7</lt></range>
<range><ge>8.2</ge><lt>8.2_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="http://security.freebsd.org/advisories/FreeBSD-SA-11:10.pam.asc">
<h1>Problem Description:</h1>
<p>Some third-party applications, including KDE's kcheckpass command,
allow the user to specify the name of the policy on the command
line. Since OpenPAM treats the policy name as a path relative to
/etc/pam.d or /usr/local/etc/pam.d, users who are permitted to run
such an application can craft their own policies and cause the
application to load and execute their own modules.</p>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-11:10.pam</freebsdsa>
<cvename>CVE-2011-4122</cvename>
</references>
<dates>
<discovery>2011-12-23</discovery>
<entry>2012-01-29</entry>
</dates>
</vuln>
<vuln vid="eda151d8-4638-11e1-9f47-00e0815b8da8">
<topic>FreeBSD -- pam_ssh improperly grants access when user account has unencrypted SSH private keys</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>7.3</ge><lt>7.3_9</lt></range>
<range><ge>7.4</ge><lt>7.4_5</lt></range>
<range><ge>8.1</ge><lt>8.1_7</lt></range>
<range><ge>8.2</ge><lt>8.2_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="http://security.freebsd.org/advisories/FreeBSD-SA-11:09.pam_ssh.asc">
<h1>Problem Description:</h1>
<p>The OpenSSL library call used to decrypt private keys ignores the
passphrase argument if the key is not encrypted. Because the
pam_ssh module only checks whether the passphrase provided by the
user is null, users with unencrypted SSH private keys may
successfully authenticate themselves by providing a dummy
passphrase.</p>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-11:09.pam_ssh</freebsdsa>
</references>
<dates>
<discovery>2011-12-23</discovery>
<entry>2012-01-29</entry>
<modified>2013-06-18</modified>
</dates>
</vuln>
<vuln vid="f56390a4-4638-11e1-9f47-00e0815b8da8">
<topic>FreeBSD -- Buffer overflow in handling of UNIX socket addresses</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>7.3</ge><lt>7.3_8</lt></range>
<range><ge>7.4</ge><lt>7.4_4</lt></range>
<range><ge>8.1</ge><lt>8.1_6</lt></range>
<range><ge>8.2</ge><lt>8.2_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="http://security.freebsd.org/advisories/FreeBSD-SA-11:05.unix.asc">
<h1>Problem Description:</h1>
<p>When a UNIX-domain socket is attached to a location using the
bind(2) system call, the length of the provided path is not
validated. Later, when this address was returned via other system
calls, it is copied into a fixed-length buffer.</p>
<p>Linux uses a larger socket address structure for UNIX-domain
sockets than FreeBSD, and the FreeBSD's linux emulation code did
not translate UNIX-domain socket addresses into the correct size
of structure.</p>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-11:05.unix</freebsdsa>
</references>
<dates>
<discovery>2011-09-28</discovery>
<entry>2012-01-29</entry>
</dates>
</vuln>
<vuln vid="fee94342-4638-11e1-9f47-00e0815b8da8">
<topic>FreeBSD -- errors handling corrupt compress file in compress(1) and gzip(1)</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>7.3</ge><lt>7.3_7</lt></range>
<range><ge>7.4</ge><lt>7.4_3</lt></range>
<range><ge>8.1</ge><lt>8.1_5</lt></range>
<range><ge>8.2</ge><lt>8.2_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="http://security.freebsd.org/advisories/FreeBSD-SA-11:04.compress.asc">
<h1>Problem Description:</h1>
<p>The code used to decompress a file created by compress(1) does not
do sufficient boundary checks on compressed code words, allowing
reference beyond the decompression table, which may result in a
stack overflow or an infinite loop when the decompressor encounters
a corrupted file.</p>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-11:04.compress</freebsdsa>
<cvename>CVE-2011-2895</cvename>
</references>
<dates>
<discovery>2011-09-28</discovery>
<entry>2012-01-29</entry>
</dates>
</vuln>
<vuln vid="87261557-a450-11e2-9898-001060e06fd4">
<topic>FreeBSD -- Network ACL mishandling in mountd(8)</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>7.3</ge><lt>7.3_5</lt></range>
<range><ge>7.4</ge><lt>7.4_1</lt></range>
<range><ge>8.1</ge><lt>8.1_3</lt></range>
<range><ge>8.2</ge><lt>8.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="http://security.freebsd.org/advisories/FreeBSD-SA-11:01.mountd.asc">
<h1>Problem Description:</h1>
<p>While parsing the exports(5) table, a network mask in the form of
"-network=netname/prefixlength" results in an incorrect network mask
being computed if the prefix length is not a multiple of 8.</p>
<p>For example, specifying the ACL for an export as "-network
192.0.2.0/23" would result in a netmask of 255.255.127.0 being used
instead of the correct netmask of 255.255.254.0.</p>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-11:01.mountd</freebsdsa>
<cvename>CVE-2011-1739</cvename>
</references>
<dates>
<discovery>2011-04-20</discovery>
<entry>2012-01-29</entry>
</dates>
</vuln>
<vuln vid="93688f8f-4935-11e1-89b4-001ec9578670">
<topic>postfixadmin -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>postfixadmin</name>
<range><lt>2.3.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Postfix Admin Team reports:</p>
<blockquote cite="http://sourceforge.net/projects/postfixadmin/forums/forum/676076/topic/4977778">
<p>Multiple XSS vulnerabilities exist:<br/>
- XSS with $_GET[domain] in templates/menu.php and
edit-vacation<br/>
- XSS in some create-domain input fields<br/>
- XSS in create-alias and edit-alias error message<br/>
- XSS (by values stored in the database) in fetchmail list
view, list-domain and list-virtual</p>
<p>Multiple SQL injection issues exist:<br/>
- SQL injection in pacrypt() (if $CONF[encrypt] ==
'mysql_encrypt')<br/>
- SQL injection in backup.php - the dump was not mysql_escape()d,
therefore users could inject SQL (for example in the vacation message)
which will be executed when restoring the database dump.
WARNING: database dumps created with backup.php from 2.3.4 or older
might contain malicious SQL. Double-check before using them!</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0811</cvename>
<cvename>CVE-2012-0812</cvename>
<url>http://sourceforge.net/projects/postfixadmin/forums/forum/676076/topic/4977778</url>
</references>
<dates>
<discovery>2012-01-27</discovery>
<entry>2012-01-27</entry>
</dates>
</vuln>
<vuln vid="e465159c-4817-11e1-89b4-001ec9578670">
<topic>mpack -- Information disclosure</topic>
<affects>
<package>
<name>mpack</name>
<range><lt>1.6_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The oss-security list reports:</p>
<blockquote cite="http://openwall.com/lists/oss-security/2011/12/31/1">
<p>Incorrect permissions on temporary files can lead to
information disclosure.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-4919</cvename>
<url>http://openwall.com/lists/oss-security/2011/12/31/1</url>
</references>
<dates>
<discovery>2011-12-31</discovery>
<entry>2012-01-26</entry>
</dates>
</vuln>
<vuln vid="fa2f386f-4814-11e1-89b4-001ec9578670">
<topic>acroread9 -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>acroread9</name>
<range><lt>9.4.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Adobe Security Team reports:</p>
<blockquote cite="http://www.adobe.com/support/security/advisories/apsa11-04.html">
<p>An unspecified vulnerability in the U3D component allows
remote attackers to execute arbitrary code (or cause a denial
of service attack) via unknown vectors.</p>
</blockquote>
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb11-24.html">
<p>A heap-based buffer overflow allows attackers to execute
arbitrary code via unspecified vectors.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-2462</cvename>
<cvename>CVE-2011-1353</cvename>
<cvename>CVE-2011-2431</cvename>
<cvename>CVE-2011-2432</cvename>
<cvename>CVE-2011-2433</cvename>
<cvename>CVE-2011-2434</cvename>
<cvename>CVE-2011-2435</cvename>
<cvename>CVE-2011-2436</cvename>
<cvename>CVE-2011-2437</cvename>
<cvename>CVE-2011-2438</cvename>
<cvename>CVE-2011-2439</cvename>
<cvename>CVE-2011-2440</cvename>
<cvename>CVE-2011-2441</cvename>
<cvename>CVE-2011-2442</cvename>
<url>http://www.adobe.com/support/security/bulletins/apsb11-24.html</url>
<url>http://www.adobe.com/support/security/advisories/apsa11-04.html</url>
</references>
<dates>
<discovery>2011-12-07</discovery>
<entry>2012-01-26</entry>
</dates>
</vuln>
<vuln vid="33d73d59-4677-11e1-88cd-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>16.0.912.77</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.com/search/label/Stable%20updates">
<p>[106484] High CVE-2011-3924: Use-after-free in DOM selections.
Credit to Arthur Gerkis.</p>
<p>[108461] High CVE-2011-3928: Use-after-free in DOM handling.
Credit to wushi of team509 reported through ZDI (ZDI-CAN-1415).</p>
<p>[108605] High CVE-2011-3927: Uninitialized value in Skia. Credit
to miaubiz.</p>
<p>[109556] High CVE-2011-3926: Heap-buffer-overflow in tree builder.
Credit to Arthur Gerkis.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3924</cvename>
<cvename>CVE-2011-3926</cvename>
<cvename>CVE-2011-3927</cvename>
<cvename>CVE-2011-3928</cvename>
<url>http://googlechromereleases.blogspot.com/search/label/Stable%20updates</url>
</references>
<dates>
<discovery>2012-01-23</discovery>
<entry>2012-01-24</entry>
</dates>
</vuln>
<vuln vid="3ebb2dc8-4609-11e1-9f47-00e0815b8da8">
<topic>Wireshark -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>wireshark</name>
<range><ge>1.4</ge><lt>1.4.11</lt></range>
<range><ge>1.6.0</ge><lt>1.6.5</lt></range>
</package>
<package>
<name>wireshark-lite</name>
<range><ge>1.4</ge><lt>1.4.11</lt></range>
<range><ge>1.6.0</ge><lt>1.6.5</lt></range>
</package>
<package>
<name>tshark</name>
<range><ge>1.4</ge><lt>1.4.11</lt></range>
<range><ge>1.6.0</ge><lt>1.6.5</lt></range>
</package>
<package>
<name>tshark-lite</name>
<range><ge>1.4</ge><lt>1.4.11</lt></range>
<range><ge>1.6.0</ge><lt>1.6.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Wireshark reports:</p>
<blockquote cite="http://www.wireshark.org/docs/relnotes/wireshark-1.6.5.html">
<p>Laurent Butti discovered that Wireshark failed to properly check
record sizes for many packet capture file formats</p>
<p>Wireshark could dereference a NULL pointer and crash.</p>
<p>The RLC dissector could overflow a buffer.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0041</cvename>
<cvename>CVE-2012-0066</cvename>
<cvename>CVE-2012-0067</cvename>
<cvename>CVE-2012-0068</cvename>
<url>http://www.wireshark.org/security/wnpa-sec-2012-01.html</url>
<url>http://www.wireshark.org/security/wnpa-sec-2012-02.html</url>
<url>http://www.wireshark.org/security/wnpa-sec-2012-03.html</url>
<url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6663</url>
<url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6666</url>
<url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6667</url>
<url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6668</url>
<url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6669</url>
<url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6670</url>
<url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6634</url>
<url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6391</url>
</references>
<dates>
<discovery>2010-01-10</discovery>
<entry>2012-01-23</entry>
</dates>
</vuln>
<vuln vid="7d2336c2-4607-11e1-9f47-00e0815b8da8">
<topic>spamdyke -- Buffer Overflow Vulnerabilities</topic>
<affects>
<package>
<name>spamdyke</name>
<range><lt>4.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://www.spamdyke.org/documentation/Changelog.txt">
<p>Fixed a number of very serious errors in the usage of
snprintf()/vsnprintf().</p>
<p>The return value was being used as the length of the string
printed into the buffer, but the return value really indicates
the length of the string that *could* be printed if the buffer
were of infinite size. Because the returned value could be
larger than the buffer's size, this meant remotely exploitable
buffer overflows were possible, depending on spamdyke's
configuration.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0802</cvename>
<url>https://secunia.com/advisories/47548/</url>
<url>http://www.spamdyke.org/documentation/Changelog.txt</url>
</references>
<dates>
<discovery>2012-01-15</discovery>
<entry>2012-01-23</entry>
</dates>
</vuln>
<vuln vid="5c5f19ce-43af-11e1-89b4-001ec9578670">
<topic>OpenSSL -- DTLS Denial of Service</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.0_9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL Team reports:</p>
<blockquote cite="http://www.openssl.org/news/secadv_20120118.txt">
<p>A flaw in the fix to CVE-2011-4108 can be exploited in a
denial of service attack. Only DTLS applications using OpenSSL
1.0.0f and 0.9.8s are affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0050</cvename>
<url>http://www.openssl.org/news/secadv_20120118.txt</url>
</references>
<dates>
<discovery>2012-01-18</discovery>
<entry>2012-01-20</entry>
</dates>
</vuln>
<vuln vid="dd698b76-42f7-11e1-a1b6-14dae9ebcf89">
<topic>asterisk -- SRTP Video Remote Crash Vulnerability</topic>
<affects>
<package>
<name>asterisk18</name>
<range><lt>1.8.8.2</lt></range>
</package>
<package>
<name>asterisk10</name>
<range><lt>10.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Asterisk project reports:</p>
<blockquote cite="http://downloads.asterisk.org/pub/security/AST-2012-001.html">
<p>An attacker attempting to negotiate a secure video stream can
crash Asterisk if video support has not been enabled and the
res_srtp Asterisk module is loaded.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2012-001.html</url>
</references>
<dates>
<discovery>2012-01-15</discovery>
<entry>2012-01-20</entry>
<modified>2013-06-19</modified>
</dates>
</vuln>
<vuln vid="7f5ccb1d-439b-11e1-bc16-0023ae8e59f0">
<topic>tomcat -- Denial of Service</topic>
<affects>
<package>
<name>tomcat</name>
<range><gt>5.5.0</gt><lt>5.5.35</lt></range>
</package>
<package>
<name>tomcat</name>
<range><gt>6.0.0</gt><lt>6.0.34</lt></range>
</package>
<package>
<name>tomcat</name>
<range><gt>7.0.0</gt><lt>7.0.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Tomcat security team reports:</p>
<blockquote cite="http://tomcat.apache.org/security-5.html#Fixed_in_Apache_Tomcat_5.5.35">
<p>Analysis of the recent hash collision vulnerability identified
unrelated inefficiencies with Apache Tomcat's handling of large
numbers of parameters and parameter values. These inefficiencies
could allow an attacker, via a specially crafted request, to
cause large amounts of CPU to be used which in turn could create
a denial of service. The issue was addressed by modifying the
Tomcat parameter handling code to efficiently process large
numbers of parameters and parameter values.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0022</cvename>
<url>http://tomcat.apache.org/security-5.html#Fixed_in_Apache_Tomcat_5.5.35</url>
<url>http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.34</url>
<url>http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.23</url>
</references>
<dates>
<discovery>2011-10-21</discovery>
<entry>2012-01-17</entry>
</dates>
</vuln>
<vuln vid="1ac858b0-3fae-11e1-a127-0013d3ccd9df">
<topic>OpenTTD -- Denial of service (server) via slow read attack</topic>
<affects>
<package>
<name>openttd</name>
<range><ge>0.3.5</ge><lt>1.1.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenTTD Team reports:</p>
<blockquote cite="http://security.openttd.org/en/CVE-2012-0049">
<p>Using a slow read type attack it is possible to prevent anyone
from joining a server with virtually no resources. Once
downloading the map no other downloads of the map can start, so
downloading really slowly will prevent others from joining.
This can be further aggravated by the pause-on-join setting in
which case the game is paused and the players cannot continue
the game during such an attack. This attack requires that the
user is not banned and passes the authorization to the server,
although for many servers there is no server password and thus
authorization is easy.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0049</cvename>
<url>http://security.openttd.org/en/CVE-2012-0049</url>
</references>
<dates>
<discovery>2012-01-06</discovery>
<entry>2012-01-16</entry>
</dates>
</vuln>
<vuln vid="91be81e7-3fea-11e1-afc7-2c4138874f7d">
<topic>Multiple implementations -- DoS via hash algorithm collision</topic>
<affects>
<package>
<name>jruby</name>
<range><lt>1.6.5.1</lt></range>
</package>
<package>
<name>ruby</name>
<name>ruby+nopthreads</name>
<name>ruby+nopthreads+oniguruma</name>
<name>ruby+oniguruma</name>
<range><lt>1.8.7.357,1</lt></range>
</package>
<package>
<name>rubygem-rack</name>
<range><lt>1.3.6,3</lt></range>
</package>
<package>
<name>v8</name>
<range><lt>3.8.5</lt></range>
</package>
<package>
<name>redis</name>
<range><le>2.4.6</le></range>
</package>
<package>
<name>node</name>
<range><lt>0.6.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>oCERT reports:</p>
<blockquote cite="http://www.ocert.org/advisories/ocert-2011-003.html">
<p>A variety of programming languages suffer from a denial-of-service
(DoS) condition against storage functions of key/value pairs in
hash data structures, the condition can be leveraged by exploiting
predictable collisions in the underlying hashing algorithms.</p>
<p>The issue finds particular exposure in web server applications
and/or frameworks. In particular, the lack of sufficient limits
for the number of parameters in POST requests in conjunction with
the predictable collision properties in the hashing functions of
the underlying languages can render web applications vulnerable
to the DoS condition. The attacker, using specially crafted HTTP
requests, can lead to a 100% of CPU usage which can last up to
several hours depending on the targeted application and server
performance, the amplification effect is considerable and
requires little bandwidth and time on the attacker side.</p>
<p>The condition for predictable collisions in the hashing functions
has been reported for the following language implementations:
Java, JRuby, PHP, Python, Rubinius, Ruby. In the case of the
Ruby language, the 1.9.x branch is not affected by the
predictable collision condition since this version includes a
randomization of the hashing function.</p>
<p>The vulnerability outlined in this advisory is practically
identical to the one reported in 2003 and described in the paper
Denial of Service via Algorithmic Complexity Attacks which
affected the Perl language.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-4838</cvename>
<cvename>CVE-2011-4815</cvename>
<cvename>CVE-2011-5036</cvename>
<cvename>CVE-2011-5037</cvename>
<url>http://www.ocert.org/advisories/ocert-2011-003.html</url>
<url>http://www.nruns.com/_downloads/advisory28122011.pdf</url>
</references>
<dates>
<discovery>2011-12-28</discovery>
<entry>2012-01-16</entry>
<modified>2012-01-20</modified>
</dates>
</vuln>
<vuln vid="ea2ddc49-3e8e-11e1-8095-5404a67eef98">
<topic>ffmpeg -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ffmpeg</name>
<range><lt>0.7.11,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ubuntu Security Notice USN-1320-1 reports:</p>
<blockquote cite="http://www.ubuntu.com/usn/usn-1320-1">
<p>Phillip Langlois discovered that FFmpeg incorrectly handled
certain malformed QDM2 streams. If a user were tricked into opening
a crafted QDM2 stream file, an attacker could cause a denial of
service via application crash, or possibly execute arbitrary code
with the privileges of the user invoking the program.
(CVE-2011-4351)</p>
<p>Phillip Langlois discovered that FFmpeg incorrectly handled
certain malformed VP3 streams. If a user were tricked into opening
a crafted file, an attacker could cause a denial of service via
application crash, or possibly execute arbitrary code with the
privileges of the user invoking the program. (CVE-2011-4352)</p>
<p>Phillip Langlois discovered that FFmpeg incorrectly handled
certain malformed VP5 and VP6 streams. If a user were tricked into
opening a crafted file, an attacker could cause a denial of service
via application crash, or possibly execute arbitrary code with the
privileges of the user invoking the program. (CVE-2011-4353)</p>
<p>It was discovered that FFmpeg incorrectly handled certain
malformed VMD files. If a user were tricked into opening a crafted
VMD file, an attacker could cause a denial of service via
application crash, or possibly execute arbitrary code with the
privileges of the user invoking the program. (CVE-2011-4364)</p>
<p>Phillip Langlois discovered that FFmpeg incorrectly handled
certain malformed SVQ1 streams. If a user were tricked into opening
a crafted SVQ1 stream file, an attacker could cause a denial of
service via application crash, or possibly execute arbitrary code
with the privileges of the user invoking the program.
(CVE-2011-4579)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-4351</cvename>
<cvename>CVE-2011-4352</cvename>
<cvename>CVE-2011-4353</cvename>
<cvename>CVE-2011-4364</cvename>
<cvename>CVE-2011-4579</cvename>
<url>http://www.ubuntu.com/usn/usn-1320-1</url>
</references>
<dates>
<discovery>2011-09-14</discovery>
<entry>2012-01-14</entry>
</dates>
</vuln>
<vuln vid="78cc8a46-3e56-11e1-89b4-001ec9578670">
<topic>OpenSSL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.0_8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL Team reports:</p>
<blockquote cite="http://openssl.org/news/secadv_20120104.txt">
<p>6 security flaws have been fixed in OpenSSL 1.0.0f:</p>
<p>If X509_V_FLAG_POLICY_CHECK is set in OpenSSL 0.9.8,
then a policy check failure can lead to a double-free.</p>
<p>OpenSSL prior to 1.0.0f and 0.9.8s failed to clear the
bytes used as block cipher padding in SSL 3.0 records.
As a result, in each record, up to 15 bytes of
uninitialized memory may be sent, encrypted, to the SSL
peer. This could include sensitive contents of
previously freed memory.</p>
<p>RFC 3779 data can be included in certificates, and if
it is malformed, may trigger an assertion failure.
This could be used in a denial-of-service attack.</p>
<p>Support for handshake restarts for server gated
cryptograpy (SGC) can be used in a denial-of-service
attack.</p>
<p>A malicious TLS client can send an invalid set of GOST
parameters which will cause the server to crash due to
lack of error checking. This could be used in a
denial-of-service attack.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-4108</cvename>
<cvename>CVE-2011-4109</cvename>
<cvename>CVE-2011-4576</cvename>
<cvename>CVE-2011-4577</cvename>
<cvename>CVE-2011-4619</cvename>
<cvename>CVE-2012-0027</cvename>
<url>http://openssl.org/news/secadv_20120104.txt</url>
</references>
<dates>
<discovery>2012-01-04</discovery>
<entry>2012-01-14</entry>
</dates>
</vuln>
<vuln vid="1800886c-3dde-11e1-89b4-001ec9578670">
<topic>isc-dhcp-server -- DoS in DHCPv6</topic>
<affects>
<package>
<name>isc-dhcp42-server</name>
<range><lt>4.2.3_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://www.isc.org/software/dhcp/advisories/cve-2011-4868">
<p>Due to improper handling of a DHCPv6 lease structure, ISC DHCP
servers that are serving IPv6 address pools AND using Dynamic
DNS can encounter a segmentation fault error while updating lease
status under certain conditions.</p>
<p>The potential exists for this condition to be intentionally
triggered, resulting in effective denial of service to
clients expecting service from the affected server.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-4868</cvename>
<url>https://www.isc.org/software/dhcp/advisories/cve-2011-4868</url>
</references>
<dates>
<discovery>2012-01-13</discovery>
<entry>2012-01-13</entry>
</dates>
</vuln>
<vuln vid="3338f87c-3d5f-11e1-a00a-000c6eb41cf7">
<topic>PowerDNS -- Denial of Service Vulnerability</topic>
<affects>
<package>
<name>powerdns</name>
<name>powerdns-devel</name>
<range><lt>3.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PowerDNS Team reports:</p>
<blockquote cite="http://www.powerdns.com/news/powerdns-security-advisory-2012-01.html">
<p>Using well crafted UDP packets, one or more PowerDNS servers
could be made to enter a tight packet loop, causing temporary
denial of service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0206</cvename>
</references>
<dates>
<discovery>2012-01-10</discovery>
<entry>2012-01-12</entry>
</dates>
</vuln>
<vuln vid="d3921810-3c80-11e1-97e8-00215c6a37bb">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php5</name>
<name>php5-exif</name>
<range><lt>5.3.9</lt></range>
</package>
<package>
<name>php52</name>
<range><lt>5.2.17_5</lt></range>
</package>
<package>
<name>php52-exif</name>
<range><lt>5.2.17_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>php development team reports:</p>
<blockquote cite="http://www.php.net/archive/2012.php#id2012-01-11-1">
<p>Security Enhancements and Fixes in PHP 5.3.9:</p>
<ul>
<li>Added max_input_vars directive to prevent attacks
based on hash collisions. (CVE-2011-4885)</li>
<li>Fixed bug #60150 (Integer overflow during the parsing
of invalid exif header). (CVE-2011-4566)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-4566</cvename>
<cvename>CVE-2011-4885</cvename>
<url>http://www.nruns.com/_downloads/advisory28122011.pdf</url>
</references>
<dates>
<discovery>2011-12-29</discovery>
<entry>2012-01-11</entry>
<modified>2012-01-19</modified>
</dates>
</vuln>
<vuln vid="e7fd27b2-3ae9-11e1-8b5c-00262d5ed8ee">
<topic>torcs -- untrusted local library loading</topic>
<affects>
<package>
<name>torcs</name>
<range><lt>1.3.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>TORCS News reports:</p>
<blockquote cite="http://torcs.sourceforge.net/index.php?name=News&amp;file=article&amp;sid=77">
<p>An insecure change to LD_LIBRARY_PATH allows loading of libraries
in directories other than the standard paths. This can be a
problem when downloading and installing untrusted content from the
Internet.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-3384</cvename>
<url>http://torcs.sourceforge.net/index.php?name=News&amp;file=article&amp;sid=77</url>
<url>http://sourceforge.net/tracker/index.php?func=detail&amp;aid=3089384&amp;group_id=3777&amp;atid=103777</url>
</references>
<dates>
<discovery>2010-10-20</discovery>
<entry>2012-01-09</entry>
</dates>
</vuln>
<vuln vid="a47af810-3a17-11e1-a1be-00e0815b8da8">
<topic>spamdyke -- STARTTLS Plaintext Injection Vulnerability</topic>
<affects>
<package>
<name>spamdyke</name>
<range><lt>4.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/47435/">
<p>The vulnerability is caused due to the TLS implementation not
properly clearing transport layer buffers when upgrading from
plaintext to ciphertext after receiving the "STARTTLS" command.
This can be exploited to insert arbitrary plaintext data (e.g.
SMTP commands) during the plaintext phase, which will then be
executed after upgrading to the TLS ciphertext phase.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0070</cvename>
<url>http://secunia.com/advisories/47435/</url>
<url>http://www.spamdyke.org/documentation/Changelog.txt</url>
</references>
<dates>
<discovery>2012-01-04</discovery>
<entry>2012-01-08</entry>
<modified>2012-01-23</modified>
</dates>
</vuln>
<vuln vid="1a1aef8e-3894-11e1-8b5c-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>16.0.912.75</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.com/search/label/Stable%20updates">
<p>[106672] High CVE-2011-3921: Use-after-free in animation frames.
Credit to Boris Zbarsky of Mozilla.<br/>
[107128] High CVE-2011-3919: Heap-buffer-overflow in libxml.
Credit to Juri Aedla.<br/>
[108006] High CVE-2011-3922: Stack-buffer-overflow in glyph
handling. Credit to Google Chrome Security Team (Cris
Neckar).</p>
<p>[107182] Critical CVE-2011-3925: Use-after-free in Safe Browsing
navigation. Credit to Chamal de Silva.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3919</cvename>
<cvename>CVE-2011-3921</cvename>
<cvename>CVE-2011-3922</cvename>
<cvename>CVE-2011-3925</cvename>
</references>
<dates>
<discovery>2012-01-05</discovery>
<entry>2012-01-06</entry>
<modified>2012-01-23</modified>
</dates>
</vuln>
<vuln vid="0c7a3ee2-3654-11e1-b404-20cf30e32f6d">
<topic>bugzilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>bugzilla</name>
<range><ge>2.4.*</ge><lt>3.6.7</lt></range>
<range><ge>4.0.*</ge><lt>4.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Bugzilla Security Advisory reports:</p>
<blockquote cite="http://www.bugzilla.org/security/3.4.12/">
<p>The following security issues have been discovered in Bugzilla:</p>
<ul>
<li>Tabular and graphical reports, as well as new charts have
a debug mode which displays raw data as plain text. This
text is not correctly escaped and a crafted URL could use
this vulnerability to inject code leading to XSS.</li>
<li>The User.offer_account_by_email WebService method ignores
the user_can_create_account setting of the authentication
method and generates an email with a token in it which the
user can use to create an account. Depending on the
authentication method being active, this could allow the
user to log in using this account.
Installations where the createemailregexp parameter is
empty are not vulnerable to this issue.</li>
<li>The creation of bug reports and of attachments is not
protected by a token and so they can be created without the
consent of a user if the relevant code is embedded in an
HTML page and the user visits this page. This behavior was
intentional to let third-party applications submit new bug
reports and attachments easily. But as this behavior can be
abused by a malicious user, it has been decided to block
submissions with no valid token starting from version 4.2rc1.
Older branches are not patched to not break these third-party
applications after the upgrade.</li>
</ul>
<p>All affected installations are encouraged to upgrade as soon
as possible.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3657</cvename>
<cvename>CVE-2011-3667</cvename>
<cvename>CVE-2011-3668</cvename>
<cvename>CVE-2011-3669</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=697699</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=711714</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=703975</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=703983</url>
</references>
<dates>
<discovery>2011-11-28</discovery>
<entry>2012-01-05</entry>
</dates>
</vuln>
<vuln vid="810df820-3664-11e1-8fe3-00215c6a37bb">
<topic>WordPress -- cross site scripting vulnerability</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>3.3.1,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>zh-wordpress-zh_CN</name>
<name>zh-wordpress-zh_TW</name>
<range><lt>3.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>WordPress development team reports:</p>
<blockquote cite="http://wordpress.org/news/2012/01/wordpress-3-3-1/">
<p>WordPress 3.3.1 is now available. This maintenance release
fixes 15 issues with WordPress 3.3, as well as a fix for a
cross-site scripting vulnerability that affected version 3.3.
Thanks to Joshua H., Hoang T., Stefan Zimmerman, Chris K., and
the Go Daddy security team for responsibly disclosing the bug
to our security team.</p>
</blockquote>
</body>
</description>
<references>
<url>http://threatpost.com/en_us/blogs/xss-bug-found-wordpress-33-010312</url>
</references>
<dates>
<discovery>2012-01-03</discovery>
<entry>2012-01-03</entry>
</dates>
</vuln>
<vuln vid="048c77df-3211-11e1-9583-14dae938ec40">
<topic>zabbix-frontend -- multiple XSS vulnerabilities</topic>
<affects>
<package>
<name>zabbix-frontend</name>
<range><lt>1.8.10,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Martina Matari reports:</p>
<blockquote cite="https://support.zabbix.com/browse/ZBX-4015">
<p>These URLs (hostgroups.php, usergrps.php) are vulnerable to
persistent XSS attacks due to improper sanitation of gname
variable when creating user and host groups.</p>
</blockquote>
</body>
</description>
<references>
<url>https://support.zabbix.com/browse/ZBX-4015</url>
</references>
<dates>
<discovery>2011-08-04</discovery>
<entry>2011-12-29</entry>
</dates>
</vuln>
<vuln vid="c6521b04-314b-11e1-9cf4-5404a67eef98">
<topic>lighttpd -- remote DoS in HTTP authentication</topic>
<affects>
<package>
<name>lighttpd</name>
<range><lt>1.4.30</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>US-CERT/NIST reports:</p>
<blockquote cite="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-4362">
<p>Integer signedness error in the base64_decode function in the
HTTP authentication functionality (http_auth.c) in lighttpd 1.4
before 1.4.30 and 1.5 before SVN revision 2806 allows remote
attackers to cause a denial of service (segmentation fault)
via crafted base64 input that triggers an out-of-bounds read
with a negative index.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-4362</cvename>
</references>
<dates>
<discovery>2011-11-29</discovery>
<entry>2011-12-28</entry>
</dates>
</vuln>
<vuln vid="4ddc78dc-300a-11e1-a2aa-0016ce01e285">
<topic>krb5-appl -- telnetd code execution vulnerability</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>7.3</ge><lt>7.3_9</lt></range>
<range><ge>7.4</ge><lt>7.4_5</lt></range>
<range><ge>8.1</ge><lt>8.1_7</lt></range>
<range><ge>8.2</ge><lt>8.2_5</lt></range>
</package>
<package>
<name>krb5-appl</name>
<range><lt>1.0.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The MIT Kerberos Team reports:</p>
<blockquote cite="http://security.FreeBSD.org/advisories/FreeBSD-SA-11:08.telnetd.asc">
<p>When an encryption key is supplied via the TELNET protocol,
its length is not validated before the key is copied into a
fixed-size buffer. Also see MITKRB5-SA-2011-008.</p>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-11:08.telnetd</freebsdsa>
<cvename>CVE-2011-4862</cvename>
<url>http://security.FreeBSD.org/advisories/FreeBSD-SA-11:08.telnetd.asc</url>
<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-008.txt</url>
</references>
<dates>
<discovery>2011-12-23</discovery>
<entry>2011-12-26</entry>
<modified>2012-01-29</modified>
</dates>
</vuln>
<vuln vid="022a4c77-2da4-11e1-b356-00215c6a37bb">
<topic>proftpd -- arbitrary code execution vulnerability with chroot</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>7.3</ge><lt>7.3_9</lt></range>
<range><ge>7.4</ge><lt>7.4_5</lt></range>
<range><ge>8.1</ge><lt>8.1_6</lt></range>
<range><ge>8.2</ge><lt>8.2_5</lt></range>
</package>
<package>
<name>proftpd</name>
<name>proftpd-mysql</name>
<range><lt>1.3.3g_1</lt></range>
</package>
<package>
<name>proftpd-devel</name>
<range><lt>1.3.3.r4_3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The FreeBSD security advisory FreeBSD-SA-11:07.chroot reports:</p>
<blockquote cite="http://security.freebsd.org/advisories/FreeBSD-SA-11:07.chroot.asc">
<p>If ftpd is configured to place a user in a chroot environment,
then an attacker who can log in as that user may be able to run
arbitrary code(...).</p>
</blockquote>
<p>Proftpd shares the same problem of a similar nature.</p>
</body>
</description>
<references>
<freebsdsa>SA-11:07.chroot</freebsdsa>
<url>http://seclists.org/fulldisclosure/2011/Nov/452</url>
</references>
<dates>
<discovery>2011-11-30</discovery>
<entry>2011-12-23</entry>
<modified>2012-01-29</modified>
</dates>
</vuln>
<vuln vid="8c83145d-2c95-11e1-89b4-001ec9578670">
<topic>phpMyAdmin -- Multiple XSS</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><gt>3.4</gt><lt>3.4.9.r1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-19.php">
<p>Using crafted url parameters, it was possible to produce XSS on
the export panels in the server, database and table sections.</p>
</blockquote>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-20.php">
<p>Crafted values entered in the setup interface can produce XSS;
also, if the config directory exists and is writeable, the XSS
payload can be saved to this directory.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-4780</cvename>
<cvename>CVE-2011-4782</cvename>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-19.php</url>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-20.php</url>
</references>
<dates>
<discovery>2011-12-16</discovery>
<entry>2011-12-22</entry>
</dates>
</vuln>
<vuln vid="e3ff776b-2ba6-11e1-93c6-0011856a6e37">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>4.0,1</gt><lt>9.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>9.0,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.6</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>9.0</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.6</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><gt>4.0</gt><lt>9.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2011-53 Miscellaneous memory safety hazards (rv:9.0)</p>
<p>MFSA 2011-54 Potentially exploitable crash in the YARR regular
expression library</p>
<p>MFSA 2011-55 nsSVGValue out-of-bounds access</p>
<p>MFSA 2011-56 Key detection without JavaScript via SVG
animation</p>
<p>MFSA 2011-58 Crash scaling video to extreme sizes</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3658</cvename>
<cvename>CVE-2011-3660</cvename>
<cvename>CVE-2011-3661</cvename>
<cvename>CVE-2011-3663</cvename>
<cvename>CVE-2011-3665</cvename>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-53.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-54.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-55.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-56.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-58.html</url>
</references>
<dates>
<discovery>2011-12-20</discovery>
<entry>2011-12-21</entry>
<modified>2011-12-21</modified>
</dates>
</vuln>
<vuln vid="7ba65bfd-2a40-11e1-b96e-00215af774f0">
<topic>unbound -- denial of service vulnerabilities from nonstandard redirection and denial of existence</topic>
<affects>
<package>
<name>unbound</name>
<range><lt>1.4.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Unbound developer reports:</p>
<blockquote cite="http://www.unbound.net/downloads/CVE-2011-4528.txt">
<p>Unbound crashes when confronted with a non-standard response
from a server for a domain. This domain produces duplicate RRs
from a certain type and is DNSSEC signed. Unbound also crashes
when confronted with a query that eventually, and under specific
circumstances, resolves to a domain that misses expected NSEC3
records.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-4528</cvename>
<url>http://unbound.nlnetlabs.nl/downloads/CVE-2011-4528.txt</url>
</references>
<dates>
<discovery>2011-12-19</discovery>
<entry>2011-12-19</entry>
</dates>
</vuln>
<vuln vid="3c957a3e-2978-11e1-89b4-001ec9578670">
<topic>typo3 -- Remote Code Execution</topic>
<affects>
<package>
<name>typo3</name>
<range><ge>4.6</ge><lt>4.6.2</lt></range>
<range><lt>4.5.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The typo3 security team reports:</p>
<blockquote cite="http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2011-004/">
<p>A crafted request to a vulnerable TYPO3 installation will allow
an attacker to load PHP code from an external source and to
execute it on the TYPO3 installation.</p>
<p>This is caused by a PHP file, which is part of the workspaces
system extension, that does not validate passed arguments.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-4614</cvename>
<url>http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2011-004/</url>
</references>
<dates>
<discovery>2011-12-16</discovery>
<entry>2011-12-18</entry>
</dates>
</vuln>
<vuln vid="6c7d9a35-2608-11e1-89b4-001ec9578670">
<topic>krb5 -- KDC null pointer dereference in TGS handling</topic>
<affects>
<package>
<name>krb5</name>
<range><ge>1.9</ge><lt>1.9.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The MIT Kerberos Team reports:</p>
<blockquote cite="http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2011-007.txt">
<p>In releases krb5-1.9 and later, the KDC can crash due to a NULL
pointer dereference in code that handles TGS (Ticket Granting
Service) requests. The trigger condition is trivial to produce
using unmodified client software, but requires the ability to
authenticate as a principal in the KDC's realm.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-1530</cvename>
<url>http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2011-007.txt</url>
</references>
<dates>
<discovery>2011-12-11</discovery>
<entry>2011-12-14</entry>
</dates>
</vuln>
<vuln vid="a4a809d8-25c8-11e1-b531-00215c6a37bb">
<topic>opera -- multiple vulnerabilities</topic>
<affects>
<package>
<name>opera</name>
<name>linux-opera</name>
<range><lt>11.60</lt></range>
</package>
<package>
<name>opera-devel</name>
<range><lt>11.60,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Opera software reports:</p>
<blockquote cite="http://www.opera.com/docs/changelogs/unix/1160/">
<ul>
<li>Fixed a moderately severe issue; details will be
disclosed at a later date</li>
<li>Fixed an issue that could allow pages to set cookies
or communicate cross-site for some top level domains;
see our <a href="http://www.opera.com/support/kb/view/1003/">advisory</a></li>
<li>Improved handling of certificate revocation corner
cases</li>
<li>Added a fix for a weakness in the SSL v3.0 and TLS 1.0
specifications, as reported by Thai Duong and Juliano Rizzo;
see our <a href="http://www.opera.com/support/kb/view/1004/">advisory</a></li>
<li>Fixed an issue where the JavaScript "in" operator
allowed leakage of cross-domain information, as reported
by David Bloom; see our <a href="http://www.opera.com/support/kb/view/1005/">advisory</a></li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3389</cvename>
<cvename>CVE-2011-4681</cvename>
<cvename>CVE-2011-4682</cvename>
<cvename>CVE-2011-4683</cvename>
<url>http://www.opera.com/support/kb/view/1003/</url>
<url>http://www.opera.com/support/kb/view/1004/</url>
<url>http://www.opera.com/support/kb/view/1005/</url>
</references>
<dates>
<discovery>2011-12-06</discovery>
<entry>2011-12-13</entry>
</dates>
</vuln>
<vuln vid="68ac6266-25c3-11e1-b63a-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>16.0.912.63</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.com/search/label/Stable%20updates">
<p>[81753] Medium CVE-2011-3903: Out-of-bounds read in regex
matching. Credit to David Holloway of the Chromium development
community.<br/>
[95465] Low CVE-2011-3905: Out-of-bounds reads in libxml. Credit to
Google Chrome Security Team (Inferno).<br/>
[98809] Medium CVE-2011-3906: Out-of-bounds read in PDF parser.
Credit to Aki Helin of OUSPG.<br/>
[99016] High CVE-2011-3907: URL bar spoofing with view-source.
Credit to Mitja Kolsek of ACROS Security.<br/>
[100863] Low CVE-2011-3908: Out-of-bounds read in SVG parsing.
Credit to Aki Helin of OUSPG.<br/>
[101010] Medium CVE-2011-3909: [64-bit only] Memory corruption in
CSS property array. Credit to Google Chrome Security Team
(scarybeasts) and Chu.<br/>
[101494] Medium CVE-2011-3910: Out-of-bounds read in YUV video
frame handling. Credit to Google Chrome Security Team (Cris
Neckar).<br/>
[101779] Medium CVE-2011-3911: Out-of-bounds read in PDF. Credit to
Google Chrome Security Team (scarybeasts) and Robert Swiecki of
the Google Security Team.<br/>
[102359] High CVE-2011-3912: Use-after-free in SVG filters. Credit
to Arthur Gerkis.<br/>
[103921] High CVE-2011-3913: Use-after-free in Range handling.
Credit to Arthur Gerkis.<br/>
[104011] High CVE-2011-3914: Out-of-bounds write in v8 i18n
handling. Credit to Slawomir Blazek.<br/>
[104529] High CVE-2011-3915: Buffer overflow in PDF font handling.
Credit to Atte Kettunen of OUSPG.<br/>
[104959] Medium CVE-2011-3916: Out-of-bounds reads in PDF cross
references. Credit to Atte Kettunen of OUSPG.<br/>
[105162] Medium CVE-2011-3917: Stack-buffer-overflow in FileWatcher.
Credit to Google Chrome Security Team (Marty Barbella).<br/>
[107258] High CVE-2011-3904: Use-after-free in bidi handling.
Credit to Google Chrome Security Team (Inferno) and miaubiz.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3903</cvename>
<cvename>CVE-2011-3904</cvename>
<cvename>CVE-2011-3905</cvename>
<cvename>CVE-2011-3906</cvename>
<cvename>CVE-2011-3907</cvename>
<cvename>CVE-2011-3908</cvename>
<cvename>CVE-2011-3909</cvename>
<cvename>CVE-2011-3910</cvename>
<cvename>CVE-2011-3911</cvename>
<cvename>CVE-2011-3912</cvename>
<cvename>CVE-2011-3913</cvename>
<cvename>CVE-2011-3914</cvename>
<cvename>CVE-2011-3915</cvename>
<cvename>CVE-2011-3916</cvename>
<cvename>CVE-2011-3917</cvename>
<url>http://googlechromereleases.blogspot.com/search/label/Stable%20updates</url>
</references>
<dates>
<discovery>2011-12-13</discovery>
<entry>2011-12-13</entry>
</dates>
</vuln>
<vuln vid="bbd5f486-24f1-11e1-95bc-080027ef73ec">
<topic>PuTTY -- Password vulnerability</topic>
<affects>
<package>
<name>putty</name>
<range><ge>0.59</ge><lt>0.62</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon Tatham reports:</p>
<blockquote cite="http://lists.tartarus.org/pipermail/putty-announce/2011/000017.html">
<p>PuTTY 0.62 fixes a security issue present in 0.59, 0.60 and 0.61.
If you log in using SSH-2 keyboard-interactive authentication
(which is the usual method used by modern servers to request a
password), the password you type was accidentally kept in PuTTY's
memory for the rest of its run, where it could be retrieved by
other processes reading PuTTY's memory, or written out to swap
files or crash dumps.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-4607</cvename>
<mlist>http://lists.tartarus.org/pipermail/putty-announce/2011/000017.html</mlist>
<url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/password-not-wiped.html</url>
</references>
<dates>
<discovery>2011-12-10</discovery>
<entry>2011-12-12</entry>
<modified>2013-08-07</modified>
</dates>
</vuln>
<vuln vid="bb389137-21fb-11e1-89b4-001ec9578670">
<topic>asterisk -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>asterisk18</name>
<range><lt>1.8.7.2</lt></range>
</package>
<package>
<name>asterisk16</name>
<range><lt>1.6.2.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Asterisk project reports:</p>
<blockquote cite="http://downloads.asterisk.org/pub/security/AST-2011-013.html">
<p>It is possible to enumerate SIP usernames when the general and
user/peer NAT settings differ in whether to respond to the port
a request is sent from or the port listed for responses in the
Via header.</p>
</blockquote>
<blockquote cite="http://downloads.asterisk.org/pub/security/AST-2011-014.html">
<p>When the "automon" feature is enabled in features.conf, it is
possible to send a sequence of SIP requests that cause Asterisk
to dereference a NULL pointer and crash.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-4597</cvename>
<cvename>CVE-2011-4598</cvename>
<url>http://downloads.asterisk.org/pub/security/AST-2011-013.html</url>
<url>http://downloads.asterisk.org/pub/security/AST-2011-014.html</url>
</references>
<dates>
<discovery>2011-12-08</discovery>
<entry>2011-12-09</entry>
</dates>
</vuln>
<vuln vid="93be487e-211f-11e1-89b4-001ec9578670">
<topic>isc-dhcp-server -- Remote DoS</topic>
<affects>
<package>
<name>isc-dhcp42-server</name>
<range><lt>4.2.3_1</lt></range>
</package>
<package>
<name>isc-dhcp41-server</name>
<range><lt>4.1.e_3,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://www.isc.org/software/bind/advisories/cve-2011-4539">
<p>A bug exists which allows an attacker who is able to send DHCP
Request packets, either directly or through a relay, to remotely
crash an ISC DHCP server if that server is configured to evaluate
expressions using a regular expression (i.e. uses the "~=" or
"~~" comparison operators).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-4539</cvename>
</references>
<dates>
<discovery>2011-12-07</discovery>
<entry>2011-12-07</entry>
</dates>
</vuln>
<vuln vid="ed536336-1c57-11e1-86f4-e0cb4e266481">
<topic>phpMyAdmin -- Multiple XSS</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><gt>3.4</gt><lt>3.4.8.r1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-18.php">
<p>Using crafted database names, it was possible to produce XSS
in the Database Synchronize and Database rename panels. Using
an invalid and crafted SQL query, it was possible to produce
XSS when editing a query on a table overview panel or when
using the view creation dialog. Using a crafted column type,
it was possible to produce XSS in the table search and create
index dialogs.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-4634</cvename>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-18.php</url>
</references>
<dates>
<discovery>2011-11-24</discovery>
<entry>2011-12-01</entry>
</dates>
</vuln>
<vuln vid="eef56761-11eb-11e1-bb94-001c140104d4">
<topic>hiawatha -- memory leak in PreventSQLi routine</topic>
<affects>
<package>
<name>hiawatha</name>
<range><ge>7.6</ge><lt>7.8.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Hugo Leisink reports via private mail to maintainer:</p>
<blockquote>
<p>The memory leak was introduced in version 7.6. It is in the
routing that checks for SQL injections. So, if you have set
PreventSQLi to 'no', there is no problem.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.hiawatha-webserver.org/changelog</url>
</references>
<dates>
<discovery>2011-11-18</discovery>
<entry>2011-11-18</entry>
</dates>
</vuln>
<vuln vid="90cc1494-10ac-11e1-b3ec-0024e830109b">
<topic>BIND -- Remote DOS</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>7.3</ge><lt>7.3_9</lt></range>
<range><ge>7.4</ge><lt>7.4_5</lt></range>
<range><ge>8.1</ge><lt>8.1_7</lt></range>
<range><ge>8.2</ge><lt>8.2_5</lt></range>
</package>
<package>
<name>bind96</name>
<range><lt>9.6.3.1.ESV.R5.1</lt></range>
</package>
<package>
<name>bind97</name>
<range><lt>9.7.4.1</lt></range>
</package>
<package>
<name>bind98</name>
<range><lt>9.8.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Internet Systems Consortium reports:</p>
<blockquote cite="https://www.isc.org/software/bind/advisories/cve-2011-4313">
<p>Organizations across the Internet reported crashes interrupting
service on BIND 9 nameservers performing recursive queries.
