Index: head/security/vuxml/vuln.xml
===================================================================
--- head/security/vuxml/vuln.xml (revision 399427)
+++ head/security/vuxml/vuln.xml (revision 399428)
@@ -1,65621 +1,65622 @@
Qualys reports: During the code review of OpenSMTPD a memory leak and buffer overflow
- (an off-by-one, usually stack-based) were discovered in LibreSSL's
- OBJ_obj2txt() function. This function is called automatically during
- a TLS handshake (both client-side, unless an anonymous mode is used,
- and server-side, if client authentication is requested).
ARM Limited reports:
When the client creates its ClientHello message, due to insufficient bounds checking it can overflow the heap-based buffer containing the message while writing some extensions. Two extensions in particular could be used by a remote attacker to trigger the overflow: the session ticket extension and the server name indication (SNI) extension.
Magento, Inc. reports:
SUPEE-6482 - This patch addresses two issues related to APIs and two cross-site scripting risks.
SUPEE-6285 - This patch provides protection against several types of security-related issues, including information leaks, request forgeries, and cross-site scripting.
SUPEE-5994 - This patch addresses multiple security vulnerabilities in Magento Community Edition software, including issues that can put customer information at risk.
SUPEE-5344 - Addresses a potential remote code execution exploit.
SUPEE-1533 - Addresses two potential remote code execution exploits.
Fabien Potencier reports:
End users can craft valid Twig code that allows them to execute arbitrary code (RCEs) via the _self variable, which is always available, even in sandboxed templates.
Talos reports:
An exploitable buffer overflow vulnerability exists in the XML parser functionality of the MiniUPnP library. A specially crafted XML response can lead to a buffer overflow on the stack resulting in remote code execution. An attacker can set up a server on the local network to trigger this vulnerability.
Adobe reports:
These updates resolve a vulnerability that could be exploited to bypass the same-origin-policy and lead to information disclosure (CVE-2015-7628).
These updates include a defense-in-depth feature in the Flash broker API (CVE-2015-5569).
These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2015-7629, CVE-2015-7631, CVE-2015-7643, CVE-2015-7644).
These updates resolve a buffer overflow vulnerability that could lead to code execution (CVE-2015-7632).
These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2015-7625, CVE-2015-7626, CVE-2015-7627, CVE-2015-7630, CVE-2015-7633, CVE-2015-7634).
Google Chrome Releases reports:
24 security fixes in this release, including:
- [519558] High CVE-2015-6755: Cross-origin bypass in Blink. Credit to Mariusz Mlynski.
- [507316] High CVE-2015-6756: Use-after-free in PDFium. Credit to anonymous.
- [529520] High CVE-2015-6757: Use-after-free in ServiceWorker. Credit to Collin Payne.
- [522131] High CVE-2015-6758: Bad-cast in PDFium. Credit to Atte Kettunen of OUSPG.
- [514076] Medium CVE-2015-6759: Information leakage in LocalStorage. Credit to Muneaki Nishimura (nishimunea).
- [519642] Medium CVE-2015-6760: Improper error handling in libANGLE. Credit to lastland.net.
- [447860,532967] Medium CVE-2015-6761: Memory corruption in FFMpeg. Credit to Aki Helin of OUSPG and anonymous.
- [512678] Low CVE-2015-6762: CORS bypass via CSS fonts. Credit to Muneaki Nishimura (nishimunea).
- [542517] CVE-2015-6763: Various fixes from internal audits, fuzzing and other initiatives.
- Multiple vulnerabilities in V8 fixed at the tip of the 4.6 branch (currently 4.6.85.23).
Matthijs Kooijman reports:
It seems that the whiptail, cdialog and kdialog backends apply some improper escaping in their shell commands, causing special characters present in menu item titles to be interpreted by the shell. This includes the backtick evaluation operator, so this constitutues a security issue, allowing execution of arbitrary commands if an attacker has control over the text displayed in a menu.
Matthias Bussonnier reports:
Summary: Local folder name was used in HTML templates without escaping, allowing XSS in said pages by carefully crafting folder name and URL to access it.
URI with issues:
- GET /tree/**
Benjamin RK reports:
Vulnerability: A maliciously forged file opened for editing can execute javascript, specifically by being redirected to /files/ due to a failure to treat the file as plain text.
URI with issues:
- GET /edit/**
PostgreSQL project reports:
Two security issues have been fixed in this release which affect users of specific PostgreSQL features.
- CVE-2015-5289 json or jsonb input values constructed from arbitrary user input can crash the PostgreSQL server and cause a denial of service.
- CVE-2015-5288: The crypt() function included with the optional pgCrypto extension could be exploited to read a few additional bytes of memory. No working exploit for this issue has been developed.
Zend Framework developers report:
The PDO adapters of Zend Framework 1 do not filter null bytes values in SQL statements. A PDO adapter can treat null bytes in a query as a string terminator, allowing an attacker to add arbitrary SQL following a null byte, and thus create a SQL injection.
OpenSMTPD developers report:
fix an mda buffer truncation bug which allows a user to create forward files that pass session checks but fail delivery later down the chain, within the user mda
fix remote buffer overflow in unprivileged pony process
reworked offline enqueue to better protect against hardlink attacks
ARM Limited reports:
Florian Weimar from Red Hat published on Lenstra's RSA-CRT attach for PKCS#1 v1.5 signatures. These releases include countermeasures against that attack.
Fabian Foerg of Gotham Digital Science found a possible client-side NULL pointer dereference, using the AFL Fuzzer. This dereference can only occur when misusing the API, although a fix has still been implemented.
ARM Limited reports:
In order to strengthen the minimum requirements for connections and to protect against the Logjam attack, the minimum size of Diffie-Hellman parameters accepted by the client has been increased to 1024 bits.
In addition the default size for the Diffie-Hellman parameters on the server are increased to 2048 bits. This can be changed with ssl_set_dh_params() in case this is necessary.
reports:
We found a heap overflow and a DoS in the gdk-pixbuf implementation triggered by the scaling of tga file.
We found a heap overflow in the gdk-pixbuf implementation triggered by the scaling of gif file.
Plone.org reports:
Versions Affected: All current Plone versions.
Versions Not Affected: None.
Nature of vulnerability: Allows creation of members by anonymous users on sites that have self-registration enabled, allowing bypass of CAPTCHA and similar protections against scripted attacks.
The patch can be added to buildouts as Products.PloneHotfix20150910 (available from PyPI) or downloaded from Plone.org.
Immediate Measures You Should Take: Disable self-registration until you have applied the patch.
Plone's URL checking infrastructure includes a method for checking if URLs valid and located in the Plone site. By passing HTML into this specially crafted url, XSS can be achieved.
PHP reports:
Phar:
- Fixed bug #69720 (Null pointer dereference in phar_get_fp_offset()).
- Fixed bug #70433 (Uninitialized pointer in phar_make_dirstream when zip entry filename is "/").
OpenSMTPD developers report:
an oversight in the portable version of fgetln() that allows attackers to read and write out-of-bounds memory
multiple denial-of-service vulnerabilities that allow local users to kill or hang OpenSMTPD
a stack-based buffer overflow that allows local users to crash OpenSMTPD, or execute arbitrary code as the non-chrooted _smtpd user
a hardlink attack (or race-conditioned symlink attack) that allows local users to unset the chflags() of arbitrary files
a hardlink attack that allows local users to read the first line of arbitrary files (for example, root's hash from /etc/master.passwd)
a denial-of-service vulnerability that allows remote attackers to fill OpenSMTPD's queue or mailbox hard-disk partition
an out-of-bounds memory read that allows remote attackers to crash OpenSMTPD, or leak information and defeat the ASLR protection
a use-after-free vulnerability that allows remote attackers to crash OpenSMTPD, or execute arbitrary code as the non-chrooted _smtpd user
The Apache James Project reports:
This release has many enhancements and bug fixes over the previous release. See the Release Notes for a detailed list of changes. Some of the earlier defects could turn a James mail server into an Open Relay and allow files to be written on disk. All users of James Server are urged to upgrade to version v2.3.2.1 as soon as possible.
The OTRS project reports:
An attacker with valid LOCAL credentials could access and manipulate the process ID file for bin/otrs.schduler.pl from the CLI.
The Proc::Daemon module 0.14 for Perl uses world-writable permissions for a file that stores a process ID, which allows local users to have an unspecified impact by modifying this file.
Adobe reports:
These updates resolve a type confusion vulnerability that could lead to code execution (CVE-2015-5573).
These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2015-5570, CVE-2015-5574, CVE-2015-5581, CVE-2015-5584, CVE-2015-6682).
These updates resolve buffer overflow vulnerabilities that could lead to code execution (CVE-2015-6676, CVE-2015-6678).
These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2015-5575, CVE-2015-5577, CVE-2015-5578, CVE-2015-5580, CVE-2015-5582, CVE-2015-5588, CVE-2015-6677).
These updates include additional validation checks to ensure that Flash Player rejects malicious content from vulnerable JSONP callback APIs (CVE-2015-5571).
These updates resolve a memory leak vulnerability (CVE-2015-5576).
These updates include further hardening to a mitigation to defend against vector length corruptions (CVE-2015-5568).
These updates resolve stack corruption vulnerabilities that could lead to code execution (CVE-2015-5567, CVE-2015-5579).
These updates resolve a stack overflow vulnerability that could lead to code execution (CVE-2015-5587).
These updates resolve a security bypass vulnerability that could lead to information disclosure (CVE-2015-5572).
These updates resolve a vulnerability that could be exploited to bypass the same-origin-policy and lead to information disclosure (CVE-2015-6679).
The CodeIgniter changelog reports:
Security: Fixed an SQL injection vulnerability in Active Record method offset().
The CodeIgniter changelog reports:
Security: Removed a fallback to mysql_escape_string() in the mysql database driver (escape_str() method) when there's no active database connection.
The CodeIgniter changelog reports:
Security: Added HTTP "Host" header character validation to prevent cache poisoning attacks when base_url auto-detection is used.
Security: Added FSCommand and seekSegmentTime to the "evil attributes" list in CI_Security::xss_clean().
The CodeIgniter changelog reports:
Security: The xor_encode() method in the Encrypt Class has been removed. The Encrypt Class now requires the Mcrypt extension to be installed.
Security: The Session Library now uses HMAC authentication instead of a simple MD5 checksum.
The CodeIgniter changelog reports:
An improvement was made to the MySQL and MySQLi drivers to prevent exposing a potential vector for SQL injection on sites using multi-byte character sets in the database client connection.
An incompatibility in PHP versions < 5.2.3 and MySQL > 5.0.7 with mysql_set_charset() creates a situation where using multi-byte character sets on these environments may potentially expose a SQL injection attack vector. Latin-1, UTF-8, and other "low ASCII" character sets are unaffected on all environments.
If you are running or considering running a multi-byte character set for your database connection, please pay close attention to the server environment you are deploying on to ensure you are not vulnerable.
Google Chrome Releases reports:
Two vulnerabilities were fixed in this release:
- [530301] High CVE-2015-1303: Cross-origin bypass in DOM. Credit to Mariusz Mlynski.
- [531891] High CVE-2015-1304: Cross-origin bypass in V8. Credit to Mariusz Mlynski.
Mariusz Ziulek reports:
A malicious attacker could man in the middle a real server and cause libssh2 using clients to crash (denial of service) or otherwise read and use completely unintended memory areas in this process.
The Mozilla Project reports:
MFSA 2015-96 Miscellaneous memory safety hazards (rv:41.0 / rv:38.3)
MFSA 2015-97 Memory leak in mozTCPSocket to servers
MFSA 2015-98 Out of bounds read in QCMS library with ICC V4 profile attributes
MFSA 2015-99 Site attribute spoofing on Android by pasting URL with unknown scheme
MFSA 2015-100 Arbitrary file manipulation by local user through Mozilla updater
MFSA 2015-101 Buffer overflow in libvpx while parsing vp9 format video
MFSA 2015-102 Crash when using debugger with SavedStacks in JavaScript
MFSA 2015-103 URL spoofing in reader mode
MFSA 2015-104 Use-after-free with shared workers and IndexedDB
MFSA 2015-105 Buffer overflow while decoding WebM video
MFSA 2015-106 Use-after-free while manipulating HTML media content
MFSA 2015-107 Out-of-bounds read during 2D canvas display on Linux 16-bit color depth systems
MFSA 2015-108 Scripted proxies can access inner window
MFSA 2015-109 JavaScript immutable property enforcement can be bypassed
MFSA 2015-110 Dragging and dropping images exposes final URL after redirects
MFSA 2015-111 Errors in the handling of CORS preflight request headers
MFSA 2015-112 Vulnerabilities found through code inspection
MFSA 2015-113 Memory safety errors in libGLES in the ANGLE graphics library
MFSA 2015-114 Information disclosure via the High Resolution Time API
NVD reports:
The decode_ihdr_chunk function in libavcodec/pngdec.c in FFmpeg before 2.7.2 does not enforce uniqueness of the IHDR (aka image header) chunk in a PNG image, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted image with two or more of these chunks.
Multiple integer underflows in the ff_mjpeg_decode_frame function in libavcodec/mjpegdec.c in FFmpeg before 2.7.2 allow remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted MJPEG data.
The ff_sbr_apply function in libavcodec/aacsbr.c in FFmpeg before 2.7.2 does not check for a matching AAC frame syntax element before proceeding with Spectral Band Replication calculations, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted AAC data.
The ff_mpv_common_init function in libavcodec/mpegvideo.c in FFmpeg before 2.7.2 does not properly maintain the encoding context, which allows remote attackers to cause a denial of service (invalid pointer access) or possibly have unspecified other impact via crafted MPEG data.
The destroy_buffers function in libavcodec/sanm.c in FFmpeg before 2.7.2 does not properly maintain height and width values in the video context, which allows remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via crafted LucasArts Smush video data.
The allocate_buffers function in libavcodec/alac.c in FFmpeg before 2.7.2 does not initialize certain context data, which allows remote attackers to cause a denial of service (segmentation violation) or possibly have unspecified other impact via crafted Apple Lossless Audio Codec (ALAC) data.
The sws_init_context function in libswscale/utils.c in FFmpeg before 2.7.2 does not initialize certain pixbuf data structures, which allows remote attackers to cause a denial of service (segmentation violation) or possibly have unspecified other impact via crafted video data.
The ff_frame_thread_init function in libavcodec/pthread_frame.c in FFmpeg before 2.7.2 mishandles certain memory-allocation failures, which allows remote attackers to cause a denial of service (invalid pointer access) or possibly have unspecified other impact via a crafted file, as demonstrated by an AVI file.
The ff_rv34_decode_init_thread_copy function in libavcodec/rv34.c in FFmpeg before 2.7.2 does not initialize certain structure members, which allows remote attackers to cause a denial of service (invalid pointer access) or possibly have unspecified other impact via crafted (1) RV30 or (2) RV40 RealVideo data.
Moodle Release Notes report:
MSA-15-0030: Students can re-attempt answering questions in the lesson (CVE-2015-5264)
MSA-15-0031: Teacher in forum can still post to "all participants" and groups they are not members of (CVE-2015-5272 - 2.7.10 only)
MSA-15-0032: Users can delete files uploaded by other users in wiki (CVE-2015-5265)
MSA-15-0033: Meta course synchronization enrolls suspended students as managers for a short period of time (CVE-2015-5266)
MSA-15-0034: Vulnerability in password recovery mechanism (CVE-2015-5267)
MSA-15-0035: Rating component does not check separate groups (CVE-2015-5268)
MSA-15-0036: XSS in grouping description (CVE-2015-5269)
Amos Jeffries, release manager of the Squid-3 series, reports:
Vulnerable versions are 3.5.0.1 to 3.5.8 (inclusive), which are built with OpenSSL and configured for "SSL-Bump" decryption.
Integer overflows can lead to invalid pointer math reading from random memory on some CPU architectures. In the best case this leads to wrong TLS extensiosn being used for the client, worst-case a crash of the proxy terminating all active transactions.
Incorrect message size checks and assumptions about the existence of TLS extensions in the SSL/TLS handshake message can lead to very high CPU consumption (up to and including 'infinite loop' behaviour).
The above can be triggered remotely. Though there is one layer of authorization applied before this processing to check that the client is allowed to use the proxy, that check is generally weak. MS Skype on Windows XP is known to trigger some of these.
The FreeBSD port does not use SSL by default and is not vulnerable in the default configuration.
Dianne Skoll reports:
BUG FIX: Fix a buffer overflow found by Alexander Keller.
The bug can be manifested by an extended DUMP command using a system variable (that is a special variable whose name begins with '$')
Luke Farone reports:
In the "Shutter" screenshot application, I discovered that using the "Show in folder" menu option while viewing a file with a specially-crafted path allows for arbitrary code execution with the permissions of the user running Shutter.
Feist Josselin reports:
Use-after-free was found in openjpeg. The vuln is fixed in version 2.1.1 and was located in opj_j2k_write_mco function.
Gustavo Grieco reports:
We found a use-after-free causing an invalid/double free in optipng 0.6.4.
Qinghao Tang reports:
The function ParseExtension() in openslp 1.2.1 exists a vulnerability , an attacher can cause a denial of service (infinite loop) via a packet with crafted "nextoffset" value and "extid" value.
Alexander Cherepanov reports:
7z (and 7zr) is susceptible to a directory traversal vulnerability. While extracting an archive, it will extract symlinks and then follow them if they are referenced in further entries. This can be exploited by a rogue archive to write files outside the current directory.
Yakuzo reports:
H2O (up to version 1.4.4 / 1.5.0-beta1) contains a flaw in its URL normalization logic.
When file.dir directive is used, this flaw allows a remote attacker to retrieve arbitrary files that exist outside the directory specified by the directive.
H2O version 1.4.5 and version 1.5.0-beta2 have been released to address this vulnerability.
Users are advised to upgrade their servers immediately.
The vulnerability was reported by: Yusuke OSUMI.
Samuel Sidler reports:
WordPress 4.3.1 is now available. This is a security release for all previous versions and we strongly encourage you to update your sites immediately.
- WordPress versions 4.3 and earlier are vulnerable to a cross-site scripting vulnerability when processing shortcode tags (CVE-2015-5714). Reported by Shahar Tal and Netanel Rubin of Check Point.
- A separate cross-site scripting vulnerability was found in the user list table. Reported by Ben Bidner of the WordPress security team.
- Finally, in certain cases, users without proper permissions could publish private posts and make them sticky (CVE-2015-5715). Reported by Shahar Tal and Netanel Rubin of Check Point.
Bugzilla Security Advisory
Login names (usually an email address) longer than 127 characters are silently truncated in MySQL which could cause the domain name of the email address to be corrupted. An attacker could use this vulnerability to create an account with an email address different from the one originally requested. The login name could then be automatically added to groups based on the group's regular expression setting.
Denis Andzakovic reports:
By sending a crafted packet, an attacker may cause the OpenLDAP server to reach an assert(9 9 statement, crashing the daemon.
Paris Zoumpouloglou reports:
I discovered an integer overflow issue in oggenc, related to the number of channels in the input WAV file. The issue triggers an out-of-bounds memory access which causes oggenc to crash.
Paris Zoumpouloglou reports:
A crafted WAV file with number of channels set to 0 will cause oggenc to crash due to a division by zero issue.
pengsu reports:
I discovered an buffer overflow issue in oggenc/audio.c when it tries to open invalid aiff file.
PgBouncer reports:
New auth_user functionality introduced in 1.6 allows login as auth_user when client presents unknown username. It's quite likely auth_user is superuser. Affects only setups that have enabled auth_user in their config.
The phpMyAdmin development team reports:
This vulnerability allows to complete the reCaptcha test and subsequently perform a brute force attack to guess user credentials without having to complete further reCaptcha tests.
We consider this vulnerability to be non critical since reCaptcha is an additional opt-in security measure.
PHP reports:
- Core:
- Fixed bug #70172 (Use After Free Vulnerability in unserialize()).
- Fixed bug #70219 (Use after free vulnerability in session deserializer).
- EXIF:
- Fixed bug #70385 (Buffer over-read in exif_read_data with TIFF IFD tag byte value of 32 bytes).
- hash:
- Fixed bug #70312 (HAVAL gives wrong hashes in specific cases).
- PCRE:
- Fixed bug #70345 (Multiple vulnerabilities related to PCRE functions).
- SOAP:
- Fixed bug #70388 (SOAP serialize_function_call() type confusion / RCE).
- SPL:
- Fixed bug #70365 (Use-after-free vulnerability in unserialize() with SplObjectStorage).
- Fixed bug #70366 (Use-after-free vulnerability in unserialize() with SplDoublyLinkedList).
- XSLT:
- Fixed bug #69782 (NULL pointer dereference).
- ZIP:
- Fixed bug #70350 (ZipArchive::extractTo allows for directory traversal when creating directories).
Ivan Novikov reports:
It's easy to bypass auth by using boolean serialization...
Wireshark development team reports:
The following vulnerabilities have been fixed.
wnpa-sec-2015-21
Protocol tree crash. (Bug 11309)
wnpa-sec-2015-22
Memory manager crash. (Bug 11373)
wnpa-sec-2015-23
Dissector table crash. (Bug 11381)
wnpa-sec-2015-24
ZigBee crash. (Bug 11389)
wnpa-sec-2015-25
GSM RLC/MAC infinite loop. (Bug 11358)
wnpa-sec-2015-26
WaveAgent crash. (Bug 11358)
wnpa-sec-2015-27
OpenFlow infinite loop. (Bug 11358)
wnpa-sec-2015-28
Ptvcursor crash. (Bug 11358)
wnpa-sec-2015-29
WCCP crash. (Bug 11358)
Kuang-che Wu reports:
screen will recursively call MScrollV to depth n/256. This is time consuming and will overflow stack if n is huge.
Petr Pisar reports:
libvncserver/tight.c:rfbTightCleanup() frees a buffer without zeroing freed pointer.
Matthias Clasen reports:
Fix several integer overflows.
ISC reports:
An incorrect boundary check in openpgpkey_61.c can cause named to terminate due to a REQUIRE assertion failure. This defect can be deliberately exploited by an attacker who can provide a maliciously constructed response in answer to a query.
ISC reports:
Parsing a malformed DNSSEC key can cause a validating resolver to exit due to a failed assertion in buffer.c. It is possible for a remote attacker to deliberately trigger this condition, for example by using a query which requires a response from a zone containing a deliberately malformed key.
Google Chrome Releases reports:
29 security fixes in this release, including:
- [516377] High CVE-2015-1291: Cross-origin bypass in DOM. Credit to anonymous.
- [522791] High CVE-2015-1292: Cross-origin bypass in ServiceWorker. Credit to Mariusz Mlynski.
- [524074] High CVE-2015-1293: Cross-origin bypass in DOM. Credit to Mariusz Mlynski.
- [492263] High CVE-2015-1294: Use-after-free in Skia. Credit to cloudfuzzer.
- [502562] High CVE-2015-1295: Use-after-free in Printing. Credit to anonymous.
- [421332] High CVE-2015-1296: Character spoofing in omnibox. Credit to zcorpan.
- [510802] Medium CVE-2015-1297: Permission scoping error in Webrequest. Credit to Alexander Kashev.
- [518827] Medium CVE-2015-1298: URL validation error in extensions. Credit to Rob Wu.
- [416362] Medium CVE-2015-1299: Use-after-free in Blink. Credit to taro.suzuki.dev.
- [511616] Medium CVE-2015-1300: Information leak in Blink. Credit to cgvwzq.
- [526825] CVE-2015-1301: Various fixes from internal audits, fuzzing and other initiatives.
PowerDNS reports:
A bug was found in our DNS packet parsing/generation code, which, when exploited, can cause individual threads (disabling service) or whole processes (allowing a supervisor to restart them) to crash with just one or a few query packets.
MITRE reports:
Integer overflow in the gs_heap_alloc_bytes function in base/gsmalloc.c in Ghostscript 9.15 and earlier allows remote attackers to cause a denial of service (crash) via a crafted Postscript (ps) file, as demonstrated by using the ps2pdf command, which triggers an out-of-bounds read or write.
NVD reports:
The msrle_decode_pal4 function in msrledec.c in Libav before 10.7 and 11.x before 11.4 and FFmpeg before 2.0.7, 2.2.x before 2.2.15, 2.4.x before 2.4.8, 2.5.x before 2.5.6, and 2.6.x before 2.6.2 allows remote attackers to have unspecified impact via a crafted image, related to a pixel pointer, which triggers an out-of-bounds array access.
NVD reports:
Use-after-free vulnerability in the ff_h264_free_tables function in libavcodec/h264.c in FFmpeg before 2.3.6 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted H.264 data in an MP4 file, as demonstrated by an HTML VIDEO element that references H.264 data.
Joshua Rogers reports:
A format string vulnerability has been found in `graphviz'.
The Mozilla Project reports:
MFSA 2015-95 Add-on notification bypass through data URLs
MFSA 2015-94 Use-after-free when resizing canvas element during restyling
Jason Buberel, Go Product Manager, reports:
CVE-2015-5739 - "Content Length" treated as valid header
CVE-2015-5740 - Double content-length headers does not return 400 error
CVE-2015-5741 - Additional hardening, not sending Content-Length w/Transfer-Encoding, Closing connections
The Mozilla Project reports:
Security researcher regenrecht reported via TippingPoint's Zero Day Initiative the possibility of memory corruption during the decoding of Ogg Vorbis files. This can cause a crash during decoding and has the potential for remote code execution.
The RedHat Project reports:
Will Drewry of the Google Security Team reported multiple issues in OGG Vorbis and Tremor libraries, that could cause application using those libraries to crash (NULL pointer dereference or divide by zero), enter an infinite loop or cause heap overflow caused by integer overflow.
Guanxing Wen reports:
PCRE library is prone to a vulnerability which leads to Heap Overflow. During the compilation of a malformed regular expression, more data is written on the malloced block than the expected size output by compile_regex(). The Heap Overflow vulnerability is caused by the following regular expression.
/(?J:(?|(:(?|(?'R')(\z(?|(?'R')(\k'R')|((?'R')))k'R')|((?'R')))H'Ak'Rf)|s(?'R')))/
A dry run of this particular regular expression with pcretest will reports "double free or corruption (!prev)". But it is actually a heap overflow problem. The overflow only affects pcre 8.x branch, pcre2 branch is not affected.
Drupal development team reports:
This security advisory fixes multiple vulnerabilities. See below for a list.
Cross-site Scripting - Ajax system - Drupal 7
A vulnerability was found that allows a malicious user to perform a cross-site scripting attack by invoking Drupal.ajax() on a whitelisted HTML element.
This vulnerability is mitigated on sites that do not allow untrusted users to enter HTML.
Cross-site Scripting - Autocomplete system - Drupal 6 and 7
A cross-site scripting vulnerability was found in the autocomplete functionality of forms. The requested URL is not sufficiently sanitized.
This vulnerability is mitigated by the fact that the malicious user must be allowed to upload files.
SQL Injection - Database API - Drupal 7
A vulnerability was found in the SQL comment filtering system which could allow a user with elevated permissions to inject malicious code in SQL comments.
This vulnerability is mitigated by the fact that only one contributed module that the security team found uses the comment filtering system in a way that would trigger the vulnerability. That module requires you to have a very high level of access in order to perform the attack.
Cross-site Request Forgery - Form API - Drupal 6 and 7
A vulnerability was discovered in Drupal's form API that could allow file upload value callbacks to run with untrusted input, due to form token validation not being performed early enough. This vulnerability could allow a malicious user to upload files to the site under another user's account.
This vulnerability is mitigated by the fact that the uploaded files would be temporary, and Drupal normally deletes temporary files automatically after 6 hours.
Information Disclosure in Menu Links - Access system - Drupal 6 and 7
Users without the "access content" permission can see the titles of nodes that they do not have access to, if the nodes are added to a menu on the site that the users have access to.
Fixed a privilege separation weakness related to PAM support. Attackers who could successfully compromise the pre-authentication process for remote code execution and who had valid credentials on the host could impersonate other users.
Fixed a use-after-free bug related to PAM support that was reachable by attackers who could compromise the pre-authentication process for remote code execution.
OpenSSH 7.0 contained a logic error in PermitRootLogin= prohibit-password/without-password that could, depending on compile-time configuration, permit password authentication to root while preventing other forms of authentication. This problem was reported by Mantas Mikulenas.
Colin Percival reports:
1. SECURITY FIX: When constructing paths of objects being archived, a buffer could overflow by one byte upon encountering 1024, 2048, 4096, etc. byte paths. Theoretically this could be exploited by an unprivileged user whose files are being archived; I do not believe it is exploitable in practice, but I am offering a $1000 bounty for the first person who can prove me wrong: http://www.daemonology.net/blog/2015-08-21-tarsnap-1000-exploit-bounty.html
2. SECURITY FIX: An attacker with a machine's write keys, or with read keys and control of the tarsnap service, could make tarsnap allocate a large amount of memory upon listing archives or reading an archive the attacker created; on 32-bit machines, tarsnap can be caused to crash under the aforementioned conditions.
oCERT reports:
The stable VLC version suffers from an arbitrary pointer dereference vulnerability.
The vulnerability affects the 3GP file format parser, insufficient restrictions on a writable buffer can be exploited to execute arbitrary code via the heap memory. A specific 3GP file can be crafted to trigger the vulnerability.
Credit: vulnerability reported by Loren Maggiore of Trail of Bits.
Pengsu Cheng reports:
An use-after-free issue in Decoder.cpp was reported to upstream. The problem is due to lack of validation of ColorTableSize.
Gustavo Grieco reports:
We found a heap overflow and a DoS in the gdk-pixbuf implementation triggered by the scaling of a malformed bmp.
Tim Graham reports:
Denial-of-service possibility in logout() view by filling session store
Previously, a session could be created when anonymously accessing the django.contrib.auth.views.logout view (provided it wasn't decorated with django.contrib.auth.decorators.login_required as done in the admin). This could allow an attacker to easily create many new session records by sending repeated requests, potentially filling up the session store or causing other users' session records to be evicted.
The django.contrib.sessions.middleware.SessionMiddleware has been modified to no longer create empty session records.
This portion of the fix has been assigned CVE-2015-5963.
Additionally, on the 1.4 and 1.7 series only, the contrib.sessions.backends.base.SessionBase.flush() and cache_db.SessionStore.flush() methods have been modified to avoid creating a new empty session. Maintainers of third-party session backends should check if the same vulnerability is present in their backend and correct it if so.
This portion of the fix has been assigned CVE-2015-5964. Anyone reporting a similar vulnerability in a third-party session backend should not use this CVE ID.
Thanks Lin Hua Cheng for reporting the issue.
Unreal reports:
Summary: If SASL support is enabled in UnrealIRCd (this is not the default) and is also enabled in your services package then a malicious user with a services account can cause UnrealIRCd to crash.
Martin Prpic reports:
A double free flaw was found in the way JasPer's jasper_image_stop_load() function parsed certain JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash.
Feist Josselin reports:
A new use-after-free was found in Jasper JPEG-200. The use-after-free appears in the function mif_process_cmpt of the src/libjasper/mif/mif_cod.c file.
Stefan Cornelius reports:
There's an integer overflow in the allocate_cells() function when trying to allocate the memory for worksheet with specially crafted row/column dimensions. This can be exploited to cause a heap memory corruption. The most likely outcome of this is a crash when trying to initialize the cells later in the function.
Jodie Cunningham reports:
#1: A flaw was found in the way FreeXL reads sectors from the input file. A specially crafted file could possibly result in stack corruption near freexl.c:3752.
#2: A flaw was found in the function allocate_cells(). A specially crafted file with invalid workbook dimensions could possibly result in stack corruption near freexl.c:1074
#3: A flaw was found in the way FreeXL handles a premature EOF. A specially crafted input file could possibly result in stack corruption near freexl.c:1131
#4: FreeXL 1.0.0g did not properly check requests for workbook memory allocation. A specially crafted input file could cause a Denial of Service, or possibly write onto the stack.
NIST reports:
Apache Tomcat Connectors (mod_jk) before 1.2.41 ignores JkUnmount rules for subtrees of previous JkMount rules, which allows remote attackers to access otherwise restricted artifacts via unspecified vectors.
The Xen Project reports:
The QEMU model of the RTL8139 network card did not sufficiently validate inputs in the C+ mode offload emulation. This results in uninitialised memory from the QEMU process's heap being leaked to the domain as well as to the network.
A guest may be able to read sensitive host-level data relating to itself which resides in the QEMU process.
Such information may include things such as information relating to real devices backing emulated devices or passwords which the host administrator does not intend to share with the guest admin.
The Xen Project reports:
When unplugging an emulated block device the device was not fully unplugged, meaning a second unplug attempt would attempt to unplug the device a second time using a previously freed pointer.
An HVM guest which has access to an emulated IDE disk device may be able to exploit this vulnerability in order to take over the qemu process elevating its privilege to that of the qemu process.
The PHP project reports:
Core:
- Fixed bug #69793 (Remotely triggerable stack exhaustion via recursive method calls).
- Fixed bug #70121 (unserialize() could lead to unexpected methods execution / NULL pointer deref).
OpenSSL:
- Fixed bug #70014 (openssl_random_pseudo_bytes() is not cryptographically secure).
Phar:
- Improved fix for bug #69441.
- Fixed bug #70019 (Files extracted from archive may be placed outside of destination directory).
SOAP:
- Fixed bug #70081 (SoapClient info leak / null pointer dereference via multiple type confusions).
SPL:
- Fixed bug #70068 (Dangling pointer in the unserialization of ArrayObject items).
- Fixed bug #70166 (Use After Free Vulnerability in unserialize() with SPLArrayObject).
- Fixed bug #70168 (Use After Free Vulnerability in unserialize() with SplObjectStorage).
- Fixed bug #70169 (Use After Free Vulnerability in unserialize() with SplDoublyLinkedList).
MediaWiki reports:
Internal review discovered that Special:DeletedContributions did not properly protect the IP of autoblocked users. This fix makes the functionality of Special:DeletedContributions consistent with Special:Contributions and Special:BlockList.
Internal review discovered that watchlist anti-csrf tokens were not being compared in constant time, which could allow various timing attacks. This could allow an attacker to modify a user's watchlist via csrf
John Menerick reported that MediaWiki's thumb.php failed to sanitize various error messages, resulting in xss.
Jouni Malinen reports:
The EAP-PWD module performed insufficient validation on packets received from an EAP peer. This module is not enabled in the default configuration. Administrators must manually enable it for their server to be vulnerable. Only versions 3.0 up to 3.0.8 are affected.
gnutls.org reports:
Kurt Roeckx reported that decoding a specific certificate with very long DistinguishedName (DN) entries leads to double free, which may result to a denial of service. Since the DN decoding occurs in almost all applications using certificates it is recommended to upgrade the latest GnuTLS version fixing the issue. Recommendation: Upgrade to GnuTLS 3.4.4, or 3.3.17.
Karthikeyan Bhargavan reports:
GnuTLS does not by default support MD5 signatures. Indeed the RSA-MD5 signature-hash algorithm needs to be explicitly enabled using the priority option VERIFY_ALLOW_SIGN_RSA_MD5. In the NORMAL and SECURE profiles, GnuTLS clients do not offer RSA-MD5 in the signature algorithms extension. However, we find that all GnuTLS clients still accept RSA-MD5 in the ServerKeyExchange and GnuTLS servers still accept RSA-MD5 in the ClientCertificateVerify.
oss-security-list@demlak.de reports:
An unauthenticated remote attacker is able to get the database password via webaccess due to wrong file permissions of the /logs/ folder in froxlor version 0.9.33.1 and earlier. The plain SQL password and username may be stored in the /logs/sql-error.log file. This directory is publicly reachable under the default configuration/setup.
Note that froxlor 0.9.33.2 prevents future logging of passwords but does not retroactively remove passwords already logged. Michael Kaufmann, the Froxlor lead developer reports:
Removing all .log files from the directory should do the job, alternatively just use the class.ConfigIO.php from Github
Best Practical reports:
RT 4.0.0 and above are vulnerable to a cross-site scripting (XSS) attack via the user and group rights management pages. This vulnerability is assigned CVE-2015-5475. It was discovered and reported by Marcin Kopec at Data Reliance Shared Service Center.
RT 4.2.0 and above are vulnerable to a cross-site scripting (XSS) attack via the cryptography interface. This vulnerability could allow an attacker with a carefully-crafted key to inject JavaScript into RT's user interface. Installations which use neither GnuPG nor S/MIME are unaffected.
Brian Warner reports:
The "flappserver" feature was found to have a vulnerability in the service-lookup code which, when combined with an attacker who has the ability to write files to a location where the flappserver process could read them, would allow that attacker to obtain control of the flappserver process.
The Mozilla Project reports:
Using the Address Sanitizer tool, security researcher Abhishek Arya (Inferno) of the Google Chrome Security Team found an out-of-bounds write when buffering WebM format video containing frames with invalid tile sizes. This can lead to a potentially exploitable crash during WebM video playback.
Adobe reports:
Adobe has released security updates for Adobe Flash Player. These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system.
These updates resolve type confusion vulnerabilities that could lead to code execution (CVE-2015-5128, CVE-2015-5554, CVE-2015-5555, CVE-2015-5558, CVE-2015-5562).
These updates include further hardening to a mitigation introduced in version 18.0.0.209 to defend against vector length corruptions (CVE-2015-5125).
These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2015-5550, CVE-2015-5551, CVE-2015-3107, CVE-2015-5556, CVE-2015-5130, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5557, CVE-2015-5559, CVE-2015-5127, CVE-2015-5563, CVE-2015-5561, CVE-2015-5124, CVE-2015-5564).
These updates resolve heap buffer overflow vulnerabilities that could lead to code execution (CVE-2015-5129, CVE-2015-5541).
These updates resolve buffer overflow vulnerabilities that could lead to code execution (CVE-2015-5131, CVE-2015-5132, CVE-2015-5133).
These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2015-5544, CVE-2015-5545, CVE-2015-5546, CVE-2015-5547, CVE-2015-5548, CVE-2015-5549, CVE-2015-5552, CVE-2015-5553).
These updates resolve an integer overflow vulnerability that could lead to code execution (CVE-2015-5560).
The Mozilla Project reports:
Security researcher Abhishek Arya (Inferno) of the Google Chrome Security Team used the Address Sanitizer tool to discover two buffer overflow issues in the Libvpx library used for WebM video when decoding a malformed WebM video file. These buffer overflows result in potentially exploitable crashes.
The Mozilla Project reports:
MFSA 2015-79 Miscellaneous memory safety hazards (rv:40.0 / rv:38.2)
MFSA 2015-80 Out-of-bounds read with malformed MP3 file
MFSA 2015-81 Use-after-free in MediaStream playback
MFSA 2015-82 Redefinition of non-configurable JavaScript object properties
MFSA 2015-83 Overflow issues in libstagefright
MFSA 2015-84 Arbitrary file overwriting through Mozilla Maintenance Service with hard links
MFSA 2015-85 Out-of-bounds write with Updater and malicious MAR file
MFSA 2015-86 Feed protocol with POST bypasses mixed content protections
MFSA 2015-87 Crash when using shared memory in JavaScript
MFSA 2015-88 Heap overflow in gdk-pixbuf when scaling bitmap images
MFSA 2015-90 Vulnerabilities found through code inspection
MFSA 2015-91 Mozilla Content Security Policy allows for asterisk wildcards in violation of CSP specification
MFSA 2015-92 Use-after-free in XMLHttpRequest with shared workers
MITRE reports:
mod_auth in lighttpd before 1.4.36 allows remote attackers to inject arbitrary log entries via a basic HTTP authentication string without a colon character, as demonstrated by a string containing a NULL and new line character.
Venustech ADLAB reports:
PCRE library is prone to a vulnerability which leads to Heap Overflow. During the compilation of a malformed regular expression, more data is written on the malloced block than the expected size output by compile_regex. Exploits with advanced Heap Fengshui techniques may allow an attacker to execute arbitrary code in the context of the user running the affected application.
Latest version of PCRE is prone to a Heap Overflow vulnerability which could caused by the following regular expression.
/(?J:(?|(:(?|(?'R')(\k'R')|((?'R')))H'Rk'Rf)|s(?'R'))))/
The Mozilla Project reports:
MFSA 2015-78 Same origin violation and local file stealing via PDF reader
Gary Pendergast reports:
WordPress 4.2.4 fixes three cross-site scripting vulnerabilities and a potential SQL injection that could be used to compromise a site.
Subversion reports:
CVE-2015-3184:
Subversion's mod_authz_svn does not properly restrict anonymous access in some mixed anonymous/authenticated environments when using Apache httpd 2.4.CVE-2015-3187:
Subversion servers, both httpd and svnserve, will reveal some paths that should be hidden by path-based authz.
Elastic reports:
Vulnerability Summary: Elasticsearch versions from 1.0.0 to 1.6.0 are vulnerable to a directory traversal attack.
Remediation Summary: Users should upgrade to 1.6.1 or later, or constrain access to the snapshot API to trusted sources.
Elastic reports:
Vulnerability Summary: Elasticsearch versions prior to 1.6.1 are vulnerable to an attack that can result in remote code execution.
Remediation Summary: Users should upgrade to 1.6.1 or 1.7.0. Alternately, ensure that only trusted applications have access to the transport protocol port.
The Xen Project reports:
A heap overflow flaw was found in the way QEMU's IDE subsystem handled I/O buffer access while processing certain ATAPI commands.
A privileged guest user in a guest with CDROM drive enabled could potentially use this flaw to execute arbitrary code on the host with the privileges of the host's QEMU process corresponding to the guest.
Murray McAllister reports:
A remote denial-of-service flaw was found in the way snmptrapd handled certain SNMP traps when started with the "-OQ" option. If an attacker sent an SNMP trap containing a variable with a NULL type where an integer variable type was expected, it would cause snmptrapd to crash.
Qinghao Tang reports:
Incompletely initialized vulnerability exists in the function ‘snmp_pdu_parse()’ of ‘snmp_api.c', and remote attackers can cause memory leak, DOS and possible command executions by sending malicious packets.
ISC reports:
An error in the handling of TKEY queries can be exploited by an attacker for use as a denial-of-service vector, as a constructed packet can use the defect to trigger a REQUIRE assertion failure, causing BIND to exit.
It was discovered that the OpenSSH sshd daemon did not check the list of keyboard-interactive authentication methods for duplicates. A remote attacker could use this flaw to bypass the MaxAuthTries limit, making it easier to perform password guessing attacks.
Elastic reports:
Vulnerability Summary: All Logstash versions prior to 1.5.2 that use Lumberjack input (in combination with Logstash Forwarder agent) are vulnerable to a SSL/TLS security issue called the FREAK attack. This allows an attacker to intercept communication and access secure data. Users should upgrade to 1.5.3 or 1.4.4.
Remediation Summary: Users that do not want to upgrade can address the vulnerability by disabling the Lumberjack input.
Google Chrome Releases reports:
43 security fixes in this release, including:
- [446032] High CVE-2015-1271: Heap-buffer-overflow in pdfium. Credit to cloudfuzzer.
- [459215] High CVE-2015-1273: Heap-buffer-overflow in pdfium. Credit to makosoft.
- [461858] High CVE-2015-1274: Settings allowed executable files to run immediately after download. Credit to andrewm.bpi.
- [462843] High CVE-2015-1275: UXSS in Chrome for Android. Credit to WangTao(neobyte) of Baidu X-Team.
- [472614] High CVE-2015-1276: Use-after-free in IndexedDB. Credit to Collin Payne.
- [483981] High CVE-2015-1279: Heap-buffer-overflow in pdfium. Credit to mlafon.
- [486947] High CVE-2015-1280: Memory corruption in skia. Credit to cloudfuzzer.
- [487155] High CVE-2015-1281: CSP bypass. Credit to Masato Kinugawa.
- [487928] High CVE-2015-1282: Use-after-free in pdfium. Credit to Chamal de Silva.
- [492052] High CVE-2015-1283: Heap-buffer-overflow in expat. Credit to sidhpurwala.huzaifa.
- [493243] High CVE-2015-1284: Use-after-free in blink. Credit to Atte Kettunen of OUSPG.
- [504011] High CVE-2015-1286: UXSS in blink. Credit to anonymous.
- [505374] High CVE-2015-1290: Memory corruption in V8. Credit to Yongjun Liu of NSFOCUS Security Team.
- [419383] Medium CVE-2015-1287: SOP bypass with CSS. Credit to filedescriptor.
- [444573] Medium CVE-2015-1270: Uninitialized memory read in ICU. Credit to Atte Kettunen of OUSPG.
- [451456] Medium CVE-2015-1272: Use-after-free related to unexpected GPU process termination. Credit to Chamal de Silva.
- [479743] Medium CVE-2015-1277: Use-after-free in accessibility. Credit to SkyLined.
- [482380] Medium CVE-2015-1278: URL spoofing using pdf files. Credit to Chamal de Silva.
- [498982] Medium CVE-2015-1285: Information leak in XSS auditor. Credit to gazheyes.
- [479162] Low CVE-2015-1288: Spell checking dictionaries fetched over HTTP. Credit to mike@michaelruddy.com.
- [512110] CVE-2015-1289: Various fixes from internal audits, fuzzing and other initiatives.
Shibboleth consortium reports:
Shibboleth SP software crashes on well-formed but invalid XML.
The Service Provider software contains a code path with an uncaught exception that can be triggered by an unauthenticated attacker by supplying well-formed but schema-invalid XML in the form of SAML metadata or SAML protocol messages. The result is a crash and so causes a denial of service.
You must rebuild opensaml and shibboleth with xmltooling-1.5.5 or later. The easiest way to do so is to update the whole chain including shibboleth-2.5.5 an opensaml2.5.5.
Gary Pendergast reports:
WordPress versions 4.2.2 and earlier are affected by a cross-site scripting vulnerability, which could allow users with the Contributor or Author role to compromise a site. This was reported by Jon Cave and fixed by Robert Chapin, both of the WordPress security team.
Simon Josefsson reports:
stringprep_utf8_to_ucs4 now rejects invalid UTF-8. This function has always been documented to not validate that the input UTF-8 string is actually valid UTF-8...
Michele Spagnuolo, Google Security Team, reports:
The write heap buffer overflows are related to ADPCM handling in WAV files, while the read heap buffer overflow is while opening a .VOC.
oCERT reports:
The sox command line tool is affected by two heap-based buffer overflows, respectively located in functions start_read() and AdpcmReadBlock().
A specially crafted wav file can be used to trigger the vulnerabilities.
gustavo.grieco@imag.fr reports:
We found a heap overflow and a DoS in the gdk-pixbuf implementation triggered by the scaling of a malformed bmp.
Venustech ADLAB reports:
PCRE library is prone to a vulnerability which leads to Heap Overflow. During subpattern calculation of a malformed regular expression, an offset that is used as an array index is fully controlled and can be large enough so that unexpected heap memory regions are accessed.
One could at least exploit this issue to read objects nearby of the affected application's memory.
Such information disclosure may also be used to bypass memory protection method such as ASLR.
The Cacti Group, Inc. reports:
Important Security Fixes
- Multiple XSS and SQL injection vulnerabilities
- CVE-2015-4634 - SQL injection in graphs.php
Changelog
- bug: Fixed various SQL Injection vectors
- bug#0002574: SQL Injection Vulnerabilities in graph items and graph template items
- bug#0002577: CVE-2015-4634 - SQL injection in graphs.php
- bug#0002579: SQL Injection Vulnerabilities in data sources
- bug#0002580: SQL Injection in cdef.php
- bug#0002582: SQL Injection in data_templates.php
- bug#0002583: SQL Injection in graph_templates.php
- bug#0002584: SQL Injection in host_templates.php
reports:
Segfault in Phar::convertToData on invalid file.
Buffer overflow and stack smashing error in phar_fix_filepath.
Marina Glancy reports:
MSA-15-0026: Possible phishing when redirecting to external site using referer header. (CVE-2015-3272)
MSA-15-0027: Capability 'mod/forum:canposttomygroups' is not respected when using 'Post a copy to all groups' in forum (CVE-2015-3273)
MSA-15-0028: Possible XSS through custom text profile fields in Web Services (CVE-2015-3274)
MSA-15-0029: Javascript injection in SCORM module (CVE-2015-3275)
Apache Foundation reports:
CVE-2015-3183 core: Fix chunk header parsing defect. Remove apr_brigade_flatten(), buffering and duplicated code from the HTTP_IN filter, parse chunks in a single pass with zero copy. Limit accepted chunk-size to 2^63-1 and be strict about chunk-ext authorized characters.
zenphoto reports:
Fixes several SQL Injection, XSS and path traversal security issues
Cédric Champeau reports:
Description
When an application has Groovy on the classpath and that it uses standard Java serialization mechanim to communicate between servers, or to store local data, it is possible for an attacker to bake a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects are subject to this vulnerability.
Agostino Sarubbo reports:
libav: divide-by-zero in ff_h263_decode_mba()
The Mozilla Project reports:
MFSA 2015-59 Miscellaneous memory safety hazards (rv:39.0 / rv:31.8 / rv:38.1)
MFSA 2015-60 Local files or privileged URLs in pages can be opened into new tabs
MFSA 2015-61 Type confusion in Indexed Database Manager
MFSA 2015-62 Out-of-bound read while computing an oscillator rendering range in Web Audio
MFSA 2015-63 Use-after-free in Content Policy due to microtask execution error
MFSA 2015-64 ECDSA signature validation fails to handle some signatures correctly
MFSA 2015-65 Use-after-free in workers while using XMLHttpRequest
MFSA 2015-66 Vulnerabilities found through code inspection
MFSA 2015-67 Key pinning is ignored when overridable errors are encountered
MFSA 2015-68 OS X crash reports may contain entered key press information
MFSA 2015-69 Privilege escalation through internal workers
MFSA 2015-70 NSS accepts export-length DHE keys with regular DHE cipher suites
MFSA 2015-71 NSS incorrectly permits skipping of ServerKeyExchange
Paul Bakker reports:
PolarSSL 1.2.14 fixes one remotely-triggerable issues that was found by the Codenomicon Defensics tool, one potential remote crash and countermeasures against the "Lucky 13 strikes back" cache-based attack.
Mitre reports:
Multiple buffer overflows in the gd graphics library (libgd) 2.0.21 and earlier may allow remote attackers to execute arbitrary code via malformed image files that trigger the overflows due to improper calls to the gdMalloc function, a different set of vulnerabilities than CVE-2004-0990.
Buffer overflow in the gdImageStringFTEx function in gdft.c in GD Graphics Library 2.0.33 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted string with a JIS encoded font.
The gdPngReadData function in libgd 2.0.34 allows user-assisted attackers to cause a denial of service (CPU consumption) via a crafted PNG image with truncated data, which causes an infinite loop in the png_read_info function in libpng.
Integer overflow in gdImageCreateTrueColor function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to have unspecified attack vectors and impact.
The gdImageCreateXbm function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via unspecified vectors involving a gdImageCreate failure.
The (a) imagearc and (b) imagefilledarc functions in GD Graphics Library (libgd) before 2.0.35 allow attackers to cause a denial of service (CPU consumption) via a large (1) start or (2) end angle degree value.
The _gdGetColors function in gd_gd.c in PHP 5.2.11 and 5.3.x before 5.3.1, and the GD Graphics Library 2.x, does not properly verify a certain colorsTotal structure member, which might allow remote attackers to conduct buffer overflow or buffer over-read attacks via a crafted GD file, a different vulnerability than CVE-2009-3293. NOTE: some of these details are obtained from third party information.
Heap-based buffer overflow in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted BMP image.
meta.h in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WMF file.
Use-after-free vulnerability in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) via a crafted WMF file to the (1) wmf2gd or (2) wmf2eps command.
Heap-based buffer overflow in the DecodeImage function in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted "run-length count" in an image in a WMF file.
Jim Jagielski reports:
CVE-2015-3183 (cve.mitre.org) core: Fix chunk header parsing defect. Remove apr_brigade_flatten(), buffering and duplicated code from the HTTP_IN filter, parse chunks in a single pass with zero copy. Limit accepted chunk-size to 2^63-1 and be strict about chunk-ext authorized characters.
CVE-2015-3185 (cve.mitre.org) Replacement of ap_some_auth_required (unusable in Apache httpd 2.4) with new ap_some_authn_required and ap_force_authn hook.
CVE-2015-0253 (cve.mitre.org) core: Fix a crash with ErrorDocument 400 pointing to a local URL-path with the INCLUDES filter active, introduced in 2.4.11. PR 57531.
CVE-2015-0228 (cve.mitre.org) mod_lua: A maliciously crafted websockets PING after a script calls r:wsupgrade() can cause a child process crash.
Adobe reports:
Critical vulnerabilities (CVE-2015-5122, CVE-2015-5123) have been identified. Successful exploitation could cause a crash and potentially allow an attacker to take control of the affected system. Adobe is aware of reports that exploits targeting these vulnerabilities have been published publicly.
Symeon Paraschoudis reports:
Use-after-free vulnerability in sqlite3SafetyCheckSickOrOk()
Symeon Paraschoudis reports:
Use-after-free vulnerability in spl_recursive_it_move_forward_ex()
cmb reports:
When delayed variable substitution is enabled (can be set in the Registry, for instance), !ENV! works similar to %ENV%, and the value of the environment variable ENV will be subsituted.
Duo Security reports:
Researchers have identified a serious vulnerability in some versions of Oracle’s MySQL database product that allows an attacker to strip SSL/TLS connections of their security wrapping transparently.
Kyle Kelley reports:
Summary: POST requests exposed via the IPython REST API are vulnerable to cross-site request forgery (CSRF). Web pages on different domains can make non-AJAX POST requests to known IPython URLs, and IPython will honor them. The user's browser will automatically send IPython cookies along with the requests. The response is blocked by the Same-Origin Policy, but the request isn't.
API paths with issues:
- POST /api/contents/<path>/<file>
- POST /api/contents/<path>/<file>/checkpoints
- POST /api/contents/<path>/<file>/checkpoints/<checkpoint_id>
- POST /api/kernels
- POST /api/kernels/<kernel_id>/<action>
- POST /api/sessions
- POST /api/clusters/<cluster_id>/<action>
oCERT reports:
The FreeRADIUS server relies on OpenSSL to perform certificate validation, including Certificate Revocation List (CRL) checks. The FreeRADIUS usage of OpenSSL, in CRL application, limits the checks to leaf certificates, therefore not detecting revocation of intermediate CA certificates.
An unexpired client certificate, issued by an intermediate CA with a revoked certificate, is therefore accepted by FreeRADIUS.
Specifically sets the X509_V_FLAG_CRL_CHECK flag for leaf certificate CRL checks, but does not use X509_V_FLAG_CRL_CHECK_ALL for CRL checks on the complete trust chain.
The FreeRADIUS project advises that the recommended configuration is to use self-signed CAs for all EAP-TLS methods.
The Xen Project reports:
The xl command line utility mishandles long configuration values when passed as command line arguments, with a buffer overrun.
A semi-trusted guest administrator or controller, who is intended to be able to partially control the configuration settings for a domain, can escalate their privileges to that of the whole host.
The Xen Project reports:
A buggy loop in Xen's compat_iret() function iterates the wrong way around a 32-bit index. Any 32-bit PV guest kernel can trigger this vulnerability by attempting a hypercall_iret with EFLAGS.VM set.
Given the use of __get/put_user(), and that the virtual addresses in question are contained within the lower canonical half, the guest cannot clobber any hypervisor data. Instead, Xen will take up to 2^33 pagefaults, in sequence, effectively hanging the host.
Malicious guest administrators can cause a denial of service affecting the whole system.
The Xen Project reports:
With the introduction of version 2 grant table operations, a version check became necessary for most grant table related hypercalls. The GNTTABOP_swap_grant_ref call was lacking such a check. As a result, the subsequent code behaved as if version 2 was in use, when a guest issued this hypercall without a prior GNTTABOP_setup_table or GNTTABOP_set_version.
The effect is a possible NULL pointer dereferences. However, this cannot be exploited to elevate privileges of the attacking domain, as the maximum memory address that can be wrongly accessed this way is bounded to far below the start of hypervisor memory.
Malicious or buggy guest domain kernels can mount a denial of service attack which, if successful, can affect the whole system.
The Xen Project reports:
The handler for XEN_DOMCTL_gettscinfo failed to initialize a padding field subsequently copied to guest memory.
A similar leak existed in XEN_SYSCTL_getdomaininfolist, which is being addressed here regardless of that operation being declared unsafe for disaggregation by XSA-77.
Malicious or buggy stub domain kernels or tool stacks otherwise living outside of Domain0 may be able to read sensitive data relating to the hypervisor or other guests not under the control of that domain.
The Xen Project reports:
Qemu allows guests to not only read, but also write all parts of the PCI config space (but not extended config space) of passed through PCI devices not explicitly dealt with for (partial) emulation purposes.
Since the effect depends on the specific purpose of the the config space field, it's not possbile to give a general statement about the exact impact on the host or other guests. Privilege escalation, host crash (Denial of Service), and leaked information all cannot be excluded.
The Xen Project reports:
Device model code dealing with guest PCI MSI-X interrupt management activities logs messages on certain (supposedly) invalid guest operations.
A buggy or malicious guest repeatedly invoking such operations may result in the host disk to fill up, possibly leading to a Denial of Service.
The Xen Project reports:
The mask bits optionally available in the PCI MSI capability structure are used by the hypervisor to occasionally suppress interrupt delivery. Unprivileged guests were, however, nevertheless allowed direct control of these bits.
Interrupts may be observed by Xen at unexpected times, which may lead to a host crash and therefore a Denial of Service.
The Xen Project reports:
Logic is in place to avoid writes to certain host config space fields when the guest must nevertheless be able to access their virtual counterparts. A bug in how this logic deals with accesses spanning multiple fields allows the guest to write to the host MSI message data field.
While generally the writes write back the values previously read, their value in config space may have got changed by the host between the qemu read and write. In such a case host side interrupt handling could become confused, possibly losing interrupts or allowing spurious interrupt injection into other guests.
Certain untrusted guest administrators may be able to confuse host side interrupt handling, leading to a Denial of Service.
The Xen Project reports:
XSA-77 put the majority of the domctl operations on a list excepting them from having security advisories issued for them if any effects their use might have could hamper security. Subsequently some of them got declared disaggregation safe, but for a small subset this was not really correct: Their (mis-)use may result in host lockups.
As a result, the potential security benefits of toolstack disaggregation are not always fully realised.
Domains deliberately given partial management control may be able to deny service to the entire host.
As a result, in a system designed to enhance security by radically disaggregating the management, the security may be reduced. But, the security will be no worse than a non-disaggregated design.
The Xen Project reports:
HVM guests are currently permitted to modify the memory and I/O decode bits in the PCI command register of devices passed through to them. Unless the device is an SR-IOV virtual function, after disabling one or both of these bits subsequent accesses to the MMIO or I/O port ranges would - on PCI Express devices - lead to Unsupported Request responses. The treatment of such errors is platform specific.
Furthermore (at least) devices under control of the Linux pciback driver in the host are handed to guests with the aforementioned bits turned off. This means that such accesses can similarly lead to Unsupported Request responses until these flags are set as needed by the guest.
In the event that the platform surfaces aforementioned UR responses as Non-Maskable Interrupts, and either the OS is configured to treat NMIs as fatal or (e.g. via ACPI's APEI) the platform tells the OS to treat these errors as fatal, the host would crash, leading to a Denial of Service.
The Xen Project reports:
The XEN_DOMCTL_memory_mapping hypercall allows long running operations without implementing preemption.
This hypercall is used by the device model as part of the emulation associated with configuration of PCI devices passed through to HVM guests and is therefore indirectly exposed to those guests.
This can cause a physical CPU to become busy for a significant period, leading to a host denial of service in some cases.
If a host denial of service is not triggered then it may instead be possible to deny service to the domain running the device model, e.g. domain 0.
This hypercall is also exposed more generally to all toolstacks. However the uses of it in libxl based toolstacks are not believed to open up any avenue of attack from an untrusted guest. Other toolstacks may be vulnerable however.
The vulnerability is exposed via HVM guests which have a PCI device assigned to them. A malicious HVM guest in such a configuration can mount a denial of service attack affecting the whole system via its associated device model (qemu-dm).
A guest is able to trigger this hypercall via operations which it is legitimately expected to perform, therefore running the device model as a stub domain does not offer protection against the host denial of service issue. However it does offer some protection against secondary issues such as denial of service against dom0.
The Xen Project reports:
Instructions with register operands ignore eventual segment overrides encoded for them. Due to an insufficiently conditional assignment such a bogus segment override can, however, corrupt a pointer used subsequently to store the result of the instruction.
A malicious guest might be able to read sensitive data relating to other guests, or to cause denial of service on the host. Arbitrary code execution, and therefore privilege escalation, cannot be excluded.
The Xen Project reports:
The code handling certain sub-operations of the HYPERVISOR_xen_version hypercall fails to fully initialize all fields of structures subsequently copied back to guest memory. Due to this hypervisor stack contents are copied into the destination of the operation, thus becoming visible to the guest.
A malicious guest might be able to read sensitive data relating to other guests.
The Xen Project reports:
Emulation routines in the hypervisor dealing with certain system devices check whether the access size by the guest is a supported one. When the access size is unsupported these routines failed to set the data to be returned to the guest for read accesses, so that hypervisor stack contents are copied into the destination of the operation, thus becoming visible to the guest.
A malicious HVM guest might be able to read sensitive data relating to other guests.
The Xen Project reports:
When instantiating an emulated VGA device for an x86 HVM guest qemu will by default enable a backend to expose that device, either SDL or VNC depending on the version of qemu and the build time configuration.
The libxl toolstack library does not explicitly disable these default backends when they are not enabled, leading to an unexpected backend running.
If either SDL or VNC is explicitly enabled in the guest configuration then only the expected backends will be enabled.
This affects qemu-xen and qemu-xen-traditional differently.
If qemu-xen was compiled with SDL support then this would result in an SDL window being opened if $DISPLAY is valid, or a failure to start the guest if not.
If qemu-xen was compiled without SDL support then qemu would instead start a VNC server listening on ::1 (IPv6 localhost) or 127.0.0.1 (IPv4 localhost) with IPv6 preferred if available. A VNC password will not be configured even if one is present in the guest configuration.
qemu-xen-traditional will never start a vnc backend unless explicitly configured. However by default it will start an SDL backend if it was built with SDL support and $DISPLAY is valid.
The Xen Project reports:
On ARM systems the code which deals with virtualising the GIC distributor would, under various circumstances, log messages on a guest accessible code path without appropriate rate limiting.
A malicious guest could cause repeated logging to the hypervisor console, leading to a Denial of Service attack.
The Xen Project reports:
When decoding a guest write to a specific register in the virtual interrupt controller Xen would treat an invalid value as a critical error and crash the host.
By writing an invalid value to the GICD.SGIR register a guest can crash the host, resulting in a Denial of Service attack.
Pivotx reports:
Multiple unrestricted file upload vulnerabilities in fileupload.php in PivotX before 2.3.9 allow remote authenticated users to execute arbitrary PHP code by uploading a file with a (1) .php or (2) .php# extension, and then accessing it via unspecified vectors.
pivotx reports:
cross-site scripting (XSS) vulnerability in the nickname (and possibly the email) field. Mitigated by the fact that an attacker must have a PivotX account.
Jouni Malinen reports:
Incomplete WPS and P2P NFC NDEF record payload length validation. (2015-5)
OpenSSL reports:
During certificate verification, OpenSSL (starting from version 1.0.1n and 1.0.2b) will attempt to find an alternative certificate chain if the first attempt to build such a chain fails. An error in the implementation of this logic can mean that an attacker could cause certain checks on untrusted certificates to be bypassed, such as the CA flag, enabling them to use a valid leaf certificate to act as a CA and "issue" an invalid certificate.
Tim Graham reports:
In accordance with our security release policy, the Django team is issuing multiple releases -- Django 1.4.21, 1.7.9, and 1.8.3. These releases are now available on PyPI and our download page. These releases address several security issues detailed below. We encourage all users of Django to upgrade as soon as possible. The Django master branch has also been updated.
Adobe reports:
Adobe has released security updates for Adobe Flash Player. These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe is aware of a report that an exploit targeting CVE-2015-5119 has been publicly published.
ISC reports:
A very uncommon combination of zone data has been found that triggers a bug in BIND, with the result that named will exit with a "REQUIRE" failure in name.c when validating the data returned in answer to a recursive query.
A recursive resolver that is performing DNSSEC validation can be deliberately terminated by any attacker who can cause a query to be performed against a maliciously constructed zone. This will result in a denial of service to clients who rely on that resolver.
HAProxy reports:
A vulnerability was found when HTTP pipelining is used. In some cases, a client might be able to cause a buffer alignment issue and retrieve uninitialized memory contents that exhibit data from a past request or session. I want to address sincere congratulations to Charlie Smurthwaite of aTech Media for the really detailed traces he provided which made it possible to find the cause of this bug. Every user of 1.5-dev, 1.5.x or 1.6-dev must upgrade to 1.5.14 or latest 1.6-dev snapshot to fix this issue, or use the backport of the fix provided by their operating system vendors. CVE-2015-3281 was assigned to this bug.
Roundcube reports:
We just published updates to both stable versions 1.0 and 1.1 after fixing many minor bugs and adding some security improvements to the 1.1 release branch. Version 1.0.6 comes with cherry-picked fixes from the more recent version to ensure proper long term support especially in regards of security and compatibility.
The security-related fixes in particular are:
* XSS vulnerability in _mbox argument
* security improvement in contact photo handling
* potential info disclosure from temp directory
Oleg Moskalenko reports:
SQL injection security hole fixed.
Squid security advisory 2015:2 reports:
Squid configured with cache_peer and operating on explicit proxy traffic does not correctly handle CONNECT method peer responses.
The bug is important because it allows remote clients to bypass security in an explicit gateway proxy.
However, the bug is exploitable only if you have configured cache_peer to receive CONNECT requests.
Squid security advisory 2015:1 reports:
Squid configured with client-first SSL-bump does not correctly validate X509 server certificate domain / hostname fields.
The bug is important because it allows remote servers to bypass client certificate validation. Some attackers may also be able to use valid certificates for one domain signed by a global Certificate Authority to abuse an unrelated domain.
However, the bug is exploitable only if you have configured Squid to perform SSL Bumping with the "client-first" or "bump" mode of operation.
Sites that do not use SSL-Bump are not vulnerable.
All Squid built without SSL support are not vulnerable to the problem.
The FreeBSD port does not use SSL by default and is not vulnerable in the default configuration.
Ansible, Inc. reports:
Ensure that hostnames match certificate names when using HTTPS - resolved in Ansible 1.9.2
Improper symlink handling in zone, jail, and chroot connection plugins could lead to escape from confined environment - resolved in Ansible 1.9.2
Ansible, Inc. reports:
Arbitrary execution from data from compromised remote hosts or local data when using a legacy Ansible syntax - resolved in Ansible 1.7
ansible-galaxy command when used on local tarballs (and not galaxy.ansible.com) can install a malformed tarball if so provided - resolved in Ansible 1.7
Ansible, Inc. reports:
Arbitrary execution from data from compromised remote hosts or untrusted local data - resolved in Ansible 1.6.7
Ansible, Inc. reports:
Incomplete Fix Remote Code Execution Vulnerability - Fixed in Ansible 1.6.4
MITRE reports:
runner/connection_plugins/ssh.py in Ansible before 1.2.3, when using ControlPersist, allows local users to redirect a ssh session via a symlink attack on a socket file with a predictable name in /tmp/.
lib/ansible/playbook/__init__.py in Ansible 1.2.x before 1.2.3, when playbook does not run due to an error, allows local users to overwrite arbitrary files via a symlink attack on a retry file with a predictable name in /var/tmp/ansible/.
Ansible changelog reports:
Host key checking is on by default. Disable it if you like by adding host_key_checking=False in the [default] section of /etc/ansible/ansible.cfg or ~/ansible.cfg or by exporting ANSIBLE_HOST_KEY_CHECKING=False.
Gregory Maxwell reports:
On July 7th I will be making public details of several serious denial of service vulnerabilities which have fixed in recent versions of Bitcoin Core, including including CVE-2015-3641. I strongly recommend anyone running production nodes exposed to inbound connections from the internet upgrade to 0.10.2 as soon as possible.
node reports:
This release of Node.js fixes a bug that triggers an out-of-band write in V8's utf-8 decoder. This bug impacts all Buffer to String conversions. This is an important security update as this bug can be used to cause a denial of service attack.
Stefan Cornelius from Red Hat reports:
An integer overflow flaw leading to a heap-based buffer overflow was discovered in the way the texttopdf utility of cups-filter processed print jobs with a specially crafted line size. An attacker being able to submit print jobs could exploit this flaw to crash texttopdf or, possibly, execute arbitrary code with the privileges of the 'lp' user.
Tim Waugh reports:
The Page allocation is moved into textcommon.c, where it does all the necessary checking: lower-bounds for CVE-2015-3258 and upper-bounds for CVE-2015-3259 due to integer overflows for the calloc() call initialising Page[0] and the memset() call in texttopdf.c's WritePage() function zeroing the entire array.
Daniel Veilland reports:
Enforce the reader to run in constant memory. One of the operation on the reader could resolve entities leading to the classic expansion issue. Make sure the buffer used for xmlreader operation is bounded. Introduce a new allocation type for the buffers for this effect.
Ignacio R. Morelle reports:
As mentioned in the Wesnoth 1.12.4 and Wesnoth 1.13.1 release announcements, a security vulnerability targeting add-on authors was found (bug #23504) which allowed a malicious user to obtain add-on server passphrases from the client's .pbl files and transmit them over the network, or store them in saved game files intended to be shared by the victim. This vulnerability affects all existing releases up to and including versions 1.12.2 and 1.13.0. Additionally, version 1.12.3 included only a partial fix that failed to guard users against attempts to read from .pbl files with an uppercase or mixed-case extension. CVE-2015-5069 and CVE-2015-5070 have been assigned to the vulnerability affecting .pbl files with a lowercase extension, and .pbl files with an uppercase or mixed-case extension, respectively.
Stefan Cornelius from Red Hat reports:
A heap-based buffer overflow was discovered in the way the texttopdf utility of cups-filters processed print jobs with a specially crafted line size. An attacker being able to submit print jobs could exploit this flaw to crash texttopdf or, possibly, execute arbitrary code.
Till Kamppeter reports:
texttopdf: Fixed buffer overflow on size allocation of texttopdf when working with extremely small line sizes, which causes the size calculation to result in 0 (CVE-2015-3258, thanks to Stefan Cornelius from Red Hat for the patch).
ntp.org reports:
Under limited and specific circumstances an attacker can send a crafted packet to cause a vulnerable ntpd instance to crash. This requires each of the following to be true:
- ntpd set up to allow for remote configuration (not allowed by default), and
- knowledge of the configuration password, and
- access to a computer entrusted to perform remote configuration.
The QEMU security team reports:
A guest which has access to an emulated PCNET network device (e.g. with "model=pcnet" in their VIF configuration) can exploit this vulnerability to take over the qemu process elevating its privilege to that of the qemu process.
Elastic reports:
Vulnerability Summary: All Elasticsearch versions from 1.0.0 to 1.5.2 are vulnerable to an attack that uses Elasticsearch to modify files read and executed by certain other applications.
Remediation Summary: Users should upgrade to 1.6.0. Alternately, ensure that other applications are not present on the system, or that Elasticsearch cannot write into areas where these applications would read.
Elastic reports:
Vulnerability Summary: All Elasticsearch versions prior to 1.5.2 and 1.4.5 are vulnerable to a directory traversal attack that allows an attacker to retrieve files from the server running Elasticsearch when one or more site plugins are installed, or when Windows is the server OS.
Remediation Summary: Users should upgrade to 1.4.5 or 1.5.2. Users that do not want to upgrade can address the vulnerability by disabling site plugins. See the CVE description for additional options.
Elastic reports:
Vulnerability Summary: Elasticsearch versions 1.3.0-1.3.7 and 1.4.0-1.4.2 have vulnerabilities in the Groovy scripting engine that were introduced in 1.3.0. The vulnerability allows an attacker to construct Groovy scripts that escape the sandbox and execute shell commands as the user running the Elasticsearch Java VM.
Remediation Summary: Users should upgrade to 1.3.8 or 1.4.3. Users that do not want to upgrade can address the vulnerability by setting script.groovy.sandbox.enabled to false in elasticsearch.yml and restarting the node.
Elastic reports:
Vulnerability Summary: Elasticsearch versions 1.3.x and prior have a default configuration for CORS that allows an attacker to craft links that could cause a user's browser to send requests to Elasticsearch instances on their local network. These requests could cause data loss or compromise.
Remediation Summary: Users should either set "http.cors.enabled" to false, or set "http.cors.allow-origin" to the value of the server that should be allowed access, such as localhost or a server hosting Kibana. Disabling CORS entirely with the former setting is more secure, but may not be suitable for all use cases.
Elastic reports:
Vulnerability Summary: In Elasticsearch versions 1.1.x and prior, dynamic scripting is enabled by default. This could allow an attacker to execute OS commands.
Remediation Summary: Disable dynamic scripting.
Logstash 1.4.2 was bundled with Elasticsearch 1.1.1, which is vulnerable to CVE-2014-3120. These binaries are used in Elasticsearch output specifically when using the node protocol. Since a node client joins the Elasticsearch cluster, the attackers could use scripts to execute commands on the host OS using the node client's URL endpoint. With 1.4.3 release, we are packaging Logstash with Elasticsearch 1.5.2 binaries which by default disables the ability to run scripts. This also affects users who are using the configuration option embedded=>true in the Elasticsearch output which starts a local embedded Elasticsearch cluster. This is typically used in development environment and proof of concept deployments. Regardless of this vulnerability, we strongly recommend not using embedded in production.
Note that users of transport and http protocol are not vulnerable to this attack.
Elastic reports:
An attacker could use the File output plugin with dynamic field references in the path option to traverse paths outside of Logstash directory. This technique could also be used to overwrite any files which can be accessed with permissions associated with Logstash user. This release sandboxes the paths which can be traversed using the configuration. We have also disallowed use of dynamic field references if the path options is pointing to an absolute path.
We have added this vulnerability to our CVE page and are working on filling out the CVE. We would like to thank Colin Coghill for reporting the issue and working with us on the resolution.
Elastic reports:
The vulnerability impacts deployments that use the either the zabbix or the nagios_nsca outputs. In these cases, an attacker with an ability to send crafted events to any source of data for Logstash could execute operating system commands with the permissions of the Logstash process.
Deployments that do not use the zabbix or the nagios_nsca outputs are not vulnerable and do not need to upgrade for this reason.
We have added this vulnerability to our CVE page and are working on filling out the CVE.
We would like to thank Jan Karwowski and Danila Borisiuk for reporting the issue and working with us on the resolution.
Elastic reports:
The combination of Logstash Forwarder and Lumberjack input (and output) was vulnerable to the POODLE attack in SSLv3 protocol. We have disabled SSLv3 for this combination and set the minimum version to be TLSv1.0. We have added this vulnerability to our CVE page and are working on filling out the CVE.
Thanks to Tray Torrance, Marc Chadwick, and David Arena for reporting this.
SSLv3 is no longer supported; TLS 1.0+ is required (compatible with Logstash 1.4.2+).
Adobe reports:
Adobe has released security updates for Adobe Flash Player for Windows, Macintosh and Linux. These updates address a critical vulnerability (CVE-2015-3113) that could potentially allow an attacker to take control of the affected system.
Adobe is aware of reports that CVE-2015-3113 is being actively exploited in the wild via limited, targeted attacks. Systems running Internet Explorer for Windows 7 and below, as well as Firefox on Windows XP, are known targets.
Phill MV reports:
By submitting a specially crafted string to a service relying on the bson rubygem, an attacker may trigger denials of service or even inject data into victim's MongoDB instances.
The PHP project reports:
DOM and GD:
- Fixed bug #69719 (Incorrect handling of paths with NULs).
FTP:
- Improved fix for bug #69545 (Integer overflow in ftp_genlist() resulting in heap overflow). (CVE-2015-4643)
Postgres:
- Fixed bug #69667 (segfault in php_pgsql_meta_data). (CVE-2015-4644)
Kyle Kelley reports:
Summary: JSON error responses from the IPython notebook REST API contained URL parameters and were incorrectly reported as text/html instead of application/json. The error messages included some of these URL params, resulting in a cross site scripting attack. This affects users on Mozilla Firefox but not Chromium/Google Chrome.
API paths with issues:
- /api/contents (3.0-3.1)
- /api/notebooks (2.0-2.4, 3.0-3.1)
Google Chrome Releases reports:
4 security fixes in this release:
- [464922] High CVE-2015-1266: Scheme validation error in WebUI. Credit to anonymous.
- [494640] High CVE-2015-1268: Cross-origin bypass in Blink. Credit to Mariusz Mlynski.
- [497507] Medium CVE-2015-1267: Cross-origin bypass in Blink. Credit to anonymous.
- [461481] Medium CVE-2015-1269: Normalization error in HSTS/HPKP preload list. Credit to Mike Ruddy.
Jon Yurek reports:
Thanks to MORI Shingo of DeNA Co., Ltd. for reporting this.
There is an issue where if an HTML file is uploaded with a .html extension, but the content type is listed as being `image/jpeg`, this will bypass a validation checking for images. But it will also pass the spoof check, because a file named .html and containing actual HTML passes the spoof check.
This change makes it so that we also check the supplied content type. So even if the file contains HTML and ends with .html, it doesn't match the content type of `image/jpeg` and so it fails.
chicken developer Peter Bex reports:
Using gcc's Address Sanitizer, it was discovered that the string-translate* procedure from the data-structures unit can scan beyond the input string's length up to the length of the source strings in the map that's passed to string-translate*. This issue was fixed in master 8a46020, and it will make its way into CHICKEN 4.10.
This bug is present in all released versions of CHICKEN.
chicken developer Moritz Heidkamp reports:
The substring-index[-ci] procedures of the data-structures unit are vulnerable to a buffer overrun attack when passed an integer greater than zero as the optional START argument.
As a work-around you can switch to SRFI 13's string-contains procedure which also returns the substring's index in case it is found.
The Cacti Group, Inc. reports:
Important Security Fixes
- Multiple XSS and SQL injection vulerabilities
Changelog
- bug: Fixed SQL injection VN: JVN#78187936 / TN:JPCERT#98968540
- bug#0002542: [FG-VD-15-017] Cacti Cross-Site Scripting Vulnerability Notification
- bug#0002571: SQL Injection and Location header injection from cdef id CVE-2015-4342
- bug#0002572: SQL injection in graph template
The Cacti Group, Inc. reports:
Important Security Fixes
- CVE-2013-5588 - XSS issue via installer or device editing
- CVE-2013-5589 - SQL injection vulnerability in device editing
- CVE-2014-2326 - XSS issue via CDEF editing
- CVE-2014-2327 - Cross-site request forgery (CSRF) vulnerability
- CVE-2014-2328 - Remote Command Execution Vulnerability in graph export
- CVE-2014-4002 - XSS issues in multiple files
- CVE-2014-5025 - XSS issue via data source editing
- CVE-2014-5026 - XSS issues in multiple files
Russell Jenkins reports:
It was possible to abuse session cookie values so that file-based session stores such as Dancer::Session::YAML or Dancer2::Session::YAML would attempt to read/write from any file on the filesystem with the same extension the file-based store uses, such as '*.yml' for the YAML stores.
Drupal development team reports:
Impersonation (OpenID module - Drupal 6 and 7 - Critical)
A vulnerability was found in the OpenID module that allows a malicious user to log in as other users on the site, including administrators, and hijack their accounts.
This vulnerability is mitigated by the fact that the victim must have an account with an associated OpenID identity from a particular set of OpenID providers (including, but not limited to, Verisign, LiveJournal, or StackExchange).
Open redirect (Field UI module - Drupal 7 - Less critical)
The Field UI module uses a "destinations" query string parameter in URLs to redirect users to new destinations after completing an action on a few administration pages. Under certain circumstances, malicious users can use this parameter to construct a URL that will trick users into being redirected to a 3rd party website, thereby exposing the users to potential social engineering attacks.
This vulnerability is mitigated by the fact that only sites with the Field UI module enabled are affected.
Drupal 6 core is not affected, but see the similar advisory for the Drupal 6 contributed CCK module: SA-CONTRIB-2015-126
Open redirect (Overlay module - Drupal 7 - Less critical)
The Overlay module displays administrative pages as a layer over the current page (using JavaScript), rather than replacing the page in the browser window. The Overlay module does not sufficiently validate URLs prior to displaying their contents, leading to an open redirect vulnerability.
This vulnerability is mitigated by the fact that it can only be used against site users who have the "Access the administrative overlay" permission, and that the Overlay module must be enabled.
Information disclosure (Render cache system - Drupal 7 - Less critical)
On sites utilizing Drupal 7's render cache system to cache content on the site by user role, private content viewed by user 1 may be included in the cache and exposed to non-privileged users.
This vulnerability is mitigated by the fact that render caching is not used in Drupal 7 core itself (it requires custom code or the contributed Render Cache module to enable) and that it only affects sites that have user 1 browsing the live site. Exposure is also limited if an administrative role has been assigned to the user 1 account (which is done, for example, by the Standard install profile that ships with Drupal core).
cURL reports:
libcurl can wrongly send HTTP credentials when re-using connections.
libcurl allows applications to set credentials for the upcoming transfer with HTTP Basic authentication, like with CURLOPT_USERPWD for example. Name and password. Just like all other libcurl options the credentials are sticky and are kept associated with the "handle" until something is made to change the situation.
Further, libcurl offers a curl_easy_reset() function that resets a handle back to its pristine state in terms of all settable options. A reset is of course also supposed to clear the credentials. A reset is typically used to clear up the handle and prepare it for a new, possibly unrelated, transfer.
Within such a handle, libcurl can also store a set of previous connections in case a second transfer is requested to a host name for which an existing connection is already kept alive.
With this flaw present, using the handle even after a reset would make libcurl accidentally use those credentials in a subseqent request if done to the same host name and connection as was previously accessed.
An example case would be first requesting a password protected resource from one section of a web site, and then do a second request of a public resource from a completely different part of the site without authentication. This flaw would then inadvertently leak the credentials in the second request.
libcurl can get tricked by a malicious SMB server to send off data it did not intend to.
In libcurl's state machine function handling the SMB protocol (smb_request_state()), two length and offset values are extracted from data that has arrived over the network, and those values are subsequently used to figure out what data range to send back.
The values are used and trusted without boundary checks and are just assumed to be valid. This allows carefully handicrafted packages to trick libcurl into responding and sending off data that was not intended. Or just crash if the values cause libcurl to access invalid memory.
Ruby on Rails blog:
Rails 3.2.22, 4.1.11 and 4.2.2 have been released, along with web console and jquery-rails plugins and Rack 1.5.4 and 1.6.2.
CGSecurity TestDisk Changelog reports:
Various fix including security fix, thanks to:
Coverity scan (Static Analysis of source code)
afl-fuzz (security-oriented fuzzer).
Denis Andzakovic from Security Assessment for reporting an exploitable Stack Buffer Overflow.
Denis Andzakovic reports:
A buffer overflow is triggered within the software when a malicious disk image is attempted to be recovered. This may be leveraged by an attacker to crash TestDisk and gain control of program execution. An attacker would have to coerce the victim to run TestDisk against their malicious image.
Apache Software Foundation reports:
Low: Denial of Service CVE-2014-0230
When a response for a request with a request body is returned to the user agent before the request body is fully read, by default Tomcat swallows the remaining request body so that the next request on the connection may be processed. There was no limit to the size of request body that Tomcat would swallow. This permitted a limited Denial of Service as Tomcat would never close the connection and a processing thread would remain allocated to the connection.
Moderate: Security Manager bypass CVE-2014-7810
Malicious web applications could use expression language to bypass the protections of a Security Manager as expressions were evaluated within a privileged code section.
OSSEC reports:
The CVE-2015-3222 vulnerability, which allows for root escalation via sys check has been fixed in OSSEC 2.8.2. This issue does not affect agents.
The OpenSSL team reports:
- Missing DHE man-in-the-middle protection (Logjam) (CVE-2015-4000)
- Malformed ECParameters causes infinite loop (CVE-2015-1788)
- Exploitable out-of-bounds read in X509_cmp_time (CVE-2015-1789)
- iPKCS7 crash with missing EnvelopedContent (CVE-2015-1790)
- CMS verify infinite loop with unknown hash function (CVE-2015-1792)
- Race condition handling NewSessionTicket (CVE-2015-1791)
- Invalid free in DTLS (CVE-2014-8176)
Adobe reports:
Adobe has released security updates for Adobe Flash Player for Windows, Macintosh and Linux. These updates address vulnerabilities that could potentially allow an attacker to take control of the affected system.
These updates resolve a vulnerability (CVE-2015-3096) that could be exploited to bypass the fix for CVE-2014-5333.
These updates improve memory address randomization of the Flash heap for the Window 7 64-bit platform (CVE-2015-3097).
These updates resolve vulnerabilities that could be exploited to bypass the same-origin-policy and lead to information disclosure (CVE-2015-3098, CVE-2015-3099, CVE-2015-3102).
These updates resolve a stack overflow vulnerability that could lead to code execution (CVE-2015-3100).
These updates resolve a permission issue in the Flash broker for Internet Explorer that could be exploited to perform privilege escalation from low to medium integrity level (CVE-2015-3101).
These updates resolve an integer overflow vulnerability that could lead to code execution (CVE-2015-3104).
These updates resolve a memory corruption vulnerability that could lead to code execution (CVE-2015-3105).
These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2015-3103, CVE-2015-3106, CVE-2015-3107).
These updates resolve a memory leak vulnerability that could be used to bypass ASLR (CVE-2015-3108).
Pieter Hintjens reports:
It is easy to bypass the security mechanism in 4.1.0 and 4.0.5 by sending a ZMTP v2 or earlier header. The library accepts such connections without applying its security mechanism.
PgBouncer reports:
Fix remote crash - invalid packet order causes lookup of NULL pointer. Not exploitable, just DoS.
CUPS development team reports:
The new release addresses two security vulnerabilities, add localizations for German and Russian, and includes several general bug fixes. Changes include:
Security: Fixed CERT VU #810572/CVE-2015-1158/CVE-2015-1159 exploiting the dynamic linker (STR #4609)
Security: The scheduler could hang with malformed gzip data (STR #4602)
StrongSwan Project reports
A denial-of-service and potential remote code execution vulnerability triggered by crafted IKE messages was discovered in strongSwan. Versions 5.2.2 and 5.3.0 are affected.
strongSwan Project reports:
An information leak vulnerability was fixed that, in certain IKEv2 setups, allowed rogue servers with a valid certificate accepted by the client to trick it into disclosing user credentials (even plain passwords if the client accepts EAP-GTC). This was caused because constraints against the server's authentication were enforced too late. All versions since 4.3.0 are affected.
Ben Murphy reports:
It is possible to break out of the Lua sandbox in Redis and execute arbitrary code.
This shouldn’t pose a threat to users under the trusted Redis security model where only trusted users can connect to the database. However, in real deployments there could be databases that can be accessed by untrusted users. The main deployments that are vulnerable are developers machines, places where redis servers can be reached via SSRF attacks and cloud hosting.
