Index: head/security/vuxml/vuln.xml =================================================================== --- head/security/vuxml/vuln.xml (revision 444983) +++ head/security/vuxml/vuln.xml (revision 444984) @@ -1,65595 +1,65630 @@ + + Dropbear -- two vulnerabilities + + + dropbear + 2017.75 + + + + +

Matt Johnston reports:

+
Fix double-free in server TCP listener cleanup A double-free in + the server could be triggered by an authenticated user if dropbear + is running with -a (Allow connections to forwarded ports from any + host) This could potentially allow arbitrary code execution as root + by an authenticated user.
+
Fix information disclosure with ~/.ssh/authorized_keys symlink. + Dropbear parsed authorized_keys as root, even if it were a symlink. + The fix is to switch to user permissions when opening authorized_keys. +
+

+ + + + https://matt.ucc.asn.au/dropbear/CHANGES + CVE-2017-9078 + CVE-2017-9079 + + + 2017-05-18 + 2017-07-03 + + + smarty3 -- shell injection in math smarty3 3.1.30

The smarty project reports:

bugfix {math} shell injection vulnerability

https://github.com/smarty-php/smarty/blob/v3.1.30/change_log.txt 2016-07-19 2017-07-03 libgcrypt -- side-channel attack on RSA secret keys libgcrypt 1.7.8

GnuPG reports:

Mitigate a flush+reload side-channel attack on RSA secret keys dubbed "Sliding right into disaster".

CVE-2017-7526 https://lists.gnupg.org/pipermail/gnupg-announce/2017q2/000408.html 2017-06-29 2017-06-30 GitLab -- Various security issues gitlab 4.0.09.0.9 9.1.09.1.6 9.2.09.2.4

GitLab reports:

Cross-Site Scripting (XSS) vulnerability when editing comments

A GitLab.com user reported that recent changes to Markdown rendering designed to improve performance by allowing comments to be rendered client-side opened a persistent Cross-Site Scripting (XSS) vulnerability when comments are edited and then re-saved. This vulnerability is difficult to exploit because a victim must be tricked into editing and then saving another user's comment.

API vulnerable to embedding in iFrames using Session Auth

A tip from a Twitter user led to an internal code audit that discovered a malicious website could embed a GitLab API URL inside an iFrame, possibly tricking a user into thinking that the website had access to the user's GitLab user information. This attack would not disclose the user's data to the malicious website, but it could cause confusion and the API has added an X-Frame-Options header to prevent content from the API being included in iFrames.

Accidental or malicious use of reserved names in group names could cause deletion of all project avatars

A GitLab.com user reported that creating a group named project and then renaming the group would cause all project avatars to be deleted. This was due to an improperly constructed path variable when renaming files. To help prevent this from happening again all avatar uploads have been moved from /public/uploads/(user|group|project) to /public/uploads/system/(user|group|project) and system has been made a reserved namespace. A migration included with this release will rename any existing top-level system namespace to be system0 (or system1, system2, etc.)

Unauthenticated disclosure of usernames in autocomplete controller

HackerOne reporter Evelyn Lee reported that usernames could be enumerated using the autocomplete/users.json endpoint without authenticating. This could allow an unauthenticated attacker to gather a list of all valid usernames from a GitLab instance.

Information leakage with references to private project snippets

GitLab.com user Patrick Fiedler reported that titles of private project snippets could leak when they were referenced in other issues, merge requests, or comments.

Elasticsearch does not implement external user checks correctly

An internal code review discovered that on instances with Elasticsearch enabled GitLab allowed external users to view internal project data. This could unintentionally expose sensitive information to external users. This vulnerability only affects EE installations with Elasticsearch enabled.

https://about.gitlab.com/2017/06/07/gitlab-9-dot-2-dot-5-security-release/ 2017-06-07 2017-06-30 tor -- security regression tor 0.3.0.9 tor-devel 0.3.1.4.a

The Tor Project reports:

Tor 0.3.0.9 fixes a path selection bug that would allow a client to use a guard that was in the same network family as a chosen exit relay. This is a security regression; all clients running earlier versions of 0.3.0.x or 0.3.1.x should upgrade to 0.3.0.9 or 0.3.1.4-alpha.

https://blog.torproject.org/blog/tor-0309-released-security-update-clients https://blog.torproject.org/blog/tor-0314-alpha-released-security-update-clients https://lists.torproject.org/pipermail/tor-announce/2017-June/000133.html CVE-2017-0377 2017-06-29 2017-06-30 exim -- Privilege escalation via multiple memory leaks exim 4.89_1

Qualsys reports:

Exim supports the use of multiple "-p" command line arguments which are malloc()'ed and never free()'ed, used in conjunction with other issues allows attackers to cause arbitrary code execution. This affects exim version 4.89 and earlier. Please note that at this time upstream has released a patch (commit 65e061b76867a9ea7aeeb535341b790b90ae6c21), but it is not known if a new point release is available that addresses this issue at this time.

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000369 2017-06-19 2017-06-21 pear-Horde_Image -- DoS vulnerability pear-Horde_Image 2.3.02.5.0

Michael J Rubinsky reports:

The second vulnerability (CVE-2017-9773) is a DOS vulnerability. This only affects Horde installations that do not have a configured image handling backend, and thus use the "Null" image driver. It is exploitable by a logged in user clicking on a maliciously crafted URL.

https://lists.horde.org/archives/announce/2017/001234.html CVE-2017-9773 2017-06-21 2017-06-21 pear-Horde_Image -- remote code execution vulnerability pear-Horde_Image 2.0.02.5.0

Michael J Rubinsky reports:

The fist vulnerability (CVE-2017-9774) is a Remote Code Execution vulnerability and is exploitable by a logged in user sending a maliciously crafted GET request to the Horde server.

https://lists.horde.org/archives/announce/2017/001234.html CVE-2017-9774 2017-06-21 2017-06-21 OpenVPN -- several vulnerabilities openvpn 2.3.17 2.4.02.4.3 openvpn-mbedtls 2.4.3 openvpn-polarssl 2.3.17

Samuli Seppänen reports:

In May/June 2017 Guido Vranken threw a fuzzer at OpenVPN 2.4.2. In the process he found several vulnerabilities and reported them to the OpenVPN project. [...] The first releases to have these fixes are OpenVPN 2.4.3 and 2.3.17.

This is a list of fixed important vulnerabilities:

Remotely-triggerable ASSERT() on malformed IPv6 packet

Pre-authentication remote crash/information disclosure for clients

Potential double-free in --x509-alt-username

Remote-triggerable memory leaks

Post-authentication remote DoS when using the --x509-track option

Null-pointer dereference in establish_http_proxy_passthru()

https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243 CVE-2017-7508 CVE-2017-7512 CVE-2017-7520 CVE-2017-7521 CVE-2017-7522 2017-05-19 2017-06-21 Apache httpd -- several vulnerabilities apache22 2.2.33 apache24 2.4.26

The Apache httpd project reports:

ap_get_basic_auth_pw() Authentication Bypass (CVE-2017-3167):
Use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed.

mod_ssl Null Pointer Dereference (CVE-2017-3169):
mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port.

mod_http2 Null Pointer Dereference (CVE-2017-7659):
A maliciously constructed HTTP/2 request could cause mod_http2 to dereference a NULL pointer and crash the server process.

ap_find_token() Buffer Overread (CVE-2017-7668):
The HTTP strict parsing changes added in 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input string. By maliciously crafting a sequence of request headers, an attacker may be able to cause a segmentation fault, or to force ap_find_token() to return an incorrect value.

mod_mime Buffer Overread (CVE-2017-7679):
mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response header.

https://httpd.apache.org/security/vulnerabilities_24.html https://httpd.apache.org/security/vulnerabilities_22.html CVE-2017-3167 CVE-2017-3169 CVE-2017-7659 CVE-2017-7668 CVE-2017-7679 2017-06-20 2017-06-20 chromium -- multiple vulnerabilities chromium chromium-pulse 59.0.3071.104

Google Chrome releaseses reports:

5 security fixes in this release, including:

[725032] High CVE-2017-5087: Sandbox Escape in IndexedDB. Reported by Ned Williamson on 2017-05-22

[729991] High CVE-2017-5088: Out of bounds read in V8. Reported by Xiling Gong of Tencent Security Platform Department on 2017-06-06

[714196] Medium CVE-2017-5089: Domain spoofing in Omnibox. Reported by Michal Bentkowski on 2017-04-21

[732498] Various fixes from internal audits, fuzzing and other initiatives

CVE-2017-5087 CVE-2017-5088 CVE-2017-5089 https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop_15.html 2017-06-15 2017-06-16 cURL -- URL file scheme drive letter buffer overflow curl 7.53.07.54.1

cURL security advisory:

When libcurl is given either

1. a file: URL that doesn't use two slashes following the colon, or

2. is told that file is the default scheme to use for URLs without scheme

... and the given path starts with a drive letter and libcurl is built for Windows or DOS, then libcurl would copy the path with a wrong offset, so that the end of the given path would write beyond the malloc buffer. Up to seven bytes too much.

We are not aware of any exploit of this flaw.

CVE-2017-9502 https://curl.haxx.se/docs/adv_20170614.html 2017-06-14 2017-06-15 rt and dependent modules -- multiple security vulnerabilities rt42 4.2.04.2.13_1 rt44 4.4.04.4.1_1 p5-RT-Authen-ExternalAuth 0.90.27

BestPractical reports:

RT 4.0.0 and above are vulnerable to an information leak of cross-site request forgery (CSRF) verification tokens if a user visits a specific URL crafted by an attacker. This vulnerability is assigned CVE-2017-5943. It was discovered by a third-party security researcher.

RT 4.0.0 and above are vulnerable to a cross-site scripting (XSS) attack if an attacker uploads a malicious file with a certain content type. Installations which use the AlwaysDownloadAttachments config setting are unaffected. This fix addresses all existant and future uploaded attachments. This vulnerability is assigned CVE-2016-6127. This was responsibly disclosed to us first by Scott Russo and the GE Application Security Assessment Team.

One of RT's dependencies, a Perl module named Email::Address, has a denial of service vulnerability which could induce a denial of service of RT itself. We recommend administrators install Email::Address version 1.908 or above, though we additionally provide a new workaround within RT. Tss vulnerability was assigned CVE-2015-7686. This vulnerability's application to RT was brought to our attention by Pali Rohár.

RT 4.0.0 and above are vulnerable to timing side-channel attacks for user passwords. By carefully measuring millions or billions of login attempts, an attacker could crack a user's password even over the internet. RT now uses a constant-time comparison algorithm for secrets to thwart such attacks. This vulnerability is assigned CVE-2017-5361. This was responsibly disclosed to us by Aaron Kondziela.

RT's ExternalAuth feature is vulnerable to a similar timing side-channel attack. Both RT 4.0/4.2 with the widely-deployed RT::Authen::ExternalAuth extension, as well as the core ExternalAuth feature in RT 4.4 are vulnerable. Installations which don't use ExternalAuth, or which use ExternalAuth for LDAP/ActiveDirectory authentication, or which use ExternalAuth for cookie-based authentication, are unaffected. Only ExternalAuth in DBI (database) mode is vulnerable.

RT 4.0.0 and above are potentially vulnerable to a remote code execution attack in the dashboard subscription interface. A privileged attacker can cause unexpected code to be executed through carefully-crafted saved search names. Though we have not been able to demonstrate an actual attack owing to other defenses in place, it could be possible. This fix addresses all existant and future saved searches. This vulnerability is assigned CVE-2017-5944. It was discovered by an internal security audit.

RT 4.0.0 and above have misleading documentation which could reduce system security. The RestrictLoginReferrer config setting (which has security implications) was inconsistent with its implementation, which checked for a slightly different variable name. RT will now check for the incorrect name and produce an error message. This was responsibly disclosed to us by Alex Vandiver.

http://lists.bestpractical.com/pipermail/rt-announce/2017-June/000297.html CVE-2015-7686 CVE-2016-6127 CVE-2017-5361 CVE-2017-5943 CVE-2017-5944 2017-06-15 2017-06-15 Flash Player -- multiple vulnerabilities linux-flashplayer 26.0.0.126

Adobe reports:

These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2017-3075, CVE-2017-3081, CVE-2017-3083, CVE-2017-3084).

These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2017-3076, CVE-2017-3077, CVE-2017-3078, CVE-2017-3079, CVE-2017-3082).

CVE-2017-3075 CVE-2017-3076 CVE-2017-3077 CVE-2017-3078 CVE-2017-3079 CVE-2017-3081 CVE-2017-3082 CVE-2017-3083 CVE-2017-3084 https://helpx.adobe.com/security/products/flash-player/apsb17-17.html 2017-06-13 2017-06-15 mozilla -- multiple vulnerabilities firefox 54.0,1 seamonkey linux-seamonkey 2.51 firefox-esr 52.2.0,1 linux-firefox 52.2.0,2 libxul thunderbird linux-thunderbird 52.2.0

Mozilla Foundation reports:

CVE-2017-5472: Use-after-free using destroyed node when regenerating trees

CVE-2017-7749: Use-after-free during docshell reloading

CVE-2017-7750: Use-after-free with track elements

CVE-2017-7751: Use-after-free with content viewer listeners

CVE-2017-7752: Use-after-free with IME input

CVE-2017-7754: Out-of-bounds read in WebGL with ImageInfo object

CVE-2017-7755: Privilege escalation through Firefox Installer with same directory DLL files

CVE-2017-7756: Use-after-free and use-after-scope logging XHR header errors

CVE-2017-7757: Use-after-free in IndexedDB

CVE-2017-7778: Vulnerabilities in the Graphite 2 library

CVE-2017-7758: Out-of-bounds read in Opus encoder

CVE-2017-7759: Android intent URLs can cause navigation to local file system

CVE-2017-7760: File manipulation and privilege escalation via callback parameter in Mozilla Windows Updater and Maintenance Service

CVE-2017-7761: File deletion and privilege escalation through Mozilla Maintenance Service helper.exe application

CVE-2017-7762: Addressbar spoofing in Reader mode

CVE-2017-7763: Mac fonts render some unicode characters as spaces

CVE-2017-7764: Domain spoofing with combination of Canadian Syllabics and other unicode blocks

CVE-2017-7765: Mark of the Web bypass when saving executable files

CVE-2017-7766: File execution and privilege escalation through updater.ini, Mozilla Windows Updater, and Mozilla Maintenance Service

CVE-2017-7767: Privilege escalation and arbitrary file overwrites through Mozilla Windows Updater and Mozilla Maintenance Service

CVE-2017-7768: 32 byte arbitrary file read through Mozilla Maintenance Service

CVE-2017-5471: Memory safety bugs fixed in Firefox 54

CVE-2017-5470: Memory safety bugs fixed in Firefox 54 and Firefox ESR 52.2

CVE-2017-5470 CVE-2017-5471 CVE-2017-5472 CVE-2017-7749 CVE-2017-7750 CVE-2017-7751 CVE-2017-7752 CVE-2017-7754 CVE-2017-7755 CVE-2017-7756 CVE-2017-7757 CVE-2017-7758 CVE-2017-7759 CVE-2017-7760 CVE-2017-7761 CVE-2017-7762 CVE-2017-7763 CVE-2017-7764 CVE-2017-7765 CVE-2017-7766 CVE-2017-7767 CVE-2017-7768 CVE-2017-7778 https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/ https://www.mozilla.org/en-US/security/advisories/mfsa2017-16/ 2017-06-13 2017-06-13 roundcube -- arbitrary password resets roundcube 1.2.5,1

Roundcube reports:

Roundcube Webmail allows arbitrary password resets by authenticated users. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin.

https://roundcube.net/news/2017/04/28/security-updates-1.2.5-1.1.9-and-1.0.11 CVE-2017-8114 2017-04-28 2017-06-09 GnuTLS -- Denial of service vulnerability gnutls 3.5.13

The GnuTLS project reports:

It was found using the TLS fuzzer tools that decoding a status response TLS extension with valid contents could lead to a crash due to a null pointer dereference. The issue affects GnuTLS server applications.

https://gnutls.org/security.html#GNUTLS-SA-2017-4 2017-06-07 2017-06-08 irssi -- remote DoS irssi 1.0.3

Joseph Bisch reports:

When receiving a DCC message without source nick/host, Irssi would attempt to dereference a NULL pointer.

When receiving certain incorrectly quoted DCC files, Irssi would try to find the terminating quote one byte before the allocated memory.

CVE-2017-9468 CVE-2017-9469 https://irssi.org/security/irssi_sa_2017_06.txt 2017-06-06 2017-06-08 chromium -- multiple vulnerabilities chromium chromium-pulse 59.0.3071.86

Google Chrome releases reports:

30 security fixes in this release, including:

[722756] High CVE-2017-5070: Type confusion in V8. Reported by Zhao Qixun of Qihoo 360 Vulcan Team on 2017-05-16

[715582] High CVE-2017-5071: Out of bounds read in V8. Reported by Choongwood Han on 2017-04-26

[709417] High CVE-2017-5072: Address spoofing in Omnibox. Reported by Rayyan Bijoora on 2017-04-07

[716474] High CVE-2017-5073: Use after free in print preview. Reported by Khalil Zhani on 2017-04-28

[700040] High CVE-2017-5074: Use after free in Apps Bluetooth. Reported by anonymous on 2017-03-09

[678776] Medium CVE-2017-5075: Information leak in CSP reporting. Reported by Emmanuel Gil Peyrot on 2017-01-05

[722639] Medium CVE-2017-5086: Address spoofing in Omnibox. Reported by Rayyan Bijoora on 2017-05-16

[719199] Medium CVE-2017-5076: Address spoofing in Omnibox. Reported by Samuel Erb on 2017-05-06

[716311] Medium CVE-2017-5077: Heap buffer overflow in Skia. Reported by Sweetchip on 2017-04-28

[711020] Medium CVE-2017-5078: Possible command injection in mailto handling. Reported by Jose Carlos Exposito Bueno on 2017-04-12

[713686] Medium CVE-2017-5079: UI spoofing in Blink. Reported by Khalil Zhani on 2017-04-20

[708819] Medium CVE-2017-5080: Use after free in credit card autofill. Reported by Khalil Zhani on 2017-04-05

[672008] Medium CVE-2017-5081: Extension verification bypass. Reported by Andrey Kovalev of Yandex Security Team on 2016-12-07

[721579] Low CVE-2017-5082: Insufficient hardening in credit card editor. Reported by Nightwatch Cybersecurity Research on 2017-05-11

[714849] Low CVE-2017-5083: UI spoofing in Blink. Reported by Khalil Zhani on 2017-04-24

[692378] Low CVE-2017-5085: Inappropriate javascript execution on WebUI pages. Reported by Zhiyang Zeng of Tencent security platform department on 2017-02-15

[729639] Various fixes from internal audits, fuzzing and other initiatives

CVE-2017-5070 CVE-2017-5071 CVE-2017-5072 CVE-2017-5073 CVE-2017-5074 CVE-2017-5075 CVE-2017-5086 CVE-2017-5076 CVE-2017-5077 CVE-2017-5078 CVE-2017-5079 CVE-2017-5080 CVE-2017-5081 CVE-2017-5082 CVE-2017-5083 CVE-2017-5085 https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop.html 2017-06-05 2017-06-06 ansible -- Input validation flaw in jinja2 templating system ansible 2.3.1

RedHat security team reports:

An input validation flaw was found in Ansible, where it fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be parsed by the jinja2 templating system, result in code execution.

https://access.redhat.com/security/cve/cve-2017-7481 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7481 2017-05-09 2017-06-02 duo -- Two-factor authentication bypass duo 1.9.21

The duo security team reports:

An untrusted user may be able to set the http_proxy variable to an invalid address. If this happens, this will trigger the configured 'failmode' behavior, which defaults to safe. Safe mode causes the authentication to report a success.

https://duo.com/labs/psa/duo-psa-2017-002 2017-05-19 2017-06-01 FreeRADIUS -- TLS resumption authentication bypass freeradius freeradius2 freeradius3 3.0.14

Stefan Winter reports:

The TLS session cache in FreeRADIUS before 3.0.14 fails to reliably prevent resumption of an unauthenticated session, which allows remote attackers (such as malicious 802.1X supplicants) to bypass authentication via PEAP or TTLS.

CVE-2017-9148 http://freeradius.org/security.html http://seclists.org/oss-sec/2017/q2/342 http://www.securityfocus.com/bid/98734 2017-02-03 2017-06-01 heimdal -- bypass of capath policy heimdal 7.1.0_3

Viktor Dukhovni reports:

Commit f469fc6 (2010-10-02) inadvertently caused the previous hop realm to not be added to the transit path of issued tickets. This may, in some cases, enable bypass of capath policy in Heimdal versions 1.5 through 7.2. Note, this may break sites that rely on the bug. With the bug some incomplete [capaths] worked, that should not have. These may now break authentication in some cross-realm configurations. (CVE-2017-6594)

CVE-2017-6594 ports/219657 2017-04-13 2017-05-31 FreeBSD -- ipfilter(4) fragment handling panic FreeBSD-kernel 11.011.0_10 10.310.3_19

Problem Description:

ipfilter(4), capable of stateful packet inspection, using the "keep state" or "keep frags" rule options, will not only maintain the state of connections, such as TCP streams or UDP communication, it also maintains the state of fragmented packets. When a packet fragments are received they are cached in a hash table (and linked list). When a fragment is received it is compared with fragments already cached in the hash table for a match. If it does not match the new entry is used to create a new entry in the hash table. If on the other hand it does match, unfortunately the wrong entry is freed, the entry in the hash table. This results in use after free panic (and for a brief moment prior to the panic a memory leak due to the wrong entry being freed).

Impact:

Carefully feeding fragments that are allowed to pass by an ipfilter(4) firewall can be used to cause a panic followed by reboot loop denial of service attack.

CVE-2017-1081 SA-17:04.ipfilter 2017-04-27 2017-05-26 FreeBSD -- Multiple vulnerabilities of ntp FreeBSD 11.011.0_9 10.310.3_18

Problem Description:

A vulnerability was discovered in the NTP server's parsing of configuration directives. [CVE-2017-6464]

A vulnerability was found in NTP, in the parsing of packets from the DPTS Clock. [CVE-2017-6462]

A vulnerability was discovered in the NTP server's parsing of configuration directives. [CVE-2017-6463]

A vulnerability was found in NTP, affecting the origin timestamp check function. [CVE-2016-9042]

Impact:

A remote, authenticated attacker could cause ntpd to crash by sending a crafted message. [CVE-2017-6463, CVE-2017-6464]

A malicious device could send crafted messages, causing ntpd to crash. [CVE-2017-6462]

An attacker able to spoof messages from all of the configured peers could send crafted packets to ntpd, causing later replies from those peers to be discarded, resulting in denial of service. [CVE-2016-9042]

CVE-2016-9042 CVE-2017-6462 CVE-2017-6463 CVE-2017-6464 SA-17:03.ntp 2017-04-12 2017-05-26 vlc -- remote code execution via crafted subtitles vlc 2.2.6,4 vlc-qt4 2.2.6,4

Check Point research team reports:

Remote code execution via crafted subtitles

http://blog.checkpoint.com/2017/05/23/hacked-in-translation/ 2017-05-23 2017-05-26 OpenEXR -- multiple remote code execution and denial of service vulnerabilities OpenEXR 2.2.1

Brandon Perry reports:

[There] is a zip file of EXR images that cause segmentation faults in the OpenEXR library (tested against 2.2.0).

CVE-2017-9110 In OpenEXR 2.2.0, an invalid read of size 2 in the hufDecode function in ImfHuf.cpp could cause the application to crash.

CVE-2017-9111 In OpenEXR 2.2.0, an invalid write of size 8 in the storeSSE function in ImfOptimizedPixelReading.h could cause the application to crash or execute arbitrary code.

CVE-2017-9112 In OpenEXR 2.2.0, an invalid read of size 1 in the getBits function in ImfHuf.cpp could cause the application to crash.

CVE-2017-9113 In OpenEXR 2.2.0, an invalid write of size 1 in the bufferedReadPixels function in ImfInputFile.cpp could cause the application to crash or execute arbitrary code.

CVE-2017-9114 In OpenEXR 2.2.0, an invalid read of size 1 in the refill function in ImfFastHuf.cpp could cause the application to crash.

CVE-2017-9115 In OpenEXR 2.2.0, an invalid write of size 2 in the = operator function in half.h could cause the application to crash or execute arbitrary code.

CVE-2017-9116 In OpenEXR 2.2.0, an invalid read of size 1 in the uncompress function in ImfZip.cpp could cause the application to crash.

http://www.openwall.com/lists/oss-security/2017/05/12/5 CVE-2017-9110 CVE-2017-9111 CVE-2017-9112 CVE-2017-9113 CVE-2017-9114 CVE-2017-9115 CVE-2017-9116 https://github.com/openexr/openexr/issues/232 2017-01-12 2017-05-25 ImageMagick -- multiple vulnerabilities ImageMagick ImageMagick-nox11 6.9.6.4_2,1 6.9.7.0,16.9.8.8,1 ImageMagick7 ImageMagick7-nox11 7.0.5.9

CVE-2017-5506: Double free vulnerability in magick/profile.c in ImageMagick allows remote attackers to have unspecified impact via a crafted file.

CVE-2017-5507: Memory leak in coders/mpc.c in ImageMagick before 6.9.7-4 and 7.x before 7.0.4-4 allows remote attackers to cause a denial of service (memory consumption) via vectors involving a pixel cache.

CVE-2017-5508: Heap-based buffer overflow in the PushQuantumPixel function in ImageMagick before 6.9.7-3 and 7.x before 7.0.4-3 allows remote attackers to cause a denial of service (application crash) via a crafted TIFF file.

CVE-2017-5509: coders/psd.c in ImageMagick allows remote attackers to have unspecified impact via a crafted PSD file, which triggers an out-of-bounds write.

CVE-2017-5510: coders/psd.c in ImageMagick allows remote attackers to have unspecified impact via a crafted PSD file, which triggers an out-of-bounds write.

CVE-2017-5511: coders/psd.c in ImageMagick allows remote attackers to have unspecified impact by leveraging an improper cast, which triggers a heap-based buffer overflow.

CVE-2017-6497: An issue was discovered in ImageMagick 6.9.7. A specially crafted psd file could lead to a NULL pointer dereference (thus, a DoS).

CVE-2017-6498: An issue was discovered in ImageMagick 6.9.7. Incorrect TGA files could trigger assertion failures, thus leading to DoS.

CVE-2017-6499: An issue was discovered in Magick++ in ImageMagick 6.9.7. A specially crafted file creating a nested exception could lead to a memory leak (thus, a DoS).

CVE-2017-6500: An issue was discovered in ImageMagick 6.9.7. A specially crafted sun file triggers a heap-based buffer over-read.

CVE-2017-6501: An issue was discovered in ImageMagick 6.9.7. A specially crafted xcf file could lead to a NULL pointer dereference.

CVE-2017-6502: An issue was discovered in ImageMagick 6.9.7. A specially crafted webp file could lead to a file-descriptor leak in libmagickcore (thus, a DoS).

CVE-2017-7275: The ReadPCXImage function in coders/pcx.c in ImageMagick 7.0.4.9 allows remote attackers to cause a denial of service (attempted large memory allocation and application crash) via a crafted file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8862 and CVE-2016-8866.

CVE-2017-7606: coders/rle.c in ImageMagick 7.0.5-4 has an "outside the range of representable values of type unsigned char" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.

CVE-2017-7619: In ImageMagick 7.0.4-9, an infinite loop can occur because of a floating-point rounding error in some of the color algorithms. This affects ModulateHSL, ModulateHCL, ModulateHCLp, ModulateHSB, ModulateHSI, ModulateHSV, ModulateHWB, ModulateLCHab, and ModulateLCHuv.

CVE-2017-7941: The ReadSGIImage function in sgi.c allows remote attackers to consume an amount of available memory via a crafted file.

CVE-2017-7942: The ReadAVSImage function in avs.c allows remote attackers to consume an amount of available memory via a crafted file.

CVE-2017-7943: The ReadSVGImage function in svg.c allows remote attackers to consume an amount of available memory via a crafted file.

CVE-2017-8343: ReadAAIImage function in aai.c allows attackers to cause a denial of service (memory leak) via a crafted file.

CVE-2017-8344: ReadPCXImage function in pcx.c allows attackers to cause a denial of service (memory leak) via a crafted file. The ReadMNGImage function in png.c allows attackers to cause a denial of service (memory leak) via a crafted file.

CVE-2017-8345: ReadMNGImage function in png.c allows attackers to cause a denial of service (memory leak) via a crafted file.

CVE-2017-8346: ReadMATImage function in mat.c allows attackers to cause a denial of service (memory leak) via a crafted file.

CVE-2017-8347: ReadMATImage function in mat.c allows attackers to cause a denial of service (memory leak) via a crafted file.

CVE-2017-8348: ReadMATImage function in mat.c allows attackers to cause a denial of service (memory leak) via a crafted file.

CVE-2017-8349: ReadSFWImage function in sfw.c allows attackers to cause a denial of service (memory leak) via a crafted file.

CVE-2017-8350: ReadJNGImage function in png.c allows attackers to cause a denial of service (memory leak) via a crafted file.

CVE-2017-8351: ReadPCDImage function in pcd.c allows attackers to cause a denial of service (memory leak) via a crafted file.

CVE-2017-8352: ReadXWDImage function in xwd.c allows attackers to cause a denial of service (memory leak) via a crafted file.

CVE-2017-8353: ReadPICTImage function in pict.c allows attackers to cause a denial of service (memory leak) via a crafted file.

CVE-2017-8354: ReadBMPImage function in bmp.c allows attackers to cause a denial of service (memory leak) via a crafted file.

CVE-2017-8355: ReadMTVImage function in mtv.c allows attackers to cause a denial of service (memory leak) via a crafted file.

CVE-2017-8356: ReadSUNImage function in sun.c allows attackers to cause a denial of service (memory leak) via a crafted file.

CVE-2017-8357: ReadEPTImage function in ept.c allows attackers to cause a denial of service (memory leak) via a crafted file.

CVE-2017-8765: The function named ReadICONImage in coders\icon.c has a memory leak vulnerability which can cause memory exhaustion via a crafted ICON file.

CVE-2017-8830: ReadBMPImage function in bmp.c:1379 allows attackers to cause a denial of service (memory leak) via a crafted file.

CVE-2017-9141: A crafted file could trigger an assertion failure in the ResetImageProfileIterator function in MagickCore/profile.c because of missing checks in the ReadDDSImage function in coders/dds.c.

CVE-2017-9142: A crafted file could trigger an assertion failure in the WriteBlob function in MagickCore/blob.c because of missing checks in the ReadOneJNGImage function in coders/png.c.

CVE-2017-9143: ReadARTImage function in coders/art.c allows attackers to cause a denial of service (memory leak) via a crafted .art file.

CVE-2017-9144: A crafted RLE image can trigger a crash because of incorrect EOF handling in coders/rle.c.

https://nvd.nist.gov/vuln/search/results?query=ImageMagick CVE-2017-5506 CVE-2017-5507 CVE-2017-5508 CVE-2017-5509 CVE-2017-5510 CVE-2017-5511 CVE-2017-6497 CVE-2017-6498 CVE-2017-6499 CVE-2017-6500 CVE-2017-6501 CVE-2017-6502 CVE-2017-7275 CVE-2017-7606 CVE-2017-7619 CVE-2017-7941 CVE-2017-7942 CVE-2017-7943 CVE-2017-8343 CVE-2017-8344 CVE-2017-8345 CVE-2017-8346 CVE-2017-8347 CVE-2017-8348 CVE-2017-8349 CVE-2017-8350 CVE-2017-8351 CVE-2017-8352 CVE-2017-8353 CVE-2017-8354 CVE-2017-8355 CVE-2017-8356 CVE-2017-8357 CVE-2017-8765 CVE-2017-8830 CVE-2017-9141 CVE-2017-9142 CVE-2017-9143 CVE-2017-9144 2017-03-05 2017-05-25 2017-05-29 samba -- remote code execution vulnerability samba42 4.2.15 samba43 4.3.14 samba44 4.4.14 samba45 4.5.10 samba46 4.6.4

The samba project reports:

Remote code execution from a writable share.

All versions of Samba from 3.5.0 onwards are vulnerable to a remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and then cause the server to load and execute it.

https://www.samba.org/samba/security/CVE-2017-7494.html CVE-2017-7494 2017-05-24 2017-05-24 NVIDIA UNIX driver -- multiple vulnerabilities in the kernel mode layer handler nvidia-driver 375.66

NVIDIA Unix security team reports:

NVIDIA GPU Display Driver contains vulnerabilities in the kernel mode layer handler where not correctly validated user input, NULL pointer dereference, and incorrect access control may lead to denial of service or potential escalation of privileges.

CVE-2017-0350 CVE-2017-0351 CVE-2017-0352 http://nvidia.custhelp.com/app/answers/detail/a_id/4462 2017-05-15 2017-05-23 miniupnpc -- integer signedness error miniupnpc 2.0.20170509

Tintinweb reports:

An integer signedness error was found in miniupnp's miniwget allowing an unauthenticated remote entity typically located on the local network segment to trigger a heap corruption or an access violation in miniupnp's http response parser when processing a specially crafted chunked-encoded response to a request for the xml root description url.

CVE-2017-8798 https://github.com/tintinweb/pub/tree/master/pocs/cve-2017-8798 2017-05-09 2017-05-22 Wordpress -- multiple vulnerabilities wordpress 4.7.5,1 de-wordpress fr-wordpress ja-wordpress ru-wordpress zh-wordpress-zh_CN zh-wordpress-zh_TW 4.7.5,1

WordPress versions 4.7.4 and earlier are affected by six security issues

Insufficient redirect validation in the HTTP class.

Improper handling of post meta data values in the XML-RPC API.

Lack of capability checks for post meta data in the XML-RPC API.

A Cross Site Request Forgery (CRSF) vulnerability was discovered in the filesystem credentials dialog.

A cross-site scripting (XSS) vulnerability was discovered related to the Customizer.

https://wordpress.org/news/2017/05/wordpress-4-7-5/ 2017-05-16 2017-05-21 asterisk -- Memory exhaustion on short SCCP packets asterisk13 13.15.1

The Asterisk project reports:

A remote memory exhaustion can be triggered by sending an SCCP packet to Asterisk system with "chan_skinny" enabled that is larger than the length of the SCCP header but smaller than the packet length specified in the header. The loop that reads the rest of the packet doesn't detect that the call to read() returned end-of-file before the expected number of bytes and continues infinitely. The "partial data" message logging in that tight loop causes Asterisk to exhaust all available memory.

http://downloads.asterisk.org/pub/security/AST-2017-004.html 2017-04-13 2017-05-19 asterisk -- Buffer Overrun in PJSIP transaction layer asterisk13 13.15.1 pjsip 2.6_1 pjsip-extsrtp 2.6_1

The Asterisk project reports:

A remote crash can be triggered by sending a SIP packet to Asterisk with a specially crafted CSeq header and a Via header with no branch parameter. The issue is that the PJSIP RFC 2543 transaction key generation algorithm does not allocate a large enough buffer. By overrunning the buffer, the memory allocation table becomes corrupted, leading to an eventual crash.

The multi-part body parser in PJSIP contains a logical error that can make certain multi-part body parts attempt to read memory from outside the allowed boundaries. A specially-crafted packet can trigger these invalid reads and potentially induce a crash.

This issues is in PJSIP, and so the issue can be fixed without performing an upgrade of Asterisk at all. However, we are releasing a new version of Asterisk with the bundled PJProject updated to include the fix.

If you are running Asterisk with chan_sip, this issue does not affect you.

http://downloads.asterisk.org/pub/security/AST-2017-002.html http://downloads.asterisk.org/pub/security/AST-2017-003.html 2017-04-12 2017-05-19 Joomla3 -- SQL Injection joomla3 3.7.0

JSST reports:

Inadequate filtering of request data leads to a SQL Injection vulnerability.

CVE-2017-8917 https://developer.joomla.org/security-centre/692-20170501-core-sql-injection.html 2017-05-11 2017-05-18 gitlab -- Various security issues gitlab 6.6.08.17.5 9.0.09.0.6 9.1.09.1.2

GitLab reports:

Cross-Site Scripting (XSS) vulnerability in project import file names for gitlab_project import types

Timo Schmid from ERNW reported a persistent Cross-Site Scripting vulnerability in the new project import view for gitlab_project import types. This XSS vulnerability was caused by the use of Hamlit filters inside HAML views without manually escaping HTML. Unlike content outside of a filter, content inside Hamlit filters (:css, :javascript, :preserve, :plain) is not automatically escaped.

Cross-Site Scripting (XSS) vulnerability in git submodule support

Jobert Abma from HackerOne reported a persitent XSS vulnerability in the GitLab repository files view that could be exploited by injecting malicious script into a git submodule.

Cross-Site Scripting (XSS) vulnerability in repository "new branch" view

A GitLab user reported a persistent XSS vulnerability in the repository new branch view that allowed malicious branch names or git references to execute arbitrary Javascript.

Cross-Site Scripting (XSS) vulnerability in mirror errors display

While investigating Timo Schmid's previously reported XSS vulnerability in import filenames another persistent XSS vulnerability was discovered in the GitLab Enterprise Edition's (EE) mirror view. This vulnerability was also caused by the misuse of Hamlit filters.

Potential XSS vulnerability in DropLab

An internal code audit disclosed a vulnerability in DropLab's templating that, while not currently exploitable, could become exploitable depending on how the templates were used in the future.

Tab Nabbing vulnerabilities in mardown link filter, Asciidoc files, and other markup files

edio via HackerOne reported two tab nabbing vulnerabilities. The first tab nabbing vulnerability was caused by improper hostname filtering when identifying user-supplied external links. GitLab did not properly filter usernames from the URL. An attacker could construct a specially crafted link including a username to bypass GitLab's external link filter. This allowed an attacker to post links in Markdown that did not include the appropriate "noreferrer noopener" options, allowing tab nabbing attacks.

The second vulnerability was in the AsciiDoctor markup library. AsciiDoctor was not properly including the "noreferrer noopener" options with external links. An internal investigation discovered other markup libraries that were also vulnerable.

Unauthorized disclosure of wiki pages in search

M. Hasbini reported a flaw in the project search feature that allowed authenticated users to disclose the contents of private wiki pages inside public projects.

External users can view internal snippets

Christian Kühn discovered a vulnerability in GitLab snippets that allowed an external user to view the contents of internal snippets.

Subgroup visibility for private subgroups under a public parent group

Matt Harrison discovered a vulnerability with subgroups that allowed private subgroup names to be disclosed when they belong to a parent group that is public.

https://about.gitlab.com/2017/05/08/gitlab-9-dot-1-dot-3-security-release/ 2017-05-08 2017-05-18 2017-05-30 gitlab -- Various security issues gitlab 8.7.08.15.7 8.16.08.16.7 8.17.08.17.3

GitLab reports:

Information Disclosure in Issue and Merge Request Trackers

During an internal code review a critical vulnerability in the GitLab Issue and Merge Request trackers was discovered. This vulnerability could allow a user with access to assign ownership of an issue or merge request to another user to disclose that user's private token, email token, email address, and encrypted OTP secret. Reporter-level access to a GitLab project is required to exploit this flaw.

SSRF when importing a project from a Repo by URL

GitLab instances that have enabled project imports using "Repo by URL" were vulnerable to Server-Side Request Forgery attacks. By specifying a project import URL of localhost an attacker could target services that are bound to the local interface of the server. These services often do not require authentication. Depending on the service an attacker might be able craft an attack using the project import request URL.

Links in Environments tab vulnerable to tabnabbing

edio via HackerOne reported that user-configured Environment links include target=_blank but do not also include rel: noopener noreferrer. Anyone clicking on these links may therefore be subjected to tabnabbing attacks where a link back to the requesting page is maintained and can be manipulated by the target server.

Accounts with email set to "Do not show on profile" have addresses exposed in public atom feed

Several GitLab users reported that even with "Do not show on profile" configured for their email addresses those addresses were still being leaked in Atom feeds if they commented on a public project.

CVE-2017-0882 https://about.gitlab.com/2017/03/20/gitlab-8-dot-17-dot-4-security-release/ 2017-03-20 2017-05-18 2017-05-30 freetype2 -- buffer overflows freetype2 2.8

Werner Lemberg reports:

CVE-2017-8105, CVE-2017-8287: Older FreeType versions have out-of-bounds writes caused by heap-based buffer overflows related to Type 1 fonts.

http://lists.nongnu.org/archive/html/freetype-announce/2017-05/msg00000.html CVE-2017-8105 CVE-2017-8287 2017-05-17 2017-05-17 OpenVPN -- two remote denial-of-service vulnerabilities openvpn 2.3.15 2.4.02.4.2 openvpn23 2.3.15 openvpn-mbedtls 2.4.02.4.2 openvpn-polarssl 2.3.15 openvpn23-polarssl 2.3.15

Samuli Seppänen reports:

OpenVPN v2.4.0 was audited for security vulnerabilities independently by Quarkslabs (funded by OSTIF) and Cryptography Engineering (funded by Private Internet Access) between December 2016 and April 2017. The primary findings were two remote denial-of-service vulnerabilities. Fixes to them have been backported to v2.3.15.

An authenticated client can do the 'three way handshake' (P_HARD_RESET, P_HARD_RESET, P_CONTROL), where the P_CONTROL packet is the first that is allowed to carry payload. If that payload is too big, the OpenVPN server process will stop running due to an ASSERT() exception. That is also the reason why servers using tls-auth/tls-crypt are protected against this attack - the P_CONTROL packet is only accepted if it contains the session ID we specified, with a valid HMAC (challenge-response). (CVE-2017-7478)

An authenticated client can cause the server's the packet-id counter to roll over, which would lead the server process to hit an ASSERT() and stop running. To make the server hit the ASSERT(), the client must first cause the server to send it 2^32 packets (at least 196 GB).

https://openvpn.net/index.php/open-source/downloads.html CVE-2017-7478 CVE-2017-7479 https://community.openvpn.net/openvpn/wiki/QuarkslabAndCryptographyEngineerAudits https://ostif.org/?p=870&preview=true https://www.privateinternetaccess.com/blog/2017/05/openvpn-2-4-2-fixes-critical-issues-discovered-openvpn-audit-reports/ 2017-05-10 2017-05-11 PostgreSQL vulnerabilities postgresql92-client 9.2.09.2.20 postgresql93-client 9.3.09.3.16 postgresql94-client 9.4.09.4.11 postgresql95-client 9.5.09.5.6 postgresql96-client 9.6.09.6.2 postgresql92-server 9.2.09.2.20 postgresql93-server 9.3.09.3.16 postgresql94-server 9.4.09.4.11 postgresql95-server 9.5.09.5.6 postgresql96-server 9.6.09.6.2

The PostgreSQL project reports:

Security Fixes nested CASE expressions + database and role names with embedded special characters

CVE-2017-7484: selectivity estimators bypass SELECT privilege checks.

CVE-2017-7485: libpq ignores PGREQUIRESSL environment variable

CVE-2017-7486: pg_user_mappings view discloses foreign server passwords. This applies to new databases, see the release notes for the procedure to apply the fix to an existing database.

CVE-2016-5423 CVE-2016-5424 2017-05-11 2017-05-11 kauth: Local privilege escalation kdelibs 4.14.30_4 kf5-kauth 5.33.0_1

Albert Astals Cid reports:

KAuth contains a logic flaw in which the service invoking dbus is not properly checked. This allows spoofing the identity of the caller and with some carefully crafted calls can lead to gaining root from an unprivileged account.

CVE-2017-8422 http://www.openwall.com/lists/oss-security/2017/05/10/3 https://www.kde.org/info/security/advisory-20170510-1.txt 2017-05-10 2017-05-10 libetpan -- null dereference vulnerability in MIME parsing component libetpan 1.8

rwhitworth reports:

I was using American Fuzzy Lop (afl-fuzz) to fuzz input to the mime-parse test program. Is fixing these crashes something you're interested in? The input files can be found here: https://github.com/rwhitworth/libetpan-fuzz/. The files can be executed as ./mime-parse id_filename to cause seg faults.

CVE-2017-8825 http://cve.circl.lu/cve/CVE-2017-8825 2017-04-29 2017-05-09 chromium -- race condition vulnerability chromium 58.0.3029.96

Google Chrome Releases reports:

1 security fix in this release:

[679306] High CVE-2017-5068: Race condition in WebRTC. Credit to Philipp Hancke

CVE-2017-5068 https://chromereleases.googleblog.com/2017/05/stable-channel-update-for-desktop.html 2017-05-02 2017-05-03 dovecot -- Dovecot DoS when passdb dict was used for authentication dovecot2 2.2.25_62.2.29

Timo Sirainen reports:

passdb/userdb dict: Don't double-expand %variables in keys. If dict was used as the authentication passdb, using specially crafted %variables in the username could be used to cause DoS.

CVE-2017-2669 https://dovecot.org/list/dovecot-news/2017-April/000341.html https://dovecot.org/list/dovecot-news/2017-April/000342.html 2016-12-01 2017-04-30 LibreSSL -- TLS verification vulnerability libressl 2.5.12.5.3_1 libressl-devel 2.5.12.5.3_1

Jakub Jirutka reports:

LibreSSL 2.5.1 to 2.5.3 lacks TLS certificate verification if SSL_get_verify_result is relied upon for a later check of a verification result, in a use case where a user-provided verification callback returns 1, as demonstrated by acceptance of invalid certificates by nginx.

http://seclists.org/oss-sec/2017/q2/145 https://github.com/libressl-portable/portable/issues/307 CVE-2017-8301 2017-04-27 2017-04-28 jenkins -- multiple vulnerabilities jenkins 2.57 jenkins-lts 2.46.2

Jenkins Security Advisory:

Description

SECURITY-412 through SECURITY-420 / CVE-2017-1000356

CSRF: Multiple vulnerabilities

SECURITY-429 / CVE-2017-1000353

CLI: Unauthenticated remote code execution

SECURITY-466 / CVE-2017-1000354

CLI: Login command allowed impersonating any Jenkins user

SECURITY-503 / CVE-2017-1000355

XStream: Java crash when trying to instantiate void/Void

CVE-2017-1000356 CVE-2017-1000353 CVE-2017-1000354 CVE-2017-1000355 https://jenkins.io/security/advisory/2017-04-26/ 2017-04-26 2017-04-27 codeigniter -- multiple vulnerabilities codeigniter 3.1.4

The CodeIgniter changelog reports:

Fixed a header injection vulnerability in common function set_status_header() under Apache (thanks to Guillermo Caminer from Flowgate).

Fixed byte-safety issues in Encrypt Library (DEPRECATED) when mbstring.func_overload is enabled.

Fixed byte-safety issues in Encryption Library when mbstring.func_overload is enabled.

Fixed byte-safety issues in compatibility functions password_hash(), hash_pbkdf2() when mbstring.func_overload is enabled.

Updated Encrypt Library (DEPRECATED) to call mcrypt_create_iv() with MCRYPT_DEV_URANDOM.

https://www.codeigniter.com/user_guide/changelog.html 2017-03-23 2017-04-25 weechat -- multiple vulnerabilities weechat 1.7.1

Common Vulnerabilities and Exposures:

WeeChat before 1.7.1 allows a remote crash by sending a filename via DCC to the IRC plugin. This occurs in the irc_ctcp_dcc_filename_without_quotes function during quote removal, with a buffer overflow.

https://weechat.org/download/security/ CVE-2017-8073 2017-04-23 2017-04-24 drupal8 -- Drupal Core - Critical - Access Bypass drupal8 8.3.1

Drupal Security Team Reports:

CVE-2017-6919: Access bypass

CVE-2017-6919 2017-04-19 2017-04-21 chromium -- multiple vulnerabilities chromium chromium-pulse 58.0.3029.81

Google Chrome Releases reports:

29 security fixes in this release, including:

[695826] High CVE-2017-5057: Type confusion in PDFium. Credit to Guang Gong of Alpha Team, Qihoo 360

[694382] High CVE-2017-5058: Heap use after free in Print Preview. Credit to Khalil Zhani

[684684] High CVE-2017-5059: Type confusion in Blink. Credit to SkyLined working with Trend Micro's Zero Day Initiative

[683314] Medium CVE-2017-5060: URL spoofing in Omnibox. Credit to Xudong Zheng

[672847] Medium CVE-2017-5061: URL spoofing in Omnibox. Credit to Haosheng Wang (@gnehsoah)

[702896] Medium CVE-2017-5062: Use after free in Chrome Apps. Credit to anonymous

[700836] Medium CVE-2017-5063: Heap overflow in Skia. Credit to Sweetchip

[693974] Medium CVE-2017-5064: Use after free in Blink. Credit to Wadih Matar

[704560] Medium CVE-2017-5065: Incorrect UI in Blink. Credit to Khalil Zhani

[690821] Medium CVE-2017-5066: Incorrect signature handing in Networking. Credit to Prof. Zhenhua Duan, Prof. Cong Tian, and Ph.D candidate Chu Chen (ICTT, Xidian University)

[648117] Medium CVE-2017-5067: URL spoofing in Omnibox. Credit to Khalil Zhani

[691726] Low CVE-2017-5069: Cross-origin bypass in Blink. Credit to Michael Reizelman

[713205] Various fixes from internal audits, fuzzing and other initiatives

CVE-2017-5057 CVE-2017-5058 CVE-2017-5059 CVE-2017-5060 CVE-2017-5061 CVE-2017-5062 CVE-2017-5063 CVE-2017-5064 CVE-2017-5065 CVE-2017-5066 CVE-2017-5067 CVE-2017-5069 https://chromereleases.googleblog.com/2017/04/stable-channel-update-for-desktop.html 2017-04-19 2017-04-21 icu -- multiple vulnerabilities icu 58.2_2,1 linux-c6-icu linux-c7-icu 59.0

NVD reports:

International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function in common/utext.cpp and the utext_setNativeIndex* function.

International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function in common/utext.cpp and the utext_moveIndex32* function.

CVE-2017-7867 CVE-2017-7868 http://bugs.icu-project.org/trac/changeset/39671 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=437 2017-01-21 2017-04-20 2017-05-04 tiff -- multiple vulnerabilities tiff linux-f8-tiff linux-f10-tiff linux-c6-tiff linux-c7-tiff 4.0.8

NVD reports:

LibTIFF version 4.0.7 is vulnerable to a heap buffer overflow in the tools/tiffcp resulting in DoS or code execution via a crafted BitsPerSample value.

The putagreytile function in tif_getimage.c in LibTIFF 4.0.7 has a left-shift undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.

tif_read.c in LibTIFF 4.0.7 does not ensure that tif_rawdata is properly initialized, which might allow remote attackers to obtain sensitive information from process memory via a crafted image.

The OJPEGReadHeaderInfoSecTablesDcTable function in tif_ojpeg.c in LibTIFF 4.0.7 allows remote attackers to cause a denial of service (memory leak) via a crafted image.

The JPEGSetupEncode function in tiff_jpeg.c in LibTIFF 4.0.7 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted image.

LibTIFF 4.0.7 has an "outside the range of representable values of type float" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.

tif_dirread.c in LibTIFF 4.0.7 has an "outside the range of representable values of type float" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.

tif_dirread.c in LibTIFF 4.0.7 might allow remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted image.

LibTIFF 4.0.7 has an "outside the range of representable values of type short" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.

LibTIFF 4.0.7 has an "outside the range of representable values of type unsigned char" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.

LibTIFF 4.0.7 has a "shift exponent too large for 64-bit type long" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.

LibTIFF 4.0.7 has a signed integer overflow, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.

CVE-2017-5225 CVE-2017-7592 CVE-2017-7593 CVE-2017-7594 CVE-2017-7595 CVE-2017-7596 CVE-2017-7597 CVE-2017-7598 CVE-2017-7599 CVE-2017-7600 CVE-2017-7601 CVE-2017-7602 https://github.com/vadz/libtiff/commit/5c080298d59e https://github.com/vadz/libtiff/commit/48780b4fcc42 https://github.com/vadz/libtiff/commit/d60332057b95 https://github.com/vadz/libtiff/commit/2ea32f7372b6 https://github.com/vadz/libtiff/commit/8283e4d1b7e5 https://github.com/vadz/libtiff/commit/47f2fb61a3a6 https://github.com/vadz/libtiff/commit/3cfd62d77c2a https://github.com/vadz/libtiff/commit/3144e57770c1 https://github.com/vadz/libtiff/commit/0a76a8c765c7 https://github.com/vadz/libtiff/commit/66e7bd595209 2017-04-01 2017-04-20 libsamplerate -- multiple vulnerabilities libsamplerate linux-c6-libsamplerate linux-c7-libsamplerate 0.1.9

NVD reports:

In libsamplerate before 0.1.9, a buffer over-read occurs in the calc_output_single function in src_sinc.c via a crafted audio file.

CVE-2017-7697 https://github.com/erikd/libsamplerate/commit/c3b66186656d 2017-04-11 2017-04-20 libsndfile -- multiple vulnerabilities libsndfile linux-c6-libsndfile linux-c7-libsndfile 1.0.28

NVD reports:

In libsndfile before 1.0.28, an error in the "flac_buffer_copy()" function (flac.c) can be exploited to cause a stack-based buffer overflow via a specially crafted FLAC file.

In libsndfile before 1.0.28, an error in the "header_read()" function (common.c) when handling ID3 tags can be exploited to cause a stack-based buffer overflow via a specially crafted FLAC file.

In libsndfile before 1.0.28, an error in the "flac_buffer_copy()" function (flac.c) can be exploited to cause a segmentation violation (with write memory access) via a specially crafted FLAC file during a resample attempt, a similar issue to CVE-2017-7585.

In libsndfile before 1.0.28, an error in the "flac_buffer_copy()" function (flac.c) can be exploited to cause a segmentation violation (with read memory access) via a specially crafted FLAC file during a resample attempt, a similar issue to CVE-2017-7585.

CVE-2017-7585 CVE-2017-7586 CVE-2017-7741 CVE-2017-7742 https://github.com/erikd/libsndfile/commit/60b234301adf https://github.com/erikd/libsndfile/commit/708e996c87c5 https://github.com/erikd/libsndfile/commit/f457b7b5ecfe https://github.com/erikd/libsndfile/commit/60b234301adf 2017-04-07 2017-04-20 cURL -- TLS session resumption client cert bypass (again) curl 7.52.07.54.0

cURL security advisory:

libcurl would attempt to resume a TLS session even if the client certificate had changed. That is unacceptable since a server by specification is allowed to skip the client certificate check on resume, and may instead use the old identity which was established by the previous certificate (or no certificate).

libcurl supports by default the use of TLS session id/ticket to resume previous TLS sessions to speed up subsequent TLS handshakes. They are used when for any reason an existing TLS connection couldn't be kept alive to make the next handshake faster.

This flaw is a regression and identical to CVE-2016-5419 reported on August 3rd 2016, but affecting a different version range.

CVE-2017-7468 https://curl.haxx.se/docs/adv_20170419.html 2017-04-19 2017-04-20 graphite2 -- out-of-bounds write with malicious font graphite2 1.3.9_1 linux-c7-graphite2 1.3.10

Mozilla Foundation reports:

An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font. This results in a potentially exploitable crash. This issue was fixed in the Graphite 2 library as well as Mozilla products.

CVE-2017-5436 https://github.com/silnrsi/graphite/commit/1ce331d5548b 2017-04-19 2017-04-19 2017-04-20 libevent -- multiple vulnerabilities libevent libevent2 linux-c6-libevent2 linux-c7-libevent 2.1.6

Debian Security reports:

CVE-2016-10195: The name_parse function in evdns.c in libevent before 2.1.6-beta allows remote attackers to have unspecified impact via vectors involving the label_len variable, which triggers an out-of-bounds stack read.

CVE-2016-10196: Stack-based buffer overflow in the evutil_parse_sockaddr_port function in evutil.c in libevent before 2.1.6-beta allows attackers to cause a denial of service (segmentation fault) via vectors involving a long string in brackets in the ip_as_string argument.

CVE-2016-10197: The search_make_new function in evdns.c in libevent before 2.1.6-beta allows attackers to cause a denial of service (out-of-bounds read) via an empty hostname.

CVE-2016-10195 CVE-2016-10196 CVE-2016-10197 http://www.openwall.com/lists/oss-security/2017/01/31/17 https://github.com/libevent/libevent/issues/317 https://github.com/libevent/libevent/issues/318 https://github.com/libevent/libevent/issues/332 https://github.com/libevent/libevent/issues/335 2017-01-31 2017-04-19 NSS -- multiple vulnerabilities nss linux-f10-nss linux-c6-nss linux-c7-nss 3.303.30.1 3.293.29.5 3.223.28.4 3.21.4

Mozilla Foundation reports:

An out-of-bounds write during Base64 decoding operation in the Network Security Services (NSS) library due to insufficient memory being allocated to the buffer. This results in a potentially exploitable crash. The NSS library has been updated to fix this issue to address this issue and Firefox 53 has been updated with NSS version 3.29.5.

A flaw in DRBG number generation within the Network Security Services (NSS) library where the internal state V does not correctly carry bits over. The NSS library has been updated to fix this issue to address this issue and Firefox 53 has been updated with NSS version 3.29.5.

CVE-2017-5461 CVE-2017-5462 https://hg.mozilla.org/projects/nss/rev/99a86619eac9 https://hg.mozilla.org/projects/nss/rev/e126381a3c29 2017-03-17 2017-04-19 mozilla -- multiple vulnerabilities firefox 53.0_2,1 seamonkey linux-seamonkey 2.50 firefox-esr 46.0,152.1.0_2,1 45.9.0,1 linux-firefox 46.0,252.1.0,2 45.9.0,2 libxul 46.052.1.0 45.9.0 thunderbird linux-thunderbird 46.052.1.0 45.9.0

Mozilla Foundation reports:

CVE-2017-5433: Use-after-free in SMIL animation functions

CVE-2017-5435: Use-after-free during transaction processing in the editor

CVE-2017-5436: Out-of-bounds write with malicious font in Graphite 2

CVE-2017-5461: Out-of-bounds write in Base64 encoding in NSS

CVE-2017-5459: Buffer overflow in WebGL

CVE-2017-5466: Origin confusion when reloading isolated data:text/html URL

CVE-2017-5434: Use-after-free during focus handling

CVE-2017-5432: Use-after-free in text input selection

CVE-2017-5460: Use-after-free in frame selection

CVE-2017-5438: Use-after-free in nsAutoPtr during XSLT processing

CVE-2017-5439: Use-after-free in nsTArray Length() during XSLT processing

CVE-2017-5440: Use-after-free in txExecutionState destructor during XSLT processing

CVE-2017-5441: Use-after-free with selection during scroll events

CVE-2017-5442: Use-after-free during style changes

CVE-2017-5464: Memory corruption with accessibility and DOM manipulation

CVE-2017-5443: Out-of-bounds write during BinHex decoding

CVE-2017-5444: Buffer overflow while parsing application/http-index-format content

CVE-2017-5446: Out-of-bounds read when HTTP/2 DATA frames are sent with incorrect data

CVE-2017-5447: Out-of-bounds read during glyph processing

CVE-2017-5465: Out-of-bounds read in ConvolvePixel

CVE-2017-5448: Out-of-bounds write in ClearKeyDecryptor

CVE-2017-5437: Vulnerabilities in Libevent library

CVE-2017-5454: Sandbox escape allowing file system read access through file picker

CVE-2017-5455: Sandbox escape through internal feed reader APIs

CVE-2017-5456: Sandbox escape allowing local file system access

CVE-2017-5469: Potential Buffer overflow in flex-generated code

CVE-2017-5445: Uninitialized values used while parsing application/http-index-format content

CVE-2017-5449: Crash during bidirectional unicode manipulation with animation

CVE-2017-5450: Addressbar spoofing using javascript: URI on Firefox for Android

CVE-2017-5451: Addressbar spoofing with onblur event

CVE-2017-5462: DRBG flaw in NSS

CVE-2017-5463: Addressbar spoofing through reader view on Firefox for Android

CVE-2017-5467: Memory corruption when drawing Skia content

CVE-2017-5452: Addressbar spoofing during scrolling with editable content on Firefox for Android

CVE-2017-5453: HTML injection into RSS Reader feed preview page through TITLE element

CVE-2017-5458: Drag and drop of javascript: URLs can allow for self-XSS

CVE-2017-5468: Incorrect ownership model for Private Browsing information

CVE-2017-5430: Memory safety bugs fixed in Firefox 53 and Firefox ESR 52.1

CVE-2017-5429: Memory safety bugs fixed in Firefox 53, Firefox ESR 45.9, and Firefox ESR 52.1

CVE-2017-5433 CVE-2017-5435 CVE-2017-5436 CVE-2017-5461 CVE-2017-5459 CVE-2017-5466 CVE-2017-5434 CVE-2017-5432 CVE-2017-5460 CVE-2017-5438 CVE-2017-5439 CVE-2017-5440 CVE-2017-5441 CVE-2017-5442 CVE-2017-5464 CVE-2017-5443 CVE-2017-5444 CVE-2017-5446 CVE-2017-5447 CVE-2017-5465 CVE-2017-5448 CVE-2017-5437 CVE-2017-5454 CVE-2017-5455 CVE-2017-5456 CVE-2017-5469 CVE-2017-5445 CVE-2017-5449 CVE-2017-5450 CVE-2017-5451 CVE-2017-5462 CVE-2017-5463 CVE-2017-5467 CVE-2017-5452 CVE-2017-5453 CVE-2017-5458 CVE-2017-5468 CVE-2017-5430 CVE-2017-5429 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/ https://www.mozilla.org/en-US/security/advisories/mfsa2017-11/ https://www.mozilla.org/en-US/security/advisories/mfsa2017-12/ 2017-04-19 2017-04-19 MySQL -- mulitiple vulnerabilities mariadb55-server 5.5.55 mariadb100-server 10.0.31 mariadb101-server 10.1.23 mysql55-server 5.5.55 mysql56-server 5.6.36 mysql57-server 5.7.18

Oracle reports:

This Critical Patch Update contains 39 new security fixes for Oracle MySQL. 11 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.

http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html CVE-2017-3308 CVE-2017-3309 CVE-2017-3450 CVE-2017-3599 CVE-2017-3329 CVE-2017-3600 CVE-2017-3331 CVE-2017-3453 CVE-2017-3452 CVE-2017-3454 CVE-2017-3455 CVE-2017-3305 CVE-2017-3460 CVE-2017-3456 CVE-2017-3458 CVE-2017-3457 CVE-2017-3459 CVE-2017-3463 CVE-2017-3462 CVE-2017-3461 CVE-2017-3464 CVE-2017-3465 CVE-2017-3467 CVE-2017-3468 2017-04-19 2017-04-19 BIND -- multiple vulnerabilities bind99 9.9.9P8 bind910 9.10.4P8 bind911 9.11.0P5 bind9-devel 9.12.0.a.2017.03.25

ISC reports:

A query with a specific set of characteristics could cause a server using DNS64 to encounter an assertion failure and terminate.

An attacker could deliberately construct a query, enabling denial-of-service against a server if it was configured to use the DNS64 feature and other preconditions were met.

Mistaken assumptions about the ordering of records in the answer section of a response containing CNAME or DNAME resource records could lead to a situation in which named would exit with an assertion failure when processing a response in which records occurred in an unusual order.

named contains a feature which allows operators to issue commands to a running server by communicating with the server process over a control channel, using a utility program such as rndc.

A regression introduced in a recent feature change has created a situation under which some versions of named can be caused to exit with a REQUIRE assertion failure if they are sent a null command string.

CVE-2017-3136 CVE-2017-3137 CVE-2017-3138 https://kb.isc.org/article/AA-01465/0 https://kb.isc.org/article/AA-01466/0 https://kb.isc.org/article/AA-01471/0 2017-04-12 2017-04-13 2017-04-13 id Tech 3 -- remote code execution vulnerability ioquake3 1.36_16 ioquake3-devel g2930 iourbanterror 4.3.2,1 openarena 0.8.8.s1910_3,1

The content auto-download of id Tech 3 can be used to deliver maliciously crafted content, that triggers downloading of further content and loading and executing it as native code with user credentials. This affects ioquake3, ioUrbanTerror, OpenArena, the original Quake 3 Arena and other forks.

CVE-2017-6903 https://ioquake3.org/2017/03/13/important-security-update-please-update-ioquake3-immediately/ 2017-03-14 2017-04-07 xen-kernel -- broken check in memory_exchange() permits PV guest breakout xen-kernel 4.7.2_1

The Xen Project reports:

The XSA-29 fix introduced an insufficient check on XENMEM_exchange input, allowing the caller to drive hypervisor memory accesses outside of the guest provided input/output arrays.

A malicious or buggy 64-bit PV guest may be able to access all of system memory, allowing for all of privilege escalation, host crashes, and information leaks.

CVE-2017-7228 https://xenbits.xen.org/xsa/advisory-212.html 2017-04-04 2017-04-06 cURL -- potential memory disclosure curl 6.57.53.1_1

The cURL project reports:

There were two bugs in curl's parser for the command line option --write-out (or -w for short) that would skip the end of string zero byte if the string ended in a % (percent) or \ (backslash), and it would read beyond that buffer in the heap memory and it could then potentially output pieces of that memory to the terminal or the target file etc..

This flaw only exists in the command line tool.

We are not aware of any exploit of this flaw.

https://curl.haxx.se/docs/adv_20170403.html CVE-2017-7407 2017-04-03 2017-04-05 2017-04-06 django -- multiple vulnerabilities py27-django py33-django py34-django py35-django py36-django 1.8.18 py27-django18 py33-django18 py34-django18 py35-django18 py36-django18 1.8.18 py27-django19 py33-django19 py34-django19 py35-django19 py36-django19 1.9.13 py27-django110 py27-django110 py27-django110 py27-django110 py27-django110 1.10.7

Django team reports:

These release addresses two security issues detailed below. We encourage all users of Django to upgrade as soon as possible.

Open redirect and possible XSS attack via user-supplied numeric redirect URLs

Open redirect vulnerability in django.views.static.serve()

https://www.djangoproject.com/weblog/2017/apr/04/security-releases/ CVE-2017-7233 CVE-2017-7234 2017-04-04 2017-04-04 asterisk -- Buffer overflow in CDR's set user asterisk13 13.14.1

The Asterisk project reports:

No size checking is done when setting the user field on a CDR. Thus, it is possible for someone to use an arbitrarily large string and write past the end of the user field storage buffer. This allows the possibility of remote code injection.

http://downloads.asterisk.org/pub/security/AST-2017-001.html https://issues.asterisk.org/jira/browse/ASTERISK-26897 2017-03-27 2017-04-04 NVIDIA UNIX driver -- multiple vulnerabilities in the kernel mode layer handler nvidia-driver 375.39 nvidia-driver-340 340.102 nvidia-driver-304 304.135

NVIDIA Unix security team reports:

NVIDIA GPU Display Driver contains vulnerabilities in the kernel mode layer handler where multiple integer overflows, improper access control, and improper validation of a user input may cause a denial of service or potential escalation of privileges.

CVE-2017-0309 CVE-2017-0310 CVE-2017-0311 CVE-2017-0318 CVE-2017-0321 http://nvidia.custhelp.com/app/answers/detail/a_id/4398 2017-02-14 2017-04-04 chromium -- multiple vulnerabilities chromium chromium-npapi chromium-pulse 57.0.2987.133

Google Chrome Releases reports:

5 security fixes in this release, including:

[698622] Critical CVE-2017-5055: Use after free in printing. Credit to Wadih Matar

[699166] High CVE-2017-5054: Heap buffer overflow in V8. Credit to Nicolas Trippar of Zimperium zLabs

[662767] High CVE-2017-5052: Bad cast in Blink. Credit to JeongHoon Shin

[705445] High CVE-2017-5056: Use after free in Blink. Credit to anonymous

[702058] High CVE-2017-5053: Out of bounds memory access in V8. Credit to Team Sniper (Keen Lab and PC Mgr) reported through ZDI (ZDI-CAN-4587)

CVE-2017-5055 CVE-2017-5054 CVE-2017-5052 CVE-2017-5056 CVE-2017-5053 https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop_29.html 2017-03-29 2017-03-30 xen-tools -- xenstore denial of service via repeated update xen-tools 4.7.2_1

The Xen Project reports:

Unprivileged guests may be able to stall progress of the control domain or driver domain, possibly leading to a Denial of Service (DoS) of the entire host.

http://xenbits.xen.org/xsa/advisory-206.html 2017-03-28 2017-03-30 phpMyAdmin -- bypass 'no password' restriction phpMyAdmin 4.7.0

The phpMYAdmin team reports:

Summary

Bypass $cfg['Servers'][$i]['AllowNoPassword']

Description

A vulnerability was discovered where the restrictions caused by $cfg['Servers'][$i]['AllowNoPassword'] = false are bypassed under certain PHP versions. This can allow the login of users who have no password set even if the administrator has set $cfg['Servers'][$i]['AllowNoPassword'] to false (which is also the default).

This behavior depends on the PHP version used (it seems PHP 5 is affected, while PHP 7.0 is not).

Severity

We consider this vulnerability to be of moderate severity.

Mitigation factor

Set a password for all users.

https://www.phpmyadmin.net/security/PMASA-2017-8/ 2017-03-28 2017-03-29 samba -- symlink race allows access outside share definition samba36 3.6.03.6.25_4 samba4 4.0.04.0.26 samba41 4.1.04.1.23 samba42 4.2.04.2.14 samba43 4.3.04.3.13 samba44 4.4.04.4.12 samba45 4.5.04.5.7 samba46 4.6.04.6.1

Samba team reports:

A time-of-check, time-of-use race condition can allow clients to access non-exported parts of the file system via symlinks.

https://www.samba.org/samba/security/CVE-2017-2619.html CVE-2017-2619 2017-03-23 2017-03-24 xen-tools -- Cirrus VGA Heap overflow via display refresh xen-tools 4.7.2

The Xen Project reports:

A privileged user within the guest VM can cause a heap overflow in the device model process, potentially escalating their privileges to that of the device model process.

CVE-2016-9603 http://xenbits.xen.org/xsa/advisory-211.html 2017-03-14 2017-03-23 irssi -- use-after-free potential code execution irssi 0.8.21,11.0.2,1

The irssi project reports:

Use after free while producing list of netjoins (CWE-416). This issue was found and reported to us by APic. This issue usually leads to segmentation faults. Targeted code execution should be difficult.

https://irssi.org/security/irssi_sa_2017_03.txt CVE-2017-7191 2017-03-11 2017-03-18 mysql -- denial of service vulnerability mariadb55-client 5.5.54 mariadb100-client 10.0.30 mariadb101-client 10.1.22 mysql55-client 5.5.54 mysql56-client 5.6.21 mysql57-client 5.7.5

Openwall reports:

C client library for MySQL (libmysqlclient.so) has use-after-free defect which can cause crash of applications using that MySQL client.

http://www.openwall.com/lists/oss-security/2017/02/11/11 CVE-2017-3302 2017-01-27 2017-03-18 firefox -- integer overflow in createImageBitmap() firefox 52.0.1,1

The Mozilla Foundation reports:

An integer overflow in createImageBitmap() was reported through the Pwn2Own contest. The fix for this vulnerability disables the experimental extensions to the createImageBitmap API. This function runs in the content sandbox, requiring a second vulnerability to compromise a user's computer.

CVE-2017-5428 https://www.mozilla.org/security/advisories/mfsa2017-08/ 2017-03-17 2017-03-18 moodle -- multiple vulnerabilities moodle29 2.9.9 moodle30 3.0.9 moodle31 3.1.5 moodle32 3.2.2

Marina Glancy reports:

In addition to a number of bug fixes and small improvements, security vulnerabilities have been discovered and fixed. We highly recommend that you upgrade your sites as soon as possible. Upgrading should be very straightforward. As per our usual policy, admins of all registered Moodle sites will be notified of security issue details directly via email and we'll publish details more widely in a week.

https://moodle.org/news/#p1408104 2017-03-13 2017-03-18 moodle -- multiple vulnerabilities moodle29 2.9.9 moodle30 3.0.8 moodle31 3.1.4 moodle32 3.2.1

Marina Glancy reports:

MSA-17-0001: System file inclusion when adding own preset file in Boost theme

MSA-17-0002: Incorrect sanitation of attributes in forums

MSA-17-0003: PHPMailer vulnerability in no-reply address

MSA-17-0004: XSS in assignment submission page

.

CVE-2017-2576 CVE-2017-2578 CVE-2016-10045 https://moodle.org/security/ 2017-01-17 2017-03-18 drupal8 -- multiple vulnerabilities drupal8 8.2.7

Drupal Security Team reports:

CVE-2017-6377: Editor module incorrectly checks access to inline private files

CVE-2017-6379: Some admin paths were not protected with a CSRF token

CVE-2017-6381: Remote code execution

CVE-2017-6377 CVE-2017-6379 CVE-2017-6381 https://www.drupal.org/SA-2017-001 2017-03-15 2017-03-17 PuTTY -- integer overflow permits memory overwrite by forwarded ssh-agent connections putty 0.68

Simon G. Tatham reports:

Many versions of PuTTY prior to 0.68 have a heap-corrupting integer overflow bug in the ssh_agent_channel_data function which processes messages sent by remote SSH clients to a forwarded agent connection. [...]

This bug is only exploitable at all if you have enabled SSH agent forwarding, which is turned off by default. Moreover, an attacker able to exploit this bug would have to have already be able to connect to the Unix-domain socket representing the forwarded agent connection. Since any attacker with that capability would necessarily already be able to generate signatures with your agent's stored private keys, you should in normal circumstances be defended against this vulnerability by the same precautions you and your operating system were already taking to prevent untrusted people from accessing your SSH agent.

http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-agent-fwd-overflow.html CVE-2017-6542 2017-01-29 2017-03-16 Flash Player -- multiple vulnerabilities linux-flashplayer 25.0.0.127

Adobe reports:

These updates resolve a buffer overflow vulnerability that could lead to code execution (CVE-2017-2997).

These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2017-2998, CVE-2017-2999).

These updates resolve a random number generator vulnerability used for constant blinding that could lead to information disclosure (CVE-2017-3000).

These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2017-3001, CVE-2017-3002, CVE-2017-3003).

CVE-2017-2997 CVE-2017-2998 CVE-2017-2999 CVE-2017-3000 CVE-2017-3001 CVE-2017-3002 CVE-2017-3003 https://helpx.adobe.com/security/products/flash-player/apsb17-07.html 2017-03-14 2017-03-16 mbed TLS (PolarSSL) -- multiple vulnerabilities mbedtls 2.4.2 polarssl13 1.3.19

Janos Follath reports:

If a malicious peer supplies a certificate with a specially crafted secp224k1 public key, then an attacker can cause the server or client to attempt to free block of memory held on stack. Depending on the platform, this could result in a Denial of Service (client crash) or potentially could be exploited to allow remote code execution with the same privileges as the host application.

If the client and the server both support MD5 and the client can be tricked to authenticate to a malicious server, then the malicious server can impersonate the client. To launch this man in the middle attack, the adversary has to compute a chosen-prefix MD5 collision in real time. This is very expensive computationally, but can be practical. Depending on the platform, this could result in a Denial of Service (client crash) or potentially could be exploited to allow remote code execution with the same privileges as the host application.

A bug in the logic of the parsing of a PEM encoded Certificate Revocation List in mbedtls_x509_crl_parse() can result in an infinite loop. In versions before 1.3.10 the same bug results in an infinite recursion stack overflow that usually crashes the application. Methods and means of acquiring the CRLs is not part of the TLS handshake and in the strict TLS setting this vulnerability cannot be triggered remotely. The vulnerability cannot be triggered unless the application explicitely calls mbedtls_x509_crl_parse() or mbedtls_x509_crl_parse_file()on a PEM formatted CRL of untrusted origin. In which case the vulnerability can be exploited to launch a denial of service attack against the application.

https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2017-01 2017-03-11 2017-03-12 chromium -- multiple vulnerabilities chromium chromium-npapi chromium-pulse 57.0.2987.98

Google Chrome Releases reports:

36 security fixes in this release, including:

[682194] High CVE-2017-5030: Memory corruption in V8. Credit to Brendon Tiszka

[682020] High CVE-2017-5031: Use after free in ANGLE. Credit to Looben Yang

[668724] High CVE-2017-5032: Out of bounds write in PDFium. Credit to Ashfaq Ansari - Project Srishti

[676623] High CVE-2017-5029: Integer overflow in libxslt. Credit to Holger Fuhrmannek

[678461] High CVE-2017-5034: Use after free in PDFium. Credit to Ke Liu of Tencent's Xuanwu Lab

[688425] High CVE-2017-5035: Incorrect security UI in Omnibox. Credit to Enzo Aguado

[691371] High CVE-2017-5036: Use after free in PDFium. Credit to Anonymous

[679640] High CVE-2017-5037: Multiple out of bounds writes in ChunkDemuxer. Credit to Yongke Wang of Tecent's Xuanwu Lab

[679649] High CVE-2017-5039: Use after free in PDFium. Credit to jinmo123

[691323] Medium CVE-2017-5040: Information disclosure in V8. Credit to Choongwoo Han

[642490] Medium CVE-2017-5041: Address spoofing in Omnibox. Credit to Jordi Chancel

[669086] Medium CVE-2017-5033: Bypass of Content Security Policy in Blink. Credit to Nicolai Grodum

[671932] Medium CVE-2017-5042: Incorrect handling of cookies in Cast. Credit to Mike Ruddy

[695476] Medium CVE-2017-5038: Use after free in GuestView. Credit to Anonymous

[683523] Medium CVE-2017-5043: Use after free in GuestView. Credit to Anonymous

[688987] Medium CVE-2017-5044: Heap overflow in Skia. Credit to Kushal Arvind Shah of Fortinet's FortiGuard Labs

[667079] Medium CVE-2017-5045: Information disclosure in XSS Auditor. Credit to Dhaval Kapil

[680409] Medium CVE-2017-5046: Information disclosure in Blink. Credit to Masato Kinugawa

[699618] Various fixes from internal audits, fuzzing and other initiatives

CVE-2017-5030 CVE-2017-5031 CVE-2017-5032 CVE-2017-5029 CVE-2017-5034 CVE-2017-5035 CVE-2017-5036 CVE-2017-5037 CVE-2017-5039 CVE-2017-5040 CVE-2017-5041 CVE-2017-5033 CVE-2017-5042 CVE-2017-5038 CVE-2017-5043 CVE-2017-5044 CVE-2017-5045 CVE-2017-5046 https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html 2017-03-09 2017-03-12 Several Security Defects in the Bouncy Castle Crypto APIs bouncycastle15 1.511.56

The Legion of the Bouncy Castle reports:

Release: 1.56

2.1.4 Security Related Changes and CVE's Addressed by this Release: (multiple)

ports/215507 https://www.bouncycastle.org/releasenotes.html 2016-12-23 2017-03-12 kde-runtime -- kdesu: displayed command truncated by unicode string terminator kde-runtime 4.14.3_5

Albert Aastals Cid reports:

A maliciously crafted command line for kdesu can result in the user only seeing part of the commands that will actually get executed as super user.

CVE-2016-7787 http://www.openwall.com/lists/oss-security/2016/09/29/7 https://www.kde.org/info/security/advisory-20160930-1.txt 2016-09-30 2017-03-11 kdepimlibs -- directory traversal on KTNEF kdepimlibs 4.14.10_7

Albert Aastals Cid reports:

A directory traversal issue was found in KTNEF which can be exploited by tricking a user into opening a malicious winmail.dat file. The issue allows to write files with the permission of the user opening the winmail.dat file during extraction.

https://www.kde.org/info/security/advisory-20170227-1.txt 2017-02-27 2017-03-11 kio: Information Leak when accessing https when using a malicious PAC file kdelibs 4.14.29_10 kf5-kio 5.31.0_1

Albert Astals Cid reports:

Using a malicious PAC file, and then using exfiltration methods in the PAC function FindProxyForURL() enables the attacker to expose full https URLs.

This is a security issue since https URLs may contain sensitive information in the URL authentication part (user:password@host), and in the path and the query (e.g. access tokens).

This attack can be carried out remotely (over the LAN) since proxy settings allow "Detect Proxy Configuration Automatically". This setting uses WPAD to retrieve the PAC file, and an attacker who has access to the victim's LAN can interfere with the WPAD protocols (DHCP/DNS+HTTP) and inject his/her own malicious PAC instead of the legitimate one.

https://www.kde.org/info/security/advisory-20170228-1.txt 2017-02-28 2017-03-11 wordpress -- multiple vulnerabilities wordpress 4.7.3,1 de-wordpress ja-wordpress ru-wordpress zh-wordpress-zh_CN zh-wordpress-zh_TW 4.7.3

WordPress versions 4.7.2 and earlier are affected by six security issues.

Cross-site scripting (XSS) via media file metadata.

Control characters can trick redirect URL validation.

Unintended files can be deleted by administrators using the plugin deletion functionality.

Cross-site scripting (XSS) via video URL in YouTube embeds.

Cross-site scripting (XSS) via taxonomy term names.

Cross-site request forgery (CSRF) in Press This leading to excessive use of server resources.

http://www.openwall.com/lists/oss-security/2017/03/07/3 https://wordpress.org/news/2017/03/wordpress-4-7-3-security-and-maintenance-release/ 2017-03-07 2017-03-07 mozilla -- multiple vulnerabilities firefox 52.0_1,1 seamonkey linux-seamonkey 2.49 firefox-esr 46.0,152.0,1 45.8.0_1,1 linux-firefox 46.0,252.0,2 45.8.0_1,2 libxul 46.052.0 45.8.0_1 thunderbird linux-thunderbird 46.052.0 45.8.0

Mozilla Foundation reports:

CVE-2017-5400: asm.js JIT-spray bypass of ASLR and DEP

CVE-2017-5401: Memory Corruption when handling ErrorResult

CVE-2017-5402: Use-after-free working with events in FontFace objects

CVE-2017-5403: Use-after-free using addRange to add range to an incorrect root object

CVE-2017-5404: Use-after-free working with ranges in selections

CVE-2017-5406: Segmentation fault in Skia with canvas operations

CVE-2017-5407: Pixel and history stealing via floating-point timing side channel with SVG filters

CVE-2017-5410: Memory corruption during JavaScript garbage collection incremental sweeping

CVE-2017-5411: Use-after-free in Buffer Storage in libGLES

CVE-2017-5409: File deletion via callback parameter in Mozilla Windows Updater and Maintenance Service

CVE-2017-5408: Cross-origin reading of video captions in violation of CORS

CVE-2017-5412: Buffer overflow read in SVG filters

CVE-2017-5413: Segmentation fault during bidirectional operations

CVE-2017-5414: File picker can choose incorrect default directory

CVE-2017-5415: Addressbar spoofing through blob URL

CVE-2017-5416: Null dereference crash in HttpChannel

CVE-2017-5417: Addressbar spoofing by draging and dropping URLs

CVE-2017-5425: Overly permissive Gecko Media Plugin sandbox regular expression access

CVE-2017-5426: Gecko Media Plugin sandbox is not started if seccomp-bpf filter is running

CVE-2017-5427: Non-existent chrome.manifest file loaded during startup

CVE-2017-5418: Out of bounds read when parsing HTTP digest authorization responses

CVE-2017-5419: Repeated authentication prompts lead to DOS attack

CVE-2017-5420: Javascript: URLs can obfuscate addressbar location

CVE-2017-5405: FTP response codes can cause use of uninitialized values for ports

CVE-2017-5421: Print preview spoofing

CVE-2017-5422: DOS attack by using view-source: protocol repeatedly in one hyperlink

CVE-2017-5399: Memory safety bugs fixed in Firefox 52

CVE-2017-5398: Memory safety bugs fixed in Firefox 52 and Firefox ESR 45.8

CVE-2017-5400 CVE-2017-5401 CVE-2017-5402 CVE-2017-5403 CVE-2017-5404 CVE-2017-5406 CVE-2017-5407 CVE-2017-5410 CVE-2017-5411 CVE-2017-5409 CVE-2017-5408 CVE-2017-5412 CVE-2017-5413 CVE-2017-5414 CVE-2017-5415 CVE-2017-5416 CVE-2017-5417 CVE-2017-5425 CVE-2017-5426 CVE-2017-5427 CVE-2017-5418 CVE-2017-5419 CVE-2017-5420 CVE-2017-5405 CVE-2017-5421 CVE-2017-5422 CVE-2017-5399 CVE-2017-5398 https://www.mozilla.org/security/advisories/mfsa2017-05/ https://www.mozilla.org/security/advisories/mfsa2017-06/ 2017-03-07 2017-03-07 codeigniter -- multiple vulnerabilities codeigniter 3.1.3

The CodeIgniter changelog reports:

Fixed an XSS vulnerability in Security Library method xss_clean().

Fixed a possible file inclusion vulnerability in Loader Library method vars().

Fixed a possible remote code execution vulnerability in the Email Library when ‘mail’ or ‘sendmail’ are used (thanks to Paul Buonopane from NamePros).

Added protection against timing side-channel attacks in Security Library method csrf_verify().

Added protection against BREACH attacks targeting the CSRF token field generated by Form Helper function form_open().

https://www.codeigniter.com/user_guide/changelog.html 2017-01-09 2017-03-05 ikiwiki -- authentication bypass vulnerability ikiwiki 3.20170111

ikiwiki reports:

The ikiwiki maintainers discovered further flaws similar to CVE-2016-9646 in the passwordauth plugin's use of CGI::FormBuilder, with a more serious impact:

An attacker who can log in to a site with a password can log in as a different and potentially more privileged user.

An attacker who can create a new account can set arbitrary fields in the user database for that account

CVE-2017-0356 https://ikiwiki.info/security/#index48h2 2017-01-11 2017-03-05 ikiwiki -- multiple vulnerabilities ikiwiki 3.20161229

Mitre reports:

ikiwiki 3.20161219 does not properly check if a revision changes the access permissions for a page on sites with the git and recentchanges plugins and the CGI interface enabled, which allows remote attackers to revert certain changes by leveraging permissions to change the page before the revision was made.

When CGI::FormBuilder->field("foo") is called in list context (and in particular in the arguments to a subroutine that takes named arguments), it can return zero or more values for foo from the CGI request, rather than the expected single value. This breaks the usual Perl parsing convention for named arguments, similar to CVE-2014-1572 in Bugzilla (which was caused by a similar API design issue in CGI.pm).

CVE-2016-10026 CVE-2016-9645 CVE-2016-9646 https://ikiwiki.info/security/#index46h2 https://ikiwiki.info/security/#index47h2 2016-12-19 2017-03-05 potrace -- multiple memory failure potrace 1.13

potrace reports:

CVE-2016-8685: invalid memory access in findnext

CVE-2016-8686: memory allocation failure

https://sourceforge.net/p/potrace/news/2017/02/potrace-114-released/ CVE-2016-8685 CVE-2016-8686 2016-10-15 2017-02-28 MPD -- buffer overflows in http output musicpd 0.20.5

The MPD project reports:

httpd: fix two buffer overflows in IcyMetaData length calculation

http://git.musicpd.org/cgit/master/mpd.git/plain/NEWS?h=v0.20.5 2017-02-18 2017-02-26 cURL -- ocsp status validation error curl 7.52.07.53.0

The cURL project reports:

SSL_VERIFYSTATUS ignored
curl and libcurl support "OCSP stapling", also known as the TLS Certificate Status Request extension (using the CURLOPT_SSL_VERIFYSTATUS option). When telling curl to use this feature, it uses that TLS extension to ask for a fresh proof of the server's certificate's validity. If the server doesn't support the extension, or fails to provide said proof, curl is expected to return an error.
Due to a coding mistake, the code that checks for a test success or failure, ends up always thinking there's valid proof, even when there is none or if the server doesn't support the TLS extension in question. Contrary to how it used to function and contrary to how this feature is documented to work.
This could lead to users not detecting when a server's certificate goes invalid or otherwise be mislead that the server is in a better shape than it is in reality.

https://curl.haxx.se/docs/adv_20170222.html CVE-2017-2629 2017-02-22 2017-02-22 xen-tools -- cirrus_bitblt_cputovideo does not check if memory region is safe xen-tools 4.7.1_4

The Xen Project reports:

In CIRRUS_BLTMODE_MEMSYSSRC mode the bitblit copy routine cirrus_bitblt_cputovideo fails to check wethehr the specified memory region is safe. A malicious guest administrator can cause an out of bounds memory write, very likely exploitable as a privilege escalation.

CVE-2017-2620 http://xenbits.xen.org/xsa/advisory-209.html 2017-02-21 2017-02-22 fbsdmon -- information disclosure vulnerability fbsdmon 0

Alan Somers reports:

The web site used by this port, http://fbsdmon.org, has been taken over by cybersquatters. That means that users are sending their system info to an unknown party.

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=217099 2017-02-14 2017-02-21 wavpack -- multiple invalid memory reads wavpack 5.1.0

David Bryant reports:

global buffer overread in read_code / read_words.c

heap out of bounds read in WriteCaffHeader / caff.c

heap out of bounds read in unreorder_channels / wvunpack.c

heap oob read in read_new_config_info / open_utils.c

http://www.openwall.com/lists/oss-security/2017/01/23/4 CVE-2016-10169 CVE-2016-10170 CVE-2016-10171 CVE-2016-10172 https://github.com/dbry/WavPack/commit/4bc05fc490b66ef2d45b1de26abf1455b486b0dc 2017-01-21 2017-02-18 optipng -- multiple vulnerabilities optipng 0.7.6

ifread.c in gif2png, as used in OptiPNG before 0.7.6, allows remote attackers to cause a denial of service (uninitialized memory read) via a crafted GIF file.

The bmp_read_rows function in pngxtern/pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (invalid memory write and crash) via a series of delta escapes in a crafted BMP image.

Heap-based buffer overflow in the bmp_read_rows function in pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (out-of-bounds read or write access and crash) or possibly execute arbitrary code via a crafted image file.

Off-by-one error in the bmp_rle4_fread function in pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (out-of-bounds read or write access and crash) or possibly execute arbitrary code via a crafted image file, which triggers a heap-based buffer overflow.

CVE-2015-7802 CVE-2016-2191 CVE-2016-3981 CVE-2016-3982 2015-10-09 2017-02-16 openssl -- crash on handshake openssl-devel 1.1.0e

The OpenSSL project reports:

Severity: High
During a renegotiation handshake if the Encrypt-Then-Mac extension is negotiated where it was not in the original handshake (or vice-versa) then this can cause OpenSSL to crash (dependent on ciphersuite). Both clients and servers are affected.
This issue does not affect OpenSSL version 1.0.2.

https://www.openssl.org/news/secadv/20170216.txt CVE-2017-3733 2017-02-16 2017-02-16 diffoscope -- arbitrary file write py34-diffoscope py35-diffoscope py36-diffoscope 6776

Ximin Luo reports:

[v67] introduced a security hole where diffoscope may write to arbitrary locations on disk depending on the contents of an untrusted archive.

CVE-2017-0359 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=854723 2017-02-09 2017-02-14 2017-02-16 ffmpeg -- heap overflow in lavf/mov.c ffmpeg 3.2.4,1

FFmpeg security reports:

FFmpeg 3.2.4 fixes the following vulnerabilities: CVE-2017-5024, CVE-2017-5025

CVE-2017-5024 https://www.ffmpeg.org/security.html https://chromereleases.googleblog.com/2017/01/stable-channel-update-for-desktop.html CVE-2017-5025 https://www.ffmpeg.org/security.html https://chromereleases.googleblog.com/2017/01/stable-channel-update-for-desktop.html 2017-01-25 2017-02-12 gtk-vnc -- bounds checking vulnabilities gtk-vnc 0.7.0

Daniel P. Berrange reports:

CVE-2017-5884 - fix bounds checking for RRE, hextile and copyrect encodings

CVE-2017-5885 - fix color map index bounds checking.

https://mail.gnome.org/archives/ftp-release-list/2017-February/msg00015.html CVE-2017-5884 CVE-2017-5885 2017-02-09 2017-02-11 xen-tools -- oob access in cirrus bitblt copy xen-tools 4.7.1_2

The Xen Project reports:

When doing bitblt copy backwards, qemu should negate the blit width. This avoids an oob access before the start of video memory.

A malicious guest administrator can cause an out of bounds memory access, possibly leading to information disclosure or privilege escalation.

CVE-2017-2615 http://xenbits.xen.org/xsa/advisory-208.html 2017-02-10 2017-02-11 tiff -- multiple vulnerabilities tiff 4.0.7 linux-c6-libtiff linux-c6-tiff 3.9.4_5 linux-c7-libtiff linux-c7-tiff 4.0.3_3

libtiff project reports:

Multiple flaws have been discovered in libtiff library and utilities.

http://simplesystems.org/libtiff/v4.0.7.html CVE-2016-9533 CVE-2016-9534 CVE-2016-9535 CVE-2015-8870 CVE-2016-5652 CVE-2016-9540 CVE-2016-9537 CVE-2016-9536 2016-11-19 2017-02-06 mantis -- XSS vulnerability mantis 1.2.19

wdollman reports:

The value of the view_type parameter on the view_all_bug_page.php page is not encoded before being displayed on the page.

https://mantisbt.org/bugs/view.php?id=21611 CVE-2016-6837 ports/216662 2016-08-15 2017-02-04 guile2 -- multiple vulnerabilities guile2 2.0.13

Ludovic Courtès reports:

The REPL server is vulnerable to the HTTP inter-protocol attack

The ‘mkdir’ procedure of GNU Guile, an implementation of the Scheme programming language, temporarily changed the process’ umask to zero. During that time window, in a multithreaded application, other threads could end up creating files with insecure permissions.

http://www.openwall.com/lists/oss-security/2016/10/11/1 http://www.openwall.com/lists/oss-security/2016/10/12/2 CVE-2016-8605 CVE-2016-8606 ports/216663 2016-10-12 2017-02-04 chicken -- multiple vulnerabilities chicken 4.12,1

Peter Bex reports:

A buffer overflow error was found in the POSIX unit's procedures process-execute and process-spawn.

Additionally, a memory leak existed in this code, which would be triggered when an error is raised during argument and environment processing.

Irregex versions before 0.9.6 contain a resource exhaustion vulnerability: when compiling deeply nested regexes containing the "+" operator due to exponential expansion behaviour.

http://lists.nongnu.org/archive/html/chicken-announce/2016-08/msg00001.html CVE-2016-6830 CVE-2016-6831 CVE-2016-9954 ports/216661 2016-08-12 2017-02-04 2017-03-05 libebml -- multiple vulnerabilities libebml 1.3.3

Mortiz Bunkus reports:

Multiple invalid memory accesses vulnerabilities.

https://lists.matroska.org/pipermail/matroska-users/2015-October/006985.html CVE-2015-8789 CVE-2015-8790 CVE-2015-8791 ports/216659 2015-10-20 2017-02-04 freeimage -- code execution vulnerability freeimage 0

TALOS reports:

An exploitable out-of-bounds write vulnerability exists in the XMP image handling functionality of the FreeImage library.

http://www.talosintelligence.com/reports/TALOS-2016-0189/ CVE-2016-5684 ports/216657 2016-10-03 2017-02-04 shotwell -- failure to encrypt authentication shotwell 0.24.5

Jens Georg reports:

I have just released Shotwell 0.24.5 and 0.25.4 which turn on HTTPS encyption all over the publishing plugins.

Users using Tumblr and Yandex.Fotki publishing are strongly advised to change their passwords and reauthenticate Shotwell to those services after upgrade.

Users of Picasa and Youtube publishing are strongly advised to reauthenticate (Log out and back in) Shotwell to those services after upgrade.

https://mail.gnome.org/archives/shotwell-list/2017-January/msg00048.html 2017-01-31 2017-02-01 jenkins -- multiple vulnerabilities jenkins 2.44 jenkins-lts 2.32.2

Jenkins Security Advisory:

Description

SECURITY-304 / CVE-2017-2598

Use of AES ECB block cipher mode without IV for encrypting secrets

SECURITY-321 / CVE-2017-2599

Items could be created with same name as existing item

SECURITY-343 / CVE-2017-2600

Node monitor data could be viewed by low privilege users

SECURITY-349 / CVE-2011-4969

Possible cross-site scripting vulnerability in jQuery bundled with timeline widget

SECURITY-353 / CVE-2017-2601

Persisted cross-site scripting vulnerability in parameter names and descriptions

SECURITY-354 / CVE-2015-0886

Outdated jbcrypt version bundled with Jenkins

SECURITY-358 / CVE-2017-2602

Pipeline metadata files not blacklisted in agent-to-master security subsystem

SECURITY-362 / CVE-2017-2603

User data leak in disconnected agents' config.xml API

SECURITY-371 / CVE-2017-2604

Low privilege users were able to act on administrative monitors

SECURITY-376 / CVE-2017-2605

Re-key admin monitor leaves behind unencrypted credentials in upgraded installations

SECURITY-380 / CVE-2017-2606

Internal API allowed access to item names that should not be visible

SECURITY-382 / CVE-2017-2607

Persisted cross-site scripting vulnerability in console notes

SECURITY-383 / CVE-2017-2608

XStream remote code execution vulnerability

SECURITY-385 / CVE-2017-2609

Information disclosure vulnerability in search suggestions

SECURITY-388 / CVE-2017-2610

Persisted cross-site scripting vulnerability in search suggestions

SECURITY-389 / CVE-2017-2611

Insufficient permission check for periodic processes

SECURITY-392 / CVE-2017-2612

Low privilege users were able to override JDK download credentials

SECURITY-406 / CVE-2017-2613

User creation CSRF using GET by admins

CVE-2017-2598 CVE-2017-2599 CVE-2017-2600 CVE-2011-4969 CVE-2017-2601 CVE-2015-0886 CVE-2017-2602 CVE-2017-2603 CVE-2017-2604 CVE-2017-2605 CVE-2017-2606 CVE-2017-2607 CVE-2017-2608 CVE-2017-2609 CVE-2017-2610 CVE-2017-2611 CVE-2017-2612 CVE-2017-2613 https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2017-02-01 2017-02-01 2017-02-01 wordpress -- multiple vulnerabilities wordpress 4.7.2,1 de-wordpress ja-wordpress ru-wordpress zh-wordpress-zh_CN zh-wordpress-zh_TW 4.7.2

Aaron D. Campbell reports:

WordPress versions 4.7.1 and earlier are affected by three security issues:

The user interface for assigning taxonomy terms in Press This is shown to users who do not have permissions to use it.

WP_Query is vulnerable to a SQL injection (SQLi) when passing unsafe data. WordPress core is not directly vulnerable to this issue, but we’ve added hardening to prevent plugins and themes from accidentally causing a vulnerability.

A cross-site scripting (XSS) vulnerability was discovered in the posts list table.

An unauthenticated privilege escalation vulnerability was discovered in a REST API endpoint.

CVE-2017-5610 CVE-2017-5611 CVE-2017-5612 http://www.openwall.com/lists/oss-security/2017/01/28/5 https://wordpress.org/news/2017/01/wordpress-4-7-2-security-release/ https://make.wordpress.org/core/2017/02/01/disclosure-of-additional-security-fix-in-wordpress-4-7-2/ 2017-01-26 2017-01-29 nfsen -- remote command execution nfsen 1.3.7

Peter Haag reports:

A remote attacker with access to the web interface to execute arbitrary commands on the host operating system.

https://sourceforge.net/p/nfsen/mailman/message/35623845/ 2017-01-24 2017-01-27 chromium -- multiple vulnerabilities chromium chromium-npapi chromium-pulse 56.0.2924.76

Google Chrome Releases reports:

51 security fixes in this release, including:

[671102] High CVE-2017-5007: Universal XSS in Blink. Credit to Mariusz Mlynski

[673170] High CVE-2017-5006: Universal XSS in Blink. Credit to Mariusz Mlynski

[668552] High CVE-2017-5008: Universal XSS in Blink. Credit to Mariusz Mlynski

[663476] High CVE-2017-5010: Universal XSS in Blink. Credit to Mariusz Mlynski

[662859] High CVE-2017-5011: Unauthorised file access in Devtools. Credit to Khalil Zhani

[667504] High CVE-2017-5009: Out of bounds memory access in WebRTC. Credit to Sean Stanek and Chip Bradford

[681843] High CVE-2017-5012: Heap overflow in V8. Credit to Gergely Nagy (Tresorit)

[677716] Medium CVE-2017-5013: Address spoofing in Omnibox. Credit to Haosheng Wang (@gnehsoah)

[675332] Medium CVE-2017-5014: Heap overflow in Skia. Credit to sweetchip

[673971] Medium CVE-2017-5015: Address spoofing in Omnibox. Credit to Armin Razmdjou

[666714] Medium CVE-2017-5019: Use after free in Renderer. Credit to Wadih Matar

[673163] Medium CVE-2017-5016: UI spoofing in Blink. Credit to Haosheng Wang (@gnehsoah)

[676975] Medium CVE-2017-5017: Uninitialised memory access in webm video. Credit to danberm

[668665] Medium CVE-2017-5018: Universal XSS in chrome://apps. Credit to Rob Wu

[668653] Medium CVE-2017-5020: Universal XSS in chrome://downloads. Credit to Rob Wu

[663726] Low CVE-2017-5021: Use after free in Extensions. Credit to Rob Wu

[663620] Low CVE-2017-5022: Bypass of Content Security Policy in Blink. Credit to Pujun Li of PKAV Team

[651443] Low CVE-2017-5023: Type confunsion in metrics. Credit to the UK's National Cyber Security Centre (NCSC)

[643951] Low CVE-2017-5024: Heap overflow in FFmpeg. Credit to Paul Mehta

[643950] Low CVE-2017-5025: Heap overflow in FFmpeg. Credit to Paul Mehta

[634108] Low CVE-2017-5026: UI spoofing. Credit to Ronni Skansing

[685349] Various fixes from internal audits, fuzzing and other initiatives

CVE-2017-5007 CVE-2017-5006 CVE-2017-5008 CVE-2017-5010 CVE-2017-5011 CVE-2017-5009 CVE-2017-5012 CVE-2017-5013 CVE-2017-5014 CVE-2017-5015 CVE-2017-5019 CVE-2017-5016 CVE-2017-5017 CVE-2017-5018 CVE-2017-2020 CVE-2017-2021 CVE-2017-2022 CVE-2017-2023 CVE-2017-2024 CVE-2017-2025 CVE-2017-2026 https://chromereleases.googleblog.com/2017/01/stable-channel-update-for-desktop.html 2017-01-25 2017-01-26 OpenSSL -- multiple vulnerabilities openssl 1.0.2k,1 openssl-devel 1.1.0d linux-c6-openssl 1.0.1e_13 linux-c7-openssl-libs 1.0.1e_3 FreeBSD 11.011.0_8 10.310.3_17

The OpenSSL project reports:

Truncated packet could crash via OOB read (CVE-2017-3731)
Severity: Moderate
If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash.

Bad (EC)DHE parameters cause a client crash (CVE-2017-3730)
Severity: Moderate
If a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this can result in the client attempting to dereference a NULL pointer leading to a client crash. This could be exploited in a Denial of Service attack.

BN_mod_exp may produce incorrect results on x86_64 (CVE-2017-3732)
Severity: Moderate
There is a carry propagating bug in the x86_64 Montgomery squaring procedure. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be very significant and likely only accessible to a limited number of attackers. An attacker would additionally need online access to an unpatched system using the target private key in a scenario with persistent DH parameters and a private key that is shared between multiple clients. For example this can occur by default in OpenSSL DHE based SSL/TLS ciphersuites. Note: This issue is very similar to CVE-2015-3193 but must be treated as a separate problem.

Montgomery multiplication may produce incorrect results (CVE-2016-7055)
Severity: Low
There is a carry propagating bug in the Broadwell-specific Montgomery multiplication procedure that handles input lengths divisible by, but longer than 256 bits. (OpenSSL 1.0.2 only)
This issue was previously fixed in 1.1.0c

https://www.openssl.org/news/secadv/20170126.txt CVE-2016-7055 CVE-2017-3730 CVE-2017-3731 CVE-2017-3732 SA-17:02.openssl 2017-01-26 2017-01-26 2017-05-26 mozilla -- multiple vulnerabilities firefox 51.0_1,1 seamonkey linux-seamonkey 2.48 firefox-esr 45.7.0,1 linux-firefox 45.7.0,2 libxul thunderbird linux-thunderbird 45.7.0

Mozilla Foundation reports:

CVE-2017-5373: Memory safety bugs fixed in Firefox 51 and Firefox ESR 45.7

CVE-2017-5374: Memory safety bugs fixed in Firefox 51

CVE-2017-5375: Excessive JIT code allocation allows bypass of ASLR and DEP

CVE-2017-5376: Use-after-free in XSL

CVE-2017-5377: Memory corruption with transforms to create gradients in Skia

CVE-2017-5378: Pointer and frame data leakage of Javascript objects

CVE-2017-5379: Use-after-free in Web Animations

CVE-2017-5380: Potential use-after-free during DOM manipulations

CVE-2017-5381: Certificate Viewer exporting can be used to navigate and save to arbitrary filesystem locations

CVE-2017-5382: Feed preview can expose privileged content errors and exceptions

CVE-2017-5383: Location bar spoofing with unicode characters

CVE-2017-5384: Information disclosure via Proxy Auto-Config (PAC)

CVE-2017-5385: Data sent in multipart channels ignores referrer-policy response headers

CVE-2017-5386: WebExtensions can use data: protocol to affect other extensions

CVE-2017-5387: Disclosure of local file existence through TRACK tag error messages

CVE-2017-5388: WebRTC can be used to generate a large amount of UDP traffic for DDOS attacks

CVE-2017-5389: WebExtensions can install additional add-ons via modified host requests

CVE-2017-5390: Insecure communication methods in Developer Tools JSON viewer

CVE-2017-5391: Content about: pages can load privileged about: pages

CVE-2017-5392: Weak references using multiple threads on weak proxy objects lead to unsafe memory usage

CVE-2017-5393: Remove addons.mozilla.org CDN from whitelist for mozAddonManager

CVE-2017-5394: Android location bar spoofing using fullscreen and JavaScript events

CVE-2017-5395: Android location bar spoofing during scrolling

CVE-2017-5396: Use-after-free with Media Decoder

CVE-2017-5373 CVE-2017-5374 CVE-2017-5375 CVE-2017-5376 CVE-2017-5377 CVE-2017-5378 CVE-2017-5379 CVE-2017-5380 CVE-2017-5381 CVE-2017-5382 CVE-2017-5383 CVE-2017-5384 CVE-2017-5385 CVE-2017-5386 CVE-2017-5387 CVE-2017-5388 CVE-2017-5389 CVE-2017-5390 CVE-2017-5391 CVE-2017-5392 CVE-2017-5393 CVE-2017-5394 CVE-2017-5395 CVE-2017-5396 https://www.mozilla.org/security/advisories/mfsa2017-01/ https://www.mozilla.org/security/advisories/mfsa2017-02/ 2017-01-24 2017-01-24 phpMyAdmin -- Multiple vulnerabilities phpMyAdmin 4.6.04.6.6

The phpMyAdmin development team reports:

Summary

Open redirect

Description

It was possible to trick phpMyAdmin to redirect to insecure using special request path.

Severity

We consider this vulnerability to be non critical.

Summary

php-gettext code execution

Description

The php-gettext library can suffer to code execution. However there is no way to trigger this inside phpMyAdmin.

Severity

We consider this to be minor.

Summary

DOS vulnerabiltiy in table editing

Description

It was possible to trigger recursive include operation by crafter parameters when editing table data.

Severity

We consider this to be non critical.

Summary

CSS injection in themes

Description

It was possible to cause CSS injection in themes by crafted cookie parameters.

Severity

We consider this to be non critical.

Summary

Cookie attribute injection attack

Description

A vulnerability was found where, under some circumstances, an attacker can inject arbitrary values in the browser cookies. This was incompletely fixed in PMASA-2016-18.

Severity

We consider this to be non-critical.

Summary

SSRF in replication

Description

For a user with appropriate MySQL privileges it was possible to connect to arbitrary host.

Severity

We consider this to be non-critical.

Summary

DOS in replication status

Description

It was possible to trigger DOS in replication status by specially crafted table name.

Severity

We consider this to be non critical.

https://www.phpmyadmin.net/security/PMASA-2017-1 https://www.phpmyadmin.net/security/PMASA-2017-2 https://www.phpmyadmin.net/security/PMASA-2017-3 https://www.phpmyadmin.net/security/PMASA-2017-4 https://www.phpmyadmin.net/security/PMASA-2017-5 https://www.phpmyadmin.net/security/PMASA-2017-6 https://www.phpmyadmin.net/security/PMASA-2017-7 CVE-2015-8980 2017-01-24 2017-01-24 Intel(R) NVMUpdate -- Intel(R) Ethernet Controller X710/XL710 NVM Security Vulnerability intel-nvmupdate 5.05

Intel Corporaion reports:

A security vulnerability in the Intel(R) Ethernet Controller X710 and Intel(R) Ethernet Controller XL710 family of products (Fortville) has been found in the Non-Volatile Flash Memory (NVM) image.

https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00063&languageid=en-fr CVE-2016-8106 2017-01-09 2017-01-23 PHP -- undisclosed vulnerabilities php56 5.6.30 php70 7.0.15

The PHP project reports:

The PHP development team announces the immediate availability of PHP 7.0.15. This is a security release. Several security bugs were fixed in this release.

The PHP development team announces the immediate availability of PHP 5.6.30. This is a security release. Several security bugs were fixed in this release.

http://php.net/archive/2017.php#id2017-01-19-2 http://php.net/archive/2017.php#id2017-01-19-3 2017-01-19 2017-01-19 2017-01-20 icoutils -- check_offset overflow on 64-bit systems icoutils 0.31.1

Choongwoo Han reports:

An exploitable crash exists in the wrestool utility on 64-bit systems where the result of subtracting two pointers exceeds the size of int.

CVE-2017-5208 CVE-2017-5331 CVE-2017-5332 CVE-2017-5333 http://seclists.org/oss-sec/2017/q1/38 2017-01-03 2017-01-19 mysql -- multiple vulnerabilities mariadb55-server 5.5.54 mariadb100-server 10.0.30 mariadb101-server 10.1.22 mysql55-server 5.5.54 mysql56-server 5.6.35 mysql57-server 5.7.17

Oracle reports:

No further details have been provided in the Critical Patch Update

http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html#AppendixMSQL CVE-2016-8318 CVE-2017-3312 CVE-2017-3258 CVE-2017-3273 CVE-2017-3244 CVE-2017-3257 CVE-2017-3238 CVE-2017-3256 CVE-2017-3291 CVE-2017-3265 CVE-2017-3251 CVE-2017-3313 CVE-2017-3243 CVE-2016-8327 CVE-2017-3317 CVE-2017-3318 CVE-2017-3319 CVE-2017-3320 2017-01-18 2017-01-18 2017-03-14 powerdns -- multiple vulnerabilities powerdns 3.4.11 4.0.04.0.2 powerdns-recursor 3.7.4 4.0.04.0.4

PowerDNS reports:

2016-02: Crafted queries can cause abnormal CPU usage

2016-03: Denial of service via the web server

2016-04: Insufficient validation of TSIG signatures

2016-05: Crafted zone record can cause a denial of service

CVE-2016-7068 CVE-2016-7072 CVE-2016-7073 CVE-2016-7074 CVE-2016-2120 ports/216135 ports/216136 https://doc.powerdns.com/md/security/powerdns-advisory-2016-02/ https://doc.powerdns.com/md/security/powerdns-advisory-2016-03/ https://doc.powerdns.com/md/security/powerdns-advisory-2016-04/ https://doc.powerdns.com/md/security/powerdns-advisory-2016-05/ https://blog.powerdns.com/2017/01/13/powerdns-authoritative-server-4-0-2-released/ https://blog.powerdns.com/2017/01/13/powerdns-recursor-4-0-4-released/ 2016-12-15 2017-01-18 groovy -- remote execution of untrusted code/DoS vulnerability groovy 1.7.02.4.8

The Apache Groovy project reports:

When an application with Groovy on classpath uses standard Java serialization mechanisms, e.g. to communicate between servers or to store local data, it is possible for an attacker to bake a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects are subject to this vulnerability. This is similar to CVE-2015-3253 but this exploit involves extra wrapping of objects and catching of exceptions which are now safe guarded against.

CVE-2016-6814 http://groovy-lang.org/security.html 2016-09-20 2017-01-15 RabbitMQ -- Authentication vulnerability rabbitmq 3.0.03.5.8 3.6.03.6.6

Pivotal.io reports:

MQTT (MQ Telemetry Transport) connection authentication with a username/password pair succeeds if an existing username is provided but the password is omitted from the connection request. Connections that use TLS with a client-provided certificate are not affected.

CVE-2016-9877 https://pivotal.io/security/cve-2016-9877 https://github.com/rabbitmq/rabbitmq-server/releases/tag/rabbitmq_v3_6_6 2016-12-06 2017-01-15 wordpress -- multiple vulnerabilities wordpress 4.7.1,1 de-wordpress ja-wordpress ru-wordpress zh-wordpress-zh_CN zh-wordpress-zh_TW 4.7.1

Aaron D. Campbell reports:

WordPress versions 4.7 and earlier are affected by eight security issues...

CVE-2017-5487 CVE-2017-5488 CVE-2017-5489 CVE-2017-5490 CVE-2017-5491 CVE-2017-5492 CVE-2017-5493 http://www.openwall.com/lists/oss-security/2017/01/14/6 https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/ 2017-01-11 2017-01-15 mysql -- multiple vulnerabilities mysql57-client mysql57-server 5.7.15

Oracle reports:

Local security vulnerability in 'Server: Packaging' sub component.

93617 CVE-2016-5625 http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html 2016-10-18 2017-01-14 2017-01-15 MySQL -- multiple vulnerabilities mariadb55-client mariadb55-server 5.5.52 mariadb100-client mariadb100-server 10.0.28 mariadb101-client mariadb101-server 10.1.18 mysql55-client mysql55-server 5.5.52 mysql56-client mysql56-server 5.6.33 mysql57-client mysql57-server 5.7.15 percona55-client percona55-server 5.5.51.38.2 percona56-client percona56-server 5.6.32.78.1

The MySQL project reports:

CVE-2016-3492: Remote security vulnerability in 'Server: Optimizer' sub component.

CVE-2016-5616, CVE-2016-6663: Race condition allows local users with certain permissions to gain privileges by leveraging use of my_copystat by REPAIR TABLE to repair a MyISAM table.

CVE-2016-5617, CVE-2016-6664: mysqld_safe, when using file-based logging, allows local users with access to the mysql account to gain root privileges via a symlink attack on error logs and possibly other files.

CVE-2016-5624: Remote security vulnerability in 'Server: DML' sub component.

CVE-2016-5626: Remote security vulnerability in 'Server: GIS' sub component.

CVE-2016-5629: Remote security vulnerability in 'Server: Federated' sub component.

CVE-2016-8283: Remote security vulnerability in 'Server: Types' sub component.

http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html#AppendixMSQL https://mariadb.com/kb/en/mariadb/mariadb-10028-release-notes/ https://mariadb.com/kb/en/mariadb/mariadb-5552-release-notes/ https://mariadb.com/kb/en/mariadb/mariadb-10118-release-notes/ CVE-2016-3492 CVE-2016-5616 CVE-2016-5617 CVE-2016-5624 CVE-2016-5626 CVE-2016-5629 CVE-2016-6663 CVE-2016-6664 CVE-2016-8283 2016-09-13 2017-01-14 Ansible -- Command execution on Ansible controller from host ansible 1.9.6_12.2.0.0_2

Computest reports:

Computest found and exploited several issues that allow a compromised host to execute commands on the Ansible controller and thus gain access to other hosts controlled by that controller.

CVE-2016-9587 https://www.computest.nl/advisories/CT-2017-0109_Ansible.txt https://lwn.net/Articles/711357/ 2017-01-09 2017-01-12 phpmailer -- Remote Code Execution phpmailer 5.2.22 tt-rss 2017.01.16

SecurityFocus reports:

PHPMailer is prone to an local information-disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may aid in launching further attacks.

http://www.securityfocus.com/bid/95328/discuss CVE-2017-5223 2017-01-10 2017-01-12 BIND -- multiple vulnerabilities bind99 9.9.9P5 bind910 9.10.4P5 bind911 9.11.0P2 bind9-devel 9.12.0.a.2016.12.28 FreeBSD 9.310.0

ISC reports:

A malformed query response received by a recursive server in response to a query of RTYPE ANY could trigger an assertion failure while named is attempting to add the RRs in the query response to the cache.

Depending on the type of query and the EDNS options in the query they receive, DNSSEC-enabled authoritative servers are expected to include RRSIG and other RRsets in their responses to recursive servers. DNSSEC-validating servers will also make specific queries for DS and other RRsets. Whether DNSSEC-validating or not, an error in processing malformed query responses that contain DNSSEC-related RRsets that are inconsistent with other RRsets in the same query response can trigger an assertion failure. Although the combination of properties which triggers the assertion should not occur in normal traffic, it is potentially possible for the assertion to be triggered deliberately by an attacker sending a specially-constructed answer.

An unusually-formed answer containing a DS resource record could trigger an assertion failure. While the combination of properties which triggers the assertion should not occur in normal traffic, it is potentially possible for the assertion to be triggered deliberately by an attacker sending a specially-constructed answer having the required properties.

An error in handling certain queries can cause an assertion failure when a server is using the nxdomain-redirect feature to cover a zone for which it is also providing authoritative service. A vulnerable server could be intentionally stopped by an attacker if it was using a configuration that met the criteria for the vulnerability and if the attacker could cause it to accept a query that possessed the required attributes.

CVE-2016-9131 CVE-2016-9147 CVE-2016-9444 CVE-2016-9778 https://kb.isc.org/article/AA-01439/0 https://kb.isc.org/article/AA-01440/0 https://kb.isc.org/article/AA-01441/0 https://kb.isc.org/article/AA-01442/0 2017-01-11 2017-01-12 FreeBSD -- OpenSSH multiple vulnerabilities openssh-portable 7.3.p1_5,1 FreeBSD 11.011.0_7 10.310.3_16

Problem Description:

The ssh-agent(1) agent supports loading a PKCS#11 module from outside a trusted whitelist. An attacker can request loading of a PKCS#11 module across forwarded agent-socket. [CVE-2016-10009]

When privilege separation is disabled, forwarded Unix domain sockets would be created by sshd(8) with the privileges of 'root' instead of the authenticated user. [CVE-2016-10010]

Impact:

A remote attacker who have control of a forwarded agent-socket on a remote system and have the ability to write files on the system running ssh-agent(1) agent can run arbitrary code under the same user credential. Because the attacker must already have some control on both systems, it is relatively hard to exploit this vulnerability in a practical attack. [CVE-2016-10009]

When privilege separation is disabled (on FreeBSD, privilege separation is enabled by default and has to be explicitly disabled), an authenticated attacker can potentially gain root privileges on systems running OpenSSH server. [CVE-2016-10010]

CVE-2016-10009 CVE-2016-10010 SA-17:01.openssh 2017-01-11 2017-01-11 2017-01-13 openssl -- timing attack vulnerability openssl 1.0.2 libressl 2.4.4_1 libressl-devel 2.5.0_1

Cesar Pereida Garcia reports:

The signing function in crypto/ecdsa/ecdsa_ossl.c in certain OpenSSL versions and forks is vulnerable to timing attacks when signing with the standardized elliptic curve P-256 despite featuring constant-time curve operations and modular inversion. A software defect omits setting the BN_FLG_CONSTTIME flag for nonces, failing to take a secure code path in the BN_mod_inverse method and therefore resulting in a cache-timing attack vulnerability.
A malicious user with local access can recover ECDSA P-256 private keys.

http://seclists.org/oss-sec/2017/q1/52 CVE-2016-7056 2017-01-10 2017-01-11 2017-01-11 flash -- multiple vulnerabilities linux-flashplayer 24.0.0.194

Adobe reports:

These updates resolve a security bypass vulnerability that could lead to information disclosure (CVE-2017-2938).

These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2017-2932, CVE-2017-2936, CVE-2017-2937).

These updates resolve heap buffer overflow vulnerabilities that could lead to code execution (CVE-2017-2927, CVE-2017-2933, CVE-2017-2934, CVE-2017-2935).

These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2017-2925, CVE-2017-2926, CVE-2017-2928, CVE-2017-2930, CVE-2017-2931).