Affected servers crashed after logging an error in query.c with
the following message: "INSIST(! dns_rdataset_isassociated(sigrdataset))"
Multiple versions were reported being affected, including all
currently supported release versions of ISC BIND 9.</p>
<p>Because it may be possible to trigger this bug even on networks
that do not allow untrusted users to access the recursive name
servers (perhaps via specially crafted e-mail messages, and/or
malicious web sites) it is recommended that ALL operators of
recursive name servers upgrade immediately.</p>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-11:06.bind</freebsdsa>
<cvename>CVE-2011-4313</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4313</url>
<url>https://www.isc.org/software/bind/advisories/cve-2011-4313</url>
</references>
<dates>
<discovery>2011-11-16</discovery>
<entry>2011-11-16</entry>
<modified>2012-01-29</modified>
</dates>
</vuln>
<vuln vid="d8c901ff-0f0f-11e1-902b-20cf30e32f6d">
<topic>Apache 1.3 -- mod_proxy reverse proxy exposure</topic>
<affects>
<package>
<name>apache</name>
<range><lt>1.3.43</lt></range>
</package>
<package>
<name>apache+ssl</name>
<range><lt>1.3.43.1.59_2</lt></range>
</package>
<package>
<name>apache+ipv6</name>
<range><lt>1.3.43</lt></range>
</package>
<package>
<name>apache+mod_perl</name>
<range><lt>1.3.43</lt></range>
</package>
<package>
<name>apache+mod_ssl</name>
<range><lt>1.3.41+2.8.31_4</lt></range>
</package>
<package>
<name>apache+mod_ssl+ipv6</name>
<range><lt>1.3.41+2.8.31_4</lt></range>
</package>
<package>
<name>ru-apache-1.3</name>
<range><lt>1.3.43+30.23_1</lt></range>
</package>
<package>
<name>ru-apache+mod_ssl</name>
<range><lt>1.3.43+30.23_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache HTTP server project reports:</p>
<blockquote cite="http://httpd.apache.org/security/vulnerabilities_13.html">
<p>An exposure was found when using mod_proxy in reverse proxy mode.
In certain configurations using RewriteRule with proxy flag, a
remote attacker could cause the reverse proxy to connect to an
arbitrary server, possibly disclosing sensitive information from
internal web servers not directly accessible to attacker. There
is no patch against this issue!</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3368</cvename>
<url>http://httpd.apache.org/security/vulnerabilities_13.html</url>
<url>http://seclists.org/fulldisclosure/2011/Oct/232</url>
</references>
<dates>
<discovery>2011-10-05</discovery>
<entry>2011-11-14</entry>
</dates>
</vuln>
<vuln vid="7fb9e739-0e6d-11e1-87cd-00235a5f2c9a">
<topic>kdeutils4 -- Directory traversal vulnerability</topic>
<affects>
<package>
<name>kdeutils</name>
<range><ge>4.0.*</ge><lt>4.7.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tim Brown from Nth Dimention reports:</p>
<blockquote cite="http://seclists.org/fulldisclosure/2011/Oct/351">
<p>I recently discovered that the Ark archiving tool is vulnerable
to directory traversal via malformed. When attempts are made to
view files within the malformed Zip file in Ark's default view,
the wrong file may be displayed due to incorrect construction of
the temporary file name. Whilst this does not allow the wrong
file to be overwritten, after closing the default view, Ark will
then attempt to delete the temporary file which could result in
the deletion of the incorrect file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-2725</cvename>
<url>http://seclists.org/fulldisclosure/2011/Oct/351</url>
</references>
<dates>
<discovery>2011-10-19</discovery>
<entry>2011-11-14</entry>
</dates>
</vuln>
<vuln vid="38560d79-0e42-11e1-902b-20cf30e32f6d">
<topic>Apache APR -- DoS vulnerabilities</topic>
<affects>
<package>
<name>apr0</name>
<range><lt>0.9.20.0.9.19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Portable Runtime Project reports:</p>
<blockquote cite="http://www.apache.org/dist/apr/CHANGES-APR-0.9">
<p>Reimplement apr_fnmatch() from scratch using a non-recursive
algorithm; now has improved compliance with the fnmatch()
spec.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-0419</cvename>
<url>http://www.apache.org/dist/apr/Announcement0.9.html</url>
</references>
<dates>
<discovery>2011-05-19</discovery>
<entry>2011-11-13</entry>
</dates>
</vuln>
<vuln vid="1f6ee708-0d22-11e1-b5bd-14dae938ec40">
<topic>phpmyadmin -- Local file inclusion</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><gt>3.4</gt><lt>3.4.7.1</lt></range>
<range><lt>3.3.10.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jan Lieskovsky reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-17.php">
<p>Importing a specially-crafted XML file which contains an XML
entity injection permits to retrieve a local file (limited by the
privileges of the user running the web server).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-4107</cvename>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-17.php</url>
</references>
<dates>
<discovery>2011-11-10</discovery>
<entry>2011-11-12</entry>
</dates>
</vuln>
<vuln vid="0e8e1212-0ce5-11e1-849b-003067b2972c">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>10.3r183.11</lt></range>
<range><gt>11</gt><lt>11.1r102.55</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe Product Security Incident Response Team reports:</p>
<blockquote cite="https://www.adobe.com/support/security/bulletins/apsb11-28.html">
<p>Critical vulnerabilities have been identified in Adobe Flash
Player 11.0.1.152 and earlier versions for Windows, Macintosh,
Linux and Solaris, and Adobe Flash Player 11.0.1.153 and earlier
versions for Android.</p>
</blockquote>
<p>In addition a patch was released for users of flash10.</p>
</body>
</description>
<references>
<cvename>CVE-2011-2445</cvename>
<cvename>CVE-2011-2450</cvename>
<cvename>CVE-2011-2451</cvename>
<cvename>CVE-2011-2452</cvename>
<cvename>CVE-2011-2453</cvename>
<cvename>CVE-2011-2454</cvename>
<cvename>CVE-2011-2455</cvename>
<cvename>CVE-2011-2456</cvename>
<cvename>CVE-2011-2457</cvename>
<cvename>CVE-2011-2458</cvename>
<cvename>CVE-2011-2459</cvename>
<cvename>CVE-2011-2460</cvename>
<url>https://www.adobe.com/support/security/bulletins/apsb11-28.html</url>
</references>
<dates>
<discovery>2011-11-10</discovery>
<entry>2011-11-11</entry>
</dates>
</vuln>
<vuln vid="7be92050-a450-11e2-9898-001060e06fd4">
<topic>libxml -- Integer overflow</topic>
<affects>
<package>
<name>libxml</name>
<range><lt>1.8.17_5</lt></range>
</package>
<package>
<name>libxml2</name>
<name>linux-f10-libxml2</name>
<range><lt>2.7.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Integer overflow in xpath.c, allows context-dependent attackers
to to cause a denial of service (crash) and possibly execute
arbitrary code via a crafted XML file that triggers a heap-based
buffer overflow when adding a new namespace node, related to
handling of XPath expressions.</p>
</body>
</description>
<references>
<cvename>CVE-2011-1944</cvename>
</references>
<dates>
<discovery>2011-09-02</discovery>
<entry>2011-11-10</entry>
<modified>2011-11-12</modified>
</dates>
</vuln>
<vuln vid="ce4b3af8-0b7c-11e1-846b-00235409fd3e">
<topic>libxml -- Multiple use-after-free vulnerabilities</topic>
<affects>
<package>
<name>libxml</name>
<range><lt>1.8.17_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Multiple use-after-free vulnerabilities in libxml 1.8.17 that
allow context-dependent attackers to cause a denial of service
(application crash) via crafted (1) Notation or (2) Enumeration
attribute types in an XML file.</p>
</body>
</description>
<references>
<cvename>CVE-2009-2416</cvename>
</references>
<dates>
<discovery>2009-08-03</discovery>
<entry>2011-11-10</entry>
<modified>2011-11-12</modified>
</dates>
</vuln>
<vuln vid="5a7d4110-0b7a-11e1-846b-00235409fd3e">
<topic>libxml -- Stack consumption vulnerability</topic>
<affects>
<package>
<name>libxml</name>
<range><lt>1.8.17_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Stack consumption vulnerability allows context-dependent
attackers to cause a denial of service (application crash) via
a large depth of element declarations in a DTD.</p>
</body>
</description>
<references>
<cvename>CVE-2009-2414</cvename>
</references>
<dates>
<discovery>2009-08-03</discovery>
<entry>2011-11-10</entry>
<modified>2011-11-12</modified>
</dates>
</vuln>
<vuln vid="bdec8dc2-0b3b-11e1-b722-001cc0476564">
<topic>gnutls -- client session resumption vulnerability</topic>
<affects>
<package>
<name>gnutls</name>
<range><lt>2.12.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The GnuTLS team reports:</p>
<blockquote cite="http://www.gnu.org/software/gnutls/security.html">
<p>GNUTLS-SA-2011-2 Possible buffer overflow/Denial of service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-4128</cvename>
<url>http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/5596</url>
</references>
<dates>
<discovery>2011-11-08</discovery>
<entry>2011-11-10</entry>
</dates>
</vuln>
<vuln vid="6c8ad3e8-0a30-11e1-9580-4061862b8c22">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>4.0,1</gt><lt>8.0,1</lt></range>
<range><gt>3.6.*,1</gt><lt>3.6.24,1</lt></range>
</package>
<package>
<name>libxul</name>
<range><gt>1.9.2.*</gt><lt>1.9.2.24</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>8.0,1</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>8.0</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><gt>4.0</gt><lt>8.0</lt></range>
<range><lt>3.1.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2011-46 loadSubScript unwraps XPCNativeWrapper scope
parameter (1.9.2 branch)</p>
<p>MFSA 2011-47 Potential XSS against sites using Shift-JIS</p>
<p>MFSA 2011-48 Miscellaneous memory safety hazards (rv:8.0)</p>
<p>MFSA 2011-49 Memory corruption while profiling using Firebug</p>
<p>MFSA 2011-50 Cross-origin data theft using canvas and Windows
D2D</p>
<p>MFSA 2011-51 Cross-origin image theft on Mac with integrated
Intel GPU</p>
<p>MFSA 2011-52 Code execution via NoWaiverWrapper</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3647</cvename>
<cvename>CVE-2011-3648</cvename>
<cvename>CVE-2011-3649</cvename>
<cvename>CVE-2011-3650</cvename>
<cvename>CVE-2011-3651</cvename>
<cvename>CVE-2011-3652</cvename>
<cvename>CVE-2011-3653</cvename>
<cvename>CVE-2011-3654</cvename>
<cvename>CVE-2011-3655</cvename>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-46.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-47.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-48.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-49.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-50.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-51.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-52.html</url>
</references>
<dates>
<discovery>2011-11-08</discovery>
<entry>2011-11-08</entry>
</dates>
</vuln>
<vuln vid="9dde9dac-08f4-11e1-af36-003067b2972c">
<topic>caml-light -- insecure use of temporary files</topic>
<affects>
<package>
<name>caml-light</name>
<range><le>0.75</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>caml-light uses mktemp() insecurely, and also does
unsafe things in /tmp during make install.</p>
</body>
</description>
<references>
<cvename>CVE-2011-4119</cvename>
<mlist msgid="20111106200911.GC13652@netbsd.org">http://seclists.org/oss-sec/2011/q4/249</mlist>
</references>
<dates>
<discovery>2011-11-02</discovery>
<entry>2011-11-06</entry>
</dates>
</vuln>
<vuln vid="54075e39-04ac-11e1-a94e-bcaec565249c">
<topic>freetype -- Some type 1 fonts handling vulnerabilities</topic>
<affects>
<package>
<name>freetype2</name>
<range><lt>2.4.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The FreeType project reports:</p>
<blockquote cite="http://sourceforge.net/projects/freetype/files/freetype2/2.4.7/README/view">
<p>A couple of vulnerabilities in handling Type 1 fonts.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3256</cvename>
<url>http://sourceforge.net/projects/freetype/files/freetype2/2.4.7/README/view</url>
<url>https://bugzilla.redhat.com/attachment.cgi?id=528829&amp;action=diff</url>
</references>
<dates>
<discovery>2011-10-12</discovery>
<entry>2011-11-01</entry>
</dates>
</vuln>
<vuln vid="f08e2c15-ffc9-11e0-b0f3-bcaec565249c">
<topic>cacti -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>cacti</name>
<range><lt>0.8.7h</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cacti Group reports:</p>
<blockquote cite="http://www.cacti.net/release_notes_0_8_7h.php">
<p>SQL injection issue with user login, and cross-site scripting
issues.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.cacti.net/release_notes_0_8_7h.php</url>
</references>
<dates>
<discovery>2011-09-26</discovery>
<entry>2011-10-26</entry>
</dates>
</vuln>
<vuln vid="395e0faa-ffa7-11e0-8ac4-6c626dd55a41">
<topic>phpmyfaq -- Remote PHP Code Injection Vulnerability</topic>
<affects>
<package>
<name>phpmyfaq</name>
<range><lt>2.6.19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyFAQ project reports:</p>
<blockquote cite="http://www.phpmyfaq.de/advisory_2011-10-25.php">
<p>The phpMyFAQ Team has learned of a serious security issue that
has been discovered in our bundled ImageManager library we use
in phpMyFAQ 2.6 and 2.7. The bundled ImageManager library
allows injection of arbitrary PHP code via POST requests.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.phpmyfaq.de/advisory_2011-10-25.php</url>
<url>http://forum.phpmyfaq.de/viewtopic.php?f=3&amp;t=13402</url>
</references>
<dates>
<discovery>2011-10-25</discovery>
<entry>2011-10-26</entry>
</dates>
</vuln>
<vuln vid="edf47177-fe3f-11e0-a207-0014a5e3cda6">
<topic>phpLDAPadmin -- Remote PHP code injection vulnerability</topic>
<affects>
<package>
<name>phpldapadmin</name>
<range><ge>1.2.0</ge><lt>1.2.1.1_1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>EgiX (n0b0d13s at gmail dot com) reports:</p>
<blockquote cite="http://packetstormsecurity.org/files/106120/phpldapadmin-inject.txt">
<p>The $sortby parameter passed to 'masort' function in file
lib/functions.php isn't properly sanitized before being used in
a call to create_function() at line 1080. This can be exploited
to inject and execute arbitrary PHP code. The only possible
attack vector is when handling the 'query_engine' command, in
which input passed through $_REQUEST['orderby'] is passed as
$sortby parameter to 'masort' function.</p>
</blockquote>
</body>
</description>
<references>
<url>http://packetstormsecurity.org/files/106120/phpldapadmin-inject.txt</url>
<url>http://sourceforge.net/tracker/?func=detail&amp;aid=3417184&amp;group_id=61828&amp;atid=498546</url>
</references>
<dates>
<discovery>2011-10-23</discovery>
<entry>2011-10-24</entry>
</dates>
</vuln>
<vuln vid="6d21a287-fce0-11e0-a828-00235a5f2c9a">
<topic>kdelibs4, rekonq -- input validation failure</topic>
<affects>
<package>
<name>kdelibs</name>
<range><ge>4.0.*</ge><lt>4.7.2</lt></range>
</package>
<package>
<name>rekonq</name>
<range><lt>0.8.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>KDE Security Advisory reports:</p>
<blockquote cite="http://www.kde.org/info/security/advisory-20111003-1.txt">
<p>The default rendering type for a QLabel is QLabel::AutoText,
which uses heuristics to determine whether to render the given
content as plain text or rich text. KSSL and Rekonq did not
properly force its QLabels to use QLabel::PlainText. As a result,
if given a certificate containing rich text in its fields, they
would render the rich text. Specifically, a certificate
containing a common name (CN) that has a table element will cause
the second line of the table to be displayed. This can allow
spoofing of the certificate's common name.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.kde.org/info/security/advisory-20111003-1.txt</url>
<url>http://www.nth-dimension.org.uk/pub/NDSA20111003.txt.asc</url>
<cvename>CVE-2011-3365</cvename>
<cvename>CVE-2011-3366</cvename>
</references>
<dates>
<discovery>2011-10-03</discovery>
<entry>2011-10-23</entry>
</dates>
</vuln>
<vuln vid="411ecb79-f9bc-11e0-a7e6-6c626dd55a41">
<topic>piwik -- unknown critical vulnerabilities</topic>
<affects>
<package>
<name>piwik</name>
<range><gt>1.1</gt><lt>1.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/46461/">
<p>Multiple vulnerabilities with an unknown impact have been
reported in Piwik. The vulnerabilities are caused due to
unspecified errors. No further information is currently
available.</p>
</blockquote>
</body>
</description>
<references>
<url>http://secunia.com/advisories/46461/</url>
<url>http://piwik.org/blog/2011/10/piwik-1-6/</url>
</references>
<dates>
<discovery>2011-10-18</discovery>
<entry>2011-10-20</entry>
</dates>
</vuln>
<vuln vid="8441957c-f9b4-11e0-a78a-bcaec565249c">
<topic>Xorg server -- two vulnerabilities in X server lock handling code</topic>
<affects>
<package>
<name>xorg-server</name>
<range><lt>1.7.7_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matthieu Herrb reports:</p>
<blockquote cite="http://lists.freedesktop.org/archives/xorg-announce/2011-October/001744.html">
<p>It is possible to deduce if a file exists or not by exploiting
the way that Xorg creates its lock files. This is caused by the
fact that the X server is behaving differently if the lock file
already exists as a symbolic link pointing to an existing or
non-existing file.</p>
<p>It is possible for a non-root user to set the permissions for
all users on any file or directory to 444, giving unwanted read
access or causing denies of service (by removing execute
permission). This is caused by a race between creating the lock
file and setting its access modes.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-4028</cvename>
<cvename>CVE-2011-4029</cvename>
</references>
<dates>
<discovery>2011-10-18</discovery>
<entry>2011-10-18</entry>
</dates>
</vuln>
<vuln vid="a95092a6-f8f1-11e0-a7ea-00215c6a37bb">
<topic>asterisk -- remote crash vulnerability in SIP channel driver</topic>
<affects>
<package>
<name>asterisk18</name>
<range><gt>1.8.*</gt><lt>1.8.7.1</lt></range>
</package>
<package>
<name>asterisk</name>
<range><gt>10.0.0.*</gt><lt>10.0.0.r1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Asterisk project reports:</p>
<blockquote cite="http://downloads.asterisk.org/pub/security/AST-2011-012.html">
<p>A remote authenticated user can cause a crash with a malformed
request due to an unitialized variable.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-4063</cvename>
</references>
<dates>
<discovery>2011-10-17</discovery>
<entry>2011-10-17</entry>
</dates>
</vuln>
<vuln vid="e454ca2f-f88d-11e0-b566-00163e01a509">
<topic>PivotX -- Remote File Inclusion Vulnerability of TimThumb</topic>
<affects>
<package>
<name>pivotx</name>
<range><lt>2.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PivotX team reports:</p>
<blockquote cite="http://blog.pivotx.net/page/security">
<p>TimThumb domain name security bypass and insecure cache
handling. PivotX before 2.3.0 includes a vulnerable version
of TimThumb.</p>
</blockquote>
<blockquote cite="http://blog.pivotx.net/2011-10-14/timthumb-update-for-older-pivotx-installs">
<p>If you are still running PivotX 2.2.6, you might be vulnerable
to a security exploit, that was patched previously. Version
2.3.0 doesn't have this issue, but any older version of PivotX
might be vulnerable.</p>
</blockquote>
</body>
</description>
<references>
<bid>48963</bid>
<url>https://secunia.com/advisories/45416/</url>
</references>
<dates>
<discovery>2011-08-03</discovery>
<entry>2011-10-17</entry>
</dates>
</vuln>
<vuln vid="9bad5ab1-f3f6-11e0-8b5c-b482fe3f522d">
<topic>OpenTTD -- Multiple buffer overflows in validation of external data</topic>
<affects>
<package>
<name>openttd</name>
<range><ge>0.1.0</ge><lt>1.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenTTD Team reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3343">
<p>Multiple buffer overflows in OpenTTD before 1.1.3 allow local
users to cause a denial of service (daemon crash) or possibly
gain privileges via (1) a crafted BMP file with RLE compression
or (2) crafted dimensions in a BMP file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3343</cvename>
<url>http://security.openttd.org/en/CVE-2011-3343</url>
</references>
<dates>
<discovery>2011-08-25</discovery>
<entry>2011-10-16</entry>
</dates>
</vuln>
<vuln vid="78c25ed7-f3f9-11e0-8b5c-b482fe3f522d">
<topic>OpenTTD -- Buffer overflows in savegame loading</topic>
<affects>
<package>
<name>openttd</name>
<range><ge>0.1.0</ge><lt>1.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenTTD Team reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3342">
<p>Multiple buffer overflows in OpenTTD before 1.1.3 allow remote
attackers to cause a denial of service (daemon crash) or possibly
execute arbitrary code via vectors related to (1) NAME, (2) PLYR,
(3) CHTS, or (4) AIPL (aka AI config) chunk loading from a
savegame.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3342</cvename>
<url>http://security.openttd.org/en/CVE-2011-3342</url>
</references>
<dates>
<discovery>2011-08-08</discovery>
<entry>2011-10-16</entry>
</dates>
</vuln>
<vuln vid="e77befb5-f3f9-11e0-8b5c-b482fe3f522d">
<topic>OpenTTD -- Denial of service via improperly validated commands</topic>
<affects>
<package>
<name>openttd</name>
<range><ge>0.3.5</ge><lt>1.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenTTD Team reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3341">
<p>Multiple off-by-one errors in order_cmd.cpp in OpenTTD before
1.1.3 allow remote attackers to cause a denial of service (daemon
crash) or possibly execute arbitrary code via a crafted
CMD_INSERT_ORDER command.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3341</cvename>
<url>http://security.openttd.org/en/CVE-2011-3341</url>
</references>
<dates>
<discovery>2011-08-25</discovery>
<entry>2011-10-16</entry>
</dates>
</vuln>
<vuln vid="ab9be2c8-ef91-11e0-ad5a-00215c6a37bb">
<topic>quagga -- multiple vulnerabilities</topic>
<affects>
<package>
<name>quagga</name>
<range><lt>0.99.19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CERT-FI reports:</p>
<blockquote cite="https://www.cert.fi/en/reports/2011/vulnerability539178.html">
<p>Five vulnerabilities have been found in the BGP, OSPF, and
OSPFv3 components of Quagga. The vulnerabilities allow an
attacker to cause a denial of service or potentially to
execute his own code by sending a specially modified packets
to an affected server. Routing messages are typically accepted
from the routing peers. Exploiting these vulnerabilities may
require an established routing session (BGP peering or
OSPF/OSPFv3 adjacency) to the router.</p>
<p>The vulnerability <a href="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3327">CVE-2011-3327</a>
is related to the extended communities handling in BGP
messages. Receiving a malformed BGP update can result
in a buffer overflow and disruption of IPv4 routing.</p>
<p>The vulnerability <a href="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3326">CVE-2011-3326</a>
results from the handling of LSA (Link State Advertisement)
states in the OSPF service. Receiving a modified Link State
Update message with malicious state information can result in
denial of service in IPv4 routing.</p>
<p>The vulnerability <a href="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3325">CVE-2011-3325</a>
is a denial of service vulnerability related to Hello message
handling by the OSPF service. As Hello messages are used to
initiate adjacencies, exploiting the vulnerability may be
feasible from the same broadcast domain without an established
adjacency. A malformed packet may result in denial of service
in IPv4 routing.</p>
<p>The vulnerabilities <a href="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3324">CVE-2011-3324</a>
and <a href="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3323">CVE-2011-3323</a>
are related to the IPv6 routing protocol (OSPFv3) implemented
in ospf6d daemon. Receiving modified Database Description and
Link State Update messages, respectively, can result in denial
of service in IPv6 routing.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3323</cvename>
<cvename>CVE-2011-3324</cvename>
<cvename>CVE-2011-3325</cvename>
<cvename>CVE-2011-3326</cvename>
<cvename>CVE-2011-3327</cvename>
</references>
<dates>
<discovery>2011-09-26</discovery>
<entry>2011-10-05</entry>
</dates>
</vuln>
<vuln vid="1fade8a3-e9e8-11e0-9580-4061862b8c22">
<topic>Mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>4.0,1</gt><lt>7.0,1</lt></range>
<range><gt>3.6.*,1</gt><lt>3.6.23,1</lt></range>
</package>
<package>
<name>libxul</name>
<range><gt>1.9.2.*</gt><lt>1.9.2.23</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>7.0,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.4</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>7.0</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.4</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><gt>4.0</gt><lt>7.0</lt></range>
<range><lt>3.1.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2011-36 Miscellaneous memory safety hazards (rv:7.0 /
rv:1.9.2.23)</p>
<p>MFSA 2011-37 Integer underflow when using JavaScript RegExp</p>
<p>MFSA 2011-38 XSS via plugins and shadowed window.location
object</p>
<p>MFSA 2011-39 Defense against multiple Location headers due to
CRLF Injection</p>
<p>MFSA 2011-40 Code installation through holding down Enter</p>
<p>MFSA 2011-41 Potentially exploitable WebGL crashes</p>
<p>MFSA 2011-42 Potentially exploitable crash in the YARR regular
expression library</p>
<p>MFSA 2011-43 loadSubScript unwraps XPCNativeWrapper scope
parameter</p>
<p>MFSA 2011-44 Use after free reading OGG headers</p>
<p>MFSA 2011-45 Inferring Keystrokes from motion data</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-2372</cvename>
<cvename>CVE-2011-2995</cvename>
<cvename>CVE-2011-2996</cvename>
<cvename>CVE-2011-2997</cvename>
<cvename>CVE-2011-2999</cvename>
<cvename>CVE-2011-3000</cvename>
<cvename>CVE-2011-3001</cvename>
<cvename>CVE-2011-3002</cvename>
<cvename>CVE-2011-3003</cvename>
<cvename>CVE-2011-3004</cvename>
<cvename>CVE-2011-3005</cvename>
<cvename>CVE-2011-3232</cvename>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-36.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-37.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-38.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-39.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-40.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-41.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-42.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-43.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-44.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-45.html</url>
</references>
<dates>
<discovery>2011-09-27</discovery>
<entry>2011-09-28</entry>
</dates>
</vuln>
<vuln vid="53e531a7-e559-11e0-b481-001b2134ef46">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplugin</name>
<range><le>9.0r289</le></range>
</package>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>10.3r183.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe Product Security Incident Response Team reports:</p>
<blockquote cite="https://www.adobe.com/support/security/bulletins/apsb11-26.html">
<p>Critical vulnerabilities have been identified in Adobe Flash
Player 10.3.183.7 and earlier versions for Windows, Macintosh,
Linux and Solaris, and Adobe Flash Player 10.3.186.6 and earlier
versions for Android. These vulnerabilities could cause a crash
and potentially allow an attacker to take control of the
affected system.</p>
<p>There are reports that one of these vulnerabilities
(CVE-2011-2444) is being exploited in the wild in active
targeted attacks designed to trick the user into clicking on
a malicious link delivered in an email message. This universal
cross-site scripting issue could be used to take actions on a
user's behalf on any website or webmail provider if the user
visits a malicious website.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.adobe.com/support/security/bulletins/apsb11-26.html</url>
<cvename>CVE-2011-2426</cvename>
<cvename>CVE-2011-2427</cvename>
<cvename>CVE-2011-2428</cvename>
<cvename>CVE-2011-2429</cvename>
<cvename>CVE-2011-2430</cvename>
<cvename>CVE-2011-2444</cvename>
</references>
<dates>
<discovery>2011-06-06</discovery>
<entry>2011-09-22</entry>
</dates>
</vuln>
<vuln vid="e44fe906-df27-11e0-a333-001cc0a36e12">
<topic>phpMyAdmin -- multiple XSS vulnerabilities</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><lt>3.4.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-14.php">
<p>Firstly, if a row contains javascript code, after inline
editing this row and saving, the code is executed. Secondly,
missing sanitization on the db, table and column names leads
to XSS vulnerabilities.</p>
<p>Versions 3.4.0 to 3.4.4 were found vulnerable.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-14.php</url>
</references>
<dates>
<discovery>2011-09-11</discovery>
<entry>2011-09-14</entry>
</dates>
</vuln>
<vuln vid="d01d10c7-de2d-11e0-b215-00215c6a37bb">
<topic>django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py23-django</name>
<name>py24-django</name>
<name>py25-django</name>
<name>py26-django</name>
<name>py27-django</name>
<name>py30-django</name>
<name>py31-django</name>
<range><ge>1.3</ge><lt>1.3.1</lt></range>
<range><ge>1.2</ge><lt>1.2.7</lt></range>
</package>
<package>
<name>py23-django-devel</name>
<name>py24-django-devel</name>
<name>py25-django-devel</name>
<name>py26-django-devel</name>
<name>py27-django-devel</name>
<name>py30-django-devel</name>
<name>py31-django-devel</name>
<range><lt>16758,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Django project reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2011/sep/09/security-releases-issued/">
<p>Today the Django team is issuing multiple releases --
Django 1.2.6 and Django 1.3.1 -- to remedy security issues
reported to us. Additionally, this announcement contains
advisories for several other issues which, while not
requiring changes to Django itself, will be of concern
to users of Django.</p>
<p>All users are encouraged to upgrade Django, and to implement
the recommendations in these advisories, immediately.</p>
<h3>Session manipulation</h3>
<p>Django's session framework, django.contrib.sessions, is
configurable to use any of multiple backends for storage of
session data. One such backend, provided with Django itself,
integrates with Django's cache framework to use the cache as
storage for session data.</p>
<p>When configured in this fashion using memory-based sessions
and caching, Django sessions are stored directly in the root
namespace of the cache, using session identifiers as keys.</p>
<p>This results in a potential attack when coupled with an
application storing user-supplied data in the cache; if an
attacker can cause data to be cached using a key which is
also a valid session identifier, Django's session framework
will treat that data -- so long as it is a dictionary-like
object -- as the session, thus allowing arbitrary data to be
inserted into a session so long as the attacker knows the
session key.</p>
<h3>Denial of service attack via URLField</h3>
<p>Django's model system includes a field type -- URLField --
which validates that the supplied value is a valid URL, and if
the boolean keyword argument verify_exists is true, attempts
to validate that the supplied URL also resolves, by issuing a
request to it.</p>
<p>By default, the underlying socket libraries in Python do not
have a timeout. This can manifest as a security problem in
three different ways:</p>
<ol>
<li>An attacker can supply a slow-to-respond URL. Each request
will tie up a server process for a period of time; if the
attacker is able to make enough requests, they can tie up
all available server processes.</li>
<li>An attacker can supply a URL under his or her control, and
which will simply hold an open connection indefinitely. Due
to the lack of timeout, the Django process attempting to
verify the URL will similarly spin indefinitely. Repeating
this can easily tie up all available server processes.</li>
<li>An attacker can supply a URL under his or her control
which not only keeps the connection open, but also sends an
unending stream of random garbage data. This data will
cause the memory usage of the Django process (which will
hold the response in memory) to grow without bound, thus
consuming not only server processes but also server
memory.</li>
</ol>
<h3>URLField redirection</h3>
<p>The regular expression which validates URLs is used to check
the supplied URL before issuing a check to verify that it
exists, but if that URL issues a redirect in response to the
request, no validation of the resulting redirected URL is
performed, including basic checks for supported protocols
(HTTP, HTTPS, and FTP).</p>
<p>This creates a small window for an attacker to gain knowledge
of, for example, server layout; a redirect to a file:// URL,
for example, will tell an attacker whether a given file exists
locally on the server.</p>
<p>Additionally, although the initial request issued by Django
uses the HEAD method for HTTP/HTTPS, the request to the target
of the redirect is issued using GET. This may create further
issues for systems which implicitly trust GET requests from
the local machine/network.</p>
<h3>Host header cache poisoning</h3>
<p>In several places, Django itself -- independent of the
developer -- generates full URLs (for example, when issuing
HTTP redirects). Currently this uses the value of the HTTP
Host header from the request to construct the URL, which opens
a potential cache-poisoning vector: an attacker can submit
a request with a Host header of his or her choice, receive a
response which constructs URLs using that Host header, and --
if that response is cached -- further requests will be served
out of cache using URLs containing the attacker's host of
choice.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.djangoproject.com/weblog/2011/sep/09/security-releases-issued/</url>
</references>
<dates>
<discovery>2011-09-09</discovery>
<entry>2011-09-13</entry>
<modified>2011-11-01</modified>
</dates>
</vuln>
<vuln vid="4ae68e7c-dda4-11e0-a906-00215c6a37bb">
<topic>roundcube -- XSS vulnerability</topic>
<affects>
<package>
<name>roundcube</name>
<range><lt>0.5.4,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>RoundCube development Team reports:</p>
<blockquote cite="http://sourceforge.net/news/?group_id=139281&amp;id=302769">
<p>We just published a new release which fixes a recently
reported XSS vulnerability as an update to the stable 0.5
branch. Please update your installations with this new
version or patch them with the fix which is also published
in the downloads section or our sourceforge.net page.</p>
</blockquote>
<p>and:</p>
<blockquote cite="http://trac.roundcube.net/ticket/1488030">
<p>During one of pen-tests I found that _mbox parameter is not
properly sanitized and reflected XSS attack is possible.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-2937</cvename>
</references>
<dates>
<discovery>2011-08-09</discovery>
<entry>2011-09-13</entry>
</dates>
</vuln>
<vuln vid="b9f3ffa3-dd6c-11e0-b7fc-000a5e1e33c6">
<topic>libsndfile -- PAF file processing integer overflow</topic>
<affects>
<package>
<name>libsndfile</name>
<range><lt>1.0.25</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/45125/">
<p>Hossein Lotfi has discovered a vulnerability in libsndfile,
which can be exploited by malicious people to potentially
compromise an application using the library. The vulnerability
is caused due to an integer overflow error in the "paf24_init()"
function (src/paf.c) when processing Paris Audio (PAF) files.
This can be exploited to cause a heap-based buffer overflow via
a specially crafted file. Successful exploitation may allow
execution of arbitrary code. The vulnerability is confirmed in
version 1.0.24. Other versions may also be affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-2696</cvename>
<url>http://secunia.com/advisories/45125/</url>
</references>
<dates>
<discovery>2011-07-12</discovery>
<entry>2011-09-12</entry>
</dates>
</vuln>
<vuln vid="2ecb7b20-d97e-11e0-b2e2-00215c6a37bb">
<topic>OpenSSL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><ge>1.0.0</ge><lt>1.0.0_6</lt></range>
<range><ge>0.9.8</ge><lt>1.0.0</lt></range>
</package>
<package>
<name>linux-f10-openssl</name>
<range><ge>0.9.8</ge><lt>0.9.8r</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSSL Team reports:</p>
<blockquote cite="http://openssl.org/news/secadv_20110906.txt">
<p>Two security flaws have been fixed in OpenSSL 1.0.0e</p>
<p>Under certain circumstances OpenSSL's internal certificate
verification routines can incorrectly accept a CRL whose
nextUpdate field is in the past. (CVE-2011-3207)</p>
<p>OpenSSL server code for ephemeral ECDH ciphersuites is not
thread-safe, and furthermore can crash if a client violates
the protocol by sending handshake messages in incorrect
order. (CVE-2011-3210)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3207</cvename>
<cvename>CVE-2011-3210</cvename>
<url>http://www.openssl.org/news/secadv_20110906.txt</url>
</references>
<dates>
<discovery>2011-09-06</discovery>
<entry>2011-09-07</entry>
<modified>2014-04-10</modified>
</dates>
</vuln>
<vuln vid="a83f25df-d775-11e0-8bf1-003067b2972c">
<topic>XSS issue in MantisBT</topic>
<affects>
<package>
<name>mantis</name>
<range><ge>1.2.0</ge><lt>1.2.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="http://www.mantisbt.org/blog/?p=142">
<p>Net.Edit0r from BlACK Hat Group reported an XSS issue in
search.php. All MantisBT users (including anonymous users that
are not logged in to public bug trackers) could be impacted by
this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/160368</freebsdpr>
<cvename>CVE-2011-2938</cvename>
</references>
<dates>
<discovery>2011-08-18</discovery>
<entry>2011-09-05</entry>
</dates>
</vuln>
<vuln vid="e55f948f-d729-11e0-abd1-0017f22d6707">
<topic>security/cfs -- buffer overflow</topic>
<affects>
<package>
<name>cfs</name>
<range><le>1.4.1_6</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Debian reports:</p>
<blockquote cite="http://www.debian.org/security/2002/dsa-116">
<p>Zorgon found several buffer overflows in cfsd, a daemon that
pushes encryption services into the Unix(tm) file system.
We are not yet sure if these overflows can successfully be
exploited to gain root access to the machine running the CFS
daemon. However, since cfsd can easily be forced to die, a
malicious user can easily perform a denial of service attack
to it.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2002-0351</cvename>
<url>http://www.debian.org/security/2002/dsa-116</url>
</references>
<dates>
<discovery>2002-03-02</discovery>
<entry>2011-09-04</entry>
</dates>
</vuln>
<vuln vid="1b27af46-d6f6-11e0-89a6-080027ef73ec">
<topic>ca_root_nss -- extraction of explicitly-untrusted certificates into trust bundle</topic>
<affects>
<package>
<name>ca_root_nss</name>
<range><lt>3.12.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matthias Andree reports that the ca-bundle.pl used in older
versions of the ca_root_nss FreeBSD port before 3.12.11 did not
take the Mozilla/NSS/CKBI untrusted markers into account and
would add certificates to the trust bundle that were marked
unsafe by Mozilla.</p>
</body>
</description>
<references>
<freebsdpr>ports/160455</freebsdpr>
</references>
<dates>
<discovery>2011-09-04</discovery>
<entry>2011-09-04</entry>
</dates>
</vuln>
<vuln vid="aa5bc971-d635-11e0-b3cf-080027ef73ec">
<topic>nss/ca_root_nss -- fraudulent certificates issued by DigiNotar.nl</topic>
<affects>
<package>
<name>nss</name>
<range><lt>3.12.11</lt></range>
<!-- this builds on the assumption that 3.12.11 in ports actually
contains the CKBI 1.87 update to the built-in certificates
as commited by kwm@ on September 3rd, 2011 -->
</package>
<package>
<name>ca_root_nss</name>
<range><lt>3.12.11</lt></range>
<!-- this builds on the assumption that 3.12.11 in ports actually
contains the CKBI 1.87 update to the built-in certificates
as commited by mandree@ on September 4th, 2011 -->
</package>
<package>
<name>firefox</name>
<range><gt>3.6.*,1</gt><lt>3.6.22,1</lt></range>
<range><gt>4.0.*,1</gt><lt>6.0.2,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.3.2</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>3.6.22,1</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><gt>3.1.*</gt><lt>3.1.14</lt></range>
<range><gt>5.0.*</gt><lt>6.0.2</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>3.1.14</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.3.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Heather Adkins, Google's Information Security Manager, reported that
Google received</p>
<blockquote cite="http://googleonlinesecurity.blogspot.com/2011/08/update-on-attempted-man-in-middle.html">
<p>[...] reports of attempted SSL man-in-the-middle (MITM)
attacks against Google users, whereby someone tried to get between
them and encrypted Google services. The people affected were
primarily located in Iran. The attacker used a fraudulent SSL
certificate issued by DigiNotar, a root certificate authority that
should not issue certificates for Google (and has since revoked
it). [...]</p>
</blockquote>
<p>VASCO Data Security International Inc., owner of DigiNotar, issued a
press statement confirming this incident:</p>
<blockquote cite="http://www.vasco.com/company/press_room/news_archive/2011/news_diginotar_reports_security_incident.aspx">
<p>On July 19th 2011, DigiNotar detected an intrusion
into its Certificate Authority (CA) infrastructure, which resulted
in the fraudulent issuance of public key certificate requests for
a number of domains, including Google.com. [...] an external
security audit concluded that all fraudulently issued certificates
were
revoked. Recently, it was discovered that at least one fraudulent
certificate had not been revoked at the time. [...]</p>
</blockquote>
<p>Mozilla, maintainer of the NSS package, from which FreeBSD derived
ca_root_nss, stated that they:</p>
<blockquote cite="https://blog.mozilla.com/security/2011/09/02/diginotar-removal-follow-up/">
<p>revoked our trust in the DigiNotar certificate authority from
all Mozilla software. This is not a temporary suspension, it is
a complete removal from our trusted root program. Complete
revocation of trust is a decision we treat with careful
consideration, and employ as a last resort.
</p><p>Three central issues informed our decision:</p>
<ol><li>Failure to notify. [...]</li>
<li>The scope of the breach remains unknown. [...]</li>
<li>The attack is not theoretical.</li></ol>
</blockquote>
</body>
</description>
<references>
<url>http://www.vasco.com/company/press_room/news_archive/2011/news_diginotar_reports_security_incident.aspx</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-34.html</url>
<url>http://googleonlinesecurity.blogspot.com/2011/08/update-on-attempted-man-in-middle.html</url>
</references>
<dates>
<discovery>2011-07-19</discovery>
<entry>2011-09-03</entry>
<modified>2011-09-06</modified>
</dates>
</vuln>
<vuln vid="7f6108d2-cea8-11e0-9d58-0800279895ea">
<topic>apache -- Range header DoS vulnerability</topic>
<affects>
<package>
<name>apache</name>
<name>apache-event</name>
<name>apache-itk</name>
<name>apache-peruser</name>
<name>apache-worker</name>
<range><gt>2.*</gt><lt>2.2.20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache HTTP server project reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3192">
<p>A denial of service vulnerability has been found in the way
the multiple overlapping ranges are handled by Apache HTTPD
server.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3192</cvename>
<url>https://people.apache.org/~dirkx/CVE-2011-3192.txt</url>
<url>https://svn.apache.org/viewvc?view=revision&amp;revision=1161534</url>
<url>https://svn.apache.org/viewvc?view=revision&amp;revision=1162874</url>
</references>
<dates>
<discovery>2011-08-24</discovery>
<entry>2011-08-30</entry>
<modified>2011-09-01</modified>
</dates>
</vuln>
<vuln vid="cdeb34e6-d00d-11e0-987e-00215c6a37bb">
<topic>stunnel -- heap corruption vulnerability</topic>
<affects>
<package>
<name>stunnel</name>
<range><ge>4.40</ge><lt>4.42</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Michal Trojnara reports:</p>
<blockquote cite="http://www.stunnel.org/pipermail/stunnel-announce/2011-August/000059.html">
<p>Version 4.42, 2011.08.18, urgency: HIGH:</p>
<p>Fixed a heap corruption vulnerability in versions 4.40 and 4.41.
It may possibly be leveraged to perform DoS or remote code
execution attacks.</p>
</blockquote>
</body>
</description>
<references>
<bid>49254</bid>
<cvename>CVE-2011-2940</cvename>
</references>
<dates>
<discovery>2011-08-25</discovery>
<entry>2011-08-26</entry>
</dates>
</vuln>
<vuln vid="75e26236-ce9e-11e0-b26a-00215c6a37bb">
<topic>phpMyAdmin -- multiple XSS vulnerabilities</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><lt>3.4.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-13.php">
<p>Multiple XSS in the Tracking feature.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3181</cvename>
</references>
<dates>
<discovery>2011-08-24</discovery>
<entry>2011-08-24</entry>
</dates>
</vuln>
<vuln vid="3f1df2f9-cd22-11e0-9bb2-00215c6a37bb">
<topic>PHP -- crypt() returns only the salt for MD5</topic>
<affects>
<package>
<name>php5</name>
<range><ge>5.3.7</ge><lt>5.3.7_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PHP development team reports:</p>
<blockquote cite="https://bugs.php.net/bug.php?id=55439">
<p>If crypt() is executed with MD5 salts, the return value
consists of the salt only. DES and BLOWFISH salts work as
expected.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.php.net/bug.php?id=55439</url>
</references>
<dates>
<discovery>2011-08-17</discovery>
<entry>2011-08-23</entry>
<modified>2011-08-30</modified>
</dates>
</vuln>
<vuln vid="057bf770-cac4-11e0-aea3-00215c6a37bb">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php5</name>
<name>php5-sockets</name>
<range><lt>5.3.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PHP development team reports:</p>
<blockquote cite="http://www.php.net/ChangeLog-5.php#5.3.7">
<p>Security Enhancements and Fixes in PHP 5.3.7:</p>
<ul>
<li>Updated crypt_blowfish to 1.2. (CVE-2011-2483)</li>
<li>Fixed crash in error_log(). Reported by Mateusz
Kocielski</li>
<li>Fixed buffer overflow on overlog salt in crypt().</li>
<li>Fixed bug #54939 (File path injection vulnerability
in RFC1867 File upload filename). Reported by Krzysztof
Kotowicz. (CVE-2011-2202)</li>
<li>Fixed stack buffer overflow in socket_connect().
(CVE-2011-1938)</li>
<li>Fixed bug #54238 (use-after-free in substr_replace()).