Geoff McLane reports:
tidy is affected by a write out of bounds when processing malformed html files.
This issue could be abused on server side applications that use php-tidy extension with user input.
The issue was confirmed, analysed and fixed by the tidy5 maintainer.
Venustech ADLAB reports:
PCRE library is prone to a vulnerability which leads to Heap Overflow. During the compilation of a malformed regular expression, more data is written on the malloced block than the expected size output by compile_regex.
PCRE library is prone to a vulnerability which leads to Stack Overflow. Without enough bound checking inside match(), the stack memory could be overflowed via a crafted regular expression.
Jouni Malinen reports:
WPS UPnP vulnerability with HTTP chunked transfer encoding. (2015-2 - CVE-2015-4141)
Integer underflow in AP mode WMM Action frame processing. (2015-3 - CVE-2015-4142)
EAP-pwd missing payload length validation. (2015-4 - CVE-2015-4143, CVE-2015-4144, CVE-2015-4145, CVE-2015-4146)
NVD and Vigilance report:
Use-after-free vulnerability in Google Chrome before 24.0.1312.52 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving seek operations on video data.
An attacker can generate an integer overflow in the av_lzo1x_decode() function of Libav, in order to trigger a denial of service, and possibly to execute code.
libavcodec/mjpegdec.c in FFmpeg before 2.4.2 considers only dimension differences, and not bits-per-pixel differences, when determining whether an image size has changed, which allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted MJPEG data.
libavcodec/utils.c in FFmpeg before 2.4.2 omits a certain codec ID during enforcement of alignment, which allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted JV data.
libavcodec/mmvideo.c in FFmpeg before 2.4.2 does not consider all lines of HHV Intra blocks during validation of image height, which allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted MM video data.
libavcodec/pngdec.c in FFmpeg before 2.4.2 accepts the monochrome-black format without verifying that the bits-per-pixel value is 1, which allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted PNG data.
libavcodec/gifdec.c in FFmpeg before 2.4.2 does not properly compute image heights, which allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted GIF data.
Off-by-one error in libavcodec/smc.c in FFmpeg before 2.4.2 allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted Quicktime Graphics (aka SMC) video data.
The mjpeg_decode_app function in libavcodec/mjpegdec.c in FFMpeg before 2.1.6, 2.2.x through 2.3.x, and 2.4.x before 2.4.4 allows remote attackers to cause a denial of service (out-of-bounds heap access) and possibly have other unspecified impact via vectors related to LJIF tags in an MJPEG file.
The decode_ihdr_chunk function in libavcodec/pngdec.c in FFMpeg before 2.1.6, 2.2.x through 2.3.x, and 2.4.x before 2.4.4 allows remote attackers to cause a denial of service (out-of-bounds heap access) and possibly have other unspecified impact via an IDAT before an IHDR in a PNG file.
The vmd_decode function in libavcodec/vmdvideo.c in FFmpeg before 2.5.2 does not validate the relationship between a certain length value and the frame width, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Sierra VMD video data.
An attacker can force a read at an invalid address in mjpegdec.c of FFmpeg, in order to trigger a denial of service.
The Mageia project reports:
Avidemux is built with a bundled set of FFmpeg libraries. The bundled FFmpeg version has been updated from 1.2.10 to 1.2.12 to fix these security issues and other bugs fixed upstream in FFmpeg.
The open sourced vulnerability database reports:
REST Client for Ruby contains a flaw that is due to the application logging password information in plaintext. This may allow a local attacker to gain access to password information.
Andy Brody reports:
When Ruby rest-client processes an HTTP redirection response, it blindly passes along the values from any Set-Cookie headers to the redirection target, regardless of domain, path, or expiration.
Cabextract ChangeLog reports:
It was possible for cabinet files to extract to absolute file locations, and it was possible on Cygwin to get around cabextract's absolute and relative path protections by using backslashes.
There is a denial of service vulnerability in libmspack. The libmspack code is built into cabextract, so it is also vulnerable.
MITRE reports:
Integer overflow in the qtmd_decompress function in libmspack 0.4 allows remote attackers to cause a denial of service (hang) via a crafted CAB file, which triggers an infinite loop.
The Django project reports:
A change to session.flush() in the cached_db session backend in Django 1.8 mistakenly sets the session key to an empty string rather than None. An empty string is treated as a valid session key and the session cookie is set accordingly. Any users with an empty string in their session cookie will use the same session store. session.flush() is called by django.contrib.auth.logout() and, more seriously, by django.contrib.auth.login() when a user switches accounts. If a user is logged in and logs in again to a different account (without logging out) the session is flushed to avoid reuse. After the session is flushed (and its session key becomes '') the account details are set on the session and the session is saved. Any users with an empty string in their session cookie will now be logged into that account.
Thanks to Sam Cooke for reporting the issue.
Mamoru TASAKA reports:
proxychains4 sets LD_PRELOAD to dlopen libproxychains4.so and execvp() the arbitrary command user has specified. proxychains4 sets the current directory as the first path to search libproxychains4.so
Wireshark development team reports:
The following vulnerabilities have been fixed.
wnpa-sec-2015-12
The LBMR dissector could go into an infinite loop. (Bug 11036) CVE-2015-3808, CVE-2015-3809
wnpa-sec-2015-13
The WebSocket dissector could recurse excessively. (Bug 10989) CVE-2015-3810
wnpa-sec-2015-14
The WCP dissector could crash while decompressing data. (Bug 10978) CVE-2015-3811
wnpa-sec-2015-15
The X11 dissector could leak memory. (Bug 11088) CVE-2015-3812
wnpa-sec-2015-16
The packet reassembly code could leak memory. (Bug 11129) CVE-2015-3813
wnpa-sec-2015-17
The IEEE 802.11 dissector could go into an infinite loop. (Bug 11110) CVE-2015-3814
wnpa-sec-2015-18
The Android Logcat file parser could crash. Discovered by Hanno Böck. (Bug 11188) CVE-2015-3815
MIT reports:
In MIT krb5 1.12 and later, when the KDC is configured with PKINIT support, an unauthenticated remote attacker can bypass the requires_preauth flag on a client principal and obtain a ciphertext encrypted in the principal's long-term key. This ciphertext could be used to conduct an off-line dictionary attack against the user's password.
cURL reports:
libcurl provides applications a way to set custom HTTP headers to be sent to the server by using CURLOPT_HTTPHEADER. A similar option is available for the curl command-line tool with the '--header' option.
When the connection passes through an HTTP proxy the same set of headers is sent to the proxy as well by default. While this is by design, it has not necessarily been clear nor understood by application programmers.
cURL reports:
libcurl keeps a pool of its last few connections around after use to fascilitate easy, conventient and completely transparent connection re-use for applications.
When doing HTTP requests NTLM authenticated, the entire connnection becomes authenticated and not just the specific HTTP request which is otherwise how HTTP works. This makes NTLM special and a subject for special treatment in the code. With NTLM, once the connection is authenticated, no further authentication is necessary until the connection gets closed.
When doing HTTP requests Negotiate authenticated, the entire connnection may become authenticated and not just the specific HTTP request which is otherwise how HTTP works, as Negotiate can basically use NTLM under the hood. curl was not adhering to this fact but would assume that such requests would also be authenticated per request.
libcurl supports HTTP "cookies" as documented in RFC 6265. Together with each individual cookie there are several different properties, but for this vulnerability we focus on the associated "path" element. It tells information about for which path on a given host the cookies is valid.
The internal libcurl function called sanitize_cookie_path() that cleans up the path element as given to it from a remote site or when read from a file, did not properly validate the input. If given a path that consisted of a single double-quote, libcurl would index a newly allocated memory area with index -1 and assign a zero to it, thus destroying heap memory it wasn't supposed to.
There is a private function in libcurl called fix_hostname() that removes a trailing dot from the host name if there is one. The function is called after the host name has been extracted from the URL libcurl has been told to act on.
If a URL is given with a zero-length host name, like in "http://:80" or just ":80", fix_hostname() will index the host name pointer with a -1 offset (as it blindly assumes a non-zero length) and both read and assign that address.
Jake Luciani reports:
Under its default configuration, Cassandra binds an unauthenticated JMX/RMI interface to all network interfaces. As RMI is an API for the transport and remote execution of serialized Java, anyone with access to this interface can execute arbitrary code as the running user.
Mitigation:
1.2.x has reached EOL, so users of <= 1.2.x are recommended to upgrade to a supported version of Cassandra, or manually configure encryption and authentication of JMX, (see https://wiki.apache.org/cassandra/JmxSecurity).
2.0.x users should upgrade to 2.0.14
2.1.x users should upgrade to 2.1.4
Alternately, users of any version not wishing to upgrade can reconfigure JMX/RMI to enable encryption and authentication according to https://wiki.apache.org/cassandra/JmxSecurityor http://docs.oracle.com/javase/7/docs/technotes/guides/management/agent.html
Credit:
This issue was discovered by Georgi Geshev of MWR InfoSecurity
Colton Myers reports:
In order to fix potential shell injection vulnerabilities in salt modules, a change has been made to the various cmd module functions. These functions now default to python_shell=False, which means that the commands will not be sent to an actual shell.
The largest side effect of this change is that "shellisms", such as pipes, will not work by default. The modules shipped with salt have been audited to fix any issues that might have arisen from this change. Additionally, the cmd state module has been unaffected, and use of cmd.run in jinja is also unaffected. cmd.run calls on the CLI will also allow shellisms.
However, custom execution modules which use shellisms in cmd calls will break, unless you pass python_shell=True to these calls.
As a temporary workaround, you can set cmd_safe: False in your minion and master configs. This will revert the default, but is also less secure, as it will allow shell injection vulnerabilities to be written in custom code. We recommend you only set this setting for as long as it takes to resolve these issues in your custom code, then remove the override.
Mickaël Guessant reports:
DavMail 4.6.0 released
Enhancements: Fix potential CVE-2014-3566 vulnerability.
Simon Kelley reports:
Anyone running 2.[73]rc6 or 2.[73]rc7 should be aware that there's a remotely exploitable buffer overflow in those trees. I just tagged 2.[73]rc8, which includes the fix.
(Corrections from second URL.)
Nick Sampanis reported a potential memory exposure and denial of service vulnerability against dnsmasq 2.72. The CVE entry summarizes this as:
The tcp_request function in Dnsmasq before 2.73rc4 does not properly handle the return value of the setup_reply function, which allows remote attackers to read process memory and cause a denial of service (out-of-bounds read and crash) via a malformed DNS request."
PCRE development team reports:
A pattern such as "((?2){0,1999}())?", which has a group containing a forward reference repeated a large (but limited) number of times within a repeated outer group that has a zero minimum quantifier, caused incorrect code to be compiled, leading to the error "internal error: previously-checked referenced subpattern not found" when an incorrect memory address was read. This bug was reported as "heap overflow", discovered by Kai Lu of Fortinet's FortiGuard Labs and given the CVE number CVE-2015-2325.
A pattern such as "((?+1)(\1))/" containing a forward reference subroutine call within a group that also contained a recursive back reference caused incorrect code to be compiled. This bug was reported as "heap overflow", discovered by Kai Lu of Fortinet's FortiGuard Labs, and given the CVE number CVE-2015-2326.
PHP development team reports:
Fixed bug #69364 (PHP Multipart/form-data remote DoS Vulnerability). (CVE-2015-4024)
Fixed bug #69418 (CVE-2006-7243 fix regressions in 5.4+). (CVE-2015-4025)
Fixed bug #69545 (Integer overflow in ftp_genlist() resulting in heap overflow). (CVE-2015-4022)
Fixed bug #68598 (pcntl_exec() should not allow null char). (CVE-2015-4026)
Fixed bug #69453 (Memory Corruption in phar_parse_tarfile when entry filename starts with null). (CVE-2015-4021)
PostgreSQL project reports:
This update fixes three security vulnerabilities reported in PostgreSQL over the past few months. Nether of these issues is seen as particularly urgent. However, users should examine them in case their installations are vulnerable:.
- CVE-2015-3165 Double "free" after authentication timeout.
- CVE-2015-3166 Unanticipated errors from the standard library.
- CVE-2015-3167 pgcrypto has multiple error messages for decryption with an incorrect key.
ProFTPd development team reports:
Vadim Melihow reported a critical issue with proftpd installations that use the mod_copy module's SITE CPFR/SITE CPTO commands; mod_copy allows these commands to be used by *unauthenticated clients*.
Javantea reports:
It is a null dereference crash, leading to denial of service against the IKE daemon.
Google Chrome Releases reports:
37 security fixes in this release, including:
- [474029] High CVE-2015-1252: Sandbox escape in Chrome. Credit to anonymous.
- [464552] High CVE-2015-1253: Cross-origin bypass in DOM. Credit to anonymous.
- [444927] High CVE-2015-1254: Cross-origin bypass in Editing. Credit to armin@rawsec.net.
- [473253] High CVE-2015-1255: Use-after-free in WebAudio. Credit to Khalil Zhani.
- [478549] High CVE-2015-1256: Use-after-free in SVG. Credit to Atte Kettunen of OUSPG.
- [481015] High CVE-2015-1251: Use-after-free in Speech. Credit to SkyLined working with HP's Zero Day Initiative.
- [468519] Medium CVE-2015-1257: Container-overflow in SVG. Credit to miaubiz.
- [450939] Medium CVE-2015-1258: Negative-size parameter in libvpx. Credit to cloudfuzzer
- [468167] Medium CVE-2015-1259: Uninitialized value in PDFium. Credit to Atte Kettunen of OUSPG
- [474370] Medium CVE-2015-1260: Use-after-free in WebRTC. Credit to Khalil Zhani.
- [466351] Medium CVE-2015-1261: URL bar spoofing. Credit to Juho Nurminen.
- [476647] Medium CVE-2015-1262: Uninitialized value in Blink. Credit to miaubiz.
- [479162] Low CVE-2015-1263: Insecure download of spellcheck dictionary. Credit to Mike Ruddy.
- [481015] Low CVE-2015-1264: Cross-site scripting in bookmarks. Credit to K0r3Ph1L.
- [489518] CVE-2015-1265: Various fixes from internal audits, fuzzing and other initiatives.
- Multiple vulnerabilities in V8 fixed at the tip of the 4.3 branch (currently 4.3.61.21).
ClamAV project reports:
ClamAV 0.98.7 is here! This release contains new scanning features and bug fixes.
Fix infinite loop condition on crafted y0da cryptor file. Identified and patch suggested by Sebastian Andrzej Siewior. CVE-2015-2221.
Fix crash on crafted petite packed file. Reported and patch supplied by Sebastian Andrzej Siewior. CVE-2015-2222.
Fix an infinite loop condition on a crafted "xz" archive file. This was reported by Dimitri Kirchner and Goulven Guiheux. CVE-2015-2668.
Apply upstream patch for possible heap overflow in Henry Spencer's regex library. CVE-2015-2305.
Fix crash in upx decoder with crafted file. Discovered and patch supplied by Sebastian Andrzej Siewior. CVE-2015-2170.
Jonathan Claudius reports:
RubyGems provides the ability of a domain to direct clients to a separate host that is used to fetch gems and make API calls against. This mechanism is implemented via DNS, specificly a SRV record _rubygems._tcp under the original requested domain.
RubyGems did not validate the hostname returned in the SRV record before sending requests to it. This left clients open to a DNS hijack attack, whereby an attacker could return a SRV of their choosing and get the client to use it.
Jason Geffner, CrowdStrike Senior Security Researcher reports:
VENOM, CVE-2015-3456, is a security vulnerability in the virtual floppy drive code used by many computer virtualization platforms. This vulnerability may allow an attacker to escape from the confines of an affected virtual machine (VM) guest and potentially obtain code-execution access to the host. Absent mitigation, this VM escape could open access to the host system and all other VMs running on that host, potentially giving adversaries significant elevated access to the host's local network and adjacent systems.
Quassel IRC developers report:
Restarting a PostgreSQL database while Quassel Core is running would not properly re-initialize the database session inside Quassel, bringing back an old security issue (CVE-2013-4422).
Daniel LeCheminant reports:
When markdown is being presented as HTML, there seems to be a strange interaction between _ and @ that lets an attacker insert malicious tags.
ocert reports:
The dcraw tool, as well as several other projects re-using its code, suffers from an integer overflow condition which lead to a buffer overflow.
The vulnerability concerns the 'len' variable, parsed without validation from opened images, used in the ljpeg_start() function.
A maliciously crafted raw image file can be used to trigger the vulnerability, causing a Denial of Service condition.
The phpMyAdmin development team reports:
XSRF/CSRF vulnerability in phpMyAdmin setup.
By deceiving a user to click on a crafted URL, it is possible to alter the configuration file being generated with phpMyAdmin setup.
This vulnerability only affects the configuration file generation process and does not affect the effective configuration file. Moreover, the configuration file being generated is at risk only during the period when it's writable.
Vulnerability allowing man-in-the-middle attack on API call to GitHub.
A vulnerability in the API call to GitHub can be exploited to perform a man-in-the-middle attack.
We consider this vulnerability to be serious.
Adobe reports:
Adobe has released security updates for Adobe Flash Player for Windows, Macintosh and Linux. These updates address vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe recommends users update their product installations to the latest versions.
These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2015-3078, CVE-2015-3089, CVE-2015-3090, CVE-2015-3093).
These updates resolve a heap overflow vulnerability that could lead to code execution (CVE-2015-3088).
These updates resolve a time-of-check time-of-use (TOCTOU) race condition that could be exploited to bypass Protected Mode in Internet Explorer (CVE-2015-3081).
These updates resolve validation bypass issues that could be exploited to write arbitrary data to the file system under user permissions (CVE-2015-3082, CVE-2015-3083, CVE-2015-3085).
These updates resolve an integer overflow vulnerability that could lead to code execution (CVE-2015-3087).
These updates resolve a type confusion vulnerability that could lead to code execution (CVE-2015-3077, CVE-2015-3084, CVE-2015-3086).
These updates resolve a use-after-free vulnerability that could lead to code execution (CVE-2015-3080).
These updates resolve memory leak vulnerabilities that could be used to bypass ASLR (CVE-2015-3091, CVE-2015-3092).
These updates resolve a security bypass vulnerability that could lead to information disclosure (CVE-2015-3079), and provide additional hardening to protect against CVE-2015-3044.
The Mozilla Project reports:
MFSA-2015-46 Miscellaneous memory safety hazards (rv:38.0 / rv:31.7)
MFSA-2015-47 Buffer overflow parsing H.264 video with Linux Gstreamer
MFSA-2015-48 Buffer overflow with SVG content and CSS
MFSA-2015-49 Referrer policy ignored when links opened by middle-click and context menu
MFSA-2015-50 Out-of-bounds read and write in asm.js validation
MFSA-2015-51 Use-after-free during text processing with vertical text enabled
MFSA-2015-52 Sensitive URL encoded information written to Android logcat
MFSA-2015-53 Use-after-free due to Media Decoder Thread creation during shutdown
MFSA-2015-54 Buffer overflow when parsing compressed XML
MFSA-2015-55 Buffer overflow and out-of-bounds read while parsing MP4 video metadata
MFSA-2015-56 Untrusted site hosting trusted page can intercept webchannel responses
MFSA-2015-57 Privilege escalation through IPC channel messages
MFSA-2015-58 Mozilla Windows updater can be run outside of application directory
MFSA 2015-93 Integer overflows in libstagefright while processing MP4 video metadata
OISF Development Team reports:
The OISF development team is pleased to announce Suricata 2.0.8. This release fixes a number of issues in the 2.0 series.
The most important issue is a bug in the DER parser which is used to decode SSL/TLS certificates could crash Suricata. This issue was reported by Kostya Kortchinsky of the Google Security Team and was fixed by Pierre Chifflier of ANSSI.
Those processing large numbers of (untrusted) pcap files need to update as a malformed pcap could crash Suricata. Again, credits go to Kostya Kortchinsky.
Andreas Schneider reports:
libssh versions 0.5.1 and above have a logical error in the handling of a SSH_MSG_NEWKEYS and SSH_MSG_KEXDH_REPLY package. A detected error did not set the session into the error state correctly and further processed the packet which leads to a null pointer dereference. This is the packet after the initial key exchange and doesn’t require authentication.
This could be used for a Denial of Service (DoS) attack.
US-CERT/NIST reports:
The HWP filter in LibreOffice before 4.3.7 and 4.4.x before 4.4.2 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted HWP document, which triggers an out-of-bounds write.
Samuel Sidler reports:
The Genericons icon font package, which is used in a number of popular themes and plugins, contained an HTML file vulnerable to a cross-site scripting attack. All affected themes and plugins hosted on WordPress.org (including the Twenty Fifteen default theme) have been updated today by the WordPress security team to address this issue by removing this nonessential file. To help protect other Genericons usage, WordPress 4.2.2 proactively scans the wp-content directory for this HTML file and removes it. Reported by Robert Abela of Netsparker.
WordPress versions 4.2 and earlier are affected by a critical cross-site scripting vulnerability, which could enable anonymous users to compromise a site. WordPress 4.2.2 includes a comprehensive fix for this issue.
The release also includes hardening for a potential cross-site scripting vulnerability when using the visual editor. This issue was reported by Mahadev Subedi.
Gary Pendergast reports:
WordPress 4.2.1 is now available. This is a critical security release for all previous versions and we strongly encourage you to update your sites immediately.
A few hours ago, the WordPress team was made aware of a cross-site scripting vulnerability, which could enable commenters to compromise a site. The vulnerability was discovered by Jouko Pynnöne.
The PowerDNS project reports:
A bug was discovered in our label decompression code, making it possible for names to refer to themselves, thus causing a loop during decompression. On some platforms, this bug can be abused to cause crashes. On all platforms, this bug can be abused to cause service-affecting CPU spikes.
Google Chrome Releases reports:
5 security fixes in this release, including:
- [453279] High CVE-2015-1243: Use-after-free in DOM. Credit to Saif El-Sherei.
- [481777] CVE-2015-1250: Various fixes from internal audits, fuzzing and other initiatives.
Google Chrome Releases reports:
45 new security fixes, including:
- [456518] High CVE-2015-1235: Cross-origin-bypass in HTML parser. Credit to anonymous.
- [313939] Medium CVE-2015-1236: Cross-origin-bypass in Blink. Credit to Amitay Dobo.
- [461191] High CVE-2015-1237: Use-after-free in IPC. Credit to Khalil Zhani.
- [445808] High CVE-2015-1238: Out-of-bounds write in Skia. Credit to cloudfuzzer.
- [463599] Medium CVE-2015-1240: Out-of-bounds read in WebGL. Credit to w3bd3vil.
- [418402] Medium CVE-2015-1241: Tap-Jacking. Credit to Phillip Moon and Matt Weston of Sandfield Information Systems.
- [460917] High CVE-2015-1242: Type confusion in V8. Credit to fcole@onshape.com.
- [455215] Medium CVE-2015-1244: HSTS bypass in WebSockets. Credit to Mike Ruddy.
- [444957] Medium CVE-2015-1245: Use-after-free in PDFium. Credit to Khalil Zhani.
- [437399] Medium CVE-2015-1246: Out-of-bounds read in Blink. Credit to Atte Kettunen of OUSPG.
- [429838] Medium CVE-2015-1247: Scheme issues in OpenSearch. Credit to Jann Horn.
- [380663] Medium CVE-2015-1248: SafeBrowsing bypass. Credit to Vittorio Gambaletta (VittGam).
- [476786] CVE-2015-1249: Various fixes from internal audits, fuzzing and other initiatives. Multiple vulnerabilities in V8 fixed at the tip of the 4.2 branch (currently 4.2.77.14).
Jouni Malinen reports:
A vulnerability was found in how wpa_supplicant uses SSID information parsed from management frames that create or update P2P peer entries (e.g., Probe Response frame or number of P2P Public Action frames). SSID field has valid length range of 0-32 octets. However, it is transmitted in an element that has a 8-bit length field and potential maximum payload length of 255 octets. wpa_supplicant was not sufficiently verifying the payload length on one of the code paths using the SSID received from a peer device.
This can result in copying arbitrary data from an attacker to a fixed length buffer of 32 bytes (i.e., a possible overflow of up to 223 bytes). The SSID buffer is within struct p2p_device that is allocated from heap. The overflow can override couple of variables in the struct, including a pointer that gets freed. In addition about 150 bytes (the exact length depending on architecture) can be written beyond the end of the heap allocation.
This could result in corrupted state in heap, unexpected program behavior due to corrupted P2P peer device information, denial of service due to wpa_supplicant process crash, exposure of memory contents during GO Negotiation, and potentially arbitrary code execution.
Vulnerable versions/configurations
wpa_supplicant v1.0-v2.4 with CONFIG_P2P build option enabled (which is not compiled by default).
Attacker (or a system controlled by the attacker) needs to be within radio range of the vulnerable system to send a suitably constructed management frame that triggers a P2P peer device information to be created or updated.
The vulnerability is easiest to exploit while the device has started an active P2P operation (e.g., has ongoing P2P_FIND or P2P_LISTEN control interface command in progress). However, it may be possible, though significantly more difficult, to trigger this even without any active P2P operation in progress.
The PHP project reports:
The PHP development team announces the immediate availability of PHP 5.4.40. 14 security-related bugs were fixed in this release, including CVE-2014-9709, CVE-2015-2301, CVE-2015-2783, CVE-2015-1352. All PHP 5.4 users are encouraged to upgrade to this version.
The PHP development team announces the immediate availability of PHP 5.5.24. Several bugs have been fixed some of them beeing security related, like CVE-2015-1351 and CVE-2015-1352. All PHP 5.5 users are encouraged to upgrade to this version.
The PHP development team announces the immediate availability of PHP 5.6.8. Several bugs have been fixed some of them beeing security related, like CVE-2015-1351 and CVE-2015-1352. All PHP 5.6 users are encouraged to upgrade to this version.
Gary Pendergast reports:
WordPress 4.1.2 is now available. This is a critical security release for all previous versions and we strongly encourage you to update your sites immediately.
WordPress versions 4.1.1 and earlier are affected by a critical cross-site scripting vulnerability, which could enable anonymous users to compromise a site. This was reported by Cedric Van Bockhaven and fixed by Gary Pendergast, Mike Adams, and Andrew Nacin of the WordPress security team.
We also fixed three other security issues:
- In WordPress 4.1 and higher, files with invalid or unsafe names could be uploaded. Discovered by Michael Kapfer and Sebastian Kraemer of HSASec.
- In WordPress 3.9 and higher, a very limited cross-site scripting vulnerability could be used as part of a social engineering attack. Discovered by Jakub Zoczek.
- Some plugins were vulnerable to an SQL injection vulnerability. Discovered by Ben Bidner of the WordPress security team.
We also made four hardening changes, discovered by J.D. Grimes, Divyesh Prajapati, Allan Collins, Marc-Alexandre Montpas and Jeff Bowen.
Debian reports:
Hanno Boeck discovered a stack-based buffer overflow in the asn1_der_decoding function in Libtasn1, a library to manage ASN.1 structures. A remote attacker could take advantage of this flaw to cause an application using the Libtasn1 library to crash, or potentially to execute arbitrary code.
The Mozilla Project reports:
MFSA 2015-45 Memory corruption during failed plugin initialization
NVD reports:
SQLite before 3.8.9 does not properly implement the dequoting of collation-sequence names, which allows context-dependent attackers to cause a denial of service (uninitialized memory access and application crash) or possibly have unspecified other impact via a crafted COLLATE clause, as demonstrated by COLLATE"""""""" at the end of a SELECT statement.
The sqlite3VdbeExec function in vdbe.c in SQLite before 3.8.9 does not properly implement comparison operators, which allows context-dependent attackers to cause a denial of service (invalid free operation) or possibly have unspecified other impact via a crafted CHECK clause, as demonstrated by CHECK(0&O>O) in a CREATE TABLE statement.
The sqlite3VXPrintf function in printf.c in SQLite before 3.8.9 does not properly handle precision and width values during floating-point conversions, which allows context-dependent attackers to cause a denial of service (integer overflow and stack-based buffer overflow) or possibly have unspecified other impact via large integers in a crafted printf function call in a SELECT statement.
Chrony News reports:
CVE-2015-1853: DoS attack on authenticated symmetric NTP associations
CVE-2015-1821: Heap-based buffer overflow in access configuration
CVE-2015-1822: Use of uninitialized pointer in command processing
MITRE reports:
Buffer overflow in the C implementation of the apply_delta function in _pack.c in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a crafted pack file.
Adobe reports:
Adobe has released security updates for Adobe Flash Player for Windows, Macintosh and Linux. These updates address vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe is aware of a report that an exploit for CVE-2015-3043 exists in the wild, and recommends users update their product installations to the latest versions.
- These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2015-0347, CVE-2015-0350, CVE-2015-0352, CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360, CVE-2015-3038, CVE-2015-3041, CVE-2015-3042, CVE-2015-3043).
- These updates resolve a type confusion vulnerability that could lead to code execution (CVE-2015-0356).
- These updates resolve a buffer overflow vulnerability that could lead to code execution (CVE-2015-0348).
- These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2015-0349, CVE-2015-0351, CVE-2015-0358, CVE-2015-3039).
- These updates resolve double-free vulnerabilities that could lead to code execution (CVE-2015-0346, CVE-2015-0359).
- These updates resolve memory leak vulnerabilities that could be used to bypass ASLR (CVE-2015-0357, CVE-2015-3040).
- These updates resolve a security bypass vulnerability that could lead to information disclosure (CVE-2015-3044).
US-CERT/NIST reports:
The WML/Lua API in Battle for Wesnoth 1.7.x through 1.11.x and 1.12.x before 1.12.2 allows remote attackers to read arbitrary files via a crafted (1) campaign or (2) map file.
Richard J. Moore reports:
Due to two recent vulnerabilities identified in the built-in image format handling code, it was decided that this area required further testing to determine if further issues remained. Fuzzing using afl-fuzz located a number of issues in the handling of BMP, ICO and GIF files. The issues exposed included denial of service and buffer overflows leading to heap corruption. It is possible the latter could be used to perform remote code execution.
Ruby Developers report:
After reviewing RFC 6125 and RFC 5280, we found multiple violations of matching hostnames and particularly wildcard certificates.
Ruby’s OpenSSL extension will now provide a string-based matching algorithm which follows more strict behavior, as recommended by these RFCs. In particular, matching of more than one wildcard per subject/SAN is no-longer allowed. As well, comparison of these values are now case-insensitive.
Mark Sapiro reports:
A path traversal vulnerability has been discovered and fixed. This vulnerability is only exploitable by a local user on a Mailman server where the suggested Exim transport, the Postfix postfix_to_mailman.py transport or some other programmatic MTA delivery not using aliases is employed.
The Asterisk project reports:
When Asterisk registers to a SIP TLS device and and verifies the server, Asterisk will accept signed certificates that match a common name other than the one Asterisk is expecting if the signed certificate has a common name containing a null byte after the portion of the common name that Asterisk expected. For example, if Asterisk is trying to register to www.domain.com, Asterisk will accept certificates of the form www.domain.com\x00www.someotherdomain.com
ntp.org reports:
- [Sec 2779] ntpd accepts unauthenticated packets with symmetric key crypto.
- [Sec 2781] Authentication doesn't protect symmetric associations against DoS attacks.
The Mozilla Project reports:
MFSA 2015-44 Certificate verification bypass through the HTTP/2 Alt-Svc header
MFSA 2015-43 Loading privileged content through Reader mode
The libav project reports:
utvideodec: Handle slice_height being zero (CVE-2014-9604)
tiff: Check that there is no aliasing in pixel format selection (CVE-2014-8544)
The PHP project reports:
The PHP development team announces the immediate availability of PHP 5.6.7. Several bugs have been fixed as well as CVE-2015-0231, CVE-2015-2305 and CVE-2015-2331. All PHP 5.6 users are encouraged to upgrade to this version.
The PHP development team announces the immediate availability of PHP 5.5.23. Several bugs have been fixed as well as CVE-2015-0231, CVE-2015-2305 and CVE-2015-2331. All PHP 5.5 users are encouraged to upgrade to this version.
The PHP development team announces the immediate availability of PHP 5.4.39. Six security-related bugs were fixed in this release, including CVE-2015-0231, CVE-2015-2305 and CVE-2015-2331. All PHP 5.4 users are encouraged to upgrade to this version.
Subversion Project reports:
Subversion HTTP servers with FSFS repositories are vulnerable to a remotely triggerable excessive memory use with certain REPORT requests.
Subversion mod_dav_svn and svnserve are vulnerable to a remotely triggerable assertion DoS vulnerability for certain requests with dynamically evaluated revision numbers.
Subversion HTTP servers allow spoofing svn:author property values for new revisions.
The Mozilla Project reports:
MFSA-2015-30 Miscellaneous memory safety hazards (rv:37.0 / rv:31.6)
MFSA-2015-31 Use-after-free when using the Fluendo MP3 GStreamer plugin
MFSA-2015-32 Add-on lightweight theme installation approval bypassed through MITM attack
MFSA-2015-33 resource:// documents can load privileged pages
MFSA-2015-34 Out of bounds read in QCMS library
MFSA-2015-35 Cursor clickjacking with flash and images
MFSA-2015-36 Incorrect memory management for simple-type arrays in WebRTC
MFSA-2015-37 CORS requests should not follow 30x redirections after preflight
MFSA-2015-38 Memory corruption crashes in Off Main Thread Compositing
MFSA-2015-39 Use-after-free due to type confusion flaws
MFSA-2015-40 Same-origin bypass through anchor navigation
MFSA-2015-41 PRNG weakness allows for DNS poisoning on Android
MFSA-2015-42 Windows can retain access to privileged content on navigation to unprivileged pages
SUSE Security Update reports:
osc before 0.151.0 allows remote attackers to execute arbitrary commands via shell metacharacters in a _service file.
From the Debian Security Team:
Heap-based buffer overflow in the process_copy_in function in GNU Cpio 2.11 allows remote attackers to cause a denial of service via a large block value in a cpio archive.
cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive.
libzip developers report:
Avoid integer overflow. Fixed similarly to patch used in PHP copy of libzip.
The Django project reports:
In accordance with our security release policy, the Django team is issuing multiple releases -- Django 1.4.20, 1.6.11, 1.7.7 and 1.8c1. These releases are now available on PyPI and our download page. These releases address several security issues detailed below. We encourage all users of Django to upgrade as soon as possible. The Django master branch has also been updated.
US-CERT/NIST reports:
The _bfd_XXi_swap_aouthdr_in function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (out-of-bounds write) and possibly have other unspecified impact via a crafted NumberOfRvaAndSizes field in the AOUT header in a PE executable.
US-CERT/NIST reports:
Heap-based buffer overflow in the pe_print_edata function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly have other unspecified impact via a truncated export table in a PE file.
US-CERT/NIST reports:
Stack-based buffer overflow in the ihex_scan function in bfd/ihex.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly have other unspecified impact via a crafted ihex file.
Nodejs releases reports:
CVE-2015-0278
This may potentially allow an attacker to gain elevated privileges.
Jenkins Security Advisory:
Description
SECURITY-171, SECURITY-177 (Reflective XSS vulnerability)
An attacker without any access to Jenkins can navigate the user to a carefully crafted URL and have the user execute unintended actions. This vulnerability can be used to attack Jenkins inside firewalls from outside so long as the location of Jenkins is known to the attacker.
SECURITY-180 (forced API token change)
The part of Jenkins that issues a new API token was not adequately protected against anonymous attackers. This allows an attacker to escalate privileges on Jenkins.
The Mozilla Project reports:
MFSA-2015-28 Privilege escalation through SVG navigation
MFSA-2015-29 Code execution through incorrect JavaScript bounds checking elimination
OpenSSL project reports:
- Reclassified: RSA silently downgrades to EXPORT_RSA [Client] (CVE-2015-0204). OpenSSL only.
- Segmentation fault in ASN1_TYPE_cmp (CVE-2015-0286)
- ASN.1 structure reuse memory corruption (CVE-2015-0287)
- PKCS7 NULL pointer dereferences (CVE-2015-0289)
- Base64 decode (CVE-2015-0292). OpenSSL only.
- DoS via reachable assert in SSLv2 servers (CVE-2015-0293). OpenSSL only.
- Use After Free following d2i_ECPrivatekey error (CVE-2015-0209)
- X509_to_X509_REQ NULL pointer deref (CVE-2015-0288)
Alan Coopersmith reports:
Ilja van Sprundel, a security researcher with IOActive, has discovered an issue in the parsing of BDF font files by libXfont. Additional testing by Alan Coopersmith and William Robinet with the American Fuzzy Lop (afl) tool uncovered two more issues in the parsing of BDF font files.
As libXfont is used by the X server to read font files, and an unprivileged user with access to the X server can tell the X server to read a given font file from a path of their choosing, these vulnerabilities have the potential to allow unprivileged users to run code with the privileges of the X server (often root access).
Adobe reports:
Adobe has released security updates for Adobe Flash Player for Windows, Macintosh and Linux. These updates address vulnerabilities that could potentially allow an attacker to take control of the affected system. These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2015-0332, CVE-2015-0333, CVE-2015-0335, CVE-2015-0339). These updates resolve type confusion vulnerabilities that could lead to code execution (CVE-2015-0334, CVE-2015-0336). These updates resolve a vulnerability that could lead to a cross-domain policy bypass (CVE-2015-0337). These updates resolve a vulnerability that could lead to a file upload restriction bypass (CVE-2015-0340). These updates resolve an integer overflow vulnerability that could lead to code execution (CVE-2015-0338). These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2015-0341, CVE-2015-0342).
The Sympa Project reports:
The newsletter posting area in the web interface in Sympa 6.0.x before 6.0.10 and 6.1.x before 6.1.24 allows remote attackers to read arbitrary files via unspecified vectors.
Best Practical reports:
RT 3.0.0 and above, if running on Perl 5.14.0 or higher, are vulnerable to a remote denial-of-service via the email gateway; any installation which accepts mail from untrusted sources is vulnerable, regardless of the permissions configuration inside RT. This denial-of-service may encompass both CPU and disk usage, depending on RT's logging configuration. This vulnerability is assigned CVE-2014-9472.
RT 3.8.8 and above are vulnerable to an information disclosure attack which may reveal RSS feeds URLs, and thus ticket data; this vulnerability is assigned CVE-2015-1165. RSS feed URLs can also be leveraged to perform session hijacking, allowing a user with the URL to log in as the user that created the feed; this vulnerability is assigned CVE-2015-1464.
The phpMyAdmin development team reports:
Risk of BREACH attack due to reflected parameter.
With a large number of crafted requests it was possible to infer the CSRF token by a BREACH attack.
Mitigation factor: this vulnerability can only be exploited in the presence of another vulnerability that allows the attacker to inject JavaScript into victim's browser.
The Mono project reports:
Mono’s implementation of the SSL/TLS stack failed to check the order of the handshake messages. Which would allow various attacks on the protocol to succeed. Details of this vulnerability are discussed in SKIP-TLS post.
Mono’s implementation of SSL/TLS also contained support for the weak EXPORT cyphers and was susceptible to the FREAK attack.
Simon Tatham reports:
When PuTTY has sensitive data in memory and has no further need for it, it should wipe the data out of its memory, in case malware later gains access to the PuTTY process or the memory is swapped out to disk or written into a crash dump file. An obvious example of this is the password typed during SSH login; other examples include obsolete session keys, public-key passphrases, and the private halves of public keys.
PuTTY 0.63 and earlier versions, after loading a private key from a disk file, mistakenly leak a memory buffer containing a copy of the private key, in the function ssh2_load_userkey. The companion function ssh2_save_userkey (only called by PuTTYgen) can also leak a copy, but only in the case where the file it tried to save to could not be created.
Chrome Releases reports:
51 security fixes in this release, including:
- [456516] High CVE-2015-1212: Out-of-bounds write in media. Credit to anonymous.
- [448423] High CVE-2015-1213: Out-of-bounds write in skia filters. Credit to cloudfuzzer.
- [445810] High CVE-2015-1214: Out-of-bounds write in skia filters. Credit to cloudfuzzer.
- [445809] High CVE-2015-1215: Out-of-bounds write in skia filters. Credit to cloudfuzzer.
- [454954] High CVE-2015-1216: Use-after-free in v8 bindings. Credit to anonymous.
- [456192] High CVE-2015-1217: Type confusion in v8 bindings. Credit to anonymous.
- [456059] High CVE-2015-1218: Use-after-free in dom. Credit to cloudfuzzer.
- [446164] High CVE-2015-1219: Integer overflow in webgl. Credit to Chen Zhang (demi6od) of NSFOCUS Security Team.
- [437651] High CVE-2015-1220: Use-after-free in gif decoder. Credit to Aki Helin of OUSPG.
- [455368] High CVE-2015-1221: Use-after-free in web databases. Credit to Collin Payne.
- [448082] High CVE-2015-1222: Use-after-free in service workers. Credit to Collin Payne.
- [454231] High CVE-2015-1223: Use-after-free in dom. Credit to Maksymillian Motyl.
- High CVE-2015-1230: Type confusion in v8. Credit to Skylined working with HP's Zero Day Initiative.
- [449958] Medium CVE-2015-1224: Out-of-bounds read in vpxdecoder. Credit to Aki Helin of OUSPG.
- [446033] Medium CVE-2015-1225: Out-of-bounds read in pdfium. Credit to cloudfuzzer.
- [456841] Medium CVE-2015-1226: Validation issue in debugger. Credit to Rob Wu.
- [450389] Medium CVE-2015-1227: Uninitialized value in blink. Credit to Christoph Diehl.
- [444707] Medium CVE-2015-1228: Uninitialized value in rendering. Credit to miaubiz.
- [431504] Medium CVE-2015-1229: Cookie injection via proxies. Credit to iliwoy.
- [463349] CVE-2015-1231: Various fixes from internal audits, fuzzing, and other initiatives.
Richard J. Moore reports:
The builtin BMP decoder in QtGui prior to Qt 5.5 contained a bug that would lead to a divsion by zero when loading certain corrupt BMP files. This in turn would cause the application loading these hand crafted BMPs to crash.
Kohsuke Kawaguchi from Jenkins team reports:
Description
SECURITY-125 (Combination filter Groovy script unsecured)
This vulnerability allows users with the job configuration privilege to escalate his privileges, resulting in arbitrary code execution to the master.
SECURITY-162 (directory traversal from artifacts via symlink)
This vulnerability allows users with the job configuration privilege or users with commit access to the build script to access arbitrary files/directories on the master, resulting in the exposure of sensitive information, such as encryption keys.
SECURITY-163 (update center metadata retrieval DoS attack)
This vulnerability allows authenticated users to disrupt the operation of Jenkins by feeding malicious update center data into Jenkins, affecting plugin installation and tool installation.
SECURITY-165 (external entity injection via XPath)
This vulnerability allows users with the read access to Jenkins to retrieve arbitrary XML document on the server, resulting in the exposure of sensitive information inside/outside Jenkins.
SECURITY-166 (HudsonPrivateSecurityRealm allows creation of reserved names)
For users using "Jenkins' own user database" setting, Jenkins doesn't refuse reserved names, thus allowing privilege escalation.
SECURITY-167 (External entity processing in XML can reveal sensitive local files)
This vulnerability allows attackers to create malicious XML documents and feed that into Jenkins, which causes Jenkins to retrieve arbitrary XML document on the server, resulting in the exposure of sensitive information inside/outside Jenkins.
Severity
SECURITY-125 is rated critical. This attack can be only mounted by users with some trust, but it results in arbitrary code execution on the master.
SECURITY-162 is rated critical. This attack can be only mounted by users with some trust, but it results in the exposure of sensitive information.
SECURITY-163 is rated medium, as it results in the loss of functionality.
SECURITY-165 is rated critical. This attack is easy to mount, and it results in the exposure of sensitive information.
SECURITY-166 is rated critical. For users who use the affected feature, this attack results in arbitrary code execution on the master.
SECURITY-167 is rated critical. This attack is easy to mount, and it results in the exposure of sensitive information.
The Mozilla Project reports:
MFSA-2015-11 Miscellaneous memory safety hazards (rv:36.0 / rv:31.5)
MFSA-2015-12 Invoking Mozilla updater will load locally stored DLL files
MFSA-2015-13 Appended period to hostnames can bypass HPKP and HSTS protections
MFSA-2015-14 Malicious WebGL content crash when writing strings
MFSA-2015-15 TLS TURN and STUN connections silently fail to simple TCP connections
MFSA-2015-16 Use-after-free in IndexedDB
MFSA-2015-17 Buffer overflow in libstagefright during MP4 video playback
MFSA-2015-18 Double-free when using non-default memory allocators with a zero-length XHR
MFSA-2015-19 Out-of-bounds read and write while rendering SVG content
MFSA-2015-20 Buffer overflow during CSS restyling
MFSA-2015-21 Buffer underflow during MP3 playback
MFSA-2015-22 Crash using DrawTarget in Cairo graphics library
MFSA-2015-23 Use-after-free in Developer Console date with OpenType Sanitiser
MFSA-2015-24 Reading of local files through manipulation of form autocomplete
MFSA-2015-25 Local files or privileged URLs in pages can be opened into new tabs
MFSA-2015-26 UI Tour whitelisted sites in background tab can spoof foreground tabs
MFSA-2015-27 Caja Compiler JavaScript sandbox bypass
The PHP Project reports:
Use after free vulnerability in unserialize() with DateTimeZone.
Mitigation for CVE-2015-0235 -- GHOST: glibc gethostbyname buffer overflow.
The MIT Kerberos team announces the availability of MIT Kerberos 5 Release 1.11.6:
Handle certain invalid RFC 1964 GSS tokens correctly to avoid invalid memory reference vulnerabilities. [CVE-2014-4341
Fix memory management vulnerabilities in GSSAPI SPNEGO. [CVE-2014-4343 CVE-2014-4344]
Fix buffer overflow vulnerability in LDAP KDB back end. [CVE-2014-4345]
Fix multiple vulnerabilities in the LDAP KDC back end. [CVE-2014-5354 CVE-2014-5353]
Fix multiple kadmind vulnerabilities, some of which are based in the gssrpc library. [CVE-2014-5352 CVE-2014-9421 CVE-2014-9422 CVE-2014-9423]
Samba developement team reports:
All versions of Samba from 3.5.0 to 4.2.0rc4 are vulnerable to an unexpected code execution vulnerability in the smbd file server daemon.
A malicious client could send packets that may set up the stack in such a way that the freeing of memory in a subsequent anonymous netlogon packet could allow execution of arbitrary code. This code would execute with root privileges.
Theodore Ts'o reports:
If s_first_meta_bg is greater than the of number block group descriptor blocks, then reading or writing the block group descriptors will end up overruning the memory buffer allocated for the descriptors.
The finding is credited to a vulnerability report from Jose Duart of Google Security Team <jduart AT google.com> and was reported through oCERT-2015-002.
Theodore Ts'o reports:
On a carefully crafted filesystem that gets modified through tune2fs or debugfs, it is possible to trigger a buffer overrun when the file system is closed via closefs().
ISC reports:
When configured to perform DNSSEC validation, named can crash when encountering a rare set of conditions in the managed trust anchors.
The MIT Kerberos team announces the availability of MIT Kerberos 5 Release 1.12.3:
Fix multiple vulnerabilities in the LDAP KDC back end. [CVE-2014-5354] [CVE-2014-5353]
Fix multiple kadmind vulnerabilities, some of which are based in the gssrpc library. [CVE-2014-5352 CVE-2014-5352 CVE-2014-9421 CVE-2014-9422 CVE-2014-9423]
Ubuntu Security Notice USN-2502-1 reports:
unzip could be made to run programs if it opened a specially crafted file.
The MIT Kerberos team reports:
CVE-2014-5353: The krb5_ldap_get_password_policy_from_dn function in plugins/kdb/ldap/libkdb_ldap/ldap_pwd_policy.c in MIT Kerberos 5 (aka krb5) before 1.13.1, when the KDC uses LDAP, allows remote authenticated users to cause a denial of service (daemon crash) via a successful LDAP query with no results, as demonstrated by using an incorrect object type for a password policy.
CVE-2014-5354: plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.1, when the KDC uses LDAP, allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) by creating a database entry for a keyless principal, as demonstrated by a kadmin "add_principal -nokey" or "purgekeys -all" command.
Peter Hutterer reports:
Olivier Fourdan from Red Hat has discovered a protocol handling issue in the way the X server code base handles the XkbSetGeometry request.
The issue stems from the server trusting the client to send valid string lengths in the request data. A malicious client with string lengths exceeding the request length can cause the server to copy adjacent memory data into the XKB structs. This data is then available to the client via the XkbGetGeometry request. The data length is at least up to 64k, it is possible to obtain more data by chaining strings, each string length is then determined by whatever happens to be in that 16-bit region of memory.
A similarly crafted request can likely cause the X server to crash.
Ryan Tandy reports:
With the deref overlay enabled, ldapsearch with '-E deref=member:' causes slapd to crash.
Bill MacAllister discovered that certain queries cause slapd to crash while freeing operation controls. This is a 2.4.40 regression. Earlier releases are not affected.
Chrome Releases reports:
11 security fixes in this release, including:
- [447906] High CVE-2015-1209: Use-after-free in DOM. Credit to Maksymillian.
- [453979] High CVE-2015-1210: Cross-origin-bypass in V8 bindings. Credit to anonymous.
- [453982] High CVE-2015-1211: Privilege escalation using service workers. Credit to anonymous.
- [455225] CVE-2015-1212: Various fixes from internal audits, fuzzing and other initiatives.
PostgreSQL Project reports:
This update fixes multiple security issues reported in PostgreSQL over the past few months. All of these issues require prior authentication, and some require additional conditions, and as such are not considered generally urgent. However, users should examine the list of security holes patched below in case they are particularly vulnerable.
- CVE-2015-0241 Buffer overruns in "to_char" functions.
- CVE-2015-0242 Buffer overrun in replacement printf family of functions.
- CVE-2015-0243 Memory errors in functions in the pgcrypto extension.
- CVE-2015-0244 An error in extended protocol message reading.
- CVE-2014-8161 Constraint violation errors can cause display of values in columns which the user would not normally have rights to see.
SO-AND-SO reports:
CVE-2014-5352: In the MIT krb5 libgssapi_krb5 library, after gss_process_context_token() is used to process a valid context deletion token, the caller is left with a security context handle containing a dangling pointer. Further uses of this handle will result in use-after-free and double-free memory access violations. libgssrpc server applications such as kadmind are vulnerable as they can be instructed to call gss_process_context_token().
CVE-2014-9421: If the MIT krb5 kadmind daemon receives invalid XDR data from an authenticated user, it may perform use-after-free and double-free memory access violations while cleaning up the partial deserialization results. Other libgssrpc server applications may also be vulnerable if they contain insufficiently defensive XDR functions.
CVE-2014-9422: The MIT krb5 kadmind daemon incorrectly accepts authentications to two-component server principals whose first component is a left substring of "kadmin" or whose realm is a left prefix of the default realm.
CVE-2014-9423: libgssrpc applications including kadmind output four or eight bytes of uninitialized memory to the network as part of an unused "handle" field in replies to clients.
Ubuntu Security Notice USN-2489-1 reports:
Michal Zalewski discovered that unzip incorrectly handled certain malformed zip archives. If a user or automated system were tricked into processing a specially crafted zip archive, an attacker could possibly execute arbitrary code.
Debian reports:
web/acknowledge.c uses a string twice in a format string, but only allocates memory for one copy.
The RabbitMQ project reports:
Some user-controllable content was not properly HTML-escaped before being presented to a user in the management web UI:
- When a user unqueued a message from the management UI, message details (header names, arguments, etc.) were displayed unescaped. An attacker could publish a specially crafted message to add content or execute arbitrary Javascript code on behalf of a user, if this user unqueued the message from the management UI.
- When viewing policies, their name was displayed unescaped. An attacker could create a policy with a specially crafted name to add content or execute arbitrary Javascript code on behalf of a user who is viewing policies.
- When listing connected AMQP network clients, client details such as its version were displayed unescaped. An attacker could use a client with a specially crafted version field to add content or execute arbitrary Javascript code on behalf of a user who is viewing connected clients.
In all cases, the attacker needs a valid user account on the targetted RabbitMQ cluster.
Furthermore, some admin-controllable content was not properly escaped:
- user names;
- the cluster name.
Likewise, an attacker could add content or execute arbitrary Javascript code on behalf of a user using the management web UI. However, the attacker must be an administrator on the RabbitMQ cluster, thus a trusted user.
mod_proxy_fcgi: Fix a potential crash due to buffer over-read, with response headers' size above 8K.
mod_cache: Avoid a crash when Content-Type has an empty value. PR 56924.
mod_lua: Fix handling of the Require line when a LuaAuthzProvider is used in multiple Require directives with different arguments. PR57204.
core: HTTP trailers could be used to replace HTTP headers late during request processing, potentially undoing or otherwise confusing modules that examined or modified request headers earlier. Adds "MergeTrailers" directive to restore legacy behavior.
The Asterisk project reports:
CVE-2014-8150 reported an HTTP request injection vulnerability in libcURL. Asterisk uses libcURL in its func_curl.so module (the CURL() dialplan function), as well as its res_config_curl.so (cURL realtime backend) modules.
Since Asterisk may be configured to allow for user-supplied URLs to be passed to libcURL, it is possible that an attacker could use Asterisk as an attack vector to inject unauthorized HTTP requests if the version of libcURL installed on the Asterisk server is affected by CVE-2014-8150.
The Asterisk project reports:
Asterisk may be configured to only allow specific audio or video codecs to be used when communicating with a particular endpoint. When an endpoint sends an SDP offer that only lists codecs not allowed by Asterisk, the offer is rejected. However, in this case, RTP ports that are allocated in the process are not reclaimed.
This issue only affects the PJSIP channel driver in Asterisk. Users of the chan_sip channel driver are not affected.
As the resources are allocated after authentication, this issue only affects communications with authenticated endpoints.
Robert Krátký reports:
GHOST is a 'buffer overflow' bug affecting the gethostbyname() and gethostbyname2() function calls in the glibc library. This vulnerability allows a remote attacker that is able to make an application call to either of these functions to execute arbitrary code with the permissions of the user running the application. The gethostbyname() function calls are used for DNS resolving, which is a very common event. To exploit this vulnerability, an attacker must trigger a buffer overflow by supplying an invalid hostname argument to an application that performs a DNS resolution.
Adobe reports:
Successful exploitation could cause a crash and potentially allow an attacker to take control of the affected system. We are aware of reports that this vulnerability is being actively exploited in the wild via drive-by-download attacks against systems running Internet Explorer and Firefox on Windows 8.1 and below.
Bugzilla Security Advisory
Command Injection
Some code in Bugzilla does not properly utilize 3 arguments form for open() and it is possible for an account with editcomponents permissions to inject commands into product names and other attributes.
Information Leak
Using the WebServices API, a user can possibly execute imported functions from other non-WebService modules. A whitelist has now been added that lists explicit methods that can be executed via the API.
The Django project reports:
Today the Django team is issuing multiple releases -- Django 1.4.18, Django 1.6.10, and Django 1.7.3 -- as part of our security process. These releases are now available on PyPI and our download page.
These releases address several security issues. We encourage all users of Django to upgrade as soon as possible.
NVD reports:
Stack-based buffer overflow in utp.cpp in libutp, as used in Transmission before 2.74 and possibly other products, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted "micro transport protocol packets."
OpenSSL Security Advisory:
A memory leak can occur in the dtls1_buffer_record function under certain conditions. In particular this could occur if an attacker sent repeated DTLS records with the same sequence number but for the next epoch. The memory leak could be exploited by an attacker in a Denial of Service attack through memory exhaustion.
Adobe reports:
These updates address vulnerabilities that could potentially allow an attacker to take control of the affected system.
Google Chrome Releases reports:
62 security fixes in this release, including:
- [430353] High CVE-2014-7923: Memory corruption in ICU. Credit to yangdingning.
- [435880] High CVE-2014-7924: Use-after-free in IndexedDB. Credit to Collin Payne.
- [434136] High CVE-2014-7925: Use-after-free in WebAudio. Credit to mark.buer.
- [422824] High CVE-2014-7926: Memory corruption in ICU. Credit to yangdingning.
- [444695] High CVE-2014-7927: Memory corruption in V8. Credit to Christian Holler.
- [435073] High CVE-2014-7928: Memory corruption in V8. Credit to Christian Holler.
- [442806] High CVE-2014-7930: Use-after-free in DOM. Credit to cloudfuzzer.
- [442710] High CVE-2014-7931: Memory corruption in V8. Credit to cloudfuzzer.
- [443115] High CVE-2014-7929: Use-after-free in DOM. Credit to cloudfuzzer.
- [429666] High CVE-2014-7932: Use-after-free in DOM. Credit to Atte Kettunen of OUSPG.
- [427266] High CVE-2014-7933: Use-after-free in FFmpeg. Credit to aohelin.
- [427249] High CVE-2014-7934: Use-after-free in DOM. Credit to cloudfuzzer.
- [402957] High CVE-2014-7935: Use-after-free in Speech. Credit to Khalil Zhani.
- [428561] High CVE-2014-7936: Use-after-free in Views. Credit to Christoph Diehl.
- [419060] High CVE-2014-7937: Use-after-free in FFmpeg. Credit to Atte Kettunen of OUSPG.
- [416323] High CVE-2014-7938: Memory corruption in Fonts. Credit to Atte Kettunen of OUSPG.
- [399951] High CVE-2014-7939: Same-origin-bypass in V8. Credit to Takeshi Terada.
- [433866] Medium CVE-2014-7940: Uninitialized-value in ICU. Credit to miaubiz.
- [428557] Medium CVE-2014-7941: Out-of-bounds read in UI. Credit to Atte Kettunen of OUSPG and Christoph Diehl.
- [426762] Medium CVE-2014-7942: Uninitialized-value in Fonts. Credit to miaubiz.
- [422492] Medium CVE-2014-7943: Out-of-bounds read in Skia. Credit to Atte Kettunen of OUSPG.
- [418881] Medium CVE-2014-7944: Out-of-bounds read in PDFium. Credit to cloudfuzzer.
- [414310] Medium CVE-2014-7945: Out-of-bounds read in PDFium. Credit to cloudfuzzer.
- [414109] Medium CVE-2014-7946: Out-of-bounds read in Fonts. Credit to miaubiz.
- [430566] Medium CVE-2014-7947: Out-of-bounds read in PDFium. Credit to fuzztercluck.
- [414026] Medium CVE-2014-7948: Caching error in AppCache. Credit to jiayaoqijia.
- [449894] CVE-2015-1205: Various fixes from internal audits, fuzzing and other initiatives.
- Multiple vulnerabilities in V8 fixed at the tip of the 3.30 branch (currently 3.30.33.15).
PolarSSL team reports:
During the parsing of a ASN.1 sequence, a pointer in the linked list of asn1_sequence is not initialized by asn1_get_sequence_of(). In case an error occurs during parsing of the list, a situation is created where the uninitialized pointer is passed to polarssl_free().
This sequence can be triggered when a PolarSSL entity is parsing a certificate. So practically this means clients when receiving a certificate from the server or servers in case they are actively asking for a client certificate.
oCERT reports:
The UnZip tool is an open source extraction utility for archives compressed in the zip format.
The unzip command line tool is affected by heap-based buffer overflows within the CRC32 verification, the test_compr_eb() and the getZip64Data() functions. The input errors may result in arbitrary code execution.
A specially crafted zip file, passed to unzip -t, can be used to trigger the vulnerability.
Samba team reports:
In Samba's AD DC we neglected to ensure that attempted modifications of the userAccountControl attribute did not allow the UF_SERVER_TRUST_ACCOUNT bit to be set.
Valentin Rusu reports:
Until KDE Applications 14.12.0, kwalletd incorrectly handled CBC encryption blocks when encrypting secrets in kwl files. The secrets were still encrypted, but the result binary data corresponded to an ECB encrypted block instead of CBC.
The ECB encryption algorithm, even if it'll scramble user data, will produce same encrypted byte sequence for the same input text. As a result, attackers may eventually find-out the encrypted text.
The Mozilla Project reports:
MFSA-2015-01 Miscellaneous memory safety hazards (rv:35.0 / rv:31.4)
MFSA-2015-02 Uninitialized memory use during bitmap rendering
MFSA-2015-03 sendBeacon requests lack an Origin header
MFSA-2015-04 Cookie injection through Proxy Authenticate responses
MFSA-2015-05 Read of uninitialized memory in Web Audio
MFSA-2015-06 Read-after-free in WebRTC
MFSA-2015-07 Gecko Media Plugin sandbox escape
MFSA-2015-08 Delegated OCSP responder certificates failure with id-pkix-ocsp-nocheck extension
MFSA-2015-09 XrayWrapper bypass through DOM objects
Debian Security Team reports:
Andrew Bartlett of Catalyst reported a defect affecting certain applications using the Libevent evbuffer API. This defect leaves applications which pass insanely large inputs to evbuffers open to a possible heap overflow or infinite loop. In order to exploit this flaw, an attacker needs to be able to find a way to provoke the program into trying to make a buffer chunk larger than what will fit into a single size_t or off_t.
cURL reports:
When libcurl sends a request to a server via a HTTP proxy, it copies the entire URL into the request and sends if off. If the given URL contains line feeds and carriage returns those will be sent along to the proxy too, which allows the program to for example send a separate HTTP request injected embedded in the URL. Many programs allow some kind of external sources to set the URL or provide partial pieces for the URL to ask for, and if the URL as received from the user is not stripped good enough this flaw allows malicious users to do additional requests in a way that was not intended, or just to insert request headers into the request that the program didn't intend. We are not aware of any exploit of this flaw.
Webkit release team reports:
This release fixes the following security issues: CVE-2014-1344, CVE-2014-1384, CVE-2014-1385, CVE-2014-1386, CVE-2014-1387, CVE-2014-1388, CVE-2014-1389, CVE-2014-1390.
OpenSSL project reports:
DTLS segmentation fault in dtls1_get_record (CVE-2014-3571)
DTLS memory leak in dtls1_buffer_record (CVE-2015-0206)
no-ssl3 configuration sets method to NULL (CVE-2014-3569)
ECDHE silently downgrades to ECDH [Client] (CVE-2014-3572)
RSA silently downgrades to EXPORT_RSA [Client] (CVE-2015-0204)
DH client certificates accepted without verification [Server] (CVE-2015-0205)
Certificate fingerprints can be modified (CVE-2014-8275)
Bignum squaring may produce incorrect results (CVE-2014-3570)
MITRE reports:
wp-login.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to reset passwords by leveraging access to an e-mail account that received a password-reset message.
wp-includes/http.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to conduct server-side request forgery (SSRF) attacks by referring to a 127.0.0.0/8 resource.
WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to obtain access to an account idle since 2008 by leveraging an improper PHP dynamic type comparison for an MD5 hash.
Cross-site scripting (XSS) vulnerability in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via a crafted Cascading Style Sheets (CSS) token sequence in a post.
Cross-site scripting (XSS) vulnerability in Press This in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors
wp-includes/class-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to cause a denial of service (CPU consumption) via a long password that is improperly handled during hashing, a similar issue to CVE-2014-9016.
Cross-site request forgery (CSRF) vulnerability in wp-login.php in WordPress 3.7.4, 3.8.4, 3.9.2, and 4.0 allows remote attackers to hijack the authentication of arbitrary users for requests that reset passwords.
32-bit builds of PNG library are vulnerable to an unsigned integer overflow that is triggered by a crafted wide interlaced images. Overflow results in a heap corruption that will crash the application and may lead to the controlled overwrite of a selected portions of process address space.
RedHat reports:
Thomas Jarosch of Intra2net AG reported a number of denial of service issues (resource consumption) in the ELF parser used by file(1). These issues were fixed in the 5.21 release of file(1), but by mistake are missing from the changelog.
NVD reports:
The write_one_header function in mutt 1.5.23 does not properly handle newline characters at the beginning of a header, which allows remote attackers to cause a denial of service (crash) via a header with an empty body, which triggers a heap-based buffer overflow in the mutt_substrdup function.
CERT reports:
The Network Time Protocol (NTP) provides networked systems with a way to synchronize time for various services and applications. ntpd version 4.2.7 and pervious versions allow attackers to overflow several buffers in a way that may allow malicious code to be executed. ntp-keygen prior to version 4.2.7p230 also uses a non-cryptographic random number generator when generating symmetric keys.
The buffer overflow vulnerabilities in ntpd may allow a remote unauthenticated attacker to execute arbitrary malicious code with the privilege level of the ntpd process. The weak default key and non-cryptographic random number generator in ntp-keygen may allow an attacker to gain information regarding the integrity checking and authentication encryption schemes.
The Git Project reports:
When using a case-insensitive filesystem an attacker can craft a malicious Git tree that will cause Git to overwrite its own .git/config file when cloning or checking out a repository, leading to arbitrary command execution in the client machine. If you are a hosting service whose users may fetch from your service to Windows or Mac OS X machines, you are strongly encouraged to update to protect such users who use existing versions of Git.
The OTRS project reports:
An attacker with valid OTRS credentials could access and manipulate ticket data of other users via the GenericInterface, if a ticket webservice is configured and not additionally secured.
Subversion Project reports:
Subversion's mod_dav_svn Apache HTTPD server module will crash when it receives a REPORT request for some invalid formatted special URIs.
Subversion's mod_dav_svn Apache HTTPD server module will crash when it receives a request for some invalid formatted special URIs.
We consider this to be a medium risk vulnerability. Repositories which allow for anonymous reads will be vulnerable without authentication. Unfortunately, no special configuration is required and all mod_dav_svn servers are vulnerable.
NVIDIA Unix security team reports:
The GLX indirect rendering support supplied on NVIDIA products is subject to the recently disclosed X.Org vulnerabilities (CVE-2014-8093, CVE-2014-8098) as well as internally identified vulnerabilities (CVE-2014-8298).
Depending on how it is configured, the X server typically runs with raised privileges, and listens for GLX indirect rendering protocol requests from a local socket and potentially a TCP/IP port. The vulnerabilities could be exploited in a way that causes the X server to access uninitialized memory or overwrite arbitrary memory in the X server process. This can cause a denial of service (e.g., an X server segmentation fault), or could be exploited to achieve arbitrary code execution.
ISC reports:
We have today posted updated versions of 9.9.6 and 9.10.1 to address a significant security vulnerability in DNS resolution. The flaw was discovered by Florian Maury of ANSSI, and applies to any recursive resolver that does not support a limit on the number of recursions. [CERTFR-2014-AVI-512], [USCERT VU#264212]
A flaw in delegation handling could be exploited to put named into an infinite loop, in which each lookup of a name server triggered additional lookups of more name servers. This has been addressed by placing limits on the number of levels of recursion named will allow (default 7), and on the number of queries that it will send before terminating a recursive query (default 50). The recursion depth limit is configured via the max-recursion-depth option, and the query limit via the max-recursion-queries option. For more information, see the security advisory at https://kb.isc.org/article/AA-01216/. [CVE-2014-8500] [RT #37580]
In addition, we have also corrected a potential security vulnerability in the GeoIP feature in the 9.10.1 release only. For more information on this issue, see the security advisory at https://kb.isc.org/article/AA-01217. [CVE-2014-8680]
The Asterisk project reports:
When handling a WebSocket frame the res_http_websocket module dynamically changes the size of the memory used to allow the provided payload to fit. If a payload length of zero was received the code would incorrectly attempt to resize to zero. This operation would succeed and end up freeing the memory but be treated as a failure. When the session was subsequently torn down this memory would get freed yet again causing a crash.
Users of the WebSocket functionality also did not take into account that provided text frames are not guaranteed to be NULL terminated. This has been fixed in chan_sip and chan_pjsip in the applicable versions.
Alan Coopersmith reports:
Ilja van Sprundel, a security researcher with IOActive, has discovered a large number of issues in the way the X server code base handles requests from X clients, and has worked with X.Org's security team to analyze, confirm, and fix these issues.
The vulnerabilities could be exploited to cause the X server to access uninitialized memory or overwrite arbitrary memory in the X server process. This can cause a denial of service (e.g., an X server segmentation fault), or could be exploited to achieve arbitrary code execution.
The GLX extension to the X Window System allows an X client to send X protocol to the X server, to request that the X server perform OpenGL rendering on behalf of the X client. This is known as "GLX indirect rendering", as opposed to "GLX direct rendering" where the X client submits OpenGL rendering commands directly to the GPU, bypassing the X server and avoiding the X server code for GLX protocol handling.
Most GLX indirect rendering implementations share some common ancestry, dating back to "Sample Implementation" code from Silicon Graphics, Inc (SGI), which SGI originally commercially licensed to other Unix workstation and graphics vendors, and later released as open source, so those vulnerabilities may affect other licensees of SGI's code base beyond those running code from the X.Org Foundation or the XFree86 Project.
Unbound developer reports:
The resolver can be tricked into following an endless series of delegations, this consumes a lot of resources.
Werner LEMBERG reports:
The fix for CVE-2014-2240 was not 100% complete to fix the issue from the CVE completly.
The phpMyAdmin development team reports:
DoS vulnerability with long passwords.
With very long passwords it was possible to initiate a denial of service attack on phpMyAdmin.
We consider this vulnerability to be serious.
This vulnerability can be mitigated by configuring throttling in the webserver.
XSS vulnerability in redirection mechanism.
With a crafted URL it was possible to trigger an XSS in the redirection mechanism in phpMyAdmin.
We consider this vulnerability to be non critical.
The Mozilla Project reports:
ASN.1 DER decoding of lengths is too permissive, allowing undetected smuggling of arbitrary data
MFSA-2014-90 Apple CoreGraphics framework on OS X 10.10 logging input data to /tmp directory
MFSA-2014-89 Bad casting from the BasicThebesLayer to BasicContainerLayer
MFSA-2014-88 Buffer overflow while parsing media content
MFSA-2014-87 Use-after-free during HTML5 parsing
MFSA-2014-86 CSP leaks redirect data via violation reports
MFSA-2014-85 XMLHttpRequest crashes with some input streams
MFSA-2014-84 XBL bindings accessible via improper CSS declarations
MFSA-2014-83 Miscellaneous memory safety hazards (rv:34.0 / rv:31.3)
The OpenVPN project reports:
In late November 2014 Dragana Damjanovic notified OpenVPN developers of a critical denial of service security vulnerability (CVE-2014-8104). The vulnerability allows an tls-authenticated client to crash the server by sending a too-short control channel packet to the server. In other words this vulnerability is denial of service only.
Erik de Castro Lopo reports:
Google Security Team member, Michele Spagnuolo, recently found two potential problems in the FLAC code base. They are:
- CVE-2014-9028: Heap buffer write overflow.
- CVE-2014-8962: Heap buffer read overflow.
The Asterisk project reports:
AST-2014-014 - High call load may result in hung channels in ConfBridge.
AST-2014-017 - Permission escalation through ConfBridge actions/dialplan functions.
The Asterisk project reports:
AST-2014-012 - Mixed IP address families in access control lists may permit unwanted traffic.
AST-2014-018 - AMI permission escalation through DB dialplan function.
The phpMyAdmin development team reports:
- With a crafted database, table or column name it is possible to trigger an XSS attack in the table browse page.
- With a crafted ENUM value it is possible to trigger XSS attacks in the table print view and zoom search pages.
- With a crafted value for font size it is possible to trigger an XSS attack in the home page.
These vulnerabilities can be triggered only by someone who is logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required pages. Moreover, exploitation of the XSS vulnerability related to the font size requires forgery of the pma_fontsize cookie.
In the GIS editor feature, a parameter specifying the geometry type was not correcly validated, opening the door to a local file inclusion attack.
This vulnerability can be triggered only by someone who is logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required page.
With a crafted file name it is possible to trigger an XSS in the error reporting page.
This vulnerability can be triggered only by someone who is logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required page.
In the error reporting feature, a parameter specifying the file was not correctly validated, allowing the attacker to derive the line count of an arbitrary file
This vulnerability can be triggered only by someone who is logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required page.
Albert Aastals Cid reports:
kwebkitpart and the bookmarks:// io slave were not sanitizing input correctly allowing to some javascript being executed on the context of the referenced hostname.
Whilst in most cases, the JavaScript will be executed in an untrusted context, with the bookmarks IO slave, it will be executed in the context of the referenced hostname. It should however be noted that KDE mitigates this risk by attempting to ensure that such URLs cannot be embedded directly into Internet hosted content.
Yii PHP Framework developers report:
We are releasing Yii 1.1.15 to fix a security issue found in 1.1.14. We urge all 1.1.14 users to upgrade their Yii to this latest release. Note that the issue only affects 1.1.14. All previous releases are not affected. Upgrading to this release from 1.1.14 is very safe and will not break your existing code.
The vulnerability is in the CDetailView widget. When a Yii application uses this widget and configures the "value" property of a CDetailView attribute using end user inputs, it may allow attackers to potentially execute arbitrary PHP scripts on the server. We are not showing how to exploit it here to allow users to upgrade before details about the exploit become publicly known. To our knowledge the details of this issue are only known to core team members.
Google Chrome Releases reports:
42 security fixes in this release, including:
- [389734] High CVE-2014-7899: Address bar spoofing. Credit to Eli Grey.
- [406868] High CVE-2014-7900: Use-after-free in pdfium. Credit to Atte Kettunen from OUSPG.
- [413375] High CVE-2014-7901: Integer overflow in pdfium. Credit to cloudfuzzer.
- [414504] High CVE-2014-7902: Use-after-free in pdfium. Credit to cloudfuzzer.
- [414525] High CVE-2014-7903: Buffer overflow in pdfium. Credit to cloudfuzzer.
- [418161] High CVE-2014-7904: Buffer overflow in Skia. Credit to Atte Kettunen from OUSPG.
- [421817] High CVE-2014-7905: Flaw allowing navigation to intents that do not have the BROWSABLE category. Credit to WangTao(neobyte) of Baidu X-Team.
- [423030] High CVE-2014-7906: Use-after-free in pepper plugins. Credit to Chen Zhang (demi6od) of the NSFOCUS Security Team.
- [423703] High CVE-2014-0574: Double-free in Flash. Credit to biloulehibou.
- [424453] High CVE-2014-7907: Use-after-free in blink. Credit to Chen Zhang (demi6od) of the NSFOCUS Security Team.
- [425980] High CVE-2014-7908: Integer overflow in media. Credit to Christoph Diehl.
- [391001] Medium CVE-2014-7909: Uninitialized memory read in Skia. Credit to miaubiz.
- CVE-2014-7910: Various fixes from internal audits, fuzzing and other initiatives.
David Edmundson reports:
KDE workspace configuration module for setting the date and time has a helper program which runs as root for performing actions. This is secured with polkit.
This helper takes the name of the ntp utility to run as an argument. This allows a hacker to run any arbitrary command as root under the guise of updating the time.
An application can gain root priveledges from an admin user with either misleading information or no interaction.
On some systems the user will be shown a prompt to change the time. However, if the system has policykit-desktop-privileges installed, the datetime helper will be invoked by an admin user without any prompts.
Simon McVittie reports:
The patch issued by the D-Bus maintainers for CVE-2014-3636 was based on incorrect reasoning, and does not fully prevent the attack described as "CVE-2014-3636 part A", which is repeated below. Preventing that attack requires raising the system dbus-daemon's RLIMIT_NOFILE (ulimit -n) to a higher value. CVE-2014-7824 has been allocated for this vulnerability.
MITRE reports:
Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, and consequently execute arbitrary code, via a LIST response that references the same filename within two entries, one of which indicates that the filename is for a symlink.
Konversation developers report:
Konversation's Blowfish ECB encryption support assumes incoming blocks to be the expected 12 bytes. The lack of a sanity-check for the actual size can cause a denial of service and an information leak to the local user.
TWiki developers report:
The debugenableplugins request parameter allows arbitrary Perl code execution.
Using an HTTP GET request towards a TWiki server, add a specially crafted debugenableplugins request parameter to TWiki's view script (typically port 80/TCP). Prior authentication may or may not be necessary.
A remote attacker can execute arbitrary Perl code to view and modify any file the webserver user has access to.
Example: http://www.example.com/do/view/Main/WebHome?debugenableplugins=BackupRestorePlugin%3bprint("Content-Type:text/html\r\n\r\nVulnerable!")%3bexit
The TWiki site is vulnerable if you see a page with text "Vulnerable!".
Kohsuke Kawaguchi from Jenkins team reports:
Historically, Jenkins master and slaves behaved as if they altogether form a single distributed process. This means a slave can ask a master to do just about anything within the confinement of the operating system, such as accessing files on the master or trigger other jobs on Jenkins.
This has increasingly become problematic, as larger enterprise deployments have developed more sophisticated trust separation model, where the administators of a master might take slaves owned by other teams. In such an environment, slaves are less trusted than the master. Yet the "single distributed process" assumption was not communicated well to the users, resulting in vulnerabilities in some deployments.
SECURITY-144 (CVE-2014-3665) introduces a new subsystem to address this problem. This feature is off by default for compatibility reasons. See Wiki for more details, who should turn this on, and implications.
CVE-2014-3566 is rated high. It only affects installations that accept slaves from less trusted computers, but this will allow an owner of of such slave to mount a remote code execution attack on Jenkins.
Aris Adamantiadis reports:
When accepting a new connection, the server forks and the child process handles the request. The RAND_bytes() function of openssl doesn't reset its state after the fork, but simply adds the current process id (getpid) to the PRNG state, which is not guaranteed to be unique.
The pidgin development team reports:
.
The phpMyAdmin development team reports:
With a crafted database or table name it is possible to trigger an XSS in SQL debug output when enabled and in server monitor page when viewing and analysing executed queries.
This vulnerability can be triggered only by someone who is logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required pages. Moreover, debugging SQL is a developer option which is disabled by default and expected to be disabled in production environments.
The Asterisk project reports:
The POODLE vulnerability is described under CVE-2014-3566. This advisory describes the Asterisk's project susceptibility to this vulnerability.
RedHat reports:
A denial of service flaw was found in libxml2, a library providing support to read, modify and write XML and HTML files. A remote attacker could provide a specially crafted XML file that, when processed by an application using libxml2, would lead to excessive CPU consumption (denial of service) based on excessive entity substitutions, even if entity substitution was disabled, which is the parser default behavior.
Drupal Security Team reports:
Drupal 7 includes a database abstraction API to ensure that queries executed against the database are sanitized to prevent SQL injection attacks. A vulnerability in this API allows an attacker to send specially crafted requests resulting in arbitrary SQL execution. Depending on the content of the requests this can lead to privilege escalation, arbitrary PHP execution, or other attacks. This vulnerability can be exploited by anonymous users.
The OpenSSL Project reports:
A flaw in the DTLS SRTP extension parsing code allows an attacker, who sends a carefully crafted handshake message, to cause OpenSSL to fail to free up to 64k of memory causing a memory leak. This could be exploited in a Denial Of Service attack. This issue affects OpenSSL 1.0.1 server implementations for both SSL/TLS and DTLS regardless of whether SRTP is used or configured. Implementations of OpenSSL that have been compiled with OPENSSL_NO_SRTP defined are not affected. [CVE-2014-3513].
When an OpenSSL SSL/TLS/DTLS server receives a session ticket the integrity of that ticket is first verified. In the event of a session ticket integrity check failing, OpenSSL will fail to free memory causing a memory leak. By sending a large number of invalid session tickets an attacker could exploit this issue in a Denial Of Service attack. [CVE-2014-3567].
OpenSSL has added support for TLS_FALLBACK_SCSV to allow applications to block the ability for a MITM attacker to force a protocol downgrade.
Some client applications (such as browsers) will reconnect using a downgraded protocol to work around interoperability bugs in older servers. This could be exploited by an active man-in-the-middle to downgrade connections to SSL 3.0 even if both sides of the connection support higher protocols. SSL 3.0 contains a number of weaknesses including POODLE [CVE-2014-3566].
When OpenSSL is configured with "no-ssl3" as a build option, servers could accept and complete a SSL 3.0 handshake, and clients could be configured to send them. [CVE-2014-3568].
The Mozilla Project reports:
MFSA 2014-74 Miscellaneous memory safety hazards (rv:33.0 / rv:31.2)
MFSA 2014-75 Buffer overflow during CSS manipulation
MFSA 2014-76 Web Audio memory corruption issues with custom waveforms
MFSA 2014-78 Further uninitialized memory use during GIF
MFSA 2014-79 Use-after-free interacting with text directionality
MFSA 2014-80 Key pinning bypasses
MFSA 2014-81 Inconsistent video sharing within iframe
MFSA 2014-82 Accessing cross-origin objects via the Alarms API
Foreman Security reports:
The smart proxy when running in an SSL-secured mode permits incoming API calls to any endpoint without requiring, or performing any verification of an SSL client certificate. This permits any client with access to the API to make requests and perform actions permitting control of Puppet CA, DHCP, DNS etc.)
Google Chrome Releases reports:
159 security fixes in this release, including 113 found using MemorySanitizer:
- [416449] Critical CVE-2014-3188: A special thanks to Jüri Aedla for a combination of V8 and IPC bugs that can lead to remote code execution outside of the sandbox.
- [398384] High CVE-2014-3189: Out-of-bounds read in PDFium. Credit to cloudfuzzer.
- [400476] High CVE-2014-3190: Use-after-free in Events. Credit to cloudfuzzer.
- [402407] High CVE-2014-3191: Use-after-free in Rendering. Credit to cloudfuzzer.
- [403276] High CVE-2014-3192: Use-after-free in DOM. Credit to cloudfuzzer.
- [399655] High CVE-2014-3193: Type confusion in Session Management. Credit to miaubiz.
- [401115] High CVE-2014-3194: Use-after-free in Web Workers. Credit to Collin Payne.
- [403409] Medium CVE-2014-3195: Information Leak in V8. Credit to Jüri Aedla.
- [338538] Medium CVE-2014-3196: Permissions bypass in Windows Sandbox. Credit to James Forshaw.
- [396544] Medium CVE-2014-3197: Information Leak in XSS Auditor. Credit to Takeshi Terada.
- [415307] Medium CVE-2014-3198: Out-of-bounds read in PDFium. Credit to Atte Kettunen of OUSPG.
- [395411] Low CVE-2014-3199: Release Assert in V8 bindings. Credit to Collin Payne.
- [420899] CVE-2014-3200: Various fixes from internal audits, fuzzing and other initiatives (Chrome 38).
- Multiple vulnerabilities in V8 fixed at the tip of the 3.28 branch (currently 3.28.71.15).
Bugzilla Security Advisory
Unauthorized Account Creation
An attacker creating a new Bugzilla account can override certain parameters when finalizing the account creation that can lead to the user being created with a different email address than originally requested. The overridden login name could be automatically added to groups based on the group's regular expression setting.
Cross-Site Scripting
During an audit of the Bugzilla code base, several places were found where cross-site scripting exploits could occur which could allow an attacker to access sensitive information.
Information Leak
If a new comment was marked private to the insider group, and a flag was set in the same transaction, the comment would be visible to flag recipients even if they were not in the insider group.
Social Engineering
Search results can be exported as a CSV file which can then be imported into external spreadsheet programs. Specially formatted field values can be interpreted as formulas which can be executed and used to attack a user's computer.
Best Practical reports:
RT 4.2.0 and above may be vulnerable to arbitrary execution of code by way of CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, or CVE-2014-6271 -- collectively known as "Shellshock." This vulnerability requires a privileged user with access to an RT instance running with SMIME integration enabled; it applies to both mod_perl and fastcgi deployments. If you have already taken upgrades to bash to resolve "Shellshock," you are protected from this vulnerability in RT, and there is no need to apply this patch. This vulnerability has been assigned CVE-2014-7227.
Jenkins Security Advisory:
Description
SECURITY-87/CVE-2014-3661 (anonymous DoS attack through CLI handshake)
This vulnerability allows unauthenticated users with access to Jenkins' HTTP/HTTPS port to mount a DoS attack on Jenkins through thread exhaustion.
SECURITY-110/CVE-2014-3662 (User name discovery)
Anonymous users can test if the user of a specific name exists or not through login attempts.
SECURITY-127&128/CVE-2014-3663 (privilege escalation in job configuration permission)
An user with a permission limited to Job/CONFIGURE can exploit this vulnerability to effectively create a new job, which should have been only possible for users with Job/CREATE permission, or to destroy jobs that he/she does not have access otherwise.
SECURITY-131/CVE-2014-3664 (directory traversal attack)
Users with Overall/READ permission can access arbitrary files in the file system readable by the Jenkins process, resulting in the exposure of sensitive information, such as encryption keys.
SECURITY-138/CVE-2014-3680 (Password exposure in DOM)
If a parameterized job has a default value in a password field, that default value gets exposed to users with Job/READ permission.
SECURITY-143/CVE-2014-3681 (XSS vulnerability in Jenkins core)
Reflected cross-site scripting vulnerability in Jenkins core. An attacker can navigate the user to a carefully crafted URL and have the user execute unintended actions.
SECURITY-150/CVE-2014-3666 (remote code execution from CLI)
Unauthenticated user can execute arbitrary code on Jenkins master by sending carefully crafted packets over the CLI channel.
SECURITY-155/CVE-2014-3667 (exposure of plugin code)
Programs that constitute plugins can be downloaded by anyone with the Overall/READ permission, resulting in the exposure of otherwise sensitive information, such as hard-coded keys in plugins, if any.
SECURITY-159/CVE-2013-2186 (arbitrary file system write)
Security vulnerability in commons fileupload allows unauthenticated attacker to upload arbitrary files to Jenkins master.
SECURITY-149/CVE-2014-1869 (XSS vulnerabilities in ZeroClipboard)
reflective XSS vulnerability in one of the library dependencies of Jenkins.
SECURITY-113/CVE-2014-3678 (XSS vulnerabilities in monitoring plugin)
Monitoring plugin allows an attacker to cause a victim into executing unwanted actions on Jenkins instance.
SECURITY-113/CVE-2014-3679 (hole in access control)
Certain pages in monitoring plugin are visible to anonymous users, allowing them to gain information that they are not supposed to.
Severity
SECURITY-87 is rated medium, as it results in the loss of functionality.
SECURITY-110 is rated medium, as it results in a limited amount of information exposure.
SECURITY-127 and SECURITY-128 are rated high. The formed can be used to further escalate privileges, and the latter results inloss of data.
SECURITY-131 and SECURITY-138 is rated critical. This vulnerabilities results in exposure of sensitie information and is easily exploitable.
SECURITY-143 is rated high. It is a passive attack, but it can result in a compromise of Jenkins master or loss of data.
SECURITY-150 is rated critical. This attack can be mounted by any unauthenticated anonymous user with HTTP reachability to Jenkins instance, and results in remote code execution on Jenkins.
SECURITY-155 is rated medium. This only affects users who have installed proprietary plugins on publicly accessible instances, which is relatively uncommon.
SECURITY-159 is rated critical. This attack can be mounted by any unauthenticated anonymous user with HTTP reachability to Jenkins instance.
SECURITY-113 is rated high. It is a passive attack, but it can result in a compromise of Jenkins master or loss of data.
Note that this is different than the public "Shellshock" issue.
Specially crafted environment variables could lead to remote arbitrary code execution. This was fixed in bash 4.3.27, however the port was patched with a mitigation in 4.3.25_2.