CVE-2017-2925 CVE-2017-2926 CVE-2017-2927 CVE-2017-2928 CVE-2017-2930 CVE-2017-2931 CVE-2017-2932 CVE-2017-2933 CVE-2017-2934 CVE-2017-2935 CVE-2017-2936 CVE-2017-2937 CVE-2017-2938 https://helpx.adobe.com/security/products/flash-player/apsb17-02.html 2017-01-10 2017-01-11 moinmoin -- XSS vulnerabilities moinmoin 1.9.9

Thomas Waldmann reports:

fix XSS in AttachFile view (multifile related) CVE-2016-7148

fix XSS in GUI editor's attachment dialogue CVE-2016-7146

fix XSS in GUI editor's link dialogue CVE-2016-9119

http://hg.moinmo.in/moin/1.9/file/1.9.9/docs/CHANGES CVE-2016-7148 CVE-2016-7146 CVE-2016-9119 ports/214937 2016-10-31 2017-01-09 libvncserver -- multiple buffer overflows libvncserver 0.9.11

libvnc server reports:

Two unrelated buffer overflows can be used by a malicious server to overwrite parts of the heap and crash the client (or possibly execute arbitrary code).

https://github.com/LibVNC/libvncserver/pull/137 CVE-2016-9941 CVE-2016-9942 ports/215805 2016-11-24 2017-01-09 libdwarf -- multiple vulnerabilities libdwarf 20161124

Christian Rebischke reports:

libdwarf is vulnerable to multiple issues including arbitrary code execution, information disclosure and denial of service.

https://lwn.net/Articles/708092/ CVE-2016-5027 CVE-2016-5028 CVE-2016-5029 CVE-2016-5030 CVE-2016-5031 CVE-2016-5032 CVE-2016-5033 CVE-2016-5035 CVE-2016-5037 CVE-2016-5040 CVE-2016-5041 CVE-2016-5043 CVE-2016-5044 CVE-2016-7510 CVE-2016-7511 CVE-2016-8679 CVE-2016-8680 CVE-2016-8681 CVE-2016-9275 CVE-2016-9276 CVE-2016-9480 CVE-2016-9558 2016-12-04 2017-01-09 lynx -- multiple vulnerabilities lynx 2.8.8.2_5,1

Oracle reports:

Lynx is vulnerable to POODLE by still supporting vulnerable version of SSL. Lynx is also vulnerable to URL attacks by incorrectly parsing hostnames ending with an '?'.

https://hg.java.net/hg/solaris-userland~gate/file/bc5351dcb9ac/components/lynx/patches/02-init-openssl.patch https://hg.java.net/hg/solaris-userland~gate/file/0a979060f73b/components/lynx/patches/05-fix-CVE-2016-9179.patch CVE-2014-3566 CVE-2016-9179 ports/215464 2016-10-26 2017-01-09 hdf5 -- multiple vulnerabilities hdf5 1.10.0 hdf5-18 1.8.18

Talos Security reports:

CVE-2016-4330 (TALOS-2016-0176) - HDF5 Group libhdf5 H5T_ARRAY Code Execution Vulnerability

CVE-2016-4331 (TALOS-2016-0177) - HDF5 Group libhdf5 H5Z_NBIT Code Execution Vulnerability

CVE-2016-4332 (TALOS-2016-0178) - HDF5 Group libhdf5 Shareable Message Type Code Execution Vulnerability

CVE-2016-4333 (TALOS-2016-0179) - HDF5 Group libhdf5 H5T_COMPOUND Code Execution Vulnerability

http://blog.talosintel.com/2016/11/hdf5-vulns.html CVE-2016-4330 CVE-2016-4331 CVE-2016-4332 CVE-2016-4333 2016-11-17 2017-01-09 End of Life Ports py27-django16 py33-django16 py34-django16 py35-django16 0 drupal6 0

These packages have reached End of Life status and/or have been removed from the Ports Tree. They may contain undocumented security issues. Please take caution and find alternative software as soon as possible.

ports/211975 2017-01-06 2017-01-06 Use-After-Free Vulnerability in pcsc-lite pcsc-lite 1.6.01.8.20

Peter Wu on Openwall mailing-list reports:

The issue allows a local attacker to cause a Denial of Service, but can potentially result in Privilege Escalation since the daemon is running as root. while any local user can connect to the Unix socket. Fixed by patch which is released with hpcsc-lite 1.8.20.

CVE-2016-10109 http://www.openwall.com/lists/oss-security/2017/01/03/2 2017-01-03 2017-01-06 2017-01-10 GnuTLS -- Memory corruption vulnerabilities gnutls 3.5.8

The GnuTLS project reports:

It was found using the OSS-FUZZ fuzzer infrastructure that decoding a specially crafted OpenPGP certificate could lead to heap and stack overflows. (GNUTLS-SA-2017-2)

It was found using the OSS-FUZZ fuzzer infrastructure that decoding a specially crafted X.509 certificate with Proxy Certificate Information extension present could lead to a double free. (GNUTLS-SA-2017-1)

http://www.gnutls.org/news.html#2017-01-09 http://www.gnutls.org/security.html#GNUTLS-SA-2017-2 http://www.gnutls.org/security.html#GNUTLS-SA-2017-1 2017-01-09 2017-01-09 tomcat -- information disclosure vulnerability tomcat 6.0.49 tomcat7 7.0.74 tomcat8 8.0.40

The Apache Software Foundation reports:

Important: Information Disclosure CVE-2016-8745

CVE-2016-8745 ports/215865 http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.49 http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.74 http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.40 2017-01-05 2017-01-07 2017-03-18 tomcat -- multiple vulnerabilities tomcat 6.0.48 tomcat7 7.0.73 tomcat8 8.0.39

The Apache Software Foundation reports:

Important: Remote Code Execution CVE-2016-8735

Important: Information Disclosure CVE-2016-6816

CVE-2016-8735 CVE-2016-6816 ports/214599 http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.48 http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.73 http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.39 2016-11-22 2017-01-07 2017-03-18 tomcat -- multiple vulnerabilities tomcat 6.0.47 tomcat7 7.0.72 tomcat8 8.0.37

The Apache Software Foundation reports:

Low: Unrestricted Access to Global Resources CVE-2016-6797

Low: Security Manager Bypass CVE-2016-6796

Low: System Property Disclosure CVE-2016-6794

Low: Security Manager Bypass CVE-2016-5018

Low: Timing Attack CVE-2016-0762

CVE-2016-6797 CVE-2016-6796 CVE-2016-6794 CVE-2016-5018 CVE-2016-0762 http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.47 http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.72 http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.5_and_8.0.37 2016-10-27 2017-01-07 2017-03-18 Irssi -- multiple vulnerabilities irssi 0.8.21

Irssi reports:

Five vulnerabilities have been located in Irssi

A NULL pointer dereference in the nickcmp function found by Joseph Bisch. (CWE-690)

Use after free when receiving invalid nick message (Issue #466, CWE-146)

Out of bounds read in certain incomplete control codes found by Joseph Bisch. (CWE-126)

Out of bounds read in certain incomplete character sequences found by Hanno Böck and independently by J. Bisch. (CWE-126)

Out of bounds read when Printing the value '%['. Found by Hanno Böck. (CWE-126)

These issues may result in denial of service (remote crash).

CVE-2017-5193 CVE-2017-5194 CVE-2017-5195 CVE-2017-5196 CVE-2017-5356 ports/215800 https://irssi.org/security/irssi_sa_2017_01.txt 2017-01-03 2017-01-05 2017-01-15 codeigniter -- multiple vulnerabilities codeigniter 3.1.2

The CodeIgniter changelog reports:

Fixed a number of new vulnerabilities in Security Library method xss_clean().

https://www.codeigniter.com/user_guide/changelog.html 2016-10-28 2017-01-06 codeigniter -- multiple vulnerabilities codeigniter 3.1.0

The CodeIgniter changelog reports:

Fixed an SQL injection in the ‘odbc’ database driver.

Updated set_realpath() Path Helper function to filter-out php:// wrapper inputs.

https://www.codeigniter.com/user_guide/changelog.html 2016-07-26 2017-01-06 w3m -- multiple vulnerabilities w3m w3m-img ja-w3m ja-w3m-img 0.5.3.20170102

Multiple remote code execution and denial of service conditions present.

http://seclists.org/oss-sec/2016/q4/452 http://seclists.org/oss-sec/2016/q4/516 CVE-2016-9422 CVE-2016-9423 CVE-2016-9424 CVE-2016-9425 CVE-2016-9426 CVE-2016-9428 CVE-2016-9429 CVE-2016-9430 CVE-2016-9431 CVE-2016-9432 CVE-2016-9433 CVE-2016-9434 CVE-2016-9435 CVE-2016-9436 CVE-2016-9437 CVE-2016-9438 CVE-2016-9439 CVE-2016-9440 CVE-2016-9441 CVE-2016-9442 CVE-2016-9443 CVE-2016-9622 CVE-2016-9623 CVE-2016-9624 CVE-2016-9625 CVE-2016-9626 CVE-2016-9627 CVE-2016-9628 CVE-2016-9629 CVE-2016-9630 CVE-2016-9631 CVE-2016-9632 CVE-2016-9633 2016-11-03 2017-01-01 2017-01-09 h2o -- Use-after-free vulnerability h2o 2.0.4_2

Kazuho Oku reports:

A use-after-free vulnerability exists in H2O up to and including version 2.0.4 / 2.1.0-beta3 that can be used by a remote attacker to mount DoS attacks and / or information theft.

https://github.com/h2o/h2o/releases/tag/v2.0.5 https://github.com/h2o/h2o/issues/1144 2016-09-09 2016-12-29 PHP -- multiple vulnerabilities php70 7.0.14

Check Point reports:

... discovered 3 fresh and previously unknown vulnerabilities (CVE-2016-7479, CVE-2016-7480, CVE-2016-7478) in the PHP 7 unserialize mechanism.

The first two vulnerabilities allow attackers to take full control over servers, allowing them to do anything they want with the website, from spreading malware to defacing it or stealing customer data.

The last vulnerability generates a Denial of Service attack which basically hangs the website, exhausts its memory consumption, and shuts it down.

The PHP security team issued fixes for two of the vulnerabilities on the 13th of October and 1st of December.

http://blog.checkpoint.com/2016/12/27/check-point-discovers-three-zero-day-vulnerabilities-web-programming-language-php-7/ CVE-2016-7478 CVE-2016-7479 CVE-2016-7480 2016-12-27 2016-12-29 2017-01-04 PHP -- multiple vulnerabilities php70 7.0.14

The PHP project reports:

Use After Free Vulnerability in unserialize() (CVE-2016-9936)

Invalid read when wddx decodes empty boolean element (CVE-2016-9935)

http://php.net/ChangeLog-7.php#7.0.14 CVE-2016-9935 CVE-2016-9936 2016-12-08 2016-12-29 phpmailer -- Remote Code Execution phpmailer 5.2.20 tt-rss 29.12.2016.04.37

Legal Hackers reports:

An independent research uncovered a critical vulnerability in PHPMailer that could potentially be used by (unauthenticated) remote attackers to achieve remote arbitrary code execution in the context of the web server user and remotely compromise the target web application.

To exploit the vulnerability an attacker could target common website components such as contact/feedback forms, registration forms, password email resets and others that send out emails with the help of a vulnerable version of the PHPMailer class.

The first patch of the vulnerability CVE-2016-10033 was incomplete. This advisory demonstrates the bypass of the patch. The bypass allows to carry out Remote Code Execution on all current versions (including 5.2.19).

https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10045-Vuln-Patch-Bypass.html CVE-2016-10045 2016-12-28 2016-12-28 samba -- multiple vulnerabilities samba36 3.6.03.6.25_4 samba4 4.0.04.0.26 samba41 4.1.04.1.23 samba42 4.2.04.2.14 samba43 4.3.04.3.13 samba44 4.4.04.4.8 samba45 4.5.04.5.3

Samba team reports:

[CVE-2016-2123] Authenicated users can supply malicious dnsRecord attributes on DNS objects and trigger a controlled memory corruption.

[CVE-2016-2125] Samba client code always requests a forwardable ticket when using Kerberos authentication. This means the target server, which must be in the current or trusted domain/realm, is given a valid general purpose Kerberos "Ticket Granting Ticket" (TGT), which can be used to fully impersonate the authenticated user or service.

[CVE-2016-2126] A remote, authenticated, attacker can cause the winbindd process to crash using a legitimate Kerberos ticket due to incorrect handling of the PAC checksum. A local service with access to the winbindd privileged pipe can cause winbindd to cache elevated access permissions.

CVE-2016-2123 https://www.samba.org/samba/security/CVE-2016-2123.html CVE-2016-2125 https://www.samba.org/samba/security/CVE-2016-2125.html CVE-2016-2126 https://www.samba.org/samba/security/CVE-2016-2126.html 2016-12-19 2016-12-26 2016-12-26 upnp -- multiple vulnerabilities upnp 1.6.21

Matthew Garett reports:

Reported this to upstream 8 months ago without response, so: libupnp's default behaviour allows anyone to write to your filesystem. Seriously. Find a device running a libupnp based server (Shodan says there's rather a lot), and POST a file to /testfile. Then GET /testfile ... and yeah if the server is running as root (it is) and is using / as the web root (probably not, but maybe) this gives full host fs access.

Scott Tenaglia reports:

There is a heap buffer overflow vulnerability in the create_url_list function in upnp/src/gena/gena_device.c.

https://twitter.com/mjg59/status/755062278513319936 https://sourceforge.net/p/pupnp/bugs/133/ CVE-2016-6255 CVE-2016-8863 2016-02-23 2016-12-27 phpmailer -- Remote Code Execution phpmailer 5.2.18 tt-rss 26.12.2016.07.29

Legal Hackers reports:

An independent research uncovered a critical vulnerability in PHPMailer that could potentially be used by (unauthenticated) remote attackers to achieve remote arbitrary code execution in the context of the web server user and remotely compromise the target web application.

To exploit the vulnerability an attacker could target common website components such as contact/feedback forms, registration forms, password email resets and others that send out emails with the help of a vulnerable version of the PHPMailer class.

http://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html https://github.com/PHPMailer/PHPMailer/blob/master/SECURITY.md CVE-2016-10033 2016-12-26 2016-12-26 exim -- DKIM private key leak exim 4.694.87.1

The Exim project reports:

Exim leaks the private DKIM signing key to the log files. Additionally, if the build option EXPERIMENTAL_DSN_INFO=yes is used, the key material is included in the bounce message.

https://exim.org/static/doc/CVE-2016-9963.txt CVE-2016-9963 2016-12-15 2016-12-25 cURL -- uninitialized random vulnerability curl 7.52.07.52.1

Project curl Security Advisory:

libcurl's (new) internal function that returns a good 32bit random value was implemented poorly and overwrote the pointer instead of writing the value into the buffer the pointer pointed to.

This random value is used to generate nonces for Digest and NTLM authentication, for generating boundary strings in HTTP formposts and more. Having a weak or virtually non-existent random there makes these operations vulnerable.

This function is brand new in 7.52.0 and is the result of an overhaul to make sure libcurl uses strong random as much as possible - provided by the backend TLS crypto libraries when present. The faulty function was introduced in this commit.

We are not aware of any exploit of this flaw.

https://curl.haxx.se/docs/adv_20161223.html CVE-2016-9594 2016-12-23 2016-12-24 squid -- multiple vulnerabilities squid 3.13.5.23 squid-devel 4.04.0.17

Squid security advisory 2016:10 reports:

Due to incorrect comparsion of request headers Squid can deliver responses containing private data to clients it should not have reached.

This problem allows a remote attacker to discover private and sensitive information about another clients browsing session. Potentially including credentials which allow access to further sensitive resources. This problem only affects Squid configured to use the Collapsed Forwarding feature. It is of particular importance for HTTPS reverse-proxy sites with Collapsed Forwarding.

Squid security advisory 2016:11 reports:

Due to incorrect HTTP conditional request handling Squid can deliver responses containing private data to clients it should not have reached.

This problem allows a remote attacker to discover private and sensitive information about another clients browsing session. Potentially including credentials which allow access to further sensitive resources..

CVE-2016-10002 CVE-2016-10003 ports/215416 ports/215418 http://www.squid-cache.org/Advisories/SQUID-2016_10.txt http://www.squid-cache.org/Advisories/SQUID-2016_11.txt 2016-12-16 2016-12-23 vim -- arbitrary command execution vim vim-lite 8.0.0056 neovim 0.1.7

Mitre reports:

vim before patch 8.0.0056 does not properly validate values for the 'filetype', 'syntax' and 'keymap' options, which may result in the execution of arbitrary code if a file with a specially crafted modeline is opened.

CVE-2016-1248 94478 https://github.com/vim/vim/commit/d0b5138ba4bccff8a744c99836041ef6322ed39a https://github.com/neovim/neovim/commit/4fad66fbe637818b6b3d6bc5d21923ba72795040 2016-11-22 2016-12-23 Pligg CMS -- XSS Vulnerability pligg 2.0.2,1

Netsparker reports:

Proof of Concept URL for XSS in Pligg CMS:

Page: groups.php

Parameter Name: keyword

Parameter Type: GET

Attack Pattern: http://example.com/pligg-cms-2.0.2/groups.php?view=search&keyword='+alert(0x000D82)+'

For more information on cross-site scripting vulnerabilities read the article Cross-site Scripting (XSS).

https://www.netsparker.com/web-applications-advisories/ns-15-011-xss-vulnerability-identified-in-pligg-cms/ 2015-05-13 2016-12-22 FreeBSD -- Multiple vulnerabilities of ntp FreeBSD 11.011.0_6 10.310.3_15 10.210.2_28 10.110.1_45 9.39.3_53

Problem Description:

Multiple vulnerabilities have been discovered in the NTP suite:

CVE-2016-9311: Trap crash, Reported by Matthew Van Gundy of Cisco ASIG.

CVE-2016-9310: Mode 6 unauthenticated trap information disclosure and DDoS vector. Reported by Matthew Van Gundy of Cisco ASIG.

CVE-2016-7427: Broadcast Mode Replay Prevention DoS. Reported by Matthew Van Gundy of Cisco ASIG.

CVE-2016-7428: Broadcast Mode Poll Interval Enforcement DoS. Reported by Matthew Van Gundy of Cisco ASIG.

CVE-2016-7431: Regression: 010-origin: Zero Origin Timestamp Bypass. Reported by Sharon Goldberg and Aanchal Malhotra of Boston University.

CVE-2016-7434: Null pointer dereference in _IO_str_init_static_internal(). Reported by Magnus Stubman.

CVE-2016-7426: Client rate limiting and server responses. Reported by Miroslav Lichvar of Red Hat.

CVE-2016-7433: Reboot sync calculation problem. Reported independently by Brian Utterback of Oracle, and by Sharon Goldberg and Aanchal Malhotra of Boston University.

Impact:

A remote attacker who can send a specially crafted packet to cause a NULL pointer dereference that will crash ntpd, resulting in a Denial of Service. [CVE-2016-9311]

An exploitable configuration modification vulnerability exists in the control mode (mode 6) functionality of ntpd. If, against long-standing BCP recommendations, "restrict default noquery ..." is not specified, a specially crafted control mode packet can set ntpd traps, providing information disclosure and DDoS amplification, and unset ntpd traps, disabling legitimate monitoring by an attacker from remote. [CVE-2016-9310]

An attacker with access to the NTP broadcast domain can periodically inject specially crafted broadcast mode NTP packets into the broadcast domain which, while being logged by ntpd, can cause ntpd to reject broadcast mode packets from legitimate NTP broadcast servers. [CVE-2016-7427]

An attacker with access to the NTP broadcast domain can send specially crafted broadcast mode NTP packets to the broadcast domain which, while being logged by ntpd, will cause ntpd to reject broadcast mode packets from legitimate NTP broadcast servers. [CVE-2016-7428]

Origin timestamp problems were fixed in ntp 4.2.8p6. However, subsequent timestamp validation checks introduced a regression in the handling of some Zero origin timestamp checks. [CVE-2016-7431]

If ntpd is configured to allow mrulist query requests from a server that sends a crafted malicious packet, ntpd will crash on receipt of that crafted malicious mrulist query packet. [CVE-2016-7434]

An attacker who knows the sources (e.g., from an IPv4 refid in server response) and knows the system is (mis)configured in this way can periodically send packets with spoofed source address to keep the rate limiting activated and prevent ntpd from accepting valid responses from its sources. [CVE-2016-7426]

Ntp Bug 2085 described a condition where the root delay was included twice, causing the jitter value to be higher than expected. Due to a misinterpretation of a small-print variable in The Book, the fix for this problem was incorrect, resulting in a root distance that did not include the peer dispersion. The calculations and formulas have been reviewed and reconciled, and the code has been updated accordingly. [CVE-2016-7433]

CVE-2016-7426 CVE-2016-7427 CVE-2016-7428 CVE-2016-7431 CVE-2016-7433 CVE-2016-7434 CVE-2016-9310 CVE-2016-9311 SA-16:39.ntp 2016-12-22 2016-12-22 cURL -- buffer overflow curl 7.17.52

The cURL project reports:

printf floating point buffer overflow

libcurl's implementation of the printf() functions triggers a buffer overflow when doing a large floating point output. The bug occurs whenthe conversion outputs more than 255 bytes.

https://curl.haxx.se/docs/vuln-7.51.0.html CVE-2016-9586 2016-12-21 2016-12-22 Joomla! -- multiple vulnerabilities joomla3 1.6.03.6.5

The JSST and the Joomla! Security Center report:

[20161201] - Core - Elevated Privileges

Incorrect use of unfiltered data stored to the session on a form validation failure allows for existing user accounts to be modified; to include resetting their username, password, and user group assignments.

[20161202] - Core - Shell Upload

Inadequate filesystem checks allowed files with alternative PHP file extensions to be uploaded.

[20161203] - Core - Information Disclosure

Inadequate ACL checks in the Beez3 com_content article layout override enables a user to view restricted content.

CVE-2016-9836 CVE-2016-9837 CVE-2016-9838 https://developer.joomla.org/security-centre/664-20161201-core-elevated-privileges.html https://developer.joomla.org/security-centre/665-20161202-core-shell-upload.html https://developer.joomla.org/security-centre/666-20161203-core-information-disclosure.html https://www.joomla.org/announcements/release-news/5693-joomla-3-6-5-released.html 2016-12-06 2016-12-22 Joomla! -- multiple vulnerabilities joomla3 3.4.43.6.4

The JSST and the Joomla! Security Center report:

[20161001] - Core - Account Creation

Inadequate checks allows for users to register on a site when registration has been disabled.

[20161002] - Core - Elevated Privilege

Incorrect use of unfiltered data allows for users to register on a site with elevated privileges.

[20161003] - Core - Account Modifications

Incorrect use of unfiltered data allows for existing user accounts to be modified; to include resetting their username, password, and user group assignments.

CVE-2016-8869 CVE-2016-8870 CVE-2016-9081 https://developer.joomla.org/security-centre/659-20161001-core-account-creation.html https://developer.joomla.org/security-centre/660-20161002-core-elevated-privileges.html https://developer.joomla.org/security-centre/661-20161003-core-account-modifications.html https://www.joomla.org/announcements/release-news/5678-joomla-3-6-4-released.html 2016-10-25 2016-12-22 Joomla! -- multiple vulnerabilities joomla3 1.6.03.6.1

The JSST and the Joomla! Security Center report:

[20160801] - Core - ACL Violation

Inadequate ACL checks in com_content provide potential read access to data which should be access restricted to users with edit_own level.

[20160802] - Core - XSS Vulnerability

Inadequate escaping leads to XSS vulnerability in mail component.

[20160803] - Core - CSRF

Add additional CSRF hardening in com_joomlaupdate.

https://developer.joomla.org/security-centre/652-20160801-core-core-acl-violations.html https://developer.joomla.org/security-centre/653-20160802-core-xss-vulnerability.html https://developer.joomla.org/security-centre/654-20160803-core-csrf.html https://www.joomla.org/announcements/release-news/5665-joomla-3-6-1-released.html 2016-08-03 2016-12-22 Joomla! -- multiple vulnerabilities joomla3 1.5.03.4.7

The JSST and the Joomla! Security Center report:

[20151206] - Core - Session Hardening

The Joomla Security Strike team has been following up on the critical security vulnerability patched last week. Since the recent update it has become clear that the root cause is a bug in PHP itself. This was fixed by PHP in September of 2015 with the releases of PHP 5.4.45, 5.5.29, 5.6.13 (Note that this is fixed in all versions of PHP 7 and has been back-ported in some specific Linux LTS versions of PHP 5.3). This fixes the bug across all supported PHP versions.

[20151207] - Core - SQL Injection

Inadequate filtering of request data leads to a SQL Injection vulnerability.

https://developer.joomla.org/security-centre/639-20151206-core-session-hardening.html https://developer.joomla.org/security-centre/640-20151207-core-sql-injection.html https://www.joomla.org/announcements/release-news/5643-joomla-3-4-7.html 2015-12-21 2016-12-22 xen-kernel -- x86 PV guests may be able to mask interrupts xen-kernel 4.7.1_3

The Xen Project reports:

Certain PV guest kernel operations (page table writes in particular) need emulation, and use Xen's general x86 instruction emulator. This allows a malicious guest kernel which asynchronously modifies its instruction stream to effect the clearing of EFLAGS.IF from the state used to return to guest context.

A malicious guest kernel administrator can cause a host hang or crash, resulting in a Denial of Service.

CVE-2016-10024 https://xenbits.xen.org/xsa/advisory-202.html 2016-12-21 2016-12-22 Apache httpd -- several vulnerabilities apache24 2.4.25

Apache Software Foundation reports:

Important: Apache HTTP Request Parsing Whitespace Defects CVE-2016-8743
Apache HTTP Server, prior to release 2.4.25, accepted a broad pattern of unusual whitespace patterns from the user-agent, including bare CR, FF, VTAB in parsing the request line and request header lines, as well as HTAB in parsing the request line. Any bare CR present in request lines was treated as whitespace and remained in the request field member "the_request", while a bare CR in the request header field name would be honored as whitespace, and a bare CR in the request header field value was retained the input headers array. Implied additional whitespace was accepted in the request line and prior to the ':' delimiter of any request header lines.

RFC7230 Section 3.5 calls out some of these whitespace exceptions, and section 3.2.3 eliminated and clarified the role of implied whitespace in the grammer of this specification. Section 3.1.1 requires exactly one single SP between the method and request-target, and between the request-target and HTTP-version, followed immediately by a CRLF sequence. None of these fields permit any (unencoded) CTL character whatsoever. Section 3.2.4 explicitly disallowed any whitespace from the request header field prior to the ':' character, while Section 3.2 disallows all CTL characters in the request header line other than the HTAB character as whitespace.

These defects represent a security concern when httpd is participating in any chain of proxies or interacting with back-end application servers, either through mod_proxy or using conventional CGI mechanisms. In each case where one agent accepts such CTL characters and does not treat them as whitespace, there is the possiblity in a proxy chain of generating two responses from a server behind the uncautious proxy agent. In a sequence of two requests, this results in request A to the first proxy being interpreted as requests A + A' by the backend server, and if requests A and B were submitted to the first proxy in a keepalive connection, the proxy may interpret response A' as the response to request B, polluting the cache or potentially serving the A' content to a different downstream user-agent.

These defects are addressed with the release of Apache HTTP Server 2.4.25 and coordinated by a new directive
HttpProtocolOptions Strict

low: DoS vulnerability in mod_auth_digest CVE-2016-2161
Malicious input to mod_auth_digest will cause the server to crash, and each instance continues to crash even for subsequently valid requests.

low: Padding Oracle in Apache mod_session_crypto CVE-2016-0736
Authenticate the session data/cookie presented to mod_session_crypto with a MAC (SipHash) to prevent deciphering or tampering with a padding oracle attack.

low: Padding Oracle in Apache mod_session_crypto CVE-2016-0736
Authenticate the session data/cookie presented to mod_session_crypto with a MAC (SipHash) to prevent deciphering or tampering with a padding oracle attack.

low: HTTP/2 CONTINUATION denial of service CVE-2016-8740
The HTTP/2 protocol implementation (mod_http2) had an incomplete handling of the LimitRequestFields directive. This allowed an attacker to inject unlimited request headers into the server, leading to eventual memory exhaustion.

n/a: HTTP_PROXY environment variable "httpoxy" mitigation CVE-2016-5387
HTTP_PROXY is a well-defined environment variable in a CGI process, which collided with a number of libraries which failed to avoid colliding with this CGI namespace. A mitigation is provided for the httpd CGI environment to avoid populating the "HTTP_PROXY" variable from a "Proxy:" header, which has never been registered by IANA.

http://httpd.apache.org/security/vulnerabilities_24.html CVE-2016-8743 CVE-2016-2161 CVE-2016-0736 CVE-2016-8740 CVE-2016-5387 2016-12-20 2016-12-21 2016-12-22 xen-kernel -- x86: Mishandling of SYSCALL singlestep during emulation xen-kernel 4.7.1_2

The Xen Project reports:

The typical behaviour of singlestepping exceptions is determined at the start of the instruction, with a #DB trap being raised at the end of the instruction. SYSCALL (and SYSRET, although we don't implement it) behave differently because the typical behaviour allows userspace to escalate its privilege. (This difference in behaviour seems to be undocumented.) Xen wrongly raised the exception based on the flags at the start of the instruction.

Guest userspace which can invoke the instruction emulator can use this flaw to escalate its privilege to that of the guest kernel.

CVE-2016-10013 http://xenbits.xen.org/xsa/advisory-204.html 2016-12-19 2016-12-20 atheme-services -- multiple vulnerabilities atheme-services 7.2.7

Mitre reports:

modules/chanserv/flags.c in Atheme before 7.2.7 allows remote attackers to modify the Anope FLAGS behavior by registering and dropping the (1) LIST, (2) CLEAR, or (3) MODIFY keyword nicks.

Buffer overflow in the xmlrpc_char_encode function in modules/transport/xmlrpc/xmlrpclib.c in Atheme before 7.2.7 allows remote attackers to cause a denial of service via vectors related to XMLRPC response encoding.

ports/209217 CVE-2014-9773 CVE-2016-4478 https://github.com/atheme/atheme/commit/87580d767868360d2fed503980129504da84b63e https://github.com/atheme/atheme/commit/c597156adc60a45b5f827793cd420945f47bc03b 2016-01-09 2016-12-16 mozilla -- multiple vulnerabilities firefox 50.1.0_1,1 seamonkey linux-seamonkey 2.47 firefox-esr 45.6.0,1 linux-firefox 45.6.0,2 libxul thunderbird linux-thunderbird 45.6.0

Mozilla Foundation reports:

CVE-2016-9894: Buffer overflow in SkiaGL

CVE-2016-9899: Use-after-free while manipulating DOM events and audio elements

CVE-2016-9895: CSP bypass using marquee tag

CVE-2016-9896: Use-after-free with WebVR

CVE-2016-9897: Memory corruption in libGLES

CVE-2016-9898: Use-after-free in Editor while manipulating DOM subtrees

CVE-2016-9900: Restricted external resources can be loaded by SVG images through data URLs

CVE-2016-9904: Cross-origin information leak in shared atoms

CVE-2016-9901: Data from Pocket server improperly sanitized before execution

CVE-2016-9902: Pocket extension does not validate the origin of events

CVE-2016-9903: XSS injection vulnerability in add-ons SDK

CVE-2016-9080: Memory safety bugs fixed in Firefox 50.1

CVE-2016-9893: Memory safety bugs fixed in Firefox 50.1 and Firefox ESR 45.6

CVE-2016-9894 CVE-2016-9899 CVE-2016-9895 CVE-2016-9896 CVE-2016-9897 CVE-2016-9898 CVE-2016-9900 CVE-2016-9904 CVE-2016-9901 CVE-2016-9902 CVE-2016-9903 CVE-2016-9080 CVE-2016-9893 https://www.mozilla.org/security/advisories/mfsa2016-94/ https://www.mozilla.org/security/advisories/mfsa2016-95/ 2016-12-13 2016-12-14 wordpress -- multiple vulnerabilities wordpress 4.6.1,1 de-wordpress ja-wordpress ru-wordpress zh-wordpress-zh_CN zh-wordpress-zh_TW 4.6.1

Jeremy Felt reports:

WordPress versions 4.6 and earlier are affected by two security issues: a cross-site scripting vulnerability via image filename, reported by SumOfPwn researcher Cengiz Han Sahin; and a path traversal vulnerability in the upgrade package uploader, reported by Dominik Schilling from the WordPress security team.

https://wordpress.org/news/2016/09/wordpress-4-6-1-security-and-maintenance-release/ 2016-09-07 2016-12-14 xen-kernel -- x86 CMPXCHG8B emulation fails to ignore operand size override xen-kernel 4.7.1_1

The Xen Project reports:

The x86 instruction CMPXCHG8B is supposed to ignore legacy operand size overrides; it only honors the REX.W override (making it CMPXCHG16B). So, the operand size is always 8 or 16. When support for CMPXCHG16B emulation was added to the instruction emulator, this restriction on the set of possible operand sizes was relied on in some parts of the emulation; but a wrong, fully general, operand size value was used for other parts of the emulation. As a result, if a guest uses a supposedly-ignored operand size prefix, a small amount of hypervisor stack data is leaked to the guests: a 96 bit leak to guests running in 64-bit mode; or, a 32 bit leak to other guests.

A malicious unprivileged guest may be able to obtain sensitive information from the host.

CVE-2016-9932 http://xenbits.xen.org/xsa/advisory-200.html 2016-12-13 2016-12-14 PHP -- Multiple vulnerabilities php56 5.6.29 php70 7.0.14

The PHP project reports:

This is a security release. Several security bugs were fixed in this release.

http://php.net/archive/2016.php#id2016-12-08-1 http://php.net/archive/2016.php#id2016-12-08-2 2016-12-12 2016-12-12 asterisk -- Authentication Bypass asterisk11 11.25.1 asterisk13 13.13.1

The Asterisk project reports:

The chan_sip channel driver has a liberal definition for whitespace when attempting to strip the content between a SIP header name and a colon character. Rather than following RFC 3261 and stripping only spaces and horizontal tabs, Asterisk treats any non-printable ASCII character as if it were whitespace.

This mostly does not pose a problem until Asterisk is placed in tandem with an authenticating SIP proxy. In such a case, a crafty combination of valid and invalid To headers can cause a proxy to allow an INVITE request into Asterisk without authentication since it believes the request is an in-dialog request. However, because of the bug described above, the request will look like an out-of-dialog request to Asterisk. Asterisk will then process the request as a new call. The result is that Asterisk can process calls from unvetted sources without any authentication.

If you do not use a proxy for authentication, then this issue does not affect you.

If your proxy is dialog-aware (meaning that the proxy keeps track of what dialogs are currently valid), then this issue does not affect you.

If you use chan_pjsip instead of chan_sip, then this issue does not affect you.

http://downloads.digium.com/pub/security/ASTERISK-2016-009.html 2016-11-28 2016-12-09 asterisk -- Crash on SDP offer or answer from endpoint using Opus asterisk13 13.12.013.13.1

The Asterisk project reports:

If an SDP offer or answer is received with the Opus codec and with the format parameters separated using a space the code responsible for parsing will recursively call itself until it crashes. This occurs as the code does not properly handle spaces separating the parameters. This does NOT require the endpoint to have Opus configured in Asterisk. This also does not require the endpoint to be authenticated. If guest is enabled for chan_sip or anonymous in chan_pjsip an SDP offer or answer is still processed and the crash occurs.

http://downloads.asterisk.org/pub/security/AST-2016-008.html 2016-11-11 2016-12-09 cryptopp -- multiple vulnerabilities cryptopp 5.6.5

Multiple sources report:

CVE-2015-2141: The InvertibleRWFunction::CalculateInverse function in rw.cpp in libcrypt++ 5.6.2 does not properly blind private key operations for the Rabin-Williams digital signature algorithm, which allows remote attackers to obtain private keys via a timing attack. Fixed in 5.6.3.

CVE-2016-3995: Incorrect implementation of Rijndael timing attack countermeasure. Fixed in 5.6.4.

CVE-2016-7420: Library built without -DNDEBUG could egress sensitive information to the filesystem via a core dump if an assert was triggered. Fixed in 5.6.5.

https://eprint.iacr.org/2015/368 https://github.com/weidai11/cryptopp/issues/146 https://github.com/weidai11/cryptopp/issues/277 CVE-2015-2141 CVE-2016-3995 CVE-2016-7420 2015-02-27 2016-12-06 FreeBSD -- bhyve(8) virtual machine escape FreeBSD 11.011.0_4 10.310.3_13 10.210.2_26 10.110.1_43

Problem Description:

The bounds checking of accesses to guest memory greater than 4GB by device emulations is subject to integer overflow.

Impact:

For a bhyve virtual machine with more than 3GB of guest memory configured, a malicious guest could craft device descriptors that could give it access to the heap of the bhyve process. Since the bhyve process is running as root, this may allow guests to obtain full control of the hosts they're running on.

CVE-2016-1889 SA-16:38.bhyve 2016-12-06 2016-12-06 FreeBSD -- link_ntoa(3) buffer overflow FreeBSD 11.011.0_5 10.310.3_14 10.210.2_27 10.110.1_44 9.39.3_52

Problem Description:

A specially crafted argument can trigger a static buffer overflow in the library, with possibility to rewrite following static buffers that belong to other library functions.

Impact:

Due to very limited use of the function in the existing applications, and limited length of the overflow, exploitation of the vulnerability does not seem feasible. None of the utilities and daemons in the base system are known to be vulnerable. However, careful review of third party software that may use the function was not performed.

CVE-2016-6559 SA-16:37.libc 2016-12-06 2016-12-06 2016-12-08 FreeBSD -- Possible login(1) argument injection in telnetd(8) FreeBSD 11.011.0_4 10.310.3_13 10.210.2_26 10.110.1_43 9.39.3_51

Problem Description:

An unexpected sequence of memory allocation failures combined with insufficient error checking could result in the construction and execution of an argument sequence that was not intended.

Impact:

An attacker who controls the sequence of memory allocation failures and success may cause login(1) to run without authentication and may be able to cause misbehavior of login(1) replacements.

No practical way of controlling these memory allocation failures is known at this time.

CVE-2016-1888 SA-16:36.telnetd 2016-12-06 2016-12-06 Apache httpd -- denial of service in HTTP/2 apache24 2.4.172.4.23_1 mod_http2-devel 1.8.3

mod_http2 reports:

The Apache HTTPD web server (from 2.4.17-2.4.23) did not apply limitations on request headers correctly when experimental module for the HTTP/2 protocol is used to access a resource.

The net result is that a the server allocates too much memory instead of denying the request. This can lead to memory exhaustion of the server by a properly crafted request.

http://mail-archives.apache.org/mod_mbox/httpd-announce/201612.mbox/%3C1A097A43-7CCB-4BA1-861F-E0C7EEE83A4B%40apache.org%3E https://github.com/icing/mod_h2/releases/tag/v1.8.3 CVE-2016-8740 2016-12-06 2016-12-06 chromium -- multiple vulnerabilities chromium chromium-npapi chromium-pulse 55.0.2883.75

Google Chrome Releases reports:

36 security fixes in this release, including:

[664411] High CVE-2016-9651: Private property access in V8. Credit to Guang Gong of Alpha Team Of Qihoo 360

[658535] High CVE-2016-5208: Universal XSS in Blink. Credit to Mariusz Mlynski

[655904] High CVE-2016-5207: Universal XSS in Blink. Credit to Mariusz Mlynski

[653749] High CVE-2016-5206: Same-origin bypass in PDFium. Credit to Rob Wu (robwu.nl)

[646610] High CVE-2016-5205: Universal XSS in Blink. Credit to Anonymous

[630870] High CVE-2016-5204: Universal XSS in Blink. Credit to Mariusz Mlynski

[664139] High CVE-2016-5209: Out of bounds write in Blink. Credit to Giwan Go of STEALIEN

[644219] High CVE-2016-5203: Use after free in PDFium. Credit to Anonymous

[654183] High CVE-2016-5210: Out of bounds write in PDFium. Credit to Ke Liu of Tencent's Xuanwu LAB

[653134] High CVE-2016-5212: Local file disclosure in DevTools. Credit to Khalil Zhani

[649229] High CVE-2016-5211: Use after free in PDFium. Credit to Anonymous

[652548] High CVE-2016-5213: Use after free in V8. Credit to Khalil Zhani

[601538] Medium CVE-2016-5214: File download protection bypass. Credit to Jonathan Birch and MSVR

[653090] Medium CVE-2016-5216: Use after free in PDFium. Credit to Anonymous

[619463] Medium CVE-2016-5215: Use after free in Webaudio. Credit to Looben Yang

[654280] Medium CVE-2016-5217: Use of unvalidated data in PDFium. Credit to Rob Wu (robwu.nl)

[660498] Medium CVE-2016-5218: Address spoofing in Omnibox. Credit to Abdulrahman Alqabandi (@qab)

[657568] Medium CVE-2016-5219: Use after free in V8. Credit to Rob Wu (robwu.nl)

[660854] Medium CVE-2016-5221: Integer overflow in ANGLE. Credit to Tim Becker of ForAllSecure

[654279] Medium CVE-2016-5220: Local file access in PDFium. Credit to Rob Wu (robwu.nl)

[657720] Medium CVE-2016-5222: Address spoofing in Omnibox. Credit to xisigr of Tencent's Xuanwu Lab

[653034] Low CVE-2016-9650: CSP Referrer disclosure. Credit to Jakub Żoczek

[652038] Low CVE-2016-5223: Integer overflow in PDFium. Credit to Hwiwon Lee

[639750] Low CVE-2016-5226: Limited XSS in Blink. Credit to Jun Kokatsu (@shhnjk)

[630332] Low CVE-2016-5225: CSP bypass in Blink. Credit to Scott Helme (@Scott_Helme, scotthelme.co.uk)

[615851] Low CVE-2016-5224: Same-origin bypass in SVG. Credit to Roeland Krak

[669928] CVE-2016-9652: Various fixes from internal audits, fuzzing and other initiatives

CVE-2016-9651 CVE-2016-5208 CVE-2016-5207 CVE-2016-5206 CVE-2016-5205 CVE-2016-5204 CVE-2016-5209 CVE-2016-5203 CVE-2016-5210 CVE-2016-5212 CVE-2016-5211 CVE-2016-5213 CVE-2016-5214 CVE-2016-5216 CVE-2016-5215 CVE-2016-5217 CVE-2016-5218 CVE-2016-5219 CVE-2016-5221 CVE-2016-5220 CVE-2016-5222 CVE-2016-9650 CVE-2016-5223 CVE-2016-5226 CVE-2016-5225 CVE-2016-5224 CVE-2016-9652 https://googlechromereleases.blogspot.nl/2016/12/stable-channel-update-for-desktop.html 2016-12-01 2016-12-05 ImageMagick7 -- multiple vulnerabilities ImageMagick7 ImageMagick7-nox11 7.0.3.6

Multiple sources report:

CVE-2016-9298: heap overflow in WaveletDenoiseImage(), fixed in ImageMagick7-7.0.3.6, discovered 2016-10-31

CVE-2016-8866: memory allocation failure in AcquireMagickMemory (incomplete previous fix for CVE-2016-8862), not fixed yet with the release of this announcement, re-discovered 2016-10-13.

CVE-2016-8862: memory allocation failure in AcquireMagickMemory, initially partially fixed in ImageMagick7-7.0.3.3, discovered 2016-09-14.

https://github.com/ImageMagick/ImageMagick/issues/296 https://blogs.gentoo.org/ago/2016/10/20/imagemagick-memory-allocation-failure-in-acquiremagickmemory-memory-c-incomplete-fix-for-cve-2016-8862/ https://blogs.gentoo.org/ago/2016/10/17/imagemagick-memory-allocation-failure-in-acquiremagickmemory-memory-c/ CVE-2016-9298 CVE-2016-8866 CVE-2016-8862 ports/214514 2016-09-14 2016-12-04 Pillow -- multiple vulnerabilities py27-pillow py33-pillow py34-pillow py35-pillow 3.3.2

Pillow reports:

Pillow prior to 3.3.2 may experience integer overflow errors in map.c when reading specially crafted image files. This may lead to memory disclosure or corruption.

Pillow prior to 3.3.2 and PIL 1.1.7 (at least) do not check for negative image sizes in ImagingNew in Storage.c. A negative image size can lead to a smaller allocation than expected, leading to arbi trary writes.

http://pillow.readthedocs.io/en/3.4.x/releasenotes/3.3.2.html https://github.com/python-pillow/Pillow/issues/2105 CVE-2016-9189 CVE-2016-9190 ports/214410 2016-09-06 2016-12-04 ImageMagick -- heap overflow vulnerability ImageMagick ImageMagick-nox11 6.9.6.4,1 ImageMagick7 ImageMagick7-nox11 7.0.3.7

Bastien Roucaries reports:

Imagemagick before 3cbfb163cff9e5b8cdeace8312e9bfee810ed02b suffer from a heap overflow in WaveletDenoiseImage(). This problem is easelly trigerrable from a perl script.

http://seclists.org/oss-sec/2016/q4/413 https://github.com/ImageMagick/ImageMagick/issues/296 CVE-2016-9298 ports/214517 ports/214511 ports/214520 2016-11-13 2016-12-04 py-cryptography -- vulnerable HKDF key generation py27-cryptography py33-cryptography py34-cryptography py35-cryptography 1.5.3

Alex Gaynor reports:

Fixed a bug where ``HKDF`` would return an empty byte-string if used with a ``length`` less than ``algorithm.digest_size``.

https://github.com/pyca/cryptography/commit/b94cacf2ae6e75e4007a79709bbf5360435b512d CVE-2016-9243 ports/214915 2016-11-05 2016-12-04 2016-12-06 qemu -- denial of service vulnerability qemu qemu-devel qemu-sbruno 2.3.0

Daniel P. Berrange reports:

The VNC server websockets decoder will read and buffer data from websockets clients until it sees the end of the HTTP headers, as indicated by \r\n\r\n. In theory this allows a malicious to trick QEMU into consuming an arbitrary amount of RAM.

https://lists.gnu.org/archive/html/qemu-devel/2015-03/msg04895.html CVE-2015-1779 ports/206725 2015-03-23 2016-12-04 2016-12-06 xen-tools -- delimiter injection vulnerabilities in pygrub xen-tools 4.7.1

The Xen Project reports:

pygrub, the boot loader emulator, fails to quote (or sanity check) its results when reporting them to its caller.

A malicious guest administrator can obtain the contents of sensitive host files (an information leak). Additionally, a malicious guest administrator can cause files on the host to be removed, causing a denial of service. In some unusual host configurations, ability to remove certain files may be useable for privilege escalation.

CVE-2016-9379 CVE-2016-9380 ports/214936 https://xenbits.xen.org/xsa/advisory-198.html 2016-11-22 2016-12-04 xen-tools -- qemu incautious about shared ring processing xen-tools 4.7.1

The Xen Project reports:

The compiler can emit optimizations in qemu which can lead to double fetch vulnerabilities. Specifically data on the rings shared between qemu and the hypervisor (which the guest under control can obtain mappings of) can be fetched twice (during which time the guest can alter the contents) possibly leading to arbitrary code execution in qemu.

Malicious administrators can exploit this vulnerability to take over the qemu process, elevating its privilege to that of the qemu process.

In a system not using a device model stub domain (or other techniques for deprivileging qemu), malicious guest administrators can thus elevate their privilege to that of the host.

CVE-2016-9381 ports/214936 https://xenbits.xen.org/xsa/advisory-197.html 2016-11-22 2016-12-04 xen-kernel -- x86 64-bit bit test instruction emulation broken xen-kernel 4.7.1

The Xen Project reports:

The x86 instructions BT, BTC, BTR, and BTS, when used with a destination memory operand and a source register rather than an immediate operand, access a memory location offset from that specified by the memory operand as specified by the high bits of the register source.

A malicious guest can modify arbitrary memory, allowing for arbitrary code execution (and therefore privilege escalation affecting the whole host), a crash of the host (leading to a DoS), or information leaks. The vulnerability is sometimes exploitable by unprivileged guest user processes.

CVE-2016-9383 ports/214936 https://xenbits.xen.org/xsa/advisory-195.html 2016-11-22 2016-12-04 xen-kernel -- guest 32-bit ELF symbol table load leaking host data xen-kernel 4.74.7.1

The Xen Project reports:

Along with their main kernel binary, unprivileged guests may arrange to have their Xen environment load (kernel) symbol tables for their use. The ELF image metadata created for this purpose has a few unused bytes when the symbol table binary is in 32-bit ELF format. These unused bytes were not properly cleared during symbol table loading.

A malicious unprivileged guest may be able to obtain sensitive information from the host.

The information leak is small and not under the control of the guest, so effectively exploiting this vulnerability is probably difficult.

CVE-2016-9384 ports/214936 https://xenbits.xen.org/xsa/advisory-194.html 2016-11-22 2016-12-04 xen-kernel -- x86 segment base write emulation lacking canonical address checks xen-kernel 4.44.7.1

The Xen Project reports:

Both writes to the FS and GS register base MSRs as well as the WRFSBASE and WRGSBASE instructions require their input values to be canonical, or a #GP fault will be raised. When the use of those instructions by the hypervisor was enabled, the previous guard against #GP faults (having recovery code attached) was accidentally removed.

A malicious guest administrator can crash the host, leading to a DoS.

CVE-2016-9385 ports/214936 https://xenbits.xen.org/xsa/advisory-193.html 2016-11-22 2016-12-04 xen-kernel -- x86 task switch to VM86 mode mis-handled xen-kernel 4.7.1

The Xen Project reports:

LDTR, just like TR, is purely a protected mode facility. Hence even when switching to a VM86 mode task, LDTR loading needs to follow protected mode semantics. This was violated by the code.

On SVM (AMD hardware): a malicious unprivileged guest process can escalate its privilege to that of the guest operating system.

On both SVM and VMX (Intel hardware): a malicious unprivileged guest process can crash the guest.

CVE-2016-9382 ports/214936 https://xenbits.xen.org/xsa/advisory-192.html 2016-11-22 2016-12-04 xen-kernel -- x86 null segments not always treated as unusable xen-kernel 4.7.1

The Xen Project reports:

The Xen x86 emulator erroneously failed to consider the unusability of segments when performing memory accesses.

The intended behaviour is as follows: The user data segment (%ds, %es, %fs and %gs) selectors may be NULL in 32-bit to prevent access. In 64-bit, NULL has a special meaning for user segments, and there is no way of preventing access. However, in both 32-bit and 64-bit, a NULL LDT system segment is intended to prevent access.

On Intel hardware, loading a NULL selector zeros the base as well as most attributes, but sets the limit field to its largest possible value. On AMD hardware, loading a NULL selector zeros the attributes, leaving the stale base and limit intact.

Xen may erroneously permit the access using unexpected base/limit values.

Ability to exploit this vulnerability on Intel is easy, but on AMD depends in a complicated way on how the guest kernel manages LDTs.

An unprivileged guest user program may be able to elevate its privilege to that of the guest operating system.

CVE-2016-9386 ports/214936 https://xenbits.xen.org/xsa/advisory-191.html 2016-11-22 2016-12-04 xen-kernel -- CR0.TS and CR0.EM not always honored for x86 HVM guests xen-kernel 4.7.1

The Xen Project reports:

Instructions touching FPU, MMX, or XMM registers are required to raise a Device Not Available Exception (#NM) when either CR0.EM or CR0.TS are set. (Their AVX or AVX-512 extensions would consider only CR0.TS.) While during normal operation this is ensured by the hardware, if a guest modifies instructions while the hypervisor is preparing to emulate them, the #NM delivery could be missed.

Guest code in one task may thus (unintentionally or maliciously) read or modify register state belonging to another task in the same VM.

A malicious unprivileged guest user may be able to obtain or corrupt sensitive information (including cryptographic material) in other programs in the same guest.

CVE-2016-7777 ports/214936 https://xenbits.xen.org/xsa/advisory-190.html 2016-10-04 2016-12-04 xen-kernel -- use after free in FIFO event channel code xen-kernel 4.44.5

The Xen Project reports:

When the EVTCHNOP_init_control operation is called with a bad guest frame number, it takes an error path which frees a control structure without also clearing the corresponding pointer. Certain subsequent operations (EVTCHNOP_expand_array or another EVTCHNOP_init_control), upon finding the non-NULL pointer, continue operation assuming it points to allocated memory.

A malicious guest administrator can crash the host, leading to a DoS. Arbitrary code execution (and therefore privilege escalation), and information leaks, cannot be excluded.

CVE-2016-7154 ports/214936 https://xenbits.xen.org/xsa/advisory-188.html 2016-09-08 2016-12-04 xen-kernel -- x86 HVM: Overflow of sh_ctxt->seg_reg[] xen-kernel 4.7.1

The Xen Project reports:

x86 HVM guests running with shadow paging use a subset of the x86 emulator to handle the guest writing to its own pagetables. There are situations a guest can provoke which result in exceeding the space allocated for internal state.

A malicious HVM guest administrator can cause Xen to fail a bug check, causing a denial of service to the host.

CVE-2016-7094 ports/214936 https://xenbits.xen.org/xsa/advisory-187.html 2016-09-08 2016-12-04 xen-kernel -- x86: Mishandling of instruction pointer truncation during emulation xen-kernel 4.5.3 4.6.3 4.7.04.7.1

The Xen Project reports:

When emulating HVM instructions, Xen uses a small i-cache for fetches from guest memory. The code that handles cache misses does not check if the address from which it fetched lies within the cache before blindly writing to it. As such it is possible for the guest to overwrite hypervisor memory.

It is currently believed that the only way to trigger this bug is to use the way that Xen currently incorrectly wraps CS:IP in 16 bit modes. The included patch prevents such wrapping.

A malicious HVM guest administrator can escalate their privilege to that of the host.

CVE-2016-7093 ports/214936 https://xenbits.xen.org/xsa/advisory-186.html 2016-09-08 2016-12-04 xen-kernel -- x86: Disallow L3 recursive pagetable for 32-bit PV guests xen-kernel 4.7.1

The Xen Project reports:

On real hardware, a 32-bit PAE guest must leave the USER and RW bit clear in L3 pagetable entries, but the pagetable walk behaves as if they were set. (The L3 entries are cached in processor registers, and don't actually form part of the pagewalk.)

When running a 32-bit PV guest on a 64-bit Xen, Xen must always OR in the USER and RW bits for L3 updates for the guest to observe architectural behaviour. This is unsafe in combination with recursive pagetables.

As there is no way to construct an L3 recursive pagetable in native 32-bit PAE mode, disallow this option in 32-bit PV guests.

A malicious 32-bit PV guest administrator can escalate their privilege to that of the host.

CVE-2016-7092 ports/214936 https://xenbits.xen.org/xsa/advisory-185.html 2016-09-08 2016-12-04 wireshark -- multiple vulnerabilities tshark 2.2.2 tshark-lite 2.2.2 wireshark 2.2.2 wireshark-lite 2.2.2 wireshark-qt5 2.2.2

Wireshark project reports:

Wireshark project is releasing Wireshark 2.2.2, which addresses:

wnpa-sec-2016-58: Profinet I/O long loop - CVE-2016-9372

wnpa-sec-2016-59: AllJoyn crash - CVE-2016-9374

wnpa-sec-2016-60: OpenFlow crash - CVE-2016-9376

wnpa-sec-2016-61: DCERPC crash - CVE-2016-9373

wnpa-sec-2016-62: DTN infinite loop - CVE-2016-9375

https://www.wireshark.org/docs/relnotes/wireshark-2.2.2.html CVE-2016-9372 CVE-2016-9373 CVE-2016-9374 CVE-2016-9375 CVE-2016-9376 2016-11-16 2016-12-01 Mozilla -- SVG Animation Remote Code Execution firefox 50.0.2,1 firefox-esr 45.5.1,1 linux-firefox 45.5.1,2 seamonkey 2.46 linux-seamonkey 2.46 libxul 45.5.1 thunderbird 45.5.1 linux-thunderbird 45.5.1

The Mozilla Foundation reports:

A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows.

CVE-2016-9079 https://www.mozilla.org/en-US/security/advisories/mfsa2016-92/ 2016-11-30 2016-12-01 2016-12-16 wget -- Access List Bypass / Race Condition wget 1.17

Dawid Golunski reports:

GNU wget in version 1.17 and earlier, when used in mirroring/recursive mode, is affected by a Race Condition vulnerability that might allow remote attackers to bypass intended wget access list restrictions specified with -A parameter.

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7098 CVE-2016-7098 2016-11-24 2016-11-30 p7zip -- Null pointer dereference p7zip 15.14_2

MITRE reports:

A null pointer dereference bug affects the 16.02 and many old versions of p7zip. A lack of null pointer check for the variable folders.PackPositions in function CInArchive::ReadAndDecodePackedStreams, as used in the 7z.so library and in 7z applications, will cause a crash and a denial of service when decoding malformed 7z files.

CVE-2016-9296 https://sourceforge.net/p/p7zip/discussion/383043/thread/648d34db/ https://sourceforge.net/p/p7zip/bugs/185/ https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-9296 2016-07-17 2016-11-30 subversion -- Unrestricted XML entity expansion in mod_dontdothat and Subversionclients using http(s) subversion18 1.8.17 subversion 1.9.5

The Apache Software Foundation reports:

The mod_dontdothat module of subversion and subversion clients using http(s):// are vulnerable to a denial-of-service attack, caused by exponential XML entity expansion. The attack targets XML parsers causing targeted process to consume excessive amounts of resources. The attack is also known as the "billions of laughs attack."

http://subversion.apache.org/security/CVE-2016-8734-advisory.txt CVE-2016-8734 2016-11-29 2016-11-29 libwww -- multiple vulnerabilities libwww 5.4.0_6

Mitre reports:

The HTBoundary_put_block function in HTBound.c for W3C libwww (w3c-libwww) allows remote servers to cause a denial of service (segmentation fault) via a crafted multipart/byteranges MIME message that triggers an out-of-bounds read.

The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, as used in the XML-Twig module for Perl, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with malformed UTF-8 sequences that trigger a buffer over-read, related to the doProlog function in lib/xmlparse.c, a different vulnerability than CVE-2009-2625 and CVE-2009-3720.

The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other software, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with crafted UTF-8 sequences that trigger a buffer over-read, a different vulnerability than CVE-2009-2625.

15035 CVE-2005-3183 CVE-2009-3560 CVE-2009-3720 ports/214546 https://bugzilla.redhat.com/show_bug.cgi?id=170518 2005-10-12 2016-11-29 mozilla -- data: URL can inherit wrong origin after an HTTP redirect firefox 50.0.1,1

The Mozilla Foundation reports:

Redirection from an HTTP connection to a data: URL assigns the referring site's origin to the data: URL in some circumstances. This can result in same-origin violations against a domain if it loads resources from malicious sites. Cross-origin setting of cookies has been demonstrated without the ability to read them.

CVE-2016-9078 https://www.mozilla.org/security/advisories/mfsa2016-91/ 2016-11-28 2016-11-29 Roundcube -- arbitrary command execution roundcube 1.2.3,1

The Roundcube project reports

steps/mail/sendmail.inc in Roundcube before 1.1.7 and 1.2.x before 1.2.3, when no SMTP server is configured and the sendmail program is enabled, does not properly restrict the use of custom envelope-from addresses on the sendmail command line, which allows remote authenticated users to execute arbitrary code via a modified HTTP request that sends a crafted e-mail message.

CVE-2016-9920 94858 http://www.openwall.com/lists/oss-security/2016/12/08/17 https://github.com/roundcube/roundcubemail/wiki/Changelog#release-123 2016-11-29 2016-11-29 2016-12-14 Drupal Code -- Multiple Vulnerabilities drupal7 7.07.52 drupal8 8.0.08.2.3

The Drupal development team reports:

Inconsistent name for term access query (Less critical - Drupal 7 and Drupal 8)

Drupal provides a mechanism to alter database SELECT queries before they are executed. Contributed and custom modules may use this mechanism to restrict access to certain entities by implementing hook_query_alter() or hook_query_TAG_alter() in order to add additional conditions. Queries can be distinguished by means of query tags. As the documentation on EntityFieldQuery::addTag() suggests, access-tags on entity queries normally follow the form ENTITY_TYPE_access (e.g. node_access). However, the taxonomy module's access query tag predated this system and used term_access as the query tag instead of taxonomy_term_access.

As a result, before this security release modules wishing to restrict access to taxonomy terms may have implemented an unsupported tag, or needed to look for both tags (term_access and taxonomy_term_access) in order to be compatible with queries generated both by Drupal core as well as those generated by contributed modules like Entity Reference. Otherwise information on taxonomy terms might have been disclosed to unprivileged users.

Incorrect cache context on password reset page (Less critical - Drupal 8)

The user password reset form does not specify a proper cache context, which can lead to cache poisoning and unwanted content on the page.

Confirmation forms allow external URLs to be injected (Moderately critical - Drupal 7)

Under certain circumstances, malicious users could construct a URL to a confirmation form that would trick users into being redirected to a 3rd party website after interacting with the form, thereby exposing the users to potential social engineering attacks.

Denial of service via transliterate mechanism (Moderately critical - Drupal 8)

A specially crafted URL can cause a denial of service via the transliterate mechanism.

CVE-2016-9449 CVE-2016-9450 CVE-2016-9451 CVE-2016-9452 2016-11-16 2016-11-25 2016-11-27 phpMyAdmin -- multiple vulnerabilities phpMyAdmin 4.6.04.6.5

The phpMYAdmin development team reports:

Summary

Open redirection

Description

A vulnerability was discovered where a user can be tricked in to following a link leading to phpMyAdmin, which after authentication redirects to another malicious site.

The attacker must sniff the user's valid phpMyAdmin token.

Severity

We consider this vulnerability to be of moderate severity.

Summary

Unsafe generation of blowfish secret

Description

When the user does not specify a blowfish_secret key for encrypting cookies, phpMyAdmin generates one at runtime. A vulnerability was reported where the way this value is created using a weak algorithm.

This could allow an attacker to determine the user's blowfish_secret and potentially decrypt their cookies.

Severity

We consider this vulnerability to be of moderate severity.

Mitigation factor

This vulnerability only affects cookie authentication and only when a user has not defined a $cfg['blowfish_secret'] in their config.inc.php

Summary

phpinfo information leak value of sensitive (HttpOnly) cookies

Description

phpinfo (phpinfo.php) shows PHP information including values of HttpOnly cookies.

Severity

We consider this vulnerability to be non-critical.

Mitigation factor

phpinfo in disabled by default and needs to be enabled explicitly.

Summary

Username deny rules bypass (AllowRoot & Others) by using Null Byte

Description

It is possible to bypass AllowRoot restriction ($cfg['Servers'][$i]['AllowRoot']) and deny rules for username by using Null Byte in the username.

Severity

We consider this vulnerability to be severe.

Summary

Username rule matching issues

Description

A vulnerability in username matching for the allow/deny rules may result in wrong matches and detection of the username in the rule due to non-constant execution time.

Severity

We consider this vulnerability to be severe.

Summary

Bypass logout timeout

Description

With a crafted request parameter value it is possible to bypass the logout timeout.

Severity

We consider this vulnerability to be of moderate severity.

Summary

Multiple full path disclosure vulnerabilities

Description

By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed. During an execution timeout in the export functionality, the errors containing the full path of the directory of phpMyAdmin is written to the export file.

Severity

We consider these vulnerability to be non-critical.

Summary

Multiple XSS vulnerabilities

Description

Several XSS vulnerabilities have been reported, including an improper fix for PMASA-2016-10 and a weakness in a regular expression using in some JavaScript processing.

Severity

We consider this vulnerability to be non-critical.

Summary

Multiple DOS vulnerabilities

Description

With a crafted request parameter value it is possible to initiate a denial of service attack in saved searches feature.

With a crafted request parameter value it is possible to initiate a denial of service attack in import feature.

An unauthenticated user can execute a denial of service attack when phpMyAdmin is running with $cfg['AllowArbitraryServer']=true;.

Severity

We consider these vulnerabilities to be of moderate severity.

Summary

Bypass white-list protection for URL redirection

Description

Due to the limitation in URL matching, it was possible to bypass the URL white-list protection.

Severity

We consider this vulnerability to be of moderate severity.

Summary

BBCode injection vulnerability

Description

With a crafted login request it is possible to inject BBCode in the login page.

Severity

We consider this vulnerability to be severe.

Mitigation factor

This exploit requires phpMyAdmin to be configured with the "cookie" auth_type; other authentication methods are not affected.

Summary

DOS vulnerability in table partitioning

Description

With a very large request to table partitioning function, it is possible to invoke a Denial of Service (DOS) attack.

Severity

We consider this vulnerability to be of moderate severity.

Summary

Multiple SQL injection vulnerabilities

Description

With a crafted username or a table name, it was possible to inject SQL statements in the tracking functionality that would run with the privileges of the control user. This gives read and write access to the tables of the configuration storage database, and if the control user has the necessary privileges, read access to some tables of the mysql database.

Severity

We consider these vulnerabilities to be serious.

Summary

Incorrect serialized string parsing

Description

Due to a bug in serialized string parsing, it was possible to bypass the protection offered by PMA_safeUnserialize() function.

Severity

We consider this vulnerability to be severe.

Summary

CSRF token not stripped from the URL

Description

When the arg_separator is different from its default value of &, the token was not properly stripped from the return URL of the preference import action.

Severity

We have not yet determined a severity for this issue.

https://www.phpmyadmin.net/security/PMASA-2016-57/ https://www.phpmyadmin.net/security/PMASA-2016-58/ https://www.phpmyadmin.net/security/PMASA-2016-59/ https://www.phpmyadmin.net/security/PMASA-2016-60/ https://www.phpmyadmin.net/security/PMASA-2016-61/ https://www.phpmyadmin.net/security/PMASA-2016-62/ https://www.phpmyadmin.net/security/PMASA-2016-63/ https://www.phpmyadmin.net/security/PMASA-2016-64/ https://www.phpmyadmin.net/security/PMASA-2016-65/ https://www.phpmyadmin.net/security/PMASA-2016-66/ https://www.phpmyadmin.net/security/PMASA-2016-67/ https://www.phpmyadmin.net/security/PMASA-2016-68/ https://www.phpmyadmin.net/security/PMASA-2016-69/ https://www.phpmyadmin.net/security/PMASA-2016-70/ https://www.phpmyadmin.net/security/PMASA-2016-71/ CVE-2016-6632 CVE-2016-6633 CVE-2016-4412 2016-11-25 2016-11-25 Remote-Code-Execution vulnerability in mysql and its variants CVE 2016-6662 mysql57-client mysql57-server 5.7.15 mysql56-client mysql56-server 5.6.33 mysql55-client mysql55-server 5.5.52

LegalHackers' reports:

RCE Bugs discovered in MySQL and its variants like MariaDB. It works by manupulating my.cnf files and using --malloc-lib. The bug seems fixed in MySQL5.7.15 by Oracle

http://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.html https://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-15.html 2016-09-12 2016-11-24 2016-11-24 ntp -- multiple vulnerabilities ntp 4.2.8p9 ntp-devel 0

Network Time Foundation reports:

NTF's NTP Project is releasing ntp-4.2.8p9, which addresses:

1 HIGH severity vulnerability that only affects Windows

2 MEDIUM severity vulnerabilities

2 MEDIUM/LOW severity vulnerabilities

5 LOW severity vulnerabilities

28 other non-security fixes and improvements

All of the security issues in this release are listed in VU#633847.

CVE-2016-7426 CVE-2016-7427 CVE-2016-7428 CVE-2016-7429 CVE-2016-7431 CVE-2016-7433 CVE-2016-7434 CVE-2016-9310 CVE-2016-9311 CVE-2016-9312 http://support.ntp.org/bin/view/Main/SecurityNotice#November_2016_ntp_4_2_8p9_NTP_Se http://www.kb.cert.org/vuls/id/633847 2016-11-21 2016-11-22 teeworlds -- Remote code execution teeworlds 0.6.4

Teeworlds project reports:

Attacker controlled memory-writes and possibly arbitrary code execution on the client, abusable by any server the client joins

https://www.teeworlds.com/?page=news&id=12086 2016-11-13 2016-11-21 jenkins -- Remote code execution vulnerability in remoting module jenkins 2.31 jenkins-lts 2.19.2

Jenkins Security Advisory:

An unauthenticated remote code execution vulnerability allowed attackers to transfer a serialized Java object to the Jenkins CLI, making Jenkins connect to an attacker-controlled LDAP server, which in turn can send a serialized payload leading to code execution, bypassing existing protection mechanisms.

CVE-2016-9299 https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-11-16 2016-11-11 2016-11-16 moodle -- multiple vulnerabilities moodle29 2.9.9 moodle30 3.0.7 moodle31 3.1.3

Marina Glancy reports:

MSA-16-0023: Question engine allows access to files that should not be available

MSA-16-0024: Non-admin site managers may accidentally edit admins via web services

MSA-16-0025: Capability to view course notes is checked in the wrong context

MSA-16-0026: When debugging is enabled, error exceptions returned from webservices could contain private data

CVE-2016-8642 CVE-2016-8643 CVE-2016-8644 https://moodle.org/security/ 2016-11-14 2016-11-16 2016-11-27 moodle -- multiple vulnerabilities moodle29 2.9.8 moodle30 3.0.6 moodle31 3.1.2

Marina Glancy reports:

MSA-16-0022: Web service tokens should be invalidated when the user password is changed or forced to be changed.

CVE-2016-7038 https://moodle.org/security/ 2016-09-12 2016-11-16 mozilla -- multiple vulnerabilities firefox 50.0_1,1 seamonkey linux-seamonkey 2.47 firefox-esr 45.5.0,1 linux-firefox 45.5.0,2 libxul thunderbird linux-thunderbird 45.5.0

Mozilla Foundation reports:

CVE-2016-5289: Memory safety bugs fixed in Firefox 50

CVE-2016-5290: Memory safety bugs fixed in Firefox 50 and Firefox ESR 45.5

CVE-2016-5291: Same-origin policy violation using local HTML file and saved shortcut file

CVE-2016-5292: URL parsing causes crash

CVE-2016-5293: Write to arbitrary file with updater and moz maintenance service using updater.log h

CVE-2016-5294: Arbitrary target directory for result files of update process

CVE-2016-5295: Mozilla Maintenance Service: Ability to read arbitrary files as SYSTEM

CVE-2016-5296: Heap-buffer-overflow WRITE in rasterize_edges_1

CVE-2016-5297: Incorrect argument length checking in Javascript

CVE-2016-5298: SSL indicator can mislead the user about the real URL visited

CVE-2016-5299: Firefox AuthToken in broadcast protected with signature-level permission can be accessed by an app

CVE-2016-9061: API Key (glocation) in broadcast protected with signature-level permission can be accessed by an a

CVE-2016-9062: Private browsing browser traces (android) in browser.db and wal file

CVE-2016-9063: Possible integer overflow to fix inside XML_Parse in expat

CVE-2016-9064: Addons update must verify IDs match between current and new versions

CVE-2016-9065: Firefox for Android location bar spoofing using fullscreen

CVE-2016-9066: Integer overflow leading to a buffer overflow in nsScriptLoadHandler

CVE-2016-9067: heap-use-after-free in nsINode::ReplaceOrInsertBefore

CVE-2016-9068: heap-use-after-free in nsRefreshDriver

CVE-2016-9070: Sidebar bookmark can have reference to chrome window

CVE-2016-9071: Probe browser history via HSTS/301 redirect + CSP

CVE-2016-9072: 64-bit NPAPI sandbox isn't enabled on fresh profile

CVE-2016-9073: windows.create schema doesn't specify "format": "relativeUrl"

CVE-2016-9074: Insufficient timing side-channel resistance in divSpoiler

CVE-2016-9075: WebExtensions can access the mozAddonManager API and use it to gain elevated privileges

CVE-2016-9076: select dropdown menu can be used for URL bar spoofing on e10s

CVE-2016-9077: Canvas filters allow feDisplacementMaps to be applied to cross-origin images, allowing timing atta

CVE-2016-5289 CVE-2016-5290 CVE-2016-5291 CVE-2016-5292 CVE-2016-5293 CVE-2016-5294 CVE-2016-5295 CVE-2016-5296 CVE-2016-5297 CVE-2016-5298 CVE-2016-5299 CVE-2016-9061 CVE-2016-9062 CVE-2016-9063 CVE-2016-9064 CVE-2016-9065 CVE-2016-9066 CVE-2016-9067 CVE-2016-9068 CVE-2016-9070 CVE-2016-9071 CVE-2016-9072 CVE-2016-9073 CVE-2016-9074 CVE-2016-9075 CVE-2016-9076 CVE-2016-9077 https://www.mozilla.org/security/advisories/mfsa2016-89/ https://www.mozilla.org/security/advisories/mfsa2016-90/ 2016-11-15 2016-11-16 lives -- insecure files permissions lives 2.8.1

Debian reports:

smogrify script creates insecure temporary files.

lives creates and uses world-writable directory.

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=756565 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=798043 2016-07-30 2016-11-12 openssl -- multiple vulnerabilities openssl-devel 1.1.0c

OpenSSL reports:

ChaCha20/Poly1305 heap-buffer-overflow (CVE-2016-7054)
Severity: High
TLS connections using *-CHACHA20-POLY1305 ciphersuites are susceptible to a DoS attack by corrupting larger payloads. This can result in an OpenSSL crash. This issue is not considered to be exploitable beyond a DoS.

CMS Null dereference (CVE-2016-7053)
Severity: Medium
Applications parsing invalid CMS structures can crash with a NULL pointer dereference. This is caused by a bug in the handling of the ASN.1 CHOICE type in OpenSSL 1.1.0 which can result in a NULL value being passed to the structure callback if an attempt is made to free certain invalid encodings. Only CHOICE structures using a callback which do not handle NULL value are affected.

Montgomery multiplication may produce incorrect results (CVE-2016-7055)i
Severity: Low
There is a carry propagating bug in the Broadwell-specific Montgomery multiplication procedure that handles input lengths divisible by, but longer than 256 bits.

https://www.openssl.org/news/secadv/20161110.txt CVE-2016-7054 CVE-2016-7053 CVE-2016-7055 2016-11-10 2016-11-10 2016-11-11 chromium -- multiple vulnerabilities chromium chromium-npapi chromium-pulse 54.0.2840.100

Google Chrome Releases reports:

4 security fixes in this release, including:

[643948] High CVE-2016-5199: Heap corruption in FFmpeg. Credit to Paul Mehta

[658114] High CVE-2016-5200: Out of bounds memory access in V8. Credit to Choongwoo Han

[660678] Medium CVE-2016-5201: Info leak in extensions. Credit to Rob Wu

[662843] CVE-2016-5202: Various fixes from internal audits, fuzzing and other initiatives

CVE-2016-5199 CVE-2016-5200 CVE-2016-5201 CVE-2016-5202 https://googlechromereleases.blogspot.nl/2016/11/stable-channel-update-for-desktop_9.html 2016-11-9 2016-11-10 flash -- multiple vulnerabilities linux-c6-flashplugin linux-c7-flashplugin linux-f10-flashplugin 11.2r202.644

Adobe reports:

These updates resolve type confusion vulnerabilities that could lead to code execution (CVE-2016-7860, CVE-2016-7861, CVE-2016-7865).

These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2016-7857, CVE-2016-7858, CVE-2016-7859, CVE-2016-7862, CVE-2016-7863, CVE-2016-7864).

https://helpx.adobe.com/security/products/flash-player/apsb16-37.html CVE-2016-7857 CVE-2016-7858 CVE-2016-7859 CVE-2016-7860 CVE-2016-7861 CVE-2016-7862 CVE-2016-7863 CVE-2016-7864 CVE-2016-7865 2016-11-08 2016-11-10 gitlab -- Directory traversal via "import/export" feature gitlab 8.10.08.10.12 8.11.08.11.9 8.12.08.12.7 8.13.08.13.2

GitLab reports:

The import/export feature did not properly check for symbolic links in user-provided archives and therefore it was possible for an authenticated user to retrieve the contents of any file accessible to the GitLab service account. This included sensitive files such as those that contain secret tokens used by the GitLab service to authenticate users.

https://about.gitlab.com/2016/11/02/cve-2016-9086-patches/ CVE-2016-9086 ports/214360 2016-11-02 2016-11-09 2017-05-18 chromium -- out-of-bounds memory access chromium chromium-npapi chromium-pulse 54.0.2840.90

Google Chrome Releases reports:

[659475] High CVE-2016-5198: Out of bounds memory access in V8. Credit to Tencent Keen Security Lab, working with Trend Micro's Zero Day Initiative.

CVE-2016-5198 https://googlechromereleases.blogspot.nl/2016/11/stable-channel-update-for-desktop.html 2016-11-01 2016-11-03 FreeBSD -- OpenSSL Remote DoS vulnerability FreeBSD 10.310.3_12 10.210.2_25 10.110.1_42 9.39.3_50 openssl 1.0.2i,1 openssl-devel 1.1.0a linux-c6-openssl 1.0.1e_13 linux-c7-openssl-libs 1.0.1e_3

Problem Description:

Due to improper handling of alert packets, OpenSSL would consume an excessive amount of CPU time processing undefined alert messages.

Impact:

A remote attacker who can initiate handshakes with an OpenSSL based server can cause the server to consume a lot of computation power with very little bandwidth usage, and may be able to use this technique in a leveraged Denial of Service attack.

CVE-2016-8610 SA-16:35.openssl http://seclists.org/oss-sec/2016/q4/224 2016-11-02 2016-11-02 2017-02-22 django -- multiple vulnerabilities py27-django py33-django py34-django py35-django 1.8.16 py27-django18 py33-django18 py34-django18 py35-django18 1.8.16 py27-django19 py33-django19 py34-django19 py35-django19 1.9.11 py27-django110 py33-django110 py34-django110 py35-django110 1.10.3

The Django project reports:

Today the Django team released Django 1.10.3, Django 1.9.11, and 1.8.16. These releases addresses two security issues detailed below. We encourage all users of Django to upgrade as soon as possible.

User with hardcoded password created when running tests on Oracle

DNS rebinding vulnerability when DEBUG=True

https://www.djangoproject.com/weblog/2016/nov/01/security-releases/ CVE-2016-9013 CVE-2016-9014 2016-11-01 2016-11-02 cURL -- multiple vulnerabilities curl 7.17.51.0

The cURL project reports

cookie injection for other servers

case insensitive password comparison

OOB write via unchecked multiplication

double-free in curl_maprintf

double-free in krb5 code

glob parser write/read out of bounds

curl_getdate read out of bounds

URL unescape heap overflow via integer truncation

Use-after-free via shared cookies

invalid URL parsing with '#'

IDNA 2003 makes curl use wrong host

https://curl.haxx.se/docs/security.html CVE-2016-8615 CVE-2016-8616 CVE-2016-8617 CVE-2016-8618 CVE-2016-8619 CVE-2016-8620 CVE-2016-8621 CVE-2016-8622 CVE-2016-8623 CVE-2016-8624 CVE-2016-8625 2016-11-02 2016-11-02 BIND -- Remote Denial of Service vulnerability bind99 9.9.9P4 bind910 9.10.4P4 bind911 9.11.0P1 bind9-devel 9.12.0.a.2016.10.21 FreeBSD 9.39.3_50

ISC reports:

A defect in BIND's handling of responses containing a DNAME answer can cause a resolver to exit after encountering an assertion failure in db.c or resolver.c

CVE-2016-8864 SA-16:34.bind https://kb.isc.org/article/AA-01434/ 2016-11-01 2016-11-02 memcached -- multiple vulnerabilities memcached 1.4.33

Cisco Talos reports:

Multiple integer overflow vulnerabilities exist within Memcached that could be exploited to achieve remote code execution on the targeted system. These vulnerabilities manifest in various Memcached functions that are used in inserting, appending, prepending, or modifying key-value data pairs. Systems which also have Memcached compiled with support for SASL authentication are also vulnerable to a third flaw due to how Memcached handles SASL authentication commands.

An attacker could exploit these vulnerabilities by sending a specifically crafted Memcached command to the targeted server. Additionally, these vulnerabilities could also be exploited to leak sensitive process information which an attacker could use to bypass common exploitation mitigations, such as ASLR, and can be triggered multiple times. This enables reliable exploitation which makes these vulnerabilities severe.

http://blog.talosintel.com/2016/10/memcached-vulnerabilities.html CVE-2016-8704 CVE-2016-8705 CVE-2016-8706 2016-10-31 2016-11-02 MySQL -- multiple vulnerabilities mariadb55-server mysql55-server 5.5.53 mysql56-server 5.6.34 mysql57-server 5.7.15

The MariaDB project reports:

Fixes for the following security vulnerabilities:

CVE-2016-7440

CVE-2016-5584

https://mariadb.com/kb/en/mariadb/mariadb-5553-release-notes/ CVE-2016-7440 CVE-2016-5584 2016-10-17 2016-11-01 chromium -- multiple vulnerabilities chromium chromium-npapi chromium-pulse 54.0.2840.59

Google Chrome Releases reports:

21 security fixes in this release, including:

[645211] High CVE-2016-5181: Universal XSS in Blink. Credit to Anonymous

[638615] High CVE-2016-5182: Heap overflow in Blink. Credit to Giwan Go of STEALIEN

[645122] High CVE-2016-5183: Use after free in PDFium. Credit to Anonymous

[630654] High CVE-2016-5184: Use after free in PDFium. Credit to Anonymous

[621360] High CVE-2016-5185: Use after free in Blink. Credit to cloudfuzzer

[639702] High CVE-2016-5187: URL spoofing. Credit to Luan Herrera

[565760] Medium CVE-2016-5188: UI spoofing. Credit to Luan Herrera

[633885] Medium CVE-2016-5192: Cross-origin bypass in Blink. Credit to haojunhou@gmail.com

[646278] Medium CVE-2016-5189: URL spoofing. Credit to xisigr of Tencent's Xuanwu Lab

[644963] Medium CVE-2016-5186: Out of bounds read in DevTools. Credit to Abdulrahman Alqabandi (@qab)

[639126] Medium CVE-2016-5191: Universal XSS in Bookmarks. Credit to Gareth Hughes

[642067] Medium CVE-2016-5190: Use after free in Internals. Credit to Atte Kettunen of OUSPG

[639658] Low CVE-2016-5193: Scheme bypass. Credit to Yuyang ZHOU (martinzhou96)

[654782] CVE-2016-5194: Various fixes from internal audits, fuzzing and other initiatives

CVE-2016-5181 CVE-2016-5182 CVE-2016-5183 CVE-2016-5184 CVE-2016-5185 CVE-2016-5186 CVE-2016-5187 CVE-2016-5188 CVE-2016-5189 CVE-2016-5190 CVE-2016-5191 CVE-2016-5192 CVE-2016-5193 CVE-2016-5194 https://googlechromereleases.blogspot.nl/2016/10/stable-channel-update-for-desktop.html 2016-10-12 2016-10-31 chromium -- multiple vulnerabilities chromium chromium-npapi chromium-pulse 53.0.2785.143

Google Chrome Releases reports:

3 security fixes in this release, including:

[642496] High CVE-2016-5177: Use after free in V8. Credit to Anonymous

[651092] CVE-2016-5178: Various fixes from internal audits, fuzzing and other initiatives.

CVE-2016-5177 CVE-2016-5178 https://googlechromereleases.blogspot.nl/2016/09/stable-channel-update-for-desktop_29.html 2016-09-29 2016-10-31 FreeBSD -- OpenSSH Remote Denial of Service vulnerability openssh-portable 7.3p1_1 FreeBSD 11.011.0_3 10.310.3_12

Problem Description:

When processing the SSH_MSG_KEXINIT message, the server could allocate up to a few hundreds of megabytes of memory per each connection, before any authentication take place.

Impact:

A remote attacker may be able to cause a SSH server to allocate an excessive amount of memory. Note that the default MaxStartups setting on FreeBSD will limit the effectiveness of this attack.

http://seclists.org/oss-sec/2016/q4/191 CVE-2016-8858 SA-16:33.openssh 2016-10-19 2016-10-29 2016-11-02 sudo -- Potential bypass of sudo_noexec.so via wordexp() sudo 1.6.81.8.18p1

Todd C. Miller reports:

A flaw exists in sudo's noexec functionality that may allow a user with sudo privileges to run additional commands even when the NOEXEC tag has been applied to a command that uses the wordexp() function.

https://www.sudo.ws/alerts/noexec_wordexp.html CVE-2016-7076 2016-10-28 2016-10-28 Axis2 -- Security vulnerabilities on dependency Apache HttpClient axis2 1.7.4

Apache Axis2 reports:

Apache Axis2 1.7.4 is a maintenance release that includes fixes for several issues, including the following security issues: Session fixation (AXIS2-4739) and XSS (AXIS2-5683) vulnerabilities affecting the admin console. A dependency on an Apache HttpClient version affected by known security vulnerabilities (CVE-2012-6153 and CVE-2014-3577); see AXIS2-5757.

http://axis.apache.org/axis2/java/core/release-notes/1.7.4.html https://issues.apache.org/jira/browse/AXIS2-4739 https://issues.apache.org/jira/browse/AXIS2-5683 https://issues.apache.org/jira/browse/AXIS2-5757 CVE-2012-6153 CVE-2014-3577 2012-12-06 2016-10-28 node.js -- ares_create_query single byte out of buffer write node010 0.10.48 node012 0.12.17 node4 4.6.1

Node.js has released new verions containing the following security fix:

The following releases all contain fixes for CVE-2016-5180 "ares_create_query single byte out of buffer write": Node.js v0.10.48 (Maintenance), Node.js v0.12.17 (Maintenance), Node.js v4.6.1 (LTS "Argon")

While this is not a critical update, all users of these release lines should upgrade at their earliest convenience.

https://nodejs.org/en/blog/vulnerability/october-2016-security-releases/ CVE-2016-5180 ports/213800 2016-10-18 2016-10-26 node.js -- multiple vulnerabilities node 6.0.06.9.0

Node.js v6.9.0 LTS contains the following security fixes, specific to v6.x:

Disable auto-loading of openssl.cnf: Don't automatically attempt to load an OpenSSL configuration file, from the OPENSSL_CONF environment variable or from the default location for the current platform. Always triggering a configuration file load attempt may allow an attacker to load compromised OpenSSL configuration into a Node.js process if they are able to place a file in a default location.

Patched V8 arbitrary memory read (CVE-2016-5172): The V8 parser mishandled scopes, potentially allowing an attacker to obtain sensitive information from arbitrary memory locations via crafted JavaScript code. This vulnerability would require an attacker to be able to execute arbitrary JavaScript code in a Node.js process.

Create a unique v8_inspector WebSocket address: Generate a UUID for each execution of the inspector. This provides additional security to prevent unauthorized clients from connecting to the Node.js process via the v8_inspector port when running with --inspect. Since the debugging protocol allows extensive access to the internals of a running process, and the execution of arbitrary code, it is important to limit connections to authorized tools only. Note that the v8_inspector protocol in Node.js is still considered an experimental feature. Vulnerability originally reported by Jann Horn.

All of these vulnerabilities are considered low-severity for Node.js users, however, users of Node.js v6.x should upgrade at their earliest convenience.

https://nodejs.org/en/blog/vulnerability/october-2016-security-releases/ CVE-2016-5172 2016-10-18 2016-10-28 urllib3 -- certificate verification failure py-urllib3 1.18

urllib3 reports:

CVE-2016-9015: Certification verification failure

CVE-2016-9015 https://github.com/shazow/urllib3/blob/1.18.1/CHANGES.rst 2016-10-27 2016-10-28 flash -- remote code execution linux-f10-flashplugin linux-c6-flashplugin linux-c7-flashplugin 11.2r202.643

Adobe reports:

Adobe has released security updates for Adobe Flash Player for Windows, Macintosh, Linux and Chrome OS. These updates address a critical vulnerability that could potentially allow an attacker to take control of the affected system.

Adobe is aware of a report that an exploit for CVE-2016-7855 exists in the wild, and is being used in limited, targeted attacks against users running Windows versions 7, 8.1 and 10.

CVE-2016-7855 https://helpx.adobe.com/security/products/flash-player/apsb16-36.html 2016-10-26 2016-10-27 FreeBSD -- bhyve - privilege escalation vulnerability FreeBSD-kernel 11.011.0_2

Problem Description:

An unchecked array reference in the VGA device emulation code could potentially allow guests access to the heap of the bhyve process. Since the bhyve process is running as root, this may allow guests to obtain full control of the hosts they are running on.

Impact:

For bhyve virtual machines with the "fbuf" framebuffer device configured, if exploited, a malicious guest could obtain full access to not just the host system, but to other virtual machines running on the system.

SA-16:32.bhyve 2016-10-25 2016-10-25 2016-10-25 flash -- multiple vulnerabilities linux-c6-flashplugin linux-c6_64-flashplugin linux-c7-flashplugin linux-f10-flashplugin 11.2r202.637

Adobe reports:

Adobe has released security updates for Adobe Flash Player for Windows, Macintosh, Linux and ChromeOS. These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system.

These updates resolve a type confusion vulnerability that could lead to code execution (CVE-2016-6992).

These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2016-6981, CVE-2016-6987).

These updates resolve a security bypass vulnerability (CVE-2016-4286).

These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2016-4273, CVE-2016-6982, CVE-2016-6983, CVE-2016-6984, CVE-2016-6985, CVE-2016-6986, CVE-2016-6989, CVE-2016-6990).

CVE-2016-4273 CVE-2016-4286 CVE-2016-6981 CVE-2016-6982 CVE-2016-6983 CVE-2016-6984 CVE-2016-6985 CVE-2016-6986 CVE-2016-6987 CVE-2016-6989 CVE-2016-6990 CVE-2016-6992 https://helpx.adobe.com/security/products/flash-player/apsb16-32.html 2016-10-11 2016-10-24 mozilla -- multiple vulnerabilities firefox 49.0.2,1

Mozilla Foundation reports:

CVE-2016-5287: Crash in nsTArray_base<T>::SwapArrayElements

CVE-2016-5288: Web content can read cache entries

CVE-2016-5287 CVE-2016-5288 https://www.mozilla.org/security/advisories/mfsa2016-87/ 2016-10-20 2016-10-21 Axis2 -- Cross-site scripting (XSS) vulnerability axis2 1.7.3

Apache Axis2 reports:

Apache Axis2 1.7.3 is a security release that contains a fix for CVE-2010-3981. That security vulnerability affects the admin console that is part of the Axis2 Web application and was originally reported for SAP BusinessObjects (which includes a version of Axis2). That report didn’t mention Axis2 at all and the Axis2 project only recently became aware (thanks to Devesh Bhatt and Nishant Agarwala) that the issue affects Apache Axis2 as well.

http://axis.apache.org/axis2/java/core/release-notes/1.7.3.html CVE-2010-3981 ports/213546 2010-10-18 2016-10-18 Tor -- remote denial of service tor 0.2.8.9 tor-devel 0.2.9.4-alpha

The Tor Blog reports:

Prevent a class of security bugs caused by treating the contents of a buffer chunk as if they were a NUL-terminated string. At least one such bug seems to be present in all currently used versions of Tor, and would allow an attacker to remotely crash most Tor instances, especially those compiled with extra compiler hardening. With this defense in place, such bugs can't crash Tor, though we should still fix them as they occur. Closes ticket 20384 (TROVE-2016-10-001).

https://blog.torproject.org/blog/tor-0289-released-important-fixes 2016-10-17 2016-10-18 Rails 4 -- Possible XSS Vulnerability in Action View rubygem-actionview 3.0.04.2.7.1

Ruby Security team reports:

There is a possible XSS vulnerability in Action View. Text declared as "HTML safe" will not have quotes escaped when used as attribute values in tag helpers. This vulnerability has been assigned the CVE identifier CVE-2016-6316.

https://groups.google.com/forum/#!topic/ruby-security-ann/8B2iV2tPRSE CVE-2016-6316 2016-08-11 2016-08-18 Rails 4 -- Unsafe Query Generation Risk in Active Record rubygem-activerecord4 4.2.04.2.7.1

Ruby Security team reports:

There is a vulnerability when Active Record is used in conjunction with JSON parameter parsing. This vulnerability has been assigned the CVE identifier CVE-2016-6317. This vulnerability is similar to CVE-2012-2660, CVE-2012-2694 and CVE-2013-0155.

https://groups.google.com/forum/#!topic/ruby-security-ann/WccgKSKiPZA CVE-2016-6317 2016-08-11 2016-08-18 PHP -- multiple vulnerabilities php70 7.0.11

PHP reports:

Fixed bug #73007 (add locale length check)

Fixed bug #72293 (Heap overflow in mysqlnd related to BIT fields)

Fixed bug #72928 (Out of bound when verify signature of zip phar in phar_parse_zipfile)

Fixed bug #73029 (Missing type check when unserializing SplArray)

Fixed bug #73052 (Memory Corruption in During Deserialized-object Destruction)

Fixed bug #72860 (wddx_deserialize use-after-free)

Fixed bug #73065 (Out-Of-Bounds Read in php_wddx_push_element)

http://php.net/ChangeLog-7.php#7.0.11 CVE-2016-7416 CVE-2016-7412 CVE-2016-7414 CVE-2016-7417 CVE-2016-7413 CVE-2016-7418 2016-09-15 2016-09-30 PHP -- multiple vulnerabilities php56 5.6.26

PHP reports:

Fixed bug #73007 (add locale length check)

Fixed bug #72293 (Heap overflow in mysqlnd related to BIT fields)

Fixed bug #72928 (Out of bound when verify signature of zip phar in phar_parse_zipfile)

Fixed bug #73029 (Missing type check when unserializing SplArray)

Fixed bug #73052 (Memory Corruption in During Deserialized-object Destruction)

Fixed bug #72860 (wddx_deserialize use-after-free)

Fixed bug #73065 (Out-Of-Bounds Read in php_wddx_push_element)

http://php.net/ChangeLog-5.php#5.6.26 CVE-2016-7416 CVE-2016-7412 CVE-2016-7414 CVE-2016-7417 CVE-2016-7411 CVE-2016-7413 CVE-2016-7418 2016-09-16 2016-09-30 file-roller -- path traversal vulnerability file-roller 3.5.4,13.20.2,1

reports:

File Roller 3.5.4 through 3.20.2 was affected by a path traversal bug that could result in deleted files if a user were tricked into opening a malicious archive.

http://www.openwall.com/lists/oss-security/2016/09/08/4 CVE-2016-7162 ports/213199 2016-09-08 2016-10-12 2016-10-18 VirtualBox -- undisclosed vulnerabilities virtualbox-ose 5.05.0.8 4.34.3.32 4.24.2.34 4.14.1.42 4.04.0.34

Oracle reports reports:

Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 4.0.34, 4.1.42, 4.2.34, 4.3.32, and 5.0.8, when using a Windows guest, allows local users to affect availability via unknown vectors related to Core.

Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 4.0.34, 4.1.42, 4.2.34, 4.3.32, and 5.0.8, when a VM has the Remote Display feature (RDP) enabled, allows remote attackers to affect availability via unknown vectors related to Core.

http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html CVE-2015-4813 CVE-2015-4896 ports/204406 2015-10-01 2016-10-12 2016-10-18 ImageMagick -- multiple vulnerabilities ImageMagick ImageMagick-nox11 6.9.5.10,1

Debian reports:

Various memory handling problems and cases of missing or incomplete input sanitising may result in denial of service or the execution of arbitrary code if malformed SIXEL, PDB, MAP, SGI, TIFF and CALS files are processed.

https://www.debian.org/security/2016/dsa-3675 ports/213032 2016-09-23 2016-10-12 2016-10-18 libgd -- integer overflow which could lead to heap buffer overflow gd 2.2.3 php70-gd 7.0.11 php56-gd 5.6.26

LibGD reports:

An integer overflow issue was found in function gdImageWebpCtx of file gd_webp.c which could lead to heap buffer overflow.

https://github.com/libgd/libgd/issues/308 https://bugs.php.net/bug.php?id=73003 ports/213023 2016-09-02 2016-10-11 2016-10-18 libvncserver -- multiple security vulnerabilities libvncserver 0.9.10

Nicolas Ruff reports:

Integer overflow in MallocFrameBuffer() on client side.

Lack of malloc() return value checking on client side.

Server crash on a very large ClientCutText message.

Server crash when scaling factor is set to zero.

Multiple stack overflows in File Transfer feature.

http://seclists.org/oss-sec/2014/q3/639 CVE-2014-6051 CVE-2014-6052 CVE-2014-6053 CVE-2014-6054 CVE-2014-6055 ports/212380 2014-09-23 2016-10-11 2016-10-18 openoffice -- information disclosure vulnerability apache-openoffice apache-openoffice-devel 4.1.1

Apache reports:

The exposure exploits the way OLE previews are generated to embed arbitrary file data into a specially crafted document when it is opened. Data exposure is possible if the updated document is distributed to other parties.

http://www.openoffice.org/security/cves/CVE-2014-3575.html CVE-2014-3575 ports/212379 2014-08-21 2016-10-12 2016-10-18 mupdf -- multiple vulnerabilities mupdf 1.9a_1,1 llpp 22_2 zathura-pdf-mupdf 0.3.0_2

Tobias Kortkamp reports:

Heap-based buffer overflow in the pdf_load_mesh_params function in pdf/pdf-shade.c in MuPDF allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a large decode array.

Use-after-free vulnerability in the pdf_load_xref function in pdf/pdf-xref.c in MuPDF allows remote attackers to cause a denial of service (crash) via a crafted PDF file.

http://openbsd-archive.7691.n7.nabble.com/mupdf-CVE-2016-6525-amp-CVE-2016-6265-td302904.html http://bugs.ghostscript.com/show_bug.cgi?id=696941 http://bugs.ghostscript.com/show_bug.cgi?id=696954 CVE-2016-6525 CVE-2016-6265 ports/212207 2016-08-27 2016-10-12 2016-10-18 openjpeg -- multiple vulnerabilities openjpeg 2.1.1_1

Tencent's Xuanwu LAB reports:

A Heap Buffer Overflow (Out-of-Bounds Write) issue was found in function opj_dwt_interleave_v of dwt.c. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of OpenJPEG.

An integer overflow issue exists in function opj_pi_create_decode of pi.c. It can lead to Out-Of-Bounds Read and Out-Of-Bounds Write in function opj_pi_next_cprl of pi.c (function opj_pi_next_lrcp, opj_pi_next_rlcp, opj_pi_next_rpcl, opj_pi_next_pcrl may also be vulnerable). This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of OpenJPEG.

"http://www.openwall.com/lists/oss-security/2016/09/08/2" "http://www.openwall.com/lists/oss-security/2016/09/08/3" CVE-2016-5157 CVE-2016-7163 2016-09-08 2016-10-11 redis -- sensitive information leak through command history file redis redis-devel 3.2.3

Redis team reports:

The redis-cli history file (in linenoise) is created with the default OS umask value which makes it world readable in most systems and could potentially expose authentication credentials to other users.

https://github.com/antirez/redis/pull/1418 https://github.com/antirez/redis/issues/3284 CVE-2013-7458 2013-11-30 2016-10-11 FreeBSD -- Multiple libarchive vulnerabilities FreeBSD 11.011.0_1 10.310.3_10 10.210.2_23 10.110.1_40

Problem Description:

Flaws in libarchive's handling of symlinks and hard links allow overwriting files outside the extraction directory, or permission changes to a directory outside the extraction directory.

Impact:

An attacker who can control freebsd-update's or portsnap's input to tar can change file content or permisssions on files outside of the update tool's working sandbox.

SA-16:31.libarchive 2016-10-05 2016-10-10 FreeBSD -- Multiple portsnap vulnerabilities FreeBSD 11.011.0_1 10.310.3_10 10.210.2_23 10.110.1_40 9.39.3_48

Problem Description:

Flaws in portsnap's verification of downloaded tar files allows additional files to be included without causing the verification to fail. Portsnap may then use or execute these files.

Impact:

An attacker who can conduct man in the middle attack on the network at the time when portsnap is run can cause portsnap to execute arbitrary commands under the credentials of the user who runs portsnap, typically root.

SA-16:30.portsnap 2016-10-10 2016-10-10 FreeBSD -- Heap overflow vulnerability in bspatch FreeBSD 11.011.0_1 10.310.3_10 10.210.2_23 10.110.1_40 9.39.3_48

Problem Description:

The implementation of bspatch is susceptible to integer overflows with carefully crafted input, potentially allowing an attacker who can control the patch file to write at arbitrary locations in the heap. This issue was partially addressed in FreeBSD-SA-16:25.bspatch, but some possible integer overflows remained.

Impact:

An attacker who can control the patch file can cause a crash or run arbitrary code under the credentials of the user who runs bspatch, in many cases, root.

SA-16:29.bspatch 2016-10-10 2016-10-10 mkvtoolnix -- code execution via specially crafted files mkvtoolnix 9.4.1

Moritz Bunkus reports:

most of the bugs fixed on 2016-09-06 and 2016-09-07 for issue #1780 are potentially exploitable. The scenario is arbitrary code execution with specially-crafted files.

https://mkvtoolnix.download/doc/ChangeLog 2016-09-07 2016-10-09 X.org libraries -- multiple vulnerabilities libX11 1.6.4,1 libXfixes 5.0.3 libXi 1.7.7,1 libXrandr 1.5.1 libXrender 0.9.10 libXtst 1.2.3 libXv 1.0.11,1 libXvMC 1.0.10

Matthieu Herrb reports:

Tobias Stoeckmann from the OpenBSD project has discovered a number of issues in the way various X client libraries handle the responses they receive from servers, and has worked with X.Org's security team to analyze, confirm, and fix these issues. These issue come in addition to the ones discovered by Ilja van Sprundel in 2013.

Most of these issues stem from the client libraries trusting the server to send correct protocol data, and not verifying that the values will not overflow or cause other damage. Most of the time X clients and servers are run by the same user, with the server more privileged than the clients, so this is not a problem, but there are scenarios in which a privileged client can be connected to an unprivileged server, for instance, connecting a setuid X client (such as a screen lock program) to a virtual X server (such as Xvfb or Xephyr) which the user has modified to return invalid data, potentially allowing the user to escalate their privileges.

https://lists.x.org/archives/xorg-announce/2016-October/002720.html CVE-2016-5407 2016-10-04 2016-10-07 2016-10-10 BIND -- Remote Denial of Service vulnerability bind99 9.9.9P3 bind910 9.10.4P3 bind911 9.11.0.rc3 bind9-devel 9.12.0.a.2016.09.10 FreeBSD 9.39.3_48

ISC reports:

Testing by ISC has uncovered a critical error condition which can occur when a nameserver is constructing a response. A defect in the rendering of messages into packets can cause named to exit with an assertion failure in buffer.c while constructing a response to a query that meets certain criteria.

CVE-2016-2776 SA-16:28.bind https://kb.isc.org/article/AA-01419 2016-09-27 2016-09-28 2016-10-10 django -- CSRF protection bypass on a site with Google Analytics py-django19 1.9.10 py-django18 1.8.15 py-django 1.8.15

Django Software Foundation reports:

An interaction between Google Analytics and Django's cookie parsing could allow an attacker to set arbitrary cookies leading to a bypass of CSRF protection.

https://www.djangoproject.com/weblog/2016/sep/26/security-releases/ CVE-2016-7401 2016-09-26 2016-09-27 OpenSSL -- multiple vulnerabilities openssl 1.0.2j,1 openssl-devel 1.1.0b libressl 2.4.3 libressl-devel 2.4.3 FreeBSD 11.011.0_1

OpenSSL reports:

Critical vulnerability in OpenSSL 1.1.0a
Fix Use After Free for large message sizes (CVE-2016-6309)

Moderate vulnerability in OpenSSL 1.0.2i
Missing CRL sanity check (CVE-2016-7052)

https://www.openssl.org/news/secadv/20160926.txt CVE-2016-6309 CVE-2016-7052 SA-16:27.openssl 2016-09-26 2016-09-26 2016-10-10 OpenSSL -- multiple vulnerabilities openssl-devel 1.1.01.1.0_1 openssl 1.0.2i,1 linux-c6-openssl 1.0.1e_11 FreeBSD 10.310.3_8 10.210.2_21 10.110.1_38 9.39.3_46

OpenSSL reports:

High: OCSP Status Request extension unbounded memory growth

SSL_peek() hang on empty record

SWEET32 Mitigation

OOB write in MDC2_Update()

Malformed SHA512 ticket DoS

OOB write in BN_bn2dec()

OOB read in TS_OBJ_print_bio()

Pointer arithmetic undefined behaviour

Constant time flag not preserved in DSA signing

DTLS buffered message DoS

DTLS replay protection DoS

Certificate message OOB reads

Excessive allocation of memory in tls_get_message_header()

Excessive allocation of memory in dtls1_preprocess_fragment()

NB: LibreSSL is only affected by CVE-2016-6304

https://www.openssl.org/news/secadv/20160922.txt CVE-2016-6304 CVE-2016-6305 CVE-2016-2183 CVE-2016-6303 CVE-2016-6302 CVE-2016-2182 CVE-2016-2180 CVE-2016-2177 CVE-2016-2178 CVE-2016-2179 CVE-2016-2181 CVE-2016-6306 CVE-2016-6307 CVE-2016-6308 SA-16:26.openssl 2016-09-22 2016-09-22 2016-10-11 irssi -- heap corruption and missing boundary checks irssi zh-irssi 0.8.170.8.20

Irssi reports:

Remote crash and heap corruption. Remote code execution seems difficult since only Nuls are written.

https://irssi.org/security/irssi_sa_2016.txt CVE-2016-7044 CVE-2016-7045 2016-09-21 2016-09-21 2016-09-22 mozilla -- multiple vulnerabilities firefox 49.0,1 seamonkey linux-seamonkey 2.46 firefox-esr 45.4.0,1 linux-firefox 45.4.0,2 libxul thunderbird linux-thunderbird 45.4.0

Mozilla Foundation reports:

CVE-2016-2827 - Out-of-bounds read in mozilla::net::IsValidReferrerPolicy [low]

CVE-2016-5256 - Memory safety bugs fixed in Firefox 49 [critical]

CVE-2016-5257 - Memory safety bugs fixed in Firefox 49 and Firefox ESR 45.4 [critical]

CVE-2016-5270 - Heap-buffer-overflow in nsCaseTransformTextRunFactory::TransformString [high]

CVE-2016-5271 - Out-of-bounds read in PropertyProvider::GetSpacingInternal [low]

CVE-2016-5272 - Bad cast in nsImageGeometryMixin [high]

CVE-2016-5273 - crash in mozilla::a11y::HyperTextAccessible::GetChildOffset [high]

CVE-2016-5274 - use-after-free in nsFrameManager::CaptureFrameState [high]

CVE-2016-5275 - global-buffer-overflow in mozilla::gfx::FilterSupport::ComputeSourceNeededRegions [critical]

CVE-2016-5276 - Heap-use-after-free in mozilla::a11y::DocAccessible::ProcessInvalidationList [high]

CVE-2016-5277 - Heap-use-after-free in nsRefreshDriver::Tick [high]

CVE-2016-5278 - Heap-buffer-overflow in nsBMPEncoder::AddImageFrame [critical]

CVE-2016-5279 - Full local path of files is available to web pages after drag and drop [moderate]

CVE-2016-5280 - Use-after-free in mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap [high]

CVE-2016-5281 - use-after-free in DOMSVGLength [high]

CVE-2016-5282 - Don't allow content to request favicons from non-whitelisted schemes [moderate]

CVE-2016-5283 - <iframe src> fragment timing attack can reveal cross-origin data [high]

CVE-2016-5284 - Add-on update site certificate pin expiration [high]

CVE-2016-2827 CVE-2016-5256 CVE-2016-5257 CVE-2016-5270 CVE-2016-5271 CVE-2016-5272 CVE-2016-5273 CVE-2016-5274 CVE-2016-5275 CVE-2016-5276 CVE-2016-5277 CVE-2016-5278 CVE-2016-5279 CVE-2016-5280 CVE-2016-5281 CVE-2016-5282 CVE-2016-5283 CVE-2016-5284 https://www.mozilla.org/security/advisories/mfsa2016-85/ https://www.mozilla.org/security/advisories/mfsa2016-86/ https://www.mozilla.org/security/advisories/mfsa2016-88/ 2016-09-13 2016-09-20 2016-10-21 chromium -- multiple vulnerabilities chromium chromium-npapi chromium-pulse 53.0.2785.113

Google Chrome Releases reports:

Several security fixes in this release, including:

[641101] High CVE-2016-5170: Use after free in Blink.Credit to Anonymous

[643357] High CVE-2016-5171: Use after free in Blink. Credit to Anonymous

[616386] Medium CVE-2016-5172: Arbitrary Memory Read in v8. Credit to Choongwoo Han

[468931] Medium CVE-2016-5173: Extension resource access. Credit to Anonymous

[579934] Medium CVE-2016-5174: Popup not correctly suppressed. Credit to Andrey Kovalev (@L1kvID) Yandex Security Team

[646394] CVE-2016-5175: Various fixes from internal audits, fuzzing and other initiatives.

CVE-2016-5170 CVE-2016-5171 CVE-2016-5172 CVE-2016-5173 CVE-2016-5174 CVE-2016-5175 https://googlechromereleases.blogspot.nl/2016/09/stable-channel-update-for-desktop_13.html 2016-09-13 2016-09-16 Remote-Code-Execution vulnerability in mysql and its variants CVE 2016-6662 mysql57-client mysql57-server 5.7.15

LegalHackers' reports:

RCE Bugs discovered in MySQL and its variants like MariaDB. It works by manupulating my.cnf files and using --malloc-lib. The bug seems fixed in MySQL5.7.15 by Oracle

CVE-2016-6662 http://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.html https://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-15.html 2016-09-12 2016-09-14 dropbear -- multiple vulnerabilities dropbear 2016.74

Matt Johnston reports:

If specific usernames including "%" symbols can be created on a system (validated by getpwnam()) then an attacker could run arbitrary code as root when connecting to Dropbear server. A dbclient user who can control username or host arguments could potentially run arbitrary code as the dbclient user. This could be a problem if scripts or webpages pass untrusted input to the dbclient program.

dropbearconvert import of OpenSSH keys could run arbitrary code as the local dropbearconvert user when parsing malicious key files.

dbclient could run arbitrary code as the local dbclient user if particular -m or -c arguments are provided. This could be an issue where dbclient is used in scripts.

dbclient or dropbear server could expose process memory to the running user if compiled with DEBUG_TRACE and running with -v

"http://www.openwall.com/lists/oss-security/2016/09/15/2" CVE-2016-7406 CVE-2016-7407 CVE-2016-7408 CVE-2016-7409 2016-07-12 2016-09-15 h2o -- fix DoS attack vector h2o 2.0.4

Frederik Deweerdt reported a denial-of-service attack vector due to an unhandled error condition during socket connection.

https://github.com/h2o/h2o/issues/1077 CVE-2016-4864 2016-06-09 2016-09-14 cURL -- Escape and unescape integer overflows curl 7.11.17.50.3

The cURL project reports

The four libcurl functions curl_escape(), curl_easy_escape(), curl_unescape and curl_easy_unescape perform string URL percent escaping and unescaping. They accept custom string length inputs in signed integer arguments.

The provided string length arguments were not properly checked and due to arithmetic in the functions, passing in the length 0xffffffff (2^32-1 or UINT_MAX or even just -1) would end up causing an allocation of zero bytes of heap memory that curl would attempt to write gigabytes of data into.

https://curl.haxx.se/docs/adv_20160914.html CVE-2016-7167 2016-09-14 2016-09-14 chromium -- multiple vulnerabilities chromium chromium-npapi chromium-pulse 53.0.2785.92

Google Chrome Releases reports:

33 security fixes in this release, including:

[628942] High CVE-2016-5147: Universal XSS in Blink. Credit to anonymous

[621362] High CVE-2016-5148: Universal XSS in Blink. Credit to anonymous

[573131] High CVE-2016-5149: Script injection in extensions. Credit to Max Justicz (http://web.mit.edu/maxj/www/)

[637963] High CVE-2016-5150: Use after free in Blink. Credit to anonymous

[634716] High CVE-2016-5151: Use after free in PDFium. Credit to anonymous

[629919] High CVE-2016-5152: Heap overflow in PDFium. Credit to GiWan Go of Stealien

[631052] High CVE-2016-5153: Use after destruction in Blink. Credit to Atte Kettunen of OUSPG

[633002] High CVE-2016-5154: Heap overflow in PDFium. Credit to anonymous

[630662] High CVE-2016-5155: Address bar spoofing. Credit to anonymous

[625404] High CVE-2016-5156: Use after free in event bindings. Credit to jinmo123

[632622] High CVE-2016-5157: Heap overflow in PDFium. Credit to anonymous

[628890] High CVE-2016-5158: Heap overflow in PDFium. Credit to GiWan Go of Stealien

[628304] High CVE-2016-5159: Heap overflow in PDFium. Credit to GiWan Go of Stealien

[622420] Medium CVE-2016-5161: Type confusion in Blink. Credit to 62600BCA031B9EB5CB4A74ADDDD6771E working with Trend Micro's Zero Day Initiative

[589237] Medium CVE-2016-5162: Extensions web accessible resources bypass. Credit to Nicolas Golubovic

[609680] Medium CVE-2016-5163: Address bar spoofing. Credit to Rafay Baloch PTCL Etisalat (http://rafayhackingarticles.net)

[637594] Medium CVE-2016-5164: Universal XSS using DevTools. Credit to anonymous

[618037] Medium CVE-2016-5165: Script injection in DevTools. Credit to Gregory Panakkal

[616429] Medium CVE-2016-5166: SMB Relay Attack via Save Page As. Credit to Gregory Panakkal

[576867] Low CVE-2016-5160: Extensions web accessible resources bypass. Credit to @l33terally, FogMarks.com (@FogMarks)

[642598] CVE-2016-5167: Various fixes from internal audits, fuzzing and other initiatives.

CVE-2016-5147 CVE-2016-5148 CVE-2016-5149 CVE-2016-5150 CVE-2016-5151 CVE-2016-5152 CVE-2016-5153 CVE-2016-5154 CVE-2016-5155 CVE-2016-5156 CVE-2016-5157 CVE-2016-5158 CVE-2016-5159 CVE-2016-5160 CVE-2016-5161 CVE-2016-5162 CVE-2016-5163 CVE-2016-5164 CVE-2016-5165 CVE-2016-5166 CVE-2016-5167 https://googlechromereleases.blogspot.nl/2016/08/stable-channel-update-for-desktop_31.html 2016-08-31 2016-09-13 chromium -- multiple vulnerabilities chromium chromium-npapi chromium-pulse 52.0.2743.116

Google Chrome Releases reports:

10 security fixes in this release, including:

[629542] High CVE-2016-5141 Address bar spoofing. Credit to anonymous

[626948] High CVE-2016-5142 Use-after-free in Blink. Credit to anonymous

[625541] High CVE-2016-5139 Heap overflow in pdfium. Credit to GiWan Go of Stealien

[619405] High CVE-2016-5140 Heap overflow in pdfium. Credit to Ke Liu of Tencent's Xuanwu LAB

[623406] Medium CVE-2016-5145 Same origin bypass for images in Blink. Credit to anonymous

[619414] Medium CVE-2016-5143 Parameter sanitization failure in DevTools. Credit to Gregory Panakkal

[618333] Medium CVE-2016-5144 Parameter sanitization failure in DevTools. Credit to Gregory Panakkal

[633486] CVE-2016-5146: Various fixes from internal audits, fuzzing and other initiatives.

CVE-2016-5139 CVE-2016-5140 CVE-2016-5141 CVE-2016-5142 CVE-2016-5143 CVE-2016-5144 CVE-2016-5145 CVE-2016-5146 https://googlechromereleases.blogspot.nl/2016/08/stable-channel-update-for-desktop.html 2016-08-03 2016-09-13 mysql -- Remote Root Code Execution mariadb55-server 5.5.51 mariadb100-server 10.0.27 mariadb101-server 10.1.17 mysql55-server 5.5.52 mysql56-server 5.6.33 mysql57-server 5.7.15 percona55-server 5.5.51.38.1 percona56-server 5.6.32.78.0 percona57-server 5.7.14.7

Dawid Golunski reports:

An independent research has revealed multiple severe MySQL vulnerabilities. This advisory focuses on a critical vulnerability with a CVEID of CVE-2016-6662 which can allow attackers to (remotely) inject malicious settings into MySQL configuration files (my.cnf) leading to critical consequences.

CVE-2016-6662 http://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.txt https://jira.mariadb.org/browse/MDEV-10465 https://www.percona.com/blog/2016/09/12/percona-server-critical-update-cve-2016-6662/ https://www.percona.com/blog/2016/09/12/database-affected-cve-2016-6662/ https://www.psce.com/blog/2016/09/12/how-to-quickly-patch-mysql-server-against-cve-2016-6662/ 2016-09-12 2016-09-13 wolfssl -- leakage of private key information wolfssl 3.6.8

Florian Weimer of Redhat discovered that an optimization in RSA signature validation can result in disclosure of the server's private key under certain fault conditions.

https://www.wolfssl.com/wolfSSL/Blog/Entries/2015/9/17_Two_Vulnerabilities_Recently_Found%2C_An_Attack_on_RSA_using_CRT_and_DoS_Vulnerability_With_DTLS.html https://securityblog.redhat.com/2015/09/02/factoring-rsa-keys-with-tls-perfect-forward-secrecy/ CVE-2015-7744 2015-09-17 2016-01-05 wolfssl -- DDoS amplification in DTLS wolfssl 3.6.8

Sebastian Ramacher identified an error in wolfSSL's implementation of the server side of the DTLS handshake, which could be abused for DDoS amplification or a DoS on the DTLS server itself.

https://www.wolfssl.com/wolfSSL/Blog/Entries/2015/9/17_Two_Vulnerabilities_Recently_Found%2C_An_Attack_on_RSA_using_CRT_and_DoS_Vulnerability_With_DTLS.html https://github.com/IAIK/wolfSSL-DoS CVE-2015-6925 2015-09-18 2016-01-05 gnutls -- OCSP validation issue gnutls 3.4.15

gnutls.org reports:

Stefan Bühler discovered an issue that affects validation of certificates using OCSP responses, which can falsely report a certificate as valid under certain circumstances.

https://gnutls.org/security.html#GNUTLS-SA-2016-3 2016-09-08 2016-09-09 Mozilla -- multiple vulnerabilities firefox 48.0,1 seamonkey linux-seamonkey 2.45 firefox-esr 45.3.0,1 linux-firefox 45.3.0,2 libxul thunderbird linux-thunderbird 45.3.0

Mozilla Foundation reports:

MFSA2016-84 Information disclosure through Resource Timing API \ during page navigation

MFSA2016-83 Spoofing attack through text injection into \ internal error pages

MFSA2016-82 Addressbar spoofing with right-to-left characters \ on Firefox for Android

MFSA2016-81 Information disclosure and local file \ manipulation through drag and drop

MFSA2016-80 Same-origin policy violation using local HTML file and saved shortcut file

MFSA2016-79 Use-after-free when applying SVG effects

MFSA2016-78 Type confusion in display transformation

MFSA2016-77 Buffer overflow in ClearKey Content Decryption Module (CDM) during video playback

MFSA2016-76 Scripts on marquee tag can execute in sandboxed iframes

MFSA2016-75 Integer overflow in WebSockets during data \ buffering

MFSA2016-74 Form input type change from password to text \ can store plain text password in session restore file

MFSA2016-73 Use-after-free in service workers with nested sync events

MFSA2016-72 Use-after-free in DTLS during WebRTC session shutdown

MFSA2016-71 Crash in incremental garbage collection in \ JavaScript

MFSA2016-70 Use-after-free when using alt key and toplevel menus

MFSA2016-69 Arbitrary file manipulation by local user through \ Mozilla updater and callback application path parameter

MFSA2016-68 Out-of-bounds read during XML parsing in \ Expat library

MFSA2016-67 Stack underflow during 2D graphics rendering

MFSA2016-66 Location bar spoofing via data URLs with \ malformed/invalid mediatypes

MFSA2016-65 Cairo rendering crash due to memory allocation issue with FFmpeg 0.10

MFSA2016-64 Buffer overflow rendering SVG with bidirectional content

MFSA2016-63 Favicon network connection can persist when page is closed

MFSA2016-62 Miscellaneous memory safety hazards (rv:48.0 / rv:45.3)

CVE-2016-0718 CVE-2016-2830 CVE-2016-2835 CVE-2016-2836 CVE-2016-2837 CVE-2016-2838 CVE-2016-2839 CVE-2016-5250 CVE-2016-5251 CVE-2016-5252 CVE-2016-5253 CVE-2016-5254 CVE-2016-5255 CVE-2016-5258 CVE-2016-5259 CVE-2016-5260 CVE-2016-5261 CVE-2016-5262 CVE-2016-5263 CVE-2016-5264 CVE-2016-5265 CVE-2016-5266 CVE-2016-5267 CVE-2016-5268 https://www.mozilla.org/en-US/security/advisories/mfsa2016-62/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-63/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-64/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-65/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-66/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-67/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-68/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-69/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-70/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-71/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-72/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-73/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-74/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-75/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-76/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-77/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-78/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-79/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-80/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-81/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-82/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-83/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-84/ 2016-08-02 2016-09-07 2016-09-20 asterisk -- RTP Resource Exhaustion asterisk11 11.23.1 asterisk13 13.11.1

The Asterisk project reports:

The overlap dialing feature in chan_sip allows chan_sip to report to a device that the number that has been dialed is incomplete and more digits are required. If this functionality is used with a device that has performed username/password authentication RTP resources are leaked. This occurs because the code fails to release the old RTP resources before allocating new ones in this scenario. If all resources are used then RTP port exhaustion will occur and no RTP sessions are able to be set up.