(CVE-2011-1148)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<bid>49241</bid>
<cvename>CVE-2011-2483</cvename>
<cvename>CVE-2011-2202</cvename>
<cvename>CVE-2011-1938</cvename>
<cvename>CVE-2011-1148</cvename>
</references>
<dates>
<discovery>2011-08-18</discovery>
<entry>2011-08-20</entry>
</dates>
</vuln>
<vuln vid="be77eff6-ca91-11e0-aea3-00215c6a37bb">
<topic>rubygem-rails -- multiple vulnerabilities</topic>
<affects>
<package>
<name>rubygem-rails</name>
<range><lt>3.0.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SecurityFocus reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/49179/discuss">
<p>Ruby on Rails is prone to multiple vulnerabilities
including SQL-injection, information-disclosure,
HTTP-header-injection, security-bypass and cross-site
scripting issues.</p>
</blockquote>
</body>
</description>
<references>
<bid>49179</bid>
<url>http://groups.google.com/group/rubyonrails-security/browse_thread/thread/6a1e473744bc389b</url>
<url>http://groups.google.com/group/rubyonrails-security/browse_thread/thread/3420ac71aed312d6</url>
<url>http://groups.google.com/group/rubyonrails-security/browse_thread/thread/6ffc93bde0298768</url>
<url>http://groups.google.com/group/rubyonrails-security/browse_thread/thread/2b9130749b74ea12</url>
<url>http://groups.google.com/group/rubyonrails-security/browse_thread/thread/56bffb5923ab1195</url>
</references>
<dates>
<discovery>2011-08-16</discovery>
<entry>2011-08-19</entry>
</dates>
</vuln>
<vuln vid="0b53f5f7-ca8a-11e0-aea3-00215c6a37bb">
<topic>dovecot -- denial of service vulnerability</topic>
<affects>
<package>
<name>dovecot</name>
<range><lt>1.2.17</lt></range>
<range><gt>2.0</gt><lt>2.0.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Timo Sirainen reports:</p>
<blockquote cite="http://dovecot.org/pipermail/dovecot/2011-May/059086.html">
<p> Fixed potential crashes and other problems when parsing header
names that contained NUL characters.</p>
</blockquote>
</body>
</description>
<references>
<bid>47930</bid>
<cvename>CVE-2011-1929</cvename>
</references>
<dates>
<discovery>2011-05-25</discovery>
<entry>2011-08-19</entry>
</dates>
</vuln>
<vuln vid="86baa0d4-c997-11e0-8a8e-00151735203a">
<topic>OTRS -- Vulnerabilities in OTRS-Core allows read access to any file on local file system</topic>
<affects>
<package>
<name>otrs</name>
<range><gt>2.1.*</gt><lt>3.0.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OTRS Security Advisory reports:</p>
<blockquote cite="http://otrs.org/advisory/OSA-2011-03-en/">
<ul>
<li>An attacker with valid session and admin permissions could
get read access to any file on the servers local operating
system. For this it would be needed minimum one installed
OTRS package.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-2746</cvename>
<url>http://otrs.org/advisory/OSA-2011-03-en/</url>
</references>
<dates>
<discovery>2011-08-16</discovery>
<entry>2011-08-18</entry>
</dates>
</vuln>
<vuln vid="834591a9-c82f-11e0-897d-6c626dd55a41">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>3.6.*,1</gt><lt>3.6.20,1</lt></range>
<range><gt>5.0.*,1</gt><lt>6.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.3</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>3.6.20,1</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>3.1.12</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>3.1.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2011-29 Security issues addressed in Firefox 6</p>
<p>MFSA 2011-28 Security issues addressed in Firefox 3.6.20</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-29.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-30.html</url>
<cvename>CVE-2011-2982</cvename>
<cvename>CVE-2011-0084</cvename>
<cvename>CVE-2011-2981</cvename>
<cvename>CVE-2011-2378</cvename>
<cvename>CVE-2011-2984</cvename>
<cvename>CVE-2011-2980</cvename>
<cvename>CVE-2011-2983</cvename>
<cvename>CVE-2011-2989</cvename>
<cvename>CVE-2011-2991</cvename>
<cvename>CVE-2011-2992</cvename>
<cvename>CVE-2011-2985</cvename>
<cvename>CVE-2011-2993</cvename>
<cvename>CVE-2011-2988</cvename>
<cvename>CVE-2011-2987</cvename>
<cvename>CVE-2011-0084</cvename>
<cvename>CVE-2011-2990</cvename>
<cvename>CVE-2011-2986</cvename>
</references>
<dates>
<discovery>2011-08-16</discovery>
<entry>2011-08-16</entry>
</dates>
</vuln>
<vuln vid="56f4b3a6-c82c-11e0-a498-00215c6a37bb">
<topic>Samba -- cross site scripting and request forgery vulnerabilities</topic>
<affects>
<package>
<name>samba34</name>
<range><gt>3.4.*</gt><lt>3.4.14</lt></range>
</package>
<package>
<name>samba35</name>
<range><gt>3.5.*</gt><lt>3.5.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Samba security advisory reports:</p>
<blockquote cite="http://www.samba.org/samba/security/CVE-2011-2522">
<p>All current released versions of Samba are vulnerable to a
cross-site request forgery in the Samba Web Administration Tool
(SWAT). By tricking a user who is authenticated with SWAT into
clicking a manipulated URL on a different web page, it is
possible to manipulate SWAT.</p>
</blockquote>
<blockquote cite="http://www.samba.org/samba/security/CVE-2011-2694">
<p>All current released versions of Samba are vulnerable to a
cross-site scripting issue in the Samba Web Administration Tool
(SWAT). On the "Change Password" field, it is possible to insert
arbitrary content into the "user" field.</p>
</blockquote>
</body>
</description>
<references>
<bid>48901</bid>
<bid>48899</bid>
<cvename>CVE-2011-2522</cvename>
<cvename>CVE-2011-2694</cvename>
</references>
<dates>
<discovery>2011-07-27</discovery>
<entry>2011-08-16</entry>
</dates>
</vuln>
<vuln vid="510b630e-c43b-11e0-916c-00e0815b8da8">
<topic>isc-dhcp-server -- server halt upon processing certain packets</topic>
<affects>
<package>
<name>isc-dhcp31-server</name>
<range><lt>3.1.ESV_1,1</lt></range>
</package>
<package>
<name>isc-dhcp41-server</name>
<range><lt>4.1.e_2,2</lt></range>
</package>
<package>
<name>isc-dhcp42-server</name>
<range><lt>4.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="http://www.isc.org/software/dhcp/advisories/cve-2011-2748">
<p>A pair of defects cause the server to halt upon processing
certain packets. The patch is to properly discard or process
those packets.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-2748</cvename>
<cvename>CVE-2011-2749</cvename>
</references>
<dates>
<discovery>2011-08-10</discovery>
<entry>2011-08-13</entry>
</dates>
</vuln>
<vuln vid="dc8741b9-c5d5-11e0-8a8e-00151735203a">
<topic>bugzilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>bugzilla</name>
<range><ge>2.4.*</ge><lt>3.6.6</lt></range>
<range><ge>4.0.*</ge><lt>4.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Bugzilla Security Advisory reports:</p>
<blockquote cite="http://www.bugzilla.org/security/3.4.11/">
<p>The following security issues have been discovered in Bugzilla:</p>
<ul>
<li>Internet Explorer 8 and older, and Safari before 5.0.6 do
content sniffing when viewing a patch in "Raw Unified" mode,
which could trigger a cross-site scripting attack due to
the execution of malicious code in the attachment.</li>
<li>It is possible to determine whether or not certain group
names exist while creating or updating bugs.</li>
<li>Attachment descriptions with a newline in them could lead
to the injection of crafted headers in email notifications sent
to the requestee or the requester when editing an attachment
flag.</li>
<li>If an attacker has access to a user's session, he can modify
that user's email address without that user being notified
of the change.</li>
<li>Temporary files for uploaded attachments are not deleted
on Windows, which could let a user with local access to
the server read them.</li>
<li>Up to Bugzilla 3.4.11, if a BUGLIST cookie is compromised,
it can be used to inject HTML code when viewing a bug report,
leading to a cross-site scripting attack.</li>
</ul>
<p>All affected installations are encouraged to upgrade as soon as
possible.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-2379</cvename>
<cvename>CVE-2011-2380</cvename>
<cvename>CVE-2011-2979</cvename>
<cvename>CVE-2011-2381</cvename>
<cvename>CVE-2011-2978</cvename>
<cvename>CVE-2011-2977</cvename>
<cvename>CVE-2011-2976</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=637981</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=653477</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=674497</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=657158</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=670868</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=660502</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=660053</url>
</references>
<dates>
<discovery>2011-08-04</discovery>
<entry>2011-08-13</entry>
</dates>
</vuln>
<vuln vid="879b0242-c5b6-11e0-abd1-0017f22d6707">
<topic>dtc -- multiple vulnerabilities</topic>
<affects>
<package>
<name>dtc</name>
<range><lt>0.32.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ansgar Burchardt reports:</p>
<blockquote cite="http://www.debian.org/security/2011/dsa-2179">
<p>Ansgar Burchardt discovered several vulnerabilities in DTC, a
web control panel for admin and accounting hosting services:
The bw_per_moth.php graph contains an SQL injection
vulnerability; insufficient checks in bw_per_month.php can lead
to bandwidth usage information disclosure; after a registration,
passwords are sent in cleartext email messages and Authenticated
users could delete accounts using an obsolete interface which
was incorrectly included in the package.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-0434</cvename>
<cvename>CVE-2011-0435</cvename>
<cvename>CVE-2011-0436</cvename>
<cvename>CVE-2011-0437</cvename>
<url>http://www.debian.org/security/2011/dsa-2179</url>
</references>
<dates>
<discovery>2011-03-02</discovery>
<entry>2011-08-13</entry>
</dates>
</vuln>
<vuln vid="304409c3-c3ef-11e0-8aa5-485d60cb5385">
<topic>libXfont -- possible local privilege escalation</topic>
<affects>
<package>
<name>libXfont</name>
<range><lt>1.4.4_1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tomas Hoger reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=725760">
<p>The compress/ LZW decompress implentation does not correctly
handle compressed streams that contain code words that were not
yet added to the decompression table. This may lead to
arbitrary memory corruption. Successfull exploitation may
possible lead to a local privilege escalation.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-2895</cvename>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=725760</url>
</references>
<dates>
<discovery>2011-07-26</discovery>
<entry>2011-08-11</entry>
<modified>2012-03-13</modified>
</dates>
</vuln>
<vuln vid="5d374b01-c3ee-11e0-8aa5-485d60cb5385">
<topic>freetype2 -- execute arbitrary code or cause denial of service</topic>
<affects>
<package>
<name>freetype2</name>
<range><lt>2.4.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Vincent Danen reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-0226">
<p>Due to an error within the t1_decoder_parse_charstrings()
function (src/psaux/t1decode.c) and can be exploited to corrupt
memory by tricking a user into processing a specially-crafted
postscript Type1 font in an application that uses the freetype
library.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-0226</cvename>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-0226</url>
</references>
<dates>
<discovery>2011-07-19</discovery>
<entry>2011-08-11</entry>
</dates>
</vuln>
<vuln vid="2c12ae0c-c38d-11e0-8eb7-001b2134ef46">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplugin</name>
<range><le>9.0r289</le></range>
</package>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>10.3r183.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe Product Security Incident Response Team reports:</p>
<blockquote cite="https://www.adobe.com/support/security/bulletins/apsb11-21.html">
<p>Critical vulnerabilities have been identified in Adobe Flash
Player 10.3.181.36 and earlier versions for Windows, Macintosh,
Linux and Solaris, and Adobe Flash Player 10.3.185.25 and
earlier versions for Android. These vulnerabilities could
cause a crash and potentially allow an attacker to take control
of the affected system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-2130</cvename>
<cvename>CVE-2011-2134</cvename>
<cvename>CVE-2011-2135</cvename>
<cvename>CVE-2011-2136</cvename>
<cvename>CVE-2011-2137</cvename>
<cvename>CVE-2011-2138</cvename>
<cvename>CVE-2011-2139</cvename>
<cvename>CVE-2011-2140</cvename>
<cvename>CVE-2011-2414</cvename>
<cvename>CVE-2011-2415</cvename>
<cvename>CVE-2011-2416</cvename>
<cvename>CVE-2011-2417</cvename>
<cvename>CVE-2011-2425</cvename>
<url>https://www.adobe.com/support/security/bulletins/apsb11-21.html</url>
</references>
<dates>
<discovery>2011-05-13</discovery>
<entry>2011-08-10</entry>
<modified>2012-11-05</modified>
</dates>
</vuln>
<vuln vid="30cb4522-b94d-11e0-8182-485d60cb5385">
<topic>libsoup -- unintentionally allow access to entire local filesystem</topic>
<affects>
<package>
<name>libsoup</name>
<range><lt>2.32.2_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Dan Winship reports:</p>
<blockquote cite="http://mail.gnome.org/archives/ftp-release-list/2011-July/msg00176.html">
<p>Fixed a security hole that caused some SoupServer users to
unintentionally allow accessing the entire local filesystem when
they thought they were only providing access to a single
directory.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-2054</cvename>
<url>http://mail.gnome.org/archives/ftp-release-list/2011-July/msg00176.html</url>
<url>https://bugzilla.gnome.org/show_bug.cgi?id=653258</url>
</references>
<dates>
<discovery>2011-06-23</discovery>
<entry>2011-07-28</entry>
</dates>
</vuln>
<vuln vid="d79fc873-b5f9-11e0-89b4-001ec9578670">
<topic>phpmyadmin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><lt>3.4.3.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-9.php">
<p>XSS in table Print view.</p>
</blockquote>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-10.php">
<p>Via a crafted MIME-type transformation parameter, an attacker can
perform a local file inclusion.</p>
</blockquote>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-11.php">
<p>In the 'relational schema' code a parameter was not sanitized before
being used to concatenate a class name.</p>
<p>The end result is a local file inclusion vulnerability and code
execution.</p>
</blockquote>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-12.php">
<p>It was possible to manipulate the PHP session superglobal using
some of the Swekey authentication code.</p>
<p>This is very similar to PMASA-2011-5, documented in
7e4e5c53-a56c-11e0-b180-00216aa06fc2</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-2642</cvename>
<cvename>CVE-2011-2643</cvename>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-9.php</url>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-10.php</url>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-11.php</url>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-12.php</url>
</references>
<dates>
<discovery>2011-07-23</discovery>
<entry>2011-07-24</entry>
<modified>2011-07-28</modified>
</dates>
</vuln>
<vuln vid="9f14cb36-b6fc-11e0-a044-445c73746d79">
<topic>opensaml2 -- unauthenticated login</topic>
<affects>
<package>
<name>opensaml2</name>
<range><gt>0</gt><lt>2.4.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSAML developer reports:</p>
<blockquote cite="http://shibboleth.internet2.edu/secadv/secadv_20110725.txt">
<p>The Shibboleth software relies on the OpenSAML libraries to
perform verification of signed XML messages such as attribute
queries or SAML assertions. Both the Java and C++ versions are
vulnerable to a so-called "wrapping attack" that allows a remote,
unauthenticated attacker to craft specially formed messages that
can be successfully verified, but contain arbitrary content.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-1411</cvename>
<mlist msgid="CA530061.113D6%cantor.2@osu.edu">https://groups.google.com/a/shibboleth.net/group/announce/browse_thread/thread/cf3e0d76afbb57d9</mlist>
</references>
<dates>
<discovery>2011-07-25</discovery>
<entry>2011-07-25</entry>
</dates>
</vuln>
<vuln vid="9a777c23-b310-11e0-832d-00215c6a37bb">
<topic>rsync -- incremental recursion memory corruption vulnerability</topic>
<affects>
<package>
<name>rsync</name>
<range><gt>3.0</gt><lt>3.0.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>rsync development team reports:</p>
<blockquote cite="http://rsync.samba.org/ftp/rsync/src/rsync-3.0.8-NEWS">
<p>Fixed a data-corruption issue when preserving hard-links
without preserving file ownership, and doing deletions either
before or during the transfer (CVE-2011-1097). This
fixes some assert errors in the hard-linking code, and some
potential failed checksums (via -c) that should have matched.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-1097</cvename>
<url>https://bugzilla.samba.org/show_bug.cgi?id=7936</url>
</references>
<dates>
<discovery>2011-04-08</discovery>
<entry>2011-07-20</entry>
</dates>
</vuln>
<vuln vid="fd64188d-a71d-11e0-89b4-001ec9578670">
<topic>BIND -- Remote DoS against authoritative and recursive servers</topic>
<affects>
<package>
<name>bind96</name>
<range><lt>9.6.3.1.ESV.R4.3</lt></range>
</package>
<package>
<name>bind97</name>
<range><lt>9.7.3.3</lt></range>
</package>
<package>
<name>bind98</name>
<range><lt>9.8.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://www.isc.org/software/bind/advisories/cve-2011-2464">
<p>A defect in the affected BIND 9 versions allows an attacker to
remotely cause the "named" process to exit using a specially
crafted packet.</p>
<p>This defect affects both recursive and authoritative servers.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-2464</cvename>
<url>https://www.isc.org/software/bind/advisories/cve-2011-2464</url>
</references>
<dates>
<discovery>2011-07-05</discovery>
<entry>2011-07-05</entry>
</dates>
</vuln>
<vuln vid="4ccee784-a721-11e0-89b4-001ec9578670">
<topic>BIND -- Remote DoS with certain RPZ configurations</topic>
<affects>
<package>
<name>bind98</name>
<range><lt>9.8.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://www.isc.org/software/bind/advisories/cve-2011-2465">
<p>Two defects were discovered in ISC's BIND 9.8 code. These
defects only affect BIND 9.8 servers which have recursion
enabled and which use a specific feature of the software known
as Response Policy Zones (RPZ) and where the RPZ zone contains
a specific rule/action pattern.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-2465</cvename>
<url>https://www.isc.org/software/bind/advisories/cve-2011-2465</url>
</references>
<dates>
<discovery>2011-07-05</discovery>
<entry>2011-07-05</entry>
</dates>
</vuln>
<vuln vid="7e4e5c53-a56c-11e0-b180-00216aa06fc2">
<topic>phpmyadmin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><lt>3.4.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-5.php">
<p>It was possible to manipulate the PHP session superglobal using
some of the Swekey authentication code. This could open a path
for other attacks.</p>
</blockquote>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-6.php">
<p>An unsanitized key from the Servers array is written in a comment
of the generated config. An attacker can modify this key by
modifying the SESSION superglobal array. This allows the attacker
to close the comment and inject code.</p>
</blockquote>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-7.php">
<p>Through a possible bug in PHP running on Windows systems a NULL
byte can truncate the pattern string allowing an attacker to
inject the /e modifier causing the preg_replace function to
execute its second argument as PHP code.</p>
</blockquote>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-8.php">
<p>Fixed filtering of a file path in the MIME-type transformation
code, which allowed for directory traversal.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-2505</cvename>
<cvename>CVE-2011-2506</cvename>
<cvename>CVE-2011-2507</cvename>
<cvename>CVE-2011-2508</cvename>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-5.php</url>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-6.php</url>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-7.php</url>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-8.php</url>
</references>
<dates>
<discovery>2011-07-02</discovery>
<entry>2011-07-03</entry>
<modified>2011-07-28</modified>
</dates>
</vuln>
<vuln vid="40544e8c-9f7b-11e0-9bec-6c626dd55a41">
<topic>Asterisk -- multiple vulnerabilities</topic>
<affects>
<package>
<name>asterisk14</name>
<range><gt>1.4.*</gt><lt>1.4.41.2</lt></range>
</package>
<package>
<name>asterisk16</name>
<range><gt>1.6.*</gt><lt>1.6.2.18.2</lt></range>
</package>
<package>
<name>asterisk18</name>
<range><gt>1.8.*</gt><lt>1.8.4.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk Development Team reports:</p>
<blockquote cite="http://www.asterisk.org/node/51650">
<p>AST-2011-008: If a remote user sends a SIP packet containing a
NULL, Asterisk assumes available data extends past the null to
the end of the packet when the buffer is actually truncated when
copied. This causes SIP header parsing to modify data past the
end of the buffer altering unrelated memory structures. This
vulnerability does not affect TCP/TLS connections.</p>
<p>AST-2011-009: A remote user sending a SIP packet containing a
Contact header with a missing left angle bracket causes Asterisk
to access a null pointer.</p>
<p>AST-2011-010: A memory address was inadvertently transmitted
over the network via IAX2 via an option control frame and the
remote party would try to access it.</p>
<p>Possible enumeration of SIP users due to differing
authentication responses.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-2529</cvename>
<cvename>CVE-2011-2535</cvename>
<cvename>CVE-2011-2536</cvename>
<url>http://downloads.asterisk.org/pub/security/AST-2011-008.html</url>
<url>http://downloads.asterisk.org/pub/security/AST-2011-009.html</url>
<url>http://downloads.asterisk.org/pub/security/AST-2011-010.html</url>
<url>http://downloads.asterisk.org/pub/security/AST-2011-011.html</url>
</references>
<dates>
<discovery>2011-06-24</discovery>
<entry>2011-06-25</entry>
<modified>2011-06-29</modified>
</dates>
</vuln>
<vuln vid="01d3ab7d-9c43-11e0-bc0f-0014a5e3cda6">
<topic>ejabberd -- remote denial of service vulnerability</topic>
<affects>
<package>
<name>ejabberd</name>
<range><lt>2.1.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>It's reported in CVE advisory that:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1753">
<p>expat_erl.c in ejabberd before 2.1.7 and 3.x before
3.0.0-alpha-3, and exmpp before 0.9.7, does not properly detect
recursion during entity expansion, which allows remote attackers
to cause a denial of service (memory and CPU consumption) via a
crafted XML document containing a large number of nested entity
references, a similar issue to CVE-2003-1564.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-1753</cvename>
<url>http://www.ejabberd.im/ejabberd-2.1.7</url>
</references>
<dates>
<discovery>2011-04-27</discovery>
<entry>2011-06-24</entry>
</dates>
</vuln>
<vuln vid="dfe40cff-9c3f-11e0-9bec-6c626dd55a41">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>3.5.*,1</gt><lt>3.5.20,1</lt></range>
<range><gt>3.6.*,1</gt><lt>3.6.18,1</lt></range>
<range><gt>4.0.*,1</gt><lt>5.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>3.6.18,1</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>3.1.11</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>3.1.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2011-19 Miscellaneous memory safety hazards
(rv:3.0/1.9.2.18)</p>
<p>MFSA 2011-20 Use-after-free vulnerability when viewing XUL
document with script disabled</p>
<p>MFSA 2011-21 Memory corruption due to multipart/x-mixed-replace
images</p>
<p>MFSA 2011-22 Integer overflow and arbitrary code execution in
Array.reduceRight()</p>
<p>MFSA 2011-23 Multiple dangling pointer vulnerabilities</p>
<p>MFSA 2011-24 Cookie isolation error</p>
<p>MFSA 2011-25 Stealing of cross-domain images using WebGL
textures</p>
<p>MFSA 2011-26 Multiple WebGL crashes</p>
<p>MFSA 2011-27 XSS encoding hazard with inline SVG</p>
<p>MFSA 2011-28 Non-whitelisted site can trigger xpinstall</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-19.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-20.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-21.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-22.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-23.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-24.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-25.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-26.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-27.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-28.html</url>
</references>
<dates>
<discovery>2011-06-21</discovery>
<entry>2011-06-21</entry>
<modified>2011-06-23</modified>
</dates>
</vuln>
<vuln vid="bfdbc7ec-9c3f-11e0-9bec-6c626dd55a41">
<topic>Samba -- Denial of service - memory corruption</topic>
<affects>
<package>
<name>samba34</name>
<range><gt>3.4.*</gt><lt>3.4.12</lt></range>
</package>
<package>
<name>samba35</name>
<range><gt>3.5.*</gt><lt>3.5.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Samba team reports:</p>
<blockquote cite="http://www.samba.org/samba/security/CVE-2011-0719.html">
<p>Samba is vulnerable to a denial of service, caused by a memory
corruption error related to missing range checks on file
descriptors being used in the "FD_SET" macro. By performing a
select on a bad file descriptor set, a remote attacker could
exploit this vulnerability to cause the application to crash or
possibly execute arbitrary code on the system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-0719</cvename>
<url>http://www.samba.org/samba/security/CVE-2011-0719.html</url>
<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0719</url>
</references>
<dates>
<discovery>2011-02-28</discovery>
<entry>2011-06-21</entry>
</dates>
</vuln>
<vuln vid="23c8423e-9bff-11e0-8ea2-0019d18c446a">
<topic>Piwik -- remote command execution vulnerability</topic>
<affects>
<package>
<name>piwik</name>
<range><ge>1.2</ge><lt>1.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Piwik security advisory reports:</p>
<blockquote cite="http://piwik.org/blog/2011/06/piwik-1-5-security-advisory/">
<p>The Piwik 1.5 release addresses a critical security
vulnerability, which affect all Piwik users that have let
granted some access to the "anonymous" user.</p>
<p>Piwik contains a remotely exploitable vulnerability that could
allow a remote attacker to execute arbitrary code. Only
installations that have granted untrusted view access to their
stats (ie. grant "view" access to a website to anonymous) are
at risk.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/158084</freebsdpr>
<url>http://piwik.org/blog/2011/06/piwik-1-5-security-advisory/</url>
</references>
<dates>
<discovery>2011-06-21</discovery>
<entry>2011-06-21</entry>
</dates>
</vuln>
<vuln vid="0b535cd0-9b90-11e0-800a-00215c6a37bb">
<topic>Dokuwiki -- cross site scripting vulnerability</topic>
<affects>
<package>
<name>dokuwiki</name>
<range><lt>20110525a</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Dokuwiki reports:</p>
<blockquote cite="http://www.freelists.org/post/dokuwiki/Hotfix-Release-20110525a-Rincewind">
<p>We just released a Hotfix Release "2011-05-25a Rincewind".
It contains the following changes:</p>
<p>Security fix for a Cross Site Scripting vulnerability.
Malicious users could abuse DokuWiki's RSS embedding mechanism
to create links containing arbitrary JavaScript. Note: this
security problem is present in at least Anteater and Rincewind
but probably in older releases as well.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.freelists.org/post/dokuwiki/Hotfix-Release-20110525a-Rincewind</url>
</references>
<dates>
<discovery>2011-06-14</discovery>
<entry>2011-06-20</entry>
</dates>
</vuln>
<vuln vid="55a528e8-9787-11e0-b24a-001b2134ef46">
<topic>linux-flashplugin -- remote code execution vulnerability</topic>
<affects>
<package>
<name>linux-flashplugin</name>
<range><le>9.0r289</le></range>
</package>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>10.3r181.26</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe Product Security Incident Response Team reports:</p>
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb11-18.html">
<p>A critical vulnerability has been identified in Adobe Flash
Player 10.3.181.23 and earlier versions for Windows, Macintosh,
Linux and Solaris, and Adobe Flash Player 10.3.185.23 and
earlier versions for Android. This memory corruption
vulnerability (CVE-2011-2110) could cause a crash and
potentially allow an attacker to take control of the affected
system. There are reports that this vulnerability is being
exploited in the wild in targeted attacks via malicious Web
pages.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-2110</cvename>
<url>http://www.adobe.com/support/security/bulletins/apsb11-18.html</url>
</references>
<dates>
<discovery>2011-05-13</discovery>
<entry>2011-06-15</entry>
</dates>
</vuln>
<vuln vid="3145faf1-974c-11e0-869e-000c29249b2e">
<topic>ikiwiki -- tty hijacking via ikiwiki-mass-rebuild</topic>
<affects>
<package>
<name>ikiwiki</name>
<range><lt>3.20110608</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The IkiWiki development team reports:</p>
<blockquote cite="http://ikiwiki.info/security/#index40h2">
<p>Ludwig Nussel discovered a way for users to hijack root's tty
when ikiwiki-mass-rebuild was run. Additionally, there was
some potential for information disclosure via symlinks.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-1408</cvename>
<url>http://ikiwiki.info/security/#index40h2</url>
</references>
<dates>
<discovery>2011-06-08</discovery>
<entry>2011-06-15</entry>
</dates>
</vuln>
<vuln vid="57573136-920e-11e0-bdc9-001b2134ef46">
<topic>linux-flashplugin -- cross-site scripting vulnerability</topic>
<affects>
<package>
<name>linux-flashplugin</name>
<range><le>9.0r289</le></range>
</package>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>10.3r181.22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe Product Security Incident Response Team reports:</p>
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb11-13.html">
<p>An important vulnerability has been identified in Adobe
Flash Player 10.3.181.16 and earlier versions for Windows,
Macintosh, Linux and Solaris, and Adobe Flash Player
10.3.185.22 and earlier versions for Android. This universal
cross-site scripting vulnerability (CVE-2011-2107) could be
used to take actions on a user's behalf on any website or
webmail provider, if the user visits a malicious website.
There are reports that this vulnerability is being exploited
in the wild in active targeted attacks designed to trick
the user into clicking on a malicious link delivered in an
email message.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-2107</cvename>
<url>http://www.adobe.com/support/security/bulletins/apsb11-13.html</url>
</references>
<dates>
<discovery>2011-05-13</discovery>
<entry>2011-06-08</entry>
</dates>
</vuln>
<vuln vid="1e1421f0-8d6f-11e0-89b4-001ec9578670">
<topic>BIND -- Large RRSIG RRsets and Negative Caching DoS</topic>
<affects>
<package>
<name>bind9-sdb-ldap</name>
<name>bind9-sdb-postgresql</name>
<range><lt>9.4.3.4</lt></range>
</package>
<package>
<name>bind96</name>
<range><lt>9.6.3.1.ESV.R4.1</lt></range>
</package>
<package>
<name>bind97</name>
<range><lt>9.7.3.1</lt></range>
</package>
<package>
<name>bind98</name>
<range><lt>9.8.0.2</lt></range>
</package>
<system>
<name>FreeBSD</name>
<range><gt>7.3</gt><lt>7.3_6</lt></range>
<range><gt>7.4</gt><lt>7.4_2</lt></range>
<range><gt>8.1</gt><lt>8.1_4</lt></range>
<range><gt>8.2</gt><lt>8.2_2</lt></range>
</system>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="http://www.isc.org/software/bind/advisories/cve-2011-1910">
<p>A BIND 9 DNS server set up to be a caching resolver is
vulnerable to a user querying a domain with very large resource
record sets (RRSets) when trying to negatively cache a response.
This can cause the BIND 9 DNS server (named process) to crash.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-1910</cvename>
<freebsdsa>SA-11:02.bind</freebsdsa>
<url>http://www.isc.org/software/bind/advisories/cve-2011-1910</url>
</references>
<dates>
<discovery>2011-05-26</discovery>
<entry>2011-06-04</entry>
</dates>
</vuln>
<vuln vid="f7d838f2-9039-11e0-a051-080027ef73ec">
<topic>fetchmail -- STARTTLS denial of service</topic>
<affects>
<package>
<name>fetchmail</name>
<range><lt>6.3.20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matthias Andree reports:</p>
<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2011-01.txt">
<p>Fetchmail version 5.9.9 introduced STLS support for POP3,
version 6.0.0 added STARTTLS for IMAP. However, the actual
S(TART)TLS-initiated in-band SSL/TLS negotiation was not guarded
by a timeout.</p>
<p>Depending on the operating system defaults as to TCP stream
keepalive mode, fetchmail hangs in excess of one week after
sending STARTTLS were observed if the connection failed without
notifying the operating system, for instance, through network
outages or hard server crashes.</p>
<p>A malicious server that does not respond, at the network level,
after acknowledging fetchmail's STARTTLS or STLS request, can
hold fetchmail in this protocol state, and thus render fetchmail
unable to complete the poll, or proceed to the next server,
effecting a denial of service.</p>
<p>SSL-wrapped mode on dedicated ports was unaffected by this
problem, so can be used as a workaround.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-1947</cvename>
<url>http://www.fetchmail.info/fetchmail-SA-2011-01.txt</url>
<url>https://gitorious.org/fetchmail/fetchmail/commit/7dc67b8cf06f74aa57525279940e180c99701314</url>
</references>
<dates>
<discovery>2011-04-28</discovery>
<entry>2011-06-06</entry>
</dates>
</vuln>
<vuln vid="34ce5817-8d56-11e0-b5a2-6c626dd55a41">
<topic>asterisk -- Remote crash vulnerability</topic>
<affects>
<package>
<name>asterisk18</name>
<range><gt>1.8.*</gt><lt>1.8.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk Development Team reports:</p>
<blockquote cite="http://lists.digium.com/pipermail/asterisk-announce/2011-June/000325.html">
<p>If a remote user initiates a SIP call and the recipient picks
up, the remote user can reply with a malformed Contact header
that Asterisk will improperly handle and cause a crash due to a
segmentation fault.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-2216</cvename>
<url>http://downloads.asterisk.org/pub/security/AST-2011-007.pdf</url>
</references>
<dates>
<discovery>2011-06-02</discovery>
<entry>2011-06-02</entry>
</dates>
</vuln>
<vuln vid="e27a1af3-8d21-11e0-a45d-001e8c75030d">
<topic>Subversion -- multiple vulnerabilities</topic>
<affects>
<package>
<name>subversion</name>
<range><lt>1.6.17</lt></range>
</package>
<package>
<name>subversion-freebsd</name>
<range><lt>1.6.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Subversion team reports:</p>
<blockquote cite="http://subversion.apache.org/security/CVE-2011-1752-advisory.txt">
<p>Subversion's mod_dav_svn Apache HTTPD server module will
dereference a NULL pointer if asked to deliver baselined WebDAV
resources.</p>
<p>This can lead to a DoS. An exploit has been tested, and tools
or users have been observed triggering this problem in the
wild.</p>
</blockquote>
<blockquote cite="http://subversion.apache.org/security/CVE-2011-1783-advisory.txt">
<p>Subversion's mod_dav_svn Apache HTTPD server module may in
certain scenarios enter a logic loop which does not exit and
which allocates memory in each iteration, ultimately exhausting
all the available memory on the server.</p>
<p>This can lead to a DoS. There are no known instances of this
problem being observed in the wild, but an exploit has been
tested.</p>
</blockquote>
<blockquote cite="http://subversion.apache.org/security/CVE-2011-1921-advisory.txt">
<p>Subversion's mod_dav_svn Apache HTTPD server module may leak to
remote users the file contents of files configured to be
unreadable by those users.</p>
<p>There are no known instances of this problem being observed in
the wild, but an exploit has been tested.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-1752</cvename>
<cvename>CVE-2011-1783</cvename>
<cvename>CVE-2011-1921</cvename>
</references>
<dates>
<discovery>2011-05-28</discovery>
<entry>2011-06-02</entry>
</dates>
</vuln>
<vuln vid="1acf9ec5-877d-11e0-b937-001372fd0af2">
<topic>drupal6 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>drupal6</name>
<range><lt>6.22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Team reports:</p>
<blockquote cite="http://drupal.org/node/1168756">
<p>A reflected cross site scripting vulnerability was discovered
in Drupal's error handler. Drupal displays PHP errors in the
messages area, and a specially crafted URL can cause malicious
scripts to be injected into the message. The issue can be
mitigated by disabling on-screen error display at admin /
settings / error-reporting. This is the recommended setting
for production sites.</p>
<p>When using re-colorable themes, color inputs are not sanitized.
Malicious color values can be used to insert arbitrary CSS and
script code. Successful exploitation requires the "Administer
themes" permission.</p>
</blockquote>
</body>
</description>
<references>
<url>http://drupal.org/node/1168756</url>
</references>
<dates>
<discovery>2011-05-25</discovery>
<entry>2011-05-26</entry>
</dates>
</vuln>
<vuln vid="e4833927-86e5-11e0-a6b4-000a5e1e33c6">
<topic>Erlang -- ssh library uses a weak random number generator</topic>
<affects>
<package>
<name>erlang</name>
<range><lt>r14b03</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>US-CERT reports:</p>
<blockquote cite="http://www.kb.cert.org/vuls/id/178990">
<p>The Erlang/OTP ssh library implements a number of
cryptographic operations that depend on cryptographically
strong random numbers. Unfortunately the RNG used by the
library is not cryptographically strong, and is further
weakened by the use of predictable seed material. The RNG
(Wichman-Hill) is not mixed with an entropy source.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-0766</cvename>
<url>http://www.erlang.org/download/otp_src_R14B03.readme</url>
<url>https://github.com/erlang/otp/commit/f228601de45c5b53241b103af6616453c50885a5</url>
</references>
<dates>
<discovery>2011-05-25</discovery>
<entry>2011-05-25</entry>
</dates>
</vuln>
<vuln vid="dc96ac1f-86b1-11e0-9e85-00215af774f0">
<topic>Unbound -- an empty error packet handling assertion failure</topic>
<affects>
<package>
<name>unbound</name>
<range><lt>1.4.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Unbound developer reports:</p>
<blockquote cite="http://unbound.nlnetlabs.nl/downloads/CVE-2011-1922.txt">
<p>NLnet Labs was notified of an error in Unbound's code-path
for error replies which is triggered under special conditions.
The error causes the program to abort.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-1922</cvename>
<url>http://unbound.nlnetlabs.nl/downloads/CVE-2011-1922.txt</url>
</references>
<dates>
<discovery>2011-05-25</discovery>
<entry>2011-05-25</entry>
</dates>
</vuln>
<vuln vid="115a1389-858e-11e0-a76c-000743057ca2">
<topic>Pubcookie Login Server -- XSS vulnerability</topic>
<affects>
<package>
<name>pubcookie-login-server</name>
<range><lt>3.3.2d</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Nathan Dors, Pubcookie Project reports:</p>
<blockquote cite="http://pubcookie.org/news/20070606-login-secadv.html">
<p>A new non-persistent XSS vulnerability was found in the
Pubcookie login server's compiled binary "index.cgi" CGI
program. The CGI program mishandles untrusted data when
printing responses to the browser. This makes the program
vulnerable to carefully crafted requests containing script
or HTML. If an attacker can lure an unsuspecting user to
visit carefully staged content, the attacker can use it to
redirect the user to his or her local Pubcookie login page
and attempt to exploit the XSS vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>http://pubcookie.org/news/20070606-login-secadv.html</url>
</references>
<dates>
<discovery>2007-05-25</discovery>
<entry>2011-05-23</entry>
</dates>
</vuln>
<vuln vid="1ca8228f-858d-11e0-a76c-000743057ca2">
<topic>mod_pubcookie -- Empty Authentication Security Advisory</topic>
<affects>
<package>
<name>ap20-mod_pubcookie</name>
<range><ge>3.1.0</ge><lt>3.3.2b</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Nathan Dors, Pubcookie Project reports:</p>
<blockquote cite="http://pubcookie.org/news/20061106-empty-auth-secadv.html">
<p>An Abuse of Functionality vulnerability in the Pubcookie
authentication process was found. This vulnerability allows an
attacker to appear as if he or she were authenticated using an
empty userid when such a userid isn't expected. Unauthorized
access to web content and applications may result where access
is restricted to users who can authenticate successfully but
where no additional authorization is performed after
authentication.</p>
</blockquote>
</body>
</description>
<references>
<url>http://pubcookie.org/news/20061106-empty-auth-secadv.html</url>
</references>
<dates>
<discovery>2006-10-04</discovery>
<entry>2011-05-23</entry>
</dates>
</vuln>
<vuln vid="7af2fb85-8584-11e0-96b7-00300582f9fc">
<topic>ViewVC -- user-reachable override of cvsdb row limit</topic>
<affects>
<package>
<name>viewvc</name>
<range><lt>1.1.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ViewVC.org reports:</p>
<blockquote cite="http://viewvc.tigris.org/source/browse/viewvc/trunk/CHANGES?r1=2536&amp;r2=2574">
<p>Security fix: remove user-reachable override of cvsdb row limit.</p>
</blockquote>
</body>
</description>
<references>
<url>http://viewvc.tigris.org/source/browse/*checkout*/viewvc/branches/1.1.x/CHANGES</url>
</references>
<dates>
<discovery>2011-05-17</discovery>
<entry>2011-05-23</entry>
</dates>
</vuln>
<vuln vid="99a5590c-857e-11e0-96b7-00300582f9fc">
<topic>Apache APR -- DoS vulnerabilities</topic>
<affects>
<package>
<name>apr1</name>
<range><lt>1.4.5.1.3.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Portable Runtime Project reports:</p>
<blockquote cite="http://www.apache.org/dist/apr/CHANGES-APR-1.4">
<p>A flaw was discovered in the apr_fnmatch() function in the
Apache Portable Runtime (APR) library 1.4.4 (or any backported
versions that contained the upstream fix for CVE-2011-0419).
This could cause httpd workers to enter a hung state (100% CPU
utilization).</p>
<p>apr-util 1.3.11 could cause crashes with httpd's
mod_authnz_ldap in some situations.</p>
</blockquote>
</body>
</description>
<references>
<bid>47929</bid>
<cvename>CVE-2011-1928</cvename>
<cvename>CVE-2011-0419</cvename>
<url>http://www.apache.org/dist/apr/Announcement1.x.html</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-1928</url>
</references>
<dates>
<discovery>2011-05-19</discovery>
<entry>2011-05-23</entry>
</dates>
</vuln>
<vuln vid="d226626c-857f-11e0-95cc-001b2134ef46">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplugin</name>
<range><le>9.0r289</le></range>
</package>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>10.3r181.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe Product Security Incident Response Team reports:</p>
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb11-12.html">
<p>Critical vulnerabilities have been identified in Adobe Flash
Player 10.2.159.1 and earlier versions (Adobe Flash Player
10.2.154.28 and earlier for Chrome users) for Windows,
Macintosh, Linux and Solaris, and Adobe Flash Player 10.2.157.51
and earlier versions for Android. These vulnerabilities could
cause the application to crash and could potentially allow an
attacker to take control of the affected system. There are
reports of malware attempting to exploit one of the
vulnerabilities, CVE-2011-0627, in the wild via a Flash (.swf)
file embedded in a Microsoft Word (.doc) or Microsoft Excel
(.xls) file delivered as an email attachment targeting the
Windows platform. However, to date, Adobe has not obtained a
sample that successfully completes an attack.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-0579</cvename>
<cvename>CVE-2011-0618</cvename>
<cvename>CVE-2011-0619</cvename>
<cvename>CVE-2011-0620</cvename>
<cvename>CVE-2011-0621</cvename>
<cvename>CVE-2011-0622</cvename>
<cvename>CVE-2011-0623</cvename>
<cvename>CVE-2011-0624</cvename>
<cvename>CVE-2011-0625</cvename>
<cvename>CVE-2011-0626</cvename>
<cvename>CVE-2011-0627</cvename>
<url>http://www.adobe.com/support/security/bulletins/apsb11-12.html</url>
</references>
<dates>
<discovery>2011-01-20</discovery>
<entry>2011-05-23</entry>
</dates>
</vuln>
<vuln vid="e666498a-852a-11e0-8f78-080027ef73ec">
<topic>Opera -- code injection vulnerability through broken frameset handling</topic>
<affects>
<package><name>opera</name><range><lt>11.11</lt></range></package>
<package><name>opera-devel</name><range><lt>11.11</lt></range></package>
<package><name>linux-opera</name><range><lt>11.11</lt></range></package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Opera Software ASA reports:</p>
<blockquote cite="http://www.opera.com/docs/changelogs/unix/1111/">
<p>Fixed an issue with framesets that could allow execution of
arbitrary code, as reported by an anonymous contributor working
with the SecuriTeam Secure Disclosure program.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.opera.com/docs/changelogs/unix/1111/</url>
<url>http://www.opera.com/support/kb/view/992/</url>
</references>
<dates>
<discovery>2011-05-18</discovery>
<entry>2011-05-23</entry>
</dates>
</vuln>
<vuln vid="1495f931-8522-11e0-a1c1-00215c6a37bb">
<topic>pureftpd -- multiple vulnerabilities</topic>
<affects>
<package>
<name>pure-ftpd</name>
<range><lt>1.0.32</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Pure-FTPd development team reports:</p>
<blockquote cite="http://www.pureftpd.org/project/pure-ftpd/news">
<p>Support for braces expansion in directory listings has been
disabled -- Cf. CVE-2011-0418.</p>
<p>Fix a STARTTLS flaw similar to Postfix's CVE-2011-0411.
If you're using TLS, upgrading is recommended.</p>
</blockquote>
</body>
</description>
<references>
<bid>46767</bid>
<cvename>CVE-2011-0418</cvename>
<cvename>CVE-2011-1575</cvename>
</references>
<dates>
<discovery>2011-04-01</discovery>
<entry>2011-05-23</entry>
</dates>
</vuln>
<vuln vid="36594c54-7be7-11e0-9838-0022156e8794">
<topic>Exim -- remote code execution and information disclosure</topic>
<affects>
<package>
<name>exim</name>
<range><ge>4.70</ge><lt>4.76</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Release notes for Exim 4.76 says:</p>
<blockquote cite="ftp://ftp.exim.org/pub/exim/ChangeLogs/ChangeLog-4.76">
<p>Bugzilla 1106: CVE-2011-1764 - DKIM log line was subject to
a format-string attack -- SECURITY: remote arbitrary code
execution.</p>
<p>DKIM signature header parsing was double-expanded, second
time unintentionally subject to list matching rules, letting
the header cause arbitrary Exim lookups (of items which can
occur in lists, *not* arbitrary string expansion). This
allowed for information disclosure.</p>
</blockquote>
<p>Also, impact assessment was redone shortly after the original
announcement:</p>
<blockquote cite="https://lists.exim.org/lurker/message/20110512.102909.8136175a.en.html">
<p>Further analysis revealed that the second security was
more severe than I realised at the time that I wrote the
announcement. The second security issue has been assigned
CVE-2011-1407 and is also a remote code execution flaw.
For clarity: both issues were introduced with 4.70.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-1764</cvename>
<cvename>CVE-2011-1407</cvename>
<mlist msgid="20110512102909.GA58484@redoubt.spodhuis.org">https://lists.exim.org/lurker/message/20110512.102909.8136175a.en.html</mlist>
<url>http://bugs.exim.org/show_bug.cgi?id=1106</url>
</references>
<dates>
<discovery>2011-05-10</discovery>
<entry>2011-05-14</entry>
</dates>
</vuln>
<vuln vid="00b296b6-7db1-11e0-96b7-00300582f9fc">
<topic>Apache APR -- DoS vulnerabilities</topic>
<affects>
<package>
<name>apr1</name>
<range><lt>1.4.4.1.3.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Portable Runtime Project reports:</p>
<blockquote cite="http://www.apache.org/dist/apr/CHANGES-APR-1.4">
<p>Note especially a security fix to APR 1.4.4, excessive CPU
consumption was possible due to an unconstrained, recursive
invocation of apr_fnmatch, as apr_fnmatch processed '*' wildcards.
Reimplement apr_fnmatch() from scratch using a non-recursive
algorithm now has improved compliance with the fnmatch() spec.
(William Rowe)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-0419</cvename>
<url>http://www.apache.org/dist/apr/Announcement1.x.html</url>
</references>
<dates>
<discovery>2011-05-10</discovery>
<entry>2011-05-12</entry>
</dates>
</vuln>
<vuln vid="34e8ccf5-7d71-11e0-9d83-000c29cc39d3">
<topic>Zend Framework -- potential SQL injection when using PDO_MySql</topic>
<affects>
<package>
<name>ZendFramework</name>
<range><lt>1.11.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Zend Framework team reports:</p>
<blockquote cite="http://framework.zend.com/security/advisory/ZF2011-02">
<p>Developers using non-ASCII-compatible encodings in conjunction
with the MySQL PDO driver of PHP may be vulnerable to SQL
injection attacks. Developers using ASCII-compatible encodings
like UTF8 or latin1 are not affected by this PHP issue.</p>
</blockquote>
</body>
</description>
<references>
<url>http://framework.zend.com/security/advisory/ZF2011-02</url>
<url>http://zend-framework-community.634137.n4.nabble.com/Zend-Framework-1-11-6-and-1-10-9-released-td3503741.html</url>
</references>
<dates>
<discovery>2011-05-06</discovery>
<entry>2011-05-13</entry>
</dates>
</vuln>
<vuln vid="3fadb7c6-7b0a-11e0-89b4-001ec9578670">
<topic>mediawiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mediawiki</name>
<range><lt>1.16.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mediawiki reports:</p>
<blockquote cite="http://lists.wikimedia.org/pipermail/mediawiki-announce/2011-May/000098.html">
<p>(Bug 28534) XSS vulnerability for IE 6 clients. This is the
third attempt at fixing bug 28235.</p>
<p>(Bug 28639) Potential privilege escalation when
$wgBlockDisablesLogin is enabled.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugzilla.wikimedia.org/show_bug.cgi?id=28534</url>
<url>https://bugzilla.wikimedia.org/show_bug.cgi?id=28639</url>
<url>http://lists.wikimedia.org/pipermail/mediawiki-announce/2011-May/000098.html</url>
<url>http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_16_5/phase3/RELEASE-NOTES</url>
</references>
<dates>
<discovery>2011-04-14</discovery>
<entry>2011-05-12</entry>
</dates>
</vuln>
<vuln vid="3eb2c100-738b-11e0-89f4-001e90d46635">
<topic>Postfix -- memory corruption vulnerability</topic>
<affects>
<package>
<name>postfix</name>
<name>postfix-base</name>
<range><ge>2.8.*,1</ge><lt>2.8.3,1</lt></range>
<range><ge>2.7.*,1</ge><lt>2.7.4,1</lt></range>
<range><ge>2.6.*,1</ge><lt>2.6.10,1</lt></range>
<range><ge>2.5.*,2</ge><lt>2.5.13,2</lt></range>
<range><le>2.4.16,1</le></range>
</package>
<package>
<name>postfix-current</name>
<name>postfix-current-base</name>
<range><lt>2.9.20110501,4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Postfix SMTP server has a memory corruption error, when the
Cyrus SASL library is used with authentication mechanisms other
than PLAIN and LOGIN (ANONYMOUS is not affected, but should not
be used for other reasons). This memory corruption is known to
result in a program crash (SIGSEV).</p>
</body>
</description>
<references>
<cvename>CVE-2011-1720</cvename>
<url>http://www.postfix.org/CVE-2011-1720.html</url>
</references>
<dates>
<discovery>2011-05-09</discovery>
<entry>2011-05-09</entry>
</dates>
</vuln>
<vuln vid="04b7d46c-7226-11e0-813a-6c626dd55a41">
<topic>Mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>3.6.*,1</gt><lt>3.6.17,1</lt></range>
<range><gt>3.5.*,1</gt><lt>3.5.19,1</lt></range>
<range><gt>4.0.*,1</gt><lt>4.0.1,1</lt></range>
</package>
<package>
<name>libxul</name>
<range><gt>1.9.2.*</gt><lt>1.9.2.17</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>3.6.17,1</lt></range>
</package>
<package>
<name>linux-firefox-devel</name>
<range><lt>3.5.19</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><gt>2.0.*</gt><lt>2.0.14</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><gt>2.0.*</gt><lt>2.0.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2011-12 Miscellaneous memory safety hazards</p>
<p>MFSA 2011-13 Multiple dangling pointer vulnerabilities</p>
<p>MFSA 2011-14 Information stealing via form history</p>
<p>MFSA 2011-15 Escalation of privilege through Java Embedding Plugin</p>
<p>MFSA 2011-16 Directory traversal in resource: protocol</p>
<p>MFSA 2011-17 WebGLES vulnerabilities</p>
<p>MFSA 2011-18 XSLT generate-id() function heap address leak</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-12.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-13.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-14.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-15.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-16.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-17.html</url>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-18.html</url>
</references>
<dates>
<discovery>2011-04-28</discovery>
<entry>2011-04-29</entry>
</dates>
</vuln>
<vuln vid="3c7d565a-6c64-11e0-813a-6c626dd55a41">
<topic>Asterisk -- multiple vulnerabilities</topic>
<affects>
<package>
<name>asterisk14</name>
<range><gt>1.4.*</gt><lt>1.4.40.1</lt></range>
</package>
<package>
<name>asterisk16</name>
<range><gt>1.6.*</gt><lt>1.6.2.17.3</lt></range>
</package>
<package>
<name>asterisk18</name>
<range><gt>1.8.*</gt><lt>1.8.3.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk Development Team reports:</p>
<blockquote cite="http://lists.digium.com/pipermail/asterisk-announce/2011-April/000316.html">
<p>It is possible for a user of the Asterisk Manager Interface to
bypass a security check and execute shell commands when they
should not have that ability. Sending the "Async" header with
the "Application" header during an Originate action, allows
authenticated manager users to execute shell commands. Only
users with the "system" privilege should be able to do this.</p>
<p>On systems that have the Asterisk Manager Interface, Skinny, SIP
over TCP, or the built in HTTP server enabled, it is possible for
an attacker to open as many connections to asterisk as he wishes.