The phpMyAdmin development team reports:
With a crafted ENUM value it is possible to trigger an XSS in table search and table structure pages. This vulnerability can be triggered only by someone who is logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required pages.
RedHat security team reports:
It was discovered that the fixed-sized redir_stack could be forced to overflow in the Bash parser, resulting in memory corruption, and possibly leading to arbitrary code execution when evaluating untrusted input that would not otherwise be run as code.
An off-by-one error was discovered in the way Bash was handling deeply nested flow control constructs. Depending on the layout of the .bss segment, this could allow arbitrary execution of code that would not otherwise be executed by Bash.
The rsyslog project reports:
potential abort when a message with PRI > 191 was processed if the "pri-text" property was used in active templates, this could be abused to a remote denial of service from permitted senders
The original fix for CVE-2014-3634 was not adequate.
Fish developer David Adam reports:
This release fixes a number of local privilege escalation vulnerability and one remote code execution vulnerability.
Adobe reports:
These updates address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.
The Mozilla Project reports:
Antoine Delignat-Lavaud discovered that NSS is vulnerable to a variant of a signature forgery attack previously published by Daniel Bleichenbacher. This is due to lenient parsing of ASN.1 values involved in a signature and could lead to the forging of RSA certificates.
Google Chrome Releases reports:
[414124] RSA signature malleability in NSS (CVE-2014-1568). Thanks to Antoine Delignat-Lavaud of Prosecco/INRIA, Brian Smith and Advanced Threat Research team at Intel Security
Martin Sandsmark reports:
krfb 4.14 [and earlier] embeds libvncserver which has had several security issues.
Several remotely exploitable security issues have been uncovered in libvncserver, some of which might allow a remote authenticated user code execution or application crashes.
Chet Ramey reports:
Under certain circumstances, bash will execute user code while processing the environment for exported function definitions.
The original fix released for CVE-2014-6271 was not adequate. A similar vulnerability was discovered and tagged as CVE-2014-7169.
The Asterisk project reports:
When an out of call message - delivered by either the SIP or PJSIP channel driver or the XMPP stack - is handled in Asterisk, a crash can occur if the channel servicing the message is sent into the ReceiveFax dialplan application while using the res_fax_spandsp module.
Note that this crash does not occur when using the res_fax_digium module. While this crash technically occurs due to a configuration issue, as attempting to receive a fax from a channel driver that only contains textual information will never succeed, the likelihood of having it occur is sufficiently high as to warrant this advisory.
The squid-cache project reports:
Due to incorrect buffer management Squid can be caused by an attacker to write outside its allocated SNMP buffer.
Simon McVittie reports:
Do not accept an extra fd in the padding of a cmsg message, which could lead to a 4-byte heap buffer overrun (CVE-2014-3635).
Reduce default for maximum Unix file descriptors passed per message from 1024 to 16, preventing a uid with the default maximum number of connections from exhausting the system bus' file descriptors under Linux's default rlimit (CVE-2014-3636).
Disconnect connections that still have a fd pending unmarshalling after a new configurable limit, pending_fd_timeout (defaulting to 150 seconds), removing the possibility of creating an abusive connection that cannot be disconnected by setting up a circular reference to a connection's file descriptor (CVE-2014-3637).
Reduce default for maximum pending replies per connection from 8192 to 128, mitigating an algorithmic complexity denial-of-service attack (CVE-2014-3638).
Reduce default for authentication timeout on the system bus from 30 seconds to 5 seconds, avoiding denial of service by using up all unauthenticated connection slots; and when all unauthenticated connection slots are used up, make new connection attempts block instead of disconnecting them (CVE-2014-3639).
The nginx project reports:
Security: it was possible to reuse SSL sessions in unrelated contexts if a shared SSL session cache or the same TLS session ticket key was used for multiple "server" blocks (CVE-2014-3616).
The phpMyAdmin development team reports:
XSRF/CSRF due to DOM based XSS in the micro history feature.
By deceiving a logged-in user to click on a crafted URL, it is possible to perform remote code execution and in some cases, create a root account due to a DOM based XSS vulnerability in the micro history feature.
OSSEC reports:
This correction will create the temp file for the hosts deny file in /var/ossec and will use mktemp where available to create NON-predictable temp file name. In cases where mktemp is not available we have written a BAD version of mktemp, but should be a little better then just process id.
Google Chrome Releases reports:
4 security fixes in this release, including:
- [401362] High CVE-2014-3178: Use-after-free in rendering. Credit to miaubiz.
- [411014] CVE-2014-3179: Various fixes from internal audits, fuzzing and other initiatives.
Bryan Call reports:
Below is our announcement for the security issue reported to us from Yahoo! Japan. All versions of Apache Traffic Server are vulnerable. We urge users to upgrade to either 4.2.1.1 or 5.0.1 immediately.
This fixes CVE-2014-3525 and limits access to how the health checks are performed.
Google Chrome Releases reports:
50 security fixes in this release, including:
- [386988] Critical CVE-2014-3176, CVE-2014-3177: A special reward to lokihardt@asrt for a combination of bugs in V8, IPC, sync, and extensions that can lead to remote code execution outside of the sandbox.
- [369860] High CVE-2014-3168: Use-after-free in SVG. Credit to cloudfuzzer.
- [387389] High CVE-2014-3169: Use-after-free in DOM. Credit to Andrzej Dyjak.
- [390624] High CVE-2014-3170: Extension permission dialog spoofing. Credit to Rob Wu.
- [390928] High CVE-2014-3171: Use-after-free in bindings. Credit to cloudfuzzer.
- [367567] Medium CVE-2014-3172: Issue related to extension debugging. Credit to Eli Grey.
- [376951] Medium CVE-2014-3173: Uninitialized memory read in WebGL. Credit to jmuizelaar.
- [389219] Medium CVE-2014-3174: Uninitialized memory read in Web Audio. Credit to Atte Kettunen from OUSPG.
- [406143] CVE-2014-3175: Various fixes from internal audits, fuzzing and other initiatives (Chrome 37).
Christos Zoulas reports:
A specially crafted file can cause a segmentation fault.
The Django project reports:
These releases address an issue with reverse() generating external URLs; a denial of service involving file uploads; a potential session hijacking issue in the remote-user middleware; and a data leak in the administrative interface. We encourage all users of Django to upgrade as soon as possible.
The PHP Team reports:
insecure temporary file use in the configure script
unserialize() SPL ArrayObject / SPLObjectStorage Type Confusion
Heap buffer over-read in DateInterval
fileinfo: cdf_read_short_sector insufficient boundary check
fileinfo: CDF infinite loop in nelements DoS
fileinfo: fileinfo: numerous file_printf calls resulting in performance degradation)
Fix potential segfault in dns_check_record()
The phpMyAdmin development team reports:
Multiple XSS vulnerabilities in browse table, ENUM editor, monitor, query charts and table relations pages.
With a crafted database, table or a primary/unique key column name it is possible to trigger an XSS when dropping a row from the table. With a crafted column name it is possible to trigger an XSS in the ENUM editor dialog. With a crafted variable name or a crafted value for unit field it is possible to trigger a self-XSS when adding a new chart in the monitor page. With a crafted value for x-axis label it is possible to trigger a self-XSS in the query chart page. With a crafted relation name it is possible to trigger an XSS in table relations page.
XSS in view operations page.
With a crafted view name it is possible to trigger an XSS when dropping the view in view operation page.
Google Chrome Releases reports:
12 security fixes in this release, including
- [390174] High CVE-2014-3165: Use-after-free in web sockets. Credit to Collin Payne.
- [398925] High CVE-2014-3166: Information disclosure in SPDY. Credit to Antoine Delignat-Lavaud.
- [400950] CVE-2014-3167: Various fixes from internal audits, fuzzing and other initiatives.
serf Development list reports:
Serf provides APIs to retrieve information about a certificate. These APIs return the information as NUL terminated strings (commonly called C strings). X.509 uses counted length strings which may include a NUL byte. This means that a library user will interpret any information as ending upon seeing this NUL byte and will only see a partial value for that field.
Attackers could exploit this vulnerability to create a certificate that a client will accept for a different hostname than the full certificate is actually for by embedding a NUL byte in the certificate.
This can lead to a man-in-the-middle attack. There are no known instances of this problem being exploited in the wild and in practice it should be difficult to actually exploit this vulnerability.
Subversion Project reports:
Using the Serf RA layer of Subversion for HTTPS uses the apr_fnmatch API to handle matching wildcards in certificate Common Names and Subject Alternate Names. However, apr_fnmatch is not designed for this purpose. Instead it is designed to behave like common shell globbing. In particular this means that '*' is not limited to a single label within a hostname (i.e. it will match '.'). But even further apr_fnmatch supports '?' and character classes (neither of which are part of the RFCs defining how certificate validation works).
Subversion stores cached credentials by an MD5 hash based on the URL and the authentication realm of the server the credentials are cached for. MD5 has been shown to be subject to chosen plaintext hash collisions. This means it may be possible to generate an authentication realm which results in the same MD5 hash for a different URL.
The nginx project reports:
Security: pipelined commands were not discarded after STARTTLS command in SMTP proxy (CVE-2014-3556); the bug had appeared in 1.5.6.
The OpenSSL Project reports:
A flaw in OBJ_obj2txt may cause pretty printing functions such as X509_name_oneline, X509_name_print_ex et al. to leak some information from the stack. [CVE-2014-3508]
The issue affects OpenSSL clients and allows a malicious server to crash the client with a null pointer dereference (read) by specifying an SRP ciphersuite even though it was not properly negotiated with the client. [CVE-2014-5139]
If a multithreaded client connects to a malicious server using a resumed session and the server sends an ec point format extension it could write up to 255 bytes to freed memory. [CVE-2014-3509]
An attacker can force an error condition which causes openssl to crash whilst processing DTLS packets due to memory being freed twice. This can be exploited through a Denial of Service attack. [CVE-2014-3505]
An attacker can force openssl to consume large amounts of memory whilst processing DTLS handshake messages. This can be exploited through a Denial of Service attack. [CVE-2014-3506]
By sending carefully crafted DTLS packets an attacker could cause openssl to leak memory. This can be exploited through a Denial of Service attack. [CVE-2014-3507]
OpenSSL DTLS clients enabling anonymous (EC)DH ciphersuites are subject to a denial of service attack. A malicious server can crash the client with a null pointer dereference (read) by specifying an anonymous (EC)DH ciphersuite and sending carefully crafted handshake messages. [CVE-2014-3510]
A flaw in the OpenSSL SSL/TLS server code causes the server to negotiate TLS 1.0 instead of higher protocol versions when the ClientHello message is badly fragmented. This allows a man-in-the-middle attacker to force a downgrade to TLS 1.0 even if both the server and the client support a higher protocol version, by modifying the client's TLS records. [CVE-2014-3511]
A malicious client or server can send invalid SRP parameters and overrun an internal buffer. Only applications which are explicitly set up for SRP use are affected. [CVE-2014-3512]
Albert Aastals Cid reports:
krfb embeds libvncserver which embeds liblzo2, it contains various flaws that result in integer overflow problems.
This potentially allows a malicious application to create a possible denial of service or code execution. Due to the need to exploit precise details of the target architecture and threading it is unlikely that remote code execution can be achieved in practice.
Samba developers report:
A malicious browser can send packets that may overwrite the heap of the target nmbd NetBIOS name services daemon. It may be possible to use this to generate a remote code execution vulnerability as the superuser (root).
Tomas Trnka reports:
Gpgme contains a buffer overflow in the gpgsm status handler that could possibly be exploited using a specially crafted certificate.
Martin Sandsmark reports:
The KAuth framework uses polkit-1 API which tries to authenticate using the requestors PID. This is prone to PID reuse race conditions.
This potentially allows a malicious application to pose as another for authentication purposes when executing privileged actions.
The Tor Project reports:
Tor before 0.2.4.23 and 0.2.5 before 0.2.5.6-alpha maintains a circuit after an inbound RELAY_EARLY cell is received by a client, which makes it easier for remote attackers to conduct traffic-confirmation attacks by using the pattern of RELAY and RELAY_EARLY cells as a means of communicating information about hidden service names.
The i2p project reports:
XSS and remote execution vulnerabilities reported by Exodus Intelligence.
Exodus Intelligence reports:
The vulnerability we have found is able to perform remote code execution with a specially crafted payload. This payload can be customized to unmask a user and show the public IP address in which the user connected from within 'a couple of seconds.'
Adobe does not properly restrict the SWF file format, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks against Bugzilla's JSONP endpoint, possibly obtaining sensitive bug information, via a crafted OBJECT element with SWF content satisfying the character-set requirements of a callback API.
Apache HTTP SERVER PROJECT reports:
mod_deflate: The DEFLATE input filter (inflates request bodies) now limits the length and compression ratio of inflated request bodies to avoid denial of service via highly compressed bodies. See directives DeflateInflateLimitRequestBody, DeflateInflateRatioLimit, and DeflateInflateRatioBurst.
mod_cgid: Fix a denial of service against CGI scripts that do not consume stdin that could lead to lingering HTTPD child processes filling up the scoreboard and eventually hanging the server. By default, the client I/O timeout (Timeout directive) now applies to communication with scripts. The CGIDScriptTimeout directive can be used to set a different timeout for communication with scripts.
Fix a race condition in scoreboard handling, which could lead to a heap buffer overflow.
core: HTTP trailers could be used to replace HTTP headers late during request processing, potentially undoing or otherwise confusing modules that examined or modified request headers earlier. Adds "MergeTrailers" directive to restore legacy behavior.
Tomcat Security Team reports:
Tomcat does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
An integer overflow, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.
An integer overflow in parseChunkHeader allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data.
The Mozilla Project reports:
MFSA 2014-66 IFRAME sandbox same-origin access through redirect
MFSA 2014-65 Certificate parsing broken by non-standard character encoding
MFSA 2014-64 Crash in Skia library when scaling high quality images
MFSA 2014-63 Use-after-free while when manipulating certificates in the trusted cache
MFSA 2014-62 Exploitable WebGL crash with Cesium JavaScript library
MFSA 2014-61 Use-after-free with FireOnStateChange event
MFSA 2014-60 Toolbar dialog customization event spoofing
MFSA 2014-59 Use-after-free in DirectWrite font handling
MFSA 2014-58 Use-after-free in Web Audio due to incorrect control message ordering
MFSA 2014-57 Buffer overflow during Web Audio buffering for playback
MFSA 2014-56 Miscellaneous memory safety hazards (rv:31.0 / rv:24.7)
Melissa Stone reports:
The MCollective aes_security public key plugin does not correctly validate certs against the CA. By exploiting this vulnerability within a race/initialization window, an attacker with local access could initiate an unauthorized MCollective client connection with a server, and thus control the mcollective plugins running on that server. This vulnerability requires a collective be configured to use the aes_security plugin. Puppet Enterprise and open source MCollective are not configured to use the plugin and are not vulnerable by default.
Richard J. Moore reports:
The builtin GIF decoder in QtGui prior to Qt 5.3 contained a bug that would lead to a null pointer dereference when loading certain hand crafted corrupt GIF files. This in turn would cause the application loading these hand crafted GIFs to crash.
mod_proxy: Fix crash in Connection header handling which allowed a denial of service attack against a reverse proxy with a threaded MPM.
Fix a race condition in scoreboard handling, which could lead to a heap buffer overflow.
mod_deflate: The DEFLATE input filter (inflates request bodies) now limits the length and compression ratio of inflated request bodies to avoid denial of sevice via highly compressed bodies. See directives DeflateInflateLimitRequestBody, DeflateInflateRatioLimit, and DeflateInflateRatioBurst.
mod_cgid: Fix a denial of service against CGI scripts that do not consume stdin that could lead to lingering HTTPD child processes filling up the scoreboard and eventually hanging the server. By default, the client I/O timeout (Timeout directive) now applies to communication with scripts. The CGIDScriptTimeout directive can be used to set a different timeout for communication with scripts.
The phpMyAdmin development team reports:
Self-XSS due to unescaped HTML output in database structure page.
With a crafted table comment, it is possible to trigger an XSS in database structure page.
Self-XSS due to unescaped HTML output in database triggers page.
When navigating into the database triggers page, it is possible to trigger an XSS with a crafted trigger name.
Multiple XSS in AJAX confirmation messages.
With a crafted column name it is possible to trigger an XSS when dropping the column in table structure page. With a crafted table name it is possible to trigger an XSS when dropping or truncating the table in table operations page.
Access for an unprivileged user to MySQL user list.
An unpriviledged user could view the MySQL user list and manipulate the tabs displayed in phpMyAdmin for them.
Google Chrome Releases reports:
26 security fixes in this release, including
- [380885] Medium CVE-2014-3160: Same-Origin-Policy bypass in SVG. Credit to Christian Schneider.
- [393765] CVE-2014-3162: Various fixes from internal audits, fuzzing and other initiatives.
Richard J. Moore reports:
The POP3 kioslave used by KMail will accept invalid certificates without presenting a dialog to the user due a bug that leads to an inability to display the dialog combined with an error in the way the result is checked.
This flaw allows an active attacker to perform MITM attacks against the ioslave which could result in the leakage of sensitive data such as the authentication details and the contents of emails.
Thijs Kinkhorst reports:
Postfixadmin has an SQL injection vulnerability. This vulnerability is only exploitable by authenticated users able to create new aliases.
Simon McVittie reports:
Alban Crequy at Collabora Ltd. discovered a bug in dbus-daemon's support for file descriptor passing. A malicious process could force system services or user applications to be disconnected from the D-Bus system bus by sending them a message containing a file descriptor, then causing that file descriptor to exceed the kernel's maximum recursion depth (itself introduced to fix a DoS) before dbus-daemon forwards the message to the victim process. Most services and applications exit when disconnected from the system bus, leading to a denial of service.
Additionally, Alban discovered that bug fd.o#79694, a bug previously reported by Alejandro Martínez Suárez which was n believed to be security flaw, could be used for a similar denial of service, by causing dbus-daemon to attempt to forward invalid file descriptors to a victim process when file descriptors become associated with the wrong message.
Michael Niedermayer and Luca Barbato report in upstream ffmpeg:
avutil/lzo: Fix integer overflow
Michael Niedermayer and Luca Barbato report in upstream ffmpeg:
avutil/lzo: Fix integer overflow
Markus Franz Xaver Johannes Oberhumer reports, in the package's NEWS file:
Fixed a potential integer overflow condition in the "safe" decompressor variants which could result in a possible buffer overrun when processing maliciously crafted compressed input data.
As this issue only affects 32-bit systems and also can only happen if you use uncommonly huge buffer sizes where you have to decompress more than 16 MiB (2^24 bytes) compressed bytes within a single function call, the practical implications are limited.
Werner Koch reports:
This release includes a *security fix* to stop a possible DoS using garbled compressed data packets which can be used to put gpg into an infinite loop.
The samba project reports:
A malformed packet can cause the nmbd server to loop the CPU and prevent any further NetBIOS name service.
Valid unicode path names stored on disk can cause smbd to crash if an authenticated client attempts to read them using a non-unicode request.
The phpMyAdmin development team reports:
Self-XSS due to unescaped HTML output in recent/favorite tables navigation.
When marking a crafted database or table name as favorite or having it in recent tables, it is possible to trigger an XSS.
This vulnerability can be triggered only by someone who logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required form.
Self-XSS due to unescaped HTML output in navigation items hiding feature.
When hiding or unhiding a crafted table name in the navigation, it is possible to trigger an XSS.
This vulnerability can be triggered only by someone who logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required form.
Erik Ekman of the iodine project reports:
The client could bypass the password check by continuing after getting error from the server and guessing the network parameters. The server would still accept the rest of the setup and also network traffic.
The Asterisk project reports:
Asterisk Manager User Unauthorized Shell Access. Manager users can execute arbitrary shell commands with the MixMonitor manager action. Asterisk does not require system class authorization for a manager user to use the MixMonitor action, so any manager user who is permitted to use manager commands can potentially execute shell commands as the user executing the Asterisk process.
Exhaustion of Allowed Concurrent HTTP Connections. Establishing a TCP or TLS connection to the configured HTTP or HTTPS port respectively in http.conf and then not sending or completing a HTTP request will tie up a HTTP session. By doing this repeatedly until the maximum number of open HTTP sessions is reached, legitimate requests are blocked.
Simon MvVittie reports:
Alban Crequy at Collabora Ltd. discovered and fixed a denial-of-service flaw in dbus-daemon, part of the reference implementation of D-Bus. Additionally, in highly unusual environments the same flaw could lead to a side channel between processes that should not be able to communicate.
Google Chrome Releases reports:
4 security fixes in this release, including:
- [369525] High CVE-2014-3154: Use-after-free in filesystem api. Credit to Collin Payne.
- [369539] High CVE-2014-3155: Out-if-bounds read in SPDY. Credit to James March, Daniel Sommermann and Alan Frindell of Facebook.
- [369621] Medium CVE-2014-3156: Buffer overflow in clipboard. Credit to Atte Kettunen of OUSPG.
- [368980] CVE-2014-3157: Heap overflow in media.
The Mozilla Project reports:
MFSA 2014-48 Miscellaneous memory safety hazards (rv:30.0 / rv:24.6)
MFSA 2014-49 Use-after-free and out of bounds issues found using Address Sanitizer
MFSA 2014-51 Use-after-free in Event Listener Manager
MFSA 2014-52 Use-after-free with SMIL Animation Controller
MFSA 2014-53 Buffer overflow in Web Audio Speex resampler
MFSA 2014-54 Buffer overflow in Gamepad API
MFSA 2014-55 Out of bounds write in NSPR
The OpenSSL Project reports:
An attacker using a carefully crafted handshake can force the use of weak keying material in OpenSSL SSL/TLS clients and servers. This can be exploited by a Man-in-the-middle (MITM) attack where the attacker can decrypt and modify traffic from the attacked client and server. [CVE-2014-0224]
By sending an invalid DTLS handshake to an OpenSSL DTLS client the code can be made to recurse eventually crashing in a DoS attack. [CVE-2014-0221]
A buffer overrun attack can be triggered by sending invalid DTLS fragments to an OpenSSL DTLS client or server. This is potentially exploitable to run arbitrary code on a vulnerable client or server. [CVE-2014-0195]
OpenSSL TLS clients enabling anonymous ECDH ciphersuites are subject to a denial of service attack. [CVE-2014-3470]
GnuTLS project reports:
This vulnerability affects the client side of the gnutls library. A server that sends a specially crafted ServerHello could corrupt the memory of a requesting client.
GnuTLS project reports:
This vulnerability affects the client side of the gnutls library. A server that sends a specially crafted ServerHello could corrupt the memory of a requesting client.
Mumble reports:
SVG images with local file references could trigger client DoS
The Mumble client did not properly HTML-escape some external strings before using them in a rich-text (HTML) context.
Mumble reports:
A malformed Opus voice packet sent to a Mumble client could trigger a NULL pointer dereference or an out-of-bounds array access.
A malformed Opus voice packet sent to a Mumble client could trigger a heap-based buffer overflow.
Adobe reports:
These updates address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.
Openjpeg release notes report:
That CVE-2012-3535 and CVE-2012-3358 are fixed in the 1.5.1 release.
That CVE-2013-4289, CVE-2013-4290, CVE-2013-1447, CVE-2013-6045, CVE-2013-6052, CVE-2013-6054, CVE-2013-6053, CVE-2013-6887, where fixed in the 1.5.2 release.
Google Chrome Releases reports:
23 security fixes in this release, including:
- [356653] High CVE-2014-1743: Use-after-free in styles. Credit to cloudfuzzer.
- [359454] High CVE-2014-1744: Integer overflow in audio. Credit to Aaron Staple.
- [346192] High CVE-2014-1745: Use-after-free in SVG. Credit to Atte Kettunen of OUSPG.
- [364065] Medium CVE-2014-1746: Out-of-bounds read in media filters. Credit to Holger Fuhrmannek.
- [330663] Medium CVE-2014-1747: UXSS with local MHTML file. Credit to packagesu.
- [331168] Medium CVE-2014-1748: UI spoofing with scrollbar. Credit to Jordan Milne.
- [374649] CVE-2014-1749: Various fixes from internal audits, fuzzing and other initiatives.
- [358057] CVE-2014-3152: Integer underflow in V8 fixed in version 3.25.28.16.
Google Chrome Releases reports:
3 security fixes in this release:
- [358038] High CVE-2014-1740: Use-after-free in WebSockets. Credit to Collin Payne.
- [349898] High CVE-2014-1741: Integer overflow in DOM ranges. Credit to John Butler.
- [356690] High CVE-2014-1742: Use-after-free in editing. Credit to cloudfuzzer.
Alan Coopersmith reports:
Ilja van Sprundel, a security researcher with IOActive, has discovered several issues in the way the libXfont library handles the responses it receives from xfs servers, and has worked with X.Org's security team to analyze, confirm, and fix these issues.
Most of these issues stem from libXfont trusting the font server to send valid protocol data, and not verifying that the values will not overflow or cause other damage. This code is commonly called from the X server when an X Font Server is active in the font path, so may be running in a setuid-root process depending on the X server in use. Exploits of this path could be used by a local, authenticated user to attempt to raise privileges; or by a remote attacker who can control the font server to attempt to execute code with the privileges of the X server.
CVE MITRE reports:
parser.c in libxml2 before 2.9.0, as used in Google Chrome before 28.0.1500.71 and other products, allows remote attackers to cause a denial of service (out-of-bounds read) via a document that ends abruptly, related to the lack of certain checks for the XML_PARSER_EOF state.
Stefan Cornelius reports:
It was discovered that libxml2, a library providing support to read, modify and write XML files, incorrectly performs entity substitution in the doctype prolog, even if the application using libxml2 disabled any entity substitution. A remote attacker could provide a specially-crafted XML file that, when processed, would lead to the exhaustion of CPU and memory resources or file descriptors.
This issue was discovered by Daniel Berrange of Red Hat.
OpenBSD and David Ramos reports:
Applications that use SSL_MODE_RELEASE_BUFFERS, such as nginx/apache, are prone to a race condition which may allow a remote attacker to crash the current service.
Richard J. Moore reports:
QXmlSimpleReader in Qt versions prior to 5.2 supports expansion of internal entities in XML documents without placing restrictions to ensure the document does not cause excessive memory usage. If an application using this API processes untrusted data then the application may use unexpected amounts of memory if a malicious document is processed.
It is possible to construct XML documents using internal entities that consume large amounts of memory and other resources to process, this is known as the 'Billion Laughs' attack. Qt versions prior to 5.2 did not offer protection against this issue.
strongSwan developers report:
Remote attackers are able to bypass authentication by rekeying an IKE_SA during (1) initiation or (2) re-authentication, which triggers the IKE_SA state to be set to established.
Only installations that actively initiate or re-authenticate IKEv2 IKE_SAs are affected.
The mohawk project reports:
Segfault when parsing malformed / unescaped url, coredump when setting syslog facility.
Google Chrome Releases reports (belatedly):
9 security fixes in this release, including:
- [354967] High CVE-2014-1730: Type confusion in V8. Credit to Anonymous.
- [349903] High CVE-2014-1731: Type confusion in DOM. Credit to John Butler.
- [359802] High CVE-2014-1736: Integer overflow in V8. Credit to SkyLined working with HP's Zero Day Initiative.
- [352851] Medium CVE-2014-1732: Use-after-free in Speech Recognition. Credit to Khalil Zhani.
- [351103] Medium CVE-2014-1733: Compiler bug in Seccomp-BPF. Credit to Jed Davis.
- [367314] CVE-2014-1734: Various fixes from internal audits, fuzzing and other initiatives.
- [359130, 359525, 360429] CVE-2014-1735: Multiple vulnerabilities in V8 fixed in version 3.24.35.33.
The Mozilla Project reports:
MFSA 2014-34 Miscellaneous memory safety hazards (rv:29.0 / rv:24.5)
MFSA 2014-35 Privilege escalation through Mozilla Maintenance Service Installer
MFSA 2014-36 Web Audio memory corruption issues
MFSA 2014-37 Out of bounds read while decoding JPG images
MFSA 2014-38 Buffer overflow when using non-XBL object as XBL
MFSA 2014-39 Use-after-free in the Text Track Manager for HTML video
MFSA 2014-41 Out-of-bounds write in Cairo
MFSA 2014-42 Privilege escalation through Web Notification API
MFSA 2014-43 Cross-site scripting (XSS) using history navigations
MFSA 2014-44 Use-after-free in imgLoader while resizing images
MFSA 2014-45 Incorrect IDNA domain name matching for wildcard certificates
MFSA 2014-46 Use-after-free in nsHostResolve
MFSA 2014-47 Debugger can bypass XrayWrappers with JavaScript
The Django project reports:
These releases address an unexpected code-execution issue, a caching issue which can expose CSRF tokens and a MySQL typecasting issue. While these issues present limited risk and may not affect all Django users, we encourage all users to evaluate their own risk and upgrade as soon as possible.
Applications that use SSL_MODE_RELEASE_BUFFERS, such as nginx, are prone to a race condition which may allow a remote attacker to inject random data into other connections.
The login form had no CSRF protection, meaning that an attacker could force the victim to log in using the attacker's credentials. If the victim then reports a new security sensitive bug, the attacker would get immediate access to this bug.
Due to changes involved in the Bugzilla API, this fix is not backported to the 4.0 and 4.2 branches, meaning that Bugzilla 4.0.12 and older, and 4.2.8 and older, will remain vulnerable to this issue.
Dangerous control characters can be inserted into Bugzilla, notably into bug comments. If the text, which may look safe, is copied into a terminal such as xterm or gnome-terminal, then unexpected commands could be executed on the local machine.
Jan Lieskovsky reports:
OpenLDAP does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority
cURL reports:
When doing GSSAPI authentication, libcurl unconditionally performs credential delegation. This hands the server a copy of the client's security credentials, allowing the server to impersonate the client to any other using the same GSSAPI mechanism.
Sebastian Krahmer reports:
A privilege escalation flaw was found in the way dbus-glib, the D-Bus add-on library to integrate the standard D-Bus library with the GLib thread abstraction and main loop, performed filtering of the message sender (message source subject), when the NameOwnerChanged signal was received. A local attacker could use this flaw to escalate their privileges.
Hamid Zamani reports:
multiple security problems (buffer overflows, format string vulnerabilities and missing input sanitising), which could lead to the execution of arbitrary code.
Debian reports:
Heap-based buffer overflow in msadpcm.c in libaudiofile in audiofile 0.2.6 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted WAV file.
JVN iPedia reports:
ChaSen provided by Nara Institute of Science and Technology is a software for morphologically analyzing Japanese. ChaSen contains an issue when reading in strings, which may lead to a buffer overflow.
An arbitrary script may be executed by an attacker with access to a system that is running a product listed in "Products Affected."
OpenSSL reports:
A flaw in the implementation of Montgomery Ladder Approach would create a side-channel that leaks sensitive timing information.
A local attacker might be able to snoop a signing process and might recover the signing key from it.
The OpenAFS development team reports:
An attacker with the ability to connect to an OpenAFS fileserver can trigger a buffer overflow, crashing the server.
The buffer overflow can be triggered by sending an unauthenticated request for file server statistical information.
Clients are not affected.
Google Chrome Releases reports:
31 vulnerabilities fixed in this release, including:
- [354123] High CVE-2014-1716: UXSS in V8. Credit to Anonymous.
- [353004] High CVE-2014-1717: OOB access in V8. Credit to Anonymous.
- [348332] High CVE-2014-1718: Integer overflow in compositor. Credit to Aaron Staple.
- [343661] High CVE-2014-1719: Use-after-free in web workers. Credit to Collin Payne.
- [356095] High CVE-2014-1720: Use-after-free in DOM. Credit to cloudfuzzer.
- [350434] High CVE-2014-1721: Memory corruption in V8. Credit to Christian Holler.
- [330626] High CVE-2014-1722: Use-after-free in rendering. Credit to miaubiz.
- [337746] High CVE-2014-1723: Url confusion with RTL characters. Credit to George McBay.
- [327295] High CVE-2014-1724: Use-after-free in speech. Credit to Atte Kettunen of OUSPG.
- [357332] Medium CVE-2014-1725: OOB read with window property. Credit to Anonymous
- [346135] Medium CVE-2014-1726: Local cross-origin bypass. Credit to Jann Horn.
- [342735] Medium CVE-2014-1727: Use-after-free in forms. Credit to Khalil Zhani.
- [360298] CVE-2014-1728: Various fixes from internal audits, fuzzing and other initiatives.
- [345820, 347262, 348319, 350863, 352982, 355586, 358059] CVE-2014-1729: Multiple vulnerabilities in V8 fixed in version 3.24.35.22.
OpenSSL Reports:
A missing bounds check in the handling of the TLS heartbeat extension can be used to reveal up to 64k of memory to a connected client or server.
Affected users should upgrade to OpenSSL 1.0.1g. Users unable to immediately upgrade can alternatively recompile OpenSSL with -DOPENSSL_NO_HEARTBEATS.
The bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software. This compromises the secret keys used to identify the service providers and to encrypt the traffic, the names and passwords of the users and the actual content. This allows attackers to eavesdrop communications, steal data directly from the services and users and to impersonate services and users.
The code used to handle the Heartbeat Extension does not do sufficient boundary checks on record length, which allows reading beyond the actual payload.
The OTRS Project reports:
An attacker could embed OTRS in a hidden iframe tag of another page, tricking the user into clicking links in OTRS.
oCERT reports:
The LibYAML project is an open source YAML 1.1 parser and emitter written in C.
The library is affected by a heap-based buffer overflow which can lead to arbitrary code execution. The vulnerability is caused by lack of proper expansion for the string passed to the yaml_parser_scan_uri_escapes() function.
A specially crafted YAML file, with a long sequence of percent-encoded characters in a URL, can be used to trigger the overflow.
The Icinga Team reports:
Wrong strlen check against MAX_INPUT_BUFFER without taking '\0' into account [...]
Aaron Reffett reports:
softmagic.c in file ... and libmagic allows context-dependent attackers to cause a denial of service (out-of-bounds memory access and crash) via crafted offsets in the softmagic of a PE executable.
The JSST and the Joomla! Security Center report:
[20140301] - Core - SQL Injection
Inadequate escaping leads to SQL injection vulnerability.
[20140302] - Core - XSS Vulnerability
Inadequate escaping leads to XSS vulnerability in com_contact.
[20140303] - Core - XSS Vulnerability
Inadequate escaping leads to XSS vulnerability.
[20140304] - Core - Unauthorised Logins
Inadequate checking allowed unauthorised logins via GMail authentication.
Jan Kundrát reports:
An SSL stripping vulnerability was discovered in Trojitá, a fast Qt IMAP e-mail client. User's credentials are never leaked, but if a user tries to send an e-mail, the automatic saving into the "sent" or "draft" folders could happen over a plaintext connection even if the user's preferences specify STARTTLS as a requirement.
The nginx project reports:
A bug in the experimental SPDY implementation in nginx was found, which might allow an attacker to cause a heap memory buffer overflow in a worker process by using a specially crafted request, potentially resulting in arbitrary code execution (CVE-2014-0133).
The problem affects nginx 1.3.15 - 1.5.11, compiled with the ngx_http_spdy_module module (which is not compiled by default) and without --with-debug configure option, if the "spdy" option of the "listen" directive is used in a configuration file.
The problem is fixed in nginx 1.5.12, 1.4.7.
The nginx project reports:
A bug in the experimental SPDY implementation in nginx was found, which might allow an attacker to cause a heap memory buffer overflow in a worker process by using a specially crafted request, potentially resulting in arbitrary code execution (CVE-2014-0133).
The problem affects nginx 1.3.15 - 1.5.11, compiled with the ngx_http_spdy_module module (which is not compiled by default) and without --with-debug configure option, if the "spdy" option of the "listen" directive is used in a configuration file.
The problem is fixed in nginx 1.5.12, 1.4.7.
Clean up cookie logging with fewer redundant string parsing passes. Log only cookies with a value assignment. Prevents segfaults when logging truncated cookies.
mod_dav: Keep track of length of cdata properly when removing leading spaces. Eliminates a potential denial of service from specifically crafted DAV WRITE requests.
The Mozilla Project reports:
MFSA 2014-15 Miscellaneous memory safety hazards (rv:28.0 / rv:24.4)
MFSA 2014-16 Files extracted during updates are not always read only
MFSA 2014-17 Out of bounds read during WAV file decoding
MFSA 2014-18 crypto.generateCRMFRequest does not validate type of key
MFSA 2014-19 Spoofing attack on WebRTC permission prompt
MFSA 2014-20 onbeforeunload and Javascript navigation DOS
MFSA 2014-21 Local file access via Open Link in new tab
MFSA 2014-22 WebGL content injection from one domain to rendering in another
MFSA 2014-23 Content Security Policy for data: documents not preserved by session restore
MFSA 2014-24 Android Crash Reporter open to manipulation
MFSA 2014-25 Firefox OS DeviceStorageFile object vulnerable to relative path escape
MFSA 2014-26 Information disclosure through polygon rendering in MathML
MFSA 2014-27 Memory corruption in Cairo during PDF font rendering
MFSA 2014-28 SVG filters information disclosure through feDisplacementMap
MFSA 2014-29 Privilege escalation using WebIDL-implemented APIs
MFSA 2014-30 Use-after-free in TypeObject
MFSA 2014-31 Out-of-bounds read/write through neutering ArrayBuffer objects
MFSA 2014-32 Out-of-bounds write through TypedArrayObject after neutering
Google Chrome Releases reports:
New vulnerabilities after the Pwn2Own competition:
- [352369] Code execution outside sandbox. Credit to VUPEN.
- [352374] High CVE-2014-1713: Use-after-free in Blink bindings
- [352395] High CVE-2014-1714: Windows clipboard vulnerability
- [352420] Code execution outside sandbox. Credit to Anonymous.
- [351787] High CVE-2014-1705: Memory corruption in V8
- [352429] High CVE-2014-1715: Directory traversal issue
Beatrice Torracca and Evgeni Golov report:
A buffer overflow has been discovered that could result in denial of service or potential execution of arbitrary code.
This condition can be triggered by malformed RFC2047 header lines
JonApps reports:
The read-only mode can be bypassed and any command sent to bash session
Samba project reports:
In Samba's SAMR server we neglect to ensure that attempted password changes will update the bad password count, nor set the lockout flags. This would allow a user unlimited attempts against the password by simply calling ChangePasswordUser2 repeatedly.
This is available without any other authentication.
smbcacls can remove a file or directory ACL by mistake.
The Asterisk project reports:
Stack Overflow in HTTP Processing of Cookie Headers. Sending a HTTP request that is handled by Asterisk with a large number of Cookie headers could overflow the stack. You could even exhaust memory if you sent an unlimited number of headers in the request.
Denial of Service Through File Descriptor Exhaustion with chan_sip Session-Timers. An attacker can use all available file descriptors using SIP INVITE requests. Asterisk will respond with code 400, 420, or 422 for INVITEs meeting this criteria. Each INVITE meeting these conditions will leak a channel and several file descriptors. The file descriptors cannot be released without restarting Asterisk which may allow intrusion detection systems to be bypassed by sending the requests slowly.
Remote Crash Vulnerability in PJSIP channel driver. A remotely exploitable crash vulnerability exists in the PJSIP channel driver if the "qualify_frequency" configuration option is enabled on an AOR and the remote SIP server challenges for authentication of the resulting OPTIONS request. The response handling code wrongly assumes that a PJSIP endpoint will always be associated with an outgoing request which is incorrect.
Google Chrome Releases reports:
7 vulnerabilities fixed in this release, including:
- [344881] High CVE-2014-1700: Use-after-free in speech. Credit to Chamal de Silva.
- [342618] High CVE-2014-1701: UXSS in events. Credit to aidanhs.
- [333058] High CVE-2014-1702: Use-after-free in web database. Credit to Collin Payne.
- [338354] High CVE-2014-1703: Potential sandbox escape due to a use-after-free in web sockets.
- [328202, 349079, 345715] CVE-2014-1704: Multiple vulnerabilities in V8 fixed in version 3.23.17.18.
Mateusz Jurczyk reports:
Out of bounds stack-based read/write in cf2_hintmap_build.
This is a critical vulnerability in the CFF Rasterizer code recently contributed by Adobe, leading to potential arbitrary code execution in the context of the FreeType2 library client.
Secunia reports:
Secunia Research has discovered two vulnerabilities in XMMS, which can be exploited by malicious people to compromise a user's system.
1) An integer underflow error exists in the processing of skin bitmap images. This can be exploited to cause a stack-based buffer overflow via specially crafted skin images containing manipulated header information.
Successful exploitation allows execution of arbitrary code.
2) An integer overflow error exists in the processing of skin bitmap images. This can be exploited to cause memory corruption via specially crafted skin images containing manipulated header information.
Successful exploitation may allow the execution of arbitrary code.
The nginx project reports:
A bug in the experimental SPDY implementation in nginx 1.5.10 was found, which might allow an attacker to corrupt worker process memory by using a specially crafted request, potentially resulting in arbitrary code execution (CVE-2014-0088).
The problem only affects nginx 1.5.10 on 32-bit platforms, compiled with the ngx_http_spdy_module module (which is not compiled by default), if the "spdy" option of the "listen" directive is used in a configuration file.
Google Chrome Releases reports:
19 vulnerabilities fixed in this release, including:
- [344492] High CVE-2013-6663: Use-after-free in svg images. Credit to Atte Kettunen of OUSPG.
- [326854] High CVE-2013-6664: Use-after-free in speech recognition. Credit to Khalil Zhani.
- [337882] High CVE-2013-6665: Heap buffer overflow in software rendering. Credit to cloudfuzzer.
- [332023] Medium CVE-2013-6666: Chrome allows requests in flash header request. Credit to netfuzzerr.
- [348175] CVE-2013-6667: Various fixes from internal audits, fuzzing and other initiatives.
- [343964, 344186, 347909] CVE-2013-6668: Multiple vulnerabilities in V8 fixed in version 3.24.35.10.
GnuTLS project reports:
A vulnerability was discovered that affects the certificate verification functions of all gnutls versions. A specially crafted certificate could bypass certificate validation checks. The vulnerability was discovered during an audit of GnuTLS for Red Hat.
Suman Jana reported a vulnerability that affects the certificate verification functions of gnutls 2.11.5 and later versions. A version 1 intermediate certificate will be considered as a CA certificate by default (something that deviates from the documented behavior).
The Fine Free file project reports:
file before 5.17 allows context-dependent attackers to cause a denial of service (infinite recursion, CPU consumption, and crash) via a crafted indirect offset value in the magic of a file.
Vincent Danen via Red Hat Issue Tracker reports:
A vulnerability was reported in Python's socket module, due to a boundary error within the sock_recvfrom_into() function, which could be exploited to cause a buffer overflow. This could be used to crash a Python application that uses the socket.recvfrom_info() function or, possibly, execute arbitrary code with the permissions of the user running vulnerable Python code.
This vulnerable function, socket.recvfrom_into(), was introduced in Python 2.5. Earlier versions are not affected by this flaw.
Subversion Project reports:
Subversion's mod_dav_svn Apache HTTPD server module will crash when it receives an OPTIONS request against the server root and Subversion is configured to handle the server root and SVNListParentPath is on. This can lead to a DoS. There are no known instances of this problem being exploited in the wild, but the details of how to exploit it have been disclosed on the Subversion development mailing list.
The OTRS Project reports:
An attacker could send a specially prepared HTML email to OTRS. If he can then trick an agent into following a special link to display this email, JavaScript code would be executed.
Google Chrome Releases reports:
28 security fixes in this release, including:
- [334897] High CVE-2013-6652: Issue with relative paths in Windows sandbox named pipe policy. Credit to tyranid.
- [331790] High CVE-2013-6653: Use-after-free related to web contents. Credit to Khalil Zhani.
- [333176] High CVE-2013-6654: Bad cast in SVG. Credit to TheShow3511.
- [293534] High CVE-2013-6655: Use-after-free in layout. Credit to cloudfuzzer.
- [331725] High CVE-2013-6656: Information leak in XSS auditor. Credit to NeexEmil.
- [331060] Medium CVE-2013-6657: Information leak in XSS auditor. Credit to NeexEmil.
- [322891] Medium CVE-2013-6658: Use-after-free in layout. Credit to cloudfuzzer.
- [306959] Medium CVE-2013-6659: Issue with certificates validation in TLS handshake. Credit to Antoine Delignat-Lavaud and Karthikeyan Bhargavan from Prosecco, Inria Paris.
- [332579] Low CVE-2013-6660: Information leak in drag and drop. Credit to bishopjeffreys.
- [344876] Low-High CVE-2013-6661: Various fixes from internal audits, fuzzing and other initiatives. Of these, seven are fixes for issues that could have allowed for sandbox escapes from compromised renderers.
PostgreSQL Project reports:
This update fixes CVE-2014-0060, in which PostgreSQL did not properly enforce the WITH ADMIN OPTION permission for ROLE management. Before this fix, any member of a ROLE was able to grant others access to the same ROLE regardless if the member was given the WITH ADMIN OPTION permission. It also fixes multiple privilege escalation issues, including: CVE-2014-0061, CVE-2014-0062, CVE-2014-0063, CVE-2014-0064, CVE-2014-0065, and CVE-2014-0066. More information on these issues can be found on our security page and the security issue detail wiki page.
With this release, we are also alerting users to a known security hole that allows other users on the same machine to gain access to an operating system account while it is doing "make check": CVE-2014-0067. "Make check" is normally part of building PostgreSQL from source code. As it is not possible to fix this issue without causing significant issues to our testing infrastructure, a patch will be released separately and publicly. Until then, users are strongly advised not to run "make check" on machines where untrusted users have accounts.
The phpMyAdmin development team reports:
When importing a file with crafted filename, it is possible to trigger an XSS. We consider this vulnerability to be non critical.
Jenkins Security Advisory reports:
This advisory announces multiple security vulnerabilities that were found in Jenkins core.
iSECURITY-105
In some places, Jenkins XML API uses XStream to deserialize arbitrary content, which is affected by CVE-2013-7285 reported against XStream. This allows malicious users of Jenkins with a limited set of permissions to execute arbitrary code inside Jenkins master.
SECURITY-76 & SECURITY-88 / CVE-2013-5573
Restrictions of HTML tags for user-editable contents are too lax. This allows malicious users of Jenkins to trick other unsuspecting users into providing sensitive information.
SECURITY-109
Plugging a hole in the earlier fix to SECURITY-55. Under some circimstances, a malicious user of Jenkins can configure job X to trigger another job Y that the user has no access to.
SECURITY-108
CLI job creation had a directory traversal vulnerability. This allows a malicious user of Jenkins with a limited set of permissions to overwrite files in the Jenkins master and escalate privileges.
SECURITY-106
The embedded Winstone servlet container is susceptive to session hijacking attack.
SECURITY-93
The password input control in the password parameter definition in the Jenkins UI was serving the actual value of the password in HTML, not an encrypted one. If a sensitive value is set as the default value of such a parameter definition, it can be exposed to unintended audience.
SECURITY-89
Deleting the user was not invalidating the API token, allowing users to access Jenkins when they shouldn't be allowed to do so.
SECURITY-80
Jenkins UI was vulnerable to click jacking attacks.
SECURITY-79
"Jenkins' own user database" was revealing the presence/absence of users when login attempts fail.
SECURITY-77
Jenkins had a cross-site scripting vulnerability in one of its cookies. If Jenkins is deployed in an environment that allows an attacker to override Jenkins cookies in victim's browser, this vulnerability can be exploited.
SECURITY-75
Jenkins was vulnerable to session fixation attack. If Jenkins is deployed in an environment that allows an attacker to override Jenkins cookies in victim's browser, this vulnerability can be exploited.
SECURITY-74
Stored XSS vulnerability. A malicious user of Jenkins with a certain set of permissions can cause Jenkins to store arbitrary HTML fragment.
SECURITY-73
Some of the system diagnostic functionalities were checking a lesser permission than it should have. In a very limited circumstances, this can cause an attacker to gain information that he shouldn't have access to.
Severity
- SECURITY-106, and SECURITY-80 are rated high. An attacker only needs direct HTTP access to the server to mount this attack.
- SECURITY-105, SECURITY-109, SECURITY-108, and SECURITY-74 are rated high. These vulnerabilities allow attackes with valid Jenkins user accounts to escalate privileges in various ways.
- SECURITY-76, SECURIT-88, and SECURITY-89 are rated medium. These vulnerabilities requires an attacker to be an user of Jenkins, and the mode of the attack is limited.
- SECURITY-93, and SECURITY-79 are rated low. These vulnerabilities only affect a small part of Jenkins and has limited impact.
- SECURITY-77, SECURITY-75, and SECURITY-73 are rated low. These vulnerabilities are hard to exploit unless combined with other exploit in the network.
lighttpd security advisories report:
It is possible to inadvertantly enable vulnerable ciphers when using ssl.cipher-list.
In certain cases setuid() and similar can fail, potentially triggering lighttpd to restart running as root.
If FAMMonitorDirectory fails, the memory intended to store the context is released; some lines below the "version" compoment of that context is read. Reading invalid data doesn't matter, but the memory access could trigger a segfault.
The phpMyFAQ team reports:
An arbitrary script may be executed on the user's Internet Explorer when using an older version of the browser. If a user views a malicious page while logged in, settings may be changed unintentionally.
Adobe reports:
These updates address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.
The Mozilla Project reports:
MFSA 2014-01 Miscellaneous memory safety hazards (rv:27.0 / rv:24.3)
MFSA 2014-02 Clone protected content with XBL scopes
MFSA 2014-03 UI selection timeout missing on download prompts
MFSA 2014-04 Incorrect use of discarded images by RasterImage
MFSA 2014-05 Information disclosure with *FromPoint on iframes
MFSA 2014-06 Profile path leaks to Android system log
MFSA 2014-07 XSLT stylesheets treated as styles in Content Security Policy
MFSA 2014-08 Use-after-free with imgRequestProxy and image proccessing
MFSA 2014-09 Cross-origin information leak through web workers
MFSA 2014-10 Firefox default start page UI content invokable by script
MFSA 2014-11 Crash when using web workers with asm.js
MFSA 2014-12 NSS ticket handling issues
MFSA 2014-13 Inconsistent JavaScript handling of access to Window objects
libyaml was prone to a heap overflow that could result in arbitrary code execution. Pkg uses libyaml to parse the package manifests in some cases. Pkg also used libyaml to parse the remote repository until 1.2.
RedHat Product Security Team reports on libyaml:
A heap-based buffer overflow flaw was found in the way libyaml parsed YAML tags. A remote attacker could provide a specially-crafted YAML document that, when parsed by an application using libyaml, would cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application.
Florian Weimer of the Red Hat Product Security Team reports:
Due to a missing check during assembly of the HTTP request line a long target server name in the PROXY-CONNECT address can cause a stack buffer overrun. Exploitation requires that the attacker is able to provide the target server name to the PROXY-CONNECT address in the command line. This can happen for example in scripts that receive data from untrusted sources.
The OTRS Project reports:
SQL injection issue
An attacker that managed to take over the session of a logged in customer could create tickets and/or send follow-ups to existing tickets due to missing challenge token checks.
Google Chrome Releases reports:
14 security fixes in this release, including:
- [330420] High CVE-2013-6649: Use-after-free in SVG images. Credit to Atte Kettunen of OUSPG.
- [331444] High CVE-2013-6650: Memory corruption in V8. This issue was fixed in v8 version 3.22.24.16. Credit to Christian Holler.
The RT development team reports:
Versions of RT between 4.2.0 and 4.2.2 (inclusive) are vulnerable to a denial-of-service attack via the email gateway; any installation which accepts mail from untrusted sources is vulnerable, regardless of the permissions configuration inside RT. This vulnerability is assigned CVE-2014-1474.
This vulnerability is caused by poor parsing performance in the Email::Address::List module, which RT depends on. We recommend that affected users upgrade their version of Email::Address::List to v0.02 or above, which resolves the issue. Due to a communications mishap, the release on CPAN will temporarily appear as "unauthorized," and the command-line cpan client will hence not install it. We expect this to be resolved shortly; in the meantime, the release is also available from our server.
strongSwan Project reports:
A DoS vulnerability triggered by crafted IKEv1 fragmentation payloads was discovered in strongSwan's IKE daemon charon. All versions since 5.0.2 are affected.
A DoS vulnerability and potential authorization bypass triggered by a crafted ID_DER_ASN1_DN ID payload was discovered in strongSwan. All versions since 4.3.3 are affected.
A DoS vulnerability in strongSwan was discovered, which is triggered by XAuth usernames and EAP identities in versions 5.0.3 and 5.0.4.
Varnish Cache Project reports:
If Varnish receives a certain illegal request, and the subroutine 'vcl_error{}' restarts the request, the varnishd worker process will crash with an assert.
The varnishd management process will restart the worker process, but there will be a brief interruption of service and the cache will be emptied, causing more traffic to go to the backend.
We are releasing this advisory because restarting from vcl_error{} is both fairly common and documented.
This is purely a denial of service vulnerability, there is no risk of privilege escalation.
Workaround
Insert this at the top of your VCL file:
sub vcl_error { if (obj.status == 400 || obj.status == 413) { return(deliver); } } Or add this test at the top of your existing vcl_error{}.
Adobe reports:
These updates address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.
Michael Sweet reports:
HTMLDOC 1.8.28 fixes some known security issues and formatting bugs. Changes include:
- SECURITY: Fixed three buffer overflow issues when reading AFM files and parsing page sizes.
Oracle reports:
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.22, and 4.3.6 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core.
Google Chrome Releases reports:
11 security fixes in this release, including:
- [249502] High CVE-2013-6646: Use-after-free in web workers. Credit to Collin Payne.
- [326854] High CVE-2013-6641: Use-after-free related to forms. Credit to Atte Kettunen of OUSPG.
- [324969] High CVE-2013-6642: Address bar spoofing in Chrome for Android. Credit to lpilorz.
- [321940] High CVE-2013-6643: Unprompted sync with an attacker’s Google account. Credit to Joao Lucas Melo Brasio.
- [318791] Medium CVE-2013-6645 Use-after-free related to speech input elements. Credit to Khalil Zhani.
- [333036] CVE-2013-6644: Various fixes from internal audits, fuzzing and other initiatives.
ntp.org reports:
Unrestricted access to the monlist feature in ntp_request.c in ntpd in NTP before 4.2.7p26 allows remote attackers to cause a denial of service (traffic amplification) via forged (1) REQ_MON_GETLIST or (2) REQ_MON_GETLIST_1 requests, as exploited in the wild in December 2013
Use noquery to your default restrictions to block all status queries.
Use disable monitor to disable the ``ntpdc -c monlist'' command while still allowing other status queries.
Eric Stanley reports:
Most CGIs previously incremented the input variable counter twice when it encountered a long key value. This could cause the CGI to read past the end of the list of CGI variables.
ISC reports:
Because of a defect in handling queries for NSEC3-signed zones, BIND can crash with an "INSIST" failure in name.c when processing queries possessing certain properties. By exploiting this defect an attacker deliberately constructing a query with the right properties could achieve denial of service against an authoritative nameserver serving NSEC3-signed zones.
freedesktop.org reports:
A BDF font file containing a longer than expected string can cause a buffer overflow on the stack. Testing in X servers built with Stack Protector restulted in an immediate crash when reading a user-proveded specially crafted font.
As libXfont is used to read user-specified font files in all X servers distributed by X.Org, including the Xorg server which is often run with root privileges or as setuid-root in order to access hardware, this bug may lead to an unprivileged user acquiring root privileges in some systems.
OpenSSL development team reports:
Major changes between OpenSSL 1.0.1e and OpenSSL 1.0.1f [6 Jan 2014]:
- Fix for TLS record tampering bug [CVE-2013-4353]
- Fix for TLS version checking bug [CVE-2013-6449]
- Fix for DTLS retransmission bug [CVE-2013-6450]
Revive reports:
An SQL-injection vulnerability was recently discovered and reported to the Revive Adserver team by Florian Sander. The vulnerability is known to be already exploited to gain unauthorised access to the application using brute force mechanisms, however other kind of attacks might be possible and/or already in use. The risk is rated to be critical as the most common end goal of the attackers is to spread malware to the visitors of all the websites and ad networks that the ad server is being used on.
The vulnerability is also present and exploitable in OpenX Source 2.8.11 and earlier versions, potentially back to phpAdsNew 2.0.x.
cURL project reports:
libcurl is vulnerable to a case of missing out the checking of the certificate CN or SAN name field when the digital signature verification is turned off.
libcurl offers two separate and independent options for verifying a server's TLS certificate. CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST. The first one tells libcurl to verify the trust chain using a CA cert bundle, while the second tells libcurl to make sure that the name fields in the server certificate meets the criteria. Both options are enabled by default.
This flaw had the effect that when an application disabled CURLOPT_SSL_VERIFYPEER, libcurl mistakenly also skipped the CURLOPT_SSL_VERIFYHOST check. Applications can disable CURLOPT_SSL_VERIFYPEER and still achieve security by doing the check on its own using other means.
The curl command line tool is not affected by this problem as it either enables both options or disables both at the same time.
Werner Koch reports:
CVE-2013-4576 has been assigned to this security bug.
The paper describes two attacks. The first attack allows to distinguish keys: An attacker is able to notice which key is currently used for decryption. This is in general not a problem but may be used to reveal the information that a message, encrypted to a commonly not used key, has been received by the targeted machine. We do not have a software solution to mitigate this attack.
The second attack is more serious. It is an adaptive chosen ciphertext attack to reveal the private key. A possible scenario is that the attacker places a sensor (for example a standard smartphone) in the vicinity of the targeted machine. That machine is assumed to do unattended RSA decryption of received mails, for example by using a mail client which speeds up browsing by opportunistically decrypting mails expected to be read soon. While listening to the acoustic emanations of the targeted machine, the smartphone will send new encrypted messages to that machine and re-construct the private key bit by bit. A 4096 bit RSA key used on a laptop can be revealed within an hour.
The Asterisk project reports:
A 16 bit SMS message that contains an odd message length value will cause the message decoding loop to run forever. The message buffer is not on the stack but will be overflowed resulting in corrupted memory and an immediate crash.
External control protocols, such as the Asterisk Manager Interface, often have the ability to get and set channel variables; this allows the execution of dialplan functions. Dialplan functions within Asterisk are incredibly powerful, which is wonderful for building applications using Asterisk. But during the read or write execution, certain diaplan functions do much more. For example, reading the SHELL() function can execute arbitrary commands on the system Asterisk is running on. Writing to the FILE() function can change any file that Asterisk has write access to. When these functions are executed from an external protocol, that execution could result in a privilege escalation.
The phpMyFAQ team reports:
Secunia noticed while analysing the advisory that authenticated users with "Right to add attachments" are able to exploit an already publicly known issue in the bundled Ajax File Manager of phpMyFAQ version 2.8.3, which leads to arbitrary PHP code execution for authenticated users with the permission "Right to add attachments".
Recurity Labs Team project reports:
Zabbix agent is vulnerable to remote command execution from the Zabbix server in some cases.
Stefan Esser reports:
The PHP function openssl_x509_parse() uses a helper function called asn1_time_to_time_t() to convert timestamps from ASN1 string format into integer timestamp values. The parser within this helper function is not binary safe and can therefore be tricked to write up to five NUL bytes outside of an allocated buffer.
This problem can be triggered by x509 certificates that contain NUL bytes in their notBefore and notAfter timestamp fields and leads to a memory corruption that might result in arbitrary code execution.
Depending on how openssl_x509_parse() is used within a PHP application the attack requires either a malicious cert signed by a compromised/malicious CA or can be carried out with a self-signed cert.
The Mozilla Project reports:
MFSA 2013-116 JPEG information leak
MFSA 2013-105 Application Installation doorhanger persists on navigation
MFSA 2013-106 Character encoding cross-origin XSS attack
MFSA 2013-107 Sandbox restrictions not applied to nested object elements
MFSA 2013-108 Use-after-free in event listeners
MFSA 2013-109 Use-after-free during Table Editing
MFSA 2013-110 Potential overflow in JavaScript binary search algorithms
MFSA 2013-111 Segmentation violation when replacing ordered list elements
MFSA 2013-112 Linux clipboard information disclosure though selection paste
MFSA 2013-113 Trust settings for built-in roots ignored during EV certificate validation
MFSA 2013-114 Use-after-free in synthetic mouse movement
MFSA 2013-115 GetElementIC typed array stubs can be generated outside observed typesets
MFSA 2013-116 JPEG information leak
MFSA 2013-117 Mis-issued ANSSI/DCSSI certificate
The Samba project reports:
These are security releases in order to address CVE-2013-4408 (DCE-RPC fragment length field is incorrectly checked) and CVE-2012-6150 (pam_winbind login without require_membership_of restrictions).
Rails weblog:
Rails 3.2.16 and 4.0.2 have been released! These two releases contain important security fixes, so please upgrade as soon as possible! In order to make upgrading as smooth as possible, we've only included commits directly related to each security issue.
The security fixes in 3.2.16 are:
- CVE-2013-4491
- CVE-2013-6414
- CVE-2013-6415
- CVE-2013-6417
The security fixes in 4.0.2 are:
- CVE-2013-4491
- CVE-2013-6414
- CVE-2013-6415
- CVE-2013-6416
- CVE-2013-6417
Drupal Security Team reports:
Multiple vulnerabilities were fixed in the supported Drupal core versions 6 and 7.
- Multiple vulnerabilities due to optimistic cross-site request forgery protection (Form API validation - Drupal 6 and 7)
- Multiple vulnerabilities due to weakness in pseudorandom number generation using mt_rand() (Form API, OpenID and random password generation - Drupal 6 and 7)
- Code execution prevention (Files directory .htaccess for Apache - Drupal 6 and 7)
- Access bypass (Security token validation - Drupal 6 and 7)
- Cross-site scripting (Image module - Drupal 7)
- Cross-site scripting (Color module - Drupal 7)
- Open redirect (Overlay module - Drupal 7)
Google Chrome Releases reports:
15 security fixes in this release, including:
- [307159] Medium CVE-2013-6634: Session fixation in sync related to 302 redirects. Credit to Andrey Labunets.
- [314469] High CVE-2013-6635: Use-after-free in editing. Credit to cloudfuzzer.
- [322959] Medium CVE-2013-6636: Address bar spoofing related to modal dialogs. Credit to Bas Venis.
- [325501] CVE-2013-6637: Various fixes from internal audits, fuzzing and other initiatives.
- [319722] Medium CVE-2013-6638: Buffer overflow in v8. This issue was fixed in v8 version 3.22.24.7. Credit to Jakob Kummerow of the Chromium project.
- [319835] High CVE-2013-6639: Out of bounds write in v8. This issue was fixed in v8 version 3.22.24.7. Credit to Jakob Kummerow of the Chromium project.
- [319860] Medium CVE-2013-6640: Out of bounds read in v8. This issue was fixed in v8 version 3.22.24.7. Credit to Jakob Kummerow of the Chromium project.
The JSST and the Joomla! Security Center report:
[20131101] Core XSS Vulnerability
Inadequate filtering leads to XSS vulnerability in com_contact.
[20131102] Core XSS Vulnerability
Inadequate filtering leads to XSS vulnerability in com_contact, com_weblinks, com_newsfeeds.
[20131103] Core XSS Vulnerability
Inadequate filtering leads to XSS vulnerability in com_contact.
The OpenTTD Team reports:
The problem is caused by incorrectly handling the fact that the aircraft circling the corner airport will be outside of the bounds of the map. In the 'out of fuel' crash code the height of the tile under the aircraft is determined. In this case that means a tile outside of the allocated map array, which could occasionally trigger invalid reads.
Monitorix Project reports:
A serious bug in the built-in HTTP server. It was discovered that the handle_request() routine did not properly perform input sanitization which led into a number of security vulnerabilities. An unauthenticated, remote attacker could exploit this flaw to execute arbitrary commands on the remote host. All users still using older versions are advised to upgrade to this version, which resolves this issue.
Subversion Project reports:
mod_dontdothat does not restrict requests from serf based clients
mod_dontdothat allows you to block update REPORT requests against certain paths in the repository. It expects the paths in the REPORT request to be absolute URLs. Serf based clients send relative URLs instead of absolute URLs in many cases. As a result these clients are not blocked as configured by mod_dontdothat.
mod_dav_svn assertion triggered by non-canonical URLs in autoversioning commits
When SVNAutoversioning is enabled via SVNAutoversioning on commits can be made by single HTTP requests such as MKCOL and PUT. If Subversion is built with assertions enabled any such requests that have non-canonical URLs, such as URLs with a trailing /, may trigger an assert. An assert will cause the Apache process to abort.
Ruby Gem developers report:
The patch for CVE-2013-4363 was insufficiently verified so the combined regular expression for verifying gem version remains vulnerable following CVE-2013-4363.
RubyGems validates versions with a regular expression that is vulnerable to denial of service due to backtracking. For specially crafted RubyGems versions attackers can cause denial of service through CPU consumption.
Ruby Gem developers report:
RubyGems validates versions with a regular expression that is vulnerable to denial of service due to backtracking. For specially crafted RubyGems versions attackers can cause denial of service through CPU consumption.
Ruby developers report:
Any time a string is converted to a floating point value, a specially crafted string can cause a heap overflow. This can lead to a denial of service attack via segmentation faults and possibly arbitrary code execution. Any program that converts input of unknown origin to floating point values (especially common when accepting JSON) are vulnerable.
The Samba project reports:
Samba 4.0.x before 4.0.11 and 4.1.x before 4.1.1, when LDAP or HTTP is provided over SSL, uses world-readable permissions for a private key, which allows local users to obtain sensitive information by reading the key file, as demonstrated by access to the local filesystem on an AD domain controller.
The Samba project reports:
Samba versions 3.2.0 and above (all versions of 3.2.x, 3.3.x, 3.4.x, 3.5.x, 3.6.x, 4.0.x and 4.1.x) do not check the underlying file or directory ACL when opening an alternate data stream.
According to the SMB1 and SMB2+ protocols the ACL on an underlying file or directory should control what access is allowed to alternate data streams that are associated with the file or directory.
The nginx project reports:
Ivan Fratric of the Google Security Team discovered a bug in nginx, which might allow an attacker to bypass security restrictions in certain configurations by using a specially crafted request, or might have potential other impact (CVE-2013-4547).
Google Chrome Releases reports:
[319117] [319125] Critical CVE-2013-6632: Multiple memory corruption issues. Credit to Pinkie Pie.
Adobe reports:
These updates address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.
Google Chrome Releases reports:
25 security fixes in this release, including:
- [268565] Medium CVE-2013-6621: Use after free related to speech input elements. Credit to Khalil Zhani.
- [272786] High CVE-2013-6622: Use after free related to media elements. Credit to cloudfuzzer.
- [282925] High CVE-2013-6623: Out of bounds read in SVG. Credit to miaubiz.
- [290566] High CVE-2013-6624: Use after free related to “id” attribute strings. Credit to Jon Butler.
- [295010] High CVE-2013-6625: Use after free in DOM ranges. Credit to cloudfuzzer.
- [295695] Low CVE-2013-6626: Address bar spoofing related to interstitial warnings. Credit to Chamal de Silva.
- [299892] High CVE-2013-6627: Out of bounds read in HTTP parsing. Credit to skylined.
- [306959] Medium CVE-2013-6628: Issue with certificates not being checked during TLS renegotiation. Credit to Antoine Delignat-Lavaud and Karthikeyan Bhargavan from Prosecco of INRIA Paris.
- [315823] Medium-Critical CVE-2013-2931: Various fixes from internal audits, fuzzing and other initiatives.
- [258723] Medium CVE-2013-6629: Read of uninitialized memory in libjpeg and libjpeg-turbo. Credit to Michal Zalewski of Google.
- [299835] Medium CVE-2013-6630: Read of uninitialized memory in libjpeg-turbo. Credit to Michal Zalewski of Google.
- [296804] High CVE-2013-6631: Use after free in libjingle. Credit to Patrik Höglund of the Chromium project.
The OpenSSH development team reports:
A memory corruption vulnerability exists in the post- authentication sshd process when an AES-GCM cipher (aes128-gcm@openssh.com or aes256-gcm@openssh.com) is selected during kex exchange.
If exploited, this vulnerability might permit code execution with the privileges of the authenticated user and may therefore allow bypassing restricted shell/command configurations.
Either upgrade to 6.4 or disable AES-GCM in the server configuration. The following sshd_config option will disable AES-GCM while leaving other ciphers active:
Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc
Quassel IRC developers report:
SQL injection vulnerability in Quassel IRC before 0.9.1, when Qt 4.8.5 or later and PostgreSQL 8.2 or later are used, allows remote attackers to execute arbitrary SQL commands via a \ (backslash) in a message.
The Mozilla Project reports:
MFSA 2013-93 Miscellaneous memory safety hazards (rv:25.0 / rv:24.1 / rv:17.0.10)
MFSA 2013-94 Spoofing addressbar though SELECT element
MFSA 2013-95 Access violation with XSLT and uninitialized data
MFSA 2013-96 Improperly initialized memory and overflows in some JavaScript functions
MFSA 2013-97 Writing to cycle collected object during image decoding
MFSA 2013-98 Use-after-free when updating offline cache
MFSA 2013-99 Security bypass of PDF.js checks using iframes
MFSA 2013-100 Miscellaneous use-after-free issues found through ASAN fuzzing
MFSA 2013-101 Memory corruption in workers
MFSA 2013-102 Use-after-free in HTML document templates
mod_pagespeed developers report:
Various versions of mod_pagespeed are subject to critical cross-site scripting (XSS) vulnerability, CVE-2013-6111. This permits a hostile third party to execute JavaScript in users' browsers in context of the domain running mod_pagespeed, which could permit theft of users' cookies or data on the site.
Salvatore Bonaccorso reports:
This vulnerability affects the DANE library of gnutls 3.1.x and gnutls 3.2.x. A server that returns more 4 DANE entries could corrupt the memory of a requesting client.
Alan Coopersmith reports:
Pedro Ribeiro (pedrib at gmail.com) reported an issue to the X.Org security team in which an authenticated X client can cause an X server to use memory after it was freed, potentially leading to crash and/or memory corruption.
Dwayne Litzenberger reports:
In PyCrypto before v2.6.1, the Crypto.Random pseudo-random number generator (PRNG) exhibits a race condition that may cause it to generate the same 'random' output in multiple processes that are forked from each other. Depending on the application, this could reveal sensitive information or cryptographic keys to remote attackers.
The wordpress development team reports:
- Block unsafe PHP unserialization that could occur in limited situations and setups, which can lead to remote code execution.
- Prevent a user with an Author role, using a specially crafted request, from being able to create a post "written by" another user.
- Fix insufficient input validation that could result in redirecting or leading a user to another website.
Additionally, we've adjusted security restrictions around file uploads to mitigate the potential for cross-site scripting.
node.js developers report
This release contains a security fix for the http server implementation, please upgrade as soon as possible.
Cross-Site Request Forgery
When a user submits changes to a bug right after another user did, a midair collision page is displayed to inform the user about changes recently made. This page contains a token which can be used to validate the changes if the user decides to submit his changes anyway. A regression in Bugzilla 4.4 caused this token to be recreated if a crafted URL was given, even when no midair collision page was going to be displayed, allowing an attacker to bypass the token check and abuse a user to commit changes on his behalf.
Cross-Site Request Forgery
When an attachment is edited, a token is generated to validate changes made by the user. Using a crafted URL, an attacker could force the token to be recreated, allowing him to bypass the token check and abuse a user to commit changes on his behalf.
Cross-Site Scripting
Some parameters passed to editflagtypes.cgi were not correctly filtered in the HTML page, which could lead to XSS.
Cross-Site Scripting
Due to an incomplete fix for CVE-2012-4189, some incorrectly filtered field values in tabular reports could lead to XSS.
The Dropbear project reports:
A weakness and a vulnerability have been reported in Dropbear SSH Server, which can be exploited by malicious people to disclose certain sensitive information and cause a DoS.
Google Chrome Releases reports:
5 security fixes in this release, including:
- [292422] High CVE-2013-2925: Use after free in XHR. Credit to Atte Kettunen of OUSPG.
- [294456] High CVE-2013-2926: Use after free in editing. Credit to cloudfuzzer.
- [297478] High CVE-2013-2927: Use after free in forms. Credit to cloudfuzzer.
- [305790] High CVE-2013-2928: Various fixes from internal audits, fuzzing and other initiatives.
Apache Project reports:
Fix possible heap buffer overwrite.
Werner Koch reports:
Special crafted input data may be used to cause a denial of service against GPG (GnuPG's OpenPGP part) and some other OpenPGP implementations. All systems using GPG to process incoming data are affected..
xinetd would execute configured TCPMUX services without dropping privilege to match the service configuration allowing the service to run with same privilege as the xinetd process (root).
PolarSSL Project reports:
The researchers Cyril Arnaud and Pierre-Alain Fouque investigated the PolarSSL RSA implementation and discovered a bias in the implementation of the Montgomery multiplication that we used. For which they then show that it can be used to mount an attack on the RSA key. Although their test attack is done on a local system, there seems to be enough indication that this can properly be performed from a remote system as well.
All versions prior to PolarSSL 1.2.9 and 1.3.0 are affected if a third party can send arbitrary handshake messages to your server.
If correctly executed, this attack reveals the entire private RSA key after a large number of attack messages (> 600.000 on a local machine) are sent to show the timing differences.
Google Chrome Releases reports:
50 security fixes in this release, including:
- [223962][270758][271161][284785][284786] Medium CVE-2013-2906: Races in Web Audio. Credit to Atte Kettunen of OUSPG.
- [260667] Medium CVE-2013-2907: Out of bounds read in Window.prototype object. Credit to Boris Zbarsky.
- [265221] Medium CVE-2013-2908: Address bar spoofing related to the “204 No Content” status code. Credit to Chamal de Silva.
- [265838][279277] High CVE-2013-2909: Use after free in inline-block rendering. Credit to Atte Kettunen of OUSPG.
- [269753] Medium CVE-2013-2910: Use-after-free in Web Audio. Credit to Byoungyoung Lee of Georgia Tech Information Security Center (GTISC).
- [271939] High CVE-2013-2911: Use-after-free in XSLT. Credit to Atte Kettunen of OUSPG.
- [276368] High CVE-2013-2912: Use-after-free in PPAPI. Credit to Chamal de Silva and 41.w4r10r(at)garage4hackers.com.
- [278908] High CVE-2013-2913: Use-after-free in XML document parsing. Credit to cloudfuzzer.
- [279263] High CVE-2013-2914: Use after free in the Windows color chooser dialog. Credit to Khalil Zhani.
- [280512] Low CVE-2013-2915: Address bar spoofing via a malformed scheme. Credit to Wander Groeneveld.
- [281256] High CVE-2013-2916: Address bar spoofing related to the “204 No Content” status code. Credit to Masato Kinugawa.
- [281480] Medium CVE-2013-2917: Out of bounds read in Web Audio. Credit to Byoungyoung Lee and Tielei Wang of Georgia Tech Information Security Center (GTISC).
- [282088] High CVE-2013-2918: Use-after-free in DOM. Credit to Byoungyoung Lee of Georgia Tech Information Security Center (GTISC).
- [282736] High CVE-2013-2919: Memory corruption in V8. Credit to Adam Haile of Concrete Data.
- [285742] Medium CVE-2013-2920: Out of bounds read in URL parsing. Credit to Atte Kettunen of OUSPG.
- [286414] High CVE-2013-2921: Use-after-free in resource loader. Credit to Byoungyoung Lee and Tielei Wang of Georgia Tech Information Security Center (GTISC).
- [286975] High CVE-2013-2922: Use-after-free in template element. Credit to Jon Butler.
- [299016] CVE-2013-2923: Various fixes from internal audits, fuzzing and other initiatives (Chrome 30).
- [275803] Medium CVE-2013-2924: Use-after-free in ICU. Upstream bug here.
Graphite developers report:
This release contains several security fixes for cross-site scripting (XSS) as well as a fix for a remote-execution exploit in graphite-web (CVE-2013-5903).
The Django project reports:
These releases address a denial-of-service attack against Django's authentication framework. All users of Django are encouraged to upgrade immediately.
Problem Description:
The nullfs(5) implementation of the VOP_LINK(9) VFS operation does not check whether the source and target of the link are both in the same nullfs instance. It is therefore possible to create a hardlink from a location in one nullfs instance to a file in another, as long as the underlying (source) filesystem is the same.
Impact:
If multiple nullfs views into the same filesystem are mounted in different locations, a user with read access to one of these views and write access to another will be able to create a hard link from the latter to a file in the former, even though they are, from the user's perspective, different filesystems. The user may thereby gain write access to files which are nominally on a read-only filesystem.
Problem Description:
As is commonly the case, the IPv6 and ATM network layer ioctl request handlers are written in such a way that an unrecognized request is passed on unmodified to the link layer, which will either handle it or return an error code.
Network interface drivers, however, assume that the SIOCSIFADDR, SIOCSIFBRDADDR, SIOCSIFDSTADDR and SIOCSIFNETMASK requests have been handled at the network layer, and therefore do not perform input validation or verify the caller's credentials. Typical link-layer actions for these requests may include marking the interface as "up" and resetting the underlying hardware.
Impact:
An unprivileged user with the ability to run arbitrary code can cause any network interface in the system to perform the link layer actions associated with a SIOCSIFADDR, SIOCSIFBRDADDR, SIOCSIFDSTADDR or SIOCSIFNETMASK ioctl request; or trigger a kernel panic by passing a specially crafted address structure which causes a network interface driver to dereference an invalid pointer.
Although this has not been confirmed, the possibility that an attacker may be able to execute arbitrary code in kernel context can not be ruled out.
The Mozilla Project reports:
MFSA 2013-76 Miscellaneous memory safety hazards (rv:24.0 / rv:17.0.9)
MFSA 2013-77 Improper state in HTML5 Tree Builder with templates
MFSA 2013-78 Integer overflow in ANGLE library
MFSA 2013-79 Use-after-free in Animation Manager during stylesheet cloning
MFSA 2013-80 NativeKey continues handling key messages after widget is destroyed
MFSA 2013-81 Use-after-free with select element
MFSA 2013-82 Calling scope for new Javascript objects can lead to memory corruption
MFSA 2013-83 Mozilla Updater does not lock MAR file after signature verification
MFSA 2013-84 Same-origin bypass through symbolic links
MFSA 2013-85 Uninitialized data in IonMonkey
MFSA 2013-86 WebGL Information disclosure through OS X NVIDIA graphic drivers
MFSA 2013-87 Shared object library loading from writable location
MFSA 2013-88 compartment mismatch re-attaching XBL-backed nodes
MFSA 2013-89 Buffer overflow with multi-column, lists, and floats
MFSA 2013-90 Memory corruption involving scrolling
MFSA 2013-91 User-defined properties on DOM proxies get the wrong "this" object
MFSA 2013-92 GC hazard with default compartments and frame chain restoration
Adobe reports:
These updates address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.
The Django project reports:
These releases address a directory-traversal vulnerability in one of Django's built-in template tags. While this issue requires some fairly specific factors to be exploitable, we encourage all users of Django to upgrade promptly.
Subversion Project reports:
svnserve takes a --pid-file option which creates a file containing the process id it is running as. It does not take steps to ensure that the file it has been directed at is not a symlink. If the pid file is in a directory writeable by unprivileged users, the destination could be replaced by a symlink allowing for privilege escalation. svnserve does not create a pid file by default.
All versions are only vulnerable when the --pid-file=ARG option is used.
Cacti release reports:
Multiple security vulnerabilities have been fixed:
- SQL injection vulnerabilities
The Asterisk project reports:
Remote Crash From Late Arriving SIP ACK With SDP
Remote Crash when Invalid SDP is sent in SIP Request
Google Chrome Releases reports:
25 security fixes in this release, including:
- [181617] High CVE-2013-2900: Incomplete path sanitization in file handling. Credit to Krystian Bigaj.
- [254159] Low CVE-2013-2905: Information leak via overly broad permissions on shared memory files. Credit to Christian Jaeger.
- [257363] High CVE-2013-2901: Integer overflow in ANGLE. Credit to Alex Chapman.
- [260105] High CVE-2013-2902: Use after free in XSLT. Credit to cloudfuzzer.
- [260156] High CVE-2013-2903: Use after free in media element. Credit to cloudfuzzer.
- [260428] High CVE-2013-2904: Use after free in document parsing. Credit to cloudfuzzer.
- [274602] CVE-2013-2887: Various fixes from internal audits, fuzzing and other initiatives (Chrome 29).
Bundled version of libav in gstreamer-ffmpeg contains a number of vulnerabilities.
Werner Koch of the GNU project reports:
Noteworthy changes in version 1.5.3:
Mitigate the Yarom/Falkner flush+reload side-channel attack on RSA secret keys...
Note that Libgcrypt is used by GnuPG 2.x and thus this release fixes the above problem. The fix for GnuPG less than 2.0 can be found in the just released GnuPG 1.4.14.
Puppet Labs reports:
By using the `resource_type` service, an attacker could cause puppet to load arbitrary Ruby files from the puppet master node's file system. While this behavior is not enabled by default, `auth.conf` settings could be modified to allow it. The exploit requires local file system access to the Puppet Master.
Puppet Module Tool (PMT) did not correctly control permissions of modules it installed, instead transferring permissions that existed when the module was built.
Mageia security team reports:
It was discovered that Little CMS did not properly verify certain memory allocations. If a user or automated system using Little CMS were tricked into opening a specially crafted file, an attacker could cause Little CMS to crash (CVE-2013-4160).
Paul Bakker reports:
A bug in the logic of the parsing of PEM encoded certificates in x509parse_crt() can result in an infinite loop, thus hogging processing power.
While parsing a Certificate message during the SSL/TLS handshake, PolarSSL extracts the presented certificates and sends them on to be parsed. As the RFC specifies that the certificates in the Certificate message are always X.509 certificates in DER format, bugs in the decoding of PEM certificates should normally not be triggerable via the SSL/TLS handshake.
Versions of PolarSSL prior to 1.1.7 in the 1.1 branch and prior to 1.2.8 in the 1.2 branch call the generic x509parse_crt() function for parsing during the handshake. x509parse_crt() is a generic functions that wraps parsing of both PEM-encoded and DER-formatted certificates. As a result it is possible to craft a Certificate message that includes a PEM encoded certificate in the Certificate message that triggers the infinite loop.
The Samba project reports:
All current released versions of Samba are vulnerable to a denial of service on an authenticated or guest connection. A malformed packet can cause the smbd server to loop the CPU performing memory allocations and preventing any further service.
A connection to a file share, or a local account is needed to exploit this problem, either authenticated or unauthenticated if guest connections are allowed.
The Mozilla Project reports:
MFSA 2013-63 Miscellaneous memory safety hazards (rv:23.0 / rv:17.0.8)
MFSA 2013-64 Use after free mutating DOM during SetBody
MFSA 2013-65 Buffer underflow when generating CRMF requests
MFSA 2013-66 Buffer overflow in Mozilla Maintenance Service and Mozilla Updater
MFSA 2013-67 Crash during WAV audio file decoding
MFSA 2013-68 Document URI misrepresentation and masquerading
MFSA 2013-69 CRMF requests allow for code execution and XSS attacks
MFSA 2013-70 Bypass of XrayWrappers using XBL Scopes
MFSA 2013-71 Further Privilege escalation through Mozilla Updater
MFSA 2013-72 Wrong principal used for validating URI for some Javascript components
MFSA 2013-73 Same-origin bypass with web workers and XMLHttpRequest
MFSA 2013-74 Firefox full and stub installer DLL hijacking
MFSA 2013-75 Local Java applets may read contents of local file system
Simon Tatham reports:
This [0.63] release fixes multiple security holes in previous versions of PuTTY, which can allow an SSH-2 server to make PuTTY overrun or underrun buffers and crash. [...]
These vulnerabilities can be triggered before host key verification, which means that you are not even safe if you trust the server you think you're connecting to, since it could be spoofed over the network and the host key check would not detect this before the attack could take place.
Additionally, when PuTTY authenticated with a user's private key, the private key or information equivalent to it was accidentally kept in PuTTY's memory for the rest of its run, where it could be retrieved by other processes reading PuTTY's memory, or written out to swap files or crash dumps. This release fixes that as well.
Typo Security Team reports:
It has been discovered that TYPO3 Core is vulnerable to Cross-Site Scripting and Remote Code Execution.
TYPO3 bundles flash files for video and audio playback. Old versions of FlowPlayer and flashmedia are susceptible to Cross-Site Scripting. No authentication is required to exploit this vulnerability.
The file upload component and the File Abstraction Layer are failing to check for denied file extensions, which allows authenticated editors (even with limited permissions) to upload php files with arbitrary code, which can then be executed in web server's context.
The phpMyAdmin development team reports:
phpMyAdmin has a number of mechanisms to avoid a clickjacking attack, however these mechanisms either work only in modern browser versions, or can be bypassed.
"We have no solution for 3.5.x, due to the proposed solution requiring JavaScript. We don't want to introduce a dependency to JavaScript in the 3.5.x family."
Google Chrome Releases reports:
Eleven vulnerabilities, including:
[257748] Medium CVE-2013-2881: Origin bypass in frame handling. Credit to Karthik Bhargavan.
[260106] High CVE-2013-2882: Type confusion in V8. Credit to Cloudfuzzer.
[260165] High CVE-2013-2883: Use-after-free in MutationObserver. Credit to Cloudfuzzer.
[248950] High CVE-2013-2884: Use-after-free in DOM. Credit to Ivan Fratric of Google Security Team.
[249640] [257353] High CVE-2013-2885: Use-after-free in input handling. Credit to Ivan Fratric of Google Security Team.
[261701] High CVE-2013-2886: Various fixes from internal audits, fuzzing and other initiatives.
The phpMyAdmin development team reports:
XSS due to unescaped HTML Output when executing a SQL query.
Using a crafted SQL query, it was possible to produce an XSS on the SQL query form.
This vulnerability can be triggered only by someone who logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required form.
5 XSS vulnerabilities in setup, chart display, process list, and logo link.
- In the setup/index.php, using a crafted # hash with a Javascript event, untrusted JS code could be executed.
- In the Display chart view, a chart title containing HTML code was rendered unescaped, leading to possible JavaScript code execution via events.
- A malicious user with permission to create databases or users having HTML tags in their name, could trigger an XSS vulnerability by issuing a sleep query with a long delay. In the server status monitor, the query parameters were shown unescaped.
- By configuring a malicious URL for the phpMyAdmin logo link in the navigation sidebar, untrusted script code could be executed when a user clicked the logo.
- The setup field for "List of trusted proxies for IP allow/deny" Ajax validation code returned the unescaped input on errors, leading to possible JavaScript execution by entering arbitrary HTML.
If a crafted version.json would be presented, an XSS could be introduced.
Due to not properly validating the version.json file, which is fetched from the phpMyAdmin.net website, could lead to an XSS attack, if a crafted version.json file would be presented.
This vulnerability can only be exploited with a combination of complicated techniques and tricking the user to visit a page.
Full path disclosure vulnerabilities.
By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed.
This path disclosure is possible on servers where the recommended setting of the PHP configuration directive display_errors is set to on, which is against the recommendations given in the PHP manual.