If overlap dialing support is not needed the "allowoverlap" option can be set to no. This will stop any usage of the scenario which causes the resource exhaustion.

http://downloads.asterisk.org/pub/security/AST-2016-007.html 2016-08-05 2016-09-08 asterisk -- Crash on ACK from unknown endpoint asterisk13 13.10.013.11.1

The Asterisk project reports:

Asterisk can be crashed remotely by sending an ACK to it from an endpoint username that Asterisk does not recognize. Most SIP request types result in an "artificial" endpoint being looked up, but ACKs bypass this lookup. The resulting NULL pointer results in a crash when attempting to determine if ACLs should be applied.

This issue was introduced in the Asterisk 13.10 release and only affects that release.

This issue only affects users using the PJSIP stack with Asterisk. Those users that use chan_sip are unaffected.

http://downloads.asterisk.org/pub/security/AST-2016-006.html 2016-08-03 2016-09-08 inspircd -- authentication bypass vulnerability inspircd 2.0.23

Adam reports:

A serious vulnerability exists in when using m_sasl in combination with any services that support SASL EXTERNAL. To be vulnerable you must have m_sasl loaded, and have services which support SASL EXTERNAL authentication.

http://www.inspircd.org/2016/09/03/v2023-released.html 2016-09-03 2016-09-06 mailman -- CSRF hardening in parts of the web interface mailman 2.1.15

The late Tokio Kikuchi reported:

We may have to set lifetime for input forms because of recent activities on cross-site request forgery (CSRF). The form lifetime is successfully deployed in frameworks like web.py or plone etc. Proposed branch lp:~tkikuchi/mailman/form-lifetime implement lifetime in admin, admindb, options and edithtml interfaces. [...]

The web admin interface has been hardened against CSRF attacks by adding a hidden, encrypted token with a time stamp to form submissions and not accepting authentication by cookie if the token is missing, invalid or older than the new mm_cfg.py setting FORM_LIFETIME which defaults to one hour. Posthumous thanks go to Tokio Kikuchi for this implementation [...].

https://bugs.launchpad.net/mailman/+bug/775294 https://launchpad.net/mailman/2.1/2.1.15 CVE-2016-7123 2011-05-02 2016-09-06 openssh -- sshd -- remote valid user discovery and PAM /bin/login attack openssh-portable 7.3.p1,1

The OpenSSH project reports:

* sshd(8): Mitigate timing differences in password authentication that could be used to discern valid from invalid account names when long passwords were sent and particular password hashing algorithms are in use on the server. CVE-2016-6210, reported by EddieEzra.Harari at verint.com

* sshd(8): (portable only) Ignore PAM environment vars when UseLogin=yes. If PAM is configured to read user-specified environment variables and UseLogin=yes in sshd_config, then a hostile local user may attack /bin/login via LD_PRELOAD or similar environment variables set via PAM. CVE-2015-8325, found by Shayan Sadigh.

http://www.openssh.com/txt/release-7.3 CVE-2016-6210 CVE-2015-8325 2016-08-01 2016-09-01 mailman -- CSRF protection enhancements mailman 2.1.23

Mark Sapiro reports:

CSRF protection has been extended to the user options page. This was actually fixed by Tokio Kikuchi as part of the fix for LP: #775294 and intended for Mailman 2.1.15, but that fix wasn't completely merged at the time. The full fix also addresses the admindb, and edithtml pages as well as the user options page and the previously fixed admin pages. Thanks to Nishant Agarwala for reporting the issue.

http://bazaar.launchpad.net/~mailman-coders/mailman/2.1/revision/1668 https://mail.python.org/pipermail/mailman-announce/2016-August/000226.html CVE-2016-6893 2016-08-19 2016-08-29 libxml2 -- multiple vulnabilities libxml2 2.9.4

Daniel Veillard reports:

More format string warnings with possible format string vulnerability (David Kilzer)

Avoid building recursive entities (Daniel Veillard)

Heap-based buffer overread in htmlCurrentChar (Pranjal Jumde)

Heap-based buffer-underreads due to xmlParseName (David Kilzer)

Heap use-after-free in xmlSAX2AttributeNs (Pranjal Jumde)

Heap use-after-free in htmlParsePubidLiteral and htmlParseSystemiteral (Pranjal Jumde)

Fix some format string warnings with possible format string vulnerability (David Kilzer)

Detect change of encoding when parsing HTML names (Hugh Davenport)

Fix inappropriate fetch of entities content (Daniel Veillard)

Bug 759398: Heap use-after-free in xmlDictComputeFastKey (Pranjal Jumde)

Bug 758605: Heap-based buffer overread in xmlDictAddString (Pranjal Jumde)

Bug 758588: Heap-based buffer overread in xmlParserPrintFileContextInternal (David Kilzer)

Bug 757711: heap-buffer-overflow in xmlFAParsePosCharGroup (Pranjal Jumde)

Add missing increments of recursion depth counter to XML parser. (Peter Simons)

Fix NULL pointer deref in XPointer range-to

https://mail.gnome.org/archives/xml/2016-May/msg00023.html https://bugzilla.gnome.org/show_bug.cgi?id=759398 https://bugzilla.gnome.org/show_bug.cgi?id=758605 https://bugzilla.gnome.org/show_bug.cgi?id=758588 https://bugzilla.gnome.org/show_bug.cgi?id=757711 https://git.gnome.org/browse/libxml2/patch/?id=d8083bf77955b7879c1290f0c0a24ab8cc70f7fb CVE-2016-1762 CVE-2016-1833 CVE-2016-1834 CVE-2016-1835 CVE-2016-1836 CVE-2016-1837 CVE-2016-1838 CVE-2016-1839 CVE-2016-1840 CVE-2016-3627 CVE-2016-3705 CVE-2016-4449 CVE-2016-4483 2016-05-23 2016-08-28 kdelibs -- directory traversal vulnerability kdelibs 4.14.10_7

David Faure reports:

A maliciously crafted archive (.zip or .tar.bz2) with "../" in the file paths could be offered for download via the KNewStuff framework (e.g. on www.kde-look.org), and upon extraction would install files anywhere in the user's home directory.

CVE-2016-6232 https://www.kde.org/info/security/advisory-20160724-1.txt 2016-07-24 2016-08-27 eog -- out-of-bounds write eog 3.18.3

Felix Riemann reports:

CVE-2016-6855 out-of-bounds write in eog 3.10.2.

https://mail.gnome.org/archives/ftp-release-list/2016-August/msg00123.html CVE-2016-6855 2016-08-21 2016-08-22 fontconfig -- insufficiently cache file validation fontconfig 1.12.1

Debian security team reports:

Tobias Stoeckmann discovered that cache files are insufficiently validated in fontconfig, a generic font configuration library. An attacker can trigger arbitrary free() calls, which in turn allows double free attacks and therefore arbitrary code execution. In combination with setuid binaries using crafted cache files, this could allow privilege escalation.

https://packetstormsecurity.com/files/138236/Debian-Security-Advisory-3644-1.html CVE-2016-5384 2016-08-05 2016-08-21 End of Life Ports python32 python31 python30 python26 python25 python24 python23 python22 python21 python20 python15 0 php54 php53 php52 php5 php4 0 perl5 5.18 perl5.16 perl5.14 perl5.12 perl 0 ruby ruby_static 2.1,1 unifi2 unifi3 0 apache21 apache20 apache13 0 tomcat55 tomcat41 0 mysql51-client mysql51-server mysql50-client mysql50-server mysql41-client mysql41-server mysql40-client mysql40-server 0 postgresql90-client postgresql90-server postgresql84-client postgresql84-server postgresql83-client postgresql83-server postgresql82-client postgresql82-server postgresql81-client postgresql81-server postgresql80-client postgresql80-server postgresql74-client postgresql74-server postgresql73-client postgresql73-server postgresql72-client postgresql72-server postgresql71-client postgresql71-server postgresql7-client postgresql7-server 0

ports/211975 2016-08-18 2016-08-18 2016-10-18 gnupg -- attacker who obtains 4640 bits from the RNG can trivially predict the next 160 bits of output gnupg1 1.4.21 libgcrypt 1.7.3 linux-c6-libgcrypt 1.4.5_4 linux-c7-libgcrypt 1.5.3_1

Werner Koch reports:

There was a bug in the mixing functions of Libgcrypt's random number generator: An attacker who obtains 4640 bits from the RNG can trivially predict the next 160 bits of output. This bug exists since 1998 in all GnuPG and Libgcrypt versions.

https://lists.gnupg.org/pipermail/gnupg-announce/2016q3/000395.html CVE-2016-6313 2016-08-17 2016-08-18 2016-11-30 phpmyadmin -- multiple vulnerabilities phpmyadmin 4.6.04.6.4

The phpmyadmin development team reports:

Summary

Weakness with cookie encryption

Description

A pair of vulnerabilities were found affecting the way cookies are stored.

The decryption of the username/password is vulnerable to a padding oracle attack. The can allow an attacker who has access to a user's browser cookie file to decrypt the username and password.

A vulnerability was found where the same initialization vector (IV) is used to hash the username and password stored in the phpMyAdmin cookie. If a user has the same password as their username, an attacker who examines the browser cookie can see that they are the but the attacker can not directly decode these values from the cookie as it is still hashed.

Severity

We consider this to be critical.

Summary

Multiple XSS vulnerabilities

Description

Multiple vulnerabilities have been discovered in the following areas of phpMyAdmin:

Zoom search: Specially crafted column content can be used to trigger an XSS attack

GIS editor: Certain fields in the graphical GIS editor at not properly escaped and can be used to trigger an XSS attack

Relation view

The following Transformations:

Formatted

Imagelink

JPEG: Upload

RegexValidation

JPEG inline

PNG inline

transformation wrapper

XML export

MediaWiki export

Designer

When the MySQL server is running with a specially-crafted log_bin directive

Database tab

Replication feature

Database search

Severity

We consider these vulnerabilities to be of moderate severity.

Summary

Multiple XSS vulnerabilities

Description

XSS vulnerabilities were discovered in:

The database privilege check

The "Remove partitioning" functionality

Specially crafted database names can trigger the XSS attack.

Severity

We consider these vulnerabilities to be of moderate severity.

Summary

PHP code injection

Description

A vulnerability was found where a specially crafted database name could be used to run arbitrary PHP commands through the array export feature

Severity

We consider these vulnerabilities to be of moderate severity.

Summary

Full path disclosure

Description

A full path disclosure vulnerability was discovered where a user can trigger a particular error in the export mechanism to discover the full path of phpMyAdmin on the disk.

Severity

We consider this vulnerability to be non-critical.

Summary

SQL injection attack

Description

A vulnerability was reported where a specially crafted database and/or table name can be used to trigger an SQL injection attack through the export functionality.

Severity

We consider this vulnerability to be serious

Summary

Local file exposure

Description

A vulnerability was discovered where a user can exploit the LOAD LOCAL INFILE functionality to expose files on the server to the database system.

Severity

We consider this vulnerability to be serious.

Summary

Local file exposure through symlinks with UploadDir

Description

A vulnerability was found where a user can specially craft a symlink on disk, to a file which phpMyAdmin is permitted to read but the user is not, which phpMyAdmin will then expose to the user.

Severity

We consider this vulnerability to be serious, however due to the mitigation factors the default state is not vulnerable.

Mitigation factor

1) The installation must be run with UploadDir configured (not the default) 2) The user must be able to create a symlink in the UploadDir 3) The user running the phpMyAdmin application must be able to read the file

Summary

Path traversal with SaveDir and UploadDir

Description

A vulnerability was reported with the %u username replacement functionality of the SaveDir and UploadDir features. When the username substitution is configured, a specially-crafted user name can be used to circumvent restrictions to traverse the file system.

Severity

We consider this vulnerability to be serious, however due to the mitigation factors the default state is not vulnerable.

Mitigation factor

1) A system must be configured with the %u username replacement, such as `$cfg['SaveDir'] = 'SaveDir_%u';` 2) The user must be able to create a specially-crafted MySQL user, including the `/.` sequence of characters, such as `/../../`

Summary

Multiple XSS vulnerabilities

Description

Multiple XSS vulnerabilities were found in the following areas:

Navigation pane and database/table hiding feature. A specially-crafted database name can be used to trigger an XSS attack.

The "Tracking" feature. A specially-crafted query can be used to trigger an XSS attack.

GIS visualization feature.

Severity

We consider this vulnerability to be non-critical.

Summary

SQL injection attack

Description

A vulnerability was discovered in the following features where a user can execute an SQL injection attack against the account of the control user: User group Designer

Severity

We consider this vulnerability to be serious.

Mitigation factor

The server must have a control user account created in MySQL and configured in phpMyAdmin; installations without a control user are not vulnerable.

Summary

SQL injection attack

Description

A vulnerability was reported where a specially crafted database and/or table name can be used to trigger an SQL injection attack through the export functionality.

Severity

We consider this vulnerability to be serious

Summary

Denial of service (DOS) attack in transformation feature

Description

A vulnerability was found in the transformation feature allowing a user to trigger a denial-of-service (DOS) attack against the server.

Severity

We consider this vulnerability to be non-critical

Summary

SQL injection attack as control user

Description

A vulnerability was discovered in the user interface preference feature where a user can execute an SQL injection attack against the account of the control user.

Severity

We consider this vulnerability to be serious.

Mitigation factor

The server must have a control user account created in MySQL and configured in phpMyAdmin; installations without a control user are not vulnerable.

Summary

Unvalidated data passed to unserialize()

Description

A vulnerability was reported where some data is passed to the PHP unserialize() function without verification that it's valid serialized data.

Due to how the PHP function operates,

Unserialization can result in code being loaded and executed due to object instantiation and autoloading, and a malicious user may be able to exploit this.

Therefore, a malicious user may be able to manipulate the stored data in a way to exploit this weakness.

Severity

We consider this vulnerability to be moderately severe.

Summary

DOS attack with forced persistent connections

Description

A vulnerability was discovered where an unauthenticated user is able to execute a denial-of-service (DOS) attack by forcing persistent connections when phpMyAdmin is running with $cfg['AllowArbitraryServer']=true;.

Severity

We consider this vulnerability to be critical, although note that phpMyAdmin is not vulnerable by default.

Summary

Denial of service (DOS) attack by for loops

Description

A vulnerability has been reported where a malicious authorized user can cause a denial-of-service (DOS) attack on a server by passing large values to a loop.

Severity

We consider this issue to be of moderate severity.

Summary

IPv6 and proxy server IP-based authentication rule circumvention

Description

A vulnerability was discovered where, under certain circumstances, it may be possible to circumvent the phpMyAdmin IP-based authentication rules.

When phpMyAdmin is used with IPv6 in a proxy server environment, and the proxy server is in the allowed range but the attacking computer is not allowed, this vulnerability can allow the attacking computer to connect despite the IP rules.

Severity

We consider this vulnerability to be serious

Mitigation factor

* The phpMyAdmin installation must be running with IP-based allow/deny rules * The phpMyAdmin installation must be running behind a proxy server (or proxy servers) where the proxy server is "allowed" and the attacker is "denied" * The connection between the proxy server and phpMyAdmin must be via IPv6

Summary

Detect if user is logged in

Description

A vulnerability was reported where an attacker can determine whether a user is logged in to phpMyAdmin.

The user's session, username, and password are not compromised by this vulnerability.

Severity

We consider this vulnerability to be non-critical.

Summary

Bypass URL redirect protection

Description

A vulnerability was discovered where an attacker could redirect a user to a malicious web page.

Severity

We consider this to be of moderate severity

Summary

Referrer leak in url.php

Description

A vulnerability was discovered where an attacker can determine the phpMyAdmin host location through the file url.php.

Severity

We consider this to be of moderate severity.

Summary

Reflected File Download attack

Description

A vulnerability was discovered where an attacker may be able to trigger a user to download a specially crafted malicious SVG file.

Severity

We consider this issue to be of moderate severity.

Summary

ArbitraryServerRegexp bypass

Description

A vulnerability was reported with the $cfg['ArbitraryServerRegexp'] configuration directive. An attacker could reuse certain cookie values in a way of bypassing the servers defined by ArbitraryServerRegexp.

Severity

We consider this vulnerability to be critical.

Mitigation factor

Only servers using `$cfg['ArbitraryServerRegexp']` are vulnerable to this attack.

Summary

Denial of service (DOS) attack by changing password to a very long string

Description

An authenticated user can trigger a denial-of-service (DOS) attack by entering a very long password at the change password dialog.

Severity

We consider this vulnerability to be serious.

Summary

Remote code execution vulnerability when run as CGI

Description

A vulnerability was discovered where a user can execute a remote code execution attack against a server when phpMyAdmin is being run as a CGI application. Under certain server configurations, a user can pass a query string which is executed as a command-line argument by the file generator_plugin.sh.

Severity

We consider this vulnerability to be critical.

Mitigation factor

The file `/libraries/plugins/transformations/generator_plugin.sh` may be removed. Under certain server configurations, it may be sufficient to remove execute permissions for this file.

Summary

Denial of service (DOS) attack with dbase extension

Description

A flaw was discovered where, under certain conditions, phpMyAdmin may not delete temporary files during the import of ESRI files.

Severity

We consider this vulnerability to be non-critical.

Mitigation factor

This vulnerability only exists when PHP is running with the dbase extension, which is not shipped by default, not available in most Linux distributions, and doesn't compile with PHP7.

Summary

Remote code execution vulnerability when PHP is running with dbase extension

Description

A vulnerability was discovered where phpMyAdmin can be used to trigger a remote code execution attack against certain PHP installations.

Severity

We consider this vulnerability to be critical.

Mitigation factor

This vulnerability only exists when PHP is running with the dbase extension, which is not shipped by default, not available in most Linux distributions, and doesn't compile with PHP7.

https://www.phpmyadmin.net/security/PMASA-2016-29/ https://www.phpmyadmin.net/security/PMASA-2016-30/ https://www.phpmyadmin.net/security/PMASA-2016-31/ https://www.phpmyadmin.net/security/PMASA-2016-32/ https://www.phpmyadmin.net/security/PMASA-2016-33/ https://www.phpmyadmin.net/security/PMASA-2016-34/ https://www.phpmyadmin.net/security/PMASA-2016-35/ https://www.phpmyadmin.net/security/PMASA-2016-36/ https://www.phpmyadmin.net/security/PMASA-2016-37/ https://www.phpmyadmin.net/security/PMASA-2016-38/ https://www.phpmyadmin.net/security/PMASA-2016-39/ https://www.phpmyadmin.net/security/PMASA-2016-40/ https://www.phpmyadmin.net/security/PMASA-2016-41/ https://www.phpmyadmin.net/security/PMASA-2016-42/ https://www.phpmyadmin.net/security/PMASA-2016-43/ https://www.phpmyadmin.net/security/PMASA-2016-45/ https://www.phpmyadmin.net/security/PMASA-2016-46/ https://www.phpmyadmin.net/security/PMASA-2016-47/ https://www.phpmyadmin.net/security/PMASA-2016-48/ https://www.phpmyadmin.net/security/PMASA-2016-49/ https://www.phpmyadmin.net/security/PMASA-2016-50/ https://www.phpmyadmin.net/security/PMASA-2016-51/ https://www.phpmyadmin.net/security/PMASA-2016-52/ https://www.phpmyadmin.net/security/PMASA-2016-53/ https://www.phpmyadmin.net/security/PMASA-2016-54/ https://www.phpmyadmin.net/security/PMASA-2016-55/ https://www.phpmyadmin.net/security/PMASA-2016-56/ CVE-2016-6606 CVE-2016-6607 CVE-2016-6608 CVE-2016-6609 CVE-2016-6610 CVE-2016-6611 CVE-2016-6612 CVE-2016-6613 CVE-2016-6614 CVE-2016-6615 CVE-2016-6616 CVE-2016-6617 CVE-2016-6618 CVE-2016-6619 CVE-2016-6620 CVE-2016-6622 CVE-2016-6623 CVE-2016-6624 CVE-2016-6625 CVE-2016-6626 CVE-2016-6627 CVE-2016-6628 CVE-2016-6629 CVE-2016-6630 CVE-2016-6631 CVE-2016-6632 CVE-2016-6633 2016-08-17 2016-08-17 TeamSpeak Server 3 -- Multiple vulnerabilities including Remote Code Execution teamspeak3-server 3.0.13_1,1

Hanz Jenson audit report:

I found 10 vulnerabilities. Some of these are critical and allow remote code execution. For the average user, that means that these vulnerabilities can be exploited by a malicious attacker in order to take over any Teamspeak server, not only becoming serveradmin, but getting a shell on the affected machine.

http://seclists.org/fulldisclosure/2016/Aug/61 2016-08-12 2016-08-14 puppet-agent MCollective plugin -- Remote Code Execution vulnerability mcollective-puppet-agent 1.11.1

Puppet reports:

Puppet Enterprise previously included a puppet-agent MCollective plugin that allowed you to pass the `--server` argument to MCollective. This insecure argument enabled remote code execution via connection to an untrusted host. The puppet-agent MCollective version included in PE 2016.2.1, this option is disabled by default.

https://puppet.com/security/cve/cve-2015-7331 CVE-2015-7331 2016-08-09 2016-08-15 FreeBSD -- Heap vulnerability in bspatch FreeBSD 10.310.3_6 10.210.2_20 10.110.1_37 9.39.3_45

Problem Description:

The implementation of bspatch does not check for a negative value on numbers of bytes read from the diff and extra streams, allowing an attacker who can control the patch file to write at arbitrary locations in the heap.

This issue was first discovered by The Chromium Project and reported independently by Lu Tung-Pin to the FreeBSD project.

Impact:

An attacker who can control the patch file can cause a crash or run arbitrary code under the credentials of the user who runs bspatch, in many cases, root.

CVE-2014-9862 SA-16:25.bspatch 2016-07-25 2016-08-11 FreeBSD -- Multiple ntp vulnerabilities FreeBSD 10.310.3_5 10.210.2_19 10.110.1_36 9.39.3_44

Problem Description:

Multiple vulnerabilities have been discovered in the NTP suite:

The fix for Sec 3007 in ntp-4.2.8p7 contained a bug that could cause ntpd to crash. [CVE-2016-4957, Reported by Nicolas Edet of Cisco]

An attacker who knows the origin timestamp and can send a spoofed packet containing a CRYPTO-NAK to an ephemeral peer target before any other response is sent can demobilize that association. [CVE-2016-4953, Reported by Miroslav Lichvar of Red Hat]

An attacker who is able to spoof packets with correct origin timestamps from enough servers before the expected response packets arrive at the target machine can affect some peer variables and, for example, cause a false leap indication to be set. [CVE-2016-4954, Reported by Jakub Prokes of Red Hat]

An attacker who is able to spoof a packet with a correct origin timestamp before the expected response packet arrives at the target machine can send a CRYPTO_NAK or a bad MAC and cause the association's peer variables to be cleared. If this can be done often enough, it will prevent that association from working. [CVE-2016-4955, Reported by Miroslav Lichvar of Red Hat]

The fix for NtpBug2978 does not cover broadcast associations, so broadcast clients can be triggered to flip into interleave mode. [CVE-2016-4956, Reported by Miroslav Lichvar of Red Hat.]

Impact:

Malicious remote attackers may be able to break time synchronization, or cause the ntpd(8) daemon to crash.

CVE-2016-4953 CVE-2016-4954 CVE-2016-4955 CVE-2016-4956 CVE-2016-4957 SA-16:24.ntp 2016-06-04 2016-08-11 FreeBSD -- Kernel stack disclosure in 4.3BSD compatibility layer FreeBSD-kernel 10.310.3_4 10.210.2_18 10.110.1_35 9.39.3_43

Problem Description:

The implementation of historic stat(2) system call does not clear the output struct before copying it out to userland.

Impact:

An unprivileged user can read a portion of uninitialised kernel stack data, which may contain sensitive information, such as the stack guard, portions of the file cache or terminal buffers, which an attacker might leverage to obtain elevated privileges.

SA-16:21.43bsd 2016-05-31 2016-08-11 FreeBSD -- Kernel stack disclosure in Linux compatibility layer FreeBSD-kernel 10.310.3_4 10.210.2_18 10.110.1_35 9.39.3_43

Problem Description:

The implementation of the TIOCGSERIAL ioctl(2) does not clear the output struct before copying it out to userland.

The implementation of the Linux sysinfo() system call does not clear the output struct before copying it out to userland.

Impact:

SA-16:20.linux 2016-05-31 2016-08-11 FreeBSD -- Incorrect argument handling in sendmsg(2) FreeBSD-kernel 10.310.3_3 10.210.2_17 10.110.1_34

Problem Description:

Incorrect argument handling in the socket code allows malicious local user to overwrite large portion of the kernel memory.

Impact:

Malicious local user may crash kernel or execute arbitrary code in the kernel, potentially gaining superuser privileges.

CVE-2016-1887 SA-16:19.sendmsg 2016-05-17 2016-08-11 FreeBSD -- Buffer overflow in keyboard driver FreeBSD-kernel 10.310.3_3 10.210.2_17 10.110.1_34 9.39.3_42

Problem Description:

Incorrect signedness comparison in the ioctl(2) handler allows a malicious local user to overwrite a portion of the kernel memory.

Impact:

A local user may crash the kernel, read a portion of kernel memory and execute arbitrary code in kernel context. The result of executing an arbitrary kernel code is privilege escalation.

CVE-2016-1886 SA-16:18.atkbd 2016-05-17 2016-08-11 FreeBSD -- Incorrect argument validation in sysarch(2) FreeBSD-kernel 11.011.0_2 10.310.3_11 10.210.2_24 10.110.1_41 9.39.3_49

Problem Description:

A special combination of sysarch(2) arguments, specify a request to uninstall a set of descriptors from the LDT. The start descriptor is cleared and the number of descriptors are provided. Due to lack of sufficient bounds checking during argument validity verification, unbound zero'ing of the process LDT and adjacent memory can be initiated from usermode.

Impact:

This vulnerability could cause the kernel to panic. In addition it is possible to perform a local Denial of Service against the system by unprivileged processes.

CVE-2016-1885 SA-16:15.sysarch 2016-03-16 2016-08-11 2016-10-25 FreeBSD -- Multiple OpenSSL vulnerabilities FreeBSD 10.210.2_13 10.110.1_30 9.39.3_38

Problem Description:

A cross-protocol attack was discovered that could lead to decryption of TLS sessions by using a server supporting SSLv2 and EXPORT cipher suites as a Bleichenbacher RSA padding oracle. Note that traffic between clients and non-vulnerable servers can be decrypted provided another server supporting SSLv2 and EXPORT ciphers (even with a different protocol such as SMTP, IMAP or POP3) shares the RSA keys of the non-vulnerable server. This vulnerability is known as DROWN. [CVE-2016-0800]

A double free bug was discovered when OpenSSL parses malformed DSA private keys and could lead to a DoS attack or memory corruption for applications that receive DSA private keys from untrusted sources. This scenario is considered rare. [CVE-2016-0705]

The SRP user database lookup method SRP_VBASE_get_by_user had confusing memory management semantics; the returned pointer was sometimes newly allocated, and sometimes owned by the callee. The calling code has no way of distinguishing these two cases. [CVE-2016-0798]

In the BN_hex2bn function, the number of hex digits is calculated using an int value |i|. Later |bn_expand| is called with a value of |i * 4|. For large values of |i| this can result in |bn_expand| not allocating any memory because |i * 4| is negative. This can leave the internal BIGNUM data field as NULL leading to a subsequent NULL pointer dereference. For very large values of |i|, the calculation |i * 4| could be a positive value smaller than |i|. In this case memory is allocated to the internal BIGNUM data field, but it is insufficiently sized leading to heap corruption. A similar issue exists in BN_dec2bn. This could have security consequences if BN_hex2bn/BN_dec2bn is ever called by user applications with very large untrusted hex/dec data. This is anticipated to be a rare occurrence. [CVE-2016-0797]

The internal |fmtstr| function used in processing a "%s" formatted string in the BIO_*printf functions could overflow while calculating the length of a string and cause an out-of-bounds read when printing very long strings. [CVE-2016-0799]

A side-channel attack was found which makes use of cache-bank conflicts on the Intel Sandy-Bridge microarchitecture which could lead to the recovery of RSA keys. [CVE-2016-0702]

s2_srvr.c did not enforce that clear-key-length is 0 for non-export ciphers. If clear-key bytes are present for these ciphers, they displace encrypted-key bytes. [CVE-2016-0703]

s2_srvr.c overwrites the wrong bytes in the master key when applying Bleichenbacher protection for export cipher suites. [CVE-2016-0704]

Impact:

Servers that have SSLv2 protocol enabled are vulnerable to the "DROWN" attack which allows a remote attacker to fast attack many recorded TLS connections made to the server, even when the client did not make any SSLv2 connections themselves.

An attacker who can supply malformed DSA private keys to OpenSSL applications may be able to cause memory corruption which would lead to a Denial of Service condition. [CVE-2016-0705]

An attacker connecting with an invalid username can cause memory leak, which could eventually lead to a Denial of Service condition. [CVE-2016-0798]

An attacker who can inject malformed data into an application may be able to cause memory corruption which would lead to a Denial of Service condition. [CVE-2016-0797, CVE-2016-0799]

A local attacker who has control of code in a thread running on the same hyper-threaded core as the victim thread which is performing decryptions could recover RSA keys. [CVE-2016-0702]

An eavesdropper who can intercept SSLv2 handshake can conduct an efficient divide-and-conquer key recovery attack and use the server as an oracle to determine the SSLv2 master-key, using only 16 connections to the server and negligible computation. [CVE-2016-0703]

An attacker can use the Bleichenbacher oracle, which enables more efficient variant of the DROWN attack. [CVE-2016-0704]

CVE-2016-0702 CVE-2016-0703 CVE-2016-0704 CVE-2016-0705 CVE-2016-0797 CVE-2016-0798 CVE-2016-0799 CVE-2016-0800 SA-16:12.openssl 2016-03-10 2016-08-11 FreeBSD -- Linux compatibility layer issetugid(2) system call FreeBSD-kernel 10.210.2_11 10.110.1_28 9.39.3_35

Problem Description:

A programming error in the Linux compatibility layer could cause the issetugid(2) system call to return incorrect information.

Impact:

If an application relies on output of the issetugid(2) system call and that information is incorrect, this could lead to a privilege escalation.

CVE-2016-1883 SA-16:10.linux 2016-01-27 2016-08-11 FreeBSD -- Insecure default snmpd.config permissions FreeBSD 10.210.2_9 10.110.1_26 9.39.3_33

Problem Description:

The SNMP protocol supports an authentication model called USM, which relies on a shared secret. The default permission of the snmpd.configiguration file, /etc/snmpd.config, is weak and does not provide adequate protection against local unprivileged users.

Impact:

A local user may be able to read the shared secret, if configured and used by the system administrator.

CVE-2015-5677 SA-16:06.bsnmpd 2016-01-14 2016-08-11 FreeBSD -- TCP MD5 signature denial of service FreeBSD-kernel 10.210.2_9 10.110.1_26 9.39.3_33

Problem Description:

A programming error in processing a TCP connection with both TCP_MD5SIG and TCP_NOOPT socket options may lead to kernel crash.

Impact:

A local attacker can crash the kernel, resulting in a denial-of-service.

A remote attack is theoretically possible, if server has a listening socket with TCP_NOOPT set, and server is either out of SYN cache entries, or SYN cache is disabled by configuration.

CVE-2016-1882 SA-16:05.tcp 2016-01-14 2016-08-11 FreeBSD -- Linux compatibility layer setgroups(2) system call FreeBSD-kernel 10.210.2_9 10.110.1_26 9.39.3_33

Problem Description:

A programming error in the Linux compatibility layer setgroups(2) system call can lead to an unexpected results, such as overwriting random kernel memory contents.

Impact:

It is possible for a local attacker to overwrite portions of kernel memory, which may result in a privilege escalation or cause a system panic.

CVE-2016-1881 SA-16:04.linux 2016-01-14 2016-08-11 FreeBSD -- Linux compatibility layer incorrect futex handling FreeBSD-kernel 10.210.2_9 10.110.1_26 9.39.3_33

Problem Description:

A programming error in the handling of Linux futex robust lists may result in incorrect memory locations being accessed.

Impact:

It is possible for a local attacker to read portions of kernel memory, which may result in a privilege escalation.

CVE-2016-1880 SA-16:03.linux 2016-01-14 2016-08-11 FreeBSD -- SCTP ICMPv6 error message vulnerability FreeBSD-kernel 10.210.2_9 10.110.1_26 9.39.3_33

Problem Description:

A lack of proper input checks in the ICMPv6 processing in the SCTP stack can lead to either a failed kernel assertion or to a NULL pointer dereference. In either case, a kernel panic will follow.

Impact:

A remote, unauthenticated attacker can reliably trigger a kernel panic in a vulnerable system running IPv6. Any kernel compiled with both IPv6 and SCTP support is vulnerable. There is no requirement to have an SCTP socket open.

IPv4 ICMP processing is not impacted by this vulnerability.

CVE-2016-1879 SA-16:01.sctp 2016-01-14 2016-08-11 FreeBSD -- rpcbind(8) remote denial of service [REVISED] FreeBSD 10.210.2_5 10.110.1_22 9.39.3_28

Problem Description:

In rpcbind(8), netbuf structures are copied directly, which would result in two netbuf structures that reference to one shared address buffer. When one of the two netbuf structures is freed, access to the other netbuf structure would result in an undefined result that may crash the rpcbind(8) daemon.

Impact:

A remote attacker who can send specifically crafted packets to the rpcbind(8) daemon can cause it to crash, resulting in a denial of service condition.

CVE-2015-7236 SA-15:24.rpcbind 2015-09-29 2016-08-11 FreeBSD -- Local privilege escalation in IRET handler FreeBSD-kernel 10.110.1_19 9.39.3_24

Problem Description:

If the kernel-mode IRET instruction generates an #SS or #NP exception, but the exception handler does not properly ensure that the right GS register base for kernel is reloaded, the userland GS segment may be used in the context of the kernel exception handler.

Impact:

By causing an IRET with #SS or #NP exceptions, a local attacker can cause the kernel to use an arbitrary GS base, which may allow escalated privileges or panic the system.

CVE-2015-5675 SA-15:21.amd64 2015-08-25 2016-08-11 FreeBSD -- Multiple integer overflows in expat (libbsdxml) XML parser FreeBSD 10.110.1_18 10.210.2_1 9.39.3_23

Problem Description:

Multiple integer overflows have been discovered in the XML_GetBuffer() function in the expat library.

Impact:

The integer overflows may be exploited by using specifically crafted XML data and lead to infinite loop, or a heap buffer overflow, which results in a Denial of Service condition, or enables remote attackers to execute arbitrary code.

CVE-2015-1283 SA-15:20.expat 2015-08-18 2016-08-11 FreeBSD -- routed(8) remote denial of service vulnerability FreeBSD 10.110.1_17 9.39.3_22

Problem Description:

The input path in routed(8) will accept queries from any source and attempt to answer them. However, the output path assumes that the destination address for the response is on a directly connected network.

Impact:

Upon receipt of a query from a source which is not on a directly connected network, routed(8) will trigger an assertion and terminate. The affected system's routing table will no longer be updated. If the affected system is a router, its routes will eventually expire from other routers' routing tables, and its networks will no longer be reachable unless they are also connected to another router.

CVE-2015-5674 SA-15:19.routed 2015-08-05 2016-08-11 FreeBSD -- shell injection vulnerability in patch(1) FreeBSD 10.110.1_17

Problem Description:

Due to insufficient sanitization of the input patch stream, it is possible for a patch file to cause patch(1) to pass certain ed(1) scripts to the ed(1) editor, which would run commands.

Impact:

This issue could be exploited to execute arbitrary commands as the user invoking patch(1) against a specically crafted patch file, which could be leveraged to obtain elevated privileges.

CVE-2015-1418 SA-15:18.bsdpatch 2015-08-05 2016-08-11 FreeBSD -- Resource exhaustion in TCP reassembly FreeBSD-kernel 10.110.1_16 9.39.3_21 8.48.4_35

Problem Description:

There is a mistake with the introduction of VNET, which converted the global limit on the number of segments that could belong to reassembly queues into a per-VNET limit. Because mbufs are allocated from a global pool, in the presence of a sufficient number of VNETs, the total number of mbufs attached to reassembly queues can grow to the total number of mbufs in the system, at which point all network traffic would cease.

Impact:

An attacker who can establish concurrent TCP connections across a sufficient number of VNETs and manipulate the inbound packet streams such that the maximum number of mbufs are enqueued on each reassembly queue can cause mbuf cluster exhaustion on the target system, resulting in a Denial of Service condition.

As the default per-VNET limit on the number of segments that can belong to reassembly queues is 1/16 of the total number of mbuf clusters in the system, only systems that have 16 or more VNET instances are vulnerable.

CVE-2015-1417 SA-15:15.tcp 2015-07-28 2016-08-11 FreeBSD -- shell injection vulnerability in patch(1) FreeBSD 10.110.1_16

Problem Description:

Due to insufficient sanitization of the input patch stream, it is possible for a patch file to cause patch(1) to run commands in addition to the desired SCCS or RCS commands.

Impact:

This issue could be exploited to execute arbitrary commands as the user invoking patch(1) against a specically crafted patch file, which could be leveraged to obtain elevated privileges.

CVE-2015-1416 SA-15:14.bsdpatch 2015-07-28 2016-08-11 FreeBSD -- Resource exhaustion due to sessions stuck in LAST_ACK state FreeBSD-kernel 10.110.1_15 9.39.3_20 8.48.4_34

Problem Description:

TCP connections transitioning to the LAST_ACK state can become permanently stuck due to mishandling of protocol state in certain situations, which in turn can lead to accumulated consumption and eventual exhaustion of system resources, such as mbufs and sockets.

Impact:

An attacker who can repeatedly establish TCP connections to a victim system (for instance, a Web server) could create many TCP connections that are stuck in LAST_ACK state and cause resource exhaustion, resulting in a denial of service condition. This may also happen in normal operation where no intentional attack is conducted, but an attacker who can send specifically crafted packets can trigger this more reliably.

CVE-2015-5358 SA-15:13.tcp 2015-07-21 2016-08-11 FreeBSD -- Denial of Service with IPv6 Router Advertisements FreeBSD-kernel 10.110.1_9 9.39.3_13 8.48.4_27

Problem Description:

The Neighbor Discover Protocol allows a local router to advertise a suggested Current Hop Limit value of a link, which will replace Current Hop Limit on an interface connected to the link on the FreeBSD system.

Impact:

When the Current Hop Limit (similar to IPv4's TTL) is small, IPv6 packets may get dropped before they reached their destinations.

By sending specifically crafted Router Advertisement packets, an attacker on the local network can cause the FreeBSD system to lose the ability to communicate with another IPv6 node on a different network.

CVE-2015-2923 SA-15:09.ipv6 2015-04-07 2016-08-11 FreeBSD -- Insecure default GELI keyfile permissions FreeBSD 10.110.1_9

Problem Description:

The default permission set by bsdinstall(8) installer when configuring full disk encrypted ZFS is too open.

Impact:

A local attacker may be able to get a copy of the geli(8) provider's keyfile which is located at a fixed location.

CVE-2015-1415 SA-15:08.bsdinstall 2015-04-07 2016-08-11 FreeBSD -- Integer overflow in IGMP protocol FreeBSD-kernel 10.110.1_9 9.39.3_13 8.48.4_27

Problem Description:

An integer overflow in computing the size of IGMPv3 data buffer can result in a buffer which is too small for the requested operation.

Impact:

An attacker who can send specifically crafted IGMP packets could cause a denial of service situation by causing the kernel to crash.

CVE-2015-1414 SA-15:04.igmp 2015-02-25 2016-08-11 FreeBSD -- SCTP stream reset vulnerability FreeBSD-kernel 10.110.1_5 10.010.0_17 9.39.3_9 8.48.4_23

Problem Description:

The input validation of received SCTP RE_CONFIG chunks is insufficient, and can result in a NULL pointer deference later.

Impact:

A remote attacker who can send a malformed SCTP packet to a FreeBSD system that serves SCTP can cause a kernel panic, resulting in a Denial of Service.

CVE-2014-8613 SA-15:03.sctp 2015-01-27 2016-08-11 FreeBSD -- SCTP SCTP_SS_VALUE kernel memory corruption and disclosure FreeBSD-kernel 10.110.1_5 10.010.0_17 9.39.3_9 8.48.4_23

Problem Description:

Due to insufficient validation of the SCTP stream ID, which serves as an array index, a local unprivileged attacker can read or write 16-bits of kernel memory.

Impact:

An unprivileged process can read or modify 16-bits of memory which belongs to the kernel. This smay lead to exposure of sensitive information or allow privilege escalation.

CVE-2014-8612 SA-15:02.kmem 2015-01-27 2016-08-11 FreeBSD -- Buffer overflow in stdio FreeBSD 10.110.1_1

Problem Description:

A programming error in the standard I/O library's __sflush() function could erroneously adjust the buffered stream's internal state even when no write actually occurred in the case when write(2) system call returns an error.

Impact:

The accounting mismatch would accumulate, if the caller does not check for stream status and will eventually lead to a heap buffer overflow.

Such overflows may lead to data corruption or the execution of arbitrary code at the privilege level of the calling program.

CVE-2014-8611 SA-14:27.stdio 2014-12-10 2016-08-11 FreeBSD -- Remote command execution in ftp(1) FreeBSD 10.010.0_12 9.39.3_5 9.29.2_15 9.19.1_22 8.48.4_19

Problem Description:

A malicious HTTP server could cause ftp(1) to execute arbitrary commands.

Impact:

When operating on HTTP URIs, the ftp(1) client follows HTTP redirects, and uses the part of the path after the last '/' from the last resource it accesses as the output filename if '-o' is not specified.

If the output file name provided by the server begins with a pipe ('|'), the output is passed to popen(3), which might be used to execute arbitrary commands on the ftp(1) client machine.

CVE-2014-8517 SA-14:26.ftp 2014-11-04 2016-08-11 FreeBSD -- Kernel stack disclosure in setlogin(2) / getlogin(2) FreeBSD-kernel 10.010.0_12 9.39.3_5 9.29.2_15 9.19.1_22 8.48.4_19

Problem Description:

When setlogin(2) is called while setting up a new login session, the login name is copied into an uninitialized stack buffer, which is then copied into a buffer of the same size in the session structure. The getlogin(2) system call returns the entire buffer rather than just the portion occupied by the login name associated with the session.

Impact:

An unprivileged user can access this memory by calling getlogin(2) and reading beyond the terminating NUL character of the resulting string. Up to 16 (FreeBSD 8) or 32 (FreeBSD 9 and 10) bytes of kernel memory may be leaked in this manner for each invocation of setlogin(2).

This memory may contain sensitive information, such as portions of the file cache or terminal buffers, which an attacker might leverage to obtain elevated privileges.

CVE-2014-8476 SA-14:25.setlogin 2014-11-04 2016-08-11 FreeBSD -- Denial of service attack against sshd(8) FreeBSD 10.010.0_12 9.29.2_15 9.19.1_22

Problem Description:

Although OpenSSH is not multithreaded, when OpenSSH is compiled with Kerberos support, the Heimdal libraries bring in the POSIX thread library as a dependency. Due to incorrect library ordering while linking sshd(8), symbols in the C library which are shadowed by the POSIX thread library may not be resolved correctly at run time.

Note that this problem is specific to the FreeBSD build system and does not affect other operating systems or the version of OpenSSH available from the FreeBSD ports tree.

Impact:

An incorrectly linked sshd(8) child process may deadlock while handling an incoming connection. The connection may then time out or be interrupted by the client, leaving the deadlocked sshd(8) child process behind. Eventually, the sshd(8) parent process stops accepting new connections.

An attacker may take advantage of this by repeatedly connecting and then dropping the connection after having begun, but not completed, the authentication process.

CVE-2014-8475 SA-14:24.sshd 2014-11-04 2016-08-11 FreeBSD -- memory leak in sandboxed namei lookup FreeBSD-kernel 10.010.0_10 9.39.3_3 9.29.2_13 9.19.1_20

Problem Description:

The namei facility will leak a small amount of kernel memory every time a sandboxed process looks up a nonexistent path name.

Impact:

A remote attacker that can cause a sandboxed process (for instance, a web server) to look up a large number of nonexistent path names can cause memory exhaustion.

CVE-2014-3711 SA-14:22.namei 2014-10-21 2016-08-11 FreeBSD -- routed(8) remote denial of service vulnerability FreeBSD 10.010.0_10 9.39.3_3 9.29.2_13 9.19.1_20 8.48.4_17

Problem Description:

Impact:

CVE-2014-3955 SA-14:21.routed 2014-10-21 2016-08-11 FreeBSD -- rtsold(8) remote buffer overflow vulnerability FreeBSD 10.010.0_10 9.39.3_3 9.29.2_13 9.19.1_20

Problem Description:

Due to a missing length check in the code that handles DNS parameters, a malformed router advertisement message can result in a stack buffer overflow in rtsold(8).

Impact:

Receipt of a router advertisement message with a malformed DNSSL option, for instance from a compromised host on the same network, can cause rtsold(8) to crash.

While it is theoretically possible to inject code into rtsold(8) through malformed router advertisement messages, it is normally compiled with stack protection enabled, rendering such an attack extremely difficult.

When rtsold(8) crashes, the existing DNS configuration will remain in force, and the kernel will continue to receive and process periodic router advertisements.

CVE-2014-3954 SA-14:20.rtsold 2014-10-21 2016-08-11 FreeBSD -- Denial of Service in TCP packet processing FreeBSD-kernel 10.010.0_9 9.39.3_2 9.29.2_12 9.19.1_19 8.48.4_16

Problem Description:

When a segment with the SYN flag for an already existing connection arrives, the TCP stack tears down the connection, bypassing a check that the sequence number in the segment is in the expected window.

Impact:

An attacker who has the ability to spoof IP traffic can tear down a TCP connection by sending only 2 packets, if they know both TCP port numbers. In case one of the two port numbers is unknown, a successful attack requires less than 2**17 packets spoofed, which can be generated within less than a second on a decent connection to the Internet.

CVE-2004-0230 SA-14:19.tcp 2014-09-16 2016-08-11 FreeBSD -- Kernel memory disclosure in control messages and SCTP FreeBSD-kernel 10.010.0_7 9.29.2_10 9.19.1_17 8.48.4_14

Problem Description:

Buffer between control message header and data may not be completely initialized before being copied to userland. [CVE-2014-3952]

Three SCTP cmsgs, SCTP_SNDRCV, SCTP_EXTRCV and SCTP_RCVINFO, have implicit padding that may not be completely initialized before being copied to userland. In addition, three SCTP notifications, SCTP_PEER_ADDR_CHANGE, SCTP_REMOTE_ERROR and SCTP_AUTHENTICATION_EVENT, have padding in the returning data structure that may not be completely initialized before being copied to userland. [CVE-2014-3953]

Impact:

An unprivileged local process may be able to retrieve portion of kernel memory.

For the generic control message, the process may be able to retrieve a maximum of 4 bytes of kernel memory.

For SCTP, the process may be able to retrieve 2 bytes of kernel memory for all three control messages, plus 92 bytes for SCTP_SNDRCV and 76 bytes for SCTP_EXTRCV. If the local process is permitted to receive SCTP notification, a maximum of 112 bytes of kernel memory may be returned to userland.

This information might be directly useful, or it might be leveraged to obtain elevated privileges in some way. For example, a terminal buffer might include a user-entered password.

CVE-2014-3952 CVE-2014-3953 SA-14:17.kmem 2014-07-08 2016-08-11 FreeBSD -- Multiple vulnerabilities in file(1) and libmagic(3) FreeBSD 10.010.0_6 9.29.2_9 9.19.1_16 8.48.4_13

Problem Description:

A specifically crafted Composite Document File (CDF) file can trigger an out-of-bounds read or an invalid pointer dereference. [CVE-2012-1571]

A flaw in regular expression in the awk script detector makes use of multiple wildcards with unlimited repetitions. [CVE-2013-7345]

A malicious input file could trigger infinite recursion in libmagic(3). [CVE-2014-1943]

A specifically crafted Portable Executable (PE) can trigger out-of-bounds read. [CVE-2014-2270]

Impact:

An attacker who can cause file(1) or any other applications using the libmagic(3) library to be run on a maliciously constructed input can the application to crash or consume excessive CPU resources, resulting in a denial-of-service.

CVE-2012-1571 CVE-2013-7345 CVE-2014-1943 CVE-2014-2270 SA-14:16.file 2014-06-24 2016-08-11 FreeBSD -- iconv(3) NULL pointer dereference and out-of-bounds array access FreeBSD 10.010.0_6

Problem Description:

A NULL pointer dereference in the initialization code of the HZ module and an out of bounds array access in the initialization code of the VIQR module make iconv_open(3) calls involving HZ or VIQR result in an application crash.

Impact:

Services where an attacker can control the arguments of an iconv_open(3) call can be caused to crash resulting in a denial-of-service. For example, an email encoded in HZ may cause an email delivery service to crash if it converts emails to a more generic encoding like UTF-8 before applying filtering rules.

CVE-2014-3951 SA-14:15.iconv 2014-06-24 2016-08-11 FreeBSD -- Incorrect error handling in PAM policy parser FreeBSD 9.29.2_7 10.010.0_4

Problem Description:

The OpenPAM library searches for policy definitions in several locations. While doing so, the absence of a policy file is a soft failure (handled by searching in the next location) while the presence of an invalid file is a hard failure (handled by returning an error to the caller).

The policy parser returns the same error code (ENOENT) when a syntactically valid policy references a non-existent module as when the requested policy file does not exist. The search loop regards this as a soft failure and looks for the next similarly-named policy, without discarding the partially-loaded configuration.

A similar issue can arise if a policy contains an include directive that refers to a non-existent policy.

Impact:

If a module is removed, or the name of a module is misspelled in the policy file, the PAM library will proceed with a partially loaded configuration. Depending on the exact circumstances, this may result in a fail-open scenario where users are allowed to log in without a password, or with an incorrect password.

In particular, if a policy references a module installed by a package or port, and that package or port is being reinstalled or upgraded, there is a brief window of time during which the module is absent and policies that use it may fail open. This can be especially damaging to Internet-facing SSH servers, which are regularly subjected to brute-force scans.

CVE-2014-3879 SA-14:13.pam 2014-06-03 2016-08-11 FreeBSD -- ktrace kernel memory disclosure FreeBSD-kernel 9.29.2_7 9.19.1_14 8.48.4_11

Problem Description:

Due to an overlooked merge to -STABLE branches, the size for page fault kernel trace entries was set incorrectly.

Impact:

A user who can enable kernel process tracing could end up reading the contents of kernel memory.

Such memory might contain sensitive information, such as portions of the file cache or terminal buffers. This information might be directly useful, or it might be leveraged to obtain elevated privileges in some way; for example, a terminal buffer might include a user-entered password.

CVE-2014-3873 SA-14:12.ktrace 2014-06-03 2016-08-11 FreeBSD -- sendmail improper close-on-exec flag handling FreeBSD 10.010.0_4 9.29.2_7 9.19.1_14 8.48.4_11

Problem Description:

There is a programming error in sendmail(8) that prevented open file descriptors have close-on-exec properly set. Consequently a subprocess will be able to access all open files that the parent process have open.

Impact:

A local user who can execute their own program for mail delivery will be able to interfere with an open SMTP connection.

SA-14:11.sendmail 2014-06-03 2016-08-11 FreeBSD -- TCP reassembly vulnerability FreeBSD-kernel 8.48.4_9 8.38.3_16 9.29.2_5 9.19.1_12 10.010.0_2

Problem Description:

FreeBSD may add a reassemble queue entry on the stack into the segment list when the reassembly queue reaches its limit. The memory from the stack is undefined after the function returns. Subsequent iterations of the reassembly function will attempt to access this entry.

Impact:

An attacker who can send a series of specifically crafted packets with a connection could cause a denial of service situation by causing the kernel to crash.

Additionally, because the undefined on stack memory may be overwritten by other kernel threads, while extremely difficult, it may be possible for an attacker to construct a carefully crafted attack to obtain portion of kernel memory via a connected socket. This may result in the disclosure of sensitive information such as login credentials, etc. before or even without crashing the system.

CVE-2014-3000 SA-14:08.tcp 2014-04-30 2016-08-11 FreeBSD -- devfs rules not applied by default for jails FreeBSD 10.010.0_2

Problem Description:

The default devfs rulesets are not loaded on boot, even when jails are used. Device nodes will be created in the jail with their normal default access permissions, while most of them should be hidden and inaccessible.

Impact:

Jailed processes can get access to restricted resources on the host system. For jailed processes running with superuser privileges this implies access to all devices on the system. This level of access could lead to information leakage and privilege escalation.

CVE-2014-3001 SA-14:07.devfs 2014-04-30 2016-08-11 FreeBSD -- Deadlock in the NFS server FreeBSD-kernel 10.010.0_1 9.29.2_4 9.19.1_11 8.48.4_8 8.38.3_15

Problem Description:

The kernel holds a lock over the source directory vnode while trying to convert the target directory file handle to a vnode, which needs to be returned with the lock held, too. This order may be in violation of normal lock order, which in conjunction with other threads that grab locks in the right order, constitutes a deadlock condition because no thread can proceed.

Impact:

An attacker on a trusted client could cause the NFS server become deadlocked, resulting in a denial of service.

CVE-2014-1453 SA-14:05.nfsserver 2014-04-08 2016-08-11 FreeBSD -- bsnmpd remote denial of service vulnerability FreeBSD 9.29.2_3 9.19.1_10 8.48.4_7 8.38.3_14

Problem Description:

The bsnmpd(8) daemon is prone to a stack-based buffer-overflow when it has received a specifically crafted GETBULK PDU request.

Impact:

This issue could be exploited to execute arbitrary code in the context of the service daemon, or crash the service daemon, causing a denial-of-service.

CVE-2014-1452 SA-14:01.bsnmpd 2014-01-14 2016-08-11 PostgreSQL -- Denial-of-Service and Code Injection Vulnerabilities postgresql91-server 9.1.09.1.23 postgresql92-server 9.2.09.2.18 postgresql93-server 9.3.09.3.11 postgresql94-server 9.4.09.4.9 postgresql95-server 9.5.09.5.4

PostgreSQL project reports:

Security Fixes nested CASE expressions + database and role names with embedded special characters

CVE-2016-5423: certain nested CASE expressions can cause the server to crash.

CVE-2016-5424: database and role names with embedded special characters can allow code injection during administrative operations like pg_dumpall.

CVE-2016-5423 CVE-2016-5424 2016-08-11 2016-08-11 piwik -- XSS vulnerability piwik 2.16.2

Piwik reports:

We have identified and fixed several XSS security issues in this release.

We have identified and fixed several XSS security issues in this release. 2016-08-03 2016-08-09 BIND,Knot,NSD,PowerDNS -- denial over service via oversized zone transfers bind99 9.9.9P2 bind910 9.10.4P2 bind911 9.11.0.b2 bind9-devel 9.12.0.a.2016.11.02 knot knot1 1.6.8 knot2 2.3.0 nsd 4.1.11 powerdns 4.0.1

ISC reports:

DNS protocols were designed with the assumption that a certain amount of trust could be presumed between the operators of primary and secondary servers for a given zone. However, in current practice some organizations have scenarios which require them to accept zone data from sources that are not fully trusted (for example: providers of secondary name service). A party who is allowed to feed data into a zone (e.g. by AXFR, IXFR, or Dynamic DNS updates) can overwhelm the server which is accepting data by intentionally or accidentally exhausting that server's memory.

CVE-2016-6170 CVE-2016-6171 CVE-2016-6172 CVE-2016-6173 https://kb.isc.org/article/AA-01390 http://www.openwall.com/lists/oss-security/2016/07/06/4 2016-07-06 2016-08-10 2017-04-24 FreeBSD -- Kernel memory disclosure in sctp(4) FreeBSD-kernel 9.19.1_6 8.48.4_3 8.38.3_10

Problem Description:

When initializing the SCTP state cookie being sent in INIT-ACK chunks, a buffer allocated from the kernel stack is not completely initialized.

Impact:

Fragments of kernel memory may be included in SCTP packets and transmitted over the network. For each SCTP session, there are two separate instances in which a 4-byte fragment may be transmitted.

This memory might contain sensitive information, such as portions of the file cache or terminal buffers. This information might be directly useful, or it might be leveraged to obtain elevated privileges in some way. For example, a terminal buffer might include a user-entered password.

SA-13:10.sctp CVE-2013-5209 2013-08-22 2016-08-09 FreeBSD -- integer overflow in IP_MSFILTER FreeBSD-kernel 9.19.1_6 8.48.4_3 8.38.3_10

Problem Description:

An integer overflow in computing the size of a temporary buffer can result in a buffer which is too small for the requested operation.

Impact:

An unprivileged process can read or write pages of memory which belong to the kernel. These may lead to exposure of sensitive information or allow privilege escalation.

CVE-2013-3077 SA-13:09.ip_multicast 2013-08-22 2016-08-09 FreeBSD -- Incorrect privilege validation in the NFS server FreeBSD-kernel 9.19.1_5 8.38.3_9

Problem Description:

The kernel incorrectly uses client supplied credentials instead of the one configured in exports(5) when filling out the anonymous credential for a NFS export, when -network or -host restrictions are used at the same time.

Impact:

The remote client may supply privileged credentials (e.g. the root user) when accessing a file under the NFS share, which will bypass the normal access checks.

CVE-2013-4851 SA-13:08.nfsserver 2013-07-06 2016-08-09 collectd -- Network plugin heap overflow collectd5 5.5.2

The collectd Project reports:

Emilien Gaspar has identified a heap overflow in collectd's network plugin which can be triggered remotely and is potentially exploitable.

CVE-2016-6254 http://collectd.org/news.shtml#news98 2016-07-26 2016-08-05 moodle -- multiple vulnerabilities moodle28 2.8.12 moodle29 2.9.7 moodle30 3.0.5 moodle31 3.1.1

Marina Glancy reports:

MSA-16-0019: Glossary search displays entries without checking user permissions to view them

MSA-16-0020: Text injection in email headers

MSA-16-0021: Unenrolled user still receives event monitor notifications even though they can no longer access course

CVE-2016-5012 CVE-2016-5013 CVE-2016-5014 https://moodle.org/security/ 2016-07-19 2016-08-06 bind -- denial of service vulnerability bind99 9.9.9P2 bind910 9.10.4P2 bind911 9.11.0.b2 bind9-devel 9.12.0.a.2016.07.14

ISC reports:

A query name which is too long can cause a segmentation fault in lwresd.

CVE-2016-2775 https://kb.isc.org/article/AA-01393 2016-07-18 2016-08-06 wireshark -- multiple vulnerabilities wireshark wireshark-lite wireshark-qt5 tshark tshark-lite 2.0.5

Wireshark development team reports:

The following vulnerabilities have been fixed:

wnpa-sec-2016-41

PacketBB crash. (Bug 12577)

wnpa-sec-2016-42

WSP infinite loop. (Bug 12594)

wnpa-sec-2016-44

RLC long loop. (Bug 12660)

wnpa-sec-2016-45

LDSS dissector crash. (Bug 12662)

wnpa-sec-2016-46

RLC dissector crash. (Bug 12664)

wnpa-sec-2016-47

OpenFlow long loop. (Bug 12659)

wnpa-sec-2016-48

MMSE, WAP, WBXML, and WSP infinite loop. (Bug 12661)

wnpa-sec-2016-49

WBXML crash. (Bug 12663)

CVE-2016-6505 CVE-2016-6506 CVE-2016-6508 CVE-2016-6509 CVE-2016-6510 CVE-2016-6511 CVE-2016-6512 CVE-2016-6513 https://www.wireshark.org/docs/relnotes/wireshark-2.0.5.html http://www.openwall.com/lists/oss-security/2016/08/01/4 2016-07-27 2016-08-06 p5-XSLoader -- local arbitrary code execution p5-XSLoader 0.22 perl5 perl5.18 perl5.20 perl5.22 perl5.24 perl5-devel 5.18.4_24 5.205.20.3_15 5.215.22.3.r2 5.235.24.1.r2 5.255.25.2.87 perl 0

Jakub Wilk reports:

XSLoader tries to load code from a subdirectory in the cwd when called inside a string eval

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=829578 CVE-2016-6185 2016-06-30 2016-08-04 2016-08-22 perl -- local arbitrary code execution perl5 perl5.18 perl5.20 perl5.22 perl5.24 perl5-devel 5.18.4_23 5.205.20.3_14 5.215.22.3.r2 5.235.24.1.r2 5.255.25.3.18 perl 0

Sawyer X reports:

Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.

http://www.nntp.perl.org/group/perl.perl5.porters/2016/07/msg238271.html CVE-2016-1238 2016-07-21 2016-08-04 2016-08-22 gd -- multiple vulnerabilities gd 2.2.3,1

Pierre Joye reports:

fix php bug 72339, Integer Overflow in _gd2GetHeader (CVE-2016-5766)

gd: Buffer over-read issue when parsing crafted TGA file (CVE-2016-6132)

Integer overflow error within _gdContributionsAlloc() (CVE-2016-6207)

fix php bug 72494, invalid color index not handled, can lead to crash ( CVE-2016-6128)

https://github.com/libgd/libgd/releases/tag/gd-2.2.3 CVE-2016-5766 CVE-2016-6132 CVE-2016-6207 CVE-2016-6128 2016-07-21 2016-08-04 Vulnerabilities in Curl curl 7.32.07.50.1

Curl security team reports:

CVE-2016-5419 - TLS session resumption client cert bypass

CVE-2016-5420 - Re-using connections with wrong client cert

CVE-2016-5421 - use of connection struct after free

CVE-2016-5419 CVE-2016-5420 CVE-2016-5421 https://curl.haxx.se/docs/adv_20160803A.html https://curl.haxx.se/docs/adv_20160803B.html https://curl.haxx.se/docs/adv_20160803C.html 2016-08-03 2016-08-04 lighttpd - multiple vulnerabilities lighttpd 1.4.41

Lighttpd Project reports:

Security fixes for Lighttpd:

security: encode quoting chars in HTML and XML

security: ensure gid != 0 if server.username is set, but not server.groupname

security: disable stat_cache if server.follow-symlink = “disable”

security: httpoxy defense: do not emit HTTP_PROXY to CGI env

http://www.lighttpd.net/2016/7/31/1.4.41/ ports/211495 2016-07-31 2016-08-03 xen-tools -- virtio: unbounded memory allocation issue xen-tools 4.7.0_4

The Xen Project reports:

A guest can submit virtio requests without bothering to wait for completion and is therefore not bound by virtqueue size...

A malicious guest administrator can cause unbounded memory allocation in QEMU, which can cause an Out-of-Memory condition in the domain running qemu. Thus, a malicious guest administrator can cause a denial of service affecting the whole host.

CVE-2016-5403 ports/211482 http://xenbits.xen.org/xsa/advisory-184.html 2016-07-27 2016-08-02 xen-kernel -- x86: Missing SMAP whitelisting in 32-bit exception / event delivery xen-kernel 4.54.7.0_3

The Xen Project reports:

Supervisor Mode Access Prevention is a hardware feature designed to make an Operating System more robust, by raising a pagefault rather than accidentally following a pointer into userspace. However, legitimate accesses into userspace require whitelisting, and the exception delivery mechanism for 32bit PV guests wasn't whitelisted.

A malicious 32-bit PV guest kernel can trigger a safety check, crashing the hypervisor and causing a denial of service to other VMs on the host.

CVE-2016-6259 ports/211482 http://xenbits.xen.org/xsa/advisory-183.html 2016-07-26 2016-08-02 xen-kernel -- x86: Privilege escalation in PV guests xen-kernel 4.7.0_3

The Xen Project reports:

The PV pagetable code has fast-paths for making updates to pre-existing pagetable entries, to skip expensive re-validation in safe cases (e.g. clearing only Access/Dirty bits). The bits considered safe were too broad, and not actually safe.

A malicous PV guest administrator can escalate their privilege to that of the host.

CVE-2016-6258 ports/211482 http://xenbits.xen.org/xsa/advisory-182.html 2016-07-26 2016-08-02 libidn -- mulitiple vulnerabilities libidn 1.33

Simon Josefsson reports:

libidn: Fix out-of-bounds stack read in idna_to_ascii_4i.

idn: Solve out-of-bounds-read when reading one zero byte as input. Also replaced fgets with getline.

libidn: stringprep_utf8_nfkc_normalize reject invalid UTF-8. It was always documented to only accept UTF-8 data, but now it doesn't crash when presented with such data.

CVE-2016-6261 CVE-2015-8948 CVE-2016-6262 CVE-2016-6263 https://lists.gnu.org/archive/html/help-libidn/2016-07/msg00009.html http://www.openwall.com/lists/oss-security/2016/07/21/4 2016-07-20 2016-07-31 The GIMP -- Use after Free vulnerability gimp-app 2.8.18,1

The GIMP team reports:

A Use-after-free vulnerability was found in the xcf_load_image function.

https://mail.gnome.org/archives/gimp-developer-list/2016-July/msg00020.html https://bugzilla.gnome.org/show_bug.cgi?id=767873 CVE-2016-4994 2016-06-20 2016-07-19 xercesi-c3 -- multiple vulnerabilities xerces-c3 3.1.4

Apache reports:

The Xerces-C XML parser fails to successfully parse a DTD that is deeply nested, and this causes a stack overflow, which makes a denial of service attack against many applications possible by an unauthenticated attacker.

Also, CVE-2016-2099: Use-after-free vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 3.1.3 and earlier allows context-dependent attackers to have unspecified impact via an invalid character in an XML document.

https://xerces.apache.org/xerces-c/secadv/CVE-2016-4463.txt http://www.openwall.com/lists/oss-security/2016/05/09/7 CVE-2016-2099 CVE-2016-4463 2016-05-09 2016-07-26 php -- multiple vulnerabilities php55 5.5.38 php56 5.6.24 php70 7.0.9 php70-curl 7.0.9 php55-bz2 5.5.38 php56-bz2 5.6.24 php70-bz2 7.0.9 php55-exif 5.5.38 php56-exif 5.6.24 php70-exif 7.0.9 php55-gd 5.5.38 php56-gd 5.6.24 php70-gd 7.0.9 php70-mcrypt 7.0.9 php55-odbc 5.5.38 php56-odbc 5.6.24 php70-odbc 7.0.9 php55-snmp 5.5.38 php56-snmp 5.6.24 php70-snmp 7.0.9 php55-xmlrpc 5.5.38 php56-xmlrpc 5.6.24 php70-xmlrpc 7.0.9 php55-zip 5.5.38 php56-zip 5.6.24 php70-zip 7.0.9

PHP reports:

Fixed bug #69975 (PHP segfaults when accessing nvarchar(max) defined columns)

Fixed bug #72479 (Use After Free Vulnerability in SNMP with GC and unserialize()).

Fixed bug #72512 (gdImageTrueColorToPaletteBody allows arbitrary write/read access).

Fixed bug #72519 (imagegif/output out-of-bounds access).

Fixed bug #72520 (Stack-based buffer overflow vulnerability in php_stream_zip_opener).

Fixed bug #72533 (locale_accept_from_http out-of-bounds access).

Fixed bug #72541 (size_t overflow lead to heap corruption).

Fixed bug #72551, bug #72552 (Incorrect casting from size_t to int lead to heap overflow in mdecrypt_generic).

Fixed bug #72558 (Integer overflow error within _gdContributionsAlloc()).

Fixed bug #72573 (HTTP_PROXY is improperly trusted by some PHP libraries and applications).

Fixed bug #72603 (Out of bound read in exif_process_IFD_in_MAKERNOTE).

Fixed bug #72606 (heap-buffer-overflow (write) simplestring_addn simplestring.c).

Fixed bug #72613 (Inadequate error handling in bzread()).

Fixed bug #72618 (NULL Pointer Dereference in exif_process_user_comment).

http://www.php.net/ChangeLog-5.php#5.5.38 http://www.php.net/ChangeLog-5.php#5.6.24 http://www.php.net/ChangeLog-7.php#7.0.8 http://seclists.org/oss-sec/2016/q3/121 CVE-2015-8879 CVE-2016-5385 CVE-2016-5399 CVE-2016-6288 CVE-2016-6289 CVE-2016-6290 CVE-2016-6291 CVE-2016-6292 CVE-2016-6294 CVE-2016-6295 CVE-2016-6296 CVE-2016-6297 2016-07-21 2016-07-26 chromium -- multiple vulnerabilities chromium chromium-npapi chromium-pulse 52.0.2743.82

Google Chrome Releases reports:

48 security fixes in this release, including:

[610600] High CVE-2016-1706: Sandbox escape in PPAPI. Credit to Pinkie Pie xisigr of Tencent's Xuanwu Lab

[613949] High CVE-2016-1708: Use-after-free in Extensions. Credit to Adam Varsan

[614934] High CVE-2016-1709: Heap-buffer-overflow in sfntly. Credit to ChenQin of Topsec Security Team

[616907] High CVE-2016-1710: Same-origin bypass in Blink. Credit to Mariusz Mlynski

[617495] High CVE-2016-1711: Same-origin bypass in Blink. Credit to Mariusz Mlynski

[618237] High CVE-2016-5127: Use-after-free in Blink. Credit to cloudfuzzer

[619166] High CVE-2016-5128: Same-origin bypass in V8. Credit to Anonymous

[620553] High CVE-2016-5129: Memory corruption in V8. Credit to Jeonghoon Shin

[623319] High CVE-2016-5130: URL spoofing. Credit to Wadih Matar

[623378] High CVE-2016-5131: Use-after-free in libxml. Credit to Nick Wellnhofer

[607543] Medium CVE-2016-5132: Limited same-origin bypass in Service Workers. Credit to Ben Kelly

[613626] Medium CVE-2016-5133: Origin confusion in proxy authentication. Credit to Patch Eudor

[593759] Medium CVE-2016-5134: URL leakage via PAC script. Credit to Paul Stone

[605451] Medium CVE-2016-5135: Content-Security-Policy bypass. Credit to kingxwy

[625393] Medium CVE-2016-5136: Use after free in extensions. Credit to Rob Wu

[625945] Medium CVE-2016-5137: History sniffing with HSTS and CSP. Credit to Xiaoyin Liu

[629852] CVE-2016-1705: Various fixes from internal audits, fuzzing and other initiatives.

CVE-2016-1705 CVE-2016-1706 CVE-2016-1708 CVE-2016-1709 CVE-2016-1710 CVE-2016-1711 CVE-2016-5127 CVE-2016-5128 CVE-2016-5129 CVE-2016-5130 CVE-2016-5131 CVE-2016-5132 CVE-2016-5133 CVE-2016-5134 CVE-2016-5135 CVE-2016-5136 CVE-2016-5137 https://googlechromereleases.blogspot.nl/2016/07/stable-channel-update.html 2016-07-20 2016-07-22 krb5 -- KDC denial of service vulnerability krb5-113 1.13.6 krb5-114 1.14.3

Major changes in krb5 1.14.3 and krb5 1.13.6:

Fix a rare KDC denial of service vulnerability when anonymous client principals are restricted to obtaining TGTs only [CVE-2016-3120] .

CVE-2016-3120 http://web.mit.edu/kerberos/krb5-1.14/ 2016-07-20 2016-07-21 2016-07-26 Apache OpenOffice 4.1.2 -- Memory Corruption Vulnerability (Impress Presentations) apache-openoffice 4.1.2_8 apache-openoffice-devel 4.2.1753426,4

The Apache OpenOffice Project reports:

An OpenDocument Presentation .ODP or Presentation Template .OTP file can contain invalid presentation elements that lead to memory corruption when the document is loaded in Apache OpenOffice Impress. The defect may cause the document to appear as corrupted and OpenOffice may crash in a recovery-stuck mode requiring manual intervention. A crafted exploitation of the defect can allow an attacker to cause denial of service (memory corruption and application crash) and possible execution of arbitrary code.

CVE-2016-1513 http://www.openoffice.org/security/cves/CVE-2015-4551.html 2016-07-17 2016-07-21 MySQL -- Multiple vulnerabilities mariadb55-server 5.5.49 mariadb100-server 10.0.25 mariadb101-server 10.1.14 mysql55-server 5.5.49 mysql56-server 5.6.30 mysql57-server 5.7.12_1 percona55-server 5.5.49 percona56-server 5.6.30

Oracle reports:

The quarterly Critical Patch Update contains 22 new security fixes for Oracle MySQL 5.5.49, 5.6.30, 5.7.13 and earlier

http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html#AppendixMSQL CVE-2016-3477 CVE-2016-3440 CVE-2016-2105 CVE-2016-3471 CVE-2016-3486 CVE-2016-3501 CVE-2016-3518 CVE-2016-3521 CVE-2016-3588 CVE-2016-3615 CVE-2016-3614 CVE-2016-5436 CVE-2016-3459 CVE-2016-5437 CVE-2016-3424 CVE-2016-5439 CVE-2016-5440 CVE-2016-5441 CVE-2016-5442 CVE-2016-5443 CVE-2016-5444 CVE-2016-3452 2016-07-20 2016-07-21 2016-08-08 typo3 -- Missing access check in Extbase typo3 7.6.8 typo3-lts 6.2.24

TYPO3 reports:

Extbase request handling fails to implement a proper access check for requested controller/ action combinations, which makes it possible for an attacker to execute arbitrary Extbase actions by crafting a special request. To successfully exploit this vulnerability, an attacker must have access to at least one Extbase plugin or module action in a TYPO3 installation. The missing access check inevitably leads to information disclosure or remote code execution, depending on the action that an attacker is able to execute.

CVE-2016-5091 https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-013/ https://wiki.typo3.org/TYPO3_CMS_7.6.8 https://wiki.typo3.org/TYPO3_CMS_6.2.24 2016-05-24 2016-07-18 atutor -- multiple vulnerabilites atutor 2.2.2

ATutor reports:

Security Fixes: Added a new layer of security over all php superglobals, fixed several XSS, CSRF, and SQL injection vulnerabilities.

https://github.com/atutor/ATutor/releases/tag/atutor_2_2_2 2016-07-01 2016-07-16 atutor -- multiple vulnerabilites atutor 2.2.1

ATutor reports:

Security Fixes: A number of minor XSS vulnerabilities discovered in the previous version of ATutor have been corrected.

https://github.com/atutor/ATutor/releases/tag/atutor_2_2_1 2016-01-30 2016-07-16 flash -- multiple vulnerabilities linux-c6-flashplugin linux-c6_64-flashplugin linux-f10-flashplugin 11.2r202.632

Adobe reports:

These updates resolve a race condition vulnerability that could lead to information disclosure (CVE-2016-4247).

These updates resolve type confusion vulnerabilities that could lead to code execution (CVE-2016-4223, CVE-2016-4224, CVE-2016-4225).

These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2016-4173, CVE-2016-4174, CVE-2016-4222, CVE-2016-4226, CVE-2016-4227, CVE-2016-4228, CVE-2016-4229, CVE-2016-4230, CVE-2016-4231, CVE-2016-4248).

These updates resolve a heap buffer overflow vulnerability that could lead to code execution (CVE-2016-4249).

These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, CVE-2016-4246).

These updates resolve a memory leak vulnerability (CVE-2016-4232).

These updates resolve stack corruption vulnerabilities that could lead to code execution (CVE-2016-4176, CVE-2016-4177).

These updates resolve a security bypass vulnerability that could lead to information disclosure (CVE-2016-4178).

CVE-2016-4172 CVE-2016-4173 CVE-2016-4174 CVE-2016-4175 CVE-2016-4176 CVE-2016-4177 CVE-2016-4178 CVE-2016-4179 CVE-2016-4180 CVE-2016-4181 CVE-2016-4182 CVE-2016-4183 CVE-2016-4184 CVE-2016-4185 CVE-2016-4186 CVE-2016-4187 CVE-2016-4188 CVE-2016-4189 CVE-2016-4190 CVE-2016-4217 CVE-2016-4218 CVE-2016-4219 CVE-2016-4220 CVE-2016-4221 CVE-2016-4222 CVE-2016-4223 CVE-2016-4224 CVE-2016-4225 CVE-2016-4226 CVE-2016-4227 CVE-2016-4228 CVE-2016-4229 CVE-2016-4230 CVE-2016-4231 CVE-2016-4232 CVE-2016-4233 CVE-2016-4234 CVE-2016-4235 CVE-2016-4236 CVE-2016-4237 CVE-2016-4238 CVE-2016-4239 CVE-2016-4240 CVE-2016-4241 CVE-2016-4242 CVE-2016-4243 CVE-2016-4244 CVE-2016-4245 CVE-2016-4246 CVE-2016-4247 CVE-2016-4248 CVE-2016-4249 https://helpx.adobe.com/security/products/flash-player/apsb16-25.html 2016-07-12 2016-07-16 Apache Commons FileUpload -- denial of service tomcat 0 tomcat7 7.0.70 tomcat8 8.0.36 apache-struts 2.5.2

Jochen Wiedmann reports:

A malicious client can send file upload requests that cause the HTTP server using the Apache Commons Fileupload library to become unresponsive, preventing the server from servicing other requests.

http://jvn.jp/en/jp/JVN89379547/index.html http://mail-archives.apache.org/mod_mbox/commons-dev/201606.mbox/%3CCAF8HOZ%2BPq2QH8RnxBuJyoK1dOz6jrTiQypAC%2BH8g6oZkBg%2BCxg%40mail.gmail.com%3E CVE-2016-3092 2016-06-21 2016-07-15 2017-03-18 libreoffice -- use-after-free vulnerability libreoffice 5.1.4

Talos reports:

An exploitable Use After Free vulnerability exists in the RTF parser LibreOffice. A specially crafted file can cause a use after free resulting in a possible arbitrary code execution. To exploit the vulnerability a malicious file needs to be opened by the user via vulnerable application.

http://www.talosintelligence.com/reports/TALOS-2016-0126/ http://www.libreoffice.org/about-us/security/advisories/cve-2016-4324/ CVE-2016-4324 2016-06-27 2016-07-15 tiff -- buffer overflow tiff 4.0.6_2 linux-c6-tiff 3.9.4_2 linux-f10-tiff *

Mathias Svensson reports:

potential buffer write overrun in PixarLogDecode() on corrupted/unexpected images

https://github.com/vadz/libtiff/commit/391e77fcd217e78b2c51342ac3ddb7100ecacdd2 CVE-2016-5314 CVE-2016-5320 CVE-2016-5875 2016-06-28 2016-07-15 2016-09-06 p7zip -- out-of-bounds read vulnerability p7zip 15.14_1

Cisco Talos reports:

An out-of-bounds read vulnerability exists in the way 7-Zip handles Universal Disk Format (UDF) files.

Central to 7-Zip’s processing of UDF files is the CInArchive::ReadFileItem method. Because volumes can have more than one partition map, their objects are kept in an object vector. To start looking for an item, this method tries to reference the proper object using the partition map’s object vector and the "PartitionRef" field from the Long Allocation Descriptor. Lack of checking whether the "PartitionRef" field is bigger than the available amount of partition map objects causes a read out-of-bounds and can lead, in some circumstances, to arbitrary code execution.

CVE-2016-2335 http://blog.talosintel.com/2016/05/multiple-7-zip-vulnerabilities.html 2016-05-11 2016-07-15 p7zip -- heap overflow vulnerability p7zip 15.14_1

Cisco Talos reports:

An exploitable heap overflow vulnerability exists in the NArchive::NHfs::CHandler::ExtractZlibFile method functionality of 7zip that can lead to arbitrary code execution.

CVE-2016-2334 http://blog.talosintel.com/2016/05/multiple-7-zip-vulnerabilities.html 2016-05-11 2016-07-15 samba -- client side SMB2/3 required signing can be downgraded samba4 4.0.04.0.26 samba41 4.1.04.1.23 samba42 4.2.04.2.14 samba43 4.3.04.3.11 samba44 4.4.04.4.5

Samba team reports:

A man in the middle attack can disable client signing over SMB2/3, even if enforced by configuration parameters.

CVE-2016-2119 https://www.samba.org/samba/security/CVE-2016-2119.html 2016-07-07 2016-07-13 ruby-saml -- XML signature wrapping attack rubygem-ruby-saml 1.3.0

RubySec reports:

ruby-saml prior to version 1.3.0 is vulnerable to an XML signature wrapping attack in the specific scenario where there was a signature that referenced at the same time 2 elements (but past the scheme validator process since 1 of the element was inside the encrypted assertion).

ruby-saml users must update to 1.3.0, which implements 3 extra validations to mitigate this kind of attack.

CVE-2016-5697 http://rubysec.com/advisories/CVE-2016-5697/ https://github.com/onelogin/ruby-saml/commit/a571f52171e6bfd87db59822d1d9e8c38fb3b995 2016-06-24 2016-07-08 quassel -- remote denial of service quassel 0.12.4

Mitre reports:

The onReadyRead function in core/coreauthhandler.cpp in Quassel before 0.12.4 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via invalid handshake data.

CVE-2016-4414 http://quassel-irc.org/node/129 https://github.com/quassel/quassel/commit/e678873 http://www.openwall.com/lists/oss-security/2016/04/30/2 http://www.openwall.com/lists/oss-security/2016/04/30/4 2016-04-24 2016-07-07 apache24 -- X509 Client certificate based authentication can be bypassed when HTTP/2 is used apache24 2.4.182.4.23

Apache Software Foundation reports:

The Apache HTTPD web server (from 2.4.18-2.4.20) did not validate a X509 client certificate correctly when experimental module for the HTTP/2 protocol is used to access a resource.

The net result is that a resource that should require a valid client certificate in order to get access can be accessed without that credential.

CVE-2016-4979 http://mail-archives.apache.org/mod_mbox/httpd-announce/201607.mbox/CVE-2016-4979-68283 2016-07-01 2016-07-05 xen-tools -- Unrestricted qemu logging xen-tools 4.7.0_2

The Xen Project reports:

When the libxl toolstack launches qemu for HVM guests, it pipes the output of stderr to a file in /var/log/xen. This output is not rate-limited in any way. The guest can easily cause qemu to print messages to stderr, causing this file to become arbitrarily large.

The disk containing the logfile can be exausted, possibly causing a denial-of-service (DoS).

CVE-2014-3672 http://xenbits.xen.org/xsa/advisory-180.html 2016-05-23 2016-07-04 xen-tools -- QEMU: Banked access to VGA memory (VBE) uses inconsistent bounds checks xen-tools 4.7.0_2

The Xen Project reports:

Qemu VGA module allows banked access to video memory using the window at 0xa00000 and it supports different access modes with different address calculations.

Qemu VGA module allows guest to edit certain registers in 'vbe' and 'vga' modes.

A privileged guest user could use CVE-2016-3710 to exceed the bank address window and write beyond the said memory area, potentially leading to arbitrary code execution with privileges of the Qemu process. If the system is not using stubdomains, this will be in domain 0.

A privileged guest user could use CVE-2016-3712 to cause potential integer overflow or OOB read access issues in Qemu, resulting in a DoS of the guest itself. More dangerous effect, such as data leakage or code execution, are not known but cannot be ruled out.

CVE-2016-3710 CVE-2016-3712 http://xenbits.xen.org/xsa/advisory-179.html 2016-05-09 2016-07-04 xen-tools -- Unsanitised driver domain input in libxl device handling xen-tools 4.7.0_1

The Xen Project reports:

libxl's device-handling code freely uses and trusts information from the backend directories in xenstore.

A malicious driver domain can deny service to management tools.

CVE-2016-4963 http://xenbits.xen.org/xsa/advisory-178.html 2016-06-02 2016-07-04 xen-kernel -- x86 software guest page walk PS bit handling flaw xen-kernel 4.7.0

The Xen Project reports:

The Page Size (PS) page table entry bit exists at all page table levels other than L1. Its meaning is reserved in L4, and conditionally reserved in L3 and L2 (depending on hardware capabilities). The software page table walker in the hypervisor, however, so far ignored that bit in L4 and (on respective hardware) L3 entries, resulting in pages to be treated as page tables which the guest OS may not have designated as such. If the page in question is writable by an unprivileged user, then that user will be able to map arbitrary guest memory.

On vulnerable OSes, guest user mode code may be able to establish mappings of arbitrary memory inside the guest, allowing it to elevate its privileges inside the guest.

CVE-2016-4480 http://xenbits.xen.org/xsa/advisory-176.html 2016-05-17 2016-07-04 xen-tools -- Unsanitised guest input in libxl device handling code xen-tools 4.7.0_1

The Xen Project reports:

Various parts of libxl device-handling code inappropriately use information from (partially) guest controlled areas of xenstore.

A malicious guest administrator can cause denial of service by resource exhaustion.

A malicious guest administrator can confuse and/or deny service to management facilities.

A malicious guest administrator of a guest configured with channel devices may be able to escalate their privilege to that of the backend domain (i.e., normally, to that of the host).

CVE-2016-4962 http://xenbits.xen.org/xsa/advisory-175.html 2016-06-02 2016-07-04 xen-kernel -- x86 shadow pagetables: address width overflow xen-kernel 3.44.7.0

The Xen Project reports:

In the x86 shadow pagetable code, the guest frame number of a superpage mapping is stored in a 32-bit field. If a shadowed guest can cause a superpage mapping of a guest-physical address at or above 2^44 to be shadowed, the top bits of the address will be lost, causing an assertion failure or NULL dereference later on, in code that removes the shadow.

A HVM guest using shadow pagetables can cause the host to crash.

A PV guest using shadow pagetables (i.e. being migrated) with PV superpages enabled (which is not the default) can crash the host, or corrupt hypervisor memory, and so a privilege escalation cannot be ruled out.

CVE-2016-3960 http://xenbits.xen.org/xsa/advisory-173.html 2016-04-18 2016-07-04 wireshark -- multiple vulnerabilities wireshark wireshark-lite wireshark-qt5 tshark tshark-lite 2.0.4

Wireshark development team reports:

The following vulnerabilities have been fixed:

wnpa-sec-2016-29

The SPOOLS dissector could go into an infinite loop. Discovered by the CESG.

wnpa-sec-2016-30

The IEEE 802.11 dissector could crash. (Bug 11585)

wnpa-sec-2016-31

The IEEE 802.11 dissector could crash. Discovered by Mateusz Jurczyk. (Bug 12175)

wnpa-sec-2016-32

The UMTS FP dissector could crash. (Bug 12191)

wnpa-sec-2016-33

Some USB dissectors could crash. Discovered by Mateusz Jurczyk. (Bug 12356)

wnpa-sec-2016-34

The Toshiba file parser could crash. Discovered by iDefense Labs. (Bug 12394)

wnpa-sec-2016-35

The CoSine file parser could crash. Discovered by iDefense Labs. (Bug 12395)

wnpa-sec-2016-36

The NetScreen file parser could crash. Discovered by iDefense Labs. (Bug 12396)

wnpa-sec-2016-37

The Ethernet dissector could crash. (Bug 12440)

CVE-2016-5350 CVE-2016-5351 CVE-2016-5352 CVE-2016-5353 CVE-2016-5354 CVE-2016-5355 CVE-2016-5356 CVE-2016-5357 CVE-2016-5358 https://www.wireshark.org/docs/relnotes/wireshark-2.0.4.html http://www.openwall.com/lists/oss-security/2016/06/09/4 2016-06-07 2016-07-04 moodle -- multiple vulnerabilities moodle28 2.8.12 moodle29 2.9.6 moodle30 3.0.4

Marina Glancy reports:

MSA-16-0013: Users are able to change profile fields that were locked by the administrator.

MSA-16-0015: Information disclosure of hidden forum names and sub-names.

MSA-16-0016: User can view badges of other users without proper permissions.

MSA-16-0017: Course idnumber not protected from teacher restore.

MSA-16-0018: CSRF in script marking forum posts as read.

CVE-2016-3729 CVE-2016-3731 CVE-2016-3732 CVE-2016-3733 CVE-2016-3734 https://moodle.org/security/ 2016-05-18 2016-07-03 icingaweb2 -- remote code execution icingaweb2 2.3.4

Eric Lippmann reports:

Possibility of remote code execution via the remote command transport.

https://www.icinga.org/2016/06/23/icinga-web-2-v2-3-4-v2-2-2-and-v2-1-4-releases/ 2016-06-23 2016-07-03 hive -- authorization logic vulnerability hive 2.0.0

Sushanth Sowmyan reports:

Some partition-level operations exist that do not explicitly also authorize privileges of the parent table. This can lead to issues when the parent table would have denied the operation, but no denial occurs because the partition-level privilege is not checked by the authorization framework, which defines authorization entities only from the table level upwards.

CVE-2015-7521 http://mail-archives.apache.org/mod_mbox/hive-user/201601.mbox/%3C20160128205008.2154F185EB%40minotaur.apache.org%3E 2016-01-28 2016-07-03 SQLite3 -- Tempdir Selection Vulnerability sqlite3 3.13.0

KoreLogic security reports:

Affected versions of SQLite reject potential tempdir locations if they are not readable, falling back to '.'. Thus, SQLite will favor e.g. using cwd for tempfiles on such a system, even if cwd is an unsafe location. Notably, SQLite also checks the permissions of '.', but ignores the results of that check.

CVE-2016-6153 ports/209827 https://www.korelogic.com/Resources/Advisories/KL-001-2016-003.txt http://openwall.com/lists/oss-security/2016/07/01/2 http://www.sqlite.org/cgi/src/info/67985761aa93fb61 http://www.sqlite.org/cgi/src/info/b38fe522cfc971b3 http://www.sqlite.org/cgi/src/info/614bb709d34e1148 2016-07-01 2016-07-03 Python -- smtplib StartTLS stripping vulnerability python27 2.7.12 python33 0 python34 3.4.5 python35 3.5.2

Red Hat reports:

A vulnerability in smtplib allowing MITM attacker to perform a startTLS stripping attack. smtplib does not seem to raise an exception when the remote end (smtp server) is capable of negotiating starttls but fails to respond with 220 (ok) to an explicit call of SMTP.starttls(). This may allow a malicious MITM to perform a startTLS stripping attack if the client code does not explicitly check the response code for startTLS.

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-0772 CVE-2016-0772 2016-06-14 2016-07-03 phpMyAdmin -- multiple vulnerabilities phpmyadmin 4.6.04.6.3

The phpMYAdmin development team reports:

Summary

BBCode injection vulnerability

Description

A vulnerability was discovered that allows an BBCode injection to setup script in case it's not accessed on https.

Severity

We consider this to be non-critical.

Summary

Cookie attribute injection attack

Description

A vulnerability was found where, under some circumstances, an attacker can inject arbitrary values in the browser cookies.

Severity

We consider this to be non-critical.

Summary

SQL injection attack

Description

A vulnerability was discovered that allows an SQL injection attack to run arbitrary commands as the control user.

Severity

We consider this vulnerability to be serious

Summary

XSS on table structure page

Description

An XSS vulnerability was discovered on the table structure page

Severity

We consider this to be a serious vulnerability

Summary

Multiple XSS vulnerabilities

Description

An XSS vulnerability was discovered on the user privileges page.

An XSS vulnerability was discovered in the error console.

An XSS vulnerability was discovered in the central columns feature.

An XSS vulnerability was discovered in the query bookmarks feature.

An XSS vulnerability was discovered in the user groups feature.

Severity

We consider this to be a serious vulnerability

Summary

DOS attack

Description

A Denial Of Service (DOS) attack was discovered in the way phpMyAdmin loads some JavaScript files.

Severity

We consider this to be of moderate severity

Summary

Multiple full path disclosure vulnerabilities

Description

This PMASA contains information on multiple full-path disclosure vulnerabilities reported in phpMyAdmin.

By specially crafting requests in the following areas, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed.

Setup script

Example OpenID authentication script

Severity

We consider these vulnerabilities to be non-critical.

Summary

XSS through FPD

Description

With a specially crafted request, it is possible to trigger an XSS attack through the example OpenID authentication script.

Severity

We do not consider this vulnerability to be secure due to the non-standard required PHP setting for html_errors.

Summary

XSS in partition range functionality

Description

A vulnerability was reported allowing a specially crafted table parameters to cause an XSS attack through the table structure page.

Severity

We consider this vulnerability to be severe.

Summary

Multiple XSS vulnerabilities

Description

A vulnerability was reported allowing a specially crafted table name to cause an XSS attack through the functionality to check database privileges.

This XSS doesn't exist in some translations due to different quotes being used there (eg. Czech).

A vulnerability was reported allowing a specifically-configured MySQL server to execute an XSS attack. This particular attack requires configuring the MySQL server log_bin directive with the payload.

Several XSS vulnerabilities were found with the Transformation feature

Several XSS vulnerabilities were found in AJAX error handling

Several XSS vulnerabilities were found in the Designer feature

An XSS vulnerability was found in the charts feature

An XSS vulnerability was found in the zoom search feature

Severity

We consider these attacks to be of moderate severity.

Summary

Unsafe handling of preg_replace parameters

Description

In some versions of PHP, it's possible for an attacker to pass parameters to the preg_replace() function which can allow the execution of arbitrary PHP code. This code is not properly sanitized in phpMyAdmin as part of the table search and replace feature.

Severity

We consider this vulnerability to be of moderate severity.

Summary

Referrer leak in transformations

Description

A vulnerability was reported where a specially crafted Transformation could be used to leak information including the authentication token. This could be used to direct a CSRF attack against a user.

Furthermore, the CSP code used in version 4.0.x is outdated and has been updated to more modern standards.

Severity

We consider this to be of moderate severity

https://www.phpmyadmin.net/security/PMASA-2016-17/ https://www.phpmyadmin.net/security/PMASA-2016-18/ https://www.phpmyadmin.net/security/PMASA-2016-19/ https://www.phpmyadmin.net/security/PMASA-2016-20/ https://www.phpmyadmin.net/security/PMASA-2016-21/ https://www.phpmyadmin.net/security/PMASA-2016-22/ https://www.phpmyadmin.net/security/PMASA-2016-23/ https://www.phpmyadmin.net/security/PMASA-2016-24/ https://www.phpmyadmin.net/security/PMASA-2016-25/ https://www.phpmyadmin.net/security/PMASA-2016-26/ https://www.phpmyadmin.net/security/PMASA-2016-27/ https://www.phpmyadmin.net/security/PMASA-2016-28/ CVE-2016-5701 CVE-2016-5702 CVE-2016-5703 CVE-2016-5704 CVE-2016-5705 CVE-2016-5706 CVE-2016-5730 CVE-2016-5731 CVE-2016-5732 CVE-2016-5733 CVE-2016-5734 CVE-2016-5739 2016-06-23 2016-07-01 haproxy -- denial of service haproxy 1.6.01.6.5_1

HAproxy reports:

HAproxy 1.6.x before 1.6.6, when a deny comes from a reqdeny rule, allows remote attackers to cause a denial of service (uninitialized memory access and crash) or possibly have unspecified other impact via unknown vectors.

http://www.openwall.com/lists/oss-security/2016/06/09/5 CVE-2016-5360 2016-06-09 2016-06-30 libtorrent-rasterbar -- denial of service libtorrent-rasterbar 1.1.1

Brandon Perry reports:

The parse_chunk_header function in libtorrent before 1.1.1 allows remote attackers to cause a denial of service (crash) via a crafted (1) HTTP response or possibly a (2) UPnP broadcast.

https://github.com/arvidn/libtorrent/issues/780 CVE-2016-5301 2016-06-03 2016-06-30 expat2 -- denial of service expat 2.1.1_2

Adam Maris reports:

It was found that original patch for issues CVE-2015-1283 and CVE-2015-2716 used overflow checks that could be optimized out by some compilers applying certain optimization settings, which can cause the vulnerability to remain even after applying the patch.

https://bugzilla.redhat.com/show_bug.cgi?id=1344251 CVE-2016-4472 2016-06-09 2016-06-30 2016-11-30 dnsmasq -- denial of service dnsmasq 2.76,1 dnsmasq-devel 2.76.0test1

reports:

Dnsmasq before 2.76 allows remote servers to cause a denial of service (crash) via a reply with an empty DNS address that has an (1) A or (2) AAAA record defined locally.

http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2016q2/010479.html http://www.openwall.com/lists/oss-security/2016/06/03/7 CVE-2015-8899 2016-04-18 2016-06-30 2016-06-30 Python -- HTTP Header Injection in Python urllib python27 2.7.10 python33 0 python34 3.4.4 python35 3.5.0

Guido Vranken reports:

HTTP header injection in urrlib2/urllib/httplib/http.client with newlines in header values, where newlines have a semantic consequence of denoting the start of an additional header line.

https://bugs.python.org/issue22928 http://blog.blindspotsecurity.com/2016/06/advisory-http-header-injection-in.html http://www.openwall.com/lists/oss-security/2016/06/14/7 CVE-2016-5699 2014-11-24 2016-06-30 2016-07-04 openssl -- denial of service openssl 1.0.2_14

Mitre reports:

OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact by leveraging unexpected malloc behavior, related to s3_srvr.c, ssl_sess.c, and t1_lib.c.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2177 ihttps://bugzilla.redhat.com/show_bug.cgi?id=1341705 https://www.openssl.org/blog/blog/2016/06/27/undefined-pointer-arithmetic/ CVE-2016-2177 2016-06-01 2016-06-30 tomcat -- remote DoS in the Apache Commons FileUpload component tomcat7 7.0.70 tomcat8 8.0.36

Mark Thomas reports:

CVE-2016-3092 is a denial of service vulnerability that has been corrected in the Apache Commons FileUpload component. It occurred when the length of the multipart boundary was just below the size of the buffer (4096 bytes) used to read the uploaded file. This caused the file upload process to take several orders of magnitude longer than if the boundary length was the typical tens of bytes.

CVE-2016-3092 ports/209669 http://tomcat.apache.org/security-7.html http://tomcat.apache.org/security-8.html http://mail-archives.apache.org/mod_mbox/tomcat-announce/201606.mbox/%3C6223ece6-2b41-ef4f-22f9-d3481e492832%40apache.org%3E 2016-06-20 2016-06-26 wordpress -- multiple vulnerabilities wordpress 4.5.3,1 de-wordpress ja-wordpress ru-wordpress zh-wordpress-zh_CN zh-wordpress-zh_TW 4.5.3

Adam Silverstein reports:

WordPress 4.5.3 is now available. This is a security release for all previous versions and we strongly encourage you to update your sites immediately.

WordPress versions 4.5.2 and earlier are affected by several security issues: redirect bypass in the customizer, reported by Yassine Aboukir; two different XSS problems via attachment names, reported by Jouko Pynnönenand Divyesh Prajapati; revision history information disclosure, reported independently by John Blackbourn from the WordPress security team and by Dan Moen from the Wordfence Research Team; oEmbed denial of service reported by Jennifer Dodd from Automattic; unauthorized category removal from a post, reported by David Herrera from Alley Interactive; password change via stolen cookie, reported by Michael Adams from the WordPress security team; and some less secure sanitize_file_name edge cases reported by Peter Westwood of the WordPress security team.

CVE-2016-5832 CVE-2016-5833 CVE-2016-5834 CVE-2016-5835 CVE-2016-5836 CVE-2016-5837 CVE-2016-5838 CVE-2016-5839 ports/210480 ports/210581 https://wordpress.org/news/2016/06/wordpress-4-5-3/ http://www.openwall.com/lists/oss-security/2016/06/23/9 2016-06-18 2016-06-25 php -- multiple vulnerabilities php55 php55-gd php55-mbstring php55-wddx php55-zip 5.5.37 php56 php56-gd php56-mbstring php56-phar php56-wddx php56-zip 5.6.23 php70 php70-gd php70-mbstring php70-phar php70-wddx php70-zip 7.0.8

The PHP Group reports:

Core:

Fixed bug #72268 (Integer Overflow in nl2br())

Fixed bug #72275 (Integer Overflow in json_encode()/ json_decode()/ json_utf8_to_utf16())

Fixed bug #72400 (Integer Overflow in addcslashes/ addslashes)

Fixed bug #72403 (Integer Overflow in Length of String-typed ZVAL)

GD:

Fixed bug #66387 (Stack overflow with imagefilltoborder) (CVE-2015-8874)

Fixed bug #72298 (pass2_no_dither out-of-bounds access)

Fixed bug #72339 (Integer Overflow in _gd2GetHeader() resulting in heap overflow) (CVE-2016-5766)

Fixed bug #72407 (NULL Pointer Dereference at _gdScaleVert)

Fixed bug #72446 (Integer Overflow in gdImagePaletteToTrueColor() resulting in heap overflow) (CVE-2016-5767)

mbstring:

Fixed bug #72402 (_php_mb_regex_ereg_replace_exec - double free) (CVE-2016-5768)

mcrypt:

Fixed bug #72455 (Heap Overflow due to integer overflows) (CVE-2016-5769)

Phar:

Fixed bug #72321 (invalid free in phar_extract_file()). (PHP 5.6/7.0 only)

SPL:

Fixed bug #72262 (int/size_t confusion in SplFileObject::fread) (CVE-2016-5770)

Fixed bug #72433 (Use After Free Vulnerability in PHP's GC algorithm and unserialize) (CVE-2016-5771)

WDDX:

Fixed bug #72340 (Double Free Courruption in wddx_deserialize) (CVE-2016-5772)

zip:

Fixed bug #72434 (ZipArchive class Use After Free Vulnerability in PHP's GC algorithm and unserialize). (CVE-2016-5773)

CVE-2015-8874 CVE-2016-5766 CVE-2016-5767 CVE-2016-5768 CVE-2016-5769 CVE-2016-5770 CVE-2016-5771 CVE-2016-5772 CVE-2016-5773 ports/210491 ports/210502 http://php.net/ChangeLog-5.php#5.5.37 http://php.net/ChangeLog-5.php#5.6.23 http://php.net/ChangeLog-7.php#7.0.8 2016-06-23 2016-06-25 libarchive -- multiple vulnerabilities libarchive 3.2.1,1

Hanno Bock and Cisco Talos report:

Out of bounds heap read in RAR parser

Signed integer overflow in ISO parser

TALOS-2016-0152 [CVE-2016-4300]: 7-Zip read_SubStreamsInfo Integer Overflow

TALOS-2016-0153 [CVE-2016-4301]: mtree parse_device Stack Based Buffer Overflow

TALOS-2016-0154 [CVE-2016-4302]: Libarchive Rar RestartModel Heap Overflow

http://openwall.com/lists/oss-security/2016/06/23/6 https://github.com/libarchive/libarchive/issues/521 https://github.com/libarchive/libarchive/issues/717#event-697151157 http://blog.talosintel.com/2016/06/the-poisoned-archives.html CVE-2015-8934 CVE-2016-4300 CVE-2016-4301 CVE-2016-4302 2016-06-23 2016-06-23 piwik -- XSS vulnerability piwik 2.16.1

Piwik reports:

iThe Piwik Security team is grateful for the responsible disclosures by our security researchers: Egidio Romano (granted a critical security bounty), James Kettle and Paweł Bartunek (XSS) and Emanuel Bronshtein (limited XSS).

http://piwik.org/changelog/piwik-2-16-1/ 2016-04-11 2016-06-23 wget -- HTTP to FTP redirection file name confusion vulnerability wget 1.18

Giuseppe Scrivano reports:

On a server redirect from HTTP to a FTP resource, wget would trust the HTTP server and uses the name in the redirected URL as the destination filename.

http://lists.gnu.org/archive/html/info-gnu/2016-06/msg00004.html CVE-2016-4971 2016-06-09 2016-06-21 libxslt -- Denial of Service libxslt 1.1.29

Google reports:

[583156] Medium CVE-2016-1683: Out-of-bounds access in libxslt. Credit to Nicolas Gregoire.

[583171] Medium CVE-2016-1684: Integer overflow in libxslt. Credit to Nicolas Gregoire.

http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html CVE-2016-1683 CVE-2016-1684 2016-05-25 2016-06-20 flash -- multiple vulnerabilities linux-c6-flashplugin linux-c6_64-flashplugin linux-f10-flashplugin 11.2r202.626

Adobe reports:

These updates resolve type confusion vulnerabilities that could lead to code execution (CVE-2016-4144, CVE-2016-4149).

These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2016-4142, CVE-2016-4143, CVE-2016-4145, CVE-2016-4146, CVE-2016-4147, CVE-2016-4148).

These updates resolve heap buffer overflow vulnerabilities that could lead to code execution (CVE-2016-4135, CVE-2016-4136, CVE-2016-4138).

These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2016-4122, CVE-2016-4123, CVE-2016-4124, CVE-2016-4125, CVE-2016-4127, CVE-2016-4128, CVE-2016-4129, CVE-2016-4130, CVE-2016-4131, CVE-2016-4132, CVE-2016-4133, CVE-2016-4134, CVE-2016-4137, CVE-2016-4141, CVE-2016-4150, CVE-2016-4151, CVE-2016-4152, CVE-2016-4153, CVE-2016-4154, CVE-2016-4155, CVE-2016-4156, CVE-2016-4166, CVE-2016-4171).

These updates resolve a vulnerability in the directory search path used to find resources that could lead to code execution (CVE-2016-4140).

These updates resolve a vulnerability that could be exploited to bypass the same-origin-policy and lead to information disclosure (CVE-2016-4139).

CVE-2016-4122 CVE-2016-4123 CVE-2016-4124 CVE-2016-4125 CVE-2016-4127 CVE-2016-4128 CVE-2016-4129 CVE-2016-4130 CVE-2016-4131 CVE-2016-4132 CVE-2016-4133 CVE-2016-4134 CVE-2016-4135 CVE-2016-4136 CVE-2016-4137 CVE-2016-4138 CVE-2016-4139 CVE-2016-4140 CVE-2016-4141 CVE-2016-4142 CVE-2016-4143 CVE-2016-4144 CVE-2016-4145 CVE-2016-4146 CVE-2016-4147 CVE-2016-4148 CVE-2016-4149 CVE-2016-4150 CVE-2016-4151 CVE-2016-4152 CVE-2016-4153 CVE-2016-4154 CVE-2016-4155 CVE-2016-4156 CVE-2016-4166 CVE-2016-4171 https://helpx.adobe.com/security/products/flash-player/apsb16-18.html 2016-06-16 2016-06-19 flash -- multiple vulnerabilities linux-c6-flashplugin linux-c6_64-flashplugin linux-f10-flashplugin 11.2r202.621

Adobe reports:

These updates resolve type confusion vulnerabilities that could lead to code execution (CVE-2016-1105, CVE-2016-4117).

These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2016-1097, CVE-2016-1106, CVE-2016-1107, CVE-2016-1108, CVE-2016-1109, CVE-2016-1110, CVE-2016-4108, CVE-2016-4110, CVE-2016-4121).

These updates resolve a heap buffer overflow vulnerability that could lead to code execution (CVE-2016-1101).

These updates resolve a buffer overflow vulnerability that could lead to code execution (CVE-2016-1103).

These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2016-1096, CVE-2016-1098, CVE-2016-1099, CVE-2016-1100, CVE-2016-1102, CVE-2016-1104, CVE-2016-4109, CVE-2016-4111, CVE-2016-4112, CVE-2016-4113, CVE-2016-4114, CVE-2016-4115, CVE-2016-4120, CVE-2016-4160, CVE-2016-4161, CVE-2016-4162, CVE-2016-4163).

These updates resolve a vulnerability in the directory search path used to find resources that could lead to code execution (CVE-2016-4116).

CVE-2016-1096 CVE-2016-1097 CVE-2016-1098 CVE-2016-1099 CVE-2016-1100 CVE-2016-1101 CVE-2016-1102 CVE-2016-1103 CVE-2016-1104 CVE-2016-1105 CVE-2016-1106 CVE-2016-1107 CVE-2016-1108 CVE-2016-1109 CVE-2016-1110 CVE-2016-4108 CVE-2016-4109 CVE-2016-4110 CVE-2016-4111 CVE-2016-4112 CVE-2016-4113 CVE-2016-4114 CVE-2016-4115 CVE-2016-4116 CVE-2016-4117 CVE-2016-4120 CVE-2016-4121 CVE-2016-4160 CVE-2016-4161 CVE-2016-4162 CVE-2016-4163 https://helpx.adobe.com/security/products/flash-player/apsb16-15.html 2016-05-12 2016-06-19 flash -- multiple vulnerabilities linux-c6-flashplugin linux-c6_64-flashplugin linux-f10-flashplugin 11.2r202.616

Adobe reports:

These updates harden a mitigation against JIT spraying attacks that could be used to bypass memory layout randomization mitigations (CVE-2016-1006).

These updates resolve type confusion vulnerabilities that could lead to code execution (CVE-2016-1015, CVE-2016-1019).

These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2016-1011, CVE-2016-1013, CVE-2016-1016, CVE-2016-1017, CVE-2016-1031).

These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2016-1012, CVE-2016-1020, CVE-2016-1021, CVE-2016-1022, CVE-2016-1023, CVE-2016-1024, CVE-2016-1025, CVE-2016-1026, CVE-2016-1027, CVE-2016-1028, CVE-2016-1029, CVE-2016-1032, CVE-2016-1033).

These updates resolve a stack overflow vulnerability that could lead to code execution (CVE-2016-1018).

These updates resolve a security bypass vulnerability (CVE-2016-1030).

These updates resolve a vulnerability in the directory search path used to find resources that could lead to code execution (CVE-2016-1014).

CVE-2016-1006 CVE-2016-1011 CVE-2016-1012 CVE-2016-1013 CVE-2016-1014 CVE-2016-1015 CVE-2016-1016 CVE-2016-1017 CVE-2016-1018 CVE-2016-1019 CVE-2016-1020 CVE-2016-1021 CVE-2016-1022 CVE-2016-1023 CVE-2016-1024 CVE-2016-1025 CVE-2016-1026 CVE-2016-1027 CVE-2016-1028 CVE-2016-1029 CVE-2016-1030 CVE-2016-1031 CVE-2016-1032 CVE-2016-1033 https://helpx.adobe.com/security/products/flash-player/apsb16-10.html 2016-04-07 2016-06-19 chromium -- multiple vulnerabilities chromium chromium-npapi chromium-pulse 51.0.2704.103

Google Chrome Releases reports:

3 security fixes in this release, including:

[620742] CVE-2016-1704: Various fixes from internal audits, fuzzing and other initiatives.

CVE-2016-1704 https://googlechromereleases.blogspot.nl/2016/06/stable-channel-update_16.html 2016-06-16 2016-06-17 Python -- Integer overflow in zipimport module python35 3.5.1_3 python34 3.4.4_3 python33 3.3.6_5 python27 2.7.11_3

Python reports:

Possible integer overflow and heap corruption in zipimporter.get_data()

http://bugs.python.org/issue26171 CVE-2016-5636 2016-01-21 2016-06-17 drupal -- multiple vulnerabilities drupal7 7.44 drupal8 8.1.3

Drupal Security Team reports:

Saving user accounts can sometimes grant the user all roles (User module - Drupal 7 - Moderately Critical)

Views can allow unauthorized users to see Statistics information (Views module - Drupal 8 - Less Critical)

CVE-2016-6211 CVE-2016-6212 https://www.drupal.org/SA-CORE-2016-002 http://www.openwall.com/lists/oss-security/2016/07/13/7 2016-06-15 2016-06-17 2016-07-16 botan -- multiple vulnerabilities botan110 1.10.13

Jack Lloyd reports:

Botan 1.10.13 has been released backporting some side channel protections for ECDSA signatures (CVE-2016-2849) and PKCS #1 RSA decryption (CVE-2015-7827).

CVE-2016-2849 CVE-2015-7827 https://lists.randombit.net/pipermail/botan-devel/2016-April/002101.html 2016-04-28 2016-06-14 botan -- cryptographic vulnerability botan110 1.10.8

MITRE reports:

The Miller-Rabin primality check in Botan before 1.10.8 and 1.11.x before 1.11.9 improperly uses a single random base, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a DH group.

CVE-2014-9742 2014-04-11 2016-06-14 VLC -- Possibly remote code execution via crafted file vlc 2.2.4,4 vlc-qt4 2.2.4,4

The VLC project reports:

Fix out-of-bound write in adpcm QT IMA codec (CVE-2016-5108)

CVE-2016-5108 2016-05-25 2016-06-11 roundcube -- XSS vulnerability roundcube 1.1.5_1,1

Roundcube reports:

Fix XSS issue in href attribute on area tag (#5240).

CVE-2016-5103 ports/209841 https://github.com/roundcube/roundcubemail/issues/5240 http://seclists.org/oss-sec/2016/q2/414 2016-05-06 2016-06-10 OpenSSL -- vulnerability in DSA signing openssl 1.0.2_13 libressl 2.2.9 2.3.02.3.6 libressl-devel 2.4.1

The OpenSSL team reports:

Operations in the DSA signing algorithm should run in constant time in order to avoid side channel attacks. A flaw in the OpenSSL DSA implementation means that a non-constant time codepath is followed for certain operations. This has been demonstrated through a cache-timing attack to be sufficient for an attacker to recover the private DSA key.

https://git.openssl.org/?p=openssl.git;a=commit;h=399944622df7bd81af62e67ea967c470534090e2 CVE-2016-2178 2016-06-09 2016-06-09 2016-12-20 expat -- multiple vulnerabilities expat 2.1.1_1

Sebastian Pipping reports:

CVE-2012-6702 -- Resolve troublesome internal call to srand that was introduced with Expat 2.1.0 when addressing CVE-2012-0876 (issue #496)

CVE-2016-5300 -- Use more entropy for hash initialization than the original fix to CVE-2012-0876.

CVE-2012-6702 CVE-2016-5300 ports/210155 https://sourceforge.net/p/expat/code_git/ci/07cc2fcacf81b32b2e06aa918df51756525240c0/ http://www.openwall.com/lists/oss-security/2016/03/18/3 2016-03-18 2016-06-09 2016-11-06 iperf3 -- buffer overflow iperf3 3.13.1.3 3.03.0.12

ESnet reports:

A malicious process can connect to an iperf3 server and, by sending a malformed message on the control channel, corrupt the server process's heap area. This can lead to a crash (and a denial of service), or theoretically a remote code execution as the user running the iperf3 server. A malicious iperf3 server could potentially mount a similar attack on an iperf3 client.

CVE-2016-4303 https://raw.githubusercontent.com/esnet/security/master/cve-2016-4303/esnet-secadv-2016-0001.txt.asc 2016-06-08 2016-06-08 gnutls -- file overwrite by setuid programs gnutls 3.4.123.4.13

gnutls.org reports:

Setuid programs using GnuTLS 3.4.12 could potentially allow an attacker to overwrite and corrupt arbitrary files in the filesystem.

https://gnutls.org/security.html#GNUTLS-SA-2016-1 2016-06-06 2016-06-07 NSS -- multiple vulnerabilities nss 3.23 linux-c6-nss linux-c7-nss 3.21.3 linux-seamonkey 2.44

Mozilla Foundation reports:

Mozilla has updated the version of Network Security Services (NSS) library used in Firefox to NSS 3.23. This addresses four moderate rated networking security issues reported by Mozilla engineers Tyson Smith and Jed Davis.

CVE-2016-2834 https://www.mozilla.org/security/advisories/mfsa2016-61/ https://hg.mozilla.org/projects/nss/rev/1ba7cd83c672 https://hg.mozilla.org/projects/nss/rev/8d78a5ae260a https://hg.mozilla.org/projects/nss/rev/5fde729fdbff https://hg.mozilla.org/projects/nss/rev/329932eb1700 2016-06-07 2016-06-07 2016-11-23 mozilla -- multiple vulnerabilities firefox 47.0,1 seamonkey linux-seamonkey 2.44 firefox-esr 45.2.0,1 linux-firefox 45.2.0,2 libxul thunderbird linux-thunderbird 45.2.0

Mozilla Foundation reports:

MFSA 2016-49 Miscellaneous memory safety hazards (rv:47.0 / rv:45.2)

MFSA 2016-50 Buffer overflow parsing HTML5 fragments

MFSA 2016-51 Use-after-free deleting tables from a contenteditable document

MFSA 2016-52 Addressbar spoofing though the SELECT element

MFSA 2016-54 Partial same-origin-policy through setting location.host through data URI

MFSA 2016-56 Use-after-free when textures are used in WebGL operations after recycle pool destruction

MFSA 2016-57 Incorrect icon displayed on permissions notifications

MFSA 2016-58 Entering fullscreen and persistent pointerlock without user permission

MFSA 2016-59 Information disclosure of disabled plugins through CSS pseudo-classes

MFSA 2016-60 Java applets bypass CSP protections

CVE-2016-2815 CVE-2016-2818 CVE-2016-2819 CVE-2016-2821 CVE-2016-2822 CVE-2016-2825 CVE-2016-2828 CVE-2016-2829 CVE-2016-2831 CVE-2016-2832 CVE-2016-2833 https://www.mozilla.org/security/advisories/mfsa2016-49/ https://www.mozilla.org/security/advisories/mfsa2016-50/ https://www.mozilla.org/security/advisories/mfsa2016-51/ https://www.mozilla.org/security/advisories/mfsa2016-52/ https://www.mozilla.org/security/advisories/mfsa2016-54/ https://www.mozilla.org/security/advisories/mfsa2016-56/ https://www.mozilla.org/security/advisories/mfsa2016-57/ https://www.mozilla.org/security/advisories/mfsa2016-58/ https://www.mozilla.org/security/advisories/mfsa2016-59/ https://www.mozilla.org/security/advisories/mfsa2016-60/ 2016-06-07 2016-06-07 chromium -- multiple vulnerabilities chromium chromium-npapi chromium-pulse 51.0.2704.79

Google Chrome Releases reports:

15 security fixes in this release, including:

601073] High CVE-2016-1696: Cross-origin bypass in Extension bindings. Credit to anonymous.

[613266] High CVE-2016-1697: Cross-origin bypass in Blink. Credit to Mariusz Mlynski.

[603725] Medium CVE-2016-1698: Information leak in Extension bindings. Credit to Rob Wu.

[607939] Medium CVE-2016-1699: Parameter sanitization failure in DevTools. Credit to Gregory Panakkal.

[608104] Medium CVE-2016-1700: Use-after-free in Extensions. Credit to Rob Wu.

[608101] Medium CVE-2016-1701: Use-after-free in Autofill. Credit to Rob Wu.

[609260] Medium CVE-2016-1702: Out-of-bounds read in Skia. Credit to cloudfuzzer.

[616539] CVE-2016-1703: Various fixes from internal audits, fuzzing and other initiatives.

CVE-2016-1695 CVE-2016-1696 CVE-2016-1697 CVE-2016-1698 CVE-2016-1699 CVE-2016-1700 CVE-2016-1701 CVE-2016-1702 CVE-2016-1703 http://googlechromereleases.blogspot.nl/2016/06/stable-channel-update.html 2016-06-01 2016-06-06 openafs -- multiple vulnerabilities openafs 1.6.17

The OpenAFS development team reports:

Foreign users can bypass access controls to create groups as system:administrators, including in the user namespace and the system: namespace.

The contents of uninitialized memory are sent on the wire when clients perform certain RPCs. Depending on the RPC, the information leaked may come from kernel memory or userspace.

CVE-2016-2860 CVE-2016-4536 ports/209534 http://www.openafs.org/pages/security/OPENAFS-SA-2016-001.txt http://www.openafs.org/pages/security/OPENAFS-SA-2016-002.txt 2016-03-16 2016-06-05 openafs -- local DoS vulnerability openafs 1.6.16

The OpenAFS development team reports:

Avoid a potential denial of service issue, by fixing a bug in pioctl logic that allowed a local user to overrun a kernel buffer with a single NUL byte.

CVE-2015-8312 https://www.openafs.org/dl/1.6.16/RELNOTES-1.6.16 2016-03-16 2016-06-05 ikiwiki -- XSS vulnerability ikiwiki 3.20160509

Mitre reports:

Cross-site scripting (XSS) vulnerability in the cgierror function in CGI.pm in ikiwiki before 3.20160506 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving an error message.