This will cause Asterisk to run out of available file descriptors
and stop processing any new calls. Additionally, disk space can
be exhausted as Asterisk logs failures to open new file
descriptors.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-1507</cvename>
<url>http://downloads.asterisk.org/pub/security/AST-2011-005.pdf</url>
<url>http://downloads.asterisk.org/pub/security/AST-2011-006.pdf</url>
</references>
<dates>
<discovery>2011-04-21</discovery>
<entry>2011-04-21</entry>
</dates>
</vuln>
<vuln vid="6a4bfe75-692a-11e0-bce7-001eecdd401a">
<topic>VLC -- Heap corruption in MP4 demultiplexer</topic>
<affects>
<package>
<name>vlc</name>
<range><ge>1.0.0</ge><lt>1.1.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>VideoLAN project reports:</p>
<blockquote cite="http://www.videolan.org/security/sa1103.html">
<p>When parsing some MP4 (MPEG-4 Part 14) files, insufficient
buffer size might lead to corruption of the heap.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.videolan.org/security/sa1103.html</url>
</references>
<dates>
<discovery>2011-04-07</discovery>
<entry>2011-04-17</entry>
</dates>
</vuln>
<vuln vid="32b05547-6913-11e0-bdc4-001b2134ef46">
<topic>linux-flashplugin -- remote code execution vulnerability</topic>
<affects>
<package>
<name>linux-flashplugin</name>
<range><le>9.0r289</le></range>
</package>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>10.2r159.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe Product Security Incident Response Team reports:</p>
<blockquote cite="http://www.adobe.com/support/security/advisories/apsa11-02.html">
<p>A critical vulnerability exists in Flash Player 10.2.153.1
and earlier versions (Adobe Flash Player 10.2.154.25 and
earlier for Chrome users) for Windows, Macintosh, Linux
and Solaris, Adobe Flash Player 10.2.156.12 and earlier
versions for Android, and the Authplay.dll component that
ships with Adobe Reader and Acrobat X (10.0.2) and earlier
10.x and 9.x versions for Windows and Macintosh operating
systems.</p>
<p>This vulnerability (CVE-2011-0611) could cause a crash
and potentially allow an attacker to take control of the
affected system. There are reports that this vulnerability
is being exploited in the wild in targeted attacks via a
malicious Web page or a Flash (.swf) file embedded in a
Microsoft Word (.doc) or Microsoft Excel (.xls) file
delivered as an email attachment, targeting the Windows
platform. At this time, Adobe is not aware of any attacks
via PDF targeting Adobe Reader and Acrobat. Adobe Reader
X Protected Mode mitigations would prevent an exploit of
this kind from executing.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-0611</cvename>
<url>http://www.adobe.com/support/security/advisories/apsa11-02.html</url>
</references>
<dates>
<discovery>2011-01-20</discovery>
<entry>2011-04-17</entry>
</dates>
</vuln>
<vuln vid="bf171509-68dd-11e0-afe6-0003ba02bf30">
<topic>rt -- multiple vulnerabilities</topic>
<affects>
<package>
<name>rt36</name>
<range><lt>3.6.11</lt></range>
</package>
<package>
<name>rt38</name>
<range><lt>3.8.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Best Practical reports:</p>
<blockquote cite="http://blog.bestpractical.com/2011/04/security-vulnerabilities-in-rt.html">
<p>In the process of preparing the release of RT 4.0.0, we performed
an extensive security audit of RT's source code. During this
audit, several vulnerabilities were found which affect earlier
releases of RT.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-1685</cvename>
<cvename>CVE-2011-1686</cvename>
<cvename>CVE-2011-1687</cvename>
<cvename>CVE-2011-1688</cvename>
<cvename>CVE-2011-1689</cvename>
<cvename>CVE-2011-1690</cvename>
<url>http://secunia.com/advisories/44189</url>
</references>
<dates>
<discovery>2011-04-14</discovery>
<entry>2011-04-17</entry>
</dates>
</vuln>
<vuln vid="6a3c3e5c-66cb-11e0-a116-c535f3aa24f0">
<topic>krb5 -- MITKRB5-SA-2011-004, kadmind invalid pointer free() [CVE-2011-0285]</topic>
<affects>
<package>
<name>krb5</name>
<range><ge>1.7</ge><lt>1.7.2</lt></range>
<range><ge>1.8</ge><lt>1.8.4</lt></range>
<range><eq>1.9</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An advisory published by the MIT Kerberos team says:</p>
<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-004.txt">
<p>The password-changing capability of the MIT krb5 administration
daemon (kadmind) has a bug that can cause it to attempt to free()
an invalid pointer under certain error conditions. This can cause
the daemon to crash or induce the execution of arbitrary code
(which is believed to be difficult). No exploit that executes
arbitrary code is known to exist, but it is easy to trigger a
denial of service manually.</p>
<p>Some platforms detect attempted freeing of invalid pointers and
protectively terminate the process, preventing arbitrary code
execution on those platforms.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-0285</cvename>
<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-004.txt</url>
</references>
<dates>
<discovery>2011-04-12</discovery>
<entry>2011-04-14</entry>
</dates>
</vuln>
<vuln vid="7edac52a-66cd-11e0-9398-5d45f3aa24f0">
<topic>krb5 -- MITKRB5-SA-2011-003, KDC vulnerable to double-free when PKINIT enabled</topic>
<affects>
<package>
<name>krb5</name>
<range><ge>1.7</ge><lt>1.7.2</lt></range>
<range><ge>1.8</ge><lt>1.8.4</lt></range>
<range><eq>1.9</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An advisory published by the MIT Kerberos team says:</p>
<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-003.txt">
<p>The MIT Kerberos 5 Key Distribution Center (KDC) daemon is
vulnerable to a double-free condition if the Public Key
Cryptography for Initial Authentication (PKINIT) capability is
enabled, resulting in daemon crash or arbitrary code execution
(which is believed to be difficult).</p>
<p>An unauthenticated remote attacker can induce a double-free
event, causing the KDC daemon to crash (denial of service),
or to execute arbitrary code. Exploiting a double-free event
to execute arbitrary code is believed to be difficult.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-0284</cvename>
<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-003.txt</url>
</references>
<dates>
<discovery>2011-03-15</discovery>
<entry>2011-04-14</entry>
</dates>
</vuln>
<vuln vid="4ab413ea-66ce-11e0-bf05-d445f3aa24f0">
<topic>krb5 -- MITKRB5-SA-2011-002, KDC vulnerable to hang when using LDAP back end</topic>
<affects>
<package>
<name>krb5</name>
<range><ge>1.7</ge><lt>1.7.2</lt></range>
<range><ge>1.8</ge><le>1.8.4</le></range>
<range><eq>1.9</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An advisory published by the MIT Kerberos team says:</p>
<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-002.txt">
<p>The MIT krb5 Key Distribution Center (KDC) daemon is vulnerable
to denial of service attacks from unauthenticated remote
attackers. CVE-2011-0281 and CVE-2011-0282 occur only in KDCs
using LDAP back ends, but CVE-2011-0283 occurs in all krb5-1.9
KDCs.</p>
<p>Exploit code is not known to exist, but the vulnerabilities are
easy to trigger manually. The trigger for CVE-2011-0281 has
already been disclosed publicly, but that fact might not be
obvious to casual readers of the message in which it was
disclosed. The triggers for CVE-2011-0282 and CVE-2011-0283
have not yet been disclosed publicly, but they are also
trivial.</p>
<p>CVE-2011-0281: An unauthenticated remote attacker can cause a KDC
configured with an LDAP back end to become completely unresponsive
until restarted.</p>
<p>CVE-2011-0282: An unauthenticated remote attacker can cause a KDC
configured with an LDAP back end to crash with a null pointer
dereference.</p>
<p>CVE-2011-0283: An unauthenticated remote attacker can cause a
krb5-1.9 KDC with any back end to crash with a null pointer
dereference.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-0281</cvename>
<cvename>CVE-2011-0282</cvename>
<cvename>CVE-2011-0283</cvename>
<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-002.txt</url>
</references>
<dates>
<discovery>2011-02-08</discovery>
<entry>2011-04-14</entry>
</dates>
</vuln>
<vuln vid="64f24a1e-66cf-11e0-9deb-f345f3aa24f0">
<topic>krb5 -- MITKRB5-SA-2011-001, kpropd denial of service</topic>
<affects>
<package>
<name>krb5</name>
<range><ge>1.7</ge><lt>1.7.2</lt></range>
<range><ge>1.8</ge><lt>1.8.4</lt></range>
<range><eq>1.9</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An advisory published by the MIT Kerberos team says:</p>
<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-001.txt">
<p>The MIT krb5 KDC database propagation daemon (kpropd) is
vulnerable to a denial-of-service attack triggered by invalid
network input. If a kpropd worker process receives invalid
input that causes it to exit with an abnormal status, it can
cause the termination of the listening process that spawned it,
preventing the slave KDC it was running on from receiving
database updates from the master KDC.</p>
<p>Exploit code is not known to exist, but the vulnerabilities are
easy to trigger manually.</p>
<p>An unauthenticated remote attacker can cause kpropd running in
standalone mode (the "-S" option) to terminate its listening
process, preventing database propagations to the KDC host on
which it was running. Configurations where kpropd runs in
incremental propagation mode ("iprop") or as an inetd server
are not affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-4022</cvename>
<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-001.txt</url>
</references>
<dates>
<discovery>2011-02-08</discovery>
<entry>2011-04-14</entry>
</dates>
</vuln>
<vuln vid="2eccb24f-61c0-11e0-b199-0015f2db7bde">
<topic>xrdb -- root hole via rogue hostname</topic>
<affects>
<package>
<name>xrdb</name>
<range><lt>1.0.6_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matthias Hopf reports:</p>
<blockquote cite="http://lists.freedesktop.org/archives/xorg-announce/2011-April/001636.html">
<p>By crafting hostnames with shell escape characters, arbitrary
commands can be executed in a root environment when a display
manager reads in the resource database via xrdb.</p>
<p>These specially crafted hostnames can occur in two environments:</p>
<p>Systems are affected are: systems set their hostname via DHCP,
and the used DHCP client allows setting of hostnames with illegal
characters. And systems that allow remote logins via xdmcp.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-0465</cvename>
<url>http://lists.freedesktop.org/archives/xorg-announce/2011-April/001636.html</url>
</references>
<dates>
<discovery>2011-04-05</discovery>
<entry>2011-04-14</entry>
</dates>
</vuln>
<vuln vid="a4372a68-652c-11e0-a25a-00151735203a">
<topic>OTRS -- Several XSS attacks possible</topic>
<affects>
<package>
<name>otrs</name>
<range><gt>2.3.*</gt><lt>3.0.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OTRS Security Advisory reports:</p>
<blockquote cite="http://otrs.org/advisory/OSA-2011-01-en/">
<ul>
<li>Several XSS attacks possible:
An attacker could trick a logged in user to following a prepared
URL inside of the OTRS system which causes a page to be shown that
possibly includes malicious !JavaScript code because of incorrect
escaping during the generation of the HTML page.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-1518</cvename>
<url>http://otrs.org/advisory/OSA-2011-01-en/</url>
</references>
<dates>
<discovery>2011-03-12</discovery>
<entry>2011-04-12</entry>
</dates>
</vuln>
<vuln vid="7e69f00d-632a-11e0-9f3a-001d092480a4">
<topic>isc-dhcp-client -- dhclient does not strip or escape shell meta-characters</topic>
<affects>
<package>
<name>isc-dhcp31-client</name>
<range><lt>3.1.ESV_1,1</lt></range>
</package>
<package>
<name>isc-dhcp41-client</name>
<range><lt>4.1.e,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="http://www.isc.org/software/dhcp/advisories/cve-2011-0997">
<p>ISC dhclient did not strip or escape certain shell meta-characters
in responses from the dhcp server (like hostname) before passing the
responses on to dhclient-script. Depending on the script and OS,
this can result in execution of exploit code on the client.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-0997</cvename>
<certvu>107886</certvu>
</references>
<dates>
<discovery>2011-04-05</discovery>
<entry>2011-04-10</entry>
</dates>
</vuln>
<vuln vid="b9281fb9-61b2-11e0-b1ce-0019d1a7ece2">
<topic>tinyproxy -- ACL lists ineffective when range is configured</topic>
<affects>
<package>
<name>tinyproxy</name>
<range><lt>1.8.2_2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>When including a line to allow a network of IP addresses, the access to tinyproxy
56 is actually allowed for all IP addresses.</p>
</body>
</description>
<references>
<cvename>CVE-2011-1499</cvename>
<url>https://banu.com/bugzilla/show_bug.cgi?id=90</url>
</references>
<dates>
<discovery>2010-05-18</discovery>
<entry>2011-04-08</entry>
</dates>
</vuln>
<vuln vid="b2a40507-5c88-11e0-9e85-00215af774f0">
<topic>quagga -- two DoS vulnerabilities</topic>
<affects>
<package>
<name>quagga</name>
<range><lt>0.99.17_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Quagga developers report:</p>
<blockquote cite="http://www.quagga.net/news2.php?y=2011&amp;m=3&amp;d=21#id1300723200">
<p>Quagga 0.99.18 has been released.
This release fixes 2 denial of services in bgpd, which can be
remotely triggered by malformed AS-Pathlimit or Extended-Community
attributes. These issues have been assigned CVE-2010-1674 and
CVE-2010-1675. Support for AS-Pathlimit has been removed with this
release.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-1674</cvename>
<cvename>CVE-2010-1675</cvename>
<url>http://www.quagga.net/news2.php?y=2011&amp;m=3&amp;d=21#id1300723200</url>
</references>
<dates>
<discovery>2010-04-30</discovery>
<entry>2011-04-01</entry>
</dates>
</vuln>
<vuln vid="c6fbd447-59ed-11e0-8d04-0015f2db7bde">
<topic>gdm -- privilege escalation vulnerability</topic>
<affects>
<package>
<name>gdm</name>
<range><lt>2.30.5_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sebastian Krahmer reports:</p>
<blockquote cite="http://mail.gnome.org/archives/distributor-list/2011-March/msg00008.html">
<p>It was discovered that the GNOME Display Manager (gdm) cleared the cache
directory, which is owned by an unprivileged user, with the privileges of the
root user. A race condition exists in gdm where a local user could take
advantage of this by writing to the cache directory between ending the session
and the signal to clean up the session, which could lead to the execution of
arbitrary code as the root user.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-0727</cvename>
<url>http://mail.gnome.org/archives/distributor-list/2011-March/msg00008.html</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=688323</url>
</references>
<dates>
<discovery>2011-03-28</discovery>
<entry>2011-03-29</entry>
</dates>
</vuln>
<vuln vid="fe853666-56ce-11e0-9668-001fd0d616cf">
<topic>php -- ZipArchive segfault with FL_UNCHANGED on empty archive</topic>
<affects>
<package>
<name>php5-zip</name>
<range><lt>5.3.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>US-CERT/NIST reports:</p>
<blockquote cite="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-0421">
<p>The _zip_name_locate function in zip_name_locate.c in the Zip extension
in PHP before 5.3.6 does not properly handle a ZIPARCHIVE::FL_UNCHANGED
argument, which might allow context-dependent attackers to cause a
denial of service (application crash) via an empty ZIP archive that is
processed with a (1) locateName or (2) statName operation.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-0421</cvename>
</references>
<dates>
<discovery>2011-03-20</discovery>
<entry>2011-03-25</entry>
</dates>
</vuln>
<vuln vid="cc3bfec6-56cd-11e0-9668-001fd0d616cf">
<topic>php -- crash on crafted tag in exif</topic>
<affects>
<package>
<name>php5-exif</name>
<range><lt>5.3.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>US-CERT/NIST reports:</p>
<blockquote cite="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-0708">
<p>exif.c in the Exif extension in PHP before 5.3.6 on 64-bit platforms
performs an incorrect cast, which allows remote attackers to cause a
denial of service (application crash) via an image with a crafted
Image File Directory (IFD) that triggers a buffer over-read.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-0708</cvename>
</references>
<dates>
<discovery>2011-03-20</discovery>
<entry>2011-03-25</entry>
</dates>
</vuln>
<vuln vid="501ee07a-5640-11e0-985a-001b2134ef46">
<topic>linux-flashplugin -- remote code execution vulnerability</topic>
<affects>
<package>
<name>linux-flashplugin</name>
<range><le>9.0r289</le></range>
</package>
<package>
<name>linux-f8-flashplugin</name>
<name>linux-f10-flashplugin</name>
<range><lt>10.2r153</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe Product Security Incident Response Team reports:</p>
<blockquote cite="http://www.adobe.com/support/security/advisories/apsa11-01.html">
<p>A critical vulnerability exists in Adobe Flash Player
10.2.152.33 and earlier versions (Adobe Flash Player
10.2.154.18 and earlier for Chrome users) for Windows,
Macintosh, Linux and Solaris operating systems, Adobe
Flash Player 10.1.106.16 and earlier versions for Android,
and the Authplay.dll component that ships with Adobe Reader
and Acrobat X (10.0.1) and earlier 10.x and 9.x versions of
Reader and Acrobat for Windows and Macintosh operating systems.</p>
<p>This vulnerability (CVE-2011-0609) could cause a crash and
potentially allow an attacker to take control of the affected
system. There are reports that this vulnerability is being
exploited in the wild in targeted attacks via a Flash (.swf)
file embedded in a Microsoft Excel (.xls) file delivered as
an email attachment.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-0609</cvename>
<url>http://www.adobe.com/support/security/advisories/apsa11-01.html</url>
</references>
<dates>
<discovery>2011-01-20</discovery>
<entry>2011-03-24</entry>
</dates>
</vuln>
<vuln vid="b2f09169-55af-11e0-9d6f-000f20797ede">
<topic>mozilla -- update to HTTPS certificate blacklist</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>3.6.*,1</gt><lt>3.6.16,1</lt></range>
<range><gt>3.5.*,1</gt><lt>3.5.18,1</lt></range>
</package>
<package>
<name>libxul</name>
<range><gt>1.9.2.*</gt><lt>1.9.2.16</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>3.6.16,1</lt></range>
</package>
<package>
<name>linux-firefox-devel</name>
<range><lt>3.5.18</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><gt>2.0.*</gt><lt>2.0.13</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><gt>2.0.*</gt><lt>2.0.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2011-11 Update to HTTPS certificate blacklist</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-11.html</url>
</references>
<dates>
<discovery>2011-03-22</discovery>
<entry>2011-03-24</entry>
</dates>
</vuln>
<vuln vid="14a6f516-502f-11e0-b448-bbfa2731f9c7">
<topic>postfix -- plaintext command injection with SMTP over TLS</topic>
<affects>
<package>
<name>postfix</name>
<name>postfix-base</name>
<range><ge>2.7.*,1</ge><lt>2.7.3,1</lt></range>
<range><ge>2.6.*,1</ge><lt>2.6.9,1</lt></range>
<range><ge>2.5.*,2</ge><lt>2.5.12,2</lt></range>
<range><ge>2.4.*,1</ge><lt>2.4.16,1</lt></range>
</package>
<package>
<name>postfix-current</name>
<name>postfix-current-base</name>
<range><lt>2.9.20100120,4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Wietse Venema has discovered a software flaw that allows
an attacker to inject client commands into an SMTP session
during the unprotected plaintext SMTP protocol phase, such
that the server will execute those commands during the SMTP-
over-TLS protocol phase when all communication is supposed
to be protected.</p>
</body>
</description>
<references>
<cvename>CVE-2011-0411</cvename>
<url>http://www.postfix.org/CVE-2011-0411.html</url>
<url>http://secunia.com/advisories/43646/</url>
</references>
<dates>
<discovery>2011-03-07</discovery>
<entry>2011-03-19</entry>
</dates>
</vuln>
<vuln vid="b13414c9-50ba-11e0-975a-000c29cc39d3">
<topic>hiawatha -- integer overflow in Content-Length header parsing</topic>
<affects>
<package>
<name>hiawatha</name>
<range><lt>7.4_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Hugo Leisink reports:</p>
<blockquote cite="http://www.hiawatha-webserver.org/weblog/16">
<p>A bug has been found in version 7.4 of the Hiawatha webserver,
which could lead to a server crash. This is caused by an integer
overflow in the routine that reads the HTTP request. A too large
value of the Content-Length HTTP header results in an overflow.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.hiawatha-webserver.org/weblog/16</url>
<url>http://secunia.com/advisories/43660/</url>
<url>http://securityvulns.com/Zdocument902.html</url>
<url>http://packetstormsecurity.org/files/99021/Hiawatha-WebServer-7.4-Denial-Of-Service.html</url>
<url>http://seclists.org/bugtraq/2011/Mar/65</url>
</references>
<dates>
<discovery>2011-02-25</discovery>
<entry>2011-03-17</entry>
</dates>
</vuln>
<vuln vid="bfe9c75e-5028-11e0-b2d2-00215c6a37bb">
<topic>asterisk -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>asterisk16</name>
<range><gt>1.6.*</gt><lt>1.6.2.17.1</lt></range>
</package>
<package>
<name>asterisk18</name>
<range><gt>1.8.*</gt><lt>1.8.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk Development Team reports:</p>
<blockquote cite="http://www.venturevoip.com/news.php?rssid=2521">
<p>The releases of Asterisk 1.6.1.23, 1.6.2.17.1, and 1.8.3.1
resolve two issues:</p>
<ul>
<li>Resource exhaustion in Asterisk Manager Interface
(AST-2011-003)</li>
<li>Remote crash vulnerability in TCP/TLS server
(AST-2011-004)</li>
</ul>
<p>The issues and resolutions are described in the AST-2011-003
and AST-2011-004 security advisories.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2011-003.html</url>
<url>http://downloads.asterisk.org/pub/security/AST-2011-004.html</url>
</references>
<dates>
<discovery>2011-03-01</discovery>
<entry>2011-03-16</entry>
</dates>
</vuln>
<vuln vid="8b986a05-4dbe-11e0-8b9a-02e0184b8d35">
<topic>avahi -- denial of service</topic>
<affects>
<package>
<name>avahi</name>
<name>avahi-app</name>
<name>avahi-autoipd</name>
<name>avahi-gtk</name>
<name>avahi-libdns</name>
<name>avahi-qt3</name>
<name>avahi-qt4</name>
<name>avahi-sharp</name>
<range><lt>0.6.29</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Avahi developers reports:</p>
<blockquote cite="http://secunia.com/advisories/43361/">
<p>A vulnerability has been reported in Avahi, which can be exploited
by malicious people to cause a DoS (Denial of Service).
The vulnerability is caused due to an error when processing certain
UDP packets, which can be exploited to trigger an infinite loop by
e.g. sending an empty packet to port 5353/UDP.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-1002</cvename>
<cvename>CVE-2010-2244</cvename>
<url>http://secunia.com/advisories/43361/</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=667187</url>
</references>
<dates>
<discovery>2011-02-21</discovery>
<entry>2011-03-13</entry>
</dates>
</vuln>
<vuln vid="64691c49-4b22-11e0-a226-00e0815b8da8">
<topic>mailman -- XSS vulnerability</topic>
<affects>
<package>
<name>mailman</name>
<range><lt>2.1.14_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CVE reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0707">
<p>Multiple cross-site scripting (XSS) vulnerabilities in
Cgi/confirm.py in GNU Mailman 2.1.14 and earlier allow remote
attackers to inject arbitrary web script or HTML via the (1)
full name or (2) username field in a confirmation message.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-0707</cvename>
<url>http://mail.python.org/pipermail/mailman-announce/2011-February/000157.html</url>
</references>
<dates>
<discovery>2011-02-13</discovery>
<entry>2011-03-10</entry>
</dates>
</vuln>
<vuln vid="cf96cd8d-48fb-11e0-98a6-0050569b2d21">
<topic>redmine -- XSS vulnerability</topic>
<affects>
<package>
<name>redmine</name>
<range><gt>1.0</gt><lt>1.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jean-Philippe Lang reports:</p>
<blockquote cite="http://www.redmine.org/news/53">
<p>This maintenance release for 1.1.x users includes
13 bug fixes since 1.1.1 and a security fix (XSS
vulnerability affecting all Redmine versions from
1.0.1 to 1.1.1).
</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.redmine.org/news/53</url>
</references>
<dates>
<discovery>2011-03-07</discovery>
<entry>2011-03-07</entry>
</dates>
</vuln>
<vuln vid="e27ca763-4721-11e0-bdc4-001e8c75030d">
<topic>subversion -- remote HTTP DoS vulnerability</topic>
<affects>
<package>
<name>subversion</name>
<range><ge>1.6</ge><le>1.6.15</le></range>
<range><ge>1.5</ge><le>1.6.9</le></range>
</package>
<package>
<name>subversion-freebsd</name>
<range><ge>1.6</ge><le>1.6.15</le></range>
<range><ge>1.5</ge><le>1.6.9</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Subversion project reports:</p>
<blockquote cite="http://subversion.apache.org/security/CVE-2011-0715-advisory.txt">
<p>Subversion HTTP servers up to 1.5.9 (inclusive) or 1.6.15 (inclusive)
are vulnerable to a remotely triggerable NULL-pointer dereference.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-0715</cvename>
</references>
<dates>
<discovery>2011-02-27</discovery>
<entry>2011-03-05</entry>
</dates>
</vuln>
<vuln vid="45f102cd-4456-11e0-9580-4061862b8c22">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>3.6.*,1</gt><lt>3.6.14,1</lt></range>
<range><gt>3.5.*,1</gt><lt>3.5.17,1</lt></range>
</package>
<package>
<name>libxul</name>
<range><gt>1.9.2.*</gt><lt>1.9.2.14</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>3.6.14,1</lt></range>
</package>
<package>
<name>linux-firefox-devel</name>
<range><lt>3.5.17</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><gt>2.0.*</gt><lt>2.0.12</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><ge>3.1</ge><lt>3.1.8</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><gt>2.0.*</gt><lt>2.0.12</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>3.1.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2011-01 Miscellaneous memory safety hazards (rv:1.9.2.14/ 1.9.1.17)</p>
<p>MFSA 2011-02 Recursive eval call causes confirm dialogs to evaluate to true</p>
<p>MFSA 2011-03 Use-after-free error in JSON.stringify</p>
<p>MFSA 2011-04 Buffer overflow in JavaScript upvarMap</p>
<p>MFSA 2011-05 Buffer overflow in JavaScript atom map</p>
<p>MFSA 2011-06 Use-after-free error using Web Workers</p>
<p>MFSA 2011-07 Memory corruption during text run construction (Windows)</p>
<p>MFSA 2011-08 ParanoidFragmentSink allows javascript: URLs in chrome documents</p>
<p>MFSA 2011-09 Crash caused by corrupted JPEG image</p>
<p>MFSA 2011-10 CSRF risk with plugins and 307 redirects</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-1585</cvename>
<cvename>CVE-2011-0051</cvename>
<cvename>CVE-2011-0053</cvename>
<cvename>CVE-2011-0054</cvename>
<cvename>CVE-2011-0055</cvename>
<cvename>CVE-2011-0056</cvename>
<cvename>CVE-2011-0057</cvename>
<cvename>CVE-2011-0058</cvename>
<cvename>CVE-2011-0059</cvename>
<cvename>CVE-2011-0061</cvename>
<cvename>CVE-2011-0062</cvename>
<url>https://www.mozilla.org/security/announce/2011/mfsa2011-01.html</url>
<url>https://www.mozilla.org/security/announce/2011/mfsa2011-02.html</url>
<url>https://www.mozilla.org/security/announce/2011/mfsa2011-03.html</url>
<url>https://www.mozilla.org/security/announce/2011/mfsa2011-04.html</url>
<url>https://www.mozilla.org/security/announce/2011/mfsa2011-05.html</url>
<url>https://www.mozilla.org/security/announce/2011/mfsa2011-06.html</url>
<url>https://www.mozilla.org/security/announce/2011/mfsa2011-07.html</url>
<url>https://www.mozilla.org/security/announce/2011/mfsa2011-08.html</url>
<url>https://www.mozilla.org/security/announce/2011/mfsa2011-09.html</url>
<url>https://www.mozilla.org/security/announce/2011/mfsa2011-10.html</url>
</references>
<dates>
<discovery>2011-03-01</discovery>
<entry>2011-03-01</entry>
</dates>
</vuln>
<vuln vid="be3dfe33-410b-11e0-9e02-00215c6a37bb">
<topic>openldap -- two security bypass vulnerabilities</topic>
<affects>
<package>
<name>openldap-server</name>
<range><gt>2.4.0</gt><lt>2.4.24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/43331/">
<p>Two vulnerabilities have been reported in
OpenLDAP, which can be exploited by malicious
people to bypass certain security restrictions.</p>
<p>The vulnerabilities are reported in versions
prior to 2.4.24.</p>
</blockquote>
</body>
</description>
<references>
<url>http://secunia.com/advisories/43331/</url>
</references>
<dates>
<discovery>2011-02-14</discovery>
<entry>2011-02-25</entry>
</dates>
</vuln>
<vuln vid="65d16342-3ec8-11e0-9df7-001c42d23634">
<topic>asterisk -- Exploitable Stack and Heap Array Overflows</topic>
<affects>
<package>
<name>asterisk14</name>
<range><gt>1.4.*</gt><lt>1.4.39.2</lt></range>
</package>
<package>
<name>asterisk16</name>
<range><gt>1.6.*</gt><lt>1.6.2.16.2</lt></range>
</package>
<package>
<name>asterisk18</name>
<range><gt>1.8.*</gt><lt>1.8.2.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk Development Team reports:</p>
<blockquote cite="http://lists.digium.com/pipermail/asterisk-announce/2011-February/000302.html">
<p>The releases of Asterisk 1.4.39.2, 1.6.1.22, 1.6.2.16.2, and
1.8.2.4 resolve an issue that when decoding UDPTL packets, multiple
heap based arrays can be made to overflow by specially
crafted packets. Systems configured for T.38 pass through or
termination are vulnerable. The issue and resolution are described
in the AST-2011-002 security advisory.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2011-002.html</url>
<url>http://secunia.com/advisories/43429/</url>
</references>
<dates>
<discovery>2011-02-21</discovery>
<entry>2011-02-22</entry>
</dates>
</vuln>
<vuln vid="ae0e5835-3cad-11e0-b654-00215c6a37bb">
<topic>PivotX -- administrator password reset vulnerability</topic>
<affects>
<package>
<name>pivotx</name>
<range><lt>2.2.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>US CERT reports:</p>
<blockquote cite="http://www.kb.cert.org/vuls/id/175068">
<p>PivotX contains a vulnerability that allows an
attacker to change the password of any account
just by guessing the username. Version 2.2.4 has
been reported to not be affected.
This vulnerability is being exploited in the wild
and users should immediately upgrade to 2.2.5 or
later. Mitigation steps for users that have been
compromised have been posted to the <a href="http://forum.pivotx.net/viewtopic.php?f=2&amp;t=1967">PivotX
Support Community</a>.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-1035</cvename>
</references>
<dates>
<discovery>2011-02-18</discovery>
<entry>2011-02-20</entry>
</dates>
</vuln>
<vuln vid="553ec4ed-38d6-11e0-94b1-000c29ba66d2">
<topic>tomcat -- Cross-site scripting vulnerability</topic>
<affects>
<package>
<name>tomcat</name>
<range><gt>5.5.0</gt><lt>5.5.32</lt></range>
</package>
<package>
<name>tomcat</name>
<range><gt>6.0.0</gt><lt>6.0.30</lt></range>
</package>
<package>
<name>tomcat</name>
<range><gt>7.0.0</gt><lt>7.0.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Tomcat security team reports:</p>
<blockquote cite="http://tomcat.apache.org/security-5.html#Fixed_in_Apache_Tomcat_5.5.32">
<p>The HTML Manager interface displayed web applciation
provided data, such as display names, without filtering.
A malicious web application could trigger script execution
by an administartive user when viewing the manager pages.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-0013</cvename>
<url>http://tomcat.apache.org/security-5.html#Fixed_in_Apache_Tomcat_5.5.32</url>
<url>http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.30</url>
<url>http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.6</url>
</references>
<dates>
<discovery>2010-11-12</discovery>
<entry>2011-02-15</entry>
<modified>2011-09-30</modified>
</dates>
</vuln>
<vuln vid="cd68ff50-362b-11e0-ad36-00215c6a37bb">
<topic>phpMyAdmin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><lt>3.3.9.2</lt></range>
</package>
<package>
<name>phpMyAdmin211</name>
<range><lt>2.11.11.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>phpMyAdmin team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-2.php">
<p>It was possible to create a bookmark which would be executed
unintentionally by other users.</p>
</blockquote>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-1.php">
<p>When the files README, ChangeLog or LICENSE have been removed
from their original place (possibly by the distributor), the
scripts used to display these files can show their full path,
leading to possible further attacks.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-2.php</url>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-1.php</url>
</references>
<dates>
<discovery>2011-02-08</discovery>
<entry>2011-02-11</entry>
</dates>
</vuln>
<vuln vid="4a3482da-3624-11e0-b995-001b2134ef46">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplugin</name>
<range><le>9.0r289</le></range>
</package>
<package>
<name>linux-f8-flashplugin</name>
<name>linux-f10-flashplugin</name>
<range><lt>10.2r152</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe Product Security Incident Response Team reports:</p>
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb11-02.html">
<p>Critical vulnerabilities have been identified in
Adobe Flash Player 10.1.102.64 and earlier versions for
Windows, Macintosh, Linux, and Solaris. These vulnerabilities
could cause the application to crash and could potentially
allow an attacker to take control of the affected system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-0558</cvename>
<cvename>CVE-2011-0559</cvename>
<cvename>CVE-2011-0560</cvename>
<cvename>CVE-2011-0561</cvename>
<cvename>CVE-2011-0571</cvename>
<cvename>CVE-2011-0572</cvename>
<cvename>CVE-2011-0573</cvename>
<cvename>CVE-2011-0574</cvename>
<cvename>CVE-2011-0575</cvename>
<cvename>CVE-2011-0577</cvename>
<cvename>CVE-2011-0578</cvename>
<cvename>CVE-2011-0607</cvename>
<cvename>CVE-2011-0608</cvename>
<url>http://www.adobe.com/support/security/bulletins/apsb11-02.html</url>
</references>
<dates>
<discovery>2011-02-08</discovery>
<entry>2011-02-11</entry>
</dates>
</vuln>
<vuln vid="53bde960-356b-11e0-8e81-0022190034c0">
<topic>mupdf -- Remote System Access</topic>
<affects>
<package>
<name>mupdf</name>
<range><lt>0.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/43020/">
<p>The vulnerability is caused due to an error within the
"closedctd()" function in fitz/filt_dctd.c when processing PDF
files containing certain malformed JPEG images. This can be
exploited to cause a stack corruption by e.g. tricking a user
into opening a specially crafted PDF file.</p>
</blockquote>
</body>
</description>
<references>
<bid>46027</bid>
<url>http://secunia.com/advisories/43020/</url>
</references>
<dates>
<discovery>2011-01-26</discovery>
<entry>2011-02-10</entry>
</dates>
</vuln>
<vuln vid="1cae628c-3569-11e0-8e81-0022190034c0">
<topic>rubygem-mail -- Remote Arbitrary Shell Command Injection Vulnerability</topic>
<affects>
<package>
<name>rubygem-mail</name>
<range><lt>2.2.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/43077/">
<p>Input passed via an email from address is not properly sanitised
in the "deliver()" function (lib/mail/network/delivery_methods/sendmail.rb)
before being used as a command line argument. This can be exploited
to inject arbitrary shell commands.</p>
</blockquote>
</body>
</description>
<references>
<bid>46021</bid>
<cvename>CVE-2011-0739</cvename>
<url>http://secunia.com/advisories/43077/</url>
<url>http://groups.google.com/group/mail-ruby/browse_thread/thread/e93bbd05706478dd?pli=1</url>
</references>
<dates>
<discovery>2011-01-25</discovery>
<entry>2011-02-10</entry>
</dates>
</vuln>
<vuln vid="7c492ea2-3566-11e0-8e81-0022190034c0">
<topic>plone -- Remote Security Bypass</topic>
<affects>
<package>
<name>plone</name>
<range><ge>2.5</ge><lt>3</lt></range>
</package>
<package>
<name>plone3</name>
<range><ge>3</ge><le>3.3</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Plone developer reports:</p>
<blockquote cite="http://plone.org/products/plone/security/advisories/cve-2011-0720">
<p>This is an escalation of privileges attack that can be used by
anonymous users to gain access to a Plone site's administration
controls, view unpublished content, create new content and modify a
site's skin. The sandbox protecting access to the underlying
system is still in place, and it does not grant access to other
applications running on the same Zope instance.</p>
</blockquote>
</body>
</description>
<references>
<bid>46102</bid>
<cvename>CVE-2011-0720</cvename>
<url>http://plone.org/products/plone/security/advisories/cve-2011-0720</url>
</references>
<dates>
<discovery>2011-02-02</discovery>
<entry>2011-02-10</entry>
</dates>
</vuln>
<vuln vid="44ccfab0-3564-11e0-8e81-0022190034c0">
<topic>exim -- local privilege escalation</topic>
<affects>
<package>
<name>exim</name>
<name>exim-ldap</name>
<name>exim-ldap2</name>
<name>exim-mysql</name>
<name>exim-postgresql</name>
<name>exim-sa-exim</name>
<range><lt>4.74</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>exim.org reports:</p>
<blockquote cite="ftp://ftp.exim.org/pub/exim/ChangeLogs/ChangeLog-4.74">
<p>CVE-2011-0017 - check return value of setuid/setgid. This is a
privilege escalation vulnerability whereby the Exim run-time user
can cause root to append content of the attacker's choosing to
arbitrary files.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-0017</cvename>
<url>ftp://ftp.exim.org/pub/exim/ChangeLogs/ChangeLog-4.74</url>
</references>
<dates>
<discovery>2011-01-31</discovery>
<entry>2011-02-10</entry>
</dates>
</vuln>
<vuln vid="f2b43905-3545-11e0-8e81-0022190034c0">
<topic>openoffice.org -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>openoffice.org</name>
<range><lt>3.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenOffice.org Security Team reports:</p>
<blockquote cite="http://www.openoffice.org/security/bulletin.html">
<p>Fixed in OpenOffice.org 3.3</p>
<ul>
<li><a href="http://www.openoffice.org/security/cves/CVE-2010-2935_CVE-2010-2936.html">
CVE-2010-2935 / CVE-2010-2936</a>: Security Vulnerability in OpenOffice.org related to PowerPoint document processing</li>
<li><a href="http://www.openoffice.org/security/cves/CVE-2010-3450.html">
CVE-2010-3450</a>: Security Vulnerability in OpenOffice.org related to Extensions and filter package files</li>
<li><a href="http://www.openoffice.org/security/cves/CVE-2010-3451_CVE-2010-3452.html">
CVE-2010-3451 / CVE-2010-3452</a>: Security Vulnerability in OpenOffice.org related to RTF document processing </li>
<li><a href="http://www.openoffice.org/security/cves/CVE-2010-3453_CVE-2010-3454.html">
CVE-2010-3453 / CVE-2010-3454</a>: Security Vulnerability in OpenOffice.org related to Word document processing </li>
<li><a href="http://www.openoffice.org/security/cves/CVE-2010-3689.html">
CVE-2010-3689</a>: Insecure LD_LIBRARY_PATH usage in OpenOffice.org shell scripts </li>
<li><a href="http://www.openoffice.org/security/cves/CVE-2010-3702_CVE-2010-3704.html">
CVE-2010-3702 / CVE-2010-3704</a>: Security Vulnerability in OpenOffice.org's PDF Import extension resulting from 3rd party library XPDF</li>
<li><a href="http://www.openoffice.org/security/cves/CVE-2010-4008_CVE-2010-4494.html">
CVE-2010-4008 / CVE-2010-4494</a>: Possible Security Vulnerability in OpenOffice.org resulting from 3rd party library LIBXML2 </li>
<li><a href="http://www.openoffice.org/security/cves/CVE-2010-4253.html">
CVE-2010-4253</a>: Security Vulnerability in OpenOffice.org related to PNG file processing </li>
<li><a href="http://www.openoffice.org/security/cves/CVE-2010-4643.html">
CVE-2010-4643</a>: Security Vulnerability in OpenOffice.org related to TGA file processing </li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://www.openoffice.org/security/bulletin.html</url>
<url>http://secunia.com/advisories/40775/</url>
</references>
<dates>
<discovery>2010-08-04</discovery>
<entry>2011-02-10</entry>
</dates>
</vuln>
<vuln vid="35ecdcbe-3501-11e0-afcd-0015f2db7bde">
<topic>webkit-gtk2 -- Multiple vurnabilities.</topic>
<affects>
<package>
<name>webkit-gtk2</name>
<range><lt>1.2.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gustavo Noronha Silva reports:</p>
<blockquote cite="http://permalink.gmane.org/gmane.os.opendarwin.webkit.gtk/405">
<p>This release has essentially security fixes. Refer to the
WebKit/gtk/NEWS file inside the tarball for details. We would like
to thank the Red Hat security team (Huzaifa Sidhpurwala in
particular) and Michael Gilbert from Debian for their help in
checking (and pushing!) security issues affecting the WebKitGTK+
stable branch for this release.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-2901</cvename>
<cvename>CVE-2010-4040</cvename>
<cvename>CVE-2010-4042</cvename>
<cvename>CVE-2010-4199</cvename>
<cvename>CVE-2010-4492</cvename>
<cvename>CVE-2010-4493</cvename>
<cvename>CVE-2010-4578</cvename>
<cvename>CVE-2011-0482</cvename>
<cvename>CVE-2011-0778</cvename>
<url>https://bugs.webkit.org/show_bug.cgi?id=48328</url>
<url>https://bugs.webkit.org/show_bug.cgi?id=50710</url>
<url>https://bugs.webkit.org/show_bug.cgi?id=50840</url>
<url>https://bugs.webkit.org/show_bug.cgi?id=50932</url>
<url>https://bugs.webkit.org/show_bug.cgi?id=51993</url>
<url>https://bugs.webkit.org/show_bug.cgi?id=53265</url>
<url>https://bugs.webkit.org/show_bug.cgi?id=53276</url>
<url>http://permalink.gmane.org/gmane.os.opendarwin.webkit.gtk/405</url>
</references>
<dates>
<discovery>2011-02-08</discovery>
<entry>2011-02-10</entry>
</dates>
</vuln>
<vuln vid="ce6ce2f8-34ac-11e0-8103-00215c6a37bb">
<topic>awstats -- arbitrary commands execution vulnerability</topic>
<affects>
<package>
<name>awstats</name>
<range><lt>7.0,1</lt></range>
</package>
<package>
<name>awstats-devel</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Awstats change log reports:</p>
<blockquote cite="http://awstats.sourceforge.net/docs/awstats_changelog.txt">
<ul>
<li>Security fix (Traverse directory of LoadPlugin)</li>
<li>Security fix (Limit config to defined directory
to avoid access to external config file via a nfs
or webdav link).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-4367</cvename>
<url>http://www.exploitdevelopment.com/Vulnerabilities/2010-WEB-001.html</url>
<url>http://awstats.sourceforge.net/docs/awstats_changelog.txt</url>
</references>
<dates>
<discovery>2010-05-01</discovery>
<entry>2011-02-10</entry>
</dates>
</vuln>
<vuln vid="2eda0c54-34ab-11e0-8103-00215c6a37bb">
<topic>opera -- multiple vulnerabilities</topic>
<affects>
<package>
<name>opera</name>
<name>opera-devel</name>
<name>linux-opera</name>
<range><lt>11.01</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Opera reports:</p>
<blockquote cite="http://www.opera.com/docs/changelogs/unix/1101/">
<p>Opera 11.01 is a recommended upgrade offering security and
stability enhancements.</p>
<p>The following security vulnerabilities have been fixed:</p>
<ul>
<li>Removed support for "<code>javascript:</code>" URLs in
CSS -o-link values, to make it easier for sites to filter
untrusted CSS.</li>
<li>Fixed an issue where large form inputs could allow
execution of arbitrary code, as reported by Jordi Chancel;
see our <a href="http://www.opera.com/support/kb/view/982/">advisory</a>.</li>
<li>Fixed an issue which made it possible to carry out
clickjacking attacks against internal opera: URLs;
see our <a href="http://www.opera.com/support/kb/view/983/">advisory</a>.</li>
<li>Fixed issues which allowed web pages to gain limited
access to files on the user's computer; see our
<a href="http://www.opera.com/support/kb/view/984/">advisory</a>.</li>
<li>Fixed an issue where email passwords were not immediately
deleted when deleting private data; see our
<a href="http://www.opera.com/support/kb/view/986/">advisory</a>.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-0450</cvename>
<cvename>CVE-2011-0681</cvename>
<cvename>CVE-2011-0682</cvename>
<cvename>CVE-2011-0683</cvename>
<cvename>CVE-2011-0684</cvename>
<cvename>CVE-2011-0685</cvename>
<cvename>CVE-2011-0686</cvename>
<cvename>CVE-2011-0687</cvename>
<url>http://www.opera.com/support/kb/view/982/</url>
<url>http://www.opera.com/support/kb/view/983/</url>
<url>http://www.opera.com/support/kb/view/984/</url>
<url>http://secunia.com/advisories/43023</url>
</references>
<dates>
<discovery>2011-01-26</discovery>
<entry>2011-02-10</entry>
</dates>
</vuln>
<vuln vid="bd760627-3493-11e0-8103-00215c6a37bb">
<topic>django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py23-django</name>
<name>py24-django</name>
<name>py25-django</name>
<name>py26-django</name>
<name>py27-django</name>
<name>py30-django</name>
<name>py31-django</name>
<range><gt>1.2</gt><lt>1.2.5</lt></range>
<range><gt>1.1</gt><lt>1.1.4</lt></range>
</package>
<package>
<name>py23-django-devel</name>
<name>py24-django-devel</name>
<name>py25-django-devel</name>
<name>py26-django-devel</name>
<name>py27-django-devel</name>
<name>py30-django-devel</name>
<name>py31-django-devel</name>
<range><lt>15470,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Django project reports:</p>
<blockquote cite="http://www.djangoproject.com/weblog/2011/feb/08/security/">
<p>Today the Django team is issuing multiple releases --
Django 1.2.5 and Django 1.1.4 -- to remedy three security
issues reported to us. All users of affected versions of
Django are urged to upgrade immediately.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.djangoproject.com/weblog/2011/feb/08/security/</url>
</references>
<dates>
<discovery>2011-02-08</discovery>
<entry>2011-02-09</entry>
</dates>
</vuln>
<vuln vid="8d04cfbd-344d-11e0-8669-0025222482c5">
<topic>mediawiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mediawiki</name>
<range><lt>1.16.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Medawiki reports:</p>
<blockquote cite="http://lists.wikimedia.org/pipermail/mediawiki-announce/2011-February/000095.html">
<p>An arbitrary script inclusion vulnerability was discovered. The
vulnerability only allows execution of files with names ending in
".php" which are already present in the local filesystem. Only servers
running Microsoft Windows and possibly Novell Netware are affected.