XSS vulnerability when a text to link transformation is used.
When the TextLinkTransformationPlugin is used to create a link to an object when displaying the contents of a table, the object name is not properly escaped, which could lead to an XSS, if the object name has a crafted value.
The stored XSS vulnerabilities can be triggered only by someone who logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required forms.
Self-XSS due to unescaped HTML output in schema export.
When calling schema_export.php with crafted parameters, it is possible to trigger an XSS.
This vulnerability can be triggered only by someone who logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required form.
SQL injection vulnerabilities, producing a privilege escalation (control user).
Due to a missing validation of parameters passed to schema_export.php and pmd_pdf.php, it was possible to inject SQL statements that would run with the privileges of the control user. This gives read and write access to the tables of the configuration storage database, and if the control user has the necessary privileges, read access to some tables of the mysql database.
These vulnerabilities can be triggered only by someone who logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required form. Moreover, a control user must have been created and configured as part of the phpMyAdmin configuration storage installation.
The wordpress development team reports:
- Blocking server-side request forgery attacks, which could potentially enable an attacker to gain access to a site
- Disallow contributors from improperly publishing posts
- An update to the SWFUpload external library to fix cross-site scripting vulnerabilities
- Prevention of a denial of service attack, affecting sites using password-protected posts
- An update to an external TinyMCE library to fix a cross-site scripting vulnerability
- Multiple fixes for cross-site scripting
- Avoid disclosing a full file path when a upload fails
ISC reports:
A specially crafted query that includes malformed rdata can cause named to terminate with an assertion failure while rejecting the malformed query.
A Yarom and Falkner paper reports:
Flush+Reload is a cache side-channel attack that monitors access to data in shared pages. In this paper we demonstrate how to use the attack to extract private encryption keys from GnuPG. The high resolution and low noise of the Flush+Reload attack enables a spy program to recover over 98% of the bits of the private key in a single decryption or signing round. Unlike previous attacks, the attack targets the last level L3 cache. Consequently, the spy program and the victim do not need to share the execution core of the CPU. The attack is not limited to a traditional OS and can be used in a virtualised environment, where it can attack programs executing in a different VM.
OpenAFS Project reports:
The small size of the DES key space permits an attacker to brute force a cell's service key and then forge traffic from any user within the cell. The key space search can be performed in under 1 day at a cost of around $100 using publicly available services.
Subversion Project reports:
Subversion's mod_dav_svn Apache HTTPD server module will trigger an assertion on some requests made against a revision root. This can lead to a DoS. If assertions are disabled it will trigger a read overflow which may cause a SEGFAULT (or equivalent) or undefined behavior.
Commit access is required to exploit this.
suPHP developer Sebastian Marsching reports:
When the suPHP_PHPPath was set, mod_suphp would use the specified PHP executable to pretty-print PHP source files (MIME type x-httpd-php-source or application/x-httpd-php-source).
However, it would not sanitize the environment. Thus a user that was allowed to use the SetEnv directive in a .htaccess file (AllowOverride FileInfo) could make PHP load a malicious configuration file (e.g. loading malicious extensions).
As the PHP process for highlighting the source file was run with the privileges of the user Apache HTTPd was running as, a local attacker could probably execute arbitrary code with the privileges of this user.
Apache HTTP SERVER PROJECT reports:
mod_dav: Sending a MERGE request against a URI handled by mod_dav_svn with the source href (sent as part of the request body as XML) pointing to a URI that is not configured for DAV will trigger a segfault.
mod_session_dbd: Make sure that dirty flag is respected when saving sessions, and ensure the session ID is changed each time the session changes. This changes the format of the updatesession SQL statement. Existing configurations must be changed.
Red Hat Security Response Team reports:
Gallery upstream has released 3.0.9 version, correcting two security flaws:
Issue #1 - Improper stripping of URL fragments in flowplayer SWF file might lead to reply attacks (a different flaw than CVE-2013-2138).
Issue #2 - gallery3: Multiple information exposure flaws in data rest core module.
The PHP development team reports:
ext/xml/xml.c in PHP before 5.3.27 does not properly consider parsing depth, which allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a crafted document that is processed by the xml_parse_into_struct function.
The PHP development team reports:
Integer overflow in the SdnToJewish function in jewish.c in the Calendar component in PHP before 5.3.26 and 5.4.x before 5.4.16 allows context-dependent attackers to cause a denial of service (application hang) via a large argument to the jdtojewish function.
Adobe reports:
These updates address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.
Squid project reports:
Due to incorrect data validation Squid is vulnerable to a denial of service attack when processing specially crafted HTTP requests
This problem allows any client who can generate HTTP requests to perform a denial of service attack on the Squid service.
Mark Dowd reports:
Vulnerability 1. Remote Heap Overflow: If an attacker sends a packet larger than 1024 bytes that gets stored temporarily (which occurs many times - such as when sending a ZRTP Hello packet), a heap overflow will occur, leading to potential arbitrary code execution on the vulnerable host.
Vulnerability 2. Multiple Stack Overflows: ZRTPCPP contains multiple stack overflows that arise when preparing a response to a client's ZRTP Hello packet.
Vulnerability 3. Information Leaking / Out of Bounds Reads: The ZRTPCPP library performs very little validation regarding the expected size of a packet versus the actual amount of data received. This can lead to both information leaking and out of bounds data reads (usually resulting in a crash). Information leaking can be performed for example by sending a malformed ZRTP Ping packet.
Ruby Developers report:
Ruby's SSL client implements hostname identity check but it does not properly handle hostnames in the certificate that contain null bytes.
The OTRS Project reports:
An attacker with a valid agent login could manipulate URLs leading to SQL injection. An attacker with a valid agent login could manipulate URLs in the ITSM ConfigItem search, leading to a JavaScript code injection (XSS) problem.
Google Chrome Releases reports:
A special reward for Andrey Labunets for his combination of CVE-2013-2879 and CVE-2013-2868 along with some (since fixed) server-side bugs.
[252216] Low CVE-2013-2867: Block pop-unders in various scenarios.
[252062] High CVE-2013-2879: Confusion setting up sign-in and sync. Credit to Andrey Labunets.
[252034] Medium CVE-2013-2868: Incorrect sync of NPAPI extension component. Credit to Andrey Labunets.
[245153] Medium CVE-2013-2869: Out-of-bounds read in JPEG2000 handling. Credit to Felix Groebert of Google Security Team.
[244746] [242762] Critical CVE-2013-2870: Use-after-free with network sockets. Credit to Collin Payne.
[244260] Medium CVE-2013-2853: Man-in-the-middle attack against HTTP in SSL. Credit to Antoine Delignat-Lavaud and Karthikeyan Bhargavan from Prosecco at INRIA Paris.
[243991] [243818] High CVE-2013-2871: Use-after-free in input handling. Credit to miaubiz.
[Mac only] [242702] Low CVE-2013-2872: Possible lack of entropy in renderers. Credit to Eric Rescorla.
[241139] High CVE-2013-2873: Use-after-free in resource loading. Credit to miaubiz.
[233848] Medium CVE-2013-2875: Out-of-bounds-read in SVG. Credit to miaubiz.
[229504] Medium CVE-2013-2876: Extensions permissions confusion with interstitials. Credit to Dev Akhawe.
[229019] Low CVE-2013-2877: Out-of-bounds read in XML parsing. Credit to Aki Helin of OUSPG.
[196636] None: Remove the "viewsource" attribute on iframes. Credit to Collin Jackson.
[177197] Medium CVE-2013-2878: Out-of-bounds read in text handling. Credit to Atte Kettunen of OUSPG.
The mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator.
mod_dav: Sending a MERGE request against a URI handled by mod_dav_svn with the source href (sent as part of the request body as XML) pointing to a URI that is not configured for DAV will trigger a segfault.
The phpMyAdmin development team reports:
The import.php script was vulnerable to GLOBALS variable injection. Therefore, an attacker could manipulate any configuration parameter.
This vulnerability can be triggered only by someone who logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required form.
The Apache Software Foundation reports:
The attempted fix to address CVE-2013-2154 introduced the possibility of a heap overflow, possibly leading to arbitrary code execution, in the processing of malformed XPointer expressions in the XML Signature Reference processing code.
The Mozilla Project reports:
Miscellaneous memory safety hazards (rv:22.0 / rv:17.0.7)
Title: Memory corruption found using Address Sanitizer
Privileged content access and execution via XBL
Arbitrary code execution within Profiler
Execution of unmapped memory through onreadystatechange
Data in the body of XHR HEAD requests leads to CSRF attacks
SVG filters can lead to information disclosure
PreserveWrapper has inconsistent behavior
Sandbox restrictions not applied to nested frame elements
X-Frame-Options ignored when using server push with multi-part responses
XrayWrappers can be bypassed to run user defined methods in a privileged context
getUserMedia permission dialog incorrectly displays location
Homograph domain spoofing in .com, .net and .name
Inaccessible updater can lead to local privilege escalation
cURL developers report:
libcurl is vulnerable to a case of bad checking of the input data which may lead to heap corruption.
The function curl_easy_unescape() decodes URL-encoded strings to raw binary data. URL-encoded octets are represented with %HH combinations where HH is a two-digit hexadecimal number. The decoded string is written to an allocated memory area that the function returns to the caller.
The function takes a source string and a length parameter, and if the length provided is 0 the function will instead use strlen() to figure out how much data to parse.
The "%HH" parser wrongly only considered the case where a zero byte would terminate the input. If a length-limited buffer was passed in which ended with a '%' character which was followed by two hexadecimal digits outside of the buffer libcurl was allowed to parse alas without a terminating zero, libcurl would still parse that sequence as well. The counter for remaining data to handle would then be decreased too much and wrap to become a very large integer and the copying would go on too long and the destination buffer that is allocated on the heap would get overwritten.
We consider it unlikely that programs allow user-provided strings unfiltered into this function. Also, only the not zero-terminated input string use case is affected by this flaw. Exploiting this flaw for gain is probably possible for specific circumstances but we consider the general risk for this to be low.
The curl command line tool is not affected by this problem as it doesn't use this function.
There are no known exploits available at this time.
Puppet Developers report:
When making REST api calls, the puppet master takes YAML from an untrusted client, deserializes it, and then calls methods on the resulting object. A YAML payload can be crafted to cause the deserialization to construct an instance of any class available in the ruby process, which allows an attacker to execute code contained in the payload.
The OTRS Project reports:
An attacker with a valid agent login could manipulate URLs in the ticket watch mechanism to see contents of tickets they are not permitted to see.
Due to insufficient permission checks in the virtual memory system, a tracing process (such as a debugger) may be able to modify portions of the traced process's address space to which the traced process itself does not have write access.
The Apache Software Foundation reports:
A heap overflow exists in the processing of the PrefixList attribute optionally used in conjunction with Exclusive Canonicalization, potentially allowing arbitary code execution. If verification of the signature occurs prior to actual evaluation of a signing key, this could be exploited by an unauthenticated attacker.
The Tor Project reports:
Disable middle relay queue overfill detection code due to possible guard discovery attack
Simon McVittie reports:
Alexandru Cornea discovered a vulnerability in libdbus caused by an implementation bug in _dbus_printf_string_upper_bound(). This vulnerability can be exploited by a local user to crash system services that use libdbus, causing denial of service. It is platform-specific: x86-64 Linux is known to be affected.
Adobe reports:
These updates address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.
The ownCloud development team reports:
oC-SA-2013-019 / CVE-2013-2045: Multiple SQL Injections. Credit to Mateusz Goik (aliantsoft.pl).
oC-SA-2013-020 / CVE-2013-[2039,2085]: Multiple directory traversals. Credit to Mateusz Goik (aliantsoft.pl).
oC-SQ-2013-021 / CVE-2013-[2040-2042]: Multiple XSS vulnerabilities. Credit to Mateusz Goik (aliantsoft.pl) and Kacper R. (http://devilteam.pl).
oC-SA-2013-022 / CVE-2013-2044: Open redirector. Credit to Mateusz Goik (aliantsoft.pl).
oC-SA-2013-023 / CVE-2013-2047: Password autocompletion.
oC-SA-2013-024 / CVE-2013-2043: Privilege escalation in the calendar application. Credit to Mateusz Goik (aliantsoft.pl).
oC-SA-2013-025 / CVE-2013-2048: Privilege escalation and CSRF in the API.
oC-SA-2013-026 / CVE-2013-2089: Incomplete blacklist vulnerability.
oC-SA-2013-027 / CVE-2013-2086: CSRF token leakage.
oC-SA-2013-028 / CVE-2013-[2149-2150]: Multiple XSS vulnerabilities.
The PHP development team reports:
A Heap-based buffer overflow flaw was found in the php quoted_printable_encode() function. A remote attacker could use this flaw to cause php to crash or execute arbirary code with the permission of the user running php
ISC reports:
A bug has been discovered in the most recent releases of BIND 9 which has the potential for deliberate exploitation as a denial-of-service attack. By sending a recursive resolver a query for a record in a specially malformed zone, an attacker can cause BIND 9 to exit with a fatal "RUNTIME_CHECK" error in resolver.c.
The phpMyAdmin development team reports:
When creating a view with a crafted name and an incorrect CREATE statement, it is possible to trigger an XSS.
This vulnerability can be triggered only by someone who logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required form.
Simon McVittie reports:
This release fixes a man-in-the-middle attack.
If you use an unencrypted connection to a "legacy Jabber" (pre-XMPP) server, this version of Gabble will not connect until you make one of these configuration changes:
. upgrade the server software to something that supports XMPP 1.0; or
. use an encrypted "old SSL" connection, typically on port 5223 (old-ssl); or
. turn off "Encryption required (TLS/SSL)" (require-encryption).
Google Chrome Releases reports:
[242322] Medium CVE-2013-2855: Memory corruption in dev tools API. Credit to "daniel.zulla".
[242224] High CVE-2013-2856: Use-after-free in input handling. Credit to miaubiz.
[240124] High CVE-2013-2857: Use-after-free in image handling. Credit to miaubiz.
[239897] High CVE-2013-2858: Use-after-free in HTML5 Audio. Credit to "cdel921".
[237022] High CVE-2013-2859: Cross-origin namespace pollution. to "bobbyholley".
[225546] High CVE-2013-2860: Use-after-free with workers accessing database APIs. Credit to Collin Payne.
[209604] High CVE-2013-2861: Use-after-free with SVG. Credit to miaubiz.
[161077] High CVE-2013-2862: Memory corruption in Skia GPU handling. Credit to Atte Kettunen of OUSPG.
[232633] Critical CVE-2013-2863: Memory corruption in SSL socket handling. Credit to Sebastian Marchand of the Chromium development community.
[239134] High CVE-2013-2864: Bad free in PDF viewer. Credit to Mateusz Jurczyk, with contributions by Gynvael Coldwind, both from Google Security Team.
[246389] High CVE-2013-2865: Various fixes from internal audits, fuzzing and other initiatives.
freedesktop.org reports:
Ilja van Sprundel, a security researcher with IOActive, has discovered a large number of issues in the way various X client libraries handle the responses they receive from servers, and has worked with X.Org's security team to analyze, confirm, and fix these issues.
Most of these issues stem from the client libraries trusting the server to send correct protocol data, and not verifying that the values will not overflow or cause other damage. Most of the time X clients & servers are run by the same user, with the server more privileged from the clients, so this is not a problem, but there are scenarios in which a privileged client can be connected to an unprivileged server, for instance, connecting a setuid X client (such as a screen lock program) to a virtual X server (such as Xvfb or Xephyr) which the user has modified to return invalid data, potentially allowing the user to escalate their privileges.
The vulnerabilities include:
Integer overflows calculating memory needs for replies.
Sign extension issues calculating memory needs for replies.
Buffer overflows due to not validating length or offset values in replies.
Integer overflows parsing user-specified files.
Unbounded recursion parsing user-specified files.
Memory corruption due to unchecked return values.
No advisory has been released yet.
schpw.c in the kpasswd service in kadmind in MIT Kerberos 5 (aka krb5) before 1.11.3 does not properly validate UDP packets before sending responses, which allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged packet that triggers a communication loop, as demonstrated by krb_pingpong.nasl, a related issue to CVE-1999-0103. [CVE-2002-2443].
Nickolai Zeldovich reports:
An attacker with the ability to manipulate AFS directory ACLs may crash the fileserver hosting that volume. In addition, once a corrupt ACL is placed on a fileserver, its existence may crash client utilities manipulating ACLs on that server.
SecurityFocus reports:
When ModSecurity receives a request body with a size bigger than the value set by the "SecRequestBodyInMemoryLimit" and with a "Content-Type" that has no request body processor mapped to it, ModSecurity will systematically crash on every call to "forceRequestBodyVariable".
The Phusion reports:
A denial of service and arbitrary code execution by hijacking temp files. [CVE-2013-2119]
Subversion team reports:
Subversion's svnserve server process may exit when an incoming TCP connection is closed early in the connection process.
Subversion team reports:
The script contrib/hook-scripts/check-mime-type.pl does not escape argv arguments to 'svnlook' that start with a hyphen. This could be used to cause 'svnlook', and hence check-mime-type.pl, to error out.
The script contrib/hook-scripts/svn-keyword-check.pl parses filenames from the output of 'svnlook changed' and passes them to a further shell command (equivalent to the 'system()' call of the C standard library) without escaping them. This could be used to run arbitrary shell commands in the context of the user whom the pre-commit script runs as (the user who owns the repository).
Subversion team reports:
If a filename which contains a newline character (ASCII 0x0a) is committed to a repository using the FSFS format, the resulting revision is corrupt.
bannedit reports:
Stack-based buffer overflow in BitchX 1.1 Final allows remote IRC servers to execute arbitrary code via a long string in a MODE command, related to the p_mode variable.
Nico Golde reports:
There is a security issue in ircii-pana in bitchx' hostname command. The e_hostname function (commands.c) uses tmpnam to create a temporary file which is known to be insecure.
Chris reports:
Chris has reported a vulnerability in the Cypress script for BitchX, which can be exploited by malicious people to disclose potentially sensitive information or to compromise a vulnerable system.
The vulnerability is caused due to malicious code being present in the modules/mdop.m file. This can be exploited to disclose the content of various system files or to execute arbitrary shell commands.
Successful exploitation allows execution of arbitrary code, but requires the control of the "lsyn.webhop.net" domain.
No advisory has been released yet.
Fix NULL pointer dereference in webadmin.
Gerhard Rieger reports:
Under certain circumstances an FD leak occurs and can be misused for denial of service attacks against socat running in server mode.
Ruby Developers report:
There is a vulnerability in DL and Fiddle in Ruby where tainted strings can be used by system calls regardless of the $SAFE level set in Ruby.
Native functions exposed to Ruby with DL or Fiddle do not check the taint values set on the objects passed in. This can result in tainted objects being accepted as input when a SecurityError exception should be raised.
Jan Lehnardt reports:
Query parameters passed into the browser-based test suite are not sanitised, and can be used to load external resources. An attacker may execute JavaScript code in the browser, using the context of the remote user.
The OTRS Project reports:
An attacker with a valid agent login could manipulate URLs in the ticket split mechanism to see contents of tickets and they are not permitted to see.
The OTRS Project reports:
An attacker with permission to write changes, workorder items or FAQ articles could inject JavaScript code into the articles which would be executed by the browser of other users reading the article.
Thomas Sibley reports:
We discovered a number of security vulnerabilities which affect both RT 3.8.x and RT 4.0.x. We are releasing RT versions 3.8.17 and 4.0.13 to resolve these vulnerabilities, as well as patches which apply atop all released versions of 3.8 and 4.0.
The vulnerabilities addressed by 3.8.17, 4.0.13, and the below patches include the following:
RT 4.0.0 and above are vulnerable to a limited privilege escalation leading to unauthorized modification of ticket data. The DeleteTicket right and any custom lifecycle transition rights may be bypassed by any user with ModifyTicket. This vulnerability is assigned CVE-2012-4733.
RT 3.8.0 and above include a version of bin/rt that uses semi-predictable names when creating tempfiles. This could possibly be exploited by a malicious user to overwrite files with permissions of the user running bin/rt. This vulnerability is assigned CVE-2013-3368.
RT 3.8.0 and above allow calling of arbitrary Mason components (without control of arguments) for users who can see administration pages. This could be used by a malicious user to run private components which may have negative side-effects. This vulnerability is assigned CVE-2013-3369.
RT 3.8.0 and above allow direct requests to private callback components. Though no callback components ship with RT, this could be used to exploit an extension or local callback which uses the arguments passed to it insecurely. This vulnerability is assigned CVE-2013-3370.
RT 3.8.3 and above are vulnerable to cross-site scripting (XSS) via attachment filenames. The vector is difficult to exploit due to parsing requirements. Additionally, RT 4.0.0 and above are vulnerable to XSS via maliciously-crafted "URLs" in ticket content when RT's "MakeClicky" feature is configured. Although not believed to be exploitable in the stock configuration, a patch is also included for RTIR 2.6.x to add bulletproofing. These vulnerabilities are assigned CVE-2013-3371.
RT 3.8.0 and above are vulnerable to an HTTP header injection limited to the value of the Content-Disposition header. Injection of other arbitrary response headers is not possible. Some (especially older) browsers may allow multiple Content-Disposition values which could lead to XSS. Newer browsers contain security measures to prevent this. Thank you to Dominic Hargreaves for reporting this vulnerability. This vulnerability is assigned CVE-2013-3372.
RT 3.8.0 and above are vulnerable to a MIME header injection in outgoing email generated by RT. The vectors via RT's stock templates are resolved by this patchset, but any custom email templates should be updated to ensure that values interpolated into mail headers do not contain newlines. This vulnerability is assigned CVE-2013-3373.
RT 3.8.0 and above are vulnerable to limited session re-use when using the file-based session store, Apache::Session::File. RT's default session configuration only uses Apache::Session::File for Oracle. RT instances using Oracle may be locally configured to use the database-backed Apache::Session::Oracle, in which case sessions are never re-used. The extent of session re-use is limited to information leaks of certain user preferences and caches, such as queue names available for ticket creation. Thank you to Jenny Martin for reporting the problem that lead to discovery of this vulnerability. This vulnerability is assigned CVE-2013-3374.
Google Chrome Releases reports:
[235638] High CVE-2013-2837: Use-after-free in SVG. Credit to Slawomir Blazek.
[235311] Medium CVE-2013-2838: Out-of-bounds read in v8. Credit to Christian Holler.
[230176] High CVE-2013-2839: Bad cast in clipboard handling. Credit to Jon of MWR InfoSecurity.
[230117] High CVE-2013-2840: Use-after-free in media loader. Credit to Nils of MWR InfoSecurity.
[227350] High CVE-2013-2841: Use-after-free in Pepper resource handling. Credit to Chamal de Silva.
[226696] High CVE-2013-2842: Use-after-free in widget handling. Credit to Cyril Cattiaux.
[222000] High CVE-2013-2843: Use-after-free in speech handling. Credit to Khalil Zhani.
[196393] High CVE-2013-2844: Use-after-free in style resolution. Credit to Sachin Shinde (@cons0ul).
[188092] [179522] [222136] [188092] High CVE-2013-2845: Memory safety issues in Web Audio. Credit to Atte Kettunen of OUSPG.
[177620] High CVE-2013-2846: Use-after-free in media loader. Credit to Chamal de Silva.
[176692] High CVE-2013-2847: Use-after-free race condition with workers. Credit to Collin Payne.
[176137] Medium CVE-2013-2848: Possible data extraction with XSS Auditor. Credit to Egor Homakov.
[171392] Low CVE-2013-2849: Possible XSS with drag+drop or copy+paste. Credit to Mario Heiderich.
[241595] High CVE-2013-2836: Various fixes from internal audits, fuzzing and other initiatives.
CVE reports:
Stack-based buffer overflow in the error function in ssg/ssgParser.cxx in PLIB 1.8.5 allows remote attackers to execute arbitrary code via a crafted 3d model file that triggers a long error message, as demonstrated by a .ase file.
Secunia reports:
A vulnerability has been discovered in PLIB, which can be exploited by malicious people to compromise an application using the library. The vulnerability is caused due to a boundary error within the "ulSetError()" function (src/util/ulError.cxx) when creating the error message, which can be exploited to overflow a static buffer.
Successful exploitation allows the execution of arbitrary code but requires that the attacker can e.g. control the content of an overly long error message passed to the "ulSetError()" function.
The vulnerability is confirmed in version 1.8.5. Other versions may also be affected.
Originally reported in TORCS by Andres Gomez.
Adobe reports:
These updates address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.
The Mozilla Project reports:
MFSA 2013-41 Miscellaneous memory safety hazards (rv:21.0 / rv:17.0.6)
MFSA 2013-42 Privileged access for content level constructor
MFSA 2013-43 File input control has access to full path
MFSA 2013-44 Local privilege escalation through Mozilla Maintenance Service
MFSA 2013-45 Mozilla Updater fails to update some Windows Registry entries
MFSA 2013-46 Use-after-free with video and onresize event
MFSA 2013-47 Uninitialized functions in DOMSVGZoomEvent
MFSA 2013-48 Memory corruption found using Address Sanitizer
The nginx project reports:
A stack-based buffer overflow might occur in a worker process process while handling a specially crafted request, potentially resulting in arbitrary code execution. [CVE-2013-2028]
A security problem related to CVE-2013-2028 was identified, affecting some previous nginx versions if proxy_pass to untrusted upstream HTTP servers is used.
The problem may lead to a denial of service or a disclosure of a worker process memory on a specially crafted response from an upstream proxied server. [CVE-2013-2070]
strongSwan security team reports:
If the openssl plugin is used for ECDSA signature verification an empty, zeroed or otherwise invalid signature is handled as a legitimate one. Both IKEv1 and IKEv2 are affected.
Affected are only installations that have enabled and loaded the OpenSSL crypto backend (--enable-openssl). Builds using the default crypto backends are not affected.
Jenkins Security Advisory reports:
This advisory announces multiple security vulnerabilities that were found in Jenkins core.
SECURITY-63 / CVE-2013-2034
This creates a cross-site request forgery (CSRF) vulnerability on Jenkins master, where an anonymous attacker can trick an administrator to execute arbitrary code on Jenkins master by having him open a specifically crafted attack URL.
There's also a related vulnerability where the permission check on this ability is done imprecisely, which may affect those who are running Jenkins instances with a custom authorization strategy plugin.
SECURITY-67 / CVE-2013-2033
This creates a cross-site scripting (XSS) vulnerability, where an attacker with a valid user account on Jenkins can execute JavaScript in the browser of other users, if those users are using certain browsers.
SECURITY-69 / CVE-2013-2034
This is another CSRF vulnerability that allows an attacker to cause a deployment of binaries to Maven repositories. This vulnerability has the same CVE ID as SEUCRITY-63.
SECURITY-71 / CVE-2013-1808
This creates a cross-site scripting (XSS) vulnerability.
Insufficient input validation in the NFS server allows an attacker to cause the underlying file system to treat a regular file as a directory.
The JSST and the Joomla! Security Center report:
[20130405] - Core - XSS Vulnerability
Inadequate filtering leads to XSS vulnerability in Voting plugin.
[20130403] - Core - XSS Vulnerability
Inadequate filtering allows possibility of XSS exploit in some circumstances.
[20130402] - Core - Information Disclosure
Inadequate permission checking allows unauthorised user to see permission settings in some circumstances.
[20130404] - Core - XSS Vulnerability
Use of old version of Flash-based file uploader leads to XSS vulnerability.
[20130401] - Core - Privilege Escalation
Inadequate permission checking allows unauthorised user to delete private messages.
[20130406] - Core - DOS Vulnerability
Object unserialize method leads to possible denial of service vulnerability.
[20130407] - Core - XSS Vulnerability
Inadequate filtering leads to XSS vulnerability in highlighter plugin
The phpMyAdmin development team reports:
In some PHP versions, the preg_replace() function can be tricked into executing arbitrary PHP code on the server. This is done by passing a crafted argument as the regular expression, containing a null byte. phpMyAdmin does not correctly sanitize an argument passed to preg_replace() when using the "Replace table prefix" feature, opening the way to this vulnerability..
This vulnerability can be triggered only by someone who logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users to access the required form.
phpMyAdmin can be configured to save an export file on the web server, via its SaveDir directive. With this in place, it's possible, either via a crafted filename template or a crafted table name, to save a double extension file like foobar.php.sql. In turn, an Apache webserver on which there is no definition for the MIME type "sql" (the default) will treat this saved file as a ".php" script, leading to remote code execution.
This vulnerability can be triggered only by someone who logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users to access the required form. Moreover, the SaveDir directive is empty by default, so a default configuration is not vulnerable. The $cfg['SaveDir'] directive must be configured, and the server must be running Apache with mod_mime to be exploitable.
tinc-vpn.org reports:
Drop packets forwarded via TCP if they are too big.
The phpMyAdmin development team reports:
When modifying a URL parameter with a crafted value it is possible to trigger an XSS.
These XSS can only be triggered when a valid database is known and when a valid cookie token is used.
RoundCube development team reports:
After getting reports about a possible vulnerability of Roundcube which allows an attacker to modify its users preferences in a way that he/she can then read files from the server, we now published updated packages as well as patches that fix this security issue.
Fedora reports:
JasPer fails to properly decode marker segments and other sections in malformed JPEG2000 files. Malformed inputs can cause heap buffer overflows which in turn may result in execution of attacker-controlled code.
Positive Technologies has reported a vulnerability in ModSecurity, which can be exploited by malicious people to disclose potentially sensitive information or cause a DoS (Denial Of Serice).
The vulnerability is caused due to an error when parsing external XML entities and can be exploited to e.g. disclose local files or cause excessive memory and CPU consumption.
.
sieve-connect developer Phil Pennock reports:
sieve-connect was not actually verifying TLS certificate identities matched the expected hostname.
Adobe reports:
These updates address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.
Ruby on Rails team reports:
Rails versions 3.2.13 has been released. This release contains important security fixes. It is recommended users upgrade as soon as possible.
Four vulnerabilities have been discovered and fixed:
- (CVE-2013-1854) Symbol DoS vulnerability in Active Record
- (CVE-2013-1855) XSS vulnerability in sanitize_css in Action Pack
- (CVE-2013-1856) XML Parsing Vulnerability affecting JRuby users
- (CVE-2013-1857) XSS Vulnerability in the `sanitize` helper of Ruby on Rails
NVIDIA Unix security team reports:
When the NVIDIA driver for the X Window System is operated in "NoScanout" mode, and an X client installs an ARGB cursor that is larger than the expected size (64x64 or 256x256, depending on the driver version), the driver will overflow a buffer. This can cause a denial of service (e.g., an X server segmentation fault), or could be exploited to achieve arbitrary code execution. Because the X server runs as setuid root in many configurations, an attacker could potentially use this vulnerability in those configurations to gain root privileges.
Opera reports:
Fixed a moderately severe issue, as reported by Attila Suszte.
Subversion team reports:
Subversion's mod_dav_svn Apache HTTPD server module will use excessive amounts of memory when a large number of properties are set or deleted on a node.
Subversion's mod_dav_svn Apache HTTPD server module will crash when a LOCK request is made against activity URLs.
Subversion's mod_dav_svn Apache HTTPD server module will crash in some circumstances when a LOCK request is made against a non-existent URL.
Subversion's mod_dav_svn Apache HTTPD server module will crash when a PROPFIND request is made against activity URLs.
Subversion's mod_dav_svn Apache HTTPD server module will crash when a log REPORT request receives a limit that is out of the allowed range.
The OTRS Project reports:
An attacker with a valid agent login could manipulate URLs in the object linking mechanism to see titles of tickets and other objects that are not obliged to be seen. Furthermore, links to objects without permission can be placed and removed.
PostgreSQL project reports:
The PostgreSQL Global Development Group has released a security update to all current versions of the PostgreSQL database system, including versions 9.2.4, 9.1.9, 9.0.13, and 8.4.17. This update fixes a high-exposure security vulnerability in versions 9.0 and later. All users of the affected versions are strongly urged to apply the update *immediately*.
A major security issue (for versions 9.x only) fixed in this release, [CVE-2013-1899](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1899), makes it possible for a connection request containing a database name that begins with "-" to be crafted that can damage or destroy files within a server's data directory. Anyone with access to the port the PostgreSQL server listens on can initiate this request. This issue was discovered by Mitsumasa Kondo and Kyotaro Horiguchi of NTT Open Source Software Center.
Two lesser security fixes are also included in this release: [CVE-2013-1900](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1900), wherein random numbers generated by contrib/pgcrypto functions may be easy for another database user to guess (all versions), and [CVE-2013-1901](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1901), which mistakenly allows an unprivileged user to run commands that could interfere with in-progress backups (for versions 9.x only).
The Mozilla Project reports:
MFSA 2013-30 Miscellaneous memory safety hazards (rv:20.0 / rv:17.0.5)
MFSA 2013-31 Out-of-bounds write in Cairo library
MFSA 2013-32 Privilege escalation through Mozilla Maintenance Service
MFSA 2013-33 World read and write access to app_tmp directory on Android
MFSA 2013-34 Privilege escalation through Mozilla Updater
MFSA 2013-35 WebGL crash with Mesa graphics driver on Linux
MFSA 2013-36 Bypass of SOW protections allows cloning of protected nodes
MFSA 2013-37 Bypass of tab-modal dialog origin disclosure
MFSA 2013-38 Cross-site scripting (XSS) using timed history navigations
MFSA 2013-39 Memory corruption while rendering grayscale PNG images
MFSA 2013-40 Out-of-bounds array read in CERT_DecodeCertPackage
A flaw in a library used by BIND allows an attacker to deliberately cause excessive memory consumption by the named(8) process. This affects both recursive and authoritative servers.
A flaw in the OpenSSL handling of OCSP response verification could be exploited to cause a denial of service attack.
OpenSSL has a weakness in the handling of CBC ciphersuites in SSL, TLS and DTLS. The weakness could reveal plaintext in a timing attack.
The OpenVPN project reports:
OpenVPN 2.3.0 and earlier running in UDP mode are subject to chosen ciphertext injection due to a non-constant-time HMAC comparison function.
Kurt Seifried reports:
libxml2 is affected by the expansion of internal entities (which can be used to consume resources) and external entities (which can cause a denial of service against other services, be used to port scan, etc.)..
Asterisk project reports:
Buffer Overflow Exploit Through SIP SDP Header
Username disclosure in SIP channel driver
Denial of Service in HTTP server
ISC reports:
A critical defect in BIND 9 allows an attacker to cause excessive memory consumption in named or other programs linked to libdns.
Google Chrome Releases reports:
[172342] High CVE-2013-0916: Use-after-free in Web Audio. Credit to Atte Kettunen of OUSPG.
[180909] Low CVE-2013-0917: Out-of-bounds read in URL loader. Credit to Google Chrome Security Team (Cris Neckar).
[180555] Low CVE-2013-0918: Do not navigate dev tools upon drag and drop. Credit to Vsevolod Vlasov of the Chromium development community.
[Linux only] [178760] Medium CVE-2013-0919: Use-after-free with pop-up windows in extensions. Credit to Google Chrome Security Team (Mustafa Emre Acer).
[177410] Medium CVE-2013-0920: Use-after-free in extension bookmarks API. Credit to Google Chrome Security Team (Mustafa Emre Acer).
[174943] High CVE-2013-0921: Ensure isolated web sites run in their own processes.
[174129] Low CVE-2013-0922: Avoid HTTP basic auth brute force attempts. Credit to "t3553r".
[169981] [169972] [169765] Medium CVE-2013-0923: Memory safety issues in the USB Apps API. Credit to Google Chrome Security Team (Mustafa Emre Acer).
[169632] Low CVE-2013-0924: Check an extension's permissions API usage again file permissions. Credit to Benjamin Kalman of the Chromium development community.
[168442] Low CVE-2013-0925: Avoid leaking URLs to extensions without the tabs permissions. Credit to Michael Vrable of Google.
[112325] Medium CVE-2013-0926: Avoid pasting active tags in certain situations. Credit to Subho Halder, Aditya Gupta, and Dev Kar of xys3c (xysec.com).
Firebird Project reports:
The FirebirdSQL server is vulnerable to a stack buffer overflow that can be triggered when an unauthenticated user sends a specially crafted packet. The result can lead to remote code execution as the user which runs the FirebirdSQL server.
Secunia reports:
A vulnerability has been reported in OptiPNG, which can be exploited by malicious people to potentially compromise a user's system.
The vulnerability is caused due to a use-after-free error related to the palette reduction functionality. No further information is currently available.
Success exploitation may allow execution of arbitrary code.
The PHP development team reports:
PHP does not validate the relationship between the soap.wsdl_cache_dir directive and the open_basedir directive, which allows remote attackers to bypass intended access restrictions by triggering the creation of cached SOAP WSDL files in an arbitrary directory.
The SOAP parser in PHP allows remote attackers to read arbitrary files via a SOAP WSDL file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue in the soap_xmlParseFile and soap_xmlParseMemory functions.
High-Tech Bridge Security Research Lab reports:
The CSRF vulnerability exists due to insufficient verification of the HTTP request origin in "/admin.php" script. A remote attacker can trick a logged-in administrator to visit a specially crafted webpage and create arbitrary PHP file on the remote server.
The path traversal vulnerability exists due to insufficient filtration of user-supplied input in "dl" HTTP GET parameter passed to "/install.php" script. The script is present on the system after installation by default, and can be accessed by attacker without any restrictions.
libexif project security advisory:
A number of remotely exploitable issues were discovered in libexif and exif, with effects ranging from information leakage to potential remote code execution.
Adobe reports:
These updates address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.
Moses Mendoza reports:
A vulnerability found in Puppet could allow an authenticated client to cause the master to execute arbitrary code while responding to a catalog request. Specifically, in order to exploit the vulnerability, the puppet master must be made to invoke the 'template' or 'inline_template' functions during catalog compilation.
A vulnerability found in Puppet could allow an authenticated client to connect to a puppet master and perform unauthorized actions. Specifically, given a valid certificate and private key, an agent could retrieve catalogs from the master that it is not authorized to access or it could poison the puppet master's caches for any puppet-generated data that supports caching such as catalogs, nodes, facts, and resources. The extent and severity of this vulnerability varies depending on the specific configuration of the master: for example, whether it is using storeconfigs or not, which version, whether it has access to the cache or not, etc.
A vulnerability has been found in Puppet which could allow authenticated clients to execute arbitrary code on agents that have been configured to accept kick connections. This vulnerability is not present in the default configuration of puppet agents, but if they have been configured to listen for incoming connections ('listen=true'), and the agent's auth.conf has been configured to allow access to the `run` REST endpoint, then a client could construct an HTTP request which could execute arbitrary code. The severity of this issue is exacerbated by the fact that puppet agents typically run as root.
A vulnerability has been found in Puppet that could allow a client negotiating a connection to a master to downgrade the master's SSL protocol to SSLv2. This protocol has been found to contain design weaknesses. This issue only affects systems running older versions (pre 1.0.0) of openSSL. Newer versions explicitly disable SSLv2.
A vulnerability found in Puppet could allow unauthenticated clients to send requests to the puppet master which would cause it to load code unsafely. While there are no reported exploits, this vulnerability could cause issues like those described in Rails CVE-2013-0156. This vulnerability only affects puppet masters running Ruby 1.9.3 and higher.
This vulnerability affects puppet masters 0.25.0 and above. By default, auth.conf allows any authenticated node to submit a report for any other node. This can cause issues with compliance. The defaults in auth.conf have been changed.
Moses Mendoza reports:
A vulnerability found in Puppet could allow an authenticated client to cause the master to execute arbitrary code while responding to a catalog request. Specifically, in order to exploit the vulnerability, the puppet master must be made to invoke the 'template' or 'inline_template' functions during catalog compilation.
A vulnerability found in Puppet could allow an authenticated client to connect to a puppet master and perform unauthorized actions. Specifically, given a valid certificate and private key, an agent could retrieve catalogs from the master that it is not authorized to access or it could poison the puppet master's caches for any puppet-generated data that supports caching such as catalogs, nodes, facts, and resources. The extent and severity of this vulnerability varies depending on the specific configuration of the master: for example, whether it is using storeconfigs or not, which version, whether it has access to the cache or not, etc.
A vulnerability has been found in Puppet that could allow a client negotiating a connection to a master to downgrade the master's SSL protocol to SSLv2. This protocol has been found to contain design weaknesses. This issue only affects systems running older versions (pre 1.0.0) of openSSL. Newer versions explicitly disable SSLv2.
A vulnerability found in Puppet could allow an authenticated client to execute arbitrary code on a puppet master that is running in the default configuration, or an agent with `puppet kick` enabled. Specifically, a properly authenticated and connected puppet agent could be made to construct an HTTP PUT request for an authorized report that actually causes the execution of arbitrary code on the master.
This vulnerability affects puppet masters 0.25.0 and above. By default, auth.conf allows any authenticated node to submit a report for any other node. This can cause issues with compliance. The defaults in auth.conf have been changed.
Perl developers report:
In order to prevent an algorithmic complexity attack against its hashing mechanism, perl will sometimes recalculate keys and redistribute the contents of a hash. This mechanism has made perl robust against attacks that have been demonstrated against other systems.
Research by Yves Orton has recently uncovered a flaw in the rehashing code which can result in pathological behavior. This flaw could be exploited to carry out a denial of service attack against code that uses arbitrary user input as hash keys.
Because using user-provided strings as hash keys is a very common operation, we urge users of perl to update their perl executable as soon as possible.
Pidgin reports:
libpurple
Fix a crash when receiving UPnP responses with abnormally long values.
MXit
Fix two bugs where a remote MXit user could possibly specify a local file path to be written to.
Fix a bug where the MXit server or a man-in-the-middle could potentially send specially crafted data that could overflow a buffer and lead to a crash or remote code execution.
Sametime
Fix a crash in Sametime when a malicious server sends us an abnormally long user ID.
The Mozilla Project reports:
MFSA 2013-29 Use-after-free in HTML Editor
Google Chrome Releases reports:
[180763] High CVE-2013-0912: Type confusion in WebKit. Credit to Nils and Jon of MWR Labs.
Typo Security Team reports:
Extbase Framework - Failing to sanitize user input, the Extbase database abstraction layer is susceptible to SQL Injection. TYPO3 sites which have no Extbase extensions installed are not affected. Extbase extensions are affected if they use the Query Object Model and relation values are user generated input. Credits go to Helmut Hummel and Markus Opahle who discovered and reported the issue.
Access tracking mechanism - Failing to validate user provided input, the access tracking mechanism allows redirects to arbitrary URLs. To fix this vulnerability, we had to break existing behaviour of TYPO3 sites that use the access tracking mechanism (jumpurl feature) to transform links to external sites. The link generation has been changed to include a hash that is checked before redirecting to an external URL. This means that old links that have been distributed (e.g. by a newsletter) will not work any more.
Google Chrome Releases reports:
[176882] High CVE-2013-0902: Use-after-free in frame loader. Credit to Chamal de Silva.
[176252] High CVE-2013-0903: Use-after-free in browser navigation handling. Credit to "chromium.khalil".
[172926] [172331] High CVE-2013-0904: Memory corruption in Web Audio. Credit to Atte Kettunen of OUSPG.
[168982] High CVE-2013-0905: Use-after-free with SVG animations. Credit to Atte Kettunen of OUSPG.
[174895] High CVE-2013-0906: Memory corruption in Indexed DB. Credit to Google Chrome Security Team (Juri Aedla).
[174150] Medium CVE-2013-0907: Race condition in media thread handling. Credit to Andrew Scherkus of the Chromium development community.
[174059] Medium CVE-2013-0908: Incorrect handling of bindings for extension processes.
[173906] Low CVE-2013-0909: Referer leakage with XSS Auditor. Credit to Egor Homakov.
[172573] Medium CVE-2013-0910: Mediate renderer -> browser plug-in loads more strictly. Credit to Google Chrome Security Team (Chris Evans).
[172264] High CVE-2013-0911: Possible path traversal in database handling. Credit to Google Chrome Security Team (Juri Aedla).
Michal Trojnara reports:
64-bit versions of stunnel with the following conditions: * NTLM authentication enabled * CONNECT protocol negotiation enabled * Configured in SSL client mode * An attacker that can either control the proxy server specified in the "connect" option or execute MITM attacks on the TCP session between stunnel and the proxy
Can be exploited for remote code execution. The code is executed within the configured chroot directory, with privileges of the configured user and group.
low: XSS due to unescaped hostnames CVE-2012-3499
Various XSS flaws due to unescaped hostnames and URIs HTML output in mod_info, mod_status, mod_imagemap, mod_ldap, and mod_proxy_ftp.
moderate: XSS in mod_proxy_balancer CVE-2012-4558
A XSS flaw affected the mod_proxy_balancer manager interface.
Todd Miller reports:
The flaw may allow someone with physical access to a machine that is not password-protected to run sudo commands without knowing the logged in user's password. On systems where sudo is the principal way of running commands as root, such as on Ubuntu and Mac OS X, there is a greater chance that the logged in user has run sudo before and thus that an attack would succeed.
Todd Miller reports:
A (potentially malicious) program run by a user with sudo access may be able to bypass the "tty_ticket" constraints. In order for this to succeed there must exist on the machine a terminal device that the user has previously authenticated themselves on via sudo within the last time stamp timeout (5 minutes by default).
Mark Evans reports:
Unfortnately there is a security vulnerability in Dragonfly when used with Rails which would potentially allow an attacker to run arbitrary code on a host machine using carefully crafted requests.
Adobe reports:
These updates address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.
The OTRS Project reports:
This advisory covers vulnerabilities discovered in the OTRS core system. This is a variance of the XSS vulnerability, where an attacker could send a specially prepared HTML email to OTRS which would cause JavaScript code to be executed in your browser while displaying the email. In this case this is achieved by using javascript source attributes with whitespaces.
Affected by this vulnerability are all releases of OTRS 2.4.x up to and including 2.4.14, 3.0.x up to and including 3.0.16 and 3.1.x up to and including 3.1.10.
The OTRS Project reports:
This advisory covers vulnerabilities discovered in the OTRS core system. This is a variance of the XSS vulnerability, where an attacker could send a specially prepared HTML email to OTRS which would cause JavaScript code to be executed in your browser while displaying the email in Firefox and Opera. In this case this is achieved with an invalid HTML structure with nested tags.
Affected by this vulnerability are all releases of OTRS 2.4.x up to and including 2.4.13, 3.0.x up to and including 3.0.15 and 3.1.x up to and including 3.1.9 in combination with Firefox and Opera.
The OTRS Project reports:
This advisory covers vulnerabilities discovered in the OTRS core system. Due to the XSS vulnerability in Internet Explorer an attacker could send a specially prepared HTML email to OTRS which would cause JavaScript code to be executed in your Internet Explorer while displaying the email.
Affected by this vulnerability are all releases of OTRS 2.4.x up to and including 2.4.12, 3.0.x up to and including 3.0.14 and 3.1.x up to and including 3.1.8 in combination with Internet Explorer.
Ruby developers report:
Unrestricted entity expansion can lead to a DoS vulnerability in REXML. (The CVE identifier will be assigned later.) We strongly recommend to upgrade ruby.
When reading text nodes from an XML document, the REXML parser can be coerced in to allocating extremely large string objects which can consume all of the memory on a machine, causing a denial of service.
Michael Scherer reports:
This is a relatively minor tmp file usage issue.
The Django Project reports:
These security releases fix four issues: one potential phishing vector, one denial-of-service vector, an information leakage issue, and a range of XML vulnerabilities.
Host header poisoning
an attacker could cause Django to generate and display URLs that link to arbitrary domains. This could be used as part of a phishing attack. These releases fix this problem by introducing a new setting, ALLOWED_HOSTS, which specifies a whitelist of domains your site is known to respond to.
Important: by default Django 1.3.6 and 1.4.4 set ALLOWED_HOSTS to allow all hosts. This means that to actually fix the security vulnerability you should define this setting yourself immediately after upgrading.
Formset denial-of-service
an attacker can abuse Django's tracking of the number of forms in a formset to cause a denial-of-service attack. This has been fixed by adding a default maximum number of forms of 1,000. You can still manually specify a bigger max_num, if you wish, but 1,000 should be enough for anyone.
XML attacks
Django's serialization framework was vulnerable to attacks via XML entity expansion and external references; this is now fixed. However, if you're parsing arbitrary XML in other parts of your application, we recommend you look into the defusedxml Python packages which remedy this anywhere you parse XML, not just via Django's serialization framework.
Data leakage via admin history log
Django's admin interface could expose supposedly-hidden information via its history log. This has been fixed.
Google Chrome Releases reports:
[172243] High CVE-2013-0879: Memory corruption with web audio node. Credit to Atte Kettunen of OUSPG.
[171951] High CVE-2013-0880: Use-after-free in database handling. Credit to Chamal de Silva.
[167069] Medium CVE-2013-0881: Bad read in Matroska handling. Credit to Atte Kettunen of OUSPG.
[165432] High CVE-2013-0882: Bad memory access with excessive SVG parameters. Credit to Renata Hodovan.
[142169] Medium CVE-2013-0883: Bad read in Skia. Credit to Atte Kettunen of OUSPG.
[172984] Low CVE-2013-0884: Inappropriate load of NaCl. Credit to Google Chrome Security Team (Chris Evans).
[172369] Medium CVE-2013-0885: Too many API permissions granted to web store.
[171065] [170836] Low CVE-2013-0887: Developer tools process has too many permissions and places too much trust in the connected server.
[170666] Medium CVE-2013-0888: Out-of-bounds read in Skia. Credit to Google Chrome Security Team (Inferno).
[170569] Low CVE-2013-0889: Tighten user gesture check for dangerous file downloads.
[169973] [169966] High CVE-2013-0890: Memory safety issues across the IPC layer. Credit to Google Chrome Security Team (Chris Evans).
[169685] High CVE-2013-0891: Integer overflow in blob handling. Credit to Google Chrome Security Team (Jüri Aedla).
[169295] [168710] [166493] [165836] [165747] [164958] [164946] Medium CVE-2013-0892: Lower severity issues across the IPC layer. Credit to Google Chrome Security Team (Chris Evans).
[168570] Medium CVE-2013-0893: Race condition in media handling. Credit to Andrew Scherkus of the Chromium development community.
[168473] High CVE-2013-0894: Buffer overflow in vorbis decoding. Credit to Google Chrome Security Team (Inferno).
[Linux / Mac] [167840] High CVE-2013-0895: Incorrect path handling in file copying. Credit to Google Chrome Security Team (Jüri Aedla).
[166708] High CVE-2013-0896: Memory management issues in plug-in message handling. Credit to Google Chrome Security Team (Cris Neckar).
[165537] Low CVE-2013-0897: Off-by-one read in PDF. Credit to Mateusz Jurczyk, with contributions by Gynvael Coldwind, both from Google Security Team.
[164643] High CVE-2013-0898: Use-after-free in URL handling. Credit to Alexander Potapenko of the Chromium development community.
[160480] Low CVE-2013-0899: Integer overflow in Opus handling. Credit to Google Chrome Security Team (Jüri Aedla).
[152442] Medium CVE-2013-0900: Race condition in ICU. Credit to Google Chrome Security Team (Inferno).
No advisory has been released yet.
Fix a null pointer dereference in the KDC PKINIT code [CVE-2013-1415].
Problem description:
GLOB_LIMIT is supposed to limit the number of paths to prevent against memory or CPU attacks. The implementation however is insufficient.
Problem description:
Due to a software defect a crafted query can cause named(8) to crash with an assertion failure.
Drupal Security Team reports:
Drupal core's Image module allows for the on-demand generation of image derivatives. This capability can be abused by requesting a large number of new derivatives which can fill up the server disk space, and which can cause a very high CPU load. Either of these effects may lead to the site becoming unavailable or unresponsive.
Garth Mollett reports:
A file descriptor overflow issue in the use of FD_SET() in nss-pam-ldapd can lead to a stack-based buffer overflow. An attacker could, under some circumstances, use this flaw to cause a process that has the NSS or PAM module loaded to crash or potentially execute arbitrary code.
Cross-Site Scripting
When viewing a single bug report, which is the default, the bug ID is validated and rejected if it is invalid. But when viewing several bug reports at once, which is specified by the format=multiple parameter, invalid bug IDs can go through and are sanitized in the HTML page itself. But when an invalid page format is passed to the CGI script, the wrong HTML page is called and data are not correctly sanitized, which can lead to XSS.
Information Leak
When running a query in debug mode, the generated SQL query used to collect the data is displayed. The way this SQL query is built permits the user to determine if some confidential field value (such as a product name) exists. This problem only affects Bugzilla 4.0.9 and older. Newer releases are not affected by this issue.
The Mozilla Project reports:
MFSA 2013-21 Miscellaneous memory safety hazards (rv:19.0 / rv:17.0.3)
MFSA 2013-22 Out-of-bounds read in image rendering
MFSA 2013-23 Wrapped WebIDL objects can be wrapped again
MFSA 2013-24 Web content bypass of COW and SOW security wrappers
MFSA 2013-25 Privacy leak in JavaScript Workers
MFSA 2013-26 Use-after-free in nsImageLoadingContent
MFSA 2013-27 Phishing on HTTPS connection through malicious proxy
MFSA 2013-28 Use-after-free, out of bounds read, and buffer overflow issues found using Address Sanitizer
Rack developers report:
Today we are proud to announce the release of Rack 1.4.5.
Fix CVE-2013-0263, timing attack against Rack::Session::Cookie
Fix CVE-2013-0262, symlink path traversal in Rack::File
Aaron Patterson reports:
The attr_protected method allows developers to specify a blacklist of model attributes which users should not be allowed to assign to. By using a specially crafted request, attackers could circumvent this protection and alter values that were meant to be protected.
All users running an affected release should either upgrade or use one of the work arounds immediately. Users should also consider switching from attr_protected to the whitelist method attr_accessible which is not vulnerable to this attack.
Jenkins Security Advisory reports:
This advisory announces multiple security vulnerabilities that were found in Jenkins core.
- One of the vulnerabilities allows cross-site request forgery (CSRF) attacks on Jenkins master, which causes an user to make unwanted actions on Jenkins. Another vulnerability enables cross-site scripting (XSS) attacks, which has the similar consequence. Another vulnerability allowed an attacker to bypass the CSRF protection mechanism in place, thereby mounting more CSRF attackes. These attacks allow an attacker without direct access to Jenkins to mount an attack.
- In the fourth vulnerability, a malicious user of Jenkins can trick Jenkins into building jobs that he does not have direct access to.
- And lastly, a vulnerability allows a malicious user of Jenkins to mount a denial of service attack by feeding a carefully crafted payload to Jenkins.
Multiple cross-site scripting (XSS) vulnerabilities
Multiple scripts are vulnerable to XSS attacks.
Aaron Patterson reports:
When parsing certain JSON documents, the JSON gem can be coerced in to creating Ruby symbols in a target system. Since Ruby symbols are not garbage collected, this can result in a denial of service attack.
The same technique can be used to create objects in a target system that act like internal objects. These "act alike" objects can be used to bypass certain security mechanisms and can be used as a spring board for SQL injection attacks in Ruby on Rails.
Ruby developers report:
RDoc documentation generated by rdoc bundled with ruby are vulnerable to an XSS exploit. All ruby users are recommended to update ruby to newer version which includes security-fixed RDoc. If you are publishing RDoc documentation generated by rdoc, you are recommended to apply a patch for the documentaion or re-generate it with security-fixed RDoc.
Adobe reports:
These updates address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.
OpenSSL security team reports:
A flaw in the OpenSSL handling of CBC mode ciphersuites in TLS 1.1 and TLS 1.2 on AES-NI supporting platforms can be exploited in a DoS attack.
A flaw in the OpenSSL handling of OCSP response verification can be exploited in a denial of service attack.
ORACLE reports:
Multiple SQL injection vulnerabilities in the replication code
Stack-based buffer overflow
Heap-based buffer overflow
Opera reports:
Particular DOM event manipulations can cause Opera to crash. In some cases, this crash might occur in a way that allows execution of arbitrary code. To inject code, additional techniques would have to be employed.
Project changelog reports:
This patch addresses three possible buffer overflows in function unique_service_name().The three issues have the folowing CVE numbers:
- CVE-2012-5958 Issue #2: Stack buffer overflow of Tempbuf
- CVE-2012-5959 Issue #4: Stack buffer overflow of Event->UDN
- CVE-2012-5960 Issue #8: Stack buffer overflow of Event->UDN
Notice that the following issues have already been dealt by previous work:
- CVE-2012-5961 Issue #1: Stack buffer overflow of Evt->UDN
- CVE-2012-5962 Issue #3: Stack buffer overflow of Evt->DeviceType
- CVE-2012-5963 Issue #5: Stack buffer overflow of Event->UDN
- CVE-2012-5964 Issue #6: Stack buffer overflow of Event->DeviceType
- CVE-2012-5965 Issue #7: Stack buffer overflow of Event->DeviceType
Wordpress reports:
WordPress 3.5.1 also addresses the following security issues:
- A server-side request forgery vulnerability and remote port scanning using pingbacks. This vulnerability, which could potentially be used to expose information and compromise a site, affects all previous WordPress versions. This was fixed by the WordPress security team. We'd like to thank security researchers Gennady Kovshenin and Ryan Dewhurst for reviewing our work.
- Two instances of cross-site scripting via shortcodes and post content. These issues were discovered by Jon Cave of the WordPress security team.
- A cross-site scripting vulnerability in the external library Plupload. Thanks to the Moxiecode team for working with us on this, and for releasing Plupload 1.5.5 to address this issue.
Cross-site scripting (XSS) vulnerability
Jonas Obrist reports: The security issue allows users with limited admin access to elevate their privileges through XSS injection using the page_attribute template tag. Only users with admin access and the permission to edit at least one django CMS page object could exploit this vulnerability. Websites that do not use the page_attribute template tag are not affected.
Google Chrome Releases reports:
[151008] High CVE-2013-0839: Use-after-free in canvas font handling. Credit to Atte Kettunen of OUSPG.
[170532] Medium CVE-2013-0840: Missing URL validation when opening new windows.
[169770] High CVE-2013-0841: Unchecked array index in content blocking. Credit to Google Chrome Security Team (Chris Evans).
[166867] Medium CVE-2013-0842: Problems with NULL characters embedded in paths. Credit to Google Chrome Security Team (Jüri Aedla).
Drupal Security Team reports:
Cross-site scripting (Various core and contributed modules)
Access bypass (Book module printer friendly version)
Access bypass (Image module)
Host target list parsing routine in ettercap 0.7.4-series prior to 0.7.4.1 and 0.7.5-series is prone to the stack-based buffer overflow that may lead to the code execution with the privileges of the ettercap process.
In order to trigger this vulnerability, user or service that use ettercap should be tricked to pass the crafted list of targets via the "-j" option.
US CERT reports:
Java 7 Update 10 and earlier versions of Java 7 contain a vulnerability that can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system.
The Java JRE plug-in provides its own Security Manager. Typically, a web applet runs with a security manager provided by the browser or Java Web Start plugin. Oracle's document states, "If there is a security manager already installed, this method first calls the security manager's checkPermission method with a RuntimePermission("setSecurityManager") permission to ensure it's safe to replace the existing security manager. This may result in throwing a SecurityException".
By leveraging the vulnerability in the Java Management Extensions (JMX) MBean components, unprivileged Java code can access restricted classes. By using that vulnerability in conjunction with a second vulnerability involving the Reflection API and the invokeWithArguments method of the MethodHandle class, an untrusted Java applet can escalate its privileges by calling the the setSecurityManager() function to allow full privileges, without requiring code signing. Oracle Java 7 update 10 and earlier Java 7 versions are affected. The invokeWithArguments method was introduced with Java 7, so therefore Java 6 is not affected.
This vulnerability is being attacked in the wild, and is reported to be incorporated into exploit kits. Exploit code for this vulnerability is also publicly available.
Esteban Guillardoy from Immunity Inc. additionally clarifies on the recursive reflection exploitation technique:
The real issue is in the native sun.reflect.Reflection.getCallerClass method.
We can see the following information in the Reflection source code:
Returns the class of the method realFramesToSkip frames up the stack (zero-based), ignoring frames associated with java.lang.reflect.Method.invoke() and its implementation.
So what is happening here is that they forgot to skip the frames related to the new Reflection API and only the old reflection API is taken into account.
This exploit does not only affect Java applets, but every piece of software that relies on the Java Security Manager for sandboxing executable code is affected: malicious code can totally disable Security Manager.
For users who are running native Web browsers with enabled Java plugin, the workaround is to remove the java/icedtea-web port and restart all browser instances.
For users who are running Linux Web browser flavors, the workaround is either to disable the Java plugin in browser or to upgrade linux-sun-* packages to the non-vulnerable version.
It is not recommended to run untrusted applets using appletviewer, since this may lead to the execution of the malicious code on vulnerable versions on JDK/JRE.
full disclosure reports:
history.cgi is vulnerable to a buffer overflow due to the use of sprintf with user supplied data that has not been restricted in size.
Google Chrome Releases reports:
[162494] High CVE-2012-5145: Use-after-free in SVG layout. Credit to Atte Kettunen of OUSPG.
[165622] High CVE-2012-5146: Same origin policy bypass with malformed URL. Credit to Erling A Ellingsen and Subodh Iyengar, both of Facebook.
[165864] High CVE-2012-5147: Use-after-free in DOM handling. Credit to José A. Vázquez.
[167122] Medium CVE-2012-5148: Missing filename sanitization in hyphenation support. Credit to Google Chrome Security Team (Justin Schuh).
[166795] High CVE-2012-5149: Integer overflow in audio IPC handling. Credit to Google Chrome Security Team (Chris Evans).
[165601] High CVE-2012-5150: Use-after-free when seeking video. Credit to Google Chrome Security Team (Inferno).
[165538] High CVE-2012-5151: Integer overflow in PDF JavaScript. Credit to Mateusz Jurczyk, with contribution from Gynvael Coldwind, both of Google Security Team.
[165430] Medium CVE-2012-5152: Out-of-bounds read when seeking video. Credit to Google Chrome Security Team (Inferno).
[164565] High CVE-2012-5153: Out-of-bounds stack access in v8. Credit to Andreas Rossberg of the Chromium development community.
[Mac only] [163208] Medium CVE-2012-5155: Missing Mac sandbox for worker processes. Credit to Google Chrome Security Team (Julien Tinnes).
[162778] High CVE-2012-5156: Use-after-free in PDF fields. Credit to Mateusz Jurczyk, with contribution from Gynvael Coldwind, both of Google Security Team.
[162776] [162156] Medium CVE-2012-5157: Out-of-bounds reads in PDF image handling. Credit to Mateusz Jurczyk, with contribution from Gynvael Coldwind, both of Google Security Team.
[162153] High CVE-2013-0828: Bad cast in PDF root handling. Credit to Mateusz Jurczyk, with contribution from Gynvael Coldwind, both of Google Security Team.
[162114] High CVE-2013-0829: Corruption of database metadata leading to incorrect file access. Credit to Google Chrome Security Team (Jüri Aedla).
[161836] Low CVE-2013-0831: Possible path traversal from extension process. Credit to Google Chrome Security Team (Tom Sepez).
[160380] Medium CVE-2013-0832: Use-after-free with printing. Credit to Google Chrome Security Team (Cris Neckar).
[154485] Medium CVE-2013-0833: Out-of-bounds read with printing. Credit to Google Chrome Security Team (Cris Neckar).
[154283] Medium CVE-2013-0834: Out-of-bounds read with glyph handling. Credit to Google Chrome Security Team (Cris Neckar).
[152921] Low CVE-2013-0835: Browser crash with geolocation. Credit to Arthur Gerkis.
[150545] High CVE-2013-0836: Crash in v8 garbage collection. Credit to Google Chrome Security Team (Cris Neckar).
[145363] Medium CVE-2013-0837: Crash in extension tab handling. Credit to Tom Nielsen.
[Linux only] [143859] Low CVE-2013-0838: Tighten permissions on shared memory segments. Credit to Google Chrome Security Team (Chris Palmer).
The Mozilla Project reports:
MFSA 2013-01 Miscellaneous memory safety hazards (rv:18.0/ rv:10.0.12 / rv:17.0.2)
MFSA 2013-02 Use-after-free and buffer overflow issues found using Address Sanitizer
MFSA 2013-03 Buffer Overflow in Canvas
MFSA 2013-04 URL spoofing in addressbar during page loads
MFSA 2013-05 Use-after-free when displaying table with many columns and column groups
MFSA 2013-06 Touch events are shared across iframes
MFSA 2013-07 Crash due to handling of SSL on threads
MFSA 2013-08 AutoWrapperChanger fails to keep objects alive during garbage collection
MFSA 2013-09 Compartment mismatch with quickstubs returned values
MFSA 2013-10 Event manipulation in plugin handler to bypass same-origin policy
MFSA 2013-11 Address space layout leaked in XBL objects
MFSA 2013-12 Buffer overflow in Javascript string concatenation
MFSA 2013-13 Memory corruption in XBL with XML bindings containing SVG
MFSA 2013-14 Chrome Object Wrapper (COW) bypass through changing prototype
MFSA 2013-15 Privilege escalation through plugin objects
MFSA 2013-16 Use-after-free in serializeToStream
MFSA 2013-17 Use-after-free in ListenerManager
MFSA 2013-18 Use-after-free in Vibrate
MFSA 2013-19 Use-after-free in Javascript Proxy objects
MFSA 2013-20 Mis-issued TURKTRUST certificates
Ruby on Rails team reports:
Two high-risk vulnerabilities have been discovered:
(CVE-2013-0155) There is a vulnerability when Active Record is used in conjunction with JSON parameter parsing.
Due to the way Active Record interprets parameters in combination with the way that JSON parameters are parsed, it is possible for an attacker to issue unexpected database queries with "IS NULL" or empty "WHERE" clauses. This issue does not let an attacker insert arbitrary values into an SQL query, however they can cause the query to check for NULL or eliminate a WHERE clause when most users would not expect it.
(CVE-2013-0156) There are multiple weaknesses in the parameter parsing code for Ruby on Rails which allows attackers to bypass authentication systems, inject arbitrary SQL, inject and execute arbitrary code, or perform a DoS attack on a Rails application.
The parameter parsing code of Ruby on Rails allows applications to automatically cast values from strings to certain data types. Unfortunately the type casting code supported certain conversions which were not suitable for performing on user-provided data including creating Symbols and parsing YAML. These unsuitable conversions can be used by an attacker to compromise a Rails application.
Ruby on Rails team reports:
There is a SQL injection vulnerability in Active Record in ALL versions. Due to the way dynamic finders in Active Record extract options from method parameters, a method parameter can mistakenly be used as a scope. Carefully crafted requests can use the scope to inject arbitrary SQL.
Jenkins Security Advisory reports:
This advisory announces a security vulnerability that was found in Jenkins core.
An attacker can then use this master cryptographic key to mount remote code execution attack against the Jenkins master, or impersonate arbitrary users in making REST API calls.
There are several factors that mitigate some of these problems that may apply to specific installations.
- The particular attack vector is only applicable on Jenkins instances that have slaves attached to them, and allow anonymous read access.
- Jenkins allows users to re-generate the API tokens. Those re-generated API tokens cannot be impersonated by the attacker.
The Django Project reports:
Host header poisoning
Several earlier Django security releases focused on the issue of poisoning the HTTP Host header, causing Django to generate URLs pointing to arbitrary, potentially-malicious domains.
In response to further input received and reports of continuing issues following the previous release, we're taking additional steps to tighten Host header validation. Rather than attempt to accommodate all features HTTP supports here, Django's Host header validation attempts to support a smaller, but far more common, subset:
- Hostnames must consist of characters [A-Za-z0-9] plus hyphen ('-') or dot ('.').
- IP addresses -- both IPv4 and IPv6 -- are permitted.
- Port, if specified, is numeric.
Any deviation from this will now be rejected, raising the exception django.core.exceptions.SuspiciousOperation.
Redirect poisoning
Also following up on a previous issue: in July of this year, we made changes to Django's HTTP redirect classes, performing additional validation of the scheme of the URL to redirect to (since, both within Django's own supplied applications and many third-party applications, accepting a user-supplied redirect target is a common pattern).
Since then, two independent audits of the code turned up further potential problems. So, similar to the Host-header issue, we are taking steps to provide tighter validation in response to reported problems (primarily with third-party applications, but to a certain extent also within Django itself). This comes in two parts:
- A new utility function, django.utils.http.is_safe_url, is added; this function takes a URL and a hostname, and checks that the URL is either relative, or if absolute matches the supplied hostname. This function is intended for use whenever user-supplied redirect targets are accepted, to ensure that such redirects cannot lead to arbitrary third-party sites.
- All of Django's own built-in views -- primarily in the authentication system -- which allow user-supplied redirect targets now use is_safe_url to validate the supplied URL.
The FreeType Project reports:
Some vulnerabilities in the BDF implementation have been fixed. Users of this font format should upgrade.
MoinMoin developers report the following vulnerabilities as fixed in version 1.9.6:
- remote code execution vulnerability in twikidraw/anywikidraw action,
- path traversal vulnerability in AttachFile action,
- XSS issue, escape page name in rss link.
CVE entries at MITRE furher clarify:
Multiple unrestricted file upload vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory, as exploited in the wild in July 2012.
Directory traversal vulnerability in the _do_attachment_move function in the AttachFile action (action/AttachFile.py) in MoinMoin 1.9.3 through 1.9.5 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in a file name.
Cross-site scripting (XSS) vulnerability in the rsslink function in theme/__init__.py in MoinMoin 1.9.5 allows remote attackers to inject arbitrary web script or HTML via the page name in a rss link.
Asterisk project reports:
Crashes due to large stack allocations when using TCP
Denial of Service Through Exploitation of Device State Caching
atheme.org reports:
All versions of Charybdis are vulnerable to a remotely-triggered crash bug caused by code originating from ircd-ratbox 2.0. (Incidentally, this means all versions since ircd-ratbox 2.0 are also vulnerable.)
puppet -- multiple vulnerabilities
Arbitrary file read on the puppet master from authenticated clients (high). It is possible to construct an HTTP get request from an authenticated client with a valid certificate that will return the contents of an arbitrary file on the Puppet master that the master has read-access to.
Arbitrary file delete/D.O.S on Puppet Master from authenticated clients (high). Given a Puppet master with the "Delete" directive allowed in auth.conf for an authenticated host, an attacker on that host can send a specially crafted Delete request that can cause an arbitrary file deletion on the Puppet master, potentially causing a denial of service attack. Note that this vulnerability does *not* exist in Puppet as configured by default.
Insufficient input validation for agent hostnames (low). An attacker could trick the administrator into signing an attacker's certificate rather than the intended one by constructing specially crafted certificate requests containing specific ANSI control sequences. It is possible to use the sequences to rewrite the order of text displayed to an administrator such that display of an invalid certificate and valid certificate are transposed. If the administrator signs the attacker's certificate, the attacker can then man-in-the-middle the agent.
OTRS Security Advisory reports:
This advisory covers vulnerabilities discovered in the OTRS core system. This is a variance of the XSS vulnerability, where an attacker could send a specially prepared HTML email to OTRS which would cause JavaScript code to be executed in your browser while displaying the email. In this case this is achieved by using javascript source attributes with whitespaces.
OTRS Security Advisory reports:
This advisory covers vulnerabilities discovered in the OTRS core system. This is a variance of the XSS vulnerability, where an attacker could send a specially prepared HTML email to OTRS which would cause JavaScript code to be executed in your browser while displaying the email in Firefox and Opera. In this case this is achieved with an invalid HTML structure with nested tags.
OTRS Security Advisory reports:
This advisory covers vulnerabilities discovered in the OTRS core system. Due to the XSS vulnerability in Internet Explorer an attacker could send a specially prepared HTML email to OTRS which would cause JavaScript code to be executed in your Internet Explorer while displaying the email.
Squid developers report:
Due to missing input validation Squid cachemgr.cgi tool is vulnerable to a denial of service attack when processing specially crafted requests.
This problem allows any client able to reach the cachemgr.cgi to perform a denial of service attack on the service host.
The nature of the attack may cause secondary effects through resource consumption on the host server.
Opera reports:
When loading GIF images into memory, Opera should allocate the correct amount of memory to store that image. Specially crafted image files can cause Opera to allocate the wrong amount of memory. Subsequent data may then overwrite unrelated memory with attacker-controlled data. This can lead to a crash, which may also execute that data as code.
Adobe reports:
These updates address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.
Google Chrome Releases reports:
[158204] High CVE-2012-5139: Use-after-free with visibility events. Credit to Chamal de Silva.
[159429] High CVE-2012-5140: Use-after-free in URL loader. Credit to Chamal de Silva.
[160456] Medium CVE-2012-5141: Limit Chromoting client plug-in instantiation. Credit to Google Chrome Security Team (Jüri Aedla).
[160803] Critical CVE-2012-5142: Crash in history navigation. Credit to Michal Zalewski of Google Security Team.
[160926] Medium CVE-2012-5143: Integer overflow in PPAPI image buffers. Credit to Google Chrome Security Team (Cris Neckar).
[161639] High CVE-2012-5144: Stack corruption in AAC decoding. Credit to pawlkt.
The Apache Software Foundation reports:
The CSRF prevention filter could be bypassed if a request was made to a protected resource without a session identifier present in the request.
The Apache Software Foundation reports:
When using the NIO connector with sendfile and HTTPS enabled, if a client breaks the connection while reading the response an infinite loop is entered leading to a denial of service.
The Apache Software Foundation reports:
When using FORM authentication it was possible to bypass the security constraint checks in the FORM authenticator by appending "/j_security_check" to the end of the URL if some other component (such as the Single-Sign-On valve) had called request.setUserPrincipal() before the call to FormAuthenticator#authenticate().
ISC reports:
BIND 9 nameservers using the DNS64 IPv6 transition mechanism are vulnerable to a software defect that allows a crafted query to crash the server with a REQUIRE assertion failure. Remote exploitation of this defect can be achieved without extensive effort, resulting in a denial-of-service (DoS) vector against affected servers.
David Relson reports:
Fix a heap corruption in base64 decoder on invalid input. Analysis and patch by Julius Plenz, [FU Berlin, Germany].
Google Chrome Releases reports:
[161564] High CVE-2012-5138: Incorrect file path handling. Credit to Google Chrome Security Team (Jüri Aedla).
[162835] High CVE-2012-5137: Use-after-free in media source handling. Credit to Pinkie Pie.
The YUI team reports:
Vulnerability in YUI 2.4.0 through YUI 2.9.0
A XSS vulnerability has been discovered in some YUI 2 .swf files from versions 2.4.0 through 2.9.0. This defect allows JavaScript injection exploits to be created against domains that host affected YUI .swf files.
If your site loads YUI 2 from a CDN (yui.yahooapis.com, ajax.googleapis.com, etc.) and not from your own domain, you are not affected. YUI 3 is not affected by this issue.
Google Chrome Releases reports:
[156567] High CVE-2012-5133: Use-after-free in SVG filters. Credit to miaubiz.
[148638] Medium CVE-2012-5130: Out-of-bounds read in Skia. Credit to Atte Kettunen of OUSPG.
[155711] Low CVE-2012-5132: Browser crash with chunked encoding. Credit to Attila Szász.
[158249] High CVE-2012-5134: Buffer underflow in libxml. Credit to Google Chrome Security Team (Jüri Aedla).
[159165] Medium CVE-2012-5135: Use-after-free with printing. Credit to Fermin Serna of Google Security Team.
[159829] Medium CVE-2012-5136: Bad cast in input element handling. Credit to Google Chrome Security Team (Inferno).
Problem description:
A programming error in the handling of some Linux system calls may result in memory locations being accessed without proper validation.
Problem description:
The internal authentication server of hostapd does not sufficiently validate the message length field of EAP-TLS messages.
Problem description:
The BIND daemon would crash when a query is made on a resource record with RDATA that exceeds 65535 bytes.
The BIND daemon would lock up when a query is made on specific combinations of RDATA.
Opera reports:
When requesting pages using HTTP, Opera temporarily stores the response in a buffer. In some cases, Opera may incorrectly allocate too little space for a buffer, and may then store too much of the response in that buffer. This causes a buffer overflow, which in turn can lead to a memory corruption and crash. It is possible to use this crash to execute the overflowing data as code, which may be controlled by an attacking site.
Lighttpd security advisory reports:
Certain Connection header values will trigger an endless loop, for example: "Connection: TE,,Keep-Alive"
On receiving such value, lighttpd will enter an endless loop, detecting an empty token but not incrementing the current string position, and keep reading the ',' again and again.
This bug was introduced in 1.4.31, when we fixed an "invalid read" bug (it would try to read the byte before the string if it started with ',', although the value wasn't actually used).
The Mozilla Project reports:
MFSA 2012-91 Miscellaneous memory safety hazards (rv:17.0/ rv:10.0.11)
MFSA 2012-92 Buffer overflow while rendering GIF images
MFSA 2012-93 evalInSanbox location context incorrectly applied
MFSA 2012-94 Crash when combining SVG text on path with CSS
MFSA 2012-95 Javascript: URLs run in privileged context on New Tab page
MFSA 2012-96 Memory corruption in str_unescape
MFSA 2012-97 XMLHttpRequest inherits incorrect principal within sandbox
MFSA 2012-98 Firefox installer DLL hijacking
MFSA 2012-99 XrayWrappers exposes chrome-only properties when not in chrome compartment
MFSA 2012-100 Improper security filtering for cross-origin wrappers
MFSA 2012-101 Improper character decoding in HZ-GB-2312 charset
MFSA 2012-102 Script entered into Developer Toolbar runs with chrome privileges
MFSA 2012-103 Frames can shadow top.location
MFSA 2012-104 CSS and HTML injection through Style Inspector
MFSA 2012-105 Use-after-free and buffer overflow issues found
MFSA 2012-106 Use-after-free, buffer overflow, and memory corruption issues found using Address Sanitizer
Sebastien Helleu reports:
Untrusted command for function hook_process could lead to execution of commands, because of shell expansions.
Workaround with a non-patched version: remove/unload all scripts calling function hook_process (for maximum safety).
The following security issues have been discovered in Bugzilla:
Information Leak
If the visibility of a custom field is controlled by a product or a component of a product you cannot see, their names are disclosed in the JavaScript code generated for this custom field despite they should remain confidential.
Calling the User.get method with a 'groups' argument leaks the existence of the groups depending on whether an error is thrown or not. This method now also throws an error if the user calling this method does not belong to these groups (independently of whether the groups exist or not).
Trying to mark an attachment in a bug you cannot see as obsolete discloses its description in the error message. The description of the attachment is now removed from the error message.
Cross-Site Scripting
Due to incorrectly filtered field values in tabular reports, it is possible to inject code leading to XSS.
A vulnerability in swfstore.swf from YUI2 allows JavaScript injection exploits to be created against domains that host this affected YUI .swf file.
Typo Security Team reports:
TYPO3 Backend History Module - Due to missing encoding of user input, the history module is susceptible to SQL Injection and Cross-Site Scripting. A valid backend login is required to exploit this vulnerability. Credits go to Thomas Worm who discovered and reported the issue.
TYPO3 Backend API - Failing to properly HTML-encode user input the tree render API (TCA-Tree) is susceptible to Cross-Site Scripting. TYPO3 Versions below 6.0 does not make us of this API, thus is not exploitable, if no third party extension is installed which uses this API. A valid backend login is required to exploit this vulnerability. Credits go to Richard Brain who discovered and reported the issue.
US-CERT reports:
DomainKeys Identified Mail (DKIM) Verifiers may inappropriately convey message trust when messages are signed using test or small bit signing keys.
Sebastien Helleu reports:
A buffer overflow is causing a crash or freeze of WeeChat when decoding IRC colors in strings.
Workaround for a non-patched version: /set irc.network.colors_receive off
The official ruby site reports:
Carefully crafted sequence of strings can cause a denial of service attack on the service that parses the sequence to create a Hash object by using the strings as keys. For instance, this vulnerability affects web application that parses the JSON data sent from untrusted entity.
This vulnerability is similar to CVS-2011-4815 for ruby 1.8.7. ruby 1.9 versions were using modified MurmurHash function but it's reported that there is a way to create sequence of strings that collide their hash values each other. This fix changes the Hash function of String object from the MurmurHash to SipHash 2-4.
The Apache Software Foundation reports:
Three weaknesses in Tomcat's implementation of DIGEST authentication were identified and resolved:
- Tomcat tracked client rather than server nonces and nonce count.
- When a session ID was present, authentication was bypassed.
- The user name and password were not checked before when indicating that a nonce was stale.
These issues reduced the security of DIGEST authentication making replay attacks possible in some circumstances.
The first issue was identified by Tilmann Kuhn. The second and third issues were identified by the Tomcat security team during the code review resulting from the first issue.
The Apache Software Foundation reports:
The checks that limited the permitted size of request headers were implemented too late in the request parsing process for the HTTP NIO connector. This enabled a malicious user to trigger an OutOfMemoryError by sending a single request with very large headers. This issue was identified by Josh Spiewak.
Adobe reports:
These vulnerabilities could cause a crash and potentially allow an attacker to take control of the affected system.
Google Chrome Releases reports:
[157079] Medium CVE-2012-5127: Integer overflow leading to out-of-bounds read in WebP handling. Credit to Phil Turnbull.
[Linux 64-bit only] [150729] Medium CVE-2012-5120: Out-of-bounds array access in v8. Credit to Atte Kettunen of OUSPG.
[143761] High CVE-2012-5116: Use-after-free in SVG filter handling. Credit to miaubiz.
[Mac OS only] [149717] High CVE-2012-5118: Integer bounds check issue in GPU command buffers. Credit to miaubiz.
[154055] High CVE-2012-5121: Use-after-free in video layout. Credit to Atte Kettunen of OUSPG.
[145915] Low CVE-2012-5117: Inappropriate load of SVG subresource in img context. Credit to Felix Gröbert of the Google Security Team.
[149759] Medium CVE-2012-5119: Race condition in Pepper buffer handling. Credit to Fermin Serna of the Google Security Team.
[154465] Medium CVE-2012-5122: Bad cast in input handling. Credit to Google Chrome Security Team (Inferno).
[154590] [156826] Medium CVE-2012-5123: Out-of-bounds reads in Skia. Credit to Google Chrome Security Team (Inferno).
[155323] High CVE-2012-5124: Memory corruption in texture handling. Credit to Al Patrick of the Chromium development community.
[156051] Medium CVE-2012-5125: Use-after-free in extension tab handling. Credit to Alexander Potapenko of the Chromium development community.
[156366] Medium CVE-2012-5126: Use-after-free in plug-in placeholder handling. Credit to Google Chrome Security Team (Inferno).
[157124] High CVE-2012-5128: Bad write in v8. Credit to Google Chrome Security Team (Cris Neckar).
Opera reports:
CORS (Cross-Origin Resource Sharing) allows web pages to retrieve the contents of pages from other sites, with their permission, as they would appear for the current user. When requests are made in this way, the browser should only allow the page content to be retrieved if the target site sends the correct headers that give permission for their contents to be used in this way. Specially crafted requests may trick Opera into thinking that the target site has given permission when it had not done so. This can result in the contents of any target page being revealed to untrusted sites, including any sensitive information or session IDs contained within the source of those pages.
Also reported are vulnerabilities involving SVG graphics and XSS.
Adobe reports:
These vulnerabilities could cause a crash and potentially allow an attacker to take control of the affected system.
low: XSS in mod_negotiation when untrusted uploads are supported CVE-2012-2687
Possible XSS for sites which use mod_negotiation and allow untrusted uploads to locations which have MultiViews enabled.
low: insecure LD_LIBRARY_PATH handling CVE-2012-0883
This issue was already fixed in port version 2.2.22_5
The webmin updates site reports
Module: Change Passwords; Version: 1.600; Problem: Fix for potential XSS attack via real name field; Solution: New module.
The official ruby site reports:
A vulnerability was found that file creation routines can create unintended files by strategically inserting NUL(s) in file paths. This vulnerability has been reported as CVE-2012-4522.
Ruby can handle arbitrary binary patterns as Strings, including NUL chars. On the other hand OSes and other libraries tend not. They usually treat a NUL as an End of String mark. So to interface them with Ruby, NUL chars should properly be avoided.
However methods like IO#open did not check the filename passed to them, and just passed those strings to lower layer routines. This led to create unintentional files.
The official ruby site reports:
Vulnerabilities found for Exception#to_s, NameError#to_s, and name_err_mesg_to_s() which is Ruby interpreter-internal API. A malicious user code can bypass $SAFE check by utilizing one of those security holes.
Ruby's $SAFE mechanism enables untrusted user codes to run in $SAFE >= 4 mode. This is a kind of sandboxing so some operations are restricted in that mode to protect other data outside the sandbox.
The problem found was around this mechanism. Exception#to_s, NameError#to_s, and name_err_mesg_to_s() interpreter-internal API was not correctly handling the $SAFE bits so a String object which is not tainted can destructively be marked as tainted using them. By using this an untrusted code in a sandbox can modify a formerly-untainted string destructively.
Ruby 1.8 once had a similar security issue. It fixed Exception#to_s and NameError#to_s, but name_err_mesg_to_str() issue survived previous security fix
BestPractical report:
All versions of RT are vulnerable to an email header injection attack. Users with ModifySelf or AdminUser can cause RT to add arbitrary headers or content to outgoing mail. Depending on the scrips that are configured, this may be be leveraged for information leakage or phishing.
RT 4.0.0 and above and RTFM 2.0.0 and above contain a vulnerability due to lack of proper rights checking, allowing any privileged user to create Articles in any class.
All versions of RT with cross-site-request forgery (CSRF) protection (RT 3.8.12 and above, RT 4.0.6 and above, and any instances running the security patches released 2012-05-22) contain a vulnerability which incorrectly allows though CSRF requests which toggle ticket bookmarks.
All versions of RT are vulnerable to a confused deputy attack on the user. While not strictly a CSRF attack, users who are not logged in who are tricked into following a malicious link may, after supplying their credentials, be subject to an attack which leverages their credentials to modify arbitrary state. While users who were logged in would have observed the CSRF protection page, users who were not logged in receive no such warning due to the intervening login process. RT has been extended to notify users of pending actions during the login process.
RT 3.8.0 and above are susceptible to a number of vulnerabilities concerning improper signing or encryption of messages using GnuPG; if GnuPG is not enabled, none of the following affect you.
Drupal Security Team reports:
Arbitrary PHP code execution
A bug in the installer code was identified that allows an attacker to re-install Drupal using an external database server under certain transient conditions. This could allow the attacker to execute arbitrary PHP code on the original server.
Information disclosure - OpenID module
For sites using the core OpenID module, an information disclosure vulnerability was identified that allows an attacker to read files on the local filesystem by attempting to log in to the site using a malicious OpenID server.
The Mozilla Project reports:
MFSA 2012-90 Fixes for Location object issues
This vulnerability affects Exim instances built with DKIM enabled (this is the default for FreeBSD Exim port) and running verification of DKIM signatures on the incoming mail messages.
Phil Penncock reports:
This is a SECURITY release, addressing a CRITICAL remote code execution flaw in versions of Exim between 4.70 and 4.80 inclusive, when built with DKIM support (the default).
This security vulnerability can be exploited by anyone who can send email from a domain for which they control the DNS.