CVE-2016-4561 ports/209593 2016-05-04 2016-06-05 h2o -- use after free on premature connection close h2o 1.7.3

Tim Newsha reports:

When H2O tries to disconnect a premature HTTP/2 connection, it calls free(3) to release memory allocated for the connection and immediately after then touches the memory. No malloc-related operation is performed by the same thread between the time it calls free and the time the memory is touched. Fixed by Frederik Deweerdt.

https://h2o.examp1e.net/vulnerabilities.html 2016-05-17 2016-06-01 nginx -- a specially crafted request might result in worker process crash nginx 1.4.01.8.1_3,2 1.10.0,21.10.1,2 nginx-devel 1.3.91.9.15_1 1.10.01.11.1

Maxim Dounin reports:

A problem was identified in nginx code responsible for saving client request body to a temporary file. A specially crafted request might result in worker process crash due to a NULL pointer dereference while writing client request body to a temporary file.

http://mailman.nginx.org/pipermail/nginx-announce/2016/000179.html CVE-2016-4450 2016-05-31 2016-05-31 2016-06-05 cacti -- multiple vulnerabilities cacti 0.8.8h

The Cacti Group, Inc. reports:

Changelog

bug:0002667: Cacti SQL Injection Vulnerability

bug:0002673: CVE-2016-3659 - Cacti graph_view.php SQL Injection Vulnerability

bug:0002656: Authentication using web authentication as a user not in the cacti database allows complete access (regression)

CVE-2016-3659 http://www.cacti.net/release_notes_0_8_8h.php http://bugs.cacti.net/view.php?id=2673 http://seclists.org/fulldisclosure/2016/Apr/4 http://packetstormsecurity.com/files/136547/Cacti-0.8.8g-SQL-Injection.html 2016-04-04 2016-05-28 openvswitch -- MPLS buffer overflow openvswitch 2.2.02.3.3 2.4.02.4.1

Open vSwitch reports:

Multiple versions of Open vSwitch are vulnerable to remote buffer overflow attacks, in which crafted MPLS packets could overflow the buffer reserved for MPLS labels in an OVS internal data structure. The MPLS packets that trigger the vulnerability and the potential for exploitation vary depending on version:

Open vSwitch 2.1.x and earlier are not vulnerable.

In Open vSwitch 2.2.x and 2.3.x, the MPLS buffer overflow can be exploited for arbitrary remote code execution.

In Open vSwitch 2.4.x, the MPLS buffer overflow does not obviously lead to a remote code execution exploit, but testing shows that it can allow a remote denial of service. See the mitigation section for details.

Open vSwitch 2.5.x is not vulnerable.

CVE-2016-2074 http://openvswitch.org/pipermail/announce/2016-March/000082.html http://openvswitch.org/pipermail/announce/2016-March/000083.html 2016-03-28 2016-05-29 2016-07-03 chromium -- multiple vulnerabilities chromium chromium-npapi chromium-pulse 51.0.2704.63

Google Chrome Releases reports:

42 security fixes in this release, including:

[590118] High CVE-2016-1672: Cross-origin bypass in extension bindings. Credit to Mariusz Mlynski.

[597532] High CVE-2016-1673: Cross-origin bypass in Blink. Credit to Mariusz Mlynski.

[598165] High CVE-2016-1674: Cross-origin bypass in extensions.i Credit to Mariusz Mlynski.

[600182] High CVE-2016-1675: Cross-origin bypass in Blink. Credit to Mariusz Mlynski.

[604901] High CVE-2016-1676: Cross-origin bypass in extension bindings. Credit to Rob Wu.

[602970] Medium CVE-2016-1677: Type confusion in V8. Credit to Guang Gong of Qihoo 360.

[595259] High CVE-2016-1678: Heap overflow in V8. Credit to Christian Holler.

[606390] High CVE-2016-1679: Heap use-after-free in V8 bindings. Credit to Rob Wu.

[589848] High CVE-2016-1680: Heap use-after-free in Skia. Credit to Atte Kettunen of OUSPG.

[613160] High CVE-2016-1681: Heap overflow in PDFium. Credit to Aleksandar Nikolic of Cisco Talos.

[579801] Medium CVE-2016-1682: CSP bypass for ServiceWorker. Credit to KingstonTime.

[601362] Medium CVE-2016-1685: Out-of-bounds read in PDFium. Credit to Ke Liu of Tencent's Xuanwu LAB.

[603518] Medium CVE-2016-1686: Out-of-bounds read in PDFium. Credit to Ke Liu of Tencent's Xuanwu LAB.

[603748] Medium CVE-2016-1687: Information leak in extensions. Credit to Rob Wu.

[604897] Medium CVE-2016-1688: Out-of-bounds read in V8. Credit to Max Korenko.

[606185] Medium CVE-2016-1689: Heap buffer overflow in media. Credit to Atte Kettunen of OUSPG.

[608100] Medium CVE-2016-1690: Heap use-after-free in Autofill. Credit to Rob Wu.

[597926] Low CVE-2016-1691: Heap buffer-overflow in Skia. Credit to Atte Kettunen of OUSPG.

[598077] Low CVE-2016-1692: Limited cross-origin bypass in ServiceWorker. Credit to Til Jasper Ullrich.

[598752] Low CVE-2016-1693: HTTP Download of Software Removal Tool. Credit to Khalil Zhani.

[603682] Low CVE-2016-1694: HPKP pins removed on cache clearance. Credit to Ryan Lester and Bryant Zadegan.

[614767] CVE-2016-1695: Various fixes from internal audits, fuzzing and other initiatives.

CVE-2016-1672 CVE-2016-1673 CVE-2016-1674 CVE-2016-1675 CVE-2016-1672 CVE-2016-1677 CVE-2016-1678 CVE-2016-1679 CVE-2016-1680 CVE-2016-1681 CVE-2016-1682 CVE-2016-1685 CVE-2016-1686 CVE-2016-1687 CVE-2016-1688 CVE-2016-1689 CVE-2016-1690 CVE-2016-1691 CVE-2016-1692 CVE-2016-1693 CVE-2016-1694 CVE-2016-1695 http://googlechromereleases.blogspot.nl/2016/05/stable-channel-update_25.html 2016-05-25 2016-05-28 2016-06-20 chromium -- multiple vulnerabilities chromium chromium-npapi chromium-pulse 50.0.2661.102

Google Chrome Releases reports:

5 security fixes in this release, including:

[605766] High CVE-2016-1667: Same origin bypass in DOM. Credit to Mariusz Mlynski.

[605910] High CVE-2016-1668: Same origin bypass in Blink V8 bindings. Credit to Mariusz Mlynski.

[606115] High CVE-2016-1669: Buffer overflow in V8. Credit to Choongwoo Han.

[578882] Medium CVE-2016-1670: Race condition in loader. Credit to anonymous.

[586657] Medium CVE-2016-1671: Directory traversal using the file scheme on Android. Credit to Jann Horn.

CVE-2016-1667 CVE-2016-1668 CVE-2016-1669 CVE-2016-1670 CVE-2016-1671 http://googlechromereleases.blogspot.nl/2016/05/stable-channel-update.html 2016-05-11 2016-05-28 chromium -- multiple vulnerablities chromium chromium-npapi chromium-pulse 50.0.2661.94

Google Chrome Releases reports:

9 security fixes in this release, including:

[574802] High CVE-2016-1660: Out-of-bounds write in Blink. Credit to Atte Kettunen of OUSPG.

[601629] High CVE-2016-1661: Memory corruption in cross-process frames. Credit to Wadih Matar.

[603732] High CVE-2016-1662: Use-after-free in extensions. Credit to Rob Wu.

[603987] High CVE-2016-1663: Use-after-free in Blink's V8 bindings. Credit to anonymous.

[597322] Medium CVE-2016-1664: Address bar spoofing. Credit to Wadih Matar.

[606181] Medium CVE-2016-1665: Information leak in V8. Credit to HyungSeok Han.

[607652] CVE-2016-1666: Various fixes from internal audits, fuzzing and other initiatives.

CVE-2016-1660 CVE-2016-1661 CVE-2016-1662 CVE-2016-1663 CVE-2016-1664 CVE-2016-1665 CVE-2016-1666 http://googlechromereleases.blogspot.nl/2016/04/stable-channel-update_28.html 2016-04-28 2016-05-28 php -- multiple vulnerabilities php70-gd php70-intl 7.0.7 php56 php56-gd 5.6.22 php55 php55-gd php55-phar 5.5.36

The PHP Group reports:

Core:

Fixed bug #72114 (Integer underflow / arbitrary null write in fread/gzread). (CVE-2016-5096) (PHP 5.5/5.6 only)

Fixed bug #72135 (Integer Overflow in php_html_entities). (CVE-2016-5094) (PHP 5.5/5.6 only)

GD:

Fixed bug #72227 (imagescale out-of-bounds read). (CVE-2013-7456)

Intl:

Fixed bug #72241 (get_icu_value_internal out-of-bounds read). (CVE-2016-5093)

Phar:

Fixed bug #71331 (Uninitialized pointer in phar_make_dirstream()). (CVE-2016-4343) (PHP 5.5 only)

CVE-2016-5096 CVE-2016-5094 CVE-2013-7456 CVE-2016-5093 CVE-2016-4343 ports/209779 http://php.net/ChangeLog-7.php#7.0.7 http://php.net/ChangeLog-5.php#5.6.22 http://php.net/ChangeLog-5.php#5.5.36 2016-05-26 2016-05-28 phpmyadmin -- XSS and sensitive data leakage phpmyadmin 4.6.04.6.2

The phpmyadmin development team reports:

Description

Because user SQL queries are part of the URL, sensitive information made as part of a user query can be exposed by clicking on external links to attackers monitoring user GET query parameters or included in the webserver logs.

Severity

We consider this to be non-critical.

Description

A specially crafted attack could allow for special HTML characters to be passed as URL encoded values and displayed back as special characters in the page.

Severity

We consider this to be non-critical.

https://www.phpmyadmin.net/security/PMASA-2016-14/ https://www.phpmyadmin.net/security/PMASA-2016-16/ CVE-2016-5097 CVE-2016-5099 2016-05-25 2016-05-25 2016-05-26 mediawiki -- multiple vulnerabilities mediawiki123 1.23.14 mediawiki124 1.24.6 mediawiki125 1.25.6 mediawiki126 1.26.3

Mediawiki reports:

Security fixes:

T122056: Old tokens are remaining valid within a new session

T127114: Login throttle can be tricked using non-canonicalized usernames

T123653: Cross-domain policy regexp is too narrow

T123071: Incorrectly identifying http link in a's href attributes, due to m modifier in regex

T129506: MediaWiki:Gadget-popups.js isn't renderable

T125283: Users occasionally logged in as different users after SessionManager deployment

T103239: Patrol allows click catching and patrolling of any page

T122807: [tracking] Check php crypto primatives

T98313: Graphs can leak tokens, leading to CSRF

T130947: Diff generation should use PoolCounter

T133507: Careless use of $wgExternalLinkTarget is insecure

T132874: API action=move is not rate limited

https://lists.wikimedia.org/pipermail/mediawiki-announce/2016-May/000188.html 2016-05-20 2016-05-24 hostapd and wpa_supplicant -- psk configuration parameter update allowing arbitrary data to be written wpa_supplicant 2.5_2 hostapd 2.6

Jouni Malinen reports:

psk configuration parameter update allowing arbitrary data to be written (2016-1 - CVE-2016-4476/CVE-2016-4477).

CVE-2016-4476 CVE-2016-4477 ports/209564 http://w1.fi/security/2016-1/psk-parameter-config-update.txt 2016-05-02 2016-05-20 2017-03-22 expat -- denial of service vulnerability on malformed input expat 2.1.1 linux-c6-expat 2.0.1_3 linux-c7-expat 2.1.0_1

Gustavo Grieco reports:

The Expat XML parser mishandles certain kinds of malformed input documents, resulting in buffer overflows during processing and error reporting. The overflows can manifest as a segmentation fault or as memory corruption during a parse operation. The bugs allow for a denial of service attack in many applications by an unauthenticated attacker, and could conceivably result in remote code execution.

CVE-2016-0718 ports/209360 http://www.openwall.com/lists/oss-security/2016/05/17/12 2016-05-17 2016-05-20 2016-11-30 Bugzilla security issues bugzilla44 4.4.12 bugzilla50 5.0.3

Bugzilla Security Advisory

A specially crafted bug summary could trigger XSS in dependency graphs. Due to an incorrect parsing of the image map generated by the dot script, a specially crafted bug summary could trigger XSS in dependency graphs.

CVE-2016-2803 https://bugzilla.mozilla.org/show_bug.cgi?id=1253263 2016-03-03 2016-05-17 OpenVPN -- Buffer overflow in PAM authentication and DoS through port sharing openvpn 2.3.11 openvpn-polarssl 2.3.11

Samuli Seppänen reports:

OpenVPN 2.3.11 [...] fixes two vulnerabilities: a port-share bug with DoS potential and a buffer overflow by user supplied data when using pam authentication.[...]

https://sourceforge.net/p/openvpn/mailman/message/35076507/ https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn23#OpenVPN2.3.11 2016-03-03 2016-05-14 imagemagick -- buffer overflow ImageMagick ImageMagick-nox11 6.9.4.1,1 ImageMagick7 ImageMagick7-nox11 7.0.0.0.b201507157.0.1.3

ImageMagick reports:

Fix a buffer overflow in magick/drag.c/DrawStrokePolygon().

http://legacy.imagemagick.org/script/changelog.php 2016-05-09 2016-05-13 jenkins -- multiple vulnerabilities jenkins 2.2 jenkins2 2.2 jenkins-lts 1.651.1

Jenkins Security Advisory:

Description

SECURITY-170 / CVE-2016-3721

Arbitrary build parameters are passed to build scripts as environment variables

SECURITY-243 / CVE-2016-3722

Malicious users with multiple user accounts can prevent other users from logging in

SECURITY-250 / CVE-2016-3723

Information on installed plugins exposed via API

SECURITY-266 / CVE-2016-3724

Encrypted secrets (e.g. passwords) were leaked to users with permission to read configuration

SECURITY-273 / CVE-2016-3725

Regular users can trigger download of update site metadata

SECURITY-276 / CVE-2016-3726

Open redirect to scheme-relative URLs

SECURITY-281 / CVE-2016-3727

Granting the permission to read node configurations allows access to overall system configuration

CVE-2016-3721 CVE-2016-3722 CVE-2016-3723 CVE-2016-3724 CVE-2016-3725 CVE-2016-3726 CVE-2016-3727 https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-05-11 2016-05-11 2016-05-12 perl5 -- taint mechanism bypass vulnerability perl5 5.18.4_21 5.20.05.20.3_12 5.22.05.22.1_8 perl5.18 5.18.05.18.4_21 perl5.20 5.20.05.20.3_12 perl5.22 5.22.05.22.1_8 perl 0

MITRE reports:

Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp.

CVE-2016-2381 ports/208879 2016-04-08 2016-05-10 2016-08-22 wordpress -- multiple vulnerabilities wordpress 4.5.2,1 de-wordpress ja-wordpress ru-wordpress zh-wordpress-zh_CN zh-wordpress-zh_TW 4.5.2

Helen Hou-Sandi reports:

WordPress 4.5.2 is now available. This is a security release for all previous versions and we strongly encourage you to update your sites immediately.

WordPress versions 4.5.1 and earlier are affected by a SOME vulnerability through Plupload, the third-party library WordPress uses for uploading files. WordPress versions 4.2 through 4.5.1 are vulnerable to reflected XSS using specially crafted URIs through MediaElement.js, the third-party library used for media players. MediaElement.js and Plupload have also released updates fixing these issues.

CVE-2016-4566 CVE-2016-4567 https://wordpress.org/news/2016/05/wordpress-4-5-2/ http://www.openwall.com/lists/oss-security/2016/05/07/7 2016-05-06 2016-05-10 libarchive -- RCE vulnerability libarchive 3.2.0,1

The libarchive project reports:

Heap-based buffer overflow in the zip_read_mac_metadata function in archive_read_support_format_zip.c in libarchive before 3.2.0 allows remote attackers to execute arbitrary code via crafted entry-size values in a ZIP archive.

CVE-2016-1541 https://github.com/libarchive/libarchive/commit/d0331e8e5b05b475f20b1f3101fe1ad772d7e7e7 2016-05-01 2016-05-09 2016-05-10 squid -- multiple vulnerabilities squid 3.0.03.5.18 squid-devel 4.0.04.0.10

The squid development team reports:

Problem Description:

Due to incorrect data validation of intercepted HTTP Request messages Squid is vulnerable to clients bypassing the protection against CVE-2009-0801 related issues. This leads to cache poisoning.

Severity:

This problem is serious because it allows any client, including browser scripts, to bypass local security and poison the proxy cache and any downstream caches with content from an arbitrary source.

Problem Description:

Due to incorrect input validation Squid is vulnerable to a header smuggling attack leading to cache poisoning and to bypass of same-origin security policy in Squid and some client browsers.

Severity:

This problem allows a client to smuggle Host header value past same-origin security protections to cause Squid operating as interception or reverse-proxy to contact the wrong origin server. Also poisoning any downstream cache which stores the response.

However, the cache poisoning is only possible if the caching agent (browser or explicit/forward proxy) is not following RFC 7230 processing guidelines and lets the smuggled value through.

Problem Description:

Due to incorrect pointer handling and reference counting Squid is vulnerable to a denial of service attack when processing ESI responses.

Severity:

These problems allow a remote server delivering certain ESI response syntax to trigger a denial of service for all clients accessing the Squid service.

Due to unrelated changes Squid-3.5 has become vulnerable to some regular ESI server responses also triggering one or more of these issues.

CVE-2016-4553 CVE-2016-4554 CVE-2016-4555 CVE-2016-4556 http://www.squid-cache.org/Advisories/SQUID-2016_7.txt http://www.squid-cache.org/Advisories/SQUID-2016_8.txt http://www.squid-cache.org/Advisories/SQUID-2016_9.txt 2016-05-06 2016-05-07 2016-05-09 ImageMagick -- multiple vulnerabilities ImageMagick ImageMagick-nox11 6.9.3.9_1,1 ImageMagick7 ImageMagick7-nox11 7.0.0.0.b201507157.0.1.0_1

Openwall reports:

Insufficient filtering for filename passed to delegate's command allows remote code execution during conversion of several file formats. Any service which uses ImageMagick to process user supplied images and uses default delegates.xml / policy.xml, may be vulnerable to this issue.

It is possible to make ImageMagick perform a HTTP GET or FTP request

It is possible to delete files by using ImageMagick's 'ephemeral' pseudo protocol which deletes files after reading.

It is possible to move image files to file with any extension in any folder by using ImageMagick's 'msl' pseudo protocol. msl.txt and image.gif should exist in known location - /tmp/ for PoC (in real life it may be web service written in PHP, which allows to upload raw txt files and process images with ImageMagick).

It is possible to get content of the files from the server by using ImageMagick's 'label' pseudo protocol.

CVE-2016-3714 CVE-2016-3715 CVE-2016-3716 CVE-2016-3717 CVE-2016-3718 http://www.openwall.com/lists/oss-security/2016/05/03/18 https://imagetragick.com/ 2016-05-03 2016-05-06 2016-05-07 jansson -- local denial of service vulnerabilities jansson 2.7_2

QuickFuzz reports:

A crash caused by stack exhaustion parsing a JSON was found.

http://www.openwall.com/lists/oss-security/2016/05/01/5 http://www.openwall.com/lists/oss-security/2016/05/02/1 CVE-2016-4425 2016-05-01 2016-05-04 OpenSSL -- multiple vulnerabilities openssl 1.0.2_11 linux-c6-openssl 1.0.1e_8 libressl 2.3.02.3.4 2.2.7 libressl-devel 2.3.4 FreeBSD 10.310.3_2 10.210.2_16 10.110.1_33 9.39.3_41

OpenSSL reports:

Memory corruption in the ASN.1 encoder

Padding oracle in AES-NI CBC MAC check

EVP_EncodeUpdate overflow

EVP_EncryptUpdate overflow

ASN.1 BIO excessive memory allocation

EBCDIC overread (OpenSSL only)

https://www.openssl.org/news/secadv/20160503.txt https://marc.info/?l=openbsd-tech&m=146228598730414 CVE-2016-2105 CVE-2016-2106 CVE-2016-2107 CVE-2016-2108 CVE-2016-2109 CVE-2016-2176 SA-16:17.openssl 2016-05-03 2016-05-03 2016-08-09 gitlab -- privilege escalation via "impersonate" feature gitlab 8.2.08.2.5 8.3.08.3.9 8.4.08.4.10 8.5.08.5.12 8.6.08.6.8 8.7.08.7.1

GitLab reports:

During an internal code review, we discovered a critical security flaw in the "impersonate" feature of GitLab. Added in GitLab 8.2, this feature was intended to allow an administrator to simulate being logged in as any other user.

A part of this feature was not properly secured and it was possible for any authenticated user, administrator or not, to "log in" as any other user, including administrators. Please see the issue for more details.

CVE-2016-4340 ports/209225 https://about.gitlab.com/2016/05/02/cve-2016-4340-patches/ https://gitlab.com/gitlab-org/gitlab-ce/issues/15548 2016-05-02 2016-05-03 php -- multiple vulnerabilities php70 php70-bcmath php70-exif php70-gd php70-xml 7.0.6 php56 php56-bcmath php56-exif php56-gd php56-xml 5.6.21 php55 php55-bcmath php55-exif php55-gd php55-xml 5.5.35

The PHP Group reports:

BCMath:

Fixed bug #72093 (bcpowmod accepts negative scale and corrupts _one_ definition).

Exif:

Fixed bug #72094 (Out of bounds heap read access in exif header processing).

GD:

Fixed bug #71912 (libgd: signedness vulnerability). (CVE-2016-3074)

Intl:

Fixed bug #72061 (Out-of-bounds reads in zif_grapheme_stripos with negative offset).

XML:

Fixed bug #72099 (xml_parse_into_struct segmentation fault).

CVE-2016-3074 ports/209145 http://www.php.net/ChangeLog-7.php#7.0.6 http://www.php.net/ChangeLog-5.php#5.6.21 http://www.php.net/ChangeLog-5.php#5.5.35 2016-04-28 2016-05-03 libksba -- local denial of service vulnerabilities libksba 1.3.3

Martin Prpic, Red Hat Product Security Team, reports:

Denial of Service due to stack overflow in src/ber-decoder.c.

Integer overflow in the BER decoder src/ber-decoder.c.

Integer overflow in the DN decoder src/dn.c.

CVE-2016-4353 CVE-2016-4354 CVE-2016-4355 CVE-2016-4356 http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libksba.git;a=commit;h=07116a314f4dcd4d96990bbd74db95a03a9f650a http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libksba.git;a=commit;h=aea7b6032865740478ca4b706850a5217f1c3887 http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libksba.git;a=commit;h=243d12fdec66a4360fbb3e307a046b39b5b4ffc3 https://security.gentoo.org/glsa/201604-04 http://www.openwall.com/lists/oss-security/2016/04/29/5 2015-04-08 2016-05-03 wireshark -- multiple vulnerabilities wireshark wireshark-lite wireshark-qt5 tshark tshark-lite 2.0.3

Wireshark development team reports:

The following vulnerabilities have been fixed:

wnpa-sec-2016-19

The NCP dissector could crash. (Bug 11591)

wnpa-sec-2016-20

TShark could crash due to a packet reassembly bug. (Bug 11799)

wnpa-sec-2016-21

The IEEE 802.11 dissector could crash. (Bug 11824, Bug 12187)

wnpa-sec-2016-22

The PKTC dissector could crash. (Bug 12206)

wnpa-sec-2016-23

The PKTC dissector could crash. (Bug 12242)

wnpa-sec-2016-24

The IAX2 dissector could go into an infinite loop. (Bug 12260)

wnpa-sec-2016-25

Wireshark and TShark could exhaust the stack. (Bug 12268)

wnpa-sec-2016-26

The GSM CBCH dissector could crash. (Bug 12278)

wnpa-sec-2016-27

MS-WSP dissector crash. (Bug 12341)

CVE-2016-4076 CVE-2016-4077 CVE-2016-4078 CVE-2016-4079 CVE-2016-4080 CVE-2016-4081 CVE-2016-4006 CVE-2016-4082 CVE-2016-4083 CVE-2016-4084 https://www.wireshark.org/docs/relnotes/wireshark-2.0.3.html http://www.openwall.com/lists/oss-security/2016/04/25/2 2016-04-22 2016-05-02 2016-07-04 mercurial -- arbitrary code execution vulnerability mercurial 3.8.1

Mercurial reports:

CVE-2016-3105: Arbitrary code execution when converting Git repos

CVE-2016-3105 https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_3.8_.2F_3.8.1_.282016-5-1.29 2016-05-01 2016-05-01 MySQL -- multiple vulnerabilities mariadb55-server 5.5.49 mariadb100-server 10.0.25 mariadb101-server 10.1.12 mysql55-server 5.5.49 mysql56-server 5.6.30 mysql57-server 5.7.12 percona55-server 5.5.49 percona-server 5.6.30

Oracle reports reports:

Critical Patch Update contains 31 new security fixes for Oracle MySQL 5.5.48, 5.6.29, 5.7.11 and earlier

http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html#AppendixMSQL https://mariadb.com/kb/en/mariadb/mariadb-5549-release-notes/ https://mariadb.com/kb/en/mariadb/mariadb-10025-release-notes/ https://mariadb.com/kb/en/mariadb/mariadb-10112-release-notes/ CVE-2016-0705 CVE-2016-0639 CVE-2015-3194 CVE-2016-0640 CVE-2016-0641 CVE-2016-3461 CVE-2016-2047 CVE-2016-0642 CVE-2016-0643 CVE-2016-0644 CVE-2016-0646 CVE-2016-0647 CVE-2016-0648 CVE-2016-0649 CVE-2016-0650 CVE-2016-0652 CVE-2016-0653 CVE-2016-0654 CVE-2016-0655 CVE-2016-0656 CVE-2016-0657 CVE-2016-0658 CVE-2016-0651 CVE-2016-0659 CVE-2016-0661 CVE-2016-0662 CVE-2016-0663 CVE-2016-0665 CVE-2016-0666 CVE-2016-0667 CVE-2016-0668 2016-04-19 2016-04-30 logstash -- password disclosure vulnerability logstash 2.1.02.3.2

Logstash developers report:

Passwords Printed in Log Files under Some Conditions

It was discovered that, in Logstash 2.1.0+, log messages generated by a stalled pipeline during shutdown will print plaintext contents of password fields. While investigating this issue we also discovered that debug logging has included this data for quite some time. Our latest releases fix both leaks. You will want to scrub old log files if this is of particular concern to you. This was fixed in issue #4965

https://www.elastic.co/blog/logstash-2.3.1-and-2.2.4-released#Passwords_Printed_in_Log_Files_under_Some_Conditions_18 https://github.com/elastic/logstash/pull/4965 2016-04-01 2016-04-28 subversion -- multiple vulnerabilities subversion 1.9.01.9.4 1.0.01.8.15 subversion18 1.0.01.8.15

Subversion project reports:

svnserve, the svn:// protocol server, can optionally use the Cyrus SASL library for authentication, integrity protection, and encryption. Due to a programming oversight, authentication against Cyrus SASL would permit the remote user to specify a realm string which is a prefix of the expected realm string.

Subversion's httpd servers are vulnerable to a remotely triggerable crash in the mod_authz_svn module. The crash can occur during an authorization check for a COPY or MOVE request with a specially crafted header value.

This allows remote attackers to cause a denial of service.

CVE-2016-2167 http://subversion.apache.org/security/CVE-2016-2167-advisory.txt CVE-2016-2168 http://subversion.apache.org/security/CVE-2016-2168-advisory.txt 2016-04-21 2016-04-28 ntp -- multiple vulnerabilities ntp 4.2.8p7 ntp-devel 4.3.92 FreeBSD 10.310.3_1 10.210.2_15 10.110.1_32 9.39.3_40

Network Time Foundation reports:

NTF's NTP Project has been notified of the following low- and medium-severity vulnerabilities that are fixed in ntp-4.2.8p7, released on Tuesday, 26 April 2016:

Bug 3020 / CVE-2016-1551: Refclock impersonation vulnerability, AKA: refclock-peering. Reported by Matt Street and others of Cisco ASIG

Bug 3012 / CVE-2016-1549: Sybil vulnerability: ephemeral association attack, AKA: ntp-sybil - MITIGATION ONLY. Reported by Matthew Van Gundy of Cisco ASIG

Bug 3011 / CVE-2016-2516: Duplicate IPs on unconfig directives will cause an assertion botch. Reported by Yihan Lian of the Cloud Security Team, Qihoo 360

Bug 3010 / CVE-2016-2517: Remote configuration trustedkey/requestkey values are not properly validated. Reported by Yihan Lian of the Cloud Security Team, Qihoo 360

Bug 3009 / CVE-2016-2518: Crafted addpeer with hmode > 7 causes array wraparound with MATCH_ASSOC. Reported by Yihan Lian of the Cloud Security Team, Qihoo 360

Bug 3008 / CVE-2016-2519: ctl_getitem() return value not always checked. Reported by Yihan Lian of the Cloud Security Team, Qihoo 360

Bug 3007 / CVE-2016-1547: Validate crypto-NAKs, AKA: nak-dos. Reported by Stephen Gray and Matthew Van Gundy of Cisco ASIG

Bug 2978 / CVE-2016-1548: Interleave-pivot - MITIGATION ONLY. Reported by Miroslav Lichvar of RedHat and separately by Jonathan Gardner of Cisco ASIG.

Bug 2952 / CVE-2015-7704: KoD fix: peer associations were broken by the fix for NtpBug2901, AKA: Symmetric active/passive mode is broken. Reported by Michael Tatarinov, NTP Project Developer Volunteer

Bug 2945 / Bug 2901 / CVE-2015-8138: Zero Origin Timestamp Bypass, AKA: Additional KoD Checks. Reported by Jonathan Gardner of Cisco ASIG

Bug 2879 / CVE-2016-1550: Improve NTP security against buffer comparison timing attacks, authdecrypt-timing, AKA: authdecrypt-timing. Reported independently by Loganaden Velvindron, and Matthew Van Gundy and Stephen Gray of Cisco ASIG.

SA-16:16.ntp CVE-2015-7704 CVE-2015-8138 CVE-2016-1547 CVE-2016-1548 CVE-2016-1549 CVE-2016-1550 CVE-2016-1551 CVE-2016-2516 CVE-2016-2517 CVE-2016-2518 CVE-2016-2519 http://support.ntp.org/bin/view/Main/SecurityNotice#April_2016_NTP_4_2_8p7_Security 2016-04-26 2016-04-27 2016-08-09 mozilla -- multiple vulnerabilities firefox linux-firefox 46.0,1 seamonkey linux-seamonkey 2.43 firefox-esr 39.0,145.1.0,1 38.8.0,1 libxul thunderbird linux-thunderbird 39.045.1.0 38.8.0

Mozilla Foundation reports:

MFSA 2016-39 Miscellaneous memory safety hazards (rv:46.0 / rv:45.1 / rv:38.8)

MFSA 2016-42 Use-after-free and buffer overflow in Service Workers

MFSA 2016-44 Buffer overflow in libstagefright with CENC offsets

MFSA 2016-45 CSP not applied to pages sent with multipart/x-mixed-replace

MFSA 2016-46 Elevation of privilege with chrome.tabs.update API in web extensions

MFSA 2016-47 Write to invalid HashMap entry through JavaScript.watch()

MFSA 2016-48 Firefox Health Reports could accept events from untrusted domains

CVE-2016-2804 CVE-2016-2805 CVE-2016-2806 CVE-2016-2807 CVE-2016-2808 CVE-2016-2811 CVE-2016-2812 CVE-2016-2814 CVE-2016-2816 CVE-2016-2817 CVE-2016-2820 https://www.mozilla.org/security/advisories/mfsa2016-39/ https://www.mozilla.org/security/advisories/mfsa2016-42/ https://www.mozilla.org/security/advisories/mfsa2016-44/ https://www.mozilla.org/security/advisories/mfsa2016-45/ https://www.mozilla.org/security/advisories/mfsa2016-46/ https://www.mozilla.org/security/advisories/mfsa2016-47/ https://www.mozilla.org/security/advisories/mfsa2016-48/ 2016-04-26 2016-04-26 phpmyfaq -- cross-site request forgery vulnerability phpmyfaq 2.8.27

The phpMyFAQ team reports:

The vulnerability exists due to application does not properly verify origin of HTTP requests in "Interface Translation" functionality.: A remote unauthenticated attacker can create a specially crafted malicious web page with CSRF exploit, trick a logged-in administrator to visit the page, spoof the HTTP request, as if it was coming from the legitimate user, inject and execute arbitrary PHP code on the target system with privileges of the webserver.

http://www.phpmyfaq.de/security/advisory-2016-04-11 https://www.htbridge.com/advisory/HTB23300 2016-04-11 2016-04-23 libtasn1 -- denial of service parsing malicious DER certificates libtasn1 4.8

GNU Libtasn1 NEWS reports:

Fixes to avoid an infinite recursion when decoding without the ASN1_DECODE_FLAG_STRICT_DER flag. Reported by Pascal Cuoq.

CVE-2016-4008 http://www.openwall.com/lists/oss-security/2016/04/13/3 http://git.savannah.gnu.org/gitweb/?p=libtasn1.git;a=blob_plain;f=NEWS;hb=e9bcdc86b920d72c9cffc2570d14eea2f6365b37 2016-04-11 2016-04-21 squid -- multiple vulnerabilities squid 3.5.17

Squid security advisory 2016:5 reports:

Due to incorrect buffer management Squid cachemgr.cgi tool is vulnerable to a buffer overflow when processing remotely supplied inputs relayed to it from Squid.

This problem allows any client to seed the Squid manager reports with data that will cause a buffer overflow when processed by the cachemgr.cgi tool. However, this does require manual administrator actions to take place. Which greatly reduces the impact and possible uses.

Squid security advisory 2016:6 reports:

Due to buffer overflow issues Squid is vulnerable to a denial of service attack when processing ESI responses. Due to incorrect input validation Squid is vulnerable to public information disclosure of the server stack layout when processing ESI responses. Due to incorrect input validation and buffer overflow Squid is vulnerable to remote code execution when processing ESI responses.

These problems allow ESI components to be used to perform a denial of service attack on the Squid service and all other services on the same machine. Under certain build conditions these problems allow remote clients to view large sections of the server memory. However, the bugs are exploitable only if you have built and configured the ESI features to be used by a reverse-proxy and if the ESI components being processed by Squid can be controlled by an attacker.

CVE-2016-4051 CVE-2016-4052 CVE-2016-4053 CVE-2016-4054 ports/208939 http://www.squid-cache.org/Advisories/SQUID-2016_5.txt http://www.squid-cache.org/Advisories/SQUID-2016_6.txt 2016-04-20 2016-04-21 ansible -- use of predictable paths in lxc_container ansible 2.0.0.02.0.2.0 ansible1 1.9.6

Ansible developers report:

CVE-2016-3096: do not use predictable paths in lxc_container

do not use a predictable filename for the LXC attach script

don't use predictable filenames for LXC attach script logging

don't set a predictable archive_path

this should prevent symlink attacks which could result in

data corruption

data leakage

privilege escalation

CVE-2016-3096 https://github.com/ansible/ansible-modules-extras/pull/1941/commits/8c6fe646ee79f5e55361b885b7efed5bec72d4a4 https://bugzilla.redhat.com/show_bug.cgi?id=1322925 2016-04-02 2016-04-20 proftpd -- vulnerability in mod_tls proftpd 1.3.5b 1.3.6.r1

MITRE reports:

The mod_tls module in ProFTPD before 1.3.5b and 1.3.6 before 1.3.6rc2 does not properly handle the TLSDHParamFile directive, which might cause a weaker than intended Diffie-Hellman (DH) key to be used and consequently allow attackers to have unspecified impact via unknown vectors.

CVE-2016-3125 2016-03-08 2016-04-20 chromium -- multiple vulnerabilities chromium chromium-npapi chromium-pulse 50.0.2661.75

Google Chrome Releases reports:

20 security fixes in this release, including:

[590275] High CVE-2016-1652: Universal XSS in extension bindings. Credit to anonymous.

[589792] High CVE-2016-1653: Out-of-bounds write in V8. Credit to Choongwoo Han.

[591785] Medium CVE-2016-1651: Out-of-bounds read in Pdfium JPEG2000 decoding. Credit to kdot working with HP's Zero Day Initiative.

[589512] Medium CVE-2016-1654: Uninitialized memory read in media. Credit to Atte Kettunen of OUSPG.

[582008] Medium CVE-2016-1655: Use-after-free related to extensions. Credit to Rob Wu.

[570750] Medium CVE-2016-1656: Android downloaded file path restriction bypass. Credit to Dzmitry Lukyanenko.

[567445] Medium CVE-2016-1657: Address bar spoofing. Credit to Luan Herrera.

[573317] Low CVE-2016-1658: Potential leak of sensitive information to malicious extensions. Credit to Antonio Sanso (@asanso) of Adobe.

[602697] CVE-2016-1659: Various fixes from internal audits, fuzzing and other initiatives.

CVE-2016-1651 CVE-2016-1652 CVE-2016-1653 CVE-2016-1654 CVE-2016-1655 CVE-2016-1656 CVE-2016-1657 CVE-2016-1658 CVE-2016-1659 http://googlechromereleases.blogspot.nl/2016/04/stable-channel-update_13.html 2016-04-13 2016-04-19 hostapd and wpa_supplicant -- multiple vulnerabilities wpa_supplicant 2.5_1 hostapd 2.6

Jouni Malinen reports:

wpa_supplicant unauthorized WNM Sleep Mode GTK control. (2015-6 - CVE-2015-5310)

EAP-pwd missing last fragment length validation. (2015-7 - CVE-2015-5315)

EAP-pwd peer error path failure on unexpected Confirm message. (2015-8 - CVE-2015-5316)

CVE-2015-5310 CVE-2015-5315 CVE-2015-5316 ports/208482 http://w1.fi/security/2015-6/wpa_supplicant-unauthorized-wnm-sleep-mode-gtk-control.txt http://w1.fi/security/2015-7/eap-pwd-missing-last-fragment-length-validation.txt http://w1.fi/security/2015-8/eap-pwd-unexpected-confirm.txt 2015-11-10 2016-04-19 2017-03-22 dhcpcd -- remote code execution/denial of service dhcpcd 6.9.1

MITRE reports:

The get_option function in dhcp.c in dhcpcd before 6.2.0, as used in dhcpcd 5.x in Android before 5.1 and other products, does not validate the relationship between length fields and the amount of data, which allows remote DHCP servers to execute arbitrary code or cause a denial of service (memory corruption) via a large length value of an option in a DHCPACK message.

CVE-2014-7912 http://roy.marples.name/projects/dhcpcd/info/d71cfd8aa203bffe 2015-06-19 2016-04-17 dhcpcd -- remote code execution/denial of service dhcpcd 6.10.2

MITRE reports:

The print_option function in dhcp-common.c in dhcpcd through 6.9.1, as used in dhcp.c in dhcpcd 5.x in Android before 5.1 and other products, misinterprets the return value of the snprintf function, which allows remote DHCP servers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted message.

CVE-2014-7913 ports/208702 http://roy.marples.name/projects/dhcpcd/info/528541c4c619520e 2016-01-22 2016-04-17 PJSIP -- TCP denial of service in PJProject pjsip 2.4.5 pjsip-extsrtp 2.4.5

The Asterisk project reports:

PJProject has a limit on the number of TCP connections that it can accept. Furthermore, PJProject does not close TCP connections it accepts. By default, this value is approximately 60.

An attacker can deplete the number of allowed TCP connections by opening TCP connections and sending no data to Asterisk.

If PJProject has been compiled in debug mode, then once the number of allowed TCP connections has been depleted, the next attempted TCP connection to Asterisk will crash due to an assertion in PJProject.

If PJProject has not been compiled in debug mode, then any further TCP connection attempts will be rejected. This makes Asterisk unable to process TCP SIP traffic.

Note that this only affects TCP/TLS, since UDP is connectionless.

http://downloads.asterisk.org/pub/security/AST-2016-005.html 2016-02-15 2016-04-15 asterisk -- Long Contact URIs in REGISTER requests can crash Asterisk asterisk13 13.8.1

The Asterisk project reports:

Asterisk may crash when processing an incoming REGISTER request if that REGISTER contains a Contact header with a lengthy URI.

This crash will only happen for requests that pass authentication. Unauthenticated REGISTER requests will not result in a crash occurring.

This vulnerability only affects Asterisk when using PJSIP as its SIP stack. The chan_sip module does not have this problem.

http://downloads.asterisk.org/pub/security/AST-2016-004.html 2016-01-19 2016-04-15 go -- remote denial of service go 1.6.1,1

Jason Buberel reports:

Go has an infinite loop in several big integer routines that makes Go programs vulnerable to remote denial of service attacks. Programs using HTTPS client authentication or the Go ssh server libraries are both exposed to this vulnerability.

CVE-2016-3959 http://www.openwall.com/lists/oss-security/2016/04/05/2 https://golang.org/cl/21533 2016-04-05 2016-04-14 samba -- multiple vulnerabilities samba36 3.6.03.6.25_3 samba4 4.0.04.0.26 samba41 4.1.04.1.23 samba42 4.2.04.2.11 samba43 4.3.04.3.8 samba44 4.4.04.4.2

Samba team reports:

[CVE-2015-5370] Errors in Samba DCE-RPC code can lead to denial of service (crashes and high cpu consumption) and man in the middle attacks.

[CVE-2016-2110] The feature negotiation of NTLMSSP is not downgrade protected. A man in the middle is able to clear even required flags, especially NTLMSSP_NEGOTIATE_SIGN and NTLMSSP_NEGOTIATE_SEAL.

[CVE-2016-2111] When Samba is configured as Domain Controller it allows remote attackers to spoof the computer name of a secure channel's endpoints, and obtain sensitive session information, by running a crafted application and leveraging the ability to sniff network traffic.

[CVE-2016-2112] A man in the middle is able to downgrade LDAP connections to no integrity protection.

[CVE-2016-2113] Man in the middle attacks are possible for client triggered LDAP connections (with ldaps://) and ncacn_http connections (with https://).

[CVE-2016-2114] Due to a bug Samba doesn't enforce required smb signing, even if explicitly configured.

[CVE-2016-2115] The protection of DCERPC communication over ncacn_np (which is the default for most the file server related protocols) is inherited from the underlying SMB connection.

[CVE-2016-2118] a.k.a. BADLOCK. A man in the middle can intercept any DCERPC traffic between a client and a server in order to impersonate the client and get the same privileges as the authenticated user account. This is most problematic against active directory domain controllers.

CVE-2015-5370 https://www.samba.org/samba/security/CVE-2015-5370.html CVE-2016-2110 https://www.samba.org/samba/security/CVE-2016-2110.html CVE-2016-2111 https://www.samba.org/samba/security/CVE-2016-2111.html CVE-2016-2112 https://www.samba.org/samba/security/CVE-2016-2112.html CVE-2016-2113 https://www.samba.org/samba/security/CVE-2016-2113.html CVE-2016-2114 https://www.samba.org/samba/security/CVE-2016-2114.html CVE-2016-2115 https://www.samba.org/samba/security/CVE-2016-2115.html CVE-2016-2118 https://www.samba.org/samba/security/CVE-2016-2118.html 2016-04-12 2016-04-12 2016-04-12 php -- multiple vulnerabilities php70 php70-fileinfo php70-mbstring php70-phar php70-snmp 7.0.5 php56 php56-fileinfo php56-mbstring php56-phar php56-snmp 5.6.20 php55 php55-fileinfo php55-mbstring php55-phar php55-snmp 5.5.34

The PHP Group reports:

Fileinfo:

Fixed bug #71527 (Buffer over-write in finfo_open with malformed magic file).

mbstring:

Fixed bug #71906 (AddressSanitizer: negative-size-param (-1) in mbfl_strcut).

Phar:

Fixed bug #71860 (Invalid memory write in phar on filename with \0 in name).

SNMP:

Fixed bug #71704 (php_snmp_error() Format String Vulnerability).

Standard:

Fixed bug #71798 (Integer Overflow in php_raw_url_encode).

ports/208465 http://php.net/ChangeLog-7.php#7.0.5 http://php.net/ChangeLog-5.php#5.6.20 http://php.net/ChangeLog-5.php#5.5.34 2016-03-31 2016-04-03 pcre -- heap overflow vulnerability pcre 8.38_1

Mitre reports:

The pcre_compile2 function in pcre_compile.c in PCRE 8.38 mishandles the /((?:F?+(?:^(?(R)a+\"){99}-))(?J)(?'R'(?'R'<((?'RR'(?'R'\){97)?J)?J)(?'R'(?'R'\){99|(:(?|(?'R')(\k'R')|((?'R')))H'R'R)(H'R))))))/ pattern and related patterns with named subgroups, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

CVE-2016-1283 ports/208260 https://bugs.exim.org/show_bug.cgi?id=1767 2016-02-27 2016-04-03 py-djblets -- Self-XSS vulnerability py27-djblets py32-djblets py33-djblets py34-djblets py35-djblets 0.9.2

Djblets Release Notes reports:

A recently-discovered vulnerability in the datagrid templates allows an attacker to generate a URL to any datagrid page containing malicious code in a column sorting value. If the user visits that URL and then clicks that column, the code will execute.

The cause of the vulnerability was due to a template not escaping user-provided values.

https://www.reviewboard.org/docs/releasenotes/djblets/0.9.2/ 2016-03-01 2016-04-03 moodle -- multiple vulnerabilities moodle28 2.8.11 moodle29 2.9.5 moodle30 3.0.3

Marina Glancy reports:

MSA-16-0003: Incorrect capability check when displaying users emails in Participants list

MSA-16-0004: XSS from profile fields from external db

MSA-16-0005: Reflected XSS in mod_data advanced search

MSA-16-0006: Hidden courses are shown to students in Event Monitor

MSA-16-0007: Non-Editing Instructor role can edit exclude checkbox in Single View

MSA-16-0008: External function get_calendar_events return events that pertains to hidden activities

MSA-16-0009: CSRF in Assignment plugin management page

MSA-16-0010: Enumeration of category details possible without authentication

MSA-16-0011: Add no referrer to links with _blank target attribute

MSA-16-0012: External function mod_assign_save_submission does not check due dates

CVE-2016-2151 CVE-2016-2152 CVE-2016-2153 CVE-2016-2154 CVE-2016-2155 CVE-2016-2156 CVE-2016-2157 CVE-2016-2158 CVE-2016-2190 CVE-2016-2159 https://moodle.org/security/ 2016-03-21 2016-04-03 squid -- multiple vulnerabilities squid 3.5.16

Squid security advisory 2016:3 reports:

Due to a buffer overrun Squid pinger binary is vulnerable to denial of service or information leak attack when processing ICMPv6 packets.

This bug also permits the server response to manipulate other ICMP and ICMPv6 queries processing to cause information leak.

This bug allows any remote server to perform a denial of service attack on the Squid service by crashing the pinger. This may affect Squid HTTP routing decisions. In some configurations, sub-optimal routing decisions may result in serious service degradation or even transaction failures.

If the system does not contain buffer-overrun protection leading to that crash this bug will instead allow attackers to leak arbitrary amounts of information from the heap into Squid log files. This is of higher importance than usual because the pinger process operates with root priviliges.

Squid security advisory 2016:4 reports:

Due to incorrect bounds checking Squid is vulnerable to a denial of service attack when processing HTTP responses.

This problem allows a malicious client script and remote server delivering certain unusual HTTP response syntax to trigger a denial of service for all clients accessing the Squid service.

CVE-2016-3947 CVE-2016-3948 ports/208463 http://www.squid-cache.org/Advisories/SQUID-2016_3.txt http://www.squid-cache.org/Advisories/SQUID-2016_4.txt 2016-03-28 2016-04-02 PostgreSQL -- minor security problems. postgresql95-server postgresql95-contrib 9.5.09.5.2

PostgreSQL project reports:

Security Fixes for RLS, BRIN

This release closes security hole CVE-2016-2193 (https://access.redhat.com/security/cve/CVE-2016-2193), where a query plan might get reused for more than one ROLE in the same session. This could cause the wrong set of Row Level Security (RLS) policies to be used for the query.

The update also fixes CVE-2016-3065 (https://access.redhat.com/security/cve/CVE-2016-3065), a server crash bug triggered by using `pageinspect` with BRIN index pages. Since an attacker might be able to expose a few bytes of server memory, this crash is being treated as a security issue.

CVE-2016-2193 CVE-2016-3065 2016-03-01 2016-03-31 flash -- multiple vulnerabilities linux-c6-flashplugin linux-f10-flashplugin linux-c6_64-flashplugin 11.2r202.577

Adobe reports:

These updates resolve integer overflow vulnerabilities that could lead to code execution (CVE-2016-0963, CVE-2016-0993, CVE-2016-1010).

These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, CVE-2016-1000).

These updates resolve a heap overflow vulnerability that could lead to code execution (CVE-2016-1001).

These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2016-0960, CVE-2016-0961, CVE-2016-0962, CVE-2016-0986, CVE-2016-0989, CVE-2016-0992, CVE-2016-1002, CVE-2016-1005).

CVE-2016-0960 CVE-2016-0961 CVE-2016-0962 CVE-2016-0963 CVE-2016-0986 CVE-2016-0987 CVE-2016-0988 CVE-2016-0989 CVE-2016-0990 CVE-2016-0991 CVE-2016-0992 CVE-2016-0993 CVE-2016-0994 CVE-2016-0995 CVE-2016-0996 CVE-2016-0997 CVE-2016-0998 CVE-2016-0999 CVE-2016-1000 CVE-2016-1001 CVE-2016-1002 CVE-2016-1005 CVE-2016-1010 https://helpx.adobe.com/security/products/flash-player/apsb16-08.html 2016-03-10 2016-03-31 Multiple vulnerabilities in Botan botan110 1.10.11

The botan developers reports:

Infinite loop in modular square root algorithm - The ressol function implements the Tonelli-Shanks algorithm for finding square roots could be sent into a nearly infinite loop due to a misplaced conditional check. This could occur if a composite modulus is provided, as this algorithm is only defined for primes. This function is exposed to attacker controlled input via the OS2ECP function during ECC point decompression.

Heap overflow on invalid ECC point - The PointGFp constructor did not check that the affine coordinate arguments were less than the prime, but then in curve multiplication assumed that both arguments if multiplied would fit into an integer twice the size of the prime.

The bigint_mul and bigint_sqr functions received the size of the output buffer, but only used it to dispatch to a faster algorithm in cases where there was sufficient output space to call an unrolled multiplication function.

The result is a heap overflow accessible via ECC point decoding, which accepted untrusted inputs. This is likely exploitable for remote code execution.

On systems which use the mlock pool allocator, it would allow an attacker to overwrite memory held in secure_vector objects. After this point the write will hit the guard page at the end of the mmapped region so it probably could not be used for code execution directly, but would allow overwriting adjacent key material.

http://botan.randombit.net/security.html CVE-2016-2194 CVE-2016-2195 2016-02-01 2016-03-31 Botan BER Decoder vulnerabilities botan110 1.10.10

The botan developers reports:

Excess memory allocation in BER decoder - The BER decoder would allocate a fairly arbitrary amount of memory in a length field, even if there was no chance the read request would succeed. This might cause the process to run out of memory or invoke the OOM killer.

Crash in BER decoder - The BER decoder would crash due to reading from offset 0 of an empty vector if it encountered a BIT STRING which did not contain any data at all. This can be used to easily crash applications reading untrusted ASN.1 data, but does not seem exploitable for code execution.

http://botan.randombit.net/security.html CVE-2015-5726 CVE-2015-5727 2015-08-03 2016-03-31 mercurial -- multiple vulnerabilities mercurial 2.7.3

Mercurial reports:

CVE-2016-3630: Remote code execution in binary delta decoding

CVE-2016-3068: Arbitrary code execution with Git subrepos

CVE-2016-3069: Arbitrary code execution when converting Git repos

CVE-2016-3630 CVE-2016-3068 CVE-2016-3069 https://www.mercurial-scm.org/pipermail/mercurial/2016-March/049452.html 2016-03-29 2016-03-29 chromium -- multiple vulnerabilities chromium chromium-npapi chromium-pulse 49.0.2623.108

Google Chrome Releases reports:

[594574] High CVE-2016-1646: Out-of-bounds read in V8.

[590284] High CVE-2016-1647: Use-after-free in Navigation.

[590455] High CVE-2016-1648: Use-after-free in Extensions.

[597518] CVE-2016-1650: Various fixes from internal audits, fuzzing and other initiatives.

Multiple vulnerabilities in V8 fixed at the tip of the 4.9 branch

CVE-2016-1646 CVE-2016-1647 CVE-2016-1648 CVE-2016-1649 CVE-2016-1650 http://googlechromereleases.blogspot.de/2016/03/stable-channel-update_24.html 2016-03-24 2016-03-29 chromium -- multiple vulnerabilities chromium chromium-npapi chromium-pulse 49.0.2623.87

Google Chrome Releases reports:

[589838] High CVE-2016-1643: Type confusion in Blink.

[590620] High CVE-2016-1644: Use-after-free in Blink.

[587227] High CVE-2016-1645: Out-of-bounds write in PDFium.

CVE-2016-1643 CVE-2016-1644 CVE-2016-1645 http://googlechromereleases.blogspot.de/2016/03/stable-channel-update_8.html 2016-03-08 2016-03-29 bind -- denial of service vulnerability bind910 9.10.09.10.3P4 bind9-devel 9.11.0.a20160309

ISC reports:

A response containing multiple DNS cookies causes servers with cookie support enabled to exit with an assertion failure.

CVE-2016-2088 https://kb.isc.org/article/AA-01351 2016-03-09 2016-03-28 bind -- denial of service vulnerability bind98 9.8.8 bind99 9.9.09.9.8P4 bind910 9.10.09.10.3P4 bind9-devel 9.11.0.a20160309 FreeBSD 9.39.3_38

ISC reports:

A problem parsing resource record signatures for DNAME resource records can lead to an assertion failure in resolver.c or db.c

CVE-2016-1286 SA-16:13.bind https://kb.isc.org/article/AA-01353 2016-03-09 2016-03-28 2016-08-09 bind -- denial of service vulnerability bind98 9.8.8 bind99 9.9.09.9.8P4 bind910 9.10.09.10.3P4 bind9-devel 9.11.0.a20160309 FreeBSD 9.39.3_38

ISC reports:

An error parsing input received by the rndc control channel can cause an assertion failure in sexpr.c or alist.c.

CVE-2016-1285 SA-16:13.bind https://kb.isc.org/article/AA-01352 2016-03-09 2016-03-28 2016-08-09 salt -- Insecure configuration of PAM external authentication service py27-salt py32-salt py33-salt py34-salt py35-salt 2015.5.10 2015.8.02015.8.8

SaltStack reports:

This issue affects all Salt versions prior to 2015.8.8/2015.5.10 when PAM external authentication is enabled. This issue involves passing an alternative PAM authentication service with a command that is sent to LocalClient, enabling the attacker to bypass the configured authentication service.

CVE-2016-3176 https://docs.saltstack.com/en/latest/topics/releases/2015.8.8.html 2016-03-17 2016-03-27 activemq -- Unsafe deserialization activemq 5.13.0

Alvaro Muatoz, Matthias Kaiser and Christian Schneider reports:

JMS Object messages depends on Java Serialization for marshaling/unmashaling of the message payload. There are a couple of places inside the broker where deserialization can occur, like web console or stomp object message transformation. As deserialization of untrusted data can leaed to security flaws as demonstrated in various reports, this leaves the broker vunerable to this attack vector. Additionally, applications that consume ObjectMessage type of messages can be vunerable as they deserlize objects on ObjectMessage.getObject() calls.

http://activemq.apache.org/security-advisories.data/CVE-2015-5254-announcement.txt CVE-2015-5254 2016-01-08 2016-03-25 activemq -- Web Console Clickjacking activemq 5.13.2

Michael Furman reports:

The web based administration console does not set the X-Frame-Options header in HTTP responses. This allows the console to be embedded in a frame or iframe which could then be used to cause a user to perform an unintended action in the console.

http://activemq.apache.org/security-advisories.data/CVE-2016-0734-announcement.txt CVE-2016-0734 2016-03-10 2016-03-25 activemq -- Web Console Cross-Site Scripting activemq 5.13.1

Vladimir Ivanov (Positive Technologies) reports:

Several instances of cross-site scripting vulnerabilities were identified to be present in the web based administration console as well as the ability to trigger a Java memory dump into an arbitrary folder. The root cause of these issues are improper user data output validation and incorrect permissions configured on Jolokia.

http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt CVE-2016-0782 2016-03-10 2016-03-25 pcre -- stack buffer overflow pcre 8.38 pcre2 10.20_1

Philip Hazel reports:

PCRE does not validate that handling the (*ACCEPT) verb will occur within the bounds of the cworkspace stack buffer, leading to a stack buffer overflow.

https://bugs.exim.org/show_bug.cgi?id=1791 CVE-2016-3191 2016-02-09 2016-03-21 2016-03-21 kamailio -- SEAS Module Heap overflow kamailio 4.3.5

Stelios Tsampas reports:

A (remotely exploitable) heap overflow vulnerability was found in Kamailio v4.3.4.

CVE-2016-2385 https://github.com/kamailio/kamailio/commit/f50c9c853e7809810099c970780c30b0765b0643 https://census-labs.com/news/2016/03/30/kamailio-seas-heap-overflow/ http://seclists.org/oss-sec/2016/q1/338 2016-02-15 2016-03-19 2016-04-03 hadoop2 -- unauthorized disclosure of data vulnerability hadoop2 2.62.7

Arun Suresh reports:

RPC traffic from clients, potentially including authentication credentials, may be intercepted by a malicious user with access to run tasks or containers on a cluster.

CVE-2015-1776 http://mail-archives.apache.org/mod_mbox/hadoop-general/201602.mbox/browser 2016-02-15 2016-03-19 git -- integer overflow git 2.4.11 2.5.02.5.5 2.6.02.6.6 2.7.02.7.4 git-gui 2.4.11 2.5.02.5.5 2.6.02.6.6 2.7.02.7.4 git-lite 2.4.11 2.5.02.5.5 2.6.02.6.6 2.7.02.7.4 git-subversion 2.4.11 2.5.02.5.5 2.6.02.6.6 2.7.02.7.4

Debian reports:

integer overflow due to a loop which adds more to "len".

CVE-2016-2324 https://security-tracker.debian.org/tracker/CVE-2016-2324 https://github.com/git/git/commit/9831e92bfa833ee9c0ce464bbc2f941ae6c2698d 2016-02-24 2016-03-18 git -- potential code execution git 2.7.0

Debian reports:

"int" is the wrong data type for ... nlen assignment.

CVE-2016-2315 http://www.openwall.com/lists/oss-security/2016/03/15/6 https://marc.info/?l=oss-security&m=145809217306686&w=2 https://github.com/git/git/commit/34fa79a6cde56d6d428ab0d3160cb094ebad3305 https://security-tracker.debian.org/tracker/CVE-2016-2315 2015-09-24 2016-03-17 node -- multiple vulnerabilities node 5.7.1

Jeremiah Senkpiel reports:

Fix a double-free defect in parsing malformed DSA keys that may potentially be used for DoS or memory corruption attacks.

Fix a defect that can cause memory corruption in certain very rare cases

Fix a defect that makes the CacheBleed Attack possible

https://github.com/nodejs/node/commit/805f054cc7791c447dbb960fbf3b179ea05294ac CVE-2016-0702 CVE-2016-0705 CVE-2016-0797 2016-03-02 2016-03-14 dropbear -- authorized_keys command= bypass dropbear 2016.72

Matt Johnson reports:

Validate X11 forwarding input. Could allow bypass of authorized_keys command= restrictions

https://matt.ucc.asn.au/dropbear/CHANGES CVE-2016-3116 2016-03-11 2016-03-14 jpgraph2 -- XSS vulnerability jpgraph2 3.0.7_1

Martin Barbella reports:

JpGraph is an object oriented library for PHP that can be used to create various types of graphs which also contains support for client side image maps. The GetURLArguments function for the JpGraph's Graph class does not properly sanitize the names of get and post variables, leading to a cross site scripting vulnerability.

http://www.securityfocus.com/archive/1/archive/1/508586/100/0/threaded 2009-12-22 2016-03-13 php7 -- multiple vulnerabilities php70 php70-soap 7.0.4

The PHP Group reports:

Core:

Fixed bug #71637 (Multiple Heap Overflow due to integer overflows in xml/filter_url/addcslashes).

SOAP:

Fixed bug #71610 (Type Confusion Vulnerability - SOAP / make_http_soap_request()).

http://php.net/ChangeLog-7.php#7.0.4 2016-03-03 2016-03-13 php5 -- multiple vulnerabilities php55-phar php55-wddx 5.5.33 php56-phar php56-wddx 5.6.19

The PHP Group reports:

Phar:

Fixed bug #71498 (Out-of-Bound Read in phar_parse_zipfile()).

WDDX:

Fixed bug #71587 (Use-After-Free / Double-Free in WDDX Deserialize).

http://php.net/ChangeLog-5.php#5.6.19 http://php.net/ChangeLog-5.php#5.5.33 2016-03-03 2016-03-13 openssh -- command injection when X11Forwarding is enabled openssh-portable 7.2.p2,1 FreeBSD 10.210.2_14 10.110.1_31 9.39.3_39

The OpenSSH project reports:

Missing sanitisation of untrusted input allows an authenticated user who is able to request X11 forwarding to inject commands to xauth(1).

Injection of xauth commands grants the ability to read arbitrary files under the authenticated user's privilege, Other xauth commands allow limited information leakage, file overwrite, port probing and generally expose xauth(1), which was not written with a hostile user in mind, as an attack surface.

Mitigation:

Set X11Forwarding=no in sshd_config. This is the default.

For authorized_keys that specify a "command" restriction, also set the "restrict" (available in OpenSSH >=7.2) or "no-x11-forwarding" restrictions.

http://www.openssh.com/txt/x11fwd.adv CVE-2016-3115 SA-16:14.openssh 2016-03-11 2016-03-11 2016-08-09 quagga -- stack based buffer overflow vulnerability quagga 1.0.20160309

Donald Sharp reports:

A malicious BGP peer may execute arbitrary code in particularly configured remote bgpd hosts.

https://www.kb.cert.org/vuls/id/270232 http://savannah.nongnu.org/forum/forum.php?forum_id=8476 CVE-2016-2342 2016-01-27 2016-03-10 ricochet -- information disclosure ricochet 1.1.2

special reports:

By sending a nickname with some HTML tags in a contact request, an attacker could cause Ricochet to make network requests without Tor after the request is accepted, which would reveal the user's IP address.

https://github.com/ricochet-im/ricochet/releases/tag/v1.1.2 2016-02-15 2016-03-10 pidgin-otr -- use after free pidgin-otr 4.0.2

Hanno Bock reports:

The pidgin-otr plugin version 4.0.2 fixes a heap use after free error. The bug is triggered when a user tries to authenticate a buddy and happens in the function create_smp_dialog.

http://seclists.org/oss-sec/2016/q1/572 https://bugs.otr.im/issues/88 https://bugs.otr.im/issues/128 CVE-2015-8833 2015-04-04 2016-03-10 libotr -- integer overflow libotr 4.1.1 libotr3 0

X41 D-Sec reports:

A remote attacker may crash or execute arbitrary code in libotr by sending large OTR messages.

https://www.x41-dsec.de/lab/advisories/x41-2016-001-libotr/ CVE-2016-2851 2016-02-17 2016-03-09 2016-03-09 brotli -- buffer overflow brotli 0.3.00.3.0_1 0.2.0_2 libbrotli 0.3.0_3 chromium chromium-npapi chromium-pulse 48.0.2564.109 firefox linux-firefox 45.0,1 seamonkey linux-seamonkey 2.42 firefox-esr 38.7.0,1 libxul thunderbird linux-thunderbird 38.7.0

Google Chrome Releases reports:

[583607] High CVE-2016-1624: Buffer overflow in Brotli. Credit to lukezli.

Mozilla Foundation reports:

Security researcher Luke Li reported a pointer underflow bug in the Brotli library's decompression that leads to a buffer overflow. This results in a potentially exploitable crash when triggered.

CVE-2016-1624 CVE-2016-1968 https://github.com/google/brotli/commit/37a320dd81db8d546cd24a45b4c61d87b45dcade https://chromium.googlesource.com/chromium/src/+/7716418a27d561ee295a99f11fd3865580748de2%5E!/ https://www.mozilla.org/security/advisories/mfsa2016-30/ https://hg.mozilla.org/releases/mozilla-release/rev/4a5d8ade4e3e 2016-02-08 2016-03-08 2016-03-08 mozilla -- multiple vulnerabilities firefox linux-firefox 45.0,1 seamonkey linux-seamonkey 2.42 firefox-esr 38.7.0,1 libxul thunderbird linux-thunderbird 38.7.0

Mozilla Foundation reports:

MFSA 2016-16 Miscellaneous memory safety hazards (rv:45.0 / rv:38.7)

MFSA 2016-17 Local file overwriting and potential privilege escalation through CSP reports

MFSA 2016-18 CSP reports fail to strip location information for embedded iframe pages

MFSA 2016-19 Linux video memory DOS with Intel drivers

MFSA 2016-20 Memory leak in libstagefright when deleting an array during MP4 processing

MFSA 2016-21 Displayed page address can be overridden

MFSA 2016-22 Service Worker Manager out-of-bounds read in Service Worker Manager

MFSA 2016-23 Use-after-free in HTML5 string parser

MFSA 2016-24 Use-after-free in SetBody

MFSA 2016-25 Use-after-free when using multiple WebRTC data channels

MFSA 2016-26 Memory corruption when modifying a file being read by FileReader

MFSA 2016-27 Use-after-free during XML transformations

MFSA 2016-28 Addressbar spoofing though history navigation and Location protocol property

MFSA 2016-29 Same-origin policy violation using perfomance.getEntries and history navigation with session restore

MFSA 2016-31 Memory corruption with malicious NPAPI plugin

MFSA 2016-32 WebRTC and LibVPX vulnerabilities found through code inspection

MFSA 2016-33 Use-after-free in GetStaticInstance in WebRTC

MFSA 2016-34 Out-of-bounds read in HTML parser following a failed allocation

CVE-2016-1952 CVE-2016-1953 CVE-2016-1954 CVE-2016-1955 CVE-2016-1956 CVE-2016-1957 CVE-2016-1958 CVE-2016-1959 CVE-2016-1960 CVE-2016-1961 CVE-2016-1962 CVE-2016-1963 CVE-2016-1964 CVE-2016-1965 CVE-2016-1966 CVE-2016-1967 CVE-2016-1970 CVE-2016-1971 CVE-2016-1972 CVE-2016-1973 CVE-2016-1974 CVE-2016-1975 CVE-2016-1976 https://www.mozilla.org/security/advisories/mfsa2016-16/ https://www.mozilla.org/security/advisories/mfsa2016-17/ https://www.mozilla.org/security/advisories/mfsa2016-18/ https://www.mozilla.org/security/advisories/mfsa2016-19/ https://www.mozilla.org/security/advisories/mfsa2016-20/ https://www.mozilla.org/security/advisories/mfsa2016-21/ https://www.mozilla.org/security/advisories/mfsa2016-22/ https://www.mozilla.org/security/advisories/mfsa2016-23/ https://www.mozilla.org/security/advisories/mfsa2016-24/ https://www.mozilla.org/security/advisories/mfsa2016-25/ https://www.mozilla.org/security/advisories/mfsa2016-26/ https://www.mozilla.org/security/advisories/mfsa2016-27/ https://www.mozilla.org/security/advisories/mfsa2016-28/ https://www.mozilla.org/security/advisories/mfsa2016-29/ https://www.mozilla.org/security/advisories/mfsa2016-31/ https://www.mozilla.org/security/advisories/mfsa2016-32/ https://www.mozilla.org/security/advisories/mfsa2016-33/ https://www.mozilla.org/security/advisories/mfsa2016-34/ 2016-03-08 2016-03-08 2016-03-08 graphite2 -- multiple vulnerabilities graphite2 1.3.6 linux-firefox 45.0,1 linux-thunderbird 38.7.0 linux-seamonkey 2.42

Mozilla Foundation reports:

Security researcher Holger Fuhrmannek and Mozilla security engineer Tyson Smith reported a number of security vulnerabilities in the Graphite 2 library affecting version 1.3.5. The issue reported by Holger Fuhrmannek is a mechanism to induce stack corruption with a malicious graphite font. This leads to a potentially exploitable crash when the font is loaded. Tyson Smith used the Address Sanitizer tool in concert with a custom software fuzzer to find a series of uninitialized memory, out-of-bounds read, and out-of-bounds write errors when working with fuzzed graphite fonts.

Security researcher James Clawson used the Address Sanitizer tool to discover an out-of-bounds write in the Graphite 2 library when loading a crafted Graphite font file. This results in a potentially exploitable crash.

https://www.mozilla.org/security/advisories/mfsa2016-37/ https://www.mozilla.org/security/advisories/mfsa2016-38/ CVE-2016-1969 CVE-2016-1977 CVE-2016-2790 CVE-2016-2791 CVE-2016-2792 CVE-2016-2793 CVE-2016-2794 CVE-2016-2795 CVE-2016-2796 CVE-2016-2797 CVE-2016-2798 CVE-2016-2799 CVE-2016-2800 CVE-2016-2801 CVE-2016-2802 2016-03-08 2016-03-08 2016-03-14 NSS -- multiple vulnerabilities nss 3.203.21.1 3.19.2.3 linux-c6-nss 3.203.21.0_1 3.19.2.3 linux-firefox 45.0,1 linux-thunderbird 38.7.0 linux-seamonkey 2.42

Mozilla Foundation reports:

Security researcher Francis Gabriel reported a heap-based buffer overflow in the way the Network Security Services (NSS) libraries parsed certain ASN.1 structures. An attacker could create a specially-crafted certificate which, when parsed by NSS, would cause it to crash or execute arbitrary code with the permissions of the user.

Mozilla developer Tim Taubert used the Address Sanitizer tool and software fuzzing to discover a use-after-free vulnerability while processing DER encoded keys in the Network Security Services (NSS) libraries. The vulnerability overwrites the freed memory with zeroes.

CVE-2016-1950 CVE-2016-1979 https://www.mozilla.org/security/advisories/mfsa2016-35/ https://www.mozilla.org/security/advisories/mfsa2016-36/ https://hg.mozilla.org/projects/nss/rev/b9a31471759d https://hg.mozilla.org/projects/nss/rev/7033b1193c94 2016-03-08 2016-03-08 2016-09-05 NSS -- multiple vulnerabilities nss linux-c6-nss 3.21 linux-firefox 44.0,1 linux-seamonkey 2.41

Mozilla Foundation reports:

Security researcher Hanno Böck reported that calculations with mp_div and mp_exptmod in Network Security Services (NSS) can produce wrong results in some circumstances. These functions are used within NSS for a variety of cryptographic division functions, leading to potential cryptographic weaknesses.

Mozilla developer Eric Rescorla reported that a failed allocation during DHE and ECDHE handshakes would lead to a use-after-free vulnerability.

CVE-2016-1938 CVE-2016-1978 https://www.mozilla.org/security/advisories/mfsa2016-07/ https://www.mozilla.org/security/advisories/mfsa2016-15/ https://hg.mozilla.org/projects/nss/rev/a555bf0fc23a https://hg.mozilla.org/projects/nss/rev/a245a4ccd354 2016-01-26 2016-03-08 django -- multiple vulnerabilities py27-django py32-django py33-django py34-django py35-django 1.8.10 py27-django18 py32-django18 py33-django18 py34-django18 py35-django18 1.8.10 py27-django19 py32-django19 py33-django19 py34-django19 py35-django19 1.9.3 py27-django-devel py32-django-devel py33-django-devel py34-django-devel py35-django-devel 20150709,1

Tim Graham reports:

Malicious redirect and possible XSS attack via user-supplied redirect URLs containing basic auth

User enumeration through timing difference on password hasher work factor upgrade

CVE-2016-2512 CVE-2016-2513 https://www.djangoproject.com/weblog/2016/mar/01/security-releases/ 2016-03-01 2016-03-08 wordpress -- multiple vulnerabilities wordpress 4.4.2,1 de-wordpress ja-wordpress ru-wordpress zh-wordpress-zh_CN zh-wordpress-zh_TW 4.4.2

Samuel Sidler reports:

WordPress 4.4.2 is now available. This is a security release for all previous versions and we strongly encourage you to update your sites immediately.

WordPress versions 4.4.1 and earlier are affected by two security issues: a possible SSRF for certain local URIs, reported by Ronni Skansing; and an open redirection attack, reported by Shailesh Suthar.

CVE-2016-2221 CVE-2016-2222 http://www.openwall.com/lists/oss-security/2016/02/04/6 https://wordpress.org/news/2016/02/wordpress-4-4-2-security-and-maintenance-release/ 2016-02-02 2016-03-08 PuTTY - old-style scp downloads may allow remote code execution putty 0.67

Simon G. Tatham reports:

Many versions of PSCP prior to 0.67 have a stack corruption vulnerability in their treatment of the 'sink' direction (i.e. downloading from server to client) of the old-style SCP protocol.

In order for this vulnerability to be exploited, the user must connect to a malicious server and attempt to download any file.[...] you can work around it in a vulnerable PSCP by using the -sftp option to force the use of the newer SFTP protocol, provided your server supports that protocol.

http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-pscp-sink-sscanf.html CVE-2016-2563 https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-2563 2016-02-26 2016-03-07 websvn -- reflected cross-site scripting websvn 2.3.3_1

Sebastien Delafond reports:

Jakub Palaczynski discovered that websvn, a web viewer for Subversion repositories, does not correctly sanitize user-supplied input, which allows a remote user to run reflected cross-site scripting attacks.

CVE-2016-2511 https://lists.debian.org/debian-security-announce/2016/msg00060.html http://seclists.org/fulldisclosure/2016/Feb/99 2016-02-22 2016-03-06 websvn -- information disclosure websvn 2.3.3_1

Thijs Kinkhorst reports:

James Clawson reported:

"Arbitrary files with a known path can be accessed in websvn by committing a symlink to a repository and then downloading the file (using the download link).

An attacker must have write access to the repo, and the download option must have been enabled in the websvn config file."

CVE-2013-6892 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-6892 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775682 2015-01-18 2016-03-06 rails -- multiple vulnerabilities rubygem-actionpack 3.2.22.2 rubygem-actionpack4 4.2.5.2 rubygem-actionview 4.2.5.2 rubygem-rails 3.2.22.2 rubygem-rails4 4.2.5.2

Ruby on Rails blog:

Rails 4.2.5.2, 4.1.14.2, and 3.2.22.2 have been released! These contain the following important security fixes, and it is recommended that users upgrade as soon as possible.

CVE-2016-2097 CVE-2016-2098 https://groups.google.com/d/msg/rubyonrails-security/ddY6HgqB2z4/we0RasMZIAAJ https://groups.google.com/d/msg/rubyonrails-security/ly-IH-fxr_Q/WLoOhcMZIAAJ http://weblog.rubyonrails.org/2016/2/29/Rails-4-2-5-2-4-1-14-2-3-2-22-2-have-been-released/ 2016-02-29 2016-03-06 chromium -- multiple vulnerabilities chromium chromium-npapi chromium-pulse 49.0.2623.75

Google Chrome Releases reports:

[560011] High CVE-2016-1630: Same-origin bypass in Blink.

[569496] High CVE-2016-1631: Same-origin bypass in Pepper Plugin.

[549986] High CVE-2016-1632: Bad cast in Extensions.

[572537] High CVE-2016-1633: Use-after-free in Blink.

[559292] High CVE-2016-1634: Use-after-free in Blink.

[585268] High CVE-2016-1635: Use-after-free in Blink.

[584155] High CVE-2016-1636: SRI Validation Bypass.

[555544] Medium CVE-2016-1637: Information Leak in Skia.

[585282] Medium CVE-2016-1638: WebAPI Bypass.

[572224] Medium CVE-2016-1639: Use-after-free in WebRTC.

[550047] Medium CVE-2016-1640: Origin confusion in Extensions UI.

[583718] Medium CVE-2016-1641: Use-after-free in Favicon.

[591402] CVE-2016-1642: Various fixes from internal audits, fuzzing and other initiatives.

Multiple vulnerabilities in V8 fixed.

CVE-2016-1630 CVE-2016-1631 CVE-2016-1632 CVE-2016-1633 CVE-2016-1634 CVE-2016-1635 CVE-2016-1636 CVE-2016-1637 CVE-2016-1638 CVE-2016-1639 CVE-2016-1640 CVE-2016-1641 CVE-2016-1642 http://googlechromereleases.blogspot.de/2016/03/stable-channel-update.html 2016-03-02 2016-03-05 libssh -- weak Diffie-Hellman secret generation libssh 0.7.3

Andreas Schneider reports:

libssh versions 0.1 and above have a bits/bytes confusion bug and generate the an anormaly short ephemeral secret for the diffie-hellman-group1 and diffie-hellman-group14 key exchange methods. The resulting secret is 128 bits long, instead of the recommended sizes of 1024 and 2048 bits respectively. There are practical algorithms (Baby steps/Giant steps, Pollard’s rho) that can solve this problem in O(2^63) operations.

Both client and server are are vulnerable, pre-authentication. This vulnerability could be exploited by an eavesdropper with enough resources to decrypt or intercept SSH sessions. The bug was found during an internal code review by Aris Adamantiadis of the libssh team.

CVE-2016-0739 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-0739 https://www.libssh.org/2016/02/23/libssh-0-7-3-security-and-bugfix-release/ 2016-02-23 2016-03-05 exim -- local privilleges escalation exim 4.86.2 4.85.2 4.84.2

The Exim development team reports:

All installations having Exim set-uid root and using 'perl_startup' are vulnerable to a local privilege escalation. Any user who can start an instance of Exim (and this is normally any user) can gain root privileges. If you do not use 'perl_startup' you should be safe.

CVE-2016-1531 https://lists.exim.org/lurker/message/20160302.191005.a72d8433.en.html 2016-02-26 2016-03-02 cacti -- multiple vulnerabilities cacti 0.8.8g

The Cacti Group, Inc. reports:

Changelog

bug:0002652: CVE-2015-8604: SQL injection in graphs_new.php

bug:0002655: CVE-2015-8377: SQL injection vulnerability in the host_new_graphs_save function in graphs_new.php

bug:0002656: Authentication using web authentication as a user not in the cacti database allows complete access

CVE-2015-8377 CVE-2015-8604 CVE-2016-2313 http://www.cacti.net/release_notes_0_8_8g.php http://bugs.cacti.net/view.php?id=2652 http://bugs.cacti.net/view.php?id=2655 http://bugs.cacti.net/view.php?id=2656 http://www.openwall.com/lists/oss-security/2016/02/09/3 2016-02-21 2016-03-02 phpmyadmin -- multiple XSS and a man-in-the-middle vulnerability phpmyadmin 4.5.04.5.5.1

The phpMyAdmin development team reports:

XSS vulnerability in SQL parser.

Using a crafted SQL query, it is possible to trigger an XSS attack through the SQL query page.

We consider this vulnerability to be non-critical.

Multiple XSS vulnerabilities.

By sending a specially crafted URL as part of the HOST header, it is possible to trigger an XSS attack.

A weakness was found that allows an XSS attack with Internet Explorer versions older than 8 and Safari on Windows using a specially crafted URL.

Using a crafted SQL query, it is possible to trigger an XSS attack through the SQL query page.

Using a crafted parameter value, it is possible to trigger an XSS attack in user accounts page.

Using a crafted parameter value, it is possible to trigger an XSS attack in zoom search page.

We consider this vulnerability to be non-critical.

Multiple XSS vulnerabilities.

With a crafted table/column name it is possible to trigger an XSS attack in the database normalization page.

With a crafted parameter it is possible to trigger an XSS attack in the database structure page.

With a crafted parameter it is possible to trigger an XSS attack in central columns page.

We consider this vulnerability to be non-critical.

Vulnerability allowing man-in-the-middle attack on API call to GitHub.

A vulnerability in the API call to GitHub can be exploited to perform a man-in-the-middle attack.

We consider this vulnerability to be serious.

https://www.phpmyadmin.net/security/PMASA-2016-10/ https://www.phpmyadmin.net/security/PMASA-2016-11/ https://www.phpmyadmin.net/security/PMASA-2016-12/ https://www.phpmyadmin.net/security/PMASA-2016-13/ CVE-2016-2559 CVE-2016-2560 CVE-2016-2561 CVE-2016-2562 2016-02-29 2016-03-01 wireshark -- multiple vulnerabilities wireshark wireshark-lite wireshark-qt5 tshark tshark-lite 2.0.2

Wireshark development team reports:

The following vulnerabilities have been fixed:

wnpa-sec-2016-02

ASN.1 BER dissector crash. (Bug 11828) CVE-2016-2522

wnpa-sec-2016-03

DNP dissector infinite loop. (Bug 11938) CVE-2016-2523

wnpa-sec-2016-04

X.509AF dissector crash. (Bug 12002) CVE-2016-2524

wnpa-sec-2016-05

HTTP/2 dissector crash. (Bug 12077) CVE-2016-2525

wnpa-sec-2016-06

HiQnet dissector crash. (Bug 11983) CVE-2016-2526

wnpa-sec-2016-07

3GPP TS 32.423 Trace file parser crash. (Bug 11982)
CVE-2016-2527

wnpa-sec-2016-08

LBMC dissector crash. (Bug 11984) CVE-2016-2528

wnpa-sec-2016-09

iSeries file parser crash. (Bug 11985) CVE-2016-2529

wnpa-sec-2016-10

RSL dissector crash. (Bug 11829) CVE-2016-2530 CVE-2016-2531

wnpa-sec-2016-11

LLRP dissector crash. (Bug 12048) CVE-2016-2532

wnpa-sec-2016-12

Ixia IxVeriWave file parser crash. (Bug 11795)

wnpa-sec-2016-13

IEEE 802.11 dissector crash. (Bug 11818)

wnpa-sec-2016-14

GSM A-bis OML dissector crash. (Bug 11825)

wnpa-sec-2016-15

ASN.1 BER dissector crash. (Bug 12106)

wnpa-sec-2016-16

SPICE dissector large loop. (Bug 12151)

wnpa-sec-2016-17

NFS dissector crash.

wnpa-sec-2016-18

ASN.1 BER dissector crash. (Bug 11822)

CVE-2016-2522 CVE-2016-2523 CVE-2016-2524 CVE-2016-2525 CVE-2016-2526 CVE-2016-2527 CVE-2016-2528 CVE-2016-2529 CVE-2016-2530 CVE-2016-2531 CVE-2016-2532 CVE-2016-4415 CVE-2016-4416 CVE-2016-4417 CVE-2016-4418 CVE-2016-4419 CVE-2016-4420 CVE-2016-4421 https://www.wireshark.org/docs/relnotes/wireshark-2.0.2.html http://www.openwall.com/lists/oss-security/2016/05/01/1 2016-02-26 2016-03-01 2016-07-04 wireshark -- multiple vulnerabilities wireshark wireshark-lite wireshark-qt5 tshark tshark-lite 2.0.1

Wireshark development team reports:

The following vulnerabilities have been fixed:

wnpa-sec-2015-31

NBAP dissector crashes. (Bug 11602, Bug 11835, Bug 11841)

wnpa-sec-2015-37

NLM dissector crash.

wnpa-sec-2015-39

BER dissector crash.

wnpa-sec-2015-40

Zlib decompression crash. (Bug 11548)

wnpa-sec-2015-41

SCTP dissector crash. (Bug 11767)

wnpa-sec-2015-42

802.11 decryption crash. (Bug 11790, Bug 11826)

wnpa-sec-2015-43

DIAMETER dissector crash. (Bug 11792)

wnpa-sec-2015-44

VeriWave file parser crashes. (Bug 11789, Bug 11791)

wnpa-sec-2015-45

RSVP dissector crash. (Bug 11793)

wnpa-sec-2015-46

ANSI A and GSM A dissector crashes. (Bug 11797)

wnpa-sec-2015-47

Ascend file parser crash. (Bug 11794)

wnpa-sec-2015-48

NBAP dissector crash. (Bug 11815)

wnpa-sec-2015-49

RSL dissector crash. (Bug 11829)

wnpa-sec-2015-50

ZigBee ZCL dissector crash. (Bug 11830)

wnpa-sec-2015-51

Sniffer file parser crash. (Bug 11827)

wnpa-sec-2015-52

NWP dissector crash. (Bug 11726)

wnpa-sec-2015-53

BT ATT dissector crash. (Bug 11817)

wnpa-sec-2015-54

MP2T file parser crash. (Bug 11820)

wnpa-sec-2015-55

MP2T file parser crash. (Bug 11821)

wnpa-sec-2015-56

S7COMM dissector crash. (Bug 11823)

wnpa-sec-2015-57

IPMI dissector crash. (Bug 11831)

wnpa-sec-2015-58

TDS dissector crash. (Bug 11846)

wnpa-sec-2015-59

PPI dissector crash. (Bug 11876)

wnpa-sec-2015-60

MS-WSP dissector crash. (Bug 11931)

https://www.wireshark.org/docs/relnotes/wireshark-2.0.1.html 2015-12-29 2016-03-01 tomcat -- multiple vulnerabilities tomcat7 7.0.68 tomcat8 8.0.30

Mark Thomas reports:

CVE-2015-5346 Apache Tomcat Session fixation

CVE-2015-5351 Apache Tomcat CSRF token leak

CVE-2016-0763 Apache Tomcat Security Manager Bypass

http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEF96.7070701@apache.org%3e http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEF7B.1010901@apache.org%3e http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEFB2.9030605@apache.org%3e CVE-2015-5346 CVE-2015-5351 CVE-2016-0763 2016-02-22 2016-02-28 tomcat -- multiple vulnerabilities tomcat 6.0.45 tomcat7 7.0.68 tomcat8 8.0.30

Mark Thomas reports:

CVE-2015-5345 Apache Tomcat Directory disclosure

CVE-2016-0706 Apache Tomcat Security Manager bypass

CVE-2016-0714 Apache Tomcat Security Manager Bypass

http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEF96.7070701@apache.org%3e http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEF6A.70703@apache.org%3e http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEF4F.5090003@apache.org%3e CVE-2015-5345 CVE-2015-5346 CVE-2016-0706 CVE-2016-0714 2016-02-22 2016-02-28 2017-03-18 xerces-c3 -- Parser Crashes on Malformed Input xerces-c3 3.1.3

The Apache Software Foundation reports:

The Xerces-C XML parser mishandles certain kinds of malformed input documents, resulting in buffer overlows during processing and error reporting. The overflows can manifest as a segmentation fault or as memory corruption during a parse operation. The bugs allow for a denial of service attack in many applications by an unauthenticated attacker, and could conceivably result in remote code execution.

CVE-2016-0729 http://xerces.apache.org/xerces-c/secadv/CVE-2016-0729.txt 2016-02-25 2016-02-28 django -- regression in permissions model py27-django19 py33-django19 py34-django19 py35-django19 1.9.2 py27-django-devel py33-django-devel py34-django-devel py35-django-devel 20150709,1

Tim Graham reports:

User with "change" but not "add" permission can create objects for ModelAdmin’s with save_as=True

https://www.djangoproject.com/weblog/2016/feb/01/releases-192-and-189/ CVE-2016-2048 2016-02-01 2016-02-28 xen-kernel -- VMX: guest user mode may crash guest with non-canonical RIP xen-kernel 4.5.2_2

The Xen Project reports:

VMX refuses attempts to enter a guest with an instruction pointer which doesn't satisfy certain requirements. In particular, the instruction pointer needs to be canonical when entering a guest currently in 64-bit mode. This is the case even if the VM entry information specifies an exception to be injected immediately (in which case the bad instruction pointer would possibly never get used for other than pushing onto the exception handler's stack). Provided the guest OS allows user mode to map the virtual memory space immediately below the canonical/non-canonical address boundary, a non-canonical instruction pointer can result even from normal user mode execution. VM entry failure, however, is fatal to the guest.

Malicious HVM guest user mode code may be able to crash the guest.

CVE-2016-2271 http://xenbits.xen.org/xsa/advisory-170.html 2016-02-17 2016-02-28 xen-kernel -- VMX: intercept issue with INVLPG on non-canonical address xen-kernel 3.34.5.2_2

The Xen Project reports:

While INVLPG does not cause a General Protection Fault when used on a non-canonical address, INVVPID in its "individual address" variant, which is used to back the intercepted INVLPG in certain cases, fails in such cases. Failure of INVVPID results in a hypervisor bug check.

A malicious guest can crash the host, leading to a Denial of Service.

CVE-2016-1571 http://xenbits.xen.org/xsa/advisory-168.html 2016-01-20 2016-02-28 xen-kernel -- PV superpage functionality missing sanity checks xen-kernel 3.4.0 3.4.1 4.14.5.2_2

The Xen Project reports:

The PV superpage functionality lacks certain validity checks on data being passed to the hypervisor by guests. This is the case for the page identifier (MFN) passed to MMUEXT_MARK_SUPER and MMUEXT_UNMARK_SUPER sub-ops of the HYPERVISOR_mmuext_op hypercall as well as for various forms of page table updates.

Use of the feature, which is disabled by default, may have unknown effects, ranging from information leaks through Denial of Service to privilege escalation.

CVE-2016-1570 http://xenbits.xen.org/xsa/advisory-167.html 2016-01-20 2016-02-28 moodle -- multiple vulnerabilities moodle28 2.8.10 moodle29 2.9.4 moodle30 3.0.2

Marina Glancy reports:

MSA-16-0001: Two enrolment-related web services don't check course visibility

MSA-16-0002: XSS Vulnerability in course management search

https://moodle.org/security/ CVE-2016-0724 CVE-2016-0725 2016-01-18 2016-02-28 pitivi -- code execution pitivi 0.95

Luke Farone reports:

Double-clicking a file in the user's media library with a specially-crafted path or filename allows for arbitrary code execution with the permissions of the user running Pitivi.

http://www.openwall.com/lists/oss-security/2015/12/23/8 https://git.gnome.org/browse/pitivi/commit/?id=45a4c84edb3b4343f199bba1c65502e3f49f5bb2 CVE-2015-0855 2015-09-13 2016-02-26 giflib -- heap overflow giflib 5.1.2

Hans Jerry Illikainen reports:

A heap overflow may occur in the giffix utility included in giflib-5.1.1 when processing records of the type `IMAGE_DESC_RECORD_TYPE' due to the allocated size of `LineBuffer' equaling the value of the logical screen width, `GifFileIn->SWidth', while subsequently having `GifFileIn->Image.Width' bytes of data written to it.

http://seclists.org/bugtraq/2015/Dec/114 CVE-2015-7555 2015-12-21 2016-02-26 drupal -- multiple vulnerabilities drupal6 6.38 drupal7 7.43 drupal8 8.0.4

Drupal Security Team reports:

File upload access bypass and denial of service (File module - Drupal 7 and 8 - Moderately Critical)

Brute force amplification attacks via XML-RPC (XML-RPC server - Drupal 6 and 7 - Moderately Critical)

Open redirect via path manipulation (Base system - Drupal 6, 7 and 8 - Moderately Critical)

Form API ignores access restrictions on submit buttons (Form API - Drupal 6 - Critical)

HTTP header injection using line breaks (Base system - Drupal 6 - Moderately Critical)

Open redirect via double-encoded 'destination' parameter (Base system - Drupal 6 - Moderately Critical)

Reflected file download vulnerability (System module - Drupal 6 and 7 - Moderately Critical)

Saving user accounts can sometimes grant the user all roles (User module - Drupal 6 and 7 - Less Critical)

Email address can be matched to an account (User module - Drupal 7 and 8 - Less Critical)

Session data truncation can lead to unserialization of user provided data (Base system - Drupal 6 - Less Critical)

https://www.drupal.org/SA-CORE-2016-001 2016-02-24 2016-02-25 jenkins -- multiple vulnerabilities jenkins 1.650 jenkins-lts 1.642.2

Jenkins Security Advisory:

Description

SECURITY-232 / CVE-2016-0788(Remote code execution vulnerability in remoting module)

A vulnerability in the Jenkins remoting module allowed unauthenticated remote attackers to open a JRMP listener on the server hosting the Jenkins master process, which allowed arbitrary code execution.

SECURITY-238 / CVE-2016-0789(HTTP response splitting vulnerability)

An HTTP response splitting vulnerability in the CLI command documentation allowed attackers to craft Jenkins URLs that serve malicious content.

SECURITY-241 / CVE-2016-0790(Non-constant time comparison of API token)

The verification of user-provided API tokens with the expected value did not use a constant-time comparison algorithm, potentially allowing attackers to use statistical methods to determine valid API tokens using brute-force methods.

SECURITY-245 / CVE-2016-0791(Non-constant time comparison of CSRF crumbs)

The verification of user-provided CSRF crumbs with the expected value did not use a constant-time comparison algorithm, potentially allowing attackers to use statistical methods to determine valid CSRF crumbs using brute-force methods.

SECURITY-247 / CVE-2016-0792(Remote code execution through remote API)

Jenkins has several API endpoints that allow low-privilege users to POST XML files that then get deserialized by Jenkins. Maliciously crafted XML files sent to these API endpoints could result in arbitrary code execution.

https://wiki.jenkins-ci.org/display/SECURITY/Security+Advisory+2016-02-24 2016-02-24 2016-02-25 squid -- remote DoS in HTTP response processing squid 3.5.15

Squid security advisory 2016:2 reports:

Due to incorrect bounds checking Squid is vulnerable to a denial of service attack when processing HTTP responses.

These problems allow remote servers delivering certain unusual HTTP response syntax to trigger a denial of service for all clients accessing the Squid service.

HTTP responses containing malformed headers that trigger this issue are becoming common. We are not certain at this time if that is a sign of malware or just broken server scripting.

CVE-2016-2569 CVE-2016-2570 CVE-2016-2571 ports/207454 http://www.squid-cache.org/Advisories/SQUID-2016_2.txt http://www.openwall.com/lists/oss-security/2016/02/24/12 2016-02-24 2016-02-24 2016-02-28 bsh -- remote code execution vulnerability bsh 2.0.b6

Stian Soiland-Reyes reports:

This release fixes a remote code execution vulnerability that was identified in BeanShell by Alvaro Muñoz and Christian Schneider. The BeanShell team would like to thank them for their help and contributions to this fix!

An application that includes BeanShell on the classpath may be vulnerable if another part of the application uses Java serialization or XStream to deserialize data from an untrusted source.

A vulnerable application could be exploited for remote code execution, including executing arbitrary shell commands.

This update fixes the vulnerability in BeanShell, but it is worth noting that applications doing such deserialization might still be insecure through other libraries. It is recommended that application developers take further measures such as using a restricted class loader when deserializing. See notes on Java serialization security XStream security and How to secure deserialization from untrusted input without using encryption or sealing.

CVE-2016-2510 ports/207334 https://github.com/beanshell/beanshell/releases/tag/2.0b6 2016-02-18 2016-02-21 libsrtp -- DoS via crafted RTP header vulnerability libsrtp 1.5.3

libsrtp reports:

Prevent potential DoS attack due to lack of bounds checking on RTP header CSRC count and extension header length. Credit goes to Randell Jesup and the Firefox team for reporting this issue.

CVE-2015-6360 ports/207003 https://github.com/cisco/libsrtp/releases/tag/v1.5.3 https://github.com/cisco/libsrtp/commit/704a31774db0dd941094fd2b47c21638b8dc3de2 https://github.com/cisco/libsrtp/commit/be95365fbb4788b688cab7af61c65b7989055fb4 https://github.com/cisco/libsrtp/commit/be06686c8e98cc7bd934e10abb6f5e971d03f8ee https://github.com/cisco/libsrtp/commit/cdc69f2acde796a4152a250f869271298abc233f 2015-11-02 2016-02-21 jasper -- multiple vulnerabilities jasper 1.900.1_16

oCERT reports:

The library is affected by a double-free vulnerability in function jas_iccattrval_destroy() as well as a heap-based buffer overflow in function jp2_decode(). A specially crafted jp2 file can be used to trigger the vulnerabilities.

oCERT reports:

The library is affected by an off-by-one error in a buffer boundary check in jpc_dec_process_sot(), leading to a heap based buffer overflow, as well as multiple unrestricted stack memory use issues in jpc_qmfb.c, leading to stack overflow. A specially crafted jp2 file can be used to trigger the vulnerabilities.

oCERT reports:

Multiple off-by-one flaws, leading to heap-based buffer overflows, were found in the way JasPer decoded JPEG 2000 files. A specially crafted file could cause an application using JasPer to crash or, possibly, execute arbitrary code.

limingxing reports:

A vulnerability was found in the way the JasPer's jas_matrix_clip() function parses certain JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash.

http://www.ocert.org/advisories/ocert-2014-012.html https://bugzilla.redhat.com/show_bug.cgi?id=1173157 https://bugzilla.redhat.com/show_bug.cgi?id=1173162 http://www.ocert.org/advisories/ocert-2015-001.html https://bugzilla.redhat.com/show_bug.cgi?id=1179282 http://www.ocert.org/advisories/ocert-2014-009.html https://bugzilla.redhat.com/show_bug.cgi?id=1167537 http://seclists.org/oss-sec/2016/q1/233 https://bugzilla.redhat.com/show_bug.cgi?id=1302636 CVE-2014-8137 CVE-2014-8138 CVE-2014-8157 CVE-2014-8158 CVE-2014-9029 CVE-2016-2089 2014-12-10 2016-02-20 2016-02-24 chromium -- same origin bypass chromium chromium-npapi chromium-pulse 48.0.2564.116

Google Chrome Releases reports:

[583431] Critical CVE-2016-1629: Same-origin bypass in Blink and Sandbox escape in Chrome. Credit to anonymous.

CVE-2016-1629 http://googlechromereleases.blogspot.nl/2016/02/stable-channel-update_18.html 2016-02-18 2016-02-18 glibc -- getaddrinfo stack-based buffer overflow linux_base-c6 linux_base-c6_64 6.7_1 linux_base-f10 0

Fabio Olive Leite reports:

A stack-based buffer overflow was found in libresolv when invoked from nss_dns, allowing specially crafted DNS responses to seize control of EIP in the DNS client. The buffer overflow occurs in the functions send_dg (send datagram) and send_vc (send TCP) for the NSS module libnss_dns.so.2 when calling getaddrinfo with AF_UNSPEC family, or in some cases AF_INET6 family. The use of AF_UNSPEC (or AF_INET6 in some cases) triggers the low-level resolver code to send out two parallel queries for A and AAAA. A mismanagement of the buffers used for those queries could result in the response of a query writing beyond the alloca allocated buffer created by __res_nquery.

CVE-2015-7547 ports/207272 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-7547 https://blog.des.no/2016/02/freebsd-and-cve-2015-7547/ https://googleonlinesecurity.blogspot.no/2016/02/cve-2015-7547-glibc-getaddrinfo-stack.html https://sourceware.org/ml/libc-alpha/2016-02/msg00416.html 2016-02-16 2016-02-18 squid -- SSL/TLS processing remote DoS squid 3.5.133.5.14

Squid security advisory 2016:1 reports:

Due to incorrectly handling server errors Squid is vulnerable to a denial of service attack when connecting to TLS or SSL servers.

This problem allows any trusted client to perform a denial of service attack on the Squid service regardless of whether TLS or SSL is configured for use in the proxy.

Misconfigured client or server software may trigger this issue to perform a denial of service unintentionally.

However, the bug is exploitable only if Squid is built using the --with-openssl option.

The FreeBSD port does not use SSL by default and is not vulnerable in the default configuration.

CVE-2016-2390 ports/207294 http://www.squid-cache.org/Advisories/SQUID-2016_1.txt 2016-02-16 2016-02-18 adminer -- remote code execution adminer 4.2.4

Jakub Vrana reports:

Fix remote code execution in SQLite query

https://github.com/vrana/adminer/commit/e5352cc5acad21513bb02677e2021b80bf7e7b8b 2016-02-06 2016-02-17 adminer -- XSS vulnerability adminer 4.2.3

Jakub Vrana reports:

Fix XSS in indexes (non-MySQL only)

https://github.com/vrana/adminer/commit/4be0b6655e0bf415960659db2a6dd4e60eebbd66 2015-11-08 2016-02-17 adminer -- XSS vulnerability adminer 4.2.2

Jakub Vrana reports:

Fix XSS in alter table

https://github.com/vrana/adminer/commit/596f8df373cd3efe5bcb6013858bd7a6bb5ecb2c 2015-08-05 2016-02-17 adminer -- XSS vulnerability adminer 4.2.0

Jakub Vrana reports:

Fix XSS in login form

https://github.com/vrana/adminer/commit/c990de3b3ee1816afb130bd0e1570577bf54a8e5 https://sourceforge.net/p/adminer/bugs-and-features/436/ 2015-01-30 2016-02-17 libgcrypt -- side-channel attack on ECDH libgcrypt 1.6.5

GnuPG reports:

Mitigate side-channel attack on ECDH with Weierstrass curves.

CVE-2015-7511 https://lists.gnupg.org/pipermail/gnupg-announce/2016q1/000384.html 2016-02-09 2016-02-16 xdelta3 -- buffer overflow vulnerability xdelta3 3.0.9,1

Stepan Golosunov reports:

Buffer overflow was found and fixed in xdelta3 binary diff tool that allows arbitrary code execution from input files at least on some systems.

CVE-2014-9765 http://www.openwall.com/lists/oss-security/2016/02/08/1 https://github.com/jmacd/xdelta-devel/commit/ef93ff74203e030073b898c05e8b4860b5d09ef2 2014-10-08 2016-02-16 firefox -- Same-origin-policy violation using Service Workers with plugins firefox 44.0.2,1 linux-firefox 44.0.2,1

The Mozilla Foundation reports:

MFSA 2016-13 Jason Pang of OneSignal reported that service workers intercept responses to plugin network requests made through the browser. Plugins which make security decisions based on the content of network requests can have these decisions subverted if a service worker forges responses to those requests. For example, a forged crossdomain.xml could allow a malicious site to violate the same-origin policy using the Flash plugin.

CVE-2016-1949 https://www.mozilla.org/en-US/security/advisories/mfsa2016-13/ 2016-02-11 2016-02-15 nghttp2 -- Out of memory in nghttpd, nghttp, and libnghttp2_asio nghttp2 1.7.1

Nghttp2 reports:

Out of memory in nghttpd, nghttp, and libnghttp2_asio applications due to unlimited incoming HTTP header fields.

nghttpd, nghttp, and libnghttp2_asio applications do not limit the memory usage for the incoming HTTP header field. If peer sends specially crafted HTTP/2 HEADERS frames and CONTINUATION frames, they will crash with out of memory error.

Note that libnghttp2 itself is not affected by this vulnerability.

http://nghttp2.org/blog/2016/02/11/nghttp2-v1-7-1/ CVE-2016-1544 2016-02-03 2016-02-13 horde -- XSS vulnerabilities horde 5.2.9 pear-Horde_Core 2.22.6

The Horde Team reports:

Fixed XSS vulnerabilities in menu bar and form renderer.

CVE-2015-8807 CVE-2016-2228 https://github.com/horde/horde/commit/11d74fa5a22fe626c5e5a010b703cd46a136f253 https://bugs.horde.org/ticket/14213 https://github.com/horde/horde/commit/f03301cf6edcca57121a15e80014c4d0f29d99a0 https://github.com/horde/horde/commit/ab07a1b447de34e13983b4d7ceb18b58c3a358d8 http://www.openwall.com/lists/oss-security/2016/02/06/4 http://lists.horde.org/archives/announce/2016/001149.html 2016-02-02 2016-02-14 PostgreSQL -- Security Fixes for Regular Expressions, PL/Java. postgresql91-server 9.1.09.1.20 postgresql92-server 9.2.09.2.15 postgresql93-server 9.3.09.3.11 postgresql94-server 9.4.09.4.6 postgresql95-server 9.5.09.5.1

PostgreSQL project reports:

Security Fixes for Regular Expressions, PL/Java

CVE-2016-0773: This release closes security hole CVE-2016-0773, an issue with regular expression (regex) parsing. Prior code allowed users to pass in expressions which included out-of-range Unicode characters, triggering a backend crash. This issue is critical for PostgreSQL systems with untrusted users or which generate regexes based on user input.

CVE-2016-0766: The update also fixes CVE-2016-0766, a privilege escalation issue for users of PL/Java. Certain custom configuration settings (GUCS) for PL/Java will now be modifiable only by the database superuser

CVE-2016-0773 CVE-2016-0766 2016-02-08 2016-02-12 flash -- multiple vulnerabilities linux-c6-flashplugin linux-f10-flashplugin linux-c6_64-flashplugin 11.2r202.569

Adobe reports:

These updates resolve a type confusion vulnerability that could lead to code execution (CVE-2016-0985).

These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2016-0973, CVE-2016-0974, CVE-2016-0975, CVE-2016-0982, CVE-2016-0983, CVE-2016-0984).

These updates resolve a heap buffer overflow vulnerability that could lead to code execution (CVE-2016-0971).

These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2016-0964, CVE-2016-0965, CVE-2016-0966, CVE-2016-0967, CVE-2016-0968, CVE-2016-0969, CVE-2016-0970, CVE-2016-0972, CVE-2016-0976, CVE-2016-0977, CVE-2016-0978, CVE-2016-0979, CVE-2016-0980, CVE-2016-0981).

CVE-2016-0964 CVE-2016-0965 CVE-2016-0966 CVE-2016-0967 CVE-2016-0968 CVE-2016-0969 CVE-2016-0970 CVE-2016-0971 CVE-2016-0972 CVE-2016-0973 CVE-2016-0974 CVE-2016-0975 CVE-2016-0976 CVE-2016-0977 CVE-2016-0978 CVE-2016-0979 CVE-2016-0980 CVE-2016-0981 CVE-2016-0982 CVE-2016-0983 CVE-2016-0984 CVE-2016-0985 https://helpx.adobe.com/security/products/flash-player/apsb16-04.html 2016-02-09 2016-02-10 dnscrypt-proxy -- code execution dnscrypt-proxy 1.1.01.6.1

Frank Denis reports:

Malformed packets could lead to denial of service or code execution.

https://github.com/jedisct1/dnscrypt-proxy/blob/1d129f7d5f0d469308967cbe4eacb4a6919f1fa1/NEWS#L2-L8 2016-02-02 2016-02-10 2016-02-14 chromium -- multiple vulnerabilities chromium chromium-npapi chromium-pulse 48.0.2564.109

Google Chrome Releases reports:

6 security fixes in this release, including:

[546677] High CVE-2016-1622: Same-origin bypass in Extensions. Credit to anonymous.

[577105] High CVE-2016-1623: Same-origin bypass in DOM. Credit to Mariusz Mlynski.

[509313] Medium CVE-2016-1625: Navigation bypass in Chrome Instant. Credit to Jann Horn.

[571480] Medium CVE-2016-1626: Out-of-bounds read in PDFium. Credit to anonymous, working with HP's Zero Day Initiative.

[585517] CVE-2016-1627: Various fixes from internal audits, fuzzing and other initiatives.

CVE-2016-1622 CVE-2016-1623 CVE-2016-1625 CVE-2016-1626 CVE-2016-1627 http://googlechromereleases.blogspot.nl/2016/02/stable-channel-update_9.html 2016-02-08 2016-02-09 2016-03-08 graphite2 -- code execution vulnerability graphite2 1.3.5 silgraphite 2.3.1_4 linux-thunderbird 38.6.0

Talos reports:

An exploitable denial of service vulnerability exists in the font handling of Libgraphite. A specially crafted font can cause an out-of-bounds read potentially resulting in an information leak or denial of service.

A specially crafted font can cause a buffer overflow resulting in potential code execution.

An exploitable NULL pointer dereference exists in the bidirectional font handling functionality of Libgraphite. A specially crafted font can cause a NULL pointer dereference resulting in a crash.

http://blog.talosintel.com/2016/02/vulnerability-spotlight-libgraphite.html http://www.talosintel.com/reports/TALOS-2016-0061/ https://www.mozilla.org/security/advisories/mfsa2016-14/ CVE-2016-1521 CVE-2016-1522 CVE-2016-1523 CVE-2016-1526 2016-02-05 2016-02-09 2016-03-08 xymon-server -- multiple vulnerabilities xymon-server 4.3.25

J.C. Cleaver reports:

CVE-2016-2054: Buffer overflow in xymond handling of "config" command

CVE-2016-2055: Access to possibly confidential files in the Xymon configuration directory

CVE-2016-2056: Shell command injection in the "useradm" and "chpasswd" web applications

CVE-2016-2057: Incorrect permissions on IPC queues used by the xymond daemon can bypass IP access filtering

CVE-2016-2058: Javascript injection in "detailed status webpage" of monitoring items; XSS vulnerability via malformed acknowledgment messages

http://lists.xymon.com/pipermail/xymon/2016-February/042986.html CVE-2016-2054 CVE-2016-2055 CVE-2016-2056 CVE-2016-2057 CVE-2016-2058 2016-01-19 2016-02-09 php -- multiple vulnerabilities php55 php55-phar php55-wddx 5.5.32 php56 php56-phar php56-wddx 5.6.18

PHP reports:

Core:

Fixed bug #71039 (exec functions ignore length but look for NULL termination).

Fixed bug #71323 (Output of stream_get_meta_data can be falsified by its input).

Fixed bug #71459 (Integer overflow in iptcembed()).

PCRE:

Upgraded bundled PCRE library to 8.38.(CVE-2015-8383, CVE-2015-8386, CVE-2015-8387, CVE-2015-8389, CVE-2015-8390, CVE-2015-8391, CVE-2015-8393, CVE-2015-8394)

Phar:

Fixed bug #71354 (Heap corruption in tar/zip/phar parser).

Fixed bug #71391 (NULL Pointer Dereference in phar_tar_setupmetadata()).

Fixed bug #71488 (Stack overflow when decompressing tar archives). (CVE-2016-2554)

WDDX:

Fixed bug #71335 (Type Confusion in WDDX Packet Deserialization).

CVE-2015-8383 CVE-2015-8386 CVE-2015-8387 CVE-2015-8389 CVE-2015-8390 CVE-2015-8391 CVE-2015-8393 CVE-2015-8394 CVE-2016-2554 http://php.net/ChangeLog-5.php#5.6.18 http://php.net/ChangeLog-5.php#5.5.32 2016-02-04 2016-02-09 2016-03-13 py-imaging, py-pillow -- Buffer overflow in PCD decoder py27-pillow py33-pillow py34-pillow py35-pillow 2.9.0_1 py27-imaging 1.1.7_6

The Pillow maintainers report:

In all versions of Pillow, dating back at least to the last PIL 1.1.7 release, PcdDecode.c has a buffer overflow error.

The state.buffer for PcdDecode.c is allocated based on a 3 bytes per pixel sizing, where PcdDecode.c wrote into the buffer assuming 4 bytes per pixel. This writes 768 bytes beyond the end of the buffer into other Python object storage. In some cases, this causes a segfault, in others an internal Python malloc error.

http://openwall.com/lists/oss-security/2016/02/02/5 https://github.com/python-pillow/Pillow/commit/ae453aa18b66af54e7ff716f4ccb33adca60afd4 https://github.com/python-pillow/Pillow/issues/568 2016-02-02 2016-02-09 py-pillow -- Integer overflow in Resample.c py27-pillow py33-pillow py34-pillow py35-pillow 2.9.0_1

The Pillow maintainers report:

If a large value was passed into the new size for an image, it is possible to overflow an int32 value passed into malloc, leading the malloc’d buffer to be undersized. These allocations are followed by a loop that writes out of bounds. This can lead to corruption on the heap of the Python process with attacker controlled float data.

This issue was found by Ned Williamson.

https://github.com/python-pillow/Pillow/commit/41fae6d9e2da741d2c5464775c7f1a609ea03798 https://github.com/python-pillow/Pillow/issues/1710 2016-02-05 2016-02-09 py-imaging, py-pillow -- Buffer overflow in FLI decoding code py27-pillow py33-pillow py34-pillow py35-pillow 2.9.0_1 py27-imaging 1.1.7_6

The Pillow maintainers report:

In all versions of Pillow, dating back at least to the last PIL 1.1.7 release, FliDecode.c has a buffer overflow error.

There is a memcpy error where x is added to a target buffer address. X is used in several internal temporary variable roles, but can take a value up to the width of the image. Im->image[y] is a set of row pointers to segments of memory that are the size of the row. At the max y, this will write the contents of the line off the end of the memory buffer, causing a segfault.

This issue was found by Alyssa Besseling at Atlassian.

CVE-2016-0775 https://github.com/python-pillow/Pillow/commit/bcaaf97f4ff25b3b5b9e8efeda364e17e80858ec 2016-02-05 2016-02-09 py-pillow -- Buffer overflow in TIFF decoding code py27-pillow py33-pillow py34-pillow py35-pillow 2.9.0_1

The Pillow maintainers report:

Pillow 3.1.0 and earlier when linked against libtiff >= 4.0.0 on x64 may overflow a buffer when reading a specially crafted tiff file.

Specifically, libtiff >= 4.0.0 changed the return type of TIFFScanlineSize from int32 to machine dependent int32|64. If the scanline is sized so that it overflows an int32, it may be interpreted as a negative number, which will then pass the size check in TiffDecode.c line 236. To do this, the logical scanline size has to be > 2gb, and for the test file, the allocated buffer size is 64k against a roughly 4gb scan line size. Any image data over 64k is written over the heap, causing a segfault.

This issue was found by security researcher FourOne.

CVE-2016-0740 https://github.com/python-pillow/Pillow/commit/6dcbf5bd96b717c58d7b642949da8d323099928e 2016-02-04 2016-02-09 ffmpeg -- remote denial of service in JPEG2000 decoder ffmpeg 2.8.6,1 mplayer mencoder 1.2.r20151219_3

FFmpeg security reports:

FFmpeg 2.8.6 fixes the following vulnerabilities: CVE-2016-2213

CVE-2016-2213 https://www.ffmpeg.org/security.html 2016-01-27 2016-02-06 shotwell -- not verifying certificates shotwell 0.22.0.99

Michael Catanzaro reports:

Shotwell has a serious security issue ("Shotwell does not verify TLS certificates"). Upstream is no longer active and I do not expect any further upstream releases unless someone from the community steps up to maintain it.

What is the impact of the issue? If you ever used any of the publish functionality (publish to Facebook, publish to Flickr, etc.), your passwords may have been stolen; changing them is not a bad idea.

What is the risk of the update? Regressions. The easiest way to validate TLS certificates was to upgrade WebKit; it seems to work but I don't have accounts with the online services it supports, so I don't know if photo publishing still works properly on all the services.

https://mail.gnome.org/archives/distributor-list/2016-January/msg00000.html 2016-01-06 2016-02-05 webkit -- UI spoof webkit-gtk2 webkit-gtk3 2.4.9_1

webkit reports:

The ScrollView::paint function in platform/scroll/ScrollView.cpp in Blink, as used in Google Chrome before 35.0.1916.114, allows remote attackers to spoof the UI by extending scrollbar painting into the parent frame.

CVE-2014-1748 http://webkitgtk.org/security/WSA-2015-0002.html 2015-12-28 2016-02-04 py-rsa -- Bleichenbacher'06 signature forgery vulnerability py27-rsa py32-rsa py33-rsa py34-rsa py35-rsa 3.3

Filippo Valsorda reports:

python-rsa is vulnerable to a straightforward variant of the Bleichenbacher'06 attack against RSA signature verification with low public exponent.

CVE-2016-1494 https://blog.filippo.io/bleichenbacher-06-signature-forgery-in-python-rsa/ https://bitbucket.org/sybren/python-rsa/pull-requests/14/security-fix-bb06-attack-in-verify-by https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1494 http://www.openwall.com/lists/oss-security/2016/01/05/3 http://www.openwall.com/lists/oss-security/2016/01/05/1 2016-01-05 2016-02-04 asterisk -- Multiple vulnerabilities asterisk 1.8.32.3_5 asterisk11 11.21.1 asterisk13 13.7.1

The Asterisk project reports:

AST-2016-001 - BEAST vulnerability in HTTP server

AST-2016-002 - File descriptor exhaustion in chan_sip

AST-2016-003 - Remote crash vulnerability when receiving UDPTL FAX data

http://downloads.asterisk.org/pub/security/AST-2016-001.html CVE-2011-3389 http://downloads.asterisk.org/pub/security/AST-2016-002.html CVE-2016-2316 http://downloads.asterisk.org/pub/security/AST-2016-003.html CVE-2016-2232 2016-02-03 2016-02-04 2016-03-07 salt -- code execution py27-salt py32-salt py33-salt py34-salt py35-salt 2015.8.02015.8.4

SaltStack reports:

Improper handling of clear messages on the minion, which could result in executing commands not sent by the master.

https://docs.saltstack.com/en/latest/topics/releases/2015.8.4.html https://github.com/saltstack/salt/pull/30613/files CVE-2016-1866 2016-01-25 2016-02-03 rails -- multiple vulnerabilities rubygem-actionpack 3.2.22.1 rubygem-actionpack4 4.2.5.1 rubygem-actionview 4.2.5.1 rubygem-activemodel4 4.2.5.1 rubygem-activerecord 3.2.22.1 rubygem-activerecord4 4.2.5.1 rubygem-rails 3.2.22.1 rubygem-rails-html-sanitizer 1.0.3 rubygem-rails4 4.2.5.1

Ruby on Rails blog:

Rails 5.0.0.beta1.1, 4.2.5.1, 4.1.14.1, and 3.2.22.1 have been released! These contain important security fixes, and it is recommended that users upgrade as soon as possible.

CVE-2015-7576 CVE-2015-7577 CVE-2015-7581 CVE-2016-0751 CVE-2016-0752 CVE-2016-0753 https://groups.google.com/d/msg/rubyonrails-security/ANv0HDHEC3k/mt7wNGxbFQAJ https://groups.google.com/d/msg/rubyonrails-security/cawsWcQ6c8g/tegZtYdbFQAJ https://groups.google.com/d/msg/rubyonrails-security/dthJ5wL69JE/YzPnFelbFQAJ https://groups.google.com/d/msg/rubyonrails-security/9oLY_FCzvoc/w9oI9XxbFQAJ https://groups.google.com/d/msg/rubyonrails-security/335P1DcLG00/OfB9_LhbFQAJ https://groups.google.com/d/msg/rubyonrails-security/6jQVC1geukQ/8oYETcxbFQAJ http://weblog.rubyonrails.org/2016/1/25/Rails-5-0-0-beta1-1-4-2-5-1-4-1-14-1-3-2-22-1-and-rails-html-sanitizer-1-0-3-have-been-released/ 2016-01-25 2016-02-02 socat -- diffie hellman parameter was not prime socat 1.7.2.51.7.3.1

socat reports:

In the OpenSSL address implementation the hard coded 1024 bit DH p parameter was not prime. The effective cryptographic strength of a key exchange using these parameters was weaker than the one one could get by using a prime p. Moreover, since there is no indication of how these parameters were chosen, the existence of a trapdoor that makes possible for an eavesdropper to recover the shared secret from a key exchange that uses them cannot be ruled out.

http://www.dest-unreach.org/socat/contrib/socat-secadv7.html 2016-02-01 2016-02-01 mozilla -- multiple vulnerabilities firefox linux-firefox 44.0,1 seamonkey linux-seamonkey 2.41 firefox-esr 38.6.0,1 libxul thunderbird linux-thunderbird 38.6.0

Mozilla Foundation reports:

MFSA 2016-01 Miscellaneous memory safety hazards (rv:44.0 / rv:38.6)

MFSA 2016-02 Out of Memory crash when parsing GIF format images

MFSA 2016-03 Buffer overflow in WebGL after out of memory allocation

MFSA 2016-04 Firefox allows for control characters to be set in cookie names

MFSA 2016-06 Missing delay following user click events in protocol handler dialog

MFSA 2016-09 Addressbar spoofing attacks

MFSA 2016-10 Unsafe memory manipulation found through code inspection

MFSA 2016-11 Application Reputation service disabled in Firefox 43

CVE-2015-7208 CVE-2016-1930 CVE-2016-1931 CVE-2016-1933 CVE-2016-1935 CVE-2016-1937 CVE-2016-1939 CVE-2016-1942 CVE-2016-1943 CVE-2016-1944 CVE-2016-1945 CVE-2016-1946 CVE-2016-1947 https://www.mozilla.org/security/advisories/mfsa2016-01/ https://www.mozilla.org/security/advisories/mfsa2016-02/ https://www.mozilla.org/security/advisories/mfsa2016-03/ https://www.mozilla.org/security/advisories/mfsa2016-04/ https://www.mozilla.org/security/advisories/mfsa2016-06/ https://www.mozilla.org/security/advisories/mfsa2016-09/ https://www.mozilla.org/security/advisories/mfsa2016-10/ https://www.mozilla.org/security/advisories/mfsa2016-11/ 2016-01-26 2016-02-01 2016-03-08 gdcm -- multiple vulnerabilities gdcm 2.6.2

CENSUS S.A. reports:

GDCM versions 2.6.0 and 2.6.1 (and possibly previous versions) are prone to an integer overflow vulnerability which leads to a buffer overflow and potentially to remote code execution.