Despite these mitigating factors, all users are advised to upgrade,
since there is a risk of complete server compromise. MediaWiki 1.8.0
and later is affected.</p>
<p>Security researcher mghack discovered a CSS injection
vulnerability. For Internet Explorer and similar browsers, this is
equivalent to an XSS vulnerability, that is to say, it allows the
compromise of wiki user accounts. For other browsers, it allows private
data such as IP addresses and browsing patterns to be sent to a malicious
external web server. It affects all versions of MediaWiki. All users are
advised to upgrade.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-0047</cvename>
<url>https://bugzilla.wikimedia.org/show_bug.cgi?id=27094</url>
<url>https://bugzilla.wikimedia.org/show_bug.cgi?id=27093</url>
<url>http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_16_2/phase3/RELEASE-NOTES</url>
<url>http://lists.wikimedia.org/pipermail/mediawiki-announce/2011-February/000095.html</url>
</references>
<dates>
<discovery>2011-02-01</discovery>
<entry>2011-02-09</entry>
</dates>
</vuln>
<vuln vid="8c93e997-30e0-11e0-b300-485d605f4717">
<topic>wordpress -- SQL injection vulnerability</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>3.0.2,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>zh-wordpress-zh_CN</name>
<name>zh-wordpress-zh_TW</name>
<range><lt>3.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Vendor reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4257">
<p>SQL injection vulnerability in the do_trackbacks function in
wp-includes/comment.php in WordPress before 3.0.2 allows remote
authenticated users to execute arbitrary SQL commands via the Send
Trackbacks field.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-4257</cvename>
<url>http://www.cvedetails.com/cve/CVE-2010-4257/</url>
</references>
<dates>
<discovery>2010-11-16</discovery>
<entry>2011-02-05</entry>
<modified>2011-02-09</modified>
</dates>
</vuln>
<vuln vid="f9258873-2ee2-11e0-afcd-0015f2db7bde">
<topic>vlc -- Insufficient input validation in MKV demuxer</topic>
<affects>
<package>
<name>vlc</name>
<range><lt>1.1.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>VLC team reports:</p>
<blockquote cite="http://www.videolan.org/security/sa1102.html">
<p>When parsing an invalid MKV (Matroska or WebM) file, input
validation are insufficient.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.videolan.org/security/sa1102.html</url>
</references>
<dates>
<discovery>2011-01-26</discovery>
<entry>2011-02-02</entry>
</dates>
</vuln>
<vuln vid="8015600f-2c80-11e0-9cc1-00163e5bf4f9">
<topic>maradns -- denial of service when resolving a long DNS hostname</topic>
<affects>
<package>
<name>maradns</name>
<range><lt>1.4.06</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MaraDNS developer Sam Trenholme reports:</p>
<blockquote cite="http://samiam.org/blog/20110129.html">
<p>... a mistake in allocating an array of integers, allocating it
in bytes instead of sizeof(int) units. This resulted in a buffer
being too small, allowing it to be overwritten. The impact of this
programming error is that MaraDNS can be crashed by sending
MaraDNS a single "packet of death". Since the data placed in the
overwritten array can not be remotely controlled (it is a list of
increasing integers), there is no way to increase privileges
exploiting this bug.</p>
</blockquote>
</body>
</description>
<references>
<bid>45966</bid>
<cvename>CVE-2011-0520</cvename>
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=610834</url>
</references>
<dates>
<discovery>2011-01-23</discovery>
<entry>2011-01-31</entry>
</dates>
</vuln>
<vuln vid="dc9f8335-2b3b-11e0-a91b-00e0815b8da8">
<topic>isc-dhcp-server -- DHCPv6 crash</topic>
<affects>
<package>
<name>isc-dhcp41-server</name>
<range><le>4.1.2,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="http://www.isc.org/software/dhcp/advisories/cve-2011-0413">
<p>When the DHCPv6 server code processes a message for an address
that was previously declined and internally tagged as abandoned
it can trigger an assert failure resulting in the server crashing.
This could be used to crash DHCPv6 servers remotely. This issue
only affects DHCPv6 servers. DHCPv4 servers are unaffected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-0413</cvename>
<url>http://www.isc.org/software/dhcp/advisories/cve-2011-0413</url>
<url>http://www.kb.cert.org/vuls/id/686084</url>
</references>
<dates>
<discovery>2011-01-26</discovery>
<entry>2011-01-28</entry>
</dates>
</vuln>
<vuln vid="c8c927e5-2891-11e0-8f26-00151735203a">
<topic>bugzilla -- multiple serious vulnerabilities</topic>
<affects>
<package>
<name>bugzilla</name>
<range><ge>2.14.*</ge><lt>3.6.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Bugzilla Security Advisory reports:</p>
<blockquote cite="http://www.bugzilla.org/security/3.2.9/">
<p>This advisory covers three security issues that have recently been
fixed in the Bugzilla code:</p>
<ul>
<li>A weakness in Bugzilla could allow a user to gain unauthorized
access to another Bugzilla account.</li>
<li>A weakness in the Perl CGI.pm module allows injecting HTTP
headers and content to users via several pages in Bugzilla.</li>
<li>If you put a harmful "javascript:" or "data:" URL into
Bugzilla's "URL" field, then there are multiple situations in
which Bugzilla will unintentionally make that link clickable.</li>
<li>Various pages lack protection against cross-site request
forgeries.</li>
</ul>
<p>All affected installations are encouraged to upgrade as soon as
possible.</p>
</blockquote>
</body>
</description>
<references>
<bid>25425</bid>
<cvename>CVE-2010-4568</cvename>
<cvename>CVE-2010-2761</cvename>
<cvename>CVE-2010-4411</cvename>
<cvename>CVE-2010-4572</cvename>
<cvename>CVE-2010-4567</cvename>
<cvename>CVE-2010-0048</cvename>
<cvename>CVE-2011-0046</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=621591</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=619594</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=591165</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=621572</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=619588</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=628034</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=621090</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=621105</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=621107</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=621108</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=621109</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=621110</url>
</references>
<dates>
<discovery>2011-01-24</discovery>
<entry>2011-01-25</entry>
</dates>
</vuln>
<vuln vid="7580f00e-280c-11e0-b7c8-00215c6a37bb">
<topic>dokuwiki -- multiple privilege escalation vulnerabilities</topic>
<affects>
<package>
<name>dokuwiki</name>
<range><lt>20101107a</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Dokuwiki reports:</p>
<blockquote cite="http://bugs.dokuwiki.org/index.php?do=details&amp;task_id=2136">
<p>This security update fixes problems in the XMLRPC
interface where ACLs where not checked correctly
sometimes, making it possible to access and write
information that should not have been accessible/writable.
This only affects users who have enabled the XMLRPC
interface (default is off) and have enabled XMLRPC
access for users who can't access/write all content
anyway (default is nobody, see <a href="http://www.dokuwiki.org/config:xmlrpcuser">http://www.dokuwiki.org/config:xmlrpcuser</a>
for details).</p>
<p>This update also includes a fix for a problem in
the general ACL checking function that could be exploited
to gain access to restricted pages and media files in rare
conditions (when you had rights for an id you could get
the same rights on ids where one character has been
replaced by a ".").</p>
</blockquote>
</body>
</description>
<references>
<url>http://bugs.dokuwiki.org/index.php?do=details&amp;task_id=2136</url>
</references>
<dates>
<discovery>2011-01-16</discovery>
<entry>2011-01-24</entry>
</dates>
</vuln>
<vuln vid="5ab9fb2a-23a5-11e0-a835-0003ba02bf30">
<topic>asterisk -- Exploitable Stack Buffer Overflow</topic>
<affects>
<package>
<name>asterisk14</name>
<range><gt>1.4.*</gt><lt>1.4.39.1</lt></range>
</package>
<package>
<name>asterisk16</name>
<range><gt>1.6.*</gt><lt>1.6.2.16.1</lt></range>
</package>
<package>
<name>asterisk18</name>
<range><gt>1.8.*</gt><lt>1.8.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk Development Team reports:</p>
<blockquote cite="http://lists.digium.com/pipermail/asterisk-announce/2011-January/000297.html">
<p>The releases of Asterisk 1.4.38.1, 1.4.39.1, 1.6.1.21, 1.6.2.15.1,
1.6.2.16.2, 1.8.1.2, and 1.8.2.1 resolve an issue when forming an
outgoing SIP request while in pedantic mode, which can cause a stack
buffer to be made to overflow if supplied with carefully crafted
caller ID information. The issue and resolution are described in the
AST-2011-001 security advisory.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2011-001.pdf</url>
</references>
<dates>
<discovery>2011-01-18</discovery>
<entry>2011-01-19</entry>
</dates>
</vuln>
<vuln vid="2c2d4e83-2370-11e0-a91b-00e0815b8da8">
<topic>tarsnap -- cryptographic nonce reuse</topic>
<affects>
<package>
<name>tarsnap</name>
<range><ge>1.0.22</ge><le>1.0.27</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Colin Percival reports:</p>
<blockquote cite="http://www.daemonology.net/blog/2011-01-18-tarsnap-critical-security-bug.html">
<p>In versions 1.0.22 through 1.0.27 of Tarsnap, the CTR nonce value
is not incremented after each chunk is encrypted. (The CTR counter
is correctly incremented after each 16 bytes of data was processed,
but this counter is reset to zero for each new chunk.)</p>
<p>Note that since the Tarsnap client-server protocol is encrypted,
being able to intercept Tarsnap client-server traffic does not
provide an attacker with access to the data.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.daemonology.net/blog/2011-01-18-tarsnap-critical-security-bug.html</url>
</references>
<dates>
<discovery>2011-01-18</discovery>
<entry>2011-01-19</entry>
</dates>
</vuln>
<vuln vid="4c017345-1d89-11e0-bbee-0014a5e3cda6">
<topic>MoinMoin -- cross-site scripting vulnerabilities</topic>
<affects>
<package>
<name>moinmoin</name>
<range><lt>1.9.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The MoinMoin developers reports:</p>
<blockquote cite="http://hg.moinmo.in/moin/1.9/raw-file/1.9.3/docs/CHANGES">
<p>Fix XSS in Despam action (CVE-2010-0828)</p>
</blockquote>
<blockquote cite="http://moinmo.in/MoinMoinBugs/1.9.2UnescapedInputForThemeAddMsg">
<p>Fix XSS issues</p>
<ul>
<li>by escaping template name in messages</li>
<li>by fixing other places that had similar issues</li>
</ul>
</blockquote>
</body>
</description>
<references>
<bid>39110</bid>
<cvename>CVE-2010-0828</cvename>
<url>http://hg.moinmo.in/moin/1.9/raw-file/1.9.3/docs/CHANGES</url>
<url>http://moinmo.in/MoinMoinBugs/1.9.2UnescapedInputForThemeAddMsg</url>
</references>
<dates>
<discovery>2010-04-05</discovery>
<entry>2011-01-11</entry>
</dates>
</vuln>
<vuln vid="38bdf10e-2293-11e0-bfa4-001676740879">
<topic>tor -- remote code execution and crash</topic>
<affects>
<package>
<name>tor</name>
<range><lt>0.2.1.29</lt></range>
</package>
<package>
<name>tor-devel</name>
<range><lt>0.2.2.21.a</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Tor Project reports:</p>
<blockquote cite="http://archives.seul.org/or/announce/Jan-2011/msg00000.html">
<p>A remote heap overflow vulnerability that can allow remote
code execution. Other fixes address a variety of assert and crash
bugs, most of which we think are hard to exploit remotely.
All Tor users should upgrade.</p>
</blockquote>
</body>
</description>
<references>
<bid>45832</bid>
<cvename>CVE-2011-0427</cvename>
<freebsdpr>ports/154099</freebsdpr>
<mlist msgid="20110117155813.GG3300@moria.seul.org">http://archives.seul.org/or/announce/Jan-2011/msg00000.html</mlist>
<url>https://gitweb.torproject.org/tor.git/blob/release-0.2.1:/ChangeLog</url>
<url>https://gitweb.torproject.org/tor.git/blob/release-0.2.2:/ChangeLog</url>
</references>
<dates>
<discovery>2011-01-15</discovery>
<entry>2011-01-17</entry>
</dates>
</vuln>
<vuln vid="908f4cf2-1e8b-11e0-a587-001b77d09812">
<topic>sudo -- local privilege escalation</topic>
<affects>
<package>
<name>sudo</name>
<range><ge>1.7.0</ge><lt>1.7.4.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Todd Miller reports:</p>
<blockquote cite="http://www.sudo.ws/sudo/alerts/runas_group_pw.html">
<p>Beginning with sudo version 1.7.0 it has been possible
to grant permission to run a command using a specified
group via sudo's -g option (run as group), if allowed by
the sudoers file. A flaw exists in sudo's password
checking logic that allows a user to run a command
with only the group changed without being prompted
for a password.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-0010</cvename>
<url>http://www.sudo.ws/sudo/alerts/runas_group_pw.html</url>
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=609641</url>
</references>
<dates>
<discovery>2011-01-11</discovery>
<entry>2011-01-13</entry>
</dates>
</vuln>
<vuln vid="71612099-1e93-11e0-a587-001b77d09812">
<topic>subversion -- multiple DoS</topic>
<affects>
<package>
<name>subversion</name>
<range><lt>1.6.15</lt></range>
</package>
<package>
<name>subversion-freebsd</name>
<range><lt>1.6.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Entry for CVE-2010-4539 says:</p>
<blockquote cite="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-4539">
<p>The walk function in repos.c in the mod_dav_svn module
for the Apache HTTP Server, as distributed in Apache
Subversion before 1.6.15, allows remote authenticated
users to cause a denial of service (NULL pointer
dereference and daemon crash) via vectors that trigger
the walking of SVNParentPath collections.</p>
</blockquote>
<p>Entry for CVE-2010-4644 says:</p>
<blockquote cite="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-4644">
<p>Multiple memory leaks in rev_hunt.c in Apache Subversion
before 1.6.15 allow remote authenticated users to cause
a denial of service (memory consumption and daemon crash)
via the -g option to the blame command.</p>
</blockquote>
</body>
</description>
<references>
<bid>45655</bid>
<cvename>CVE-2010-4539</cvename>
<cvename>CVE-2010-4644</cvename>
</references>
<dates>
<discovery>2011-01-02</discovery>
<entry>2011-01-13</entry>
</dates>
</vuln>
<vuln vid="2b6ed5c7-1a7f-11e0-b61d-000c29d1636d">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php5</name>
<range><lt>5.3.5</lt></range>
</package>
<package>
<name>php52</name>
<range><lt>5.2.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PHP developers reports:</p>
<blockquote cite="http://www.php.net/releases/5_3_5.php">
<p>Security Enhancements and Fixes in PHP 5.3.5:</p>
<ul>
<li>Fixed bug #53632 (PHP hangs on numeric value
2.2250738585072011e-308). (CVE-2010-4645)</li>
</ul>
</blockquote>
<blockquote cite="http://www.php.net/releases/5_2_17.php">
<p>Security Enhancements and Fixes in PHP 5.2.17:</p>
<ul>
<li>Fixed bug #53632 (PHP hangs on numeric value
2.2250738585072011e-308). (CVE-2010-4645)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-4645</cvename>
</references>
<dates>
<discovery>2011-01-06</discovery>
<entry>2011-01-09</entry>
<modified>2011-01-09</modified>
</dates>
</vuln>
<vuln vid="e4fcf020-0447-11e0-becc-0022156e8794">
<topic>exim -- local privilege escalation</topic>
<affects>
<package>
<name>exim</name>
<range><lt>4.73</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>David Woodhouse reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=661756#c3">
<p>Secondly a privilege escalation where the trusted 'exim'
user is able to tell Exim to use arbitrary config files,
in which further ${run ...} commands will be invoked as
root.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-4345</cvename>
<url>http://www.exim.org/lurker/message/20101209.022730.dbb6732d.en.html</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=661756#c3</url>
</references>
<dates>
<discovery>2010-12-10</discovery>
<entry>2011-01-08</entry>
</dates>
</vuln>
<vuln vid="e177c410-1943-11e0-9d1c-000c29ba66d2">
<topic>mediawiki -- Clickjacking vulnerabilities</topic>
<affects>
<package>
<name>mediawiki</name>
<range><gt>1.16</gt><lt>1.16.1</lt></range>
<range><gt>1.15</gt><lt>1.15.5_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Clickjacking vulnerabilities:</p>
<blockquote cite="https://bugzilla.wikimedia.org/show_bug.cgi?id=26561">
<p>Clickjacking is a type of vulnerability discovered in 2008, which
is similar to CSRF. The attack involves displaying the target webpage
in a iframe embedded in a malicious website. Using CSS, the submit button
of the form on the targeit webpage is made invisible, and then overlaid
with some button or link on the malicious website that encourages
the user to click on it.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugzilla.wikimedia.org/show_bug.cgi?id=26561</url>
</references>
<dates>
<discovery>2011-01-04</discovery>
<entry>2011-01-06</entry>
</dates>
</vuln>
<vuln vid="06a12e26-142e-11e0-bea2-0015f2db7bde">
<topic>webkit-gtk2 -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>webkit-gtk2</name>
<range><lt>1.2.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gustavo Noronha Silva reports:</p>
<blockquote cite="http://gitorious.org/webkitgtk/stable/blobs/master/WebKit/gtk/NEWS">
<p>The patches to fix the following CVEs are included with help
from Huzaifa Sidhpurwala from the Red Hat security team.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-1791</cvename>
<cvename>CVE-2010-3812</cvename>
<cvename>CVE-2010-3813</cvename>
<cvename>CVE-2010-4197</cvename>
<cvename>CVE-2010-4198</cvename>
<cvename>CVE-2010-4204</cvename>
<cvename>CVE-2010-4206</cvename>
<cvename>CVE-2010-4577</cvename>
<url>http://gitorious.org/webkitgtk/stable/blobs/master/WebKit/gtk/NEWS</url>
</references>
<dates>
<discovery>2010-12-28</discovery>
<entry>2010-12-30</entry>
</dates>
</vuln>
<vuln vid="14a37474-1383-11e0-8a58-00215c6a37bb">
<topic>django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py23-django</name>
<name>py24-django</name>
<name>py25-django</name>
<name>py26-django</name>
<name>py27-django</name>
<name>py30-django</name>
<name>py31-django</name>
<range><gt>1.2</gt><lt>1.2.4</lt></range>
<range><gt>1.1</gt><lt>1.1.3</lt></range>
</package>
<package>
<name>py23-django-devel</name>
<name>py24-django-devel</name>
<name>py25-django-devel</name>
<name>py26-django-devel</name>
<name>py27-django-devel</name>
<name>py30-django-devel</name>
<name>py31-django-devel</name>
<range><lt>15032,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Django project reports:</p>
<blockquote cite="http://www.djangoproject.com/weblog/2010/dec/22/security/">
<p>Today the Django team is issuing multiple releases
-- Django 1.2.4, Django 1.1.3 and Django 1.3 beta 1 --
to remedy two security issues reported to us. All users
of affected versions of Django are urged to upgrade
immediately.</p>
<h3>Information leakage in Django administrative interface</h3>
<p>The Django administrative interface, django.contrib.admin
supports filtering of displayed lists of objects by fields
on the corresponding models, including across database-level
relationships. This is implemented by passing lookup arguments
in the querystring portion of the URL, and options on the
ModelAdmin class allow developers to specify particular
fields or relationships which will generate automatic links
for filtering.</p>
<h3>Denial-of-service attack in password-reset mechanism</h3>
<p>Django's bundled authentication framework,
django.contrib.auth, offers views which allow users to
reset a forgotten password. The reset mechanism involves
generating a one-time token composed from the user's ID,
the timestamp of the reset request converted to a base36
integer, and a hash derived from the user's current password
hash (which will change once the reset is complete, thus
invalidating the token).</p>
</blockquote>
</body>
</description>
<references>
<bid>45562</bid>
<bid>45563</bid>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=665373</url>
<url>http://secunia.com/advisories/42715/</url>
</references>
<dates>
<discovery>2010-12-22</discovery>
<entry>2010-12-29</entry>
</dates>
</vuln>
<vuln vid="ff8b419a-0ffa-11e0-becc-0022156e8794">
<topic>Drupal Views plugin -- cross-site scripting</topic>
<affects>
<package>
<name>drupal6-views</name>
<range><lt>2.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal security team reports:</p>
<blockquote cite="http://drupal.org/node/999380">
<p>The Views module provides a flexible method for Drupal site
designers to control how lists and tables of content are
presented. Under certain circumstances, Views could display
parts of the page path without escaping, resulting in a
relected Cross Site Scripting (XSS) vulnerability. An attacker
could exploit this to gain full administrative access.</p>
<p>Mitigating factors: This vulnerability only occurs with a
specific combination of configuration options for a specific
View, but this combination is used in the default Views
provided by some additional modules. A malicious user would
need to get an authenticated administrative user to visit a
specially crafted URL.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-4521</cvename>
<url>http://drupal.org/node/999380</url>
</references>
<dates>
<discovery>2010-12-15</discovery>
<entry>2010-12-28</entry>
</dates>
</vuln>
<vuln vid="584c506d-0e98-11e0-b59b-0050569b2d21">
<topic>redmine -- multiple vulnerabilities</topic>
<affects>
<package>
<name>redmine</name>
<range><lt>1.0.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jean-Philippe Lang reports:</p>
<blockquote cite="http://www.redmine.org/news/49">
<p>This release also fixes 3 security issues reported by
joernchen of Phenoelit:</p>
<ul>
<li>logged in users may be able to access private data
(affected versions: 1.0.x)</li>
<li>persistent XSS vulnerability in textile formatter
(affected versions: all previous releases)</li>
<li>remote command execution in bazaar repository adapter
(affected versions: 0.9.x, 1.0.x)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://www.redmine.org/news/49</url>
</references>
<dates>
<discovery>2010-12-23</discovery>
<entry>2010-12-23</entry>
</dates>
</vuln>
<vuln vid="4bd33bc5-0cd6-11e0-bfa4-001676740879">
<topic>tor -- remote crash and potential remote code execution</topic>
<affects>
<package>
<name>tor</name>
<range><lt>0.2.1.28</lt></range>
</package>
<package>
<name>tor-devel</name>
<range><lt>0.2.2.20-alpha</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Tor Project reports:</p>
<blockquote cite="http://archives.seul.org/or/announce/Dec-2010/msg00000.html">
<p>Remotely exploitable bug that could be used to crash instances
of Tor remotely by overflowing on the heap. Remote-code execution
hasn't been confirmed, but can't be ruled out. Everyone should
upgrade.</p>
</blockquote>
</body>
</description>
<references>
<bid>45500</bid>
<cvename>CVE-2010-1676</cvename>
<freebsdpr>ports/153326</freebsdpr>
<mlist msgid="20101220135830.GU3300@moria.seul.org">http://archives.seul.org/or/announce/Dec-2010/msg00000.html</mlist>
<mlist msgid="20101220141526.GS3255@moria.seul.org">http://archives.seul.org/or/talk/Dec-2010/msg00167.html</mlist>
<url>https://gitweb.torproject.org/tor.git/blob/release-0.2.1:/ChangeLog</url>
<url>https://gitweb.torproject.org/tor.git/blob/release-0.2.2:/ChangeLog</url>
</references>
<dates>
<discovery>2010-12-17</discovery>
<entry>2010-12-22</entry>
</dates>
</vuln>
<vuln vid="d560b346-08a2-11e0-bcca-0050568452ac">
<topic>YUI JavaScript library -- JavaScript injection exploits in Flash components</topic>
<affects>
<package>
<name>yahoo-ui</name>
<range><lt>2.8.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The YUI team reports:</p>
<blockquote cite="http://yuilibrary.com/support/2.8.2/">
<p>A security-related defect was introduced in the YUI 2 Flash
component infrastructure beginning with the YUI 2.4.0 release.
This defect allows JavaScript injection exploits to be created
against domains that host affected YUI .swf files.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-4207</cvename>
<cvename>CVE-2010-4208</cvename>
<cvename>CVE-2010-4209</cvename>
<url>http://www.yuiblog.com/blog/2010/10/25/yui-2-8-2-security-update/</url>
<url>http://secunia.com/advisories/41955</url>
<url>http://www.openwall.com/lists/oss-security/2010/11/07/1</url>
<url>http://yuilibrary.com/support/2.8.2/</url>
</references>
<dates>
<discovery>2010-10-25</discovery>
<entry>2010-12-15</entry>
</dates>
</vuln>
<vuln vid="2a41233d-10e7-11e0-becc-0022156e8794">
<topic>php-zip -- multiple Denial of Service vulnerabilities</topic>
<affects>
<package>
<name>php5-zip</name>
<range><lt>5.3.4</lt></range>
</package>
<package>
<name>php52-zip</name>
<range><lt>5.2.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The following DoS conditions in Zip extension
were fixed in PHP 5.3.4 and PHP 5.2.15:</p>
<ul>
<li>
<blockquote cite="http://www.php.net/releases/5_3_4.php">
<p>Fixed crash in zip extract method (possible
CWE-170).</p>
</blockquote>
</li>
<li>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3709">
<p>The ZipArchive::getArchiveComment function
in PHP 5.2.x through 5.2.14 and 5.3.x through 5.3.3
allows context-dependent attackers to cause a denial
of service (NULL pointer dereference and application
crash) via a crafted ZIP archive.</p>
</blockquote>
</li>
</ul>
</body>
</description>
<references>
<cvename>CVE-2010-3709</cvename>
<url>http://www.php.net/releases/5_3_4.php</url>
<url>http://www.php.net/releases/5_2_15.php</url>
<url>http://securityreason.com/achievement_securityalert/90</url>
</references>
<dates>
<discovery>2010-12-13</discovery>
<entry>2011-01-13</entry>
</dates>
</vuln>
<vuln vid="c623f058-10e7-11e0-becc-0022156e8794">
<topic>php-filter -- Denial of Service</topic>
<affects>
<package>
<name>php5-filter</name>
<range><lt>5.3.4</lt></range>
</package>
<package>
<name>php52-filter</name>
<range><lt>5.2.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The following DoS condition in filter extension
was fixed in PHP 5.3.4 and PHP 5.2.15:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3710">
<p>Stack consumption vulnerability in the filter_var
function in PHP 5.2.x through 5.2.14 and 5.3.x through
5.3.3, when FILTER_VALIDATE_EMAIL mode is used, allows
remote attackers to cause a denial of service (memory
consumption and application crash) via a long e-mail
address string.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-3710</cvename>
<url>http://www.php.net/releases/5_3_4.php</url>
<url>http://www.php.net/releases/5_2_15.php</url>
</references>
<dates>
<discovery>2010-12-13</discovery>
<entry>2011-01-13</entry>
</dates>
</vuln>
<vuln vid="1a0704e7-0edf-11e0-becc-0022156e8794">
<topic>php-imap -- Denial of Service</topic>
<affects>
<package>
<name>php5-imap</name>
<range><lt>5.3.4</lt></range>
</package>
<package>
<name>php52-imap</name>
<range><lt>5.2.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The following DoS condition in IMAP extension
was fixed in PHP 5.3.4 and PHP 5.2.15:</p>
<blockquote cite="http://securitytracker.com/alerts/2010/Nov/1024761.html">
<p>A remote user can send specially crafted IMAP user name
or password data to trigger a double free memory error
in 'ext/imap/php_imap.c' and cause the target service
to crash.</p>
<p>It may be possible to execute arbitrary code.
However, code execution was not confirmed.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-4150</cvename>
<url>http://www.php.net/releases/5_3_4.php</url>
<url>http://www.php.net/releases/5_2_15.php</url>
</references>
<dates>
<discovery>2010-12-13</discovery>
<entry>2011-01-13</entry>
</dates>
</vuln>
<vuln vid="da3d381b-0ee6-11e0-becc-0022156e8794">
<topic>pecl-phar -- format string vulnerability</topic>
<affects>
<package>
<name>pecl-phar</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Entry for CVE-2010-2094 says:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2094">
<p>Multiple format string vulnerabilities in the phar
extension in PHP 5.3 before 5.3.2 allow context-dependent
attackers to obtain sensitive information (memory
contents) and possibly execute arbitrary code via a
crafted phar:// URI that is not properly handled by the
(1) phar_stream_flush, (2) phar_wrapper_unlink,
(3) phar_parse_url, or (4) phar_wrapper_open_url functions
in ext/phar/stream.c; and the (5) phar_wrapper_open_dir
function in ext/phar/dirstream.c, which triggers errors
in the php_stream_wrapper_log_error function.</p>
</blockquote>
<p>PECL source code for PHAR extension shares the same code,
so it is vulnerable too.</p>
</body>
</description>
<references>
<cvename>CVE-2010-2094</cvename>
<url>http://php-security.org/2010/05/14/mops-2010-024-php-phar_stream_flush-format-string-vulnerability/index.html</url>
<url>http://php-security.org/2010/05/14/mops-2010-025-php-phar_wrapper_open_dir-format-string-vulnerability/index.htm</url>
<url>http://php-security.org/2010/05/14/mops-2010-026-php-phar_wrapper_unlink-format-string-vulnerability/index.htm</url>
<url>http://php-security.org/2010/05/14/mops-2010-027-php-phar_parse_url-format-string-vulnerabilities/index.htm</url>
<url>http://php-security.org/2010/05/14/mops-2010-028-php-phar_wrapper_open_url-format-string-vulnerabilities/index.html</url>
</references>
<dates>
<discovery>2010-12-13</discovery>
<entry>2011-01-13</entry>
</dates>
</vuln>
<vuln vid="3761df02-0f9c-11e0-becc-0022156e8794">
<topic>php -- NULL byte poisoning</topic>
<affects>
<package>
<name>php5</name>
<range><lt>5.3.4</lt></range>
</package>
<package>
<name>php52</name>
<range><lt>5.2.17_12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PHP-specific version of NULL-byte poisoning was briefly
described by ShAnKaR:</p>
<blockquote cite="http://www.securityfocus.com/archive/1/archive/1/445788/100/0/threaded">
<p>Poison NULL byte vulnerability for perl CGI applications
was described in
<a href="http://artofhacking.com/files/phrack/phrack55/P55-07.TXT">[1]</a>.
ShAnKaR noted, that same vulnerability also affects
different PHP applications.</p>
</blockquote>
<p>PHP developers report that branch 5.3 received a fix:</p>
<blockquote cite="http://www.php.net/releases/5_3_4.php">
<p>Paths with NULL in them (foo\0bar.txt) are now considered
as invalid (CVE-2006-7243).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-7243</cvename>
<url>http://www.securityfocus.com/archive/1/archive/1/445788/100/0/threaded</url>
<url>http://artofhacking.com/files/phrack/phrack55/P55-07.TXT</url>
</references>
<dates>
<discovery>2010-12-10</discovery>
<entry>2011-01-13</entry>
<modified>2012-11-25</modified>
</dates>
</vuln>
<vuln vid="73634294-0fa7-11e0-becc-0022156e8794">
<topic>php -- open_basedir bypass</topic>
<affects>
<package>
<name>php5</name>
<range><lt>5.3.4</lt></range>
</package>
<package>
<name>php52</name>
<range><lt>5.2.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3436">
<p>fopen_wrappers.c in PHP 5.3.x through 5.3.3 might allow
remote attackers to bypass open_basedir restrictions via
vectors related to the length of a filename.</p>
</blockquote>
</body>
</description>
<references>
<bid>44723</bid>
<cvename>CVE-2010-3436</cvename>
</references>
<dates>
<discovery>2010-12-10</discovery>
<entry>2011-01-13</entry>
</dates>
</vuln>
<vuln vid="f3148a05-0fa7-11e0-becc-0022156e8794">
<topic>php -- corruption of $GLOBALS and $this variables via extract() method</topic>
<affects>
<package>
<name>php5</name>
<range><lt>5.3.4</lt></range>
</package>
<package>
<name>php52</name>
<range><lt>5.2.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Off-by-one error in the sanity validator for the extract()
method allowed attackers to replace the values of $GLOBALS
and $this when mode EXTR_OVERWRITE was used.</p>
</body>
</description>
<references>
<url>http://www.mail-archive.com/php-cvs@lists.php.net/msg47722.html</url>
<url>http://www.php.net/releases/5_2_15.php</url>
</references>
<dates>
<discovery>2010-12-10</discovery>
<entry>2011-01-13</entry>
</dates>
</vuln>
<vuln vid="b2a6fc0e-070f-11e0-a6e9-00215c6a37bb">
<cancelled/>
</vuln>
<vuln vid="1d8ff4a2-0445-11e0-8e32-000f20797ede">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>3.6.*,1</gt><lt>3.6.13,1</lt></range>
<range><gt>3.5.*,1</gt><lt>3.5.16,1</lt></range>
</package>
<package>
<name>libxul</name>
<range><gt>1.9.2.*</gt><lt>1.9.2.13</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>3.6.13,1</lt></range>
</package>
<package>
<name>linux-firefox-devel</name>
<range><lt>3.5.16</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><gt>2.0.*</gt><lt>2.0.11</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><ge>3.1</ge><lt>3.1.7</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><gt>2.0.*</gt><lt>2.0.11</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><ge>3.0</ge><lt>3.0.11</lt></range>
<range><ge>3.1</ge><lt>3.1.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2010-74 Miscellaneous memory safety hazards (rv:1.9.2.13/ 1.9.1.16)</p>
<p>MFSA 2010-75 Buffer overflow while line breaking after document.write with long string</p>
<p>MFSA 2010-76 Chrome privilege escalation with window.open and isindex element</p>
<p>MFSA 2010-77 Crash and remote code execution using HTML tags inside a XUL tree</p>
<p>MFSA 2010-78 Add support for OTS font sanitizer</p>
<p>MFSA 2010-79 Java security bypass from LiveConnect loaded via data: URL meta refresh</p>
<p>MFSA 2010-80 Use-after-free error with nsDOMAttribute MutationObserver</p>
<p>MFSA 2010-81 Integer overflow vulnerability in NewIdArray</p>
<p>MFSA 2010-82 Incomplete fix for CVE-2010-0179</p>
<p>MFSA 2010-83 Location bar SSL spoofing using network error page</p>
<p>MFSA 2010-84 XSS hazard in multiple character encodings</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-3766</cvename>
<cvename>CVE-2010-3767</cvename>
<cvename>CVE-2010-3768</cvename>
<cvename>CVE-2010-3769</cvename>
<cvename>CVE-2010-3770</cvename>
<cvename>CVE-2010-3771</cvename>
<cvename>CVE-2010-3772</cvename>
<cvename>CVE-2010-3773</cvename>
<cvename>CVE-2010-3774</cvename>
<cvename>CVE-2010-3775</cvename>
<cvename>CVE-2010-3776</cvename>
<cvename>CVE-2010-3777</cvename>
<cvename>CVE-2010-3778</cvename>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-74.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-75.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-76.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-77.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-78.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-79.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-80.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-81.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-82.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-83.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-84.html</url>
</references>
<dates>
<discovery>2010-12-09</discovery>
<entry>2010-12-10</entry>
</dates>
</vuln>
<vuln vid="4ccbd40d-03f7-11e0-bf50-001a926c7637">
<topic>krb5 -- client impersonation vulnerability</topic>
<affects>
<package>
<name>krb5</name>
<range><ge>1.7.0</ge><lt>1.7.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The MIT Kerberos team reports:</p>
<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt">
<p>MIT krb5 KDC may issue tickets not requested
by a client, based on an attacker-chosen KrbFastArmoredReq.</p>
<p>An authenticated remote attacker that controls a legitimate service
principal could obtain a valid service ticket to itself containing
valid KDC-generated authorization data for a client whose TGS-REQ it
has intercepted. The attacker could then use this ticket for
S4U2Proxy to impersonate the targeted client even if the client
never authenticated to the subverted service. The vulnerable
configuration is believed to be rare.</p>
</blockquote>
</body>
</description>
<references>
<bid>45122</bid>
<cvename>CVE-2010-4021</cvename>
<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt</url>
<url>http://osvdb.org/69607</url>
</references>
<dates>
<discovery>2010-11-30</discovery>
<entry>2010-12-09</entry>
</dates>
</vuln>
<vuln vid="1d193bba-03f6-11e0-bf50-001a926c7637">
<topic>krb5 -- RFC 3961 key-derivation checksum handling vulnerability</topic>
<affects>
<package>
<name>krb5</name>
<range><ge>1.8.0</ge><le>1.8.3</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The MIT Kerberos team reports:</p>
<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt">
<p>MIT krb5 (releases incorrectly accepts RFC 3961
key-derivation checksums using RC4 keys when verifying AD-SIGNEDPATH
and AD-KDC-ISSUED authorization data.</p>
<p>An authenticated remote attacker that controls a legitimate service
principal has a 1/256 chance of forging the AD-SIGNEDPATH signature
if the TGT key is RC4, allowing it to use self-generated "evidence"
tickets for S4U2Proxy, instead of tickets obtained from the user or
with S4U2Self. Configurations using RC4 for the TGT key are
believed to be rare.</p>
<p>An authenticated remote attacker has a 1/256 chance of forging
AD-KDC-ISSUED signatures on authdata elements in tickets having
an RC4 service key, resulting in privilege escalation against
a service that relies on these signatures. There are no known
uses of the KDC-ISSUED authdata container at this time.</p>
</blockquote>
</body>
</description>
<references>
<bid>45117</bid>
<cvename>CVE-2010-4020</cvename>
<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt</url>
<url>http://osvdb.org/69608</url>
</references>
<dates>
<discovery>2010-11-30</discovery>
<entry>2010-12-09</entry>
</dates>
</vuln>
<vuln vid="9f971cea-03f5-11e0-bf50-001a926c7637">
<topic>krb5 -- unkeyed PAC checksum handling vulnerability</topic>
<affects>
<package>
<name>krb5</name>
<range><ge>1.7.0</ge><lt>1.7.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The MIT Kerberos team reports:</p>
<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt">
<p>MIT krb5 incorrectly accepts an unkeyed checksum for PAC
signatures.</p>
<p>An authenticated remote attacker can forge PACs if using a KDC that
does not filter client-provided PAC data. This can result in
privilege escalation against a service that relies on PAC contents
to make authorization decisions.</p>
</blockquote>
</body>
</description>
<references>
<bid>45116</bid>
<cvename>CVE-2010-1324</cvename>
<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt</url>
<url>http://osvdb.org/69609</url>
</references>
<dates>
<discovery>2010-11-30</discovery>
<entry>2010-12-09</entry>
</dates>
</vuln>
<vuln vid="0d57c1d9-03f4-11e0-bf50-001a926c7637">
<topic>krb5 -- multiple checksum handling vulnerabilities</topic>
<affects>
<package>
<name>krb5</name>
<range><ge>1.7.0</ge><lt>1.7.2</lt></range>
<range><ge>1.8.0</ge><le>1.8.3</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The MIT Kerberos team reports:</p>
<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt">
<p>MIT krb incorrectly accepts an unkeyed
checksum with DES session keys for version 2 (RFC 4121)
of the GSS-API krb5 mechanism.</p>
<p>An unauthenticated remote attacker can forge GSS tokens that are
intended to be integrity-protected but unencrypted, if the targeted
pre-existing application session uses a DES session key.</p>
<p>MIT krb5 KDC incorrectly accepts RFC
3961 key-derivation checksums using RC4 keys when verifying the
req-checksum in a KrbFastArmoredReq.</p>
<p>An unauthenticated remote attacker has a 1/256 chance of swapping a
client-issued KrbFastReq into a different KDC-REQ, if the armor
key is RC4. The consequences are believed to be minor.</p>
</blockquote>
</body>
</description>
<references>
<bid>45116</bid>
<cvename>CVE-2010-1324</cvename>
<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt</url>
<url>http://osvdb.org/69609</url>
</references>
<dates>
<discovery>2010-11-30</discovery>
<entry>2010-12-09</entry>
</dates>
</vuln>
<vuln vid="11bbccbc-03ee-11e0-bcdb-001fc61c2a55">
<topic>krb5 -- multiple checksum handling vulnerabilities</topic>
<affects>
<package>
<name>krb5</name>
<range><ge>1.3.0</ge><lt>1.7.2</lt></range>
<range><ge>1.8.0</ge><le>1.8.3</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The MIT Kerberos team reports:</p>
<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt">
<p>MIT krb5 clients incorrectly accept an unkeyed checksums
in the SAM-2 preauthentication challenge.</p>
<p>An unauthenticated remote attacker could alter a SAM-2 challenge,
affecting the prompt text seen by the user or the kind of response
sent to the KDC. Under some circumstances, this can negate the
incremental security benefit of using a single-use authentication
mechanism token.</p>
<p>MIT krb5 incorrectly accepts RFC 3961 key-derivation checksums
using RC4 keys when verifying KRB-SAFE messages.</p>
<p>An unauthenticated remote attacker has a 1/256 chance of forging
KRB-SAFE messages in an application protocol if the targeted
pre-existing session uses an RC4 session key. Few application
protocols use KRB-SAFE messages.</p>
</blockquote>
</body>
</description>
<references>
<bid>45118</bid>
<cvename>CVE-2010-1323</cvename>
<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt</url>
<url>http://osvdb.org/69610</url>
</references>
<dates>
<discovery>2010-11-30</discovery>
<entry>2010-12-09</entry>
</dates>
</vuln>
<vuln vid="6887828f-0229-11e0-b84d-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>15.0.874.121</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.com/search/label/Stable%20updates">
<p>Fixed in 15.0.874.121:<br/>
[103259] High CVE-2011-3900: Out-of-bounds write in v8. Credit to
Christian Holler.</p>
<p>Fixed in 15.0.874.120:<br/>
[100465] High CVE-2011-3892: Double free in Theora decoder. Credit
to Aki Helin of OUSPG.<br/>
[100492] [100543] Medium CVE-2011-3893: Out of bounds reads in MKV
and Vorbis media handlers. Credit to Aki Helin of OUSPG.<br/>
[101172] High CVE-2011-3894: Memory corruption regression in VP8
decoding. Credit to Andrew Scherkus of the Chromium development
community.<br/>
[101458] High CVE-2011-3895: Heap overflow in Vorbis decoder.
Credit to Aki Helin of OUSPG.<br/>
[101624] High CVE-2011-3896: Buffer overflow in shader variable
mapping. Credit to Ken "strcpy" Russell of the Chromium
development community.<br/>
[102242] High CVE-2011-3897: Use-after-free in editing. Credit to
pa_kt reported through ZDI (ZDI-CAN-1416).<br/>
[102461] Low CVE-2011-3898: Failure to ask for permission to run
applets in JRE7. Credit to Google Chrome Security Team (Chris
Evans).</p>
<p>Fixed in 15.0.874.102:<br/>
[86758] High CVE-2011-2845: URL bar spoof in history handling.
Credit to Jordi Chancel.<br/>
[88949] Medium CVE-2011-3875: URL bar spoof with drag+drop of URLs.
Credit to Jordi Chancel.<br/>
[90217] Low CVE-2011-3876: Avoid stripping whitespace at the end of
download filenames. Credit to Marc Novak.<br/>
[91218] Low CVE-2011-3877: XSS in appcache internals page. Credit
to Google Chrome Security Team (Tom Sepez) plus independent
discovery by Juho Nurminen.<br/>
[94487] Medium CVE-2011-3878: Race condition in worker process
initialization. Credit to miaubiz.<br/>
[95374] Low CVE-2011-3879: Avoid redirect to chrome scheme URIs.
Credit to Masato Kinugawa.<br/>
[95992] Low CVE-2011-3880: Don't permit as a HTTP header delimiter.
Credit to Vladimir Vorontsov, ONsec company.<br/>
[96047] [96885] [98053] [99512] [99750] High CVE-2011-3881:
Cross-origin policy violations. Credit to Sergey Glazunov.<br/>
[96292] High CVE-2011-3882: Use-after-free in media buffer handling.
Credit to Google Chrome Security Team (Inferno).<br/>
[96902] High CVE-2011-3883: Use-after-free in counter handling.
Credit to miaubiz.<br/>
[97148] High CVE-2011-3884: Timing issues in DOM traversal. Credit
to Brian Ryner of the Chromium development community.<br/>
[97599] [98064] [98556] [99294] [99880] [100059] High CVE-2011-3885:
Stale style bugs leading to use-after-free. Credit to
miaubiz.<br/>
[98773] [99167] High CVE-2011-3886: Out of bounds writes in v8.
Credit to Christian Holler.<br/>
[98407] Medium CVE-2011-3887: Cookie theft with javascript URIs.
Credit to Sergey Glazunov.<br/>
[99138] High CVE-2011-3888: Use-after-free with plug-in and editing.
Credit to miaubiz.<br/>
[99211] High CVE-2011-3889: Heap overflow in Web Audio. Credit to
miaubiz.<br/>
[99553] High CVE-2011-3890: Use-after-free in video source handling.
Credit to Ami Fischman of the Chromium development community.<br/>
[100332] High CVE-2011-3891: Exposure of internal v8 functions.
Credit to Steven Keuchel of the Chromium development community
plus independent discovery by Daniel Divricean.</p>
<p>Fixed in 14.0.835.202:<br/>
[93788] High CVE-2011-2876: Use-after-free in text line box
handling. Credit to miaubiz.<br/>
[95072] High CVE-2011-2877: Stale font in SVG text handling. Credit
to miaubiz.<br/>
[95671] High CVE-2011-2878: Inappropriate cross-origin access to the
window prototype. Credit to Sergey Glazunov.<br/>
[96150] High CVE-2011-2879: Lifetime and threading issues in audio
node handling. Credit to Google Chrome Security Team
(Inferno).<br/>
[97451] [97520] [97615] High CVE-2011-2880: Use-after-free in the v8
bindings. Credit to Sergey Glazunov.<br/>
[97784] High CVE-2011-2881: Memory corruption with v8 hidden
objects. Credit to Sergey Glazunov.<br/>
[98089] Critical CVE-2011-3873: Memory corruption in shader
translator. Credit to Zhenyao Mo of the Chromium development
community.</p>
<p>Fixed in 14.0.835.163:<br/>
[49377] High CVE-2011-2835: Race condition in the certificate cache. Credit to Ryan Sleevi of the Chromium development community.<br/>
[51464] Low CVE-2011-2836: Infobar the Windows Media Player plug-in
to avoid click-free access to the system Flash. Credit to
electronixtar.<br/>
[Linux only] [57908] Low CVE-2011-2837: Use PIC / pie compiler
flags. Credit to wbrana.<br/>
[75070] Low CVE-2011-2838: Treat MIME type more authoritatively when
loading plug-ins. Credit to Michal Zalewski of the Google Security
Team.<br/>
[76771] High CVE-2011-2839: Crash in v8 script object wrappers.
Credit to Kostya Serebryany of the Chromium development
community.<br/>
[78427] [83031] Low CVE-2011-2840: Possible URL bar spoofs with
unusual user interaction. Credit to kuzzcc.<br/>
[78639] High CVE-2011-2841: Garbage collection error in PDF. Credit
to Mario Gomes.<br/>
[82438] Medium CVE-2011-2843: Out-of-bounds read with media buffers.