You are not vulnerable if you built Exim with DISABLE_DKIM or if you put this at the start of an ACL plumbed into acl_smtp_connect or acl_smtp_rcpt:
warn control = dkim_disable_verify
The Django Project reports:
Host header poisoning
Some parts of Django -- independent of end-user-written applications -- make use of full URLs, including domain name, which are generated from the HTTP Host header. Some attacks against this are beyond Django's ability to control, and require the web server to be properly configured; Django's documentation has for some time contained notes advising users on such configuration.
Django's own built-in parsing of the Host header is, however, still vulnerable, as was reported to us recently. The Host header parsing in Django 1.3 and Django 1.4 -- specifically, django.http.HttpRequest.get_host() -- was incorrectly handling username/password information in the header. Thus, for example, the following Host header would be accepted by Django when running on "validsite.com":
Host: validsite.com:random@evilsite.com
Using this, an attacker can cause parts of Django -- particularly the password-reset mechanism -- to generate and display arbitrary URLs to users.
To remedy this, the parsing in HttpRequest.get_host() is being modified; Host headers which contain potentially dangerous content (such as username/password pairs) now raise the exception django.core.exceptions.SuspiciousOperation.
Documentation of HttpOnly cookie option
As of Django 1.4, session cookies are always sent with the HttpOnly flag, which provides some additional protection from cross-site scripting attacks by denying client-side scripts access to the session cookie.
Though not directly a security issue in Django, it has been reported that the Django 1.4 documentation incorrectly described this change, by claiming that this was now the default for all cookies set by the HttpResponse.set_cookie() method.
The Django documentation has been updated to reflect that this only applies to the session cookie. Users of Django are encouraged to review their use of set_cookie() to ensure that the HttpOnly flag is being set or unset appropriately.
Wireshark reports:
The HSRP dissector could go into an infinite loop.
The PPP dissector could abort.
Martin Wilck discovered an infinite loop in the DRDA dissector.
Laurent Butti discovered a buffer overflow in the LDP dissector.
Ignatios Souvatzis of NetBSD reports:
Due to an error in the dclock screensaver in xlockmore, users who explicitly use this screensaver or a random mix of screensavers using something like "xlockmore -mode random" may have their screen unlocked unexpectedly at a random time.
Thomas Swan reports:
xinetd allows for services to be configured with the TCPMUX or TCPMUXPLUS service types, which makes those services available on port 1, as per RFC 1078 [1], if the tcpmux-server service is enabled. When the tcpmux-server service is enabled, xinetd would expose _all_ enabled services via the tcpmux port, instead of just the configured service(s). This could allow a remote attacker to bypass firewall restrictions and access services via the tcpmux port.
The Zend Framework team reports:
The XmlRpc package of Zend Framework is vulnerable to XML eXternal Entity Injection attacks (both server and client). The SimpleXMLElement class (SimpleXML PHP extension) is used in an insecure way to parse XML data. External entities can be specified by adding a specific DOCTYPE element to XML-RPC requests. By exploiting this vulnerability an application may be coerced to open arbitrary files and/or TCP connections.
Additionally, the Zend_Dom, Zend_Feed, Zend_Soap, and Zend_XmlRpc components are vulnerable to XML Entity Expansion (XEE) vectors, leading to Denial of Service vectors. XEE attacks occur when the XML DOCTYPE declaration includes XML entity definitions that contain either recursive or circular references; this leads to CPU and memory consumption, making Denial of Service exploits trivial to implement.
Sitaram Chamarty reports:
I'm sorry to say there is a potential path traversal vulnerability in v3. Thanks to Stephane Chazelas for finding it and alerting me.
Can it affect you? This can only affect you if you are using wild card repos, *and* at least one of your patterns allows the string "../" to match multiple times.
How badly can it affect you? A malicious user who *also* has the ability to create arbitrary files in, say, /tmp (e.g., he has his own userid on the same box), can compromise the entire "git" user. Otherwise the worst he can do is create arbitrary repos in /tmp.
The phpMyAdmin development team reports:
When creating/modifying a trigger, event or procedure with a crafted name, it is possible to trigger an XSS.
To display information about the current phpMyAdmin version on the main page, a piece of JavaScript is fetched from the phpmyadmin.net website in non-SSL mode. A man-in-the-middle could modify this script on the wire to cause mischief.
Google Chrome Releases reports:
[154983][154987] Critical CVE-2012-5112: SVG use-after-free and IPC arbitrary file write. Credit to Pinkie Pie.
The Mozilla Project reports:
MFSA 2012-74 Miscellaneous memory safety hazards (rv:16.0/ rv:10.0.8)
MFSA 2012-75 select element persistance allows for attacks
MFSA 2012-76 Continued access to initial origin after setting document.domain
MFSA 2012-77 Some DOMWindowUtils methods bypass security checks
MFSA 2012-78 Reader Mode pages have chrome privileges
MFSA 2012-79 DOS and crash with full screen and history navigation
MFSA 2012-80 Crash with invalid cast when using instanceof operator
MFSA 2012-81 GetProperty function can bypass security checks
MFSA 2012-82 top object and location property accessible by plugins
MFSA 2012-83 Chrome Object Wrapper (COW) does not disallow acces to privileged functions or properties
MFSA 2012-84 Spoofing and script injection through location.hash
MFSA 2012-85 Use-after-free, buffer overflow, and out of bounds read issues found using Address Sanitizer
MFSA 2012-86 Heap memory corruption issues found using Address Sanitizer
MFSA 2012-87 Use-after-free in the IME State Manager
MFSA 2012-88 Miscellaneous memory safety hazards (rv:16.0.1)
MFSA 2012-89 defaultValue security checks not applied
ISC reports:
A deliberately constructed combination of records could cause named to hang while populating the additional section of a response.
Google Chrome Releases reports:
[138208] High CVE-2012-2900: Crash in Skia text rendering. Credit to Atte Kettunen of OUSPG.
[147499] Critical CVE-2012-5108: Race condition in audio device handling. Credit to Atte Kettunen of OUSPG.
[148692] Medium CVE-2012-5109: OOB read in ICU regex. Credit to Arthur Gerkis.
[151449] Medium CVE-2012-5110: Out-of-bounds read in compositor. Credit to Google Chrome Security Team (Inferno).
[151895] Low CVE-2012-5111: Plug-in crash monitoring was missing for Pepper plug-ins. Credit to Google Chrome Security Team (Chris Evans).
Secunia reports:
A vulnerability has been discovered in OpenX, which can be exploited by malicious people to conduct SQL injection attacks.
Input passed via the "xajaxargs" parameter to www/admin/updates-history.php (when "xajax" is set to "expandOSURow") is not properly sanitised in e.g. the "queryAuditBackupTablesByUpgradeId()" function (lib/OA/Upgrade/DB_UpgradeAuditor.php) before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
The vulnerability is confirmed in version 2.8.9. Prior versions may also be affected.
Google Chrome Releases reports:
[143439] High CVE-2012-2889: UXSS in frame handling. Credit to Sergey Glazunov.
[143437] High CVE-2012-2886: UXSS in v8 bindings. Credit to Sergey Glazunov.
[139814] High CVE-2012-2881: DOM tree corruption with plug-ins. Credit to Chamal de Silva.
[135432] High CVE-2012-2876: Buffer overflow in SSE2 optimizations. Credit to Atte Kettunen of OUSPG.
[140803] High CVE-2012-2883: Out-of-bounds write in Skia. Credit to Atte Kettunen of OUSPG.
[143609] High CVE-2012-2887: Use-after-free in onclick handling. Credit to Atte Kettunen of OUSPG.
[143656] High CVE-2012-2888: Use-after-free in SVG text references. Credit to miaubiz.
[144899] High CVE-2012-2894: Crash in graphics context handling. Credit to Slawomir Blazek.
[137707] Medium CVE-2012-2877: Browser crash with extensions and modal dialogs. Credit to Nir Moshe.
[139168] Low CVE-2012-2879: DOM topology corruption. Credit to pawlkt.
[141651] Medium CVE-2012-2884: Out-of-bounds read in Skia. Credit to Atte Kettunen of OUSPG.
[132398] High CVE-2012-2874: Out-of-bounds write in Skia. Credit to Google Chrome Security Team (Inferno).
[134955] [135488] [137106] [137288] [137302] [137547] [137556] [137606] [137635] [137880] [137928] [144579] [145079] [145121] [145163] [146462] Medium CVE-2012-2875: Various lower severity issues in the PDF viewer. Credit to Mateusz Jurczyk of Google Security Team, with contributions by Gynvael Coldwind of Google Security Team.
[137852] High CVE-2012-2878: Use-after-free in plug-in handling. Credit to Fermin Serna of Google Security Team.
[139462] Medium CVE-2012-2880: Race condition in plug-in paint buffer. Credit to Google Chrome Security Team (Cris Neckar).
[140647] High CVE-2012-2882: Wild pointer in OGG container handling. Credit to Google Chrome Security Team (Inferno).
[142310] Medium CVE-2012-2885: Possible double free on exit. Credit to the Chromium development community.
[143798] [144072] [147402] High CVE-2012-2890: Use-after-free in PDF viewer. Credit to Mateusz Jurczyk of Google Security Team, with contributions by Gynvael Coldwind of Google Security Team.
[144051] Low CVE-2012-2891: Address leak over IPC. Credit to Lei Zhang of the Chromium development community.
[144704] Low CVE-2012-2892: Pop-up block bypass. Credit to Google Chrome Security Team (Cris Neckar).
[144799] High CVE-2012-2893: Double free in XSL transforms. Credit to Google Chrome Security Team (Cris Neckar).
[145029] [145157] [146460] High CVE-2012-2895: Out-of-bounds writes in PDF viewer. Credit to Mateusz Jurczyk of Google Security Team, with contributions by Gynvael Coldwind of Google Security Team.
David Madison reports:
ePerl is a multipurpose Perl filter and interpreter program for Unix systems. The ePerl preprocessor contains an input validation error. The preprocessor allows foreign data to be "safely" included using the 'sinclude' directive.
The problem occurs when a file referenced by a 'sinclude' directive contains a 'include' directive; the contents of the file referred to by the second directive will be loaded and executed.
Kurt Seifried reports:
There is an issue in ImageMagick that is also present in GraphicsMagick. CVE-2011-3026 deals with libpng memory allocation, and limitations have been added so that a bad PNG can't cause the system to allocate a lot of memory and a denial of service. However on further investigation of ImageMagick, Tom Lane found that PNG malloc function (Magick_png_malloc) in turn calls AcquireMagickMemory with an improper size argument.
MITRE CVE team reports:
The SQLite functionality in PHP before 5.3.15 allows remote attackers to bypass the open_basedir protection mechanism via unspecified vectors.
MITRE CVE team reports:
Memory leak in the timezone functionality in PHP before 5.3.9 allows remote attackers to cause a denial of service (memory consumption) by triggering many strtotime function calls, which are not properly handled by the php_date_parse_tzfile cache.
ISC reports:
Prevents a crash when queried for a record whose RDATA exceeds 65535 bytes.
Prevents a crash when validating caused by using "Bad cache" data before it has been initialized.
ISC_QUEUE handling for recursive clients was updated to address a race condition that could cause a memory leak. This rarely occurred with UDP clients, but could be a significant problem for a server handling a steady rate of TCP queries.
A condition has been corrected where improper handling of zero-length RDATA could cause undesirable behavior, including termination of the named process.
Jenkins Security Advisory reports:
This advisory announces security vulnerabilities that were found in Jenkins core and several plugins.
- The first vulnerability in Jenkins core allows unprivileged users to insert data into Jenkins master, which can lead to remote code execution. For this vulnerability to be exploited, the attacker must have an HTTP access to a Jenkins master, and he must have a read access to Jenkins.
- The second vulnerability in Jenkins core is a cross-site scripting vulnerability. This allows an attacker to craft an URL that points to Jenkins, and if a legitimate user clicks this link, and the attacker will be able to hijack the user session.
- The third vulnerability is a cross-site scripting vulnerability in the Violations plugin
- The fourth vulnerability is a cross-site scripting vulnerability in The Continuous Integration Game plugin
Jean-Baptiste Kempf, on behalf of the VideoLAN project reports:
If successful, a malicious third party could crash the VLC media player process. Arbitrary code execution could be possible on some systems.
A security issue has been reported in Bacula, which can be exploited by malicious users to bypass certain security restrictions.
The security issue is caused due to an error within the implementation of console ACLs, which can be exploited to gain access to certain restricted functionality and e.g. dump resources.
Google Reports:
mod_pagespeed 0.10.22.6 is a security update that fixes two critical issues that affect earlier versions:
- CVE-2012-4001, a problem with validation of own host name.
- CVE-2012-4360, a cross-site scripting attack, which affects versions starting from 0.10.19.1.
The effect of the first problem is that it is possible to confuse mod_pagespeed about its own host name, and to trick it into fetching resources from other machines. This could be an issue if the HTTP server has access to machines that are not otherwise publicly visible.
The second problem would permit a hostile third party to execute JavaScript in users' browsers in context of the domain running mod_pagespeed, which could permit interception of users' cookies or data on the site.
Because of the severity of the two problems, users are strongly encouraged to update immediately.
Behavior Changes in the Update:
As part of the fix to the first issue, mod_pagespeed will not fetch resources from machines other than localhost if they are not explicitly mentioned in the configuration. This means that if you need resources on the server's domain to be handled by some other system, you'll need to explicitly use ModPagespeedMapOriginDomain or ModPagespeedDomain to authorize that.
freeRADIUS security team reports:
Overflow in EAP-TLS for 2.1.10, 2.1.11 and 2.1.12.
The issue was found by Timo Warns, and communicated to security@freeradius.org. A sample exploit for the issue was included in the notification.
The vulnerability was created in commit a368a6f4f4aaf on August 18, 2010. Vulnerable versions include 2.1.10, 2.1.11, and 2.1.12. Also anyone running the git "master" branch after August 18, 2010 is vulnerable.
All sites using TLS-based EAP methods and the above versions are vulnerable. The only configuration change which can avoid the issue is to disable EAP-TLS, EAP-TTLS, and PEAP.
An external attacker can use this vulnerability to over-write the stack frame of the RADIUS server, and cause it to crash. In addition, more sophisticated attacks may gain additional privileges on the system running the RADIUS server.
This attack does not require local network access to the RADIUS server. It can be done by an attacker through a WiFi Access Point, so long as the Access Point is configured to use 802.1X authentication with the RADIUS server.
Chong Yidong reports:
Paul Ling has found a security flaw in the file-local variables code in GNU Emacs.
When the Emacs user option `enable-local-variables' is set to `:safe' (the default value is t), Emacs should automatically refuse to evaluate `eval' forms in file-local variable sections. Due to the bug, Emacs instead automatically evaluates such `eval' forms. Thus, if the user changes the value of `enable-local-variables' to `:safe', visiting a malicious file can cause automatic execution of arbitrary Emacs Lisp code with the permissions of the user.
The bug is present in Emacs 23.2, 23.3, 23.4, and 24.1.
Wordpress reports:
Version 3.4.2 also fixes a few security issues and contains some security hardening. The vulnerabilities included potential privilege escalation and a bug that affects multisite installs with untrusted users. These issues were discovered and fixed by the WordPress security team.
MITRE CVE team reports:
Cross-site scripting (XSS) vulnerability in the reStructuredText (rst) parser in parser/text_rst.py in MoinMoin before 1.9.4, when docutils is installed or when "format rst" is set, allows remote attackers to inject arbitrary web script or HTML via a javascript: URL in the refuri attribute.
MoinMoin developers report:
If you have group NAMES containing "All" or "Known" or "Trusted", they behaved wrong until now (they erroneously included All/Known/Trusted users even if you did not list them as members), but will start working correctly with this changeset.
E.g. AllFriendsGroup:
- JoeDoe
AllFriendsGroup will now (correctly) include only JoeDoe. It (erroneously) contained all users (including JoeDoe) before.
E.g. MyTrustedFriendsGroup:
- JoeDoe
MyTrustedFriendsGroup will now (correctly) include only JoeDoe. It (erroneously) contained all trusted users and JoeDoe before.
Rui Hirokawa reports:
As of PHP 5.1.2, header() can no longer be used to send multiple response headers in a single call to prevent the HTTP Response Splitting Attack. header() only checks the linefeed (LF, 0x0A) as line-end marker, it doesn't check the carriage-return (CR, 0x0D).
However, some browsers including Google Chrome, IE also recognize CR as the line-end.
The current specification of header() still has the vulnerability against the HTTP header splitting attack.
A unspecified denial-of-service attack that could cause the bitcoin process to become unresponsive was found.
The following security issues have been discovered in Bugzilla:
LDAP Injection
When the user logs in using LDAP, the username is not escaped when building the uid=$username filter which is used to query the LDAP directory. This could potentially lead to LDAP injection.
Directory Browsing
Extensions are not protected against directory browsing and users can access the source code of the templates which may contain sensitive data. Directory browsing is blocked in Bugzilla 4.3.3 only, because it requires a configuration change in the Apache httpd.conf file to allow local .htaccess files to use Options -Indexes. To not break existing installations, this fix has not been backported to stable branches. The access to templates is blocked for all supported branches except the old 3.6 branch, because this branch doesn't have .htaccess in the bzr repository and cannot be fixed easily for existing installations without potentially conflicting with custom changes.
Jan Willamowius reports:
GNU Gatekeeper before 3.1 does not limit the number of connections to the status port, which allows remote attackers to cause a denial of service (connection and thread consumption) via a large number of connections.
Mediawiki reports:
(Bug 39700) Wikipedia administrator Writ Keeper discovered a stored XSS (HTML injection) vulnerability. This was possible due to the handling of link text on File: links for nonexistent files. MediaWiki 1.16 and later is affected.
(Bug 39180) User Fomafix reported several DOM-based XSS vulnerabilities, made possible by a combination of loose filtering of the uselang parameter, and JavaScript gadgets on various language Wikipedias.
(Bug 39180) During internal review, it was discovered that CSRF tokens, available via the api, were not protected with X-Frame-Options headers. This could lead to a CSRF vulnerability if the API response is embedded in an external website using using an iframe.
(Bug 39824) During internal review, it was discovered extensions were not always allowed to prevent the account creation action. This allowed users blocked by the GlobalBlocking extension to create accounts.
(Bug 39184) During internal review, it was discovered that password data was always saved to the local MediaWiki database even if authentication was handled by an extension, such as LDAP. This could allow a compromised MediaWiki installation to leak information about user's LDAP passwords. Additionally, in situations when an authentication plugin returned false in its strict function, this would allow old passwords to be used for accounts that did not exist in the external system, indefinitely.
(Bug 39823) During internal review, it was discovered that metadata about blocks, hidden by a user with suppression rights, was visible to administrators.
RedHat security team reports:
A denial of service flaw was found in the way Distributed Relational Database Architecture (DRDA) dissector of Wireshark, a network traffic analyzer, performed processing of certain DRDA packet capture files. A remote attacker could create a specially-crafted capture file that, when opened could lead to wireshark executable to consume excessive amount of CPU time and hang with an infinite loop.
Google Chrome Releases reports:
[121347] Medium CVE-2012-2865: Out-of-bounds read in line breaking. Credit to miaubiz.
[134897] High CVE-2012-2866: Bad cast with run-ins. Credit to miaubiz.
[135485] Low CVE-2012-2867: Browser crash with SPDY.
[136881] Medium CVE-2012-2868: Race condition with workers and XHR. Credit to miaubiz.
[137778] High CVE-2012-2869: Avoid stale buffer in URL loading. Credit to Fermin Serna of the Google Security Team.
[138672] [140368] Low CVE-2012-2870: Lower severity memory management issues in XPath. Credit to Nicolas Gregoire.
[138673] High CVE-2012-2871: Bad cast in XSL transforms. Credit to Nicolas Gregoire.
[142956] Medium CVE-2012-2872: XSS in SSL interstitial. Credit to Emmanuel Bronshtein.
Asterisk project reports:
Asterisk Manager User Unauthorized Shell Access
ACL rules ignored when placing outbound calls by certain IAX2 users
The Mozilla Project reports:
MFSA 2012-57 Miscellaneous memory safety hazards (rv:15.0/ rv:10.0.7)
MFSA 2012-58 Use-after-free issues found using Address Sanitizer
MFSA 2012-59 Location object can be shadowed using Object.defineProperty
MFSA 2012-60 Escalation of privilege through about:newtab
MFSA 2012-61 Memory corruption with bitmap format images with negative height
MFSA 2012-62 WebGL use-after-free and memory corruption
MFSA 2012-63 SVG buffer overflow and use-after-free issues
MFSA 2012-64 Graphite 2 memory corruption
MFSA 2012-65 Out-of-bounds read in format-number in XSLT
MFSA 2012-66 HTTPMonitor extension allows for remote debugging without explicit activation
MFSA 2012-67 Installer will launch incorrect executable following new installation
MFSA 2012-68 DOMParser loads linked resources in extensions when parsing text/html
MFSA 2012-69 Incorrect site SSL certificate data display
MFSA 2012-70 Location object security checks bypassed by chrome code
MFSA 2012-71 Insecure use of __android_log_print
MFSA 2012-72 Web console eval capable of executing chrome-privileged code
The Coppermine Team reports:
The release covers several path disclosure vulnerabilities. If unpatched, it's possible to generate an error that will reveal the full path of the script. A remote user can determine the full path to the web root directory and other potentially sensitive information. Furthermore, the release covers a recently discovered XSS vulnerability that allows (if unpatched) a malevolent visitor to include own script routines under certain conditions.
US-CERT reports:
Oracle Java Runtime Environment (JRE) 1.7 contains a vulnerability that may allow an applet to call setSecurityManager in a way that allows setting of arbitrary permissions.
By leveraging the public, privileged getField() function, an untrusted Java applet can escalate its privileges by calling the setSecurityManager() function to allow full privileges, without requiring code signing.
This vulnerability is being actively exploited in the wild, and exploit code is publicly available.
This exploit does not only affect Java applets, but every piece of software that relies on the Java Security Manager for sandboxing executable code is affected: malicious code can totally disable Security Manager.
Matthias Andree reports:
Fetchmail version 6.3.9 enabled "all SSL workarounds" (SSL_OP_ALL) which contains a switch to disable a countermeasure against certain attacks against block ciphers that permit guessing the initialization vectors, providing that an attacker can make the application (fetchmail) encrypt some data for him -- which is not easily the case.
Stream ciphers (such as RC4) are unaffected.
Credits to Apple Product Security for reporting this.
RoundCube branch 0.8.x prior to the version 0.8.1 is prone to the cross-scripting attack (XSS) originating from incoming HTML e-mails: due to the lack of proper sanitization of JavaScript code inside the "href" attribute, sender could launch XSS attack when recipient opens the message in RoundCube interface.
KDE Security Advisory reports:
A flaw has been found which can allow malicious code to take advantage of an input validation failure in the Microsoft import filter in Calligra and KOffice. Exploitation can allow the attacker to gain control of the running process and execute code on its behalf.
SquidClamav developers report:
This release fix several security issues by escaping CGI parameters.
Prior to versions 6.7 and 5.8, CGI script clwarn.cgi was not properly sanitizing input variables, so they could be used to inject arbitrary strings to the generated page, leading to the cross-site scripting attacks.
SquidClamav developers report:
Add a workaround for a squidGuard bug that unescape the URL and send it back unescaped. This result in garbage staying into pipe of the system command call and could crash squidclamav on next read or return false information. This is specially true with URL containing the %0D or %0A character.
This vulnerability can be triggered only in configurations where external chained URL checker is configured via "squidguard" directive.
INN developers report:
Fixed a possible plaintext command injection during the negotiation of a TLS layer. The vulnerability detailed in CVE-2011-0411 affects the STARTTLS and AUTHINFO SASL commands. nnrpd now resets its read buffer upon a successful negotiation of a TLS layer. It prevents malicious commands, sent unencrypted, from being executed in the new encrypted state of the session.
XMPP Standards Foundation reports:
Some implementations of the XMPP Server Dialback protocol (RFC 3920/XEP-0220) have not been checking dialback responses to ensure that validated results are correlated with requests.
An attacking server could spoof one or more domains in communicating with a vulnerable server implementation, thereby avoiding the protections built into the Server Dialback protocol.
Derek Martin (rssh maintainer) reports:
John Barber reported a problem where, if the system administrator misconfigures rssh by providing too few access bits in the configuration file, the user will be given default permissions (scp) to the entire system, potentially circumventing any configured chroot. Fixing this required a behavior change: in the past, using rssh without a config file would give all users default access to use scp on an unchrooted system. In order to correct the reported bug, this feature has been eliminated, and you must now have a valid configuration file. If no config file exists, all users will be locked out.
Derek Martin (rssh maintainer) reports:
Henrik Erkkonen has discovered that, through clever manipulation of environment variables on the ssh command line, it is possible to circumvent rssh. As far as I can tell, there is no way to effect a root compromise, except of course if the root account is the one you're attempting to protect with rssh...
OTR developers report:
The otrl_base64_otr_decode() function and similar functions within OTR suffer from buffer overflows in the case of malformed input; specifically if a message of the format of "?OTR:===." is received then a zero-byte allocation is performed without a similar correlation between the subsequent base64 decoding write, as such it becomes possible to write between zero and three bytes incorrectly to the heap, albeit only with a value of '='.
Because this code path is highly utilized, specifically in the reception of instant messages over pidgin or similar, this vulnerability is considered severe even though in many platforms and circumstances the bug would yield an unexploitable state and result simply in denial of service.
The developers of OTR promptly fixed the errors and users of OTR are advised to upgrade the software at the next release cycle.
The OpenTTD Team reports:
Denial of service (server) using ships on half tiles and landscaping.
Wireshark reports:
It may be possible to make Wireshark crash by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file.
It may be possible to make Wireshark consume excessive CPU resources by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file.
The PPP dissector could crash.
The NFS dissector could use excessive amounts of CPU.
The DCP ETSI dissector could trigger a zero division.
The MongoDB dissector could go into a large loop.
The XTP dissector could go into an infinite loop.
The ERF dissector could overflow a buffer.
The AFP dissector could go into a large loop.
The RTPS2 dissector could overflow a buffer.
The GSM RLC MAC dissector could overflow a buffer.
The CIP dissector could exhaust system memory.
The STUN dissector could crash.
The EtherCAT Mailbox dissector could abort.
The CTDB dissector could go into a large loop.
The pcap-ng file parser could trigger a zero division.
The Ixia IxVeriWave file parser could overflow a buffer.
The PostgreSQL Global Development Group reports:
The PostgreSQL Global Development Group today released security updates for all active branches of the PostgreSQL database system, including versions 9.1.5, 9.0.9, 8.4.13 and 8.3.20. This update patches security holes associated with libxml2 and libxslt, similar to those affecting other open source projects. All users are urged to update their installations at the first available opportunity
Users who are relying on the built-in XML functionality to validate external DTDs will need to implement a workaround, as this security patch disables that functionality. Users who are using xslt_process() to fetch documents or stylesheets from external URLs will no longer be able to do so. The PostgreSQL project regrets the need to disable both of these features in order to maintain our security standards. These security issues with XML are substantially similar to issues patched recently by the Webkit (CVE-2011-1774), XMLsec (CVE-2011-1425) and PHP5 (CVE-2012-0057) projects.
The phpMyAdmin development team reports:
Using a crafted table name, it was possible to produce a XSS : 1) On the Database Structure page, creating a new table with a crafted name 2) On the Database Structure page, using the Empty and Drop links of the crafted table name 3) On the Table Operations page of a crafted table, using the 'Empty the table (TRUNCATE)' and 'Delete the table (DROP)' links 4) On the Triggers page of a database containing tables with a crafted name, when opening the 'Add Trigger' popup 5) When creating a trigger for a table with a crafted name, with an invalid definition. Having crafted data in a database table, it was possible to produce a XSS : 6) When visualizing GIS data, having a crafted label name.
Typo Security Team reports:
It has been discovered that TYPO3 Core is vulnerable to Cross-Site Scripting, Information Disclosure, Insecure Unserialize leading to Arbitrary Code Execution.
TYPO3 Backend Help System - Due to a missing signature (HMAC) for a parameter in the view_help.php file, an attacker could unserialize arbitrary objects within TYPO3. We are aware of a working exploit, which can lead to arbitrary code execution. A valid backend user login or multiple successful cross site request forgery attacks are required to exploit this vulnerability.
TYPO3 Backend - Failing to properly HTML-encode user input in several places, the TYPO3 backend is susceptible to Cross-Site Scripting. A valid backend user is required to exploit these vulnerabilities.
TYPO3 Backend - Accessing the configuration module discloses the Encryption Key. A valid backend user with access to the configuration module is required to exploit this vulnerability.
TYPO3 HTML Sanitizing API - By not removing several HTML5 JavaScript events, the API method t3lib_div::RemoveXSS() fails to filter specially crafted HTML injections, thus is susceptible to Cross-Site Scripting. Failing to properly encode for JavaScript the API method t3lib_div::quoteJSvalue(), it is susceptible to Cross-Site Scripting.
TYPO3 Install Tool - Failing to properly sanitize user input, the Install Tool is susceptible to Cross-Site Scripting.
Matthias Andree reports:
With NTLM support enabled, fetchmail might mistake a server-side error message during NTLM protocol exchange for protocol data, leading to a SIGSEGV.
Also, with a carefully crafted NTLM challenge, a malicious server might cause fetchmail to read from a bad memory location, betraying confidential data. It is deemed hard, although not impossible, to steal other accounts' data.
The IcedTea project team reports:
CVE-2012-3422: Use of uninitialized instance pointers
An uninitialized pointer use flaw was found in IcedTea-Web web browser plugin. A malicious web page could use this flaw make IcedTea-Web browser plugin pass invalid pointer to a web browser. Depending on the browser used, it may cause the browser to crash or possibly execute arbitrary code.
The get_cookie_info() and get_proxy_info() call getFirstInTableInstance() with the instance_to_id_map hash as a parameter. If instance_to_id_map is empty (which can happen when plugin was recently removed), getFirstInTableInstance() returns an uninitialized pointer.
CVE-2012-3423: Incorrect handling of non 0-terminated strings
It was discovered that the IcedTea-Web web browser plugin incorrectly assumed that all strings provided by browser are NUL terminated, which is not guaranteed by the NPAPI (Netscape Plugin Application Programming Interface). When used in a browser that does not NUL terminate NPVariant NPStrings, this could lead to buffer over-read or over-write, resulting in possible information leak, crash, or code execution.
Mozilla browsers currently NUL terminate strings, however recent Chrome versions are known not to provide NUL terminated data.
The libcloud development team reports:
When establishing a secure (SSL / TLS) connection to a target server an invalid regular expression has been used for performing the hostname verification. Subset instead of the full target server hostname has been marked an an acceptable match for the given hostname. For example, certificate with a hostname field of "aexample.com" was considered a valid certificate for domain "example.com".
The phpMyAdmin development team reports:
The show_config_errors.php script does not include a library, so an error message shows the full path of this file, leading to possible further attacks.
Google Chrome Releases reports:
[136643] [137721] [137957] High CVE-2012-2862: Use-after-free in PDF viewer. Credit to Mateusz Jurczyk of Google Security Team, with contributions by Gynvael Coldwind of Google Security Team.
[136968] [137361] High CVE-2012-2863: Out-of-bounds writes in PDF viewer. Credit to Mateusz Jurczyk of Google Security Team, with contributions by Gynvael Coldwind of Google Security Team.
Google Chrome Releases reports:
[Linux only] [125225] Medium CVE-2012-2846: Cross-process interference in renderers. Credit to Google Chrome Security Team (Julien Tinnes).
[127522] Low CVE-2012-2847: Missing re-prompt to user upon excessive downloads. Credit to Matt Austin of Aspect Security.
[127525] Medium CVE-2012-2848: Overly broad file access granted after drag+drop. Credit to Matt Austin of Aspect Security.
[128163] Low CVE-2012-2849: Off-by-one read in GIF decoder. Credit to Atte Kettunen of OUSPG.
[130251] [130592] [130611] [131068] [131237] [131252] [131621] [131690] [132860] Medium CVE-2012-2850: Various lower severity issues in the PDF viewer. Credit to Mateusz Jurczyk of Google Security Team, with contributions by Gynvael Coldwind of Google Security Team.
[132585] [132694] [132861] High CVE-2012-2851: Integer overflows in PDF viewer. Credit to Mateusz Jurczyk of Google Security Team, with contributions by Gynvael Coldwind of Google Security Team.
[134028] High CVE-2012-2852: Use-after-free with bad object linkage in PDF. Credit to Alexey Samsonov of Google.
[134101] Medium CVE-2012-2853: webRequest can interfere with the Chrome Web Store. Credit to Trev of Adblock.
[134519] Low CVE-2012-2854: Leak of pointer values to WebUI renderers. Credit to Nasko Oskov of the Chromium development community.
[134888] High CVE-2012-2855: Use-after-free in PDF viewer. Credit to Mateusz Jurczyk of Google Security Team, with contributions by Gynvael Coldwind of Google Security Team.
[134954] [135264] High CVE-2012-2856: Out-of-bounds writes in PDF viewer. Credit to Mateusz Jurczyk of Google Security Team, with contributions by Gynvael Coldwind of Google Security Team.
[136235] High CVE-2012-2857: Use-after-free in CSS DOM. Credit to Arthur Gerkis.
[136894] High CVE-2012-2858: Buffer overflow in WebP decoder. Credit to Juri Aedla.
[Linux only] [137541] Critical CVE-2012-2859: Crash in tab handling. Credit to Jeff Roberts of Google Security Team.
[137671] Medium CVE-2012-2860: Out-of-bounds access when clicking in date picker. Credit to Chamal de Silva.
Google Chrome Releases reports:
[129898] High CVE-2012-2842: Use-after-free in counter handling. Credit to miaubiz.
[130595] High CVE-2012-2843: Use-after-free in layout height tracking. Credit to miaubiz.
[133450] High CVE-2012-2844: Bad object access with JavaScript in PDF. Credit to Alexey Samsonov of Google.
Rails core team reports:
This version contains three important security fixes, please upgrade immediately.
One of security fixes impacts all users and is related to HTML escaping code. The other two fixes impacts people using select_tag's prompt option and strip_tags helper from ActionPack.
CVE-2012-3463 Potential XSS Vulnerability in select_tag prompt.
CVE-2012-3464 Potential XSS Vulnerability in the HTML escaping code.
CVE-2012-3465 XSS Vulnerability in strip_tags.
ISS reports:
sudosh2 and sudosh3 are vulnerable to a stack-based buffer overflow, caused by improper bounds checking by the replay() function. By persuading a victim to replay a specially-crafted recorded sudo session, a local attacker could overflow a buffer and execute arbitrary code on the system with elevated privileges or cause the application to crash.
Problem description:
BIND 9 stores a cache of query names that are known to be failing due to misconfigured name servers or a broken chain of trust. Under high query loads, when DNSSEC validation is active, it is possible for a condition to arise in which data from this cache of failing queries could be used before it was fully initialized, triggering an assertion failure.
GNU reports:
The recipe of the 'distcheck' target granted temporary world-write permissions on the extracted distdir. This introduced a locally exploitable race condition for those who run "make distcheck" with a non-restrictive umask (e.g., 022) in a directory that was accessible by others. A successful exploit would result in arbitrary code execution with the privileges of the user running "make distcheck".
It is important to stress that this vulnerability impacts not only the Automake package itself, but all packages with Automake-generated makefiles. For an effective fix it is necessary to regenerate the Makefile.in files with a fixed Automake version.
The Mozilla Project reports:
MFSA 2012-42 Miscellaneous memory safety hazards (rv:14.0/ rv:10.0.6)
MFSA 2012-43 Incorrect URL displayed in addressbar through drag and drop
MFSA 2012-44 Gecko memory corruption
MFSA 2012-45 Spoofing issue with location
MFSA 2012-46 XSS through data: URLs
MFSA 2012-47 Improper filtering of javascript in HTML feed-view
MFSA 2012-48 use-after-free in nsGlobalWindow::PageHidden
MFSA 2012-49 Same-compartment Security Wrappers can be bypassed
MFSA 2012-50 Out of bounds read in QCMS
MFSA 2012-51 X-Frame-Options header ignored when duplicated
MFSA 2012-52 JSDependentString::undepend string conversion results in memory corruption
MFSA 2012-53 Content Security Policy 1.0 implementation errors cause data leakage
MFSA 2012-54 Clickjacking of certificate warning page
MFSA 2012-55 feed: URLs with an innerURI inherit security context of page
MFSA 2012-56 Code execution through javascript: URLs
Apache reports:
Insecure handling of LD_LIBRARY_PATH was found that could lead to the current working directory to be searched for DSOs. This could allow a local user to execute code as root if an administrator runs apachectl from an untrusted directory.
The Django project reports:
Today the Django team is issuing multiple releases -- Django 1.3.2 and Django 1.4.1 -- to remedy security issues reported to us:
- Cross-site scripting in authentication views
- Denial-of-service in image validation
- Denial-of-service via get_image_dimensions()
All users are encouraged to upgrade Django immediately.
The following security issues have been discovered in Bugzilla:
Information Leak
Versions: 4.1.1 to 4.2.1, 4.3.1
In HTML bugmails, all bug IDs and attachment IDs are linkified, and hovering these links displays a tooltip with the bug summary or the attachment description if the user is allowed to see the bug or attachment. But when validating user permissions when generating the email, the permissions of the user who edited the bug were taken into account instead of the permissions of the addressee. This means that confidential information could be disclosed to the addressee if the other user has more privileges than the addressee. Plain text bugmails are not affected as bug and attachment IDs are not linkified.
Information Leak
Versions: 2.17.5 to 3.6.9, 3.7.1 to 4.0.6, 4.1.1 to 4.2.1, 4.3.1
The description of a private attachment could be visible to a user who hasn't permissions to access this attachment if the attachment ID is mentioned in a public comment in a bug that the user can see.
Tom Hendrikx reports:
It is possible to crash (SIGSEGV) a NSD child server process by sending it a DNS packet from any host on the internet and the per zone stats build option is enabled. A crashed child process will automatically be restarted by the parent process, but an attacker may keep the NSD server occupied restarting child processes by sending it a stream of such packets effectively preventing the NSD server to serve.
There is a DoS vulnerability in Action Pack digest authentication handling in authenticate_or_request_with_http_digest.
The RT development team reports:
RT::Authen::ExternalAuth 0.10 and below (for all versions of RT) are vulnerable to an escalation of privilege attack where the URL of a RSS feed of the user can be used to acquire a fully logged-in session as that user. CVE-2012-2770 has been assigned to this vulnerability.
Users of RT 3.8.2 and above should upgrade to RT::Authen::ExternalAuth 0.11, which resolves this vulnerability.
ISC reports:
An unexpected client identifier parameter can cause the ISC DHCP daemon to segmentation fault when running in DHCPv6 mode, resulting in a denial of service to further client requests. In order to exploit this condition, an attacker must be able to send requests to the DHCP server.
An error in the handling of malformed client identifiers can cause a DHCP server running affected versions (see "Impact") to enter a state where further client requests are not processed and the server process loops endlessly, consuming all available CPU cycles. Under normal circumstances this condition should not be triggered, but a non-conforming or malicious client could deliberately trigger it in a vulnerable server. In order to exploit this condition an attacker must be able to send requests to the DHCP server.
Two memory leaks have been found and fixed in ISC DHCP. Both are reproducible when running in DHCPv6 mode (with the -6 command-line argument.) The first leak is confirmed to only affect servers operating in DHCPv6 mode, but based on initial code analysis the second may theoretically affect DHCPv4 servers (though this has not been demonstrated.)
ISC reports:
High numbers of queries with DNSSEC validation enabled can cause an assertion failure in named, caused by using a 'bad cache' data structure before it has been initialized.
BIND 9 stores a cache of query names that are known to be failing due to misconfigured name servers or a broken chain of trust. Under high query loads when DNSSEC validation is active, it is possible for a condition to arise in which data from this cache of failing queries could be used before it was fully initialized, triggering an assertion failure.
This bug cannot be encountered unless your server is doing DNSSEC validation.
rubygem-activerecord -- multiple vulernabilities
Due to the way Active Record interprets parameters in combination with the way that Rack parses query parameters, it is possible for an attacker to issue unexpected database queries with "IS NULL" where clauses. This issue does *not* let an attacker insert arbitrary values into an SQL query, however they can cause the query to check for NULL where most users wouldn't expect it.
Due to the way Active Record handles nested query parameters, an attacker can use a specially crafted request to inject some forms of SQL into your application's SQL queries.
The PHP Development Team reports:
The release of PHP 5.4.15 and 5.4.5 fix a potential overflow in _php_stream_scandir
Marek Vavrusa and Lubos Slovak report:
It is possible to crash (SIGSEGV) a NSD child server process by sending it a non-standard DNS packet from any host on the internet. A crashed child process will automatically be restarted by the parent process, but an attacker may keep the NSD server occupied restarting child processes by sending it a stream of such packets effectively preventing the NSD server to serve.
The Changelog for version 1.2.1 says: Fixed a regression caused by 1.2.0[6] in which decompressing corrupt JPEG images (specifically, images in which the component count was erroneously set to a large value) would cause libjpeg-turbo to segfault.
A Heap-based buffer overflow was found in the way libjpeg-turbo decompressed certain corrupt JPEG images in which the component count was erroneously set to a large value. An attacker could create a specially-crafted JPEG image that, when opened, could cause an application using libpng to crash or, possibly, execute arbitrary code with the privileges of the user running the application.
Secunia Research reports:
Secunia Research has discovered a vulnerability in DokuWiki, which can be exploited by malicious people to conduct cross-site scripting attacks.
Input passed to the "ns" POST parameter in lib/exe/ajax.php (when "call" is set to "medialist" and "do" is set to "media") is not properly sanitised within the "tpl_mediaFileList()" function in inc/template.php before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
puppet -- multiple vulnerabilities
Arbitrary file read on the puppet master from authenticated clients (high). It is possible to construct an HTTP get request from an authenticated client with a valid certificate that will return the contents of an arbitrary file on the Puppet master that the master has read-access to.
Arbitrary file delete/D.O.S on Puppet Master from authenticated clients (high). Given a Puppet master with the "Delete" directive allowed in auth.conf for an authenticated host, an attacker on that host can send a specially crafted Delete request that can cause an arbitrary file deletion on the Puppet master, potentially causing a denial of service attack. Note that this vulnerability does *not* exist in Puppet as configured by default.
The last_run_report.yaml is world readable (medium). The most recent Puppet run report is stored on the Puppet master with world-readable permissions. The report file contains the context diffs of any changes to configuration on an agent, which may contain sensitive information that an attacker can then access. The last run report is overwritten with every Puppet run.
Arbitrary file read on the Puppet master by an agent (medium). This vulnerability is dependent upon vulnerability "last_run_report.yml is world readable" above. By creating a hard link of a Puppet-managed file to an arbitrary file that the Puppet master can read, an attacker forces the contents to be written to the puppet run summary. The context diff is stored in last_run_report.yaml, which can then be accessed by the attacker.
Insufficient input validation for agent hostnames (low). An attacker could trick the administrator into signing an attacker's certificate rather than the intended one by constructing specially crafted certificate requests containing specific ANSI control sequences. It is possible to use the sequences to rewrite the order of text displayed to an administrator such that display of an invalid certificate and valid certificate are transposed. If the administrator signs the attacker's certificate, the attacker can then man-in-the-middle the agent.
Agents with certnames of IP addresses can be impersonated (low). If an authenticated host with a certname of an IP address changes IP addresses, and a second host assumes the first host's former IP address, the second host will be treated by the puppet master as the first one, giving the second host access to the first host's catalog. Note: This will not be fixed in Puppet versions prior to the forthcoming 3.x. Instead, with this announcement IP-based authentication in Puppet < 3.x is deprecated.
Asterisk project reports:
Possible resource leak on uncompleted re-invite transactions.
Remote crash vulnerability in voice mail application.
Typo3 Security Report (TYPO3-CORE-SA-2012-003):
TYPO3 bundles and uses an external JavaScript and Flash Upload Library called swfupload. TYPO3 can be configured to use this Flash uploader. Input passed via the "movieName" parameter to swfupload.swf is not properly sanitised before being used in a call to "ExternalInterface.call()". This can be exploited to execute arbitrary script code in a user's browser session in context of an affected site. The existance of the swfupload library is sufficient to be vulnerable to the reported problem.
Zero Science Lab reports:
Input passed via the parameter 'sortby' is not properly sanitised before being returned to the user or used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. The param 'num' is vulnerable to a XSS issue where the attacker can execute arbitrary HTML and script code in a user's browser session in context of an affected site.
Google Chrome Releases reports:
[118633] Low CVE-2012-2815: Leak of iframe fragment id. Credit to Elie Bursztein of Google.
[120222] High CVE-2012-2817: Use-after-free in table section handling. Credit to miaubiz.
[120944] High CVE-2012-2818: Use-after-free in counter layout. Credit to miaubiz.
[120977] High CVE-2012-2819: Crash in texture handling. Credit to Ken "gets" Russell of the Chromium development community.
[121926] Medium CVE-2012-2820: Out-of-bounds read in SVG filter handling. Credit to Atte Kettunen of OUSPG.
[122925] Medium CVE-2012-2821: Autofill display problem. Credit to "simonbrown60".
[various] Medium CVE-2012-2822: Misc. lower severity OOB read issues in PDF. Credit to awesome ASAN and various Googlers (Kostya Serebryany, Evgeniy Stepanov, Mateusz Jurczyk, Gynvael Coldwind).
[124356] High CVE-2012-2823: Use-after-free in SVG resource handling. Credit to miaubiz.
[125374] High CVE-2012-2824: Use-after-free in SVG painting. Credit to miaubiz.
[128688] Medium CVE-2012-2826: Out-of-bounds read in texture conversion. Credit to Google Chrome Security Team (Inferno).
[Mac only] [129826] Low CVE-2012-2827: Use-after-free in Mac UI. Credit to the Chromium development community (Dharani Govindan).
[129857] High CVE-2012-2828: Integer overflows in PDF. Credit to Mateusz Jurczyk of Google Security Team and Google Chrome Security Team (Chris Evans).
[129947] High CVE-2012-2829: Use-after-free in first-letter handling. Credit to miaubiz.
[129951] High CVE-2012-2830: Wild pointer in array value setting. Credit to miaubiz.
[130356] High CVE-2012-2831: Use-after-free in SVG reference handling. Credit to miaubiz.
[131553] High CVE-2012-2832: Uninitialized pointer in PDF image codec. Credit to Mateusz Jurczyk of Google Security Team.
[132156] High CVE-2012-2833: Buffer overflow in PDF JS API. Credit to Mateusz Jurczyk of Google Security Team.
[132779] High CVE-2012-2834: Integer overflow in Matroska container. Credit to Juri Aedla.
Problem description:
FreeBSD/amd64 runs on CPUs from different vendors. Due to varying behaviour of CPUs in 64 bit mode a sanity check of the kernel may be insufficient when returning from a system call.
Successful exploitation of the problem can lead to local kernel privilege escalation, kernel data corruption and/or crash. To exploit this vulnerability, an attacker must be able to run code with user privileges on the target system.
Problem description:
The named(8) server does not properly handle DNS resource records where the RDATA field is zero length, which may cause various issues for the servers handling them.
Resolving servers may crash or disclose some portion of memory to the client. Authoritative servers may crash on restart after transferring a zone containing records with zero-length RDATA fields. These would result in a denial of service, or leak of sensitive information.
Problem description:
There is a programming error in the DES implementation used in crypt() when handling input which contains characters that can not be represented with 7-bit ASCII.
When the input contains characters with only the most significant bit set (0x80), that character and all characters after it will be ignored.
Problem description:
OpenSSL fails to clear the bytes used as block cipher padding in SSL 3.0 records when operating as a client or a server that accept SSL 3.0 handshakes. As a result, in each record, up to 15 bytes of uninitialized memory may be sent, encrypted, to the SSL peer. This could include sensitive contents of previously freed memory. [CVE-2011-4576]
OpenSSL support for handshake restarts for server gated cryptography (SGC) can be used in a denial-of-service attack. [CVE-2011-4619]
If an application uses OpenSSL's certificate policy checking when verifying X509 certificates, by enabling the X509_V_FLAG_POLICY_CHECK flag, a policy check failure can lead to a double-free. [CVE-2011-4109]
A weakness in the OpenSSL PKCS #7 code can be exploited using Bleichenbacher's attack on PKCS #1 v1.5 RSA padding also known as the million message attack (MMA). [CVE-2012-0884]
The asn1_d2i_read_bio() function, used by the d2i_*_bio and d2i_*_fp functions, in OpenSSL contains multiple integer errors that can cause memory corruption when parsing encoded ASN.1 data. This error can occur on systems that parse untrusted ASN.1 data, such as X.509 certificates or RSA public keys. [CVE-2012-2110]
Dwayne C. Litzenberger of PyCrypto reports:
In the ElGamal schemes (for both encryption and signatures), g is supposed to be the generator of the entire Z^*_p group. However, in PyCrypto 2.5 and earlier, g is more simply the generator of a random sub-group of Z^*_p.
The result is that the signature space (when the key is used for signing) or the public key space (when the key is used for encryption) may be greatly reduced from its expected size of log(p) bits, possibly down to 1 bit (the worst case if the order of g is 2).
While it has not been confirmed, it has also been suggested that an attacker might be able to use this fact to determine the private key.
Anyone using ElGamal keys should generate new keys as soon as practical.
Any additional information about this bug will be tracked at https://bugs.launchpad.net/pycrypto/+bug/985164
Joomla! reported a Core Privilege Escalation::
Inadequate checking leads to possible user privilege escalation..
MITRE Advisories report:
The TAR parser allows remote attackers to bypass malware detection via a POSIX TAR file with an initial [aliases] character sequence.
The TAR parser allows remote attackers to bypass malware detection via a TAR archive entry with a length field that exceeds the total TAR file size.
The Microsoft CHM file parser allows remote attackers to bypass malware detection via a crafted reset interval in the LZXC header of a CHM file.
The TAR file parser allows remote attackers to bypass malware detection via a TAR archive entry with a length field corresponding to that entire entry, plus part of the header ofxi the next entry.
Asterisk project reports:
Skinny Channel Driver Remote Crash Vulnerability.
ImageMagick reports:
Three vulnerabilities have been identified in ImageMagick's handling of JPEG and TIFF files. With these vulnerabilities, it is possible to cause a denial of service situation in the target system.
Mantis reports:
Roland Becker and Damien Regad (MantisBT developers) found that any user able to report issues via the SOAP interface could also modify any bugnotes (comments) created by other users. In a default/typical MantisBT installation, SOAP API is enabled and any user can sign up to report new issues. This vulnerability therefore impacts upon many public facing MantisBT installations.
Roland Becker (MantisBT developer) found that the delete_attachments_threshold permission was not being checked when a user attempted to delete an attachment from an issue. The more generic update_bug_threshold permission was being checked instead. MantisBT administrators may have been under the false impression that their configuration of the delete_attachments_threshold was successfully preventing unwanted users from deleting attachments.
Adobe reports:
These vulnerabilities could cause a crash and potentially allow an attacker to take control of the affected system.
The Mozilla Project reports:
MFSA 2012-34 Miscellaneous memory safety hazards (rv:13.0/ rv:10.0.5)
MFSA 2012-36 Content Security Policy inline-script bypass
MFSA 2012-37 Information disclosure though Windows file shares and shortcut files
MFSA 2012-38 Use-after-free while replacing/inserting a node in a document
MFSA 2012-39 NSS parsing errors with zero length items
MFSA 2012-40 Buffer overflow and use-after-free issues found using Address Sanitizer
CERT reports:
If a pre-configured BGP peer sends a specially-crafted OPEN message with a malformed ORF capability TLV, Quagga bgpd process will erroneously try to consume extra bytes from the input packet buffer. The process will detect a buffer overrun attempt before it happens and immediately terminate with an error message. All BGP sessions established by the attacked router will be closed and its BGP routing disrupted.
David Verdin reports:
Multiple vulnerabilities have been discovered in Sympa archive management that allow to skip the scenario-based authorization mechanisms.
This vulnerability allows the attacker to:
- display the archives management page ('arc_manage')
- download the list's archives
- delete the list's archives
ISC reports:
Processing of DNS resource records where the rdata field is zero length may cause various issues for the servers handling them.
Processing of these records may lead to unexpected outcomes. Recursive servers may crash or disclose some portion of memory to the client. Secondary servers may crash on restart after transferring a zone containing these records. Master servers may corrupt zone data if the zone option "auto-dnssec" is set to "maintain". Other unexpected problems that are not listed here may also be encountered.
Impact: This issue primarily affects recursive nameservers. Authoritative nameservers will only be impacted if an administrator configures experimental record types with no data. If the server is configured this way, then secondaries can crash on restart after transferring that zone. Zone data on the master can become corrupted if the zone with those records has named configured to manage the DNSSEC key rotation.
The PostgreSQL Global Development Group reports:
Today the PHP, OpenBSD and FreeBSD communities announced updates to patch a security hole involving their crypt() hashing algorithms. This issue is described in CVE-2012-2143. This vulnerability also affects a minority of PostgreSQL users, and will be fixed in an update release on June 4, 2012.
Affected users are those who use the crypt(text, text) function with DES encryption in the optional pg_crypto module. Passwords affected are those that contain characters that cannot be represented with 7-bit ASCII. If a password contains a character that has the most significant bit set (0x80), and DES encryption is used, that character and all characters after it will be ignored.
Networkupstools project reports:
NUT server (upsd), from versions 2.4.0 to 2.6.3, are exposed to crashes when receiving random data from the network.
This issue is related to the way NUT parses characters, especially from the network. Non printable characters were missed from strings operation (such as strlen), but still copied to the buffer, causing an overflow.
Asterisk project reports:
Remote crash vulnerability in IAX2 channel driver.
Skinny Channel Driver Remote Crash Vulnerability
Google Chrome Releases reports:
[117409] High CVE-2011-3103: Crashes in v8 garbage collection. Credit to the Chromium development community (Brett Wilson).
[118018] Medium CVE-2011-3104: Out-of-bounds read in Skia. Credit to Google Chrome Security Team (Inferno).
[120912] High CVE-2011-3105: Use-after-free in first-letter handling. Credit to miaubiz.
[122654] Critical CVE-2011-3106: Browser memory corruption with websockets over SSL. Credit to the Chromium development community (Dharani Govindan).
[124625] High CVE-2011-3107: Crashes in the plug-in JavaScript bindings. Credit to the Chromium development community (Dharani Govindan).
[125159] Critical CVE-2011-3108: Use-after-free in browser cache. Credit to "efbiaiinzinz".
[Linux only] [126296] High CVE-2011-3109: Bad cast in GTK UI. Credit to Micha Bartholome.
[126337] [126343] [126378] [127349] [127819] [127868] High CVE-2011-3110: Out of bounds writes in PDF. Credit to Mateusz Jurczyk of the Google Security Team, with contributions by Gynvael Coldwind of the Google Security Team.
[126414] Medium CVE-2011-3111: Invalid read in v8. Credit to Christian Holler.
[127331] High CVE-2011-3112: Use-after-free with invalid encrypted PDF. Credit to Mateusz Jurczyk of the Google Security Team, with contributions by Gynvael Coldwind of the Google Security Team.
[127883] High CVE-2011-3113: Invalid cast with colorspace handling in PDF. Credit to Mateusz Jurczyk of the Google Security Team, with contributions by Gynvael Coldwind of the Google Security Team.
[128014] High CVE-2011-3114: Buffer overflows with PDF functions. Credit to Google Chrome Security Team (scarybeasts).
[128018] High CVE-2011-3115: Type corruption in v8. Credit to Christian Holler.
HAProxy reports:
A flaw was reported in HAProxy where, due to a boundary error when copying data into the trash buffer, an external attacker could cause a buffer overflow. Exploiting this flaw could lead to the execution of arbitrary code, however it requires non-default settings for the global.tune.bufsize configuration option (must be set to a value greater than the default), and also that header rewriting is enabled (via, for example, the regrep or rsprep directives). This flaw is reported against 1.4.20, prior versions may also be affected.
BestPractical report:
Internal audits of the RT codebase have uncovered a number of security vulnerabilities in RT. We are releasing versions 3.8.12 and 4.0.6 to resolve these vulnerabilities, as well as patches which apply atop all released versions of 3.8 and 4.0.
The vulnerabilities addressed by 3.8.12, 4.0.6, and the below patches include the following:
The previously released tool to upgrade weak password hashes as part of CVE-2011-0009 was an incomplete fix and failed to upgrade passwords of disabled users.
RT versions 3.0 and above contain a number of cross-site scripting (XSS) vulnerabilities which allow an attacker to run JavaScript with the user's credentials. CVE-2011-2083 is assigned to this vulnerability.
RT versions 3.0 and above are vulnerable to multiple information disclosure vulnerabilities. This includes the ability for privileged users to expose users' previous password hashes -- this vulnerability is particularly dangerous given RT's weak hashing previous to the fix in CVE-2011-0009. A separate vulnerability allows privileged users to obtain correspondence history for any ticket in RT. CVE-2011-2084 is assigned to this vulnerability.
All publicly released versions of RT are vulnerable to cross-site request forgery (CSRF). CVE-2011-2085 is assigned to this vulnerability.
We have also added a separate configuration option ($RestrictLoginReferrer) to prevent login CSRF, a different class of CSRF attack.
RT versions 3.6.1 and above are vulnerable to a remote execution of code vulnerability if the optional VERP configuration options ($VERPPrefix and $VERPDomain) are enabled. RT 3.8.0 and higher are vulnerable to a limited remote execution of code which can be leveraged for privilege escalation. RT 4.0.0 and above contain a vulnerability in the global $DisallowExecuteCode option, allowing sufficiently privileged users to still execute code even if RT was configured to not allow it. CVE-2011-4458 is assigned to this set of vulnerabilities.
RT versions 3.0 and above may, under some circumstances, still respect rights that a user only has by way of a currently-disabled group. CVE-2011-4459 is assigned to this vulnerability.
RT versions 2.0 and above are vulnerable to a SQL injection attack, which allow privileged users to obtain arbitrary information from the database. CVE-2011-4460 is assigned to this vulnerability.
Secunia team reports:
Multiple vulnerabilities have been reported in Sympa, which can be exploited by malicious people to bypass certain security restrictions.
The vulnerabilities are caused due to the application allowing access to archive functions without checking credentials. This can be exploited to create, download, and delete an archive.
Foswiki team reports:
When a new user registers, the new user can add arbitrary HTML and script code into the user topic which is generated by the RegistrationAgent via standard registration fields such as "FirstName" or "OrganisationName".
By design, Foswiki's normal editing features allow arbitrary HTML markup, including script code, to be inserted into any topic anyway, assuming the authenticated user has CHANGE permission - which is the case on many Foswiki sites. However, the assumption that only authenticated users with CHANGE permission may create script content is false if new users exploit the vulnerability detailed in this alert to manipulate the registration agent into creating that content for them.
Google chrome team reports:
An off-by-one out-of-bounds write flaw was found in the way libxml, a library for providing XML and HTML support, evaluated certain XPointer parts (XPointer is used by libxml to include only the part from the returned XML document, that can be accessed using the XPath expression given with the XPointer). A remote attacker could provide a specially-crafted XML file, which once opened in an application, linked against libxml, would lead to that application crash, or, potentially arbitrary code execution with the privileges of the user running the application.
Note: The flaw to be exploited requires the particular application, linked against libxml, to use the XPointer evaluation functionality.
InspIRCd reports:
InspIRCd contains a heap corruption vulnerability that exists in the dns.cpp code. The res[] buffer is allocated on the heap and can be overflowed. The res[] buffer can be exploited during its deallocation. The number of overflowed bytes can be controlled with DNS compression features.
The authors report:
Versions 3.2.0 and earlier of the pidgin-otr plugin contain a format string security flaw. This flaw could potentially be exploited by a remote attacker to cause arbitrary code to be executed on the user's machine.
The flaw is in pidgin-otr, not in libotr. Other applications that use libotr are not affected.
Todd Miller reports:
Sudo supports granting access to commands on a per-host basis. The host specification may be in the form of a host name, a netgroup, an IP address, or an IP network (an IP address with an associated netmask).
When IPv6 support was added to sudo, a bug was introduced that caused the IPv6 network matching code to be called when an IPv4 network address does not match. Depending on the value of the uninitialized portion of the IPv6 address, it is possible for the IPv4 network number to match when it should not. This bug only affects IP network matching and does not affect simple IP address matching.
The reported configuration that exhibited the bug was an LDAP-based sudo installation where the sudoRole object contained multiple sudoHost entries, each containing a different IPv4 network. File-based sudoers should be affected as well as the same matching code is used.
OpenSSL security team reports:
A flaw in the OpenSSL handling of CBC mode ciphersuites in TLS 1.1, 1.2 and DTLS can be exploited in a denial of service attack on both clients and servers.
Google Chrome Releases reports:
[112983] Low CVE-2011-3083: Browser crash with video + FTP. Credit to Aki Helin of OUSPG.
[113496] Low CVE-2011-3084: Load links from internal pages in their own process. Credit to Brett Wilson of the Chromium development community.
[118374] Medium CVE-2011-3085: UI corruption with long autofilled values. Credit to "psaldorn".
[118642] High CVE-2011-3086: Use-after-free with style element. Credit to Arthur Gerkis.
[118664] Low CVE-2011-3087: Incorrect window navigation. Credit to Charlie Reis of the Chromium development community.
[120648] Medium CVE-2011-3088: Out-of-bounds read in hairline drawing. Credit to Aki Helin of OUSPG.
[120711] High CVE-2011-3089: Use-after-free in table handling. Credit to miaubiz.
[121223] Medium CVE-2011-3090: Race condition with workers. Credit to Arthur Gerkis.
[121734] High CVE-2011-3091: Use-after-free with indexed DB. Credit to Google Chrome Security Team (Inferno).
[122337] High CVE-2011-3092: Invalid write in v8 regex. Credit to Christian Holler.
[122585] Medium CVE-2011-3093: Out-of-bounds read in glyph handling. Credit to miaubiz.
[122586] Medium CVE-2011-3094: Out-of-bounds read in Tibetan handling. Credit to miaubiz.
[123481] High CVE-2011-3095: Out-of-bounds write in OGG container. Credit to Hannu Heikkinen.
[Linux only] [123530] Low CVE-2011-3096: Use-after-free in GTK omnibox handling. Credit to Arthur Gerkis.
[123733] [124182] High CVE-2011-3097: Out-of-bounds write in sampled functions with PDF. Credit to Kostya Serebryany of Google and Evgeniy Stepanov of Google.
[124479] High CVE-2011-3099: Use-after-free in PDF with corrupt font encoding name. Credit to Mateusz Jurczyk of Google Security Team and Gynvael Coldwind of Google Security Team.
[124652] Medium CVE-2011-3100: Out-of-bounds read drawing dash paths. Credit to Google Chrome Security Team (Inferno).
The socat development team reports:
This vulnerability can be exploited when socat is invoked with the READLINE address (this is usually only used interactively) without option "prompt" and without option "noprompt" and an attacker succeeds to provide malicious data to the other (arbitrary) address that is then transferred by socat to the READLINE address for output.
Successful exploitation may allow an attacker to execute arbitrary code with the privileges of the socat process.
The PHP Development Team reports:
The release of PHP 5.4.13 and 5.4.3 complete a fix for the vulnerability in CGI-based setups as originally described in CVE-2012-1823. (CVE-2012-2311)
Note: mod_php and php-fpm are not vulnerable to this attack.
PHP 5.4.3 fixes a buffer overflow vulnerability in the apache_request_headers() (CVE-2012-2329).
Pidgin reports:
A series of specially crafted file transfer requests can cause clients to reference invalid memory. The user must have accepted one of the file transfer requests.
High-Tech Bridge reports:
Input passed via the "file" GET parameter to /pivotx/ajaxhelper.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in administrator's browser session in context of the affected website.
NVIDIA Unix security team reports:
Security vulnerability CVE-2012-0946 in the NVIDIA UNIX driver was disclosed to NVIDIA on March 20th, 2012. The vulnerability makes it possible for an attacker who has read and write access to the GPU device nodes to reconfigure GPUs to gain access to arbitrary system memory. NVIDIA is not aware of any reports of this vulnerability, outside of the disclosure which was made privately to NVIDIA.
NVIDIA has identified the root cause of the vulnerability and has released updated drivers which close it. [NVIDIA encourages] all users with Geforce 8 or newer, G80 Quadro or newer, and all Tesla GPUs to update their drivers to 295.40 or later.
Later, it was additionally discovered that similar exploit could be achieved through remapping of VGA window:
NVIDIA received notification of a security exploit that uses NVIDIA UNIX device files to map and program registers to redirect the VGA window. Through the VGA window, the exploit can access any region of physical system memory. This arbitrary memory access can be further exploited, for example, to escalate user privileges.
rubygem-mail -- multiple vulnerabilities
Two issues were fixed. They are a file system traversal in file_delivery method and arbitrary command execution when using exim or sendmail from the command line.
Private information disclosure
An attacker can cause private information disclosure.
Unsafe Temporary file creation
Config::IniFiles used a predictable name for its temporary file without opening it correctly.
php development team reports:
Security Enhancements and Fixes in PHP 5.3.12:
- Initial fix for cgi-bin ?-s cmdarg parse issue (CVE-2012-1823)
Hanno Boeck reports:
Fixes [are now available] for various security vulnerabilities including LFI (local file inclusion), XSS (cross site scripting) and others.
Google Chrome Releases reports:
[106413] High CVE-2011-3078: Use after free in floats handling. Credit to Google Chrome Security Team (Marty Barbella) and independent later discovery by miaubiz.
[117627] Medium CVE-2011-3079: IPC validation failure. Credit to PinkiePie.
[121726] Medium CVE-2011-3080: Race condition in sandbox IPC. Credit to Willem Pinckaers of Matasano.
[121899] High CVE-2011-3081: Use after free in floats handling. Credit to miaubiz.
[117110] High CVE-2012-1521: Use after free in xml parser. Credit to Google Chrome Security Team (SkyLined) and independent later discovery by wushi of team509 reported through iDefense VCP (V-874rcfpq7z).
php development team reports:
Security Enhancements for both PHP 5.3.11 and PHP 5.4.1:
- Insufficient validating of upload name leading to corrupted $_FILES indices. (CVE-2012-1172)
- Add open_basedir checks to readline_write_history and readline_read_history.
Security Enhancements for both PHP 5.3.11 only:
- Regression in magic_quotes_gpc fix for CVE-2012-0831.
The Samba project reports:
Samba versions 3.4.x to 3.6.4 inclusive are affected by a vulnerability that allows arbitrary users to modify privileges on a file server.
Security checks were incorrectly applied to the Local Security Authority (LSA) remote proceedure calls (RPC) CreateAccount, OpenAccount, AddAccountRights and RemoveAccountRights allowing any authenticated user to modify the privileges database.
This is a serious error, as it means that authenticated users can connect to the LSA and grant themselves the "take ownership" privilege. This privilege is used by the smbd file server to grant the ability to change ownership of a file or directory which means users could take ownership of files or directories they do not own.
Ports security team reports:
The portupgrade-devel port fetched directly from a git respository without checking against a known good SHA hash. This means that it is possible that packages built using this port may not match the one vetted by the maintainer. Users are advised to rebuild portupgrade-devel from known good sources.
The Red Hat Security Response Team reports:
An array index error, leading to out-of heap-based buffer read flaw was found in the way the net-snmp agent performed lookups in the extension table. When certain MIB subtrees were handled by the extend directive, a remote attacker (having read privileges to the subntree) could use this flaw to cause a denial of service condition via an SNMP GET request involving a non-existent extension table entry.
The Mozilla Project reports:
MFSA 2012-20 Miscellaneous memory safety hazards (rv:12.0/ rv:10.0.4)
MFSA 2012-21 Multiple security flaws fixed in FreeType v2.4.9
MFSA 2012-22 use-after-free in IDBKeyRange
MFSA 2012-23 Invalid frees causes heap corruption in gfxImageSurface
MFSA 2012-24 Potential XSS via multibyte content processing errors
MFSA 2012-25 Potential memory corruption during font rendering using cairo-dwrite
MFSA 2012-26 WebGL.drawElements may read illegal video memory due to FindMaxUshortElement error
MFSA 2012-27 Page load short-circuit can lead to XSS
MFSA 2012-28 Ambiguous IPv6 in Origin headers may bypass webserver access restrictions
MFSA 2012-29 Potential XSS through ISO-2022-KR/ISO-2022-CN decoding issues
MFSA 2012-30 Crash with WebGL content using textImage2D
MFSA 2012-31 Off-by-one error in OpenType Sanitizer
MFSA 2012-32 HTTP Redirections and remote content can be read by javascript errors
MFSA 2012-33 Potential site identity spoofing when loading RSS and Atom feeds
Andy Webber reports:
Add User appears to be vulnerable to Cross Site Request Forgery (CSRF/XSRF).
Asterisk project reports:
Remote Crash Vulnerability in SIP Channel Driver
Heap Buffer Overflow in Skinny Channel Driver
Asterisk Manager User Unauthorized Shell Access
Wordpress reports:
External code has been updated to non-vulnerable versions. In addition the following bugs have been fixed:
- Limited privilege escalation where a site administrator could deactivate network-wide plugins when running a WordPress network under particular circumstances.
- Cross-site scripting vulnerability when making URLs clickable.
- Cross-site scripting vulnerabilities in redirects after posting comments in older browsers, and when filtering URLs.
OpenSSL security team reports:
A potentially exploitable vulnerability has been discovered in the OpenSSL function asn1_d2i_read_bio. Any application which uses BIO or FILE based functions to read untrusted DER format data is vulnerable. Affected functions are of the form d2i_*_bio or d2i_*_fp, for example d2i_X509_bio or d2i_PKCS12_fp.
The following security issues have been discovered in Bugzilla:
Unauthorized Access
Due to a lack of proper validation of the X-FORWARDED-FOR header of an authentication request, an attacker could bypass the current lockout policy used for protection against brute- force password discovery. This vulnerability can only be exploited if the 'inbound_proxies' parameter is set.
Cross Site Scripting
A JavaScript template used by buglist.cgi could be used by a malicious script to permit an attacker to gain access to some information about bugs he would not normally be allowed to see, using the victim's credentials. To be exploitable, the victim must be logged in when visiting the attacker's malicious page.
All affected installations are encouraged to upgrade as soon as possible.
Typo Security Team reports:
Failing to properly encode the output, the default TYPO3 Exception Handler is susceptible to Cross-Site Scripting. We are not aware of a possibility to exploit this vulnerability without third party extensions being installed that put user input in exception messages. However, it has come to our attention that extensions using the extbase MVC framework can be used to exploit this vulnerability if these extensions accept objects in controller actions.
The nginx project reports:
Buffer overflow in the ngx_http_mp4_module
The phpMyFAQ project reports:
The bundled ImageManager library allows injection of arbitrary PHP code to execute arbitrary PHP code and upload malware and trojan horses.
Multiple vulnerabilities exist in puppet that can result in arbitrary code execution, arbitrary file read access, denial of service, and arbitrary file write access. Please review the details in each of the CVEs for additional information.
Samba development team reports:
Samba versions 3.6.3 and all versions previous to this are affected by a vulnerability that allows remote code execution as the "root" user from an anonymous connection.
As this does not require an authenticated connection it is the most serious vulnerability possible in a program, and users and vendors are encouraged to patch their Samba installations immediately.
A Bugzilla Security Advisory reports:
The following security issues have been discovered in Bugzilla:
- Due to a lack of validation of the enctype form attribute when making POST requests to xmlrpc.cgi, a possible CSRF vulnerability was discovered. If a user visits an HTML page with some malicious HTML code in it, an attacker could make changes to a remote Bugzilla installation on behalf of the victim's account by using the XML-RPC API on a site running mod_perl. Sites running under mod_cgi are not affected. Also, the user would have had to be already logged in to the target site for the vulnerability to work.
All affected installations are encouraged to upgrade as soon as possible.
Adobe reports:
Multiple Priority 2 vulnerabilities could cause a crash and potentially allow an attacker to take control of the affected system.
The PNG project reports:
libpng fails to correctly handle malloc() failures for text chunks (in png_set_text_2()), which can lead to memory corruption and the possibility of remote code execution.
The Freetype project reports:
Multiple vulnerabilities exist in freetype that can result in application crashes and remote code execution. Please review the details in each of the CVEs for additional information.
Dave B reports on Full Disclosure:
It seems that mutt fails to check the validity of a SMTP servers certificate during a TLS connection. [...] This means that an attacker could potentially MITM a mutt user connecting to their SMTP server even when the user has forced a TLS connection.
Google Chrome Releases reports:
[106577] Medium CVE-2011-3066: Out-of-bounds read in Skia clipping. Credit to miaubiz.
[117583] Medium CVE-2011-3067: Cross-origin iframe replacement. Credit to Sergey Glazunov.
[117698] High CVE-2011-3068: Use-after-free in run-in handling. Credit to miaubiz.
[117728] High CVE-2011-3069: Use-after-free in line box handling. Credit to miaubiz.
[118185] High CVE-2011-3070: Use-after-free in v8 bindings. Credit to Google Chrome Security Team (SkyLined).
[118273] High CVE-2011-3071: Use-after-free in HTMLMediaElement. Credit to pa_kt, reporting through HP TippingPoint ZDI (ZDI-CAN-1528).
[118467] Low CVE-2011-3072: Cross-origin violation parenting pop-up window. Credit to Sergey Glazunov.
[118593] High CVE-2011-3073: Use-after-free in SVG resource handling. Credit to Arthur Gerkis.
[119281] Medium CVE-2011-3074: Use-after-free in media handling. Credit to Slawomir Blazek.
[119525] High CVE-2011-3075: Use-after-free applying style command. Credit to miaubiz.
[120037] High CVE-2011-3076: Use-after-free in focus handling. Credit to miaubiz.
[120189] Medium CVE-2011-3077: Read-after-free in script bindings. Credit to Google Chrome Security Team (Inferno).
US-CERT reports:
The msn_oim_report_to_user function in oim.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.2 allows remote servers to cause a denial of service (application crash) via an OIM message that lacks UTF-8 encoding.
The phpMYAdmin development team reports:
The show_config_errors.php scripts did not validate the presence of the configuration file, so an error message shows the full path of this file, leading to possible further attacks. For the error messages to be displayed, php.ini's error_reporting must be set to E_ALL and display_errors must be On (these settings are not recommended on a production server in the PHP manual).
Google Chrome Releases reports:
[109574] Medium CVE-2011-3058: Bad interaction possibly leading to XSS in EUC-JP. Credit to Masato Kinugawa.
[112317] Medium CVE-2011-3059: Out-of-bounds read in SVG text handling. Credit to Arthur Gerkis.
[114056] Medium CVE-2011-3060: Out-of-bounds read in text fragment handling. Credit to miaubiz.
[116398] Medium CVE-2011-3061: SPDY proxy certificate checking error. Credit to Leonidas Kontothanassis of Google.
[116524] High CVE-2011-3062: Off-by-one in OpenType Sanitizer. Credit to Mateusz Jurczyk of the Google Security Team.
[117417] Low CVE-2011-3063: Validate navigation requests from the renderer more carefully. Credit to kuzzcc, Sergey Glazunov, PinkiePie and scarybeasts (Google Chrome Security Team).
[117471] High CVE-2011-3064: Use-after-free in SVG clipping. Credit to Atte Kettunen of OUSPG.
[117588] High CVE-2011-3065: Memory corruption in Skia. Credit to Omair.
[117794] Medium CVE-2011-3057: Invalid read in v8. Credit to Christian Holler.
Timothy D. Morgan reports:
In December 2011, VSR identified a vulnerability in multiple open source office products (including OpenOffice, LibreOffice, KOffice, and AbiWord) due to unsafe interpretation of XML files with custom entity declarations. Deeper analysis revealed that the vulnerability was caused by acceptance of external entities by the libraptor library, which is used by librdf and is in turn used by these office products.
In the context of office applications, these vulnerabilities could allow for XML External Entity (XXE) attacks resulting in file theft and a loss of user privacy when opening potentially malicious ODF documents. For other applications which depend on librdf or libraptor, potentially serious consequences could result from accepting RDF/XML content from untrusted sources, though the impact may vary widely depending on the context.
CERT reports:
The ospfd implementation of OSPF in Quagga allows a remote attacker (on a local network segment with OSPF enabled) to cause a denial of service (daemon aborts due to an assert) with a malformed OSPF LS-Update message.
The ospfd implementation of OSPF in Quagga allows a remote attacker (on a local network segment with OSPF enabled) to cause a denial of service (daemon crash) with a malformed OSPF Network- LSA message.
The bgpd implementation of BGP in Quagga allows remote attackers to cause a denial of service (daemon aborts due to an assert) via BGP Open message with an invalid AS4 capability.
CERT-FI reports:
A heap overflow vulnerability has been found in the HTTP (Hypertext Transfer Protocol) protocol handling of Apache Traffic Server. The vulnerability allows an attacker to cause a denial of service or potentially to execute his own code by sending a specially modified HTTP message to an affected server.
Google Chrome Releases reports:
[113902] High CVE-2011-3050: Use-after-free with first-letter handling. Credit to miaubiz.
[116162] High CVE-2011-3045: libpng integer issue from upstream. Credit to Glenn Randers-Pehrson of the libpng project.
[116461] High CVE-2011-3051: Use-after-free in CSS cross-fade handling. Credit to Arthur Gerkis.
[116637] High CVE-2011-3052: Memory corruption in WebGL canvas handling. Credit to Ben Vanik of Google.
[116746] High CVE-2011-3053: Use-after-free in block splitting. Credit to miaubiz.
[117418] Low CVE-2011-3054: Apply additional isolations to webui privileges. Credit to Sergey Glazunov.
[117736] Low CVE-2011-3055: Prompt in the browser native UI for unpacked extension installation. Credit to PinkiePie.
[117550] High CVE-2011-3056: Cross-origin violation with "magic iframe". Credit to Sergey Glazunov.
[117794] Medium CVE-2011-3057: Invalid read in v8. Credit to Christian Holler.
[108648] Low CVE-2011-3049: Extension web request API can interfere with system requests. Credit to Michael Gundlach. Fixed in an earlier release.
Mu Dynamics, Inc. reports:
Various functions using the ASN.1 length decoding logic in Libtasn1 were incorrectly assuming that the return value from asn1_get_length_der is always less than the length of the enclosing ASN.1 structure, which is only true for valid structures and not for intentionally corrupt or otherwise buggy structures.
Mu Dynamics, Inc. reports:
The block cipher decryption logic in GnuTLS assumed that a record containing any data which was a multiple of the block size was valid for further decryption processing, leading to a heap corruption vulnerability.
Asterisk project reports:
Stack Buffer Overflow in HTTP Manager
Remote Crash Vulnerability in Milliwatt Application
The OpenSSL Team reports:
A weakness in the OpenSSL CMS and PKCS #7 code can be exploited using Bleichenbacher's attack on PKCS #1 v1.5 RSA padding also known as the million message attack (MMA).
Only users of CMS, PKCS #7, or S/MIME decryption operations are affected. A successful attack needs on average 2^20 messages. In practice only automated systems will be affected as humans will not be willing to process this many messages.
SSL/TLS applications are *NOT* affected by this problem since the SSL/TLS code does not use the PKCS#7 or CMS decryption code.
nginx development team reports:
Matthew Daley recently discovered a security problem which may lead to a disclosure of previously freed memory on specially crafted response from an upstream server, potentially resulting in sensitive information leak.
The Mozilla Project reports:
MFSA 2012-13 XSS with Drag and Drop and Javascript: URL
MFSA 2012-14 SVG issues found with Address Sanitizer
MFSA 2012-15 XSS with multiple Content Security Policy headers
MFSA 2012-16 Escalation of privilege with Javascript: URL as home page
MFSA 2012-17 Crash when accessing keyframe cssText after dynamic modification
MFSA 2012-18 window.fullScreen writeable by untrusted content
MFSA 2012-19 Miscellaneous memory safety hazards (rv:11.0/ rv:10.0.3 / rv:1.9.2.28)
Michael Gmelin and Jörg Scheinert has reported a remote command execution vulnerability in portaudit.
An attacker who can get the user to use a specially crafted audit file will be able to run commands on the users system, with the privileges of the user running running portaudit (often root).
The attack could e.g. happen through DNS hijacking or a man in the middle attack.
Note that if the user has set up portaudit to run from periodic this attack could happen without direct user interaction.
In the FreeBSD Ports Collection (bsd.port.mk) the check for vulnerable ports at install-time directly operates on the auditfile and has the same vulnerability as portaudit. As the Ports Collection infrastructure does not have a version number just be sure to have a Ports Collection new enough to contain the fix for portaudit. Note that this is only a problem for users which has portaudit installed, as they will not have the audit database installed or downloaded otherwise.
Google Chrome Releases reports:
[117620] [117656] Critical CVE-2011-3047: Errant plug-in load and GPU process memory corruption. Credit to PinkiePie.
These vulnerabilities could cause a crash and potentially allow an attacker to take control of the affected system.
Google Chrome Releases reports:
[117226] [117230] Critical CVE-2011-3046: UXSS and bad history navigation. Credit to Sergey Glazunov.
Jenkins Security Advisory reports:
An XSS vulnerability was found in Jenkins core, which allows an attacker to inject malicious HTMLs to pages served by Jenkins. This allows an attacker to escalate his privileges by hijacking sessions of other users. This vulnerability affects all versions.
Google Chrome Releases reports:
[105867] High CVE-2011-3031: Use-after-free in v8 element wrapper. Credit to Chamal de Silva.
[108037] High CVE-2011-3032: Use-after-free in SVG value handling. Credit to Arthur Gerkis.
[108406] [115471] High CVE-2011-3033: Buffer overflow in the Skia drawing library. Credit to Aki Helin of OUSPG.
[111748] High CVE-2011-3034: Use-after-free in SVG document handling. Credit to Arthur Gerkis.
[112212] High CVE-2011-3035: Use-after-free in SVG use handling. Credit to Arthur Gerkis.
[113258] High CVE-2011-3036: Bad cast in line box handling. Credit to miaubiz.
[113439] [114924] [115028] High CVE-2011-3037: Bad casts in anonymous block splitting. Credit to miaubiz.
[113497] High CVE-2011-3038: Use-after-free in multi-column handling. Credit to miaubiz.
[113707] High CVE-2011-3039: Use-after-free in quote handling. Credit to miaubiz.
[114054] High CVE-2011-3040: Out-of-bounds read in text handling. Credit to miaubiz.
[114068] High CVE-2011-3041: Use-after-free in class attribute handling. Credit to miaubiz.
[114219] High CVE-2011-3042: Use-after-free in table section handling. Credit to miaubiz.
[115681] High CVE-2011-3043: Use-after-free in flexbox with floats. Credit to miaubiz.
[116093] High CVE-2011-3044: Use-after-free with SVG animation elements. Credit to Arthur Gerkis.
The Dropbear project reports:
Dropbear SSH Server could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a use-after- free error. If a command restriction is enforced, an attacker could exploit this vulnerability to execute arbitrary code on the system with root privileges.
OpenX does not provide information about vulnerabilities beyond their existence.
The PostgreSQL Global Development Group reports:
These vulnerabilities could allow users to define triggers that execute functions on which the user does not have EXECUTE permission, allow SSL certificate spoofing and allow line breaks in object names to be exploited to execute code when loading a pg_dump file.
These vulnerabilities could cause a crash and potentially allow an attacker to take control of the affected system.
Google chrome team reports:
Heap-based buffer overflow in libxml2, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
Secunia reports:
A vulnerability has been discovered in PLIB, which can be exploited by malicious people to compromise an application using the library.
The vulnerability is caused due to a boundary error within the "ulSetError()" function (src/util/ulError.cxx) when creating the error message, which can be exploited to overflow a static buffer.
Successful exploitation allows the execution of arbitrary code but requires that the attacker can e.g. control the content of an overly long error message passed to the "ulSetError()" function.
The vulnerability is confirmed in version 1.8.5. Other versions may also be affected.
The phpMyAdmin development team reports:
It was possible to conduct XSS using a crafted database name.
The Piwik Team reports:
We would like to thank the following security researchers for their responsible disclosure of XSS and click-jacking issues: Piotr Duszynski, Sergey Markov, Mauro Gentile.
The Mozilla Project reports:
MFSA 2012-11 libpng integer overflow
Google Chrome Releases reports:
[105803] High CVE-2011-3015: Integer overflows in PDF codecs. Credit to Google Chrome Security Team (scarybeasts).
[106336] Medium CVE-2011-3016: Read-after-free with counter nodes. Credit to miaubiz.
[108695] High CVE-2011-3017: Possible use-after-free in database handling. Credit to miaubiz.
[110172] High CVE-2011-3018: Heap overflow in path rendering. Credit to Aki Helin of OUSPG.
[110849] High CVE-2011-3019: Heap buffer overflow in MKV handling. Credit to Google Chrome Security Team (scarybeasts) and Mateusz Jurczyk of the Google Security Team.
[111575] Medium CVE-2011-3020: Native client validator error. Credit to Nick Bray of the Chromium development community.
[111779] High CVE-2011-3021: Use-after-free in subframe loading. Credit to Arthur Gerkis.
[112236] Medium CVE-2011-3022: Inappropriate use of http for translation script. Credit to Google Chrome Security Team (Jorge Obes).
[112259] Medium CVE-2011-3023: Use-after-free with drag and drop. Credit to pa_kt.
[112451] Low CVE-2011-3024: Browser crash with empty x509 certificate. Credit to chrometot.
[112670] Medium CVE-2011-3025: Out-of-bounds read in h.264 parsing. Credit to Slawomir Blazek.
[112822] High CVE-2011-3026: Integer overflow / truncation in libpng. Credit to Juri Aedla.
[112847] Medium CVE-2011-3027: Bad cast in column handling. Credit to miaubiz.
Jan Lieskovsky reports,
A denial of service flaw was found in the way Simple XML-RPC Server module of Python processed client connections, that were closed prior the complete request body has been received. A remote attacker could use this flaw to cause Python Simple XML-RPC based server process to consume excessive amount of CPU.
tom reports,
There is no sanitation on the input of the location variable allowing for persistent XSS.
The Mozilla Project reports:
MFSA 2012-10 use after free in nsXBLDocumentInfo::ReadPrototypeBindings
Julien Tinnes reports,
Bip doesn't check if fd is equal or larger than FD_SETSIZE.
surf does not protect its cookie jar against access read access from other local users
The GLPI project reports:
The autocompletion functionality in GLPI before 0.80.2 does not blacklist certain username and password fields, which allows remote attackers to obtain sensitive information via a crafted POST request.
Google Chrome Releases reports:
[73478] Low CVE-2011-3953: Avoid clipboard monitoring after paste event. Credit to Daniel Cheng of the Chromium development community.
[92550] Low CVE-2011-3954: Crash with excessive database usage. Credit to Collin Payne.
[93106] High CVE-2011-3955: Crash aborting an IndexDB transaction. Credit to David Grogan of the Chromium development community.