GDCM versions 2.6.0 and 2.6.1 (and possibly previous versions) are prone to an out-of-bounds read vulnerability due to missing checks.

CVE-2015-8396 CVE-2015-8397 http://census-labs.com/news/2016/01/11/gdcm-buffer-overflow-imageregionreaderreadintobuffer/ http://census-labs.com/news/2016/01/11/gdcm-out-bounds-read-jpeglscodec-decodeextent/ 2015-12-23 2016-02-01 nginx -- multiple vulnerabilities nginx 1.8.1,2 nginx-devel 1.9.10

Maxim Dounin reports:

Several problems in nginx resolver were identified, which might allow an attacker to cause worker process crash, or might have potential other impact if the "resolver" directive is used in a configuration file.

http://mailman.nginx.org/pipermail/nginx/2016-January/049700.html CVE-2016-0742 CVE-2016-0746 CVE-2016-0747 2016-01-26 2016-01-30 typo3 -- multiple vulnerabilities typo3 7.6.1 typo3-lts 6.2.16

TYPO3 Security Team reports:

It has been discovered that TYPO3 CMS is susceptible to Cross-Site Scripting and Cross-Site Flashing.

http://lists.typo3.org/pipermail/typo3-announce/2015/000351.html https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-010/ https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-011/ https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-012/ https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-013/ https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-014/ https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-015/ 2015-12-15 2016-01-29 nghttp2 -- use after free nghttp2 1.6.0

nghttp2 reports:

This release fixes heap-use-after-free bug in idle stream handling code. We strongly recommend to upgrade the older installation to this latest version as soon as possible.

https://nghttp2.org/blog/2015/12/23/nghttp2-v1-6-0/ CVE-2015-8659 2015-12-23 2016-01-29 owncloud -- multiple vulnerabilities owncloud 8.2.2

Owncloud reports:

Reflected XSS in OCS provider discovery (oC-SA-2016-001)

Information Exposure Through Directory Listing in the file scanner (oC-SA-2016-002)

Disclosure of files that begin with ".v" due to unchecked return value (oC-SA-2016-003)

https://owncloud.org/blog/owncloud-8-2-2-8-1-5-8-0-10-and-7-0-12-here-with-sharing-ldap-fixes/ https://owncloud.org/security/advisory/?id=oc-sa-2016-001 https://owncloud.org/security/advisory/?id=oc-sa-2016-002 https://owncloud.org/security/advisory/?id=oc-sa-2016-003 CVE-2016-1498 CVE-2016-1499 CVE-2016-1500 2015-12-23 2016-01-29 radicale -- multiple vulnerabilities py27-radicale py32-radicale py33-radicale py34-radicale 1.1

Radicale reports:

The multifilesystem backend allows access to arbitrary files on all platforms.

Prevent regex injection in rights management.

http://www.openwall.com/lists/oss-security/2016/01/06/4 CVE-2015-8747 CVE-2015-8748 2015-12-24 2016-01-29 phpmyadmin -- XSS vulnerability in SQL editor phpmyadmin 4.5.04.5.4

The phpMyAdmin development team reports:

With a crafted SQL query, it is possible to trigger an XSS attack in the SQL editor.

We consider this vulnerability to be non-critical.

This vulnerability can be triggered only by someone who is logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required pages.

https://www.phpmyadmin.net/security/PMASA-2016-9/ CVE-2016-2045 2016-01-28 2016-01-28 phpmyadmin -- Full path disclosure vulnerability in SQL parser phpmyadmin 4.5.04.5.4

The phpMyAdmin development team reports:

By calling a particular script that is part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed.

We consider this vulnerability to be non-critical.

This path disclosure is possible on servers where the recommended setting of the PHP configuration directive display_errors is set to on, which is against the recommendations given in the PHP manual for a production server.

https://www.phpmyadmin.net/security/PMASA-2016-8/ CVE-2016-2044 2016-01-28 2016-01-28 phpmyadmin -- XSS vulnerability in normalization page phpmyadmin 4.5.04.5.4

The phpMyAdmin development team reports:

With a crafted table name it is possible to trigger an XSS attack in the database normalization page.

We consider this vulnerability to be non-critical.

This vulnerability can be triggered only by someone who is logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required page.

https://www.phpmyadmin.net/security/PMASA-2016-7/ CVE-2016-2043 2016-01-28 2016-01-28 phpmyadmin -- Multiple full path disclosure vulnerabilities phpmyadmin 4.5.04.5.4

The phpMyAdmin development team reports:

By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed.

We consider these vulnerabilities to be non-critical.

This path disclosure is possible on servers where the recommended setting of the PHP configuration directive display_errors is set to on, which is against the recommendations given in the PHP manual for a production server.

https://www.phpmyadmin.net/security/PMASA-2016-6/ CVE-2016-2042 2016-01-28 2016-01-28 phpmyadmin -- Unsafe comparison of XSRF/CSRF token phpmyadmin 4.5.04.5.4

The phpMyAdmin development team reports:

The comparison of the XSRF/CSRF token parameter with the value saved in the session is vulnerable to timing attacks. Moreover, the comparison could be bypassed if the XSRF/CSRF token matches a particular pattern.

We consider this vulnerability to be serious.

https://www.phpmyadmin.net/security/PMASA-2016-5/ CVE-2016-2041 2016-01-28 2016-01-28 phpmyadmin -- Insecure password generation in JavaScript phpmyadmin 4.5.04.5.4

The phpMyAdmin development team reports:

Password suggestion functionality uses Math.random() which does not provide cryptographically secure random numbers.

We consider this vulnerability to be non-critical.

https://www.phpmyadmin.net/security/PMASA-2016-4/ CVE-2016-1927 2016-01-28 2016-01-28 phpmyadmin -- Multiple XSS vulnerabilities phpmyadmin 4.5.04.5.4

The phpMyAdmin development team reports:

With a crafted table name it is possible to trigger an XSS attack in the database search page.

With a crafted SET value or a crafted search query, it is possible to trigger an XSS attacks in the zoom search page.

With a crafted hostname header, it is possible to trigger an XSS attacks in the home page.

We consider these vulnerabilities to be non-critical.

These vulnerabilities can be triggered only by someone who is logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required pages.

https://www.phpmyadmin.net/security/PMASA-2016-3/ CVE-2016-2040 2016-01-28 2016-01-28 phpmyadmin -- Unsafe generation of XSRF/CSRF token phpmyadmin 4.5.04.5.4

The phpMyAdmin development team reports:

The XSRF/CSRF token is generated with a weak algorithm using functions that do not return cryptographically secure values.

We consider this vulnerability to be non-critical.

https://www.phpmyadmin.net/security/PMASA-2016-2/ CVE-2016-2039 2016-01-28 2016-01-28 phpmyadmin -- Multiple full path disclosure vulnerabilities phpmyadmin 4.5.04.5.4

The phpMyAdmin development team reports:

By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed.

We consider these vulnerabilities to be non-critical.

This path disclosure is possible on servers where the recommended setting of the PHP configuration directive display_errors is set to on, which is against the recommendations given in the PHP manual for a production server.

https://www.phpmyadmin.net/security/PMASA-2016-1/ CVE-2016-2038 2016-01-28 2016-01-28 prosody -- user impersonation vulnerability prosody 0.9.10

The Prosody team reports:

Adopt key generation algorithm from XEP-0185, to prevent impersonation attacks (CVE-2016-0756)

ports/206707 CVE-2016-0756 https://prosody.im/security/advisory_20160127/ 2016-01-27 2016-01-28 openssl -- multiple vulnerabilities openssl 1.0.2_7 mingw32-openssl 1.0.11.0.2f FreeBSD 10.210.2_12 10.110.1_29 9.39.3_36

OpenSSL project reports:

Historically OpenSSL only ever generated DH parameters based on "safe" primes. More recently (in version 1.0.2) support was provided for generating X9.42 style parameter files such as those required for RFC 5114 support. The primes used in such files may not be "safe". Where an application is using DH configured with parameters based on primes that are not "safe" then an attacker could use this fact to find a peer's private DH exponent. This attack requires that the attacker complete multiple handshakes in which the peer uses the same private DH exponent. For example this could be used to discover a TLS server's private DH exponent if it's reusing the private DH exponent or it's using a static DH ciphersuite. OpenSSL provides the option SSL_OP_SINGLE_DH_USE for ephemeral DH (DHE) in TLS. It is not on by default. If the option is not set then the server reuses the same private DH exponent for the life of the server process and would be vulnerable to this attack. It is believed that many popular applications do set this option and would therefore not be at risk. (CVE-2016-0701)

A malicious client can negotiate SSLv2 ciphers that have been disabled on the server and complete SSLv2 handshakes even if all SSLv2 ciphers have been disabled, provided that the SSLv2 protocol was not also disabled via SSL_OP_NO_SSLv2. (CVE-2015-3197)

SA-16:11.openssl CVE-2016-0701 CVE-2015-3197 https://www.openssl.org/news/secadv/20160128.txt 2016-01-22 2016-01-28 2016-08-09 curl -- Credentials not checked curl 7.10.07.47.0

The cURL project reports:

libcurl will reuse NTLM-authenticated proxy connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer.

http://curl.haxx.se/docs/adv_20160127A.html CVE-2016-0755 2016-01-27 2016-01-27 2017-02-06 wordpress -- XSS vulnerability wordpress 4.4.1,1 de-wordpress ja-wordpress ru-wordpress zh-wordpress-zh_CN zh-wordpress-zh_TW 4.4.1

Aaron Jorbin reports:

WordPress 4.4.1 is now available. This is a security release for all previous versions and we strongly encourage you to update your sites immediately.

WordPress versions 4.4 and earlier are affected by a cross-site scripting vulnerability that could allow a site to be compromised. This was reported by Crtc4L.

CVE-2016-1564 http://www.openwall.com/lists/oss-security/2016/01/08/3 https://wordpress.org/news/2016/01/wordpress-4-4-1-security-and-maintenance-release/ 2016-01-06 2016-01-26 2016-03-08 privoxy -- multiple vulnerabilities privoxy 3.0.24

Privoxy Developers reports:

Prevent invalid reads in case of corrupt chunk-encoded content. CVE-2016-1982. Bug discovered with afl-fuzz and AddressSanitizer.

Remove empty Host headers in client requests. Previously they would result in invalid reads. CVE-2016-1983. Bug discovered with afl-fuzz and AddressSanitizer.

CVE-2016-1982 CVE-2016-1983 ports/206504 http://www.privoxy.org/3.0.24/user-manual/whatsnew.html http://www.openwall.com/lists/oss-security/2016/01/21/4 2016-01-22 2016-01-26 privoxy -- multiple vulnerabilities privoxy 3.0.23

Privoxy Developers reports:

Fixed a DoS issue in case of client requests with incorrect chunk-encoded body. When compiled with assertions enabled (the default) they could previously cause Privoxy to abort(). Reported by Matthew Daley. CVE-2015-1380.

Fixed multiple segmentation faults and memory leaks in the pcrs code. This fix also increases the chances that an invalid pcrs command is rejected as such. Previously some invalid commands would be loaded without error. Note that Privoxy's pcrs sources (action and filter files) are considered trustworthy input and should not be writable by untrusted third-parties. CVE-2015-1381.

Fixed an 'invalid read' bug which could at least theoretically cause Privoxy to crash. So far, no crashes have been observed. CVE-2015-1382.

CVE-2015-1380 CVE-2015-1381 CVE-2015-1382 ports/197089 http://www.privoxy.org/3.0.23/user-manual/whatsnew.html http://www.openwall.com/lists/oss-security/2015/01/26/4 2015-01-26 2016-01-26 privoxy -- multiple vulnerabilities privoxy 3.0.22

Privoxy Developers reports:

Fixed a memory leak when rejecting client connections due to the socket limit being reached (CID 66382). This affected Privoxy 3.0.21 when compiled with IPv6 support (on most platforms this is the default).

Fixed an immediate-use-after-free bug (CID 66394) and two additional unconfirmed use-after-free complaints made by Coverity scan (CID 66391, CID 66376).

MITRE reports:

Privoxy before 3.0.22 allows remote attackers to cause a denial of service (file descriptor consumption) via unspecified vectors.

CVE-2015-1030 CVE-2015-1031 CVE-2015-1201 ports/195468 http://www.privoxy.org/3.0.22/user-manual/whatsnew.html http://www.openwall.com/lists/oss-security/2015/01/11/1 2015-01-10 2016-01-26 privoxy -- malicious server spoofing as proxy vulnerability privoxy 3.0.21

Privoxy Developers reports:

Proxy authentication headers are removed unless the new directive enable-proxy-authentication-forwarding is used. Forwarding the headers potentially allows malicious sites to trick the user into providing them with login information. Reported by Chris John Riley.

CVE-2013-2503 ports/176813 http://www.privoxy.org/3.0.21/user-manual/whatsnew.html 2013-03-07 2016-01-26 sudo -- potential privilege escalation via symlink misconfiguration sudo 1.8.15

MITRE reports:

sudoedit in Sudo before 1.8.15 allows local users to gain privileges via a symlink attack on a file whose full path is defined using multiple wildcards in /etc/sudoers, as demonstrated by "/home/*/*/file.txt."

CVE-2015-5602 ports/206590 https://www.exploit-db.com/exploits/37710/ https://bugzilla.sudo.ws/show_bug.cgi?id=707 http://www.sudo.ws/stable.html#1.8.15 2015-11-17 2016-01-26 imlib2 -- denial of service vulnerabilities imlib2 1.4.7

Enlightenment reports:

GIF loader: Fix segv on images without colormap

Prevent division-by-zero crashes.

Fix segfault when opening input/queue/id:000007,src:000000,op:flip1,pos:51 with feh

https://git.enlightenment.org/legacy/imlib2.git/tree/ChangeLog http://seclists.org/oss-sec/2016/q1/162 CVE-2014-9762 CVE-2014-9763 CVE-2014-9764 2013-12-21 2016-01-22 bind -- denial of service vulnerability bind99 9.9.8P3 bind910 9.10.3P3 FreeBSD 9.39.3_35

ISC reports:

Specific APL data could trigger an INSIST in apl_42.c

https://kb.isc.org/article/AA-01335 CVE-2015-8704 SA-16:08.bind 2016-01-19 2016-01-22 2016-08-09 chromium -- multiple vulnerabilities chromium chromium-npapi chromium-pulse 48.0.2564.82

Google Chrome Releases reports:

This update includes 37 security fixes, including:

[497632] High CVE-2016-1612: Bad cast in V8.

[572871] High CVE-2016-1613: Use-after-free in PDFium.

[544691] Medium CVE-2016-1614: Information leak in Blink.

[468179] Medium CVE-2016-1615: Origin confusion in Omnibox.

[541415] Medium CVE-2016-1616: URL Spoofing.

[544765] Medium CVE-2016-1617: History sniffing with HSTS and CSP.

[552749] Medium CVE-2016-1618: Weak random number generator in Blink.

[557223] Medium CVE-2016-1619: Out-of-bounds read in PDFium.

[579625] CVE-2016-1620: Various fixes from internal audits, fuzzing and other initiatives.

Multiple vulnerabilities in V8 fixed at the tip of the 4.8 branch.

CVE-2016-1612 CVE-2016-1613 CVE-2016-1614 CVE-2016-1615 CVE-2016-1616 CVE-2016-1617 CVE-2016-1618 CVE-2016-1619 CVE-2016-1620 http://googlechromereleases.blogspot.de/2016/01/stable-channel-update_20.html 2016-01-20 2016-01-21 ntp -- multiple vulnerabilities ntp 4.2.8p6 ntp-devel 4.3.90 FreeBSD 10.210.2_11 10.110.1_28 9.39.3_35

Network Time Foundation reports:

NTF's NTP Project has been notified of the following low- and medium-severity vulnerabilities that are fixed in ntp-4.2.8p6, released on Tuesday, 19 January 2016:

Bug 2948 / CVE-2015-8158: Potential Infinite Loop in ntpq. Reported by Cisco ASIG.

Bug 2945 / CVE-2015-8138: origin: Zero Origin Timestamp Bypass. Reported by Cisco ASIG.

Bug 2942 / CVE-2015-7979: Off-path Denial of Service (DoS) attack on authenticated broadcast mode. Reported by Cisco ASIG.

Bug 2940 / CVE-2015-7978: Stack exhaustion in recursive traversal of restriction list. Reported by Cisco ASIG.

Bug 2939 / CVE-2015-7977: reslist NULL pointer dereference. Reported by Cisco ASIG.

Bug 2938 / CVE-2015-7976: ntpq saveconfig command allows dangerous characters in filenames. Reported by Cisco ASIG.

Bug 2937 / CVE-2015-7975: nextvar() missing length check. Reported by Cisco ASIG.

Bug 2936 / CVE-2015-7974: Skeleton Key: Missing key check allows impersonation between authenticated peers. Reported by Cisco ASIG.

Bug 2935 / CVE-2015-7973: Deja Vu: Replay attack on authenticated broadcast mode. Reported by Cisco ASIG.

Additionally, mitigations are published for the following two issues:

Bug 2947 / CVE-2015-8140: ntpq vulnerable to replay attacks. Reported by Cisco ASIG.

Bug 2946 / CVE-2015-8139: Origin Leak: ntpq and ntpdc, disclose origin. Reported by Cisco ASIG.

SA-16:09.ntp CVE-2015-7973 CVE-2015-7974 CVE-2015-7975 CVE-2015-7976 CVE-2015-7977 CVE-2015-7978 CVE-2015-7979 CVE-2015-8138 CVE-2015-8139 CVE-2015-8140 CVE-2015-8158 http://support.ntp.org/bin/view/Main/SecurityNotice#January_2016_NTP_4_2_8p6_Securit 2016-01-20 2016-01-21 2016-08-09 cgit -- multiple vulnerabilities cgit 0.12

Jason A. Donenfeld reports:

Reflected Cross Site Scripting and Header Injection in Mimetype Query String.

Stored Cross Site Scripting and Header Injection in Filename Parameter.

Integer Overflow resulting in Buffer Overflow.

CVE-2016-1899 CVE-2016-1900 CVE-2016-1901 ports/206417 http://lists.zx2c4.com/pipermail/cgit/2016-January/002817.html http://www.openwall.com/lists/oss-security/2016/01/14/6 2016-01-14 2016-01-20 bind -- denial of service vulnerability bind910 9.10.3P3

ISC reports:

Problems converting OPT resource records and ECS options to text format can cause BIND to terminate

https://kb.isc.org/article/AA-01336 CVE-2015-8705 2016-01-19 2016-01-20 2016-01-22 claws-mail -- no bounds checking on the output buffer in conv_jistoeuc, conv_euctojis, conv_sjistoeuc claws-mail 3.13.2

DrWhax reports:

So in codeconv.c there is a function for japanese character set conversion called conv_jistoeuc(). There is no bounds checking on the output buffer, which is created on the stack with alloca() Bug can be triggered by sending an email to TAILS_luser@riseup.net or whatever. Since my C is completely rusty, you might be able to make a better judgement on the severity of this issue. Marking critical for now.

CVE-2015-8614 https://security-tracker.debian.org/tracker/CVE-2015-8614 2015-11-04 2016-01-19 libarchive -- multiple vulnerabilities libarchive 3.1.2_5,1 FreeBSD 10.310.3_4 10.210.2_18 10.110.1_35 9.39.3_43

MITRE reports:

Integer signedness error in the archive_write_zip_data function in archive_write_set_format_zip.c in libarchive 3.1.2 and earlier, when running on 64-bit machines, allows context-dependent attackers to cause a denial of service (crash) via unspecified vectors, which triggers an improper conversion between unsigned and signed types, leading to a buffer overflow.

Absolute path traversal vulnerability in bsdcpio in libarchive 3.1.2 and earlier allows remote attackers to write to arbitrary files via a full pathname in an archive.

Libarchive issue tracker reports:

Using a crafted tar file bsdtar can perform an out-of-bounds memory read which will lead to a SEGFAULT. The issue exists when the executable skips data in the archive. The amount of data to skip is defined in byte offset [16-19] If ASLR is disabled, the issue can lead to an infinite loop.

CVE-2013-0211 CVE-2015-2304 ports/200176 SA-16:22.libarchive SA-16:23.libarchive https://github.com/libarchive/libarchive/pull/110 https://github.com/libarchive/libarchive/commit/5935715 https://github.com/libarchive/libarchive/commit/2253154 https://github.com/libarchive/libarchive/issues/502 https://github.com/libarchive/libarchive/commit/3865cf2 https://github.com/libarchive/libarchive/commit/e6c9668 https://github.com/libarchive/libarchive/commit/24f5de6 2012-12-06 2016-01-18 2016-08-09 go -- information disclosure vulnerability go 1.5,11.5.3,1

Jason Buberel reports:

A security-related issue has been reported in Go's math/big package. The issue was introduced in Go 1.5. We recommend that all users upgrade to Go 1.5.3, which fixes the issue. Go programs must be recompiled with Go 1.5.3 in order to receive the fix.

The Go team would like to thank Nick Craig-Wood for identifying the issue.

This issue can affect RSA computations in crypto/rsa, which is used by crypto/tls. TLS servers on 32-bit systems could plausibly leak their RSA private key due to this issue. Other protocol implementations that create many RSA signatures could also be impacted in the same way.

Specifically, incorrect results in one part of the RSA Chinese Remainder computation can cause the result to be incorrect in such a way that it leaks one of the primes. While RSA blinding should prevent an attacker from crafting specific inputs that trigger the bug, on 32-bit systems the bug can be expected to occur at random around one in 2^26 times. Thus collecting around 64 million signatures (of known data) from an affected server should be enough to extract the private key used.

On 64-bit systems, the frequency of the bug is so low (less than one in 2^50) that it would be very difficult to exploit. Nonetheless, everyone is strongly encouraged to upgrade.

CVE-2015-8618 http://www.openwall.com/lists/oss-security/2016/01/13/7 https://go-review.googlesource.com/#/c/17672/ https://go-review.googlesource.com/#/c/18491/ 2016-01-13 2016-01-18 isc-dhcpd -- Denial of Service isc-dhcp41-server 4.1.e_10,2 isc-dhcp41-client 4.1.e_3,2 isc-dhcp41-relay 4.1.e_6,2 isc-dhcp42-client isc-dhcp42-server isc-dhcp42-relay 0 isc-dhcp43-client isc-dhcp43-server isc-dhcp43-relay 4.3.3.p1

ISC reports:

A badly formed packet with an invalid IPv4 UDP length field can cause a DHCP server, client, or relay program to terminate abnormally.

https://kb.isc.org/article/AA-01334 CVE-2015-8605 2016-01-05 2016-01-12 libproxy -- stack-based buffer overflow libproxy 0.4.00.4.6_1 libproxy-gnome 0.4.00.4.6_2 libproxy-kde 0.4.00.4.6_6 libproxy-perl 0.4.00.4.6_3 libproxy-webkit 0.4.00.4.6_4

Tomas Hoger reports:

A buffer overflow flaw was discovered in the libproxy's url::get_pac() used to download proxy.pac proxy auto-configuration file. A malicious host hosting proxy.pac, or a man in the middle attacker, could use this flaw to trigger a stack-based buffer overflow in an application using libproxy, if proxy configuration instructed it to download proxy.pac file from a remote HTTP server.

CVE-2012-4504 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-4504 http://www.openwall.com/lists/oss-security/2012/10/12/1 https://github.com/libproxy/libproxy/commit/c440553c12836664afd24a24fb3a4d10a2facd2c https://bugzilla.redhat.com/show_bug.cgi?id=864417 https://groups.google.com/forum/?fromgroups=#!topic/libproxy/VxZ8No7mT0E 2012-10-10 2016-01-17 2016-01-18 ffmpeg -- remote attacker can access local files ffmpeg 2.0,1 2.8.5,1 mplayer mencoder 1.2.r20151219_2

Arch Linux reports:

ffmpeg has a vulnerability in the current version that allows the attacker to create a specially crafted video file, downloading which will send files from a user PC to a remote attacker server. The attack does not even require the user to open that file — for example, KDE Dolphin thumbnail generation is enough.

CVE-2016-1897 CVE-2016-1898 ports/206282 https://www.ffmpeg.org/security.html 2016-01-13 2016-01-17 h2o -- directory traversal vulnerability h2o 1.6.2

Yakuzo OKU reports:

When redirect directive is used, this flaw allows a remote attacker to inject response headers into an HTTP redirect response.

CVE-2016-1133 https://h2o.examp1e.net/vulnerabilities.html 2016-01-13 2016-01-15 openssh -- information disclosure openssh-portable 5.4.p0,1 7.1.p2,1 FreeBSD 10.210.2_10 10.110.1_27 9.39.3_34

OpenSSH reports:

OpenSSH clients between versions 5.4 and 7.1 are vulnerable to information disclosure that may allow a malicious server to retrieve information including under some circumstances, user's private keys.

http://www.openssh.com/security.html CVE-2016-0777 CVE-2016-0778 SA-16:07 2016-01-14 2016-01-14 2016-08-09 prosody -- multiple vulnerabilities prosody 0.9.9

The Prosody Team reports:

Fix path traversal vulnerability in mod_http_files (CVE-2016-1231)

Fix use of weak PRNG in generation of dialback secrets (CVE-2016-1232)

CVE-2016-1231 CVE-2016-1232 ports/206150 http://blog.prosody.im/prosody-0-9-9-security-release/ 2016-01-08 2016-01-14 kibana4 -- XSS vulnerability kibana4 kibana41 4.1.4 kibana42 4.2.2 kibana43 4.3.1

Elastic reports:

Fixes XSS vulnerability (CVE pending) - Thanks to Vladimir Ivanov for responsibly reporting.

ports/205961 ports/205962 ports/205963 https://www.elastic.co/blog/kibana-4-3-1-and-4-2-2-and-4-1-4 2015-12-17 2016-01-13 p5-PathTools -- File::Spec::canonpath loses taint p5-PathTools 3.4000 3.6200 perl5 perl5.20 perl5.22 perl5-devel 5.19.95.20.2 5.21.05.22.2 5.23.05.23.7

Ricardo Signes reports:

Beginning in PathTools 3.47 and/or perl 5.20.0, the File::Spec::canonpath() routine returned untained strings even if passed tainted input. This defect undermines the guarantee of taint propagation, which is sometimes used to ensure that unvalidated user input does not reach sensitive code.

This defect was found and reported by David Golden of MongoDB.

CVE-2015-8607 https://rt.perl.org/Public/Bug/Display.html?id=126862 2016-01-11 2016-01-12 2016-08-22 php -- multiple vulnerabilities php55 php55-gd php55-wddx php55-xmlrpc 5.5.31 php56 php56-gd php56-soap php56-wddx php56-xmlrpc 5.6.17

PHP reports:

Core:

Fixed bug #70755 (fpm_log.c memory leak and buffer overflow).

GD:

Fixed bug #70976 (Memory Read via gdImageRotateInterpolated Array Index Out of Bounds).

SOAP:

Fixed bug #70900 (SoapClient systematic out of memory error).

Wddx

Fixed bug #70661 (Use After Free Vulnerability in WDDX Packet Deserialization).

Fixed bug #70741 (Session WDDX Packet Deserialization Type Confusion Vulnerability).

XMLRPC:

Fixed bug #70728 (Type Confusion Vulnerability in PHP_to_XMLRPC_worker()).

http://www.php.net/ChangeLog-5.php#5.5.31 http://www.php.net/ChangeLog-5.php#5.6.17 2016-01-07 2016-01-11 pygments -- shell injection vulnerability py27-pygments py32-pygments py33-pygments py34-pygments py35-pygments 2.0.2_1

NVD reports:

The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name.

CVE-2015-8557 http://seclists.org/fulldisclosure/2015/Oct/4 https://bitbucket.org/birkenfeld/pygments-main/commits/0036ab1c99e256298094505e5e92fdacdfc5b0a8 2015-09-28 2016-01-09 polkit -- multiple vulnerabilities polkit 0.113

Colin Walters reports:

Integer overflow in the authentication_agent_new_cookie function in PolicyKit (aka polkit) before 0.113 allows local users to gain privileges by creating a large number of connections, which triggers the issuance of a duplicate cookie value.

The authentication_agent_new function in polkitbackend/polkitbackendinteractiveauthority.c in PolicyKit (aka polkit) before 0.113 allows local users to cause a denial of service (NULL pointer dereference and polkitd daemon crash) by calling RegisterAuthenticationAgent with an invalid object path.

The polkit_backend_action_pool_init function in polkitbackend/polkitbackendactionpool.c in PolicyKit (aka polkit) before 0.113 might allow local users to gain privileges via duplicate action IDs in action descriptions.

PolicyKit (aka polkit) before 0.113 allows local users to cause a denial of service (memory corruption and polkitd daemon crash) and possibly gain privileges via unspecified vectors, related to "javascript rule evaluation."

http://lists.freedesktop.org/archives/polkit-devel/2015-June/000425.html CVE-2015-4625 CVE-2015-3218 CVE-2015-3255 CVE-2015-3256 2015-06-03 2016-01-08 librsync -- collision vulnerability librsync 1.0.0

Michael Samuel reports:

librsync before 1.0.0 uses a truncated MD4 checksum to match blocks, which makes it easier for remote attackers to modify transmitted data via a birthday attack.

http://www.openwall.com/lists/oss-security/2014/07/28/1 CVE-2014-8242 2014-07-28 2016-01-08 ntp -- denial of service vulnerability ntp 4.2.8p5 ntp-devel 4.3.78 FreeBSD 10.210.2_9 10.110.1_26 9.39.3_33

Network Time Foundation reports:

NTF's NTP Project has been notified of the following 1 medium-severity vulnerability that is fixed in ntp-4.2.8p5, released on Thursday, 7 January 2016:

NtpBug2956: Small-step/Big-step CVE-2015-5300

SA-16:02.ntp CVE-2015-5300 https://www.cs.bu.edu/~goldbe/NTPattack.html http://support.ntp.org/bin/view/Main/NtpBug2956 http://support.ntp.org/bin/view/Main/SecurityNotice#January_2016_NTP_4_2_8p5_Securit 2015-10-21 2016-01-08 2016-08-09 dhcpcd -- multiple vulnerabilities dhcpcd 6.10.0

Nico Golde reports:

heap overflow via malformed dhcp responses later in print_option (via dhcp_envoption1) due to incorrect option length values. Exploitation is non-trivial, but I'd love to be proven wrong.

invalid read/crash via malformed dhcp responses. not exploitable beyond DoS as far as I can judge.

CVE-2016-1503 CVE-2016-1504 ports/206015 http://roy.marples.name/projects/dhcpcd/info/76a1609352263bd9def1300d7ba990679571fa30 http://roy.marples.name/projects/dhcpcd/info/595883e2a431f65d8fabf33059aa4689cca17403 http://www.openwall.com/lists/oss-security/2016/01/07/3 2016-01-04 2016-01-08 mbedTLS/PolarSSL -- SLOTH attack on TLS 1.2 server authentication polarssl13 1.3.16 mbedtls 2.2.1

ARM Limited reports:

MD5 handshake signatures in TLS 1.2 are vulnerable to the SLOTH attack on TLS 1.2 server authentication. They have been disabled by default. Other attacks from the SLOTH paper do not apply to any version of mbed TLS or PolarSSL.

https://tls.mbed.org/tech-updates/releases/mbedtls-2.2.1-2.1.4-1.3.16-and-polarssl.1.2.19-released 2016-01-04 2016-01-07 xen-kernel -- ioreq handling possibly susceptible to multiple read issue xen-kernel 4.5.2_1

The Xen Project reports:

Single memory accesses in source code can be translated to multiple ones in machine code by the compiler, requiring special caution when accessing shared memory. Such precaution was missing from the hypervisor code inspecting the state of I/O requests sent to the device model for assistance.

Due to the offending field being a bitfield, it is however believed that there is no issue in practice, since compilers, at least when optimizing (which is always the case for non-debug builds), should find it more expensive to extract the bit field value twice than to keep the calculated value in a register.

This vulnerability is exposed to malicious device models. In conventional Xen systems this means the qemu which service an HVM domain. On such systems this vulnerability can only be exploited if the attacker has gained control of the device model qemu via another vulnerability.

Privilege escalation, host crash (Denial of Service), and leaked information all cannot be excluded.

ports/205841 http://xenbits.xen.org/xsa/advisory-166.html 2015-12-17 2016-01-06 xen-kernel -- information leak in legacy x86 FPU/XMM initialization xen-kernel 4.5.2_1

The Xen Project reports:

When XSAVE/XRSTOR are not in use by Xen to manage guest extended register state, the initial values in the FPU stack and XMM registers seen by the guest upon first use are those left there by the previous user of those registers.

A malicious domain may be able to leverage this to obtain sensitive information such as cryptographic keys from another domain.

CVE-2015-8555 ports/205841 http://xenbits.xen.org/xsa/advisory-165.html 2015-12-17 2016-01-06 xen-tools -- libxl leak of pv kernel and initrd on error xen-tools 4.14.5.2_1

The Xen Project reports:

When constructing a guest which is configured to use a PV bootloader which runs as a userspace process in the toolstack domain (e.g. pygrub) libxl creates a mapping of the files to be used as kernel and initial ramdisk when building the guest domain.

However if building the domain subsequently fails these mappings would not be released leading to a leak of virtual address space in the calling process, as well as preventing the recovery of the temporary disk files containing the kernel and initial ramdisk.

For toolstacks which manage multiple domains within the same process, an attacker who is able to repeatedly start a suitable domain (or many such domains) can cause an out-of-memory condition in the toolstack process, leading to a denial of service.

Under the same circumstances an attacker can also cause files to accumulate on the toolstack domain filesystem (usually under /var in dom0) used to temporarily store the kernel and initial ramdisk, perhaps leading to a denial of service against arbitrary other services using that filesystem.

CVE-2015-8341 ports/205841 http://xenbits.xen.org/xsa/advisory-160.html 2015-12-08 2016-01-06 xen-kernel -- XENMEM_exchange error handling issues xen-kernel 4.5.2_1

The Xen Project reports:

Error handling in the operation may involve handing back pages to the domain. This operation may fail when in parallel the domain gets torn down. So far this failure unconditionally resulted in the host being brought down due to an internal error being assumed. This is CVE-2015-8339.

Furthermore error handling so far wrongly included the release of a lock. That lock, however, was either not acquired or already released on all paths leading to the error handling sequence. This is CVE-2015-8340.

A malicious guest administrator may be able to deny service by crashing the host or causing a deadlock.

CVE-2015-8339 CVE-2015-8340 ports/205841 http://xenbits.xen.org/xsa/advisory-159.html 2015-12-08 2016-01-06 tiff -- out-of-bounds read in CIE Lab image format tiff 4.0.6_1 linux-c6-tiff 3.9.4_2 linux-f10-tiff *

zzf of Alibaba discovered an out-of-bounds vulnerability in the code processing the LogLUV and CIE Lab image format files. An attacker could create a specially-crafted TIFF file that could cause libtiff to crash.

CVE-2015-8683 http://www.openwall.com/lists/oss-security/2015/12/25/2 2015-12-25 2016-01-05 2016-09-06 tiff -- out-of-bounds read in tif_getimage.c tiff 4.0.6_1 linux-c6-tiff 3.9.4_2 linux-f10-tiff *

LMX of Qihoo 360 Codesafe Team discovered an out-of-bounds read in tif_getimage.c. An attacker could create a specially-crafted TIFF file that could cause libtiff to crash.

CVE-2015-8665 http://www.openwall.com/lists/oss-security/2015/12/24/2 2015-12-24 2016-01-05 2016-09-06 unzip -- multiple vulnerabilities unzip 6.0_7

Gustavo Grieco reports:

Two issues were found in unzip 6.0:

* A heap overflow triggered by unzipping a file with password (e.g unzip -p -P x sigsegv.zip).

* A denegation of service with a file that never finishes unzipping (e.g. unzip sigxcpu.zip).

http://www.openwall.com/lists/oss-security/2015/09/07/4 ports/204413 CVE-2015-7696 CVE-2015-7697 2015-09-26 2016-01-04 cacti -- SQL injection vulnerabilities cacti 0.8.8f_1

NVD reports:

SQL injection vulnerability in include/top_graph_header.php in Cacti 0.8.8f and earlier allows remote attackers to execute arbitrary SQL commands via the rra_id parameter in a properties action to graph.php.

CVE-2015-8369 http://bugs.cacti.net/view.php?id=2646 http://svn.cacti.net/viewvc?view=rev&revision=7767 http://seclists.org/fulldisclosure/2015/Dec/8 2015-12-05 2016-01-05 kea -- unexpected termination while handling a malformed packet kea 0.9.21.0.0

ISC Support reports:

ISC Kea may terminate unexpectedly (crash) while handling a malformed client packet. Related defects in the kea-dhcp4 and kea-dhcp6 servers can cause the server to crash during option processing if a client sends a malformed packet. An attacker sending a crafted malformed packet can cause an ISC Kea server providing DHCP services to IPv4 or IPv6 clients to exit unexpectedly.

The kea-dhcp4 server is vulnerable only in versions 0.9.2 and 1.0.0-beta, and furthermore only when logging at debug level 40 or higher. Servers running kea-dhcp4 versions 0.9.1 or lower, and servers which are not logging or are logging at debug level 39 or below are not vulnerable.

The kea-dhcp6 server is vulnerable only in versions 0.9.2 and 1.0.0-beta, and furthermore only when logging at debug level 45 or higher. Servers running kea-dhcp6 versions 0.9.1 or lower, and servers which are not logging or are logging at debug level 44 or below are not vulnerable.

CVE-2015-8373 https://kb.isc.org/article/AA-01318/0/CVE-2015-8373-ISC-Kea%3A-unexpected-termination-while-handling-a-malformed-packet.html 2015-12-15 2016-01-04 2016-01-05 mini_httpd -- buffer overflow via snprintf mini_httpd 1.23

ACME Updates reports:

mini_httpd 1.21 and earlier allows remote attackers to obtain sensitive information from process memory via an HTTP request with a long protocol string, which triggers an incorrect response size calculation and an out-of-bounds read.

(rene) ACME, the author, claims that the vulnerability is fixed *after* version 1.22, released on 2015-12-28

CVE-2015-1548 https://cxsecurity.com/cveshow/CVE-2015-1548 http://acme.com/updates/archive/192.html 2015-02-10 2016-01-03 qemu -- denial of service vulnerability in Rocker switch emulation qemu qemu-devel 2.5.50 qemu-sbruno qemu-user-static 2.5.50.g20160213

Prasad J Pandit, Red Hat Product Security Team, reports:

Qemu emulator built with the Rocker switch emulation support is vulnerable to an off-by-one error. It happens while processing transmit(tx) descriptors in 'tx_consume' routine, if a descriptor was to have more than allowed (ROCKER_TX_FRAGS_MAX=16) fragments.

A privileged user inside guest could use this flaw to cause memory leakage on the host or crash the Qemu process instance resulting in DoS issue.

CVE-2015-8701 ports/205813 ports/205814 http://www.openwall.com/lists/oss-security/2015/12/28/6 https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg04629.html http://git.qemu.org/?p=qemu.git;a=commit;h=007cd223de527b5f41278f2d886c1a4beb3e67aa https://github.com/seanbruno/qemu-bsd-user/commit/007cd223de527b5f41278f2d886c1a4beb3e67aa 2015-12-28 2016-01-03 2016-07-06 qemu -- denial of service vulnerability in Q35 chipset emulation qemu qemu-devel 2.5.50 qemu-sbruno qemu-user-static 2.5.50.g20151224

Prasad J Pandit, Red Hat Product Security Team, reports:

Qemu emulator built with the Q35 chipset based pc system emulator is vulnerable to a heap based buffer overflow. It occurs during VM guest migration, as more(16 bytes) data is moved into allocated (8 bytes) memory area.

A privileged guest user could use this issue to corrupt the VM guest image, potentially leading to a DoS. This issue affects q35 machine types.

CVE-2015-8666 http://www.openwall.com/lists/oss-security/2015/12/24/1 http://git.qemu.org/?p=qemu.git;a=commit;h=d9a3b33d2c9f996537b7f1d0246dee2d0120cefb https://github.com/seanbruno/qemu-bsd-user/commit/d9a3b33d2c9f996537b7f1d0246dee2d0120cefb 2015-11-19 2016-01-03 2016-07-06 qemu -- denial of service vulnerability in Human Monitor Interface support qemu qemu-devel 2.5.0 qemu-sbruno qemu-user-static 2.5.50.g20160213

Prasad J Pandit, Red Hat Product Security Team, reports:

Qemu emulator built with the Human Monitor Interface(HMP) support is vulnerable to an OOB write issue. It occurs while processing 'sendkey' command in hmp_sendkey routine, if the command argument is longer than the 'keyname_buf' buffer size.

A user/process could use this flaw to crash the Qemu process instance resulting in DoS.

CVE-2015-8619 ports/205813 ports/205814 http://www.openwall.com/lists/oss-security/2015/12/22/8 https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg02930.html http://git.qemu.org/?p=qemu.git;a=commit;h=64ffbe04eaafebf4045a3ace52a360c14959d196 https://github.com/seanbruno/qemu-bsd-user/commit/64ffbe04eaafebf4045a3ace52a360c14959d196 2015-12-23 2016-01-03 2016-07-06 qemu -- denial of service vulnerability in MegaRAID SAS HBA emulation qemu qemu-devel 2.5.0 qemu-sbruno qemu-user-static 2.5.50.g20160213

Prasad J Pandit, Red Hat Product Security Team, reports:

Qemu emulator built with the SCSI MegaRAID SAS HBA emulation support is vulnerable to a stack buffer overflow issue. It occurs while processing the SCSI controller's CTRL_GET_INFO command. A privileged guest user could use this flaw to crash the Qemu process instance resulting in DoS.

CVE-2015-8613 ports/205813 ports/205814 http://www.openwall.com/lists/oss-security/2015/12/21/7 https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg03737.html http://git.qemu.org/?p=qemu.git;a=commit;h=36fef36b91f7ec0435215860f1458b5342ce2811 https://github.com/seanbruno/qemu-bsd-user/commit/36fef36b91f7ec0435215860f1458b5342ce2811 2015-12-21 2016-01-03 2016-07-06 qemu -- denial of service vulnerability in VMWARE VMXNET3 NIC support qemu qemu-devel 2.5.0 qemu-sbruno qemu-user-static 2.5.50.g20160213

Prasad J Pandit, Red Hat Product Security Team, reports:

Qemu emulator built with a VMWARE VMXNET3 paravirtual NIC emulator support is vulnerable to a memory leakage flaw. It occurs when a guest repeatedly tries to activate the vmxnet3 device.

A privileged guest user could use this flaw to leak host memory, resulting in DoS on the host.

CVE-2015-8567 CVE-2015-8568 ports/205813 ports/205814 http://www.openwall.com/lists/oss-security/2015/12/15/4 https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg02299.html http://git.qemu.org/?p=qemu.git;a=commit;h=aa4a3dce1c88ed51b616806b8214b7c8428b7470 https://github.com/seanbruno/qemu-bsd-user/commit/aa4a3dce1c88ed51b616806b8214b7c8428b7470 2015-12-15 2016-01-03 2016-07-06 qemu -- denial of service vulnerability in USB EHCI emulation support qemu qemu-devel 2.5.0 qemu-sbruno qemu-user-static 2.5.50.g20151224

Prasad J Pandit, Red Hat Product Security Team, reports:

Qemu emulator built with the USB EHCI emulation support is vulnerable to an infinite loop issue. It occurs during communication between host controller interface(EHCI) and a respective device driver. These two communicate via a isochronous transfer descriptor list(iTD) and an infinite loop unfolds if there is a closed loop in this list.

A privileges user inside guest could use this flaw to consume excessive CPU cycles & resources on the host.

CVE-2015-8558 ports/205814 http://www.openwall.com/lists/oss-security/2015/12/14/9 http://git.qemu.org/?p=qemu.git;a=commit;h=156a2e4dbffa85997636a7a39ef12da6f1b40254 https://github.com/seanbruno/qemu-bsd-user/commit/156a2e4dbffa85997636a7a39ef12da6f1b40254 2015-12-14 2016-01-03 qemu -- denial of service vulnerability in MSI-X support qemu qemu-devel 2.5.0 qemu-sbruno qemu-user-static 2.5.50.g20151224

Prasad J Pandit, Red Hat Product Security Team, reports:

Qemu emulator built with the PCI MSI-X support is vulnerable to null pointer dereference issue. It occurs when the controller attempts to write to the pending bit array(PBA) memory region. Because the MSI-X MMIO support did not define the .write method.

A privileges used inside guest could use this flaw to crash the Qemu process resulting in DoS issue.

CVE-2015-7549 http://www.openwall.com/lists/oss-security/2015/12/14/2 http://git.qemu.org/?p=qemu.git;a=commit;h=43b11a91dd861a946b231b89b7542856ade23d1b https://github.com/seanbruno/qemu-bsd-user/commit/43b11a91dd861a946b231b89b7542856ade23d1b 2015-06-26 2016-01-03 qemu -- denial of service vulnerability in VNC qemu qemu-devel 2.5.0 qemu-sbruno qemu-user-static 2.5.50.g20151224

Prasad J Pandit, Red Hat Product Security Team, reports:

Qemu emulator built with the VNC display driver support is vulnerable to an arithmetic exception flaw. It occurs on the VNC server side while processing the 'SetPixelFormat' messages from a client.

A privileged remote client could use this flaw to crash the guest resulting in DoS.

CVE-2015-8504 http://www.openwall.com/lists/oss-security/2015/12/08/4 http://git.qemu.org/?p=qemu.git;a=commitdiff;h=4c65fed8bdf96780735dbdb92a8bd0d6b6526cc3 https://github.com/seanbruno/qemu-bsd-user/commit/4c65fed8bdf96780735dbdb92a8bd0d6b6526cc3 2015-12-08 2016-01-03 qemu and xen-tools -- denial of service vulnerabilities in AMD PC-Net II NIC support qemu qemu-devel 2.5.0 qemu-sbruno qemu-user-static 2.5.50.g20151224 xen-tools 4.5.2_1

Prasad J Pandit, Red Hat Product Security Team, reports:

Qemu emulator built with the AMD PC-Net II Ethernet Controller support is vulnerable to a heap buffer overflow flaw. While receiving packets in the loopback mode, it appends CRC code to the receive buffer. If the data size given is same as the receive buffer size, the appended CRC code overwrites 4 bytes beyond this 's->buffer' array.

A privileged(CAP_SYS_RAWIO) user inside guest could use this flaw to crash the Qemu instance resulting in DoS or potentially execute arbitrary code with privileges of the Qemu process on the host.

The AMD PC-Net II emulator(hw/net/pcnet.c), while receiving packets from a remote host(non-loopback mode), fails to validate the received data size, thus resulting in a buffer overflow issue. It could potentially lead to arbitrary code execution on the host, with privileges of the Qemu process. It requires the guest NIC to have larger MTU limit.

A remote user could use this flaw to crash the guest instance resulting in DoS or potentially execute arbitrary code on a remote host with privileges of the Qemu process.

CVE-2015-7504 CVE-2015-7512 http://www.openwall.com/lists/oss-security/2015/11/30/2 http://www.openwall.com/lists/oss-security/2015/11/30/3 http://git.qemu.org/?p=qemu.git;a=commit;h=837f21aacf5a714c23ddaadbbc5212f9b661e3f7 http://git.qemu.org/?p=qemu.git;a=commit;h=8b98a2f07175d46c3f7217639bd5e03f2ec56343 https://github.com/seanbruno/qemu-bsd-user/commit/837f21aacf5a714c23ddaadbbc5212f9b661e3f7 https://github.com/seanbruno/qemu-bsd-user/commit/8b98a2f07175d46c3f7217639bd5e03f2ec56343 http://xenbits.xen.org/xsa/advisory-162.html 2015-11-30 2016-01-03 2016-01-06 qemu -- denial of service vulnerabilities in eepro100 NIC support qemu qemu-devel 2.5.50 qemu-sbruno qemu-user-static 2.5.50.g20160213

Prasad J Pandit, Red Hat Product Security Team, reports:

Qemu emulator built with the i8255x (PRO100) emulation support is vulnerable to an infinite loop issue. It could occur while processing a chain of commands located in the Command Block List (CBL). Each Command Block(CB) points to the next command in the list. An infinite loop unfolds if the link to the next CB points to the same block or there is a closed loop in the chain.

A privileged(CAP_SYS_RAWIO) user inside guest could use this flaw to crash the Qemu instance resulting in DoS.

CVE-2015-8345 ports/205813 ports/205814 http://www.openwall.com/lists/oss-security/2015/11/25/3 https://lists.gnu.org/archive/html/qemu-devel/2015-10/msg03911.html http://git.qemu.org/?p=qemu.git;a=commit;h=00837731d254908a841d69298a4f9f077babaf24 https://github.com/seanbruno/qemu-bsd-user/commit/00837731d254908a841d69298a4f9f077babaf24 2015-10-16 2016-01-03 2016-07-06 qemu -- denial of service vulnerability in virtio-net support qemu qemu-devel 2.4.1 qemu-sbruno qemu-user-static 2.5.50.g20151224

Prasad J Pandit, Red Hat Product Security Team, reports:

Qemu emulator built with the Virtual Network Device(virtio-net) support is vulnerable to a DoS issue. It could occur while receiving large packets over the tuntap/macvtap interfaces and when guest's virtio-net driver did not support big/mergeable receive buffers.

An attacker on the local network could use this flaw to disable guest's networking by sending a large number of jumbo frames to the guest, exhausting all receive buffers and thus leading to a DoS situation.

CVE-2015-7295 http://www.openwall.com/lists/oss-security/2015/09/18/5 http://git.qemu.org/?p=qemu.git;a=commit;h=696317f1895e836d53b670c7b77b7be93302ba08 https://github.com/seanbruno/qemu-bsd-user/commit/0cf33fb6b49a19de32859e2cdc6021334f448fb3 2015-09-18 2016-01-02 qemu -- denial of service vulnerabilities in NE2000 NIC support qemu qemu-devel 2.4.0.1 qemu-sbruno qemu-user-static 2.5.50.g20151224

Prasad J Pandit, Red Hat Product Security Team, reports:

Qemu emulator built with the NE2000 NIC emulation support is vulnerable to an infinite loop issue. It could occur when receiving packets over the network.

A privileged user inside guest could use this flaw to crash the Qemu instance resulting in DoS.

Qemu emulator built with the NE2000 NIC emulation support is vulnerable to a heap buffer overflow issue. It could occur when receiving packets over the network.

A privileged user inside guest could use this flaw to crash the Qemu instance or potentially execute arbitrary code on the host.

CVE-2015-5278 CVE-2015-5279 http://www.openwall.com/lists/oss-security/2015/09/15/2 http://www.openwall.com/lists/oss-security/2015/09/15/3 http://git.qemu.org/?p=qemu.git;a=commit;h=5a1ccdfe44946e726b4c6fda8a4493b3931a68c1 https://github.com/seanbruno/qemu-bsd-user/commit/737d2b3c41d59eb8f94ab7eb419b957938f24943 http://git.qemu.org/?p=qemu.git;a=commit;h=7aa2bcad0ca837dd6d4bf4fa38a80314b4a6b755 https://github.com/seanbruno/qemu-bsd-user/commit/9bbdbc66e5765068dce76e9269dce4547afd8ad4 2015-09-15 2016-01-02 qemu -- denial of service vulnerability in IDE disk/CD/DVD-ROM emulation qemu qemu-devel 2.4.1 qemu-sbruno qemu-user-static 2.5.50.g20151224

Prasad J Pandit, Red Hat Product Security Team, reports:

Qemu emulator built with the IDE disk and CD/DVD-ROM emulation support is vulnerable to a divide by zero issue. It could occur while executing an IDE command WIN_READ_NATIVE_MAX to determine the maximum size of a drive.

A privileged user inside guest could use this flaw to crash the Qemu instance resulting in DoS.

CVE-2015-6855 http://www.openwall.com/lists/oss-security/2015/09/10/1 http://git.qemu.org/?p=qemu.git;a=commit;h=63d761388d6fea994ca498c6e7a210851a99ad93 https://github.com/seanbruno/qemu-bsd-user/commit/d9033e1d3aa666c5071580617a57bd853c5d794a 2015-09-09 2016-01-02 qemu -- denial of service vulnerability in e1000 NIC support qemu qemu-devel 2.4.0.1 qemu-sbruno qemu-user-static 2.5.50.g20151224

Prasad J Pandit, Red Hat Product Security Team, reports:

Qemu emulator built with the e1000 NIC emulation support is vulnerable to an infinite loop issue. It could occur while processing transmit descriptor data when sending a network packet.

A privileged user inside guest could use this flaw to crash the Qemu instance resulting in DoS.

CVE-2015-6815 http://www.openwall.com/lists/oss-security/2015/09/04/4 http://git.qemu.org/?p=qemu.git;a=commit;h=3a56af1fbc17ff453f6e90fb08ce0c0e6fd0b61b https://github.com/seanbruno/qemu-bsd-user/commit/b947ac2bf26479e710489739c465c8af336599e7 2015-09-04 2016-01-02 qemu -- denial of service vulnerability in VNC qemu qemu-devel 2.1.0 qemu-sbruno qemu-user-static 2.2.50.g20141230

Prasad J Pandit, Red Hat Product Security Team, reports:

Qemu emulator built with the VNC display driver is vulnerable to an infinite loop issue. It could occur while processing a CLIENT_CUT_TEXT message with specially crafted payload message.

A privileged guest user could use this flaw to crash the Qemu process on the host, resulting in DoS.

CVE-2015-5239 http://www.openwall.com/lists/oss-security/2015/09/02/7 http://git.qemu.org/?p=qemu.git;a=commit;h=f9a70e79391f6d7c2a912d785239ee8effc1922d https://github.com/seanbruno/qemu-bsd-user/commit/f9a70e79391f6d7c2a912d785239ee8effc1922d 2014-06-30 2016-01-02 qemu -- buffer overflow vulnerability in VNC qemu qemu-devel 2.4.0.1 qemu-sbruno qemu-user-static 2.4.50.g20151011

Prasad J Pandit, Red Hat Product Security Team, reports:

Qemu emulator built with the VNC display driver support is vulnerable to a buffer overflow flaw leading to a heap memory corruption issue. It could occur while refreshing the server display surface via routine vnc_refresh_server_surface().

A privileged guest user could use this flaw to corrupt the heap memory and crash the Qemu process instance OR potentially use it to execute arbitrary code on the host.

CVE-2015-5225 http://www.openwall.com/lists/oss-security/2015/08/21/6 http://git.qemu.org/?p=qemu.git;a=commit;h=efec4dcd2552e85ed57f276b58f09fc385727450 https://github.com/seanbruno/qemu-bsd-user/commit/eb8934b0418b3b1d125edddc4fc334a54334a49b 2015-08-17 2016-01-01 qemu -- buffer overflow vulnerability in virtio-serial message exchanges qemu qemu-devel 2.4.0 qemu-sbruno qemu-user-static 2.4.50.g20150814

Prasad J Pandit, Red Hat Product Security Team, reports:

Qemu emulator built with the virtio-serial vmchannel support is vulnerable to a buffer overflow issue. It could occur while exchanging virtio control messages between guest and the host.

A malicious guest could use this flaw to corrupt few bytes of Qemu memory area, potentially crashing the Qemu process.

CVE-2015-5745 http://www.openwall.com/lists/oss-security/2015/08/06/5 http://git.qemu.org/?p=qemu.git;a=commit;h=7882080388be5088e72c425b02223c02e6cb4295 https://github.com/seanbruno/qemu-bsd-user/commit/7882080388be5088e72c425b02223c02e6cb4295 2015-08-06 2016-01-01 qemu -- stack buffer overflow while parsing SCSI commands qemu qemu-devel 2.4.0 qemu-sbruno qemu-user-static 2.4.50.g20150814

Prasad J Pandit, Red Hat Product Security Team, reports:

Qemu emulator built with the SCSI device emulation support is vulnerable to a stack buffer overflow issue. It could occur while parsing SCSI command descriptor block with an invalid operation code.

A privileged(CAP_SYS_RAWIO) user inside guest could use this flaw to crash the Qemu instance resulting in DoS.

CVE-2015-5158 http://openwall.com/lists/oss-security/2015/07/23/6 http://git.qemu.org/?p=qemu.git;a=commit;h=c170aad8b057223b1139d72e5ce7acceafab4fa9 https://github.com/seanbruno/qemu-bsd-user/commit/c170aad8b057223b1139d72e5ce7acceafab4fa9 2015-07-23 2016-01-01 qemu -- code execution on host machine qemu qemu-devel 2.4.0 qemu-sbruno qemu-user-static 2.4.50.g20150814

Petr Matousek of Red Hat Inc. reports:

Due converting PIO to the new memory read/write api we no longer provide separate I/O region lenghts for read and write operations. As a result, reading from PIT Mode/Command register will end with accessing pit->channels with invalid index and potentially cause memory corruption and/or minor information leak.

A privileged guest user in a guest with QEMU PIT emulation enabled could potentially (tough unlikely) use this flaw to execute arbitrary code on the host with the privileges of the hosting QEMU process.

Please note that by default QEMU/KVM guests use in-kernel (KVM) PIT emulation and are thus not vulnerable to this issue.

CVE-2015-3214 http://openwall.com/lists/oss-security/2015/06/17/5 http://git.qemu.org/?p=qemu.git;a=commit;h=d4862a87e31a51de9eb260f25c9e99a75efe3235 https://github.com/seanbruno/qemu-bsd-user/commit/d4862a87e31a51de9eb260f25c9e99a75efe3235 2015-06-17 2016-01-01 mono -- DoS and code execution mono 4.2

NCC Group reports:

An attacker who can cause a carefully-chosen string to be converted to a floating-point number can cause a crash and potentially induce arbitrary code execution.

http://seclists.org/oss-sec/2015/q4/543 CVE-2009-0689 2015-12-19 2015-12-31 flash -- multiple vulnabilities linux-c6-flashplugin linux-f10-flashplugin linux-c6_64-flashplugin 11.2r202.559

Adobe reports:

These updates resolve a type confusion vulnerability that could lead to code execution (CVE-2015-8644).

These updates resolve an integer overflow vulnerability that could lead to code execution (CVE-2015-8651).

These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2015-8634, CVE-2015-8635, CVE-2015-8638, CVE-2015-8639, CVE-2015-8640, CVE-2015-8641, CVE-2015-8642, CVE-2015-8643, CVE-2015-8646, CVE-2015-8647, CVE-2015-8648, CVE-2015-8649, CVE-2015-8650).

These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2015-8459, CVE-2015-8460, CVE-2015-8636, CVE-2015-8645).

CVE-2015-8459 CVE-2015-8460 CVE-2015-8634 CVE-2015-8636 CVE-2015-8638 CVE-2015-8639 CVE-2015-8640 CVE-2015-8641 CVE-2015-8642 CVE-2015-8643 CVE-2015-8644 CVE-2015-8645 CVE-2015-8646 CVE-2015-8647 CVE-2015-8648 CVE-2015-8649 CVE-2015-8650 CVE-2015-8651 https://helpx.adobe.com/security/products/flash-player/apsb16-01.html 2015-12-28 2015-12-29 inspircd -- DoS inspircd 2.0.19

Inspircd reports:

This release fixes the issues discovered since 2.0.18, containing multiple important stability and correctness related improvements, including a fix for a bug which allowed malformed DNS records to cause netsplits on a network.

http://www.inspircd.org/2015/04/16/v2019-released.html https://github.com/inspircd/inspircd/commit/6058483d9fbc1b904d5ae7cfea47bfcde5c5b559 http://comments.gmane.org/gmane.comp.security.oss.general/18464 CVE-2015-8702 2015-04-16 2015-12-29 2015-12-29 ffmpeg -- multiple vulnerabilities libav 0 gstreamer-ffmpeg 0 handbrake 0 ffmpeg 2.8,12.8.4,1 2.7.4,1 ffmpeg26 2.6.6 ffmpeg25 2.5.9 ffmpeg24 2.4.12 ffmpeg-devel ffmpeg23 ffmpeg2 ffmpeg1 ffmpeg-011 ffmpeg0 0 avidemux avidemux2 avidemux26 0 kodi 16.0 mplayer mencoder 1.2.r20151219_1 mythtv mythtv-frontend 0 plexhometheater 0

NVD reports:

The ff_dwt_decode function in libavcodec/jpeg2000dwt.c in FFmpeg before 2.8.4 does not validate the number of decomposition levels before proceeding with Discrete Wavelet Transform decoding, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JPEG 2000 data.

The ff_get_buffer function in libavcodec/utils.c in FFmpeg before 2.8.4 preserves width and height values after a failure, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted .mov file.

CVE-2015-8662 CVE-2015-8663 https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=75422280fbcdfbe9dc56bde5525b4d8b280f1bc5 https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=abee0a1c60612e8638640a8a3738fffb65e16dbf https://ffmpeg.org/security.html 2015-12-20 2015-12-28 NSS -- MD5 downgrade in TLS 1.2 signatures nss linux-c6-nss 3.203.20.2 3.19.2.2 linux-firefox 43.0.2,1 linux-thunderbird 38.5.1 linux-seamonkey 2.40

The Mozilla Project reports:

Security researcher Karthikeyan Bhargavan reported an issue in Network Security Services (NSS) where MD5 signatures in the server signature within the TLS 1.2 ServerKeyExchange message are still accepted. This is an issue since NSS has officially disallowed the accepting MD5 as a hash algorithm in signatures since 2011. This issues exposes NSS based clients such as Firefox to theoretical collision-based forgery attacks.

CVE-2015-7575 https://www.mozilla.org/security/advisories/mfsa2015-150/ https://hg.mozilla.org/projects/nss/rev/94e1157f3fbb 2015-12-22 2015-12-28 phpMyAdmin -- path disclosure vulnerability phpMyAdmin 4.5.04.5.3.1

The phpMyAdmin development team reports:

By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed.

We consider these vulnerabilities to be non-critical.

This path disclosure is possible on servers where the recommended setting of the PHP configuration directive display_errors is set to on, which is against the recommendations given in the PHP manual for a production server.

https://www.phpmyadmin.net/security/PMASA-2015-6/ CVE-2015-8669 2015-12-25 2015-12-26 dpkg -- stack-based buffer overflow dpkg 1.16.17 1.17.26 1.18.4

Salvatore Bonaccorso reports:

Hanno Boeck discovered a stack-based buffer overflow in the dpkg-deb component of dpkg, the Debian package management system. This flaw could potentially lead to arbitrary code execution if a user or an automated system were tricked into processing a specially crafted Debian binary package (.deb) in the old style Debian binary package format.

CVE-2015-0860 http://openwall.com/lists/oss-security/2015/11/26/3 https://anonscm.debian.org/cgit/dpkg/dpkg.git/commit/?id=f1aac7d933819569bf6f347c3c0d5a64a90bbce0 2015-11-26 2015-12-25 mantis -- information disclosure vulnerability mantis 1.2.19_1

Mantis reports:

CVE-2015-5059: documentation in private projects can be seen by every user

CVE-2015-5059 ports/201106 https://mantisbt.org/bugs/view.php?id=19873 http://openwall.com/lists/oss-security/2015/06/25/3 2015-06-23 2015-12-24 mediawiki -- multiple vulnerabilities mediawiki123 1.23.12 mediawiki124 1.24.5 mediawiki125 1.25.4 mediawiki126 1.26.1

MediaWiki reports:

(T117899) SECURITY: $wgArticlePath can no longer be set to relative paths that do not begin with a slash. This enabled trivial XSS attacks. Configuration values such as "http://my.wiki.com/wiki/$1" are fine, as are "/wiki/$1". A value such as "$1" or "wiki/$1" is not and will now throw an error.

(T119309) SECURITY: Use hash_compare() for edit token comparison.

(T118032) SECURITY: Don't allow cURL to interpret POST parameters starting with '@' as file uploads.

(T115522) SECURITY: Passwords generated by User::randomPassword() can no longer be shorter than $wgMinimalPasswordLength.

(T97897) SECURITY: Improve IP parsing and trimming. Previous behavior could result in improper blocks being issued.

(T109724) SECURITY: Special:MyPage, Special:MyTalk, Special:MyContributions and related pages no longer use HTTP redirects and are now redirected by MediaWiki.

CVE-2015-8622 CVE-2015-8623 CVE-2015-8624 CVE-2015-8625 CVE-2015-8626 CVE-2015-8627 CVE-2015-8628 https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-December/000186.html https://phabricator.wikimedia.org/T117899 https://phabricator.wikimedia.org/T119309 https://phabricator.wikimedia.org/T118032 https://phabricator.wikimedia.org/T115522 https://phabricator.wikimedia.org/T97897 https://phabricator.wikimedia.org/T109724 http://www.openwall.com/lists/oss-security/2015/12/23/7 2015-12-18 2015-12-24 Ruby -- unsafe tainted string vulnerability ruby 2.0.0,12.0.0.648,1 2.1.0,12.1.8,1 2.2.0,12.2.4,1

Ruby developer reports:

There is an unsafe tainted string vulnerability in Fiddle and DL. This issue was originally reported and fixed with CVE-2009-5147 in DL, but reappeared after DL was reimplemented using Fiddle and libffi.

And, about DL, CVE-2009-5147 was fixed at Ruby 1.9.1, but not fixed at other branches, then rubies which bundled DL except Ruby 1.9.1 are still vulnerable.

https://www.ruby-lang.org/en/news/2015/12/16/unsafe-tainted-string-usage-in-fiddle-and-dl-cve-2015-7551/ CVE-2015-7551 2015-12-16 2015-12-23 Bugzilla security issues bugzilla44 4.4.11 bugzilla50 5.0.2

Bugzilla Security Advisory

During the generation of a dependency graph, the code for the HTML image map is generated locally if a local dot installation is used. With escaped HTML characters in a bug summary, it is possible to inject unfiltered HTML code in the map file which the CreateImagemap function generates. This could be used for a cross-site scripting attack.

If an external HTML page contains a <script> element with its src attribute pointing to a buglist in CSV format, some web browsers incorrectly try to parse the CSV file as valid JavaScript code. As the buglist is generated based on the privileges of the user logged into Bugzilla, the external page could collect confidential data contained in the CSV file.

CVE-2015-8508 CVE-2015-8509 https://bugzilla.mozilla.org/show_bug.cgi?id=1221518 https://bugzilla.mozilla.org/show_bug.cgi?id=1232785 2015-12-22 2015-12-23 librsvg2 -- denial of service vulnerability librsvg2 2.40.12

Adam Maris, Red Hat Product Security, reports:

CVE-2015-7558: Stack exhaustion due to cyclic dependency causing to crash an application was found in librsvg2 while parsing SVG file. It has been fixed in 2.40.12 by many commits that has rewritten the checks for cyclic references.

CVE-2015-7558 ports/205502 http://www.openwall.com/lists/oss-security/2015/12/21/5 https://bugzilla.redhat.com/1268243 2015-10-02 2015-12-22 librsvg2 -- denial of service vulnerability librsvg2 2.40.7

Adam Maris, Red Hat Product Security, reports:

CVE-2015-7557: Out-of-bounds heap read in librsvg2 was found when parsing SVG file.

CVE-2015-7557 http://www.openwall.com/lists/oss-security/2015/12/21/5 https://git.gnome.org/browse/librsvg/commit/rsvg-shapes.c?id=40af93e6eb1c94b90c3b9a0b87e0840e126bb8df 2015-02-06 2015-12-22 quassel -- remote denial of service quassel 0.12.2_1

Pierre Schweitzer reports:

Any client sending the command "/op *" in a query will cause the Quassel core to crash.

http://www.openwall.com/lists/oss-security/2015/12/12/1 CVE-2015-8547 2015-11-22 2015-12-18 libvirt -- ACL bypass using ../ to access beyond storage pool libvirt 1.1.01.2.19_2 1.2.201.3.0

Libvit development team reports:

Various virStorageVol* API operate on user-supplied volume names by concatenating the volume name to the pool location. Note that the virStoragePoolListVolumes API, when used on a storage pool backed by a directory in a file system, will only list volumes immediately in that directory (there is no traversal into subdirectories). However, other APIs such as virStorageVolCreateXML were not checking if a potential volume name represented one of the volumes that could be returned by virStoragePoolListVolumes; because they were not rejecting the use of '/' in a volume name.

Because no checking was done on volume names, a user could supply a potential volume name of something like '../../../etc/passwd' to attempt to access a file not belonging to the storage pool. When fine-grained Access Control Lists (ACL) are in effect, a user with storage_vol:create ACL permission but lacking domain:write permssion could thus abuse virStorageVolCreateXML and similar APIs to gain access to files not normally permitted to that user. Fortunately, it appears that the only APIs that could leak information or corrupt files require read-write connection to libvirtd; and when ACLs are not in use (the default without any further configuration), a user with read-write access can already be considered to have full access to the machine, and without an escalation of privilege there is no security problem.

CVE-2015-5313 http://security.libvirt.org/2015/0004.html 2015-10-30 2015-12-20 samba -- multiple vulnerabilities samba36 3.6.03.6.25_2 samba4 4.0.04.0.26 samba41 4.1.04.1.22 samba42 4.2.04.2.7 samba43 4.3.04.3.3 ldb 1.0.01.1.24

Samba team reports:

[CVE-2015-3223] Malicious request can cause Samba LDAP server to hang, spinning using CPU.

[CVE-2015-5330] Malicious request can cause Samba LDAP server to return uninitialized memory that should not be part of the reply.

[CVE-2015-5296] Requesting encryption should also request signing when setting up the connection to protect against man-in-the-middle attacks.

[CVE-2015-5299] A missing access control check in the VFS shadow_copy2 module could allow unauthorized users to access snapshots.

[CVE-2015-7540] Malicious request can cause Samba LDAP server to return crash.

[CVE-2015-8467] Samba can expose Windows DCs to MS15-096 Denial of service via the creation of multiple machine accounts(The Microsoft issue is CVE-2015-2535).

[CVE-2015-5252] Insufficient symlink verification could allow data access outside share path.

CVE-2015-3223 https://www.samba.org/samba/security/CVE-2015-3223.html CVE-2015-5252 https://www.samba.org/samba/security/CVE-2015-5252.html CVE-2015-5296 https://www.samba.org/samba/security/CVE-2015-5296.html CVE-2015-5299 https://www.samba.org/samba/security/CVE-2015-5299.html CVE-2015-5330 https://www.samba.org/samba/security/CVE-2015-5330.html CVE-2015-7540 https://www.samba.org/samba/security/CVE-2015-7540.html CVE-2015-8467 https://www.samba.org/samba/security/CVE-2015-8467.html 2015-12-16 2015-12-19 2016-02-05 chromium -- multiple vulnerabilities chromium chromium-npapi chromium-pulse 47.0.2526.106

Google Chrome Releases reports:

2 security fixes in this release, including:

[569486] CVE-2015-6792: Fixes from internal audits and fuzzing.

CVE-2015-6792 http://googlechromereleases.blogspot.nl/2015/12/stable-channel-update_15.html 2015-12-16 2015-12-18 cups-filters -- code execution cups-filters 1.4.0 foomatic-filters 4.0.17_4

Till Kamppeter reports:

Cups Filters/Foomatic Filters does not consider semicolon as an illegal escape character.

http://www.openwall.com/lists/oss-security/2015/12/14/13 CVE-2015-8560 2015-12-12 2015-12-17 cups-filters -- code execution cups-filters 1.2.0 foomatic-filters 4.0.17_4

Salvatore Bonaccorso reports:

Cups Filters/Foomatic Filters does not consider backtick as an illegal escape character.

http://www.openwall.com/lists/oss-security/2015/12/13/2 CVE-2015-8327 2015-10-30 2015-12-17 py-amf -- input sanitization errors py27-amf py32-amf py33-amf py34-amf 0.8.0

oCERT reports:

A specially crafted AMF payload, containing malicious references to XML external entities, can be used to trigger Denial of Service (DoS) conditions or arbitrarily return the contents of files that are accessible with the running application privileges.

http://www.ocert.org/advisories/ocert-2015-011.html CVE-2015-8549 2015-12-01 2015-12-17 joomla -- multiple vulnerabilities joomla3 3.4.6

The JSST and the Joomla! Security Center report:

[20151201] - Core - Remote Code Execution Vulnerability

Browser information is not filtered properly while saving the session values into the database which leads to a Remote Code Execution vulnerability.

[20151202] - Core - CSRF Hardening

Add additional CSRF hardening in com_templates.

[20151203] - Core - Directory Traversal

Failure to properly sanitise input data from the XML install file located within an extension's package archive allows for directory traversal.

[20151204] - Core - Directory Traversal

Inadequate filtering of request data leads to a Directory Traversal vulnerability.

https://www.joomla.org/announcements/release-news/5641-joomla-3-4-6-released.html CVE-2015-8562 CVE-2015-8563 CVE-2015-8564 CVE-2015-8565 https://developer.joomla.org/security-centre/630-20151214-core-remote-code-execution-vulnerability.html https://developer.joomla.org/security-centre/633-20151214-core-csrf-hardening.html https://developer.joomla.org/security-centre/634-20151214-core-directory-traversal.html https://developer.joomla.org/security-centre/635-20151214-core-directory-traversal-2.html 2015-12-14 2015-12-17 2016-12-22 bind -- multiple vulnerabilities bind99 9.9.8P2 bind910 9.10.3P2 bind9-devel 9.11.0.a20151215 FreeBSD 9.39.3_32

ISC reports:

Named is potentially vulnerable to the OpenSSL vulnerabilty described in CVE-2015-3193.

Incorrect reference counting could result in an INSIST failure if a socket error occurred while performing a lookup. This flaw is disclosed in CVE-2015-8461. [RT#40945]

Insufficient testing when parsing a message allowed records with an incorrect class to be be accepted, triggering a REQUIRE failure when those records were subsequently cached. This flaw is disclosed in CVE-2015-8000. [RT #40987]

https://kb.isc.org/article/AA-01328/0/BIND-9.10.3-P2-Release-Notes.html https://kb.isc.org/article/AA-01317/0/CVE-2015-8000%3A-Responses-with-a-malformed-class-attribute-can-trigger-an-assertion-failure-in-db.c.html https://kb.isc.org/article/AA-01319/0/CVE-2015-8461%3A-A-race-condition-when-handling-socket-errors-can-lead-to-an-assertion-failure-in-resolver.c.html CVE-2015-3193 CVE-2015-8000 CVE-2015-8461 SA-15:27.bind 2015-11-24 2015-12-16 2016-08-09 mozilla -- multiple vulnerabilities firefox 43.0,1 linux-firefox 43.0,1 seamonkey 2.40 linux-seamonkey 2.40 firefox-esr 38.5.0,1 libxul 38.5.0 thunderbird 38.5.0 linux-thunderbird 38.5.0

The Mozilla Project reports:

MFSA 2015-134 Miscellaneous memory safety hazards (rv:43.0 / rv:38.5)

MFSA 2015-135 Crash with JavaScript variable assignment with unboxed objects

MFSA 2015-136 Same-origin policy violation using perfomance.getEntries and history navigation

MFSA 2015-137 Firefox allows for control characters to be set in cookies

MFSA 2015-138 Use-after-free in WebRTC when datachannel is used after being destroyed

MFSA 2015-139 Integer overflow allocating extremely large textures

MFSA 2015-140 Cross-origin information leak through web workers error events

MFSA 2015-141 Hash in data URI is incorrectly parsed

MFSA 2015-142 DOS due to malformed frames in HTTP/2

MFSA 2015-143 Linux file chooser crashes on malformed images due to flaws in Jasper library

MFSA 2015-144 Buffer overflows found through code inspection

MFSA 2015-145 Underflow through code inspection

MFSA 2015-146 Integer overflow in MP4 playback in 64-bit versions

MFSA 2015-147 Integer underflow and buffer overflow processing MP4 metadata in libstagefright

MFSA 2015-148 Privilege escalation vulnerabilities in WebExtension APIs

MFSA 2015-149 Cross-site reading attack through data and view-source URIs

CVE-2015-7201 CVE-2015-7202 CVE-2015-7203 CVE-2015-7204 CVE-2015-7205 CVE-2015-7207 CVE-2015-7208 CVE-2015-7210 CVE-2015-7211 CVE-2015-7212 CVE-2015-7213 CVE-2015-7214 CVE-2015-7215 CVE-2015-7216 CVE-2015-7217 CVE-2015-7218 CVE-2015-7219 CVE-2015-7220 CVE-2015-7221 CVE-2015-7222 CVE-2015-7223 https://www.mozilla.org/security/advisories/mfsa2015-134/ https://www.mozilla.org/security/advisories/mfsa2015-135/ https://www.mozilla.org/security/advisories/mfsa2015-136/ https://www.mozilla.org/security/advisories/mfsa2015-137/ https://www.mozilla.org/security/advisories/mfsa2015-138/ https://www.mozilla.org/security/advisories/mfsa2015-139/ https://www.mozilla.org/security/advisories/mfsa2015-140/ https://www.mozilla.org/security/advisories/mfsa2015-141/ https://www.mozilla.org/security/advisories/mfsa2015-142/ https://www.mozilla.org/security/advisories/mfsa2015-143/ https://www.mozilla.org/security/advisories/mfsa2015-144/ https://www.mozilla.org/security/advisories/mfsa2015-145/ https://www.mozilla.org/security/advisories/mfsa2015-146/ https://www.mozilla.org/security/advisories/mfsa2015-147/ https://www.mozilla.org/security/advisories/mfsa2015-148/ https://www.mozilla.org/security/advisories/mfsa2015-149/ 2015-12-15 2015-12-15 java -- multiple vulnerabilities openjdk8 openjdk8-jre 8.66.17 openjdk7 openjdk7-jre 7.91.02,1

Oracle reports:

This Critical Patch Update contains 25 new security fixes for Oracle Java SE. 24 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password.

http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html#AppendixJAVA CVE-2015-4835 CVE-2015-4881 CVE-2015-4843 CVE-2015-4883 CVE-2015-4860 CVE-2015-4805 CVE-2015-4844 CVE-2015-4901 CVE-2015-4868 CVE-2015-4810 CVE-2015-4806 CVE-2015-4871 CVE-2015-4902 CVE-2015-4840 CVE-2015-4882 CVE-2015-4842 CVE-2015-4734 CVE-2015-4903 CVE-2015-4803 CVE-2015-4893 CVE-2015-4911 CVE-2015-4872 CVE-2015-4906 CVE-2015-4916 CVE-2015-4908 2015-10-20 2015-12-15 2016-01-08 subversion -- multiple vulnerabilities subversion17 1.7.01.7.22_1 subversion18 1.8.01.8.15 subversion 1.9.01.9.3 mod_dav_svn 1.7.01.7.22_1 1.8.01.8.15 1.9.01.9.3

Subversion Project reports:

Remotely triggerable heap overflow and out-of-bounds read caused by integer overflow in the svn:// protocol parser.

Remotely triggerable heap overflow and out-of-bounds read in mod_dav_svn caused by integer overflow when parsing skel-encoded request bodies.

CVE-2015-5343 http://subversion.apache.org/security/CVE-2015-5343-advisory.txt CVE-2015-5259 http://subversion.apache.org/security/CVE-2015-5259-advisory.txt 2015-11-14 2015-12-15 chromium -- multiple vulnerabilities chromium chromium-npapi chromium-pulse 47.0.2526.80

Google Chrome Releases reports:

7 security fixes in this release, including:

[548273] High CVE-2015-6788: Type confusion in extensions. Credit to anonymous.

[557981] High CVE-2015-6789: Use-after-free in Blink. Credit to cloudfuzzer.

[542054] Medium CVE-2015-6790: Escaping issue in saved pages. Credit to Inti De Ceukelaire.

[567513] CVE-2015-6791: Various fixes from internal audits, fuzzing and other initiatives.

Multiple vulnerabilities in V8 fixed at the tip of the 4.7 branch (currently 4.7.80.23).

CVE-2015-6788 CVE-2015-6789 CVE-2015-6790 CVE-2015-6791 http://googlechromereleases.blogspot.nl/2015/12/stable-channel-update_8.html 2015-12-08 2015-12-13 freeimage -- multiple integer overflows freeimage 3.16.0_1

Pcheng pcheng reports:

An integer overflow issue in the FreeImage project was reported and fixed recently.

CVE-2015-0852 http://www.openwall.com/lists/oss-security/2015/08/28/1 2015-08-28 2015-12-13 redmine -- information leak vulnerability redmine 2.6.9 3.0.03.0.7 3.1.03.1.3

Redmine reports:

Data disclosure in atom feed.

CVE-2015-8537 http://www.redmine.org/projects/redmine/wiki/Security_Advisories 2015-12-05 2015-12-10 2015-12-11 redmine -- multiple vulnerabilities redmine 2.6.8 3.0.03.0.6 3.1.03.1.2

Redmine reports:

Potential changeset message disclosure in issues API.

Data disclosure on the time logging form

CVE-2015-8346 CVE-2015-8473 http://www.redmine.org/projects/redmine/wiki/Security_Advisories http://www.openwall.com/lists/oss-security/2015/11/25/12 http://www.openwall.com/lists/oss-security/2015/12/03/7 2015-11-14 2015-12-10 redmine -- open redirect vulnerability redmine 2.5.12.6.7 3.0.03.0.5 3.1.0

Redmine reports:

Open Redirect vulnerability.

CVE-2015-8474 http://www.redmine.org/projects/redmine/wiki/Security_Advisories http://www.openwall.com/lists/oss-security/2015/12/04/1 2015-09-20 2015-12-10 redmine -- potential XSS vulnerability redmine 2.6.2

Redmine reports:

Potential XSS vulnerability when rendering some flash messages.

CVE-2015-8477 http://www.redmine.org/projects/redmine/wiki/Security_Advisories http://www.openwall.com/lists/oss-security/2015/12/05/6 2015-02-19 2015-12-10 redmine -- information leak vulnerability redmine 2.4.6 2.5.02.5.2

Redmine reports:

Potential data leak (project names) in the invalid form authenticity token error screen.

http://www.redmine.org/projects/redmine/wiki/Security_Advisories 2014-07-06 2015-12-10 redmine -- open redirect vulnerability redmine 2.4.5 2.5.0

Redmine reports:

Open Redirect vulnerability

CVE-2014-1985 http://www.redmine.org/projects/redmine/wiki/Security_Advisories https://jvn.jp/en/jp/JVN93004610/index.html 2014-03-29 2015-12-10 redmine -- XSS vulnerability redmine 2.1.02.1.2

Redmine reports:

XSS vulnerability

http://www.redmine.org/projects/redmine/wiki/Security_Advisories 2012-09-30 2015-12-10 redmine -- multiple vulnerabilities redmine 1.3.2

Redmine reports:

Mass-assignemnt vulnerability that would allow an attacker to bypass part of the security checks.

Persistent XSS vulnerability

CVE-2012-0327 http://www.redmine.org/projects/redmine/wiki/Security_Advisories http://jvn.jp/en/jp/JVN93406632/ 2012-03-11 2015-12-10 redmine -- CSRF protection bypass redmine 1.3.0

Redmine reports:

Vulnerability that would allow an attacker to bypass the CSRF protection.

http://www.redmine.org/projects/redmine/wiki/Security_Advisories 2011-12-10 2015-12-10 jenkins -- multiple vulnerabilities jenkins 1.641 jenkins-lts 1.625.3

Jenkins Security Advisory:

Description

SECURITY-95 / CVE-2015-7536 (Stored XSS vulnerability through workspace files and archived artifacts)

In certain configurations, low privilege users were able to create e.g. HTML files in workspaces and archived artifacts that could result in XSS when accessed by other users. Jenkins now sends Content-Security-Policy headers that enables sandboxing and prohibits script execution by default.

SECURITY-225 / CVE-2015-7537 (CSRF vulnerability in some administrative actions)

Several administration/configuration related URLs could be accessed using GET, which allowed attackers to circumvent CSRF protection.

SECURITY-233 / CVE-2015-7538 (CSRF protection ineffective)

Malicious users were able to circumvent CSRF protection on any URL by sending specially crafted POST requests.

SECURITY-234 / CVE-2015-7539 (Jenkins plugin manager vulnerable to MITM attacks)

While the Jenkins update site data is digitally signed, and the signature verified by Jenkins, Jenkins did not verify the provided SHA-1 checksums for the plugin files referenced in the update site data. This enabled MITM attacks on the plugin manager, resulting in installation of attacker-provided plugins.

https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-12-09 2015-12-09 2015-12-09 flash -- multiple vulnabilities linux-c6-flashplugin linux-f10-flashplugin linux-c6_64-flashplugin 11.2r202.554

Adobe reports:

These updates resolve heap buffer overflow vulnerabilities that could lead to code execution (CVE-2015-8438, CVE-2015-8446).

These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2015-8444, CVE-2015-8443, CVE-2015-8417, CVE-2015-8416, CVE-2015-8451, CVE-2015-8047, CVE-2015-8053, CVE-2015-8045, CVE-2015-8051, CVE-2015-8060, CVE-2015-8419, CVE-2015-8408).

These updates resolve security bypass vulnerabilities (CVE-2015-8453, CVE-2015-8440, CVE-2015-8409).

These updates resolve a stack overflow vulnerability that could lead to code execution (CVE-2015-8407).

These updates resolve a type confusion vulnerability that could lead to code execution (CVE-2015-8439).

These updates resolve an integer overflow vulnerability that could lead to code execution (CVE-2015-8445).

These updates resolve a buffer overflow vulnerability that could lead to code execution (CVE-2015-8415).

These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2015-8050, CVE-2015-8049, CVE-2015-8437, CVE-2015-8450, CVE-2015-8449, CVE-2015-8448, CVE-2015-8436, CVE-2015-8452, CVE-2015-8048, CVE-2015-8413, CVE-2015-8412, CVE-2015-8410, CVE-2015-8411, CVE-2015-8424, CVE-2015-8422, CVE-2015-8420, CVE-2015-8421, CVE-2015-8423, CVE-2015-8425, CVE-2015-8433, CVE-2015-8432, CVE-2015-8431, CVE-2015-8426, CVE-2015-8430, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8434, CVE-2015-8435, CVE-2015-8414, CVE-2015-8052, CVE-2015-8059, CVE-2015-8058, CVE-2015-8055, CVE-2015-8057, CVE-2015-8056, CVE-2015-8061, CVE-2015-8067, CVE-2015-8066, CVE-2015-8062, CVE-2015-8068, CVE-2015-8064, CVE-2015-8065, CVE-2015-8063, CVE-2015-8405, CVE-2015-8404, CVE-2015-8402, CVE-2015-8403, CVE-2015-8071, CVE-2015-8401, CVE-2015-8406, CVE-2015-8069, CVE-2015-8070, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447).

https://helpx.adobe.com/security/products/flash-player/apsb15-32.html CVE-2015-8045 CVE-2015-8047 CVE-2015-8048 CVE-2015-8049 CVE-2015-8050 CVE-2015-8051 CVE-2015-8052 CVE-2015-8053 CVE-2015-8054 CVE-2015-8055 CVE-2015-8056 CVE-2015-8057 CVE-2015-8058 CVE-2015-8059 CVE-2015-8060 CVE-2015-8061 CVE-2015-8062 CVE-2015-8063 CVE-2015-8064 CVE-2015-8065 CVE-2015-8066 CVE-2015-8067 CVE-2015-8068 CVE-2015-8069 CVE-2015-8070 CVE-2015-8071 CVE-2015-8401 CVE-2015-8402 CVE-2015-8403 CVE-2015-8404 CVE-2015-8405 CVE-2015-8406 CVE-2015-8407 CVE-2015-8408 CVE-2015-8409 CVE-2015-8410 CVE-2015-8411 CVE-2015-8412 CVE-2015-8413 CVE-2015-8414 CVE-2015-8415 CVE-2015-8416 CVE-2015-8417 CVE-2015-8419 CVE-2015-8420 CVE-2015-8421 CVE-2015-8422 CVE-2015-8423 CVE-2015-8424 CVE-2015-8425 CVE-2015-8426 CVE-2015-8427 CVE-2015-8428 CVE-2015-8429 CVE-2015-8430 CVE-2015-8431 CVE-2015-8432 CVE-2015-8433 CVE-2015-8434 CVE-2015-8435 CVE-2015-8436 CVE-2015-8437 CVE-2015-8438 CVE-2015-8439 CVE-2015-8440 CVE-2015-8441 CVE-2015-8442 CVE-2015-8443 CVE-2015-8444 CVE-2015-8445 CVE-2015-8446 CVE-2015-8447 CVE-2015-8448 CVE-2015-8449 CVE-2015-8450 CVE-2015-8451 CVE-2015-8452 CVE-2015-8453 2015-12-08 2015-12-08 libressl -- NULL pointer dereference libressl 2.2.5 2.3.02.3.1_1

The OpenBSD project reports:

A NULL pointer deference could be triggered by a crafted certificate sent to services configured to verify client certificates on TLS/SSL connections.

https://marc.info/?l=openbsd-announce&t=144920914600002 CVE-2015-3194 2015-12-03 2015-12-08 KeePassX -- information disclosure KeePassX 0.4.4

Yves-Alexis Perez reports:

Starting an export (using File / Export to / KeepassX XML file) and cancelling it leads to KeepassX saving a cleartext XML file in ~/.xml without any warning.

CVE-2015-8378 ports/205105 http://www.openwall.com/lists/oss-security/2015/11/30/4 2015-07-08 2015-12-08 passenger -- client controlled header overwriting rubygem-passenger 5.0.05.0.22 4.0.60

Daniel Knoppel reports:

It was discovered by the SUSE security team that it was possible, in some cases, for clients to overwrite headers set by the server, resulting in a medium level security issue. CVE-2015-7519 has been assigned to this issue.

Affected use-cases:

Header overwriting may occur if all of the following conditions are met:

Apache integration mode, or standalone+builtin engine without a filtering proxy

Ruby or Python applications only (Passenger 5); or any application (Passenger 4)

The app depends on a request header containing a dash (-)

The header is supposed to be trusted (set by the server)

The client correctly guesses the header name

This vulnerability has been fixed by filtering out client headers that do not consist of alphanumeric/dash characters (Nginx already did this, so Passenger+Nginx was not affected). If your application depends on headers that don't conform to this, you can add a workaround in Apache specifically for those to convert them to a dash-based format.

CVE-2015-7519 https://blog.phusion.nl/2015/12/07/cve-2015-7519/ 2015-12-07 2015-12-07 Salt -- information disclosure py27-salt 2015.8.3

Salt release notes report:

CVE-2015-8034: Saving state.sls cache data to disk with insecure permissions

This affects users of the state.sls function. The state run cache on the minion was being created with incorrect permissions. This file could potentially contain sensitive data that was inserted via jinja into the state SLS files. The permissions for this file are now being set correctly. Thanks to @zmalone for bringing this issue to our attention.

CVE-2015-8034 https://docs.saltstack.com/en/latest/topics/releases/2015.8.3.html 2015-11-25 2015-12-07 libraw -- memory objects not properly initialized libraw 0.17.1

ChenQin reports:

The LibRaw raw image decoder has multiple vulnerabilities that can cause memory errors which may lead to code execution or other problems.

In CVE-2015-8367, LibRaw's phase_one_correct function does not handle memory initialization correctly, which may cause other problems.

http://www.libraw.org/news/libraw-0-17-1 https://github.com/LibRaw/LibRaw/commit/490ef94d1796f730180039e80997efe5c58db780 http://seclists.org/fulldisclosure/2015/Nov/108 CVE-2015-8367 2015-11-30 2015-12-07 libraw -- index overflow in smal_decode_segment libraw 0.17.1

ChenQin reports:

The LibRaw raw image decoder has multiple vulnerabilities that can cause memory errors which may lead to code execution or other problems.

In CVE-2015-8366, LibRaw's smal_decode_segment function does not handle indexes carefully, which can cause an index overflow.

http://www.libraw.org/news/libraw-0-17-1 https://github.com/LibRaw/LibRaw/commit/89d065424f09b788f443734d44857289489ca9e2 http://seclists.org/fulldisclosure/2015/Nov/108 CVE-2015-8366 2015-11-30 2015-12-07 openssl -- multiple vulnerabilities openssl 1.0.2_5 mingw32-openssl 1.0.11.0.2e linux-c6-openssl 1.0.1e_7 FreeBSD 10.210.2_8 10.110.1_25 9.39.3_31

OpenSSL project reports:

BN_mod_exp may produce incorrect results on x86_64 (CVE-2015-3193)

Certificate verify crash with missing PSS parameter (CVE-2015-3194)

X509_ATTRIBUTE memory leak (CVE-2015-3195)

Race condition handling PSK identify hint (CVE-2015-3196)

Anon DH ServerKeyExchange with 0 p parameter (CVE-2015-1794)

SA-15:26.openssl CVE-2015-1794 CVE-2015-3193 CVE-2015-3194 CVE-2015-3195 CVE-2015-3196 https://www.openssl.org/news/secadv/20151203.txt 2015-12-03 2015-12-05 2016-08-09 PHPmailer -- SMTP injection vulnerability phpmailer 5.2.14

PHPMailer changelog reports:

Fix vulnerability that allowed email addresses with line breaks (valid in RFC5322) to pass to SMTP, permitting message injection at the SMTP level. Mitigated in both the address validator and in the lower-level SMTP class. Thanks to Takeshi Terada.

https://github.com/PHPMailer/PHPMailer/blob/v5.2.14/changelog.md 2015-11-05 2015-12-03 ffmpeg -- multiple vulnerabilities libav 0 gstreamer-ffmpeg 0 handbrake 0 ffmpeg 2.8,12.8.3,1 2.7.3,1 ffmpeg26 2.6.5 ffmpeg25 2.5.9 ffmpeg24 2.4.12 ffmpeg-devel ffmpeg23 ffmpeg2 ffmpeg1 ffmpeg-011 ffmpeg0 0 avidemux avidemux2 avidemux26 0 kodi 16.0 mplayer mencoder 1.1.r20150822_7 mythtv mythtv-frontend 0 plexhometheater 0

NVD reports:

The update_dimensions function in libavcodec/vp8.c in FFmpeg through 2.8.1, as used in Google Chrome before 46.0.2490.71 and other products, relies on a coefficient-partition count during multi-threaded operation, which allows remote attackers to cause a denial of service (race condition and memory corruption) or possibly have unspecified other impact via a crafted WebM file.

The ljpeg_decode_yuv_scan function in libavcodec/mjpegdec.c in FFmpeg before 2.8.2 omits certain width and height checks, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted MJPEG data.

The ff_hevc_parse_sps function in libavcodec/hevc_ps.c in FFmpeg before 2.8.2 does not validate the Chroma Format Indicator, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted High Efficiency Video Coding (HEVC) data.

The decode_uncompressed function in libavcodec/faxcompr.c in FFmpeg before 2.8.2 does not validate uncompressed runs, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted CCITT FAX data.

The init_tile function in libavcodec/jpeg2000dec.c in FFmpeg before 2.8.2 does not enforce minimum-value and maximum-value constraints on tile coordinates, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JPEG 2000 data.

The jpeg2000_read_main_headers function in libavcodec/jpeg2000dec.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8.x through 2.8.2 does not enforce uniqueness of the SIZ marker in a JPEG 2000 image, which allows remote attackers to cause a denial of service (out-of-bounds heap-memory access) or possibly have unspecified other impact via a crafted image with two or more of these markers.

Integer overflow in the ff_ivi_init_planes function in libavcodec/ivi.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8.x through 2.8.2 allows remote attackers to cause a denial of service (out-of-bounds heap-memory access) or possibly have unspecified other impact via crafted image dimensions in Indeo Video Interactive data.

The smka_decode_frame function in libavcodec/smacker.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8.x through 2.8.2 does not verify that the data size is consistent with the number of channels, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Smacker data.

CVE-2015-6761 CVE-2015-8216 CVE-2015-8217 CVE-2015-8218 CVE-2015-8219 CVE-2015-8363 CVE-2015-8364 CVE-2015-8365 https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=dabea74d0e82ea80cd344f630497cafcb3ef872c https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=d24888ef19ba38b787b11d1ee091a3d94920c76a https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=93f30f825c08477fe8f76be00539e96014cc83c8 https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=d4a731b84a08f0f3839eaaaf82e97d8d9c67da46 https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=43492ff3ab68a343c1264801baa1d5a02de10167 https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=44a7f17d0b20e6f8d836b2957e3e357b639f19a2 https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=df91aa034b82b77a3c4e01791f4a2b2ff6c82066 https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=4a9af07a49295e014b059c1ab624c40345af5892 https://ffmpeg.org/security.html 2015-11-27 2015-12-02 2015-12-28 chromium -- multiple vulnerabilities chromium chromium-npapi chromium-pulse 47.0.2526.73

Google Chrome Releases reports:

41 security fixes in this release, inclduding:

[558589] Critical CVE-2015-6765: Use-after-free in AppCache. Credit to anonymous.

[551044] High CVE-2015-6766: Use-after-free in AppCache. Credit to anonymous.

[554908] High CVE-2015-6767: Use-after-free in AppCache. Credit to anonymous.

[556724] High CVE-2015-6768: Cross-origin bypass in DOM. Credit to Mariusz Mlynski.

[534923] High CVE-2015-6769: Cross-origin bypass in core. Credit to Mariusz Mlynski.

[541206] High CVE-2015-6770: Cross-origin bypass in DOM. Credit to Mariusz Mlynski.

[544991] High CVE-2015-6771: Out of bounds access in v8. Credit to anonymous.

[546545] High CVE-2015-6772: Cross-origin bypass in DOM. Credit to Mariusz Mlynski.

[554946] High CVE-2015-6764: Out of bounds access in v8. Credit to Guang Gong of Qihoo 360 via pwn2own.

[491660] High CVE-2015-6773: Out of bounds access in Skia. Credit to cloudfuzzer.

[549251] High CVE-2015-6774: Use-after-free in Extensions. Credit to anonymous.

[529012] High CVE-2015-6775: Type confusion in PDFium. Credit to Atte Kettunen of OUSPG.

[457480] High CVE-2015-6776: Out of bounds access in PDFium. Credit to Hanno Böck.

[544020] High CVE-2015-6777: Use-after-free in DOM. Credit to Long Liu of Qihoo 360Vulcan Team.

[514891] Medium CVE-2015-6778: Out of bounds access in PDFium. Credit to Karl Skomski.

[528505] Medium CVE-2015-6779: Scheme bypass in PDFium. Credit to Til Jasper Ullrich.

[490492] Medium CVE-2015-6780: Use-after-free in Infobars. Credit to Khalil Zhani.

[497302] Medium CVE-2015-6781: Integer overflow in Sfntly. Credit to miaubiz.

[536652] Medium CVE-2015-6782: Content spoofing in Omnibox. Credit to Luan Herrera.

[537205] Medium CVE-2015-6783: Signature validation issue in Android Crazy Linker. Credit to Michal Bednarski.

[503217] Low CVE-2015-6784: Escaping issue in saved pages. Credit to Inti De Ceukelaire.

[534542] Low CVE-2015-6785: Wildcard matching issue in CSP. Credit to Michael Ficarra / Shape Security.

[534570] Low CVE-2015-6786: Scheme bypass in CSP. Credit to Michael Ficarra / Shape Security.

[563930] CVE-2015-6787: Various fixes from internal audits, fuzzing and other initiatives.

Multiple vulnerabilities in V8 fixed at the tip of the 4.7 branch (currently 4.7.80.23).

CVE-2015-6765 CVE-2015-6766 CVE-2015-6767 CVE-2015-6768 CVE-2015-6769 CVE-2015-6770 CVE-2015-6771 CVE-2015-6772 CVE-2015-6773 CVE-2015-6774 CVE-2015-6775 CVE-2015-6776 CVE-2015-6777 CVE-2015-6778 CVE-2015-6779 CVE-2015-6780 CVE-2015-6781 CVE-2015-6782 CVE-2015-6783 CVE-2015-6784 CVE-2015-6785 CVE-2015-6786 CVE-2015-6787 http://googlechromereleases.blogspot.nl/2015/12/stable-channel-update.html 2015-12-01 2015-12-02 piwik -- multiple vulnerabilities piwik 2.15.0

Piwik changelog reports:

This release is rated critical. We are grateful for Security researchers who disclosed security issues privately to the Piwik Security Response team: Elamaran Venkatraman, Egidio Romano and Dmitriy Shcherbatov. The following vulnerabilities were fixed: XSS, CSRF, possible file inclusion in older PHP versions (low impact), possible Object Injection Vulnerability (low impact).

CVE-2015-7815 CVE-2015-7816 http://piwik.org/changelog/piwik-2-15-0/ 2015-11-17 2015-12-02 cyrus-imapd -- integer overflow in the start_octet addition cyrus-imapd25 2.5.02.5.7 cyrus-imapd24 2.4.02.4.18_2

Cyrus IMAP 2.5.7 Release Note states:

CVE-2015-8077, CVE-2015-8078: protect against integer overflow in urlfetch range checks

CVE-2015-8078 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8078 http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-8078.html https://security-tracker.debian.org/tracker/CVE-2015-8078 CVE-2015-8077 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8077 http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-8077.html https://security-tracker.debian.org/tracker/CVE-2015-8077 2015-11-04 2015-12-01 django -- information leak vulnerability py27-django py32-django py33-django py34-django 1.8.7 py27-django18 py32-django18 py33-django18 py34-django18 1.8.7 py27-django17 py32-django17 py33-django17 py34-django17 1.7.11 py27-django-devel py32-django-devel py33-django-devel py34-django-devel 20150709,1

Tim Graham reports:

If an application allows users to specify an unvalidated format for dates and passes this format to the date filter, e.g. {{ last_updated|date:user_date_format }}, then a malicious user could obtain any secret in the application's settings by specifying a settings key instead of a date format. e.g. "SECRET_KEY" instead of "j/m/Y".

https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/ CVE-2015-8213 2015-11-24 2015-11-30 2015-12-24 kibana4 -- CSRF vulnerability kibana4 kibana41 4.0.04.1.3 kibana42 4.2.04.2.1

Elastic reports:

Vulnerability Summary: Kibana versions prior to 4.1.3 and 4.2.1 are vulnerable to a CSRF attack.

Remediation Summary: Users should upgrade to 4.1.3 or 4.2.1.

CVE-2015-8131 https://www.elastic.co/community/security/ 2015-11-17 2015-11-22 a2ps -- format string vulnerability a2ps 4.13b_8

Jong-Gwon Kim reports:

When user runs a2ps with malicious crafted pro(a2ps prologue) file, an attacker can execute arbitrary code.

CVE-2015-8107 http://www.openwall.com/lists/oss-security/2015/11/16/4 2015-11-16 2015-11-22 libxslt -- DoS vulnability due to type confusing error libsxlt 1.1.28_8

libxslt maintainer reports:

CVE-2015-7995: http://www.openwall.com/lists/oss-security/2015/10/27/10 We need to check that the parent node is an element before dereferencing its namespace.

CVE-2015-7995 https://git.gnome.org/browse/libxslt/commit/?id=7ca19df892ca22d9314e95d59ce2abdeff46b617 2015-10-29 2015-11-20 libxml2 -- multiple vulnabilities libxml2 2.9.3

reports:

CVE-2015-5312 Another entity expansion issue (David Drysdale).

CVE-2015-7497 Avoid an heap buffer overflow in xmlDictComputeFastQKey (David Drysdale).

CVE-2015-7498 Avoid processing entities after encoding conversion failures (Daniel Veillard).

CVE-2015-7499 (1) Add xmlHaltParser() to stop the parser (Daniel Veillard).

CVE-2015-7499 (2) Detect incoherency on GROW (Daniel Veillard).

CVE-2015-7500 Fix memory access error due to incorrect entities boundaries (Daniel Veillard).

CVE-2015-7941 (1) Stop parsing on entities boundaries errors (Daniel Veillard).

CVE-2015-7941 (2) Cleanup conditional section error handling (Daniel Veillard).

CVE-2015-7942 Another variation of overflow in Conditional sections (Daniel Veillard).

CVE-2015-7942 (2) Fix an error in previous Conditional section patch (Daniel Veillard).

CVE-2015-8035 Fix XZ compression support loop (Daniel Veillard).

CVE-2015-8242 Buffer overead with HTML parser in push mode (Hugh Davenport)

CVE-2015-5312 CVE-2015-7497 CVE-2015-7498 CVE-2015-7499 CVE-2015-7500 CVE-2015-7941 CVE-2015-7942 CVE-2015-8035 CVE-2015-8241 CVE-2015-8242 http://xmlsoft.org/news.html http://www.openwall.com/lists/oss-security/2015/11/18/23 2015-11-20 2015-11-20 mozilla -- multiple vulnerabilities nspr 4.10.10 linux-c6-nspr 4.10.10 nss 3.203.20.1 3.19.33.19.4 3.19.2.1 firefox 42.0,1 linux-firefox 42.0,1 seamonkey 2.39 linux-seamonkey 2.39 firefox-esr 38.4.0,1 libxul 38.4.0 thunderbird 38.4.0 linux-thunderbird 38.4.0

The Mozilla Project reports:

MFSA 2015-133 NSS and NSPR memory corruption issues

MFSA 2015-132 Mixed content WebSocket policy bypass through workers

MFSA 2015-131 Vulnerabilities found through code inspection

MFSA 2015-130 JavaScript garbage collection crash with Java applet

MFSA 2015-129 Certain escaped characters in host of Location-header are being treated as non-escaped

MFSA 2015-128 Memory corruption in libjar through zip files

MFSA 2015-127 CORS preflight is bypassed when non-standard Content-Type headers are received

MFSA 2015-126 Crash when accessing HTML tables with accessibility tools on OS X

MFSA 2015-125 XSS attack through intents on Firefox for Android

MFSA 2015-124 Android intents can be used on Firefox for Android to open privileged files

MFSA 2015-123 Buffer overflow during image interactions in canvas

MFSA 2015-122 Trailing whitespace in IP address hostnames can bypass same-origin policy

MFSA 2015-121 Disabling scripts in Add-on SDK panels has no effect

MFSA 2015-120 Reading sensitive profile files through local HTML file on Android

MFSA 2015-119 Firefox for Android addressbar can be removed after fullscreen mode

MFSA 2015-118 CSP bypass due to permissive Reader mode whitelist

MFSA 2015-117 Information disclosure through NTLM authentication

MFSA 2015-116 Miscellaneous memory safety hazards (rv:42.0 / rv:38.4)

CVE-2015-4513 CVE-2015-4514 CVE-2015-4515 CVE-2015-4518 CVE-2015-7181 CVE-2015-7182 CVE-2015-7183 CVE-2015-7185 CVE-2015-7186 CVE-2015-7187 CVE-2015-7188 CVE-2015-7189 CVE-2015-7190 CVE-2015-7191 CVE-2015-7192 CVE-2015-7193 CVE-2015-7194 CVE-2015-7195 CVE-2015-7196 CVE-2015-7197 CVE-2015-7198 CVE-2015-7199 CVE-2015-7200 https://www.mozilla.org/security/advisories/mfsa2015-116/ https://www.mozilla.org/security/advisories/mfsa2015-117/ https://www.mozilla.org/security/advisories/mfsa2015-118/ https://www.mozilla.org/security/advisories/mfsa2015-119/ https://www.mozilla.org/security/advisories/mfsa2015-120/ https://www.mozilla.org/security/advisories/mfsa2015-121/ https://www.mozilla.org/security/advisories/mfsa2015-122/ https://www.mozilla.org/security/advisories/mfsa2015-123/ https://www.mozilla.org/security/advisories/mfsa2015-124/ https://www.mozilla.org/security/advisories/mfsa2015-125/ https://www.mozilla.org/security/advisories/mfsa2015-126/ https://www.mozilla.org/security/advisories/mfsa2015-127/ https://www.mozilla.org/security/advisories/mfsa2015-128/ https://www.mozilla.org/security/advisories/mfsa2015-129/ https://www.mozilla.org/security/advisories/mfsa2015-130/ https://www.mozilla.org/security/advisories/mfsa2015-131/ https://www.mozilla.org/security/advisories/mfsa2015-132/ https://www.mozilla.org/security/advisories/mfsa2015-133/ 2015-11-03 2015-11-19 2016-04-13 gdm -- lock screen bypass when holding escape key gdm 3.16.2_1

Ray Strode reports:

CVE-2015-7496 - lock screen bypass when holding escape key.

CVE-2015-7496 https://mail.gnome.org/archives/ftp-release-list/2015-November/msg00074.html https://bugzilla.gnome.org/show_bug.cgi?id=758032 2015-11-12 2015-11-18 strongswan -- authentication bypass vulnerability in the eap-mschapv2 plugin strongswan 5.3.4

Strongswan Release Notes reports:

Fixed an authentication bypass vulnerability in the eap-mschapv2 plugin that was caused by insufficient verification of the internal state when handling MSCHAPv2 Success messages received by the client. This vulnerability has been registered as CVE-2015-8023.

CVE-2015-8023 https://github.com/strongswan/strongswan/commit/453e204ac40dfff2e0978e8f84a5f8ff0cbc45e2 2015-11-16 2015-11-16 moodle -- multiple vulnerabilities moodle27 2.7.11 moodle28 2.8.9 moodle29 2.9.3

Moodle Release Notes report:

MSA-15-0037 Possible to send a message to a user who blocked messages from non contacts

MSA-15-0038 DDoS possibility in Atto

MSA-15-0039 CSRF in site registration form

MSA-15-0040 Student XSS in survey

MSA-15-0041 XSS in flash video player

MSA-15-0042 CSRF in lesson login form

MSA-15-0043 Web service core_enrol_get_enrolled_users does not respect course group mode

MSA-15-0044 Capability to view available badges is not respected

MSA-15-0045 SCORM module allows to bypass access restrictions based on date

MSA-15-0046 Choice module closing date can be bypassed

https://docs.moodle.org/dev/Moodle_2.7.11_release_notes https://docs.moodle.org/dev/Moodle_2.8.9_release_notes https://docs.moodle.org/dev/Moodle_2.9.3_release_notes 2015-11-09 2015-11-16 2015-12-21 xen-kernel -- CPU lockup during exception delivery xen-kernel 4.5.2

The Xen Project reports:

A malicious HVM guest administrator can cause a denial of service. Specifically, prevent use of a physical CPU for a significant, perhaps indefinite period. If a host watchdog (Xen or dom0) is in use, this can lead to a watchdog timeout and consequently a reboot of the host. If another, innocent, guest, is configured with a watchdog, this issue can lead to a reboot of such a guest.

CVE-2015-5307 CVE-2015-8104 http://xenbits.xen.org/xsa/advisory-156.html 2015-11-10 2015-11-16 libpng buffer overflow in png_set_PLTE png 1.6.20

libpng reports:

CVE for a vulnerability in libpng, all versions, in the png_set_PLTE/png_get_PLTE functions. These functions failed to check for an out-of-range palette when reading or writing PNG files with a bit_depth less than 8. Some applications might read the bit depth from the IHDR chunk and allocate memory for a 2^N entry palette, while libpng can return a palette with up to 256 entries even when the bit depth is less than 8.

http://www.openwall.com/lists/oss-security/2015/11/12/2 http://www.openwall.com/lists/oss-security/2015/12/03/6 CVE-2015-8126 CVE-2015-8472 2015-11-15 2015-11-15 2015-12-08 flash -- multiple vulnabilities linux-c6-flashplugin linux-f10-flashplugin linux-c6_64-flashplugin 11.2r202.548

Adobe reports:

These updates resolve a type confusion vulnerability that could lead to code execution (CVE-2015-7659).

These updates resolve a security bypass vulnerability that could be exploited to write arbitrary data to the file system under user permissions (CVE-2015-7662).

These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, CVE-2015-8046).

https://helpx.adobe.com/security/products/flash-player/apsb15-28.html CVE-2015-7651 CVE-2015-7652 CVE-2015-7653 CVE-2015-7654 CVE-2015-7655 CVE-2015-7656 CVE-2015-7657 CVE-2015-7658 CVE-2015-7659 CVE-2015-7660 CVE-2015-7661 CVE-2015-7662 CVE-2015-7663 CVE-2015-8043 CVE-2015-8044 CVE-2015-8046 2015-11-10 2015-11-14 chromium -- multiple vulnerabilities chromium chromium-npapi chromium-pulse 46.0.2490.86

Google Chrome Releases reports:

[520422] High CVE-2015-1302: Information leak in PDF viewer. Credit to Rob Wu.

CVE-2015-1302 http://googlechromereleases.blogspot.nl/2015/11/stable-channel-update.html 2015-11-10 2015-11-11 MySQL - Multiple vulnerabilities mariadb-client 5.3.13 mariadb-server 5.3.13 mariadb55-client 5.5.46 mariadb55-server 5.5.46 mariadb100-client 10.0.22 mariadb100-server 10.0.22 mysql55-client 5.5.46 mysql55-server 5.5.46 mysql56-client 5.6.27 mysql56-server 5.6.27 percona55-client 5.5.46 percona55-server 5.5.46 percona56-client 5.6.27 percona56-server 5.6.27

Oracle reports:

Critical Patch Update: MySQL Server, version(s) 5.5.45 and prior, 5.6.26 and prior

http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html CVE-2015-4802 CVE-2015-4807 CVE-2015-4815 CVE-2015-4826 CVE-2015-4830 CVE-2015-4836 CVE-2015-4858 CVE-2015-4861 CVE-2015-4870 CVE-2015-4913 CVE-2015-4792 https://mariadb.com/kb/en/mariadb/mariadb-5546-release-notes/ https://mariadb.com/kb/en/mariadb/mariadb-10022-release-notes/ https://www.percona.com/doc/percona-server/5.5/release-notes/Percona-Server-5.5.46-37.5.html https://www.percona.com/doc/percona-server/5.6/release-notes/Percona-Server-5.6.27-75.0.html 2015-11-10 2015-11-11 jenkins -- remote code execution via unsafe deserialization jenkins 1.638 jenkins-lts 1.625.2

Jenkins Developers report:

Unsafe deserialization allows unauthenticated remote attackers to run arbitrary code on the Jenkins master.

https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11 https://jenkins-ci.org/content/mitigating-unauthenticated-remote-code-execution-0-day-jenkins-cli http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/#thefix 2015-11-06 2015-11-11 owncloudclient -- Improper validation of certificates when using self-signed certificates owncloudclient 2.0.1

owncloud.org reports:

The ownCloud Desktop Client was vulnerable against MITM attacks until version 2.0.0 in combination with self-signed certificates.

https://owncloud.org/security/advisory/?id=oc-sa-2015-016 CVE-2015-7298 2015-09-21 2015-11-11 xen-tools -- populate-on-demand balloon size inaccuracy can crash guests xen-tools 3.44.5.1_2

The Xen Project reports:

Guests configured with PoD might be unstable, especially under load. In an affected guest, an unprivileged guest user might be able to cause a guest crash, perhaps simply by applying load so as to cause heavy memory pressure within the guest.

CVE-2015-7972 http://xenbits.xen.org/xsa/advisory-153.html 2015-10-29 2015-11-11 xen-kernel -- some pmu and profiling hypercalls log without rate limiting xen-kernel 3.24.5.1_1

The Xen Project reports:

HYPERCALL_xenoprof_op and HYPERVISOR_xenpmu_op log some errors and attempts at invalid operations. These log messages are not rate-limited, even though they can be triggered by guests.

A malicious guest could cause repeated logging to the hypervisor console, leading to a Denial of Service attack.

CVE-2015-7971 http://xenbits.xen.org/xsa/advisory-152.html 2015-10-29 2015-11-11 xen-kernel -- leak of per-domain profiling-related vcpu pointer array xen-kernel 4.04.5.1_1

The Xen Project reports:

A domain's xenoprofile state contains an array of per-vcpu information... This array is leaked on domain teardown. This memory leak could -- over time -- exhaust the host's memory.

The following parties can mount a denial of service attack affecting the whole system:

A malicious guest administrator via XENOPROF_get_buffer.

A domain given suitable privilege over another domain via XENOPROF_set_passive (this would usually be a domain being used to profile another domain, eg with the xenoprof tool).

The ability to also restart or create suitable domains is also required to fully exploit the issue. Without this the leak is limited to a small multiple of the maximum number of vcpus for the domain.

CVE-2015-7969 http://xenbits.xen.org/xsa/advisory-151.html 2015-10-29 2015-11-11 xen-kernel -- Long latency populate-on-demand operation is not preemptible xen-kernel 3.44.5.1_1

The Xen Project reports:

When running an HVM domain in Populate-on-Demand mode, Xen would sometimes search the domain for memory to reclaim, in response to demands for population of other pages in the same domain. This search runs without preemption. The guest can, by suitable arrangement of its memory contents, create a situation where this search is a time-consuming linear scan of the guest's address space.

A malicious HVM guest administrator can cause a denial of service. Specifically, prevent use of a physical CPU for a significant period.

CVE-2015-7970 http://xenbits.xen.org/xsa/advisory-150.html 2015-10-29 2015-11-11 xen-kernel -- leak of main per-domain vcpu pointer array xen-kernel 4.5.1_1

The Xen Project reports:

A domain's primary array of vcpu pointers can be allocated by a toolstack exactly once in the lifetime of a domain via the XEN_DOMCTL_max_vcpus hypercall. This array is leaked on domain teardown. This memory leak could -- over time -- exhaust the host's memory.

A domain given partial management control via XEN_DOMCTL_max_vcpus can mount a denial of service attack affecting the whole system. The ability to also restart or create suitable domains is also required to fully exploit the issue. Without this the leak is limited to a small multiple of the maximum number of vcpus for the domain. The maximum leak is 64kbytes per domain (re)boot (less on ARM).

CVE-2015-7969 http://xenbits.xen.org/xsa/advisory-149.html 2015-10-29 2015-11-11 xen-kernel -- Uncontrolled creation of large page mappings by PV guests xen-kernel 3.44.5.1_1

The Xen Project reports:

The code to validate level 2 page table entries is bypassed when certain conditions are satisfied. This means that a PV guest can create writeable mappings using super page mappings. Such writeable mappings can violate Xen intended invariants for pages which Xen is supposed to keep read-only. This is possible even if the "allowsuperpage" command line option is not used.

Malicious PV guest administrators can escalate privilege so as to control the whole system.

CVE-2015-7835 http://xenbits.xen.org/xsa/advisory-148.html 2015-10-29 2015-11-11 xen-tools -- libxl fails to honour readonly flag on disks with qemu-xen xen-tools 4.14.5.1_1

The Xen Project reports:

Callers of libxl can specify that a disk should be read-only to the guest. However, there is no code in libxl to pass this information to qemu-xen (the upstream-based qemu); and indeed there is no way in qemu to make a disk read-only.

The vulnerability is exploitable only via devices emulated by the device model, not the parallel PV devices for supporting PVHVM. Normally the PVHVM device unplug protocol renders the emulated devices inaccessible early in boot.

Malicious guest administrators or (in some situations) users may be able to write to supposedly read-only disk images.

CDROM devices (that is, devices specified to be presented to the guest as CDROMs, regardless of the nature of the backing storage on the host) are not affected.

CVE-2015-7311 http://xenbits.xen.org/xsa/advisory-142.html 2015-09-22 2015-11-11 p5-HTML-Scrubber -- XSS vulnerability p5-HTML-Scrubber 0.15

MITRE reports:

Cross-site scripting (XSS) vulnerability in the HTML-Scrubber module before 0.15 for Perl, when the comment feature is enabled, allows remote attackers to inject arbitrary web script or HTML via a crafted comment.