Credit to Kostya Serebryany of the Chromium development
community.<br/>
[85041] Medium CVE-2011-2844: Out-of-bounds read with mp3 files.
Credit to Mario Gomes.<br/>
[89219] High CVE-2011-2846: Use-after-free in unload event handling.
Credit to Arthur Gerkis.<br/>
[89330] High CVE-2011-2847: Use-after-free in document loader.
Credit to miaubiz.<br/>
[89564] Medium CVE-2011-2848: URL bar spoof with forward button.
Credit to Jordi Chancel.<br/>
[89795] Low CVE-2011-2849: Browser NULL pointer crash with
WebSockets. Credit to Arthur Gerkis.<br/>
[89991] Medium CVE-2011-3234: Out-of-bounds read in box handling.
Credit to miaubiz.<br/>
[90134] Medium CVE-2011-2850: Out-of-bounds read with Khmer
characters. Credit to miaubiz.<br/>
[90173] Medium CVE-2011-2851: Out-of-bounds read in video handling.
Credit to Google Chrome Security Team (Inferno).<br/>
[91120] High CVE-2011-2852: Off-by-one in v8. Credit to Christian
Holler.<br/>
[91197] High CVE-2011-2853: Use-after-free in plug-in handling.
Credit to Google Chrome Security Team (SkyLined).<br/>
[92651] [94800] High CVE-2011-2854: Use-after-free in ruby / table
style handing. Credit to Slawomir Blazek, and independent later
discoveries by miaubiz and Google Chrome Security Team
(Inferno).<br/>
[92959] High CVE-2011-2855: Stale node in stylesheet handling.
Credit to Arthur Gerkis.<br/>
[93416] High CVE-2011-2856: Cross-origin bypass in v8. Credit to
Daniel Divricean.<br/>
[93420] High CVE-2011-2857: Use-after-free in focus controller.
Credit to miaubiz.<br/>
[93472] High CVE-2011-2834: Double free in libxml XPath handling.
Credit to Yang Dingning from NCNIPC, Graduate University of
Chinese Academy of Sciences.<br/>
[93497] Medium CVE-2011-2859: Incorrect permissions assigned to
non-gallery pages. Credit to Bernhard "Bruhns" Brehm of Recurity
Labs.<br/>
[93587] High CVE-2011-2860: Use-after-free in table style handling.
Credit to miaubiz.<br/>
[93596] Medium CVE-2011-2861: Bad string read in PDF. Credit to Aki
Helin of OUSPG.<br/>
[93906] High CVE-2011-2862: Unintended access to v8 built-in
objects. Credit to Sergey Glazunov.<br/>
[95563] Medium CVE-2011-2864: Out-of-bounds read with Tibetan
characters. Credit to Google Chrome Security Team (Inferno).<br/>
[95625] Medium CVE-2011-2858: Out-of-bounds read with triangle
arrays. Credit to Google Chrome Security Team (Inferno).<br/>
[95917] Low CVE-2011-2874: Failure to pin a self-signed cert for a
session. Credit to Nishant Yadant of VMware and Craig Chamberlain
(@randomuserid).<br/>
High CVE-2011-2875: Type confusion in v8 object sealing. Credit to
Christian Holler.</p>
<p>Fixed in 13.0.782.215:<br/>
[89402] High CVE-2011-2821: Double free in libxml XPath handling.
Credit to Yang Dingning from NCNIPC, Graduate University of
Chinese Academy of Sciences.<br/>
[82552] High CVE-2011-2823: Use-after-free in line box handling.
Credit to Google Chrome Security Team (SkyLined) and independent
later discovery by miaubiz.<br/>
[88216] High CVE-2011-2824: Use-after-free with counter nodes.
Credit to miaubiz.<br/>
[88670] High CVE-2011-2825: Use-after-free with custom fonts. Credit
to wushi of team509 reported through ZDI (ZDI-CAN-1283), plus
indepdendent later discovery by miaubiz.<br/>
[87453] High CVE-2011-2826: Cross-origin violation with empty
origins. Credit to Sergey Glazunov.<br/>
[90668] High CVE-2011-2827: Use-after-free in text searching. Credit
to miaubiz.<br/>
[91517] High CVE-2011-2828: Out-of-bounds write in v8. Credit to
Google Chrome Security Team (SkyLined).<br/>
[32-bit only] [91598] High CVE-2011-2829: Integer overflow in
uniform arrays. Credit to Sergey Glazunov.<br/>
[Linux only] [91665] High CVE-2011-2839: Buggy memset() in PDF.
Credit to Aki Helin of OUSPG.</p>
<p>Fixed in 13.0.782.107:<br/>
[75821] Medium CVE-2011-2358: Always confirm an extension install
via a browser dialog. Credit to Sergey Glazunov.<br/>
[78841] High CVE-2011-2359: Stale pointer due to bad line box
tracking in rendering. Credit to miaubiz and Martin Barbella.<br/>
[79266] Low CVE-2011-2360: Potential bypass of dangerous file
prompt. Credit to kuzzcc.<br/>
[79426] Low CVE-2011-2361: Improve designation of strings in the
basic auth dialog. Credit to kuzzcc.<br/>
[Linux only] [81307] Medium CVE-2011-2782: File permissions error
with drag and drop. Credit to Evan Martin of the Chromium
development community.<br/>
[83273] Medium CVE-2011-2783: Always confirm a developer mode NPAPI
extension install via a browser dialog. Credit to Sergey
Glazunov.<br/>
[83841] Low CVE-2011-2784: Local file path disclosure via GL
program log. Credit to kuzzcc.<br/>
[84402] Low CVE-2011-2785: Sanitize the homepage URL in extensions.
Credit to kuzzcc.<br/>
[84600] Low CVE-2011-2786: Make sure the speech input bubble is
always on-screen. Credit to Olli Pettay of Mozilla.<br/>
[84805] Medium CVE-2011-2787: Browser crash due to GPU lock
re-entrancy issue. Credit to kuzzcc.<br/>
[85559] Low CVE-2011-2788: Buffer overflow in inspector
serialization. Credit to Mikolaj Malecki.<br/>
[85808] Medium CVE-2011-2789: Use after free in Pepper plug-in
instantiation. Credit to Mario Gomes and kuzzcc.<br/>
[86502] High CVE-2011-2790: Use-after-free with floating styles.
Credit to miaubiz.<br/>
[86900] High CVE-2011-2791: Out-of-bounds write in ICU. Credit to
Yang Dingning from NCNIPC, Graduate University of Chinese Academy
of Sciences.<br/>
[87148] High CVE-2011-2792: Use-after-free with float removal.
Credit to miaubiz.<br/>
[87227] High CVE-2011-2793: Use-after-free in media selectors.
Credit to miaubiz.<br/>
[87298] Medium CVE-2011-2794: Out-of-bounds read in text iteration.
Credit to miaubiz.<br/>
[87339] Medium CVE-2011-2795: Cross-frame function leak. Credit to
Shih Wei-Long.<br/>
[87548] High CVE-2011-2796: Use-after-free in Skia. Credit to Google
Chrome Security Team (Inferno) and Kostya Serebryany of the
Chromium development community.<br/>
[87729] High CVE-2011-2797: Use-after-free in resource caching.
Credit to miaubiz.<br/>
[87815] Low CVE-2011-2798: Prevent a couple of internal schemes from
being web accessible. Credit to sirdarckcat of the Google Security
Team.<br/>
[87925] High CVE-2011-2799: Use-after-free in HTML range handling.
Credit to miaubiz.<br/>
[88337] Medium CVE-2011-2800: Leak of client-side redirect target.
Credit to Juho Nurminen.<br/>
[88591] High CVE-2011-2802: v8 crash with const lookups. Credit to
Christian Holler.<br/>
[88827] Medium CVE-2011-2803: Out-of-bounds read in Skia paths.
Credit to Google Chrome Security Team (Inferno).<br/>
[88846] High CVE-2011-2801: Use-after-free in frame loader. Credit
to miaubiz.<br/>
[88889] High CVE-2011-2818: Use-after-free in display box rendering.
Credit to Martin Barbella.<br/>
[89142] High CVE-2011-2804: PDF crash with nested functions. Credit
to Aki Helin of OUSPG.<br/>
[89520] High CVE-2011-2805: Cross-origin script injection. Credit to
Sergey Glazunov.<br/>
[90222] High CVE-2011-2819: Cross-origin violation in base URI
handling. Credit to Sergey Glazunov.</p>
<p>Fixed in 12.0.742.112:<br/>
[77493] Medium CVE-2011-2345: Out-of-bounds read in NPAPI string
handling. Credit to Philippe Arteau.<br/>
[84355] High CVE-2011-2346: Use-after-free in SVG font handling.
Credit to miaubiz.<br/>
[85003] High CVE-2011-2347: Memory corruption in CSS parsing. Credit
to miaubiz.<br/>
[85102] High CVE-2011-2350: Lifetime and re-entrancy issues in the
HTML parser. Credit to miaubiz.<br/>
[85177] High CVE-2011-2348: Bad bounds check in v8. Credit to Aki
Helin of OUSPG.<br/>
[85211] High CVE-2011-2351: Use-after-free with SVG use element.
Credit to miaubiz.<br/>
[85418] High CVE-2011-2349: Use-after-free in text selection. Credit
to miaubiz.</p>
<p>Fixed in 12.0.742.91:<br/>
[73962] [79746] High CVE-2011-1808: Use-after-free due to integer
issues in float handling. Credit to miaubiz.<br/>
[75496] Medium CVE-2011-1809: Use-after-free in accessibility
support. Credit to Google Chrome Security Team (SkyLined).<br/>
[75643] Low CVE-2011-1810: Visit history information leak in CSS.
Credit to Jesse Mohrland of Microsoft and Microsoft Vulnerability
Research (MSVR).<br/>
[76034] Low CVE-2011-1811: Browser crash with lots of form
submissions. Credit to "DimitrisV22".<br/>
[77026] Medium CVE-2011-1812: Extensions permission bypass. Credit
to kuzzcc.<br/>
[78516] High CVE-2011-1813: Stale pointer in extension framework.
Credit to Google Chrome Security Team (Inferno).<br/>
[79362] Medium CVE-2011-1814: Read from uninitialized pointer.
Credit to Eric Roman of the Chromium development community.<br/>
[79862] Low CVE-2011-1815: Extension script injection into new tab
page. Credit to kuzzcc.<br/>
[80358] Medium CVE-2011-1816: Use-after-free in developer tools.
Credit to kuzzcc.<br/>
[81916] Medium CVE-2011-1817: Browser memory corruption in history
deletion. Credit to Collin Payne.<br/>
[81949] High CVE-2011-1818: Use-after-free in image loader. Credit
to miaubiz.<br/>
[83010] Medium CVE-2011-1819: Extension injection into chrome://
pages. Credit to Vladislavas Jarmalis, plus subsequent
independent discovery by Sergey Glazunov.<br/>
[83275] High CVE-2011-2332: Same origin bypass in v8. Credit to
Sergey Glazunov.<br/>
[83743] High CVE-2011-2342: Same origin bypass in DOM. Credit to
Sergey Glazunov.</p>
<p>Fixed in 11.0.696.71:<br/>
[72189] Low CVE-2011-1801: Pop-up blocker bypass. Credit to Chamal
De Silva.<br/>
[82546] High CVE-2011-1804: Stale pointer in floats rendering.
Credit to Martin Barbella.<br/>
[82873] Critical CVE-2011-1806: Memory corruption in GPU command
buffer. Credit to Google Chrome Security Team (Cris Neckar).<br/>
[82903] Critical CVE-2011-1807: Out-of-bounds write in blob
handling. Credit to Google Chrome Security Team (Inferno) and
Kostya Serebryany of the Chromium development community.</p>
<p>Fixed in 11.0.696.68:<br/>
[64046] High CVE-2011-1799: Bad casts in Chromium WebKit glue.
Credit to Google Chrome Security Team (SkyLined).<br/>
[80608] High CVE-2011-1800: Integer overflows in SVG filters.
Credit to Google Chrome Security Team (Cris Neckar).</p>
<p>Fixed in 11.0.696.57:<br/>
[61502] High CVE-2011-1303: Stale pointer in floating object
handling. Credit to Scott Hess of the Chromium development
community and Martin Barbella.<br/>
[70538] Low CVE-2011-1304: Pop-up block bypass via plug-ins. Credit
to Chamal De Silva.<br/>
[Linux / Mac only] [70589] Medium CVE-2011-1305: Linked-list race
in database handling. Credit to Kostya Serebryany of the
Chromium development community.<br/>
[71586] Medium CVE-2011-1434: Lack of thread safety in MIME
handling. Credit to Aki Helin.<br/>
[72523] Medium CVE-2011-1435: Bad extension with "tabs" permission
can capture local files. Credit to Cole Snodgrass.<br/>
[Linux only] [72910] Low CVE-2011-1436: Possible browser crash due
to bad interaction with X. Credit to miaubiz.<br/>
[73526] High CVE-2011-1437: Integer overflows in float rendering.
Credit to miaubiz.<br/>
[74653] High CVE-2011-1438: Same origin policy violation with
blobs. Credit to kuzzcc.<br/>
[Linux only] [74763] High CVE-2011-1439: Prevent interference
between renderer processes. Credit to Julien Tinnes of the
Google Security Team.<br/>
[75186] High CVE-2011-1440: Use-after-free with &lt;ruby&gt; tag
and CSS. Credit to Jose A. Vazquez.<br/>
[75347] High CVE-2011-1441: Bad cast with floating select lists.
Credit to Michael Griffiths.<br/>
[75801] High CVE-2011-1442: Corrupt node trees with mutation events.
Credit to Sergey Glazunov and wushi of team 509.<br/>
[76001] High CVE-2011-1443: Stale pointers in layering code. Credit
to Martin Barbella.<br/>
[Linux only] [76542] High CVE-2011-1444: Race condition in sandbox
launcher. Credit to Dan Rosenberg.<br/>
Medium CVE-2011-1445: Out-of-bounds read in SVG. Credit to wushi of
team509.<br/>
[76666] [77507] [78031] High CVE-2011-1446: Possible URL bar spoofs
with navigation errors and interrupted loads. Credit to
kuzzcc.<br/>
[76966] High CVE-2011-1447: Stale pointer in drop-down list
handling. Credit to miaubiz.<br/>
[77130] High CVE-2011-1448: Stale pointer in height calculations.
Credit to wushi of team509.<br/>
[77346] High CVE-2011-1449: Use-after-free in WebSockets. Credit to
Marek Majkowski.<br/>
Low CVE-2011-1450: Dangling pointers in file dialogs. Credit to
kuzzcc.<br/>
[77463] High CVE-2011-1451: Dangling pointers in DOM id map. Credit
to Sergey Glazunov.<br/>
[77786] Medium CVE-2011-1452: URL bar spoof with redirect and manual
reload. Credit to Jordi Chancel.<br/>
[79199] High CVE-2011-1454: Use-after-free in DOM id handling.
Credit to Sergey Glazunov.<br/>
[79361] Medium CVE-2011-1455: Out-of-bounds read with
multipart-encoded PDF. Credit to Eric Roman of the Chromium
development community.<br/>
[79364] High CVE-2011-1456: Stale pointers with PDF forms. Credit to
Eric Roman of the Chromium development community.</p>
<p>Fixed in 10.0.648.205:<br/>
[75629] Critical CVE-2011-1301: Use-after-free in the GPU process.
Credit to Google Chrome Security Team (Inferno).<br/>
[78524] Critical CVE-2011-1302: Heap overflow in the GPU process.
Credit to Christoph Diehl.</p>
<p>Fixed in 10.0.648.204:<br/>
[72517] High CVE-2011-1291: Buffer error in base string handling.
Credit to Alex Turpin.<br/>
[73216] High CVE-2011-1292: Use-after-free in the frame loader.
Credit to Slawomir Blazek.<br/>
[73595] High CVE-2011-1293: Use-after-free in HTMLCollection.
Credit to Sergey Glazunov.<br/>
[74562] High CVE-2011-1294: Stale pointer in CSS handling.
Credit to Sergey Glazunov.<br/>
[74991] High CVE-2011-1295: DOM tree corruption with broken node
parentage. Credit to Sergey Glazunov.<br/>
[75170] High CVE-2011-1296: Stale pointer in SVG text handling.
Credit to Sergey Glazunov.</p>
<p>Fixed in 10.0.648.133:<br/>
[75712] High Memory corruption in style handling.
Credit to Vincenzo Iozzo, Ralf Philipp Weinmann and Willem
Pinckaers reported through ZDI.</p>
<p>Fixed in 10.0.648.127:<br/>
[42765] Low Possible to navigate or close the top location in a
sandboxed frame. Credit to sirdarckcat of the Google Security
Team.<br/>
[Linux only] [49747] Low Work around an X server bug and crash with
long messages. Credit to Louis Lang.<br/>
[Linux only] [66962] Low Possible browser crash with parallel
print()s. Credit to Aki Helin of OUSPG.<br/>
[69187] Medium Cross-origin error message leak. Credit to Daniel
Divricean.<br/>
[69628] High Memory corruption with counter nodes. Credit to Martin
Barbella.<br/>
[70027] High Stale node in box layout. Credit to Martin
Barbella.<br/>
[70336] Medium Cross-origin error message leak with workers. Credit
to Daniel Divricean.<br/>
[70442] High Use after free with DOM URL handling. Credit to Sergey
Glazunov.<br/>
[Linux only] [70779] Medium Out of bounds read handling unicode
ranges. Credit to miaubiz.<br/>
[70877] High Same origin policy bypass in v8. Credit to Daniel
Divricean.<br/>
[70885] [71167] Low Pop-up blocker bypasses. Credit to Chamal de
Silva.<br/>
[71763] High Use-after-free in document script lifetime handling.
Credit to miaubiz.<br/>
[71788] High Out-of-bounds write in the OGG container. Credit to
Google Chrome Security Team (SkyLined); plus subsequent
independent discovery by David Weston of Microsoft and MSVR.<br/>
[72028] High Stale pointer in table painting. Credit to Martin
Barbella.<br/>
[73026] High Use of corrupt out-of-bounds structure in video code.
Credit to Tavis Ormandy of the Google Security Team.<br/>
[73066] High Crash with the DataView object. Credit to Sergey
Glazunov.<br/>
[73134] High Bad cast in text rendering. Credit to miaubiz.<br/>
[73196] High Stale pointer in WebKit context code. Credit to Sergey
Glazunov.<br/>
[73716] Low Leak of heap address in XSLT. Credit to Google Chrome
Security Team (Chris Evans).<br/>
[73746] High Stale pointer with SVG cursors. Credit to Sergey
Glazunov.<br/>
[74030] High DOM tree corruption with attribute handling. Credit to
Sergey Glazunov.<br/>
[74662] High Corruption via re-entrancy of RegExp code. Credit to
Christian Holler.<br/>
[74675] High Invalid memory access in v8. Credit to Christian
Holler.</p>
<p>Fixed in 9.0.597.107:<br/>
[54262] High URL bar spoof. Credit to Jordi Chancel.<br/>
[63732] High Crash with javascript dialogs. Credit to Sergey
Radchenko.<br/>
[68263] High Stylesheet node stale pointer. Credit to Sergey
Glazunov.<br/>
[68741] High Stale pointer with key frame rule. Credit to Sergey
Glazunov.<br/>
[70078] High Crash with forms controls. Credit to Stefan van
Zanden.<br/>
[70244] High Crash in SVG rendering. Credit to Slawomir Blazek.<br/>
[64-bit Linux only] [70376] Medium Out-of-bounds read in pickle
deserialization. Credit to Evgeniy Stepanov of the Chromium
development community.<br/>
[71114] High Stale node in table handling. Credit to Martin
Barbella.<br/>
[71115] High Stale pointer in table rendering. Credit to Martin
Barbella.<br/>
[71296] High Stale pointer in SVG animations. Credit to
miaubiz.<br/>
[71386] High Stale nodes in XHTML. Credit to wushi of team509.<br/>
[71388] High Crash in textarea handling. Credit to wushi of
team509.<br/>
[71595] High Stale pointer in device orientation. Credit to Sergey
Glazunov.<br/>
[71717] Medium Out-of-bounds read in WebGL. Credit to miaubiz.<br/>
[71855] High Integer overflow in textarea handling. Credit to
miaubiz.<br/>
[71960] Medium Out-of-bounds read in WebGL. Credit to Google Chrome
Security Team (Inferno).<br/>
[72214] High Accidental exposure of internal extension functions.
Credit to Tavis Ormandy of the Google Security Team.<br/>
[72437] High Use-after-free with blocked plug-ins. Credit to Chamal
de Silva.<br/>
[73235] High Stale pointer in layout. Credit to Martin Barbella.</p>
<p>Fixed in 9.0.597.94:<br/>
[67234] High Stale pointer in animation event handling. Credit to
Rik Cabanier.<br/>
[68120] High Use-after-free in SVG font faces. Credit to
miaubiz.<br/>
[69556] High Stale pointer with anonymous block handling. Credit to
Martin Barbella.<br/>
[69970] Medium Out-of-bounds read in plug-in handling. Credit to
Bill Budge of Google.<br/>
[70456] Medium Possible failure to terminate process on
out-of-memory condition. Credit to David Warren of CERT/CC.</p>
<p>Fixed in 9.0.597.84:<br/>
[Mac only] [42989] Low Minor sandbox leak via stat(). Credit to
Daniel Cheng of the Chromium development community.<br/>
[55831] High Use-after-free in image loading. Credit to Aki
Helin of OUSPG.<br/>
[59081] Low Apply some restrictions to cross-origin drag + drop.
Credit to Google Chrome Security Team (SkyLined) and the Google
Security Team (Michal Zalewski, David Bloom).<br/>
[62791] Low Browser crash with extension with missing key. Credit
to Brian Kirchoff.<br/>
[64051] High Crashing when printing in PDF event handler. Credit to
Aki Helin of OUSPG.<br/>
[65669] Low Handle merging of autofill profiles more gracefully.
Credit to Google Chrome Security Team (Inferno).<br/>
[Mac only] [66931] Low Work around a crash in the Mac OS 10.5 SSL
libraries. Credit to Dan Morrison.<br/>
[68244] Low Browser crash with bad volume setting. Credit to
Matthew Heidermann.<br/>
[69195] Critical Race condition in audio handling. Credit to the
gamers of Reddit!</p>
<p>Fixed in 8.0.552.237:<br/>
[58053] Medium Browser crash in extensions notification handling.
Credit to Eric Roman of the Chromium development community.<br/>
[65764] High Bad pointer handling in node iteration. Credit to
Sergey Glazunov.<br/>
[66334] High Crashes when printing multi-page PDFs. Credit to
Google Chrome Security Team (Chris Evans).<br/>
[66560] High Stale pointer with CSS + canvas. Credit to Sergey
Glazunov.<br/>
[66748] High Stale pointer with CSS + cursors. Credit to Jan
Tosovsk.<br/>
[67100] High Use after free in PDF page handling. Credit to Google
Chrome Security Team (Chris Evans).<br/>
[67208] High Stack corruption after PDF out-of-memory condition.
Credit to Jared Allar of CERT.<br/>
[67303] High Bad memory access with mismatched video frame sizes.
Credit to Aki Helin of OUSPG; plus independent discovery by
Google Chrome Security Team (SkyLined) and David Warren of
CERT.<br/>
[67363] High Stale pointer with SVG use element. Credited
anonymously; plus indepdent discovery by miaubiz.<br/>
[67393] Medium Uninitialized pointer in the browser triggered by
rogue extension. Credit to kuzzcc.<br/>
[68115] High Vorbis decoder buffer overflows. Credit to David
Warren of CERT.<br/>
[68170] High Buffer overflow in PDF shading. Credit to Aki Helin of
OUSPG.<br/>
[68178] High Bad cast in anchor handling. Credit to Sergey
Glazunov.<br/>
[68181] High Bad cast in video handling. Credit to Sergey
Glazunov.<br/>
[68439] High Stale rendering node after DOM node removal. Credit to
Martin Barbella; plus independent discovery by Google Chrome
Security Team (SkyLined).<br/>
[68666] Critical Stale pointer in speech handling. Credit to Sergey
Glazunov.</p>
<p>Fixed in 8.0.552.224:<br/>
[64-bit Linux only] [56449] High Bad validation for message
deserialization on 64-bit builds. Credit to Lei Zhang of the
Chromium development community.<br/>
[60761] Medium Bad extension can cause browser crash in tab
handling. Credit to kuzzcc.<br/>
[63529] Low Browser crash with NULL pointer in web worker handling.
Credit to Nathan Weizenbaum of Google.<br/>
[63866] Medium Out-of-bounds read in CSS parsing. Credit to Chris
Rohlf.<br/>
[64959] High Stale pointers in cursor handling. Credit to Slawomir
Blazek and Sergey Glazunov.</p>
<p>Fixed in 8.0.552.215:<br/>
[17655] Low Possible pop-up blocker bypass. Credit to Google Chrome
Security Team (SkyLined).<br/>
[55745] Medium Cross-origin video theft with canvas. Credit to
Nirankush Panchbhai and Microsoft Vulnerability Research
(MSVR).<br/>
[56237] Low Browser crash with HTML5 databases. Credit to Google
Chrome Security Team (Inferno).<br/>
[58319] Low Prevent excessive file dialogs, possibly leading to
browser crash. Credit to Cezary Tomczak (gosu.pl).<br/>
[59554] High Use after free in history handling. Credit to Stefan
Troger.<br/>
[Linux / Mac] [59817] Medium Make sure the "dangerous file types"
list is uptodate with the Windows platforms. Credit to Billy Rios
of the Google Security Team.<br/>
[61701] Low Browser crash with HTTP proxy authentication. Credit to
Mohammed Bouhlel.<br/>
[61653] Medium Out-of-bounds read regression in WebM video support.
Credit to Google Chrome Security Team (Chris Evans), based on
earlier testcases from Mozilla and Microsoft (MSVR).<br/>
[62127] High Crash due to bad indexing with malformed video. Credit
to miaubiz.<br/>
[62168] Medium Possible browser memory corruption via malicious
privileged extension. Credit to kuzzcc.<br/>
[62401] High Use after free with SVG animations. Credit to Slawomir
Blazek.<br/>
[63051] Medium Use after free in mouse dragging event handling.
Credit to kuzzcc.<br/>
[63444] High Double free in XPath handling. Credit to Yang Dingning
from NCNIPC, Graduate University of Chinese Academy of Sciences.</p>
<p>Fixed in 7.0.517.44:<br/>
[51602] High Use-after-free in text editing. Credit to David Bloom
of the Google Security Team, Google Chrome Security Team (Inferno)
and Google Chrome Security Team (Cris Neckar).<br/>
[55257] High Memory corruption with enormous text area. Credit to
wushi of team509.<br/>
[58657] High Bad cast with the SVG use element. Credit to the
kuzzcc.<br/>
[58731] High Invalid memory read in XPath handling. Credit to Bui
Quang Minh from Bkis (www.bkis.com).<br/>
[58741] High Use-after-free in text control selections. Credit to
"vkouchna".<br/>
[Linux only] [59320] High Integer overflows in font handling. Credit
to Aki Helin of OUSPG.<br/>
[60055] High Memory corruption in libvpx. Credit to Christoph
Diehl.<br/>
[60238] High Bad use of destroyed frame object. Credit to various
developers, including "gundlach".<br/>
[60327] [60769] [61255] High Type confusions with event objects.
Credit to "fam.lam" and Google Chrome Security Team
(Inferno).<br/>
[60688] High Out-of-bounds array access in SVG handling. Credit to
wushi of team509.</p>
<p>Fixed in 7.0.517.43:<br/>
[48225] [51727] Medium Possible autofill / autocomplete profile
spamming. Credit to Google Chrome Security Team (Inferno).<br/>
[48857] High Crash with forms. Credit to the Chromium development
community.<br/>
[50428] Critical Browser crash with form autofill. Credit to the
Chromium development community.<br/>
[51680] High Possible URL spoofing on page unload. Credit to kuzzcc;
plus independent discovery by Jordi Chancel.<br/>
[53002] Low Pop-up block bypass. Credit to kuzzcc.<br/>
[53985] Medium Crash on shutdown with Web Sockets. Credit to the
Chromium development community.<br/>
[Linux only] [54132] Low Bad construction of PATH variable. Credit
to Dan Rosenberg, Virtual Security Research.<br/>
[54500] High Possible memory corruption with animated GIF. Credit to
Simon Schaak.<br/>
[Linux only] [54794] High Failure to sandbox worker processes on
Linux. Credit to Google Chrome Security Team (Chris Evans).<br/>
[56451] High Stale elements in an element map. Credit to Michal
Zalewski of the Google Security Team.</p>
</blockquote>
</body>
</description>
<references>
<url>http://googlechromereleases.blogspot.com/search/label/Stable%20updates</url>
<cvename>CVE-2011-1290</cvename>
<cvename>CVE-2011-1291</cvename>
<cvename>CVE-2011-1292</cvename>
<cvename>CVE-2011-1293</cvename>
<cvename>CVE-2011-1294</cvename>
<cvename>CVE-2011-1295</cvename>
<cvename>CVE-2011-1296</cvename>
<cvename>CVE-2011-1301</cvename>
<cvename>CVE-2011-1302</cvename>
<cvename>CVE-2011-1303</cvename>
<cvename>CVE-2011-1304</cvename>
<cvename>CVE-2011-1305</cvename>
<cvename>CVE-2011-1434</cvename>
<cvename>CVE-2011-1435</cvename>
<cvename>CVE-2011-1436</cvename>
<cvename>CVE-2011-1437</cvename>
<cvename>CVE-2011-1438</cvename>
<cvename>CVE-2011-1439</cvename>
<cvename>CVE-2011-1440</cvename>
<cvename>CVE-2011-1441</cvename>
<cvename>CVE-2011-1442</cvename>
<cvename>CVE-2011-1443</cvename>
<cvename>CVE-2011-1444</cvename>
<cvename>CVE-2011-1445</cvename>
<cvename>CVE-2011-1446</cvename>
<cvename>CVE-2011-1447</cvename>
<cvename>CVE-2011-1448</cvename>
<cvename>CVE-2011-1449</cvename>
<cvename>CVE-2011-1450</cvename>
<cvename>CVE-2011-1451</cvename>
<cvename>CVE-2011-1452</cvename>
<cvename>CVE-2011-1454</cvename>
<cvename>CVE-2011-1455</cvename>
<cvename>CVE-2011-1456</cvename>
<cvename>CVE-2011-1799</cvename>
<cvename>CVE-2011-1800</cvename>
<cvename>CVE-2011-1801</cvename>
<cvename>CVE-2011-1804</cvename>
<cvename>CVE-2011-1806</cvename>
<cvename>CVE-2011-1807</cvename>
<cvename>CVE-2011-1808</cvename>
<cvename>CVE-2011-1809</cvename>
<cvename>CVE-2011-1810</cvename>
<cvename>CVE-2011-1811</cvename>
<cvename>CVE-2011-1812</cvename>
<cvename>CVE-2011-1813</cvename>
<cvename>CVE-2011-1814</cvename>
<cvename>CVE-2011-1815</cvename>
<cvename>CVE-2011-1816</cvename>
<cvename>CVE-2011-1817</cvename>
<cvename>CVE-2011-1818</cvename>
<cvename>CVE-2011-1819</cvename>
<cvename>CVE-2011-2332</cvename>
<cvename>CVE-2011-2342</cvename>
<cvename>CVE-2011-2345</cvename>
<cvename>CVE-2011-2346</cvename>
<cvename>CVE-2011-2347</cvename>
<cvename>CVE-2011-2348</cvename>
<cvename>CVE-2011-2349</cvename>
<cvename>CVE-2011-2350</cvename>
<cvename>CVE-2011-2351</cvename>
<cvename>CVE-2011-2358</cvename>
<cvename>CVE-2011-2359</cvename>
<cvename>CVE-2011-2360</cvename>
<cvename>CVE-2011-2361</cvename>
<cvename>CVE-2011-2782</cvename>
<cvename>CVE-2011-2783</cvename>
<cvename>CVE-2011-2784</cvename>
<cvename>CVE-2011-2785</cvename>
<cvename>CVE-2011-2786</cvename>
<cvename>CVE-2011-2787</cvename>
<cvename>CVE-2011-2788</cvename>
<cvename>CVE-2011-2789</cvename>
<cvename>CVE-2011-2790</cvename>
<cvename>CVE-2011-2791</cvename>
<cvename>CVE-2011-2792</cvename>
<cvename>CVE-2011-2793</cvename>
<cvename>CVE-2011-2794</cvename>
<cvename>CVE-2011-2795</cvename>
<cvename>CVE-2011-2796</cvename>
<cvename>CVE-2011-2797</cvename>
<cvename>CVE-2011-2798</cvename>
<cvename>CVE-2011-2799</cvename>
<cvename>CVE-2011-2800</cvename>
<cvename>CVE-2011-2801</cvename>
<cvename>CVE-2011-2802</cvename>
<cvename>CVE-2011-2803</cvename>
<cvename>CVE-2011-2804</cvename>
<cvename>CVE-2011-2805</cvename>
<cvename>CVE-2011-2818</cvename>
<cvename>CVE-2011-2819</cvename>
<cvename>CVE-2011-2821</cvename>
<cvename>CVE-2011-2823</cvename>
<cvename>CVE-2011-2824</cvename>
<cvename>CVE-2011-2825</cvename>
<cvename>CVE-2011-2826</cvename>
<cvename>CVE-2011-2827</cvename>
<cvename>CVE-2011-2828</cvename>
<cvename>CVE-2011-2829</cvename>
<cvename>CVE-2011-2834</cvename>
<cvename>CVE-2011-2835</cvename>
<cvename>CVE-2011-2836</cvename>
<cvename>CVE-2011-2837</cvename>
<cvename>CVE-2011-2838</cvename>
<cvename>CVE-2011-2839</cvename>
<cvename>CVE-2011-2840</cvename>
<cvename>CVE-2011-2841</cvename>
<cvename>CVE-2011-2842</cvename>
<cvename>CVE-2011-2843</cvename>
<cvename>CVE-2011-2844</cvename>
<cvename>CVE-2011-2845</cvename>
<cvename>CVE-2011-2846</cvename>
<cvename>CVE-2011-2847</cvename>
<cvename>CVE-2011-2848</cvename>
<cvename>CVE-2011-2849</cvename>
<cvename>CVE-2011-2850</cvename>
<cvename>CVE-2011-2851</cvename>
<cvename>CVE-2011-2852</cvename>
<cvename>CVE-2011-2853</cvename>
<cvename>CVE-2011-2854</cvename>
<cvename>CVE-2011-2855</cvename>
<cvename>CVE-2011-2856</cvename>
<cvename>CVE-2011-2857</cvename>
<cvename>CVE-2011-2858</cvename>
<cvename>CVE-2011-2859</cvename>
<cvename>CVE-2011-2860</cvename>
<cvename>CVE-2011-2861</cvename>
<cvename>CVE-2011-2862</cvename>
<cvename>CVE-2011-2864</cvename>
<cvename>CVE-2011-2874</cvename>
<cvename>CVE-2011-2875</cvename>
<cvename>CVE-2011-2876</cvename>
<cvename>CVE-2011-2877</cvename>
<cvename>CVE-2011-2878</cvename>
<cvename>CVE-2011-2879</cvename>
<cvename>CVE-2011-2880</cvename>
<cvename>CVE-2011-2881</cvename>
<cvename>CVE-2011-3234</cvename>
<cvename>CVE-2011-3873</cvename>
<cvename>CVE-2011-3873</cvename>
<cvename>CVE-2011-3875</cvename>
<cvename>CVE-2011-3876</cvename>
<cvename>CVE-2011-3877</cvename>
<cvename>CVE-2011-3878</cvename>
<cvename>CVE-2011-3879</cvename>
<cvename>CVE-2011-3880</cvename>
<cvename>CVE-2011-3881</cvename>
<cvename>CVE-2011-3882</cvename>
<cvename>CVE-2011-3883</cvename>
<cvename>CVE-2011-3884</cvename>
<cvename>CVE-2011-3885</cvename>
<cvename>CVE-2011-3886</cvename>
<cvename>CVE-2011-3887</cvename>
<cvename>CVE-2011-3888</cvename>
<cvename>CVE-2011-3889</cvename>
<cvename>CVE-2011-3890</cvename>
<cvename>CVE-2011-3891</cvename>
<cvename>CVE-2011-3892</cvename>
<cvename>CVE-2011-3893</cvename>
<cvename>CVE-2011-3894</cvename>
<cvename>CVE-2011-3895</cvename>
<cvename>CVE-2011-3896</cvename>
<cvename>CVE-2011-3897</cvename>
<cvename>CVE-2011-3898</cvename>
<cvename>CVE-2011-3900</cvename>
</references>
<dates>
<discovery>2010-10-19</discovery>
<entry>2010-12-07</entry>
<modified>2011-11-17</modified>
</dates>
</vuln>
<vuln vid="ed7fa1b4-ff59-11df-9759-080027284eaa">
<topic>proftpd -- Compromised source packages backdoor</topic>
<affects>
<package>
<name>proftpd</name>
<range><eq>1.3.3c_2</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The ProFTPD Project team reports:</p>
<blockquote cite="http://proftpd.org/">
<p>The security issue is caused due to the distribution of compromised
ProFTPD 1.3.3c source code packages via the project's main FTP server
and all of the mirror servers, which contain a backdoor allowing
remote root access.</p>
</blockquote>
</body>
</description>
<references>
<url>http://sourceforge.net/mailarchive/message.php?msg_name=alpine.DEB.2.00.1012011542220.12930%40familiar.castaglia.org</url>
<url>http://secunia.com/advisories/42449</url>
</references>
<dates>
<discovery>2010-11-28</discovery>
<entry>2010-12-04</entry>
</dates>
</vuln>
<vuln vid="753f8185-5ba9-42a4-be02-3f55ee580093">
<topic>phpMyAdmin -- XSS attack in database search</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><lt>3.3.8.1</lt></range>
</package>
<package>
<name>phpMyAdmin211</name>
<range><lt>2.11.11.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>phpMyAdmin team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2010-8.php">
<p>It was possible to conduct a XSS attack using spoofed request on the
db search script.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/152685</freebsdpr>
<freebsdpr>ports/152686</freebsdpr>
<cvename>CVE-2010-4329</cvename>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2010-8.php</url>
</references>
<dates>
<discovery>2010-11-29</discovery>
<entry>2010-11-30</entry>
</dates>
</vuln>
<vuln vid="f154a3c7-f7f4-11df-b617-00e0815b8da8">
<topic>isc-dhcp-server -- Empty link-address denial of service</topic>
<affects>
<package>
<name>isc-dhcp41-server</name>
<range><ge>4.1.0</ge><lt>4.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="http://www.isc.org/software/dhcp/advisories/cve-2010-3611">
<p>If the server receives a DHCPv6 packet containing one or more
Relay-Forward messages, and none of them supply an address in the
Relay-Forward link-address field, then the server will crash. This
can be used as a single packet crash attack vector.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-3611</cvename>
<url>http://www.isc.org/software/dhcp/advisories/cve-2010-3611</url>
<url>http://www.kb.cert.org/vuls/id/102047</url>
</references>
<dates>
<discovery>2010-11-02</discovery>
<entry>2010-11-24</entry>
</dates>
</vuln>
<vuln vid="373e412e-f748-11df-96cd-0015f2db7bde">
<topic>OpenTTD -- Denial of service (server/client) via invalid read</topic>
<affects>
<package>
<name>openttd</name>
<range><ge>1.0.0</ge><lt>1.0.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenTTD Team reports:</p>
<blockquote cite="http://security.openttd.org/en/CVE-2010-4168">
<p>When a client disconnects, without sending the "quit" or
"client error" message, the server has a chance of reading and
writing a just freed piece of memory. The writing can only
happen while the server is sending the map. Depending on what
happens directly after freeing the memory there is a chance of
segmentation fault, and thus a denial of service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-4168</cvename>
<url>http://security.openttd.org/en/CVE-2010-4168</url>
</references>
<dates>
<discovery>2010-11-20</discovery>
<entry>2010-11-23</entry>
</dates>
</vuln>
<vuln vid="a3314314-f731-11df-a757-0011098ad87f">
<topic>horde-base -- XSS: VCARD attachments vulnerability</topic>
<affects>
<package>
<name>horde-base</name>
<range><lt>3.3.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Horde team reports:</p>
<blockquote cite="http://article.gmane.org/gmane.comp.horde.announce/532">
<p>The major changes compared to Horde version 3.3.10 are:</p>
<p>* Fixed XSS vulnerability when viewing details of a vCard.</p>
</blockquote>
</body>
</description>
<references>
<url>http://article.gmane.org/gmane.comp.horde.announce/532</url>
<url>http://bugs.horde.org/ticket/9357</url>
</references>
<dates>
<discovery>2010-11-02</discovery>
<entry>2010-11-23</entry>
</dates>
</vuln>
<vuln vid="533d20e7-f71f-11df-9ae1-000bcdf0a03b">
<topic>proftpd -- remote code execution vulnerability</topic>
<affects>
<package>
<name>proftpd</name>
<range><lt>1.3.3c</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tippingpoint reports:</p>
<blockquote cite="http://www.zerodayinitiative.com/advisories/ZDI-10-229/">
<p>This vulnerability allows remote attackers to execute arbitrary
code on vulnerable installations of ProFTPD. Authentication is not
required to exploit this vulnerability.</p>
<p>The flaw exists within the proftpd server component which
listens by default on TCP port 21. When reading user input if a
TELNET_IAC escape sequence is encountered the process
miscalculates a buffer length counter value allowing a user
controlled copy of data to a stack buffer. A remote attacker can
exploit this vulnerability to execute arbitrary code under the
context of the proftpd process.</p>
</blockquote>
</body>
</description>
<references>
<bid>44562</bid>
<cvename>CVE-2010-4221</cvename>
<url>http://www.zerodayinitiative.com/advisories/ZDI-10-229/</url>
</references>
<dates>
<discovery>2010-11-02</discovery>
<entry>2010-11-23</entry>
</dates>
</vuln>
<vuln vid="3042c33a-f237-11df-9d02-0018fe623f2b">
<topic>openssl -- TLS extension parsing race condition</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.0_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSSL Team reports:</p>
<blockquote cite="http://openssl.org/news/secadv_20101116.txt">
<p>Rob Hulswit has found a flaw in the OpenSSL TLS server extension
code parsing which on affected servers can be exploited in a buffer
overrun attack.</p>
<p>Any OpenSSL based TLS server is vulnerable if it is multi-threaded
and uses OpenSSL's internal caching mechanism. Servers that are
multi-process and/or disable internal session caching are NOT
affected.</p>
<p>In particular the Apache HTTP server (which never uses OpenSSL
internal caching) and Stunnel (which includes its own workaround)
are NOT affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-3864</cvename>
<url>http://openssl.org/news/secadv_20101116.txt</url>
</references>
<dates>
<discovery>2010-10-08</discovery>
<entry>2010-11-17</entry>
</dates>
</vuln>
<vuln vid="76b597e4-e9c6-11df-9e10-001b2134ef46">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplugin</name>
<range><lt>9.0r289</lt></range>
</package>
<package>
<name>linux-f8-flashplugin</name>
<name>linux-f10-flashplugin</name>
<range><lt>10.1r102</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe Product Security Incident Response Team reports:</p>
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb10-26.html">
<p>Critical vulnerabilities have been identified in
Adobe Flash Player 10.1.85.3 and earlier versions for
Windows, Macintosh, Linux, and Solaris, and Adobe Flash Player
10.1.95.1 for Android. These vulnerabilities, including
CVE-2010-3654 referenced in Security Advisory APSA10-05,
could cause the application to crash and could potentially
allow an attacker to take control of the affected system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-3636</cvename>
<cvename>CVE-2010-3637</cvename>
<cvename>CVE-2010-3638</cvename>
<cvename>CVE-2010-3639</cvename>
<cvename>CVE-2010-3640</cvename>
<cvename>CVE-2010-3641</cvename>
<cvename>CVE-2010-3642</cvename>
<cvename>CVE-2010-3643</cvename>
<cvename>CVE-2010-3644</cvename>
<cvename>CVE-2010-3645</cvename>
<cvename>CVE-2010-3646</cvename>
<cvename>CVE-2010-3647</cvename>
<cvename>CVE-2010-3648</cvename>
<cvename>CVE-2010-3649</cvename>
<cvename>CVE-2010-3650</cvename>
<cvename>CVE-2010-3652</cvename>
<cvename>CVE-2010-3654</cvename>
<cvename>CVE-2010-3676</cvename>
<url>http://www.adobe.com/support/security/bulletins/apsb10-26.html</url>
<url>http://www.adobe.com/support/security/advisories/apsa10-05.html</url>
</references>
<dates>
<discovery>2010-09-28</discovery>
<entry>2010-11-06</entry>
</dates>
</vuln>
<vuln vid="b2eaa7c2-e64a-11df-bc65-0022156e8794">
<topic>Wireshark -- DoS in the BER-based dissectors</topic>
<affects>
<package>
<name>wireshark</name>
<range><ge>1.3</ge><lt>1.4.1</lt></range>
<range><ge>1.0</ge><lt>1.2.12</lt></range>
</package>
<package>
<name>wireshark-lite</name>
<range><ge>1.3</ge><lt>1.4.1</lt></range>
<range><ge>1.0</ge><lt>1.2.12</lt></range>
</package>
<package>
<name>tshark</name>
<range><ge>1.3</ge><lt>1.4.1</lt></range>
<range><ge>1.0</ge><lt>1.2.12</lt></range>
</package>
<package>
<name>tshark-lite</name>
<range><ge>1.3</ge><lt>1.4.1</lt></range>
<range><ge>1.0</ge><lt>1.2.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/41535">
<p>A vulnerability has been discovered in Wireshark, which can
be exploited by malicious people to cause a DoS (Denial of
Service).</p>
<p>The vulnerability is caused due to an infinite recursion
error in the "dissect_unknown_ber()" function in
epan/dissectors/packet-ber.c and can be exploited to cause a
stack overflow e.g. via a specially crafted SNMP packet.</p>
<p>The vulnerability is confirmed in version 1.4.0 and
reported in version 1.2.11 and prior and version 1.4.0 and
prior.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-3445</cvename>
<url>http://www.wireshark.org/lists/wireshark-announce/201010/msg00002.html</url>
<url>http://www.wireshark.org/lists/wireshark-announce/201010/msg00001.html</url>
</references>
<dates>
<discovery>2010-09-16</discovery>
<entry>2010-11-05</entry>
</dates>
</vuln>
<vuln vid="4ab29e12-e787-11df-adfa-00e0815b8da8">
<topic>Mailman -- cross-site scripting in web interface</topic>
<affects>
<package>
<name>mailman</name>
<range><lt>2.1.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/41265">
<p>Two vulnerabilities have been reported in Mailman, which
can be exploited by malicious users to conduct script
insertion attacks.</p>
<p>Certain input passed via the list descriptions is not
properly sanitised before being displayed to the user. This
can be exploited to insert arbitrary HTML and script code,
which will be executed in a user's browser session in context
of an affected site when the malicious data is being
viewed.</p>
<p>Successful exploitation requires "list owner" permissions.</p>
</blockquote>
</body>
</description>
<references>
<bid>43187</bid>
<cvename>CVE-2010-3089</cvename>
<url>http://secunia.com/advisories/41265</url>
</references>
<dates>
<discovery>2010-09-14</discovery>
<entry>2010-11-03</entry>
</dates>
</vuln>
<vuln vid="96e776c7-e75c-11df-8f26-00151735203a">
<topic>OTRS -- Multiple XSS and denial of service vulnerabilities</topic>
<affects>
<package>
<name>otrs</name>
<range><gt>2.3.*</gt><lt>2.4.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OTRS Security Advisory reports:</p>
<blockquote cite="http://otrs.org/advisory/OSA-2010-02-en/">
<ul>
<li>Multiple Cross Site Scripting issues:
Missing HTML quoting allows authenticated agents or
customers to inject HTML tags. This vulnerability
allows an attacker to inject script code into the OTRS
web-interface which will be loaded and executed
in the browsers of system users.</li>
<li>Possible Denial of Service Attack:
Perl's regular expressions consume 100% CPU time
on the server if an agent or customer views an affected
article. To exploit this vulnerability the malicious user
needs to send extremely large HTML emails to your
system address.</li>
</ul>
</blockquote>
<blockquote cite="http://otrs.org/advisory/OSA-2010-03-en/">
<p>AgentTicketZoom is vulnerable to XSS attacks from HTML e-mails:</p>
<p>Whenever a customer sends an HTML e-mail and RichText is enabled
in OTRS, javascript contained in the email can do everything
in the OTRS agent interface that the agent himself could do.</p>
<p>Most relevant is that this type of exploit can be used in such
a way that the agent won't even detect he is being exploited.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-2080</cvename>
<cvename>CVE-2010-4071</cvename>
<url>http://otrs.org/advisory/OSA-2010-02-en/</url>