[103630] Low CVE-2011-3956: Incorrect handling of sandboxed origins inside extensions. Credit to Devdatta Akhawe, UC Berkeley.
[104056] High CVE-2011-3957: Use-after-free in PDF garbage collection. Credit to Aki Helin of OUSPG.
[105459] High CVE-2011-3958: Bad casts with column spans. Credit to miaubiz.
[106441] High CVE-2011-3959: Buffer overflow in locale handling. Credit to Aki Helin of OUSPG.
[108416] Medium CVE-2011-3960: Out-of-bounds read in audio decoding. Credit to Aki Helin of OUSPG.
[108871] Critical CVE-2011-3961: Race condition after crash of utility process. Credit to Shawn Goertzen.
[108901] Medium CVE-2011-3962: Out-of-bounds read in path clipping. Credit to Aki Helin of OUSPG.
[109094] Medium CVE-2011-3963: Out-of-bounds read in PDF fax image handling. Credit to Atte Kettunen of OUSPG.
[109245] Low CVE-2011-3964: URL bar confusion after drag + drop. Credit to Code Audit Labs of VulnHunt.com.
[109664] Low CVE-2011-3965: Crash in signature check. Credit to Slawomir Blazek.
[109716] High CVE-2011-3966: Use-after-free in stylesheet error handling. Credit to Aki Helin of OUSPG.
[109717] Low CVE-2011-3967: Crash with unusual certificate. Credit to Ben Carrillo.
[109743] High CVE-2011-3968: Use-after-free in CSS handling. Credit to Arthur Gerkis.
[110112] High CVE-2011-3969: Use-after-free in SVG layout. Credit to Arthur Gerkis.
[110277] Medium CVE-2011-3970: Out-of-bounds read in libxslt. Credit to Aki Helin of OUSPG.
[110374] High CVE-2011-3971: Use-after-free with mousemove events. Credit to Arthur Gerkis.
[110559] Medium CVE-2011-3972: Out-of-bounds read in shader translator. Credit to Google Chrome Security Team (Inferno).
Drupal development team reports:
Cross Site Request Forgery vulnerability in Aggregator module
CVE: CVE-2012-0826
An XSRF vulnerability can force an aggregator feed to update. Since some services are rate-limited (e.g. Twitter limits requests to 150 per hour) this could lead to a denial of service.
This issue affects Drupal 6.x and 7.x.
OpenID not verifying signed attributes in SREG and AX
CVE: CVE-2012-0825
A group of security researchers identified a flaw in how some OpenID relying parties implement Attribute Exchange (AX). Not verifying that attributes being passed through AX have been signed could allow an attacker to modify users' information.
This issue affects Drupal 6.x and 7.x.
Access bypass in File module
CVE: CVE-2012-0827
When using private files in combination with certain field access modules, the File module will allow users to download the file even if they do not have access to view the field it was attached to.
This issue affects Drupal 7.x only.
A Bugzilla Security Advisory reports:
The following security issues have been discovered in Bugzilla:
- Account Impersonation: When a user creates a new account, Bugzilla doesn't correctly reject email addresses containing non-ASCII characters, which could be used to impersonate another user account. Such email addresses could look visually identical to other valid email addresses, and an attacker could try to confuse other users and be added to bugs he shouldn't have access to.
- Cross-Site Request Forgery: Due to a lack of validation of the Content-Type head when making POST requests to jsonrpc.cgi, a possible CSRF vulnerability was discovered. If a user visits an HTML page with some malicious JS code in it, an attacker could make changes to a remote Bugzilla installation on behalf of the victim's account by using the JSON-RPC API. The user would have had to be already logged in to the target site for the vulnerability to work.
All affected installations are encouraged to upgrade as soon as possible.
Secunia reports:
A vulnerability has been reported in PHP, which can be exploited by malicious people to compromise a vulnerable system.
The vulnerability is caused due to a logic error within the "php_register_variable_ex()" function (php_variables.c) when hashing form posts and updating a hash table, which can be exploited to execute arbitrary code.
Michiel Boland reports:
The software has a vulnerability that could lead to directory traversal if the '*' construct for mass virtual hosting is used.
CVE MITRE reports:
An exposure was found when using mod_proxy in reverse proxy mode. In certain configurations using RewriteRule with proxy flag or ProxyPassMatch, a remote attacker could cause the reverse proxy to connect to an arbitrary server, possibly disclosing sensitive information from internal web servers not directly accessible to attacker.
Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, leading to a heap-based buffer overflow.
An additional exposure was found when using mod_proxy in reverse proxy mode. In certain configurations using RewriteRule with proxy flag or ProxyPassMatch, a remote attacker could cause the reverse proxy to connect to an arbitrary server, possibly disclosing sensitive information from internal web servers not directly accessible to attacker.
A flaw was found in mod_log_config. If the '%{cookiename}C' log format string is in use, a remote attacker could send a specific cookie causing a crash. This crash would only be a denial of service if using a threaded MPM.
A flaw was found in the handling of the scoreboard. An unprivileged child process could cause the parent process to crash at shutdown rather than terminate cleanly.
A flaw was found in the default error response for status code 400. This flaw could be used by an attacker to expose "httpOnly" cookies when no custom ErrorDocument is specified.
The Mozilla Project reports:
MFSA 2012-01 Miscellaneous memory safety hazards (rv:10.0/ rv:1.9.2.26)
MFSA 2012-02 Overly permissive IPv6 literal syntax
MFSA 2012-03 iframe element exposed across domains via name attribute
MFSA 2012-04 Child nodes from nsDOMAttribute still accessible after removal of nodes
MFSA 2012-05 Frame scripts calling into untrusted objects bypass security checks
MFSA 2012-06 Uninitialized memory appended when encoding icon images may cause information disclosure
MFSA 2012-07 Potential Memory Corruption When Decoding Ogg Vorbis files
MFSA 2012-08 Crash with malformed embedded XSLT stylesheets
MFSA 2012-09 Firefox Recovery Key.html is saved with unsafe permission
Todd Miller reports:
Sudo 1.8.0 introduced simple debugging support that was primarily intended for use when developing policy or I/O logging plugins. The sudo_debug() function contains a flaw where the program name is used as part of the format string passed to the fprintf() function. The program name can be controlled by the caller, either via a symbolic link or, on some systems, by setting argv[0] when executing sudo.
Using standard format string vulnerability exploitation techniques it is possible to leverage this bug to achieve root privileges.
Exploitation of the bug does not require that the attacker be listed in the sudoers file. As such, we strongly suggest that affected sites upgrade from affected sudo versions as soon as possible.
Problem Description:
Some third-party applications, including KDE's kcheckpass command, allow the user to specify the name of the policy on the command line. Since OpenPAM treats the policy name as a path relative to /etc/pam.d or /usr/local/etc/pam.d, users who are permitted to run such an application can craft their own policies and cause the application to load and execute their own modules.
Problem Description:
The OpenSSL library call used to decrypt private keys ignores the passphrase argument if the key is not encrypted. Because the pam_ssh module only checks whether the passphrase provided by the user is null, users with unencrypted SSH private keys may successfully authenticate themselves by providing a dummy passphrase.
Problem Description:
When a UNIX-domain socket is attached to a location using the bind(2) system call, the length of the provided path is not validated. Later, when this address was returned via other system calls, it is copied into a fixed-length buffer.
Linux uses a larger socket address structure for UNIX-domain sockets than FreeBSD, and the FreeBSD's linux emulation code did not translate UNIX-domain socket addresses into the correct size of structure.
Problem Description:
The code used to decompress a file created by compress(1) does not do sufficient boundary checks on compressed code words, allowing reference beyond the decompression table, which may result in a stack overflow or an infinite loop when the decompressor encounters a corrupted file.
Problem Description:
While parsing the exports(5) table, a network mask in the form of "-network=netname/prefixlength" results in an incorrect network mask being computed if the prefix length is not a multiple of 8.
For example, specifying the ACL for an export as "-network 192.0.2.0/23" would result in a netmask of 255.255.127.0 being used instead of the correct netmask of 255.255.254.0.
The Postfix Admin Team reports:
Multiple XSS vulnerabilities exist:
- XSS with $_GET[domain] in templates/menu.php and edit-vacation
- XSS in some create-domain input fields
- XSS in create-alias and edit-alias error message
- XSS (by values stored in the database) in fetchmail list view, list-domain and list-virtualMultiple SQL injection issues exist:
- SQL injection in pacrypt() (if $CONF[encrypt] == 'mysql_encrypt')
- SQL injection in backup.php - the dump was not mysql_escape()d, therefore users could inject SQL (for example in the vacation message) which will be executed when restoring the database dump. WARNING: database dumps created with backup.php from 2.3.4 or older might contain malicious SQL. Double-check before using them!
The oss-security list reports:
Incorrect permissions on temporary files can lead to information disclosure.
The Adobe Security Team reports:
An unspecified vulnerability in the U3D component allows remote attackers to execute arbitrary code (or cause a denial of service attack) via unknown vectors.
A heap-based buffer overflow allows attackers to execute arbitrary code via unspecified vectors.
Google Chrome Releases reports:
[106484] High CVE-2011-3924: Use-after-free in DOM selections. Credit to Arthur Gerkis.
[108461] High CVE-2011-3928: Use-after-free in DOM handling. Credit to wushi of team509 reported through ZDI (ZDI-CAN-1415).
[108605] High CVE-2011-3927: Uninitialized value in Skia. Credit to miaubiz.
[109556] High CVE-2011-3926: Heap-buffer-overflow in tree builder. Credit to Arthur Gerkis.
Wireshark reports:
Laurent Butti discovered that Wireshark failed to properly check record sizes for many packet capture file formats
Wireshark could dereference a NULL pointer and crash.
The RLC dissector could overflow a buffer.
Secunia reports:
Fixed a number of very serious errors in the usage of snprintf()/vsnprintf().
The return value was being used as the length of the string printed into the buffer, but the return value really indicates the length of the string that *could* be printed if the buffer were of infinite size. Because the returned value could be larger than the buffer's size, this meant remotely exploitable buffer overflows were possible, depending on spamdyke's configuration.
The OpenSSL Team reports:
A flaw in the fix to CVE-2011-4108 can be exploited in a denial of service attack. Only DTLS applications using OpenSSL 1.0.0f and 0.9.8s are affected.
Asterisk project reports:
An attacker attempting to negotiate a secure video stream can crash Asterisk if video support has not been enabled and the res_srtp Asterisk module is loaded.
The Tomcat security team reports:
Analysis of the recent hash collision vulnerability identified unrelated inefficiencies with Apache Tomcat's handling of large numbers of parameters and parameter values. These inefficiencies could allow an attacker, via a specially crafted request, to cause large amounts of CPU to be used which in turn could create a denial of service. The issue was addressed by modifying the Tomcat parameter handling code to efficiently process large numbers of parameters and parameter values.
The OpenTTD Team reports:
Using a slow read type attack it is possible to prevent anyone from joining a server with virtually no resources. Once downloading the map no other downloads of the map can start, so downloading really slowly will prevent others from joining. This can be further aggravated by the pause-on-join setting in which case the game is paused and the players cannot continue the game during such an attack. This attack requires that the user is not banned and passes the authorization to the server, although for many servers there is no server password and thus authorization is easy.
oCERT reports:
A variety of programming languages suffer from a denial-of-service (DoS) condition against storage functions of key/value pairs in hash data structures, the condition can be leveraged by exploiting predictable collisions in the underlying hashing algorithms.
The issue finds particular exposure in web server applications and/or frameworks. In particular, the lack of sufficient limits for the number of parameters in POST requests in conjunction with the predictable collision properties in the hashing functions of the underlying languages can render web applications vulnerable to the DoS condition. The attacker, using specially crafted HTTP requests, can lead to a 100% of CPU usage which can last up to several hours depending on the targeted application and server performance, the amplification effect is considerable and requires little bandwidth and time on the attacker side.
The condition for predictable collisions in the hashing functions has been reported for the following language implementations: Java, JRuby, PHP, Python, Rubinius, Ruby. In the case of the Ruby language, the 1.9.x branch is not affected by the predictable collision condition since this version includes a randomization of the hashing function.
The vulnerability outlined in this advisory is practically identical to the one reported in 2003 and described in the paper Denial of Service via Algorithmic Complexity Attacks which affected the Perl language.
Ubuntu Security Notice USN-1320-1 reports:
Phillip Langlois discovered that FFmpeg incorrectly handled certain malformed QDM2 streams. If a user were tricked into opening a crafted QDM2 stream file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2011-4351)
Phillip Langlois discovered that FFmpeg incorrectly handled certain malformed VP3 streams. If a user were tricked into opening a crafted file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2011-4352)
Phillip Langlois discovered that FFmpeg incorrectly handled certain malformed VP5 and VP6 streams. If a user were tricked into opening a crafted file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2011-4353)
It was discovered that FFmpeg incorrectly handled certain malformed VMD files. If a user were tricked into opening a crafted VMD file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2011-4364)
Phillip Langlois discovered that FFmpeg incorrectly handled certain malformed SVQ1 streams. If a user were tricked into opening a crafted SVQ1 stream file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2011-4579)
The OpenSSL Team reports:
6 security flaws have been fixed in OpenSSL 1.0.0f:
If X509_V_FLAG_POLICY_CHECK is set in OpenSSL 0.9.8, then a policy check failure can lead to a double-free.
OpenSSL prior to 1.0.0f and 0.9.8s failed to clear the bytes used as block cipher padding in SSL 3.0 records. As a result, in each record, up to 15 bytes of uninitialized memory may be sent, encrypted, to the SSL peer. This could include sensitive contents of previously freed memory.
RFC 3779 data can be included in certificates, and if it is malformed, may trigger an assertion failure. This could be used in a denial-of-service attack.
Support for handshake restarts for server gated cryptograpy (SGC) can be used in a denial-of-service attack.
A malicious TLS client can send an invalid set of GOST parameters which will cause the server to crash due to lack of error checking. This could be used in a denial-of-service attack.
ISC reports:
Due to improper handling of a DHCPv6 lease structure, ISC DHCP servers that are serving IPv6 address pools AND using Dynamic DNS can encounter a segmentation fault error while updating lease status under certain conditions.
The potential exists for this condition to be intentionally triggered, resulting in effective denial of service to clients expecting service from the affected server.
The PowerDNS Team reports:
Using well crafted UDP packets, one or more PowerDNS servers could be made to enter a tight packet loop, causing temporary denial of service.
php development team reports:
Security Enhancements and Fixes in PHP 5.3.9:
- Added max_input_vars directive to prevent attacks based on hash collisions. (CVE-2011-4885)
- Fixed bug #60150 (Integer overflow during the parsing of invalid exif header). (CVE-2011-4566)
TORCS News reports:
An insecure change to LD_LIBRARY_PATH allows loading of libraries in directories other than the standard paths. This can be a problem when downloading and installing untrusted content from the Internet.
Secunia reports:
The vulnerability is caused due to the TLS implementation not properly clearing transport layer buffers when upgrading from plaintext to ciphertext after receiving the "STARTTLS" command. This can be exploited to insert arbitrary plaintext data (e.g. SMTP commands) during the plaintext phase, which will then be executed after upgrading to the TLS ciphertext phase.
Google Chrome Releases reports:
[106672] High CVE-2011-3921: Use-after-free in animation frames. Credit to Boris Zbarsky of Mozilla.
[107128] High CVE-2011-3919: Heap-buffer-overflow in libxml. Credit to Juri Aedla.
[108006] High CVE-2011-3922: Stack-buffer-overflow in glyph handling. Credit to Google Chrome Security Team (Cris Neckar).[107182] Critical CVE-2011-3925: Use-after-free in Safe Browsing navigation. Credit to Chamal de Silva.
A Bugzilla Security Advisory reports:
The following security issues have been discovered in Bugzilla:
- Tabular and graphical reports, as well as new charts have a debug mode which displays raw data as plain text. This text is not correctly escaped and a crafted URL could use this vulnerability to inject code leading to XSS.
- The User.offer_account_by_email WebService method ignores the user_can_create_account setting of the authentication method and generates an email with a token in it which the user can use to create an account. Depending on the authentication method being active, this could allow the user to log in using this account. Installations where the createemailregexp parameter is empty are not vulnerable to this issue.
- The creation of bug reports and of attachments is not protected by a token and so they can be created without the consent of a user if the relevant code is embedded in an HTML page and the user visits this page. This behavior was intentional to let third-party applications submit new bug reports and attachments easily. But as this behavior can be abused by a malicious user, it has been decided to block submissions with no valid token starting from version 4.2rc1. Older branches are not patched to not break these third-party applications after the upgrade.
All affected installations are encouraged to upgrade as soon as possible.
WordPress development team reports:
WordPress 3.3.1 is now available. This maintenance release fixes 15 issues with WordPress 3.3, as well as a fix for a cross-site scripting vulnerability that affected version 3.3. Thanks to Joshua H., Hoang T., Stefan Zimmerman, Chris K., and the Go Daddy security team for responsibly disclosing the bug to our security team.
Martina Matari reports:
These URLs (hostgroups.php, usergrps.php) are vulnerable to persistent XSS attacks due to improper sanitation of gname variable when creating user and host groups.
US-CERT/NIST reports:
Integer signedness error in the base64_decode function in the HTTP authentication functionality (http_auth.c) in lighttpd 1.4 before 1.4.30 and 1.5 before SVN revision 2806 allows remote attackers to cause a denial of service (segmentation fault) via crafted base64 input that triggers an out-of-bounds read with a negative index.
The MIT Kerberos Team reports:
When an encryption key is supplied via the TELNET protocol, its length is not validated before the key is copied into a fixed-size buffer. Also see MITKRB5-SA-2011-008.
The FreeBSD security advisory FreeBSD-SA-11:07.chroot reports:
If ftpd is configured to place a user in a chroot environment, then an attacker who can log in as that user may be able to run arbitrary code(...).
Proftpd shares the same problem of a similar nature.
The phpMyAdmin development team reports:
Using crafted url parameters, it was possible to produce XSS on the export panels in the server, database and table sections.
Crafted values entered in the setup interface can produce XSS; also, if the config directory exists and is writeable, the XSS payload can be saved to this directory.
The Mozilla Project reports:
MFSA 2011-53 Miscellaneous memory safety hazards (rv:9.0)
MFSA 2011-54 Potentially exploitable crash in the YARR regular expression library
MFSA 2011-55 nsSVGValue out-of-bounds access
MFSA 2011-56 Key detection without JavaScript via SVG animation
MFSA 2011-58 Crash scaling video to extreme sizes
Unbound developer reports:
Unbound crashes when confronted with a non-standard response from a server for a domain. This domain produces duplicate RRs from a certain type and is DNSSEC signed. Unbound also crashes when confronted with a query that eventually, and under specific circumstances, resolves to a domain that misses expected NSEC3 records.
The typo3 security team reports:
A crafted request to a vulnerable TYPO3 installation will allow an attacker to load PHP code from an external source and to execute it on the TYPO3 installation.
This is caused by a PHP file, which is part of the workspaces system extension, that does not validate passed arguments.
The MIT Kerberos Team reports:
In releases krb5-1.9 and later, the KDC can crash due to a NULL pointer dereference in code that handles TGS (Ticket Granting Service) requests. The trigger condition is trivial to produce using unmodified client software, but requires the ability to authenticate as a principal in the KDC's realm.
Opera software reports:
- Fixed a moderately severe issue; details will be disclosed at a later date
- Fixed an issue that could allow pages to set cookies or communicate cross-site for some top level domains; see our advisory
- Improved handling of certificate revocation corner cases
- Added a fix for a weakness in the SSL v3.0 and TLS 1.0 specifications, as reported by Thai Duong and Juliano Rizzo; see our advisory
- Fixed an issue where the JavaScript "in" operator allowed leakage of cross-domain information, as reported by David Bloom; see our advisory
Google Chrome Releases reports:
[81753] Medium CVE-2011-3903: Out-of-bounds read in regex matching. Credit to David Holloway of the Chromium development community.
[95465] Low CVE-2011-3905: Out-of-bounds reads in libxml. Credit to Google Chrome Security Team (Inferno).
[98809] Medium CVE-2011-3906: Out-of-bounds read in PDF parser. Credit to Aki Helin of OUSPG.
[99016] High CVE-2011-3907: URL bar spoofing with view-source. Credit to Mitja Kolsek of ACROS Security.
[100863] Low CVE-2011-3908: Out-of-bounds read in SVG parsing. Credit to Aki Helin of OUSPG.
[101010] Medium CVE-2011-3909: [64-bit only] Memory corruption in CSS property array. Credit to Google Chrome Security Team (scarybeasts) and Chu.
[101494] Medium CVE-2011-3910: Out-of-bounds read in YUV video frame handling. Credit to Google Chrome Security Team (Cris Neckar).
[101779] Medium CVE-2011-3911: Out-of-bounds read in PDF. Credit to Google Chrome Security Team (scarybeasts) and Robert Swiecki of the Google Security Team.
[102359] High CVE-2011-3912: Use-after-free in SVG filters. Credit to Arthur Gerkis.
[103921] High CVE-2011-3913: Use-after-free in Range handling. Credit to Arthur Gerkis.
[104011] High CVE-2011-3914: Out-of-bounds write in v8 i18n handling. Credit to Slawomir Blazek.
[104529] High CVE-2011-3915: Buffer overflow in PDF font handling. Credit to Atte Kettunen of OUSPG.
[104959] Medium CVE-2011-3916: Out-of-bounds reads in PDF cross references. Credit to Atte Kettunen of OUSPG.
[105162] Medium CVE-2011-3917: Stack-buffer-overflow in FileWatcher. Credit to Google Chrome Security Team (Marty Barbella).
[107258] High CVE-2011-3904: Use-after-free in bidi handling. Credit to Google Chrome Security Team (Inferno) and miaubiz.
Simon Tatham reports:
PuTTY 0.62 fixes a security issue present in 0.59, 0.60 and 0.61. If you log in using SSH-2 keyboard-interactive authentication (which is the usual method used by modern servers to request a password), the password you type was accidentally kept in PuTTY's memory for the rest of its run, where it could be retrieved by other processes reading PuTTY's memory, or written out to swap files or crash dumps.
Asterisk project reports:
It is possible to enumerate SIP usernames when the general and user/peer NAT settings differ in whether to respond to the port a request is sent from or the port listed for responses in the Via header.
When the "automon" feature is enabled in features.conf, it is possible to send a sequence of SIP requests that cause Asterisk to dereference a NULL pointer and crash.
ISC reports:
A bug exists which allows an attacker who is able to send DHCP Request packets, either directly or through a relay, to remotely crash an ISC DHCP server if that server is configured to evaluate expressions using a regular expression (i.e. uses the "~=" or "~~" comparison operators).
The phpMyAdmin development team reports:
Using crafted database names, it was possible to produce XSS in the Database Synchronize and Database rename panels. Using an invalid and crafted SQL query, it was possible to produce XSS when editing a query on a table overview panel or when using the view creation dialog. Using a crafted column type, it was possible to produce XSS in the table search and create index dialogs.
Hugo Leisink reports via private mail to maintainer:
The memory leak was introduced in version 7.6. It is in the routing that checks for SQL injections. So, if you have set PreventSQLi to 'no', there is no problem.
The Internet Systems Consortium reports:
Organizations across the Internet reported crashes interrupting service on BIND 9 nameservers performing recursive queries. Affected servers crashed after logging an error in query.c with the following message: "INSIST(! dns_rdataset_isassociated(sigrdataset))" Multiple versions were reported being affected, including all currently supported release versions of ISC BIND 9.
Because it may be possible to trigger this bug even on networks that do not allow untrusted users to access the recursive name servers (perhaps via specially crafted e-mail messages, and/or malicious web sites) it is recommended that ALL operators of recursive name servers upgrade immediately.
Apache HTTP server project reports:
An exposure was found when using mod_proxy in reverse proxy mode. In certain configurations using RewriteRule with proxy flag, a remote attacker could cause the reverse proxy to connect to an arbitrary server, possibly disclosing sensitive information from internal web servers not directly accessible to attacker. There is no patch against this issue!
Tim Brown from Nth Dimention reports:
I recently discovered that the Ark archiving tool is vulnerable to directory traversal via malformed. When attempts are made to view files within the malformed Zip file in Ark's default view, the wrong file may be displayed due to incorrect construction of the temporary file name. Whilst this does not allow the wrong file to be overwritten, after closing the default view, Ark will then attempt to delete the temporary file which could result in the deletion of the incorrect file.
The Apache Portable Runtime Project reports:
Reimplement apr_fnmatch() from scratch using a non-recursive algorithm; now has improved compliance with the fnmatch() spec.
Jan Lieskovsky reports:
Importing a specially-crafted XML file which contains an XML entity injection permits to retrieve a local file (limited by the privileges of the user running the web server).
Adobe Product Security Incident Response Team reports:
Critical vulnerabilities have been identified in Adobe Flash Player 11.0.1.152 and earlier versions for Windows, Macintosh, Linux and Solaris, and Adobe Flash Player 11.0.1.153 and earlier versions for Android.
In addition a patch was released for users of flash10.
Integer overflow in xpath.c, allows context-dependent attackers to to cause a denial of service (crash) and possibly execute arbitrary code via a crafted XML file that triggers a heap-based buffer overflow when adding a new namespace node, related to handling of XPath expressions.
Multiple use-after-free vulnerabilities in libxml 1.8.17 that allow context-dependent attackers to cause a denial of service (application crash) via crafted (1) Notation or (2) Enumeration attribute types in an XML file.
Stack consumption vulnerability allows context-dependent attackers to cause a denial of service (application crash) via a large depth of element declarations in a DTD.
The GnuTLS team reports:
GNUTLS-SA-2011-2 Possible buffer overflow/Denial of service.
The Mozilla Project reports:
MFSA 2011-46 loadSubScript unwraps XPCNativeWrapper scope parameter (1.9.2 branch)
MFSA 2011-47 Potential XSS against sites using Shift-JIS
MFSA 2011-48 Miscellaneous memory safety hazards (rv:8.0)
MFSA 2011-49 Memory corruption while profiling using Firebug
MFSA 2011-50 Cross-origin data theft using canvas and Windows D2D
MFSA 2011-51 Cross-origin image theft on Mac with integrated Intel GPU
MFSA 2011-52 Code execution via NoWaiverWrapper
caml-light uses mktemp() insecurely, and also does unsafe things in /tmp during make install.
The FreeType project reports:
A couple of vulnerabilities in handling Type 1 fonts.
Cacti Group reports:
SQL injection issue with user login, and cross-site scripting issues.
The phpMyFAQ project reports:
The phpMyFAQ Team has learned of a serious security issue that has been discovered in our bundled ImageManager library we use in phpMyFAQ 2.6 and 2.7. The bundled ImageManager library allows injection of arbitrary PHP code via POST requests.
EgiX (n0b0d13s at gmail dot com) reports:
The $sortby parameter passed to 'masort' function in file lib/functions.php isn't properly sanitized before being used in a call to create_function() at line 1080. This can be exploited to inject and execute arbitrary PHP code. The only possible attack vector is when handling the 'query_engine' command, in which input passed through $_REQUEST['orderby'] is passed as $sortby parameter to 'masort' function.
KDE Security Advisory reports:
The default rendering type for a QLabel is QLabel::AutoText, which uses heuristics to determine whether to render the given content as plain text or rich text. KSSL and Rekonq did not properly force its QLabels to use QLabel::PlainText. As a result, if given a certificate containing rich text in its fields, they would render the rich text. Specifically, a certificate containing a common name (CN) that has a table element will cause the second line of the table to be displayed. This can allow spoofing of the certificate's common name.
Secunia reports:
Multiple vulnerabilities with an unknown impact have been reported in Piwik. The vulnerabilities are caused due to unspecified errors. No further information is currently available.
Matthieu Herrb reports:
It is possible to deduce if a file exists or not by exploiting the way that Xorg creates its lock files. This is caused by the fact that the X server is behaving differently if the lock file already exists as a symbolic link pointing to an existing or non-existing file.
It is possible for a non-root user to set the permissions for all users on any file or directory to 444, giving unwanted read access or causing denies of service (by removing execute permission). This is caused by a race between creating the lock file and setting its access modes.
Asterisk project reports:
A remote authenticated user can cause a crash with a malformed request due to an unitialized variable.
The PivotX team reports:
TimThumb domain name security bypass and insecure cache handling. PivotX before 2.3.0 includes a vulnerable version of TimThumb.
If you are still running PivotX 2.2.6, you might be vulnerable to a security exploit, that was patched previously. Version 2.3.0 doesn't have this issue, but any older version of PivotX might be vulnerable.
The OpenTTD Team reports:
Multiple buffer overflows in OpenTTD before 1.1.3 allow local users to cause a denial of service (daemon crash) or possibly gain privileges via (1) a crafted BMP file with RLE compression or (2) crafted dimensions in a BMP file.
The OpenTTD Team reports:
Multiple buffer overflows in OpenTTD before 1.1.3 allow remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via vectors related to (1) NAME, (2) PLYR, (3) CHTS, or (4) AIPL (aka AI config) chunk loading from a savegame.
The OpenTTD Team reports:
Multiple off-by-one errors in order_cmd.cpp in OpenTTD before 1.1.3 allow remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted CMD_INSERT_ORDER command.
CERT-FI reports:
Five vulnerabilities have been found in the BGP, OSPF, and OSPFv3 components of Quagga. The vulnerabilities allow an attacker to cause a denial of service or potentially to execute his own code by sending a specially modified packets to an affected server. Routing messages are typically accepted from the routing peers. Exploiting these vulnerabilities may require an established routing session (BGP peering or OSPF/OSPFv3 adjacency) to the router.
The vulnerability CVE-2011-3327 is related to the extended communities handling in BGP messages. Receiving a malformed BGP update can result in a buffer overflow and disruption of IPv4 routing.
The vulnerability CVE-2011-3326 results from the handling of LSA (Link State Advertisement) states in the OSPF service. Receiving a modified Link State Update message with malicious state information can result in denial of service in IPv4 routing.
The vulnerability CVE-2011-3325 is a denial of service vulnerability related to Hello message handling by the OSPF service. As Hello messages are used to initiate adjacencies, exploiting the vulnerability may be feasible from the same broadcast domain without an established adjacency. A malformed packet may result in denial of service in IPv4 routing.
The vulnerabilities CVE-2011-3324 and CVE-2011-3323 are related to the IPv6 routing protocol (OSPFv3) implemented in ospf6d daemon. Receiving modified Database Description and Link State Update messages, respectively, can result in denial of service in IPv6 routing.
The Mozilla Project reports:
MFSA 2011-36 Miscellaneous memory safety hazards (rv:7.0 / rv:1.9.2.23)
MFSA 2011-37 Integer underflow when using JavaScript RegExp
MFSA 2011-38 XSS via plugins and shadowed window.location object
MFSA 2011-39 Defense against multiple Location headers due to CRLF Injection
MFSA 2011-40 Code installation through holding down Enter
MFSA 2011-41 Potentially exploitable WebGL crashes
MFSA 2011-42 Potentially exploitable crash in the YARR regular expression library
MFSA 2011-43 loadSubScript unwraps XPCNativeWrapper scope parameter
MFSA 2011-44 Use after free reading OGG headers
MFSA 2011-45 Inferring Keystrokes from motion data
Adobe Product Security Incident Response Team reports:
Critical vulnerabilities have been identified in Adobe Flash Player 10.3.183.7 and earlier versions for Windows, Macintosh, Linux and Solaris, and Adobe Flash Player 10.3.186.6 and earlier versions for Android. These vulnerabilities could cause a crash and potentially allow an attacker to take control of the affected system.
There are reports that one of these vulnerabilities (CVE-2011-2444) is being exploited in the wild in active targeted attacks designed to trick the user into clicking on a malicious link delivered in an email message. This universal cross-site scripting issue could be used to take actions on a user's behalf on any website or webmail provider if the user visits a malicious website.
phpMyAdmin development team reports:
Firstly, if a row contains javascript code, after inline editing this row and saving, the code is executed. Secondly, missing sanitization on the db, table and column names leads to XSS vulnerabilities.
Versions 3.4.0 to 3.4.4 were found vulnerable.
The Django project reports:
Today the Django team is issuing multiple releases -- Django 1.2.6 and Django 1.3.1 -- to remedy security issues reported to us. Additionally, this announcement contains advisories for several other issues which, while not requiring changes to Django itself, will be of concern to users of Django.
All users are encouraged to upgrade Django, and to implement the recommendations in these advisories, immediately.
Session manipulation
Django's session framework, django.contrib.sessions, is configurable to use any of multiple backends for storage of session data. One such backend, provided with Django itself, integrates with Django's cache framework to use the cache as storage for session data.
When configured in this fashion using memory-based sessions and caching, Django sessions are stored directly in the root namespace of the cache, using session identifiers as keys.
This results in a potential attack when coupled with an application storing user-supplied data in the cache; if an attacker can cause data to be cached using a key which is also a valid session identifier, Django's session framework will treat that data -- so long as it is a dictionary-like object -- as the session, thus allowing arbitrary data to be inserted into a session so long as the attacker knows the session key.
Denial of service attack via URLField
Django's model system includes a field type -- URLField -- which validates that the supplied value is a valid URL, and if the boolean keyword argument verify_exists is true, attempts to validate that the supplied URL also resolves, by issuing a request to it.
By default, the underlying socket libraries in Python do not have a timeout. This can manifest as a security problem in three different ways:
- An attacker can supply a slow-to-respond URL. Each request will tie up a server process for a period of time; if the attacker is able to make enough requests, they can tie up all available server processes.
- An attacker can supply a URL under his or her control, and which will simply hold an open connection indefinitely. Due to the lack of timeout, the Django process attempting to verify the URL will similarly spin indefinitely. Repeating this can easily tie up all available server processes.
- An attacker can supply a URL under his or her control which not only keeps the connection open, but also sends an unending stream of random garbage data. This data will cause the memory usage of the Django process (which will hold the response in memory) to grow without bound, thus consuming not only server processes but also server memory.
URLField redirection
The regular expression which validates URLs is used to check the supplied URL before issuing a check to verify that it exists, but if that URL issues a redirect in response to the request, no validation of the resulting redirected URL is performed, including basic checks for supported protocols (HTTP, HTTPS, and FTP).
This creates a small window for an attacker to gain knowledge of, for example, server layout; a redirect to a file:// URL, for example, will tell an attacker whether a given file exists locally on the server.
Additionally, although the initial request issued by Django uses the HEAD method for HTTP/HTTPS, the request to the target of the redirect is issued using GET. This may create further issues for systems which implicitly trust GET requests from the local machine/network.
Host header cache poisoning
In several places, Django itself -- independent of the developer -- generates full URLs (for example, when issuing HTTP redirects). Currently this uses the value of the HTTP Host header from the request to construct the URL, which opens a potential cache-poisoning vector: an attacker can submit a request with a Host header of his or her choice, receive a response which constructs URLs using that Host header, and -- if that response is cached -- further requests will be served out of cache using URLs containing the attacker's host of choice.
RoundCube development Team reports:
We just published a new release which fixes a recently reported XSS vulnerability as an update to the stable 0.5 branch. Please update your installations with this new version or patch them with the fix which is also published in the downloads section or our sourceforge.net page.
and:
During one of pen-tests I found that _mbox parameter is not properly sanitized and reflected XSS attack is possible.
Secunia reports:
Hossein Lotfi has discovered a vulnerability in libsndfile, which can be exploited by malicious people to potentially compromise an application using the library. The vulnerability is caused due to an integer overflow error in the "paf24_init()" function (src/paf.c) when processing Paris Audio (PAF) files. This can be exploited to cause a heap-based buffer overflow via a specially crafted file. Successful exploitation may allow execution of arbitrary code. The vulnerability is confirmed in version 1.0.24. Other versions may also be affected.
OpenSSL Team reports:
Two security flaws have been fixed in OpenSSL 1.0.0e
Under certain circumstances OpenSSL's internal certificate verification routines can incorrectly accept a CRL whose nextUpdate field is in the past. (CVE-2011-3207)
OpenSSL server code for ephemeral ECDH ciphersuites is not thread-safe, and furthermore can crash if a client violates the protocol by sending handshake messages in incorrect order. (CVE-2011-3210)
Net.Edit0r from BlACK Hat Group reported an XSS issue in search.php. All MantisBT users (including anonymous users that are not logged in to public bug trackers) could be impacted by this vulnerability.
Debian reports:
Zorgon found several buffer overflows in cfsd, a daemon that pushes encryption services into the Unix(tm) file system. We are not yet sure if these overflows can successfully be exploited to gain root access to the machine running the CFS daemon. However, since cfsd can easily be forced to die, a malicious user can easily perform a denial of service attack to it.
Matthias Andree reports that the ca-bundle.pl used in older versions of the ca_root_nss FreeBSD port before 3.12.11 did not take the Mozilla/NSS/CKBI untrusted markers into account and would add certificates to the trust bundle that were marked unsafe by Mozilla.
Heather Adkins, Google's Information Security Manager, reported that Google received
[...] reports of attempted SSL man-in-the-middle (MITM) attacks against Google users, whereby someone tried to get between them and encrypted Google services. The people affected were primarily located in Iran. The attacker used a fraudulent SSL certificate issued by DigiNotar, a root certificate authority that should not issue certificates for Google (and has since revoked it). [...]
VASCO Data Security International Inc., owner of DigiNotar, issued a press statement confirming this incident:
On July 19th 2011, DigiNotar detected an intrusion into its Certificate Authority (CA) infrastructure, which resulted in the fraudulent issuance of public key certificate requests for a number of domains, including Google.com. [...] an external security audit concluded that all fraudulently issued certificates were revoked. Recently, it was discovered that at least one fraudulent certificate had not been revoked at the time. [...]
Mozilla, maintainer of the NSS package, from which FreeBSD derived ca_root_nss, stated that they:
revoked our trust in the DigiNotar certificate authority from all Mozilla software. This is not a temporary suspension, it is a complete removal from our trusted root program. Complete revocation of trust is a decision we treat with careful consideration, and employ as a last resort.
Three central issues informed our decision:
- Failure to notify. [...]
- The scope of the breach remains unknown. [...]
- The attack is not theoretical.
Apache HTTP server project reports:
A denial of service vulnerability has been found in the way the multiple overlapping ranges are handled by Apache HTTPD server.
Michal Trojnara reports:
Version 4.42, 2011.08.18, urgency: HIGH:
Fixed a heap corruption vulnerability in versions 4.40 and 4.41. It may possibly be leveraged to perform DoS or remote code execution attacks.
The phpMyAdmin development team reports:
Multiple XSS in the Tracking feature.
PHP development team reports:
If crypt() is executed with MD5 salts, the return value consists of the salt only. DES and BLOWFISH salts work as expected.
PHP development team reports:
Security Enhancements and Fixes in PHP 5.3.7:
- Updated crypt_blowfish to 1.2. (CVE-2011-2483)
- Fixed crash in error_log(). Reported by Mateusz Kocielski
- Fixed buffer overflow on overlog salt in crypt().
- Fixed bug #54939 (File path injection vulnerability in RFC1867 File upload filename). Reported by Krzysztof Kotowicz. (CVE-2011-2202)
- Fixed stack buffer overflow in socket_connect(). (CVE-2011-1938)
- Fixed bug #54238 (use-after-free in substr_replace()). (CVE-2011-1148)
SecurityFocus reports:
Ruby on Rails is prone to multiple vulnerabilities including SQL-injection, information-disclosure, HTTP-header-injection, security-bypass and cross-site scripting issues.
Timo Sirainen reports:
Fixed potential crashes and other problems when parsing header names that contained NUL characters.
OTRS Security Advisory reports:
- An attacker with valid session and admin permissions could get read access to any file on the servers local operating system. For this it would be needed minimum one installed OTRS package.
The Mozilla Project reports:
MFSA 2011-29 Security issues addressed in Firefox 6
MFSA 2011-28 Security issues addressed in Firefox 3.6.20
Samba security advisory reports:
All current released versions of Samba are vulnerable to a cross-site request forgery in the Samba Web Administration Tool (SWAT). By tricking a user who is authenticated with SWAT into clicking a manipulated URL on a different web page, it is possible to manipulate SWAT.
All current released versions of Samba are vulnerable to a cross-site scripting issue in the Samba Web Administration Tool (SWAT). On the "Change Password" field, it is possible to insert arbitrary content into the "user" field.
ISC reports:
A pair of defects cause the server to halt upon processing certain packets. The patch is to properly discard or process those packets.
A Bugzilla Security Advisory reports:
The following security issues have been discovered in Bugzilla:
- Internet Explorer 8 and older, and Safari before 5.0.6 do content sniffing when viewing a patch in "Raw Unified" mode, which could trigger a cross-site scripting attack due to the execution of malicious code in the attachment.
- It is possible to determine whether or not certain group names exist while creating or updating bugs.
- Attachment descriptions with a newline in them could lead to the injection of crafted headers in email notifications sent to the requestee or the requester when editing an attachment flag.
- If an attacker has access to a user's session, he can modify that user's email address without that user being notified of the change.
- Temporary files for uploaded attachments are not deleted on Windows, which could let a user with local access to the server read them.
- Up to Bugzilla 3.4.11, if a BUGLIST cookie is compromised, it can be used to inject HTML code when viewing a bug report, leading to a cross-site scripting attack.
All affected installations are encouraged to upgrade as soon as possible.
Ansgar Burchardt reports:
Ansgar Burchardt discovered several vulnerabilities in DTC, a web control panel for admin and accounting hosting services: The bw_per_moth.php graph contains an SQL injection vulnerability; insufficient checks in bw_per_month.php can lead to bandwidth usage information disclosure; after a registration, passwords are sent in cleartext email messages and Authenticated users could delete accounts using an obsolete interface which was incorrectly included in the package.
Tomas Hoger reports:
The compress/ LZW decompress implentation does not correctly handle compressed streams that contain code words that were not yet added to the decompression table. This may lead to arbitrary memory corruption. Successfull exploitation may possible lead to a local privilege escalation.
Vincent Danen reports:
Due to an error within the t1_decoder_parse_charstrings() function (src/psaux/t1decode.c) and can be exploited to corrupt memory by tricking a user into processing a specially-crafted postscript Type1 font in an application that uses the freetype library.
Adobe Product Security Incident Response Team reports:
Critical vulnerabilities have been identified in Adobe Flash Player 10.3.181.36 and earlier versions for Windows, Macintosh, Linux and Solaris, and Adobe Flash Player 10.3.185.25 and earlier versions for Android. These vulnerabilities could cause a crash and potentially allow an attacker to take control of the affected system.
Dan Winship reports:
Fixed a security hole that caused some SoupServer users to unintentionally allow accessing the entire local filesystem when they thought they were only providing access to a single directory.
The phpMyAdmin development team reports:
XSS in table Print view.
Via a crafted MIME-type transformation parameter, an attacker can perform a local file inclusion.
In the 'relational schema' code a parameter was not sanitized before being used to concatenate a class name.
The end result is a local file inclusion vulnerability and code execution.
It was possible to manipulate the PHP session superglobal using some of the Swekey authentication code.
This is very similar to PMASA-2011-5, documented in 7e4e5c53-a56c-11e0-b180-00216aa06fc2
OpenSAML developer reports:
The Shibboleth software relies on the OpenSAML libraries to perform verification of signed XML messages such as attribute queries or SAML assertions. Both the Java and C++ versions are vulnerable to a so-called "wrapping attack" that allows a remote, unauthenticated attacker to craft specially formed messages that can be successfully verified, but contain arbitrary content.
rsync development team reports:
Fixed a data-corruption issue when preserving hard-links without preserving file ownership, and doing deletions either before or during the transfer (CVE-2011-1097). This fixes some assert errors in the hard-linking code, and some potential failed checksums (via -c) that should have matched.
ISC reports:
A defect in the affected BIND 9 versions allows an attacker to remotely cause the "named" process to exit using a specially crafted packet.
This defect affects both recursive and authoritative servers.
ISC reports:
Two defects were discovered in ISC's BIND 9.8 code. These defects only affect BIND 9.8 servers which have recursion enabled and which use a specific feature of the software known as Response Policy Zones (RPZ) and where the RPZ zone contains a specific rule/action pattern.
The phpMyAdmin development team reports:
It was possible to manipulate the PHP session superglobal using some of the Swekey authentication code. This could open a path for other attacks.
An unsanitized key from the Servers array is written in a comment of the generated config. An attacker can modify this key by modifying the SESSION superglobal array. This allows the attacker to close the comment and inject code.
Through a possible bug in PHP running on Windows systems a NULL byte can truncate the pattern string allowing an attacker to inject the /e modifier causing the preg_replace function to execute its second argument as PHP code.
Fixed filtering of a file path in the MIME-type transformation code, which allowed for directory traversal.
The Asterisk Development Team reports:
AST-2011-008: If a remote user sends a SIP packet containing a NULL, Asterisk assumes available data extends past the null to the end of the packet when the buffer is actually truncated when copied. This causes SIP header parsing to modify data past the end of the buffer altering unrelated memory structures. This vulnerability does not affect TCP/TLS connections.
AST-2011-009: A remote user sending a SIP packet containing a Contact header with a missing left angle bracket causes Asterisk to access a null pointer.
AST-2011-010: A memory address was inadvertently transmitted over the network via IAX2 via an option control frame and the remote party would try to access it.
Possible enumeration of SIP users due to differing authentication responses.
It's reported in CVE advisory that:
expat_erl.c in ejabberd before 2.1.7 and 3.x before 3.0.0-alpha-3, and exmpp before 0.9.7, does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.
The Mozilla Project reports:
MFSA 2011-19 Miscellaneous memory safety hazards (rv:3.0/1.9.2.18)
MFSA 2011-20 Use-after-free vulnerability when viewing XUL document with script disabled
MFSA 2011-21 Memory corruption due to multipart/x-mixed-replace images
MFSA 2011-22 Integer overflow and arbitrary code execution in Array.reduceRight()
MFSA 2011-23 Multiple dangling pointer vulnerabilities
MFSA 2011-24 Cookie isolation error
MFSA 2011-25 Stealing of cross-domain images using WebGL textures
MFSA 2011-26 Multiple WebGL crashes
MFSA 2011-27 XSS encoding hazard with inline SVG
MFSA 2011-28 Non-whitelisted site can trigger xpinstall
The Samba team reports:
Samba is vulnerable to a denial of service, caused by a memory corruption error related to missing range checks on file descriptors being used in the "FD_SET" macro. By performing a select on a bad file descriptor set, a remote attacker could exploit this vulnerability to cause the application to crash or possibly execute arbitrary code on the system.
The Piwik security advisory reports:
The Piwik 1.5 release addresses a critical security vulnerability, which affect all Piwik users that have let granted some access to the "anonymous" user.
Piwik contains a remotely exploitable vulnerability that could allow a remote attacker to execute arbitrary code. Only installations that have granted untrusted view access to their stats (ie. grant "view" access to a website to anonymous) are at risk.
Dokuwiki reports:
We just released a Hotfix Release "2011-05-25a Rincewind". It contains the following changes:
Security fix for a Cross Site Scripting vulnerability. Malicious users could abuse DokuWiki's RSS embedding mechanism to create links containing arbitrary JavaScript. Note: this security problem is present in at least Anteater and Rincewind but probably in older releases as well.
Adobe Product Security Incident Response Team reports:
A critical vulnerability has been identified in Adobe Flash Player 10.3.181.23 and earlier versions for Windows, Macintosh, Linux and Solaris, and Adobe Flash Player 10.3.185.23 and earlier versions for Android. This memory corruption vulnerability (CVE-2011-2110) could cause a crash and potentially allow an attacker to take control of the affected system. There are reports that this vulnerability is being exploited in the wild in targeted attacks via malicious Web pages.
The IkiWiki development team reports:
Ludwig Nussel discovered a way for users to hijack root's tty when ikiwiki-mass-rebuild was run. Additionally, there was some potential for information disclosure via symlinks.
Adobe Product Security Incident Response Team reports:
An important vulnerability has been identified in Adobe Flash Player 10.3.181.16 and earlier versions for Windows, Macintosh, Linux and Solaris, and Adobe Flash Player 10.3.185.22 and earlier versions for Android. This universal cross-site scripting vulnerability (CVE-2011-2107) could be used to take actions on a user's behalf on any website or webmail provider, if the user visits a malicious website. There are reports that this vulnerability is being exploited in the wild in active targeted attacks designed to trick the user into clicking on a malicious link delivered in an email message.
ISC reports:
A BIND 9 DNS server set up to be a caching resolver is vulnerable to a user querying a domain with very large resource record sets (RRSets) when trying to negatively cache a response. This can cause the BIND 9 DNS server (named process) to crash.
Matthias Andree reports:
Fetchmail version 5.9.9 introduced STLS support for POP3, version 6.0.0 added STARTTLS for IMAP. However, the actual S(TART)TLS-initiated in-band SSL/TLS negotiation was not guarded by a timeout.
Depending on the operating system defaults as to TCP stream keepalive mode, fetchmail hangs in excess of one week after sending STARTTLS were observed if the connection failed without notifying the operating system, for instance, through network outages or hard server crashes.
A malicious server that does not respond, at the network level, after acknowledging fetchmail's STARTTLS or STLS request, can hold fetchmail in this protocol state, and thus render fetchmail unable to complete the poll, or proceed to the next server, effecting a denial of service.
SSL-wrapped mode on dedicated ports was unaffected by this problem, so can be used as a workaround.
The Asterisk Development Team reports:
If a remote user initiates a SIP call and the recipient picks up, the remote user can reply with a malformed Contact header that Asterisk will improperly handle and cause a crash due to a segmentation fault.
Subversion team reports:
Subversion's mod_dav_svn Apache HTTPD server module will dereference a NULL pointer if asked to deliver baselined WebDAV resources.
This can lead to a DoS. An exploit has been tested, and tools or users have been observed triggering this problem in the wild.
Subversion's mod_dav_svn Apache HTTPD server module may in certain scenarios enter a logic loop which does not exit and which allocates memory in each iteration, ultimately exhausting all the available memory on the server.
This can lead to a DoS. There are no known instances of this problem being observed in the wild, but an exploit has been tested.
Subversion's mod_dav_svn Apache HTTPD server module may leak to remote users the file contents of files configured to be unreadable by those users.
There are no known instances of this problem being observed in the wild, but an exploit has been tested.
Drupal Team reports:
A reflected cross site scripting vulnerability was discovered in Drupal's error handler. Drupal displays PHP errors in the messages area, and a specially crafted URL can cause malicious scripts to be injected into the message. The issue can be mitigated by disabling on-screen error display at admin / settings / error-reporting. This is the recommended setting for production sites.
When using re-colorable themes, color inputs are not sanitized. Malicious color values can be used to insert arbitrary CSS and script code. Successful exploitation requires the "Administer themes" permission.
US-CERT reports:
The Erlang/OTP ssh library implements a number of cryptographic operations that depend on cryptographically strong random numbers. Unfortunately the RNG used by the library is not cryptographically strong, and is further weakened by the use of predictable seed material. The RNG (Wichman-Hill) is not mixed with an entropy source.
Unbound developer reports:
NLnet Labs was notified of an error in Unbound's code-path for error replies which is triggered under special conditions. The error causes the program to abort.
Nathan Dors, Pubcookie Project reports:
A new non-persistent XSS vulnerability was found in the Pubcookie login server's compiled binary "index.cgi" CGI program. The CGI program mishandles untrusted data when printing responses to the browser. This makes the program vulnerable to carefully crafted requests containing script or HTML. If an attacker can lure an unsuspecting user to visit carefully staged content, the attacker can use it to redirect the user to his or her local Pubcookie login page and attempt to exploit the XSS vulnerability.
Nathan Dors, Pubcookie Project reports:
An Abuse of Functionality vulnerability in the Pubcookie authentication process was found. This vulnerability allows an attacker to appear as if he or she were authenticated using an empty userid when such a userid isn't expected. Unauthorized access to web content and applications may result where access is restricted to users who can authenticate successfully but where no additional authorization is performed after authentication.
ViewVC.org reports:
Security fix: remove user-reachable override of cvsdb row limit.
The Apache Portable Runtime Project reports:
A flaw was discovered in the apr_fnmatch() function in the Apache Portable Runtime (APR) library 1.4.4 (or any backported versions that contained the upstream fix for CVE-2011-0419). This could cause httpd workers to enter a hung state (100% CPU utilization).
apr-util 1.3.11 could cause crashes with httpd's mod_authnz_ldap in some situations.
Adobe Product Security Incident Response Team reports:
Critical vulnerabilities have been identified in Adobe Flash Player 10.2.159.1 and earlier versions (Adobe Flash Player 10.2.154.28 and earlier for Chrome users) for Windows, Macintosh, Linux and Solaris, and Adobe Flash Player 10.2.157.51 and earlier versions for Android. These vulnerabilities could cause the application to crash and could potentially allow an attacker to take control of the affected system. There are reports of malware attempting to exploit one of the vulnerabilities, CVE-2011-0627, in the wild via a Flash (.swf) file embedded in a Microsoft Word (.doc) or Microsoft Excel (.xls) file delivered as an email attachment targeting the Windows platform. However, to date, Adobe has not obtained a sample that successfully completes an attack.
Opera Software ASA reports:
Fixed an issue with framesets that could allow execution of arbitrary code, as reported by an anonymous contributor working with the SecuriTeam Secure Disclosure program.
Pure-FTPd development team reports:
Support for braces expansion in directory listings has been disabled -- Cf. CVE-2011-0418.
Fix a STARTTLS flaw similar to Postfix's CVE-2011-0411. If you're using TLS, upgrading is recommended.
Release notes for Exim 4.76 says:
Bugzilla 1106: CVE-2011-1764 - DKIM log line was subject to a format-string attack -- SECURITY: remote arbitrary code execution.
DKIM signature header parsing was double-expanded, second time unintentionally subject to list matching rules, letting the header cause arbitrary Exim lookups (of items which can occur in lists, *not* arbitrary string expansion). This allowed for information disclosure.
Also, impact assessment was redone shortly after the original announcement:
Further analysis revealed that the second security was more severe than I realised at the time that I wrote the announcement. The second security issue has been assigned CVE-2011-1407 and is also a remote code execution flaw. For clarity: both issues were introduced with 4.70.
The Apache Portable Runtime Project reports:
Note especially a security fix to APR 1.4.4, excessive CPU consumption was possible due to an unconstrained, recursive invocation of apr_fnmatch, as apr_fnmatch processed '*' wildcards. Reimplement apr_fnmatch() from scratch using a non-recursive algorithm now has improved compliance with the fnmatch() spec. (William Rowe)
The Zend Framework team reports:
Developers using non-ASCII-compatible encodings in conjunction with the MySQL PDO driver of PHP may be vulnerable to SQL injection attacks. Developers using ASCII-compatible encodings like UTF8 or latin1 are not affected by this PHP issue.
Mediawiki reports:
(Bug 28534) XSS vulnerability for IE 6 clients. This is the third attempt at fixing bug 28235.
(Bug 28639) Potential privilege escalation when $wgBlockDisablesLogin is enabled.
The Postfix SMTP server has a memory corruption error, when the Cyrus SASL library is used with authentication mechanisms other than PLAIN and LOGIN (ANONYMOUS is not affected, but should not be used for other reasons). This memory corruption is known to result in a program crash (SIGSEV).
The Mozilla Project reports:
MFSA 2011-12 Miscellaneous memory safety hazards
MFSA 2011-13 Multiple dangling pointer vulnerabilities
MFSA 2011-14 Information stealing via form history
MFSA 2011-15 Escalation of privilege through Java Embedding Plugin
MFSA 2011-16 Directory traversal in resource: protocol
MFSA 2011-17 WebGLES vulnerabilities
MFSA 2011-18 XSLT generate-id() function heap address leak
The Asterisk Development Team reports:
It is possible for a user of the Asterisk Manager Interface to bypass a security check and execute shell commands when they should not have that ability. Sending the "Async" header with the "Application" header during an Originate action, allows authenticated manager users to execute shell commands. Only users with the "system" privilege should be able to do this.
On systems that have the Asterisk Manager Interface, Skinny, SIP over TCP, or the built in HTTP server enabled, it is possible for an attacker to open as many connections to asterisk as he wishes. This will cause Asterisk to run out of available file descriptors and stop processing any new calls. Additionally, disk space can be exhausted as Asterisk logs failures to open new file descriptors.
VideoLAN project reports:
When parsing some MP4 (MPEG-4 Part 14) files, insufficient buffer size might lead to corruption of the heap.
Adobe Product Security Incident Response Team reports:
A critical vulnerability exists in Flash Player 10.2.153.1 and earlier versions (Adobe Flash Player 10.2.154.25 and earlier for Chrome users) for Windows, Macintosh, Linux and Solaris, Adobe Flash Player 10.2.156.12 and earlier versions for Android, and the Authplay.dll component that ships with Adobe Reader and Acrobat X (10.0.2) and earlier 10.x and 9.x versions for Windows and Macintosh operating systems.
This vulnerability (CVE-2011-0611) could cause a crash and potentially allow an attacker to take control of the affected system. There are reports that this vulnerability is being exploited in the wild in targeted attacks via a malicious Web page or a Flash (.swf) file embedded in a Microsoft Word (.doc) or Microsoft Excel (.xls) file delivered as an email attachment, targeting the Windows platform. At this time, Adobe is not aware of any attacks via PDF targeting Adobe Reader and Acrobat. Adobe Reader X Protected Mode mitigations would prevent an exploit of this kind from executing.
Best Practical reports:
In the process of preparing the release of RT 4.0.0, we performed an extensive security audit of RT's source code. During this audit, several vulnerabilities were found which affect earlier releases of RT.
An advisory published by the MIT Kerberos team says:
The password-changing capability of the MIT krb5 administration daemon (kadmind) has a bug that can cause it to attempt to free() an invalid pointer under certain error conditions. This can cause the daemon to crash or induce the execution of arbitrary code (which is believed to be difficult). No exploit that executes arbitrary code is known to exist, but it is easy to trigger a denial of service manually.
Some platforms detect attempted freeing of invalid pointers and protectively terminate the process, preventing arbitrary code execution on those platforms.
An advisory published by the MIT Kerberos team says:
The MIT Kerberos 5 Key Distribution Center (KDC) daemon is vulnerable to a double-free condition if the Public Key Cryptography for Initial Authentication (PKINIT) capability is enabled, resulting in daemon crash or arbitrary code execution (which is believed to be difficult).
An unauthenticated remote attacker can induce a double-free event, causing the KDC daemon to crash (denial of service), or to execute arbitrary code. Exploiting a double-free event to execute arbitrary code is believed to be difficult.
An advisory published by the MIT Kerberos team says:
The MIT krb5 Key Distribution Center (KDC) daemon is vulnerable to denial of service attacks from unauthenticated remote attackers. CVE-2011-0281 and CVE-2011-0282 occur only in KDCs using LDAP back ends, but CVE-2011-0283 occurs in all krb5-1.9 KDCs.
Exploit code is not known to exist, but the vulnerabilities are easy to trigger manually. The trigger for CVE-2011-0281 has already been disclosed publicly, but that fact might not be obvious to casual readers of the message in which it was disclosed. The triggers for CVE-2011-0282 and CVE-2011-0283 have not yet been disclosed publicly, but they are also trivial.
CVE-2011-0281: An unauthenticated remote attacker can cause a KDC configured with an LDAP back end to become completely unresponsive until restarted.
CVE-2011-0282: An unauthenticated remote attacker can cause a KDC configured with an LDAP back end to crash with a null pointer dereference.
CVE-2011-0283: An unauthenticated remote attacker can cause a krb5-1.9 KDC with any back end to crash with a null pointer dereference.
An advisory published by the MIT Kerberos team says:
The MIT krb5 KDC database propagation daemon (kpropd) is vulnerable to a denial-of-service attack triggered by invalid network input. If a kpropd worker process receives invalid input that causes it to exit with an abnormal status, it can cause the termination of the listening process that spawned it, preventing the slave KDC it was running on from receiving database updates from the master KDC.
Exploit code is not known to exist, but the vulnerabilities are easy to trigger manually.
An unauthenticated remote attacker can cause kpropd running in standalone mode (the "-S" option) to terminate its listening process, preventing database propagations to the KDC host on which it was running. Configurations where kpropd runs in incremental propagation mode ("iprop") or as an inetd server are not affected.
Matthias Hopf reports:
By crafting hostnames with shell escape characters, arbitrary commands can be executed in a root environment when a display manager reads in the resource database via xrdb.
These specially crafted hostnames can occur in two environments:
Systems are affected are: systems set their hostname via DHCP, and the used DHCP client allows setting of hostnames with illegal characters. And systems that allow remote logins via xdmcp.
OTRS Security Advisory reports:
- Several XSS attacks possible: An attacker could trick a logged in user to following a prepared URL inside of the OTRS system which causes a page to be shown that possibly includes malicious !JavaScript code because of incorrect escaping during the generation of the HTML page.
ISC reports:
ISC dhclient did not strip or escape certain shell meta-characters in responses from the dhcp server (like hostname) before passing the responses on to dhclient-script. Depending on the script and OS, this can result in execution of exploit code on the client.
When including a line to allow a network of IP addresses, the access to tinyproxy 56 is actually allowed for all IP addresses.
Quagga developers report:
Quagga 0.99.18 has been released. This release fixes 2 denial of services in bgpd, which can be remotely triggered by malformed AS-Pathlimit or Extended-Community attributes. These issues have been assigned CVE-2010-1674 and CVE-2010-1675. Support for AS-Pathlimit has been removed with this release.
Sebastian Krahmer reports:
It was discovered that the GNOME Display Manager (gdm) cleared the cache directory, which is owned by an unprivileged user, with the privileges of the root user. A race condition exists in gdm where a local user could take advantage of this by writing to the cache directory between ending the session and the signal to clean up the session, which could lead to the execution of arbitrary code as the root user.
US-CERT/NIST reports:
The _zip_name_locate function in zip_name_locate.c in the Zip extension in PHP before 5.3.6 does not properly handle a ZIPARCHIVE::FL_UNCHANGED argument, which might allow context-dependent attackers to cause a denial of service (application crash) via an empty ZIP archive that is processed with a (1) locateName or (2) statName operation.
US-CERT/NIST reports:
exif.c in the Exif extension in PHP before 5.3.6 on 64-bit platforms performs an incorrect cast, which allows remote attackers to cause a denial of service (application crash) via an image with a crafted Image File Directory (IFD) that triggers a buffer over-read.
Adobe Product Security Incident Response Team reports:
A critical vulnerability exists in Adobe Flash Player 10.2.152.33 and earlier versions (Adobe Flash Player 10.2.154.18 and earlier for Chrome users) for Windows, Macintosh, Linux and Solaris operating systems, Adobe Flash Player 10.1.106.16 and earlier versions for Android, and the Authplay.dll component that ships with Adobe Reader and Acrobat X (10.0.1) and earlier 10.x and 9.x versions of Reader and Acrobat for Windows and Macintosh operating systems.
This vulnerability (CVE-2011-0609) could cause a crash and potentially allow an attacker to take control of the affected system. There are reports that this vulnerability is being exploited in the wild in targeted attacks via a Flash (.swf) file embedded in a Microsoft Excel (.xls) file delivered as an email attachment.
The Mozilla Project reports:
MFSA 2011-11 Update to HTTPS certificate blacklist
Wietse Venema has discovered a software flaw that allows an attacker to inject client commands into an SMTP session during the unprotected plaintext SMTP protocol phase, such that the server will execute those commands during the SMTP- over-TLS protocol phase when all communication is supposed to be protected.
Hugo Leisink reports:
A bug has been found in version 7.4 of the Hiawatha webserver, which could lead to a server crash. This is caused by an integer overflow in the routine that reads the HTTP request. A too large value of the Content-Length HTTP header results in an overflow.
The Asterisk Development Team reports:
The releases of Asterisk 1.6.1.23, 1.6.2.17.1, and 1.8.3.1 resolve two issues:
- Resource exhaustion in Asterisk Manager Interface (AST-2011-003)
- Remote crash vulnerability in TCP/TLS server (AST-2011-004)
The issues and resolutions are described in the AST-2011-003 and AST-2011-004 security advisories.
Avahi developers reports:
A vulnerability has been reported in Avahi, which can be exploited by malicious people to cause a DoS (Denial of Service). The vulnerability is caused due to an error when processing certain UDP packets, which can be exploited to trigger an infinite loop by e.g. sending an empty packet to port 5353/UDP.
CVE reports:
Multiple cross-site scripting (XSS) vulnerabilities in Cgi/confirm.py in GNU Mailman 2.1.14 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) full name or (2) username field in a confirmation message.
Jean-Philippe Lang reports:
This maintenance release for 1.1.x users includes 13 bug fixes since 1.1.1 and a security fix (XSS vulnerability affecting all Redmine versions from 1.0.1 to 1.1.1).
Subversion project reports:
Subversion HTTP servers up to 1.5.9 (inclusive) or 1.6.15 (inclusive) are vulnerable to a remotely triggerable NULL-pointer dereference.
The Mozilla Project reports:
MFSA 2011-01 Miscellaneous memory safety hazards (rv:1.9.2.14/ 1.9.1.17)
MFSA 2011-02 Recursive eval call causes confirm dialogs to evaluate to true
MFSA 2011-03 Use-after-free error in JSON.stringify
MFSA 2011-04 Buffer overflow in JavaScript upvarMap
MFSA 2011-05 Buffer overflow in JavaScript atom map
MFSA 2011-06 Use-after-free error using Web Workers
MFSA 2011-07 Memory corruption during text run construction (Windows)
MFSA 2011-08 ParanoidFragmentSink allows javascript: URLs in chrome documents
MFSA 2011-09 Crash caused by corrupted JPEG image
MFSA 2011-10 CSRF risk with plugins and 307 redirects
Secunia reports:
Two vulnerabilities have been reported in OpenLDAP, which can be exploited by malicious people to bypass certain security restrictions.
The vulnerabilities are reported in versions prior to 2.4.24.
The Asterisk Development Team reports:
The releases of Asterisk 1.4.39.2, 1.6.1.22, 1.6.2.16.2, and 1.8.2.4 resolve an issue that when decoding UDPTL packets, multiple heap based arrays can be made to overflow by specially crafted packets. Systems configured for T.38 pass through or termination are vulnerable. The issue and resolution are described in the AST-2011-002 security advisory.
US CERT reports:
PivotX contains a vulnerability that allows an attacker to change the password of any account just by guessing the username. Version 2.2.4 has been reported to not be affected. This vulnerability is being exploited in the wild and users should immediately upgrade to 2.2.5 or later. Mitigation steps for users that have been compromised have been posted to the PivotX Support Community.
The Tomcat security team reports:
The HTML Manager interface displayed web applciation provided data, such as display names, without filtering. A malicious web application could trigger script execution by an administartive user when viewing the manager pages.
phpMyAdmin team reports:
It was possible to create a bookmark which would be executed unintentionally by other users.
When the files README, ChangeLog or LICENSE have been removed from their original place (possibly by the distributor), the scripts used to display these files can show their full path, leading to possible further attacks.
Adobe Product Security Incident Response Team reports:
Critical vulnerabilities have been identified in Adobe Flash Player 10.1.102.64 and earlier versions for Windows, Macintosh, Linux, and Solaris. These vulnerabilities could cause the application to crash and could potentially allow an attacker to take control of the affected system.
Secunia reports:
The vulnerability is caused due to an error within the "closedctd()" function in fitz/filt_dctd.c when processing PDF files containing certain malformed JPEG images. This can be exploited to cause a stack corruption by e.g. tricking a user into opening a specially crafted PDF file.
Secunia reports:
Input passed via an email from address is not properly sanitised in the "deliver()" function (lib/mail/network/delivery_methods/sendmail.rb) before being used as a command line argument. This can be exploited to inject arbitrary shell commands.
Plone developer reports:
This is an escalation of privileges attack that can be used by anonymous users to gain access to a Plone site's administration controls, view unpublished content, create new content and modify a site's skin. The sandbox protecting access to the underlying system is still in place, and it does not grant access to other applications running on the same Zope instance.
exim.org reports:
CVE-2011-0017 - check return value of setuid/setgid. This is a privilege escalation vulnerability whereby the Exim run-time user can cause root to append content of the attacker's choosing to arbitrary files.
OpenOffice.org Security Team reports:
Fixed in OpenOffice.org 3.3
- CVE-2010-2935 / CVE-2010-2936: Security Vulnerability in OpenOffice.org related to PowerPoint document processing
- CVE-2010-3450: Security Vulnerability in OpenOffice.org related to Extensions and filter package files
- CVE-2010-3451 / CVE-2010-3452: Security Vulnerability in OpenOffice.org related to RTF document processing
- CVE-2010-3453 / CVE-2010-3454: Security Vulnerability in OpenOffice.org related to Word document processing
- CVE-2010-3689: Insecure LD_LIBRARY_PATH usage in OpenOffice.org shell scripts
- CVE-2010-3702 / CVE-2010-3704: Security Vulnerability in OpenOffice.org's PDF Import extension resulting from 3rd party library XPDF
- CVE-2010-4008 / CVE-2010-4494: Possible Security Vulnerability in OpenOffice.org resulting from 3rd party library LIBXML2
- CVE-2010-4253: Security Vulnerability in OpenOffice.org related to PNG file processing
- CVE-2010-4643: Security Vulnerability in OpenOffice.org related to TGA file processing
Gustavo Noronha Silva reports:
This release has essentially security fixes. Refer to the WebKit/gtk/NEWS file inside the tarball for details. We would like to thank the Red Hat security team (Huzaifa Sidhpurwala in particular) and Michael Gilbert from Debian for their help in checking (and pushing!) security issues affecting the WebKitGTK+ stable branch for this release.
Awstats change log reports:
- Security fix (Traverse directory of LoadPlugin)
- Security fix (Limit config to defined directory to avoid access to external config file via a nfs or webdav link).
Opera reports:
Opera 11.01 is a recommended upgrade offering security and stability enhancements.
The following security vulnerabilities have been fixed:
- Removed support for "
javascript:
" URLs in CSS -o-link values, to make it easier for sites to filter untrusted CSS.- Fixed an issue where large form inputs could allow execution of arbitrary code, as reported by Jordi Chancel; see our advisory.
- Fixed an issue which made it possible to carry out clickjacking attacks against internal opera: URLs; see our advisory.
- Fixed issues which allowed web pages to gain limited access to files on the user's computer; see our advisory.
- Fixed an issue where email passwords were not immediately deleted when deleting private data; see our advisory.
Django project reports:
Today the Django team is issuing multiple releases -- Django 1.2.5 and Django 1.1.4 -- to remedy three security issues reported to us. All users of affected versions of Django are urged to upgrade immediately.
Medawiki reports:
An arbitrary script inclusion vulnerability was discovered. The vulnerability only allows execution of files with names ending in ".php" which are already present in the local filesystem. Only servers running Microsoft Windows and possibly Novell Netware are affected. Despite these mitigating factors, all users are advised to upgrade, since there is a risk of complete server compromise. MediaWiki 1.8.0 and later is affected.
Security researcher mghack discovered a CSS injection vulnerability. For Internet Explorer and similar browsers, this is equivalent to an XSS vulnerability, that is to say, it allows the compromise of wiki user accounts. For other browsers, it allows private data such as IP addresses and browsing patterns to be sent to a malicious external web server. It affects all versions of MediaWiki. All users are advised to upgrade.
Vendor reports:
SQL injection vulnerability in the do_trackbacks function in wp-includes/comment.php in WordPress before 3.0.2 allows remote authenticated users to execute arbitrary SQL commands via the Send Trackbacks field.
VLC team reports:
When parsing an invalid MKV (Matroska or WebM) file, input validation are insufficient.
MaraDNS developer Sam Trenholme reports:
... a mistake in allocating an array of integers, allocating it in bytes instead of sizeof(int) units. This resulted in a buffer being too small, allowing it to be overwritten. The impact of this programming error is that MaraDNS can be crashed by sending MaraDNS a single "packet of death". Since the data placed in the overwritten array can not be remotely controlled (it is a list of increasing integers), there is no way to increase privileges exploiting this bug.
ISC reports:
When the DHCPv6 server code processes a message for an address that was previously declined and internally tagged as abandoned it can trigger an assert failure resulting in the server crashing. This could be used to crash DHCPv6 servers remotely. This issue only affects DHCPv6 servers. DHCPv4 servers are unaffected.
A Bugzilla Security Advisory reports:
This advisory covers three security issues that have recently been fixed in the Bugzilla code:
- A weakness in Bugzilla could allow a user to gain unauthorized access to another Bugzilla account.
- A weakness in the Perl CGI.pm module allows injecting HTTP headers and content to users via several pages in Bugzilla.
- If you put a harmful "javascript:" or "data:" URL into Bugzilla's "URL" field, then there are multiple situations in which Bugzilla will unintentionally make that link clickable.
- Various pages lack protection against cross-site request forgeries.
All affected installations are encouraged to upgrade as soon as possible.
Dokuwiki reports:
This security update fixes problems in the XMLRPC interface where ACLs where not checked correctly sometimes, making it possible to access and write information that should not have been accessible/writable. This only affects users who have enabled the XMLRPC interface (default is off) and have enabled XMLRPC access for users who can't access/write all content anyway (default is nobody, see http://www.dokuwiki.org/config:xmlrpcuser for details).
This update also includes a fix for a problem in the general ACL checking function that could be exploited to gain access to restricted pages and media files in rare conditions (when you had rights for an id you could get the same rights on ids where one character has been replaced by a ".").
The Asterisk Development Team reports:
The releases of Asterisk 1.4.38.1, 1.4.39.1, 1.6.1.21, 1.6.2.15.1, 1.6.2.16.2, 1.8.1.2, and 1.8.2.1 resolve an issue when forming an outgoing SIP request while in pedantic mode, which can cause a stack buffer to be made to overflow if supplied with carefully crafted caller ID information. The issue and resolution are described in the AST-2011-001 security advisory.
Colin Percival reports:
In versions 1.0.22 through 1.0.27 of Tarsnap, the CTR nonce value is not incremented after each chunk is encrypted. (The CTR counter is correctly incremented after each 16 bytes of data was processed, but this counter is reset to zero for each new chunk.)
Note that since the Tarsnap client-server protocol is encrypted, being able to intercept Tarsnap client-server traffic does not provide an attacker with access to the data.
The MoinMoin developers reports:
Fix XSS in Despam action (CVE-2010-0828)
Fix XSS issues
- by escaping template name in messages
- by fixing other places that had similar issues
The Tor Project reports:
A remote heap overflow vulnerability that can allow remote code execution. Other fixes address a variety of assert and crash bugs, most of which we think are hard to exploit remotely. All Tor users should upgrade.
Todd Miller reports:
Beginning with sudo version 1.7.0 it has been possible to grant permission to run a command using a specified group via sudo's -g option (run as group), if allowed by the sudoers file. A flaw exists in sudo's password checking logic that allows a user to run a command with only the group changed without being prompted for a password.
Entry for CVE-2010-4539 says:
The walk function in repos.c in the mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.15, allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via vectors that trigger the walking of SVNParentPath collections.
Entry for CVE-2010-4644 says:
Multiple memory leaks in rev_hunt.c in Apache Subversion before 1.6.15 allow remote authenticated users to cause a denial of service (memory consumption and daemon crash) via the -g option to the blame command.
PHP developers reports:
Security Enhancements and Fixes in PHP 5.3.5:
- Fixed bug #53632 (PHP hangs on numeric value 2.2250738585072011e-308). (CVE-2010-4645)
Security Enhancements and Fixes in PHP 5.2.17:
- Fixed bug #53632 (PHP hangs on numeric value 2.2250738585072011e-308). (CVE-2010-4645)
David Woodhouse reports:
Secondly a privilege escalation where the trusted 'exim' user is able to tell Exim to use arbitrary config files, in which further ${run ...} commands will be invoked as root.
Clickjacking vulnerabilities:
Clickjacking is a type of vulnerability discovered in 2008, which is similar to CSRF. The attack involves displaying the target webpage in a iframe embedded in a malicious website. Using CSS, the submit button of the form on the targeit webpage is made invisible, and then overlaid with some button or link on the malicious website that encourages the user to click on it.
Gustavo Noronha Silva reports:
The patches to fix the following CVEs are included with help from Huzaifa Sidhpurwala from the Red Hat security team.
Django project reports:
Today the Django team is issuing multiple releases -- Django 1.2.4, Django 1.1.3 and Django 1.3 beta 1 -- to remedy two security issues reported to us. All users of affected versions of Django are urged to upgrade immediately.
Information leakage in Django administrative interface
The Django administrative interface, django.contrib.admin supports filtering of displayed lists of objects by fields on the corresponding models, including across database-level relationships. This is implemented by passing lookup arguments in the querystring portion of the URL, and options on the ModelAdmin class allow developers to specify particular fields or relationships which will generate automatic links for filtering.
Denial-of-service attack in password-reset mechanism
Django's bundled authentication framework, django.contrib.auth, offers views which allow users to reset a forgotten password. The reset mechanism involves generating a one-time token composed from the user's ID, the timestamp of the reset request converted to a base36 integer, and a hash derived from the user's current password hash (which will change once the reset is complete, thus invalidating the token).
Drupal security team reports:
The Views module provides a flexible method for Drupal site designers to control how lists and tables of content are presented. Under certain circumstances, Views could display parts of the page path without escaping, resulting in a relected Cross Site Scripting (XSS) vulnerability. An attacker could exploit this to gain full administrative access.
Mitigating factors: This vulnerability only occurs with a specific combination of configuration options for a specific View, but this combination is used in the default Views provided by some additional modules. A malicious user would need to get an authenticated administrative user to visit a specially crafted URL.
Jean-Philippe Lang reports:
This release also fixes 3 security issues reported by joernchen of Phenoelit:
- logged in users may be able to access private data (affected versions: 1.0.x)
- persistent XSS vulnerability in textile formatter (affected versions: all previous releases)
- remote command execution in bazaar repository adapter (affected versions: 0.9.x, 1.0.x)
The Tor Project reports:
Remotely exploitable bug that could be used to crash instances of Tor remotely by overflowing on the heap. Remote-code execution hasn't been confirmed, but can't be ruled out. Everyone should upgrade.
The YUI team reports:
A security-related defect was introduced in the YUI 2 Flash component infrastructure beginning with the YUI 2.4.0 release. This defect allows JavaScript injection exploits to be created against domains that host affected YUI .swf files.
The following DoS conditions in Zip extension were fixed in PHP 5.3.4 and PHP 5.2.15:
Fixed crash in zip extract method (possible CWE-170).
The ZipArchive::getArchiveComment function in PHP 5.2.x through 5.2.14 and 5.3.x through 5.3.3 allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted ZIP archive.
The following DoS condition in filter extension was fixed in PHP 5.3.4 and PHP 5.2.15:
Stack consumption vulnerability in the filter_var function in PHP 5.2.x through 5.2.14 and 5.3.x through 5.3.3, when FILTER_VALIDATE_EMAIL mode is used, allows remote attackers to cause a denial of service (memory consumption and application crash) via a long e-mail address string.
The following DoS condition in IMAP extension was fixed in PHP 5.3.4 and PHP 5.2.15:
A remote user can send specially crafted IMAP user name or password data to trigger a double free memory error in 'ext/imap/php_imap.c' and cause the target service to crash.
It may be possible to execute arbitrary code. However, code execution was not confirmed.
Entry for CVE-2010-2094 says:
Multiple format string vulnerabilities in the phar extension in PHP 5.3 before 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) and possibly execute arbitrary code via a crafted phar:// URI that is not properly handled by the (1) phar_stream_flush, (2) phar_wrapper_unlink, (3) phar_parse_url, or (4) phar_wrapper_open_url functions in ext/phar/stream.c; and the (5) phar_wrapper_open_dir function in ext/phar/dirstream.c, which triggers errors in the php_stream_wrapper_log_error function.
PECL source code for PHAR extension shares the same code, so it is vulnerable too.
PHP-specific version of NULL-byte poisoning was briefly described by ShAnKaR:
Poison NULL byte vulnerability for perl CGI applications was described in [1]. ShAnKaR noted, that same vulnerability also affects different PHP applications.
PHP developers report that branch 5.3 received a fix:
Paths with NULL in them (foo\0bar.txt) are now considered as invalid (CVE-2006-7243).
MITRE reports:
fopen_wrappers.c in PHP 5.3.x through 5.3.3 might allow remote attackers to bypass open_basedir restrictions via vectors related to the length of a filename.
Off-by-one error in the sanity validator for the extract() method allowed attackers to replace the values of $GLOBALS and $this when mode EXTR_OVERWRITE was used.
The Mozilla Project reports:
MFSA 2010-74 Miscellaneous memory safety hazards (rv:1.9.2.13/ 1.9.1.16)
MFSA 2010-75 Buffer overflow while line breaking after document.write with long string
MFSA 2010-76 Chrome privilege escalation with window.open and isindex element
MFSA 2010-77 Crash and remote code execution using HTML tags inside a XUL tree
MFSA 2010-78 Add support for OTS font sanitizer
MFSA 2010-79 Java security bypass from LiveConnect loaded via data: URL meta refresh
MFSA 2010-80 Use-after-free error with nsDOMAttribute MutationObserver
MFSA 2010-81 Integer overflow vulnerability in NewIdArray
MFSA 2010-82 Incomplete fix for CVE-2010-0179
MFSA 2010-83 Location bar SSL spoofing using network error page
MFSA 2010-84 XSS hazard in multiple character encodings
The MIT Kerberos team reports:
MIT krb5 KDC may issue tickets not requested by a client, based on an attacker-chosen KrbFastArmoredReq.
An authenticated remote attacker that controls a legitimate service principal could obtain a valid service ticket to itself containing valid KDC-generated authorization data for a client whose TGS-REQ it has intercepted. The attacker could then use this ticket for S4U2Proxy to impersonate the targeted client even if the client never authenticated to the subverted service. The vulnerable configuration is believed to be rare.
The MIT Kerberos team reports:
MIT krb5 (releases incorrectly accepts RFC 3961 key-derivation checksums using RC4 keys when verifying AD-SIGNEDPATH and AD-KDC-ISSUED authorization data.
An authenticated remote attacker that controls a legitimate service principal has a 1/256 chance of forging the AD-SIGNEDPATH signature if the TGT key is RC4, allowing it to use self-generated "evidence" tickets for S4U2Proxy, instead of tickets obtained from the user or with S4U2Self. Configurations using RC4 for the TGT key are believed to be rare.
An authenticated remote attacker has a 1/256 chance of forging AD-KDC-ISSUED signatures on authdata elements in tickets having an RC4 service key, resulting in privilege escalation against a service that relies on these signatures. There are no known uses of the KDC-ISSUED authdata container at this time.
The MIT Kerberos team reports:
MIT krb5 incorrectly accepts an unkeyed checksum for PAC signatures.
An authenticated remote attacker can forge PACs if using a KDC that does not filter client-provided PAC data. This can result in privilege escalation against a service that relies on PAC contents to make authorization decisions.
The MIT Kerberos team reports:
MIT krb incorrectly accepts an unkeyed checksum with DES session keys for version 2 (RFC 4121) of the GSS-API krb5 mechanism.
An unauthenticated remote attacker can forge GSS tokens that are intended to be integrity-protected but unencrypted, if the targeted pre-existing application session uses a DES session key.
MIT krb5 KDC incorrectly accepts RFC 3961 key-derivation checksums using RC4 keys when verifying the req-checksum in a KrbFastArmoredReq.
An unauthenticated remote attacker has a 1/256 chance of swapping a client-issued KrbFastReq into a different KDC-REQ, if the armor key is RC4. The consequences are believed to be minor.
The MIT Kerberos team reports:
MIT krb5 clients incorrectly accept an unkeyed checksums in the SAM-2 preauthentication challenge.
An unauthenticated remote attacker could alter a SAM-2 challenge, affecting the prompt text seen by the user or the kind of response sent to the KDC. Under some circumstances, this can negate the incremental security benefit of using a single-use authentication mechanism token.
MIT krb5 incorrectly accepts RFC 3961 key-derivation checksums using RC4 keys when verifying KRB-SAFE messages.
An unauthenticated remote attacker has a 1/256 chance of forging KRB-SAFE messages in an application protocol if the targeted pre-existing session uses an RC4 session key. Few application protocols use KRB-SAFE messages.
Google Chrome Releases reports:
Fixed in 15.0.874.121:
[103259] High CVE-2011-3900: Out-of-bounds write in v8. Credit to Christian Holler.Fixed in 15.0.874.120:
[100465] High CVE-2011-3892: Double free in Theora decoder. Credit to Aki Helin of OUSPG.
[100492] [100543] Medium CVE-2011-3893: Out of bounds reads in MKV and Vorbis media handlers. Credit to Aki Helin of OUSPG.
[101172] High CVE-2011-3894: Memory corruption regression in VP8 decoding. Credit to Andrew Scherkus of the Chromium development community.
[101458] High CVE-2011-3895: Heap overflow in Vorbis decoder. Credit to Aki Helin of OUSPG.
[101624] High CVE-2011-3896: Buffer overflow in shader variable mapping. Credit to Ken "strcpy" Russell of the Chromium development community.
[102242] High CVE-2011-3897: Use-after-free in editing. Credit to pa_kt reported through ZDI (ZDI-CAN-1416).
[102461] Low CVE-2011-3898: Failure to ask for permission to run applets in JRE7. Credit to Google Chrome Security Team (Chris Evans).Fixed in 15.0.874.102:
[86758] High CVE-2011-2845: URL bar spoof in history handling. Credit to Jordi Chancel.
[88949] Medium CVE-2011-3875: URL bar spoof with drag+drop of URLs. Credit to Jordi Chancel.
[90217] Low CVE-2011-3876: Avoid stripping whitespace at the end of download filenames. Credit to Marc Novak.
[91218] Low CVE-2011-3877: XSS in appcache internals page. Credit to Google Chrome Security Team (Tom Sepez) plus independent discovery by Juho Nurminen.
[94487] Medium CVE-2011-3878: Race condition in worker process initialization. Credit to miaubiz.
[95374] Low CVE-2011-3879: Avoid redirect to chrome scheme URIs. Credit to Masato Kinugawa.
[95992] Low CVE-2011-3880: Don't permit as a HTTP header delimiter. Credit to Vladimir Vorontsov, ONsec company.
[96047] [96885] [98053] [99512] [99750] High CVE-2011-3881: Cross-origin policy violations. Credit to Sergey Glazunov.
[96292] High CVE-2011-3882: Use-after-free in media buffer handling. Credit to Google Chrome Security Team (Inferno).
[96902] High CVE-2011-3883: Use-after-free in counter handling. Credit to miaubiz.
[97148] High CVE-2011-3884: Timing issues in DOM traversal. Credit to Brian Ryner of the Chromium development community.
[97599] [98064] [98556] [99294] [99880] [100059] High CVE-2011-3885: Stale style bugs leading to use-after-free. Credit to miaubiz.
[98773] [99167] High CVE-2011-3886: Out of bounds writes in v8. Credit to Christian Holler.
[98407] Medium CVE-2011-3887: Cookie theft with javascript URIs. Credit to Sergey Glazunov.
[99138] High CVE-2011-3888: Use-after-free with plug-in and editing. Credit to miaubiz.
[99211] High CVE-2011-3889: Heap overflow in Web Audio. Credit to miaubiz.