CVE-2015-5667 https://metacpan.org/release/HTML-Scrubber http://jvndb.jvn.jp/jvndb/JVNDB-2015-000171 http://jvn.jp/en/jp/JVN53973084/index.html 2015-10-10 2015-11-11 libvpx -- buffer overflow in vp9_init_context_buffers libvpx 1.4.0.488_1

The Mozilla Project reports:

Security researcher Khalil Zhani reported that a maliciously crafted vp9 format video could be used to trigger a buffer overflow while parsing the file. This leads to a potentially exploitable crash due to a flaw in the libvpx library.

CVE-2015-4506 https://www.mozilla.org/security/advisories/mfsa2015-101/ 2015-09-22 2015-11-10 powerdns -- Denial of Service powerdns 3.4.43.4.7

PowerDNS reports:

A bug was found using afl-fuzz in our packet parsing code. This bug, when exploited, causes an assertion error and consequent termination of the the pdns_server process, causing a Denial of Service.

https://doc.powerdns.com/md/security/powerdns-advisory-2015-03/ CVE-2015-5311 2015-11-03 2015-11-09 PuTTY -- memory corruption in terminal emulator's erase character handling putty 0.540.66

Ben Harris reports:

Versions of PuTTY and pterm between 0.54 and 0.65 inclusive have a potentially memory-corrupting integer overflow in the handling of the ECH (erase characters) control sequence in the terminal emulator.

To exploit a vulnerability in the terminal emulator, an attacker must be able to insert a carefully crafted escape sequence into the terminal stream. For a PuTTY SSH session, this must be before encryption, so the attacker likely needs access to the server you're connecting to. For instance, an attacker on a multi-user machine that you connect to could trick you into running cat on a file they control containing a malicious escape sequence. (Unix write(1) is not a vector for this, if implemented correctly.)

Only PuTTY, PuTTYtel, and pterm are affected; other PuTTY tools do not include the terminal emulator, so cannot be exploited this way.

http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-ech-overflow.html CVE-2015-5309 2015-11-06 2015-11-09 OpenOffice 4.1.1 -- multiple vulnerabilities apache-openoffice 4.1.2 apache-openoffice-devel 4.2.1705368,3

The Apache OpenOffice Project reports:

A vulnerability in OpenOffice settings of OpenDocument Format files and templates allows silent access to files that are readable from an user account, over-riding the user's default configuration settings. Once these files are imported into a maliciously-crafted document, the data can be silently hidden in the document and possibly exported to an external party without being observed.

The Apache OpenOffice Project reports:

A crafted ODF document can be used to create a buffer that is too small for the amount of data loaded into it, allowing an attacker to cause denial of service (memory corruption and application crash) and possible execution of arbitrary code.

The Apache OpenOffice Project reports:

A crafted Microsoft Word DOC file can be used to specify a document buffer that is too small for the amount of data provided for it. Failure to detect the discrepancy allows an attacker to cause denial of service (memory corruption and application crash) and possible execution of arbitrary code.

The Apache OpenOffice Project reports:

A crafted Microsoft Word DOC can contain invalid bookmark positions leading to memory corruption when the document is loaded or bookmarks are manipulated. The defect allows an attacker to cause denial of service (memory corruption and application crash) and possible execution of arbitrary code.

CVE-2015-4551 http://www.openoffice.org/security/cves/CVE-2015-4551.html CVE-2015-5212 http://www.openoffice.org/security/cves/CVE-2015-5212.html CVE-2015-5213 http://www.openoffice.org/security/cves/CVE-2015-5213.html CVE-2015-5214 http://www.openoffice.org/security/cves/CVE-2015-5214.html 2015-11-04 2015-11-05 2015-11-05 codeigniter -- multiple vulnerabilities codeigniter 2.2.6

The CodeIgniter changelog reports:

Fixed an XSS attack vector in Security Library method xss_clean().

Changed Config Library method base_url() to fallback to ``$_SERVER['SERVER_ADDR']`` in order to avoid Host header injections.

Changed CAPTCHA Helper to try to use the operating system's PRNG first.

ports/203403 https://codeigniter.com/userguide2/changelog.html 2015-10-31 2015-11-01 openafs -- information disclosure openafs 1.6.15

The OpenAFS development team reports:

When constructing an Rx acknowledgment (ACK) packet, Andrew-derived Rx implementations do not initialize three octets of data that are padding in the C language structure and were inadvertently included in the wire protocol (CVE-2015-7762). Additionally, OpenAFS Rx in versions 1.5.75 through 1.5.78, 1.6.0 through 1.6.14, and 1.7.0 through 1.7.32 include a variable-length padding at the end of the ACK packet, in an attempt to detect the path MTU, but only four octets of the additional padding are initialized (CVE-2015-7763).

http://openafs.org/pages/security/OPENAFS-SA-2015-007.txt CVE-2015-7762 CVE-2015-7763 2015-10-28 2015-10-28 xscreensaver - lock bypass xscreensaver xscreensaver-gnome xscreensaver-gnome-hacks 5.34

RedHat bugzilla reports:

In dual screen configurations, unplugging one screen will cause xscreensaver to crash, leaving the screen unlocked.

https://www.jwz.org/xscreensaver/changelog.html https://bugzilla.redhat.com/show_bug.cgi?id=1274452 CVE-2015-8025 2015-10-24 2015-10-27 2015-11-04 lldpd -- Buffer overflow/Denial of service lldpd 0.5.60.7.19

The lldpd developer Vincent Bernat reports:

A buffer overflow may allow arbitrary code execution only if hardening was disabled.

Malformed packets should not make lldpd crash. Ensure we can handle them by not using assert() in this part.

CVE-2015-8011 CVE-2015-8012 https://github.com/vincentbernat/lldpd/raw/0.7.19/NEWS http://www.openwall.com/lists/oss-security/2015/10/30/2 2015-10-04 2015-10-26 2015-11-10 wireshark -- Pcapng file parser crash wireshark wireshark-lite wireshark-qt5 tshark tshark-lite 1.12.8

Wireshark development team reports:

The following vulnerability has been fixed.

wnpa-sec-2015-30

Pcapng file parser crash. (Bug 11455)

https://www.wireshark.org/docs/relnotes/wireshark-1.12.8.html CVE-2015-7830 2015-10-14 2015-10-25 Joomla! -- Core - SQL Injection/ACL Violation vulnerabilities joomla3 3.2.03.4.5

The JSST and the Joomla! Security Center report:

[20151001] - Core - SQL Injection

Inadequate filtering of request data leads to a SQL Injection vulnerability.

[20151002] - Core - ACL Violations

Inadequate ACL checks in com_contenthistory provide potential read access to data which should be access restricted.

CVE-2015-7297 CVE-2015-7857 CVE-2015-7858 CVE-2015-7859 http://developer.joomla.org/security-centre/628-20151001-core-sql-injection.html http://developer.joomla.org/security-centre/629-20151002-core-acl-violations.html https://www.joomla.org/announcements/release-news/5634-joomla-3-4-5-released.html 2015-10-22 2015-10-25 Joomla! -- Core - ACL Violation vulnerabilities joomla3 3.0.03.4.5

The JSST and the Joomla! Security Center report:

[20151003] - Core - ACL Violations

Inadequate ACL checks in com_content provide potential read access to data which should be access restricted.

CVE-2015-7899 http://developer.joomla.org/security-centre/630-20151003-core-acl-violations.html https://www.joomla.org/announcements/release-news/5634-joomla-3-4-5-released.html 2015-10-22 2015-10-25 Joomla! -- Core - XSS Vulnerability joomla3 3.4.03.4.4

The JSST and the Joomla! Security Center report:

[20150908] - Core - XSS Vulnerability

Inadequate escaping leads to XSS vulnerability in login module.

CVE-2015-6939 http://developer.joomla.org/security-centre/626-20150908-core-xss-vulnerability.html https://www.joomla.org/announcements/release-news/5628-joomla-3-4-4-released.html 2015-09-08 2015-10-25 Joomla! -- Core - CSRF Protection vulnerabilities joomla3 3.2.03.4.2

The JSST and the Joomla! Security Center report:

[20150602] - Core - CSRF Protection

Lack of CSRF checks potentially enabled uploading malicious code.

CVE-2015-5397 http://developer.joomla.org/security-centre/618-20150602-core-remote-code-execution.html https://www.joomla.org/announcements/release-news/5589-joomla-3-4-2-released.html 2015-06-30 2015-10-25 Joomla! -- Core - Open Redirect vulnerability joomla3 3.0.03.4.2

The JSST and the Joomla! Security Center report:

[20150601] - Core - Open Redirect

Inadequate checking of the return value allowed to redirect to an external page.

CVE-2015-5608 http://developer.joomla.org/security-centre/617-20150601-core-open-redirect.html https://www.joomla.org/announcements/release-news/5589-joomla-3-4-2-released.html 2015-06-30 2015-10-25 Joomla! -- Core - Remote File Execution/Denial of Service vulnerabilities joomla3 3.2.6 3.3.03.3.5 joomla2 2.5.42.5.26

The JSST and the Joomla! Security Center report:

[20140903] - Core - Remote File Inclusion

Inadequate checking allowed the potential for remote files to be executed.

[20140904] - Core - Denial of Service

Inadequate checking allowed the potential for a denial of service attack.

CVE-2014-7228 CVE-2014-7229 http://developer.joomla.org/security-centre/595-20140903-core-remote-file-inclusion.html http://developer.joomla.org/security-centre/596-20140904-core-denial-of-service.html https://www.joomla.org/announcements/release-news/5567-joomla-3-3-5-released.html https://www.joomla.org/announcements/release-news/5566-joomla-2-5-26-released.html 2014-09-30 2015-10-25 Joomla! -- Core - Unauthorised Login vulnerability joomla3 3.2.5 3.3.03.3.4 joomla2 2.5.25

The JSST and the Joomla! Security Center report:

[20140902] - Core - Unauthorised Logins

Inadequate checking allowed unauthorised logins via LDAP authentication.

CVE-2014-6632 http://developer.joomla.org/security-centre/594-20140902-core-unauthorised-logins.html https://www.joomla.org/announcements/release-news/5564-joomla-3-3-4-released.html https://www.joomla.org/announcements/release-news/5563-joomla-2-5-25-released.html 2014-09-23 2015-10-25 Joomla! -- Core - XSS Vulnerability joomla3 3.2.03.2.5 3.3.03.3.4

The JSST and the Joomla! Security Center report:

[20140901] - Core - XSS Vulnerability

Inadequate escaping leads to XSS vulnerability in com_media.

CVE-2014-6631 http://developer.joomla.org/security-centre/593-20140901-core-xss-vulnerability.html https://www.joomla.org/announcements/release-news/5564-joomla-3-3-4-released.html 2014-09-23 2015-10-25 drupal -- open redirect vulnerability drupal7 7.41

Drupal development team reports:

The Overlay module in Drupal core displays administrative pages as a layer over the current page (using JavaScript), rather than replacing the page in the browser window. The Overlay module does not sufficiently validate URLs prior to displaying their contents, leading to an open redirect vulnerability.

This vulnerability is mitigated by the fact that it can only be used against site users who have the "Access the administrative overlay" permission, and that the Overlay module must be enabled.

An incomplete fix for this issue was released as part of SA-CORE-2015-002.

CVE-2015-7943 https://www.drupal.org/SA-CORE-2015-004 http://www.openwall.com/lists/oss-security/2015/10/23/6 2015-10-21 2015-10-24 phpMyAdmin -- Content spoofing vulnerability phpMyAdmin 4.4.04.4.15.1 4.5.04.5.1

The phpMyAdmin development team reports:

This vulnerability allows an attacker to perform a content spoofing attack using the phpMyAdmin's redirection mechanism to external sites.

We consider this vulnerability to be non critical since the spoofed content is escaped and no HTML injection is possible.

https://www.phpmyadmin.net/security/PMASA-2015-5/ CVE-2015-7873 2015-10-23 2015-10-23 mediawiki -- multiple vulnerabilities mediawiki123 1.23.11 mediawiki124 1.24.4 mediawiki125 1.25.3

MediaWiki reports:

Wikipedia user RobinHood70 reported two issues in the chunked upload API. The API failed to correctly stop adding new chunks to the upload when the reported size was exceeded (T91203), allowing a malicious users to upload add an infinite number of chunks for a single file upload. Additionally, a malicious user could upload chunks of 1 byte for very large files, potentially creating a very large number of files on the server's filesystem (T91205).

Internal review discovered that it is not possible to throttle file uploads.

Internal review discovered a missing authorization check when removing suppression from a revision. This allowed users with the 'viewsuppressed' user right but not the appropriate 'suppressrevision' user right to unsuppress revisions.

Richard Stanway from teamliquid.net reported that thumbnails of PNG files generated with ImageMagick contained the local file path in the image metadata.

CVE-2015-8001 CVE-2015-8002 CVE-2015-8003 CVE-2015-8004 CVE-2015-8005 CVE-2015-8006 CVE-2015-8007 CVE-2015-8008 CVE-2015-8009 https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-October/000181.html https://phabricator.wikimedia.org/T91203 https://phabricator.wikimedia.org/T91205 https://phabricator.wikimedia.org/T91850 https://phabricator.wikimedia.org/T95589 https://phabricator.wikimedia.org/T108616 http://www.openwall.com/lists/oss-security/2015/10/29/14 2015-10-16 2015-10-23 2015-12-24 ntp -- 13 low- and medium-severity vulnerabilities ntp 4.2.8p4 ntp-devel 4.3.76 FreeBSD 10.210.2_7 10.110.1_24 9.39.3_30

ntp.org reports:

NTF's NTP Project has been notified of the following 13 low- and medium-severity vulnerabilities that are fixed in ntp-4.2.8p4, released on Wednesday, 21 October 2015:

Bug 2941 CVE-2015-7871 NAK to the Future: Symmetric association authentication bypass via crypto-NAK (Cisco ASIG)

Bug 2922 CVE-2015-7855 decodenetnum() will ASSERT botch instead of returning FAIL on some bogus values (IDA)

Bug 2921 CVE-2015-7854 Password Length Memory Corruption Vulnerability. (Cisco TALOS)

Bug 2920 CVE-2015-7853 Invalid length data provided by a custom refclock driver could cause a buffer overflow. (Cisco TALOS)

Bug 2919 CVE-2015-7852 ntpq atoascii() Memory Corruption Vulnerability. (Cisco TALOS)

Bug 2918 CVE-2015-7851 saveconfig Directory Traversal Vulnerability. (OpenVMS) (Cisco TALOS)

Bug 2917 CVE-2015-7850 remote config logfile-keyfile. (Cisco TALOS)

Bug 2916 CVE-2015-7849 trusted key use-after-free. (Cisco TALOS)

Bug 2913 CVE-2015-7848 mode 7 loop counter underrun. (Cisco TALOS)

Bug 2909 CVE-2015-7701 Slow memory leak in CRYPTO_ASSOC. (Tenable)

Bug 2902 : CVE-2015-7703 configuration directives "pidfile" and "driftfile" should only be allowed locally. (RedHat)

Bug 2901 : CVE-2015-7704, CVE-2015-7705 Clients that receive a KoD should validate the origin timestamp field. (Boston University)

Bug 2899 : CVE-2015-7691, CVE-2015-7692, CVE-2015-7702 Incomplete autokey data packet length checks. (Tenable)

The only generally-exploitable bug in the above list is the crypto-NAK bug, which has a CVSS2 score of 6.4.

Additionally, three bugs that have already been fixed in ntp-4.2.8 but were not fixed in ntp-4.2.6 as it was EOL'd have a security component, but are all below 1.8 CVSS score, so we're reporting them here:

Bug 2382 : Peer precision < -31 gives division by zero

Bug 1774 : Segfaults if cryptostats enabled when built without OpenSSL

Bug 1593 : ntpd abort in free() with logconfig syntax error

SA-15:25.ntp CVE-2015-7691 CVE-2015-7692 CVE-2015-7701 CVE-2015-7702 CVE-2015-7703 CVE-2015-7704 CVE-2015-7705 CVE-2015-7848 CVE-2015-7849 CVE-2015-7850 CVE-2015-7851 CVE-2015-7852 CVE-2015-7853 CVE-2015-7854 CVE-2015-7855 CVE-2015-7871 http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities 2015-10-21 2015-10-21 2016-08-09 codeigniter -- multiple XSS vulnerabilities codeigniter 2.2.5

The CodeIgniter changelog reports:

Fixed a number of XSS attack vectors in Security Library method xss_clean (thanks to Frans Rosén from Detectify.

ports/203403 https://codeigniter.com/userguide2/changelog.html 2015-10-08 2015-10-20 Git -- Execute arbitrary code git 2.6.1 git-gui 2.6.1 git-lite 2.6.1 git-subversion 2.6.1

Git release notes:

Some protocols (like git-remote-ext) can execute arbitrary code found in the URL. The URLs that submodules use may come from arbitrary sources (e.g., .gitmodules files in a remote repository), and can hurt those who blindly enable recursive fetch. Restrict the allowed protocols to well known and safe ones.

CVE-2015-7545 https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.6.1.txt http://www.openwall.com/lists/oss-security/2015/12/11/7 2015-09-23 2015-10-19 2015-12-12 Salt -- multiple vulnerabilities py27-salt 2015.8.1

Salt release notes:

CVE-2015-6918 - Git modules leaking HTTPS auth credentials to debug log

Updated the Git state and execution modules to no longer display HTTPS basic authentication credentials in loglevel debug output on the Salt master. These credentials are now replaced with REDACTED in the debug output. Thanks to Andreas Stieger for bringing this to our attention.

CVE-2015-6941 - win_useradd module and salt-cloud display passwords in debug log

Updated the win_useradd module return data to no longer include the password of the newly created user. The password is now replaced with the string XXX-REDACTED-XXX. Updated the Salt Cloud debug output to no longer display win_password and sudo_password authentication credentials. Also updated the Linode driver to no longer display authentication credentials in debug logs. These credentials are now replaced with REDACTED in the debug output.

https://docs.saltstack.com/en/latest/topics/releases/2015.8.1.html CVE-2015-6918 CVE-2015-6941 2015-10-16 2015-10-17 firefox -- Cross-origin restriction bypass using Fetch firefox 41.0.2,1 linux-firefox 41.0.2,1

Firefox Developers report:

Security researcher Abdulrahman Alqabandi reported that the fetch() API did not correctly implement the Cross-Origin Resource Sharing (CORS) specification, allowing a malicious page to access private data from other origins. Mozilla developer Ben Kelly independently reported the same issue.

https://www.mozilla.org/en-US/security/advisories/mfsa2015-115/ CVE-2015-7184 2015-10-15 2015-10-16 flash -- remote code execution linux-c6-flashplugin linux-f10-flashplugin linux-c6_64-flashplugin 11.2r202.540

Adobe reports:

These updates resolve type confusion vulnerabilities that could lead to code execution (CVE-2015-7645, CVE-2015-7647, CVE-2015-7648).

CVE-2015-7645 CVE-2015-7647 CVE-2015-7648 https://helpx.adobe.com/security/products/flash-player/apsb15-27.html 2015-10-16 2015-10-16 LibreSSL -- Memory leak and buffer overflow libressl 2.2.4

Qualys reports:

During the code review of OpenSMTPD a memory leak and buffer overflow (an off-by-one, usually stack-based) were discovered in LibreSSL's OBJ_obj2txt() function. This function is called automatically during a TLS handshake (both client-side, unless an anonymous mode is used, and server-side, if client authentication is requested).

http://marc.info/?l=openbsd-announce&m=144495690528446 CVE-2015-5333 CVE-2015-5334 2015-10-15 2015-10-16 2015-10-26 mbedTLS/PolarSSL -- DoS and possible remote code execution polarssl 1.2.01.2.17 polarssl13 1.3.01.3.14 mbedtls 2.1.2

ARM Limited reports:

When the client creates its ClientHello message, due to insufficient bounds checking it can overflow the heap-based buffer containing the message while writing some extensions. Two extensions in particular could be used by a remote attacker to trigger the overflow: the session ticket extension and the server name indication (SNI) extension.

https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2015-01 CVE-2015-5291 2015-10-05 2015-10-15 magento -- multiple vulnerabilities magento 1.9.2.1

Magento, Inc. reports:

SUPEE-6482 - This patch addresses two issues related to APIs and two cross-site scripting risks.

SUPEE-6285 - This patch provides protection against several types of security-related issues, including information leaks, request forgeries, and cross-site scripting.

SUPEE-5994 - This patch addresses multiple security vulnerabilities in Magento Community Edition software, including issues that can put customer information at risk.

SUPEE-5344 - Addresses a potential remote code execution exploit.

SUPEE-1533 - Addresses two potential remote code execution exploits.

ports/201709 https://www.magentocommerce.com/download http://merch.docs.magento.com/ce/user_guide/Magento_Community_Edition_User_Guide.html#magento/release-notes-ce-1.9.2.html http://merch.docs.magento.com/ce/user_guide/Magento_Community_Edition_User_Guide.html#magento/release-notes-ce-1.9.2.1.html 2014-10-03 2015-10-14 pear-twig -- remote code execution pear-twig-twig 1.20.0

Fabien Potencier reports:

End users can craft valid Twig code that allows them to execute arbitrary code (RCEs) via the _self variable, which is always available, even in sandboxed templates.

http://symfony.com/blog/security-release-twig-1-20-0 CVE-2015-7809 2015-08-12 2015-10-14 miniupnpc -- buffer overflow miniupnpc 1.9.11.9.20150917 1.9_1

Talos reports:

An exploitable buffer overflow vulnerability exists in the XML parser functionality of the MiniUPnP library. A specially crafted XML response can lead to a buffer overflow on the stack resulting in remote code execution. An attacker can set up a server on the local network to trigger this vulnerability.

CVE-2015-6031 http://talosintel.com/reports/TALOS-2015-0035/ https://github.com/miniupnp/miniupnp/commit/79cca974a4c2ab1199786732a67ff6d898051b78 2015-09-15 2015-10-14 2015-10-14 flash -- multiple vulnerabilities linux-c6-flashplugin linux-f10-flashplugin linux-c6_64-flashplugin 11.2r202.535

Adobe reports:

These updates resolve a vulnerability that could be exploited to bypass the same-origin-policy and lead to information disclosure (CVE-2015-7628).

These updates include a defense-in-depth feature in the Flash broker API (CVE-2015-5569).

These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2015-7629, CVE-2015-7631, CVE-2015-7643, CVE-2015-7644).

These updates resolve a buffer overflow vulnerability that could lead to code execution (CVE-2015-7632).

These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2015-7625, CVE-2015-7626, CVE-2015-7627, CVE-2015-7630, CVE-2015-7633, CVE-2015-7634).

CVE-2015-5569 CVE-2015-7625 CVE-2015-7626 CVE-2015-7627 CVE-2015-7628 CVE-2015-7629 CVE-2015-7630 CVE-2015-7631 CVE-2015-7632 CVE-2015-7633 CVE-2015-7634 CVE-2015-7643 CVE-2015-7644 https://helpx.adobe.com/security/products/flash-player/apsb15-25.html 2015-10-13 2015-10-14 chromium -- multiple vulnerabilities chromium chromium-npapi chromium-pulse 46.0.2490.71

Google Chrome Releases reports:

24 security fixes in this release, including:

[519558] High CVE-2015-6755: Cross-origin bypass in Blink. Credit to Mariusz Mlynski.

[507316] High CVE-2015-6756: Use-after-free in PDFium. Credit to anonymous.

[529520] High CVE-2015-6757: Use-after-free in ServiceWorker. Credit to Collin Payne.

[522131] High CVE-2015-6758: Bad-cast in PDFium. Credit to Atte Kettunen of OUSPG.

[514076] Medium CVE-2015-6759: Information leakage in LocalStorage. Credit to Muneaki Nishimura (nishimunea).

[519642] Medium CVE-2015-6760: Improper error handling in libANGLE. Credit to lastland.net.

[447860,532967] Medium CVE-2015-6761: Memory corruption in FFMpeg. Credit to Aki Helin of OUSPG and anonymous.

[512678] Low CVE-2015-6762: CORS bypass via CSS fonts. Credit to Muneaki Nishimura (nishimunea).

[542517] CVE-2015-6763: Various fixes from internal audits, fuzzing and other initiatives.

Multiple vulnerabilities in V8 fixed at the tip of the 4.6 branch (currently 4.6.85.23).

CVE-2015-6755 CVE-2015-6756 CVE-2015-6757 CVE-2015-6758 CVE-2015-6759 CVE-2015-6760 CVE-2015-6761 CVE-2015-6762 CVE-2015-6763 http://googlechromereleases.blogspot.nl/2015/10/stable-channel-update.html 2015-10-13 2015-10-13 p5-UI-Dialog -- shell command execution vulnerability p5-UI-Dialog 1.09_2

Matthijs Kooijman reports:

It seems that the whiptail, cdialog and kdialog backends apply some improper escaping in their shell commands, causing special characters present in menu item titles to be interpreted by the shell. This includes the backtick evaluation operator, so this constitutues a security issue, allowing execution of arbitrary commands if an attacker has control over the text displayed in a menu.

CVE-2008-7315 ports/203667 https://rt.cpan.org/Public/Bug/Display.html?id=107364 https://bugs.debian.org/496448 https://github.com/kckrinke/UI-Dialog/commit/6adc44cc636c615d76297d86835e1a997681eb61 2008-08-24 2015-10-10 devel/ipython -- multiple vulnerabilities ipython 3.2.2

Matthias Bussonnier reports:

Summary: Local folder name was used in HTML templates without escaping, allowing XSS in said pages by carefully crafting folder name and URL to access it.

URI with issues:

GET /tree/**

Benjamin RK reports:

Vulnerability: A maliciously forged file opened for editing can execute javascript, specifically by being redirected to /files/ due to a failure to treat the file as plain text.

URI with issues:

GET /edit/**

ports/203668 CVE-2015-6938 CVE-2015-7337 http://www.openwall.com/lists/oss-security/2015/09/02/3 https://github.com/ipython/ipython/commit/3ab41641cf6fce3860c73d5cf4645aa12e1e5892 http://www.openwall.com/lists/oss-security/2015/09/16/3 https://github.com/ipython/ipython/commit/0a8096adf165e2465550bd5893d7e352544e5967 2015-09-01 2015-10-10 PostgreSQL -- minor security problems. postgresql90-server 9.0.09.0.22 postgresql91-server 9.1.09.1.18 postgresql92-server 9.2.09.2.13 postgresql93-server 9.3.09.3.9 postgresql94-server 9.4.09.4.4

PostgreSQL project reports:

Two security issues have been fixed in this release which affect users of specific PostgreSQL features.

CVE-2015-5289 json or jsonb input values constructed from arbitrary user input can crash the PostgreSQL server and cause a denial of service.

CVE-2015-5288: The crypt() function included with the optional pgCrypto extension could be exploited to read a few additional bytes of memory. No working exploit for this issue has been developed.

CVE-2015-5289 CVE-2015-5288 2015-10-08 2015-10-08 ZendFramework1 -- SQL injection vulnerability ZendFramework1 1.12.16

Zend Framework developers report:

The PDO adapters of Zend Framework 1 do not filter null bytes values in SQL statements. A PDO adapter can treat null bytes in a query as a string terminator, allowing an attacker to add arbitrary SQL following a null byte, and thus create a SQL injection.

CVE-2015-7695 http://www.openwall.com/lists/oss-security/2015/09/30/6 http://framework.zend.com/security/advisory/ZF2015-08 2015-09-15 2015-10-06 2015-10-12 OpenSMTPD -- multiple vulnerabilities opensmtpd 5.7.3,1

OpenSMTPD developers report:

fix an mda buffer truncation bug which allows a user to create forward files that pass session checks but fail delivery later down the chain, within the user mda

fix remote buffer overflow in unprivileged pony process

reworked offline enqueue to better protect against hardlink attacks

http://www.openwall.com/lists/oss-security/2015/10/04/2 https://www.opensmtpd.org/announces/release-5.7.3.txt 2015-10-04 2015-10-06 mbedTLS/PolarSSL -- multiple vulnerabilities polarssl 1.2.01.2.16 polarssl13 1.3.01.3.13 mbedtls 2.1.1

ARM Limited reports:

Florian Weimar from Red Hat published on Lenstra's RSA-CRT attach for PKCS#1 v1.5 signatures. These releases include countermeasures against that attack.

Fabian Foerg of Gotham Digital Science found a possible client-side NULL pointer dereference, using the AFL Fuzzer. This dereference can only occur when misusing the API, although a fix has still been implemented.

https://tls.mbed.org/tech-updates/releases/mbedtls-2.1.1-and-1.3.13-and-polarssl-1.2.16-released 2015-09-18 2015-10-06 mbedTLS/PolarSSL -- multiple vulnerabilities polarssl 1.2.01.2.15 polarssl13 1.3.01.3.12

ARM Limited reports:

In order to strengthen the minimum requirements for connections and to protect against the Logjam attack, the minimum size of Diffie-Hellman parameters accepted by the client has been increased to 1024 bits.

In addition the default size for the Diffie-Hellman parameters on the server are increased to 2048 bits. This can be changed with ssl_set_dh_params() in case this is necessary.

https://tls.mbed.org/tech-updates/releases/polarssl-1.2.15-and-mbedtls-1.3.12-released 2015-08-11 2015-10-06 gdk-pixbuf2 -- head overflow and DoS gdk-pixbuf2 2.32.1

reports:

We found a heap overflow and a DoS in the gdk-pixbuf implementation triggered by the scaling of tga file.

We found a heap overflow in the gdk-pixbuf implementation triggered by the scaling of gif file.

CVE-2015-7673 CVE-2015-7674 https://mail.gnome.org/archives/ftp-release-list/2015-September/msg00201.html https://mail.gnome.org/archives/ftp-release-list/2015-September/msg00287.html http://www.openwall.com/lists/oss-security/2015/10/02/9 http://www.openwall.com/lists/oss-security/2015/10/02/10 2015-10-02 2015-10-05 plone -- multiple vulnerabilities plone 4.3.7

Plone.org reports:

Versions Affected: All current Plone versions.

Versions Not Affected: None.

Nature of vulnerability: Allows creation of members by anonymous users on sites that have self-registration enabled, allowing bypass of CAPTCHA and similar protections against scripted attacks.

The patch can be added to buildouts as Products.PloneHotfix20150910 (available from PyPI) or downloaded from Plone.org.

Immediate Measures You Should Take: Disable self-registration until you have applied the patch.

Plone's URL checking infrastructure includes a method for checking if URLs valid and located in the Plone site. By passing HTML into this specially crafted url, XSS can be achieved.

ports/203255 https://plone.org/products/plone-hotfix/releases/20150910 https://plone.org/products/plone/security/advisories/20150910-announcement https://plone.org/security/20150910/non-persistent-xss-in-plone https://github.com/plone/Products.CMFPlone/commit/3da710a2cd68587f0bf34f2e7ea1167d6eeee087 2015-09-10 2015-10-05 php -- multiple vulnerabilities php5-phar 5.4.45 php55-phar 5.5.30 php56-phar 5.6.14

PHP reports:

Phar:

Fixed bug #69720 (Null pointer dereference in phar_get_fp_offset()).

Fixed bug #70433 (Uninitialized pointer in phar_make_dirstream when zip entry filename is "/").

ports/203541 CVE-2015-7803 CVE-2015-7804 http://php.net/ChangeLog-5.php#5.5.30 http://php.net/ChangeLog-5.php#5.6.14 2015-10-01 2015-10-04 2015-10-12 OpenSMTPD -- multiple vulnerabilities opensmtpd 5.7.2,1

OpenSMTPD developers report:

an oversight in the portable version of fgetln() that allows attackers to read and write out-of-bounds memory

multiple denial-of-service vulnerabilities that allow local users to kill or hang OpenSMTPD

a stack-based buffer overflow that allows local users to crash OpenSMTPD, or execute arbitrary code as the non-chrooted _smtpd user

a hardlink attack (or race-conditioned symlink attack) that allows local users to unset the chflags() of arbitrary files

a hardlink attack that allows local users to read the first line of arbitrary files (for example, root's hash from /etc/master.passwd)

a denial-of-service vulnerability that allows remote attackers to fill OpenSMTPD's queue or mailbox hard-disk partition

an out-of-bounds memory read that allows remote attackers to crash OpenSMTPD, or leak information and defeat the ASLR protection

a use-after-free vulnerability that allows remote attackers to crash OpenSMTPD, or execute arbitrary code as the non-chrooted _smtpd user

https://www.opensmtpd.org/announces/release-5.7.2.txt CVE-2015-7687 2015-10-02 2015-10-04 2015-10-06 james -- multiple vulnerabilities james 2.3.2.1

The Apache James Project reports:

This release has many enhancements and bug fixes over the previous release. See the Release Notes for a detailed list of changes. Some of the earlier defects could turn a James mail server into an Open Relay and allow files to be written on disk. All users of James Server are urged to upgrade to version v2.3.2.1 as soon as possible.

ports/203461 988628 CVE-2015-7611 http://james.apache.org/download.cgi#Apache_James_Server https://blogs.apache.org/james/entry/apache_james_server_2_3 2015-09-30 2015-10-01 2015-10-04 otrs -- Scheduler Process ID File Access otrs 3.2.*3.2.18 3.3.*3.3.15 4.0.*4.0.13

The OTRS project reports:

An attacker with valid LOCAL credentials could access and manipulate the process ID file for bin/otrs.schduler.pl from the CLI.

The Proc::Daemon module 0.14 for Perl uses world-writable permissions for a file that stores a process ID, which allows local users to have an unspecified impact by modifying this file.

https://www.otrs.com/security-advisory-2015-02-scheduler-process-id-file-access/ CVE-2015-6842 CVE-2013-7135 2015-09-17 2015-09-30 flash -- multiple vulnabilities linux-c6-flashplugin linux-f10-flashplugin linux-c6_64-flashplugin 11.2r202.521

Adobe reports:

These updates resolve a type confusion vulnerability that could lead to code execution (CVE-2015-5573).

These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2015-5570, CVE-2015-5574, CVE-2015-5581, CVE-2015-5584, CVE-2015-6682).

These updates resolve buffer overflow vulnerabilities that could lead to code execution (CVE-2015-6676, CVE-2015-6678).

These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2015-5575, CVE-2015-5577, CVE-2015-5578, CVE-2015-5580, CVE-2015-5582, CVE-2015-5588, CVE-2015-6677).

These updates include additional validation checks to ensure that Flash Player rejects malicious content from vulnerable JSONP callback APIs (CVE-2015-5571).

These updates resolve a memory leak vulnerability (CVE-2015-5576).

These updates include further hardening to a mitigation to defend against vector length corruptions (CVE-2015-5568).

These updates resolve stack corruption vulnerabilities that could lead to code execution (CVE-2015-5567, CVE-2015-5579).

These updates resolve a stack overflow vulnerability that could lead to code execution (CVE-2015-5587).

These updates resolve a security bypass vulnerability that could lead to information disclosure (CVE-2015-5572).

These updates resolve a vulnerability that could be exploited to bypass the same-origin-policy and lead to information disclosure (CVE-2015-6679).

CVE-2015-5567 CVE-2015-5568 CVE-2015-5570 CVE-2015-5571 CVE-2015-5572 CVE-2015-5573 CVE-2015-5574 CVE-2015-5575 CVE-2015-5576 CVE-2015-5577 CVE-2015-5578 CVE-2015-5588 CVE-2015-6676 CVE-2015-6677 CVE-2015-6678 CVE-2015-6679 CVE-2015-6682 https://helpx.adobe.com/security/products/flash-player/apsb15-23.html 2015-09-21 2015-09-28 codeigniter -- SQL injection vulnerability codeigniter 2.2.4

The CodeIgniter changelog reports:

Security: Fixed an SQL injection vulnerability in Active Record method offset().

ports/203401 https://codeigniter.com/userguide2/changelog.html 2015-08-20 2015-09-28 codeigniter -- mysql database driver vulnerability codeigniter 2.2.3

The CodeIgniter changelog reports:

Security: Removed a fallback to mysql_escape_string() in the mysql database driver (escape_str() method) when there's no active database connection.

ports/203401 https://codeigniter.com/userguide2/changelog.html 2015-07-15 2015-09-28 codeigniter -- multiple vulnerabilities codeigniter 2.2.2

The CodeIgniter changelog reports:

Security: Added HTTP "Host" header character validation to prevent cache poisoning attacks when base_url auto-detection is used.

Security: Added FSCommand and seekSegmentTime to the "evil attributes" list in CI_Security::xss_clean().

ports/203401 https://codeigniter.com/userguide2/changelog.html 2015-04-15 2015-09-28 codeigniter -- multiple vulnerabilities codeigniter 2.2.0

The CodeIgniter changelog reports:

Security: The xor_encode() method in the Encrypt Class has been removed. The Encrypt Class now requires the Mcrypt extension to be installed.

Security: The Session Library now uses HMAC authentication instead of a simple MD5 checksum.

ports/203401 https://codeigniter.com/userguide2/changelog.html 2014-06-05 2015-09-28 codeigniter -- SQL injection vulnerability codeigniter 2.0.3

The CodeIgniter changelog reports:

An improvement was made to the MySQL and MySQLi drivers to prevent exposing a potential vector for SQL injection on sites using multi-byte character sets in the database client connection.

An incompatibility in PHP versions < 5.2.3 and MySQL > 5.0.7 with mysql_set_charset() creates a situation where using multi-byte character sets on these environments may potentially expose a SQL injection attack vector. Latin-1, UTF-8, and other "low ASCII" character sets are unaffected on all environments.

If you are running or considering running a multi-byte character set for your database connection, please pay close attention to the server environment you are deploying on to ensure you are not vulnerable.

ports/156486 https://codeigniter.com/userguide2/changelog.html 2011-08-20 2015-09-28 chromium -- multiple vulnerabilities chromium 45.0.2454.101 chromium-npapi 45.0.2454.101 chromium-pulse 45.0.2454.101

Google Chrome Releases reports:

Two vulnerabilities were fixed in this release:

[530301] High CVE-2015-1303: Cross-origin bypass in DOM. Credit to Mariusz Mlynski.

[531891] High CVE-2015-1304: Cross-origin bypass in V8. Credit to Mariusz Mlynski.

CVE-2015-1303 CVE-2015-1304 http://googlechromereleases.blogspot.nl/2015/09/stable-channel-update_24.html 2015-09-24 2015-09-27 libssh2 -- denial of service vulnerability libssh2 1.5.0,2

Mariusz Ziulek reports:

A malicious attacker could man in the middle a real server and cause libssh2 using clients to crash (denial of service) or otherwise read and use completely unintended memory areas in this process.

http://www.libssh2.org/adv_20150311.html https://trac.libssh2.org/ticket/294 CVE-2015-1782 2015-01-25 2015-09-22 2015-09-22 mozilla -- multiple vulnerabilities firefox 41.0,1 linux-firefox 41.0,1 seamonkey 2.38 linux-seamonkey 2.38 firefox-esr 38.3.0,1 libxul 38.3.0 thunderbird 38.3.0 linux-thunderbird 38.3.0

The Mozilla Project reports:

MFSA 2015-96 Miscellaneous memory safety hazards (rv:41.0 / rv:38.3)

MFSA 2015-97 Memory leak in mozTCPSocket to servers

MFSA 2015-98 Out of bounds read in QCMS library with ICC V4 profile attributes

MFSA 2015-99 Site attribute spoofing on Android by pasting URL with unknown scheme

MFSA 2015-100 Arbitrary file manipulation by local user through Mozilla updater

MFSA 2015-101 Buffer overflow in libvpx while parsing vp9 format video

MFSA 2015-102 Crash when using debugger with SavedStacks in JavaScript

MFSA 2015-103 URL spoofing in reader mode

MFSA 2015-104 Use-after-free with shared workers and IndexedDB

MFSA 2015-105 Buffer overflow while decoding WebM video

MFSA 2015-106 Use-after-free while manipulating HTML media content

MFSA 2015-107 Out-of-bounds read during 2D canvas display on Linux 16-bit color depth systems

MFSA 2015-108 Scripted proxies can access inner window

MFSA 2015-109 JavaScript immutable property enforcement can be bypassed

MFSA 2015-110 Dragging and dropping images exposes final URL after redirects

MFSA 2015-111 Errors in the handling of CORS preflight request headers

MFSA 2015-112 Vulnerabilities found through code inspection

MFSA 2015-113 Memory safety errors in libGLES in the ANGLE graphics library

MFSA 2015-114 Information disclosure via the High Resolution Time API

CVE-2015-4476 CVE-2015-4500 CVE-2015-4501 CVE-2015-4502 CVE-2015-4503 CVE-2015-4504 CVE-2015-4505 CVE-2015-4506 CVE-2015-4507 CVE-2015-4508 CVE-2015-4509 CVE-2015-4510 CVE-2015-4512 CVE-2015-4516 CVE-2015-4517 CVE-2015-4519 CVE-2015-4520 CVE-2015-4521 CVE-2015-4522 CVE-2015-7174 CVE-2015-7175 CVE-2015-7176 CVE-2015-7177 CVE-2015-7178 CVE-2015-7179 CVE-2015-7180 https://www.mozilla.org/security/advisories/mfsa2015-96/ https://www.mozilla.org/security/advisories/mfsa2015-97/ https://www.mozilla.org/security/advisories/mfsa2015-98/ https://www.mozilla.org/security/advisories/mfsa2015-99/ https://www.mozilla.org/security/advisories/mfsa2015-100/ https://www.mozilla.org/security/advisories/mfsa2015-101/ https://www.mozilla.org/security/advisories/mfsa2015-102/ https://www.mozilla.org/security/advisories/mfsa2015-103/ https://www.mozilla.org/security/advisories/mfsa2015-104/ https://www.mozilla.org/security/advisories/mfsa2015-105/ https://www.mozilla.org/security/advisories/mfsa2015-106/ https://www.mozilla.org/security/advisories/mfsa2015-107/ https://www.mozilla.org/security/advisories/mfsa2015-108/ https://www.mozilla.org/security/advisories/mfsa2015-109/ https://www.mozilla.org/security/advisories/mfsa2015-110/ https://www.mozilla.org/security/advisories/mfsa2015-111/ https://www.mozilla.org/security/advisories/mfsa2015-112/ https://www.mozilla.org/security/advisories/mfsa2015-113/ https://www.mozilla.org/security/advisories/mfsa2015-114/ 2015-09-22 2015-09-22 ffmpeg -- multiple vulnerabilities libav 0 gstreamer1-libav 1.5.90 gstreamer-ffmpeg 0 handbrake 0 ffmpeg 2.7.2,1 ffmpeg26 2.6.4 ffmpeg25 2.5.8 ffmpeg24 2.4.11 ffmpeg-devel ffmpeg23 ffmpeg2 ffmpeg1 ffmpeg-011 ffmpeg0 0 avidemux avidemux2 avidemux26 2.6.11 kodi 15.1 mplayer mencoder 1.1.r20150822 mythtv mythtv-frontend 0 plexhometheater 0

NVD reports:

The decode_ihdr_chunk function in libavcodec/pngdec.c in FFmpeg before 2.7.2 does not enforce uniqueness of the IHDR (aka image header) chunk in a PNG image, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted image with two or more of these chunks.

Multiple integer underflows in the ff_mjpeg_decode_frame function in libavcodec/mjpegdec.c in FFmpeg before 2.7.2 allow remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted MJPEG data.

The ff_sbr_apply function in libavcodec/aacsbr.c in FFmpeg before 2.7.2 does not check for a matching AAC frame syntax element before proceeding with Spectral Band Replication calculations, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted AAC data.

The ff_mpv_common_init function in libavcodec/mpegvideo.c in FFmpeg before 2.7.2 does not properly maintain the encoding context, which allows remote attackers to cause a denial of service (invalid pointer access) or possibly have unspecified other impact via crafted MPEG data.

The destroy_buffers function in libavcodec/sanm.c in FFmpeg before 2.7.2 does not properly maintain height and width values in the video context, which allows remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via crafted LucasArts Smush video data.

The allocate_buffers function in libavcodec/alac.c in FFmpeg before 2.7.2 does not initialize certain context data, which allows remote attackers to cause a denial of service (segmentation violation) or possibly have unspecified other impact via crafted Apple Lossless Audio Codec (ALAC) data.

The sws_init_context function in libswscale/utils.c in FFmpeg before 2.7.2 does not initialize certain pixbuf data structures, which allows remote attackers to cause a denial of service (segmentation violation) or possibly have unspecified other impact via crafted video data.

The ff_frame_thread_init function in libavcodec/pthread_frame.c in FFmpeg before 2.7.2 mishandles certain memory-allocation failures, which allows remote attackers to cause a denial of service (invalid pointer access) or possibly have unspecified other impact via a crafted file, as demonstrated by an AVI file.

The ff_rv34_decode_init_thread_copy function in libavcodec/rv34.c in FFmpeg before 2.7.2 does not initialize certain structure members, which allows remote attackers to cause a denial of service (invalid pointer access) or possibly have unspecified other impact via crafted (1) RV30 or (2) RV40 RealVideo data.

CVE-2015-6818 CVE-2015-6819 CVE-2015-6820 CVE-2015-6821 CVE-2015-6822 CVE-2015-6823 CVE-2015-6824 CVE-2015-6825 CVE-2015-6826 https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=47f4e2d8960ca756ca153ab8e3e93d80449b8c91 https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=84afc6b70d24fc0bf686e43138c96cf60a9445fe https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=79a98294da6cd85f8c86b34764c5e0c43b09eea3 https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=b160fc290cf49b516c5b6ee0730fd9da7fc623b1 https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=39bbdebb1ed8eb9c9b0cd6db85afde6ba89d86e4 https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=f7068bf277a37479aecde2832208d820682b35e6 https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=a5d44d5c220e12ca0cb7a4eceb0f74759cb13111 https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=f1a38264f20382731cf2cc75fdd98f4c9a84a626 https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=3197c0aa87a3b7190e17d49e6fbc7b554e4b3f0a https://ffmpeg.org/security.html 2015-09-05 2015-09-20 2015-09-20 moodle -- multiple vulnerabilities moodle27 2.7.10 moodle28 2.8.8 moodle29 2.9.2

Moodle Release Notes report:

MSA-15-0030: Students can re-attempt answering questions in the lesson (CVE-2015-5264)

MSA-15-0031: Teacher in forum can still post to "all participants" and groups they are not members of (CVE-2015-5272 - 2.7.10 only)

MSA-15-0032: Users can delete files uploaded by other users in wiki (CVE-2015-5265)

MSA-15-0033: Meta course synchronization enrolls suspended students as managers for a short period of time (CVE-2015-5266)

MSA-15-0034: Vulnerability in password recovery mechanism (CVE-2015-5267)

MSA-15-0035: Rating component does not check separate groups (CVE-2015-5268)

MSA-15-0036: XSS in grouping description (CVE-2015-5269)

CVE-2015-5264 CVE-2015-5272 CVE-2015-5265 CVE-2015-5266 CVE-2015-5267 CVE-2015-5268 CVE-2015-5269 http://www.openwall.com/lists/oss-security/2015/09/21/1 https://docs.moodle.org/dev/Moodle_2.7.10_release_notes https://docs.moodle.org/dev/Moodle_2.8.8_release_notes https://docs.moodle.org/dev/Moodle_2.9.2_release_notes 2015-09-14 2015-09-18 2015-09-24 squid -- TLS/SSL parser denial of service vulnerability squid 3.5.0.13.5.9

Amos Jeffries, release manager of the Squid-3 series, reports:

Vulnerable versions are 3.5.0.1 to 3.5.8 (inclusive), which are built with OpenSSL and configured for "SSL-Bump" decryption.

Integer overflows can lead to invalid pointer math reading from random memory on some CPU architectures. In the best case this leads to wrong TLS extensiosn being used for the client, worst-case a crash of the proxy terminating all active transactions.

Incorrect message size checks and assumptions about the existence of TLS extensions in the SSL/TLS handshake message can lead to very high CPU consumption (up to and including 'infinite loop' behaviour).

The above can be triggered remotely. Though there is one layer of authorization applied before this processing to check that the client is allowed to use the proxy, that check is generally weak. MS Skype on Windows XP is known to trigger some of these.

The FreeBSD port does not use SSL by default and is not vulnerable in the default configuration.

ports/203186 http://www.squid-cache.org/Advisories/SQUID-2015_3.txt http://www.openwall.com/lists/oss-security/2015/09/18/1 2015-09-18 2015-09-18 2016-02-18 remind -- buffer overflow with malicious reminder file input remind 3.1.15

Dianne Skoll reports:

BUG FIX: Fix a buffer overflow found by Alexander Keller.

The bug can be manifested by an extended DUMP command using a system variable (that is a special variable whose name begins with '$')

CVE-2015-5957 ports/202942 http://lists.roaringpenguin.com/pipermail/remind-fans/2015/003172.html http://www.openwall.com/lists/oss-security/2015/08/07/1 2015-07-27 2015-09-18 shutter -- arbitrary code execution shutter 0.800.93.1_2

Luke Farone reports:

In the "Shutter" screenshot application, I discovered that using the "Show in folder" menu option while viewing a file with a specially-crafted path allows for arbitrary code execution with the permissions of the user running Shutter.

http://seclists.org/oss-sec/2015/q3/541 https://bugs.launchpad.net/shutter/+bug/1495163 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=798862 CVE-2015-0854 2015-09-13 2015-09-17 openjpeg -- use-after-free vulnerability openjpeg 2.1.1

Feist Josselin reports:

Use-after-free was found in openjpeg. The vuln is fixed in version 2.1.1 and was located in opj_j2k_write_mco function.

http://seclists.org/oss-sec/2015/q3/550 https://github.com/uclouvain/openjpeg/issues/563 2015-08-14 2015-09-17 optipng -- use-after-free vulnerability optipng 0.6.5

Gustavo Grieco reports:

We found a use-after-free causing an invalid/double free in optipng 0.6.4.

http://seclists.org/oss-sec/2015/q3/556 CVE-2015-7801 2015-09-16 2015-09-17 2015-10-14 openslp -- denial of service vulnerability openslp 2.0.0

Qinghao Tang reports:

The function ParseExtension() in openslp 1.2.1 exists a vulnerability , an attacher can cause a denial of service (infinite loop) via a packet with crafted "nextoffset" value and "extid" value.

http://seclists.org/oss-sec/2015/q3/559 CVE-2015-5155 2015-09-16 2015-09-17 p7zip -- directory traversal vulnerability p7zip 9.38.1_2

Alexander Cherepanov reports:

7z (and 7zr) is susceptible to a directory traversal vulnerability. While extracting an archive, it will extract symlinks and then follow them if they are referenced in further entries. This can be exploited by a rogue archive to write files outside the current directory.

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774660 http://www.openwall.com/lists/oss-security/2015/01/11/2 http://sourceforge.net/p/p7zip/bugs/147/ CVE-2015-1038 2015-01-05 2015-09-16 h2o -- directory traversal vulnerability h2o 1.4.5

Yakuzo reports:

H2O (up to version 1.4.4 / 1.5.0-beta1) contains a flaw in its URL normalization logic.

When file.dir directive is used, this flaw allows a remote attacker to retrieve arbitrary files that exist outside the directory specified by the directive.

H2O version 1.4.5 and version 1.5.0-beta2 have been released to address this vulnerability.

Users are advised to upgrade their servers immediately.

The vulnerability was reported by: Yusuke OSUMI.

CVE-2015-5638 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5638 2015-09-14 2015-09-16 wordpress -- multiple vulnerabilities wordpress 4.3.1,1 de-wordpress ja-wordpress ru-wordpress zh-wordpress-zh_CN zh-wordpress-zh_TW 4.3.1

Samuel Sidler reports:

WordPress 4.3.1 is now available. This is a security release for all previous versions and we strongly encourage you to update your sites immediately.

WordPress versions 4.3 and earlier are vulnerable to a cross-site scripting vulnerability when processing shortcode tags (CVE-2015-5714). Reported by Shahar Tal and Netanel Rubin of Check Point.

A separate cross-site scripting vulnerability was found in the user list table. Reported by Ben Bidner of the WordPress security team.

Finally, in certain cases, users without proper permissions could publish private posts and make them sticky (CVE-2015-5715). Reported by Shahar Tal and Netanel Rubin of Check Point.

CVE-2015-5714 CVE-2015-5715 CVE-2015-7989 http://www.openwall.com/lists/oss-security/2015/10/28/1 https://wordpress.org/news/2015/09/wordpress-4-3-1/ 2015-09-15 2015-09-15 2015-10-29 Bugzilla security issues bugzilla44 4.4.10 bugzilla50 5.0.1

Bugzilla Security Advisory

Login names (usually an email address) longer than 127 characters are silently truncated in MySQL which could cause the domain name of the email address to be corrupted. An attacker could use this vulnerability to create an account with an email address different from the one originally requested. The login name could then be automatically added to groups based on the group's regular expression setting.

CVE-2015-4499 https://bugzilla.mozilla.org/show_bug.cgi?id=1202447 2015-09-10 2015-09-14 openldap -- denial of service vulnerability openldap-server 2.4.42_1

Denis Andzakovic reports:

By sending a crafted packet, an attacker may cause the OpenLDAP server to reach an assert(9 9 statement, crashing the daemon.

http://www.openldap.org/its/index.cgi/Software%20Bugs?id=8240 http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=commit;h=6fe51a9ab04fd28bbc171da3cf12f1c1040d6629 CVE-2015-6908 2015-09-09 2015-09-12 2015-09-13 vorbis-tools, opus-tools -- multiple vulnerabilities vorbis-tools 1.4.0_10,3 opus-tools 0.1.9_2

Paris Zoumpouloglou reports:

I discovered an integer overflow issue in oggenc, related to the number of channels in the input WAV file. The issue triggers an out-of-bounds memory access which causes oggenc to crash.

Paris Zoumpouloglou reports:

A crafted WAV file with number of channels set to 0 will cause oggenc to crash due to a division by zero issue.

pengsu reports:

I discovered an buffer overflow issue in oggenc/audio.c when it tries to open invalid aiff file.

ports/202941 https://trac.xiph.org/ticket/2136 CVE-2014-9639 https://trac.xiph.org/ticket/2137 CVE-2014-9638 https://trac.xiph.org/ticket/2212 CVE-2015-6749 2015-08-08 2015-09-09 2015-09-09 pgbouncer -- failed auth_query lookup leads to connection as auth_user pgbouncer 1.6.0

PgBouncer reports:

New auth_user functionality introduced in 1.6 allows login as auth_user when client presents unknown username. It's quite likely auth_user is superuser. Affects only setups that have enabled auth_user in their config.

CVE-2015-6817 https://pgbouncer.github.io/2015/09/pgbouncer-1-6-1/ https://github.com/pgbouncer/pgbouncer/issues/69 http://www.openwall.com/lists/oss-security/2015/09/04/3 2015-09-03 2015-09-09 phpMyAdmin -- reCaptcha bypass phpMyAdmin 4.4.04.4.14.1

The phpMyAdmin development team reports:

This vulnerability allows to complete the reCaptcha test and subsequently perform a brute force attack to guess user credentials without having to complete further reCaptcha tests.

We consider this vulnerability to be non critical since reCaptcha is an additional opt-in security measure.

https://www.phpmyadmin.net/security/PMASA-2015-4/ CVE-2015-6830 2015-09-08 2015-09-08 php -- multiple vulnerabilities php5 php5-soap php5-xsl 5.4.45 php55 php55-soap php55-xsl 5.5.29 php56 php56-soap php56-xsl 5.6.13

PHP reports:

Core:

Fixed bug #70172 (Use After Free Vulnerability in unserialize()).

Fixed bug #70219 (Use after free vulnerability in session deserializer).

EXIF:

Fixed bug #70385 (Buffer over-read in exif_read_data with TIFF IFD tag byte value of 32 bytes).

hash:

Fixed bug #70312 (HAVAL gives wrong hashes in specific cases).

PCRE:

Fixed bug #70345 (Multiple vulnerabilities related to PCRE functions).

SOAP:

Fixed bug #70388 (SOAP serialize_function_call() type confusion / RCE).

SPL:

Fixed bug #70365 (Use-after-free vulnerability in unserialize() with SplObjectStorage).

Fixed bug #70366 (Use-after-free vulnerability in unserialize() with SplDoublyLinkedList).

XSLT:

Fixed bug #69782 (NULL pointer dereference).

ZIP:

Fixed bug #70350 (ZipArchive::extractTo allows for directory traversal when creating directories).

http://php.net/ChangeLog-5.php#5.4.45 http://php.net/ChangeLog-5.php#5.5.29 http://php.net/ChangeLog-5.php#5.6.13 CVE-2015-6834 CVE-2015-6835 CVE-2015-6836 CVE-2015-6837 CVE-2015-6838 2015-09-03 2015-09-08 2015-09-08 ganglia-webfrontend -- auth bypass ganglia-webfrontend 3.7.1

Ivan Novikov reports:

It's easy to bypass auth by using boolean serialization...

https://github.com/ganglia/ganglia-web/issues/267 CVE-2015-6816 2015-09-04 2015-09-08 2015-09-08 wireshark -- multiple vulnerabilities wireshark wireshark-lite wireshark-qt5 tshark tshark-lite 1.12.7

Wireshark development team reports:

The following vulnerabilities have been fixed.

wnpa-sec-2015-21

Protocol tree crash. (Bug 11309)

wnpa-sec-2015-22

Memory manager crash. (Bug 11373)

wnpa-sec-2015-23

Dissector table crash. (Bug 11381)

wnpa-sec-2015-24

ZigBee crash. (Bug 11389)

wnpa-sec-2015-25

GSM RLC/MAC infinite loop. (Bug 11358)

wnpa-sec-2015-26

WaveAgent crash. (Bug 11358)

wnpa-sec-2015-27

OpenFlow infinite loop. (Bug 11358)

wnpa-sec-2015-28

Ptvcursor crash. (Bug 11358)

wnpa-sec-2015-29

WCCP crash. (Bug 11358)

https://www.wireshark.org/docs/relnotes/wireshark-1.12.7.html CVE-2015-6241 CVE-2015-6242 CVE-2015-6243 CVE-2015-6244 CVE-2015-6245 CVE-2015-6246 CVE-2015-6247 CVE-2015-6248 CVE-2015-6249 2015-08-12 2015-09-08 2015-09-08 screen -- stack overflow screen 4.3.1_2

Kuang-che Wu reports:

screen will recursively call MScrollV to depth n/256. This is time consuming and will overflow stack if n is huge.

https://savannah.gnu.org/bugs/?45713 CVE-2015-6806 2015-08-07 2015-09-08 libvncserver -- memory corruption libvncserver 0.9.8

Petr Pisar reports:

libvncserver/tight.c:rfbTightCleanup() frees a buffer without zeroing freed pointer.

https://bugzilla.redhat.com/show_bug.cgi?id=706087 https://github.com/LibVNC/libvncserver/commit/804335f9d296440bb708ca844f5d89b58b50b0c6 2011-05-19 2015-09-08 gdk-pixbuf2 -- integer overflows gdk-pixbuf2 2.31.7

Matthias Clasen reports:

Fix several integer overflows.

https://mail.gnome.org/archives/ftp-release-list/2015-September/msg00013.html 2015-09-01 2015-09-04 bind -- denial of service vulnerability bind99 9.9.79.9.7P3 bind910 9.10.2P4 bind910-base bind99-base 0

ISC reports:

An incorrect boundary check in openpgpkey_61.c can cause named to terminate due to a REQUIRE assertion failure. This defect can be deliberately exploited by an attacker who can provide a maliciously constructed response in answer to a query.

https://www.isc.org/blogs/cve-2015-5986-an-incorrect-boundary-check-can-trigger-a-require-assertion-failure-in-openpgpkey_61-c/ CVE-2015-5986 2015-08-19 2015-09-03 bind -- denial of service vulnerability bind99 9.9.7P3 bind910 9.10.29.10.2P4 bind910-base bind99-base 0 FreeBSD 9.39.3_25

ISC reports:

Parsing a malformed DNSSEC key can cause a validating resolver to exit due to a failed assertion in buffer.c. It is possible for a remote attacker to deliberately trigger this condition, for example by using a query which requires a response from a zone containing a deliberately malformed key.

https://www.isc.org/blogs/cve-2015-5722-parsing-malformed-keys-may-cause-bind-to-exit-due-to-a-failed-assertion-in-buffer-c/ CVE-2015-5722 SA-15:23.bind 2015-08-19 2015-09-03 2016-08-09 chromium -- multiple vulnerabilities chromium 45.0.2454.85 chromium-npapi 45.0.2454.85 chromium-pulse 45.0.2454.85

Google Chrome Releases reports:

29 security fixes in this release, including:

[516377] High CVE-2015-1291: Cross-origin bypass in DOM. Credit to anonymous.

[522791] High CVE-2015-1292: Cross-origin bypass in ServiceWorker. Credit to Mariusz Mlynski.

[524074] High CVE-2015-1293: Cross-origin bypass in DOM. Credit to Mariusz Mlynski.

[492263] High CVE-2015-1294: Use-after-free in Skia. Credit to cloudfuzzer.

[502562] High CVE-2015-1295: Use-after-free in Printing. Credit to anonymous.

[421332] High CVE-2015-1296: Character spoofing in omnibox. Credit to zcorpan.

[510802] Medium CVE-2015-1297: Permission scoping error in Webrequest. Credit to Alexander Kashev.

[518827] Medium CVE-2015-1298: URL validation error in extensions. Credit to Rob Wu.

[416362] Medium CVE-2015-1299: Use-after-free in Blink. Credit to taro.suzuki.dev.

[511616] Medium CVE-2015-1300: Information leak in Blink. Credit to cgvwzq.

[526825] CVE-2015-1301: Various fixes from internal audits, fuzzing and other initiatives.

CVE-2015-1291 CVE-2015-1292 CVE-2015-1293 CVE-2015-1294 CVE-2015-1295 CVE-2015-1296 CVE-2015-1297 CVE-2015-1298 CVE-2015-1299 CVE-2015-1300 CVE-2015-1301 http://googlechromereleases.blogspot.nl 2015-09-01 2015-09-02 powerdns -- denial of service powerdns 3.4.03.4.6

PowerDNS reports:

A bug was found in our DNS packet parsing/generation code, which, when exploited, can cause individual threads (disabling service) or whole processes (allowing a supervisor to restart them) to crash with just one or a few query packets.

https://doc.powerdns.com/md/security/powerdns-advisory-2015-02/ CVE-2015-5230 2015-09-02 2015-09-02 ghostscript -- denial of service (crash) via crafted Postscript files ghostscript7 ghostscript7-nox11 ghostscript7-base ghostscript7-x11 7.07_32 ghostscript8 ghostscript8-nox11 ghostscript8-base ghostscript8-x11 8.71_19 ghostscript9 ghostscript9-nox11 ghostscript9-base ghostscript9-x11 9.06_11 ghostscript9-agpl ghostscript9-agpl-nox11 9.15_2 ghostscript9-agpl-base ghostscript9-agpl-x11 9.16_2

MITRE reports:

Integer overflow in the gs_heap_alloc_bytes function in base/gsmalloc.c in Ghostscript 9.15 and earlier allows remote attackers to cause a denial of service (crash) via a crafted Postscript (ps) file, as demonstrated by using the ps2pdf command, which triggers an out-of-bounds read or write.

CVE-2015-3228 http://bugs.ghostscript.com/show_bug.cgi?id=696041 http://bugs.ghostscript.com/show_bug.cgi?id=696070 http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=0c0b0859 2015-06-17 2015-09-01 2015-09-02 ffmpeg -- out-of-bounds array access libav 11.011.4 10.7 gstreamer1-libav 1.5.1 handbrake 0 ffmpeg 2.2.0,12.2.15,1 2.0.7,1 ffmpeg26 2.6.2 ffmpeg25 2.5.6 ffmpeg24 2.4.8 ffmpeg23 0 ffmpeg1 0 avidemux avidemux26 2.6.11 kodi 15.1 mplayer mencoder 1.1.r20150403 mythtv mythtv-frontend 0

NVD reports:

The msrle_decode_pal4 function in msrledec.c in Libav before 10.7 and 11.x before 11.4 and FFmpeg before 2.0.7, 2.2.x before 2.2.15, 2.4.x before 2.4.8, 2.5.x before 2.5.6, and 2.6.x before 2.6.2 allows remote attackers to have unspecified impact via a crafted image, related to a pixel pointer, which triggers an out-of-bounds array access.

CVE-2015-3395 https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=f7e1367f58263593e6cee3c282f7277d7ee9d553 https://git.libav.org/?p=libav.git;a=commit;h=5ecabd3c54b7c802522dc338838c9a4c2dc42948 https://ffmpeg.org/security.html https://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v11.4 2015-04-12 2015-09-01 2015-09-20 ffmpeg -- use-after-free libav 11.011.4 10.7 gstreamer1-libav 1.5.0 handbrake 0 ffmpeg 2.2.0,12.2.12,1 2.1.0,12.1.7,1 2.0.7,1 ffmpeg25 2.5.2 ffmpeg24 2.4.5 ffmpeg23 2.3.6 ffmpeg1 1.2.11 mythtv mythtv-frontend 0

NVD reports:

Use-after-free vulnerability in the ff_h264_free_tables function in libavcodec/h264.c in FFmpeg before 2.3.6 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted H.264 data in an MP4 file, as demonstrated by an HTML VIDEO element that references H.264 data.

CVE-2015-3417 https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=e8714f6f93d1a32f4e4655209960afcf4c185214 https://git.libav.org/?p=libav.git;a=commitdiff;h=3b69f245dbe6e2016659a45c4bfe284f6c5ac57e https://ffmpeg.org/security.html https://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v11.4 2014-12-19 2015-09-01 graphviz -- format string vulnerability graphviz 2.38.0_7

Joshua Rogers reports:

A format string vulnerability has been found in `graphviz'.

http://seclists.org/oss-sec/2014/q4/784 https://github.com/ellson/graphviz/commit/99eda421f7ddc27b14e4ac1d2126e5fe41719081 2014-11-24 2015-08-29 mozilla -- multiple vulnerabilities firefox 40.0.3,1 linux-firefox 40.0.3,1 firefox-esr 38.2.1,1

The Mozilla Project reports:

MFSA 2015-95 Add-on notification bypass through data URLs

MFSA 2015-94 Use-after-free when resizing canvas element during restyling

CVE-2015-4497 CVE-2015-4498 https://www.mozilla.org/security/advisories/mfsa2015-94/ https://www.mozilla.org/security/advisories/mfsa2015-95/ 2015-08-27 2015-08-28 go -- multiple vulnerabilities go 1.4.3,1 go14 1.4.3

Jason Buberel, Go Product Manager, reports:

CVE-2015-5739 - "Content Length" treated as valid header

CVE-2015-5740 - Double content-length headers does not return 400 error

CVE-2015-5741 - Additional hardening, not sending Content-Length w/Transfer-Encoding, Closing connections

CVE-2015-5739 CVE-2015-5740 CVE-2015-5741 https://github.com/golang/go/commit/117ddcb83d7f42d6aa72241240af99ded81118e9 https://github.com/golang/go/commit/143822585e32449860e624cace9d2e521deee62e https://github.com/golang/go/commit/300d9a21583e7cf0149a778a0611e76ff7c6680f http://seclists.org/oss-sec/2015/q3/237 2015-07-29 2015-08-25 libtremor -- memory corruption libtremor 1.2.0.s20120120

The Mozilla Project reports:

Security researcher regenrecht reported via TippingPoint's Zero Day Initiative the possibility of memory corruption during the decoding of Ogg Vorbis files. This can cause a crash during decoding and has the potential for remote code execution.

CVE-2012-0444 https://bugzilla.mozilla.org/show_bug.cgi?id=719612 https://git.xiph.org/?p=tremor.git;a=commitdiff;h=3daa274 2012-01-31 2015-08-25 2015-08-25 libtremor -- multiple vulnerabilities libtremor 1.2.0.s20101013

The RedHat Project reports:

Will Drewry of the Google Security Team reported multiple issues in OGG Vorbis and Tremor libraries, that could cause application using those libraries to crash (NULL pointer dereference or divide by zero), enter an infinite loop or cause heap overflow caused by integer overflow.

CVE-2008-1418 CVE-2008-1419 CVE-2008-1420 CVE-2008-1423 CVE-2008-2009 http://redpig.dataspill.org/2008/05/multiple-vulnerabilities-in-ogg-tremor.html https://git.xiph.org/?p=tremor.git;a=commitdiff;h=7e94eea https://git.xiph.org/?p=tremor.git;a=commitdiff;h=1d1f93e https://git.xiph.org/?p=tremor.git;a=commitdiff;h=159efc4 2008-03-19 2015-08-25 2015-08-25 pcre -- heap overflow vulnerability pcre 8.37_4

Guanxing Wen reports:

PCRE library is prone to a vulnerability which leads to Heap Overflow. During the compilation of a malformed regular expression, more data is written on the malloced block than the expected size output by compile_regex(). The Heap Overflow vulnerability is caused by the following regular expression.

/(?J:(?|(:(?|(?'R')(\z(?|(?'R')(\k'R')|((?'R')))k'R')|((?'R')))H'Ak'Rf)|s(?'R')))/

A dry run of this particular regular expression with pcretest will reports "double free or corruption (!prev)". But it is actually a heap overflow problem. The overflow only affects pcre 8.x branch, pcre2 branch is not affected.

http://seclists.org/oss-sec/2015/q3/295 https://bugs.exim.org/show_bug.cgi?id=1672 2015-08-21 2015-08-24 drupal -- multiple vulnerabilities drupal6 6.37 drupal7 7.39

Drupal development team reports:

This security advisory fixes multiple vulnerabilities. See below for a list.

Cross-site Scripting - Ajax system - Drupal 7

A vulnerability was found that allows a malicious user to perform a cross-site scripting attack by invoking Drupal.ajax() on a whitelisted HTML element.

This vulnerability is mitigated on sites that do not allow untrusted users to enter HTML.

Cross-site Scripting - Autocomplete system - Drupal 6 and 7

A cross-site scripting vulnerability was found in the autocomplete functionality of forms. The requested URL is not sufficiently sanitized.

This vulnerability is mitigated by the fact that the malicious user must be allowed to upload files.

SQL Injection - Database API - Drupal 7

A vulnerability was found in the SQL comment filtering system which could allow a user with elevated permissions to inject malicious code in SQL comments.

This vulnerability is mitigated by the fact that only one contributed module that the security team found uses the comment filtering system in a way that would trigger the vulnerability. That module requires you to have a very high level of access in order to perform the attack.

Cross-site Request Forgery - Form API - Drupal 6 and 7

A vulnerability was discovered in Drupal's form API that could allow file upload value callbacks to run with untrusted input, due to form token validation not being performed early enough. This vulnerability could allow a malicious user to upload files to the site under another user's account.

This vulnerability is mitigated by the fact that the uploaded files would be temporary, and Drupal normally deletes temporary files automatically after 6 hours.

Information Disclosure in Menu Links - Access system - Drupal 6 and 7

Users without the "access content" permission can see the titles of nodes that they do not have access to, if the nodes are added to a menu on the site that the users have access to.

https://www.drupal.org/SA-CORE-2015-003 2015-08-19 2015-08-22 OpenSSH -- PAM vulnerabilities openssh-portable 7.0.p1,1 FreeBSD 10.210.2_2 10.110.1_19 9.39.3_24

OpenSSH 6.8 and 6.9 incorrectly set TTYs to be world-writable. Local attackers may be able to write arbitrary messages to logged-in users, including terminal escape sequences. Reported by Nikolay Edigaryev.

Fixed a privilege separation weakness related to PAM support. Attackers who could successfully compromise the pre-authentication process for remote code execution and who had valid credentials on the host could impersonate other users.

Fixed a use-after-free bug related to PAM support that was reachable by attackers who could compromise the pre-authentication process for remote code execution.

http://www.openssh.com/txt/release-7.0 CVE-2015-6563 CVE-2015-6564 CVE-2015-6565 SA-15:22.openssh 2015-08-11 2015-08-21 2016-08-09 OpenSSH -- PermitRootLogin may allow password connections with 'without-password' openssh-portable 7.0.p1,1

OpenSSH 7.0 contained a logic error in PermitRootLogin= prohibit-password/without-password that could, depending on compile-time configuration, permit password authentication to root while preventing other forms of authentication. This problem was reported by Mantas Mikulenas.

http://www.openssh.com/txt/release-7.1 2015-08-20 2015-08-21 tarsnap -- buffer overflow and local DoS tarsnap 1.0.36

Colin Percival reports:

1. SECURITY FIX: When constructing paths of objects being archived, a buffer could overflow by one byte upon encountering 1024, 2048, 4096, etc. byte paths. Theoretically this could be exploited by an unprivileged user whose files are being archived; I do not believe it is exploitable in practice, but I am offering a $1000 bounty for the first person who can prove me wrong: http://www.daemonology.net/blog/2015-08-21-tarsnap-1000-exploit-bounty.html

2. SECURITY FIX: An attacker with a machine's write keys, or with read keys and control of the tarsnap service, could make tarsnap allocate a large amount of memory upon listing archives or reading an archive the attacker created; on 32-bit machines, tarsnap can be caused to crash under the aforementioned conditions.

http://mail.tarsnap.com/tarsnap-announce/msg00032.html http://www.daemonology.net/blog/2015-08-21-tarsnap-1000-exploit-bounty.html 2015-08-21 2015-08-21 vlc -- arbitrary pointer dereference vulnerability vlc 2.2.1_5,4

oCERT reports:

The stable VLC version suffers from an arbitrary pointer dereference vulnerability.

The vulnerability affects the 3GP file format parser, insufficient restrictions on a writable buffer can be exploited to execute arbitrary code via the heap memory. A specific 3GP file can be crafted to trigger the vulnerability.

Credit: vulnerability reported by Loren Maggiore of Trail of Bits.

CVE-2015-5949 https://git.videolan.org/?p=vlc/vlc-2.2.git;a=commitdiff;h=ce91452460a75d7424b165c4dc8db98114c3cbd9;hp=9e12195d3e4316278af1fa4bcb6a705ff27456fd https://www.ocert.org/advisories/ocert-2015-009.html 2015-08-20 2015-08-20 libpgf -- use-after-free libpgf 6.14.12

Pengsu Cheng reports:

An use-after-free issue in Decoder.cpp was reported to upstream. The problem is due to lack of validation of ColorTableSize.

http://seclists.org/oss-sec/2015/q3/404 https://sourceforge.net/p/libpgf/code/147/ https://sourceforge.net/p/libpgf/code/148/ CVE-2015-6673 2015-08-08 2015-08-20 2015-08-26 gdk-pixbuf2 -- heap overflow and DoS gdk-pixbuf2 2.31.6

Gustavo Grieco reports:

We found a heap overflow and a DoS in the gdk-pixbuf implementation triggered by the scaling of a malformed bmp.

CVE-2015-4491 https://bugzilla.gnome.org/show_bug.cgi?id=752297 2015-07-12 2015-08-19 django -- multiple vulnerabilities py27-django py32-django py33-django py34-django 1.8.4 py27-django17 py32-django17 py33-django17 py34-django17 1.7.10 py27-django14 py32-django14 py33-django14 py34-django14 1.4.22 py27-django-devel py32-django-devel py33-django-devel py34-django-devel 20150709,1

Tim Graham reports:

Denial-of-service possibility in logout() view by filling session store

Previously, a session could be created when anonymously accessing the django.contrib.auth.views.logout view (provided it wasn't decorated with django.contrib.auth.decorators.login_required as done in the admin). This could allow an attacker to easily create many new session records by sending repeated requests, potentially filling up the session store or causing other users' session records to be evicted.

The django.contrib.sessions.middleware.SessionMiddleware has been modified to no longer create empty session records.

This portion of the fix has been assigned CVE-2015-5963.

Additionally, on the 1.4 and 1.7 series only, the contrib.sessions.backends.base.SessionBase.flush() and cache_db.SessionStore.flush() methods have been modified to avoid creating a new empty session. Maintainers of third-party session backends should check if the same vulnerability is present in their backend and correct it if so.

This portion of the fix has been assigned CVE-2015-5964. Anyone reporting a similar vulnerability in a third-party session backend should not use this CVE ID.

Thanks Lin Hua Cheng for reporting the issue.

https://www.djangoproject.com/weblog/2015/aug/18/security-releases/ CVE-2015-5963 CVE-2015-5964 2015-08-18 2015-08-18 unreal -- denial of service Unreal 3.2.103.2.10.5

Unreal reports:

Summary: If SASL support is enabled in UnrealIRCd (this is not the default) and is also enabled in your services package then a malicious user with a services account can cause UnrealIRCd to crash.

https://www.unrealircd.org/txt/unrealsecadvisory.20150816.txt http://seclists.org/oss-sec/2015/q3/367 2015-08-13 2015-08-18 jasper -- multiple vulnerabilities jasper 1.900.1_16

Martin Prpic reports:

A double free flaw was found in the way JasPer's jasper_image_stop_load() function parsed certain JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash.

Feist Josselin reports:

A new use-after-free was found in Jasper JPEG-200. The use-after-free appears in the function mif_process_cmpt of the src/libjasper/mif/mif_cod.c file.

https://bugzilla.redhat.com/show_bug.cgi?id=1254242#c0 http://seclists.org/oss-sec/2015/q3/366 http://seclists.org/oss-sec/2015/q3/408 CVE-2015-5203 CVE-2015-5221 2015-08-17 2015-08-18 2016-02-24 freexl -- integer overflow freexl 1.0.2

Stefan Cornelius reports:

There's an integer overflow in the allocate_cells() function when trying to allocate the memory for worksheet with specially crafted row/column dimensions. This can be exploited to cause a heap memory corruption. The most likely outcome of this is a crash when trying to initialize the cells later in the function.

http://www.openwall.com/lists/oss-security/2015/07/06/7 2015-07-06 2015-08-18 freexl -- multiple vulnerabilities freexl 1.0.1

Jodie Cunningham reports:

#1: A flaw was found in the way FreeXL reads sectors from the input file. A specially crafted file could possibly result in stack corruption near freexl.c:3752.

#2: A flaw was found in the function allocate_cells(). A specially crafted file with invalid workbook dimensions could possibly result in stack corruption near freexl.c:1074

#3: A flaw was found in the way FreeXL handles a premature EOF. A specially crafted input file could possibly result in stack corruption near freexl.c:1131

#4: FreeXL 1.0.0g did not properly check requests for workbook memory allocation. A specially crafted input file could cause a Denial of Service, or possibly write onto the stack.

http://www.openwall.com/lists/oss-security/2015/03/25/1 CVE-2015-2776 2015-03-24 2015-08-18 mod_jk -- information disclosure ap22-mod_jk ap24-mod_jk 1.2.41,1

NIST reports:

Apache Tomcat Connectors (mod_jk) before 1.2.41 ignores JkUnmount rules for subtrees of previous JkMount rules, which allows remote attackers to access otherwise restricted artifacts via unspecified vectors.

https://www.mail-archive.com/users@tomcat.apache.org/msg118949.html http://readlist.com/lists/tomcat.apache.org/users/27/135512.html http://www.cvedetails.com/cve/CVE-2014-8111/ CVE-2014-8111 2015-01-15 2015-08-17 qemu, xen-tools -- QEMU leak of uninitialized heap memory in rtl8139 device model qemu qemu-devel 0.11.1_20 0.122.3.0_2 qemu-sbruno qemu-user-static 2.4.50.g20150814 xen-tools 4.5.1

The Xen Project reports:

The QEMU model of the RTL8139 network card did not sufficiently validate inputs in the C+ mode offload emulation. This results in uninitialised memory from the QEMU process's heap being leaked to the domain as well as to the network.

A guest may be able to read sensitive host-level data relating to itself which resides in the QEMU process.

Such information may include things such as information relating to real devices backing emulated devices or passwords which the host administrator does not intend to share with the guest admin.

CVE-2015-5165 http://xenbits.xen.org/xsa/advisory-140.html http://git.qemu.org/?p=qemu.git;a=commit;h=2a3612ccc1fa9cea77bd193afbfe21c77e7e91ef 2015-08-03 2015-08-17 2015-08-19 qemu, xen-tools -- use-after-free in QEMU/Xen block unplug protocol qemu qemu-devel 0.11.1_20 0.122.3.0_2 qemu-sbruno qemu-user-static 2.4.50.g20150814 xen-tools 4.5.1

The Xen Project reports:

When unplugging an emulated block device the device was not fully unplugged, meaning a second unplug attempt would attempt to unplug the device a second time using a previously freed pointer.

An HVM guest which has access to an emulated IDE disk device may be able to exploit this vulnerability in order to take over the qemu process elevating its privilege to that of the qemu process.

CVE-2015-5166 http://xenbits.xen.org/xsa/advisory-139.html http://git.qemu.org/?p=qemu.git;a=commit;h=260425ab405ea76c44dd59744d05176d4f579a52 2015-08-03 2015-08-17 2015-08-19 php5 -- multiple vulnerabilities php5 php5-openssl php5-phar php5-soap 5.4.44 php55 php55-openssl php55-phar php55-soap 5.5.28 php56 php56-openssl php56-phar php56-soap 5.6.12

The PHP project reports:

Core:

Fixed bug #69793 (Remotely triggerable stack exhaustion via recursive method calls).

Fixed bug #70121 (unserialize() could lead to unexpected methods execution / NULL pointer deref).

OpenSSL:

Fixed bug #70014 (openssl_random_pseudo_bytes() is not cryptographically secure).

Phar:

Improved fix for bug #69441.

Fixed bug #70019 (Files extracted from archive may be placed outside of destination directory).

SOAP:

Fixed bug #70081 (SoapClient info leak / null pointer dereference via multiple type confusions).

SPL:

Fixed bug #70068 (Dangling pointer in the unserialization of ArrayObject items).

Fixed bug #70166 (Use After Free Vulnerability in unserialize() with SPLArrayObject).

Fixed bug #70168 (Use After Free Vulnerability in unserialize() with SplObjectStorage).

Fixed bug #70169 (Use After Free Vulnerability in unserialize() with SplDoublyLinkedList).

http://php.net/ChangeLog-5.php#5.4.44 http://php.net/ChangeLog-5.php#5.5.28 http://php.net/ChangeLog-5.php#5.6.12 CVE-2015-6831 CVE-2015-6832 CVE-2015-6833 2015-08-06 2015-08-17 2015-09-08 mediawiki -- multiple vulnerabilities mediawiki123 1.23.10 mediawiki124 1.24.3 mediawiki125 1.25.2

MediaWiki reports:

Internal review discovered that Special:DeletedContributions did not properly protect the IP of autoblocked users. This fix makes the functionality of Special:DeletedContributions consistent with Special:Contributions and Special:BlockList.

Internal review discovered that watchlist anti-csrf tokens were not being compared in constant time, which could allow various timing attacks. This could allow an attacker to modify a user's watchlist via csrf

John Menerick reported that MediaWiki's thumb.php failed to sanitize various error messages, resulting in xss.

CVE-2015-6727 CVE-2013-7444 CVE-2015-6728 CVE-2015-6729 CVE-2015-6730 CVE-2015-6731 CVE-2015-6733 CVE-2015-6734 CVE-2015-6735 CVE-2015-6736 CVE-2015-6737 https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-August/000179.html https://phabricator.wikimedia.org/T106893 https://phabricator.wikimedia.org/T94116 https://phabricator.wikimedia.org/T97391 http://www.openwall.com/lists/oss-security/2015/08/27/6 2015-08-10 2015-08-14 2015-12-24 freeradius3 -- insufficient validation on packets freeradius3 3.0.8

Jouni Malinen reports:

The EAP-PWD module performed insufficient validation on packets received from an EAP peer. This module is not enabled in the default configuration. Administrators must manually enable it for their server to be vulnerable. Only versions 3.0 up to 3.0.8 are affected.

http://freeradius.org/security.html#eap-pwd-2015 2015-04-04 2015-08-14 gnutls -- double free in certificate DN decoding gnutls 3.3.17

gnutls.org reports:

Kurt Roeckx reported that decoding a specific certificate with very long DistinguishedName (DN) entries leads to double free, which may result to a denial of service. Since the DN decoding occurs in almost all applications using certificates it is recommended to upgrade the latest GnuTLS version fixing the issue. Recommendation: Upgrade to GnuTLS 3.4.4, or 3.3.17.

http://www.gnutls.org/security.html#GNUTLS-SA-2015-3 http://seclists.org/oss-sec/2015/q3/308 https://gitlab.com/gnutls/gnutls/commit/272854367efc130fbd4f1a51840d80c630214e12 CVE-2015-6251 2015-07-20 2015-08-14 2015-08-18 gnutls -- MD5 downgrade in TLS signatures gnutls 3.3.15

Karthikeyan Bhargavan reports:

GnuTLS does not by default support MD5 signatures. Indeed the RSA-MD5 signature-hash algorithm needs to be explicitly enabled using the priority option VERIFY_ALLOW_SIGN_RSA_MD5. In the NORMAL and SECURE profiles, GnuTLS clients do not offer RSA-MD5 in the signature algorithms extension. However, we find that all GnuTLS clients still accept RSA-MD5 in the ServerKeyExchange and GnuTLS servers still accept RSA-MD5 in the ClientCertificateVerify.

http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/8132 http://www.gnutls.org/security.html#GNUTLS-SA-2015-2 http://seclists.org/oss-sec/2015/q2/367 2015-04-25 2015-08-14 froxlor -- database password information leak froxlor 0.9.33.2

oss-security-list@demlak.de reports:

An unauthenticated remote attacker is able to get the database password via webaccess due to wrong file permissions of the /logs/ folder in froxlor version 0.9.33.1 and earlier. The plain SQL password and username may be stored in the /logs/sql-error.log file. This directory is publicly reachable under the default configuration/setup.

Note that froxlor 0.9.33.2 prevents future logging of passwords but does not retroactively remove passwords already logged. Michael Kaufmann, the Froxlor lead developer reports:

Removing all .log files from the directory should do the job, alternatively just use the class.ConfigIO.php from Github

CVE-2015-5959 ports/202262 http://seclists.org/oss-sec/2015/q3/238 https://forum.froxlor.org/index.php/topic/13054-important-bugfix-release-09332/ 2015-07-29 2015-08-13 RT -- two XSS vulnerabilities rt42 4.2.04.2.12 rt40 4.0.04.0.24

Best Practical reports:

RT 4.0.0 and above are vulnerable to a cross-site scripting (XSS) attack via the user and group rights management pages. This vulnerability is assigned CVE-2015-5475. It was discovered and reported by Marcin Kopec at Data Reliance Shared Service Center.

RT 4.2.0 and above are vulnerable to a cross-site scripting (XSS) attack via the cryptography interface. This vulnerability could allow an attacker with a carefully-crafted key to inject JavaScript into RT's user interface. Installations which use neither GnuPG nor S/MIME are unaffected.

CVE-2015-5475 CVE-2015-6506 http://blog.bestpractical.com/2015/08/security-vulnerabilities-in-rt.html 2015-08-12 2015-08-12 2015-08-18 py-foolscap -- local file inclusion py27-foolscap py32-foolscap py33-foolscap py34-foolscap 0.7.0

Brian Warner reports:

The "flappserver" feature was found to have a vulnerability in the service-lookup code which, when combined with an attacker who has the ability to write files to a location where the flappserver process could read them, would allow that attacker to obtain control of the flappserver process.

https://github.com/warner/foolscap/blob/a17218e18e01c05a9655863cd507b80561692c14/NEWS http://foolscap.lothar.com/trac/ticket/226 2014-09-23 2015-08-12 libvpx -- out-of-bounds write libvpx 1.4.0 firefox 33.0,1 firefox-esr 31.1.2,1 linux-firefox 33.0,1 linux-seamonkey 2.30 linux-thunderbird 31.1.2 seamonkey 2.30 thunderbird 31.1.2 libxul 31.1.2

The Mozilla Project reports:

Using the Address Sanitizer tool, security researcher Abhishek Arya (Inferno) of the Google Chrome Security Team found an out-of-bounds write when buffering WebM format video containing frames with invalid tile sizes. This can lead to a potentially exploitable crash during WebM video playback.

CVE-2014-1578 https://www.mozilla.org/security/advisories/mfsa2014-77/ https://hg.mozilla.org/releases/mozilla-esr31/rev/6023f0b4f8ba 2014-10-14 2015-08-12 Adobe Flash Player -- critical vulnerabilities linux-c6-flashplugin linux-c6_64-flashplugin 11.2r202.508 linux-f10-flashplugin 11.2r202.508

Adobe reports:

Adobe has released security updates for Adobe Flash Player. These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system.

These updates resolve type confusion vulnerabilities that could lead to code execution (CVE-2015-5128, CVE-2015-5554, CVE-2015-5555, CVE-2015-5558, CVE-2015-5562).

These updates include further hardening to a mitigation introduced in version 18.0.0.209 to defend against vector length corruptions (CVE-2015-5125).

These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2015-5550, CVE-2015-5551, CVE-2015-3107, CVE-2015-5556, CVE-2015-5130, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5557, CVE-2015-5559, CVE-2015-5127, CVE-2015-5563, CVE-2015-5561, CVE-2015-5124, CVE-2015-5564).

These updates resolve heap buffer overflow vulnerabilities that could lead to code execution (CVE-2015-5129, CVE-2015-5541).

These updates resolve buffer overflow vulnerabilities that could lead to code execution (CVE-2015-5131, CVE-2015-5132, CVE-2015-5133).

These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2015-5544, CVE-2015-5545, CVE-2015-5546, CVE-2015-5547, CVE-2015-5548, CVE-2015-5549, CVE-2015-5552, CVE-2015-5553).

These updates resolve an integer overflow vulnerability that could lead to code execution (CVE-2015-5560).

CVE-2015-3107 CVE-2015-5124 CVE-2015-5125 CVE-2015-5127 CVE-2015-5128 CVE-2015-5129 CVE-2015-5130 CVE-2015-5131 CVE-2015-5132 CVE-2015-5133 CVE-2015-5134 CVE-2015-5539 CVE-2015-5540 CVE-2015-5541 CVE-2015-5544 CVE-2015-5545 CVE-2015-5546 CVE-2015-5547 CVE-2015-5548 CVE-2015-5549 CVE-2015-5550 CVE-2015-5551 CVE-2015-5552 CVE-2015-5553 CVE-2015-5554 CVE-2015-5555 CVE-2015-5556 CVE-2015-5557 CVE-2015-5558 CVE-2015-5559 CVE-2015-5560 CVE-2015-5561 CVE-2015-5562 CVE-2015-5563 CVE-2015-5564 https://helpx.adobe.com/security/products/flash-player/apsb15-19.html 2015-08-11 2015-08-12 libvpx -- multiple buffer overflows libvpx 1.4.0.488 firefox 40.0,1 linux-firefox 40.0,1

The Mozilla Project reports:

Security researcher Abhishek Arya (Inferno) of the Google Chrome Security Team used the Address Sanitizer tool to discover two buffer overflow issues in the Libvpx library used for WebM video when decoding a malformed WebM video file. These buffer overflows result in potentially exploitable crashes.

CVE-2015-4485 CVE-2015-4486 https://www.mozilla.org/security/advisories/mfsa2015-89/ 2015-08-11 2015-08-11 2015-08-14 mozilla -- multiple vulnerabilities firefox 40.0,1 linux-firefox 40.0,1 seamonkey 2.362.37 2.35 linux-seamonkey 2.362.37 2.35 firefox-esr 38.2.0,1 libxul 38.2.0 thunderbird 38.2.0 linux-thunderbird 38.2.0

The Mozilla Project reports:

MFSA 2015-79 Miscellaneous memory safety hazards (rv:40.0 / rv:38.2)

MFSA 2015-80 Out-of-bounds read with malformed MP3 file

MFSA 2015-81 Use-after-free in MediaStream playback

MFSA 2015-82 Redefinition of non-configurable JavaScript object properties

MFSA 2015-83 Overflow issues in libstagefright

MFSA 2015-84 Arbitrary file overwriting through Mozilla Maintenance Service with hard links

MFSA 2015-85 Out-of-bounds write with Updater and malicious MAR file

MFSA 2015-86 Feed protocol with POST bypasses mixed content protections

MFSA 2015-87 Crash when using shared memory in JavaScript

MFSA 2015-88 Heap overflow in gdk-pixbuf when scaling bitmap images

MFSA 2015-90 Vulnerabilities found through code inspection

MFSA 2015-91 Mozilla Content Security Policy allows for asterisk wildcards in violation of CSP specification

MFSA 2015-92 Use-after-free in XMLHttpRequest with shared workers

CVE-2015-4473 CVE-2015-4474 CVE-2015-4475 CVE-2015-4477 CVE-2015-4478 CVE-2015-4479 CVE-2015-4480 CVE-2015-4481 CVE-2015-4482 CVE-2015-4483 CVE-2015-4484 CVE-2015-4487 CVE-2015-4488 CVE-2015-4489 CVE-2015-4490 CVE-2015-4491 CVE-2015-4492 CVE-2015-4493 https://www.mozilla.org/security/advisories/mfsa2015-79/ https://www.mozilla.org/security/advisories/mfsa2015-80/ https://www.mozilla.org/security/advisories/mfsa2015-81/ https://www.mozilla.org/security/advisories/mfsa2015-82/ https://www.mozilla.org/security/advisories/mfsa2015-83/ https://www.mozilla.org/security/advisories/mfsa2015-84/ https://www.mozilla.org/security/advisories/mfsa2015-85/ https://www.mozilla.org/security/advisories/mfsa2015-86/ https://www.mozilla.org/security/advisories/mfsa2015-87/ https://www.mozilla.org/security/advisories/mfsa2015-88/ https://www.mozilla.org/security/advisories/mfsa2015-90/ https://www.mozilla.org/security/advisories/mfsa2015-91/ https://www.mozilla.org/security/advisories/mfsa2015-92/ 2015-08-11 2015-08-11 2015-08-22 lighttpd -- Log injection vulnerability in mod_auth lighttpd 1.4.36

MITRE reports:

mod_auth in lighttpd before 1.4.36 allows remote attackers to inject arbitrary log entries via a basic HTTP authentication string without a colon character, as demonstrated by a string containing a NULL and new line character.

CVE-2015-3200 http://redmine.lighttpd.net/issues/2646 2015-05-25 2015-08-10 pcre -- heap overflow vulnerability in '(?|' situations pcre 8.37_2

Venustech ADLAB reports:

PCRE library is prone to a vulnerability which leads to Heap Overflow. During the compilation of a malformed regular expression, more data is written on the malloced block than the expected size output by compile_regex. Exploits with advanced Heap Fengshui techniques may allow an attacker to execute arbitrary code in the context of the user running the affected application.

Latest version of PCRE is prone to a Heap Overflow vulnerability which could caused by the following regular expression.

/(?J:(?|(:(?|(?'R')(\k'R')|((?'R')))H'Rk'Rf)|s(?'R'))))/

ports/202209 https://bugs.exim.org/show_bug.cgi?id=1667 2015-08-05 2015-08-10 mozilla -- multiple vulnerabilities firefox 39.0.3,1 linux-firefox 39.0.3,1 firefox-esr 38.1.1,1

The Mozilla Project reports:

MFSA 2015-78 Same origin violation and local file stealing via PDF reader

CVE-2015-4495 https://www.mozilla.org/security/advisories/mfsa2015-78/ 2015-08-06 2015-08-07 wordpress -- Multiple vulnerability wordpress 4.2.4,1 de-wordpress ja-wordpress ru-wordpress zh-wordpress-zh_CN zh-wordpress-zh_TW 4.2.4

Gary Pendergast reports:

WordPress 4.2.4 fixes three cross-site scripting vulnerabilities and a potential SQL injection that could be used to compromise a site.

https://wordpress.org/news/2015/08/wordpress-4-2-4-security-and-maintenance-release/ CVE-2015-2213 CVE-2015-5730 CVE-2015-5731 CVE-2015-5732 CVE-2015-5733 CVE-2015-5734 2015-08-04 2015-08-06 2015-09-15 subversion -- multiple vulnerabilities subversion 1.8.01.8.14 1.7.01.7.21

Subversion reports:

CVE-2015-3184:
Subversion's mod_authz_svn does not properly restrict anonymous access in some mixed anonymous/authenticated environments when using Apache httpd 2.4.

CVE-2015-3187:
Subversion servers, both httpd and svnserve, will reveal some paths that should be hidden by path-based authz.

CVE-2015-3184 http://subversion.apache.org/security/CVE-2015-3184-advisory.txt CVE-2015-3187 http://subversion.apache.org/security/CVE-2015-3187-advisory.txt 2015-07-27 2015-08-06 elasticsearch -- directory traversal attack via snapshot API elasticsearch 1.0.01.6.1

Elastic reports:

Vulnerability Summary: Elasticsearch versions from 1.0.0 to 1.6.0 are vulnerable to a directory traversal attack.

Remediation Summary: Users should upgrade to 1.6.1 or later, or constrain access to the snapshot API to trusted sources.

CVE-2015-5531 ports/201834 https://www.elastic.co/community/security 2015-07-16 2015-08-05 elasticsearch -- remote code execution via transport protocol elasticsearch 1.6.1

Elastic reports:

Vulnerability Summary: Elasticsearch versions prior to 1.6.1 are vulnerable to an attack that can result in remote code execution.

Remediation Summary: Users should upgrade to 1.6.1 or 1.7.0. Alternately, ensure that only trusted applications have access to the transport protocol port.

CVE-2015-5377 ports/201834 https://www.elastic.co/community/security 2015-07-16 2015-08-05 qemu, xen-tools -- QEMU heap overflow flaw with certain ATAPI commands qemu qemu-devel 0.11.1_20 0.122.3.0_2 qemu-sbruno qemu-user-static 2.4.50.g20150814 xen-tools 4.5.0_9

The Xen Project reports:

A heap overflow flaw was found in the way QEMU's IDE subsystem handled I/O buffer access while processing certain ATAPI commands.

A privileged guest user in a guest with CDROM drive enabled could potentially use this flaw to execute arbitrary code on the host with the privileges of the host's QEMU process corresponding to the guest.

CVE-2015-5154 http://xenbits.xen.org/xsa/advisory-138.html http://git.qemu.org/?p=qemu.git;a=commit;h=e40db4c6d391419c0039fe274c74df32a6ca1a28 2015-07-27 2015-08-04 2015-08-19 net-snmp -- snmptrapd crash net-snmp 5.7.05.7.2.1 5.6.05.6.2.1 5.5.05.5.2.1 5.4.05.4.4

Murray McAllister reports:

A remote denial-of-service flaw was found in the way snmptrapd handled certain SNMP traps when started with the "-OQ" option. If an attacker sent an SNMP trap containing a variable with a NULL type where an integer variable type was expected, it would cause snmptrapd to crash.

http://seclists.org/oss-sec/2014/q3/473 http://sourceforge.net/p/net-snmp/code/ci/7f4a7b891332899cea26e95be0337aae01648742/ https://sourceforge.net/p/net-snmp/official-patches/48/ CVE-2014-3565 2014-07-31 2015-07-31 net-snmp -- snmp_pdu_parse() function incomplete initialization net-snmp 5.7.3_7

Qinghao Tang reports:

Incompletely initialized vulnerability exists in the function ‘snmp_pdu_parse()’ of ‘snmp_api.c', and remote attackers can cause memory leak, DOS and possible command executions by sending malicious packets.

http://seclists.org/oss-sec/2015/q2/116 http://sourceforge.net/p/net-snmp/code/ci/f23bcd3ac6ddee5d0a48f9703007ccc738914791/ https://bugzilla.redhat.com/show_bug.cgi?id=1212408 CVE-2015-5621 2015-04-11 2015-07-31 bind -- denial of service vulnerability bind910 9.10.2P3 bind99 9.9.7P2 bind910-base bind99-base 0 FreeBSD 9.39.3_21 8.48.4_35

ISC reports:

An error in the handling of TKEY queries can be exploited by an attacker for use as a denial-of-service vector, as a constructed packet can use the defect to trigger a REQUIRE assertion failure, causing BIND to exit.

SA-15:17.bind CVE-2015-5477 https://kb.isc.org/article/AA-01272/ 2015-07-21 2015-07-28 2016-08-09 OpenSSH -- MaxAuthTries limit bypass via duplicates in KbdInteractiveDevices openssh-portable 6.9.p1_2,1 FreeBSD 10.110.1_16 9.39.3_21 8.48.4_36

It was discovered that the OpenSSH sshd daemon did not check the list of keyboard-interactive authentication methods for duplicates. A remote attacker could use this flaw to bypass the MaxAuthTries limit, making it easier to perform password guessing attacks.

https://access.redhat.com/security/cve/CVE-2015-5600 CVE-2015-5600 SA-15:16.openssh 2015-07-21 2015-07-27 2016-08-09 logstash -- SSL/TLS vulnerability with Lumberjack input logstash 1.4.4 1.5.01.5.3

Elastic reports:

Vulnerability Summary: All Logstash versions prior to 1.5.2 that use Lumberjack input (in combination with Logstash Forwarder agent) are vulnerable to a SSL/TLS security issue called the FREAK attack. This allows an attacker to intercept communication and access secure data. Users should upgrade to 1.5.3 or 1.4.4.

Remediation Summary: Users that do not want to upgrade can address the vulnerability by disabling the Lumberjack input.

CVE-2015-5378 https://www.elastic.co/community/security 2015-07-22 2015-07-27 chromium -- multiple vulnerabilities chromium 44.0.2403.89 chromium-npapi 44.0.2403.89 chromium-pulse 44.0.2403.89

Google Chrome Releases reports:

43 security fixes in this release, including:

[446032] High CVE-2015-1271: Heap-buffer-overflow in pdfium. Credit to cloudfuzzer.

[459215] High CVE-2015-1273: Heap-buffer-overflow in pdfium. Credit to makosoft.

[461858] High CVE-2015-1274: Settings allowed executable files to run immediately after download. Credit to andrewm.bpi.

[462843] High CVE-2015-1275: UXSS in Chrome for Android. Credit to WangTao(neobyte) of Baidu X-Team.

[472614] High CVE-2015-1276: Use-after-free in IndexedDB. Credit to Collin Payne.

[483981] High CVE-2015-1279: Heap-buffer-overflow in pdfium. Credit to mlafon.

[486947] High CVE-2015-1280: Memory corruption in skia. Credit to cloudfuzzer.

[487155] High CVE-2015-1281: CSP bypass. Credit to Masato Kinugawa.

[487928] High CVE-2015-1282: Use-after-free in pdfium. Credit to Chamal de Silva.

[492052] High CVE-2015-1283: Heap-buffer-overflow in expat. Credit to sidhpurwala.huzaifa.

[493243] High CVE-2015-1284: Use-after-free in blink. Credit to Atte Kettunen of OUSPG.

[504011] High CVE-2015-1286: UXSS in blink. Credit to anonymous.

[505374] High CVE-2015-1290: Memory corruption in V8. Credit to Yongjun Liu of NSFOCUS Security Team.

[419383] Medium CVE-2015-1287: SOP bypass with CSS. Credit to filedescriptor.

[444573] Medium CVE-2015-1270: Uninitialized memory read in ICU. Credit to Atte Kettunen of OUSPG.

[451456] Medium CVE-2015-1272: Use-after-free related to unexpected GPU process termination. Credit to Chamal de Silva.

[479743] Medium CVE-2015-1277: Use-after-free in accessibility. Credit to SkyLined.

[482380] Medium CVE-2015-1278: URL spoofing using pdf files. Credit to Chamal de Silva.

[498982] Medium CVE-2015-1285: Information leak in XSS auditor. Credit to gazheyes.

[479162] Low CVE-2015-1288: Spell checking dictionaries fetched over HTTP. Credit to mike@michaelruddy.com.

[512110] CVE-2015-1289: Various fixes from internal audits, fuzzing and other initiatives.

CVE-2015-1270 CVE-2015-1271 CVE-2015-1272 CVE-2015-1273 CVE-2015-1274 CVE-2015-1275 CVE-2015-1276 CVE-2015-1277 CVE-2015-1278 CVE-2015-1279 CVE-2015-1280 CVE-2015-1281 CVE-2015-1282 CVE-2015-1283 CVE-2015-1284 CVE-2015-1285 CVE-2015-1286 CVE-2015-1287 CVE-2015-1288 CVE-2015-1289 CVE-2015-1290 http://googlechromereleases.blogspot.nl/ 2015-07-21 2015-07-25 shibboleth-sp -- DoS vulnerability xmltooling 1.5.5 opensaml2 2.5.5 shibboleth-sp 2.5.5

Shibboleth consortium reports:

Shibboleth SP software crashes on well-formed but invalid XML.

The Service Provider software contains a code path with an uncaught exception that can be triggered by an unauthenticated attacker by supplying well-formed but schema-invalid XML in the form of SAML metadata or SAML protocol messages. The result is a crash and so causes a denial of service.

You must rebuild opensaml and shibboleth with xmltooling-1.5.5 or later. The easiest way to do so is to update the whole chain including shibboleth-2.5.5 an opensaml2.5.5.

http://shibboleth.net/community/advisories/secadv_20150721.txt CVE-2015-2684 2015-07-21 2015-07-23 wordpress -- XSS vulnerability wordpress 4.2.3,1 de-wordpress ja-wordpress ru-wordpress zh-wordpress-zh_CN zh-wordpress-zh_TW 4.2.3

Gary Pendergast reports:

WordPress versions 4.2.2 and earlier are affected by a cross-site scripting vulnerability, which could allow users with the Contributor or Author role to compromise a site. This was reported by Jon Cave and fixed by Robert Chapin, both of the WordPress security team.

https://wordpress.org/news/2015/07/wordpress-4-2-3/ CVE-2015-5622 CVE-2015-5623 2015-07-23 2015-07-23 2015-09-15 libidn -- out-of-bounds read issue with invalid UTF-8 input libidn 1.31

Simon Josefsson reports:

stringprep_utf8_to_ucs4 now rejects invalid UTF-8. This function has always been documented to not validate that the input UTF-8 string is actually valid UTF-8...

CVE-2015-2059 http://git.savannah.gnu.org/cgit/libidn.git/plain/NEWS?id=libidn-1-31 2015-02-09 2015-07-23 2015-08-03 sox -- memory corruption vulnerabilities sox 14.4.2

Michele Spagnuolo, Google Security Team, reports:

The write heap buffer overflows are related to ADPCM handling in WAV files, while the read heap buffer overflow is while opening a .VOC.

http://seclists.org/oss-sec/2015/q3/167 2015-07-22 2015-07-23 sox -- input sanitization errors sox 14.4.2

oCERT reports:

The sox command line tool is affected by two heap-based buffer overflows, respectively located in functions start_read() and AdpcmReadBlock().

A specially crafted wav file can be used to trigger the vulnerabilities.

71774 CVE-2014-8145 http://www.ocert.org/advisories/ocert-2014-010.html 2014-11-20 2015-07-23 gdk-pixbuf2 -- heap overflow and DoS affecting Firefox and other programs gdk-pixbuf2 2.31.2_2

gustavo.grieco@imag.fr reports:

We found a heap overflow and a DoS in the gdk-pixbuf implementation triggered by the scaling of a malformed bmp.

https://bugzilla.gnome.org/show_bug.cgi?id=752297 2015-07-12 2015-07-22 pcre -- Heap Overflow Vulnerability in find_fixedlength() pcre 8.37_1

Venustech ADLAB reports:

PCRE library is prone to a vulnerability which leads to Heap Overflow. During subpattern calculation of a malformed regular expression, an offset that is used as an array index is fully controlled and can be large enough so that unexpected heap memory regions are accessed.

One could at least exploit this issue to read objects nearby of the affected application's memory.

Such information disclosure may also be used to bypass memory protection method such as ASLR.

CVE-2015-5073 https://bugs.exim.org/show_bug.cgi?id=1651 http://vcs.pcre.org/pcre?view=revision&revision=1571 http://www.openwall.com/lists/oss-security/2015/06/26/1 2015-06-23 2015-06-29 cacti -- Multiple XSS and SQL injection vulnerabilities cacti 0.8.8e

The Cacti Group, Inc. reports:

Important Security Fixes

Multiple XSS and SQL injection vulnerabilities

CVE-2015-4634 - SQL injection in graphs.php

Changelog

bug: Fixed various SQL Injection vectors

bug#0002574: SQL Injection Vulnerabilities in graph items and graph template items

bug#0002577: CVE-2015-4634 - SQL injection in graphs.php

bug#0002579: SQL Injection Vulnerabilities in data sources

bug#0002580: SQL Injection in cdef.php

bug#0002582: SQL Injection in data_templates.php

bug#0002583: SQL Injection in graph_templates.php

bug#0002584: SQL Injection in host_templates.php

CVE-2015-4634 ports/201702 http://www.cacti.net/release_notes_0_8_8e.php http://seclists.org/oss-sec/2015/q3/150 2015-07-12 2015-07-20 php-phar -- multiple vulnerabilities php56-phar 5.6.11 php55-phar 5.5.27 php5-phar 5.4.43

reports:

Segfault in Phar::convertToData on invalid file.

Buffer overflow and stack smashing error in phar_fix_filepath.

http://seclists.org/oss-sec/2015/q3/141 https://bugs.php.net/bug.php?id=69958 http://git.php.net/?p=php-src.git;a=commit;h=bf58162ddf970f63502837f366930e44d6a992cf https://bugs.php.net/bug.php?id=69923 http://git.php.net/?p=php-src.git;a=commit;h=6dedeb40db13971af45276f80b5375030aa7e76f CVE-2015-5589 CVE-2015-5590 2015-06-24 2015-07-18 2015-12-18 moodle -- multiple vulnerabilities moodle27 2.7.9 moodle28 2.8.7 moodle29 2.9.1

Marina Glancy reports:

MSA-15-0026: Possible phishing when redirecting to external site using referer header. (CVE-2015-3272)

MSA-15-0027: Capability 'mod/forum:canposttomygroups' is not respected when using 'Post a copy to all groups' in forum (CVE-2015-3273)

MSA-15-0028: Possible XSS through custom text profile fields in Web Services (CVE-2015-3274)

MSA-15-0029: Javascript injection in SCORM module (CVE-2015-3275)

CVE-2015-3272 CVE-2015-3273 CVE-2015-3274 CVE-2015-3275 http://seclists.org/oss-sec/2015/q3/94 https://docs.moodle.org/dev/Moodle_2.7.9_release_notes https://docs.moodle.org/dev/Moodle_2.8.7_release_notes https://docs.moodle.org/dev/Moodle_2.9.1_release_notes 2015-07-06 2015-07-18 2015-07-19 apache22 -- chunk header parsing defect apache22 apache22-event-mpm apache22-itk-mpm apache22-peruser-mpm apache22-worker-mpm 2.2.29_5

Apache Foundation reports:

CVE-2015-3183 core: Fix chunk header parsing defect. Remove apr_brigade_flatten(), buffering and duplicated code from the HTTP_IN filter, parse chunks in a single pass with zero copy. Limit accepted chunk-size to 2^63-1 and be strict about chunk-ext authorized characters.

http://www.apache.org/dist/httpd/Announcement2.2.html https://github.com/apache/httpd/commit/29779fd08c18b18efc5e640d74cbe297c7ec007e CVE-2015-3183 2015-06-24 2015-07-17 zenphoto -- multiple vulnerabilities zenphoto 1.4.9

zenphoto reports:

Fixes several SQL Injection, XSS and path traversal security issues

http://www.zenphoto.org/news/zenphoto-1.4.9 http://seclists.org/oss-sec/2015/q3/123 https://github.com/zenphoto/zenphoto/pull/935 CVE-2015-5591 CVE-2015-5592 CVE-2015-5593 CVE-2015-5594 CVE-2015-5595 2015-05-24 2015-07-16 2015-07-18 groovy -- remote execution of untrusted code groovy 1.7.02.4.4

Cédric Champeau reports:

Description

When an application has Groovy on the classpath and that it uses standard Java serialization mechanim to communicate between servers, or to store local data, it is possible for an attacker to bake a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects are subject to this vulnerability.

http://seclists.org/oss-sec/2015/q3/121 http://groovy-lang.org/security.html https://issues.apache.org/jira/browse/GROOVY-7504 CVE-2015-3253 2015-07-09 2015-07-16 libav -- divide by zero libav 11.3_2

Agostino Sarubbo reports:

libav: divide-by-zero in ff_h263_decode_mba()

https://blogs.gentoo.org/ago/2015/07/16/libav-divide-by-zero-in-ff_h263_decode_mba/ https://git.libav.org/?p=libav.git;a=commitdiff;h=0a49a62f998747cfa564d98d36a459fe70d3299b;hp=6f4cd33efb5a9ec75db1677d5f7846c60337129f CVE-2015-5479 2015-06-21 2015-07-16 mozilla -- multiple vulnerabilities firefox 39.0,1 linux-firefox 39.0,1 seamonkey 2.35 linux-seamonkey 2.35 firefox-esr 31.8.0,1 38.0,138.1.0,1 libxul 31.8.0 38.038.1.0 thunderbird 31.8.0 38.038.1.0 linux-thunderbird 31.8.0 38.038.1.0

The Mozilla Project reports:

MFSA 2015-59 Miscellaneous memory safety hazards (rv:39.0 / rv:31.8 / rv:38.1)

MFSA 2015-60 Local files or privileged URLs in pages can be opened into new tabs

MFSA 2015-61 Type confusion in Indexed Database Manager

MFSA 2015-62 Out-of-bound read while computing an oscillator rendering range in Web Audio

MFSA 2015-63 Use-after-free in Content Policy due to microtask execution error

MFSA 2015-64 ECDSA signature validation fails to handle some signatures correctly

MFSA 2015-65 Use-after-free in workers while using XMLHttpRequest

MFSA 2015-66 Vulnerabilities found through code inspection

MFSA 2015-67 Key pinning is ignored when overridable errors are encountered

MFSA 2015-68 OS X crash reports may contain entered key press information

MFSA 2015-69 Privilege escalation through internal workers

MFSA 2015-70 NSS accepts export-length DHE keys with regular DHE cipher suites

MFSA 2015-71 NSS incorrectly permits skipping of ServerKeyExchange

CVE-2015-2721 CVE-2015-2722 CVE-2015-2724 CVE-2015-2725 CVE-2015-2726 CVE-2015-2727 CVE-2015-2728 CVE-2015-2729 CVE-2015-2730 CVE-2015-2731 CVE-2015-2733 CVE-2015-2734 CVE-2015-2735 CVE-2015-2736 CVE-2015-2737 CVE-2015-2738 CVE-2015-2739 CVE-2015-2740 CVE-2015-2741 CVE-2015-2742 CVE-2015-2743 CVE-2015-4000 https://www.mozilla.org/security/advisories/mfsa2015-59/ https://www.mozilla.org/security/advisories/mfsa2015-60/ https://www.mozilla.org/security/advisories/mfsa2015-61/ https://www.mozilla.org/security/advisories/mfsa2015-62/ https://www.mozilla.org/security/advisories/mfsa2015-63/ https://www.mozilla.org/security/advisories/mfsa2015-64/ https://www.mozilla.org/security/advisories/mfsa2015-65/ https://www.mozilla.org/security/advisories/mfsa2015-66/ https://www.mozilla.org/security/advisories/mfsa2015-67/ https://www.mozilla.org/security/advisories/mfsa2015-68/ https://www.mozilla.org/security/advisories/mfsa2015-69/ https://www.mozilla.org/security/advisories/mfsa2015-70/ https://www.mozilla.org/security/advisories/mfsa2015-71/ 2015-07-02 2015-07-16 2015-09-22 PolarSSL -- Security Fix Backports polarssl 1.2.14

Paul Bakker reports:

PolarSSL 1.2.14 fixes one remotely-triggerable issues that was found by the Codenomicon Defensics tool, one potential remote crash and countermeasures against the "Lucky 13 strikes back" cache-based attack.

https://tls.mbed.org/tech-updates/releases/polarssl-1.2.14-released 2015-06-26 2015-07-15 libwmf -- multiple vulnerabilities libwmf 0.2.8.4_14

Mitre reports:

Multiple buffer overflows in the gd graphics library (libgd) 2.0.21 and earlier may allow remote attackers to execute arbitrary code via malformed image files that trigger the overflows due to improper calls to the gdMalloc function, a different set of vulnerabilities than CVE-2004-0990.

Buffer overflow in the gdImageStringFTEx function in gdft.c in GD Graphics Library 2.0.33 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted string with a JIS encoded font.

The gdPngReadData function in libgd 2.0.34 allows user-assisted attackers to cause a denial of service (CPU consumption) via a crafted PNG image with truncated data, which causes an infinite loop in the png_read_info function in libpng.

Integer overflow in gdImageCreateTrueColor function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to have unspecified attack vectors and impact.

The gdImageCreateXbm function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via unspecified vectors involving a gdImageCreate failure.

The (a) imagearc and (b) imagefilledarc functions in GD Graphics Library (libgd) before 2.0.35 allow attackers to cause a denial of service (CPU consumption) via a large (1) start or (2) end angle degree value.

The _gdGetColors function in gd_gd.c in PHP 5.2.11 and 5.3.x before 5.3.1, and the GD Graphics Library 2.x, does not properly verify a certain colorsTotal structure member, which might allow remote attackers to conduct buffer overflow or buffer over-read attacks via a crafted GD file, a different vulnerability than CVE-2009-3293. NOTE: some of these details are obtained from third party information.

Heap-based buffer overflow in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted BMP image.

meta.h in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WMF file.

Use-after-free vulnerability in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) via a crafted WMF file to the (1) wmf2gd or (2) wmf2eps command.

Heap-based buffer overflow in the DecodeImage function in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted "run-length count" in an image in a WMF file.

11663 22289 24089 24651 36712 ports/201513 CVE-2004-0941 CVE-2007-0455 CVE-2007-2756 CVE-2007-3472 CVE-2007-3473 CVE-2007-3477 CVE-2009-3546 CVE-2015-0848 CVE-2015-4695 CVE-2015-4696 CVE-2015-4588 2004-10-12 2015-07-15 apache24 -- multiple vulnerabilities apache24 2.4.16

Jim Jagielski reports:

CVE-2015-3183 (cve.mitre.org) core: Fix chunk header parsing defect. Remove apr_brigade_flatten(), buffering and duplicated code from the HTTP_IN filter, parse chunks in a single pass with zero copy. Limit accepted chunk-size to 2^63-1 and be strict about chunk-ext authorized characters.

CVE-2015-3185 (cve.mitre.org) Replacement of ap_some_auth_required (unusable in Apache httpd 2.4) with new ap_some_authn_required and ap_force_authn hook.

CVE-2015-0253 (cve.mitre.org) core: Fix a crash with ErrorDocument 400 pointing to a local URL-path with the INCLUDES filter active, introduced in 2.4.11. PR 57531.

CVE-2015-0228 (cve.mitre.org) mod_lua: A maliciously crafted websockets PING after a script calls r:wsupgrade() can cause a child process crash.

https://mail-archives.apache.org/mod_mbox/www-announce/201507.mbox/%3CAA5C882C-A9C3-46B9-9320-5040A2152E83@apache.org%3E CVE-2015-3183 CVE-2015-3185 CVE-2015-0253 CVE-2015-0228 2015-02-04 2015-07-15 Adobe Flash Player -- critical vulnerabilities linux-c6-flashplugin 11.2r202.491 linux-f10-flashplugin 11.2r202.491

Adobe reports:

Critical vulnerabilities (CVE-2015-5122, CVE-2015-5123) have been identified. Successful exploitation could cause a crash and potentially allow an attacker to take control of the affected system. Adobe is aware of reports that exploits targeting these vulnerabilities have been published publicly.