<url>http://otrs.org/advisory/OSA-2010-03-en/</url>
</references>
<dates>
<discovery>2010-09-15</discovery>
<entry>2010-11-03</entry>
</dates>
</vuln>
<vuln vid="c223b00d-e272-11df-8e32-000f20797ede">
<topic>mozilla -- Heap buffer overflow mixing document.write and DOM insertion</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>3.6.*,1</gt><lt>3.6.12,1</lt></range>
<range><gt>3.5.*,1</gt><lt>3.5.15,1</lt></range>
</package>
<package>
<name>libxul</name>
<range><gt>1.9.2.*</gt><lt>1.9.2.12</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>3.6.12,1</lt></range>
</package>
<package>
<name>linux-firefox-devel</name>
<range><lt>3.5.15</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.0.10</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>3.1.6</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><gt>2.0.*</gt><lt>2.0.10</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><ge>3.0</ge><lt>3.0.10</lt></range>
<range><ge>3.1</ge><lt>3.1.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2010-73 Heap buffer overflow mixing document.write and DOM insertion</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-3765</cvename>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-73.html</url>
</references>
<dates>
<discovery>2010-10-27</discovery>
<entry>2010-10-28</entry>
</dates>
</vuln>
<vuln vid="aab187d4-e0f3-11df-b1ea-001999392805">
<topic>opera -- multiple vulnerabilities</topic>
<affects>
<package>
<name>opera</name>
<range><lt>10.63</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Opera Desktop Team reports:</p>
<blockquote cite="http://www.opera.com/docs/changelogs/unix/1063/">
<ul>
<li>Fixed an issue that allowed cross-domain checks to be bypassed,
allowing limited data theft using CSS, as reported by Isaac
Dawson.</li>
<li>Fixed an issue where manipulating the window could be used to
spoof the page address.</li>
<li>Fixed an issue with reloads and redirects that could allow
spoofing and cross-site scripting.</li>
<li>Fixed an issue that allowed private video streams to be
intercepted, as reported by Nirankush Panchbhai of Microsoft
Vulnerability Research.</li>
<li>Fixed an issue that caused JavaScript to run in the wrong
security context after manual interaction.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://www.opera.com/support/kb/view/971/</url>
<url>http://www.opera.com/support/kb/view/972/</url>
<url>http://www.opera.com/support/kb/view/973/</url>
<url>http://www.opera.com/support/kb/view/974/</url>
<url>http://www.opera.com/support/kb/view/976/</url>
</references>
<dates>
<discovery>2010-10-12</discovery>
<entry>2010-10-26</entry>
</dates>
</vuln>
<vuln vid="0ddb57a9-da20-4e99-b048-4366092f3d31">
<topic>bzip2 -- integer overflow vulnerability</topic>
<affects>
<package>
<name>bzip2</name>
<range><lt>1.0.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/41452">
<p>A vulnerability has been reported in bzip2, which can be exploited by
malicious people to cause a DoS (Denial of Service) or potentially
compromise a vulnerable system.</p>
<p>The vulnerability is caused due to an integer overflow in the
"BZ2_decompress()" function in decompress.c and can be exploited to
cause a crash or potentially execute arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-10:08.bzip2</freebsdsa>
<freebsdpr>ports/151364</freebsdpr>
<cvename>CVE-2010-0405</cvename>
<bid>43331</bid>
<mlist>http://www.openwall.com/lists/oss-security/2010/09/21/4</mlist>
<url>http://secunia.com/advisories/41452</url>
</references>
<dates>
<discovery>2010-09-21</discovery>
<entry>2010-10-25</entry>
</dates>
</vuln>
<vuln vid="18dc48fe-ca42-11df-aade-0050568f000c">
<topic>FreeBSD -- Integer overflow in bzip2 decompression</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><gt>6.4</gt><lt>6.4_11</lt></range>
<range><gt>7.1</gt><lt>7.1_14</lt></range>
<range><gt>7.3</gt><lt>7.3_3</lt></range>
<range><gt>8.0</gt><lt>8.0_5</lt></range>
<range><gt>8.1</gt><lt>8.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>When decompressing data, the run-length encoded values are not
adequately sanity-checked, allowing for an integer overflow.</p>
</body>
</description>
<references>
<freebsdsa>SA-10:08.bzip2</freebsdsa>
</references>
<dates>
<discovery>2010-09-20</discovery>
<entry>2010-10-24</entry>
</dates>
</vuln>
<vuln vid="7a09a8df-ca41-11df-aade-0050568f000c">
<topic>FreeBSD -- Lost mbuf flag resulting in data corruption</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><gt>7.1</gt><lt>7.1_13</lt></range>
<range><gt>7.3</gt><lt>7.3_2</lt></range>
<range><gt>8.0</gt><lt>8.0_4</lt></range>
<range><gt>8.1</gt><lt>8.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The read-only flag is not correctly copied when a mbuf buffer
reference is duplicated. When the sendfile(2) system call is used to
transmit data over the loopback interface, this can result in the
backing pages for the transmitted file being modified, causing data
corruption.</p>
</body>
</description>
<references>
<freebsdsa>SA-10:07.mbuf</freebsdsa>
</references>
<dates>
<discovery>2010-07-13</discovery>
<entry>2010-10-24</entry>
</dates>
</vuln>
<vuln vid="0dc91089-ca41-11df-aade-0050568f000c">
<topic>FreeBSD -- Unvalidated input in nfsclient</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><gt>7.2</gt><lt>7.2_8</lt></range>
<range><gt>7.3</gt><lt>7.3_1</lt></range>
<range><gt>8.0</gt><lt>8.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The NFS client subsystem fails to correctly validate the length of a
parameter provided by the user when a filesystem is mounted.</p>
</body>
</description>
<references>
<freebsdsa>SA-10:06.nfsclient</freebsdsa>
</references>
<dates>
<discovery>2010-05-27</discovery>
<entry>2010-10-24</entry>
</dates>
</vuln>
<vuln vid="768cfe70-ca40-11df-aade-0050568f000c">
<topic>FreeBSD -- OPIE off-by-one stack overflow</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><gt>6.4</gt><lt>6.4_10</lt></range>
<range><gt>7.1</gt><lt>7.1_12</lt></range>
<range><gt>7.2</gt><lt>7.2_8</lt></range>
<range><gt>7.3</gt><lt>7.3_1</lt></range>
<range><gt>8.0</gt><lt>8.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A programming error in the OPIE library could allow an off-by-one
buffer overflow to write a single zero byte beyond the end of an
on-stack buffer.</p>
</body>
</description>
<references>
<freebsdsa>SA-10:05.opie</freebsdsa>
</references>
<dates>
<discovery>2010-05-27</discovery>
<entry>2010-10-24</entry>
</dates>
</vuln>
<vuln vid="f6eb2279-ca3f-11df-aade-0050568f000c">
<topic>FreeBSD -- Insufficient environment sanitization in jail(8)</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><gt>8.0</gt><lt>8.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The jail(8) utility does not change the current working directory
while imprisoning. The current working directory can be accessed by
its descendants.</p>
</body>
</description>
<references>
<freebsdsa>SA-10:04.jail</freebsdsa>
</references>
<dates>
<discovery>2010-05-27</discovery>
<entry>2010-10-24</entry>
</dates>
</vuln>
<vuln vid="97f09f2f-ca3f-11df-aade-0050568f000c">
<topic>FreeBSD -- ZFS ZIL playback with insecure permissions</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><gt>7.1</gt><lt>7.1_10</lt></range>
<range><gt>7.2</gt><lt>7.2_6</lt></range>
<range><gt>8.0</gt><lt>8.0_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>When replaying setattr transaction, the replay code would set the
attributes with certain insecure defaults, when the logged
transaction did not touch these attributes.</p>
</body>
</description>
<references>
<freebsdsa>SA-10:03.zfs</freebsdsa>
</references>
<dates>
<discovery>2010-01-06</discovery>
<entry>2010-10-24</entry>
</dates>
</vuln>
<vuln vid="48103b0a-ca3f-11df-aade-0050568f000c">
<topic>FreeBSD -- ntpd mode 7 denial of service</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><gt>6.3</gt><lt>6.3_15</lt></range>
<range><gt>6.4</gt><lt>6.4_9</lt></range>
<range><gt>7.1</gt><lt>7.1_10</lt></range>
<range><gt>7.2</gt><lt>7.2_6</lt></range>
<range><gt>8.0</gt><lt>8.0_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>If ntpd receives a mode 7 (MODE_PRIVATE) request or error response
from a source address not listed in either a 'restrict ... noquery'
or a 'restrict ... ignore' section it will log the even and send a
mode 7 error response.</p>
</body>
</description>
<references>
<freebsdsa>SA-10:02.ntpd</freebsdsa>
</references>
<dates>
<discovery>2010-01-06</discovery>
<entry>2010-10-24</entry>
</dates>
</vuln>
<vuln vid="e500b9bf-ca3e-11df-aade-0050568f000c">
<topic>FreeBSD -- BIND named(8) cache poisoning with DNSSEC validation</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><gt>6.3</gt><lt>6.3_15</lt></range>
<range><gt>6.4</gt><lt>6.4_9</lt></range>
<range><gt>7.1</gt><lt>7.1_10</lt></range>
<range><gt>7.2</gt><lt>7.2_6</lt></range>
<range><gt>8.0</gt><lt>8.0_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>If a client requests DNSSEC records with the Checking Disabled (CD)
flag set, BIND may cache the unvalidated responses. These responses
may later be returned to another client that has not set the CD
flag.</p>
</body>
</description>
<references>
<freebsdsa>SA-10:01.bind</freebsdsa>
</references>
<dates>
<discovery>2010-01-06</discovery>
<entry>2010-10-24</entry>
</dates>
</vuln>
<vuln vid="6e87b696-ca3e-11df-aade-0050568f000c">
<topic>FreeBSD -- Inappropriate directory permissions in freebsd-update(8)</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><gt>6.3</gt><lt>6.3_14</lt></range>
<range><gt>6.4</gt><lt>6.4_8</lt></range>
<range><gt>7.1</gt><lt>7.1_9</lt></range>
<range><gt>7.2</gt><lt>7.2_5</lt></range>
<range><gt>8.0</gt><lt>8.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>When downloading updates to FreeBSD via 'freebsd-update fetch' or
'freebsd-update upgrade', the freebsd-update(8) utility copies
currently installed files into its working directory
(/var/db/freebsd-update by default) both for the purpose of merging
changes to configuration files and in order to be able to roll back
installed updates.</p>
<p>The default working directory used by freebsd-update(8) is normally
created during the installation of FreeBSD with permissions which
allow all local users to see its contents, and freebsd-update(8) does
not take any steps to restrict access to files stored in said
directory.</p>
</body>
</description>
<references>
<freebsdsa>SA-09:17.freebsd-update</freebsdsa>
</references>
<dates>
<discovery>2009-12-03</discovery>
<entry>2010-10-24</entry>
</dates>
</vuln>
<vuln vid="ad08d14b-ca3d-11df-aade-0050568f000c">
<topic>FreeBSD -- Improper environment sanitization in rtld(1)</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><gt>7.1</gt><lt>7.1_9</lt></range>
<range><gt>7.2</gt><lt>7.2_5</lt></range>
<range><gt>8.0</gt><lt>8.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>When running setuid programs rtld will normally remove potentially
dangerous environment variables. Due to recent changes in FreeBSD
environment variable handling code, a corrupt environment may
result in attempts to unset environment variables failing.</p>
</body>
</description>
<references>
<freebsdsa>SA-09:16.rtld</freebsdsa>
</references>
<dates>
<discovery>2009-12-03</discovery>
<entry>2010-10-24</entry>
</dates>
</vuln>
<vuln vid="406779fd-ca3b-11df-aade-0050568f000c">
<topic>FreeBSD -- SSL protocol flaw</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><gt>6.3</gt><lt>6.3_14</lt></range>
<range><gt>6.4</gt><lt>6.4_8</lt></range>
<range><gt>7.1</gt><lt>7.1_9</lt></range>
<range><gt>7.2</gt><lt>7.2_5</lt></range>
<range><gt>8.0</gt><lt>8.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The SSL version 3 and TLS protocols support session
renegotiation without cryptographically tying the new
session parameters to the old parameters.</p>
</body>
</description>
<references>
<freebsdsa>SA-09:15.ssl</freebsdsa>
</references>
<dates>
<discovery>2009-12-03</discovery>
<entry>2010-10-24</entry>
</dates>
</vuln>
<vuln vid="c9a6ae4a-df8b-11df-9573-00262d5ed8ee">
<topic>monotone -- remote denial of service in default setup</topic>
<affects>
<package>
<name>monotone</name>
<range><lt>0.48.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The monotone developers report:</p>
<blockquote cite="http://www.monotone.ca/NEWS">
<p>Running "mtn ''" or "mtn ls ''" doesn't cause an internal
error anymore. In monotone 0.48 and earlier this behavior
could be used to crash a server remotely (but only if it was
configured to allow execution of remote commands).</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/151665</freebsdpr>
<url>http://www.monotone.ca/NEWS</url>
<url>http://www.thomaskeller.biz/blog/2010/10/22/monotone-0-48-1-released-please-update-your-servers/</url>
</references>
<dates>
<discovery>2010-10-21</discovery>
<entry>2010-10-24</entry>
</dates>
</vuln>
<vuln vid="c4f067b9-dc4a-11df-8e32-000f20797ede">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>3.6.*,1</gt><lt>3.6.11,1</lt></range>
<range><gt>3.5.*,1</gt><lt>3.5.14,1</lt></range>
</package>
<package>
<name>libxul</name>
<range><gt>1.9.2.*</gt><lt>1.9.2.11</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>3.6.11,1</lt></range>
</package>
<package>
<name>linux-firefox-devel</name>
<range><lt>3.5.14</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><gt>2.0.*</gt><lt>2.0.9</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><ge>3.0</ge><lt>3.0.9</lt></range>
<range><ge>3.1</ge><lt>3.1.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2010-64 Miscellaneous memory safety hazards (rv:1.9.2.11/ 1.9.1.14)</p>
<p>MFSA 2010-65 Buffer overflow and memory corruption using document.write</p>
<p>MFSA 2010-66 Use-after-free error in nsBarProp</p>
<p>MFSA 2010-67 Dangling pointer vulnerability in LookupGetterOrSetter</p>
<p>MFSA 2010-68 XSS in gopher parser when parsing hrefs</p>
<p>MFSA 2010-69 Cross-site information disclosure via modal calls</p>
<p>MFSA 2010-70 SSL wildcard certificate matching IP addresses</p>
<p>MFSA 2010-71 Unsafe library loading vulnerabilities</p>
<p>MFSA 2010-72 Insecure Diffie-Hellman key exchange</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-3170</cvename>
<cvename>CVE-2010-3173</cvename>
<cvename>CVE-2010-3174</cvename>
<cvename>CVE-2010-3175</cvename>
<cvename>CVE-2010-3176</cvename>
<cvename>CVE-2010-3177</cvename>
<cvename>CVE-2010-3178</cvename>
<cvename>CVE-2010-3179</cvename>
<cvename>CVE-2010-3180</cvename>
<cvename>CVE-2010-3181</cvename>
<cvename>CVE-2010-3182</cvename>
<cvename>CVE-2010-3183</cvename>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-64.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-65.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-66.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-67.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-68.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-69.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-70.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-71.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-72.html</url>
</references>
<dates>
<discovery>2010-10-19</discovery>
<entry>2010-10-20</entry>
</dates>
</vuln>
<vuln vid="e5090d2a-dbbe-11df-82f8-0015f2db7bde">
<topic>Webkit-gtk2 -- Multiple Vulnabilities</topic>
<affects>
<package>
<name>webkit-gtk2</name>
<range><lt>1.2.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gustavo Noronha Silva reports:</p>
<blockquote cite="http://gitorious.org/webkitgtk/stable/blobs/master/WebKit/gtk/NEWS">
<p>The patches to fix the following CVEs are included with help from
Vincent Danen and other members of the Red Hat security team:</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-1780</cvename>
<cvename>CVE-2010-1807</cvename>
<cvename>CVE-2010-1812</cvename>
<cvename>CVE-2010-1814</cvename>
<cvename>CVE-2010-1815</cvename>
<cvename>CVE-2010-3113</cvename>
<cvename>CVE-2010-3114</cvename>
<cvename>CVE-2010-3115</cvename>
<cvename>CVE-2010-3116</cvename>
<cvename>CVE-2010-3255</cvename>
<cvename>CVE-2010-3257</cvename>
<cvename>CVE-2010-3259</cvename>
<url>http://gitorious.org/webkitgtk/stable/blobs/master/WebKit/gtk/NEWS</url>
</references>
<dates>
<discovery>2010-10-01</discovery>
<entry>2010-10-19</entry>
</dates>
</vuln>
<vuln vid="dd943fbb-d0fe-11df-95a8-00219b0fc4d8">
<topic>apr -- multiple vunerabilities</topic>
<affects>
<package>
<name>apr1</name>
<range><lt>1.4.2.1.3.10</lt></range>
</package>
<package>
<name>apr0</name>
<range><lt>0.9.19.0.9.19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/41701">
<p>Multiple vulnerabilities have been reported in APR-util, which can
be exploited by malicious people to cause a DoS (Denial of
Service).</p>
<p>Two XML parsing vulnerabilities exist in the bundled version of
expat.</p>
<p>An error within the "apr_brigade_split_line()" function in
buckets/apr_brigade.c can be exploited to cause high memory
consumption.</p>
</blockquote>
</body>
</description>
<references>
<bid>43673</bid>
<cvename>CVE-2009-3560</cvename>
<cvename>CVE-2009-3720</cvename>
<cvename>CVE-2010-1623</cvename>
<url>http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.3</url>
<url>http://secunia.com/advisories/41701</url>
</references>
<dates>
<discovery>2010-10-02</discovery>
<entry>2010-10-06</entry>
<modified>2010-10-20</modified>
</dates>
</vuln>
<vuln vid="99021f88-ca3c-11df-be21-00e018aa7788">
<topic>phpmyfaq -- cross site scripting vulnerabilities</topic>
<affects>
<package>
<name>phpmyfaq</name>
<range><lt>2.6.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyFAQ project reports:</p>
<blockquote cite="http://www.phpmyfaq.de/advisory_2010-09-28.php">
<p>The phpMyFAQ Team has learned of a security issue that has been
discovered in phpMyFAQ 2.6.x: phpMyFAQ doesn't sanitize
some variables in different pages correctly. With a
properly crafted URL it is e.g. possible to inject
JavaScript code into the output of a page, which could
result in the leakage of domain cookies (f.e. session
identifiers)..</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/151055</freebsdpr>
<url>http://www.phpmyfaq.de/advisory_2010-09-28.php</url>
</references>
<dates>
<discovery>2010-09-28</discovery>
<entry>2010-10-02</entry>
</dates>
</vuln>
<vuln vid="e08c596e-cb28-11df-9c1b-0011098ad87f">
<topic>horde-gollem -- XSS vulnerability</topic>
<affects>
<package>
<name>horde-gollem</name>
<range><lt>1.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Horde team reports:</p>
<blockquote cite="http://article.gmane.org/gmane.comp.horde.announce/523">
<p>The major changes compared to Gollem version H3 (1.1.1) are:</p>
<p>* Fixed an XSS vulnerability in the file viewer.</p>
</blockquote>
</body>
</description>
<references>
<url>http://article.gmane.org/gmane.comp.horde.announce/523</url>
<url>http://git.horde.org/diff.php/gollem/docs/CHANGES?rt=horde&amp;r1=1.114.2.55&amp;r2=1.114.2.59&amp;ty=h</url>
<url>http://bugs.horde.org/ticket/9191</url>
</references>
<dates>
<discovery>2010-08-21</discovery>
<entry>2010-09-28</entry>
</dates>
</vuln>
<vuln vid="6c4db192-cb23-11df-9c1b-0011098ad87f">
<topic>horde-imp -- XSS vulnerability</topic>
<affects>
<package>
<name>horde-imp</name>
<range><gt>4.2,1</gt><lt>4.3.8,1</lt></range>
<range><lt>4.3.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Horde team reports:</p>
<blockquote cite="http://article.gmane.org/gmane.comp.horde.announce/516">
<p>Thanks to Naumann IT Security Consulting for reporting the XSS
vulnerability.</p>
<p>The major changes compared to IMP version H3 (4.3.7) are:</p>
<p>* Fixed an XSS vulnerability in the Fetchmail configuration.</p>
</blockquote>
</body>
</description>
<references>
<url>http://article.gmane.org/gmane.comp.horde.announce/516</url>
<url>http://git.horde.org/diff.php/imp/docs/CHANGES?rt=horde&amp;r1=1.699.2.424&amp;r2=1.699.2.430&amp;ty=h</url>
</references>
<dates>
<discovery>2010-09-28</discovery>
<entry>2010-09-28</entry>
<modified>2011-09-23</modified>
</dates>
</vuln>
<vuln vid="8fc55043-cb1e-11df-9c1b-0011098ad87f">
<topic>horde-base -- XSS and CSRF vulnerabilities</topic>
<affects>
<package>
<name>horde-base</name>
<range><lt>3.3.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Horde team reports:</p>
<blockquote cite="http://article.gmane.org/gmane.comp.horde.announce/515">
<p>Thanks to Naumann IT Security Consulting for reporting the XSS
vulnerability.</p>
<p>Thanks to Secunia for releasing an advisory for the new CSRF
protection in the preference interface</p>
<p>The major changes compared to Horde version 3.3.8 are:</p>
<p>* Fixed XSS vulnerability in util/icon_browser.php.</p>
<p>* Protected preference forms against CSRF attacks.</p>
</blockquote>
</body>
</description>
<references>
<url>http://article.gmane.org/gmane.comp.horde.announce/515</url>
<url>http://cvs.horde.org/diff.php/horde/docs/CHANGES?rt=horde&amp;r1=1.515.2.607&amp;r2=1.515.2.620&amp;ty=h</url>
<url>http://secunia.com/advisories/39860/</url>
<url>http://holisticinfosec.org/content/view/145/45/</url>
</references>
<dates>
<discovery>2010-06-03</discovery>
<entry>2010-09-28</entry>
</dates>
</vuln>
<vuln vid="80b6d6cc-c970-11df-bb18-0015587e2cc1">
<topic>openx -- remote code execution vulnerability</topic>
<affects>
<package>
<name>openx</name>
<range><lt>2.8.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenX project reported:</p>
<blockquote cite="http://blog.openx.org/09/security-update/">
<p>It has been brought to our attention that there is a vulnerability
in the 2.8 downloadable version of OpenX that can result in a server
running the downloaded version of OpenX being compromised.</p>
</blockquote>
<p>This vulnerability exists in the file upload functionality
and allows attackers to upload and execute PHP code of
their choice.</p>
</body>
</description>
<references>
<url>http://blog.openx.org/09/security-update/</url>
<url>http://www.h-online.com/security/news/item/Web-sites-distribute-malware-via-hacked-OpenX-servers-1079099.html</url>
</references>
<dates>
<discovery>2010-09-14</discovery>
<entry>2010-09-26</entry>
</dates>
</vuln>
<vuln vid="e4dac715-c818-11df-a92c-0015587e2cc1">
<topic>squid -- Denial of service vulnerability in request handling</topic>
<affects>
<package>
<name>squid</name>
<range><ge>3.0.1</ge><lt>3.0.25_3</lt></range>
<range><ge>3.1.0.1</ge><lt>3.1.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Squid security advisory 2010:3 reports:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2010_3.txt">
<p>Due to an internal error in string handling Squid is
vulnerable to a denial of service attack when processing
specially crafted requests.</p>
<p>This problem allows any trusted client to perform a
denial of service attack on the Squid service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-3072</cvename>
<url>http://www.squid-cache.org/Advisories/SQUID-2010_3.txt</url>
</references>
<dates>
<discovery>2010-08-30</discovery>
<entry>2010-09-24</entry>
</dates>
</vuln>
<vuln vid="8a34d9e6-c662-11df-b2e1-001b2134ef46">
<topic>linux-flashplugin -- remote code execution</topic>
<affects>
<package>
<name>linux-flashplugin</name>
<range><lt>9.0r283</lt></range>
</package>
<package>
<name>linux-f8-flashplugin</name>
<name>linux-f10-flashplugin</name>
<range><lt>10.1r85</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe Product Security Incident Response Team reports:</p>
<blockquote cite="http://www.adobe.com/support/security/advisories/apsa10-03.html">
<p>A critical vulnerability exists in Adobe Flash Player
10.1.82.76 and earlier versions for Windows, Macintosh,
Linux, Solaris, and Adobe Flash Player 10.1.92.10 for
Android. This vulnerability also affects Adobe Reader
9.3.4 and earlier versions for Windows, Macintosh and
UNIX, and Adobe Acrobat 9.3.4 and earlier versions for
Windows and Macintosh. This vulnerability (CVE-2010-2884)
could cause a crash and potentially allow an attacker
to take control of the affected system. There are
reports that this vulnerability is being actively
exploited in the wild against Adobe Flash Player on
Windows. Adobe is not aware of any attacks exploiting
this vulnerability against Adobe Reader or Acrobat to
date.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-2884</cvename>
<url>http://www.adobe.com/support/security/advisories/apsa10-03.html</url>
</references>
<dates>
<discovery>2010-09-14</discovery>
<entry>2010-09-22</entry>
</dates>
</vuln>
<vuln vid="3ff95dd3-c291-11df-b0dc-00215c6a37bb">
<topic>django -- cross-site scripting vulnerability</topic>
<affects>
<package>
<name>py23-django</name>
<name>py24-django</name>
<name>py25-django</name>
<name>py26-django</name>
<name>py30-django</name>
<name>py31-django</name>
<range><gt>1.2</gt><lt>1.2.2</lt></range>
</package>
<package>
<name>py23-django-devel</name>
<name>py24-django-devel</name>
<name>py25-django-devel</name>
<name>py26-django-devel</name>
<name>py30-django-devel</name>
<name>py31-django-devel</name>
<range><lt>13698,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Django project reports:</p>
<blockquote cite="http://www.djangoproject.com/weblog/2010/sep/08/security-release/">
<p>The provided template tag for inserting the CSRF
token into forms -- {% csrf_token %} -- explicitly
trusts the cookie value, and displays it as-is.
Thus, an attacker who is able to tamper with the
value of the CSRF cookie can cause arbitrary content
to be inserted, unescaped, into the outgoing HTML of
the form, enabling cross-site scripting (XSS) attacks.</p>
</blockquote>
</body>
</description>
<references>
<bid>43116</bid>
<cvename>CVE-2010-3082</cvename>
<url>http://xforce.iss.net/xforce/xfdb/61729</url>
</references>
<dates>
<discovery>2010-09-13</discovery>
<entry>2010-09-17</entry>
</dates>
</vuln>
<vuln vid="9bcfd7b6-bcda-11df-9a6a-0015f2db7bde">
<topic>webkit-gtk2 -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>webkit-gtk2</name>
<range><lt>1.2.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gustavo Noronha Silva reports:</p>
<blockquote cite="http://gitorious.org/webkitgtk/stable/commit/9d07fda89aab7105962d933eef32ca15dda610d8">
<p>With help from Vincent Danen and other members of the Red Hat
security team, the following CVE's where fixed.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-1781</cvename>
<cvename>CVE-2010-1782</cvename>
<cvename>CVE-2010-1784</cvename>
<cvename>CVE-2010-1785</cvename>
<cvename>CVE-2010-1786</cvename>
<cvename>CVE-2010-1787</cvename>
<cvename>CVE-2010-1788</cvename>
<cvename>CVE-2010-1790</cvename>
<cvename>CVE-2010-1792</cvename>
<cvename>CVE-2010-1793</cvename>
<cvename>CVE-2010-2647</cvename>
<cvename>CVE-2010-2648</cvename>
<cvename>CVE-2010-3119</cvename>
<url>http://gitorious.org/webkitgtk/stable/commit/9d07fda89aab7105962d933eef32ca15dda610d8</url>
</references>
<dates>
<discovery>2010-09-7</discovery>
<entry>2010-09-10</entry>
</dates>
</vuln>
<vuln vid="f866d2af-bbba-11df-8a8d-0008743bf21a">
<topic>vim6 -- heap-based overflow while parsing shell metacharacters</topic>
<affects>
<package>
<name>vim6</name>
<name>vim6+ruby</name>
<range><ge>6.2.429</ge><lt>6.3.62</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Description for CVE-2008-3432 says:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3432">
<p>Heap-based buffer overflow in the mch_expand_wildcards
function in os_unix.c in Vim 6.2 and 6.3 allows user-assisted
attackers to execute arbitrary code via shell metacharacters
in filenames, as demonstrated by the netrw.v3 test case.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-3432</cvename>
<url>http://www.openwall.com/lists/oss-security/2008/07/15/4</url>
</references>
<dates>
<discovery>2008-07-31</discovery>
<entry>2010-09-09</entry>
</dates>
</vuln>
<vuln vid="4a21ce2c-bb13-11df-8e32-000f20797ede">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>3.6.*,1</gt><lt>3.6.9,1</lt></range>
<range><gt>3.5.*,1</gt><lt>3.5.12,1</lt></range>
</package>
<package>
<name>libxul</name>
<range><gt>1.9.2.*</gt><lt>1.9.2.9</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>3.6.9,1</lt></range>
</package>
<package>
<name>linux-firefox-devel</name>
<range><lt>3.5.12</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><gt>2.0.*</gt><lt>2.0.7</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><ge>3.0</ge><lt>3.0.7</lt></range>
<range><ge>3.1</ge><lt>3.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2010-49 Miscellaneous memory safety hazards (rv:1.9.2.9/ 1.9.1.12)</p>
<p>MFSA 2010-50 Frameset integer overflow vulnerability</p>
<p>MFSA 2010-51 Dangling pointer vulnerability using DOM plugin array</p>
<p>MFSA 2010-52 Windows XP DLL loading vulnerability</p>
<p>MFSA 2010-53 Heap buffer overflow in nsTextFrameUtils::TransformText</p>
<p>MFSA 2010-54 Dangling pointer vulnerability in nsTreeSelection</p>
<p>MFSA 2010-55 XUL tree removal crash and remote code execution</p>
<p>MFSA 2010-56 Dangling pointer vulnerability in nsTreeContentView</p>
<p>MFSA 2010-57 Crash and remote code execution in normalizeDocument</p>
<p>MFSA 2010-58 Crash on Mac using fuzzed font in data: URL</p>
<p>MFSA 2010-59 SJOW creates scope chains ending in outer object</p>
<p>MFSA 2010-60 XSS using SJOW scripted function</p>
<p>MFSA 2010-61 UTF-7 XSS by overriding document charset using object type attribute</p>
<p>MFSA 2010-62 Copy-and-paste or drag-and-drop into designMode document allows XSS</p>
<p>MFSA 2010-63 Information leak via XMLHttpRequest statusText</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-2762</cvename>
<cvename>CVE-2010-2763</cvename>
<cvename>CVE-2010-2764</cvename>
<cvename>CVE-2010-2765</cvename>
<cvename>CVE-2010-2766</cvename>
<cvename>CVE-2010-2767</cvename>
<cvename>CVE-2010-2768</cvename>
<cvename>CVE-2010-2769</cvename>
<cvename>CVE-2010-2770</cvename>
<cvename>CVE-2010-2760</cvename>
<cvename>CVE-2010-3131</cvename>
<cvename>CVE-2010-3166</cvename>
<cvename>CVE-2010-3167</cvename>
<cvename>CVE-2010-3168</cvename>
<cvename>CVE-2010-3169</cvename>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-49.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-50.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-51.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-52.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-53.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-54.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-55.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-56.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-57.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-58.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-59.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-60.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-61.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-62.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-63.html</url>
</references>
<dates>
<discovery>2010-09-07</discovery>
<entry>2010-09-08</entry>
<modified>2010-09-15</modified>
</dates>
</vuln>
<vuln vid="67b514c3-ba8f-11df-8f6e-000c29a67389">
<topic>sudo -- Flaw in Runas group matching</topic>
<affects>
<package>
<name>sudo</name>
<range><ge>1.7.0</ge><lt>1.7.4.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Todd Miller reports:</p>
<blockquote cite="http://www.sudo.ws/sudo/alerts/runas_group.html">
<p>Beginning with sudo version 1.7.0 it has been possible to grant
permission to run a command using a specified group via sudo -g
option (run as group). A flaw exists in the logic that matches
Runas groups in the sudoers file when the -u option is also
specified (run as user). This flaw results in a positive match for
the user specified via -u so long as the group specified via -g
is allowed by the sudoers file.</p>
<p>Exploitation of the flaw requires that Sudo be configured with
sudoers entries that contain a Runas group. Entries that do not
contain a Runas group, or only contain a Runas user are not
affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-2956</cvename>
<url>http://www.sudo.ws/sudo/alerts/runas_group.html</url>
</references>
<dates>
<discovery>2010-09-07</discovery>
<entry>2010-09-07</entry>
</dates>
</vuln>
<vuln vid="29b7e3f4-b6a9-11df-ae63-f255a795cb21">
<topic>lftp -- multiple HTTP client download filename vulnerability</topic>
<affects>
<package>
<name>lftp</name>
<range><lt>4.0.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The get1 command, as used by lftpget, in LFTP before 4.0.6 does
not properly validate a server-provided filename before determining
the destination filename of a download, which allows remote servers
to create or overwrite arbitrary files via a Content-Disposition
header that suggests a crafted filename, and possibly execute
arbitrary code as a consequence of writing to a dotfile in a home
directory.</p>
</body>
</description>
<references>
<cvename>CVE-2010-2251</cvename>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=591580</url>
</references>
<dates>
<discovery>2010-06-09</discovery>
<entry>2010-09-03</entry>
</dates>
</vuln>
<vuln vid="d754b7d2-b6a7-11df-826c-e464a695cb21">
<topic>wget -- multiple HTTP client download filename vulnerability</topic>
<affects>
<package>
<name>wget</name>
<name>wget-devel</name>
<range><le>1.12_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GNU Wget version 1.12 and earlier uses a server-provided filename
instead of the original URL to determine the destination filename of
a download, which allows remote servers to create or overwrite
arbitrary files via a 3xx redirect to a URL with a .wgetrc filename
followed by a 3xx redirect to a URL with a crafted filename, and
possibly execute arbitrary code as a consequence of writing to a
dotfile in a home directory.</p>
</body>
</description>
<references>
<cvename>CVE-2010-2252</cvename>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=602797</url>
</references>
<dates>
<discovery>2010-06-09</discovery>
<entry>2010-09-03</entry>
</dates>
</vuln>
<vuln vid="3a7c5fc4-b50c-11df-977b-ecc31dd8ad06">
<topic>p5-libwww -- possibility to remote servers to create file with a .(dot) character</topic>
<affects>
<package>
<name>p5-libwww</name>
<range><lt>5.835</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>lwp-download in libwww-perl before 5.835 does not reject downloads
to filenames that begin with a `.' (dot) character, which allows
remote servers to create or overwrite files via a 3xx redirect to a
URL with a crafted filename or a Content-Disposition header that
suggests a crafted filename, and possibly execute arbitrary code as
a consequence of writing to a dotfile in a home directory.</p>
</body>
</description>
<references>
<cvename>CVE-2010-2253</cvename>
<url>http://cpansearch.perl.org/src/GAAS/libwww-perl-5.836/Changes</url>
</references>
<dates>
<discovery>2010-06-09</discovery>
<entry>2010-08-31</entry>
</dates>
</vuln>
<vuln vid="167953a4-b01c-11df-9a98-0015587e2cc1">
<topic>quagga -- stack overflow and DoS vulnerabilities</topic>
<affects>
<package>
<name>quagga</name>
<range><lt>0.99.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Red Hat security team reported two vulnerabilities:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2010/08/24/3">
<p>A stack buffer overflow flaw was found in the way Quagga's bgpd
daemon processed Route-Refresh messages. A configured
Border Gateway Protocol (BGP) peer could send a
Route-Refresh message with specially-crafted Outbound
Route Filtering (ORF) record, which would cause the
master BGP daemon (bgpd) to crash or, possibly, execute
arbitrary code with the privileges of the user running
bgpd.</p>
<p>A NULL pointer dereference flaw was found in the way
Quagga's bgpd daemon parsed paths of autonomous systems
(AS). A configured BGP peer could send a BGP update AS
path request with unknown AS type, which could lead to
denial of service (bgpd daemon crash).</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2010/08/24/3</url>
<url>http://www.quagga.net/news2.php?y=2010&amp;m=8&amp;d=19#id1282241100</url>
</references>
<dates>
<discovery>2010-08-24</discovery>
<entry>2010-08-25</entry>
</dates>
</vuln>
<vuln vid="8cbf4d65-af9a-11df-89b8-00151735203a">
<topic>bugzilla -- information disclosure, denial of service</topic>
<affects>
<package>
<name>bugzilla</name>
<range><gt>2.17.1</gt><lt>3.6.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Bugzilla Security Advisory reports:</p>
<blockquote cite="http://www.bugzilla.org/security/3.2.7/">
<ul>
<li>Remote Information Disclosure:
An unprivileged user is normally not allowed to view
other users' group membership. But boolean charts
let the user use group-based pronouns, indirectly
disclosing group membership. This security fix
restricts the use of pronouns to groups the user
belongs to.</li>
<li>Notification Bypass:
Normally, when a user is impersonated, he receives
an email informing him that he is being impersonated,
containing the identity of the impersonator. However,
it was possible to impersonate a user without this
notification being sent.</li>
<li>Remote Information Disclosure:
An error message thrown by the "Reports" and "Duplicates"
page confirmed the non-existence of products, thus
allowing users to guess confidential product names.
(Note that the "Duplicates" page was not vulnerable
in Bugzilla 3.6rc1 and above though.)</li>
<li>Denial of Service:
If a comment contained the phrases "bug X" or
"attachment X", where X was an integer larger than the
maximum 32-bit signed integer size, PostgreSQL would
throw an error, and any page containing that comment would
not be viewable. On most Bugzillas, any user can enter
a comment on any bug, so any user could have used this to
deny access to one or all bugs. Bugzillas running on
databases other than PostgreSQL are not affected.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-2756</cvename>
<cvename>CVE-2010-2757</cvename>
<cvename>CVE-2010-2758</cvename>
<cvename>CVE-2010-2759</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=417048</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=450013</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=577139</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=519835</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=583690</url>
</references>
<dates>
<discovery>2010-08-05</discovery>
<entry>2010-08-24</entry>
</dates>
</vuln>
<vuln vid="b6069837-aadc-11df-82df-0015f2db7bde">
<topic>OpenTTD -- Denial of service (server) via infinite loop</topic>
<affects>
<package>
<name>openttd</name>
<range><ge>1.0.1</ge><lt>1.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenTTD Team reports:</p>
<blockquote cite="http://security.openttd.org/en/CVE-2010-2534">
<p>When multiple commands are queued (at the server) for execution
in the next game tick and an client joins the server can get into
an infinite loop. With the default settings triggering this bug
is difficult (if not impossible), however the larger value of
the "frame_freq" setting is easier it is to trigger the bug.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-2534</cvename>
<url>http://security.openttd.org/en/CVE-2010-2534</url>
</references>
<dates>
<discovery>2010-06-27</discovery>
<entry>2010-08-22</entry>
</dates>
</vuln>
<vuln vid="67a1c3ae-ad69-11df-9be6-0015587e2cc1">
<topic>corkscrew -- buffer overflow vulnerability</topic>
<affects>
<package>
<name>corkscrew</name>
<range><le>2.0</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The affected corkscrew versions use sscanf calls without proper
bounds checking. In the authentication file parsing routine
this can cause an exploitable buffer overflow condition.
A similar but issue exists in the server response code but
appears to be non-exploitable.</p>
</body>
</description>
<references>
<url>http://people.freebsd.org/~niels/issues/corkscrew-20100821.txt</url>
</references>
<dates>
<discovery>2010-08-21</discovery>
<entry>2010-08-21</entry>
</dates>
</vuln>
<vuln vid="274922b8-ad20-11df-af1f-00e0814cab4e">
<topic>phpmyadmin -- Several XSS vulnerabilities</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><lt>3.3.5.1</lt></range>
</package>
<package>
<name>phpMyAdmin211</name>
<range><lt>2.11.10.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>phpMyAdmin Team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2010-5.php">
<p>It was possible to conduct a XSS attack using crafted URLs org
POST parameters on several pages.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-3056</cvename>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2010-5.php</url>
</references>
<dates>
<discovery>2010-08-09</discovery>
<entry>2010-08-21</entry>
</dates>
</vuln>
<vuln vid="68c7187a-abd2-11df-9be6-0015587e2cc1">
<topic>slim -- insecure PATH assignment</topic>
<affects>
<package>
<name>slim</name>
<range><lt>1.3.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SLiM assigns logged on users a PATH in which the current
working directory ("./") is included. This PATH can allow
unintentional code execution through planted binaries and
has therefore been fixed SLiM version 1.3.2.</p>
</body>
</description>
<references>
<cvename>CVE-2010-2945</cvename>
<url>http://seclists.org/oss-sec/2010/q3/198</url>
</references>
<dates>
<discovery>2010-05-12</discovery>
<entry>2010-08-19</entry>
<modified>2010-08-20</modified>
</dates>
</vuln>
<vuln vid="34e0316a-aa91-11df-8c2e-001517289bf8">
<topic>ruby -- UTF-7 encoding XSS vulnerability in WEBrick</topic>
<affects>
<package>
<name>ruby</name>
<name>ruby+pthreads</name>
<name>ruby+pthreads+oniguruma</name>
<name>ruby+oniguruma</name>
<range><ge>1.8.*,1</ge><lt>1.8.7.248_3,1</lt></range>
<range><ge>1.9.*,1</ge><lt>1.9.1.430,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The official ruby site reports:</p>
<blockquote cite="http://www.ruby-lang.org/en/news/2010/08/16/xss-in-webrick-cve-2010-0541/">
<p>WEBrick have had a cross-site scripting vulnerability that allows
an attacker to inject arbitrary script or HTML via a crafted URI.
This does not affect user agents that strictly implement HTTP/1.1,
however, some user agents do not.</p>
</blockquote>
</body>
</description>
<references>
<bid>40895</bid>
<cvename>CVE-2010-0541</cvename>
<url>http://www.ruby-lang.org/en/news/2010/08/16/xss-in-webrick-cve-2010-0541/</url>
</references>
<dates>
<discovery>2010-08-16</discovery>
<entry>2010-08-17</entry>
<modified>2010-08-20</modified>
</dates>
</vuln>
<vuln vid="b74a8076-9b1f-11df-9f58-021e8c343e76">
<topic>isolate -- local root exploit</topic>
<affects>
<package>
<name>isolate</name>
<range><lt>20100717</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="http://code.google.com/p/isolate/">
<p>Isolate currently suffers from some bad security bugs! These
are local root privilege escalation bugs. Thanks to the helpful
person who reported them (email Chris if you want credit!).