[99553] High CVE-2011-3890: Use-after-free in video source handling. Credit to Ami Fischman of the Chromium development community.
[100332] High CVE-2011-3891: Exposure of internal v8 functions. Credit to Steven Keuchel of the Chromium development community plus independent discovery by Daniel Divricean.Fixed in 14.0.835.202:
[93788] High CVE-2011-2876: Use-after-free in text line box handling. Credit to miaubiz.
[95072] High CVE-2011-2877: Stale font in SVG text handling. Credit to miaubiz.
[95671] High CVE-2011-2878: Inappropriate cross-origin access to the window prototype. Credit to Sergey Glazunov.
[96150] High CVE-2011-2879: Lifetime and threading issues in audio node handling. Credit to Google Chrome Security Team (Inferno).
[97451] [97520] [97615] High CVE-2011-2880: Use-after-free in the v8 bindings. Credit to Sergey Glazunov.
[97784] High CVE-2011-2881: Memory corruption with v8 hidden objects. Credit to Sergey Glazunov.
[98089] Critical CVE-2011-3873: Memory corruption in shader translator. Credit to Zhenyao Mo of the Chromium development community.Fixed in 14.0.835.163:
[49377] High CVE-2011-2835: Race condition in the certificate cache. Credit to Ryan Sleevi of the Chromium development community.
[51464] Low CVE-2011-2836: Infobar the Windows Media Player plug-in to avoid click-free access to the system Flash. Credit to electronixtar.
[Linux only] [57908] Low CVE-2011-2837: Use PIC / pie compiler flags. Credit to wbrana.
[75070] Low CVE-2011-2838: Treat MIME type more authoritatively when loading plug-ins. Credit to Michal Zalewski of the Google Security Team.
[76771] High CVE-2011-2839: Crash in v8 script object wrappers. Credit to Kostya Serebryany of the Chromium development community.
[78427] [83031] Low CVE-2011-2840: Possible URL bar spoofs with unusual user interaction. Credit to kuzzcc.
[78639] High CVE-2011-2841: Garbage collection error in PDF. Credit to Mario Gomes.
[82438] Medium CVE-2011-2843: Out-of-bounds read with media buffers. Credit to Kostya Serebryany of the Chromium development community.
[85041] Medium CVE-2011-2844: Out-of-bounds read with mp3 files. Credit to Mario Gomes.
[89219] High CVE-2011-2846: Use-after-free in unload event handling. Credit to Arthur Gerkis.
[89330] High CVE-2011-2847: Use-after-free in document loader. Credit to miaubiz.
[89564] Medium CVE-2011-2848: URL bar spoof with forward button. Credit to Jordi Chancel.
[89795] Low CVE-2011-2849: Browser NULL pointer crash with WebSockets. Credit to Arthur Gerkis.
[89991] Medium CVE-2011-3234: Out-of-bounds read in box handling. Credit to miaubiz.
[90134] Medium CVE-2011-2850: Out-of-bounds read with Khmer characters. Credit to miaubiz.
[90173] Medium CVE-2011-2851: Out-of-bounds read in video handling. Credit to Google Chrome Security Team (Inferno).
[91120] High CVE-2011-2852: Off-by-one in v8. Credit to Christian Holler.
[91197] High CVE-2011-2853: Use-after-free in plug-in handling. Credit to Google Chrome Security Team (SkyLined).
[92651] [94800] High CVE-2011-2854: Use-after-free in ruby / table style handing. Credit to Slawomir Blazek, and independent later discoveries by miaubiz and Google Chrome Security Team (Inferno).
[92959] High CVE-2011-2855: Stale node in stylesheet handling. Credit to Arthur Gerkis.
[93416] High CVE-2011-2856: Cross-origin bypass in v8. Credit to Daniel Divricean.
[93420] High CVE-2011-2857: Use-after-free in focus controller. Credit to miaubiz.
[93472] High CVE-2011-2834: Double free in libxml XPath handling. Credit to Yang Dingning from NCNIPC, Graduate University of Chinese Academy of Sciences.
[93497] Medium CVE-2011-2859: Incorrect permissions assigned to non-gallery pages. Credit to Bernhard "Bruhns" Brehm of Recurity Labs.
[93587] High CVE-2011-2860: Use-after-free in table style handling. Credit to miaubiz.
[93596] Medium CVE-2011-2861: Bad string read in PDF. Credit to Aki Helin of OUSPG.
[93906] High CVE-2011-2862: Unintended access to v8 built-in objects. Credit to Sergey Glazunov.
[95563] Medium CVE-2011-2864: Out-of-bounds read with Tibetan characters. Credit to Google Chrome Security Team (Inferno).
[95625] Medium CVE-2011-2858: Out-of-bounds read with triangle arrays. Credit to Google Chrome Security Team (Inferno).
[95917] Low CVE-2011-2874: Failure to pin a self-signed cert for a session. Credit to Nishant Yadant of VMware and Craig Chamberlain (@randomuserid).
High CVE-2011-2875: Type confusion in v8 object sealing. Credit to Christian Holler.Fixed in 13.0.782.215:
[89402] High CVE-2011-2821: Double free in libxml XPath handling. Credit to Yang Dingning from NCNIPC, Graduate University of Chinese Academy of Sciences.
[82552] High CVE-2011-2823: Use-after-free in line box handling. Credit to Google Chrome Security Team (SkyLined) and independent later discovery by miaubiz.
[88216] High CVE-2011-2824: Use-after-free with counter nodes. Credit to miaubiz.
[88670] High CVE-2011-2825: Use-after-free with custom fonts. Credit to wushi of team509 reported through ZDI (ZDI-CAN-1283), plus indepdendent later discovery by miaubiz.
[87453] High CVE-2011-2826: Cross-origin violation with empty origins. Credit to Sergey Glazunov.
[90668] High CVE-2011-2827: Use-after-free in text searching. Credit to miaubiz.
[91517] High CVE-2011-2828: Out-of-bounds write in v8. Credit to Google Chrome Security Team (SkyLined).
[32-bit only] [91598] High CVE-2011-2829: Integer overflow in uniform arrays. Credit to Sergey Glazunov.
[Linux only] [91665] High CVE-2011-2839: Buggy memset() in PDF. Credit to Aki Helin of OUSPG.Fixed in 13.0.782.107:
[75821] Medium CVE-2011-2358: Always confirm an extension install via a browser dialog. Credit to Sergey Glazunov.
[78841] High CVE-2011-2359: Stale pointer due to bad line box tracking in rendering. Credit to miaubiz and Martin Barbella.
[79266] Low CVE-2011-2360: Potential bypass of dangerous file prompt. Credit to kuzzcc.
[79426] Low CVE-2011-2361: Improve designation of strings in the basic auth dialog. Credit to kuzzcc.
[Linux only] [81307] Medium CVE-2011-2782: File permissions error with drag and drop. Credit to Evan Martin of the Chromium development community.
[83273] Medium CVE-2011-2783: Always confirm a developer mode NPAPI extension install via a browser dialog. Credit to Sergey Glazunov.
[83841] Low CVE-2011-2784: Local file path disclosure via GL program log. Credit to kuzzcc.
[84402] Low CVE-2011-2785: Sanitize the homepage URL in extensions. Credit to kuzzcc.
[84600] Low CVE-2011-2786: Make sure the speech input bubble is always on-screen. Credit to Olli Pettay of Mozilla.
[84805] Medium CVE-2011-2787: Browser crash due to GPU lock re-entrancy issue. Credit to kuzzcc.
[85559] Low CVE-2011-2788: Buffer overflow in inspector serialization. Credit to Mikolaj Malecki.
[85808] Medium CVE-2011-2789: Use after free in Pepper plug-in instantiation. Credit to Mario Gomes and kuzzcc.
[86502] High CVE-2011-2790: Use-after-free with floating styles. Credit to miaubiz.
[86900] High CVE-2011-2791: Out-of-bounds write in ICU. Credit to Yang Dingning from NCNIPC, Graduate University of Chinese Academy of Sciences.
[87148] High CVE-2011-2792: Use-after-free with float removal. Credit to miaubiz.
[87227] High CVE-2011-2793: Use-after-free in media selectors. Credit to miaubiz.
[87298] Medium CVE-2011-2794: Out-of-bounds read in text iteration. Credit to miaubiz.
[87339] Medium CVE-2011-2795: Cross-frame function leak. Credit to Shih Wei-Long.
[87548] High CVE-2011-2796: Use-after-free in Skia. Credit to Google Chrome Security Team (Inferno) and Kostya Serebryany of the Chromium development community.
[87729] High CVE-2011-2797: Use-after-free in resource caching. Credit to miaubiz.
[87815] Low CVE-2011-2798: Prevent a couple of internal schemes from being web accessible. Credit to sirdarckcat of the Google Security Team.
[87925] High CVE-2011-2799: Use-after-free in HTML range handling. Credit to miaubiz.
[88337] Medium CVE-2011-2800: Leak of client-side redirect target. Credit to Juho Nurminen.
[88591] High CVE-2011-2802: v8 crash with const lookups. Credit to Christian Holler.
[88827] Medium CVE-2011-2803: Out-of-bounds read in Skia paths. Credit to Google Chrome Security Team (Inferno).
[88846] High CVE-2011-2801: Use-after-free in frame loader. Credit to miaubiz.
[88889] High CVE-2011-2818: Use-after-free in display box rendering. Credit to Martin Barbella.
[89142] High CVE-2011-2804: PDF crash with nested functions. Credit to Aki Helin of OUSPG.
[89520] High CVE-2011-2805: Cross-origin script injection. Credit to Sergey Glazunov.
[90222] High CVE-2011-2819: Cross-origin violation in base URI handling. Credit to Sergey Glazunov.Fixed in 12.0.742.112:
[77493] Medium CVE-2011-2345: Out-of-bounds read in NPAPI string handling. Credit to Philippe Arteau.
[84355] High CVE-2011-2346: Use-after-free in SVG font handling. Credit to miaubiz.
[85003] High CVE-2011-2347: Memory corruption in CSS parsing. Credit to miaubiz.
[85102] High CVE-2011-2350: Lifetime and re-entrancy issues in the HTML parser. Credit to miaubiz.
[85177] High CVE-2011-2348: Bad bounds check in v8. Credit to Aki Helin of OUSPG.
[85211] High CVE-2011-2351: Use-after-free with SVG use element. Credit to miaubiz.
[85418] High CVE-2011-2349: Use-after-free in text selection. Credit to miaubiz.Fixed in 12.0.742.91:
[73962] [79746] High CVE-2011-1808: Use-after-free due to integer issues in float handling. Credit to miaubiz.
[75496] Medium CVE-2011-1809: Use-after-free in accessibility support. Credit to Google Chrome Security Team (SkyLined).
[75643] Low CVE-2011-1810: Visit history information leak in CSS. Credit to Jesse Mohrland of Microsoft and Microsoft Vulnerability Research (MSVR).
[76034] Low CVE-2011-1811: Browser crash with lots of form submissions. Credit to "DimitrisV22".
[77026] Medium CVE-2011-1812: Extensions permission bypass. Credit to kuzzcc.
[78516] High CVE-2011-1813: Stale pointer in extension framework. Credit to Google Chrome Security Team (Inferno).
[79362] Medium CVE-2011-1814: Read from uninitialized pointer. Credit to Eric Roman of the Chromium development community.
[79862] Low CVE-2011-1815: Extension script injection into new tab page. Credit to kuzzcc.
[80358] Medium CVE-2011-1816: Use-after-free in developer tools. Credit to kuzzcc.
[81916] Medium CVE-2011-1817: Browser memory corruption in history deletion. Credit to Collin Payne.
[81949] High CVE-2011-1818: Use-after-free in image loader. Credit to miaubiz.
[83010] Medium CVE-2011-1819: Extension injection into chrome:// pages. Credit to Vladislavas Jarmalis, plus subsequent independent discovery by Sergey Glazunov.
[83275] High CVE-2011-2332: Same origin bypass in v8. Credit to Sergey Glazunov.
[83743] High CVE-2011-2342: Same origin bypass in DOM. Credit to Sergey Glazunov.Fixed in 11.0.696.71:
[72189] Low CVE-2011-1801: Pop-up blocker bypass. Credit to Chamal De Silva.
[82546] High CVE-2011-1804: Stale pointer in floats rendering. Credit to Martin Barbella.
[82873] Critical CVE-2011-1806: Memory corruption in GPU command buffer. Credit to Google Chrome Security Team (Cris Neckar).
[82903] Critical CVE-2011-1807: Out-of-bounds write in blob handling. Credit to Google Chrome Security Team (Inferno) and Kostya Serebryany of the Chromium development community.Fixed in 11.0.696.68:
[64046] High CVE-2011-1799: Bad casts in Chromium WebKit glue. Credit to Google Chrome Security Team (SkyLined).
[80608] High CVE-2011-1800: Integer overflows in SVG filters. Credit to Google Chrome Security Team (Cris Neckar).Fixed in 11.0.696.57:
[61502] High CVE-2011-1303: Stale pointer in floating object handling. Credit to Scott Hess of the Chromium development community and Martin Barbella.
[70538] Low CVE-2011-1304: Pop-up block bypass via plug-ins. Credit to Chamal De Silva.
[Linux / Mac only] [70589] Medium CVE-2011-1305: Linked-list race in database handling. Credit to Kostya Serebryany of the Chromium development community.
[71586] Medium CVE-2011-1434: Lack of thread safety in MIME handling. Credit to Aki Helin.
[72523] Medium CVE-2011-1435: Bad extension with "tabs" permission can capture local files. Credit to Cole Snodgrass.
[Linux only] [72910] Low CVE-2011-1436: Possible browser crash due to bad interaction with X. Credit to miaubiz.
[73526] High CVE-2011-1437: Integer overflows in float rendering. Credit to miaubiz.
[74653] High CVE-2011-1438: Same origin policy violation with blobs. Credit to kuzzcc.
[Linux only] [74763] High CVE-2011-1439: Prevent interference between renderer processes. Credit to Julien Tinnes of the Google Security Team.
[75186] High CVE-2011-1440: Use-after-free with <ruby> tag and CSS. Credit to Jose A. Vazquez.
[75347] High CVE-2011-1441: Bad cast with floating select lists. Credit to Michael Griffiths.
[75801] High CVE-2011-1442: Corrupt node trees with mutation events. Credit to Sergey Glazunov and wushi of team 509.
[76001] High CVE-2011-1443: Stale pointers in layering code. Credit to Martin Barbella.
[Linux only] [76542] High CVE-2011-1444: Race condition in sandbox launcher. Credit to Dan Rosenberg.
Medium CVE-2011-1445: Out-of-bounds read in SVG. Credit to wushi of team509.
[76666] [77507] [78031] High CVE-2011-1446: Possible URL bar spoofs with navigation errors and interrupted loads. Credit to kuzzcc.
[76966] High CVE-2011-1447: Stale pointer in drop-down list handling. Credit to miaubiz.
[77130] High CVE-2011-1448: Stale pointer in height calculations. Credit to wushi of team509.
[77346] High CVE-2011-1449: Use-after-free in WebSockets. Credit to Marek Majkowski.
Low CVE-2011-1450: Dangling pointers in file dialogs. Credit to kuzzcc.
[77463] High CVE-2011-1451: Dangling pointers in DOM id map. Credit to Sergey Glazunov.
[77786] Medium CVE-2011-1452: URL bar spoof with redirect and manual reload. Credit to Jordi Chancel.
[79199] High CVE-2011-1454: Use-after-free in DOM id handling. Credit to Sergey Glazunov.
[79361] Medium CVE-2011-1455: Out-of-bounds read with multipart-encoded PDF. Credit to Eric Roman of the Chromium development community.
[79364] High CVE-2011-1456: Stale pointers with PDF forms. Credit to Eric Roman of the Chromium development community.Fixed in 10.0.648.205:
[75629] Critical CVE-2011-1301: Use-after-free in the GPU process. Credit to Google Chrome Security Team (Inferno).
[78524] Critical CVE-2011-1302: Heap overflow in the GPU process. Credit to Christoph Diehl.Fixed in 10.0.648.204:
[72517] High CVE-2011-1291: Buffer error in base string handling. Credit to Alex Turpin.
[73216] High CVE-2011-1292: Use-after-free in the frame loader. Credit to Slawomir Blazek.
[73595] High CVE-2011-1293: Use-after-free in HTMLCollection. Credit to Sergey Glazunov.
[74562] High CVE-2011-1294: Stale pointer in CSS handling. Credit to Sergey Glazunov.
[74991] High CVE-2011-1295: DOM tree corruption with broken node parentage. Credit to Sergey Glazunov.
[75170] High CVE-2011-1296: Stale pointer in SVG text handling. Credit to Sergey Glazunov.Fixed in 10.0.648.133:
[75712] High Memory corruption in style handling. Credit to Vincenzo Iozzo, Ralf Philipp Weinmann and Willem Pinckaers reported through ZDI.Fixed in 10.0.648.127:
[42765] Low Possible to navigate or close the top location in a sandboxed frame. Credit to sirdarckcat of the Google Security Team.
[Linux only] [49747] Low Work around an X server bug and crash with long messages. Credit to Louis Lang.
[Linux only] [66962] Low Possible browser crash with parallel print()s. Credit to Aki Helin of OUSPG.
[69187] Medium Cross-origin error message leak. Credit to Daniel Divricean.
[69628] High Memory corruption with counter nodes. Credit to Martin Barbella.
[70027] High Stale node in box layout. Credit to Martin Barbella.
[70336] Medium Cross-origin error message leak with workers. Credit to Daniel Divricean.
[70442] High Use after free with DOM URL handling. Credit to Sergey Glazunov.
[Linux only] [70779] Medium Out of bounds read handling unicode ranges. Credit to miaubiz.
[70877] High Same origin policy bypass in v8. Credit to Daniel Divricean.
[70885] [71167] Low Pop-up blocker bypasses. Credit to Chamal de Silva.
[71763] High Use-after-free in document script lifetime handling. Credit to miaubiz.
[71788] High Out-of-bounds write in the OGG container. Credit to Google Chrome Security Team (SkyLined); plus subsequent independent discovery by David Weston of Microsoft and MSVR.
[72028] High Stale pointer in table painting. Credit to Martin Barbella.
[73026] High Use of corrupt out-of-bounds structure in video code. Credit to Tavis Ormandy of the Google Security Team.
[73066] High Crash with the DataView object. Credit to Sergey Glazunov.
[73134] High Bad cast in text rendering. Credit to miaubiz.
[73196] High Stale pointer in WebKit context code. Credit to Sergey Glazunov.
[73716] Low Leak of heap address in XSLT. Credit to Google Chrome Security Team (Chris Evans).
[73746] High Stale pointer with SVG cursors. Credit to Sergey Glazunov.
[74030] High DOM tree corruption with attribute handling. Credit to Sergey Glazunov.
[74662] High Corruption via re-entrancy of RegExp code. Credit to Christian Holler.
[74675] High Invalid memory access in v8. Credit to Christian Holler.Fixed in 9.0.597.107:
[54262] High URL bar spoof. Credit to Jordi Chancel.
[63732] High Crash with javascript dialogs. Credit to Sergey Radchenko.
[68263] High Stylesheet node stale pointer. Credit to Sergey Glazunov.
[68741] High Stale pointer with key frame rule. Credit to Sergey Glazunov.
[70078] High Crash with forms controls. Credit to Stefan van Zanden.
[70244] High Crash in SVG rendering. Credit to Slawomir Blazek.
[64-bit Linux only] [70376] Medium Out-of-bounds read in pickle deserialization. Credit to Evgeniy Stepanov of the Chromium development community.
[71114] High Stale node in table handling. Credit to Martin Barbella.
[71115] High Stale pointer in table rendering. Credit to Martin Barbella.
[71296] High Stale pointer in SVG animations. Credit to miaubiz.
[71386] High Stale nodes in XHTML. Credit to wushi of team509.
[71388] High Crash in textarea handling. Credit to wushi of team509.
[71595] High Stale pointer in device orientation. Credit to Sergey Glazunov.
[71717] Medium Out-of-bounds read in WebGL. Credit to miaubiz.
[71855] High Integer overflow in textarea handling. Credit to miaubiz.
[71960] Medium Out-of-bounds read in WebGL. Credit to Google Chrome Security Team (Inferno).
[72214] High Accidental exposure of internal extension functions. Credit to Tavis Ormandy of the Google Security Team.
[72437] High Use-after-free with blocked plug-ins. Credit to Chamal de Silva.
[73235] High Stale pointer in layout. Credit to Martin Barbella.Fixed in 9.0.597.94:
[67234] High Stale pointer in animation event handling. Credit to Rik Cabanier.
[68120] High Use-after-free in SVG font faces. Credit to miaubiz.
[69556] High Stale pointer with anonymous block handling. Credit to Martin Barbella.
[69970] Medium Out-of-bounds read in plug-in handling. Credit to Bill Budge of Google.
[70456] Medium Possible failure to terminate process on out-of-memory condition. Credit to David Warren of CERT/CC.Fixed in 9.0.597.84:
[Mac only] [42989] Low Minor sandbox leak via stat(). Credit to Daniel Cheng of the Chromium development community.
[55831] High Use-after-free in image loading. Credit to Aki Helin of OUSPG.
[59081] Low Apply some restrictions to cross-origin drag + drop. Credit to Google Chrome Security Team (SkyLined) and the Google Security Team (Michal Zalewski, David Bloom).
[62791] Low Browser crash with extension with missing key. Credit to Brian Kirchoff.
[64051] High Crashing when printing in PDF event handler. Credit to Aki Helin of OUSPG.
[65669] Low Handle merging of autofill profiles more gracefully. Credit to Google Chrome Security Team (Inferno).
[Mac only] [66931] Low Work around a crash in the Mac OS 10.5 SSL libraries. Credit to Dan Morrison.
[68244] Low Browser crash with bad volume setting. Credit to Matthew Heidermann.
[69195] Critical Race condition in audio handling. Credit to the gamers of Reddit!Fixed in 8.0.552.237:
[58053] Medium Browser crash in extensions notification handling. Credit to Eric Roman of the Chromium development community.
[65764] High Bad pointer handling in node iteration. Credit to Sergey Glazunov.
[66334] High Crashes when printing multi-page PDFs. Credit to Google Chrome Security Team (Chris Evans).
[66560] High Stale pointer with CSS + canvas. Credit to Sergey Glazunov.
[66748] High Stale pointer with CSS + cursors. Credit to Jan Tosovsk.
[67100] High Use after free in PDF page handling. Credit to Google Chrome Security Team (Chris Evans).
[67208] High Stack corruption after PDF out-of-memory condition. Credit to Jared Allar of CERT.
[67303] High Bad memory access with mismatched video frame sizes. Credit to Aki Helin of OUSPG; plus independent discovery by Google Chrome Security Team (SkyLined) and David Warren of CERT.
[67363] High Stale pointer with SVG use element. Credited anonymously; plus indepdent discovery by miaubiz.
[67393] Medium Uninitialized pointer in the browser triggered by rogue extension. Credit to kuzzcc.
[68115] High Vorbis decoder buffer overflows. Credit to David Warren of CERT.
[68170] High Buffer overflow in PDF shading. Credit to Aki Helin of OUSPG.
[68178] High Bad cast in anchor handling. Credit to Sergey Glazunov.
[68181] High Bad cast in video handling. Credit to Sergey Glazunov.
[68439] High Stale rendering node after DOM node removal. Credit to Martin Barbella; plus independent discovery by Google Chrome Security Team (SkyLined).
[68666] Critical Stale pointer in speech handling. Credit to Sergey Glazunov.Fixed in 8.0.552.224:
[64-bit Linux only] [56449] High Bad validation for message deserialization on 64-bit builds. Credit to Lei Zhang of the Chromium development community.
[60761] Medium Bad extension can cause browser crash in tab handling. Credit to kuzzcc.
[63529] Low Browser crash with NULL pointer in web worker handling. Credit to Nathan Weizenbaum of Google.
[63866] Medium Out-of-bounds read in CSS parsing. Credit to Chris Rohlf.
[64959] High Stale pointers in cursor handling. Credit to Slawomir Blazek and Sergey Glazunov.Fixed in 8.0.552.215:
[17655] Low Possible pop-up blocker bypass. Credit to Google Chrome Security Team (SkyLined).
[55745] Medium Cross-origin video theft with canvas. Credit to Nirankush Panchbhai and Microsoft Vulnerability Research (MSVR).
[56237] Low Browser crash with HTML5 databases. Credit to Google Chrome Security Team (Inferno).
[58319] Low Prevent excessive file dialogs, possibly leading to browser crash. Credit to Cezary Tomczak (gosu.pl).
[59554] High Use after free in history handling. Credit to Stefan Troger.
[Linux / Mac] [59817] Medium Make sure the "dangerous file types" list is uptodate with the Windows platforms. Credit to Billy Rios of the Google Security Team.
[61701] Low Browser crash with HTTP proxy authentication. Credit to Mohammed Bouhlel.
[61653] Medium Out-of-bounds read regression in WebM video support. Credit to Google Chrome Security Team (Chris Evans), based on earlier testcases from Mozilla and Microsoft (MSVR).
[62127] High Crash due to bad indexing with malformed video. Credit to miaubiz.
[62168] Medium Possible browser memory corruption via malicious privileged extension. Credit to kuzzcc.
[62401] High Use after free with SVG animations. Credit to Slawomir Blazek.
[63051] Medium Use after free in mouse dragging event handling. Credit to kuzzcc.
[63444] High Double free in XPath handling. Credit to Yang Dingning from NCNIPC, Graduate University of Chinese Academy of Sciences.Fixed in 7.0.517.44:
[51602] High Use-after-free in text editing. Credit to David Bloom of the Google Security Team, Google Chrome Security Team (Inferno) and Google Chrome Security Team (Cris Neckar).
[55257] High Memory corruption with enormous text area. Credit to wushi of team509.
[58657] High Bad cast with the SVG use element. Credit to the kuzzcc.
[58731] High Invalid memory read in XPath handling. Credit to Bui Quang Minh from Bkis (www.bkis.com).
[58741] High Use-after-free in text control selections. Credit to "vkouchna".
[Linux only] [59320] High Integer overflows in font handling. Credit to Aki Helin of OUSPG.
[60055] High Memory corruption in libvpx. Credit to Christoph Diehl.
[60238] High Bad use of destroyed frame object. Credit to various developers, including "gundlach".
[60327] [60769] [61255] High Type confusions with event objects. Credit to "fam.lam" and Google Chrome Security Team (Inferno).
[60688] High Out-of-bounds array access in SVG handling. Credit to wushi of team509.Fixed in 7.0.517.43:
[48225] [51727] Medium Possible autofill / autocomplete profile spamming. Credit to Google Chrome Security Team (Inferno).
[48857] High Crash with forms. Credit to the Chromium development community.
[50428] Critical Browser crash with form autofill. Credit to the Chromium development community.
[51680] High Possible URL spoofing on page unload. Credit to kuzzcc; plus independent discovery by Jordi Chancel.
[53002] Low Pop-up block bypass. Credit to kuzzcc.
[53985] Medium Crash on shutdown with Web Sockets. Credit to the Chromium development community.
[Linux only] [54132] Low Bad construction of PATH variable. Credit to Dan Rosenberg, Virtual Security Research.
[54500] High Possible memory corruption with animated GIF. Credit to Simon Schaak.
[Linux only] [54794] High Failure to sandbox worker processes on Linux. Credit to Google Chrome Security Team (Chris Evans).
[56451] High Stale elements in an element map. Credit to Michal Zalewski of the Google Security Team.
The ProFTPD Project team reports:
The security issue is caused due to the distribution of compromised ProFTPD 1.3.3c source code packages via the project's main FTP server and all of the mirror servers, which contain a backdoor allowing remote root access.
phpMyAdmin team reports:
It was possible to conduct a XSS attack using spoofed request on the db search script.
ISC reports:
If the server receives a DHCPv6 packet containing one or more Relay-Forward messages, and none of them supply an address in the Relay-Forward link-address field, then the server will crash. This can be used as a single packet crash attack vector.
The OpenTTD Team reports:
When a client disconnects, without sending the "quit" or "client error" message, the server has a chance of reading and writing a just freed piece of memory. The writing can only happen while the server is sending the map. Depending on what happens directly after freeing the memory there is a chance of segmentation fault, and thus a denial of service.
The Horde team reports:
The major changes compared to Horde version 3.3.10 are:
* Fixed XSS vulnerability when viewing details of a vCard.
Tippingpoint reports:
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ProFTPD. Authentication is not required to exploit this vulnerability.
The flaw exists within the proftpd server component which listens by default on TCP port 21. When reading user input if a TELNET_IAC escape sequence is encountered the process miscalculates a buffer length counter value allowing a user controlled copy of data to a stack buffer. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the proftpd process.
OpenSSL Team reports:
Rob Hulswit has found a flaw in the OpenSSL TLS server extension code parsing which on affected servers can be exploited in a buffer overrun attack.
Any OpenSSL based TLS server is vulnerable if it is multi-threaded and uses OpenSSL's internal caching mechanism. Servers that are multi-process and/or disable internal session caching are NOT affected.
In particular the Apache HTTP server (which never uses OpenSSL internal caching) and Stunnel (which includes its own workaround) are NOT affected.
Adobe Product Security Incident Response Team reports:
Critical vulnerabilities have been identified in Adobe Flash Player 10.1.85.3 and earlier versions for Windows, Macintosh, Linux, and Solaris, and Adobe Flash Player 10.1.95.1 for Android. These vulnerabilities, including CVE-2010-3654 referenced in Security Advisory APSA10-05, could cause the application to crash and could potentially allow an attacker to take control of the affected system.
Secunia reports:
A vulnerability has been discovered in Wireshark, which can be exploited by malicious people to cause a DoS (Denial of Service).
The vulnerability is caused due to an infinite recursion error in the "dissect_unknown_ber()" function in epan/dissectors/packet-ber.c and can be exploited to cause a stack overflow e.g. via a specially crafted SNMP packet.
The vulnerability is confirmed in version 1.4.0 and reported in version 1.2.11 and prior and version 1.4.0 and prior.
Secunia reports:
Two vulnerabilities have been reported in Mailman, which can be exploited by malicious users to conduct script insertion attacks.
Certain input passed via the list descriptions is not properly sanitised before being displayed to the user. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed.
Successful exploitation requires "list owner" permissions.
OTRS Security Advisory reports:
- Multiple Cross Site Scripting issues: Missing HTML quoting allows authenticated agents or customers to inject HTML tags. This vulnerability allows an attacker to inject script code into the OTRS web-interface which will be loaded and executed in the browsers of system users.
- Possible Denial of Service Attack: Perl's regular expressions consume 100% CPU time on the server if an agent or customer views an affected article. To exploit this vulnerability the malicious user needs to send extremely large HTML emails to your system address.
AgentTicketZoom is vulnerable to XSS attacks from HTML e-mails:
Whenever a customer sends an HTML e-mail and RichText is enabled in OTRS, javascript contained in the email can do everything in the OTRS agent interface that the agent himself could do.
Most relevant is that this type of exploit can be used in such a way that the agent won't even detect he is being exploited.
The Mozilla Project reports:
MFSA 2010-73 Heap buffer overflow mixing document.write and DOM insertion
The Opera Desktop Team reports:
- Fixed an issue that allowed cross-domain checks to be bypassed, allowing limited data theft using CSS, as reported by Isaac Dawson.
- Fixed an issue where manipulating the window could be used to spoof the page address.
- Fixed an issue with reloads and redirects that could allow spoofing and cross-site scripting.
- Fixed an issue that allowed private video streams to be intercepted, as reported by Nirankush Panchbhai of Microsoft Vulnerability Research.
- Fixed an issue that caused JavaScript to run in the wrong security context after manual interaction.
Secunia reports:
A vulnerability has been reported in bzip2, which can be exploited by malicious people to cause a DoS (Denial of Service) or potentially compromise a vulnerable system.
The vulnerability is caused due to an integer overflow in the "BZ2_decompress()" function in decompress.c and can be exploited to cause a crash or potentially execute arbitrary code.
When decompressing data, the run-length encoded values are not adequately sanity-checked, allowing for an integer overflow.
The read-only flag is not correctly copied when a mbuf buffer reference is duplicated. When the sendfile(2) system call is used to transmit data over the loopback interface, this can result in the backing pages for the transmitted file being modified, causing data corruption.
The NFS client subsystem fails to correctly validate the length of a parameter provided by the user when a filesystem is mounted.
A programming error in the OPIE library could allow an off-by-one buffer overflow to write a single zero byte beyond the end of an on-stack buffer.
The jail(8) utility does not change the current working directory while imprisoning. The current working directory can be accessed by its descendants.
When replaying setattr transaction, the replay code would set the attributes with certain insecure defaults, when the logged transaction did not touch these attributes.
If ntpd receives a mode 7 (MODE_PRIVATE) request or error response from a source address not listed in either a 'restrict ... noquery' or a 'restrict ... ignore' section it will log the even and send a mode 7 error response.
If a client requests DNSSEC records with the Checking Disabled (CD) flag set, BIND may cache the unvalidated responses. These responses may later be returned to another client that has not set the CD flag.
When downloading updates to FreeBSD via 'freebsd-update fetch' or 'freebsd-update upgrade', the freebsd-update(8) utility copies currently installed files into its working directory (/var/db/freebsd-update by default) both for the purpose of merging changes to configuration files and in order to be able to roll back installed updates.
The default working directory used by freebsd-update(8) is normally created during the installation of FreeBSD with permissions which allow all local users to see its contents, and freebsd-update(8) does not take any steps to restrict access to files stored in said directory.
When running setuid programs rtld will normally remove potentially dangerous environment variables. Due to recent changes in FreeBSD environment variable handling code, a corrupt environment may result in attempts to unset environment variables failing.
The SSL version 3 and TLS protocols support session renegotiation without cryptographically tying the new session parameters to the old parameters.
The monotone developers report:
Running "mtn ''" or "mtn ls ''" doesn't cause an internal error anymore. In monotone 0.48 and earlier this behavior could be used to crash a server remotely (but only if it was configured to allow execution of remote commands).
The Mozilla Project reports:
MFSA 2010-64 Miscellaneous memory safety hazards (rv:1.9.2.11/ 1.9.1.14)
MFSA 2010-65 Buffer overflow and memory corruption using document.write
MFSA 2010-66 Use-after-free error in nsBarProp
MFSA 2010-67 Dangling pointer vulnerability in LookupGetterOrSetter
MFSA 2010-68 XSS in gopher parser when parsing hrefs
MFSA 2010-69 Cross-site information disclosure via modal calls
MFSA 2010-70 SSL wildcard certificate matching IP addresses
MFSA 2010-71 Unsafe library loading vulnerabilities
MFSA 2010-72 Insecure Diffie-Hellman key exchange
Gustavo Noronha Silva reports:
The patches to fix the following CVEs are included with help from Vincent Danen and other members of the Red Hat security team:
Secunia reports:
Multiple vulnerabilities have been reported in APR-util, which can be exploited by malicious people to cause a DoS (Denial of Service).
Two XML parsing vulnerabilities exist in the bundled version of expat.
An error within the "apr_brigade_split_line()" function in buckets/apr_brigade.c can be exploited to cause high memory consumption.
The phpMyFAQ project reports:
The phpMyFAQ Team has learned of a security issue that has been discovered in phpMyFAQ 2.6.x: phpMyFAQ doesn't sanitize some variables in different pages correctly. With a properly crafted URL it is e.g. possible to inject JavaScript code into the output of a page, which could result in the leakage of domain cookies (f.e. session identifiers)..
The Horde team reports:
The major changes compared to Gollem version H3 (1.1.1) are:
* Fixed an XSS vulnerability in the file viewer.
The Horde team reports:
Thanks to Naumann IT Security Consulting for reporting the XSS vulnerability.
The major changes compared to IMP version H3 (4.3.7) are:
* Fixed an XSS vulnerability in the Fetchmail configuration.
The Horde team reports:
Thanks to Naumann IT Security Consulting for reporting the XSS vulnerability.
Thanks to Secunia for releasing an advisory for the new CSRF protection in the preference interface
The major changes compared to Horde version 3.3.8 are:
* Fixed XSS vulnerability in util/icon_browser.php.
* Protected preference forms against CSRF attacks.
The OpenX project reported:
It has been brought to our attention that there is a vulnerability in the 2.8 downloadable version of OpenX that can result in a server running the downloaded version of OpenX being compromised.
This vulnerability exists in the file upload functionality and allows attackers to upload and execute PHP code of their choice.
Squid security advisory 2010:3 reports:
Due to an internal error in string handling Squid is vulnerable to a denial of service attack when processing specially crafted requests.
This problem allows any trusted client to perform a denial of service attack on the Squid service.
Adobe Product Security Incident Response Team reports:
A critical vulnerability exists in Adobe Flash Player 10.1.82.76 and earlier versions for Windows, Macintosh, Linux, Solaris, and Adobe Flash Player 10.1.92.10 for Android. This vulnerability also affects Adobe Reader 9.3.4 and earlier versions for Windows, Macintosh and UNIX, and Adobe Acrobat 9.3.4 and earlier versions for Windows and Macintosh. This vulnerability (CVE-2010-2884) could cause a crash and potentially allow an attacker to take control of the affected system. There are reports that this vulnerability is being actively exploited in the wild against Adobe Flash Player on Windows. Adobe is not aware of any attacks exploiting this vulnerability against Adobe Reader or Acrobat to date.
Django project reports:
The provided template tag for inserting the CSRF token into forms -- {% csrf_token %} -- explicitly trusts the cookie value, and displays it as-is. Thus, an attacker who is able to tamper with the value of the CSRF cookie can cause arbitrary content to be inserted, unescaped, into the outgoing HTML of the form, enabling cross-site scripting (XSS) attacks.
Gustavo Noronha Silva reports:
With help from Vincent Danen and other members of the Red Hat security team, the following CVE's where fixed.
Description for CVE-2008-3432 says:
Heap-based buffer overflow in the mch_expand_wildcards function in os_unix.c in Vim 6.2 and 6.3 allows user-assisted attackers to execute arbitrary code via shell metacharacters in filenames, as demonstrated by the netrw.v3 test case.
The Mozilla Project reports:
MFSA 2010-49 Miscellaneous memory safety hazards (rv:1.9.2.9/ 1.9.1.12)
MFSA 2010-50 Frameset integer overflow vulnerability
MFSA 2010-51 Dangling pointer vulnerability using DOM plugin array
MFSA 2010-52 Windows XP DLL loading vulnerability
MFSA 2010-53 Heap buffer overflow in nsTextFrameUtils::TransformText
MFSA 2010-54 Dangling pointer vulnerability in nsTreeSelection
MFSA 2010-55 XUL tree removal crash and remote code execution
MFSA 2010-56 Dangling pointer vulnerability in nsTreeContentView
MFSA 2010-57 Crash and remote code execution in normalizeDocument
MFSA 2010-58 Crash on Mac using fuzzed font in data: URL
MFSA 2010-59 SJOW creates scope chains ending in outer object
MFSA 2010-60 XSS using SJOW scripted function
MFSA 2010-61 UTF-7 XSS by overriding document charset using object type attribute
MFSA 2010-62 Copy-and-paste or drag-and-drop into designMode document allows XSS
MFSA 2010-63 Information leak via XMLHttpRequest statusText
Todd Miller reports:
Beginning with sudo version 1.7.0 it has been possible to grant permission to run a command using a specified group via sudo -g option (run as group). A flaw exists in the logic that matches Runas groups in the sudoers file when the -u option is also specified (run as user). This flaw results in a positive match for the user specified via -u so long as the group specified via -g is allowed by the sudoers file.
Exploitation of the flaw requires that Sudo be configured with sudoers entries that contain a Runas group. Entries that do not contain a Runas group, or only contain a Runas user are not affected.
The get1 command, as used by lftpget, in LFTP before 4.0.6 does not properly validate a server-provided filename before determining the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via a Content-Disposition header that suggests a crafted filename, and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory.
GNU Wget version 1.12 and earlier uses a server-provided filename instead of the original URL to determine the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via a 3xx redirect to a URL with a .wgetrc filename followed by a 3xx redirect to a URL with a crafted filename, and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory.
lwp-download in libwww-perl before 5.835 does not reject downloads to filenames that begin with a `.' (dot) character, which allows remote servers to create or overwrite files via a 3xx redirect to a URL with a crafted filename or a Content-Disposition header that suggests a crafted filename, and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory.
The Red Hat security team reported two vulnerabilities:
A stack buffer overflow flaw was found in the way Quagga's bgpd daemon processed Route-Refresh messages. A configured Border Gateway Protocol (BGP) peer could send a Route-Refresh message with specially-crafted Outbound Route Filtering (ORF) record, which would cause the master BGP daemon (bgpd) to crash or, possibly, execute arbitrary code with the privileges of the user running bgpd.
A NULL pointer dereference flaw was found in the way Quagga's bgpd daemon parsed paths of autonomous systems (AS). A configured BGP peer could send a BGP update AS path request with unknown AS type, which could lead to denial of service (bgpd daemon crash).
A Bugzilla Security Advisory reports:
- Remote Information Disclosure: An unprivileged user is normally not allowed to view other users' group membership. But boolean charts let the user use group-based pronouns, indirectly disclosing group membership. This security fix restricts the use of pronouns to groups the user belongs to.
- Notification Bypass: Normally, when a user is impersonated, he receives an email informing him that he is being impersonated, containing the identity of the impersonator. However, it was possible to impersonate a user without this notification being sent.
- Remote Information Disclosure: An error message thrown by the "Reports" and "Duplicates" page confirmed the non-existence of products, thus allowing users to guess confidential product names. (Note that the "Duplicates" page was not vulnerable in Bugzilla 3.6rc1 and above though.)
- Denial of Service: If a comment contained the phrases "bug X" or "attachment X", where X was an integer larger than the maximum 32-bit signed integer size, PostgreSQL would throw an error, and any page containing that comment would not be viewable. On most Bugzillas, any user can enter a comment on any bug, so any user could have used this to deny access to one or all bugs. Bugzillas running on databases other than PostgreSQL are not affected.
The OpenTTD Team reports:
When multiple commands are queued (at the server) for execution in the next game tick and an client joins the server can get into an infinite loop. With the default settings triggering this bug is difficult (if not impossible), however the larger value of the "frame_freq" setting is easier it is to trigger the bug.
The affected corkscrew versions use sscanf calls without proper bounds checking. In the authentication file parsing routine this can cause an exploitable buffer overflow condition. A similar but issue exists in the server response code but appears to be non-exploitable.
phpMyAdmin Team reports:
It was possible to conduct a XSS attack using crafted URLs org POST parameters on several pages.
SLiM assigns logged on users a PATH in which the current working directory ("./") is included. This PATH can allow unintentional code execution through planted binaries and has therefore been fixed SLiM version 1.3.2.
The official ruby site reports:
WEBrick have had a cross-site scripting vulnerability that allows an attacker to inject arbitrary script or HTML via a crafted URI. This does not affect user agents that strictly implement HTTP/1.1, however, some user agents do not.
Isolate currently suffers from some bad security bugs! These are local root privilege escalation bugs. Thanks to the helpful person who reported them (email Chris if you want credit!). We're working to fix them ASAP, but until then, isolate is unsafe and you should uninstall it. Sorry!
VideoLAN project reports:
VLC fails to perform sufficient input validation when trying to extract some meta-informations about input media through ID3v2 tags. In the failure case, VLC attempt dereference an invalid memory address, and a crash will ensure.
Adobe Product Security Incident Response Team reports:
Critical vulnerabilities have been identified in Adobe Flash Player version 10.1.53.64 and earlier. These vulnerabilities could cause the application to crash and could potentially allow an attacker to take control of the affected system.
The Opera Destkop Team reports:
- Fixed an issue where heap buffer overflow in HTML5 canvas could be used to execute arbitrary code, as reported by Kuzzcc.
- Fixed an issue where unexpected changes in tab focus could be used to run programs from the Internet, as reported by Jakob Balle and Sven Krewitt of Secunia.
- Fixed an issue where news feed preview could subscribe to feeds without interaction, as reported by Alexios Fakos.
The Mozilla Project reports:
MFSA 2010-48 Dangling pointer crash regression from plugin parameter array fix
Piwik versions 0.6 through 0.6.3 are vulnerable to arbitrary, remote file inclusion using a directory traversal pattern infinite a crafted request for a data renderer.
A vulnerability has been reported in Piwik, which can before exploited by malicious people to disclose potentially sensitive information. Input passed to unspecified parameters when requesting a data renderer is not properly verified before being used to include files. This can be exploited to includes arbitrary files from local resources via directory traversal attacks.
There is a denial of service vulnerability in libmspack. The libmspack code is built into cabextract, so it is also vulnerable.
Secunia reports:
The vulnerability is caused due to an error when copying data from an uncompressed block (block type 0) and can be exploited to trigger an infinite loop by tricking an application using the library into processing specially crafted MS-ZIP archives.
Apache ChangeLog reports:
mod_dav, mod_cache: Fix Handling of requests without a path segment.
Greg Brockman reports:
If an attacker were to create a crafted working copy where the user runs any git command, the attacker could force execution of arbitrary code.
Derek Jones reports:
A fix has been implemented for a security flaw in CodeIgniter 1.7.2. All applications using the File Upload class should install the patch to ensure that their application is not subject to a vulnerability.
The Mozilla Project reports:
MFSA 2010-34 Miscellaneous memory safety hazards (rv:1.9.2.7/ 1.9.1.11)
MFSA 2010-35 DOM attribute cloning remote code execution vulnerability
MFSA 2010-36 Use-after-free error in NodeIterator
MFSA 2010-37 Plugin parameter EnsureCachedAttrParamArrays remote code execution vulnerability
MFSA 2010-38 Arbitrary code execution using SJOW and fast native function
MFSA 2010-39 nsCSSValue::Array index integer overflow
MFSA 2010-40 nsTreeSelection dangling pointer remote code execution vulnerability
MFSA 2010-41 Remote code execution using malformed PNG image
MFSA 2010-42 Cross-origin data disclosure via Web Workers and importScripts
MFSA 2010-43 Same-origin bypass using canvas context
MFSA 2010-44 Characters mapped to U+FFFD in 8 bit encodings cause subsequent character to vanish
MFSA 2010-45 Multiple location bar spoofing vulnerabilities
MFSA 2010-46 Cross-domain data theft using CSS
MFSA 2010-47 Cross-origin data leakage from script filename in error messages
Kees Cook reports:
Janne Snabb discovered that applications using VTE, such as gnome-terminal, did not correctly filter window and icon title request escape codes. If a user were tricked into viewing specially crafted output in their terminal, a remote attacker could execute arbitrary commands with user privileges.
Gustavo Noronha reports:
Debian's Michael Gilbert has done a great job going through all CVEs released about WebKit, and including patches in the Debian package. 1.2.3 includes all of the commits from trunk to fix those, too.
Eric Davis reports:
This security release addresses some security vulnerabilities found in the advanced subversion integration module (Redmine.pm perl script).
Julius Plenz reports:
I found a bug in the base64_decode function which may cause memory corruption when the function is executed on a malformed base64 encoded string.
If a string starting with an equal-sign is passed to the base64_decode function it triggers a memory corruption that in some cases makes bogofilter crash.
A Bugzilla Security Advisory reports:
- Normally, information about time-tracking (estimated hours, actual hours, hours worked, and deadlines) is restricted to users in the "time-tracking group". However, any user was able, by crafting their own search URL, to search for bugs based using those fields as criteria, thus possibly exposing sensitive time-tracking information by a user seeing that a bug matched their search.
- If $use_suexec was set to "1" in the localconfig file, then the localconfig file's permissions were set as world-readable by checksetup.pl. This allowed any user with local shell access to see the contents of the file, including the database password and the site_wide_secret variable used for CSRF protection.
Two security vulnerabilities have been discovered:
Multiple format string vulnerabilities in the DCC functionality in KVIrc 3.4 and 4.0 have unspecified impact and remote attack vectors.
Directory traversal vulnerability in the DCC functionality in KVIrc 3.4 and 4.0 allows remote attackers to overwrite arbitrary files via unknown vectors.
The PNG project describes the problem in an advisory:
Several versions of libpng through 1.4.2 (and through 1.2.43 in the older series) contain a bug whereby progressive applications such as web browsers (or the rpng2 demo app included in libpng) could receive an extra row of image data beyond the height reported in the header, potentially leading to an out-of-bounds write to memory (depending on how the application is written) and the possibility of execution of an attacker's code with the privileges of the libpng user (including remote compromise in the case of a libpng-based browser visiting a hostile web site).
The Moodle release notes report multiple vulnerabilities which could allow cross site scripting, XSS attacks, unauthorised deletion of attempts in some instances.
Juli Mallett reports:
mdnsd will crash on some systems with a corrupt stack and once that's fixed it will still leak a file descriptor when parsing resolv.conf. The crash is because scanf is used with %10s for a buffer that is only 10 chars long. The buffer size needs increased to 11 chars to hold the trailing NUL. To fix the leak, an fclose needs added.
The Opera Desktop Team reports:
Data URIs are allowed to run scripts that manipulate pages from the site that directly opened them. In some cases, the opening site is not correctly detected. In these cases, Data URIs may erroneously be able to run scripts so that they interact with sites that did not directly cause them to be opened.
Multiple vulnerabilities have been reported to exist in older version of Cacti. The release notes of Cacti 0.8.7f summarizes the problems as follows:
- SQL injection and shell escaping issues
- Cross-site scripting issues
- Cacti Graph Viewer SQL injection vulnerability
Mozilla Project reports:
MFSA 2010-33 User tracking across sites using Math.random()
MFSA 2010-32 Content-Disposition: attachment ignored if Content-Type: multipart also present
MFSA 2010-31 focus() behavior can be used to inject or steal keystrokes
MFSA 2010-30 Integer Overflow in XSLT Node Sorting
MFSA 2010-29 Heap buffer overflow in nsGenericDOMDataNode::SetTextInternal
MFSA 2010-28 Freed object reuse across plugin instances
MFSA 2010-27 Use-after-free error in nsCycleCollector::MarkRoots()
MFSA 2010-26 Crashes with evidence of memory corruption (rv:1.9.2.4/ 1.9.1.10)
MFSA 2010-25 Re-use of freed object due to scope confusion
Daniel Mealha Cabrita reports:
Fixed security vulnerability (heap-related) in PNG decoder. (new bug from 3.1.0)
Tielei Wang:
Multiple integer overflows in inter-color spaces conversion tools in libtiff 3.8 through 3.8.2, 3.9, and 4.0 allow context-dependent attackers to execute arbitrary code via a TIFF image with large (1) width and (2) height values, which triggers a heap-based buffer overflow in the (a) cvt_whole_image function in tiff2rgba and (b) tiffcvt function in rgb2ycbcr.
Adobe Product Security Incident Response Team reports:
Critical vulnerabilities have been identified in Adobe Flash Player version 10.0.45.2 and earlier. These vulnerabilities could cause the application to crash and could potentially allow an attacker to take control of the affected system.
Kevin Finisterre reports:
Multiple integer overflows in the handling of TIFF files may result in a heap buffer overflow. Opening a maliciously crafted TIFF file may lead to an unexpected application termination or arbitrary code execution. The issues are addressed through improved bounds checking. Credit to Kevin Finisterre of digitalmunition.com for reporting these issues.
Todd Miller reports:
Most versions of the C library function getenv() return the first instance of an environment variable to the caller. However, some programs, notably the GNU Bourne Again SHell (bash), do their own environment parsing and may choose the last instance of a variable rather than the first one.
An attacker may manipulate the environment of the process that executes Sudo such that a second PATH variable is present. When Sudo runs a bash script, it is this second PATH variable that is used by bash, regardless of whether or not Sudo has overwritten the first instance of PATH. This may allow an attacker to subvert the program being run under Sudo and execute commands he/she would not otherwise be allowed to run.
Ziproxy 3.0.1 release fixes a security vulnerability related to atypical huge picture files (>4GB of size once expanded).
Two security vulnerabilities were discovered:
Noncompliant CSS parsing behaviour in Internet Explorer allows attackers to construct CSS strings which are treated as safe by previous versions of MediaWiki, but are decoded to unsafe strings by Internet Explorer.
A CSRF vulnerability was discovered in our login interface. Although regular logins are protected as of 1.15.3, it was discovered that the account creation and password reset reset features were not protected from CSRF. This could lead to unauthorised access to private wikis.
The Redmine release announcement reports that several cross side scripting vulnerabilities and a potential data disclosure vulnerability have been fixed in the latest release.
A vulnerability found in the DOCSIS dissector can cause Wireshark to crash when a malformed packet trace file is opened. This means that an attacker will have to trick a victim into opening such a trace file before being able to crash the application
The Piwik security advisory reports:
A non-persistent, cross-site scripting vulnerability (XSS) was found in Piwik's Login form that reflected the form_url parameter without being properly escaped or filtered.
The spamassassin milter plugin contains a vulnerability that can allow remote attackers to execute commands on affected systems.
The vulnerability can be exploited trough a special-crafted email header when the plugin was started with the '-x' (expand) flag.
A MediaWiki security announcement reports:
MediaWiki was found to be vulnerable to login CSRF. An attacker who controls a user account on the target wiki can force the victim to log in as the attacker, via a script on an external website.
If the wiki is configured to allow user scripts, say with "$wgAllowUserJs = true" in LocalSettings.php, then the attacker can proceed to mount a phishing-style attack against the victim to obtain their password.
Dan Rosenberg reports:
There are several cross-site scripting vulnerabilities in LXR. These vulnerabilities could allow an attacker to execute scripts in a user's browser, steal cookies associated with vulnerable domains, redirect the user to malicious websites, etc.
VideoLAN project reports:
VLC media player suffers from various vulnerabilities when attempting to parse malformatted or overly long byte streams.
Joomla! reported the following vulnerabilities:
If a user entered a URL with a negative query limit or offset, a PHP notice would display revealing information about the system..
The migration script in the Joomla! installer does not check the file type being uploaded. If the installation application is present, an attacker could use it to upload malicious files to a server.
Session id doesn't get modified when user logs in. A remote site may be able to forward a visitor to the Joomla! site and set a specific cookie. If the user then logs in, the remote site can use that cookie to authenticate as that user.
When a user requests a password reset, the reset tokens were stored in plain text in the database. While this is not a vulnerability in itself, it allows user accounts to be compromised if there is an extension on the site with an SQL injection vulnerability.
Bonsai information security reports:
A Vulnerability has been discovered in Cacti, which can be exploited by any user to conduct SQL Injection attacks. Input passed via the "export_item_id" parameter to "templates_export.php" script is not properly sanitized before being used in a SQL query.
The same source also reported a command execution vulnerability. This second issue can be exploited by Cacti users who have the rights to modify device or graph configurations.
The Moodle release notes report multiple vulnerabilities which could allow remote attackers to perform, amongst others, cross site scripting, user enumeration and SQL injection attacks.
The Apache software foundation reports:
The "WWW-Authenticate" header for BASIC and DIGEST authentication includes a realm name. If a <realm-name> element is specified for the application in web.xml it will be used. However, a <realm-name> is not specified then Tomcat will generate one.
In some circumstances this can expose the local hostname or IP address of the machine running Tomcat.
The MIT Kerberos team reports:
An authenticated remote attacker can crash the KDC by inducing the KDC to perform a double free. Under some circumstances on some platforms, this could also allow malicious code execution.
Secunia Research reported two vulnerabilities in e107:
The first problem affects installations that have the Content Manager plugin enabled. This plugin does not sanitize the "content_heading" parameter correctly and is therefore vulnerable to a cross site scripting attack.
The second vulnerability is related to the avatar upload functionality. Images containing PHP code can be uploaded and executed.
Fetchmail developer Matthias Andree reported a vulnerability that allows remote attackers to crash the application when it is runs in verbose mode.
Fetchmail before release 6.3.17 did not properly sanitize external input (mail headers and UID). When a multi-character locale (such as UTF-8) was in use, this could cause memory exhaustion and thus a denial of service.
Three denial of service vulnerabilities where found in pidgin and allow remote attackers to crash the application. The developers summarized these problems as follows:
Pidgin can become unresponsive when displaying large numbers of smileys
Certain nicknames in group chat rooms can trigger a crash in Finch
Failure to validate all fields of an incoming message can trigger a crash
A vulnerability in libpng can result in denial of service conditions when a remote attacker tricks a victim to open a specially-crafted PNG file.
The PNG project describes the problem in an advisory:
Because of the efficient compression method used in Portable Network Graphics (PNG) files, a small PNG file can expand tremendously, acting as a "decompression bomb".
Malformed PNG chunks can consume a large amount of CPU and wall-clock time and large amounts of memory, up to all memory available on a system
The cURL project reports in a security advisory:
Using the affected libcurl version to download compressed content over HTTP, an application can ask libcurl to automatically uncompress data. When doing so, libcurl can wrongly send data up to 64K in size to the callback which thus is much larger than the documented maximum size.
An application that blindly trusts libcurl's max limit for a fixed buffer size or similar is then a possible target for a buffer overflow vulnerability.
The Red Hat security response team reports:
A remotely exploitable DoS from XMPP client to ejabberd server via too many "client2server" messages (causing the message queue on the server to get overloaded, leading to server crash) has been found.
Two vulnerabilities have found in irssi. The first issue could allow man-in-the-middle attacks due to a missing comparison of SSL server hostnames and the certificate domain names (e.g. CN).
A second vulnerability, related to the nick matching code, could be triggered by remote attackers in order to crash an irssi client when leaving a channel.
An authenticated remote attacker can causing a denial of service by using a newer version of the kadmin protocol than the server supports.
The MIT Kerberos team also reports the cause:
The Kerberos administration daemon (kadmind) can crash due to referencing freed memory.
Two vulnerabilities in krb5 can be used by remote attackers in denial of service attacks. The MIT security advisories report this as follows:
An unauthenticated remote attacker can send an invalid request to a KDC process that will cause it to crash due to an assertion failure, creating a denial of service.
An unauthenticated remote attacker could cause a GSS-API application, including the Kerberos administration daemon (kadmind) to crash.
The Debian security team reports:
It was discovered that mahara, an electronic portfolio, weblog, and resume builder is not properly escaping input when generating a unique username based on a remote user name from a single sign-on application. An attacker can use this to compromise the mahara database via crafted user names.
Todd Miller reports:
Sudo's command matching routine expects actual commands to include one or more slash ('/') characters. The flaw is that sudo's path resolution code did not add a "./" prefix to commands found in the current working directory. This creates an ambiguity between a "sudoedit" command found in the cwd and the "sudoedit" pseudo-command in the sudoers file. As a result, a user may be able to run an arbitrary command named "sudoedit" in the current working directory. For the attack to be successful, the PATH environment variable must include "." and may not include any other directory that contains a "sudoedit" command.
KDE Security Advisory reports:
KDM contains a race condition that allows local attackers to make arbitrary files on the system world-writeable. This can happen while KDM tries to create its control socket during user login. A local attacker with a valid local account can under certain circumstances make use of this vulnerability to execute arbitrary code as root.
The Dojo Toolkit team reports:
Some PHP files did not properly escape input.
Some files could operate like "open redirects". A bad actor could form an URL that looks like it came from a trusted site, but the user would be redirected or load content from the bad actor's site.
A file exposed a more serious cross-site scripting vulnerability with the possibility of executing code on the domain where the file exists.
The Dojo build process defaulted to copying over tests and demos, which are normally not needed and just increased the number of files that could be targets of attacks.
The Zend Framework team reports:
Several files in the bundled Dojo library were identified as having potential exploits, and the Dojo team also advised disabling or removing any PHP scripts in the Dojo library tree when deploying to production.
Mozilla Project reports:
MFSA 2009-25 Re-use of freed object due to scope confusion
Mozilla Project reports:
MFSA 2010-24 XMLDocument::load() doesn't check nsIContentPolicy
MFSA 2010-23 Image src redirect to mailto: URL opens email editor
MFSA 2010-22 Update NSS to support TLS renegotiation indication
MFSA 2010-21 Arbitrary code execution with Firebug XMLHttpRequestSpy
MFSA 2010-20 Chrome privilege escalation via forced URL drag and drop
MFSA 2010-19 Dangling pointer vulnerability in nsPluginArray
MFSA 2010-18 Dangling pointer vulnerability in nsTreeContentView
MFSA 2010-17 Remote code execution with use-after-free in nsTreeSelection
MFSA 2010-16 Crashes with evidence of memory corruption (rv:1.9.2.2/ 1.9.1.9/ 1.9.0.19)
BugTraq reports:
PostgreSQL is prone to a buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.
Attackers can exploit this issue to execute arbitrary code with elevated privileges or crash the affected application.
Jakob Lell reports:
The rmt client implementation of GNU Tar/Cpio contains a heap-based buffer overflow which possibly allows arbitrary code execution.
The problem can be exploited when using an untrusted/compromised rmt server.
Mozilla Project reports:
MFSA 2010-08 WOFF heap corruption due to integer overflow
Mozilla Project reports:
MFSA 2010-07 Fixes for potentially exploitable crashes ported to the legacy branch
MFSA 2010-06 Scriptable plugin execution in SeaMonkey mail
MFSA 2009-68 NTLM reflection vulnerability
MFSA 2009-62 Download filename spoofing with RTL override
MFSA 2009-59 Heap buffer overflow in string to number conversion
MFSA 2009-49 TreeColumns dangling pointer vulnerability
Egroupware Team report:
Nahuel Grisolia from CYBSEC S.A. Security Systems found two security problems in EGroupware:
Serious remote command execution (allowing to run arbitrary command on the web server by simply issuing a HTTP request!).
A reflected cross-site scripting (XSS).
Both require NO valid EGroupware account and work without being logged in!
Drupal Team reports:
A user-supplied value is directly output during installation allowing a malicious user to craft a URL and perform a cross-site scripting attack. The exploit can only be conducted on sites not yet installed.
The API function drupal_goto() is susceptible to a phishing attack. An attacker could formulate a redirect in a way that gets the Drupal site to send the user to an arbitrarily provided URL. No user submitted data will be sent to that URL.
Locale module and dependent contributed modules do not sanitize the display of language codes, native and English language names properly. While these usually come from a preselected list, arbitrary administrator input is allowed. This vulnerability is mitigated by the fact that the attacker must have a role with the 'administer languages' permission.
Under certain circumstances, a user with an open session that is blocked can maintain his/her session on the Drupal site, despite being blocked.
Todd Miller reports:
When sudo performs its command matching, there is a special case for pseudo-commands in the sudoers file (currently, the only pseudo-command is sudoedit). Unlike a regular command, pseudo-commands do not begin with a slash ('/'). The flaw is that sudo's the matching code would only check against the list of pseudo-commands if the user-specified command also contained no slashes. As a result, if the user ran "sudo ./sudoedit" the normal matching code path was followed, which uses stat(2) to verify that the user-specified command matches the one in sudoers. In this case, it would compare the "./sudoedit" specified by the user with "sudoedit" from the sudoers file, resulting in a positive match.
OpenOffice.org Security Team reports:
Fixed in OpenOffice.org 3.2
CVE-2006-4339: Potential vulnerability from 3rd party libxml2 libraries
CVE-2009-0217: Potential vulnerability from 3rd party libxmlsec libraries
CVE-2009-2493: OpenOffice.org 3 for Windows bundles a vulnerable version of MSVC Runtime
CVE-2009-2949: Potential vulnerability related to XPM file processing
CVE-2009-2950: Potential vulnerability related to GIF file processing
CVE-2009-3301/2: Potential vulnerability related to MS-Word document processing
Mozilla Project reports:
MFSA 2010-05 XSS hazard using SVG document and binary Content-Type
MFSA 2010-04 XSS due to window.dialogArguments being readable cross-domain
MFSA 2010-03 Use-after-free crash in HTML parser
MFSA 2010-02 Web Worker Array Handling Heap Corruption Vulnerability
MFSA 2010-01 Crashes with evidence of memory corruption (rv:1.9.1.8/ 1.9.0.18)
Lighttpd security advisory reports:
If you send the request data very slow (e.g. sleep 0.01 after each byte), lighttpd will easily use all available memory and die (especially for parallel requests), allowing a DoS within minutes.
Squid security advisory 2010:2 reports:
Due to incorrect processing Squid is vulnerable to a denial of service attack when receiving specially crafted HTCP packets.
This problem allows any machine to perform a denial of service attack on the Squid service when its HTCP port is open.
Adobe Product Security Incident Response Team reports:
A critical vulnerability has been identified in Adobe Flash Player version 10.0.42.34 and earlier. This vulnerability (CVE-2010-0186) could subvert the domain sandbox and make unauthorized cross-domain requests. This update also resolves a potential Denial of Service issue (CVE-2010-0187).
Ray Strode reports:
Under certain circumstances it is possible to circumvent the security of screen locking functionality of gnome-screensaver by changing the systems physical monitor configuration.
gnome-screensaver can lose its keyboard grab when locked, exposing the system to intrusion by adding and removing monitors.
Matthias Andree reports:
In verbose mode, fetchmail prints X.509 certificate subject and issuer information to the user, and counts and allocates a malloc() buffer for that purpose.
If the material to be displayed contains characters with high bit set and the platform treats the "char" type as signed, this can cause a heap buffer overrun because non-printing characters are escaped as \xFF..FFnn, where nn is 80..FF in hex.
Wireshark project reports:
Babi discovered several buffer overflows in the LWRES dissector.
It may be possible to make Wireshark crash remotely or by convincing someone to read a malformed packet trace file.
OTRS Security Advisory reports:
Missing security quoting for SQL statements allows agents and customers to manipulate SQL queries. So it's possible for authenticated users to inject SQL queries via string manipulation of statements.
A malicious user may be able to manipulate SQL queries to read or modify records in the database. This way it could also be possible to get access to more permissions (e. g. administrator permissions).
To use this vulnerability the malicious user needs to have a valid Agent- or Customer-session.
Apache ChangeLog reports:
Integer overflow in the ap_proxy_send_fb function in proxy/proxy_util.c in mod_proxy in the Apache HTTP Server before 1.3.42 on 64-bit platforms allows remote origin servers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a large chunk size that triggers a heap-based buffer overflow.
Squid security advisory 2010:1 reports:
Due to incorrect data validation Squid is vulnerable to a denial of service attack when processing specially crafted DNS packets.
This problem allows any trusted client or external server who can determine the squid receiving port to perform a short-term denial of service attack on the Squid service.
A Bugzilla Security Advisory reports:
When moving a bug from one product to another, an intermediate page is displayed letting you select the groups the bug should be restricted to in the new product. However, a regression in the 3.4.x series made it ignore all groups which are not available in both products. As a workaround, you had to move the bug to the new product first and then restrict it to the desired groups, in two distinct steps, which could make the bug temporarily public.
SecurityFocus reports:
The first affects the /quote HELP module and allows a user to trigger an IRCD crash on some platforms.
The second affects the /links processing module when the flatten_links configuration option is not enabled.
Dokuwiki reports:
The plugin does no checks against cross-site request forgeries (CSRF) which can be exploited to e.g. change the access control rules by tricking a logged in administrator into visiting a malicious web site.
The bug allows listing the names of arbitrary file on the webserver - not their contents. This could leak private information about wiki pages and server structure.
The Zend Framework team reports:
Potential XSS or HTML Injection vector in Zend_Json.
Potential XSS vector in Zend_Service_ReCaptcha_MailHide.
Potential MIME-type Injection in Zend_File_Transfer Executive Summary.
Potential XSS vector in Zend_Filter_StripTags when comments allowed.
Potential XSS vector in Zend_Dojo_View_Helper_Editor.
Potential XSS vectors due to inconsistent encodings.
XSS vector in Zend_Filter_StripTags.
LFI vector in Zend_View::setScriptPath() and render().
PowerDNS Security Advisory reports:
PowerDNS Recursor up to and including 3.1.7.1 can be brought down and probably exploited.
PowerDNS Recursor up to and including 3.1.7.1 can be spoofed into accepting bogus data
PEAR Security Advisory reports:
Multiple remote arbitrary command injections have been found in the Net_Ping and Net_Traceroute.
When input from forms are used directly, the attacker could pass variables that would allow him to execute remote arbitrary command injections.
Drupal Team reports:
The Contact module does not correctly handle certain user input when displaying category information. Users privileged to create contact categories can insert arbitrary HTML and script code into the contact module administration page. Such a cross-site scripting attack may lead to the malicious user gaining administrative access.
The Menu module does not correctly handle certain user input when displaying the menu administration overview. Users privileged to create new menus can insert arbitrary HTML and script code into the menu module administration page. Such a cross-site scripting attack may lead to the malicious user gaining administrative access.
Denis Barov reports:
sysutils/fuser allows user to send any signal to any process when installed with suid bit.
Census Labs reports:
We have discovered a remotely exploitable "improper input validation" vulnerability in the Monkey web server that allows an attacker to perform denial of service attacks by repeatedly crashing worker threads that process HTTP requests.
PHP developers reports:
This release focuses on improving the stability of the PHP 5.2.x branch with over 60 bug fixes, some of which are security related. All users of PHP 5.2 are encouraged to upgrade to this release.
Security Enhancements and Fixes in PHP 5.2.12:
- Fixed a safe_mode bypass in tempnam() identified by Grzegorz Stachowiak. (CVE-2009-3557, Rasmus)
- Fixed a open_basedir bypass in posix_mkfifo() identified by Grzegorz Stachowiak. (CVE-2009-3558, Rasmus)
- Added "max_file_uploads" INI directive, which can be set to limit the number of file uploads per-request to 20 by default, to prevent possible DOS via temporary file exhaustion, identified by Bogdan Calin. (CVE-2009-4017, Ilia)
- Added protection for $_SESSION from interrupt corruption and improved "session.save_path" check, identified by Stefan Esser. (CVE-2009-4143, Stas)
- Fixed bug #49785 (insufficient input string validation of htmlspecialchars()). (CVE-2009-4142, Moriyoshi, hello at iwamot dot com)
PostgreSQL project reports:
PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before 8.4.2 does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which (1) allows man-in-the-middle attackers to spoof arbitrary SSL-based PostgreSQL servers via a crafted server certificate issued by a legitimate Certification Authority, and (2) allows remote attackers to bypass intended client-hostname restrictions via a crafted client certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before 8.4.2 does not properly manage session-local state during execution of an index function by a database superuser, which allows remote authenticated users to gain privileges via a table with crafted index functions, as demonstrated by functions that modify (1) search_path or (2) a prepared statement, a related issue to CVE-2007-6600 and CVE-2009-3230.
SecurityFocus reports:
TPTEST is prone to a remote stack-based buffer-overflow vulnerability. An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.
Mozilla Project reports:
MFSA 2009-71 GeckoActiveXObject exception messages can be used to enumerate installed COM objects
MFSA 2009-70 Privilege escalation via chrome window.opener
MFSA 2009-69 Location bar spoofing vulnerabilities
MFSA 2009-68 NTLM reflection vulnerability
MFSA 2009-67 Integer overflow, crash in libtheora video library
MFSA 2009-66 Memory safety fixes in liboggplay media library
MFSA 2009-65 Crashes with evidence of memory corruption (rv:1.9.1.6/ 1.9.0.16)
freeRADIUS Vulnerability Notifications reports:
2009.09.09 v1.1.7 - Anyone who can send packets to the server can crash it by sending a Tunnel-Password attribute in an Access-Request packet. This vulnerability is not otherwise exploitable. We have released 1.1.8 to correct this vulnerability.
This issue is similar to the previous Tunnel-Password issue noted below. The vulnerable versions are 1.1.3 through 1.1.7. Version 2.x is not affected.
secunia reports:
Russ McRee has discovered some vulnerabilities in Pligg, which can be exploited by malicious people to conduct cross-site scripting and request forgery attacks.
Input passed via the "Referer" HTTP header to various scripts (e.g. admin/admin_config.php, admin/admin_modules.php, delete.php, editlink.php, submit.php, submit_groups.php, user_add_remove_links.php, and user_settings.php) is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to e.g. create an arbitrary user with administrative privileges if a logged-in administrative user visits a malicious web site.
secunia reports:
Stefan Esser has reported a vulnerability in Piwik, which can be exploited by malicious people to compromise a vulnerable system.
The vulnerability is caused due to the core/Cookie.php script using "unserialize()" with user controlled input. This can be exploited to e.g. execute arbitrary PHP code via the "__wakeup()" or "__destruct()" methods of a serialized object passed via an HTTP cookie.
Dovecot author reports:
Dovecot v1.2.x had been creating base_dir (and its parents if necessary) with 0777 permissions. The base_dir's permissions get changed to 0755 automatically at startup, but you may need to chmod the parent directories manually.
Adobe Product Security Incident Response Team reports:
Critical vulnerabilities have been identified in Adobe Flash Player version 10.0.32.18 and earlier. These vulnerabilities could cause the application to crash and could potentially allow an attacker to take control of the affected system.
The official ruby site reports:
There is a heap overflow vulnerability in String#ljust, String#center and String#rjust. This has allowed an attacker to run arbitrary code in some rare cases.
Secunia reports:
A vulnerability has been reported in RT, which can be exploited by malicious people to conduct session fixation attacks. The vulnerability is caused due to an error in the handling of sessions and can be exploited to hijack another user's session by tricking the user into logging in after following a specially crafted link.
CVE reports:
The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other software, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with crafted UTF-8 sequences that trigger a buffer over-read.
CVE reports:
The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, as used in the XML-Twig module for Perl, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with malformed UTF-8 sequences that trigger a buffer over-read, related to the doProlog function in lib/xmlparse.c.
Opera Team reports:
- Fixed a heap buffer overflow in string to number conversion
- Fixed an issue where error messages could leak onto unrelated sites
- Fixed a moderately severe issue, as reported by Chris Evans of the Google Security Team; details will be disclosed at a later date.
Secunia.com
Do not attempt to load an unqualified module.la file from the current directory (by default) since doing so is insecure and is not compliant with the documentation.
The Ubuntu security team reports:
It was discovered that libvorbis did not correctly handle certain malformed vorbis files. If a user were tricked into opening a specially crafted vorbis file with an application that uses libvorbis, an attacker could cause a denial of service or possibly execute arbitrary code with the user's privileges.
A Bugzilla Security Advisory reports:
When a bug is in a group, none of its information (other than its status and resolution) should be visible to users outside that group. It was discovered that as of 3.3.2, Bugzilla was showing the alias of the bug (a very short string used as a shortcut for looking up the bug) to users outside of the group, if the protected bug ended up in the "Depends On" or "Blocks" list of any other bug.
The cacti development team reports:
The Cross-Site Scripting patch has been posted.
This patch addresses cross-site scripting issues reported by Moritz Naumann.
secunia reports:
The security issue is caused due to the wp_check_filetype() function in /wp-includes/functions.php improperly validating uploaded files. This can be exploited to execute arbitrary PHP code by uploading a malicious PHP script with multiple extensions.
Successful exploitation of this vulnerability requires that Apache is not configured to handle the mime-type for media files with an e.g. "gif", "jpg", "png", "tif", "wmv" extension.
Input passed via certain parameters to press-this.php is not properly sanitised before being displayed to the user. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed.
CVE reports:
The decode_entities function in util.c in HTML-Parser before 3.63 allows context-dependent attackers to cause a denial of service (infinite loop) via an incomplete SGML numeric character reference, which triggers generation of an invalid UTF-8 character.
CVE reports:
The _gdGetColors function in gd_gd.c in PHP 5.2.11 and 5.3.0, and the GD Graphics Library 2.x, does not properly verify a certain colorsTotal structure member, which might allow remote attackers to conduct buffer overflow or buffer over-read attacks via a crafted GD file, a different vulnerability than CVE-2009-3293.
TYPO3 develop team reports:
Affected versions: TYPO3 versions 4.0.13 and below, 4.1.12 and below, 4.2.9 and below, 4.3.0beta1 and below.
SQL injection, Cross-site scripting (XSS), Information disclosure, Frame hijacking, Remote shell command execution and Insecure Install Tool authentication/session handling.
VideoLAN reports:
When parsing a MP4, ASF or AVI file with an overly deep box structure, a stack overflow might occur. It would overwrite the return address and thus redirect the execution flow.
If successful, a malicious third party could trigger execution of arbitrary code within the context of the VLC media player.
oCERT reports:
Ark input sanitization errors: The KDE archiving tool, Ark, performs insufficient validation which leads to specially crafted archive files, using unknown MIME types, to be rendered using a KHTML instance, this can trigger uncontrolled XMLHTTPRequests to remote sites.
IO Slaves input sanitization errors: KDE protocol handlers perform insufficient input validation, an attacker can craft malicious URI that would trigger JavaScript execution. Additionally the 'help://' protocol handler suffer from directory traversal. It should be noted that the scope of this issue is limited as the malicious URIs cannot be embedded in Internet hosted content.
KMail input sanitization errors: The KDE mail client, KMail, performs insufficient validation which leads to specially crafted email attachments, using unknown MIME types, to be rendered using a KHTML instance, this can trigger uncontrolled XMLHTTPRequests to remote sites.
The exploitation of these vulnerabilities is unlikely according to Portcullis and KDE but the execution of active content is nonetheless unexpected and might pose a threat.
Opera Team Reports:
- Fixed an issue where certain domain names could allow execution of arbitrary code, as reported by Chris Weber of Casaba Security
- Fixed an issue where scripts can run on the feed subscription page, as reported by Inferno
Securityfocus reports:
cTorrent and dTorrent are prone to a remote buffer-overflow vulnerability because the software fails to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer.
Successful exploits allow remote attackers to execute arbitrary machine code in the context of a vulnerable application. Failed exploit attempts will likely result in denial-of-service conditions.
Mozilla Foundation reports:
MFSA 2009-64 Crashes with evidence of memory corruption (rv:1.9.1.4/ 1.9.0.15)
MFSA 2009-63 Upgrade media libraries to fix memory safety bugs
MFSA 2009-62 Download filename spoofing with RTL override
MFSA 2009-61 Cross-origin data theft through document.getSelection()
MFSA 2009-59 Heap buffer overflow in string to number conversion
MFSA 2009-57 Chrome privilege escalation in XPCVariant::VariantDataToJS()
MFSA 2009-56 Heap buffer overflow in GIF color map parser
MFSA 2009-55 Crash in proxy auto-configuration regexp parsing
MFSA 2009-54 Crash with recursive web-worker calls
MFSA 2009-53 Local downloaded file tampering
MFSA 2009-52 Form history vulnerable to stealing
SecurityFocus reports:
ELinks is prone to an off-by-one buffer-overflow vulnerability because the application fails to accurately reference the last element of a buffer.
Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.
SquidGuard website reports:
Patch 20091015 fixes one buffer overflow problem in sgLog.c when overlong URLs are requested. SquidGuard will then go into emergency mode were no blocking occurs. This is not required in this situation.
Patch 20091019 fixes two bypass problems with URLs which length is close to the limit defined by MAX_BUF (default: 4096) in squidGuard and MAX_URL (default: 4096 in squid 2.x and 8192 in squid 3.x) in squid. For this kind of URLs the proxy request exceeds MAX_BUF causing squidGuard to complain about not being able to parse the squid request. Increasing the buffer limit to be higher than the one defined in MAX_URL solves the issue.
SecurityFocus reports:
Some vulnerabilities have been reported in Xpdf, which can be exploited by malicious people to potentially compromise a user's system.
1) Multiple integer overflows in "SplashBitmap::SplashBitmap()" can be exploited to cause heap-based buffer overflows.
2) An integer overflow error in "ObjectStream::ObjectStream()" can be exploited to cause a heap-based buffer overflow.
3) Multiple integer overflows in "Splash::drawImage()" can be exploited to cause heap-based buffer overflows.
4) An integer overflow error in "PSOutputDev::doImageL1Sep()" can be exploited to cause a heap-based buffer overflow when converting a PDF document to a PS file.
Successful exploitation of the vulnerabilities may allow execution of arbitrary code by tricking a user into opening a specially crafted PDF file.
Django project reports:
Django's forms library includes field types which perform regular-expression-based validation of email addresses and URLs. Certain addresses/URLs could trigger a pathological performance case in these regular expression, resulting in the server process/thread becoming unresponsive, and consuming excessive CPU over an extended period of time. If deliberately triggered, this could result in an effectively denial-of-service attack.
phpMyAdmin Team reports:
Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via a crafted MySQL table name.
SQL injection vulnerability allows remote attackers to inject SQL via various interface parameters of the PDF schema generator feature.
Vendor reports
Security Enhancements and Fixes in PHP 5.2.11: Fixed certificate validation inside php_openssl_apply_verification_policy. Fixed sanity check for the color index in imagecolortransparent. Added missing sanity checks around exif processing. Fixed bug 44683 popen crashes when an invalid mode is passed.
Sun reports:
A security vulnerability in the VBoxNetAdpCtl configuration tool for certain Sun VirtualBox 3.0 packages may allow local unprivileged users who are authorized to run VirtualBox to execute arbitrary commands with root privileges.
Due to the interaction between devfs and VFS, a race condition exists where the kernel might dereference a NULL pointer.
Successful exploitation of the race condition can lead to local kernel privilege escalation, kernel data corruption and/or crash.
To exploit this vulnerability, an attacker must be able to run code with user privileges on the target system.
An errata note, FreeBSD-EN-09:05.null has been released simultaneously to this advisory, and contains a kernel patch implementing a workaround for a more broad class of vulnerabilities. However, prior to those changes, no workaround is available.
A race condition exists in the pipe close() code relating to kqueues, causing use-after-free for kernel memory, which may lead to an exploitable NULL pointer vulnerability in the kernel, kernel memory corruption, and other unpredictable results.
Successful exploitation of the race condition can lead to local kernel privilege escalation, kernel data corruption and/or crash.
To exploit this vulnerability, an attacker must be able to run code on the target system.
An errata notice, FreeBSD-EN-09:05.null has been released simultaneously to this advisory, and contains a kernel patch implementing a workaround for a more broad class of vulnerabilities. However, prior to those changes, no workaround is available.
mybb team reports:
Input passed via avatar extensions is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by uploading specially named avatars.
The script allows to sign up with usernames containing zero width space characters, which can be exploited to e.g. conduct spoofing attacks.
Drupal Team reports:
The core OpenID module does not correctly implement Form API for the form that allows one to link user accounts with OpenID identifiers. A malicious user is therefore able to use cross site request forgeries to add attacker controlled OpenID identities to existing accounts. These OpenID identities can then be used to gain access to the affected accounts.
The OpenID module is not a compliant implementation of the OpenID Authentication 2.0 specification. An implementation error allows a user to access the account of another user when they share the same OpenID 2.0 provider.
File uploads with certain extensions are not correctly processed by the File API. This may lead to the creation of files that are executable by Apache. The .htaccess that is saved into the files directory by Drupal should normally prevent execution. The files are only executable when the server is configured to ignore the directives in the .htaccess file.
Drupal doesn't regenerate the session ID when an anonymous user follows the one time login link used to confirm email addresses and reset forgotten passwords. This enables a malicious user to fix and reuse the session id of a victim under certain circumstances.
Firewall Builder release notes reports:
Vadim Kurland (vadim.kurland@fwbuilder.org) reports:
Fwbuilder and libfwbuilder 3.0.4 through to 3.0.6 generate iptables scripts with a security issue when also used to generate static routing configurations.
A Bugzilla Security Advisory reports:
- It is possible to inject raw SQL into the Bugzilla database via the "Bug.create" and "Bug.search" WebService functions.
- When a user would change his password, his new password would be exposed in the URL field of the browser if he logged in right after changing his password.
The Horde team reports:
An error within the form library when handling image form fields can be exploited to overwrite arbitrary local files.
An error exists within the MIME Viewer library when rendering unknown text parts. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site if malicious data is viewed.
The preferences system does not properly sanitise numeric preference types. This can be exploited to execute arbitrary HTML and script code in a user's browser session in contact of an affected site.
nginx development team reports:
A segmentation fault might occur in worker process while specially crafted request handling.
The IkiWiki development team reports:
IkiWikis teximg plugin's blacklisting of insecure TeX commands is insufficient; it can be bypassed and used to read arbitrary files.
Olly Betts reports:
There's a cross-site scripting issue in Omega - exception messages don't currently get HTML entities escaped, but can contain CGI parameter values in some cases.
Mozilla Foundation reports:
MFSA 2009-51 Chrome privilege escalation with FeedWriter
MFSA 2009-50 Location bar spoofing via tall line-height Unicode characters
MFSA 2009-49 TreeColumns dangling pointer vulnerability
MFSA 2009-48 Insufficient warning for PKCS11 module installation and removal
MFSA 2009-47 Crashes with evidence of memory corruption (rv:1.9.1.3/1.9.0.14)
The Cyrus IMAP Server ChangeLog states:
Fixed CERT VU#336053 - Potential buffer overflow in Sieve.
SILC Changlog reports:
An unspecified format string vulnerability exists in silc-toolkit.
Opera Team Reports:
- Issue where sites using revoked intermediate certificates might be shown as secure
- Issue where the collapsed address bar didn't show the current domain
- Issue where pages could trick users into uploading files
- Some IDNA characters not correctly displaying in the address bar
- Issue where Opera accepts nulls and invalid wild-cards in certificates
Simon Kelley reports:
Fix security problem which allowed any host permitted to do TFTP to possibly compromise dnsmasq by remote buffer overflow when TFTP enabled.
Fix a problem which allowed a malicious TFTP client to crash dnsmasq.
Apache ChangeLog reports:
CVE-2009-1891: Fix a potential Denial-of-Service attack against mod_deflate or other modules.
CVE-2009-1195: Prevent the "Includes" Option from being enabled in an .htaccess file if the AllowOverride restrictions do not permit it.
CVE-2009-1890: Fix a potential Denial-of-Service attack against mod_proxy in a reverse proxy configuration.
CVE-2009-1191: mod_proxy_ajp: Avoid delivering content from a previous request which failed to send a request body.
CVE-2009-0023, CVE-2009-1955, CVE-2009-1956: The bundled copy of the APR-util library has been updated, fixing three different security issues which may affect particular configurations and third-party modules (was already fixed in 2.2.11_5).
Secunia reports:
A vulnerability has been reported in Pidgin, which can be exploited by malicious people to potentially compromise a user's system.
The vulnerability is caused due to an error in the "msn_slplink_process_msg()" function when processing MSN SLP messages and can be exploited to corrupt memory.
Successful exploitation may allow execution of arbitrary code.
The vulnerability is reported in versions 2.5.8 and prior. Other versions may also be affected.
SecurityFocus reports:
GnuTLS is prone to multiple remote vulnerabilities:
- A remote code-execution vulnerability.
- A denial-of-service vulnerability.
- A signature-generation vulnerability.
- A signature-verification vulnerability.
An attacker can exploit these issues to potentially execute arbitrary code, trigger denial-of-service conditions, carry out attacks against data signed with weak signatures, and cause clients to accept expired or invalid certificates from servers.
GnuTLS reports:
By using a NUL byte in CN/SAN fields, it was possible to fool GnuTLS into 1) not printing the entire CN/SAN field value when printing a certificate and 2) cause incorrect positive matches when matching a hostname against a certificate.
Secunia reports:
A weakness has been reported in memcached, which can be exploited by malicious people to disclose system information.