CVE-2015-5122 CVE-2015-5123 https://helpx.adobe.com/security/products/flash-player/apsb15-18.html 2015-07-10 2015-07-14 2015-07-16 php -- use-after-free vulnerability php56-sqlite3 5.6.11 php55-sqlite3 5.5.27 php5-sqlite3 5.4.43

Symeon Paraschoudis reports:

Use-after-free vulnerability in sqlite3SafetyCheckSickOrOk()

https://bugs.php.net/bug.php?id=69972 2015-06-30 2015-07-13 php -- use-after-free vulnerability php56 5.6.11 php55 5.5.27 php5 5.4.43

Symeon Paraschoudis reports:

Use-after-free vulnerability in spl_recursive_it_move_forward_ex()

https://bugs.php.net/bug.php?id=69970 2015-06-30 2015-07-13 php -- arbitrary code execution php56 5.6.11 php55 5.5.27 php5 5.4.43

cmb reports:

When delayed variable substitution is enabled (can be set in the Registry, for instance), !ENV! works similar to %ENV%, and the value of the environment variable ENV will be subsituted.

https://bugs.php.net/bug.php?id=69768 2015-06-07 2015-07-13 mysql -- SSL Downgrade php56-mysql php56-mysqli 5.6.11 php55-mysql php55-mysqli 5.5.27 php5-mysql php5-mysqli 5.4.43 mariadb55-client 5.5.44 mariadb100-client 10.0.20

Duo Security reports:

Researchers have identified a serious vulnerability in some versions of Oracle’s MySQL database product that allows an attacker to strip SSL/TLS connections of their security wrapping transparently.

https://bugs.php.net/bug.php?id=69669 https://www.duosecurity.com/blog/backronym-mysql-vulnerability http://www.ocert.org/advisories/ocert-2015-003.html https://mariadb.atlassian.net/browse/MDEV-7937 https://mariadb.com/kb/en/mariadb/mariadb-10020-changelog/ https://mariadb.com/kb/en/mariadb/mariadb-5544-changelog/ CVE-2015-3152 2015-03-20 2015-07-13 2015-07-18 devel/ipython -- CSRF possible remote execution vulnerability ipython 0.123.2.1

Kyle Kelley reports:

Summary: POST requests exposed via the IPython REST API are vulnerable to cross-site request forgery (CSRF). Web pages on different domains can make non-AJAX POST requests to known IPython URLs, and IPython will honor them. The user's browser will automatically send IPython cookies along with the requests. The response is blocked by the Same-Origin Policy, but the request isn't.

API paths with issues:

POST /api/contents/<path>/<file>

POST /api/contents/<path>/<file>/checkpoints

POST /api/contents/<path>/<file>/checkpoints/<checkpoint_id>

POST /api/kernels

POST /api/kernels/<kernel_id>/<action>

POST /api/sessions

POST /api/clusters/<cluster_id>/<action>

CVE-2015-5607 http://seclists.org/oss-sec/2015/q3/92 http://ipython.org/ipython-doc/3/whatsnew/version3.html#ipython-3-2-1 2015-07-12 2015-07-13 2015-07-22 freeradius -- insufficent CRL application vulnerability freeradius2 2.2.8 freeradius3 3.0.9

oCERT reports:

The FreeRADIUS server relies on OpenSSL to perform certificate validation, including Certificate Revocation List (CRL) checks. The FreeRADIUS usage of OpenSSL, in CRL application, limits the checks to leaf certificates, therefore not detecting revocation of intermediate CA certificates.

An unexpired client certificate, issued by an intermediate CA with a revoked certificate, is therefore accepted by FreeRADIUS.

Specifically sets the X509_V_FLAG_CRL_CHECK flag for leaf certificate CRL checks, but does not use X509_V_FLAG_CRL_CHECK_ALL for CRL checks on the complete trust chain.

The FreeRADIUS project advises that the recommended configuration is to use self-signed CAs for all EAP-TLS methods.

CVE-2015-4680 ports/201058 ports/201059 http://www.ocert.org/advisories/ocert-2015-008.html http://freeradius.org/security.html 2015-06-22 2015-07-13 xen-tools -- xl command line config handling stack overflow xen-tools 4.14.5.0_8

The Xen Project reports:

The xl command line utility mishandles long configuration values when passed as command line arguments, with a buffer overrun.

A semi-trusted guest administrator or controller, who is intended to be able to partially control the configuration settings for a domain, can escalate their privileges to that of the whole host.

CVE-2015-3259 http://xenbits.xen.org/xsa/advisory-137.html 2015-07-07 2015-07-11 xen-kernel -- vulnerability in the iret hypercall handler xen-kernel 3.14.5.0_3

The Xen Project reports:

A buggy loop in Xen's compat_iret() function iterates the wrong way around a 32-bit index. Any 32-bit PV guest kernel can trigger this vulnerability by attempting a hypercall_iret with EFLAGS.VM set.

Given the use of __get/put_user(), and that the virtual addresses in question are contained within the lower canonical half, the guest cannot clobber any hypervisor data. Instead, Xen will take up to 2^33 pagefaults, in sequence, effectively hanging the host.

Malicious guest administrators can cause a denial of service affecting the whole system.

CVE-2015-4164 http://xenbits.xen.org/xsa/advisory-136.html 2015-06-11 2015-07-11 xen-kernel -- GNTTABOP_swap_grant_ref operation misbehavior xen-kernel 4.24.5.0_3

The Xen Project reports:

With the introduction of version 2 grant table operations, a version check became necessary for most grant table related hypercalls. The GNTTABOP_swap_grant_ref call was lacking such a check. As a result, the subsequent code behaved as if version 2 was in use, when a guest issued this hypercall without a prior GNTTABOP_setup_table or GNTTABOP_set_version.

The effect is a possible NULL pointer dereferences. However, this cannot be exploited to elevate privileges of the attacking domain, as the maximum memory address that can be wrongly accessed this way is bounded to far below the start of hypervisor memory.

Malicious or buggy guest domain kernels can mount a denial of service attack which, if successful, can affect the whole system.

CVE-2015-4163 http://xenbits.xen.org/xsa/advisory-134.html 2015-06-11 2015-07-11 xen-kernel -- Information leak through XEN_DOMCTL_gettscinfo xen-kernel 4.04.5.0_3

The Xen Project reports:

The handler for XEN_DOMCTL_gettscinfo failed to initialize a padding field subsequently copied to guest memory.

A similar leak existed in XEN_SYSCTL_getdomaininfolist, which is being addressed here regardless of that operation being declared unsafe for disaggregation by XSA-77.

Malicious or buggy stub domain kernels or tool stacks otherwise living outside of Domain0 may be able to read sensitive data relating to the hypervisor or other guests not under the control of that domain.

CVE-2015-3340 http://xenbits.xen.org/xsa/advisory-132.html 2015-04-20 2015-07-11 xen-tools -- Unmediated PCI register access in qemu xen-tools 3.34.5.0_6

The Xen Project reports:

Qemu allows guests to not only read, but also write all parts of the PCI config space (but not extended config space) of passed through PCI devices not explicitly dealt with for (partial) emulation purposes.

Since the effect depends on the specific purpose of the the config space field, it's not possbile to give a general statement about the exact impact on the host or other guests. Privilege escalation, host crash (Denial of Service), and leaked information all cannot be excluded.

CVE-2015-4106 http://xenbits.xen.org/xsa/advisory-131.html 2015-06-02 2015-07-11 xen-tools -- Guest triggerable qemu MSI-X pass-through error messages xen-tools 3.34.5.0_6

The Xen Project reports:

Device model code dealing with guest PCI MSI-X interrupt management activities logs messages on certain (supposedly) invalid guest operations.

A buggy or malicious guest repeatedly invoking such operations may result in the host disk to fill up, possibly leading to a Denial of Service.

CVE-2015-4105 http://xenbits.xen.org/xsa/advisory-130.html 2015-06-02 2015-07-11 xen-tools -- PCI MSI mask bits inadvertently exposed to guests xen-tools 3.34.5.0_6

The Xen Project reports:

The mask bits optionally available in the PCI MSI capability structure are used by the hypervisor to occasionally suppress interrupt delivery. Unprivileged guests were, however, nevertheless allowed direct control of these bits.

Interrupts may be observed by Xen at unexpected times, which may lead to a host crash and therefore a Denial of Service.

CVE-2015-4104 http://xenbits.xen.org/xsa/advisory-129.html 2015-06-02 2015-07-11 xen-tools -- Potential unintended writes to host MSI message data field via qemu xen-tools 3.34.5.0_6

The Xen Project reports:

Logic is in place to avoid writes to certain host config space fields when the guest must nevertheless be able to access their virtual counterparts. A bug in how this logic deals with accesses spanning multiple fields allows the guest to write to the host MSI message data field.

While generally the writes write back the values previously read, their value in config space may have got changed by the host between the qemu read and write. In such a case host side interrupt handling could become confused, possibly losing interrupts or allowing spurious interrupt injection into other guests.

Certain untrusted guest administrators may be able to confuse host side interrupt handling, leading to a Denial of Service.

CVE-2015-4103 http://xenbits.xen.org/xsa/advisory-128.html 2015-06-02 2015-07-11 xen-kernel -- Certain domctl operations may be abused to lock up the host xen-kernel 4.34.5.0_3

The Xen Project reports:

XSA-77 put the majority of the domctl operations on a list excepting them from having security advisories issued for them if any effects their use might have could hamper security. Subsequently some of them got declared disaggregation safe, but for a small subset this was not really correct: Their (mis-)use may result in host lockups.

As a result, the potential security benefits of toolstack disaggregation are not always fully realised.

Domains deliberately given partial management control may be able to deny service to the entire host.

As a result, in a system designed to enhance security by radically disaggregating the management, the security may be reduced. But, the security will be no worse than a non-disaggregated design.

CVE-2015-2751 http://xenbits.xen.org/xsa/advisory-127.html 2015-03-31 2015-07-11 xen-tools -- Unmediated PCI command register access in qemu xen-tools 3.34.5.0_6

The Xen Project reports:

HVM guests are currently permitted to modify the memory and I/O decode bits in the PCI command register of devices passed through to them. Unless the device is an SR-IOV virtual function, after disabling one or both of these bits subsequent accesses to the MMIO or I/O port ranges would - on PCI Express devices - lead to Unsupported Request responses. The treatment of such errors is platform specific.

Furthermore (at least) devices under control of the Linux pciback driver in the host are handed to guests with the aforementioned bits turned off. This means that such accesses can similarly lead to Unsupported Request responses until these flags are set as needed by the guest.

In the event that the platform surfaces aforementioned UR responses as Non-Maskable Interrupts, and either the OS is configured to treat NMIs as fatal or (e.g. via ACPI's APEI) the platform tells the OS to treat these errors as fatal, the host would crash, leading to a Denial of Service.

CVE-2015-2756 http://xenbits.xen.org/xsa/advisory-126.html 2015-03-31 2015-07-11 xen-kernel and xen-tools -- Long latency MMIO mapping operations are not preemptible xen-kernel 4.5.0_3 xen-tools 4.5.0_6

The Xen Project reports:

The XEN_DOMCTL_memory_mapping hypercall allows long running operations without implementing preemption.

This hypercall is used by the device model as part of the emulation associated with configuration of PCI devices passed through to HVM guests and is therefore indirectly exposed to those guests.

This can cause a physical CPU to become busy for a significant period, leading to a host denial of service in some cases.

If a host denial of service is not triggered then it may instead be possible to deny service to the domain running the device model, e.g. domain 0.

This hypercall is also exposed more generally to all toolstacks. However the uses of it in libxl based toolstacks are not believed to open up any avenue of attack from an untrusted guest. Other toolstacks may be vulnerable however.

The vulnerability is exposed via HVM guests which have a PCI device assigned to them. A malicious HVM guest in such a configuration can mount a denial of service attack affecting the whole system via its associated device model (qemu-dm).

A guest is able to trigger this hypercall via operations which it is legitimately expected to perform, therefore running the device model as a stub domain does not offer protection against the host denial of service issue. However it does offer some protection against secondary issues such as denial of service against dom0.

CVE-2015-2752 http://xenbits.xen.org/xsa/advisory-125.html 2015-03-31 2015-07-11 xen-kernel -- Hypervisor memory corruption due to x86 emulator flaw xen-kernel 4.5.0_3

The Xen Project reports:

Instructions with register operands ignore eventual segment overrides encoded for them. Due to an insufficiently conditional assignment such a bogus segment override can, however, corrupt a pointer used subsequently to store the result of the instruction.

A malicious guest might be able to read sensitive data relating to other guests, or to cause denial of service on the host. Arbitrary code execution, and therefore privilege escalation, cannot be excluded.

CVE-2015-2151 http://xenbits.xen.org/xsa/advisory-123.html 2015-03-10 2015-07-11 xen-kernel -- Information leak through version information hypercall xen-kernel 4.5.0_3

The Xen Project reports:

The code handling certain sub-operations of the HYPERVISOR_xen_version hypercall fails to fully initialize all fields of structures subsequently copied back to guest memory. Due to this hypervisor stack contents are copied into the destination of the operation, thus becoming visible to the guest.

A malicious guest might be able to read sensitive data relating to other guests.

CVE-2015-2045 http://xenbits.xen.org/xsa/advisory-122.html 2015-03-05 2015-07-11 xen-kernel -- Information leak via internal x86 system device emulation xen-kernel 4.5.0_3

The Xen Project reports:

Emulation routines in the hypervisor dealing with certain system devices check whether the access size by the guest is a supported one. When the access size is unsupported these routines failed to set the data to be returned to the guest for read accesses, so that hypervisor stack contents are copied into the destination of the operation, thus becoming visible to the guest.

A malicious HVM guest might be able to read sensitive data relating to other guests.

CVE-2015-2044 http://xenbits.xen.org/xsa/advisory-121.html 2015-03-05 2015-07-11 xen-tools -- HVM qemu unexpectedly enabling emulated VGA graphics backends xen-tools 4.5.0_6

The Xen Project reports:

When instantiating an emulated VGA device for an x86 HVM guest qemu will by default enable a backend to expose that device, either SDL or VNC depending on the version of qemu and the build time configuration.

The libxl toolstack library does not explicitly disable these default backends when they are not enabled, leading to an unexpected backend running.

If either SDL or VNC is explicitly enabled in the guest configuration then only the expected backends will be enabled.

This affects qemu-xen and qemu-xen-traditional differently.

If qemu-xen was compiled with SDL support then this would result in an SDL window being opened if $DISPLAY is valid, or a failure to start the guest if not.

If qemu-xen was compiled without SDL support then qemu would instead start a VNC server listening on ::1 (IPv6 localhost) or 127.0.0.1 (IPv4 localhost) with IPv6 preferred if available. A VNC password will not be configured even if one is present in the guest configuration.

qemu-xen-traditional will never start a vnc backend unless explicitly configured. However by default it will start an SDL backend if it was built with SDL support and $DISPLAY is valid.

CVE-2015-2152 http://xenbits.xen.org/xsa/advisory-119.html 2015-03-13 2015-07-11 xen-kernel -- arm: vgic: incorrect rate limiting of guest triggered logging xen-kernel 4.44.5.0_3

The Xen Project reports:

On ARM systems the code which deals with virtualising the GIC distributor would, under various circumstances, log messages on a guest accessible code path without appropriate rate limiting.

A malicious guest could cause repeated logging to the hypervisor console, leading to a Denial of Service attack.

CVE-2015-1563 http://xenbits.xen.org/xsa/advisory-118.html 2015-01-29 2015-07-11 xen-kernel -- arm: vgic-v2: GICD_SGIR is not properly emulated xen-kernel 4.54.5.0_3

The Xen Project reports:

When decoding a guest write to a specific register in the virtual interrupt controller Xen would treat an invalid value as a critical error and crash the host.

By writing an invalid value to the GICD.SGIR register a guest can crash the host, resulting in a Denial of Service attack.

CVE-2015-0268 http://xenbits.xen.org/xsa/advisory-117.html 2015-02-12 2015-07-11 pivotx -- Multiple unrestricted file upload vulnerabilities pivotx 2.3.9

Pivotx reports:

Multiple unrestricted file upload vulnerabilities in fileupload.php in PivotX before 2.3.9 allow remote authenticated users to execute arbitrary PHP code by uploading a file with a (1) .php or (2) .php# extension, and then accessing it via unspecified vectors.

CVE-2014-0341 2014-04-15 2015-07-11 pivotx -- cross-site scripting (XSS) vulnerability pivotx 2.3.9

pivotx reports:

cross-site scripting (XSS) vulnerability in the nickname (and possibly the email) field. Mitigated by the fact that an attacker must have a PivotX account.

CVE-2014-0341 2014-04-15 2015-07-11 wpa_supplicant -- WPS_NFC option payload length validation vulnerability wpa_supplicant 2.4_4

Jouni Malinen reports:

Incomplete WPS and P2P NFC NDEF record payload length validation. (2015-5)

CVE-2015-8041 http://w1.fi/security/2015-5/incomplete-wps-and-p2p-nfc-ndef-record-payload-length-validation.txt 2015-07-08 2015-07-09 2015-11-10 openssl -- alternate chains certificate forgery vulnerability openssl 1.0.2_21.0.2_4 mingw32-openssl 1.0.2b1.0.2d

OpenSSL reports:

During certificate verification, OpenSSL (starting from version 1.0.1n and 1.0.2b) will attempt to find an alternative certificate chain if the first attempt to build such a chain fails. An error in the implementation of this logic can mean that an attacker could cause certain checks on untrusted certificates to be bypassed, such as the CA flag, enabling them to use a valid leaf certificate to act as a CA and "issue" an invalid certificate.

CVE-2015-1793 https://www.openssl.org/news/secadv_20150709.txt 2015-07-09 2015-07-09 django -- multiple vulnerabilities py27-django 1.4.01.4.21 py32-django 1.4.01.4.21 py33-django 1.4.01.4.21 py34-django 1.4.01.4.21 py27-django 1.7.01.7.9 py32-django 1.7.01.7.9 py33-django 1.7.01.7.9 py34-django 1.7.01.7.9 py27-django 1.8.01.8.3 py32-django 1.8.01.8.3 py33-django 1.8.01.8.3 py34-django 1.8.01.8.3 py27-django-devel 20150531,1 py32-django-devel 20150531,1 py33-django-devel 20150531,1 py34-django-devel 20150531,1

Tim Graham reports:

In accordance with our security release policy, the Django team is issuing multiple releases -- Django 1.4.21, 1.7.9, and 1.8.3. These releases are now available on PyPI and our download page. These releases address several security issues detailed below. We encourage all users of Django to upgrade as soon as possible. The Django master branch has also been updated.

https://www.djangoproject.com/weblog/2015/jul/08/security-releases/ https://github.com/django/django/commit/df049ed77a4db67e45db5679bfc76a85d2a26680 https://github.com/django/django/commit/014247ad1922931a2f17beaf6249247298e9dc44 https://github.com/django/django/commit/17d3a6d8044752f482453f5906026eaf12c39e8e CVE-2015-5143 CVE-2015-5144 CVE-2015-5145 2015-06-10 2015-07-09 Adobe Flash Player -- critical vulnerabilities linux-c6-flashplugin 11.2r202.481 linux-f10-flashplugin 11.2r202.481

Adobe reports:

Adobe has released security updates for Adobe Flash Player. These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe is aware of a report that an exploit targeting CVE-2015-5119 has been publicly published.

https://helpx.adobe.com/security/products/flash-player/apsb15-16.html CVE-2015-5119 2015-07-07 2015-07-08 bind -- denial of service vulnerability bind910 9.10.2P2 bind99 9.9.7P1 bind910-base bind99-base 0 FreeBSD 9.39.3_19 8.48.4_33

ISC reports:

A very uncommon combination of zone data has been found that triggers a bug in BIND, with the result that named will exit with a "REQUIRE" failure in name.c when validating the data returned in answer to a recursive query.

A recursive resolver that is performing DNSSEC validation can be deliberately terminated by any attacker who can cause a query to be performed against a maliciously constructed zone. This will result in a denial of service to clients who rely on that resolver.

SA-15:11.bind CVE-2015-4620 https://kb.isc.org/article/AA-01267/ 2015-07-07 2015-07-07 2016-08-09 haproxy -- information leak vulnerability haproxy 1.5.01.5.14

HAProxy reports:

A vulnerability was found when HTTP pipelining is used. In some cases, a client might be able to cause a buffer alignment issue and retrieve uninitialized memory contents that exhibit data from a past request or session. I want to address sincere congratulations to Charlie Smurthwaite of aTech Media for the really detailed traces he provided which made it possible to find the cause of this bug. Every user of 1.5-dev, 1.5.x or 1.6-dev must upgrade to 1.5.14 or latest 1.6-dev snapshot to fix this issue, or use the backport of the fix provided by their operating system vendors. CVE-2015-3281 was assigned to this bug.

http://www.haproxy.org/news.html http://git.haproxy.org/?p=haproxy-1.5.git;a=commit;h=7ec765568883b2d4e5a2796adbeb492a22ec9bd4 http://seclists.org/oss-sec/2015/q3/61 CVE-2015-3281 2015-07-02 2015-07-07 roundcube -- multiple vulnerabilities roundcube 1.1.0,11.1.2,1 1.0.6,1

Roundcube reports:

We just published updates to both stable versions 1.0 and 1.1 after fixing many minor bugs and adding some security improvements to the 1.1 release branch. Version 1.0.6 comes with cherry-picked fixes from the more recent version to ensure proper long term support especially in regards of security and compatibility.

The security-related fixes in particular are:

* XSS vulnerability in _mbox argument
* security improvement in contact photo handling
* potential info disclosure from temp directory

CVE-2015-5381 CVE-2015-5383 http://openwall.com/lists/oss-security/2015/07/06/10 https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released/ 2015-05-30 2015-07-07 turnserver -- SQL injection vulnerability turnserver 4.4.5.3

Oleg Moskalenko reports:

SQL injection security hole fixed.

http://turnserver.open-sys.org/downloads/v4.4.5.3/ChangeLog https://groups.google.com/d/msg/turn-server-project-rfc5766-turn-server/Dj3MmgyZX1o/ZaFo3zvxIw0J 2015-06-20 2015-07-02 squid -- Improper Protection of Alternate Path with CONNECT requests squid 3.5.6

Squid security advisory 2015:2 reports:

Squid configured with cache_peer and operating on explicit proxy traffic does not correctly handle CONNECT method peer responses.

The bug is important because it allows remote clients to bypass security in an explicit gateway proxy.

However, the bug is exploitable only if you have configured cache_peer to receive CONNECT requests.

http://www.squid-cache.org/Advisories/SQUID-2015_2.txt CVE-2015-5400 2015-07-06 2015-07-06 2015-07-17 squid -- client-first SSL-bump does not correctly validate X509 server certificate squid 3.53.5.4 3.43.4.13 squid33 3.33.3.14 squid32 3.23.2.14

Squid security advisory 2015:1 reports:

Squid configured with client-first SSL-bump does not correctly validate X509 server certificate domain / hostname fields.

The bug is important because it allows remote servers to bypass client certificate validation. Some attackers may also be able to use valid certificates for one domain signed by a global Certificate Authority to abuse an unrelated domain.

However, the bug is exploitable only if you have configured Squid to perform SSL Bumping with the "client-first" or "bump" mode of operation.

Sites that do not use SSL-Bump are not vulnerable.

All Squid built without SSL support are not vulnerable to the problem.

The FreeBSD port does not use SSL by default and is not vulnerable in the default configuration.

CVE-2015-3455 http://www.squid-cache.org/Advisories/SQUID-2015_1.txt 2015-05-01 2015-07-06 ansible -- multiple vulnerabilities ansible 1.9.2

Ansible, Inc. reports:

Ensure that hostnames match certificate names when using HTTPS - resolved in Ansible 1.9.2

Improper symlink handling in zone, jail, and chroot connection plugins could lead to escape from confined environment - resolved in Ansible 1.9.2

CVE-2015-3908 CVE-2015-6240 http://www.ansible.com/security https://raw.githubusercontent.com/ansible/ansible/v1.9.2-1/CHANGELOG.md 2015-06-25 2015-07-02 2015-08-18 ansible -- multiple vulnerabilities ansible 1.7

Ansible, Inc. reports:

Arbitrary execution from data from compromised remote hosts or local data when using a legacy Ansible syntax - resolved in Ansible 1.7

ansible-galaxy command when used on local tarballs (and not galaxy.ansible.com) can install a malformed tarball if so provided - resolved in Ansible 1.7

http://www.ansible.com/security https://raw.githubusercontent.com/ansible/ansible/devel/CHANGELOG.md 2014-08-06 2015-07-02 ansible -- code execution from compromised remote host data or untrusted local data ansible 1.6.7

Ansible, Inc. reports:

Arbitrary execution from data from compromised remote hosts or untrusted local data - resolved in Ansible 1.6.7

CVE-2014-4966 68794 http://www.ansible.com/security https://raw.githubusercontent.com/ansible/ansible/devel/CHANGELOG.md 2014-07-21 2015-07-02 ansible -- remote code execution vulnerability ansible 1.6.4

Ansible, Inc. reports:

Incomplete Fix Remote Code Execution Vulnerability - Fixed in Ansible 1.6.4

CVE-2014-4678 68335 http://www.ansible.com/security https://raw.githubusercontent.com/ansible/ansible/devel/CHANGELOG.md 2014-06-25 2015-07-02 ansible -- local symlink exploits ansible 1.2.3

MITRE reports:

runner/connection_plugins/ssh.py in Ansible before 1.2.3, when using ControlPersist, allows local users to redirect a ssh session via a symlink attack on a socket file with a predictable name in /tmp/.

lib/ansible/playbook/__init__.py in Ansible 1.2.x before 1.2.3, when playbook does not run due to an error, allows local users to overwrite arbitrary files via a symlink attack on a retry file with a predictable name in /var/tmp/ansible/.

CVE-2013-4259 CVE-2013-4260 http://www.ansible.com/security https://groups.google.com/forum/#!topic/ansible-project/UVDYW0HGcNg 2013-08-21 2015-07-02 ansible -- enable host key checking in paramiko connection type ansible 1.2.1

Ansible changelog reports:

Host key checking is on by default. Disable it if you like by adding host_key_checking=False in the [default] section of /etc/ansible/ansible.cfg or ~/ansible.cfg or by exporting ANSIBLE_HOST_KEY_CHECKING=False.

CVE-2013-2233 https://raw.githubusercontent.com/ansible/ansible/devel/CHANGELOG.md http://www.ansible.com/security https://github.com/ansible/ansible/issues/857 2012-08-13 2015-07-02 bitcoin -- denial of service bitcoin 0.10.2

Gregory Maxwell reports:

On July 7th I will be making public details of several serious denial of service vulnerabilities which have fixed in recent versions of Bitcoin Core, including including CVE-2015-3641. I strongly recommend anyone running production nodes exposed to inbound connections from the internet upgrade to 0.10.2 as soon as possible.

CVE-2015-3641 http://bitcoin-development.narkive.com/tO8M0R0j/upcoming-dos-vulnerability-announcements-for-bitcoin-core https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures 2015-06-27 2015-07-06 node, iojs, and v8 -- denial of service node 0.12.6 node-devel 0.12.6 iojs 2.3.3 v8 3.18.5 v8-devel 3.27.7_2

node reports:

This release of Node.js fixes a bug that triggers an out-of-band write in V8's utf-8 decoder. This bug impacts all Buffer to String conversions. This is an important security update as this bug can be used to cause a denial of service attack.

http://blog.nodejs.org/2015/07/03/node-v0-12-6-stable/ https://github.com/joyent/node/commit/78b0e30954111cfaba0edbeee85450d8cbc6fdf6 https://github.com/nodejs/io.js/commit/030f8045c706a8c3925ec7cb3184fdfae4ba8676 https://codereview.chromium.org/1226493003 CVE-2015-5380 2015-07-03 2015-07-06 2015-07-10 cups-filters -- texttopdf integer overflow cups-filters 1.0.71

Stefan Cornelius from Red Hat reports:

An integer overflow flaw leading to a heap-based buffer overflow was discovered in the way the texttopdf utility of cups-filter processed print jobs with a specially crafted line size. An attacker being able to submit print jobs could exploit this flaw to crash texttopdf or, possibly, execute arbitrary code with the privileges of the 'lp' user.

Tim Waugh reports:

The Page allocation is moved into textcommon.c, where it does all the necessary checking: lower-bounds for CVE-2015-3258 and upper-bounds for CVE-2015-3259 due to integer overflows for the calloc() call initialising Page[0] and the memset() call in texttopdf.c's WritePage() function zeroing the entire array.

CVE-2015-3279 https://access.redhat.com/security/cve/CVE-2015-3279 http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7365 http://osdir.com/ml/opensource-software-security/2015-07/msg00021.html 2015-07-03 2015-07-03 2015-07-07 libxml2 -- Enforce the reader to run in constant memory libxml2 2.9.2_3 linux-c6-libxml2 2.7.6_5 linux-f10-libxml2 *

Daniel Veilland reports:

Enforce the reader to run in constant memory. One of the operation on the reader could resolve entities leading to the classic expansion issue. Make sure the buffer used for xmlreader operation is bounded. Introduce a new allocation type for the buffers for this effect.

CVE-2015-1819 https://git.gnome.org/browse/libxml2/commit/?id=213f1fe0d76d30eaed6e5853057defc43e6df2c9 2015-04-14 2015-07-01 2016-01-31 wesnoth -- disclosure of .pbl files with lowercase, uppercase, and mixed-case extension wesnoth 1.12.4,1

Ignacio R. Morelle reports:

As mentioned in the Wesnoth 1.12.4 and Wesnoth 1.13.1 release announcements, a security vulnerability targeting add-on authors was found (bug #23504) which allowed a malicious user to obtain add-on server passphrases from the client's .pbl files and transmit them over the network, or store them in saved game files intended to be shared by the victim. This vulnerability affects all existing releases up to and including versions 1.12.2 and 1.13.0. Additionally, version 1.12.3 included only a partial fix that failed to guard users against attempts to read from .pbl files with an uppercase or mixed-case extension. CVE-2015-5069 and CVE-2015-5070 have been assigned to the vulnerability affecting .pbl files with a lowercase extension, and .pbl files with an uppercase or mixed-case extension, respectively.

CVE-2015-5069 CVE-2015-5070 http://forums.wesnoth.org/viewtopic.php?t=42776 http://forums.wesnoth.org/viewtopic.php?t=42775 2015-06-28 2015-07-01 cups-filters -- buffer overflow in texttopdf size allocation cups-filters 1.0.70

Stefan Cornelius from Red Hat reports:

A heap-based buffer overflow was discovered in the way the texttopdf utility of cups-filters processed print jobs with a specially crafted line size. An attacker being able to submit print jobs could exploit this flaw to crash texttopdf or, possibly, execute arbitrary code.

Till Kamppeter reports:

texttopdf: Fixed buffer overflow on size allocation of texttopdf when working with extremely small line sizes, which causes the size calculation to result in 0 (CVE-2015-3258, thanks to Stefan Cornelius from Red Hat for the patch).

CVE-2015-3258 http://www.openwall.com/lists/oss-security/2015/06/26/4 http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7363 2015-06-26 2015-06-29 ntp -- control message remote Deinal of Service vulnerability ntp 4.2.8p3 ntp-devel 4.3.25

ntp.org reports:

Under limited and specific circumstances an attacker can send a crafted packet to cause a vulnerable ntpd instance to crash. This requires each of the following to be true:

ntpd set up to allow for remote configuration (not allowed by default), and

knowledge of the configuration password, and

access to a computer entrusted to perform remote configuration.

http://bugs.ntp.org/show_bug.cgi?id=2853 https://www.kb.cert.org/vuls/id/668167 http://support.ntp.org/bin/view/Main/SecurityNotice#June_2015_NTP_Security_Vulnerabi 2015-06-29 2015-06-30 qemu -- Heap overflow in QEMU PCNET controller, allowing guest to host escape (CVE-2015-3209) qemu qemu-devel 0.11.1_20 0.122.3.0_2 qemu-sbruno 2.3.50.g20150618_1 xen-tools 4.5.0_6

The QEMU security team reports:

A guest which has access to an emulated PCNET network device (e.g. with "model=pcnet" in their VIF configuration) can exploit this vulnerability to take over the qemu process elevating its privilege to that of the qemu process.

http://xenbits.xen.org/xsa/advisory-135.html CVE-2015-3209 2015-04-10 2015-06-26 2015-07-11 elasticsearch -- security fix for shared file-system repositories elasticsearch 1.0.01.6.0

Elastic reports:

Vulnerability Summary: All Elasticsearch versions from 1.0.0 to 1.5.2 are vulnerable to an attack that uses Elasticsearch to modify files read and executed by certain other applications.

Remediation Summary: Users should upgrade to 1.6.0. Alternately, ensure that other applications are not present on the system, or that Elasticsearch cannot write into areas where these applications would read.

CVE-2015-4165 ports/201008 https://www.elastic.co/community/security https://www.elastic.co/blog/elasticsearch-1-6-0-released 2015-06-09 2015-06-26 elasticsearch -- directory traversal attack with site plugins elasticsearch 1.4.5 1.5.01.5.2

Elastic reports:

Vulnerability Summary: All Elasticsearch versions prior to 1.5.2 and 1.4.5 are vulnerable to a directory traversal attack that allows an attacker to retrieve files from the server running Elasticsearch when one or more site plugins are installed, or when Windows is the server OS.

Remediation Summary: Users should upgrade to 1.4.5 or 1.5.2. Users that do not want to upgrade can address the vulnerability by disabling site plugins. See the CVE description for additional options.

CVE-2015-3337 74353 https://www.elastic.co/community/security https://www.elastic.co/blog/elasticsearch-1-5-2-and-1-4-5-released https://www.exploit-db.com/exploits/37054/ https://packetstormsecurity.com/files/131646/Elasticsearch-Directory-Traversal.html http://www.securityfocus.com/archive/1/535385 2015-04-27 2015-06-26 elasticsearch -- remote OS command execution via Groovy scripting engine elasticsearch 1.3.01.3.8 1.4.01.4.3

Elastic reports:

Vulnerability Summary: Elasticsearch versions 1.3.0-1.3.7 and 1.4.0-1.4.2 have vulnerabilities in the Groovy scripting engine that were introduced in 1.3.0. The vulnerability allows an attacker to construct Groovy scripts that escape the sandbox and execute shell commands as the user running the Elasticsearch Java VM.

Remediation Summary: Users should upgrade to 1.3.8 or 1.4.3. Users that do not want to upgrade can address the vulnerability by setting script.groovy.sandbox.enabled to false in elasticsearch.yml and restarting the node.

CVE-2015-1427 72585 https://www.elastic.co/community/security https://www.elastic.co/blog/elasticsearch-1-4-3-and-1-3-8-released http://www.securityfocus.com/archive/1/archive/1/534689/100/0/threaded https://packetstormsecurity.com/files/130368/Elasticsearch-1.3.7-1.4.2-Sandbox-Escape-Command-Execution.html https://packetstormsecurity.com/files/130784/ElasticSearch-Unauthenticated-Remote-Code-Execution.html 2015-02-11 2015-06-26 elasticsearch -- cross site scripting vulnerability in the CORS functionality elasticsearch 1.4.0

Elastic reports:

Vulnerability Summary: Elasticsearch versions 1.3.x and prior have a default configuration for CORS that allows an attacker to craft links that could cause a user's browser to send requests to Elasticsearch instances on their local network. These requests could cause data loss or compromise.

Remediation Summary: Users should either set "http.cors.enabled" to false, or set "http.cors.allow-origin" to the value of the server that should be allowed access, such as localhost or a server hosting Kibana. Disabling CORS entirely with the former setting is more secure, but may not be suitable for all use cases.

CVE-2014-6439 70233 https://www.elastic.co/community/security https://www.elastic.co/blog/elasticsearch-1-4-0-beta-released https://packetstormsecurity.com/files/128556/Elasticsearch-1.3.x-CORS-Issue.html http://www.securityfocus.com/archive/1/archive/1/533602/100/0/threaded 2014-10-01 2015-06-26 elasticsearch and logstash -- remote OS command execution via dynamic scripting elasticsearch 1.2.0 logstash 1.4.3

Elastic reports:

Vulnerability Summary: In Elasticsearch versions 1.1.x and prior, dynamic scripting is enabled by default. This could allow an attacker to execute OS commands.

Remediation Summary: Disable dynamic scripting.

Logstash 1.4.2 was bundled with Elasticsearch 1.1.1, which is vulnerable to CVE-2014-3120. These binaries are used in Elasticsearch output specifically when using the node protocol. Since a node client joins the Elasticsearch cluster, the attackers could use scripts to execute commands on the host OS using the node client's URL endpoint. With 1.4.3 release, we are packaging Logstash with Elasticsearch 1.5.2 binaries which by default disables the ability to run scripts. This also affects users who are using the configuration option embedded=>true in the Elasticsearch output which starts a local embedded Elasticsearch cluster. This is typically used in development environment and proof of concept deployments. Regardless of this vulnerability, we strongly recommend not using embedded in production.

Note that users of transport and http protocol are not vulnerable to this attack.

CVE-2014-3120 67731 https://www.elastic.co/community/security https://www.elastic.co/blog/elasticsearch-1-2-0-released https://www.elastic.co/blog/logstash-1-4-3-released https://www.exploit-db.com/exploits/33370/ http://bouk.co/blog/elasticsearch-rce/ http://www.rapid7.com/db/modules/exploit/multi/elasticsearch/script_mvel_rce https://www.found.no/foundation/elasticsearch-security/#staying-safe-while-developing-with-elasticsearch 2014-05-22 2015-06-26 logstash -- Directory traversal vulnerability in the file output plugin logstash 1.4.3

Elastic reports:

An attacker could use the File output plugin with dynamic field references in the path option to traverse paths outside of Logstash directory. This technique could also be used to overwrite any files which can be accessed with permissions associated with Logstash user. This release sandboxes the paths which can be traversed using the configuration. We have also disallowed use of dynamic field references if the path options is pointing to an absolute path.

We have added this vulnerability to our CVE page and are working on filling out the CVE. We would like to thank Colin Coghill for reporting the issue and working with us on the resolution.

CVE-2015-4152 https://www.elastic.co/blog/logstash-1-4-3-released https://www.elastic.co/community/security 2015-06-09 2015-06-24 logstash -- Remote command execution in Logstash zabbix and nagios_nsca outputs logstash 1.4.2

Elastic reports:

The vulnerability impacts deployments that use the either the zabbix or the nagios_nsca outputs. In these cases, an attacker with an ability to send crafted events to any source of data for Logstash could execute operating system commands with the permissions of the Logstash process.

Deployments that do not use the zabbix or the nagios_nsca outputs are not vulnerable and do not need to upgrade for this reason.

We have added this vulnerability to our CVE page and are working on filling out the CVE.

We would like to thank Jan Karwowski and Danila Borisiuk for reporting the issue and working with us on the resolution.

CVE-2014-4326 https://www.elastic.co/blog/logstash-1-4-2 https://www.elastic.co/community/security 2014-06-24 2015-06-24 logstash-forwarder and logstash -- susceptibility to POODLE vulnerability logstash-forwarder 0.4.0.20150507 logstash 1.4.3

Elastic reports:

The combination of Logstash Forwarder and Lumberjack input (and output) was vulnerable to the POODLE attack in SSLv3 protocol. We have disabled SSLv3 for this combination and set the minimum version to be TLSv1.0. We have added this vulnerability to our CVE page and are working on filling out the CVE.

Thanks to Tray Torrance, Marc Chadwick, and David Arena for reporting this.

SSLv3 is no longer supported; TLS 1.0+ is required (compatible with Logstash 1.4.2+).

ports/201065 ports/201065 https://www.elastic.co/blog/logstash-1-4-3-released https://www.elastic.co/blog/logstash-forwarder-0-4-0-released 2015-06-09 2015-06-24 2015-06-24 Adobe Flash Player -- critical vulnerabilities linux-c6-flashplugin 11.2r202.466 linux-f10-flashplugin 11.2r202.466

Adobe reports:

Adobe has released security updates for Adobe Flash Player for Windows, Macintosh and Linux. These updates address a critical vulnerability (CVE-2015-3113) that could potentially allow an attacker to take control of the affected system.

Adobe is aware of reports that CVE-2015-3113 is being actively exploited in the wild via limited, targeted attacks. Systems running Internet Explorer for Windows 7 and below, as well as Firefox on Windows XP, are known targets.

https://helpx.adobe.com/security/products/flash-player/apsb15-14.html CVE-2015-3113 2015-06-23 2015-06-24 rubygem-bson -- DoS and possible injection rubygem-bson 3.0.4

Phill MV reports:

By submitting a specially crafted string to a service relying on the bson rubygem, an attacker may trigger denials of service or even inject data into victim's MongoDB instances.

CVE-2015-4412 http://www.openwall.com/lists/oss-security/2015/06/06/1 http://sakurity.com/blog/2015/06/04/mongo_ruby_regexp.html https://github.com/mongodb/bson-ruby/commit/976da329ff03ecdfca3030eb6efe3c85e6db9999 2015-06-04 2015-06-23 php5 -- multiple vulnerabilities php5-dom php5-ftp php5-gd php5-pgsql 5.4.42 php55-dom php55-ftp php55-gd php55-pgsql 5.5.26 php56-dom php56-ftp php56-gd php56-psql 5.6.10

The PHP project reports:

DOM and GD:

Fixed bug #69719 (Incorrect handling of paths with NULs).

FTP:

Improved fix for bug #69545 (Integer overflow in ftp_genlist() resulting in heap overflow). (CVE-2015-4643)

Postgres:

Fixed bug #69667 (segfault in php_pgsql_meta_data). (CVE-2015-4644)

CVE-2015-4643 CVE-2015-4644 http://www.php.net/ChangeLog-5.php#5.4.42 http://www.php.net/ChangeLog-5.php#5.5.26 http://www.php.net/ChangeLog-5.php#5.6.10 http://openwall.com/lists/oss-security/2015/06/18/3 2015-06-11 2015-06-23 devel/ipython -- remote execution ipython 3.2.0

Kyle Kelley reports:

Summary: JSON error responses from the IPython notebook REST API contained URL parameters and were incorrectly reported as text/html instead of application/json. The error messages included some of these URL params, resulting in a cross site scripting attack. This affects users on Mozilla Firefox but not Chromium/Google Chrome.

API paths with issues:

/api/contents (3.0-3.1)

/api/notebooks (2.0-2.4, 3.0-3.1)

CVE-2015-4706 CVE-2015-4707 http://seclists.org/oss-sec/2015/q2/779 2015-06-22 2015-06-22 www/chromium -- mulitple vulnerabilities chromium 43.0.2357.130 chromium-npapi 43.0.2357.130 chromium-pulse 43.0.2357.130

Google Chrome Releases reports:

4 security fixes in this release:

[464922] High CVE-2015-1266: Scheme validation error in WebUI. Credit to anonymous.

[494640] High CVE-2015-1268: Cross-origin bypass in Blink. Credit to Mariusz Mlynski.

[497507] Medium CVE-2015-1267: Cross-origin bypass in Blink. Credit to anonymous.

[461481] Medium CVE-2015-1269: Normalization error in HSTS/HPKP preload list. Credit to Mike Ruddy.

CVE-2015-1266 CVE-2015-1267 CVE-2015-1268 CVE-2015-1269 http://googlechromereleases.blogspot.nl/2015/06/chrome-stable-update.html 2015-06-22 2015-06-22 rubygem-paperclip -- validation bypass vulnerabilitiy rubygem-paperclip 4.2.2

Jon Yurek reports:

Thanks to MORI Shingo of DeNA Co., Ltd. for reporting this.

There is an issue where if an HTML file is uploaded with a .html extension, but the content type is listed as being `image/jpeg`, this will bypass a validation checking for images. But it will also pass the spoof check, because a file named .html and containing actual HTML passes the spoof check.

This change makes it so that we also check the supplied content type. So even if the file contains HTML and ends with .html, it doesn't match the content type of `image/jpeg` and so it fails.

CVE-2015-2963 https://github.com/thoughtbot/paperclip/commit/9aee4112f36058cd28d5fe4a006d6981bd1eda57 https://robots.thoughtbot.com/paperclip-security-release http://jvn.jp/en/jp/JVN83881261/index.html 2015-06-05 2015-06-22 chicken -- Potential buffer overrun in string-translate* chicken 4.10.0.r2,1

chicken developer Peter Bex reports:

Using gcc's Address Sanitizer, it was discovered that the string-translate* procedure from the data-structures unit can scan beyond the input string's length up to the length of the source strings in the map that's passed to string-translate*. This issue was fixed in master 8a46020, and it will make its way into CHICKEN 4.10.

This bug is present in all released versions of CHICKEN.

CVE-2015-4556 ports/200980 http://lists.nongnu.org/archive/html/chicken-announce/2015-06/msg00010.html http://lists.nongnu.org/archive/html/chicken-hackers/2015-06/msg00037.html http://lists.nongnu.org/archive/html/chicken-announce/2015-07/msg00001.html 2015-06-15 2015-06-22 2015-07-31 chicken -- buffer overrun in substring-index[-ci] chicken 4.10.0.r1,1

chicken developer Moritz Heidkamp reports:

The substring-index[-ci] procedures of the data-structures unit are vulnerable to a buffer overrun attack when passed an integer greater than zero as the optional START argument.

As a work-around you can switch to SRFI 13's string-contains procedure which also returns the substring's index in case it is found.

CVE-2014-9651 http://lists.gnu.org/archive/html/chicken-users/2015-01/msg00048.html http://lists.nongnu.org/archive/html/chicken-hackers/2014-12/txt2UqAS9CtvH.txt 2015-01-12 2015-06-22 2015-06-23 cacti -- Multiple XSS and SQL injection vulerabilities cacti 0.8.8d

The Cacti Group, Inc. reports:

Important Security Fixes

Multiple XSS and SQL injection vulerabilities

Changelog

bug: Fixed SQL injection VN: JVN#78187936 / TN:JPCERT#98968540

bug#0002542: [FG-VD-15-017] Cacti Cross-Site Scripting Vulnerability Notification

bug#0002571: SQL Injection and Location header injection from cdef id CVE-2015-4342

bug#0002572: SQL injection in graph template

CVE-2015-4342 ports/200963 http://www.cacti.net/release_notes_0_8_8d.php http://seclists.org/fulldisclosure/2015/Jun/19 2015-06-09 2015-06-21 cacti -- multiple security vulnerabilities cacti 0.8.8c

The Cacti Group, Inc. reports:

Important Security Fixes

CVE-2013-5588 - XSS issue via installer or device editing

CVE-2013-5589 - SQL injection vulnerability in device editing

CVE-2014-2326 - XSS issue via CDEF editing

CVE-2014-2327 - Cross-site request forgery (CSRF) vulnerability

CVE-2014-2328 - Remote Command Execution Vulnerability in graph export

CVE-2014-4002 - XSS issues in multiple files

CVE-2014-5025 - XSS issue via data source editing

CVE-2014-5026 - XSS issues in multiple files

CVE-2013-5588 CVE-2013-5589 CVE-2014-2326 CVE-2014-2327 CVE-2014-2328 CVE-2014-4002 CVE-2014-5025 CVE-2014-5026 ports/198586 http://sourceforge.net/p/cacti/mailman/message/33072838/ http://www.cacti.net/release_notes_0_8_8c.php 2014-11-23 2015-06-21 p5-Dancer -- possible to abuse session cookie values p5-Dancer 1.3138

Russell Jenkins reports:

It was possible to abuse session cookie values so that file-based session stores such as Dancer::Session::YAML or Dancer2::Session::YAML would attempt to read/write from any file on the filesystem with the same extension the file-based store uses, such as '*.yml' for the YAML stores.

http://lists.preshweb.co.uk/pipermail/dancer-users/2015-June/004621.html 2015-06-12 2015-06-20 drupal -- multiple vulnerabilities drupal6 6.36 drupal7 7.38

Drupal development team reports:

Impersonation (OpenID module - Drupal 6 and 7 - Critical)

A vulnerability was found in the OpenID module that allows a malicious user to log in as other users on the site, including administrators, and hijack their accounts.

This vulnerability is mitigated by the fact that the victim must have an account with an associated OpenID identity from a particular set of OpenID providers (including, but not limited to, Verisign, LiveJournal, or StackExchange).

Open redirect (Field UI module - Drupal 7 - Less critical)

The Field UI module uses a "destinations" query string parameter in URLs to redirect users to new destinations after completing an action on a few administration pages. Under certain circumstances, malicious users can use this parameter to construct a URL that will trick users into being redirected to a 3rd party website, thereby exposing the users to potential social engineering attacks.

This vulnerability is mitigated by the fact that only sites with the Field UI module enabled are affected.

Drupal 6 core is not affected, but see the similar advisory for the Drupal 6 contributed CCK module: SA-CONTRIB-2015-126

Open redirect (Overlay module - Drupal 7 - Less critical)

The Overlay module displays administrative pages as a layer over the current page (using JavaScript), rather than replacing the page in the browser window. The Overlay module does not sufficiently validate URLs prior to displaying their contents, leading to an open redirect vulnerability.

This vulnerability is mitigated by the fact that it can only be used against site users who have the "Access the administrative overlay" permission, and that the Overlay module must be enabled.

Information disclosure (Render cache system - Drupal 7 - Less critical)

On sites utilizing Drupal 7's render cache system to cache content on the site by user role, private content viewed by user 1 may be included in the cache and exposed to non-privileged users.

This vulnerability is mitigated by the fact that render caching is not used in Drupal 7 core itself (it requires custom code or the contributed Render Cache module to enable) and that it only affects sites that have user 1 browsing the live site. Exposure is also limited if an administrative role has been assigned to the user 1 account (which is done, for example, by the Standard install profile that ships with Drupal core).

CVE-2015-3231 CVE-2015-3232 CVE-2015-3233 CVE-2015-3234 https://www.drupal.org/SA-CORE-2015-002 2015-06-17 2015-06-19 cURL -- Multiple Vulnerability curl 7.407.43

cURL reports:

libcurl can wrongly send HTTP credentials when re-using connections.

libcurl allows applications to set credentials for the upcoming transfer with HTTP Basic authentication, like with CURLOPT_USERPWD for example. Name and password. Just like all other libcurl options the credentials are sticky and are kept associated with the "handle" until something is made to change the situation.

Further, libcurl offers a curl_easy_reset() function that resets a handle back to its pristine state in terms of all settable options. A reset is of course also supposed to clear the credentials. A reset is typically used to clear up the handle and prepare it for a new, possibly unrelated, transfer.

Within such a handle, libcurl can also store a set of previous connections in case a second transfer is requested to a host name for which an existing connection is already kept alive.

With this flaw present, using the handle even after a reset would make libcurl accidentally use those credentials in a subseqent request if done to the same host name and connection as was previously accessed.

An example case would be first requesting a password protected resource from one section of a web site, and then do a second request of a public resource from a completely different part of the site without authentication. This flaw would then inadvertently leak the credentials in the second request.

libcurl can get tricked by a malicious SMB server to send off data it did not intend to.

In libcurl's state machine function handling the SMB protocol (smb_request_state()), two length and offset values are extracted from data that has arrived over the network, and those values are subsequently used to figure out what data range to send back.

The values are used and trusted without boundary checks and are just assumed to be valid. This allows carefully handicrafted packages to trick libcurl into responding and sending off data that was not intended. Or just crash if the values cause libcurl to access invalid memory.

CVE-2015-3236 CVE-2015-3237 http://curl.haxx.se/docs/adv_20150617A.html http://curl.haxx.se/docs/adv_20150617B.html 2015-06-17 2015-06-17 rubygem-rails -- multiple vulnerabilities rubygem-activesupport 3.2.22 rubygem-activesupport4 4.2.2 rubygem-jquery-rails 3.1.3 rubygem-jquery-rails4 4.0.4 rubygem-rack 1.4.6 rubygem-rack15 1.5.4 rubygem-rack16 1.6.2 rubygem-rails 3.2.22 rubygem-rails4 4.2.2 rubygem-web-console 2.1.3

Ruby on Rails blog:

Rails 3.2.22, 4.1.11 and 4.2.2 have been released, along with web console and jquery-rails plugins and Rack 1.5.4 and 1.6.2.

CVE-2015-1840 CVE-2015-3224 CVE-2015-3225 CVE-2015-3226 CVE-2015-3227 http://weblog.rubyonrails.org/2015/6/16/Rails-3-2-22-4-1-11-and-4-2-2-have-been-released-and-more/ 2015-06-16 2015-06-17 testdisk -- buffer overflow with malicious disk image testdisk 7.0

CGSecurity TestDisk Changelog reports:

Various fix including security fix, thanks to:

Coverity scan (Static Analysis of source code)

afl-fuzz (security-oriented fuzzer).

Denis Andzakovic from Security Assessment for reporting an exploitable Stack Buffer Overflow.

Denis Andzakovic reports:

A buffer overflow is triggered within the software when a malicious disk image is attempted to be recovered. This may be leveraged by an attacker to crash TestDisk and gain control of program execution. An attacker would have to coerce the victim to run TestDisk against their malicious image.

http://www.cgsecurity.org/wiki/TestDisk_7.0_Release http://www.security-assessment.com/files/documents/advisory/Testdisk%20Check_OS2MB%20Stack%20Buffer%20Overflow%20-%20Release.pdf 2015-04-30 2015-06-16 tomcat -- multiple vulnerabilities tomcat 6.0.44 tomcat7 7.0.55 tomcat8 8.0.9 hadoop2 2.6.0 oozie 4.1.0

Apache Software Foundation reports:

Low: Denial of Service CVE-2014-0230

When a response for a request with a request body is returned to the user agent before the request body is fully read, by default Tomcat swallows the remaining request body so that the next request on the connection may be processed. There was no limit to the size of request body that Tomcat would swallow. This permitted a limited Denial of Service as Tomcat would never close the connection and a processing thread would remain allocated to the connection.

Moderate: Security Manager bypass CVE-2014-7810

Malicious web applications could use expression language to bypass the protections of a Security Manager as expressions were evaluated within a privileged code section.

CVE-2014-0230 CVE-2014-7810 https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.44 2015-05-12 2015-06-16 2017-03-18 security/ossec-hids-* -- root escalation via syscheck feature ossec-hids-server ossec-hids-client ossec-hids-local 2.72.8.2

OSSEC reports:

The CVE-2015-3222 vulnerability, which allows for root escalation via sys check has been fixed in OSSEC 2.8.2. This issue does not affect agents.

CVE-2015-3222 ports/200801 http://www.ossec.net/?p=1198 https://github.com/ossec/ossec-hids/releases/tag/2.8.2 2015-06-11 2015-06-12 openssl -- multiple vulnerabilities openssl 1.0.2_2 mingw32-openssl 1.0.11.0.2b linux-c6-openssl 1.0.1e_6 libressl 2.1.7 FreeBSD 10.110.1_12 9.39.3_16 8.48.4_30

The OpenSSL team reports:

Missing DHE man-in-the-middle protection (Logjam) (CVE-2015-4000)

Malformed ECParameters causes infinite loop (CVE-2015-1788)

Exploitable out-of-bounds read in X509_cmp_time (CVE-2015-1789)

iPKCS7 crash with missing EnvelopedContent (CVE-2015-1790)

CMS verify infinite loop with unknown hash function (CVE-2015-1792)

Race condition handling NewSessionTicket (CVE-2015-1791)

Invalid free in DTLS (CVE-2014-8176)

CVE-2014-8176 CVE-2015-1788 CVE-2015-1789 CVE-2015-1790 CVE-2015-1791 CVE-2015-1792 CVE-2015-4000 SA-15:10.openssl https://www.openssl.org/news/secadv_20150611.txt 2015-06-11 2015-06-11 2016-08-09 Adobe Flash Player -- critical vulnerabilities linux-c6-flashplugin 11.2r202.466 linux-f10-flashplugin 11.2r202.466

Adobe reports:

Adobe has released security updates for Adobe Flash Player for Windows, Macintosh and Linux. These updates address vulnerabilities that could potentially allow an attacker to take control of the affected system.

These updates resolve a vulnerability (CVE-2015-3096) that could be exploited to bypass the fix for CVE-2014-5333.

These updates improve memory address randomization of the Flash heap for the Window 7 64-bit platform (CVE-2015-3097).

These updates resolve vulnerabilities that could be exploited to bypass the same-origin-policy and lead to information disclosure (CVE-2015-3098, CVE-2015-3099, CVE-2015-3102).

These updates resolve a stack overflow vulnerability that could lead to code execution (CVE-2015-3100).

These updates resolve a permission issue in the Flash broker for Internet Explorer that could be exploited to perform privilege escalation from low to medium integrity level (CVE-2015-3101).

These updates resolve an integer overflow vulnerability that could lead to code execution (CVE-2015-3104).

These updates resolve a memory corruption vulnerability that could lead to code execution (CVE-2015-3105).

These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2015-3103, CVE-2015-3106, CVE-2015-3107).

These updates resolve a memory leak vulnerability that could be used to bypass ASLR (CVE-2015-3108).

https://helpx.adobe.com/security/products/flash-player/apsb15-11.html CVE-2015-3096 CVE-2015-3097 CVE-2015-3098 CVE-2015-3099 CVE-2015-3100 CVE-2015-3101 CVE-2015-3102 CVE-2015-3103 CVE-2015-3104 CVE-2015-3105 CVE-2015-3106 CVE-2015-3107 CVE-2015-3108 2015-06-09 2015-06-11 libzmq4 -- V3 protocol handler vulnerable to downgrade attacks libzmq4 4.0.04.0.6 4.1.04.1.1

Pieter Hintjens reports:

It is easy to bypass the security mechanism in 4.1.0 and 4.0.5 by sending a ZMTP v2 or earlier header. The library accepts such connections without applying its security mechanism.

CVE-2014-9721 https://github.com/zeromq/libzmq/issues/1273 http://www.openwall.com/lists/oss-security/2015/05/07/8 ports/200502 2014-12-04 2015-06-10 2015-09-28 pgbouncer -- remote denial of service pgbouncer 1.5.5

PgBouncer reports:

Fix remote crash - invalid packet order causes lookup of NULL pointer. Not exploitable, just DoS.

CVE-2015-4054 https://pgbouncer.github.io/2015/04/pgbouncer-1-5-5/ http://www.openwall.com/lists/oss-security/2015/05/21/2 ports/200507 2015-04-08 2015-06-10 2015-09-28 cups -- multiple vulnerabilities cups-base 2.0.3

CUPS development team reports:

The new release addresses two security vulnerabilities, add localizations for German and Russian, and includes several general bug fixes. Changes include:

Security: Fixed CERT VU #810572/CVE-2015-1158/CVE-2015-1159 exploiting the dynamic linker (STR #4609)

Security: The scheduler could hang with malformed gzip data (STR #4602)

CVE-2015-1158 CVE-2015-1159 https://cups.org/blog.php?L1082 https://www.kb.cert.org/vuls/id/810572 2015-06-09 2015-06-09 strongswan -- Denial-of-service and potential remote code execution vulnerability strongswan 5.2.25.3.1

StrongSwan Project reports

A denial-of-service and potential remote code execution vulnerability triggered by crafted IKE messages was discovered in strongSwan. Versions 5.2.2 and 5.3.0 are affected.

CVE-2015-3991 https://www.strongswan.org/blog/2015/06/01/strongswan-vulnerability-(cve-2015-3991).html 2015-05-15 2015-06-09 2015-09-28 strongswan -- Information Leak Vulnerability strongswan 4.3.05.3.2

strongSwan Project reports:

An information leak vulnerability was fixed that, in certain IKEv2 setups, allowed rogue servers with a valid certificate accepted by the client to trick it into disclosing user credentials (even plain passwords if the client accepts EAP-GTC). This was caused because constraints against the server's authentication were enforced too late. All versions since 4.3.0 are affected.

CVE-2015-4171 http://www.strongswan.org/blog/2015/06/08/strongswan-5.3.2-released.html 2015-06-08 2015-06-09 redis -- EVAL Lua Sandbox Escape redis redis-devel 2.6.02.8.21 3.03.0.2

Ben Murphy reports:

It is possible to break out of the Lua sandbox in Redis and execute arbitrary code.

This shouldn’t pose a threat to users under the trusted Redis security model where only trusted users can connect to the database. However, in real deployments there could be databases that can be accessed by untrusted users. The main deployments that are vulnerable are developers machines, places where redis servers can be reached via SSRF attacks and cloud hosting.

CVE-2015-4335 http://benmmurphy.github.io/blog/2015/06/04/redis-eval-lua-sandbox-escape/ 2015-06-04 2015-06-08 tidy -- heap-buffer-overflow tidy4 20000804_3 tidy-devel 090315.c_2 tidy-lib 090315.c_2 tidy-html5 4.9.31

Geoff McLane reports:

tidy is affected by a write out of bounds when processing malformed html files.

This issue could be abused on server side applications that use php-tidy extension with user input.

The issue was confirmed, analysed and fixed by the tidy5 maintainer.

https://github.com/htacg/tidy-html5/issues/217 http://seclists.org/oss-sec/2015/q2/633 http://seclists.org/oss-sec/2015/q3/116 CVE-2015-5522 CVE-2015-5523 2015-06-03 2015-06-08 2015-07-15 pcre -- multiple vulnerabilities pcre 8.37_1

Venustech ADLAB reports:

PCRE library is prone to a vulnerability which leads to Heap Overflow. During the compilation of a malformed regular expression, more data is written on the malloced block than the expected size output by compile_regex.

PCRE library is prone to a vulnerability which leads to Stack Overflow. Without enough bound checking inside match(), the stack memory could be overflowed via a crafted regular expression.

CVE-2015-3210 CVE-2015-3217 https://bugs.exim.org/show_bug.cgi?id=1636 https://bugs.exim.org/show_bug.cgi?id=1638 2015-05-29 2015-06-04 2015-06-07 hostapd and wpa_supplicant -- multiple vulnerabilities hostapd 2.4_1 wpa_supplicant 2.4_3

Jouni Malinen reports:

WPS UPnP vulnerability with HTTP chunked transfer encoding. (2015-2 - CVE-2015-4141)

Integer underflow in AP mode WMM Action frame processing. (2015-3 - CVE-2015-4142)

EAP-pwd missing payload length validation. (2015-4 - CVE-2015-4143, CVE-2015-4144, CVE-2015-4145, CVE-2015-4146)

http://w1.fi/security/2015-2/wps-upnp-http-chunked-transfer-encoding.txt http://w1.fi/security/2015-3/integer-underflow-in-ap-mode-wmm-action-frame.txt http://w1.fi/security/2015-4/eap-pwd-missing-payload-length-validation.txt CVE-2015-4141 CVE-2015-4142 CVE-2015-4143 CVE-2015-4144 CVE-2015-4145 CVE-2015-4146 http://openwall.com/lists/oss-security/2015/05/31/6 2015-05-04 2015-06-01 ffmpeg -- multiple vulnerabilities ffmpeg ffmpeg0 0.7.17,1

NVD and Vigilance report:

Use-after-free vulnerability in Google Chrome before 24.0.1312.52 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving seek operations on video data.

An attacker can generate an integer overflow in the av_lzo1x_decode() function of Libav, in order to trigger a denial of service, and possibly to execute code.

libavcodec/mjpegdec.c in FFmpeg before 2.4.2 considers only dimension differences, and not bits-per-pixel differences, when determining whether an image size has changed, which allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted MJPEG data.

libavcodec/utils.c in FFmpeg before 2.4.2 omits a certain codec ID during enforcement of alignment, which allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted JV data.

libavcodec/mmvideo.c in FFmpeg before 2.4.2 does not consider all lines of HHV Intra blocks during validation of image height, which allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted MM video data.

libavcodec/pngdec.c in FFmpeg before 2.4.2 accepts the monochrome-black format without verifying that the bits-per-pixel value is 1, which allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted PNG data.

libavcodec/gifdec.c in FFmpeg before 2.4.2 does not properly compute image heights, which allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted GIF data.

Off-by-one error in libavcodec/smc.c in FFmpeg before 2.4.2 allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted Quicktime Graphics (aka SMC) video data.

The mjpeg_decode_app function in libavcodec/mjpegdec.c in FFMpeg before 2.1.6, 2.2.x through 2.3.x, and 2.4.x before 2.4.4 allows remote attackers to cause a denial of service (out-of-bounds heap access) and possibly have other unspecified impact via vectors related to LJIF tags in an MJPEG file.

The decode_ihdr_chunk function in libavcodec/pngdec.c in FFMpeg before 2.1.6, 2.2.x through 2.3.x, and 2.4.x before 2.4.4 allows remote attackers to cause a denial of service (out-of-bounds heap access) and possibly have other unspecified impact via an IDAT before an IHDR in a PNG file.

The vmd_decode function in libavcodec/vmdvideo.c in FFmpeg before 2.5.2 does not validate the relationship between a certain length value and the frame width, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Sierra VMD video data.

An attacker can force a read at an invalid address in mjpegdec.c of FFmpeg, in order to trigger a denial of service.

CVE-2012-5150 CVE-2014-4609 CVE-2014-8541 CVE-2014-8542 CVE-2014-8543 CVE-2014-8545 CVE-2014-8547 CVE-2014-8548 CVE-2014-9316 CVE-2014-9317 CVE-2014-9603 CVE-2015-1872 https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=c3ece52decafc4923aebe7fd74b274e9ebb1962e https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=1b291e0466308b341bc2e8c2a49d44862400f014 https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=b5e661bcd2bb4fe771cb2c1e21215c68e6a17665 https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=cd3c4d8c55222337b0b59af4ea1fecfb46606e5e https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=73962e677d871fa0dde5385ee04ea07c048d8864 https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=7a5590ef4282e19d48d70cba0bc4628c13ec6fd8 https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=ef32bc8dde52439afd13988f56012a9f4dd55a83 https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=5b2097626d0e4ccb432d7d8ab040aa8dbde9eb3a https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=30e8a375901f8802853fd6d478b77a127d208bd6 https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=cb1db92cca98f963e91f421ee0c84f8866325a73 https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=fac6f744d8170585f05e098ce9c9f27eeffa818e https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=75b0cfcf105c8720a47a2ee80a70ba16799d71b7 https://ffmpeg.org/security.html 2015-03-12 2015-06-02 avidemux26 -- multiple vulnerabilities in bundled FFmpeg avidemux2 2.6.8 avidemux26 2.6.8

The Mageia project reports:

Avidemux is built with a bundled set of FFmpeg libraries. The bundled FFmpeg version has been updated from 1.2.10 to 1.2.12 to fix these security issues and other bugs fixed upstream in FFmpeg.

CVE-2014-9316 CVE-2014-9317 CVE-2014-9603 CVE-2014-9604 CVE-2015-1872 CVE-2015-3417 ports/200507 http://advisories.mageia.org/MGASA-2015-0233.html 2015-05-18 2015-06-01 2015-09-28 rest-client -- plaintext password disclosure rubygem-rest-client 1.6.7_1

The open sourced vulnerability database reports:

REST Client for Ruby contains a flaw that is due to the application logging password information in plaintext. This may allow a local attacker to gain access to password information.

CVE-2015-3448 ports/200504 https://github.com/rest-client/rest-client/issues/349 http://osvdb.org/show/osvdb/117461 2015-01-12 2015-05-31 2015-09-28 rest-client -- session fixation vulnerability rubygem-rest-client 1.6.7_1

Andy Brody reports:

When Ruby rest-client processes an HTTP redirection response, it blindly passes along the values from any Set-Cookie headers to the redirection target, regardless of domain, path, or expiration.

CVE-2015-1820 ports/200504 https://github.com/rest-client/rest-client/issues/369 2015-03-24 2015-05-31 2015-09-28 cabextract -- directory traversal with UTF-8 symbols in filenames cabextract 1.6

Cabextract ChangeLog reports:

It was possible for cabinet files to extract to absolute file locations, and it was possible on Cygwin to get around cabextract's absolute and relative path protections by using backslashes.

http://www.cabextract.org.uk/#changes http://www.openwall.com/lists/oss-security/2015/02/18/3 CVE-2015-2060 2015-02-18 2015-05-31 libmspack -- frame_end overflow which could cause infinite loop libmspack 0.5 cabextract 1.5

There is a denial of service vulnerability in libmspack. The libmspack code is built into cabextract, so it is also vulnerable.

MITRE reports:

Integer overflow in the qtmd_decompress function in libmspack 0.4 allows remote attackers to cause a denial of service (hang) via a crafted CAB file, which triggers an infinite loop.

CVE-2014-9556 https://bugs.debian.org/773041 http://www.openwall.com/lists/oss-security/2015/01/07/2 2014-12-11 2015-05-31 django -- Fixed session flushing in the cached_db backend py27-django 1.81.8.2 py32-django 1.81.8.2 py33-django 1.81.8.2 py34-django 1.81.8.2 py27-django-devel 20150531,1 py32-django-devel 20150531,1 py33-django-devel 20150531,1 py34-django-devel 20150531,1

The Django project reports:

A change to session.flush() in the cached_db session backend in Django 1.8 mistakenly sets the session key to an empty string rather than None. An empty string is treated as a valid session key and the session cookie is set accordingly. Any users with an empty string in their session cookie will use the same session store. session.flush() is called by django.contrib.auth.logout() and, more seriously, by django.contrib.auth.login() when a user switches accounts. If a user is logged in and logs in again to a different account (without logging out) the session is flushed to avoid reuse. After the session is flushed (and its session key becomes '') the account details are set on the session and the session is saved. Any users with an empty string in their session cookie will now be logged into that account.

Thanks to Sam Cooke for reporting the issue.

https://www.djangoproject.com/weblog/2015/may/20/security-release/ CVE-2015-3982 2015-05-20 2015-05-31 proxychains-ng -- current path as the first directory for the library search path proxychains-ng 4.9

Mamoru TASAKA reports:

proxychains4 sets LD_PRELOAD to dlopen libproxychains4.so and execvp() the arbitrary command user has specified. proxychains4 sets the current directory as the first path to search libproxychains4.so

http://openwall.com/lists/oss-security/2015/05/12/6 http://seclists.org/oss-sec/2015/q2/430 CVE-2015-3887 2015-05-11 2015-05-29 wireshark -- multiple vulnerabilities wireshark wireshark-lite tshark tshark-lite 1.12.5

Wireshark development team reports:

The following vulnerabilities have been fixed.

wnpa-sec-2015-12

The LBMR dissector could go into an infinite loop. (Bug 11036) CVE-2015-3808, CVE-2015-3809

wnpa-sec-2015-13

The WebSocket dissector could recurse excessively. (Bug 10989) CVE-2015-3810

wnpa-sec-2015-14

The WCP dissector could crash while decompressing data. (Bug 10978) CVE-2015-3811

wnpa-sec-2015-15

The X11 dissector could leak memory. (Bug 11088) CVE-2015-3812

wnpa-sec-2015-16

The packet reassembly code could leak memory. (Bug 11129) CVE-2015-3813

wnpa-sec-2015-17

The IEEE 802.11 dissector could go into an infinite loop. (Bug 11110) CVE-2015-3814

wnpa-sec-2015-18

The Android Logcat file parser could crash. Discovered by Hanno Böck. (Bug 11188) CVE-2015-3815

CVE-2015-3808 CVE-2015-3809 CVE-2015-3810 CVE-2015-3811 CVE-2015-3812 CVE-2015-3813 CVE-2015-3814 CVE-2015-3815 https://www.wireshark.org/docs/relnotes/wireshark-1.12.5.html https://www.wireshark.org/security/wnpa-sec-2015-12.html https://www.wireshark.org/security/wnpa-sec-2015-13.html https://www.wireshark.org/security/wnpa-sec-2015-14.html https://www.wireshark.org/security/wnpa-sec-2015-15.html https://www.wireshark.org/security/wnpa-sec-2015-16.html https://www.wireshark.org/security/wnpa-sec-2015-17.html https://www.wireshark.org/security/wnpa-sec-2015-18.html 2015-05-12 2015-05-28 krb5 -- requires_preauth bypass in PKINIT-enabled KDC krb5 1.13.2 krb5-112 1.12.3_2

MIT reports:

In MIT krb5 1.12 and later, when the KDC is configured with PKINIT support, an unauthenticated remote attacker can bypass the requires_preauth flag on a client principal and obtain a ciphertext encrypted in the principal's long-term key. This ciphertext could be used to conduct an off-line dictionary attack against the user's password.

CVE-2015-2694 http://krbdev.mit.edu/rt/Ticket/Display.html?id=8160 2015-05-25 2015-05-28 cURL -- sensitive HTTP server headers also sent to proxies curl 7.42.1

cURL reports:

libcurl provides applications a way to set custom HTTP headers to be sent to the server by using CURLOPT_HTTPHEADER. A similar option is available for the curl command-line tool with the '--header' option.

When the connection passes through an HTTP proxy the same set of headers is sent to the proxy as well by default. While this is by design, it has not necessarily been clear nor understood by application programmers.

CVE-2015-3153 http://curl.haxx.se/docs/adv_20150429.html 2015-04-29 2015-05-26 cURL -- multiple vulnerabilities curl 7.42.0

cURL reports:

libcurl keeps a pool of its last few connections around after use to fascilitate easy, conventient and completely transparent connection re-use for applications.

When doing HTTP requests NTLM authenticated, the entire connnection becomes authenticated and not just the specific HTTP request which is otherwise how HTTP works. This makes NTLM special and a subject for special treatment in the code. With NTLM, once the connection is authenticated, no further authentication is necessary until the connection gets closed.

When doing HTTP requests Negotiate authenticated, the entire connnection may become authenticated and not just the specific HTTP request which is otherwise how HTTP works, as Negotiate can basically use NTLM under the hood. curl was not adhering to this fact but would assume that such requests would also be authenticated per request.

libcurl supports HTTP "cookies" as documented in RFC 6265. Together with each individual cookie there are several different properties, but for this vulnerability we focus on the associated "path" element. It tells information about for which path on a given host the cookies is valid.

The internal libcurl function called sanitize_cookie_path() that cleans up the path element as given to it from a remote site or when read from a file, did not properly validate the input. If given a path that consisted of a single double-quote, libcurl would index a newly allocated memory area with index -1 and assign a zero to it, thus destroying heap memory it wasn't supposed to.

There is a private function in libcurl called fix_hostname() that removes a trailing dot from the host name if there is one. The function is called after the host name has been extracted from the URL libcurl has been told to act on.

If a URL is given with a zero-length host name, like in "http://:80" or just ":80", fix_hostname() will index the host name pointer with a -1 offset (as it blindly assumes a non-zero length) and both read and assign that address.

http://curl.haxx.se/docs/adv_20150422A.html http://curl.haxx.se/docs/adv_20150422B.html http://curl.haxx.se/docs/adv_20150422C.html http://curl.haxx.se/docs/adv_20150422D.html CVE-2014-3143 CVE-2014-3144 CVE-2014-3145 CVE-2014-3148 2015-04-22 2015-05-26 cassandra -- remote execution of arbitrary code cassandra 1.2.01.2.19 cassandra2 2.0.02.0.14 2.1.02.1.4

Jake Luciani reports:

Under its default configuration, Cassandra binds an unauthenticated JMX/RMI interface to all network interfaces. As RMI is an API for the transport and remote execution of serialized Java, anyone with access to this interface can execute arbitrary code as the running user.

Mitigation:

1.2.x has reached EOL, so users of <= 1.2.x are recommended to upgrade to a supported version of Cassandra, or manually configure encryption and authentication of JMX, (see https://wiki.apache.org/cassandra/JmxSecurity).

2.0.x users should upgrade to 2.0.14

2.1.x users should upgrade to 2.1.4

Alternately, users of any version not wishing to upgrade can reconfigure JMX/RMI to enable encryption and authentication according to https://wiki.apache.org/cassandra/JmxSecurityor http://docs.oracle.com/javase/7/docs/technotes/guides/management/agent.html

Credit:

This issue was discovered by Georgi Geshev of MWR InfoSecurity

http://mail-archives.apache.org/mod_mbox/cassandra-dev/201504.mbox/raw/%3CCALamADJu4yo=cO8HgA6NpgFc1wQN_VNqpkMn-3SZwhPq9foLBw@mail.gmail.com%3E/ CVE-2015-0225 2015-04-01 2015-05-24 py-salt -- potential shell injection vulnerabilities py27-salt 2015.5.0

Colton Myers reports:

In order to fix potential shell injection vulnerabilities in salt modules, a change has been made to the various cmd module functions. These functions now default to python_shell=False, which means that the commands will not be sent to an actual shell.

The largest side effect of this change is that "shellisms", such as pipes, will not work by default. The modules shipped with salt have been audited to fix any issues that might have arisen from this change. Additionally, the cmd state module has been unaffected, and use of cmd.run in jinja is also unaffected. cmd.run calls on the CLI will also allow shellisms.

However, custom execution modules which use shellisms in cmd calls will break, unless you pass python_shell=True to these calls.

As a temporary workaround, you can set cmd_safe: False in your minion and master configs. This will revert the default, but is also less secure, as it will allow shell injection vulnerabilities to be written in custom code. We recommend you only set this setting for as long as it takes to resolve these issues in your custom code, then remove the override.

http://docs.saltstack.com/en/latest/topics/releases/2015.5.0.html 2015-05-11 2015-05-24 davmail -- fix potential CVE-2014-3566 vulnerability (POODLE) davmail 4.6.0

Mickaël Guessant reports:

DavMail 4.6.0 released

Enhancements: Fix potential CVE-2014-3566 vulnerability.

http://sourceforge.net/p/davmail/mailman/message/33279118/ http://sourceforge.net/p/davmail/code/2322/ CVE-2014-3566 2014-10-27 2015-05-23 dnsmasq -- remotely exploitable buffer overflow in release candidate dnsmasq-devel 2.73rc62.73rc8

Simon Kelley reports:

Anyone running 2.[73]rc6 or 2.[73]rc7 should be aware that there's a remotely exploitable buffer overflow in those trees. I just tagged 2.[73]rc8, which includes the fix.

(Corrections from second URL.)

http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2015q2/009529.html http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2015q2/009535.html 2015-05-15 2015-05-23 dnsmasq -- data exposure and denial of service dnsmasq 2.72_1 dnsmasq-devel 2.73rc4

Nick Sampanis reported a potential memory exposure and denial of service vulnerability against dnsmasq 2.72. The CVE entry summarizes this as:

The tcp_request function in Dnsmasq before 2.73rc4 does not properly handle the return value of the setup_reply function, which allows remote attackers to read process memory and cause a denial of service (out-of-bounds read and crash) via a malformed DNS request."

http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2015q2/009382.html CVE-2015-3294 http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commitdiff;h=ad4a8ff7d9097008d7623df8543df435bfddeac8 2015-04-07 2015-05-23 pcre -- multiple vulnerabilities pcre 8.37

PCRE development team reports:

A pattern such as "((?2){0,1999}())?", which has a group containing a forward reference repeated a large (but limited) number of times within a repeated outer group that has a zero minimum quantifier, caused incorrect code to be compiled, leading to the error "internal error: previously-checked referenced subpattern not found" when an incorrect memory address was read. This bug was reported as "heap overflow", discovered by Kai Lu of Fortinet's FortiGuard Labs and given the CVE number CVE-2015-2325.

A pattern such as "((?+1)(\1))/" containing a forward reference subroutine call within a group that also contained a recursive back reference caused incorrect code to be compiled. This bug was reported as "heap overflow", discovered by Kai Lu of Fortinet's FortiGuard Labs, and given the CVE number CVE-2015-2326.

CVE-2015-2325 CVE-2015-2326 http://www.pcre.org/original/changelog.txt 2015-04-28 2015-05-22 2015-06-07 php -- multiple vulnerabilities php5 5.4.41 php55 5.5.25 php56 5.6.9

PHP development team reports:

Fixed bug #69364 (PHP Multipart/form-data remote DoS Vulnerability). (CVE-2015-4024)

Fixed bug #69418 (CVE-2006-7243 fix regressions in 5.4+). (CVE-2015-4025)

Fixed bug #69545 (Integer overflow in ftp_genlist() resulting in heap overflow). (CVE-2015-4022)

Fixed bug #68598 (pcntl_exec() should not allow null char). (CVE-2015-4026)

Fixed bug #69453 (Memory Corruption in phar_parse_tarfile when entry filename starts with null). (CVE-2015-4021)

CVE-2015-4021 CVE-2015-4022 CVE-2015-4024 CVE-2015-4025 CVE-2015-4026 https://php.net/ChangeLog-5.php#5.6.9 2015-05-14 2015-05-22 PostgreSQL -- minor security problems. postgresql90-server 9.0.09.0.20 postgresql91-server 9.1.09.1.16 postgresql92-server 9.2.09.2.11 postgresql93-server 9.3.09.3.7 postgresql94-server 9.4.09.4.2

PostgreSQL project reports:

This update fixes three security vulnerabilities reported in PostgreSQL over the past few months. Nether of these issues is seen as particularly urgent. However, users should examine them in case their installations are vulnerable:.

CVE-2015-3165 Double "free" after authentication timeout.

CVE-2015-3166 Unanticipated errors from the standard library.

CVE-2015-3167 pgcrypto has multiple error messages for decryption with an incorrect key.

CVE-2015-3165 CVE-2015-3166 CVE-2015-3167 2015-04-10 2015-05-22 proftpd -- arbitrary code execution vulnerability with chroot proftpd 1.3.5_7

ProFTPd development team reports:

Vadim Melihow reported a critical issue with proftpd installations that use the mod_copy module's SITE CPFR/SITE CPTO commands; mod_copy allows these commands to be used by *unauthenticated clients*.

CVE-2015-3306 http://bugs.proftpd.org/show_bug.cgi?id=4169 2015-04-15 2015-05-20 ipsec-tools -- Memory leak leading to denial of service ipsec-tools 0.8.2_1

Javantea reports:

It is a null dereference crash, leading to denial of service against the IKE daemon.

https://www.altsci.com/ipsec/ 2015-05-18 2015-05-19 chromium -- multiple vulnerabilities chromium 43.0.2357.65 chromium-npapi 43.0.2357.65 chromium-pulse 43.0.2357.65

Google Chrome Releases reports:

37 security fixes in this release, including:

[474029] High CVE-2015-1252: Sandbox escape in Chrome. Credit to anonymous.

[464552] High CVE-2015-1253: Cross-origin bypass in DOM. Credit to anonymous.

[444927] High CVE-2015-1254: Cross-origin bypass in Editing. Credit to armin@rawsec.net.

[473253] High CVE-2015-1255: Use-after-free in WebAudio. Credit to Khalil Zhani.

[478549] High CVE-2015-1256: Use-after-free in SVG. Credit to Atte Kettunen of OUSPG.

[481015] High CVE-2015-1251: Use-after-free in Speech. Credit to SkyLined working with HP's Zero Day Initiative.

[468519] Medium CVE-2015-1257: Container-overflow in SVG. Credit to miaubiz.

[450939] Medium CVE-2015-1258: Negative-size parameter in libvpx. Credit to cloudfuzzer

[468167] Medium CVE-2015-1259: Uninitialized value in PDFium. Credit to Atte Kettunen of OUSPG

[474370] Medium CVE-2015-1260: Use-after-free in WebRTC. Credit to Khalil Zhani.

[466351] Medium CVE-2015-1261: URL bar spoofing. Credit to Juho Nurminen.

[476647] Medium CVE-2015-1262: Uninitialized value in Blink. Credit to miaubiz.

[479162] Low CVE-2015-1263: Insecure download of spellcheck dictionary. Credit to Mike Ruddy.

[481015] Low CVE-2015-1264: Cross-site scripting in bookmarks. Credit to K0r3Ph1L.

[489518] CVE-2015-1265: Various fixes from internal audits, fuzzing and other initiatives.

Multiple vulnerabilities in V8 fixed at the tip of the 4.3 branch (currently 4.3.61.21).

http://googlechromereleases.blogspot.nl/2015/05/stable-channel-update_19.html CVE-2015-1251 CVE-2015-1252 CVE-2015-1253 CVE-2015-1254 CVE-2015-1255 CVE-2015-1256 CVE-2015-1257 CVE-2015-1258 CVE-2015-1259 CVE-2015-1260 CVE-2015-1261 CVE-2015-1262 CVE-2015-1263 CVE-2015-1264 CVE-2015-1265 2015-05-19 2015-05-19 clamav -- multiple vulnerabilities clamav 0.98.7 clamav-devel 0

ClamAV project reports:

ClamAV 0.98.7 is here! This release contains new scanning features and bug fixes.

Fix infinite loop condition on crafted y0da cryptor file. Identified and patch suggested by Sebastian Andrzej Siewior. CVE-2015-2221.

Fix crash on crafted petite packed file. Reported and patch supplied by Sebastian Andrzej Siewior. CVE-2015-2222.

Fix an infinite loop condition on a crafted "xz" archive file. This was reported by Dimitri Kirchner and Goulven Guiheux. CVE-2015-2668.

Apply upstream patch for possible heap overflow in Henry Spencer's regex library. CVE-2015-2305.

Fix crash in upx decoder with crafted file. Discovered and patch supplied by Sebastian Andrzej Siewior. CVE-2015-2170.

CVE-2015-2170 CVE-2015-2221 CVE-2015-2222 CVE-2015-2305 CVE-2015-2668 http://blog.clamav.net/2015/04/clamav-0987-has-been-released.html 2015-04-29 2015-05-19 rubygems -- request hijacking vulnerability ruby20-gems 2.4.7 ruby21-gems 2.4.7 ruby22-gems 2.4.7

Jonathan Claudius reports:

RubyGems provides the ability of a domain to direct clients to a separate host that is used to fetch gems and make API calls against. This mechanism is implemented via DNS, specificly a SRV record _rubygems._tcp under the original requested domain.

RubyGems did not validate the hostname returned in the SRV record before sending requests to it. This left clients open to a DNS hijack attack, whereby an attacker could return a SRV of their choosing and get the client to use it.

ports/200264 CVE-2015-3900 http://blog.rubygems.org/2015/05/14/CVE-2015-3900.html 2015-05-14 2015-05-17 qemu, xen and VirtualBox OSE -- possible VM escape and code execution ("VENOM") qemu qemu-devel 0.11.1_19 0.122.3.0_1 qemu-sbruno 2.3.50.g20150501_1 virtualbox-ose 4.3.28 xen-tools 4.5.04.5.0_5

Jason Geffner, CrowdStrike Senior Security Researcher reports:

VENOM, CVE-2015-3456, is a security vulnerability in the virtual floppy drive code used by many computer virtualization platforms. This vulnerability may allow an attacker to escape from the confines of an affected virtual machine (VM) guest and potentially obtain code-execution access to the host. Absent mitigation, this VM escape could open access to the host system and all other VMs running on that host, potentially giving adversaries significant elevated access to the host's local network and adjacent systems.

CVE-2015-3456 ports/200255 ports/200256 ports/200257 http://venom.crowdstrike.com/ http://www.oracle.com/technetwork/topics/security/alert-cve-2015-3456-2542656.html http://xenbits.xen.org/xsa/advisory-133.html 2015-04-29 2015-05-17 2015-09-28 Quassel IRC -- SQL injection vulnerability quassel 0.11.1

Quassel IRC developers report:

Restarting a PostgreSQL database while Quassel Core is running would not properly re-initialize the database session inside Quassel, bringing back an old security issue (CVE-2013-4422).

https://github.com/quassel/quassel/commit/6605882f41331c80f7ac3a6992650a702ec71283 CVE-2015-3427 2015-04-23 2015-05-16 rubygem-redcarpet -- XSS vulnerability rubygem-redcarpet 3.2.3

Daniel LeCheminant reports:

When markdown is being presented as HTML, there seems to be a strange interaction between _ and @ that lets an attacker insert malicious tags.

http://openwall.com/lists/oss-security/2015/04/07/11 https://hackerone.com/reports/46916 http://danlec.com/blog/bug-in-sundown-and-redcarpet 2015-04-07 2015-05-14 dcraw -- integer overflow condition cinepaint 0.22.0 darktable 1.6.7 dcraw 7.009.26 dcraw-m 0 exact-image 0.9.1 flphoto 0 freeimage 3.13.03.16.0_1 kodi 14.2_1 libraw 0.16.1 lightzone 4.1.2 netpbm 10.35.96 opengtl 0 rawstudio 2.0_11 ufraw 0.21

ocert reports:

The dcraw tool, as well as several other projects re-using its code, suffers from an integer overflow condition which lead to a buffer overflow.

The vulnerability concerns the 'len' variable, parsed without validation from opened images, used in the ljpeg_start() function.

A maliciously crafted raw image file can be used to trigger the vulnerability, causing a Denial of Service condition.

CVE-2015-3885 http://www.ocert.org/advisories/ocert-2015-006.html https://github.com/rawstudio/rawstudio/commit/983bda1f0fa5fa86884381208274198a620f006e https://github.com/LibRaw/LibRaw/commit/4606c28f494a750892c5c1ac7903e62dd1c6fdb5 https://sourceforge.net/p/netpbm/code/2512/ 2015-04-24 2015-05-15 2016-01-08 phpMyAdmin -- XSRF and man-in-the-middle vulnerabilities phpMyAdmin 4.4.04.4.6.1

The phpMyAdmin development team reports:

XSRF/CSRF vulnerability in phpMyAdmin setup.

By deceiving a user to click on a crafted URL, it is possible to alter the configuration file being generated with phpMyAdmin setup.

This vulnerability only affects the configuration file generation process and does not affect the effective configuration file. Moreover, the configuration file being generated is at risk only during the period when it's writable.

Vulnerability allowing man-in-the-middle attack on API call to GitHub.

A vulnerability in the API call to GitHub can be exploited to perform a man-in-the-middle attack.

We consider this vulnerability to be serious.

http://www.phpmyadmin.net/home_page/security/PMASA-2015-2.php http://www.phpmyadmin.net/home_page/security/PMASA-2015-3.php CVE-2015-3902 CVE-2015-3903 2015-05-13 2015-05-13 Adobe Flash Player -- critical vulnerabilities linux-c6-flashplugin 11.2r202.457 linux-f10-flashplugin 11.2r202.457

Adobe reports:

Adobe has released security updates for Adobe Flash Player for Windows, Macintosh and Linux. These updates address vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe recommends users update their product installations to the latest versions.

These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2015-3078, CVE-2015-3089, CVE-2015-3090, CVE-2015-3093).

These updates resolve a heap overflow vulnerability that could lead to code execution (CVE-2015-3088).

These updates resolve a time-of-check time-of-use (TOCTOU) race condition that could be exploited to bypass Protected Mode in Internet Explorer (CVE-2015-3081).

These updates resolve validation bypass issues that could be exploited to write arbitrary data to the file system under user permissions (CVE-2015-3082, CVE-2015-3083, CVE-2015-3085).

These updates resolve an integer overflow vulnerability that could lead to code execution (CVE-2015-3087).

These updates resolve a type confusion vulnerability that could lead to code execution (CVE-2015-3077, CVE-2015-3084, CVE-2015-3086).

These updates resolve a use-after-free vulnerability that could lead to code execution (CVE-2015-3080).

These updates resolve memory leak vulnerabilities that could be used to bypass ASLR (CVE-2015-3091, CVE-2015-3092).

These updates resolve a security bypass vulnerability that could lead to information disclosure (CVE-2015-3079), and provide additional hardening to protect against CVE-2015-3044.

CVE-2015-3044 CVE-2015-3077 CVE-2015-3078 CVE-2015-3079 CVE-2015-3080 CVE-2015-3081 CVE-2015-3082 CVE-2015-3083 CVE-2015-3084 CVE-2015-3085 CVE-2015-3086 CVE-2015-3087 CVE-2015-3088 CVE-2015-3089 CVE-2015-3090 CVE-2015-3091 CVE-2015-3092 CVE-2015-3093 https://helpx.adobe.com/security/products/flash-player/apsb15-09.html 2015-05-12 2015-05-13 mozilla -- multiple vulnerabilities firefox 38.0,1 linux-firefox 38.0,1 seamonkey 2.35 linux-seamonkey 2.35 firefox-esr 31.7.0,1 libxul 31.7.0 32.038.0 thunderbird 31.7.0 32.038.0 linux-thunderbird 31.7.0 32.038.0

The Mozilla Project reports:

MFSA-2015-46 Miscellaneous memory safety hazards (rv:38.0 / rv:31.7)

MFSA-2015-47 Buffer overflow parsing H.264 video with Linux Gstreamer

MFSA-2015-48 Buffer overflow with SVG content and CSS

MFSA-2015-49 Referrer policy ignored when links opened by middle-click and context menu

MFSA-2015-50 Out-of-bounds read and write in asm.js validation

MFSA-2015-51 Use-after-free during text processing with vertical text enabled

MFSA-2015-52 Sensitive URL encoded information written to Android logcat

MFSA-2015-53 Use-after-free due to Media Decoder Thread creation during shutdown

MFSA-2015-54 Buffer overflow when parsing compressed XML

MFSA-2015-55 Buffer overflow and out-of-bounds read while parsing MP4 video metadata

MFSA-2015-56 Untrusted site hosting trusted page can intercept webchannel responses

MFSA-2015-57 Privilege escalation through IPC channel messages

MFSA-2015-58 Mozilla Windows updater can be run outside of application directory

MFSA 2015-93 Integer overflows in libstagefright while processing MP4 video metadata

CVE-2011-3079 CVE-2015-0797 CVE-2015-0833 CVE-2015-2708 CVE-2015-2709 CVE-2015-2710 CVE-2015-2711 CVE-2015-2712 CVE-2015-2713 CVE-2015-2714 CVE-2015-2715 CVE-2015-2716 CVE-2015-2717 CVE-2015-2718 CVE-2015-2720 CVE-2015-4496 https://www.mozilla.org/security/advisories/mfsa2015-46/ https://www.mozilla.org/security/advisories/mfsa2015-47/ https://www.mozilla.org/security/advisories/mfsa2015-48/ https://www.mozilla.org/security/advisories/mfsa2015-49/ https://www.mozilla.org/security/advisories/mfsa2015-50/ https://www.mozilla.org/security/advisories/mfsa2015-51/ https://www.mozilla.org/security/advisories/mfsa2015-52/ https://www.mozilla.org/security/advisories/mfsa2015-53/ https://www.mozilla.org/security/advisories/mfsa2015-54/ https://www.mozilla.org/security/advisories/mfsa2015-55/ https://www.mozilla.org/security/advisories/mfsa2015-56/ https://www.mozilla.org/security/advisories/mfsa2015-57/ https://www.mozilla.org/security/advisories/mfsa2015-58/ https://www.mozilla.org/security/advisories/mfsa2015-93/ 2015-05-12 2015-05-12 2015-08-28 suricata -- TLS/DER Parser Bug (DoS) suricata 2.0.8

OISF Development Team reports:

The OISF development team is pleased to announce Suricata 2.0.8. This release fixes a number of issues in the 2.0 series.

The most important issue is a bug in the DER parser which is used to decode SSL/TLS certificates could crash Suricata. This issue was reported by Kostya Kortchinsky of the Google Security Team and was fixed by Pierre Chifflier of ANSSI.

Those processing large numbers of (untrusted) pcap files need to update as a malformed pcap could crash Suricata. Again, credits go to Kostya Kortchinsky.

CVE-2015-0971 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0971 https://github.com/inliniac/suricata/commit/fa73a0bb8f312fd0a95cc70f6b3ee4e4997bdba7 2015-05-06 2015-05-12 libssh -- null pointer dereference libssh 0.6.5

Andreas Schneider reports:

libssh versions 0.5.1 and above have a logical error in the handling of a SSH_MSG_NEWKEYS and SSH_MSG_KEXDH_REPLY package. A detected error did not set the session into the error state correctly and further processed the packet which leads to a null pointer dereference. This is the packet after the initial key exchange and doesn’t require authentication.

This could be used for a Denial of Service (DoS) attack.

CVE-2015-3146 https://www.libssh.org/2015/04/30/libssh-0-6-5-security-and-bugfix-release 2015-04-30 2015-05-10 Vulnerablitiy in HWP document filter libreoffice 4.3.7 apache-openoffice 4.1.1_9 apache-openoffice-devel 4.2.1677190,3

US-CERT/NIST reports:

The HWP filter in LibreOffice before 4.3.7 and 4.4.x before 4.4.2 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted HWP document, which triggers an out-of-bounds write.

CVE-2015-1774 http://www.openoffice.org/security/cves/CVE-2015-1774.html https://www.libreoffice.org/about-us/security/advisories/cve-2015-1774/ 2015-04-27 2015-05-07 wordpress -- 2 cross-site scripting vulnerabilities wordpress 4.2.2,1 de-wordpress 4.2.2 ja-wordpress 4.2.2 ru-wordpress 4.2.2 zh-wordpress-zh_CN 4.2.2 zh-wordpress-zh_TW 4.2.2

Samuel Sidler reports:

The Genericons icon font package, which is used in a number of popular themes and plugins, contained an HTML file vulnerable to a cross-site scripting attack. All affected themes and plugins hosted on WordPress.org (including the Twenty Fifteen default theme) have been updated today by the WordPress security team to address this issue by removing this nonessential file. To help protect other Genericons usage, WordPress 4.2.2 proactively scans the wp-content directory for this HTML file and removes it. Reported by Robert Abela of Netsparker.

WordPress versions 4.2 and earlier are affected by a critical cross-site scripting vulnerability, which could enable anonymous users to compromise a site. WordPress 4.2.2 includes a comprehensive fix for this issue.

The release also includes hardening for a potential cross-site scripting vulnerability when using the visual editor. This issue was reported by Mahadev Subedi.

https://wordpress.org/news/2015/05/wordpress-4-2-2/ 2015-05-07 2015-05-07 2015-09-15 wordpress -- cross-site scripting vulnerability wordpress 4.2.1,1 de-wordpress 4.2.1 ja-wordpress 4.2.1 ru-wordpress 4.2.1 zh-wordpress-zh_CN 4.2.1 zh-wordpress-zh_TW 4.2.1

Gary Pendergast reports:

WordPress 4.2.1 is now available. This is a critical security release for all previous versions and we strongly encourage you to update your sites immediately.

A few hours ago, the WordPress team was made aware of a cross-site scripting vulnerability, which could enable commenters to compromise a site. The vulnerability was discovered by Jouko Pynnöne.

https://wordpress.org/news/2015/04/wordpress-4-2-1/ 2015-04-27 2015-05-07 2015-09-15 powerdns -- Label decompression bug can cause crashes or CPU spikes powerdns 3.4.5 powerdns-recursor 3.7.3

The PowerDNS project reports:

A bug was discovered in our label decompression code, making it possible for names to refer to themselves, thus causing a loop during decompression. On some platforms, this bug can be abused to cause crashes. On all platforms, this bug can be abused to cause service-affecting CPU spikes.

CVE-2015-1868 CVE-2015-5470 https://doc.powerdns.com/md/security/powerdns-advisory-2015-01/ http://www.openwall.com/lists/oss-security/2015/07/10/8 2015-04-23 2015-05-01 2015-07-12 chromium -- multiple vulnerabilities chromium 42.0.2311.135 chromium-npapi 42.0.2311.135 chromium-pulse 42.0.2311.135

Google Chrome Releases reports:

5 security fixes in this release, including:

[453279] High CVE-2015-1243: Use-after-free in DOM. Credit to Saif El-Sherei.

[481777] CVE-2015-1250: Various fixes from internal audits, fuzzing and other initiatives.

CVE-2015-1243 CVE-2015-1250 http://googlechromereleases.blogspot.nl/2015/04/stable-channel-update_28.html 2015-04-28 2015-04-28 chromium -- multiple vulnerabilities chromium 42.0.2311.90 chromium-npapi 42.0.2311.90 chromium-pulse 42.0.2311.90

Google Chrome Releases reports:

45 new security fixes, including:

[456518] High CVE-2015-1235: Cross-origin-bypass in HTML parser. Credit to anonymous.

[313939] Medium CVE-2015-1236: Cross-origin-bypass in Blink. Credit to Amitay Dobo.

[461191] High CVE-2015-1237: Use-after-free in IPC. Credit to Khalil Zhani.

[445808] High CVE-2015-1238: Out-of-bounds write in Skia. Credit to cloudfuzzer.

[463599] Medium CVE-2015-1240: Out-of-bounds read in WebGL. Credit to w3bd3vil.

[418402] Medium CVE-2015-1241: Tap-Jacking. Credit to Phillip Moon and Matt Weston of Sandfield Information Systems.

[460917] High CVE-2015-1242: Type confusion in V8. Credit to fcole@onshape.com.

[455215] Medium CVE-2015-1244: HSTS bypass in WebSockets. Credit to Mike Ruddy.

[444957] Medium CVE-2015-1245: Use-after-free in PDFium. Credit to Khalil Zhani.

[437399] Medium CVE-2015-1246: Out-of-bounds read in Blink. Credit to Atte Kettunen of OUSPG.

[429838] Medium CVE-2015-1247: Scheme issues in OpenSearch. Credit to Jann Horn.

[380663] Medium CVE-2015-1248: SafeBrowsing bypass. Credit to Vittorio Gambaletta (VittGam).

[476786] CVE-2015-1249: Various fixes from internal audits, fuzzing and other initiatives. Multiple vulnerabilities in V8 fixed at the tip of the 4.2 branch (currently 4.2.77.14).

http://googlechromereleases.blogspot.nl/2015/04/stable-channel-update_14.html CVE-2015-1235 CVE-2015-1236 CVE-2015-1237 CVE-2015-1238 CVE-2015-1240 CVE-2015-1241 CVE-2015-1242 CVE-2015-1244 CVE-2015-1245 CVE-2015-1246 CVE-2015-1247 CVE-2015-1248 CVE-2015-1249 2015-04-14 2015-04-27 wpa_supplicant -- P2P SSID processing vulnerability wpa_supplicant 2.4_1

Jouni Malinen reports:

A vulnerability was found in how wpa_supplicant uses SSID information parsed from management frames that create or update P2P peer entries (e.g., Probe Response frame or number of P2P Public Action frames). SSID field has valid length range of 0-32 octets. However, it is transmitted in an element that has a 8-bit length field and potential maximum payload length of 255 octets. wpa_supplicant was not sufficiently verifying the payload length on one of the code paths using the SSID received from a peer device.

This can result in copying arbitrary data from an attacker to a fixed length buffer of 32 bytes (i.e., a possible overflow of up to 223 bytes). The SSID buffer is within struct p2p_device that is allocated from heap. The overflow can override couple of variables in the struct, including a pointer that gets freed. In addition about 150 bytes (the exact length depending on architecture) can be written beyond the end of the heap allocation.

This could result in corrupted state in heap, unexpected program behavior due to corrupted P2P peer device information, denial of service due to wpa_supplicant process crash, exposure of memory contents during GO Negotiation, and potentially arbitrary code execution.

Vulnerable versions/configurations

wpa_supplicant v1.0-v2.4 with CONFIG_P2P build option enabled (which is not compiled by default).

Attacker (or a system controlled by the attacker) needs to be within radio range of the vulnerable system to send a suitably constructed management frame that triggers a P2P peer device information to be created or updated.

The vulnerability is easiest to exploit while the device has started an active P2P operation (e.g., has ongoing P2P_FIND or P2P_LISTEN control interface command in progress). However, it may be possible, though significantly more difficult, to trigger this even without any active P2P operation in progress.

CVE-2015-1863 http://w1.fi/security/2015-1/wpa_supplicant-p2p-ssid-overflow.txt 2015-04-22 2015-04-25 Several vulnerabilities found in PHP php5 5.4.40 php55 5.5.24 php56 5.6.8

The PHP project reports:

The PHP development team announces the immediate availability of PHP 5.4.40. 14 security-related bugs were fixed in this release, including CVE-2014-9709, CVE-2015-2301, CVE-2015-2783, CVE-2015-1352. All PHP 5.4 users are encouraged to upgrade to this version.

The PHP development team announces the immediate availability of PHP 5.5.24. Several bugs have been fixed some of them beeing security related, like CVE-2015-1351 and CVE-2015-1352. All PHP 5.5 users are encouraged to upgrade to this version.

The PHP development team announces the immediate availability of PHP 5.6.8. Several bugs have been fixed some of them beeing security related, like CVE-2015-1351 and CVE-2015-1352. All PHP 5.6 users are encouraged to upgrade to this version.

http://php.net/archive/2015.php#id2015-04-16-2 CVE-2014-9709 CVE-2015-2301 CVE-2015-2783 CVE-2015-1351 CVE-2015-1352 ports/199585 2015-04-16 2015-04-25 2015-05-22 wordpress -- multiple vulnabilities wordpress 4.1.2 de-wordpress 4.1.2 ja-wordpress 4.1.2 ru-wordpress 4.1.2 zh-wordpress-zh_CN 4.1.2 zh-wordpress-zh_TW 4.1.2

Gary Pendergast reports:

WordPress 4.1.2 is now available. This is a critical security release for all previous versions and we strongly encourage you to update your sites immediately.

WordPress versions 4.1.1 and earlier are affected by a critical cross-site scripting vulnerability, which could enable anonymous users to compromise a site. This was reported by Cedric Van Bockhaven and fixed by Gary Pendergast, Mike Adams, and Andrew Nacin of the WordPress security team.

We also fixed three other security issues:

In WordPress 4.1 and higher, files with invalid or unsafe names could be uploaded. Discovered by Michael Kapfer and Sebastian Kraemer of HSASec.

In WordPress 3.9 and higher, a very limited cross-site scripting vulnerability could be used as part of a social engineering attack. Discovered by Jakub Zoczek.

Some plugins were vulnerable to an SQL injection vulnerability. Discovered by Ben Bidner of the WordPress security team.

We also made four hardening changes, discovered by J.D. Grimes, Divyesh Prajapati, Allan Collins, Marc-Alexandre Montpas and Jeff Bowen.

https://wordpress.org/news/2015/04/wordpress-4-1-2/ 2015-04-21 2015-04-24 2015-04-24 libtasn1 -- stack-based buffer overflow in asn1_der_decoding libtasn1 4.4

Debian reports:

Hanno Boeck discovered a stack-based buffer overflow in the asn1_der_decoding function in Libtasn1, a library to manage ASN.1 structures. A remote attacker could take advantage of this flaw to cause an application using the Libtasn1 library to crash, or potentially to execute arbitrary code.

CVE-2015-2806 https://www.debian.org/security/2015/dsa-3220.en.html 2015-04-11 2015-04-22 mozilla -- use-after-free firefox 37.0.2,1 linux-firefox 37.0.2,1

The Mozilla Project reports:

MFSA 2015-45 Memory corruption during failed plugin initialization

CVE-2015-2706 https://www.mozilla.org/en-US/security/advisories/mfsa2015-45/ 2015-04-20 2015-04-21 sqlite -- multiple vulnerabilities sqlite3 3.8.9

NVD reports:

SQLite before 3.8.9 does not properly implement the dequoting of collation-sequence names, which allows context-dependent attackers to cause a denial of service (uninitialized memory access and application crash) or possibly have unspecified other impact via a crafted COLLATE clause, as demonstrated by COLLATE"""""""" at the end of a SELECT statement.

The sqlite3VdbeExec function in vdbe.c in SQLite before 3.8.9 does not properly implement comparison operators, which allows context-dependent attackers to cause a denial of service (invalid free operation) or possibly have unspecified other impact via a crafted CHECK clause, as demonstrated by CHECK(0&O>O) in a CREATE TABLE statement.

The sqlite3VXPrintf function in printf.c in SQLite before 3.8.9 does not properly handle precision and width values during floating-point conversions, which allows context-dependent attackers to cause a denial of service (integer overflow and stack-based buffer overflow) or possibly have unspecified other impact via large integers in a crafted printf function call in a SELECT statement.

CVE-2015-3414 CVE-2015-3415 CVE-2015-3416 https://www.sqlite.org/src/info/eddc05e7bb31fae7 https://www.sqlite.org/src/info/02e3c88fbf6abdcf https://www.sqlite.org/src/info/c494171f77dc2e5e http://seclists.org/fulldisclosure/2015/Apr/31 2015-04-14 2015-04-18 2015-05-08 chrony -- multiple vulnerabilities chrony 1.31.1

Chrony News reports:

CVE-2015-1853: DoS attack on authenticated symmetric NTP associations

CVE-2015-1821: Heap-based buffer overflow in access configuration

CVE-2015-1822: Use of uninitialized pointer in command processing

http://chrony.tuxfamily.org/News.html CVE-2015-1821 CVE-2015-1822 CVE-2015-1853 2015-02-17 2015-04-18 Dulwich -- Remote code execution py27-dulwich 0.9.9

MITRE reports:

Buffer overflow in the C implementation of the apply_delta function in _pack.c in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a crafted pack file.

CVE-2015-0838 2015-01-07 2015-04-17 Adobe Flash Player -- critical vulnerabilities linux-c6-flashplugin 11.2r202.451 linux-f10-flashplugin 11.2r202.451

Adobe reports:

Adobe has released security updates for Adobe Flash Player for Windows, Macintosh and Linux. These updates address vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe is aware of a report that an exploit for CVE-2015-3043 exists in the wild, and recommends users update their product installations to the latest versions.

These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2015-0347, CVE-2015-0350, CVE-2015-0352, CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360, CVE-2015-3038, CVE-2015-3041, CVE-2015-3042, CVE-2015-3043).

These updates resolve a type confusion vulnerability that could lead to code execution (CVE-2015-0356).

These updates resolve a buffer overflow vulnerability that could lead to code execution (CVE-2015-0348).

These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2015-0349, CVE-2015-0351, CVE-2015-0358, CVE-2015-3039).

These updates resolve double-free vulnerabilities that could lead to code execution (CVE-2015-0346, CVE-2015-0359).

These updates resolve memory leak vulnerabilities that could be used to bypass ASLR (CVE-2015-0357, CVE-2015-3040).

These updates resolve a security bypass vulnerability that could lead to information disclosure (CVE-2015-3044).

https://helpx.adobe.com/security/products/flash-player/apsb15-06.html CVE-2015-3038 CVE-2015-3039 CVE-2015-3040 CVE-2015-3041 CVE-2015-3042 CVE-2015-3043 CVE-2015-3044 CVE-2015-0346 CVE-2015-0347 CVE-2015-0348 CVE-2015-0349 CVE-2015-0350 CVE-2015-0351 CVE-2015-0352 CVE-2015-0353 CVE-2015-0354 CVE-2015-0355 CVE-2015-0356 CVE-2015-0357 CVE-2015-0358 CVE-2015-0359 CVE-2015-0360 2015-04-14 2015-04-17 Wesnoth -- Remote information disclosure wesnoth wesnoth-devel 1.7.01.12.2

US-CERT/NIST reports:

The WML/Lua API in Battle for Wesnoth 1.7.x through 1.11.x and 1.12.x before 1.12.2 allows remote attackers to read arbitrary files via a crafted (1) campaign or (2) map file.

CVE-2015-0844 2015-04-11 2015-04-17 qt4-imageformats, qt4-gui, qt5-gui -- Multiple Vulnerabilities in Qt Image Format Handling qt4-imageformats 4.8.6_3 qt4-gui 4.8.6_5 qt5-gui 5.4.1_1

Richard J. Moore reports:

Due to two recent vulnerabilities identified in the built-in image format handling code, it was decided that this area required further testing to determine if further issues remained. Fuzzing using afl-fuzz located a number of issues in the handling of BMP, ICO and GIF files. The issues exposed included denial of service and buffer overflows leading to heap corruption. It is possible the latter could be used to perform remote code execution.

http://lists.qt-project.org/pipermail/announce/2015-April/000067.html CVE-2015-1858 CVE-2015-1859 CVE-2015-1860 2015-04-12 2015-04-14 Ruby -- OpenSSL Hostname Verification Vulnerability ruby ruby20 2.0,12.0.0.645,1 ruby ruby21 2.1,12.1.6,1 ruby ruby22 2.2,12.2.2,1

Ruby Developers report:

After reviewing RFC 6125 and RFC 5280, we found multiple violations of matching hostnames and particularly wildcard certificates.

Ruby’s OpenSSL extension will now provide a string-based matching algorithm which follows more strict behavior, as recommended by these RFCs. In particular, matching of more than one wildcard per subject/SAN is no-longer allowed. As well, comparison of these values are now case-insensitive.

https://www.ruby-lang.org/en/news/2015/04/13/ruby-openssl-hostname-matching-vulnerability/ CVE-2015-1855 2015-04-13 2015-04-14 2015-09-23 mailman -- path traversal vulnerability mailman 2.1.20 mailman-with-htdig 2.1.20 ja-mailman 2.1.14.j7_2,1

Mark Sapiro reports:

A path traversal vulnerability has been discovered and fixed. This vulnerability is only exploitable by a local user on a Mailman server where the suggested Exim transport, the Postfix postfix_to_mailman.py transport or some other programmatic MTA delivery not using aliases is employed.

https://mail.python.org/pipermail/mailman-announce/2015-March/000209.html https://bugs.launchpad.net/mailman/+bug/1437145 CVE-2015-2775 2015-03-27 2015-04-09 2015-06-17 asterisk -- TLS Certificate Common name NULL byte exploit asterisk 1.8.32.3 asterisk11 11.17.1 asterisk13 13.3.2

The Asterisk project reports:

When Asterisk registers to a SIP TLS device and and verifies the server, Asterisk will accept signed certificates that match a common name other than the one Asterisk is expecting if the signed certificate has a common name containing a null byte after the portion of the common name that Asterisk expected. For example, if Asterisk is trying to register to www.domain.com, Asterisk will accept certificates of the form www.domain.com\x00www.someotherdomain.com

http://downloads.asterisk.org/pub/security/AST-2015-003.html CVE-2015-3008 2015-04-04 2015-04-08 ntp -- multiple vulnerabilities ntp 4.2.8p2 ntp-devel 4.3.14 FreeBSD 10.110.1_9 9.39.3_13 8.48.4_27

ntp.org reports:

[Sec 2779] ntpd accepts unauthenticated packets with symmetric key crypto.

[Sec 2781] Authentication doesn't protect symmetric associations against DoS attacks.

SA-15:07.ntp CVE-2015-1798 CVE-2015-1799 http://archive.ntp.org/ntp4/ChangeLog-stable 2015-04-07 2015-04-07 mozilla -- multiple vulnerabilities firefox 37.0.1,1 linux-firefox 37.0.1,1

The Mozilla Project reports:

MFSA 2015-44 Certificate verification bypass through the HTTP/2 Alt-Svc header

MFSA 2015-43 Loading privileged content through Reader mode

CVE-2015-0798 CVE-2015-0799 https://www.mozilla.org/security/advisories/mfsa2015-43/ https://www.mozilla.org/security/advisories/mfsa2015-44/ https://www.mozilla.org/security/advisories/ 2015-04-03 2015-04-04 Several vulnerabilities in libav libav 11.3

The libav project reports:

utvideodec: Handle slice_height being zero (CVE-2014-9604)

tiff: Check that there is no aliasing in pixel format selection (CVE-2014-8544)

https://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v11.3 CVE-2014-8544 CVE-2014-9604 2015-03-24 2015-04-03 Several vulnerabilities found in PHP php53 5.3.29_5 php5 5.4.39 php55 5.5.23 php56 5.6.7

The PHP project reports:

The PHP development team announces the immediate availability of PHP 5.6.7. Several bugs have been fixed as well as CVE-2015-0231, CVE-2015-2305 and CVE-2015-2331. All PHP 5.6 users are encouraged to upgrade to this version.

The PHP development team announces the immediate availability of PHP 5.5.23. Several bugs have been fixed as well as CVE-2015-0231, CVE-2015-2305 and CVE-2015-2331. All PHP 5.5 users are encouraged to upgrade to this version.

The PHP development team announces the immediate availability of PHP 5.4.39. Six security-related bugs were fixed in this release, including CVE-2015-0231, CVE-2015-2305 and CVE-2015-2331. All PHP 5.4 users are encouraged to upgrade to this version.

http://php.net/archive/2015.php#id2015-03-20-2 CVE-2015-0231 CVE-2015-2305 CVE-2015-2311 ports/198739 2015-03-19 2015-04-01 subversion -- DoS vulnerabilities mod_dav_svn 1.5.01.7.20 1.8.01.8.13 subversion16 1.0.01.7.20 subversion17 1.0.01.7.20 subversion 1.0.01.7.20 1.8.01.8.13

Subversion Project reports:

Subversion HTTP servers with FSFS repositories are vulnerable to a remotely triggerable excessive memory use with certain REPORT requests.

Subversion mod_dav_svn and svnserve are vulnerable to a remotely triggerable assertion DoS vulnerability for certain requests with dynamically evaluated revision numbers.

Subversion HTTP servers allow spoofing svn:author property values for new revisions.

http://subversion.apache.org/security/ CVE-2015-0202 CVE-2015-0248 CVE-2015-0251 http://subversion.apache.org/security/CVE-2015-0202-advisory.txt http://subversion.apache.org/security/CVE-2015-0248-advisory.txt http://subversion.apache.org/security/CVE-2015-0251-advisory.txt 2015-03-31 2015-03-31 mozilla -- multiple vulnerabilities firefox 37.0,1 firefox-esr 31.6.0,1 linux-firefox 37.0,1 linux-seamonkey 2.34 linux-thunderbird 31.6.0 seamonkey 2.34 thunderbird 31.6.0 libxul 31.6.0

The Mozilla Project reports:

MFSA-2015-30 Miscellaneous memory safety hazards (rv:37.0 / rv:31.6)

MFSA-2015-31 Use-after-free when using the Fluendo MP3 GStreamer plugin

MFSA-2015-32 Add-on lightweight theme installation approval bypassed through MITM attack

MFSA-2015-33 resource:// documents can load privileged pages

MFSA-2015-34 Out of bounds read in QCMS library

MFSA-2015-35 Cursor clickjacking with flash and images

MFSA-2015-36 Incorrect memory management for simple-type arrays in WebRTC

MFSA-2015-37 CORS requests should not follow 30x redirections after preflight

MFSA-2015-38 Memory corruption crashes in Off Main Thread Compositing

MFSA-2015-39 Use-after-free due to type confusion flaws

MFSA-2015-40 Same-origin bypass through anchor navigation

MFSA-2015-41 PRNG weakness allows for DNS poisoning on Android

MFSA-2015-42 Windows can retain access to privileged content on navigation to unprivileged pages

CVE-2012-2808 CVE-2015-0800 CVE-2015-0801 CVE-2015-0802 CVE-2015-0803 CVE-2015-0804 CVE-2015-0805 CVE-2015-0806 CVE-2015-0807 CVE-2015-0808 CVE-2015-0810 CVE-2015-0811 CVE-2015-0812 CVE-2015-0813 CVE-2015-0814 CVE-2015-0815 CVE-2015-0816 https://www.mozilla.org/security/advisories/mfsa2015-30/ https://www.mozilla.org/security/advisories/mfsa2015-31/ https://www.mozilla.org/security/advisories/mfsa2015-32/ https://www.mozilla.org/security/advisories/mfsa2015-33/ https://www.mozilla.org/security/advisories/mfsa2015-34/ https://www.mozilla.org/security/advisories/mfsa2015-35/ https://www.mozilla.org/security/advisories/mfsa2015-36/ https://www.mozilla.org/security/advisories/mfsa2015-37/ https://www.mozilla.org/security/advisories/mfsa2015-38/ https://www.mozilla.org/security/advisories/mfsa2015-39/ https://www.mozilla.org/security/advisories/mfsa2015-40/ https://www.mozilla.org/security/advisories/mfsa2015-41/ https://www.mozilla.org/security/advisories/mfsa2015-42/ https://www.mozilla.org/security/advisories/ 2015-03-31 2015-03-31 osc -- shell command injection via crafted _service files osc 0.151.0

SUSE Security Update reports:

osc before 0.151.0 allows remote attackers to execute arbitrary commands via shell metacharacters in a _service file.

CVE-2015-0778 https://www.suse.com/security/cve/CVE-2015-0778.html https://bugzilla.suse.com/show_bug.cgi?id=901643 http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00012.html 2015-03-16 2015-03-31 cpio -- multiple vulnerabilities gcpio 2.11_3

From the Debian Security Team:

Heap-based buffer overflow in the process_copy_in function in GNU Cpio 2.11 allows remote attackers to cause a denial of service via a large block value in a cpio archive.

cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive.

CVE-2014-9112 https://security-tracker.debian.org/tracker/CVE-2014-9112 CVE-2015-1197 https://bugzilla.suse.com/show_bug.cgi?id=658010 2015-03-27 2015-03-31 libzip -- integer overflow libzip 0.11.2_2 ppsspp 1.0.1_5 ppsspp-devel 1.0.1.2668_1 radare2 0.9.8_1 openlierox 0.58.r3_5,1

libzip developers report:

Avoid integer overflow. Fixed similarly to patch used in PHP copy of libzip.

https://bugs.php.net/bug.php?id=69253 https://github.com/php/php-src/commit/ef8fc4b53d92fbfcd8ef1abbd6f2f5fe2c4a11e5 http://hg.nih.at/libzip/rev/9f11d54f692e CVE-2015-2331 2015-03-18 2015-03-28 2015-09-20 django -- multiple vulnerabilities py27-django 1.41.4.20 1.61.6.11 1.71.7.7 py32-django 1.41.4.20 1.61.6.11 1.71.7.7 py33-django 1.41.4.20 1.61.6.11 1.71.7.7 py34-django 1.41.4.20 1.61.6.11 1.71.7.7 py27-django-devel 20150326,1 py32-django-devel 20150326,1 py33-django-devel 20150326,1 py34-django-devel 20150326,1

The Django project reports:

In accordance with our security release policy, the Django team is issuing multiple releases -- Django 1.4.20, 1.6.11, 1.7.7 and 1.8c1. These releases are now available on PyPI and our download page. These releases address several security issues detailed below. We encourage all users of Django to upgrade as soon as possible. The Django master branch has also been updated.

https://www.djangoproject.com/weblog/2015/mar/18/security-releases/ CVE-2015-2316 CVE-2015-2317 2015-03-18 2015-03-27 GNU binutils -- multiple vulnerabilities cross-binutils 2.25 x86_64-pc-mingw32-binutils 2.25 m6811-binutils 2.25

US-CERT/NIST reports:

The _bfd_XXi_swap_aouthdr_in function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (out-of-bounds write) and possibly have other unspecified impact via a crafted NumberOfRvaAndSizes field in the AOUT header in a PE executable.