We're working to fix them ASAP, but until then, isolate is
unsafe and you should uninstall it. Sorry!</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/148911</freebsdpr>
<url>http://code.google.com/p/isolate/</url>
</references>
<dates>
<discovery>2010-07-29</discovery>
<entry>2010-08-13</entry>
</dates>
</vuln>
<vuln vid="e7d91a3c-a7c9-11df-870c-00242b513d7c">
<topic>vlc -- invalid id3v2 tags may lead to invalid memory dereferencing</topic>
<affects>
<package>
<name>vlc</name>
<range><gt>0.9.0,3</gt><lt>1.1.2_1,3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>VideoLAN project reports:</p>
<blockquote cite="http://www.videolan.org/security/sa1004.html">
<p>VLC fails to perform sufficient input validation when trying to
extract some meta-informations about input media through ID3v2
tags. In the failure case, VLC attempt dereference an invalid
memory address, and a crash will ensure.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-2937</cvename>
<url>http://www.videolan.org/security/sa1004.html</url>
</references>
<dates>
<discovery>2010-07-29</discovery>
<entry>2010-08-14</entry>
</dates>
</vuln>
<vuln vid="e19e74a4-a712-11df-b234-001b2134ef46">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplugin</name>
<range><lt>9.0r280</lt></range>
</package>
<package>
<name>linux-f8-flashplugin</name>
<name>linux-f10-flashplugin</name>
<range><lt>10.1r82</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe Product Security Incident Response Team reports:</p>
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb10-16.html">
<p>Critical vulnerabilities have been identified in Adobe
Flash Player version 10.1.53.64 and earlier. These
vulnerabilities could cause the application to crash and
could potentially allow an attacker to take control of the
affected system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-0209</cvename>
<cvename>CVE-2010-2188</cvename>
<cvename>CVE-2010-2213</cvename>
<cvename>CVE-2010-2214</cvename>
<cvename>CVE-2010-2215</cvename>
<cvename>CVE-2010-2216</cvename>
<url>http://www.adobe.com/support/security/bulletins/apsb10-16.html</url>
</references>
<dates>
<discovery>2010-01-06</discovery>
<entry>2010-08-13</entry>
</dates>
</vuln>
<vuln vid="71273c4d-a6ec-11df-8a8d-0008743bf21a">
<topic>opera -- multiple vulnerabilities</topic>
<affects>
<package>
<name>opera</name>
<range><lt>10.61</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Opera Destkop Team reports:</p>
<blockquote cite="http://www.opera.com/docs/changelogs/unix/1061/">
<ul>
<li>Fixed an issue where heap buffer overflow in HTML5 canvas could
be used to execute arbitrary code, as reported by Kuzzcc.</li>
<li>Fixed an issue where unexpected changes in tab focus could be
used to run programs from the Internet, as reported by Jakob Balle
and Sven Krewitt of Secunia.</li>
<li>Fixed an issue where news feed preview could subscribe to feeds
without interaction, as reported by Alexios Fakos.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://www.opera.com/support/search/view/966/</url>
<url>http://www.opera.com/support/search/view/967/</url>
<url>http://www.opera.com/support/search/view/968/</url>
</references>
<dates>
<discovery>2010-08-12</discovery>
<entry>2010-08-13</entry>
</dates>
</vuln>
<vuln vid="c2eac2b5-9a7d-11df-8e32-000f20797ede">
<topic>firefox -- Dangling pointer crash regression from plugin parameter array fix</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>3.6.*,1</gt><lt>3.6.8,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>3.6.8,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2010-48 Dangling pointer crash regression from plugin parameter array fix</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-2755</cvename>
<url>https://www.mozilla.org/security/announce/2010/mfsa2010-48.html</url>
</references>
<dates>
<discovery>2010-07-20</discovery>
<entry>2010-08-09</entry>
</dates>
</vuln>
<vuln vid="26e1c48a-9fa7-11df-81b5-00e0814cab4e">
<topic>Piwik -- Local File Inclusion Vulnerability</topic>
<affects>
<package>
<name>piwik</name>
<range><gt>0.6</gt><lt>0.6.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Piwik versions 0.6 through 0.6.3 are vulnerable to arbitrary,
remote file inclusion using a directory traversal pattern infinite
a crafted request for a data renderer.</p>
<blockquote cite="http://secunia.com/advisories/40703">
<p>A vulnerability has been reported in Piwik, which can before
exploited by malicious people to disclose potentially
sensitive information. Input passed to unspecified parameters
when requesting a data renderer is not properly verified before
being used to include files. This can be exploited to includes
arbitrary files from local resources via directory traversal
attacks.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-2786</cvename>
<url>http://secunia.com/advisories/40703</url>
</references>
<dates>
<discovery>2010-07-28</discovery>
<entry>2010-08-04</entry>
</dates>
</vuln>
<vuln vid="43024078-9b63-11df-8983-001d60d86f38">
<topic>libmspack -- infinite loop denial of service</topic>
<affects>
<package>
<name>libmspack</name>
<range><le>0.0.20060920</le></range>
</package>
<package>
<name>cabextract</name>
<range><lt>1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>There is a denial of service vulnerability in libmspack. The
libmspack code is built into cabextract, so it is also
vulnerable.</p>
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/40719/">
<p>The vulnerability is caused due to an error when copying data
from an uncompressed block (block type 0) and can be exploited
to trigger an infinite loop by tricking an application using the
library into processing specially crafted MS-ZIP archives.</p>
</blockquote>
</body>
</description>
<references>
<url>http://secunia.com/advisories/40719/</url>
</references>
<dates>
<discovery>2010-07-26</discovery>
<entry>2010-07-30</entry>
</dates>
</vuln>
<vuln vid="28a7310f-9855-11df-8d36-001aa0166822">
<topic>apache -- Remote DoS bug in mod_cache and mod_dav</topic>
<affects>
<package>
<name>apache</name>
<range><ge>2.2.0</ge><lt>2.2.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache ChangeLog reports:</p>
<blockquote cite="http://www.apache.org/dist/httpd/CHANGES_2.2.16">
<p>mod_dav, mod_cache: Fix Handling of requests without a path segment.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-1452</cvename>
<url>http://www.apache.org/dist/httpd/CHANGES_2.2.16</url>
<url>https://issues.apache.org/bugzilla/show_bug.cgi?id=49246</url>
<url>http://svn.apache.org/viewvc?view=revision&amp;revision=966349</url>
</references>
<dates>
<discovery>2010-07-21</discovery>
<entry>2010-07-26</entry>
</dates>
</vuln>
<vuln vid="827bc2b7-95ed-11df-9160-00e0815b8da8">
<topic>git -- buffer overflow vulnerability</topic>
<affects>
<package>
<name>git</name>
<range><ge>1.5.6</ge><lt>1.7.1.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Greg Brockman reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2010/07/22/1">
<p>If an attacker were to create a crafted working copy where the
user runs any git command, the attacker could force execution
of arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-2542</cvename>
<url>http://git.kernel.org/?p=git/git.git;a=commit;h=3c9d0414ed2db0167e6c828b547be8fc9f88fccc</url>
<url>http://www.openwall.com/lists/oss-security/2010/07/22/1</url>
</references>
<dates>
<discovery>2010-07-20</discovery>
<entry>2010-07-23</entry>
</dates>
</vuln>
<vuln vid="0502c1cb-8f81-11df-a0bb-0050568452ac">
<topic>codeigniter -- file upload class vulnerability</topic>
<affects>
<package>
<name>codeigniter</name>
<range><lt>1.7.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Derek Jones reports:</p>
<blockquote cite="http://codeigniter.com/news/codeigniter_1.7.2_security_patch/">
<p>A fix has been implemented for a security flaw in
CodeIgniter 1.7.2. All applications using the File
Upload class should install the patch to ensure that
their application is not subject to a vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>http://codeigniter.com/news/codeigniter_1.7.2_security_patch/</url>
<url>http://www.phpframeworks.com/news/p/16365/codeigniter-1-7-2-security-patch</url>
</references>
<dates>
<discovery>2010-07-12</discovery>
<entry>2010-07-21</entry>
</dates>
</vuln>
<vuln vid="8c2ea875-9499-11df-8e32-000f20797ede">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>3.6.*,1</gt><lt>3.6.7,1</lt></range>
<range><gt>3.5.*,1</gt><lt>3.5.11,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>3.6.7,1</lt></range>
</package>
<package>
<name>linux-firefox-devel</name>
<range><lt>3.5.11</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><gt>2.0.*</gt><lt>2.0.6</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><ge>3.0</ge><lt>3.0.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2010-34 Miscellaneous memory safety hazards (rv:1.9.2.7/ 1.9.1.11)</p>
<p>MFSA 2010-35 DOM attribute cloning remote code execution vulnerability</p>
<p>MFSA 2010-36 Use-after-free error in NodeIterator</p>
<p>MFSA 2010-37 Plugin parameter EnsureCachedAttrParamArrays remote code execution vulnerability</p>
<p>MFSA 2010-38 Arbitrary code execution using SJOW and fast native function</p>
<p>MFSA 2010-39 nsCSSValue::Array index integer overflow</p>
<p>MFSA 2010-40 nsTreeSelection dangling pointer remote code execution vulnerability</p>
<p>MFSA 2010-41 Remote code execution using malformed PNG image</p>
<p>MFSA 2010-42 Cross-origin data disclosure via Web Workers and importScripts</p>
<p>MFSA 2010-43 Same-origin bypass using canvas context</p>
<p>MFSA 2010-44 Characters mapped to U+FFFD in 8 bit encodings cause subsequent character to vanish</p>
<p>MFSA 2010-45 Multiple location bar spoofing vulnerabilities</p>
<p>MFSA 2010-46 Cross-domain data theft using CSS</p>
<p>MFSA 2010-47 Cross-origin data leakage from script filename in error messages</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-0654</cvename>
<cvename>CVE-2010-1205</cvename>
<cvename>CVE-2010-1206</cvename>
<cvename>CVE-2010-1207</cvename>
<cvename>CVE-2010-1208</cvename>
<cvename>CVE-2010-1209</cvename>
<cvename>CVE-2010-1210</cvename>
<cvename>CVE-2010-1211</cvename>
<cvename>CVE-2010-1212</cvename>
<cvename>CVE-2010-1213</cvename>
<cvename>CVE-2010-1214</cvename>
<cvename>CVE-2010-1215</cvename>
<cvename>CVE-2010-2751</cvename>
<cvename>CVE-2010-2752</cvename>
<cvename>CVE-2010-2753</cvename>
<cvename>CVE-2010-2754</cvename>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-34.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-35.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-36.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-37.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-38.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-39.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-40.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-41.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-42.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-43.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-44.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-45.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-46.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-47.html</url>
</references>
<dates>
<discovery>2010-07-20</discovery>
<entry>2010-07-21</entry>
</dates>
</vuln>
<vuln vid="9a8fecef-92c0-11df-b140-0015f2db7bde">
<topic>vte -- Classic terminal title set+query attack</topic>
<affects>
<package>
<name>vte</name>
<range><lt>0.24.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Kees Cook reports:</p>
<blockquote cite="http://www.securityfocus.com/archive/1/512388">
<p>Janne Snabb discovered that applications using VTE, such as
gnome-terminal, did not correctly filter window and icon title
request escape codes. If a user were tricked into viewing
specially crafted output in their terminal, a remote attacker
could execute arbitrary commands with user privileges.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-2713</cvename>
<url>http://www.securityfocus.com/archive/1/512388</url>
</references>
<dates>
<discovery>2010-07-15</discovery>
<entry>2010-07-18</entry>
</dates>
</vuln>
<vuln vid="19419b3b-92bd-11df-b140-0015f2db7bde">
<topic>webkit-gtk2 -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>webkit-gtk2</name>
<range><lt>1.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gustavo Noronha reports:</p>
<blockquote cite="http://blog.kov.eti.br/?p=116">
<p>Debian's Michael Gilbert has done a great job going through all
CVEs released about WebKit, and including patches in the Debian
package. 1.2.3 includes all of the commits from trunk to fix those,
too.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-1386</cvename>
<cvename>CVE-2010-1392</cvename>
<cvename>CVE-2010-1405</cvename>
<cvename>CVE-2010-1407</cvename>
<cvename>CVE-2010-1416</cvename>
<cvename>CVE-2010-1417</cvename>
<cvename>CVE-2010-1418</cvename>
<cvename>CVE-2010-1421</cvename>
<cvename>CVE-2010-1422</cvename>
<cvename>CVE-2010-1501</cvename>
<cvename>CVE-2010-1664</cvename>
<cvename>CVE-2010-1665</cvename>
<cvename>CVE-2010-1758</cvename>
<cvename>CVE-2010-1759</cvename>
<cvename>CVE-2010-1760</cvename>
<cvename>CVE-2010-1761</cvename>
<cvename>CVE-2010-1762</cvename>
<cvename>CVE-2010-1767</cvename>
<cvename>CVE-2010-1770</cvename>
<cvename>CVE-2010-1771</cvename>
<cvename>CVE-2010-1772</cvename>
<cvename>CVE-2010-1773</cvename>
<cvename>CVE-2010-1774</cvename>
<cvename>CVE-2010-2264</cvename>
<url>http://blog.kov.eti.br/?p=116</url>
</references>
<dates>
<discovery>2010-07-16</discovery>
<entry>2010-07-18</entry>
</dates>
</vuln>
<vuln vid="ba61ce15-8a7b-11df-87ec-0050569b2d21">
<topic>redmine -- multiple vulnerabilities</topic>
<affects>
<package>
<name>redmine</name>
<range><lt>0.9.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Eric Davis reports:</p>
<blockquote cite="http://www.redmine.org/news/41">
<p>This security release addresses some security
vulnerabilities found in the advanced subversion
integration module (Redmine.pm perl script).</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.redmine.org/news/41</url>
</references>
<dates>
<discovery>2010-07-08</discovery>
<entry>2010-07-10</entry>
</dates>
</vuln>
<vuln vid="25ed4ff8-8940-11df-a339-0026189baca3">
<topic>bogofilter -- heap underrun on malformed base64 input</topic>
<affects>
<package>
<name>bogofilter</name>
<range><lt>1.2.1_2</lt></range>
</package>
<package>
<name>bogofilter-sqlite</name>
<range><lt>1.2.1_1</lt></range>
</package>
<package>
<name>bogofilter-tc</name>
<range><lt>1.2.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Julius Plenz reports:</p>
<blockquote cite="http://www.bogofilter.org/pipermail/bogofilter-dev/2010-June/003475.html">
<p>I found a bug in the base64_decode function which may cause memory
corruption when the function is executed on a malformed base64
encoded string.</p>
<p>If a string starting with an equal-sign is passed to the
base64_decode function it triggers a memory corruption that
in some cases makes bogofilter crash.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-2494</cvename>
<url>http://bogofilter.sourceforge.net/security/bogofilter-SA-2010-01</url>
</references>
<dates>
<discovery>2010-06-28</discovery>
<entry>2010-07-06</entry>
</dates>
</vuln>
<vuln vid="f1331504-8849-11df-89b8-00151735203a">
<topic>bugzilla -- information disclosure</topic>
<affects>
<package>
<name>bugzilla</name>
<range><gt>2.17.1</gt><lt>3.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Bugzilla Security Advisory reports:</p>
<blockquote cite="http://www.bugzilla.org/security/3.2.6/">
<ul>
<li>Normally, information about time-tracking (estimated
hours, actual hours, hours worked, and deadlines) is
restricted to users in the "time-tracking group".
However, any user was able, by crafting their own
search URL, to search for bugs based using those
fields as criteria, thus possibly exposing sensitive
time-tracking information by a user seeing that a bug
matched their search.</li>
<li>If $use_suexec was set to "1" in the localconfig file,
then the localconfig file's permissions were set as
world-readable by checksetup.pl. This allowed any user
with local shell access to see the contents of the file,
including the database password and the site_wide_secret
variable used for CSRF protection.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-1204</cvename>
<cvename>CVE-2010-0180</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=309952</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=561797</url>
</references>
<dates>
<discovery>2010-06-24</discovery>
<entry>2010-07-05</entry>
</dates>
</vuln>
<vuln vid="8685d412-8468-11df-8d45-001d7d9eb79a">
<topic>kvirc -- multiple vulnerabilities</topic>
<affects>
<package>
<name>kvirc</name>
<name>kvirc-devel</name>
<range><lt>4.0.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Two security vulnerabilities have been discovered:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2451">
<p>Multiple format string vulnerabilities in the DCC functionality
in KVIrc 3.4 and 4.0 have unspecified impact and remote attack vectors.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2452">
<p>Directory traversal vulnerability in the DCC functionality
in KVIrc 3.4 and 4.0 allows remote attackers to overwrite
arbitrary files via unknown vectors.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-2451</cvename>
<cvename>CVE-2010-2452</cvename>
<url>http://lists.omnikron.net/pipermail/kvirc/2010-May/000867.html</url>
</references>
<dates>
<discovery>2010-05-17</discovery>
<entry>2010-06-30</entry>
</dates>
</vuln>
<vuln vid="edef3f2f-82cf-11df-bcce-0018f3e2eb82">
<topic>png -- libpng decompression buffer overflow</topic>
<affects>
<package>
<name>png</name>
<range>
<lt>1.4.3</lt>
</range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PNG project describes the problem in an advisory:</p>
<blockquote cite="http://www.libpng.org/pub/png/libpng.html">
<p>Several versions of libpng through 1.4.2 (and through 1.2.43
in the older series) contain a bug whereby progressive
applications such as web browsers (or the rpng2 demo app included
in libpng) could receive an extra row of image data beyond the
height reported in the header, potentially leading to an
out-of-bounds write to memory (depending on how the application
is written) and the possibility of execution of an attacker's
code with the privileges of the libpng user (including remote
compromise in the case of a libpng-based browser visiting a
hostile web site).</p>
</blockquote>
</body>
</description>
<references>
<bid>41174</bid>
<cvename>CVE-2010-1205</cvename>
<url>http://www.libpng.org/pub/png/libpng.html</url>
</references>
<dates>
<discovery>2010-03-30</discovery>
<entry>2010-06-28</entry>
<modified>2010-06-28</modified>
</dates>
</vuln>
<vuln vid="66759ce6-7530-11df-9c33-000c29ba66d2">
<topic>moodle -- multiple vulnerabilities</topic>
<affects>
<package>
<name>moodle</name>
<range><lt>1.9.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Moodle release notes report multiple vulnerabilities
which could allow cross site scripting, XSS attacks,
unauthorised deletion of attempts in some instances.</p>
</body>
</description>
<references>
<url>http://docs.moodle.org/en/Moodle_1.9.9_release_notes</url>
</references>
<dates>
<discovery>2010-06-08</discovery>
<entry>2010-06-28</entry>
</dates>
</vuln>
<vuln vid="1cd87e2a-81e3-11df-81d8-00262d5ed8ee">
<topic>mDNSResponder -- corrupted stack crash when parsing bad resolv.conf</topic>
<affects>
<package>
<name>mDNSResponder</name>
<range><le>214</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Juli Mallett reports:</p>
<blockquote>
<p>mdnsd will crash on some systems with a corrupt stack and once
that's fixed it will still leak a file descriptor when parsing
resolv.conf. The crash is because scanf is used with %10s for a
buffer that is only 10 chars long. The buffer size needs increased
to 11 chars to hold the trailing NUL. To fix the leak, an fclose
needs added.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/147007</freebsdpr>
</references>
<dates>
<discovery>2010-05-26</discovery>
<entry>2010-06-27</entry>
</dates>
</vuln>
<vuln vid="77b9f9bc-7fdf-11df-8a8d-0008743bf21a">
<topic>opera -- Data URIs can be used to allow cross-site scripting</topic>
<affects>
<package>
<name>opera</name>
<range><lt>10.11</lt></range>
</package>
<package>
<name>opera-devel</name>
<range><le>10.20_2,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Opera Desktop Team reports:</p>
<blockquote cite="http://www.opera.com/support/kb/view/955/">
<p>Data URIs are allowed to run scripts that manipulate
pages from the site that directly opened them. In some cases, the opening site
is not correctly detected. In these cases, Data URIs may erroneously be able to
run scripts so that they interact with sites that did not directly cause them to
be opened.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.opera.com/support/kb/view/955/</url>
</references>
<dates>
<discovery>2010-06-21</discovery>
<entry>2010-06-25</entry>
</dates>
</vuln>
<vuln vid="e02e6a4e-6b26-11df-96b2-0015587e2cc1">
<topic>cacti -- multiple vulnerabilities</topic>
<affects>
<package>
<name>cacti</name>
<range><lt>0.8.7f</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Multiple vulnerabilities have been reported to exist in older version of
Cacti. The release notes of Cacti 0.8.7f summarizes the problems as
follows:</p>
<blockquote cite="http://www.cacti.net/release_notes_0_8_7f.php">
<ul>
<li>SQL injection and shell escaping issues</li>
<li>Cross-site scripting issues</li>
<li>Cacti Graph Viewer SQL injection vulnerability</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://php-security.org/2010/05/13/mops-2010-023-cacti-graph-viewer-sql-injection-vulnerability/index.html</url>
<url>http://www.cacti.net/release_notes_0_8_7f.php</url>
<url>http://www.bonsai-sec.com/en/research/vulnerabilities/cacti-os-command-injection-0105.php</url>
<url>http://www.vupen.com/english/advisories/2010/1204</url>
</references>
<dates>
<discovery>2010-05-24</discovery>
<entry>2010-06-24</entry>
</dates>
</vuln>
<vuln vid="99858b7c-7ece-11df-a007-000f20797ede">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>3.6.*,1</gt><lt>3.6.4,1</lt></range>
<range><gt>3.5.*,1</gt><lt>3.5.10,1</lt></range>
</package>
<package>
<name>linux-firefox-devel</name>
<range><lt>3.5.10</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><gt>2.0.*</gt><lt>2.0.5</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><ge>3.0</ge><lt>3.0.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>MFSA 2010-33 User tracking across sites using Math.random()</p>
<p>MFSA 2010-32 Content-Disposition: attachment ignored if Content-Type: multipart also present</p>
<p>MFSA 2010-31 focus() behavior can be used to inject or steal keystrokes</p>
<p>MFSA 2010-30 Integer Overflow in XSLT Node Sorting</p>
<p>MFSA 2010-29 Heap buffer overflow in nsGenericDOMDataNode::SetTextInternal</p>
<p>MFSA 2010-28 Freed object reuse across plugin instances</p>
<p>MFSA 2010-27 Use-after-free error in nsCycleCollector::MarkRoots()</p>
<p>MFSA 2010-26 Crashes with evidence of memory corruption (rv:1.9.2.4/ 1.9.1.10)</p>
<p>MFSA 2010-25 Re-use of freed object due to scope confusion</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-5913</cvename>
<cvename>CVE-2010-0183</cvename>
<cvename>CVE-2010-1121</cvename>
<cvename>CVE-2010-1125</cvename>
<cvename>CVE-2010-1197</cvename>
<cvename>CVE-2010-1199</cvename>
<cvename>CVE-2010-1196</cvename>
<cvename>CVE-2010-1198</cvename>
<cvename>CVE-2010-1200</cvename>
<cvename>CVE-2010-1201</cvename>
<cvename>CVE-2010-1202</cvename>
<cvename>CVE-2010-1203</cvename>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-33.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-32.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-31.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-30.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-29.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-28.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-27.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-26.html</url>
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-25.html</url>
</references>
<dates>
<discovery>2010-06-22</discovery>
<entry>2010-06-23</entry>
</dates>
</vuln>
<vuln vid="25673e6e-786b-11df-a921-0245fb008c0b">
<topic>ziproxy -- security vulnerability in PNG decoder</topic>
<affects>
<package>
<name>ziproxy</name>
<range><ge>3.1.0</ge></range>
<range><lt>3.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Daniel Mealha Cabrita reports:</p>
<blockquote cite="http://ziproxy.sourceforge.net/#news">
<p>Fixed security vulnerability (heap-related) in PNG decoder.
(new bug from 3.1.0)</p>
</blockquote>
</body>
</description>
<references>
<url>http://ziproxy.sourceforge.net/#news</url>
<mlist msgid="201006150731.30474.dancab@gmx.net">http://sourceforge.net/mailarchive/message.php?msg_name=201006150731.30474.dancab%40gmx.net</mlist>
</references>
<dates>
<discovery>2010-06-15</discovery>
<entry>2010-06-15</entry>
</dates>
</vuln>
<vuln vid="8816bf3a-7929-11df-bcce-0018f3e2eb82">
<topic>tiff -- Multiple integer overflows</topic>
<affects>
<package>
<name>tiff</name>
<range><lt>3.9.4</lt></range>
</package>
<package>
<name>linux-tiff</name>
<name>linux-f10-tiff</name>
<range><lt>3.9.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tielei Wang:</p>
<blockquote cite="http://www.ocert.org/advisories/ocert-2009-012.html">
<p>Multiple integer overflows in inter-color spaces conversion
tools in libtiff 3.8 through 3.8.2, 3.9, and 4.0 allow
context-dependent attackers to execute arbitrary code via a
TIFF image with large (1) width and (2) height values, which
triggers a heap-based buffer overflow in the (a) cvt_whole_image
function in tiff2rgba and (b) tiffcvt function in rgb2ycbcr.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-2347</cvename>
<url>http://www.remotesensing.org/libtiff/v3.9.4.html</url>
<url>http://www.ocert.org/advisories/ocert-2009-012.html</url>
</references>
<dates>
<discovery>2009-05-22</discovery>
<entry>2010-06-16</entry>
</dates>
</vuln>
<vuln vid="144e524a-77eb-11df-ae06-001b2134ef46">
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplugin</name>
<range><lt>9.0r277</lt></range>
</package>
<package>
<name>linux-f8-flashplugin</name>
<name>linux-f10-flashplugin</name>
<range><lt>10.1r53</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe Product Security Incident Response Team reports:</p>
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb10-14.html">
<p>Critical vulnerabilities have been identified in Adobe
Flash Player version 10.0.45.2 and earlier. These
vulnerabilities could cause the application to crash and
could potentially allow an attacker to take control of the
affected system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-4546</cvename>
<cvename>CVE-2009-3793</cvename>
<cvename>CVE-2010-1297</cvename>
<cvename>CVE-2010-2160</cvename>
<cvename>CVE-2010-2161</cvename>
<cvename>CVE-2010-2162</cvename>
<cvename>CVE-2010-2163</cvename>
<cvename>CVE-2010-2164</cvename>
<cvename>CVE-2010-2165</cvename>
<cvename>CVE-2010-2166</cvename>
<cvename>CVE-2010-2167</cvename>
<cvename>CVE-2010-2169</cvename>
<cvename>CVE-2010-2170</cvename>
<cvename>CVE-2010-2171</cvename>
<cvename>CVE-2010-2172</cvename>
<cvename>CVE-2010-2173</cvename>
<cvename>CVE-2010-2174</cvename>
<cvename>CVE-2010-2175</cvename>
<cvename>CVE-2010-2176</cvename>
<cvename>CVE-2010-2177</cvename>
<cvename>CVE-2010-2178</cvename>
<cvename>CVE-2010-2179</cvename>
<cvename>CVE-2010-2180</cvename>
<cvename>CVE-2010-2181</cvename>
<cvename>CVE-2010-2182</cvename>
<cvename>CVE-2010-2183</cvename>
<cvename>CVE-2010-2184</cvename>
<cvename>CVE-2010-2185</cvename>
<cvename>CVE-2010-2186</cvename>
<cvename>CVE-2010-2187</cvename>
<cvename>CVE-2010-2188</cvename>
<cvename>CVE-2010-2189</cvename>
<url>http://www.adobe.com/support/security/bulletins/apsb10-14.html</url>
</references>
<dates>
<discovery>2008-10-02</discovery>
<entry>2010-06-14</entry>
</dates>
</vuln>
<vuln vid="313da7dc-763b-11df-bcce-0018f3e2eb82">
<topic>tiff -- buffer overflow vulnerability</topic>
<affects>
<package>
<name>tiff</name>
<range><lt>3.9.3</lt></range>
</package>
<package>
<name>linux-tiff</name>
<range><lt>3.9.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Kevin Finisterre reports:</p>
<blockquote cite="http://support.apple.com/kb/HT4196">
<p>Multiple integer overflows in the handling of TIFF files may
result in a heap buffer overflow. Opening a maliciously crafted
TIFF file may lead to an unexpected application termination or
arbitrary code execution. The issues are addressed through
improved bounds checking. Credit to Kevin Finisterre of
digitalmunition.com for reporting these issues.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-1411</cvename>
<url>http://www.remotesensing.org/libtiff/v3.9.3.html</url>
<url>http://support.apple.com/kb/HT4196</url>
</references>
<dates>
<discovery>2010-04-15</discovery>
<entry>2010-06-12</entry>
</dates>
</vuln>
<vuln vid="d42e5b66-6ea0-11df-9c8d-00e0815b8da8">
<topic>sudo -- Secure path vulnerability</topic>
<affects>
<package>
<name>sudo</name>
<range><lt>1.7.2.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Todd Miller reports:</p>
<blockquote cite="http://sudo.ws/sudo/alerts/secure_path.html">
<p>Most versions of the C library function getenv() return the
first instance of an environment variable to the caller. However,
some programs, notably the GNU Bourne Again SHell (bash), do
their own environment parsing and may choose the last instance
of a variable rather than the first one.</p>
<p>An attacker may manipulate the environment of the process that
executes Sudo such that a second PATH variable is present. When
Sudo runs a bash script, it is this second PATH variable that
is used by bash, regardless of whether or not Sudo has overwritten
the first instance of PATH. This may allow an attacker to
subvert the program being run under Sudo and execute commands
he/she would not otherwise be allowed to run.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-1646</cvename>
<url>http://sudo.ws/sudo/alerts/secure_path.html</url>
</references>
<dates>
<discovery>2010-06-02</discovery>
<entry>2010-06-02</entry>
</dates>
</vuln>
<vuln vid="b43004b8-6a53-11df-bc7b-0245fb008c0b">
<topic>ziproxy -- atypical huge picture files vulnerability</topic>
<affects>
<package>
<name>ziproxy</name>
<range><lt>3.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ziproxy 3.0.1 release fixes a security vulnerability related
to atypical huge picture files (&gt;4GB of size once expanded).</p>
</body>
</description>
<references>
<bid>40344</bid>
<cvename>CVE-2010-1513</cvename>
<url>http://ziproxy.sourceforge.net/#news</url>
<url>http://secunia.com/advisories/39941</url>
<mlist msgid="201005210019.37119.dancab@gmx.net">http://sourceforge.net/mailarchive/message.php?msg_name=201005210019.37119.dancab%40gmx.net</mlist>
</references>
<dates>
<discovery>2010-05-20</discovery>
<entry>2010-05-28</entry>
</dates>
</vuln>
<vuln vid="fc55e396-6deb-11df-8b8e-000c29ba66d2">
<topic>mediawiki -- two security vulnerabilities</topic>
<affects>
<package>
<name>mediawiki</name>
<range><lt>1.15.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Two security vulnerabilities were discovered:</p>
<blockquote cite="http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-May/000091.html">
<p>Noncompliant CSS parsing behaviour in Internet Explorer
allows attackers to construct CSS strings which are treated
as safe by previous versions of MediaWiki, but are decoded
to unsafe strings by Internet Explorer.</p>
<p>A CSRF vulnerability was discovered in our login interface.
Although regular logins are protected as of 1.15.3, it was
discovered that the account creation and password reset
reset features were not protected from CSRF. This could lead
to unauthorised access to private wikis.</p>
</blockquote>
</body>
</description>
<references>
<url>http://secunia.com/advisories/39922/</url>
<url>http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-May/000091.html</url>
</references>
<dates>
<discovery>2010-05-28</discovery>
<entry>2010-06-02</entry>
</dates>
</vuln>
<vuln vid="fcc39d22-5777-11df-bf33-001a92771ec2">
<topic>redmine -- multiple vulnerabilities</topic>
<affects>
<package>
<name>redmine</name>
<range><lt>0.9.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Redmine release announcement reports that
several cross side scripting vulnerabilities
and a potential data disclosure vulnerability have
been fixed in the latest release.</p>
</body>
</description>
<references>
<url>http://www.redmine.org/news/39</url>
</references>
<dates>
<discovery>2010-05-01</discovery>
<entry>2010-05-14</entry>
</dates>
</vuln>
<vuln vid="28022228-5a0e-11df-942d-0015587e2cc1">
<topic>wireshark -- DOCSIS dissector denial of service</topic>
<affects>
<package>
<name>wireshark</name>
<range><le>1.2.6_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A vulnerability found in the DOCSIS dissector can cause
Wireshark to crash when a malformed packet trace file is
opened. This means that an attacker will have to trick a
victim into opening such a trace file before being able
to crash the application</p>
</body>
</description>
<references>
<cvename>CVE-2010-1455</cvename>
<url>http://www.wireshark.org/security/wnpa-sec-2010-03.html</url>
<url>http://www.wireshark.org/security/wnpa-sec-2010-04.html</url>
</references>
<dates>
<discovery>2010-05-05</discovery>
<entry>2010-05-07</entry>
</dates>
</vuln>
<vuln vid="c0869649-5a0c-11df-942d-0015587e2cc1">
<topic>piwik -- cross site scripting vulnerability</topic>
<affects>
<package>
<name>piwik</name>
<range><le>0.5.5</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Piwik security advisory reports:</p>
<blockquote cite="http://piwik.org/blog/2010/04/piwik-0-6-security-advisory/">
<p>A non-persistent, cross-site scripting vulnerability
(XSS) was found in Piwik's Login form that reflected
the form_url parameter without being properly escaped
or filtered.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-1453</cvename>
<url>http://piwik.org/blog/2010/04/piwik-0-6-security-advisory/</url>
</references>
<dates>
<discovery>2010-04-15</discovery>
<entry>2010-05-07</entry>
</dates>
</vuln>
<vuln vid="7132c842-58e2-11df-8d80-0015587e2cc1">
<topic>spamass-milter -- remote command execution vulnerability</topic>
<affects>
<package>
<name>spamass-milter</name>
<range><le>0.3.1_8</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The spamassassin milter plugin contains a vulnerability
that can allow remote attackers to execute commands on
affected systems.</p>
<p>The vulnerability can be exploited trough a special-crafted
email header when the plugin was started with the '-x'
(expand) flag.</p>
</body>
</description>
<references>
<cvename>CVE-2010-1132</cvename>
<url>http://archives.neohapsis.com/archives/fulldisclosure/2010-03/0139.html</url>
<url>http://xforce.iss.net/xforce/xfdb/56732</url>
</references>
<dates>
<discovery>2010-03-07</discovery>
<entry>2010-05-06</entry>
</dates>
</vuln>
<vuln vid="694da5b4-5877-11df-8d80-0015587e2cc1">
<topic>mediawiki -- authenticated CSRF vulnerability</topic>
<affects>
<package>
<name>mediawiki</name>
<range><lt>1.15.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A MediaWiki security announcement reports:</p>
<blockquote cite="http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-April/000090.html">
<p>MediaWiki was found to be vulnerable to login CSRF.
An attacker who controls a user account on the target
wiki can force the victim to log in as the attacker,
via a script on an external website.</p>
<p>If the wiki is configured to allow user scripts, say
with "$wgAllowUserJs = true" in LocalSettings.php, then
the attacker can proceed to mount a phishing-style
attack against the victim to obtain their password.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-1150</cvename>
<url>http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-April/000090.html</url>
<url>https://bugzilla.wikimedia.org/show_bug.cgi?id=23076</url>
</references>
<dates>
<discovery>2010-04-07</discovery>
<entry>2010-05-05</entry>
</dates>
</vuln>
<vuln vid="0491d15a-5875-11df-8d80-0015587e2cc1">
<topic>lxr -- multiple XSS vulnerabilities</topic>
<affects>
<package>
<name>lxr</name>
<range><le>0.9.6</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Dan Rosenberg reports:</p>
<blockquote cite="http://sourceforge.net/mailarchive/message.php?msg_name=E1NS2s4-0001PE-F2%403bkjzd1.ch3.sourceforge.com">
<p>There are several cross-site scripting vulnerabilities
in LXR. These vulnerabilities could allow an attacker
to execute scripts in a user's browser, steal cookies
associated with vulnerable domains, redirect the user
to malicious websites, etc.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-4497</cvename>
<freebsdpr>ports/146337</freebsdpr>
<url>http://secunia.com/advisories/38117</url>
<url>http://sourceforge.net/mailarchive/message.php?msg_name=E1NS2s4-0001PE-F2%403bkjzd1.ch3.sourceforge.com</url>
</references>
<dates>
<discovery>2010-01-05</discovery>
<entry>2010-05-05</entry>
</dates>
</vuln>
<vuln vid="752ce039-5242-11df-9139-00242b513d7c">
<topic>vlc -- unintended code execution with specially crafted data</topic>
<affects>
<package>
<name>vlc</name>
<range><lt>1.0.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>VideoLAN project reports:</p>
<blockquote cite="http://www.videolan.org/security/sa1003.html">
<p>VLC media player suffers from various vulnerabilities when
attempting to parse malformatted or overly long byte streams.</p>
</blockquote>
</body>
</description>
<references>
<bid>39629</bid>
<url>http://www.videolan.org/security/sa1003.html</url>
</references>
<dates>
<discovery>2010-04-19</discovery>
<entry>2010-05-01</entry>
<modified>2010-05-05</modified>
</dates>
</vuln>
<vuln vid="8d10038e-515c-11df-83fb-0015587e2cc1">
<topic>joomla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>joomla15</name>
<range><ge>1.5.1</ge><le>1.5.15</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Joomla! reported the following vulnerabilities:</p>
<blockquote cite="http://developer.joomla.org/security/news/311-20100423-core-negative-values-for-limit-and-offset.html">
<p>If a user entered a URL with a negative query limit
or offset, a PHP notice would display revealing information
about the system..</p>
</blockquote>
<blockquote cite="http://developer.joomla.org/security/news/310-20100423-core-installer-migration-script.html">
<p>The migration script in the Joomla! installer does not
check the file type being uploaded. If the installation
application is present, an attacker could use it to
upload malicious files to a server.</p>
</blockquote>
<blockquote cite="http://developer.joomla.org/security/news/309-20100423-core-sessation-fixation.html">
<p>Session id doesn't get modified when user logs in. A
remote site may be able to forward a visitor to the
Joomla! site and set a specific cookie. If the user
then logs in, the remote site can use that cookie to
authenticate as that user.</p>
</blockquote>
<blockquote cite="http://developer.joomla.org/security/news/308-20100423-core-password-reset-tokens.html">
<p>When a user requests a password reset, the reset tokens
were stored in plain text in the database. While this
is not a vulnerability in itself, it allows user accounts
to be compromised if there is an extension on the site
with an SQL injection vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>http://developer.joomla.org/security/news/308-20100423-core-password-reset-tokens.html</url>
<url>http://developer.joomla.org/security/news/309-20100423-core-sessation-fixation.html</url>
<url>http://developer.joomla.org/security/news/310-20100423-core-installer-migration-script.html</url>
<url>http://developer.joomla.org/security/news/311-20100423-core-negative-values-for-limit-and-offset.html</url>
</references>
<dates>
<discovery>2010-04-23</discovery>
<entry>2010-04-26</entry>
</dates>
</vuln>
<vuln vid="5198ef84-4fdc-11df-83fb-0015587e2cc1">
<topic>cacti -- SQL injection and command execution vulnerabilities</topic>
<affects>
<package>
<name>cacti</name>
<range><le>0.8.7e4</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Bonsai information security reports:</p>
<blockquote cite="http://www.bonsai-sec.com/en/research/vulnerability.php">
<p>A Vulnerability has been discovered in Cacti, which
can be exploited by any user to conduct SQL Injection
attacks. Input passed via the "export_item_id" parameter
to "templates_export.php" script is not properly sanitized
before being used in a SQL query.</p>
</blockquote>
<p>The same source also reported a command execution
vulnerability. This second issue can be exploited by
Cacti users who have the rights to modify device or
graph configurations.</p>
</body>
</description>
<references>
<cvename>CVE-2010-1431</cvename>
<freebsdpr>ports/146021</freebsdpr>
<url>http://www.bonsai-sec.com/en/research/vulnerabilities/cacti-os-command-injection-0105.php</url>
<url>http://www.bonsai-sec.com/en/research/vulnerabilities/cacti-sql-injection-0104.php</url>
<url>http://www.debian.org/security/2010/dsa-2039</url>
</references>
<dates>
<discovery>2010-04-21</discovery>
<entry>2010-04-24</entry>
<modified>2013-06-16</modified>
</dates>
</vuln>
<vuln vid="f6429c24-4fc9-11df-83fb-0015587e2cc1">
<topic>moodle -- multiple vulnerabilities</topic>
<affects>
<package>
<name>moodle</name>
<range><lt>1.9.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Moodle release notes report multiple vulnerabilities
which could allow remote attackers to perform, amongst
others, cross site scripting, user enumeration and SQL
injection attacks.</p>
</body>
</description>
<references>
<url>http://docs.moodle.org/en/Moodle_1.9.8_release_notes</url>
</references>
<dates>
<discovery>2010-03-25</discovery>
<entry>2010-04-24</entry>
</dates>
</vuln>
<vuln vid="3383e706-4fc3-11df-83fb-0015587e2cc1">
<topic>tomcat -- information disclosure vulnerability</topic>
<affects>
<package>
<name>tomcat</name>
<range><gt>5.5.0</gt><lt>5.5.30</lt></range>
<range><gt>6.0.0</gt><lt>6.0.27</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache software foundation reports:</p>
<blockquote cite="http://seclists.org/bugtraq/2010/Apr/200">
<p>The "WWW-Authenticate" header for BASIC and DIGEST
authentication includes a realm name. If a &lt;realm-name&gt;
element is specified for the application in web.xml it
will be used. However, a &lt;realm-name&gt; is not
specified then Tomcat will generate one.</p>
<p>In some circumstances this can expose the local
hostname or IP address of the machine running Tomcat.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-1157</cvename>
<freebsdpr>ports/146022</freebsdpr>
<url>http://seclists.org/bugtraq/2010/Apr/200</url>
</references>
<dates>
<discovery>2010-04-22</discovery>
<entry>2010-04-24</entry>
</dates>
</vuln>
<vuln vid="f6b6beaa-4e0e-11df-83fb-0015587e2cc1">
<cancelled/>
</vuln>
<vuln vid="86b8b655-4d1a-11df-83fb-0015587e2cc1">
<topic>krb5 -- KDC double free vulnerability</topic>
<affects>
<package>
<name>krb5</name>
<range><ge>1.7</ge><lt>1.7.2</lt></range>
<range><ge>1.8</ge><lt>1.8.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The MIT Kerberos team reports:</p>
<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-004.txt">
<p>An authenticated remote attacker can crash the KDC by
inducing the KDC to perform a double free. Under some
circumstances on some platforms, this could also allow
malicious code execution.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-1320</cvename>
<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-004.txt</url>
</references>
<dates>
<discovery>2010-04-20</discovery>
<entry>2010-04-21</entry>
</dates>
</vuln>
<vuln vid="a4746a86-4c89-11df-83fb-0015587e2cc1">
<topic>e107 -- code execution and XSS vulnerabilities</topic>
<affects>
<package>
<name>e107</name>
<range><lt>0.7.20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia Research reported two vulnerabilities in e107:</p>
<p>The first problem affects installations that have the
Content Manager plugin enabled. This plugin does not
sanitize the "content_heading" parameter correctly and
is therefore vulnerable to a cross site scripting attack.</p>
<p>The second vulnerability is related to the avatar upload
functionality. Images containing PHP code can be uploaded
and executed.</p>
</body>
</description>
<references>
<bid>39540</bid>
<cvename>CVE-2010-0996</cvename>
<cvename>CVE-2010-0997</cvename>
<freebsdpr>ports/145885</freebsdpr>
<url>http://e107.org/comment.php?comment.news.864</url>
<url>http://secunia.com/secunia_research/2010-43/</url>
<url>http://secunia.com/secunia_research/2010-44/</url>
<url>http://xforce.iss.net/xforce/xfdb/57932</url>
</references>
<dates>
<discovery>2010-04-15</discovery>
<entry>2010-04-20</entry>
</dates>
</vuln>
<vuln vid="09910d76-4c82-11df-83fb-0015587e2cc1">
<topic>fetchmail -- denial of service vulnerability</topic>
<affects>
<package>
<name>fetchmail</name>
<range>
<ge>4.6.3</ge>
<le>6.3.16</le>
</range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Fetchmail developer Matthias Andree reported a vulnerability
that allows remote attackers to crash the application
when it is runs in verbose mode.</p>
<blockquote cite="http://gitorious.org/fetchmail/fetchmail/commit/ec06293">
<p>Fetchmail before release 6.3.17 did not properly
sanitize external input (mail headers and UID). When a
multi-character locale (such as UTF-8) was in use, this
could cause memory exhaustion and thus a denial of
service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-1167</cvename>
<freebsdpr>ports/145857</freebsdpr>
<url>http://gitorious.org/fetchmail/fetchmail/commit/ec06293</url>
<url>http://seclists.org/oss-sec/2010/q2/76</url>
</references>
<dates>
<discovery>2010-04-18</discovery>
<entry>2010-04-20</entry>
</dates>
</vuln>
<vuln vid="a2c4d3d5-4c7b-11df-83fb-0015587e2cc1">
<topic>pidgin -- multiple remote denial of service vulnerabilities</topic>
<affects>
<package>
<name>pidgin</name>
<range><lt>2.6.6</lt></range>
</package>
<package>
<name>libpurple</name>
<range><lt>2.6.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Three denial of service vulnerabilities where found in
pidgin and allow remote attackers to crash the application.
The developers summarized these problems as follows:</p>
<blockquote cite="http://pidgin.im/news/security/?id=45">
<p>Pidgin can become unresponsive when displaying large
numbers of smileys</p>
</blockquote>
<blockquote cite="http://pidgin.im/news/security/?id=44">
<p>Certain nicknames in group chat rooms can trigger a
crash in Finch</p>
</blockquote>
<blockquote cite="http://pidgin.im/news/security/?id=43">
<p>Failure to validate all fields of an incoming message
can trigger a crash</p>
</blockquote>
</body>
</description>
<references>
<bid>38294</bid>
<cvename>CVE-2010-0277</cvename>
<cvename>CVE-2010-0420</cvename>
<cvename>CVE-2010-0423</cvename>
<url>http://pidgin.im/news/security/?id=43</url>
<url>http://pidgin.im/news/security/?id=44</url>
<url>http://pidgin.im/news/security/?id=45</url>
</references>
<dates>
<discovery>2010-02-18</discovery>
<entry>2010-04-20</entry>
</dates>
</vuln>
<vuln vid="4fb5d2cd-4c77-11df-83fb-0015587e2cc1">
<topic>png -- libpng decompression denial of service</topic>
<affects>
<package>
<name>png</name>
<range>
<gt>1.2.43</gt>
<lt>1.4.1</lt>
</range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A vulnerability in libpng can result in denial of service
conditions when a remote attacker tricks a victim to open
a specially-crafted PNG file.</p>
<p>The PNG project describes the problem in an advisory:</p>
<blockquote cite="http://libpng.sourceforge.net/ADVISORY-1.4.1.html">
<p>Because of the efficient compression method used in
Portable Network Graphics (PNG) files, a small PNG file
can expand tremendously, acting as a "decompression
bomb".</p>
<p>Malformed PNG chunks can consume a large amount of CPU
and wall-clock time and large amounts of memory, up to
all memory available on a system</p>
</blockquote>
</body>
</description>
<references>
<bid>38478</bid>
<certvu>576029</certvu>
<cvename>CVE-2010-0205</cvename>
<url>http://libpng.sourceforge.net/ADVISORY-1.4.1.html</url>
<url>http://secunia.com/advisories/38774</url>
<url>http://xforce.iss.net/xforce/xfdb/56661</url>
</references>
<dates>
<discovery>2010-02-27</discovery>
<entry>2010-04-20</entry>
</dates>
</vuln>
<vuln vid="c8c31c41-49ed-11df-83fb-0015587e2cc1">
<topic>curl -- libcurl buffer overflow vulnerability</topic>
<affects>
<package>
<name>curl</name>
<range>
<ge>7.10.5</ge>
<lt>7.20.0</lt>
</range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The cURL project reports in a security advisory:</p>
<blockquote cite="http://curl.haxx.se/docs/adv_20100209.html">
<p>Using the affected libcurl version to download compressed
content over HTTP, an application can ask libcurl to
automatically uncompress data. When doing so, libcurl
can wrongly send data up to 64K in size to the callback
which thus is much larger than the documented maximum
size.</p>
<p>An application that blindly trusts libcurl's max limit
for a fixed buffer size or similar is then a possible
target for a buffer overflow vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2010-0734</cvename>
<url>http://curl.haxx.se/docs/adv_20100209.html</url>
<url>http://www.debian.org/security/2010/dsa-2023</url>
<url>http://www.openwall.com/lists/oss-security/2010/02/09/5</url>
</references>
<dates>
<discovery>2010-02-09</discovery>
<entry>2010-04-19</entry>
</dates>
</vuln>
<vuln vid="a04a3c13-4932-11df-83fb-0015587e2cc1">
<topic>ejabberd -- queue overload denial of service vulnerability</topic>
<affects>
<package>
<name>ejabberd</name>
<range><lt>2.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Red Hat security response team reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2010/01/29/1">
<p>A remotely exploitable DoS from XMPP client to ejabberd
server via too many "client2server" messages (causing the
message queue on the server to get overloaded, leading
to server crash) has been found.</p>
</blockquote>
</body>
</description>
<references>
<bid>38003</bid>
<cvename>CVE-2010-0305</cvename>
<url>http://secunia.com/advisories/38337</url>
<url>http://support.process-one.net/browse/EJAB-1173</url>
<url>http://www.openwall.com/lists/oss-security/2010/01/29/1</url>
<url>http://xforce.iss.net/xforce/xfdb/56025</url>
</references>
<dates>
<discovery>2010-01-29</discovery>
<entry>2010-04-19</entry>
</dates>
</vuln>
<vuln vid="3b7967f1-49e8-11df-83fb-0015587e2cc1">
<topic>irssi -- multiple vulnerabilities</topic>
<affects>
<package>
<name>irssi</name>
<range><lt>0.8.15</lt></range>
</package>
<package>
<name>zh-irssi</name>
<range><lt>0.8.15</lt></range>
</package>
<package>
<name>irssi-devel</name>
<range><lt>20100325</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Two vulnerabilities have found in irssi. The first issue
could allow man-in-the-middle attacks due to a missing
comparison of SSL server hostnames and the certificate
domain names (e.g. CN).</p>
<p>A second vulnerability, related to the nick matching code,
could be triggered by remote attackers in order to crash
an irssi client when leaving a channel.</p>
</body>
</description>
<references>
<cvename>CVE-2010-1155</cvename>
<cvename>CVE-2010-1156</cvename>
<url>http://xforce.iss.net/xforce/xfdb/57790</url>
<url>http://xforce.iss.net/xforce/xfdb/57791</url>
</references>
<dates>
<discovery>2010-04-16</discovery>
<entry>2010-04-19</entry>
</dates>
</vuln>
<vuln vid="a30573dc-4893-11df-a5f9-001641aeabdf">
<topic>krb5 -- remote denial of service vulnerability</topic>
<affects>
<package>
<name>krb5</name>
<range><le>1.6.3_9</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An authenticated remote attacker can causing a denial
of service by using a newer version of the kadmin protocol
than the server supports.</p>
<p>The MIT Kerberos team also reports the cause:</p>
<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-003.txt">
<p>The Kerberos administration daemon (kadmind) can crash
due to referencing freed memory.</p>
</blockquote>
</body>
</description>
<references>
<bid>39247</bid>
<cvename>CVE-2010-0629</cvename>
<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-003.txt</url>
</references>
<dates>
<discovery>2010-04-06</discovery>
<entry>2010-04-18</entry>
</dates>
</vuln>

File Metadata

Mime Type
text/x-diff
Expires
Wed, Nov 12, 11:44 PM (1 h, 50 m)
Storage Engine
local-disk
Storage Format
Raw Data
Storage Handle
61/b9/05bef411e445350e083f7f137ae1
Default Alt Text
(2 MB)

Event Timeline