The weakness is caused due to the application disclosing the content of /proc/self/maps if a stats maps command is received. This can be exploited to disclose e.g. the addresses of allocated memory regions.
WordPress reports:
A specially crafted URL could be requested that would allow an attacker to bypass a security check to verify a user requested a password reset. As a result, the first account without a key in the database (usually the admin account) would have its password reset and a new password would be emailed to the account owner.
Matthias Andree reports:
Moxie Marlinspike demonstrated in July 2009 that some CAs would sign certificates that contain embedded NUL characters in the Common Name or subjectAltName fields of ITU-T X.509 certificates.
Applications that would treat such X.509 strings as NUL-terminated C strings (rather than strings that contain an explicit length field) would only check the part up to and excluding the NUL character, so that certificate names such as www.good.example\0www.bad.example.com would be mistaken as a certificate name for www.good.example. fetchmail also had this design and implementation flaw.
Joomla! Security Center reports:
In com_mailto, it was possible to bypass timeout protection against sending automated emails.
A Subversion Security Advisory reports:
Subversion clients and servers have multiple heap overflow issues in the parsing of binary deltas. This is related to an allocation vulnerability in the APR library used by Subversion.
Clients with commit access to a vulnerable server can cause a remote heap overflow; servers can cause a heap overflow on vulnerable clients that try to do a checkout or update.
This can lead to a DoS (an exploit has been tested) and to arbitrary code execution (no exploit tested, but the possibility is clear).
A Bugzilla Security Advisory reports:
Normally, users are only supposed to see products that they can file bugs against in the "Product" drop-down on the bug-editing page. Instead, users were being shown all products, even those that they normally could not see. Any user who could edit any bug could see all product names.
Mozilla Project reports:
MFSA 2009-38: Data corruption with SOCKS5 reply containing DNS name longer than 15 characters
MFSA 2009-42: Compromise of SSL-protected communication
MFSA 2009-43: Heap overflow in certificate regexp parsing
MFSA 2009-44: Location bar and SSL indicator spoofing via window.open() on invalid URL
MFSA 2009-45: Crashes with evidence of memory corruption (rv:1.9.1.2/1.9.0.13)
MFSA 2009-46: Chrome privilege escalation due to incorrectly cached wrapper
SILC changelog reports:
An unspecified format string vulnerability exists in silc-client.
The SquirrelMail Web Server has been compromised, and three plugins are affected.
The port of squirrelmail-sasql-plugin is safe (right MD5), and change_pass is not in the FreeBSD ports tree, but multilogin has a wrong MD5.
When named(8) receives a specially crafted dynamic update message an internal assertion check is triggered which causes named(8) to exit.
To trigger the problem, the dynamic update message must contains a record of type "ANY" and at least one resource record set (RRset) for this fully qualified domain name (FQDN) must exist on the server.
An attacker which can send DNS requests to a nameserver can cause it to exit, thus creating a Denial of Service situation.
No generally applicable workaround is available, but some firewalls may be able to prevent nsupdate DNS packets from reaching the nameserver.
NOTE WELL: Merely configuring named(8) to ignore dynamic updates is NOT sufficient to protect it from this vulnerability.
Secunia reports:
A security issue has been reported in Mono, which can be exploited by malicious people to conduct spoofing attacks.
The security issue is caused due to an error when processing certain XML signatures.
Squid security advisory 2009:2 reports:
Due to incorrect buffer limits and related bound checks Squid is vulnerable to a denial of service attack when processing specially crafted requests or responses.
Due to incorrect data validation Squid is vulnerable to a denial of service attack when processing specially crafted responses.
These problems allow any trusted client or external server to perform a denial of service attack on the Squid service.
Squid-2.x releases are not affected.
Mozilla Project reports:
Firefox user zbyte reported a crash that we determined could result in an exploitable memory corruption problem. In certain cases after a return from a native function, such as escape(), the Just-in-Time (JIT) compiler could get into a corrupt state. This could be exploited by an attacker to run arbitrary code such as installing malware.
This vulnerability does not affect earlier versions of Firefox which do not support the JIT feature.
US-CERT reports:
The ISC DHCP dhclient application contains a stack buffer overflow, which may allow a remote, unauthenticated attacker to execute arbitrary code with root privileges.
The Drupal Security Team reports:
Cross-site scripting
The Forum module does not correctly handle certain arguments obtained from the URL. By enticing a suitably privileged user to visit a specially crafted URL, a malicious user is able to insert arbitrary HTML and script code into forum pages. Such a cross-site scripting attack may lead to the malicious user gaining administrative access. Wikipedia has more information about cross-site scripting (XSS).
User signatures have no separate input format, they use the format of the comment with which they are displayed. A user will no longer be able to edit a comment when an administrator changes the comment's input format to a format that is not accessible to the user. However they will still be able to modify their signature, which will then be processed by the new input format.
If the new format is very permissive, via their signature, the user may be able to insert arbitrary HTML and script code into pages or, when the PHP filter is enabled for the new format, execute PHP code. This issue affects Drupal 6.x only.
When an anonymous user fails to login due to mistyping his username or password, and the page he is on contains a sortable table, the (incorrect) username and password are included in links on the table. If the user visits these links the password may then be leaked to external sites via the HTTP referer.
In addition, if the anonymous user is enticed to visit the site via a specially crafted URL while the Drupal page cache is enabled, a malicious user might be able to retrieve the (incorrect) username and password from the page cache.
nfsen reports:
Due to double input checking, a remote command execution security bug exists in all NfSen versions 1.3 and 1.3.1. Users are requested to update to nfsen-1.3.2.
The phpMyAdmin project reports:
It was possible to conduct an XSS attack via a crafted SQL bookmark.
All 3.x releases on which the "bookmarks" feature is active are affected, previous versions are not.
Secunia reports:
A vulnerability has been reported in Nagios, which can be exploited by malicious users to potentially compromise a vulnerable system.
Input passed to the "ping" parameter in statuswml.cgi is not properly sanitised before being used to invoke the ping command. This can be exploited to inject and execute arbitrary shell commands.
Successful exploitation requires access to the ping feature of the WAP interface.
The Tor Project reports:
A malicious exit relay could convince a controller that the client's DNS question resolves to an internal IP address.
Secunia reports:
Some vulnerabilities have been reported in Cscope, which potentially can be exploited by malicious people to compromise a user's system.
The vulnerabilities are caused due to various boundary errors, which can be exploited to cause buffer overflows when parsing specially crafted files or directories.
SecurityFocus reports:
Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.
Secunia reports:
Some vulnerabilities have been reported in Joomla!, which can be exploited by malicious users to conduct script insertion attacks and by malicious people to conduct cross-site scripting attacks.
Certain unspecified input is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in the context of an affected site when the malicious data is displayed.
Certain unspecified input passed to the user view of the com_users core component is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
Input passed via certain parameters to the "JA_Purity" template is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
Secunia reports:
Some vulnerabilities and weaknesses have been reported in Pidgin, which can be exploited by malicious people to cause a DoS or to potentially compromise a user's system.
A truncation error in the processing of MSN SLP messages can be exploited to cause a buffer overflow.
A boundary error in the XMPP SOCKS5 "bytestream" server when initiating an outgoing file transfer can be exploited to cause a buffer overflow.
A boundary error exists in the implementation of the "PurpleCircBuffer" structure. This can be exploited to corrupt memory and cause a crash via specially crafted XMPP or Sametime packets.
A boundary error in the "decrypt_out()" function can be exploited to cause a stack-based buffer overflow with 8 bytes and crash the application via a specially crafted QQ packet.
SecurityFocus reports:
Git is prone to a denial-of-service vulnerability because it fails to properly handle some client requests.
Attackers can exploit this issue to cause a daemon process to enter an infinite loop. Repeated exploits may consume excessive system resources, resulting in a denial of service condition.
The official ruby site reports:
A denial of service (DoS) vulnerability was found on the BigDecimal standard library of Ruby. Conversion from BigDecimal objects into Float numbers had a problem which enables attackers to effectively cause segmentation faults.
An attacker can cause a denial of service by causing BigDecimal to parse an insanely large number, such as:
BigDecimal("9E69999999").to_s("F")
Mozilla Foundation reports:
MFSA 2009-32 JavaScript chrome privilege escalation
MFSA 2009-31 XUL scripts bypass content-policy checks
MFSA 2009-30 Incorrect principal set for file: resources loaded via location bar
MFSA 2009-29 Arbitrary code execution using event listeners attached to an element whose owner document is null
MFSA 2009-28 Race condition while accessing the private data of a NPObject JS wrapper class object
MFSA 2009-27 SSL tampering via non-200 responses to proxy CONNECT requests
MFSA 2009-26 Arbitrary domain cookie access by local file: resources
MFSA 2009-25 URL spoofing with invalid unicode characters
MFSA 2009-24 Crashes with evidence of memory corruption (rv:1.9.0.11)
Secunia reports:
Some vulnerabilities have been reported in APR-util, which can be exploited by malicious users and malicious people to cause a DoS (Denial of Service).
A vulnerability is caused due to an error in the processing of XML files and can be exploited to exhaust all available memory via a specially crafted XML file containing a predefined entity inside an entity definition.
A vulnerability is caused due to an error within the "apr_strmatch_precompile()" function in strmatch/apr_strmatch.c, which can be exploited to crash an application using the library.
RedHat reports:
A single NULL byte buffer overflow flaw was found in apr-util's apr_brigade_vprintf() function.
DokuWiki reports:
A security hole was discovered which allows an attacker to include arbitrary files located on the attacked DokuWiki installation. The included file is executed in the PHP context. This can be escalated by introducing malicious code through uploading file via the media manager or placing PHP code in editable pages.
Secunia reports:
Some vulnerabilities have been reported in OpenSSL, which can be exploited by malicious people to cause a DoS.
The library does not limit the number of buffered DTLS records with a future epoch. This can be exploited to exhaust all available memory via specially crafted DTLS packets.
An error when processing DTLS messages can be exploited to exhaust all available memory by sending a large number of out of sequence handshake messages.
Secunia reports:
The vulnerability is caused due to an error in the processing of private messages within the server module (/mod/server.mod/servrmsg.c). This can be exploited to cause a crash by sending a specially crafted message to the bot.
Secunia reports:
A vulnerability has been reported in Wireshark, which can be exploited by malicious people to cause a DoS.
The vulnerability is caused due to an error in the PCNFSD dissector and can be exploited to cause a crash via a specially crafted PCNFSD packet.
Secunia reports:
Two vulnerabilities have been reported in libsndfile, which can be exploited by malicious people to compromise an application using the library.
A boundary error exists within the "voc_read_header()" function in src/voc.c. This can be exploited to cause a heap-based buffer overflow via a specially crafted VOC file.
A boundary error exists within the "aiff_read_header()" function in src/aiff.c. This can be exploited to cause a heap-based buffer overflow via a specially crafted AIFF file.
Secunia reports:
A security issue has been reported in SLiM, which can be exploited by malicious, local users to disclose sensitive information.
The security issue is caused due to the application generating the X authority file by passing the X authority cookie via the command line to "xauth". This can be exploited to disclose the X authority cookie by consulting the process list and e.g. gain access the user's display.
US-CERT reports:
ntpd contains a stack buffer overflow which may allow a remote unauthenticated attacker to execute arbitrary code on a vulnerable system or create a denial of service.
SecurityFocus reports:
University of Washington IMAP c-client is prone to a remote format-string vulnerability because the software fails to adequately sanitize user-supplied input before passing it as the format-specifier to a formatted-printing function.
NLnet Labs:
A one-byte buffer overflow has been reported in NSD. The problem affects all versions 2.0.0 to 3.2.1. The bug allows a carefully crafted exploit to bring down your DNS server. It is highly unlikely that this one byte overflow can lead to other (system) exploits.
xine developers report:
- Fix another possible int overflow in the 4XM demuxer. (ref. TKADV2009-004, CVE-2009-0385)
- Fix an integer overflow in the Quicktime demuxer.
Multiple vulnerabilities were fixed in libxine 1.1.16.2.
Tobias Klein reports:
FFmpeg contains a type conversion vulnerability while parsing malformed 4X movie files. The vulnerability may be exploited by a (remote) attacker to execute arbitrary code in the context of FFmpeg or an application using the FFmpeg library.
Note: A similar issue also affects xine-lib < version 1.1.16.2.
xine developers report:
- Fix broken size checks in various input plugins (ref. CVE-2008-5239).
- More malloc checking (ref. CVE-2008-5240).
securityfocus research reports:
A bug that leads to the emptying of the INI file contents if the database key was not found exists in PHP dba extension in versions 5.2.6, 4.4.9 and earlier.
Function dba_replace() are not filtering strings key and value. There is a possibility for the destruction of the file.
Secunia reports:
A vulnerability has been reported in libwmf, which can be exploited by malicious people to cause a DoS (Denial of Service) or compromise an application using the library.
The vulnerability is caused due to a use-after-free error within the embedded GD library, which can be exploited to cause a crash or potentially to execute arbitrary code via a specially crafted WMF file.
Secunia reports:
infamous41md has reported a vulnerability in libwmf, which potentially can be exploited by malicious people to compromise an application using the vulnerable library.
The vulnerability is caused due to an integer overflow error when allocating memory based on a value taken directly from a WMF file without performing any checks. This can be exploited to cause a heap-based buffer overflow when a specially crafted WMF file is processed.
Secunia reports:
Input passed via multiple parameters to action/AttachFile.py is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in the context of an affected site.
Secunia reports:
Certain input passed to the "Apache::Status" and "Apache2::Status" modules is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected website.
The Drupal Security Team reports:
When outputting user-supplied data Drupal strips potentially dangerous HTML attributes and tags or escapes characters which have a special meaning in HTML. This output filtering secures the site against cross site scripting attacks via user input.
Certain byte sequences that are valid in the UTF-8 specification are potentially dangerous when interpreted as UTF-7. Internet Explorer 6 and 7 may decode these characters as UTF-7 if they appear before the <meta http-equiv="Content-Type" /> tag that specifies the page content as UTF-8, despite the fact that Drupal also sends a real HTTP header specifying the content as UTF-8. This enables attackers to execute cross site scripting attacks with UTF-7. SA-CORE-2009-005 - Drupal core - Cross site scripting contained an incomplete fix for the issue. HTML exports of books are still vulnerable, which means that anyone with edit permissions for pages in outlines is able to insert arbitrary HTML and script code in these exports.
Additionally, the taxonomy module allows users with the 'administer taxonomy' permission to inject arbitrary HTML and script code in the help text of any vocabulary.
US-CERT reports:
The sasl_encode64() function converts a string into base64. The Cyrus SASL library contains buffer overflows that occur because of unsafe use of the sasl_encode64() function.
Secunia reports:
Some vulnerabilities have been reported in MoinMoin, which can be exploited by malicious people to conduct cross-site scripting attacks.
Input passed to multiple parameters in action/AttachFile.py is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in the context of an affected site.
Certain input passed to security/antispam.py is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in the context of an affected site.
SecurityFocus reports:
Ghostscript is prone to a remote buffer-overflow vulnerability because it fails to properly bounds-check user-supplied input before copying it into a finite-sized buffer.
Exploiting this issue allows remote attackers to overwrite a sensitive memory buffer with arbitrary data, potentially allowing them to execute malicious machine code in the context of the affected application. This vulnerability may facilitate the compromise of affected computers.
oCERT reports:
Pango suffers from a multiplicative integer overflow which may lead to a potentially exploitable, heap overflow depending on the calling conditions.
For example, this vulnerability is remotely reachable in Firefox by creating an overly large document.location value but only results in a process-terminating, allocation error (denial of service).
The affected function is pango_glyph_string_set_size. An overflow check when doubling the size neglects the overflow possible on the subsequent allocation.
Wireshark team reports:
Wireshark 1.0.7 fixes the following vulnerabilities:
- The PROFINET dissector was vulnerable to a format string overflow. (Bug 3382) Versions affected: 0.99.6 to 1.0.6, CVE-2009-1210.
- The Check Point High-Availability Protocol (CPHAP) dissector could crash. (Bug 3269) Versions affected: 0.9.6 to 1.0.6; CVE-2009-1268.
- Wireshark could crash while loading a Tektronix .rf5 file. (Bug 3366) Versions affected: 0.99.6 to 1.0.6, CVE-2009-1269.
Gentoo security team summarizes:
The following issues were reported in CUPS:
- iDefense reported an integer overflow in the _cupsImageReadTIFF() function in the "imagetops" filter, leading to a heap-based buffer overflow (CVE-2009-0163).
- Aaron Siegel of Apple Product Security reported that the CUPS web interface does not verify the content of the "Host" HTTP header properly (CVE-2009-0164).
- Braden Thomas and Drew Yao of Apple Product Security reported that CUPS is vulnerable to CVE-2009-0146, CVE-2009-0147 and CVE-2009-0166, found earlier in xpdf and poppler.
A remote attacker might send or entice a user to send a specially crafted print job to CUPS, possibly resulting in the execution of arbitrary code with the privileges of the configured CUPS user -- by default this is "lp", or a Denial of Service. Furthermore, the web interface could be used to conduct DNS rebinding attacks.
The function ASN1_STRING_print_ex does not properly validate the lengths of BMPString or UniversalString objects before attempting to print them.
An application which attempts to print a BMPString or UniversalString which has an invalid length will crash as a result of OpenSSL accessing invalid memory locations. This could be used by an attacker to crash a remote application.
No workaround is available, but applications which do not use the ASN1_STRING_print_ex function (either directly or indirectly) are not affected.
Debian Security Team reports:
It was discovered that Quagga, an IP routing daemon, could no longer process the Internet routing table due to broken handling of multiple 4-byte AS numbers in an AS path. If such a prefix is received, the BGP daemon crashes with an assert failure leading to a denial of service.
Secunia reports:
A vulnerability has been reported in Openfire which can be exploited by malicious users to bypass certain security restrictions. The vulnerability is caused due to Openfire not properly respecting the no password changes setting which can be exploited to change passwords by sending jabber:iq:auth passwd_change requests to the server.
Drupal Security Team reports:
When outputting user-supplied data Drupal strips potentially dangerous HTML attributes and tags or escapes characters which have a special meaning in HTML. This output filtering secures the site against cross site scripting attacks via user input.
Certain byte sequences that are valid in the UTF-8 specification are potentially dangerous when interpreted as UTF-7. Internet Explorer 6 and 7 may decode these characters as UTF-7 if they appear before the meta http-equiv="Content-Type" tag that specifies the page content as UTF-8, despite the fact that Drupal also sends a real HTTP header specifying the content as UTF-8. This behaviour enables malicious users to insert and execute Javascript in the context of the website if site visitors are allowed to post content.
In addition, Drupal core also has a very limited information disclosure vulnerability under very specific conditions. If a user is tricked into visiting the site via a specially crafted URL and then submits a form (such as the search box) from that page, the information in their form submission may be directed to a third-party site determined by the URL and thus disclosed to the third party. The third party site may then execute a CSRF attack against the submitted form.
Mozilla Foundation reports:
MFSA 2009-22: Firefox allows Refresh header to redirect to javascript: URIs
MFSA 2009-21: POST data sent to wrong site when saving web page with embedded frame
MFSA 2009-20: Malicious search plugins can inject code into arbitrary sites
MFSA 2009-19: Same-origin violations in XMLHttpRequest and XPCNativeWrapper.toString
MFSA 2009-18: XSS hazard using third-party stylesheets and XBL bindings
MFSA 2009-17: Same-origin violations when Adobe Flash loaded via view-source: scheme
MFSA 2009-16: jar: scheme ignores the content-disposition: header on the inner URI
MFSA 2009-15: URL spoofing with box drawing character
MFSA 2009-14 Crashes with evidence of memory corruption (rv:1.9.0.9)
Secunia reports:
Some vulnerabilities have been reported in Poppler which can be exploited by malicious people to potentially compromise an application using the library.
Secunia reports:
Some vulnerabilities have been reported in Xpdf, which can be exploited by malicious people to potentially compromise a user's system.
A boundary error exists when decoding JBIG2 symbol dictionary segments. This can be exploited to cause a heap-based buffer overflow and potentially execute arbitrary code.
Multiple integer overflows in the JBIG2 decoder can be exploited to potentially execute arbitrary code.
Multiple boundary errors in the JBIG2 decoder can be exploited to cause buffer overflows and potentially execute arbitrary code.
Multiple errors in the JBIG2 decoder can be exploited can be exploited to free arbitrary memory and potentially execute arbitrary code.
Multiple unspecified input validation errors in the JBIG2 decoder can be exploited to potentially execute arbitrary code.
Secunia reports:
Some vulnerabilities have been reported in FreeType, which can be exploited by malicious people to potentially compromise an application using the library.
An integer overflow error within the "cff_charset_compute_cids()" function in cff/cffload.c can be exploited to potentially cause a heap-based buffer overflow via a specially crafted font.
Multiple integer overflow errors within validation functions in sfnt/ttcmap.c can be exploited to bypass length validations and potentially cause buffer overflows via specially crafted fonts.
An integer overflow error within the "ft_smooth_render_generic()" function in smooth/ftsmooth.c can be exploited to potentially cause a heap-based buffer overflow via a specially crafted font.
SecurityFocus reports:
The ejabberd application is prone to a cross-site scripting vulnerability.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and to steal cookie-based authentication credentials.
Ziproxy Developers reports:
Multiple HTTP proxy implementations are prone to an information-disclosure vulnerability related to the interpretation of the 'Host' HTTP header. Specifically, this issue occurs when the proxy makes a forwarding decision based on the 'Host' HTTP header instead of the destination IP address.
Attackers may exploit this issue to obtain sensitive information such as internal intranet webpages. Additional attacks may also be possible.
phpMyAdmin Team reports:
Setup script used to generate configuration can be fooled using a crafted POST request to include arbitrary PHP code in generated configuration file. Combined with ability to save files on server, this can allow unauthenticated users to execute arbitrary PHP code. This issue is on different parameters than PMASA-2009-3 and it was missed out of our radar because it was not existing in 2.11.x branch.
Drupal CCK plugin developer reports:
The Node reference and User reference sub-modules, which are part of the Content Construction Kit (CCK) project, lets administrators define node fields that are references to other nodes or to users. When displaying a node edit form, the titles of candidate referenced nodes or names of candidate referenced users are not properly filtered, allowing malicious users to inject arbitrary code on those pages. Such a cross site scripting (XSS) attack may lead to a malicious user gaining full administrative access.
Secunia reports:
A vulnerability has been discovered in Pivot, which can be exploited by malicious people to delete certain files.
Input passed to the "refkey" parameter in extensions/bbclone_tools/count.php is not properly sanitised before being used to delete files. This can be exploited to delete files with the permissions of the web server via directory traversal sequences passed within the "refkey" parameter.
NOTE: Users with the "Advanced" user level are able to include and execute uploaded PHP code via the "pivot_path" parameter in extensions/bbclone_tools/getkey.php when extensions/bbclone_tools/hr_conf.php can be deleted.
phpMyAdmin reports:
Setup script used to generate configuration can be fooled using a crafted POST request to include arbitrary PHP code in generated configuration file.
Secunia reports:
Tobias Klein has reported some vulnerabilities in Amarok, which potentially can be exploited by malicious people to compromise a user's system.
Two integer overflow errors exist within the "Audible::Tag::readTag()" function in src/metadata/audible/audibletag.cpp. These can be exploited to cause heap-based buffer overflows via specially crafted Audible Audio files.
Two errors within the "Audible::Tag::readTag()" function in src/metadata/audible/audibletag.cpp can be exploited to corrupt arbitrary memory via specially crafted Audible Audio files.
Vendor reports:
On non-Windows systems Wireshark could crash if the HOME environment variable contained sprintf-style string formatting characters. Wireshark could crash while reading a malformed NetScreen snoop file. Wireshark could crash while reading a Tektronix K12 text capture file.
Secunia reports:
A vulnerability has been reported in Netatalk, which potentially can be exploited by malicious users to compromise a vulnerable system.
The vulnerability is caused due to the papd daemon improperly sanitising several received parameters before passing them in a call to popen(). This can be exploited to execute arbitrary commands via a specially crafted printing request.
Successful exploitation requires that a printer is configured to pass arbitrary values as parameters to a piped command.
Secunia reports:
Tobias Klein has reported some vulnerabilities in GStreamer Good Plug-ins, which can potentially be exploited by malicious people to compromise a vulnerable system.
A boundary error occurs within the "qtdemux_parse_samples()" function in gst/gtdemux/qtdemux.c when performing QuickTime "ctts" Atom parsing. This can be exploited to cause a heap-based buffer overflow via a specially crafted QuickTime media file.
An array indexing error exists in the "qtdemux_parse_samples()" function in gst/gtdemux/qtdemux.c when performing QuickTime "stss" Atom parsing. This can be exploited to corrupt memory via a specially crafted QuickTime media file.
A boundary error occurs within the "qtdemux_parse_samples()" function in gst/gtdemux/qtdemux.c when performing QuickTime "stts" Atom parsing. This can be exploited to cause a heap-based buffer overflow via a specially crafted QuickTime media file.
Secunia reports:
The vulnerability is caused due to an integer overflow error in the processing of CAF description chunks. This can be exploited to cause a heap-based buffer overflow by tricking the user into processing a specially crafted CAF audio file.
Secunia reports:
Tobias Klein has reported a vulnerability in FFmpeg, which potentially can be exploited by malicious people to compromise an application using the library.
The vulnerability is caused due to a signedness error within the "fourxm_read_header()" function in libavformat/4xm.c. This can be exploited to corrupt arbitrary memory via a specially crafted 4xm file.
Secunia reports:
Some vulnerabilities have been reported in RoundCube Webmail, which can be exploited by malicious users to compromise a vulnerable system and by malicious people to conduct script insertion attacks and compromise a vulnerable system.
The HTML "background" attribute within e.g. HTML emails is not properly sanitised before being used. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site if a malicious email is viewed.
Input passed via a vCard is not properly sanitised before being used in a call to "preg_replace()" with the "e" modifier in program/include/rcube_vcard.php. This can be exploited to inject and execute arbitrary PHP code by e.g. tricking a user into importing a malicious vCard file.
Secunia reports:
Some vulnerabilities have been reported in ProFTPD, which can be exploited by malicious people to conduct SQL injection attacks.
The application improperly sets the character encoding prior to performing SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code in an environment using a multi-byte character encoding.
An error exists in the "mod_sql" module when processing e.g. user names containing '%' characters. This can be exploited to bypass input sanitation routines and manipulate SQL queries by injecting arbitrary SQL code.
Secunia reports:
Some vulnerabilities have been reported in the ZABBIX PHP frontend, which can be exploited by malicious people to conduct cross-site request forgery attacks and malicious users to disclose sensitive information and compromise a vulnerable system.
Input appended to and passed via the "extlang" parameter to the "calc_exp2()" function in include/validate.inc.php is not properly sanitised before being used. This can be exploited to inject and execute arbitrary PHP code.
The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to e.g. create users by enticing a logged in administrator to visit a malicious web page.
Input passed to the "srclang" parameter in locales.php (when "next" is set to a non-NULL value) is not properly verified before being used to include files. This can be exploited to include arbitrary files from local resources via directory traversal attacks and URL-encoded NULL bytes.
SecurityFocus reports:
PHP is prone to a buffer-overflow vulnerability because it fails to perform boundary checks before copying user-supplied data to insufficiently sized memory buffers. The issue affects the 'mbstring' extension included in the standard distribution.
An attacker can exploit this issue to execute arbitrary machine code in the context of the affected webserver. Failed exploit attempts will likely crash the webserver, denying service to legitimate users.
Secunia reports:
Dun has discovered a vulnerability in phpPgAdmin, which can be exploited by malicious people to disclose sensitive information.
Input passed via the "_language" parameter to libraries/lib.inc.php is not properly sanitised before being used to include files. This can be exploited to include arbitrary files from local resources via directory traversal attacks and URL-encoded NULL bytes.
Opera Team reports:
An unspecified error in the processing of JPEG images can be exploited to trigger a memory corruption.
An error can be exploited to execute arbitrary script code in a different domain via unspecified plugins.
An unspecified error has a "moderately severe" impact. No further information is available.
CVE Mitre reports:
Untrusted search path vulnerability in the Python interface in Epiphany 2.22.3, and possibly other versions, allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).
CVE Mitre reports:
Cross-site scripting (XSS) vulnerability in proxy_ftp.c in the mod_proxy_ftp module in Apache 2.0.63 and earlier, and mod_proxy_ftp.c in the mod_proxy_ftp module in Apache 2.2.9 and earlier 2.2 versions, allows remote attackers to inject arbitrary web script or HTML via a wildcard in the last directory component in the pathname in an FTP URI.
Secunia reports:
A vulnerability has been reported in Pngcrush, which can be exploited by malicious people to potentially compromise a user's system.
The vulnerability is caused due to the use of vulnerable libpng code.
Secunia reports:
The security issue is caused due to cURL following HTTP Location: redirects to e.g. scp:// or file:// URLs which can be exploited by a malicious HTTP server to overwrite or disclose the content of arbitrary local files and potentially execute arbitrary commands via specially crafted redirect URLs.
Matthew Weier O'Phinney reports:
A potential Local File Inclusion (LFI) vulnerability exists in the Zend_View::render() method. If user input is used to specify the script path, then it is possible to trigger the LFI.
Note that Zend Framework applications that never call the Zend_View::render() method with a user-supplied parameter are not affected by this vulnerability.
Security Focus reports:
An attacker could exploit this issue by enticing an unsuspecting victim to execute the vulnerable application in a directory containing a malicious Python file. A successful exploit will allow arbitrary Python commands to run within the privileges of the currently logged-in user.
Dwayne C. Litzenberger reports:
pycrypto is exposed to a buffer overflow issue because it fails to adequately verify user-supplied input. This issue resides in the ARC2 module. This issue can be triggered with specially crafted ARC2 keys in excess of 128 bytes.
SecurityFocus reports:
Varnish is prone to a remote denial-of-service vulnerability because the application fails to handle certain HTTP requests.
Successfully exploiting this issue allows remote attackers to crash the affected application denying further service to legitimate users.
Secunia reports:
Some vulnerabilities have been reported in Tor, where one has an unknown impact and others can be exploited by malicious people to cause a DoS.
An error when running Tor as a directory authority can be exploited to trigger the execution of an infinite loop.
An unspecified error exists when running on Windows systems prior to Windows XP. No further information is currently available.
Mozilla Foundation reports:
MFSA 2009-06: Directives to not cache pages ignored
MFSA 2009-05: XMLHttpRequest allows reading HTTPOnly cookies
MFSA 2009-04: Chrome privilege escalation via local .desktop files
MFSA 2009-03: Local file stealing with SessionStore
MFSA 2009-02: XSS using a chrome XBL method and window.eval
MFSA 2009-01: Crashes with evidence of memory corruption (rv:1.9.0.6)
znirkel reports:
The eval() function in _reset_post_array crashes when posting certain data. By passing in carefully-crafted input data, the eval() function could also execute malicious PHP code.
Note that CodeIgniter applications that either do not use the new Form Validation class or use the old Validation class are not affected by this vulnerability.
Security Focus reports:
PyBlosxom is prone to multiple XML-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.
Attacker-supplied XML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.
Secunia reports:
Some vulnerabilities have been reported in Typo3, which can be exploited by malicious people to conduct cross-site scripting attacks and disclose sensitive information.
Input passed via unspecified fields to the backend user interface is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
An error in the "jumpUrl" mechanism can be exploited to read arbitrary files from local resources by disclosing a hash secret used to restrict file access.
Secunia reports:
A boundary error when processing "div" HTML tags can be exploited to cause a stack-based buffer overflow via an overly long "id" parameter.
A boundary error exists when processing overly long links. This can be exploited to cause a stack-based buffer overflow by tricking the user into e.g. editing a malicious link.
A boundary error when processing e.g. a "bdo" HTML tag having an overly long "dir" attribute can be exploited to cause a stack-based buffer overflow.
A boundary error when processing "input" HTML tags can be exploited to cause a stack-based buffer overflow via an overly long e.g. "type" attribute.
Secunia reports:
Some vulnerabilities have been reported in WebSVN, which can be exploited by malicious users to disclose sensitive information, and by malicious people to conduct cross-site scripting attacks and manipulate data.
Input passed in the URL to index.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
Input passed to the "rev" parameter in rss.php is not properly sanitised before being used. This can be exploited to overwrite arbitrary files via directory traversal attacks.
Access to restricted repositories is not properly enforced, which can be exploited to disclose potentially sensitive information by accessing the repository via "listing.php" and using the "compare with previous" and "show changed files" links.
Secunia reports:
Input passed to the "_SERVER[ConfigFile]" parameter in admin/index.php is not properly verified before being used to include files. This can be exploited to include arbitrary files from local resources.
Squid security advisory 2009:1 reports:
Due to an internal error Squid is vulnerable to a denial of service attack when processing specially crafted requests.
This problem allows any client to perform a denial of service attack on the Squid service.
Secunia reports:
Some vulnerabilities have been reported in Typo3, which can be exploited by malicious people to bypass certain security restrictions, conduct cross-site scripting and session fixation attacks, and compromise a vulnerable system.
The "Install tool" system extension uses insufficiently random entropy sources to generate an encryption key, resulting in weak security.
The authentication library does not properly invalidate supplied session tokens, which can be exploited to hijack a user's session.
Certain unspecified input passed to the "Indexed Search Engine" system extension is not properly sanitised before being used to invoke commands. This can be exploited to inject and execute arbitrary shell commands.
Input passed via the name and content of files to the "Indexed Search Engine" system extension is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
Certain unspecified input passed to the Workspace module is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
Note: It is also reported that certain unspecified input passed to test scripts of the "ADOdb" system extension is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected website.
Todd Miller reports:
A bug was introduced in Sudo's group matching code in version 1.6.9 when support for matching based on the supplemental group vector was added. This bug may allow certain users listed in the sudoers file to run a command as a different user than their access rule specifies.
Drupal Team reports:
The Content Translation module for Drupal 6.x enables users to make a translation of an existing item of content (a node). In that proces the existing node's content is copied into the new node's submission form.
The module contains a flaw that allows a user with the 'translate content' permission to potentially bypass normal viewing access restrictions, for example allowing the user to see the content of unpublished nodes even if they do not have permission to view unpublished nodes.
When user profile pictures are enabled, the default user profile validation function will be bypassed, possibly allowing invalid user names or e-mail addresses to be submitted.
Secunia reports:
Paul Szabo has reported a vulnerability in Perl File::Path::rmtree, which potentially can be exploited by malicious, local users to gain escalated privileges.
The vulnerability is caused due to a race condition in the way File::Path::rmtree handles directory permissions when cleaning up directories. This can be exploited by replacing an existing sub directory in the directory tree with a symbolic link to an arbitrary file.
Successful exploitation may allow changing permissions of arbitrary files, if root uses an application using the vulnerable code to delete files in a directory having a world-writable sub directory.
Secunia reports:
Input passed to multiple parameters in action/AttachFile.py is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in the context of an affected site.
Certain input passed to security/antispam.py is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in the context of an affected site.
Secunia reports:
Spike Spiegel has discovered a vulnerability in Ganglia which can be exploited by malicious people to compromise a vulnerable system. The vulnerability is caused due to a boundary error within the process_path function in gmetad/server.c. This can be exploited to cause a stack-based buffer overflow by e.g. sending a specially crafted message to the gmetad service.
The vulnerability is confirmed in version 3.1.1. Other versions may also be affected.
Secunia reports:
A vulnerability with an unknown impact has been reported in Tor.
The vulnerability is caused due to an unspecified error and can be exploited to trigger a heap corruption. No further information is currently available.
The GLPI project reports:
Input passed via unspecified parameters is not properly sanitised before being used in SQL queries. This can be exploited to manipulateSQL queries by injecting arbitrary SQL code.
Core Security Technologies reports:
Multiple cross-site scripting vulnerabilities have been found which may lead to arbitrary remote code execution on the server running the application due to unauthorized upload of Java plugin code.
SecurityFocus reports:
IPsec-Tools is affected by multiple remote denial-of-service vulnerabilities because the software fails to properly handle certain network packets.
A successful attack allows a remote attacker to crash the software, denying further service to legitimate users.
SecurityFocus reports:
TeamSpeak is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data. Exploiting the issue may allow an attacker to obtain sensitive information that could aid in further attacks.
Secunia reports:
A vulnerability has been reported in OptiPNG, which potentially can be exploited by malicious people to compromise a user's system.
The vulnerability is caused due to a boundary error in the BMP reader and can be exploited to cause a buffer overflow by tricking a user into processing a specially crafted file.
Successful exploitation may allow execution of arbitrary code.
Git maintainers report:
gitweb has a possible local privilege escalation bug that allows a malicious repository owner to run a command of his choice by specifying diff.external configuration variable in his repository and running a crafted gitweb query.
SecurityFocus reports:
GNUs tar and cpio utilities are prone to a denial-of-service vulnerability because of insecure use of the alloca() function.
Successfully exploiting this issue allows attackers to crash the affected utilities and possibly to execute code but this has not been confirmed.
Secunia reports:
The vulnerability is caused due to a boundary error within the "str_read_packet()" function in libavformat/psxstr.c. This can be exploited to cause a heap-based buffer overflow via a specially crafted STR file.
Secunia reports:
A vulnerability has been reported in CGIWrap, which can be exploited by malicious people to conduct cross-site scripting attacks.
The vulnerability is caused due to the application generating error messages without specifying a charset. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
Successful exploitation may require that the victim uses Internet Explorer or a browser based on Internet Explorer components.
securityfocus reports:
An attacker with low-level privileges may exploit this issue to bypass authorization and cause arbitrary commands to run within the context of the Nagios server. This may aid in further attacks.
Secunia reports:
Some security issues have been reported in PDFjam, which can be exploited by malicious, local users to perform certain actions with escalated privileges.
The security issues are caused due to the "pdf90", "pdfjoin", and "pdfnup" scripts using temporary files in an insecure manner. This can be exploited to overwrite arbitrary files via symlink attacks.
securityfocus reports:
An attacker with local access could potentially exploit this issue to perform symbolic-link attacks, overwriting arbitrary files in the context of the affected application.
Successfully mounting a symlink attack may allow the attacker to delete or corrupt sensitive files, which may result in a denial of service. Other attacks may also be possible.
Verlihub is prone to a remote command-execution vulnerability because it fails to sufficiently validate user input.
Successfully exploiting this issue would allow an attacker to execute arbitrary commands on an affected computer in the context of the affected application.
MySQL reports:
The vulnerability is caused due to an error when processing an empty bit-string literal and can be exploited to crash the server via a specially crafted SQL statement.
MySQL reports:
Using RENAME TABLE against a table with explicit DATA DIRECTORY and INDEX DIRECTORY options can be used to overwrite system table information by replacing the symbolic link points. the file to which the symlink points.
MySQL reports:
A malformed password packet in the connection protocol could cause the server to crash.
MySQL reports:
The requirement of the DROP privilege for RENAME TABLE was not enforced.
SANS reports:
The University of Washington IMAP library is a library implementing the IMAP mail protocol. University of Washington IMAP is exposed to a buffer overflow issue that occurs due to a boundary error within the rfc822_output_char function in the c-client library. The University of Washington IMAP library versions prior to 2007e are affected.
SANS reports:
University of Washington "tmail" and "dmail" are mail deliver agents. "tmail" and "dmail" are exposed to local buffer overflow issues because they fail to perform adequate boundary checks on user-supplied data.
securityfocus reports:
The 'libcdaudio' library is prone to a remote heap code in the context of an application that uses the library. Failed attacks will cause denial-of-service conditions.
A buffer-overflow in Grip occurs when the software processes a response to a CDDB query that has more than 16 matches.
To exploit this issue, an attacker must be able to influence the response to a CDDB query, either by controlling a malicious CDDB server or through some other means. Successful exploits will allow arbitrary code to run.
Some function pointers for netgraph and bluetooth sockets are not properly initialized.
A local user can cause the FreeBSD kernel to execute arbitrary code. This could be used by an attacker directly; or it could be used to gain root privilege or to escape from a jail.
No workaround is available, but systems without local untrusted users are not vulnerable. Furthermore, systems are not vulnerable if they have neither the ng_socket nor ng_bluetooth kernel modules loaded or compiled into the kernel.
Systems with the security.jail.socket_unixiproute_only sysctl set to 1 (the default) are only vulnerable if they have local untrusted users outside of jails.
If the command
# kldstat -v | grep ng_
produces no output, the system is not vulnerable.
The ftpd(8) server splits long commands into several requests. This may result in the server executing a command which is hidden inside another very long command.
This could, with a specifically crafted command, be used in a cross-site request forgery attack.
FreeBSD systems running ftpd(8) server could act as a point of privilege escalation in an attack against users using web browser to access trusted FTP sites.
No workaround is available, but systems not running FTP servers are not vulnerable. Systems not running the FreeBSD ftp(8) server are not affected, but users of other ftp daemons are advised to take care since several other ftp daemons are known to have related bugs.
IPv6 routers may allow "on-link" IPv6 nodes to create and update the router's neighbor cache and forwarding information. A malicious IPv6 node sharing a common router but on a different physical segment from another node may be able to spoof Neighbor Discovery messages, allowing it to update router information for the victim node.
An attacker on a different physical network connected to the same IPv6 router as another node could redirect IPv6 traffic intended for that node. This could lead to denial of service or improper access to private network traffic.
Firewall packet filters can be used to filter incoming Neighbor Solicitation messages but may interfere with normal IPv6 operation if not configured carefully.
Reverse path forwarding checks could be used to make gateways, such as routers or firewalls, drop Neighbor Solicitation messages from nodes with unexpected source addresses on a particular interface.
IPv6 router administrators are encouraged to read RFC 3756 for further discussion of Neighbor Discovery security implications.
When the arc4random(9) random number generator is initialized, there may be inadequate entropy to meet the needs of kernel systems which rely on arc4random(9); and it may take up to 5 minutes before arc4random(9) is reseeded with secure entropy from the Yarrow random number generator.
All security-related kernel subsystems that rely on a quality random number generator are subject to a wide range of possible attacks for the 300 seconds after boot or until 64k of random data is consumed. The list includes:
* GEOM ELI providers with onetime keys. When a provider is configured in a way so that it gets attached at the same time during boot (e.g. it uses the rc subsystem to initialize) it might be possible for an attacker to recover the encrypted data.
* GEOM shsec providers. The GEOM shsec subsytem is used to split a shared secret between two providers so that it can be recovered when both of them are present. This is done by writing the random sequence to one of providers while appending the result of the random sequence on the other host to the original data. If the provider was created within the first 300 seconds after booting, it might be possible for an attacker to extract the original data with access to only one of the two providers between which the secret data is split.
* System processes started early after boot may receive predictable IDs.
* The 802.11 network stack uses arc4random(9) to generate initial vectors (IV) for WEP encryption when operating in client mode and WEP authentication challenges when operating in hostap mode, which may be insecure.
* The IPv4, IPv6 and TCP/UDP protocol implementations rely on a quality random number generator to produce unpredictable IP packet identifiers, initial TCP sequence numbers and outgoing port numbers. During the first 300 seconds after booting, it may be easier for an attacker to execute IP session hijacking, OS fingerprinting, idle scanning, or in some cases DNS cache poisoning and blind TCP data injection attacks.
* The kernel RPC code uses arc4random(9) to retrieve transaction identifiers, which might make RPC clients vulnerable to hijacking attacks.
No workaround is available for affected systems.
SecurityFocus reports:
The xterm program is prone to a remote command-execution vulnerability because it fails to sufficiently validate user input.
Successfully exploiting this issue would allow an attacker to execute arbitrary commands on an affected computer in the context of the affected application.
According to CVE-2008-5498 entry:
Array index error in the "imageRotate" function in PHP 5.2.8 and earlier allows context-dependent attackers to read the contents of arbitrary memory locations via a crafted value of the third argument (aka the "bgd_color" or "clrBack" argument) for an indexed image.
Secunia reports:
Morgan Todd has discovered a vulnerability in AWStats, which can be exploited by malicious people to conduct cross-site scripting attacks.
Input passed in the URL to awstats.pl is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
Successful exploitation requires that the application is running as a CGI script.
Jan Lieskovsky reports:
perl-File-Path rmtree race condition (CVE-2005-0448 was assigned to address this)
This vulnerability was fixed in 5.8.4-7 but re-introduced in 5.8.8-1. It's also present in File::Path 2.xx, up to and including 2.07 which has only a partial fix.
Jan Minar reports:
Applying the ``D'' to a file with a crafted file name, or inside a directory with a crafted directory name, can lead to arbitrary code execution.
Lack of sanitization throughout Netrw can lead to arbitrary code execution upon opening a directory with a crafted name.
The Vim Netrw Plugin shares the FTP user name and password across all FTP sessions. Every time Vim makes a new FTP connection, it sends the user name and password of the previous FTP session to the FTP server.
CORE Security Technologies reports:
A format string error has been found on the vinagre_utils_show_error() function that can be exploited via commands issued from a malicious server containing format string specifiers on the VNC name.
In a web based attack scenario, the user would be required to connect to a malicious server. Successful exploitation would then allow the attacker to execute arbitrary code with the privileges of the Vinagre user.
Marc Schoenefeld and Steve Milner of RedHat SRT and Peter Allor of IBM ISS report:
XSS vulnerability with URLPARAM variable
SEARCH variable allows arbitrary shell command execution
Entry for CVE-2008-5619 says:
html2text.php in RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2-3.beta allows remote attackers to execute arbitrary code via crafted input that is processed by the preg_replace function with the eval switch.
MySQL Team reports:
Additional corrections were made for the symlink-related privilege problem originally addressed. The original fix did not correctly handle the data directory pathname if it contained symlinked directories in its path, and the check was made only at table-creation time, not at table-opening time later.
A trapkit reports:
MPlayer contains a stack buffer overflow vulnerability while parsing malformed TwinVQ media files. The vulnerability may be exploited by a (remote) attacker to execute arbitrary code in the context of MPlayer.
Secunia reports:
A security issue has been reported in Ampache, which can be exploited by malicious, local users to perform certain actions with escalated privileges.
The security issue is caused due to the "gather-messages.sh" script handling temporary files in an insecure manner. This can be exploited via symlink attacks to overwrite arbitrary files with the privileges of the user running the script.
The Opera Team reports:
Manipulating certain text-area contents can cause a buffer overflow, which may be exploited to execute arbitrary code.
Certain HTML constructs can cause the resulting DOM to change unexpectedly, which triggers a crash. To inject code, additional techniques will have to be employed.
Exceptionally long host names in file: URLs can cause a buffer overflow, which may be exploited to execute arbitrary code. Remote Web pages cannot refer to file: URLs, so successful exploitation involves tricking users into manually opening the exploit URL, or a local file that refers to it.
When Opera is previewing a news feed, some scripted URLs are not correctly blocked. These can execute scripts which are able to subscribe the user to any feed URL that the attacker chooses, and can also view the contents of any feeds that the user is subscribed to. These may contain sensitive information.
Built-in XSLT templates incorrectly handle escaped content and can cause it to be treated as markup. If a site accepts content from untrusted users, which it then displays using XSLT as escaped strings, this can allow scripted markup to be injected. The scripts will then be executed in the security context of that site.
The MediaWiki development team reports:
Certain unspecified input is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
Certain unspecified input related to uploads is not properly sanitised before being used. This can be exploited to inject arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when a malicious data is opened. Successful exploitation may require that uploads are enabled and the victim uses an Internet Explorer based browser.
Certain SVG scripts are not properly sanitised before being used. This can be exploited to inject arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when a malicious data is opened. Successful exploitation may require that SVG uploads are enabled and the victim uses a browser supporting SVG scripting.
The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain operations when a logged in user visits a malicious site.
The Drupal Project reports:
The update system is vulnerable to Cross site request forgeries. Malicious users may cause the superuser (user 1) to execute old updates that may damage the database.
When an input format is deleted, not all existing content on a site is updated to reflect this deletion. Such content is then displayed unfiltered. This may lead to cross site scripting attacks when harmful tags are no longer stripped from 'malicious' content that was posted earlier.
The Mozilla Foundation reports:
MFSA 2008-69 XSS vulnerabilities in SessionStore
MFSA 2008-68 XSS and JavaScript privilege escalation
MFSA 2008-67 Escaped null characters ignored by CSS parser
MFSA 2008-66 Errors parsing URLs with leading whitespace and control characters
MFSA 2008-65 Cross-domain data theft via script redirect error message
MFSA 2008-64 XMLHttpRequest 302 response disclosure
MFSA 2008-62 Additional XSS attack vectors in feed preview
MFSA 2008-61 Information stealing via loadBindingDocument
MFSA 2008-60 Crashes with evidence of memory corruption (rv:1.9.0.5/1.8.1.19)
The phpMyAdmin Team reports:
A logged-in user can be subject of SQL injection through cross site request forgery. Several scripts in phpMyAdmin are vulnerable and the attack can be made through table parameter.
PHP Developers reports:
Due to a security bug found in the PHP 5.2.7 release, it has been removed from distribution. The bug affects configurations where magic_quotes_gpc is enabled, because it remains off even when set to on.
Secunia reports:
A vulnerability has been reported in Wireshark, which can be exploited by malicious people to cause a DoS.
The vulnerability is caused due to an error in the SMTP dissector and can be exploited to trigger the execution of an infinite loop via a large SMTP packet.
Secunia reports:
Some vulnerabilities have been reported in PHP, where some have an unknown impact and others can potentially be exploited by malicious people to cause a DoS (Denial of Service) or compromise a vulnerable system.
An input validation error exists within the "ZipArchive::extractTo()" function when extracting ZIP archives. This can be exploited to extract files to arbitrary locations outside the specified directory via directory traversal sequences in a specially crafted ZIP archive.
An error in the included PCRE library can be exploited to cause a buffer overflow.
The problem is that the "BG(page_uid)" and "BG(page_gid)" variables are not initialized. No further information is currently available.
The problem is that the "php_value" order is incorrect for Apache configurations. No further information is currently available.
An error in the GD library can be exploited to cause a crash via a specially crafted font file.
Debian reports:
Faxspool in mgetty 1.1.36 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/faxsp.#### temporary file.
Secunia reports:
The security issue is caused due to an input validation error when processing script names. This can be exploited to read or modify arbitrary files having ".sieve" extensions via directory traversal attacks, with the privileges of the attacker's user id.
Secunia reports:
Input passed via the "habari_username" parameter when logging in is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
Tobias Klein from TrapKit reports:
The VLC media player contains an integer overflow vulnerability while parsing malformed RealMedia (.rm) files. The vulnerability leads to a heap overflow that can be exploited by a (remote) attacker to execute arbitrary code in the context of VLC media player.
Secunia reports:
EgiX has discovered a vulnerability in Mantis, which can be exploited by malicious users to compromise a vulnerable system.
Input passed to the "sort" parameter in manage_proj_page.php is not properly sanitised before being used in a "create_function()" call. This can be exploited to execute arbitrary PHP code.
Secunia reports:
Some vulnerabilities have been reported in Mantis, which can be exploited by malicious users to compromise a vulnerable system and malicious people to conduct cross-site scripting and request forgery attacks.
Input passed to the "filter_target" parameter in return_dynamic_filters.php is not properly sanitised before being returned to a user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
A vulnerability is caused due to the application allowing users to perform certain actions via HTTP requests without performing any validity checks to verify the request. This can be exploited to e.g. add a new user with administrative privileges by enticing a logged-in administrator to visit a malicious site.
Input passed to the "value" parameter in adm_config_set.php is not properly sanitised before being used in an "eval()" statement. This can be exploited to e.g. execute arbitrary PHP commands via a specially crafted request.
Input passed to the "language" parameter in account_prefs_update.php is not properly verified before being used to include files. This can be exploited to include arbitrary files from local resources.
Squirrelmail team reports:
An issue was fixed that allowed an attacker to send specially- crafted hyperlinks in a message that could execute cross-site scripting (XSS) when the user viewed the message in SquirrelMail.
The OpenOffice Team reports:
A security vulnerability with the way OpenOffice 2.x process WMF files may allow a remote unprivileged user who provides a StarOffice/StarSuite document that is opened by a local user to execute arbitrary commands on the system with the privileges of the user running StarOffice/StarSuite. No working exploit is known right now.
A security vulnerability with the way OpenOffice 2.x process EMF files may allow a remote unprivileged user who provides a StarOffice/StarSuite document that is opened by a local user to execute arbitrary commands on the system with the privileges of the user running StarOffice/StarSuite. No working exploit is known right now.
Secunia reports:
Input passed via the HTTP "Host" header is not properly sanitised before being used. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site if malicious data is viewed.
Samba Team reports:
Samba 3.0.29 and beyond contain a change to deal with gcc 4 optimizations. Part of the change modified range checking for client-generated offsets of secondary trans, trans2 and nttrans requests. These requests are used to transfer arbitrary amounts of memory from clients to servers and back using small SMB requests and contain two offsets: One offset (A) pointing into the PDU sent by the client and one (B) to direct the transferred contents into the buffer built on the server side. While the range checking for offset (B) is correct, a cut and paste error lets offset (A) pass completely unchecked against overflow.
The buffers passed into trans, trans2 and nttrans undergo higher-level processing like DCE/RPC requests or listing directories. The missing bounds check means that a malicious client can make the server do this higher-level processing on arbitrary memory contents of the smbd process handling the request. It is unknown if that can be abused to pass arbitrary memory contents back to the client, but an important barrier is missing from the affected Samba versions.
Secunia reports:
A security issue has been reported in hplip, which can be exploited by malicious, local users to cause a DoS.
The security issue is caused due to an error within hpssd.py when parsing certain requests. This can be exploited to crash the service by sending specially crafted requests to the default port 2207/TCP.
CUPS reports:
The PNG image reading code did not validate the image size properly, leading to a potential buffer overflow (STR #2974)
Secunia reports:
A vulnerability has been discovered in imlib2, which can be exploited by malicious people to potentially compromise an application using the library.
The vulnerability is caused due to a pointer arithmetic error within the "load()" function provided by the XPM loader. This can be exploited to cause a heap-based buffer overflow via a specially crafted XPM file.
Successful exploitation may allow execution of arbitrary code.
Secunia reports:
A boundary error exists within http_parse_sc_header() in lib/http.c when parsing an overly long HTTP header starting with "Zwitterion v".
A boundary error exists within http_get_pls() in lib/http.c when parsing a specially crafted pls playlist containing an overly long entry.
A boundary error exists within http_get_m3u() in lib/http.c when parsing a specially crafted m3u playlist containing an overly long "File" entry.
The mantis Team reports:
When configuring a web application to use only ssl (e. g. by forwarding all http-requests to https), a user would expect that sniffing and hijacking the session is impossible. Though, for this to be secure, one needs to set the session cookie to have the secure flag. Else the cookie will be transferred through http if the victim's browser does a single http-request on the same domain.
Timo Sirainen reports in dovecot 1.1.4 release notes:
ACL plugin fixes: Negative rights were actually treated as positive rights. 'k' right didn't prevent creating parent/child/child mailbox. ACL groups weren't working.
Secunia reports:
Two vulnerabilities have been reported in Libxml2, which can be exploited by malicious people to cause a DoS (Denial of Service) or to potentially compromise an application using the library.
1) An integer overflow error in the "xmlSAX2Characters()" function can be exploited to trigger a memory corruption via a specially
Successful exploitation may allow execution of arbitrary code, but requires e.g. that the user is tricked into processing an overly large XML file (2GB or more).
2) An integer overflow error in the "xmlBufferResize()" function can be exploited to trigger the execution of an infinite loop. The vulnerabilities are reported in version 2.7.2.
Other versions may also be affected.
Andreas Kurtz reports:
The jabber server Openfire (<= version 3.6.0a) contains several serious vulnerabilities. Depending on the particular runtime environment these issues can potentially even be used by an attacker to execute code on operating system level.
- Authentication bypass - This vulnerability provides an attacker full access to all functions in the admin webinterface without providing any user credentials. The Tomcat filter which is responsible for authentication could be completely circumvented.
- SQL injection - It is possible to pass SQL statements to the backend database through a SQL injection vulnerability. Depending on the particular runtime environment and database permissions it is even possible to write files to disk and execute code on operating system level.
- Multiple Cross-Site Scripting - Permits arbitrary insertion of HTML- and JavaScript code in login.jsp. An attacker could also manipulate a parameter to specify a destination to which a user will be forwarded to after successful authentication.
Florian Grandel reports:
I have not had the time to analyze all of syslog-ng code. But by reading the code section near the chroot call and looking at strace results I believe that syslog-ng does not chdir to the chroot jail's location before chrooting into it.
This opens up ways to work around the chroot jail.
Ulf Harnhammar of Secunia Research reports:
Stack-based buffer overflow in the read_special_escape function in src/psgen.c in GNU Enscript 1.6.1 and 1.6.4 beta, when the -e (aka special escapes processing) option is enabled, allows user-assisted remote attackers to execute arbitrary code via a crafted ASCII file, related to the setfilename command.
SecurityFocus reports:
GnuTLS is prone to a security-bypass vulnerability because the application fails to properly validate chained X.509 certificates. Successfully exploiting this issue allows attackers to perform man-in-the-middle attacks by impersonating trusted servers. Unsuspecting users may be under a false sense of security that can aid attackers in launching further attacks.
Wes Hardaker reports through sourceforge.net forum:
SECURITY ISSUE: A bug in the getbulk handling code could let anyone with even minimal access crash the agent. If you have open access to your snmp agents (bad bad bad; stop doing that!) or if you don't trust everyone that does have access to your agents you should updated immediately to prevent potential denial of service attacks.
Description at cve.mitre.org additionally clarifies:
Integer overflow in the netsnmp_create_subtree_cache function in agent/snmp_agent.c in net-snmp 5.4 before 5.4.2.1, 5.3 before 5.3.2.3, and 5.2 before 5.2.5.1 allows remote attackers to cause a denial of service (crash) via a crafted SNMP GETBULK request, which triggers a heap-based buffer overflow, related to the number of responses or repeats.
The Mozilla Foundation reports:
MFSA 2008-58 Parsing error in E4X default namespace
MFSA 2008-57 -moz-binding property bypasses security checks on codebase principals
MFSA 2008-56 nsXMLHttpRequest::NotifyEventListeners() same-origin violation
MFSA 2008-55 Crash and remote code execution in nsFrameManager
MFSA 2008-54 Buffer overflow in http-index-format parser
MFSA 2008-53 XSS and JavaScript privilege escalation via session restore
MFSA 2008-52 Crashes with evidence of memory corruption (rv:1.9.0.4/1.8.1.18)
MFSA 2008-51 file: URIs inherit chrome privileges when opened from chrome
MFSA 2008-50 Crash and remote code execution via __proto__ tampering
MFSA 2008-49 Arbitrary code execution via Flash Player dynamic module unloading
MFSA 2008-48 Image stealing via canvas and HTTP redirect
MFSA 2008-47 Information stealing via local shortcut files
MFSA 2008-46 Heap overflow when canceling newsgroup message
MFSA 2008-44 resource: traversal vulnerabilities
MFSA 2008-43 BOM characters stripped from JavaScript before execution
MFSA 2008-42 Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17)
MFSA 2008-41 Privilege escalation via XPCnativeWrapper pollution
MFSA 2008-38 nsXMLDocument::OnChannelRedirect() same-origin violation
MFSA 2008-37 UTF-8 URL stack buffer overflow
CVE reports:
Heap-based buffer overflow in the decodeMP4file function (frontend/main.c) in FAAD2 2.6.1 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted MPEG-4 (MP4) file.
Emacs developers report:
The Emacs command `run-python' launches an interactive Python interpreter. After the Python process starts up, Emacs automatically sends it the line:
import emacs
which normally imports a script named emacs.py which is distributed with Emacs. This script, which is typically located in a write-protected installation directory with other Emacs program files, defines various functions to help the Python process communicate with Emacs.
The vulnerability arises because Python, by default, prepends '' to the module search path, so modules are looked for in the current directory. If the current directory is world-writable, an attacker may insert malicious code by adding a fake Python module named emacs.py into that directory.
Advisory from Moritz Jodeit, November 8th, 2008:
ClamAV contains an off-by-one heap overflow vulnerability in the code responsible for parsing VBA project files. Successful exploitation could allow an attacker to execute arbitrary code with the privileges of the `clamd' process by sending an email with a prepared attachment.
A VBA project file embedded inside an OLE2 office document send as an attachment can trigger the off-by-one.
Entry from Thu Oct 30 13:52:42 CET 2008 (acab) in ChangeLog:
libclamav/vba_extract.c: get_unicode_name off-by-one, bb#1239 reported by Moritz Jodeit >moritz*jodeit.org<
Trac development team reports:
0.11.2 is a new stable maintenance release. It contains several security fixes and everyone is recommended to upgrade their installations.
Bug fixes:
Fixes potential DOS vulnerability with certain wiki markup.
The VLC Team reports:
The VLC media player contains a stack overflow vulnerability while parsing malformed cue files. The vulnerability may be exploited by a (remote) attacker to execute arbitrary code in the context of VLC media player.
Opera reports:
When certain parameters are passed to Opera's History Search, they can cause content not to be correctly sanitized. This can allow scripts to be injected into the History Search results page. Such scripts can then run with elevated privileges and interact with Opera's configuration, allowing them to execute arbitrary code.
The links panel shows links in all frames on the current page, including links with JavaScript URLs. When a page is held in a frame, the script is incorrectly executed on the outermost page, not the page where the URL was located. This can be used to execute scripts in the context of an unrelated frame, which allows cross-site scripting.
Aurelien Jarno reports:
CVE-2008-4539: fix a heap overflow in Cirrus emulation
The code in hw/cirrus_vga.c has changed a lot between CVE-2007-1320 has been announced and the patch has been applied. As a consequence it has wrongly applied and QEMU is still vulnerable to this bug if using VNC.
SecurityFocus reports:
phpMyAdmin is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
Opera reports:
Certain constructs are not escaped correctly by Opera's History Search results. These can be used to inject scripts into the page, which can then be used to look through the user's browsing history, including the contents of the pages they have visited. These may contain sensitive information.
If a link that uses a JavaScript URL triggers Opera's Fast Forward feature, when the user activates Fast Forward, the script should run on the current page. When a page is held in a frame, the script is incorrectly executed on the outermost page, not the page where the URL was located. This can be used to execute scripts in the context of an unrelated frame, which allows cross-site scripting.
When Opera is previewing a news feed, some scripts are not correctly blocked. These scripts are able to subscribe the user to any feed URL that the attacker chooses, and can also view the contents of any feeds that the user is subscribed to. These may contain sensitive information.
CVE reports:
Heap-based buffer overflow in the SPF_dns_resolv_lookup function in Spf_dns_resolv.c in libspf2 before 1.2.8 allows remote attackers to execute arbitrary code via a long DNS TXT record with a modified length field.
Secunia reports:
OpenX can be exploited by malicious people to conduct SQL injection attacks.
Input passed to the "bannerid" parameter in www/delivery/ac.php is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
The Flyspray Project reports:
Flyspray is affected by a Cross Site scripting Vulnerability due to an error escaping PHP's $_SERVER['QUERY_STRING'] superglobal, that can be maliciously used to inject arbitrary code into the savesearch() javascript function.
There is an XSS problem in the history tab, the application fails to sanitize the "details" parameter correctly, leading to the possibility of arbitrary code injection into the getHistory() javascript function.
Flyspray is affected by a Cross Site scripting Vulnerability due missing escaping of SQL error messages. By including HTML code in a query and at the same time causing it to fail by submitting invalid data, an XSS hole can be exploited.
There is an XSS problem in the task history attached to comments, since the application fails to sanitize the old_value and new_value database fields for changed task summaries.
Input passed via the "item_summary" parameter to "index.php?do=details" is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
The Wordpress development team reports:
A vulnerability in the Snoopy library was announced today. WordPress uses Snoopy to fetch the feeds shown in the Dashboard. Although this seems to be a low risk vulnerability for WordPress users, we wanted to get an update out immediately.
The Drupal Project reports:
On a server configured for IP-based virtual hosts, Drupal may be caused to include and execute specifically named files outside of its root directory. This bug affects both Drupal 5 and Drupal 6.
The title of book pages is not always properly escaped, enabling users with the "create book content" permission or the permission to edit any node in the book hierarchy to insert arbitrary HTML and script code into pages. Such a Cross site scripting attack may lead to the attacker gaining administrator access. This bug affects Drupal 6.
xine team reports:
A new xine-lib version is now available. This release contains some security fixes, notably a DoS via corrupted Ogg files (CVE-2008-3231), some related fixes, and fixes for a few possible buffer overflows.
Adobe Product Security Incident Response Team reports:
Potential vulnerabilities have been identified in Adobe Flash Player 9.0.124.0 and earlier that could allow an attacker who successfully exploits these potential vulnerabilities to bypass Flash Player security controls. Adobe recommends users update to the most current version of Flash Player available for their platform.
Secunia reports:
Two vulnerabilities have been reported in Libxml2, which can be exploited by malicious people to cause a DoS (Denial of Service) or potentially compromise an application using the library.
1) A recursion error exists when processing certain XML content. This can be exploited to e.g. exhaust all available memory and CPU resources by tricking an application using Libxml2 into processing specially crafted XML documents.
2) A boundary error in the processing of long XML entity names in parser.c can be exploited to cause a heap-based buffer overflow when specially crafted XML content is parsed.
Successful exploitation may allow execution of arbitrary code.
The Drupal Project reports:
A logic error in the core upload module validation allowed unprivileged users to attach files to content. Users can view files attached to content which they do not otherwise have access to. If the core upload module is not enabled, your site will not be affected.
A deficiency in the user module allowed users who had been blocked by access rules to continue logging into the site under certain conditions. If you do not use the 'access rules' functionality in core, your site will not be affected.
The BlogAPI module does not implement correct validation for certain content fields, allowing for values to be set for fields which would otherwise be inaccessible on an internal Drupal form. We have hardened these checks in BlogAPI module for this release, but the security team would like to re-iterate that the 'Administer content with BlogAPI' permission should only be given to trusted users. If the core BlogAPI module is not enabled, your site will not be affected.
A weakness in the node module API allowed for node validation to be bypassed in certain circumstances for contributed modules implementing the API. Additional checks have been added to ensure that validation is performed in all cases. This vulnerability only affects sites using one of a very small number of contributed modules, all of which will continue to work correctly with the improved API. None of them were found vulnerable, so our correction is a preventative measure.
The release note of cups 1.3.9 reports:
It contains the following fixes:
- SECURITY: The HP-GL/2 filter did not range check pen numbers (STR #2911)
- SECURITY: The SGI image file reader did not range check 16-bit run lengths (STR #2918)
- SECURITY: The text filter did not range check cpi, lpi, or column values (STR #2919)
Exploitation of this vulnerability results in the execution of arbitrary code with the privileges of the affected service.
Opera reports:
If a malicious page redirects Opera to a specially crafted address (URL), it can cause Opera to crash. Given sufficient address content, the crash could cause execution of code controlled by the attacking page.
Once a Java applet has been cached, if a page can predict the cache path for that applet, it can load the applet from the cache, causing it to run in the context of the local machine. This allows it to read other cache files on the computer or perform other normally more restrictive actions. These files could contain sensitive information, which could then be sent to the attacker.
Thomas Henlich reports:
The mysql command-line client does not quote HTML special characters like < in its output. This allows an attacker who is able to write data into a table to hide or modify records in the output, and to inject potentially dangerous code, e. g. Javascript to perform cross-site scripting or cross-site request forgery attacks.
The oCERT team reports:
The MPlayer multimedia player suffers from a vulnerability which could result in arbitrary code execution and at the least, in unexpected process termination. Three integer underflows located in the Real demuxer code can be used to exploit a heap overflow, a specific video file can be crafted in order to make the stream_read function reading or writing arbitrary amounts of memory.
Lighttpd seurity annoucement:
lighttpd 1.4.19, and possibly other versions before 1.5.0, does not decode the url before matching against rewrite and redirect patterns, which allows attackers to bypass rewrites rules. this can be a security problem in certain configurations if these rules are used to hide certain urls.
lighttpd 1.4.19, and possibly other versions before 1.5.0, does not lowercase the filename after generating it from the url in mod_userdir on case insensitive (file)systems.
As other modules are case sensitive, this may lead to information disclosure; for example if one configured php to handle files ending on ".php", an attacker will get the php source with http://example.com/~user/file.PHP
lighttpd 1.4.19 does not always release a header if it triggered a 400 (Bad Request) due to a duplicate header.
Secunia reports:
Some security issues have been reported in BitlBee, which can be exploited by malicious people to bypass certain security restrictions and hijack accounts.
The security issues are caused due to unspecified errors, which can be exploited to overwrite existing accounts.
The Mozilla Foundation reports:
MFSA 2008-37
UTF-8 URL stack buffer overflowMFSA 2008-38
nsXMLDocument::OnChannelRedirect() same-origin violationMFSA 2008-39
Privilege escalation using feed preview page and XSS flawMFSA 2008-40
Forced mouse dragMFSA 2008-41
Privilege escalation via XPCnativeWrapper pollutionMFSA 2008-42
Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17)MFSA 2008-43
BOM characters stripped from JavaScript before executionMFSA 2008-44
resource: traversal vulnerabilitiesMFSA 2008-45
XBM image uninitialized memory reading
Hanno Boeck reports:
When configuring a web application to use only ssl (e.g. by forwarding all http-requests to https), a user would expect that sniffing and hijacking the session is impossible.
Though, for this to be secure, one needs to set the session cookie to have the secure flag. Otherwise the cookie will be transferred through HTTP if the victim's browser does a single HTTP request on the same domain.
Squirrelmail does not set that flag. It is fixed in the 1.5 test versions, but current 1.4.15 is vulnerable.
Secunia reports:
The vulnerability is caused due to the application truncating an overly long FTP command, and improperly interpreting the remainder string as a new FTP command. This can be exploited to execute arbitrary FTP commands with the privileges of another user by e.g. tricking the user into following malicious link.
Secunia reports:
An error exists in the "PMA_escapeJsString()" function in libraries/js_escape.lib.php, which can be exploited to bypass certain filters and execute arbitrary HTML and script code in a user's browser session in context of an affected site when e.g. Microsoft Internet Explorer is used.
Secunia reports:
An error in the handing of ZIP archives with symbolic links can be exploited to disclose the contents of arbitrary files.
Input from uploaded Flash animations is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which is executed in a user's browser session in context of an affected site when the malicious data is viewed.
A phpMyAdmin security announcement:
The server_databases.php script was vulnerable to an attack coming from a user who is already logged-on to phpMyAdmin, where he can execute shell code (if the PHP configuration permits commands like exec).
Th1nk3r reports:
The version of TWiki installed on the remote host allows access to the 'configure' script and fails to sanitize the 'image' parameter of that script of directory traversal sequences before returning the file contents when the 'action' parameter is set to 'image'. An unauthenticated attacker can leverage this issue to view arbitrary files on the remote host subject to the privileges of the web server user id. .
Joe Orton reports:
A NULL pointer deference in the Digest authentication support in neon versions 0.28.0 through 0.28.2 inclusive allows a malicious server to crash a client application, resulting in possible denial of service.
Hanno Boeck reports:
A fuzzing test showed weakness in the chm parser of clamav, which can possibly be exploited. The clamav team has disabled the chm module in older versions though freshclam updates and has released 0.94 with a fixed parser.
Secunia reports:
Some vulnerabilities have been reported in various Horde products, which can be exploited by malicious people to conduct script insertion attacks
Input via MIME attachment linking is not properly sanitised in the MIME library before being used. This can be exploited to execute arbitrary HTML and script code in a user's browser session if e.g. a malicious email is viewed.
Certain unspecified input in HTML messages is not properly sanitised before being used. This can be exploited to execute arbitrary HTML and script in a user's browser session if e.g. a malicious HTML email is viewed.
Secunia reports:
Some vulnerabilities have been reported in Python, where some have unknown impact and others can potentially be exploited by malicious people to cause a DoS (Denial of Service) or to compromise a vulnerable system.
Various integer overflow errors exist in core modules e.g. stringobject, unicodeobject, bufferobject, longobject, tupleobject, stropmodule, gcmodule, mmapmodule.
An integer overflow in the hashlib module can lead to an unreliable cryptographic digest results.
Integer overflow errors in the processing of unicode strings can be exploited to cause buffer overflows on 32-bit systems.
An integer overflow exists in the PyOS_vsnprintf() function on architectures that do not have a "vsnprintf()" function.
An integer underflow error in the PyOS_vsnprintf() function when passing zero-length strings can lead to memory corruption.
SecurityFocus reports:
MySQL is prone to a security-bypass vulnerability. An attacker can exploit this issue to overwrite existing table files in the MySQL data directory, bypassing certain security restrictions.
Jonathan Weiss reports, that it is possible to perform an SQL injection in Rails applications via not correctly sanitized :limit and :offset parameters. It is possible to change arbitrary values in affected tables or gain access to the sensitive data.
The Wordpress development team reports:
With open registration enabled, it is possible in WordPress versions 2.6.1 and earlier to craft a username such that it will allow resetting another users password to a randomly generated password. The randomly generated password is not disclosed to the attacker, so this problem by itself is annoying but not a security exploit. However, this attack coupled with a weakness in the random number seeding in mt_rand() could be used to predict the randomly generated password.
In case of an incoming ICMPv6 'Packet Too Big Message', there is an insufficient check on the proposed new MTU for a path to the destination.
When the kernel is configured to process IPv6 packets and has active IPv6 TCP sockets, a specifically crafted ICMPv6 'Packet Too Big Message' could cause the TCP stack of the kernel to panic.
Systems without INET6 / IPv6 support are not vulnerable and neither are systems which do not listen on any IPv6 TCP sockets and have no active IPv6 connections.
Filter ICMPv6 'Packet Too Big Messages' using a firewall, but this will at the same time break PMTU support for IPv6 connections.
Various user defined input such as mount points, devices, and mount options are prepared and passed as arguments to nmount(2) into the kernel. Under certain error conditions, user defined data will be copied into a stack allocated buffer stored in the kernel without sufficient bounds checking.
If the system is configured to allow unprivileged users to mount file systems, it is possible for a local adversary to exploit this vulnerability and execute code in the context of the kernel.
It is possible to work around this issue by allowing only privileged users to mount file systems by running the following sysctl(8) command:
# sysctl vfs.usermount=0
If a General Protection Fault happens on a FreeBSD/amd64 system while it is returning from an interrupt, trap or system call, the swapgs CPU instruction may be called one extra time when it should not resulting in userland and kernel state being mixed.
A local attacker can by causing a General Protection Fault while the kernel is returning from an interrupt, trap or system call while manipulating stack frames and, run arbitrary code with kernel privileges.
The vulnerability can be used to gain kernel / supervisor privilege. This can for example be used by normal users to gain root privileges, to break out of jails, or bypass Mandatory Access Control (MAC) restrictions.
No workaround is available, but only systems running the 64 bit FreeBSD/amd64 kernels are vulnerable.
Systems with 64 bit capable CPUs, but running the 32 bit FreeBSD/i386 kernel are not vulnerable.
The Opera Team reports:
Scripts are able to change the addresses of framed pages that come from the same site. Due to a flaw in the way that Opera checks what frames can be changed, a site can change the address of frames on other sites inside any window that it has opened. This allows sites to open pages from other sites, and display misleading information on them.
Custom shortcut and menu commands can be used to activate external applications. In some cases, the parameters passed to these applications are not prepared correctly, and may be created from uninitialized memory. These may be misinterpreted as additional parameters, and depending on the application, this could allow execution of arbitrary code.
Successful exploitation requires convincing the user to modify their shortcuts or menu files appropriately, pointing to an appropriate target application, then to activate that shortcut at an appropriate time. To inject code, additional means will have to be employed.
When insecure pages load content from secure sites into a frame, they can cause Opera to incorrectly report the insecure site as being secure. The padlock icon will incorrectly be shown, and the security information dialog will state that the connection is secure, but without any certificate information.
As a security precaution, Opera does not allow Web pages to link to files on the user's local disk. However, a flaw exists that allows Web pages to link to feed source files on the user's computer. Suitable detection of JavaScript events and appropriate manipulation can unreliably allow a script to detect the difference between successful and unsuccessful subscriptions to these files, to allow it to discover if the file exists or not. In most cases the attempt will fail.
It has been reported that when a user subscribes to a news feed using the feed subscription button, the page address can be changed. This causes the address field not to update correctly. Although this can mean that misleading information can be displayed in the address field, it can only leave the attacking page's address in the address bar, not a trusted third party address.
Secunia reports:
A vulnerability has been reported in GnuTLS, which can potentially be exploited by malicious people to cause a DoS (Denial of Service).
The vulnerability is caused due to a use-after-free error when an application calls "gnutls_handshake()" for an already valid session and can potentially be exploited, e.g. during re-handshakes.
Joomla project reports:
A flaw in the reset token validation mechanism allows for non-validating tokens to be forged. This will allow an unauthenticated, unauthorized user to reset the password of the first enabled user (lowest id). Typically, this is an administrator user. Note, that changing the first users username may lessen the impact of this exploit (since the person who changed the password does not know the login associated with the new password). However, the only way to completely rectify the issue is to upgrade to 1.5.6 (or patch the /components/com_user/models/reset.php file).
NASA Goddard Space Flight Center reports:
The libraries for the scientific data file format, Common Data Format (CDF) version 3.2 and earlier, have the potential for a buffer overflow vulnerability when reading specially-crafted (invalid) CDF files. If successful, this could trigger execution of arbitrary code within the context of the CDF-reading program that could be exploited to compromise a system, or otherwise crash the program. While it's unlikely that you would open CDFs from untrusted sources, we recommend everyone upgrade to the latest CDF libraries on their systems, including the IDL and Matlab plugins. Most worrisome is any service that enables the general public to submit CDF files for processing.
The vulnerability is in the CDF library routines not properly checking the length tags on a CDF file before copying data to a stack buffer. Exploitation requires the user to explicitly open a specially-crafted file. CDF users should not open files from untrusted third parties until the patch is applied (and continue then to exercise normal caution for files from untrusted third parties).
The Drupal Project reports:
A bug in the output filter employed by Drupal makes it possible for malicious users to insert script code into pages (cross site scripting or XSS). A bug in the private filesystem trusts the MIME type sent by the browser, enabling malicious users with the ability to upload files to execute cross site scripting attacks.
The BlogAPI module does not validate the extension of uploaded files, enabling users with the "administer content with blog api" permission to upload harmful files. This bug affects both Drupal 5.x and 6.x.
Drupal forms contain a token to protect against cross site request forgeries (CSRF). The token may not be validated properly for cached forms and forms containing AHAH elements. This bug affects Drupal 6.x.
User access rules can be added or deleted upon accessing a properly formatted URL, making such modifications vulnerable to cross site request forgeries (CSRF). This may lead to unintended addition or deletion of an access rule when a sufficiently privileged user visits a page or site created by a malicious person. This bug affects both Drupal 5.x and 6.x.
The Upload module in Drupal 6 contains privilege escalation vulnerabilities for users with the "upload files" permission. This can lead to users being able to edit nodes which they are normally not allowed to, delete any file to which the webserver has sufficient rights, and download attachments of nodes to which they have no access. Harmful files may also be uploaded via cross site request forgeries (CSRF). These bugs affect Drupal 6.x.
The official ruby site reports:
Several vulnerabilities in safe level have been discovereds:.
- untrace_var is permitted at safe level 4;
- $PROGRAM_NAME may be modified at safe level 4;
- insecure methods may be called at safe level 1-3;
- syslog operations are permitted at safe level 4;
- dl doesn't check taintness, so it could allow attackers to call dangerous functions.
The official ruby site reports:
WEBrick::HTTP::DefaultFileHandler is faulty of exponential time taking requests due to a backtracking regular expression in WEBrick::HTTPUtils.split_header_value.
The official ruby site reports:
resolv.rb allow remote attackers to spoof DNS answers. This risk can be reduced by randomness of DNS transaction IDs and source ports.
A Bugzilla Security Advisory reports:
When importing bugs using importxml.pl, the --attach_path option can be specified, pointing to the directory where attachments to import are stored. If the XML file being read by importxml.pl contains a malicious
../relative_path/to/local_filenode, the script follows this relative path and attaches the local file pointed by it to the bug, making the file public. The security fix makes sure the relative path is always ignored.
James Yonan reports:
Security Fix - affects non-Windows OpenVPN clients running OpenVPN 2.1-beta14 through 2.1-rc8 (OpenVPN 2.0.x clients are NOT vulnerable nor are any versions of the OpenVPN server vulnerable).
An OpenVPN client connecting to a malicious or compromised server could potentially receive an "lladdr" or "iproute" configuration directive from the server which could cause arbitrary code execution on the client. A successful attack requires that (a) the client has agreed to allow the server to push configuration directives to it by including "pull" or the macro "client" in its configuration file, (b) the client succesfully authenticates the server, (c) the server is malicious or has been compromised and is under the control of the attacker, and (d) the client is running a non-Windows OS.
A phpMyAdmin security announcement:
A logged-in user, if abused into clicking a crafted link or loading an attack page, would create a database he did not intend to, or would change his connection character set.
The Drupal Project reports:
Free tagging taxonomy terms can be used to insert arbitrary script and HTML code (cross site scripting or XSS) on node preview pages. A successful exploit requires that the victim selects a term containing script code and chooses to preview the node. This issue affects Drupal 6.x only. Some values from OpenID providers are output without being properly escaped, allowing malicious providers to insert arbitrary script and HTML code (XSS) into user pages. This issue affects Drupal 6.x only. filter_xss_admin() has been hardened to prevent use of the object HTML tag in administrator input.
Translated strings (5.x, 6.x) and OpenID identities (6.x) are immediately deleted upon accessing a properly formatted URL, making such deletion vulnerable to cross site request forgeries (CSRF). This may lead to unintended deletion of translated strings or OpenID identities when a sufficiently privileged user visits a page or site created by a malicious person.
When contributed modules such as Workflow NG terminate the current request during a login event, user module is not able to regenerate the user's session. This may lead to a session fixation attack, when a malicious user is able to control another users' initial session ID. As the session is not regenerated, the malicious user may use the 'fixed' session ID after the victim authenticates and will have the same access. This issue affects both Drupal 5 and Drupal 6.
Schema API uses an inappropriate placeholder for 'numeric' fields enabling SQL injection when user-supplied data is used for such fields.This issue affects Drupal 6 only.
The BIND DNS implementation does not randomize the UDP source port when doing remote queries, and the query id alone does not provide adequate randomization.
The lack of source port randomization reduces the amount of data the attacker needs to guess in order to successfully execute a DNS cache poisoning attack. This allows the attacker to influence or control the results of DNS queries being returned to users from target systems.
Limiting the group of machines that can do recursive queries on the DNS server will make it more difficult, but not impossible, for this vulnerability to be exploited.
To limit the machines able to perform recursive queries, add an ACL in named.conf and limit recursion like the following:
acl example-acl {
192.0.2.0/24;
};
options {
recursion yes;
allow-recursion { example-acl; };
};
Felipe Andres Manzano reports:
The libpoppler pdf rendering library, can free uninitialized pointers, leading to arbitrary code execution. This vulnerability results from memory management bugs in the Page class constructor/destructor.
Pylons team reports:
The error.py controller uses paste.fileapp to serve the static resources to the browser. The default error.py controller uses os.path.join to combine the id from Routes with the media path. Routes prior to 1.8 double unquoted the PATH_INFO, resulting in FileApp returning files from the filesystem that can be outside of the intended media path directory.
An attacker can craft URL's which utilize the double escaping to pass in a name to the error.py controller which contains a leading slash thus escaping the intended media path and serving files from any location on the filesystem that the Pylons application has access to.
Secunia reports:
- An integer overflow error exists in the processing of PFB font files. This can be exploited to cause a heap-based buffer overflow via a PFB file containing a specially crafted "Private" dictionary table.
- An error in the processing of PFB font files can be exploited to trigger the "free()" of memory areas that are not allocated on the heap.
- An off-by-one error exists in the processing of PFB font files. This can be exploited to cause a one-byte heap-based buffer overflow via a specially crafted PFB file.
- An off-by-one error exists in the implementation of the "SHC" instruction while processing TTF files. This can be exploited to cause a one-byte heap-based buffer overflow via a specially crafted TTF file.
Successful exploitation of the vulnerabilities may allow execution of arbitrary code.
Matthias Andree reports:
2008-06-24 1.2 also fixed issue in report_complete (reported by Petr Uzel)
Secunia report:
Some vulnerabilities have been reported in phpMyAdmin, which can be exploited by malicious people to conduct cross-site scripting attacks.
Input passed via unspecified parameters to files in /libraries is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
Successful exploitation requires that "register_globals" is enabled and support for ".htaccess" files is disabled.
Apache HTTP server project reports:
The following potential security flaws are addressed:
- CVE-2008-2364: mod_proxy_http: Better handling of excessive interim responses from origin server to prevent potential denial of service and high memory usage. Reported by Ryujiro Shibuya.
- CVE-2007-6420: mod_proxy_balancer: Prevent CSRF attacks against the balancer-manager interface
According to Maksymilian Arciemowicz research,
it is possible to bypass security restrictions
of safe_mode
in various
functions via directory traversal vulnerability. The attacker
can use this attack to gain access to sensitive
information. Functions utilizing
expand_filepath()
may be affected.
It should be noted that this vulnerability is not
considered to be serious by the FreeBSD Security Team,
since safe_mode
and open_basedir
are insecure by design and should not be relied upon.
Rdancer.org reports:
Improper quoting in some parts of Vim written in the Vim Script can lead to arbitrary code execution upon opening a crafted file.
The official ruby site reports:
Multiple vulnerabilities in Ruby may lead to a denial of service (DoS) condition or allow execution of arbitrary code.
Matthias Andree reports:
Gunter Nau reported fetchmail crashing on some messages; further debugging by Petr Uzel and Petr Cerny at Novell/SUSE Czech Republic dug up that this happened when fetchmail was trying to print, in -v -v verbose level, headers exceeding 2048 bytes. In this situation, fetchmail would resize the buffer and fill in further parts of the message, but forget to reinitialize its va_list typed source pointer, thus reading data from a garbage address found on the stack at addresses above the function arguments the caller passed in; usually that would be the caller's stack frame.
Matthieu Herrb of X.Org reports:
Several vulnerabilities have been found in the server-side code of some extensions in the X Window System. Improper validation of client-provided data can cause data corruption.
Exploiting these overflows will crash the X server or, under certain circumstances allow the execution of arbitray machine code.
When the X server is running with root privileges (which is the case for the Xorg server and for most kdrive based servers), these vulnerabilities can thus also be used to raise privileges.
All these vulnerabilities, to be exploited successfully, require either an already established connection to a running X server (and normally running X servers are only accepting authenticated connections), or a shell access with a valid user on the machine where the vulnerable server is installed.
MoinMoin team reports:
A check in the userform processing was not working as expected and could be abused for ACL and superuser privilege escalation.
Secunia reports:
A vulnerability has been reported in the Courier Authentication Library, which can be exploited by malicious people to conduct SQL injection attacks.
Input passed via e.g. the username to the library is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code and e.g. potentially bypass authentication.
Successful exploitation requires that a MySQL database is used for authentication and that a Non-Latin character set is selected.