US-CERT/NIST reports:

Heap-based buffer overflow in the pe_print_edata function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly have other unspecified impact via a truncated export table in a PE file.

US-CERT/NIST reports:

Stack-based buffer overflow in the ihex_scan function in bfd/ihex.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly have other unspecified impact via a crafted ihex file.

CVE-2014-8501 CVE-2014-8502 CVE-2014-8503 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8501 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8502 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8503 2014-12-09 2015-03-24 2016-01-08 libuv -- incorrect revocation order while relinquishing privileges node010 0.10.36

Nodejs releases reports:

CVE-2015-0278

This may potentially allow an attacker to gain elevated privileges.

http://blog.nodejs.org/2015/03/14/node-v0-10-37-stable ports/198861 CVE-2015-0278 2015-03-14 2015-03-24 jenkins -- multiple vulnerabilities jenkins 1.605 jenkins-lts 1.596.1

Jenkins Security Advisory:

Description

SECURITY-171, SECURITY-177 (Reflective XSS vulnerability)

An attacker without any access to Jenkins can navigate the user to a carefully crafted URL and have the user execute unintended actions. This vulnerability can be used to attack Jenkins inside firewalls from outside so long as the location of Jenkins is known to the attacker.

SECURITY-180 (forced API token change)

The part of Jenkins that issues a new API token was not adequately protected against anonymous attackers. This allows an attacker to escalate privileges on Jenkins.

https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-03-23 2015-03-23 2015-03-24 mozilla -- multiple vulnerabilities firefox 36.0.4,1 firefox-esr 31.5.3,1 linux-firefox 36.0.4,1 linux-seamonkey 2.33.1 seamonkey 2.33.1 libxul 31.5.3

The Mozilla Project reports:

MFSA-2015-28 Privilege escalation through SVG navigation

MFSA-2015-29 Code execution through incorrect JavaScript bounds checking elimination

CVE-2015-0817 CVE-2015-0818 https://www.mozilla.org/security/advisories/mfsa2015-28/ https://www.mozilla.org/security/advisories/mfsa2015-29/ https://www.mozilla.org/security/advisories/ 2015-03-20 2015-03-22 OpenSSL -- multiple vulnerabilities openssl 1.0.11.0.1_19 mingw32-openssl 1.0.11.0.1m linux-c6-openssl 1.0.1e_4 libressl 2.1.5_1 FreeBSD 10.110.1_8 9.39.3_12 8.48.4_26

OpenSSL project reports:

Reclassified: RSA silently downgrades to EXPORT_RSA [Client] (CVE-2015-0204). OpenSSL only.

Segmentation fault in ASN1_TYPE_cmp (CVE-2015-0286)

ASN.1 structure reuse memory corruption (CVE-2015-0287)

PKCS7 NULL pointer dereferences (CVE-2015-0289)

Base64 decode (CVE-2015-0292). OpenSSL only.

DoS via reachable assert in SSLv2 servers (CVE-2015-0293). OpenSSL only.

Use After Free following d2i_ECPrivatekey error (CVE-2015-0209)

X509_to_X509_REQ NULL pointer deref (CVE-2015-0288)

SA-15:06.openssl ports/198681 CVE-2015-0204 CVE-2015-0286 CVE-2015-0287 CVE-2015-0289 CVE-2015-0292 CVE-2015-0293 CVE-2015-0209 CVE-2015-0288 https://www.openssl.org/news/secadv_20150319.txt 2015-03-19 2015-03-19 2016-08-09 libXfont -- BDF parsing issues libXfont 1.5.1 linux-c6-xorg-libs 7.4_4 linux-f10-xorg-libs 7.4_4

Alan Coopersmith reports:

Ilja van Sprundel, a security researcher with IOActive, has discovered an issue in the parsing of BDF font files by libXfont. Additional testing by Alan Coopersmith and William Robinet with the American Fuzzy Lop (afl) tool uncovered two more issues in the parsing of BDF font files.

As libXfont is used by the X server to read font files, and an unprivileged user with access to the X server can tell the X server to read a given font file from a path of their choosing, these vulnerabilities have the potential to allow unprivileged users to run code with the privileges of the X server (often root access).

http://lists.x.org/archives/xorg-announce/2015-March/002550.html CVE-2015-1802 CVE-2015-1803 CVE-2015-1804 2015-03-17 2015-03-18 2016-01-31 Adobe Flash Player -- critical vulnerabilities linux-c6-flashplugin 11.2r202.442 linux-f10-flashplugin 11.2r202.442

Adobe reports:

Adobe has released security updates for Adobe Flash Player for Windows, Macintosh and Linux. These updates address vulnerabilities that could potentially allow an attacker to take control of the affected system. These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2015-0332, CVE-2015-0333, CVE-2015-0335, CVE-2015-0339). These updates resolve type confusion vulnerabilities that could lead to code execution (CVE-2015-0334, CVE-2015-0336). These updates resolve a vulnerability that could lead to a cross-domain policy bypass (CVE-2015-0337). These updates resolve a vulnerability that could lead to a file upload restriction bypass (CVE-2015-0340). These updates resolve an integer overflow vulnerability that could lead to code execution (CVE-2015-0338). These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2015-0341, CVE-2015-0342).

https://helpx.adobe.com/security/products/flash-player/apsb15-05.html CVE-2015-0332 CVE-2015-0333 CVE-2015-0334 CVE-2015-0335 CVE-2015-0336 CVE-2015-0337 CVE-2015-0338 CVE-2015-0339 CVE-2015-0340 CVE-2015-0341 CVE-2015-0342 2015-03-12 2015-03-13 sympa -- Remote attackers can read arbitrary files sympa 6.1.24

The Sympa Project reports:

The newsletter posting area in the web interface in Sympa 6.0.x before 6.0.10 and 6.1.x before 6.1.24 allows remote attackers to read arbitrary files via unspecified vectors.

https://www.sympa.org/security_advisories CVE-2015-1306 2015-01-13 2015-03-13 rt -- Remote DoS, Information disclosure and Session Hijackingvulnerabilities rt42 4.2.04.2.10 rt40 4.0.04.0.23

Best Practical reports:

RT 3.0.0 and above, if running on Perl 5.14.0 or higher, are vulnerable to a remote denial-of-service via the email gateway; any installation which accepts mail from untrusted sources is vulnerable, regardless of the permissions configuration inside RT. This denial-of-service may encompass both CPU and disk usage, depending on RT's logging configuration. This vulnerability is assigned CVE-2014-9472.

RT 3.8.8 and above are vulnerable to an information disclosure attack which may reveal RSS feeds URLs, and thus ticket data; this vulnerability is assigned CVE-2015-1165. RSS feed URLs can also be leveraged to perform session hijacking, allowing a user with the URL to log in as the user that created the feed; this vulnerability is assigned CVE-2015-1464.

http://blog.bestpractical.com/2015/02/security-vulnerabilities-in-rt.html CVE-2014-9472 CVE-2015-1165 CVE-2015-1464 2015-02-26 2015-03-08 phpMyAdmin -- Risk of BREACH attack due to reflected parameter phpMyAdmin 4.3.04.3.11.1

The phpMyAdmin development team reports:

Risk of BREACH attack due to reflected parameter.

With a large number of crafted requests it was possible to infer the CSRF token by a BREACH attack.

Mitigation factor: this vulnerability can only be exploited in the presence of another vulnerability that allows the attacker to inject JavaScript into victim's browser.

http://www.phpmyadmin.net/home_page/security/PMASA-2015-1.php CVE-2015-2206 2015-03-04 2015-03-08 mono -- TLS bugs mono 3.10.1 3.123.12.1

The Mono project reports:

Mono’s implementation of the SSL/TLS stack failed to check the order of the handshake messages. Which would allow various attacks on the protocol to succeed. Details of this vulnerability are discussed in SKIP-TLS post.

Mono’s implementation of SSL/TLS also contained support for the weak EXPORT cyphers and was susceptible to the FREAK attack.

http://www.mono-project.com/docs/about-mono/vulnerabilities/#tls-bugs 2015-03-06 2015-03-07 PuTTY -- fails to scrub private keys from memory after use putty 0.64

Simon Tatham reports:

When PuTTY has sensitive data in memory and has no further need for it, it should wipe the data out of its memory, in case malware later gains access to the PuTTY process or the memory is swapped out to disk or written into a crash dump file. An obvious example of this is the password typed during SSH login; other examples include obsolete session keys, public-key passphrases, and the private halves of public keys.

PuTTY 0.63 and earlier versions, after loading a private key from a disk file, mistakenly leak a memory buffer containing a copy of the private key, in the function ssh2_load_userkey. The companion function ssh2_save_userkey (only called by PuTTYgen) can also leak a copy, but only in the case where the file it tried to save to could not be created.

http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-wiped-2.html CVE-2015-2157 2015-02-28 2015-03-05 chromium -- multiple vulnerabilities chromium 41.0.2272.76 chromium-npapi 41.0.2272.76 chromium-pulse 41.0.2272.76

Chrome Releases reports:

51 security fixes in this release, including:

[456516] High CVE-2015-1212: Out-of-bounds write in media. Credit to anonymous.

[448423] High CVE-2015-1213: Out-of-bounds write in skia filters. Credit to cloudfuzzer.

[445810] High CVE-2015-1214: Out-of-bounds write in skia filters. Credit to cloudfuzzer.

[445809] High CVE-2015-1215: Out-of-bounds write in skia filters. Credit to cloudfuzzer.

[454954] High CVE-2015-1216: Use-after-free in v8 bindings. Credit to anonymous.

[456192] High CVE-2015-1217: Type confusion in v8 bindings. Credit to anonymous.

[456059] High CVE-2015-1218: Use-after-free in dom. Credit to cloudfuzzer.

[446164] High CVE-2015-1219: Integer overflow in webgl. Credit to Chen Zhang (demi6od) of NSFOCUS Security Team.

[437651] High CVE-2015-1220: Use-after-free in gif decoder. Credit to Aki Helin of OUSPG.

[455368] High CVE-2015-1221: Use-after-free in web databases. Credit to Collin Payne.

[448082] High CVE-2015-1222: Use-after-free in service workers. Credit to Collin Payne.

[454231] High CVE-2015-1223: Use-after-free in dom. Credit to Maksymillian Motyl.

High CVE-2015-1230: Type confusion in v8. Credit to Skylined working with HP's Zero Day Initiative.

[449958] Medium CVE-2015-1224: Out-of-bounds read in vpxdecoder. Credit to Aki Helin of OUSPG.

[446033] Medium CVE-2015-1225: Out-of-bounds read in pdfium. Credit to cloudfuzzer.

[456841] Medium CVE-2015-1226: Validation issue in debugger. Credit to Rob Wu.

[450389] Medium CVE-2015-1227: Uninitialized value in blink. Credit to Christoph Diehl.

[444707] Medium CVE-2015-1228: Uninitialized value in rendering. Credit to miaubiz.

[431504] Medium CVE-2015-1229: Cookie injection via proxies. Credit to iliwoy.

[463349] CVE-2015-1231: Various fixes from internal audits, fuzzing, and other initiatives.

CVE-2015-1212 CVE-2015-1213 CVE-2015-1214 CVE-2015-1215 CVE-2015-1216 CVE-2015-1217 CVE-2015-1218 CVE-2015-1219 CVE-2015-1220 CVE-2015-1221 CVE-2015-1222 CVE-2015-1223 CVE-2015-1224 CVE-2015-1225 CVE-2015-1226 CVE-2015-1227 CVE-2015-1228 CVE-2015-1229 CVE-2015-1230 CVE-2015-1231 http://googlechromereleases.blogspot.nl 2015-03-03 2015-03-04 qt4-gui, qt5-gui -- DoS vulnerability in the BMP image handler qt4-gui 4.8.6_4 qt5-gui 5.3.2_2

Richard J. Moore reports:

The builtin BMP decoder in QtGui prior to Qt 5.5 contained a bug that would lead to a divsion by zero when loading certain corrupt BMP files. This in turn would cause the application loading these hand crafted BMPs to crash.

CVE-2015-0295 http://lists.qt-project.org/pipermail/announce/2015-February/000059.html 2015-02-22 2015-03-05 jenkins -- multiple vulnerabilities jenkins 1.600 jenkins-lts 1.580.3

Kohsuke Kawaguchi from Jenkins team reports:

Description

SECURITY-125 (Combination filter Groovy script unsecured)

This vulnerability allows users with the job configuration privilege to escalate his privileges, resulting in arbitrary code execution to the master.

SECURITY-162 (directory traversal from artifacts via symlink)

This vulnerability allows users with the job configuration privilege or users with commit access to the build script to access arbitrary files/directories on the master, resulting in the exposure of sensitive information, such as encryption keys.

SECURITY-163 (update center metadata retrieval DoS attack)

This vulnerability allows authenticated users to disrupt the operation of Jenkins by feeding malicious update center data into Jenkins, affecting plugin installation and tool installation.

SECURITY-165 (external entity injection via XPath)

This vulnerability allows users with the read access to Jenkins to retrieve arbitrary XML document on the server, resulting in the exposure of sensitive information inside/outside Jenkins.

SECURITY-166 (HudsonPrivateSecurityRealm allows creation of reserved names)

For users using "Jenkins' own user database" setting, Jenkins doesn't refuse reserved names, thus allowing privilege escalation.

SECURITY-167 (External entity processing in XML can reveal sensitive local files)

This vulnerability allows attackers to create malicious XML documents and feed that into Jenkins, which causes Jenkins to retrieve arbitrary XML document on the server, resulting in the exposure of sensitive information inside/outside Jenkins.

Severity

SECURITY-125 is rated critical. This attack can be only mounted by users with some trust, but it results in arbitrary code execution on the master.

SECURITY-162 is rated critical. This attack can be only mounted by users with some trust, but it results in the exposure of sensitive information.

SECURITY-163 is rated medium, as it results in the loss of functionality.

SECURITY-165 is rated critical. This attack is easy to mount, and it results in the exposure of sensitive information.

SECURITY-166 is rated critical. For users who use the affected feature, this attack results in arbitrary code execution on the master.

SECURITY-167 is rated critical. This attack is easy to mount, and it results in the exposure of sensitive information.

https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27 2015-03-01 2015-03-01 mozilla -- multiple vulnerabilities firefox 36.0,1 firefox-esr 31.5.0,1 linux-firefox 36.0,1 linux-seamonkey 2.33 linux-thunderbird 31.5.0 seamonkey 2.33 thunderbird 31.5.0 libxul 31.5.0

The Mozilla Project reports:

MFSA-2015-11 Miscellaneous memory safety hazards (rv:36.0 / rv:31.5)

MFSA-2015-12 Invoking Mozilla updater will load locally stored DLL files

MFSA-2015-13 Appended period to hostnames can bypass HPKP and HSTS protections

MFSA-2015-14 Malicious WebGL content crash when writing strings

MFSA-2015-15 TLS TURN and STUN connections silently fail to simple TCP connections

MFSA-2015-16 Use-after-free in IndexedDB

MFSA-2015-17 Buffer overflow in libstagefright during MP4 video playback

MFSA-2015-18 Double-free when using non-default memory allocators with a zero-length XHR

MFSA-2015-19 Out-of-bounds read and write while rendering SVG content

MFSA-2015-20 Buffer overflow during CSS restyling

MFSA-2015-21 Buffer underflow during MP3 playback

MFSA-2015-22 Crash using DrawTarget in Cairo graphics library

MFSA-2015-23 Use-after-free in Developer Console date with OpenType Sanitiser

MFSA-2015-24 Reading of local files through manipulation of form autocomplete

MFSA-2015-25 Local files or privileged URLs in pages can be opened into new tabs

MFSA-2015-26 UI Tour whitelisted sites in background tab can spoof foreground tabs

MFSA-2015-27 Caja Compiler JavaScript sandbox bypass

CVE-2015-0819 CVE-2015-0820 CVE-2015-0821 CVE-2015-0822 CVE-2015-0823 CVE-2015-0824 CVE-2015-0825 CVE-2015-0826 CVE-2015-0827 CVE-2015-0828 CVE-2015-0829 CVE-2015-0830 CVE-2015-0831 CVE-2015-0832 CVE-2015-0833 CVE-2015-0834 CVE-2015-0835 CVE-2015-0836 https://www.mozilla.org/security/advisories/mfsa2015-11/ https://www.mozilla.org/security/advisories/mfsa2015-12/ https://www.mozilla.org/security/advisories/mfsa2015-13/ https://www.mozilla.org/security/advisories/mfsa2015-14/ https://www.mozilla.org/security/advisories/mfsa2015-15/ https://www.mozilla.org/security/advisories/mfsa2015-16/ https://www.mozilla.org/security/advisories/mfsa2015-17/ https://www.mozilla.org/security/advisories/mfsa2015-18/ https://www.mozilla.org/security/advisories/mfsa2015-19/ https://www.mozilla.org/security/advisories/mfsa2015-20/ https://www.mozilla.org/security/advisories/mfsa2015-21/ https://www.mozilla.org/security/advisories/mfsa2015-22/ https://www.mozilla.org/security/advisories/mfsa2015-23/ https://www.mozilla.org/security/advisories/mfsa2015-24/ https://www.mozilla.org/security/advisories/mfsa2015-25/ https://www.mozilla.org/security/advisories/mfsa2015-26/ https://www.mozilla.org/security/advisories/mfsa2015-27/ https://www.mozilla.org/security/advisories/ 2015-02-24 2015-02-27 php5 -- multiple vulnerabilities php5 5.4.38 php55 5.5.22 php56 5.6.6

The PHP Project reports:

Use after free vulnerability in unserialize() with DateTimeZone.

Mitigation for CVE-2015-0235 -- GHOST: glibc gethostbyname buffer overflow.

CVE-2015-0235 CVE-2015-0273 http://php.net/ChangeLog-5.php#5.4.38 http://php.net/ChangeLog-5.php#5.5.22 http://php.net/ChangeLog-5.php#5.6.6 2015-02-18 2015-02-26 krb5 1.11 -- New release/fix multiple vulnerabilities krb5-111 1.11.6

The MIT Kerberos team announces the availability of MIT Kerberos 5 Release 1.11.6:

Handle certain invalid RFC 1964 GSS tokens correctly to avoid invalid memory reference vulnerabilities. [CVE-2014-4341

Fix memory management vulnerabilities in GSSAPI SPNEGO. [CVE-2014-4343 CVE-2014-4344]

Fix buffer overflow vulnerability in LDAP KDB back end. [CVE-2014-4345]

Fix multiple vulnerabilities in the LDAP KDC back end. [CVE-2014-5354 CVE-2014-5353]

Fix multiple kadmind vulnerabilities, some of which are based in the gssrpc library. [CVE-2014-5352 CVE-2014-9421 CVE-2014-9422 CVE-2014-9423]

http://web.mit.edu/kerberos/krb5-1.11/README-1.11.6.txt 2015-02-25 2015-02-25 samba -- Unexpected code execution in smbd samba4 4.0.04.0.25 samba41 4.1.04.1.17 samba36 3.6.03.6.25

Samba developement team reports:

All versions of Samba from 3.5.0 to 4.2.0rc4 are vulnerable to an unexpected code execution vulnerability in the smbd file server daemon.

A malicious client could send packets that may set up the stack in such a way that the freeing of memory in a subsequent anonymous netlogon packet could allow execution of arbitrary code. This code would execute with root privileges.

CVE-2015-0240 https://www.samba.org/samba/security/CVE-2015-0240 2015-02-23 2015-02-23 e2fsprogs -- buffer overflow if s_first_meta_bg too big e2fsprogs 1.42.12

Theodore Ts'o reports:

If s_first_meta_bg is greater than the of number block group descriptor blocks, then reading or writing the block group descriptors will end up overruning the memory buffer allocated for the descriptors.

The finding is credited to a vulnerability report from Jose Duart of Google Security Team <jduart AT google.com> and was reported through oCERT-2015-002.

http://git.kernel.org/cgit/fs/ext2/e2fsprogs.git/commit/?id=f66e6ce4 http://www.ocert.org/advisories/ocert-2015-002.html https://bugzilla.redhat.com/show_bug.cgi?id=1187032 CVE-2015-0247 2014-08-09 2015-02-24 e2fsprogs -- potential buffer overflow in closefs() e2fsprogs 1.42.12_2

Theodore Ts'o reports:

On a carefully crafted filesystem that gets modified through tune2fs or debugfs, it is possible to trigger a buffer overrun when the file system is closed via closefs().

http://git.kernel.org/cgit/fs/ext2/e2fsprogs.git/commit/?h=maint&id=49d0fe2a14f2a23da2fe299643379b8c1d37df73 CVE-2015-1572 2015-02-06 2015-02-24 bind -- denial of service vulnerability bind910 bind910-base 9.10.1P2 bind99 bind99-base 9.9.6P2 FreeBSD 9.39.3_10 8.48.4_24

ISC reports:

When configured to perform DNSSEC validation, named can crash when encountering a rare set of conditions in the managed trust anchors.

SA-15:05.bind CVE-2015-1349 https://kb.isc.org/article/AA-01235 2015-02-18 2015-02-23 2016-08-09 krb5 1.12 -- New release/fix multiple vulnerabilities krb5-112 1.12.3

The MIT Kerberos team announces the availability of MIT Kerberos 5 Release 1.12.3:

Fix multiple vulnerabilities in the LDAP KDC back end. [CVE-2014-5354] [CVE-2014-5353]

Fix multiple kadmind vulnerabilities, some of which are based in the gssrpc library. [CVE-2014-5352 CVE-2014-5352 CVE-2014-9421 CVE-2014-9422 CVE-2014-9423]

http://web.mit.edu/kerberos/krb5-1.12/README-1.12.3.txt 2015-02-20 2015-02-21 unzip -- heap based buffer overflow in iconv patch unzip 6.0_5

Ubuntu Security Notice USN-2502-1 reports:

unzip could be made to run programs if it opened a specially crafted file.

CVE-2015-1315 http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-1315.html https://security-tracker.debian.org/tracker/CVE-2015-1315 http://www.ubuntu.com/usn/usn-2502-1/ 2015-02-17 2015-02-17 krb5 -- Vulnerabilities in kadmind, libgssrpc, gss_process_context_token VU#540092 krb5 1.13.1 krb5-112 1.12.2_2 krb5-111 1.11.5_5

The MIT Kerberos team reports:

CVE-2014-5353: The krb5_ldap_get_password_policy_from_dn function in plugins/kdb/ldap/libkdb_ldap/ldap_pwd_policy.c in MIT Kerberos 5 (aka krb5) before 1.13.1, when the KDC uses LDAP, allows remote authenticated users to cause a denial of service (daemon crash) via a successful LDAP query with no results, as demonstrated by using an incorrect object type for a password policy.

CVE-2014-5354: plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.1, when the KDC uses LDAP, allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) by creating a database entry for a keyless principal, as demonstrated by a kadmin "add_principal -nokey" or "purgekeys -all" command.

CVE-2014-5353 CVE-2014-5354 http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt 2015-02-12 2015-02-12 2015-02-13 xorg-server -- Information leak in the XkbSetGeometry request of X servers. xorg-server 1.14.7_2,1 xorg-server 1.15.0,11.16.4,1

Peter Hutterer reports:

Olivier Fourdan from Red Hat has discovered a protocol handling issue in the way the X server code base handles the XkbSetGeometry request.

The issue stems from the server trusting the client to send valid string lengths in the request data. A malicious client with string lengths exceeding the request length can cause the server to copy adjacent memory data into the XKB structs. This data is then available to the client via the XkbGetGeometry request. The data length is at least up to 64k, it is possible to obtain more data by chaining strings, each string length is then determined by whatever happens to be in that 16-bit region of memory.

A similarly crafted request can likely cause the X server to crash.

CVE-2015-0255 http://lists.freedesktop.org/archives/xorg/2015-February/057158.html 2015-02-10 2015-02-12 openldap -- two remote denial of service vulnerabilities openldap-server 2.4.40_3

Ryan Tandy reports:

With the deref overlay enabled, ldapsearch with '-E deref=member:' causes slapd to crash.

Bill MacAllister discovered that certain queries cause slapd to crash while freeing operation controls. This is a 2.4.40 regression. Earlier releases are not affected.

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776988 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776991 2015-02-02 2015-02-06 chromium -- multiple vulnerabilities chromium 40.0.2214.111 chromium-pulse 40.0.2214.111

Chrome Releases reports:

11 security fixes in this release, including:

[447906] High CVE-2015-1209: Use-after-free in DOM. Credit to Maksymillian.

[453979] High CVE-2015-1210: Cross-origin-bypass in V8 bindings. Credit to anonymous.

[453982] High CVE-2015-1211: Privilege escalation using service workers. Credit to anonymous.

[455225] CVE-2015-1212: Various fixes from internal audits, fuzzing and other initiatives.

CVE-2015-1209 CVE-2015-1210 CVE-2015-1211 CVE-2015-1212 http://googlechromereleases.blogspot.nl 2015-02-05 2015-02-06 PostgreSQL -- multiple buffer overflows and memory issues postgresql90-server 9.0.09.0.19 postgresql91-server 9.1.09.1.15 postgresql92-server 9.2.09.2.10 postgresql93-server 9.3.09.3.6 postgresql94-server 9.4.09.4.1

PostgreSQL Project reports:

This update fixes multiple security issues reported in PostgreSQL over the past few months. All of these issues require prior authentication, and some require additional conditions, and as such are not considered generally urgent. However, users should examine the list of security holes patched below in case they are particularly vulnerable.

CVE-2015-0241 Buffer overruns in "to_char" functions.

CVE-2015-0242 Buffer overrun in replacement printf family of functions.

CVE-2015-0243 Memory errors in functions in the pgcrypto extension.

CVE-2015-0244 An error in extended protocol message reading.

CVE-2014-8161 Constraint violation errors can cause display of values in columns which the user would not normally have rights to see.

CVE-2015-0241 CVE-2015-0242 CVE-2015-0243 CVE-2015-0244 CVE-2014-8161 2015-02-05 2015-02-05 krb5 -- Vulnerabilities in kadmind, libgssrpc, gss_process_context_token VU#540092 krb5 1.13_1 krb5-112 1.12.2_1 krb5-111 1.11.5_4

SO-AND-SO reports:

CVE-2014-5352: In the MIT krb5 libgssapi_krb5 library, after gss_process_context_token() is used to process a valid context deletion token, the caller is left with a security context handle containing a dangling pointer. Further uses of this handle will result in use-after-free and double-free memory access violations. libgssrpc server applications such as kadmind are vulnerable as they can be instructed to call gss_process_context_token().

CVE-2014-9421: If the MIT krb5 kadmind daemon receives invalid XDR data from an authenticated user, it may perform use-after-free and double-free memory access violations while cleaning up the partial deserialization results. Other libgssrpc server applications may also be vulnerable if they contain insufficiently defensive XDR functions.

CVE-2014-9422: The MIT krb5 kadmind daemon incorrectly accepts authentications to two-component server principals whose first component is a left substring of "kadmin" or whose realm is a left prefix of the default realm.

CVE-2014-9423: libgssrpc applications including kadmind output four or eight bytes of uninitialized memory to the network as part of an unused "handle" field in replies to clients.

CVE-2014-5352 CVE-2014-9421 CVE-2014-9422 CVE-2014-9423 http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt 2015-02-03 2015-02-04 unzip -- out of boundary access issues in test_compr_eb unzip 6.0_4

Ubuntu Security Notice USN-2489-1 reports:

Michal Zalewski discovered that unzip incorrectly handled certain malformed zip archives. If a user or automated system were tricked into processing a specially crafted zip archive, an attacker could possibly execute arbitrary code.

CVE-2014-9636 http://www.ubuntu.com/usn/usn-2489-1/ http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-9636.html http://seclists.org/oss-sec/2014/q4/489 http://www.info-zip.org/phpBB3/viewtopic.php?f=7&t=450 2014-11-02 2015-02-03 Xymon -- buffer overrun xymon-server 4.3.44.3.18

Debian reports:

web/acknowledge.c uses a string twice in a format string, but only allocates memory for one copy.

http://www.openwall.com/lists/oss-security/2015/01/31/4 https://security-tracker.debian.org/tracker/CVE-2015-1430 CVE-2015-1430 2014-09-28 2015-02-02 rabbitmq -- Security issues in management plugin rabbitmq 3.4.3

The RabbitMQ project reports:

Some user-controllable content was not properly HTML-escaped before being presented to a user in the management web UI:

When a user unqueued a message from the management UI, message details (header names, arguments, etc.) were displayed unescaped. An attacker could publish a specially crafted message to add content or execute arbitrary Javascript code on behalf of a user, if this user unqueued the message from the management UI.

When viewing policies, their name was displayed unescaped. An attacker could create a policy with a specially crafted name to add content or execute arbitrary Javascript code on behalf of a user who is viewing policies.

When listing connected AMQP network clients, client details such as its version were displayed unescaped. An attacker could use a client with a specially crafted version field to add content or execute arbitrary Javascript code on behalf of a user who is viewing connected clients.

In all cases, the attacker needs a valid user account on the targetted RabbitMQ cluster.

Furthermore, some admin-controllable content was not properly escaped:

user names;

the cluster name.

Likewise, an attacker could add content or execute arbitrary Javascript code on behalf of a user using the management web UI. However, the attacker must be an administrator on the RabbitMQ cluster, thus a trusted user.

http://www.rabbitmq.com/news.html#2015-01-08T10:14:05+0100 http://www.rabbitmq.com/release-notes/README-3.4.3.txt CVE-2015-0862 2015-01-08 2015-01-31 apache24 -- several vulnerabilities apache24 2.4.12

Apache HTTP SERVER PROJECT reports:

mod_proxy_fcgi: Fix a potential crash due to buffer over-read, with response headers' size above 8K.

mod_cache: Avoid a crash when Content-Type has an empty value. PR 56924.

mod_lua: Fix handling of the Require line when a LuaAuthzProvider is used in multiple Require directives with different arguments. PR57204.

core: HTTP trailers could be used to replace HTTP headers late during request processing, potentially undoing or otherwise confusing modules that examined or modified request headers earlier. Adds "MergeTrailers" directive to restore legacy behavior.

CVE-2014-3583 CVE-2014-3581 CVE-2014-8109 CVE-2013-5704 2015-01-29 2015-01-31 asterisk -- Mitigation for libcURL HTTP request injection vulnerability asterisk 1.8.32.2 asterisk11 11.15.1 asterisk13 13.1.1

The Asterisk project reports:

CVE-2014-8150 reported an HTTP request injection vulnerability in libcURL. Asterisk uses libcURL in its func_curl.so module (the CURL() dialplan function), as well as its res_config_curl.so (cURL realtime backend) modules.

Since Asterisk may be configured to allow for user-supplied URLs to be passed to libcURL, it is possible that an attacker could use Asterisk as an attack vector to inject unauthorized HTTP requests if the version of libcURL installed on the Asterisk server is affected by CVE-2014-8150.

http://downloads.asterisk.org/pub/security/AST-2015-002.html 2015-01-12 2015-01-29 asterisk -- File descriptor leak when incompatible codecs are offered asterisk13 13.1.1

The Asterisk project reports:

Asterisk may be configured to only allow specific audio or video codecs to be used when communicating with a particular endpoint. When an endpoint sends an SDP offer that only lists codecs not allowed by Asterisk, the offer is rejected. However, in this case, RTP ports that are allocated in the process are not reclaimed.

This issue only affects the PJSIP channel driver in Asterisk. Users of the chan_sip channel driver are not affected.

As the resources are allocated after authentication, this issue only affects communications with authenticated endpoints.

http://downloads.asterisk.org/pub/security/AST-2015-001.html CVE-2015-1558 2015-01-06 2015-01-29 2015-02-17 glibc -- gethostbyname buffer overflow linux_base-c6 6.6_2 linux_base-f10 0 linux-c6-devtools 6.6_3 linux-f10-devtools 0

Robert Krátký reports:

GHOST is a 'buffer overflow' bug affecting the gethostbyname() and gethostbyname2() function calls in the glibc library. This vulnerability allows a remote attacker that is able to make an application call to either of these functions to execute arbitrary code with the permissions of the user running the application. The gethostbyname() function calls are used for DNS resolving, which is a very common event. To exploit this vulnerability, an attacker must trigger a buffer overflow by supplying an invalid hostname argument to an application that performs a DNS resolution.

CVE-2015-0235 https://access.redhat.com/articles/1332213 http://www.openwall.com/lists/oss-security/2015/01/27/9 2015-01-27 2015-01-28 2015-02-02 Adobe Flash Player -- critical vulnerability linux-c6-flashplugin 11.2r202.438 linux-f10-flashplugin 11.2r202.438

Adobe reports:

Successful exploitation could cause a crash and potentially allow an attacker to take control of the affected system. We are aware of reports that this vulnerability is being actively exploited in the wild via drive-by-download attacks against systems running Internet Explorer and Firefox on Windows 8.1 and below.

CVE-2015-0311 https://helpx.adobe.com/security/products/flash-player/apsa15-01.html 2015-01-22 2015-01-26 Bugzilla multiple security issues bugzilla44 4.4.7

Bugzilla Security Advisory

Command Injection

Some code in Bugzilla does not properly utilize 3 arguments form for open() and it is possible for an account with editcomponents permissions to inject commands into product names and other attributes.

Information Leak

Using the WebServices API, a user can possibly execute imported functions from other non-WebService modules. A whitelist has now been added that lists explicit methods that can be executed via the API.

CVE-2014-8630 https://bugzilla.mozilla.org/show_bug.cgi?id=1079065 https://bugzilla.mozilla.org/show_bug.cgi?id=1090275 2015-01-21 2015-01-26 django -- multiple vulnerabilities py27-django 1.41.4.18 1.51.5.12 1.61.6.10 1.71.7.3 py32-django 1.41.4.18 1.51.5.12 1.61.6.10 1.71.7.3 py33-django 1.41.4.18 1.51.5.12 1.61.6.10 1.71.7.3 py34-django 1.41.4.18 1.51.5.12 1.61.6.10 1.71.7.3 py27-django-devel 20150124,1 py32-django-devel 20150124,1 py33-django-devel 20150124,1 py34-django-devel 20150124,1

The Django project reports:

Today the Django team is issuing multiple releases -- Django 1.4.18, Django 1.6.10, and Django 1.7.3 -- as part of our security process. These releases are now available on PyPI and our download page.

These releases address several security issues. We encourage all users of Django to upgrade as soon as possible.

https://www.djangoproject.com/weblog/2015/jan/13/security/ CVE-2015-0219 CVE-2015-0220 CVE-2015-0221 CVE-2015-0222 2015-01-13 2015-01-23 2015-01-24 libutp -- remote denial of service or arbitrary code execution bittorrent-libutp 0.20130514_1 transmission-cli transmission-deamon transmission-gtk transmission-qt4 2.74

NVD reports:

Stack-based buffer overflow in utp.cpp in libutp, as used in Transmission before 2.74 and possibly other products, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted "micro transport protocol packets."

CVE-2012-6129 https://github.com/bittorrent/libutp/issues/38 https://trac.transmissionbt.com/ticket/5002 2012-08-01 2014-12-29 LibreSSL -- DTLS vulnerability libressl 2.1.3

OpenSSL Security Advisory:

A memory leak can occur in the dtls1_buffer_record function under certain conditions. In particular this could occur if an attacker sent repeated DTLS records with the same sequence number but for the next epoch. The memory leak could be exploited by an attacker in a Denial of Service attack through memory exhaustion.

CVE-2015-0206 https://www.openssl.org/news/secadv_20150108.txt 2015-01-08 2015-01-22 Adobe Flash Player -- multiple vulnerabilities linux-c6-flashplugin 11.2r202.429 linux-f10-flashplugin 11.2r202.429

Adobe reports:

These updates address vulnerabilities that could potentially allow an attacker to take control of the affected system.

CVE-2015-0301 CVE-2015-0302 CVE-2015-0303 CVE-2015-0304 CVE-2015-0305 CVE-2015-0306 CVE-2015-0307 CVE-2015-0308 CVE-2015-0309 http://helpx.adobe.com/security/products/flash-player/apsb15-01.html 2015-01-13 2015-01-22 chromium -- multiple vulnerabilities chromium 40.0.2214.91 chromium-pulse 40.0.2214.91

Google Chrome Releases reports:

62 security fixes in this release, including:

[430353] High CVE-2014-7923: Memory corruption in ICU. Credit to yangdingning.

[435880] High CVE-2014-7924: Use-after-free in IndexedDB. Credit to Collin Payne.

[434136] High CVE-2014-7925: Use-after-free in WebAudio. Credit to mark.buer.

[422824] High CVE-2014-7926: Memory corruption in ICU. Credit to yangdingning.

[444695] High CVE-2014-7927: Memory corruption in V8. Credit to Christian Holler.

[435073] High CVE-2014-7928: Memory corruption in V8. Credit to Christian Holler.

[442806] High CVE-2014-7930: Use-after-free in DOM. Credit to cloudfuzzer.

[442710] High CVE-2014-7931: Memory corruption in V8. Credit to cloudfuzzer.

[443115] High CVE-2014-7929: Use-after-free in DOM. Credit to cloudfuzzer.

[429666] High CVE-2014-7932: Use-after-free in DOM. Credit to Atte Kettunen of OUSPG.

[427266] High CVE-2014-7933: Use-after-free in FFmpeg. Credit to aohelin.

[427249] High CVE-2014-7934: Use-after-free in DOM. Credit to cloudfuzzer.

[402957] High CVE-2014-7935: Use-after-free in Speech. Credit to Khalil Zhani.

[428561] High CVE-2014-7936: Use-after-free in Views. Credit to Christoph Diehl.

[419060] High CVE-2014-7937: Use-after-free in FFmpeg. Credit to Atte Kettunen of OUSPG.

[416323] High CVE-2014-7938: Memory corruption in Fonts. Credit to Atte Kettunen of OUSPG.

[399951] High CVE-2014-7939: Same-origin-bypass in V8. Credit to Takeshi Terada.

[433866] Medium CVE-2014-7940: Uninitialized-value in ICU. Credit to miaubiz.

[428557] Medium CVE-2014-7941: Out-of-bounds read in UI. Credit to Atte Kettunen of OUSPG and Christoph Diehl.

[426762] Medium CVE-2014-7942: Uninitialized-value in Fonts. Credit to miaubiz.

[422492] Medium CVE-2014-7943: Out-of-bounds read in Skia. Credit to Atte Kettunen of OUSPG.

[418881] Medium CVE-2014-7944: Out-of-bounds read in PDFium. Credit to cloudfuzzer.

[414310] Medium CVE-2014-7945: Out-of-bounds read in PDFium. Credit to cloudfuzzer.

[414109] Medium CVE-2014-7946: Out-of-bounds read in Fonts. Credit to miaubiz.

[430566] Medium CVE-2014-7947: Out-of-bounds read in PDFium. Credit to fuzztercluck.

[414026] Medium CVE-2014-7948: Caching error in AppCache. Credit to jiayaoqijia.

[449894] CVE-2015-1205: Various fixes from internal audits, fuzzing and other initiatives.

Multiple vulnerabilities in V8 fixed at the tip of the 3.30 branch (currently 3.30.33.15).

CVE-2014-7923 CVE-2014-7924 CVE-2014-7925 CVE-2014-7926 CVE-2014-7927 CVE-2014-7928 CVE-2014-7929 CVE-2014-7930 CVE-2014-7931 CVE-2014-7932 CVE-2014-7933 CVE-2014-7934 CVE-2014-7935 CVE-2014-7936 CVE-2014-7937 CVE-2014-7938 CVE-2014-7939 CVE-2014-7940 CVE-2014-7941 CVE-2014-7942 CVE-2014-7943 CVE-2014-7944 CVE-2014-7945 CVE-2014-7946 CVE-2014-7947 CVE-2014-7948 CVE-2015-1205 http://googlechromereleases.blogspot.nl 2015-01-21 2015-01-21 polarssl -- Remote attack using crafted certificates polarssl 1.2.01.2.12_1 polarssl13 1.3.01.3.9_1

PolarSSL team reports:

During the parsing of a ASN.1 sequence, a pointer in the linked list of asn1_sequence is not initialized by asn1_get_sequence_of(). In case an error occurs during parsing of the list, a situation is created where the uninitialized pointer is passed to polarssl_free().

This sequence can be triggered when a PolarSSL entity is parsing a certificate. So practically this means clients when receiving a certificate from the server or servers in case they are actively asking for a client certificate.

CVE-2015-1182 https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2014-04 https://www.certifiedsecure.com/polarssl-advisory/ 2015-01-14 2015-01-19 unzip -- input sanitization errors unzip 6.0_2

oCERT reports:

The UnZip tool is an open source extraction utility for archives compressed in the zip format.

The unzip command line tool is affected by heap-based buffer overflows within the CRC32 verification, the test_compr_eb() and the getZip64Data() functions. The input errors may result in arbitrary code execution.

A specially crafted zip file, passed to unzip -t, can be used to trigger the vulnerability.

CVE-2014-8139 CVE-2014-8140 CVE-2014-8141 http://www.info-zip.org/UnZip.html https://bugzilla.redhat.com/show_bug.cgi?id=1174844 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-8140 https://bugzilla.redhat.com/show_bug.cgi?id=1174856 2014-12-03 2015-01-16 samba -- Elevation of privilege to Active Directory Domain Controller samba4 4.0.04.0.23 samba41 4.1.04.1.15

Samba team reports:

In Samba's AD DC we neglected to ensure that attempted modifications of the userAccountControl attribute did not allow the UF_SERVER_TRUST_ACCOUNT bit to be set.

CVE-2014-8143 https://www.samba.org/samba/security/CVE-2014-8143 2015-01-15 2015-01-16 kde-runtime -- incorrect CBC encryption handling kde-runtime 4.12_3

Valentin Rusu reports:

Until KDE Applications 14.12.0, kwalletd incorrectly handled CBC encryption blocks when encrypting secrets in kwl files. The secrets were still encrypted, but the result binary data corresponded to an ECB encrypted block instead of CBC.

The ECB encryption algorithm, even if it'll scramble user data, will produce same encrypted byte sequence for the same input text. As a result, attackers may eventually find-out the encrypted text.

CVE-2013-7252 https://www.kde.org/info/security/advisory-20150109-1.txt 2015-01-09 2015-01-14 mozilla -- multiple vulnerabilities firefox 35.0,1 firefox-esr 31.4.0,1 linux-firefox 35.0,1 linux-seamonkey 2.32 linux-thunderbird 31.4.0 seamonkey 2.32 thunderbird 31.4.0 libxul 31.4.0

The Mozilla Project reports:

MFSA-2015-01 Miscellaneous memory safety hazards (rv:35.0 / rv:31.4)

MFSA-2015-02 Uninitialized memory use during bitmap rendering

MFSA-2015-03 sendBeacon requests lack an Origin header

MFSA-2015-04 Cookie injection through Proxy Authenticate responses

MFSA-2015-05 Read of uninitialized memory in Web Audio

MFSA-2015-06 Read-after-free in WebRTC

MFSA-2015-07 Gecko Media Plugin sandbox escape

MFSA-2015-08 Delegated OCSP responder certificates failure with id-pkix-ocsp-nocheck extension

MFSA-2015-09 XrayWrapper bypass through DOM objects

CVE-2014-8634 CVE-2014-8635 CVE-2014-8637 CVE-2014-8638 CVE-2014-8639 CVE-2014-8640 CVE-2014-8641 CVE-2014-8642 CVE-2014-8643 CVE-2014-8636 https://www.mozilla.org/en-US/security/advisories/mfsa2015-01/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-02/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-03/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-04/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-05/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-06/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-07/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-08/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-09/ https://www.mozilla.org/security/advisories/ 2015-01-13 2015-01-14 libevent -- integer overflow in evbuffers libevent 1.4.15 2.02.0.22 libevent2 2.0.22

Debian Security Team reports:

Andrew Bartlett of Catalyst reported a defect affecting certain applications using the Libevent evbuffer API. This defect leaves applications which pass insanely large inputs to evbuffers open to a possible heap overflow or infinite loop. In order to exploit this flaw, an attacker needs to be able to find a way to provoke the program into trying to make a buffer chunk larger than what will fit into a single size_t or off_t.

CVE-2014-6272 https://www.debian.org/security/2015/dsa-3119 2015-01-05 2015-01-11 2017-02-20 cURL -- URL request injection vulnerability curl 7.40.0

cURL reports:

When libcurl sends a request to a server via a HTTP proxy, it copies the entire URL into the request and sends if off. If the given URL contains line feeds and carriage returns those will be sent along to the proxy too, which allows the program to for example send a separate HTTP request injected embedded in the URL. Many programs allow some kind of external sources to set the URL or provide partial pieces for the URL to ask for, and if the URL as received from the user is not stripped good enough this flaw allows malicious users to do additional requests in a way that was not intended, or just to insert request headers into the request that the program didn't intend. We are not aware of any exploit of this flaw.

CVE-2014-8150 http://curl.haxx.se/docs/adv_20150108B.html 2014-12-25 2015-01-09 WebKit-gtk -- Multiple vulnerabilities webkit-gtk2 1.4.8 webkit-gtk3 1.4.8

Webkit release team reports:

This release fixes the following security issues: CVE-2014-1344, CVE-2014-1384, CVE-2014-1385, CVE-2014-1386, CVE-2014-1387, CVE-2014-1388, CVE-2014-1389, CVE-2014-1390.

http://webkitgtk.org/2015/01/07/webkitgtk2.4.8-released.html CVE-2014-1344 CVE-2014-1384 CVE-2014-1385 CVE-2014-1386 CVE-2014-1387 CVE-2014-1388 CVE-2014-1389 CVE-2014-1390 2015-01-07 2015-01-09 OpenSSL -- multiple vulnerabilities openssl 1.0.11.0.1_17 mingw32-openssl 1.0.11.0.1k linux-c6-openssl 1.0.1e_3 FreeBSD 10.110.1_4 10.010.0_16 9.39.3_8 8.48.4_22

OpenSSL project reports:

DTLS segmentation fault in dtls1_get_record (CVE-2014-3571)

DTLS memory leak in dtls1_buffer_record (CVE-2015-0206)

no-ssl3 configuration sets method to NULL (CVE-2014-3569)

ECDHE silently downgrades to ECDH [Client] (CVE-2014-3572)

RSA silently downgrades to EXPORT_RSA [Client] (CVE-2015-0204)

DH client certificates accepted without verification [Server] (CVE-2015-0205)

Certificate fingerprints can be modified (CVE-2014-8275)

Bignum squaring may produce incorrect results (CVE-2014-3570)

SA-15:01.openssl CVE-2014-3569 CVE-2014-3570 CVE-2014-3571 CVE-2014-3572 CVE-2014-8275 CVE-2015-0204 CVE-2015-0205 CVE-2015-0206 https://www.openssl.org/news/secadv_20150108.txt 2015-01-08 2015-01-08 2016-08-09 wordpress -- multiple vulnerabilities wordpress 3.7.5,1 3.8,13.8.5,1 3.9,13.9.3,1 4.0,14.0.1,1 zh-wordpress 3.7.5 3.83.8.5 3.93.9.3 4.04.0.1 de-wordpress 3.7.5 3.83.8.5 3.93.9.3 4.04.0.1 ja-wordpress 3.7.5 3.83.8.5 3.93.9.3 4.04.0.1 ru-wordpress 3.7.5 3.83.8.5 3.93.9.3 4.04.0.1

MITRE reports:

wp-login.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to reset passwords by leveraging access to an e-mail account that received a password-reset message.

wp-includes/http.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to conduct server-side request forgery (SSRF) attacks by referring to a 127.0.0.0/8 resource.

WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to obtain access to an account idle since 2008 by leveraging an improper PHP dynamic type comparison for an MD5 hash.

Cross-site scripting (XSS) vulnerability in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via a crafted Cascading Style Sheets (CSS) token sequence in a post.

Cross-site scripting (XSS) vulnerability in Press This in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors

wp-includes/class-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to cause a denial of service (CPU consumption) via a long password that is improperly handled during hashing, a similar issue to CVE-2014-9016.

Cross-site request forgery (CSRF) vulnerability in wp-login.php in WordPress 3.7.4, 3.8.4, 3.9.2, and 4.0 allows remote attackers to hijack the authentication of arbitrary users for requests that reset passwords.

CVE-2014-9033 CVE-2014-9034 CVE-2014-9035 CVE-2014-9036 CVE-2014-9037 CVE-2014-9038 CVE-2014-9039 2014-11-25 2015-01-05 png -- heap overflow for 32-bit builds png 1.2.61.5.21 1.61.6.16

32-bit builds of PNG library are vulnerable to an unsigned integer overflow that is triggered by a crafted wide interlaced images. Overflow results in a heap corruption that will crash the application and may lead to the controlled overwrite of a selected portions of process address space.

http://tfpwn.com/files/libpng_heap_overflow_1.6.15.txt http://codelabs.ru/security/vulns/analysis/libpng/2014-dec-libpng-1.6.15/ 2014-12-23 2015-01-05 file -- multiple vulnerabilities file 5.21 FreeBSD 8.48.4_20 9.19.1_23 9.29.2_16 9.39.3_6 10.010.0_13 10.110.1_1

RedHat reports:

Thomas Jarosch of Intra2net AG reported a number of denial of service issues (resource consumption) in the ELF parser used by file(1). These issues were fixed in the 5.21 release of file(1), but by mistake are missing from the changelog.

CVE-2014-3710 CVE-2014-8116 CVE-2014-8117 SA-14:28.file http://seclists.org/oss-sec/2014/q4/1056 2014-12-16 2015-01-02 mutt -- denial of service via crafted mail message mutt 1.5.221.5.23_7 ja-mutt 1.5.221.5.23_7 zh-mutt 1.5.221.5.23_7

NVD reports:

The write_one_header function in mutt 1.5.23 does not properly handle newline characters at the beginning of a header, which allows remote attackers to cause a denial of service (crash) via a header with an empty body, which triggers a heap-based buffer overflow in the mutt_substrdup function.

71334 CVE-2014-9116 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=771125 http://dev.mutt.org/trac/ticket/3716 2014-11-26 2014-12-23 ntp -- multiple vulnerabilities ntp ntp-devel 4.2.8

CERT reports:

The Network Time Protocol (NTP) provides networked systems with a way to synchronize time for various services and applications. ntpd version 4.2.7 and pervious versions allow attackers to overflow several buffers in a way that may allow malicious code to be executed. ntp-keygen prior to version 4.2.7p230 also uses a non-cryptographic random number generator when generating symmetric keys.

The buffer overflow vulnerabilities in ntpd may allow a remote unauthenticated attacker to execute arbitrary malicious code with the privilege level of the ntpd process. The weak default key and non-cryptographic random number generator in ntp-keygen may allow an attacker to gain information regarding the integrity checking and authentication encryption schemes.

CVE-2014-9293 CVE-2014-9294 CVE-2014-9295 CVE-2014-9296 http://www.kb.cert.org/vuls/id/852879 2014-12-19 2014-12-20 git -- Arbitrary command execution on case-insensitive filesystems git 2.2.1

The Git Project reports:

When using a case-insensitive filesystem an attacker can craft a malicious Git tree that will cause Git to overwrite its own .git/config file when cloning or checking out a repository, leading to arbitrary command execution in the client machine. If you are a hosting service whose users may fetch from your service to Windows or Mac OS X machines, you are strongly encouraged to update to protect such users who use existing versions of Git.

CVE-2014-9390 https://github.com/blog/1938-git-client-vulnerability-announced http://article.gmane.org/gmane.linux.kernel/1853266 2014-12-19 2014-12-19 otrs -- Incomplete Access Control otrs 3.2.*3.2.17 3.3.*3.3.11 4.0.*4.0.3

The OTRS project reports:

An attacker with valid OTRS credentials could access and manipulate ticket data of other users via the GenericInterface, if a ticket webservice is configured and not additionally secured.

http://www.otrs.com/security-advisory-2014-06-incomplete-access-control/ CVE-2014-9324 2014-12-16 2014-12-16 subversion -- DoS vulnerabilities mod_dav_svn 1.8.01.8.11 subversion16 1.0.01.7.19 subversion17 1.0.01.7.19 subversion 1.0.01.7.19 1.8.01.8.11

Subversion Project reports:

Subversion's mod_dav_svn Apache HTTPD server module will crash when it receives a REPORT request for some invalid formatted special URIs.

Subversion's mod_dav_svn Apache HTTPD server module will crash when it receives a request for some invalid formatted special URIs.

We consider this to be a medium risk vulnerability. Repositories which allow for anonymous reads will be vulnerable without authentication. Unfortunately, no special configuration is required and all mod_dav_svn servers are vulnerable.

CVE-2014-3580 CVE-2014-8108 http://subversion.apache.org/security/CVE-2014-3580-advisory.txt http://subversion.apache.org/security/CVE-2014-8108-advisory.txt 2014-12-13 2014-12-15 NVIDIA UNIX driver -- remote denial of service or arbitrary code execution nvidia-driver 340.65 nvidia-driver-304 304.125 nvidia-driver-173 173.14.35_3 nvidia-driver-96 96.43.23_2 nvidia-driver-71 71.86.15_4

NVIDIA Unix security team reports:

The GLX indirect rendering support supplied on NVIDIA products is subject to the recently disclosed X.Org vulnerabilities (CVE-2014-8093, CVE-2014-8098) as well as internally identified vulnerabilities (CVE-2014-8298).

Depending on how it is configured, the X server typically runs with raised privileges, and listens for GLX indirect rendering protocol requests from a local socket and potentially a TCP/IP port. The vulnerabilities could be exploited in a way that causes the X server to access uninitialized memory or overwrite arbitrary memory in the X server process. This can cause a denial of service (e.g., an X server segmentation fault), or could be exploited to achieve arbitrary code execution.

CVE-2014-8298 CVE-2014-8093 CVE-2014-8098 2014-12-03 2014-12-14 bind -- denial of service vulnerability bind99 bind99-base 9.9.6 bind98 bind98-base bind96 bind96-base 0 FreeBSD 9.39.3_6 9.29.2_16 9.19.1_23 8.48.4_20

ISC reports:

We have today posted updated versions of 9.9.6 and 9.10.1 to address a significant security vulnerability in DNS resolution. The flaw was discovered by Florian Maury of ANSSI, and applies to any recursive resolver that does not support a limit on the number of recursions. [CERTFR-2014-AVI-512], [USCERT VU#264212]

A flaw in delegation handling could be exploited to put named into an infinite loop, in which each lookup of a name server triggered additional lookups of more name servers. This has been addressed by placing limits on the number of levels of recursion named will allow (default 7), and on the number of queries that it will send before terminating a recursive query (default 50). The recursion depth limit is configured via the max-recursion-depth option, and the query limit via the max-recursion-queries option. For more information, see the security advisory at https://kb.isc.org/article/AA-01216/. [CVE-2014-8500] [RT #37580]

In addition, we have also corrected a potential security vulnerability in the GeoIP feature in the 9.10.1 release only. For more information on this issue, see the security advisory at https://kb.isc.org/article/AA-01217. [CVE-2014-8680]

SA-14:29.bind CVE-2014-8500 CVE-2014-8680 https://www.isc.org/blogs/important-security-advisory-posted/ 2014-12-08 2014-12-11 2016-08-09 asterisk -- Remote Crash Vulnerability in WebSocket Server asterisk11 11.14.2

The Asterisk project reports:

When handling a WebSocket frame the res_http_websocket module dynamically changes the size of the memory used to allow the provided payload to fit. If a payload length of zero was received the code would incorrectly attempt to resize to zero. This operation would succeed and end up freeing the memory but be treated as a failure. When the session was subsequently torn down this memory would get freed yet again causing a crash.

Users of the WebSocket functionality also did not take into account that provided text frames are not guaranteed to be NULL terminated. This has been fixed in chan_sip and chan_pjsip in the applicable versions.

http://downloads.asterisk.org/pub/security/AST-2014-019.html CVE-2014-9374 2014-10-30 2014-12-11 2015-01-29 xserver -- multiple issue with X client request handling xorg-server 1.12.4_10,1

Alan Coopersmith reports:

Ilja van Sprundel, a security researcher with IOActive, has discovered a large number of issues in the way the X server code base handles requests from X clients, and has worked with X.Org's security team to analyze, confirm, and fix these issues.

The vulnerabilities could be exploited to cause the X server to access uninitialized memory or overwrite arbitrary memory in the X server process. This can cause a denial of service (e.g., an X server segmentation fault), or could be exploited to achieve arbitrary code execution.

The GLX extension to the X Window System allows an X client to send X protocol to the X server, to request that the X server perform OpenGL rendering on behalf of the X client. This is known as "GLX indirect rendering", as opposed to "GLX direct rendering" where the X client submits OpenGL rendering commands directly to the GPU, bypassing the X server and avoiding the X server code for GLX protocol handling.

Most GLX indirect rendering implementations share some common ancestry, dating back to "Sample Implementation" code from Silicon Graphics, Inc (SGI), which SGI originally commercially licensed to other Unix workstation and graphics vendors, and later released as open source, so those vulnerabilities may affect other licensees of SGI's code base beyond those running code from the X.Org Foundation or the XFree86 Project.

http://lists.x.org/archives/xorg-announce/2014-December/002500.html CVE-2014-8091 CVE-2014-8092 CVE-2014-8093 CVE-2014-8094 CVE-2014-8095 CVE-2014-8096 CVE-2014-8097 CVE-2014-8098 CVE-2014-8099 CVE-2014-8100 CVE-2014-8101 CVE-2014-8102 2014-12-09 2014-12-10 unbound -- can be tricked into following an endless series of delegations, this consumes a lot of resources unbound 1.5.1 FreeBSD 10.010.0_14 10.110.1_2

Unbound developer reports:

The resolver can be tricked into following an endless series of delegations, this consumes a lot of resources.

http://unbound.net/downloads/CVE-2014-8602.txt SA-14:30.unbound CVE-2014-8602 2014-12-08 2014-12-09 2016-08-09 freetype -- Out of bounds stack-based read/write freetype2 2.5.4

Werner LEMBERG reports:

The fix for CVE-2014-2240 was not 100% complete to fix the issue from the CVE completly.

http://lists.nongnu.org/archive/html/freetype-announce/2014-12/msg00000.html CVE-2014-2240 2014-12-07 2014-12-07 phpMyAdmin -- XSS and DoS vulnerabilities phpMyAdmin 4.2.04.2.13.1

The phpMyAdmin development team reports:

DoS vulnerability with long passwords.

With very long passwords it was possible to initiate a denial of service attack on phpMyAdmin.

We consider this vulnerability to be serious.

This vulnerability can be mitigated by configuring throttling in the webserver.

XSS vulnerability in redirection mechanism.

With a crafted URL it was possible to trigger an XSS in the redirection mechanism in phpMyAdmin.

We consider this vulnerability to be non critical.

http://www.phpmyadmin.net/home_page/security/PMASA-2014-17.php http://www.phpmyadmin.net/home_page/security/PMASA-2014-18.php CVE-2014-9218 CVE-2014-9219 2014-12-03 2014-12-04 mozilla -- multiple vulnerabilities firefox 34.0,1 firefox-esr 31.3.0,1 linux-firefox 34.0,1 linux-seamonkey 2.31 linux-thunderbird 31.3.0 seamonkey 2.31 thunderbird 31.3.0 libxul 31.3.0 nss 3.17.3

The Mozilla Project reports:

ASN.1 DER decoding of lengths is too permissive, allowing undetected smuggling of arbitrary data

MFSA-2014-90 Apple CoreGraphics framework on OS X 10.10 logging input data to /tmp directory

MFSA-2014-89 Bad casting from the BasicThebesLayer to BasicContainerLayer

MFSA-2014-88 Buffer overflow while parsing media content

MFSA-2014-87 Use-after-free during HTML5 parsing

MFSA-2014-86 CSP leaks redirect data via violation reports

MFSA-2014-85 XMLHttpRequest crashes with some input streams

MFSA-2014-84 XBL bindings accessible via improper CSS declarations

MFSA-2014-83 Miscellaneous memory safety hazards (rv:34.0 / rv:31.3)

CVE-2014-1587 CVE-2014-1588 CVE-2014-1589 CVE-2014-1590 CVE-2014-1591 CVE-2014-1592 CVE-2014-1593 CVE-2014-1594 CVE-2014-1595 CVE-2014-1569 https://www.mozilla.org/security/advisories/mfsa2014-83 https://www.mozilla.org/security/advisories/mfsa2014-84 https://www.mozilla.org/security/advisories/mfsa2014-85 https://www.mozilla.org/security/advisories/mfsa2014-86 https://www.mozilla.org/security/advisories/mfsa2014-87 https://www.mozilla.org/security/advisories/mfsa2014-88 https://www.mozilla.org/security/advisories/mfsa2014-89 https://www.mozilla.org/security/advisories/mfsa2014-90 https://www.mozilla.org/security/advisories/ 2014-12-01 2014-12-02 OpenVPN -- denial of service security vulnerability openvpn 2.0.11 2.1.02.2.3 2.3.02.3.6

The OpenVPN project reports:

In late November 2014 Dragana Damjanovic notified OpenVPN developers of a critical denial of service security vulnerability (CVE-2014-8104). The vulnerability allows an tls-authenticated client to crash the server by sending a too-short control channel packet to the server. In other words this vulnerability is denial of service only.

CVE-2014-8104 https://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-97597e732b 2014-12-01 2014-12-02 flac -- Multiple vulnerabilities flac 1.3.0_3 linux-c6-flac 1.2.1_3

Erik de Castro Lopo reports:

Google Security Team member, Michele Spagnuolo, recently found two potential problems in the FLAC code base. They are:

CVE-2014-9028: Heap buffer write overflow.

CVE-2014-8962: Heap buffer read overflow.

https://git.xiph.org/?p=flac.git;a=commit;h=5b3033a2b355068c11fe637e14ac742d273f076e CVE-2014-8962 https://git.xiph.org/?p=flac.git;a=commit;h=fcf0ba06ae12ccd7c67cee3c8d948df15f946b85 CVE-2014-9028 2014-11-25 2014-11-25 2015-07-15 asterisk -- Multiple vulnerabilities asterisk11 11.14.1

The Asterisk project reports:

AST-2014-014 - High call load may result in hung channels in ConfBridge.

AST-2014-017 - Permission escalation through ConfBridge actions/dialplan functions.

http://downloads.asterisk.org/pub/security/AST-2014-014.html CVE-2014-8414 http://downloads.asterisk.org/pub/security/AST-2014-017.html CVE-2014-8417 2014-11-21 2014-11-21 asterisk -- Multiple vulnerabilities asterisk 1.8.32.1 asterisk11 11.14.1

The Asterisk project reports:

AST-2014-012 - Mixed IP address families in access control lists may permit unwanted traffic.

AST-2014-018 - AMI permission escalation through DB dialplan function.

http://downloads.asterisk.org/pub/security/AST-2014-012.html CVE-2014-8412 http://downloads.asterisk.org/pub/security/AST-2014-018.html CVE-2014-8418 2014-11-21 2014-11-21 phpMyAdmin -- XSS and information disclosure vulnerabilities phpMyAdmin 4.2.04.2.12

The phpMyAdmin development team reports:

With a crafted database, table or column name it is possible to trigger an XSS attack in the table browse page.

With a crafted ENUM value it is possible to trigger XSS attacks in the table print view and zoom search pages.

With a crafted value for font size it is possible to trigger an XSS attack in the home page.

These vulnerabilities can be triggered only by someone who is logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required pages. Moreover, exploitation of the XSS vulnerability related to the font size requires forgery of the pma_fontsize cookie.

In the GIS editor feature, a parameter specifying the geometry type was not correcly validated, opening the door to a local file inclusion attack.

This vulnerability can be triggered only by someone who is logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required page.

With a crafted file name it is possible to trigger an XSS in the error reporting page.

This vulnerability can be triggered only by someone who is logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required page.

In the error reporting feature, a parameter specifying the file was not correctly validated, allowing the attacker to derive the line count of an arbitrary file

This vulnerability can be triggered only by someone who is logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required page.

http://www.phpmyadmin.net/home_page/security/PMASA-2014-13.php http://www.phpmyadmin.net/home_page/security/PMASA-2014-14.php http://www.phpmyadmin.net/home_page/security/PMASA-2014-15.php http://www.phpmyadmin.net/home_page/security/PMASA-2014-16.php CVE-2014-8958 CVE-2014-8959 CVE-2014-8960 CVE-2014-8961 2014-11-20 2014-11-21 kwebkitpart, kde-runtime -- insufficient input validation kde-runtime 4.14.2_2 kwebkitpart 1.3.2_4

Albert Aastals Cid reports:

kwebkitpart and the bookmarks:// io slave were not sanitizing input correctly allowing to some javascript being executed on the context of the referenced hostname.

Whilst in most cases, the JavaScript will be executed in an untrusted context, with the bookmarks IO slave, it will be executed in the context of the referenced hostname. It should however be noted that KDE mitigates this risk by attempting to ensure that such URLs cannot be embedded directly into Internet hosted content.

https://www.kde.org/info/security/advisory-20141113-1.txt CVE-2014-8600 2014-11-13 2014-11-20 yii -- Remote arbitrary PHP code execution yii 1.1.15

Yii PHP Framework developers report:

We are releasing Yii 1.1.15 to fix a security issue found in 1.1.14. We urge all 1.1.14 users to upgrade their Yii to this latest release. Note that the issue only affects 1.1.14. All previous releases are not affected. Upgrading to this release from 1.1.14 is very safe and will not break your existing code.

The vulnerability is in the CDetailView widget. When a Yii application uses this widget and configures the "value" property of a CDetailView attribute using end user inputs, it may allow attackers to potentially execute arbitrary PHP scripts on the server. We are not showing how to exploit it here to allow users to upgrade before details about the exploit become publicly known. To our knowledge the details of this issue are only known to core team members.

CVE-2014-4672 http://www.yiiframework.com/news/78/yii-1-1-15-is-released-security-fix 2014-07-03 2014-11-19 chromium -- multiple vulnerabilities chromium 39.0.2171.65 chromium-pulse 39.0.2171.65

Google Chrome Releases reports:

42 security fixes in this release, including:

[389734] High CVE-2014-7899: Address bar spoofing. Credit to Eli Grey.

[406868] High CVE-2014-7900: Use-after-free in pdfium. Credit to Atte Kettunen from OUSPG.

[413375] High CVE-2014-7901: Integer overflow in pdfium. Credit to cloudfuzzer.

[414504] High CVE-2014-7902: Use-after-free in pdfium. Credit to cloudfuzzer.

[414525] High CVE-2014-7903: Buffer overflow in pdfium. Credit to cloudfuzzer.

[418161] High CVE-2014-7904: Buffer overflow in Skia. Credit to Atte Kettunen from OUSPG.

[421817] High CVE-2014-7905: Flaw allowing navigation to intents that do not have the BROWSABLE category. Credit to WangTao(neobyte) of Baidu X-Team.

[423030] High CVE-2014-7906: Use-after-free in pepper plugins. Credit to Chen Zhang (demi6od) of the NSFOCUS Security Team.

[423703] High CVE-2014-0574: Double-free in Flash. Credit to biloulehibou.

[424453] High CVE-2014-7907: Use-after-free in blink. Credit to Chen Zhang (demi6od) of the NSFOCUS Security Team.

[425980] High CVE-2014-7908: Integer overflow in media. Credit to Christoph Diehl.

[391001] Medium CVE-2014-7909: Uninitialized memory read in Skia. Credit to miaubiz.

CVE-2014-7910: Various fixes from internal audits, fuzzing and other initiatives.

CVE-2014-0574 CVE-2014-7899 CVE-2014-7900 CVE-2014-7901 CVE-2014-7902 CVE-2014-7903 CVE-2014-7904 CVE-2014-7905 CVE-2014-7906 CVE-2014-7907 CVE-2014-7908 CVE-2014-7909 CVE-2014-7910 http://googlechromereleases.blogspot.nl/2014/11/stable-channel-update_18.html 2014-11-18 2014-11-18 kde-workspace -- privilege escalation kde-workspace 4.11.13_1

David Edmundson reports:

KDE workspace configuration module for setting the date and time has a helper program which runs as root for performing actions. This is secured with polkit.

This helper takes the name of the ntp utility to run as an argument. This allows a hacker to run any arbitrary command as root under the guise of updating the time.

An application can gain root priveledges from an admin user with either misleading information or no interaction.

On some systems the user will be shown a prompt to change the time. However, if the system has policykit-desktop-privileges installed, the datetime helper will be invoked by an admin user without any prompts.

CVE-2014-8651 http://seclists.org/oss-sec/2014/q4/520 2014-11-06 2014-11-17 dbus -- incomplete fix for CVE-2014-3636 part A dbus 1.8.10

Simon McVittie reports:

The patch issued by the D-Bus maintainers for CVE-2014-3636 was based on incorrect reasoning, and does not fully prevent the attack described as "CVE-2014-3636 part A", which is repeated below. Preventing that attack requires raising the system dbus-daemon's RLIMIT_NOFILE (ulimit -n) to a higher value. CVE-2014-7824 has been allocated for this vulnerability.

CVE-2014-7824 http://lists.freedesktop.org/archives/dbus/2014-November/016395.html 2014-11-10 2014-11-11 wget -- path traversal vulnerability in recursive FTP mode wget 1.16

MITRE reports:

Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, and consequently execute arbitrary code, via a LIST response that references the same filename within two entries, one of which indicates that the filename is for a symlink.

CVE-2014-4877 685996 2014-10-27 2014-11-08 Konversation -- out-of-bounds read on a heap-allocated array konversation 1.5.1

Konversation developers report:

Konversation's Blowfish ECB encryption support assumes incoming blocks to be the expected 12 bytes. The lack of a sanity-check for the actual size can cause a denial of service and an information leak to the local user.

CVE-2014-8483 https://www.kde.org/info/security/advisory-20141104-1.txt 2014-11-04 2014-11-05 twiki -- remote Perl code execution twiki 5.1.4_1,1

TWiki developers report:

The debugenableplugins request parameter allows arbitrary Perl code execution.

Using an HTTP GET request towards a TWiki server, add a specially crafted debugenableplugins request parameter to TWiki's view script (typically port 80/TCP). Prior authentication may or may not be necessary.

A remote attacker can execute arbitrary Perl code to view and modify any file the webserver user has access to.

Example: http://www.example.com/do/view/Main/WebHome?debugenableplugins=BackupRestorePlugin%3bprint("Content-Type:text/html\r\n\r\nVulnerable!")%3bexit

The TWiki site is vulnerable if you see a page with text "Vulnerable!".

CVE-2014-7236 http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2014-7236 2014-10-09 2014-10-31 jenkins -- slave-originated arbitrary code execution on master servers jenkins 1.587 jenkins-lts 1.580.1

Kohsuke Kawaguchi from Jenkins team reports:

Historically, Jenkins master and slaves behaved as if they altogether form a single distributed process. This means a slave can ask a master to do just about anything within the confinement of the operating system, such as accessing files on the master or trigger other jobs on Jenkins.

This has increasingly become problematic, as larger enterprise deployments have developed more sophisticated trust separation model, where the administators of a master might take slaves owned by other teams. In such an environment, slaves are less trusted than the master. Yet the "single distributed process" assumption was not communicated well to the users, resulting in vulnerabilities in some deployments.

SECURITY-144 (CVE-2014-3665) introduces a new subsystem to address this problem. This feature is off by default for compatibility reasons. See Wiki for more details, who should turn this on, and implications.

CVE-2014-3566 is rated high. It only affects installations that accept slaves from less trusted computers, but this will allow an owner of of such slave to mount a remote code execution attack on Jenkins.

CVE-2014-3665 https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-30 https://wiki.jenkins-ci.org/display/JENKINS/Slave+To+Master+Access+Control http://www.cloudbees.com/jenkins-security-advisory-2014-10-30 2014-10-30 2014-10-31 libssh -- PRNG state reuse on forking servers libssh 0.6.3

Aris Adamantiadis reports:

When accepting a new connection, the server forks and the child process handles the request. The RAND_bytes() function of openssl doesn't reset its state after the fork, but simply adds the current process id (getpid) to the PRNG state, which is not guaranteed to be unique.

CVE-2014-0017 http://www.openwall.com/lists/oss-security/2014/03/05/1 http://secunia.com/advisories/57407 2014-03-05 2014-10-29 libpurple/pidgin -- multiple vulnerabilities libpurple 2.10.10 pidgin 2.10.10

The pidgin development team reports:

.

CVE-2014-3694 CVE-2014-3697 CVE-2014-3696 CVE-2014-3695 CVE-2014-3698 https://developer.pidgin.im/wiki/ChangeLog 2014-10-22 2014-10-24 phpMyAdmin -- XSS vulnerabilities in SQL debug output and server monitor page. phpMyAdmin 4.2.04.2.10.1

The phpMyAdmin development team reports:

With a crafted database or table name it is possible to trigger an XSS in SQL debug output when enabled and in server monitor page when viewing and analysing executed queries.

This vulnerability can be triggered only by someone who is logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required pages. Moreover, debugging SQL is a developer option which is disabled by default and expected to be disabled in production environments.

http://www.phpmyadmin.net/home_page/security/PMASA-2014-12.php CVE-2014-8326 2014-10-21 2014-10-22 asterisk -- Asterisk Susceptibility to POODLE Vulnerability asterisk 1.8.31.1 asterisk11 11.13.1

The Asterisk project reports:

The POODLE vulnerability is described under CVE-2014-3566. This advisory describes the Asterisk's project susceptibility to this vulnerability.

http://downloads.asterisk.org/pub/security/AST-2014-011.html CVE-2014-3566 2014-10-20 2014-10-21 libxml2 -- Denial of service libxml2 2.9.2 linux-c6-libxml2 2.7.6_2 linux-f10-libxml2 *

RedHat reports:

A denial of service flaw was found in libxml2, a library providing support to read, modify and write XML and HTML files. A remote attacker could provide a specially crafted XML file that, when processed by an application using libxml2, would lead to excessive CPU consumption (denial of service) based on excessive entity substitutions, even if entity substitution was disabled, which is the parser default behavior.

CVE-2014-3660 https://rhn.redhat.com/errata/RHSA-2014-1655.html 2014-10-16 2014-10-18 2015-07-15 drupal7 -- SQL injection drupal7 7.32

Drupal Security Team reports:

Drupal 7 includes a database abstraction API to ensure that queries executed against the database are sanitized to prevent SQL injection attacks. A vulnerability in this API allows an attacker to send specially crafted requests resulting in arbitrary SQL execution. Depending on the content of the requests this can lead to privilege escalation, arbitrary PHP execution, or other attacks. This vulnerability can be exploited by anonymous users.

CVE-2014-3704 https://www.drupal.org/SA-CORE-2014-005 https://www.sektioneins.de/en/blog/14-10-15-drupal-sql-injection-vulnerability.html 2014-10-15 2014-10-16 OpenSSL -- multiple vulnerabilities openssl 1.0.11.0.1_16 mingw32-openssl 1.0.11.0.1j linux-c6-openssl 1.0.1e_1 FreeBSD 8.48.4_17 9.19.1_20 9.29.2_13 9.39.3_3 10.010.0_10

The OpenSSL Project reports:

A flaw in the DTLS SRTP extension parsing code allows an attacker, who sends a carefully crafted handshake message, to cause OpenSSL to fail to free up to 64k of memory causing a memory leak. This could be exploited in a Denial Of Service attack. This issue affects OpenSSL 1.0.1 server implementations for both SSL/TLS and DTLS regardless of whether SRTP is used or configured. Implementations of OpenSSL that have been compiled with OPENSSL_NO_SRTP defined are not affected. [CVE-2014-3513].

When an OpenSSL SSL/TLS/DTLS server receives a session ticket the integrity of that ticket is first verified. In the event of a session ticket integrity check failing, OpenSSL will fail to free memory causing a memory leak. By sending a large number of invalid session tickets an attacker could exploit this issue in a Denial Of Service attack. [CVE-2014-3567].

OpenSSL has added support for TLS_FALLBACK_SCSV to allow applications to block the ability for a MITM attacker to force a protocol downgrade.

Some client applications (such as browsers) will reconnect using a downgraded protocol to work around interoperability bugs in older servers. This could be exploited by an active man-in-the-middle to downgrade connections to SSL 3.0 even if both sides of the connection support higher protocols. SSL 3.0 contains a number of weaknesses including POODLE [CVE-2014-3566].

When OpenSSL is configured with "no-ssl3" as a build option, servers could accept and complete a SSL 3.0 handshake, and clients could be configured to send them. [CVE-2014-3568].

SA-14:23.openssl CVE-2014-3513 CVE-2014-3566 CVE-2014-3567 CVE-2014-3568 https://www.openssl.org/news/secadv_20141015.txt 2014-10-15 2014-10-15 2016-08-09 mozilla -- multiple vulnerabilities firefox 33.0,1 firefox-esr 31.2.0,1 linux-firefox 33.0,1 linux-seamonkey 2.30 linux-thunderbird 31.2.0 seamonkey 2.30 thunderbird 31.2.0 libxul 31.2.0

The Mozilla Project reports:

MFSA 2014-74 Miscellaneous memory safety hazards (rv:33.0 / rv:31.2)

MFSA 2014-75 Buffer overflow during CSS manipulation

MFSA 2014-76 Web Audio memory corruption issues with custom waveforms

MFSA 2014-78 Further uninitialized memory use during GIF

MFSA 2014-79 Use-after-free interacting with text directionality

MFSA 2014-80 Key pinning bypasses

MFSA 2014-81 Inconsistent video sharing within iframe

MFSA 2014-82 Accessing cross-origin objects via the Alarms API

CVE-2014-1574 CVE-2014-1575 CVE-2014-1576 CVE-2014-1577 CVE-2014-1580 CVE-2014-1581 CVE-2014-1582 CVE-2014-1583 CVE-2014-1584 CVE-2014-1585 CVE-2014-1586 https://www.mozilla.org/security/announce/2014/mfsa2014-74.html https://www.mozilla.org/security/announce/2014/mfsa2014-75.html https://www.mozilla.org/security/announce/2014/mfsa2014-76.html https://www.mozilla.org/security/announce/2014/mfsa2014-78.html https://www.mozilla.org/security/announce/2014/mfsa2014-79.html https://www.mozilla.org/security/announce/2014/mfsa2014-80.html https://www.mozilla.org/security/announce/2014/mfsa2014-81.html https://www.mozilla.org/security/announce/2014/mfsa2014-82.html https://www.mozilla.org/security/announce/ 2014-10-14 2014-10-14 2015-08-12 foreman-proxy SSL verification issue foreman-proxy 1.6.2

Foreman Security reports:

The smart proxy when running in an SSL-secured mode permits incoming API calls to any endpoint without requiring, or performing any verification of an SSL client certificate. This permits any client with access to the API to make requests and perform actions permitting control of Puppet CA, DHCP, DNS etc.)

CVE-2014-3691 https://groups.google.com/forum/#!topic/foreman-announce/LcjZx25Bl7U 2014-05-09 2014-10-09 chromium -- multiple vulnerabilities chromium chromium-pulse 38.0.2125.101

Google Chrome Releases reports:

159 security fixes in this release, including 113 found using MemorySanitizer:

[416449] Critical CVE-2014-3188: A special thanks to Jüri Aedla for a combination of V8 and IPC bugs that can lead to remote code execution outside of the sandbox.

[398384] High CVE-2014-3189: Out-of-bounds read in PDFium. Credit to cloudfuzzer.

[400476] High CVE-2014-3190: Use-after-free in Events. Credit to cloudfuzzer.

[402407] High CVE-2014-3191: Use-after-free in Rendering. Credit to cloudfuzzer.

[403276] High CVE-2014-3192: Use-after-free in DOM. Credit to cloudfuzzer.

[399655] High CVE-2014-3193: Type confusion in Session Management. Credit to miaubiz.

[401115] High CVE-2014-3194: Use-after-free in Web Workers. Credit to Collin Payne.

[403409] Medium CVE-2014-3195: Information Leak in V8. Credit to Jüri Aedla.

[338538] Medium CVE-2014-3196: Permissions bypass in Windows Sandbox. Credit to James Forshaw.

[396544] Medium CVE-2014-3197: Information Leak in XSS Auditor. Credit to Takeshi Terada.

[415307] Medium CVE-2014-3198: Out-of-bounds read in PDFium. Credit to Atte Kettunen of OUSPG.

[395411] Low CVE-2014-3199: Release Assert in V8 bindings. Credit to Collin Payne.

[420899] CVE-2014-3200: Various fixes from internal audits, fuzzing and other initiatives (Chrome 38).

Multiple vulnerabilities in V8 fixed at the tip of the 3.28 branch (currently 3.28.71.15).

CVE-2014-3188 CVE-2014-3189 CVE-2014-3190 CVE-2014-3191 CVE-2014-3192 CVE-2014-3193 CVE-2014-3194 CVE-2014-3195 CVE-2014-3196 CVE-2014-3197 CVE-2014-3198 CVE-2014-3199 CVE-2014-3200 http://googlechromereleases.blogspot.nl/2014/10/stable-channel-update.html 2014-10-07 2014-10-08 Bugzilla multiple security issues bugzilla44 4.4.6

Bugzilla Security Advisory

Unauthorized Account Creation

An attacker creating a new Bugzilla account can override certain parameters when finalizing the account creation that can lead to the user being created with a different email address than originally requested. The overridden login name could be automatically added to groups based on the group's regular expression setting.

Cross-Site Scripting

During an audit of the Bugzilla code base, several places were found where cross-site scripting exploits could occur which could allow an attacker to access sensitive information.

Information Leak

If a new comment was marked private to the insider group, and a flag was set in the same transaction, the comment would be visible to flag recipients even if they were not in the insider group.

Social Engineering

Search results can be exported as a CSV file which can then be imported into external spreadsheet programs. Specially formatted field values can be interpreted as formulas which can be executed and used to attack a user's computer.

CVE-2014-1572 CVE-2014-1573 CVE-2014-1571 https://bugzilla.mozilla.org/show_bug.cgi?id=1074812 https://bugzilla.mozilla.org/show_bug.cgi?id=1075578 https://bugzilla.mozilla.org/show_bug.cgi?id=1064140 https://bugzilla.mozilla.org/show_bug.cgi?id=1054702 2014-10-06 2014-10-06 rt42 -- vulnerabilities related to shellshock rt42 4.2.04.2.8

Best Practical reports:

RT 4.2.0 and above may be vulnerable to arbitrary execution of code by way of CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, or CVE-2014-6271 -- collectively known as "Shellshock." This vulnerability requires a privileged user with access to an RT instance running with SMIME integration enabled; it applies to both mod_perl and fastcgi deployments. If you have already taken upgrades to bash to resolve "Shellshock," you are protected from this vulnerability in RT, and there is no need to apply this patch. This vulnerability has been assigned CVE-2014-7227.

http://blog.bestpractical.com/2014/10/security-vulnerability-in-rt-42x-cve-2014-7227.html CVE-2014-7227 2014-10-02 2014-10-02 jenkins -- remote execution, privilege escalation, XSS, password exposure, ACL hole, DoS jenkins 1.583 jenkins-lts 1.565.3

Jenkins Security Advisory:

Description

SECURITY-87/CVE-2014-3661 (anonymous DoS attack through CLI handshake)

This vulnerability allows unauthenticated users with access to Jenkins' HTTP/HTTPS port to mount a DoS attack on Jenkins through thread exhaustion.

SECURITY-110/CVE-2014-3662 (User name discovery)

Anonymous users can test if the user of a specific name exists or not through login attempts.

SECURITY-127&128/CVE-2014-3663 (privilege escalation in job configuration permission)

An user with a permission limited to Job/CONFIGURE can exploit this vulnerability to effectively create a new job, which should have been only possible for users with Job/CREATE permission, or to destroy jobs that he/she does not have access otherwise.

SECURITY-131/CVE-2014-3664 (directory traversal attack)

Users with Overall/READ permission can access arbitrary files in the file system readable by the Jenkins process, resulting in the exposure of sensitive information, such as encryption keys.

SECURITY-138/CVE-2014-3680 (Password exposure in DOM)

If a parameterized job has a default value in a password field, that default value gets exposed to users with Job/READ permission.

SECURITY-143/CVE-2014-3681 (XSS vulnerability in Jenkins core)

Reflected cross-site scripting vulnerability in Jenkins core. An attacker can navigate the user to a carefully crafted URL and have the user execute unintended actions.

SECURITY-150/CVE-2014-3666 (remote code execution from CLI)

Unauthenticated user can execute arbitrary code on Jenkins master by sending carefully crafted packets over the CLI channel.

SECURITY-155/CVE-2014-3667 (exposure of plugin code)

Programs that constitute plugins can be downloaded by anyone with the Overall/READ permission, resulting in the exposure of otherwise sensitive information, such as hard-coded keys in plugins, if any.

SECURITY-159/CVE-2013-2186 (arbitrary file system write)

Security vulnerability in commons fileupload allows unauthenticated attacker to upload arbitrary files to Jenkins master.

SECURITY-149/CVE-2014-1869 (XSS vulnerabilities in ZeroClipboard)

reflective XSS vulnerability in one of the library dependencies of Jenkins.

SECURITY-113/CVE-2014-3678 (XSS vulnerabilities in monitoring plugin)

Monitoring plugin allows an attacker to cause a victim into executing unwanted actions on Jenkins instance.

SECURITY-113/CVE-2014-3679 (hole in access control)

Certain pages in monitoring plugin are visible to anonymous users, allowing them to gain information that they are not supposed to.

Severity

SECURITY-87 is rated medium, as it results in the loss of functionality.

SECURITY-110 is rated medium, as it results in a limited amount of information exposure.

SECURITY-127 and SECURITY-128 are rated high. The formed can be used to further escalate privileges, and the latter results inloss of data.

SECURITY-131 and SECURITY-138 is rated critical. This vulnerabilities results in exposure of sensitie information and is easily exploitable.

SECURITY-143 is rated high. It is a passive attack, but it can result in a compromise of Jenkins master or loss of data.

SECURITY-150 is rated critical. This attack can be mounted by any unauthenticated anonymous user with HTTP reachability to Jenkins instance, and results in remote code execution on Jenkins.

SECURITY-155 is rated medium. This only affects users who have installed proprietary plugins on publicly accessible instances, which is relatively uncommon.

SECURITY-159 is rated critical. This attack can be mounted by any unauthenticated anonymous user with HTTP reachability to Jenkins instance.

SECURITY-113 is rated high. It is a passive attack, but it can result in a compromise of Jenkins master or loss of data.

https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01 CVE-2014-3661 CVE-2014-3662 CVE-2014-3663 CVE-2014-3664 CVE-2014-3680 CVE-2014-3681 CVE-2014-3666 CVE-2014-3667 CVE-2013-2186 CVE-2014-1869 CVE-2014-3678 CVE-2014-3679 2014-10-01 2014-10-01 bash -- remote code execution bash bash-static 4.3.25_2

Note that this is different than the public "Shellshock" issue.

Specially crafted environment variables could lead to remote arbitrary code execution. This was fixed in bash 4.3.27, however the port was patched with a mitigation in 4.3.25_2.

http://lcamtuf.blogspot.com/2014/09/bash-bug-apply-unofficial-patch-now.html CVE-2014-6277 CVE-2014-6278 2014-09-27 2014-10-01 phpMyAdmin -- XSS vulnerabilities phpMyAdmin 4.2.04.2.9.1

The phpMyAdmin development team reports:

With a crafted ENUM value it is possible to trigger an XSS in table search and table structure pages. This vulnerability can be triggered only by someone who is logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required pages.

http://www.phpmyadmin.net/home_page/security/PMASA-2014-11.php CVE-2014-7217 2014-10-01 2014-10-01 bash -- out-of-bounds memory access in parser bash bash-static 4.3.27_1

RedHat security team reports:

It was discovered that the fixed-sized redir_stack could be forced to overflow in the Bash parser, resulting in memory corruption, and possibly leading to arbitrary code execution when evaluating untrusted input that would not otherwise be run as code.

An off-by-one error was discovered in the way Bash was handling deeply nested flow control constructs. Depending on the layout of the .bss segment, this could allow arbitrary execution of code that would not otherwise be executed by Bash.

https://access.redhat.com/security/cve/CVE-2014-7186 CVE-2014-7186 CVE-2014-7187 2014-09-25 2014-10-01 rsyslog -- remote syslog PRI vulnerability rsyslog 7.6.7 rsyslog8 8.4.2

The rsyslog project reports:

potential abort when a message with PRI > 191 was processed if the "pri-text" property was used in active templates, this could be abused to a remote denial of service from permitted senders

The original fix for CVE-2014-3634 was not adequate.

http://www.rsyslog.com/remote-syslog-pri-vulnerability/ CVE-2014-3634 2014-09-30 2014-09-30 2014-10-02 fish -- local privilege escalation and remote code execution fish 1.6.02.1.1

Fish developer David Adam reports:

This release fixes a number of local privilege escalation vulnerability and one remote code execution vulnerability.

http://www.openwall.com/lists/oss-security/2014/09/28/8 CVE-2014-2905 https://github.com/fish-shell/fish-shell/issues/1436 CVE-2014-2906 CVE-2014-3856 https://github.com/fish-shell/fish-shell/issues/1437 CVE-2014-2914 https://github.com/fish-shell/fish-shell/issues/1438 CVE-2014-3219 https://github.com/fish-shell/fish-shell/issues/1440 2014-09-28 2014-09-29 Flash player -- Multiple security vulnerabilities in www/linux-*-flashplugin11 linux-f10-flashplugin 11.2r202.400 linux-c6-flashplugin 11.2r202.400

Adobe reports:

These updates address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.

CVE-2014-0547 CVE-2014-0548 CVE-2014-0549 CVE-2014-0550 CVE-2014-0551 CVE-2014-0552 CVE-2014-0553 CVE-2014-0554 CVE-2014-0555 CVE-2014-0556 CVE-2014-0557 CVE-2014-0559 http://helpx.adobe.com/security/products/flash-player/apsb14-21.html 2014-09-09 2014-09-25 NSS -- RSA Signature Forgery linux-firefox 32.0.3,1 linux-thunderbird 31.1.2 linux-seamonkey 2.29.1 nss 3.17.1 linux-c6-nss 3.16.1

The Mozilla Project reports:

Antoine Delignat-Lavaud discovered that NSS is vulnerable to a variant of a signature forgery attack previously published by Daniel Bleichenbacher. This is due to lenient parsing of ASN.1 values involved in a signature and could lead to the forging of RSA certificates.

CVE-2014-1568 https://www.mozilla.org/security/announce/2014/mfsa2014-73.html 2014-09-23 2014-09-25 chromium -- RSA signature malleability in NSS chromium 37.0.2062.124

Google Chrome Releases reports:

[414124] RSA signature malleability in NSS (CVE-2014-1568). Thanks to Antoine Delignat-Lavaud of Prosecco/INRIA, Brian Smith and Advanced Threat Research team at Intel Security

CVE-2014-1568 http://googlechromereleases.blogspot.nl/ 2014-09-24 2014-09-25 krfb -- Multiple security issues in bundled libvncserver krfb 4.12.5_4

Martin Sandsmark reports:

krfb 4.14 [and earlier] embeds libvncserver which has had several security issues.

Several remotely exploitable security issues have been uncovered in libvncserver, some of which might allow a remote authenticated user code execution or application crashes.

CVE-2014-6055 http://lists.kde.org/?l=kde-announce&m=141153917319769&w=2 2014-09-23 2014-09-25 bash -- remote code execution vulnerability bash bash-static 3.03.0.17 3.13.1.18 3.23.2.52 4.04.0.39 4.14.1.12 4.24.2.48 4.34.3.25_1 linux_base-c6 6.5_1

Chet Ramey reports:

Under certain circumstances, bash will execute user code while processing the environment for exported function definitions.

The original fix released for CVE-2014-6271 was not adequate. A similar vulnerability was discovered and tagged as CVE-2014-7169.

CVE-2014-6271 CVE-2014-7169 https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/ https://lists.gnu.org/archive/html/bug-bash/2014-09/msg00081.html http://seclists.org/oss-sec/2014/q3/690 2014-09-24 2014-09-24 2014-09-25 asterisk -- Remotely triggered crash asterisk11 11.12.1

The Asterisk project reports:

When an out of call message - delivered by either the SIP or PJSIP channel driver or the XMPP stack - is handled in Asterisk, a crash can occur if the channel servicing the message is sent into the ReceiveFax dialplan application while using the res_fax_spandsp module.

Note that this crash does not occur when using the res_fax_digium module. While this crash technically occurs due to a configuration issue, as attempting to receive a fax from a channel driver that only contains textual information will never succeed, the likelihood of having it occur is sufficiently high as to warrant this advisory.

http://downloads.asterisk.org/pub/security/AST-2014-010.pdf https://issues.asterisk.org/jira/browse/ASTERISK-24301 https://www.asterisk.org/security 2014-09-05 2014-09-18 squid -- Buffer overflow in SNMP processing squid 3.4.8 squid32 0 squid33 3.3.13_2

The squid-cache project reports:

Due to incorrect buffer management Squid can be caused by an attacker to write outside its allocated SNMP buffer.

http://www.squid-cache.org/Advisories/SQUID-2014_3.txt CVE-2014-6270 2014-09-15 2014-09-18 dbus -- multiple vulnerabilities dbus 1.8.8

Simon McVittie reports:

Do not accept an extra fd in the padding of a cmsg message, which could lead to a 4-byte heap buffer overrun (CVE-2014-3635).

Reduce default for maximum Unix file descriptors passed per message from 1024 to 16, preventing a uid with the default maximum number of connections from exhausting the system bus' file descriptors under Linux's default rlimit (CVE-2014-3636).

Disconnect connections that still have a fd pending unmarshalling after a new configurable limit, pending_fd_timeout (defaulting to 150 seconds), removing the possibility of creating an abusive connection that cannot be disconnected by setting up a circular reference to a connection's file descriptor (CVE-2014-3637).

Reduce default for maximum pending replies per connection from 8192 to 128, mitigating an algorithmic complexity denial-of-service attack (CVE-2014-3638).

Reduce default for authentication timeout on the system bus from 30 seconds to 5 seconds, avoiding denial of service by using up all unauthenticated connection slots; and when all unauthenticated connection slots are used up, make new connection attempts block instead of disconnecting them (CVE-2014-3639).

CVE-2014-3635 CVE-2014-3636 CVE-2014-3637 CVE-2014-3638 CVE-2014-3639 http://lists.freedesktop.org/archives/dbus/2014-September/016343.html 2014-09-16 2014-09-17 nginx -- inject commands into SSL session vulnerability nginx 0.6.01.6.2,2 nginx-devel 0.5.61.7.5

The nginx project reports:

Security: it was possible to reuse SSL sessions in unrelated contexts if a shared SSL session cache or the same TLS session ticket key was used for multiple "server" blocks (CVE-2014-3616).

CVE-2014-3616 http://mailman.nginx.org/pipermail/nginx-announce/2014/000147.html 2014-09-16 2014-09-16 phpMyAdmin -- XSRF/CSRF due to DOM based XSS in the micro history feature phpMyAdmin 4.2.04.2.8.1

The phpMyAdmin development team reports:

XSRF/CSRF due to DOM based XSS in the micro history feature.

By deceiving a logged-in user to click on a crafted URL, it is possible to perform remote code execution and in some cases, create a root account due to a DOM based XSS vulnerability in the micro history feature.

http://www.phpmyadmin.net/home_page/security/PMASA-2014-10.php CVE-2014-6300 2014-09-13 2014-09-13 security/ossec-hids-* -- root escalation via temp files ossec-hids-server ossec-hids-client ossec-hids-local 2.8.1

OSSEC reports:

This correction will create the temp file for the hosts deny file in /var/ossec and will use mktemp where available to create NON-predictable temp file name. In cases where mktemp is not available we have written a BAD version of mktemp, but should be a little better then just process id.

CVE-2014-5284 http://www.ossec.net/?p=1135 2014-09-09 2014-09-11 www/chromium -- multiple vulnerabilities chromium 37.0.2062.120

Google Chrome Releases reports:

4 security fixes in this release, including:

[401362] High CVE-2014-3178: Use-after-free in rendering. Credit to miaubiz.

[411014] CVE-2014-3179: Various fixes from internal audits, fuzzing and other initiatives.

CVE-2014-3178 CVE-2014-3179 http://googlechromereleases.blogspot.nl/ 2014-09-09 2014-09-09 trafficserver -- unspecified vulnerability trafficserver 5.0.1

Bryan Call reports:

Below is our announcement for the security issue reported to us from Yahoo! Japan. All versions of Apache Traffic Server are vulnerable. We urge users to upgrade to either 4.2.1.1 or 5.0.1 immediately.

This fixes CVE-2014-3525 and limits access to how the health checks are performed.

CVE-2014-3525 http://mail-archives.apache.org/mod_mbox/trafficserver-users/201407.mbox/%3CBFCEC9C8-1BE9-4DCA-AF9C-B8FE798EEC07@yahoo-inc.com%3E 2014-07-23 2014-09-05 chromium -- multiple vulnerabilities chromium 37.0.2062.94

Google Chrome Releases reports:

50 security fixes in this release, including:

[386988] Critical CVE-2014-3176, CVE-2014-3177: A special reward to lokihardt@asrt for a combination of bugs in V8, IPC, sync, and extensions that can lead to remote code execution outside of the sandbox.

[369860] High CVE-2014-3168: Use-after-free in SVG. Credit to cloudfuzzer.

[387389] High CVE-2014-3169: Use-after-free in DOM. Credit to Andrzej Dyjak.

[390624] High CVE-2014-3170: Extension permission dialog spoofing. Credit to Rob Wu.

[390928] High CVE-2014-3171: Use-after-free in bindings. Credit to cloudfuzzer.

[367567] Medium CVE-2014-3172: Issue related to extension debugging. Credit to Eli Grey.

[376951] Medium CVE-2014-3173: Uninitialized memory read in WebGL. Credit to jmuizelaar.

[389219] Medium CVE-2014-3174: Uninitialized memory read in Web Audio. Credit to Atte Kettunen from OUSPG.

[406143] CVE-2014-3175: Various fixes from internal audits, fuzzing and other initiatives (Chrome 37).

CVE-2014-3168 CVE-2014-3169 CVE-2014-3170 CVE-2014-3171 CVE-2014-3172 CVE-2014-3173 CVE-2014-3174 CVE-2014-3175 CVE-2014-3176 CVE-2014-3177 http://googlechromereleases.blogspot.nl/ 2014-08-26 2014-08-26 file -- buffer overruns and missing buffer size tests file 5.19

Christos Zoulas reports:

A specially crafted file can cause a segmentation fault.

http://mx.gw.com/pipermail/file/2014/001553.html 2014-06-09 2014-08-21 django -- multiple vulnerabilities py27-django 1.61.6.6 py27-django15 1.51.5.9 py27-django14 1.41.4.14 py32-django 1.61.6.6 py32-django15 1.51.5.9 py33-django 1.61.6.6 py33-django15 1.51.5.9 py34-django 1.61.6.6 py34-django15 1.51.5.9 py27-django-devel 20140821,1 py32-django-devel 20140821,1 py33-django-devel 20140821,1 py34-django-devel 20140821,1

The Django project reports:

These releases address an issue with reverse() generating external URLs; a denial of service involving file uploads; a potential session hijacking issue in the remote-user middleware; and a data leak in the administrative interface. We encourage all users of Django to upgrade as soon as possible.

https://www.djangoproject.com/weblog/2014/aug/20/security/ CVE-2014-0480 CVE-2014-0481 CVE-2014-0482 CVE-2014-0483 2014-08-20 2014-08-21 PHP multiple vulnerabilities php53 5.3.29

The PHP Team reports:

insecure temporary file use in the configure script

unserialize() SPL ArrayObject / SPLObjectStorage Type Confusion

Heap buffer over-read in DateInterval

fileinfo: cdf_read_short_sector insufficient boundary check

fileinfo: CDF infinite loop in nelements DoS

fileinfo: fileinfo: numerous file_printf calls resulting in performance degradation)

Fix potential segfault in dns_check_record()

CVE-2013-6712 CVE-2014-0207 CVE-2014-0237 CVE-2014-0238 CVE-2014-3515 CVE-2014-3981 CVE-2014-4049 http://php.net/ChangeLog-5.php#5.3.29 https://www.sektioneins.de/en/blog/14-07-04-phpinfo-infoleak.html 2014-08-14 2014-08-18 phpMyAdmin -- XSS vulnerabilities phpMyAdmin 4.2.04.2.7.1

The phpMyAdmin development team reports:

Multiple XSS vulnerabilities in browse table, ENUM editor, monitor, query charts and table relations pages.

With a crafted database, table or a primary/unique key column name it is possible to trigger an XSS when dropping a row from the table. With a crafted column name it is possible to trigger an XSS in the ENUM editor dialog. With a crafted variable name or a crafted value for unit field it is possible to trigger a self-XSS when adding a new chart in the monitor page. With a crafted value for x-axis label it is possible to trigger a self-XSS in the query chart page. With a crafted relation name it is possible to trigger an XSS in table relations page.

XSS in view operations page.

With a crafted view name it is possible to trigger an XSS when dropping the view in view operation page.

http://www.phpmyadmin.net/home_page/security/PMASA-2014-8.php http://www.phpmyadmin.net/home_page/security/PMASA-2014-9.php CVE-2014-5273 CVE-2014-5274 2014-08-17 2014-08-17 chromium -- multiple vulnerabilities chromium 36.0.1985.143

Google Chrome Releases reports:

12 security fixes in this release, including

[390174] High CVE-2014-3165: Use-after-free in web sockets. Credit to Collin Payne.

[398925] High CVE-2014-3166: Information disclosure in SPDY. Credit to Antoine Delignat-Lavaud.

[400950] CVE-2014-3167: Various fixes from internal audits, fuzzing and other initiatives.

CVE-2014-3165 CVE-2014-3166 CVE-2014-3167 http://googlechromereleases.blogspot.nl 2014-08-12 2014-08-13 serf -- SSL Certificate Null Byte Poisoning serf 1.3.7

serf Development list reports:

Serf provides APIs to retrieve information about a certificate. These APIs return the information as NUL terminated strings (commonly called C strings). X.509 uses counted length strings which may include a NUL byte. This means that a library user will interpret any information as ending upon seeing this NUL byte and will only see a partial value for that field.

Attackers could exploit this vulnerability to create a certificate that a client will accept for a different hostname than the full certificate is actually for by embedding a NUL byte in the certificate.

This can lead to a man-in-the-middle attack. There are no known instances of this problem being exploited in the wild and in practice it should be difficult to actually exploit this vulnerability.

CVE-2014-3504 2014-08-06 2014-08-11 subversion -- several vulnerabilities subversion16 1.0.01.7.18 subversion17 1.0.01.7.18 subversion 1.0.01.7.18 1.8.01.8.10

Subversion Project reports:

Using the Serf RA layer of Subversion for HTTPS uses the apr_fnmatch API to handle matching wildcards in certificate Common Names and Subject Alternate Names. However, apr_fnmatch is not designed for this purpose. Instead it is designed to behave like common shell globbing. In particular this means that '*' is not limited to a single label within a hostname (i.e. it will match '.'). But even further apr_fnmatch supports '?' and character classes (neither of which are part of the RFCs defining how certificate validation works).

Subversion stores cached credentials by an MD5 hash based on the URL and the authentication realm of the server the credentials are cached for. MD5 has been shown to be subject to chosen plaintext hash collisions. This means it may be possible to generate an authentication realm which results in the same MD5 hash for a different URL.

CVE-2014-3522 CVE-2014-3528 http://subversion.apache.org/security/CVE-2014-3522-advisory.txt http://subversion.apache.org/security/CVE-2014-3528-advisory.txt 2014-08-06 2014-08-11 nginx -- inject commands into SSL session vulnerability nginx 1.6.0,21.6.1,2 nginx-devel 1.5.61.7.4

The nginx project reports:

Security: pipelined commands were not discarded after STARTTLS command in SMTP proxy (CVE-2014-3556); the bug had appeared in 1.5.6.

CVE-2014-3556 http://mailman.nginx.org/pipermail/nginx-announce/2014/000144.html 2014-08-05 2014-08-09 OpenSSL -- multiple vulnerabilities openssl 1.0.11.0.1_14 mingw32-openssl 1.0.11.0.1i FreeBSD 8.48.4_15 9.19.1_18 9.29.2_11 9.39.3_1 10.010.0_8

The OpenSSL Project reports:

A flaw in OBJ_obj2txt may cause pretty printing functions such as X509_name_oneline, X509_name_print_ex et al. to leak some information from the stack. [CVE-2014-3508]

The issue affects OpenSSL clients and allows a malicious server to crash the client with a null pointer dereference (read) by specifying an SRP ciphersuite even though it was not properly negotiated with the client. [CVE-2014-5139]

If a multithreaded client connects to a malicious server using a resumed session and the server sends an ec point format extension it could write up to 255 bytes to freed memory. [CVE-2014-3509]

An attacker can force an error condition which causes openssl to crash whilst processing DTLS packets due to memory being freed twice. This can be exploited through a Denial of Service attack. [CVE-2014-3505]

An attacker can force openssl to consume large amounts of memory whilst processing DTLS handshake messages. This can be exploited through a Denial of Service attack. [CVE-2014-3506]

By sending carefully crafted DTLS packets an attacker could cause openssl to leak memory. This can be exploited through a Denial of Service attack. [CVE-2014-3507]

OpenSSL DTLS clients enabling anonymous (EC)DH ciphersuites are subject to a denial of service attack. A malicious server can crash the client with a null pointer dereference (read) by specifying an anonymous (EC)DH ciphersuite and sending carefully crafted handshake messages. [CVE-2014-3510]

A flaw in the OpenSSL SSL/TLS server code causes the server to negotiate TLS 1.0 instead of higher protocol versions when the ClientHello message is badly fragmented. This allows a man-in-the-middle attacker to force a downgrade to TLS 1.0 even if both the server and the client support a higher protocol version, by modifying the client's TLS records. [CVE-2014-3511]

A malicious client or server can send invalid SRP parameters and overrun an internal buffer. Only applications which are explicitly set up for SRP use are affected. [CVE-2014-3512]

https://www.openssl.org/news/secadv_20140806.txt SA-14:18.openssl CVE-2014-3505 CVE-2014-3506 CVE-2014-3507 CVE-2014-3508 CVE-2014-3509 CVE-2014-3510 CVE-2014-3511 CVE-2014-3512 CVE-2014-5139 2014-08-06 2014-08-06 2016-08-09 krfb -- Possible Denial of Service or code execution via integer overflow krfb 4.12.5_1

Albert Aastals Cid reports:

krfb embeds libvncserver which embeds liblzo2, it contains various flaws that result in integer overflow problems.

This potentially allows a malicious application to create a possible denial of service or code execution. Due to the need to exploit precise details of the target architecture and threading it is unlikely that remote code execution can be achieved in practice.

CVE-2014-4607 http://lists.kde.org/?l=kde-announce&m=140709940701878&w=2 2014-08-03 2014-08-03 samba -- remote code execution samba4 4.0.04.0.21 samba41 4.1.04.1.11

Samba developers report:

A malicious browser can send packets that may overwrite the heap of the target nmbd NetBIOS name services daemon. It may be possible to use this to generate a remote code execution vulnerability as the superuser (root).

CVE-2014-3560 http://www.samba.org/samba/security/CVE-2014-3560 2014-07-31 2014-08-02 gpgme -- heap-based buffer overflow in gpgsm status handler gpgme 1.5.0

Tomas Trnka reports:

Gpgme contains a buffer overflow in the gpgsm status handler that could possibly be exploited using a specially crafted certificate.

CVE-2014-3564 https://bugzilla.redhat.com/show_bug.cgi?id=1113267 2014-06-25 2014-08-02 kdelibs -- KAuth PID Reuse Flaw kdelibs 4.12.5_3

Martin Sandsmark reports:

The KAuth framework uses polkit-1 API which tries to authenticate using the requestors PID. This is prone to PID reuse race conditions.

This potentially allows a malicious application to pose as another for authentication purposes when executing privileged actions.

CVE-2014-5033 http://lists.kde.org/?l=kde-announce&m=140674898412923&w=2 2014-07-30 2014-07-31 tor -- traffic confirmation attack tor 0.2.4.23 tor-devel 0.2.5.6.a

The Tor Project reports:

Tor before 0.2.4.23 and 0.2.5 before 0.2.5.6-alpha maintains a circuit after an inbound RELAY_EARLY cell is received by a client, which makes it easier for remote attackers to conduct traffic-confirmation attacks by using the pattern of RELAY and RELAY_EARLY cells as a means of communicating information about hidden service names.

https://lists.torproject.org/pipermail/tor-announce/2014-July/000094.html https://blog.torproject.org/blog/tor-security-advisory-relay-early-traffic-confirmation-attack CVE-2014-5117 2014-07-30 2014-07-30 i2p -- Multiple Vulnerabilities i2p 0.9.14

The i2p project reports:

XSS and remote execution vulnerabilities reported by Exodus Intelligence.

Exodus Intelligence reports:

The vulnerability we have found is able to perform remote code execution with a specially crafted payload. This payload can be customized to unmask a user and show the public IP address in which the user connected from within 'a couple of seconds.'

http://blog.exodusintel.com/2014/07/23/silverbullets_and_fairytails/ http://geti2p.net/en/blog/post/2014/07/26/0.9.14-Release 2014-07-24 2014-07-28 bugzilla -- Cross Site Request Forgery bugzilla44 4.4.5

A Bugzilla Security Advisory reports:

Adobe does not properly restrict the SWF file format, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks against Bugzilla's JSONP endpoint, possibly obtaining sensitive bug information, via a crafted OBJECT element with SWF content satisfying the character-set requirements of a callback API.

CVE-2014-1546 2014-07-24 2014-07-25 apache22 -- several vulnerabilities apache22 2.2.02.2.29 apache22-event-mpm 2.2.02.2.29 apache22-itk-mpm 2.2.02.2.29 apache22-peruser-mpm 2.2.02.2.29 apache22-worker-mpm 2.2.02.2.29

Apache HTTP SERVER PROJECT reports:

mod_deflate: The DEFLATE input filter (inflates request bodies) now limits the length and compression ratio of inflated request bodies to avoid denial of service via highly compressed bodies. See directives DeflateInflateLimitRequestBody, DeflateInflateRatioLimit, and DeflateInflateRatioBurst.

mod_cgid: Fix a denial of service against CGI scripts that do not consume stdin that could lead to lingering HTTPD child processes filling up the scoreboard and eventually hanging the server. By default, the client I/O timeout (Timeout directive) now applies to communication with scripts. The CGIDScriptTimeout directive can be used to set a different timeout for communication with scripts.

Fix a race condition in scoreboard handling, which could lead to a heap buffer overflow.

core: HTTP trailers could be used to replace HTTP headers late during request processing, potentially undoing or otherwise confusing modules that examined or modified request headers earlier. Adds "MergeTrailers" directive to restore legacy behavior.

CVE-2014-0118 CVE-2014-0231 CVE-2014-0226 CVE-2013-5704 2014-07-19 2014-07-24 2014-09-03 tomcat -- multiple vulnerabilities tomcat 6.0.40 tomcat7 7.0.53 tomcat8 8.0.4

Tomcat Security Team reports:

Tomcat does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

An integer overflow, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.

An integer overflow in parseChunkHeader allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data.

CVE-2014-0096 CVE-2014-0099 CVE-2014-0075 https://tomcat.apache.org/security-6.html https://tomcat.apache.org/security-7.html https://tomcat.apache.org/security-8.html 2014-05-23 2014-07-23 2017-03-18 mozilla -- multiple vulnerabilities firefox 31.0,1 firefox-esr 24.7.0,1 linux-firefox 31.0,1 linux-thunderbird 24.7.0 thunderbird 24.7.0 nss 3.16.1_2

The Mozilla Project reports:

MFSA 2014-66 IFRAME sandbox same-origin access through redirect

MFSA 2014-65 Certificate parsing broken by non-standard character encoding

MFSA 2014-64 Crash in Skia library when scaling high quality images

MFSA 2014-63 Use-after-free while when manipulating certificates in the trusted cache

MFSA 2014-62 Exploitable WebGL crash with Cesium JavaScript library

MFSA 2014-61 Use-after-free with FireOnStateChange event

MFSA 2014-60 Toolbar dialog customization event spoofing

MFSA 2014-59 Use-after-free in DirectWrite font handling

MFSA 2014-58 Use-after-free in Web Audio due to incorrect control message ordering

MFSA 2014-57 Buffer overflow during Web Audio buffering for playback

MFSA 2014-56 Miscellaneous memory safety hazards (rv:31.0 / rv:24.7)

CVE-2014-1544 CVE-2014-1547 CVE-2014-1548 CVE-2014-1549 CVE-2014-1550 CVE-2014-1551 CVE-2014-1552 CVE-2014-1555 CVE-2014-1556 CVE-2014-1557 CVE-2014-1558 CVE-2014-1559 CVE-2014-1560 CVE-2014-1561 https://www.mozilla.org/security/announce/2014/mfsa2014-56.html https://www.mozilla.org/security/announce/2014/mfsa2014-57.html https://www.mozilla.org/security/announce/2014/mfsa2014-58.html https://www.mozilla.org/security/announce/2014/mfsa2014-59.html https://www.mozilla.org/security/announce/2014/mfsa2014-60.html https://www.mozilla.org/security/announce/2014/mfsa2014-61.html https://www.mozilla.org/security/announce/2014/mfsa2014-62.html https://www.mozilla.org/security/announce/2014/mfsa2014-63.html https://www.mozilla.org/security/announce/2014/mfsa2014-64.html https://www.mozilla.org/security/announce/2014/mfsa2014-65.html https://www.mozilla.org/security/announce/2014/mfsa2014-66.html https://www.mozilla.org/security/announce/ 2014-07-22 2014-07-23 mcollective -- cert valication issue mcollective 2.5.3

Melissa Stone reports:

The MCollective aes_security public key plugin does not correctly validate certs against the CA. By exploiting this vulnerability within a race/initialization window, an attacker with local access could initiate an unauthorized MCollective client connection with a server, and thus control the mcollective plugins running on that server. This vulnerability requires a collective be configured to use the aes_security plugin. Puppet Enterprise and open source MCollective are not configured to use the plugin and are not vulnerable by default.

CVE-2014-3251 https://groups.google.com/forum/#!topic/puppet-announce/cPykqUXMmK4 2014-07-09 2014-07-21 qt4-imageformats, qt5-gui -- DoS vulnerability in the GIF image handler qt4-imageformats 4.8.6_1 qt5-gui 5.2.1_4

Richard J. Moore reports:

The builtin GIF decoder in QtGui prior to Qt 5.3 contained a bug that would lead to a null pointer dereference when loading certain hand crafted corrupt GIF files. This in turn would cause the application loading these hand crafted GIFs to crash.

CVE-2014-0190 67087 http://lists.qt-project.org/pipermail/announce/2014-April/000045.html 2014-04-24 2014-07-19 2014-07-21 apache24 -- several vulnerabilities apache24 2.4.10

Apache HTTP SERVER PROJECT reports:

mod_proxy: Fix crash in Connection header handling which allowed a denial of service attack against a reverse proxy with a threaded MPM.

Fix a race condition in scoreboard handling, which could lead to a heap buffer overflow.

mod_deflate: The DEFLATE input filter (inflates request bodies) now limits the length and compression ratio of inflated request bodies to avoid denial of sevice via highly compressed bodies. See directives DeflateInflateLimitRequestBody, DeflateInflateRatioLimit, and DeflateInflateRatioBurst.

mod_cgid: Fix a denial of service against CGI scripts that do not consume stdin that could lead to lingering HTTPD child processes filling up the scoreboard and eventually hanging the server. By default, the client I/O timeout (Timeout directive) now applies to communication with scripts. The CGIDScriptTimeout directive can be used to set a different timeout for communication with scripts.

CVE-2014-0117 CVE-2014-3523 CVE-2014-0226 CVE-2014-0118 CVE-2014-0231 2014-07-15 2014-07-19 phpMyAdmin -- multiple XSS vulnerabilities, missing validation phpMyAdmin 4.2.04.2.6

The phpMyAdmin development team reports:

Self-XSS due to unescaped HTML output in database structure page.

With a crafted table comment, it is possible to trigger an XSS in database structure page.

Self-XSS due to unescaped HTML output in database triggers page.

When navigating into the database triggers page, it is possible to trigger an XSS with a crafted trigger name.

Multiple XSS in AJAX confirmation messages.

With a crafted column name it is possible to trigger an XSS when dropping the column in table structure page. With a crafted table name it is possible to trigger an XSS when dropping or truncating the table in table operations page.

Access for an unprivileged user to MySQL user list.

An unpriviledged user could view the MySQL user list and manipulate the tabs displayed in phpMyAdmin for them.

CVE-2014-4954 CVE-2014-4955 CVE-2014-4986 CVE-2014-4987 http://www.phpmyadmin.net/home_page/security/PMASA-2014-4.php http://www.phpmyadmin.net/home_page/security/PMASA-2014-5.php http://www.phpmyadmin.net/home_page/security/PMASA-2014-6.php http://www.phpmyadmin.net/home_page/security/PMASA-2014-7.php 2014-07-18 2014-07-18 2014-07-20 chromium -- multiple vulnerabilities chromium 36.0.1985.125

Google Chrome Releases reports:

26 security fixes in this release, including

[380885] Medium CVE-2014-3160: Same-Origin-Policy bypass in SVG. Credit to Christian Schneider.

[393765] CVE-2014-3162: Various fixes from internal audits, fuzzing and other initiatives.

CVE-2014-3160 CVE-2014-3162 http://googlechromereleases.blogspot.nl 2014-07-16 2014-07-16 kdelibs4 -- KMail/KIO POP3 SSL Man-in-the-middle Flaw kdelibs 4.10.954.12.5_2

Richard J. Moore reports:

The POP3 kioslave used by KMail will accept invalid certificates without presenting a dialog to the user due a bug that leads to an inability to display the dialog combined with an error in the way the result is checked.

This flaw allows an active attacker to perform MITM attacks against the ioslave which could result in the leakage of sensitive data such as the authentication details and the contents of emails.

CVE-2014-3494 68113 http://lists.kde.org/?l=kde-announce&m=140312275318160&w=2 2014-06-17 2014-07-16 postfixadmin -- SQL injection vulnerability postfixadmin 2.3.7

Thijs Kinkhorst reports:

Postfixadmin has an SQL injection vulnerability. This vulnerability is only exploitable by authenticated users able to create new aliases.

CVE-2014-2655 66455 ports/189248 http://www.openwall.com/lists/oss-security/2014/03/26/6 https://www.debian.org/security/2014/dsa-2889 2014-03-28 2014-07-13 2015-09-28 dbus -- multiple vulnerabilities dbus 1.8.6

Simon McVittie reports:

Alban Crequy at Collabora Ltd. discovered a bug in dbus-daemon's support for file descriptor passing. A malicious process could force system services or user applications to be disconnected from the D-Bus system bus by sending them a message containing a file descriptor, then causing that file descriptor to exceed the kernel's maximum recursion depth (itself introduced to fix a DoS) before dbus-daemon forwards the message to the victim process. Most services and applications exit when disconnected from the system bus, leading to a denial of service.

Additionally, Alban discovered that bug fd.o#79694, a bug previously reported by Alejandro Martínez Suárez which was n believed to be security flaw, could be used for a similar denial of service, by causing dbus-daemon to attempt to forward invalid file descriptors to a victim process when file descriptors become associated with the wrong message.

CVE-2014-3532 CVE-2014-3533 http://lists.freedesktop.org/archives/dbus/2014-July/016235.html 2014-07-02 2014-07-03 mencoder -- potential buffer overrun when processing malicious lzo compressed input mencoder 1.1.r20140418_1

Michael Niedermayer and Luca Barbato report in upstream ffmpeg:

avutil/lzo: Fix integer overflow

http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=ccda51b14c0fcae2fad73a24872dce75a7964996 http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=d6af26c55c1ea30f85a7d9edbc373f53be1743ee CVE-2014-4610 2014-06-24 2014-06-28 mplayer -- potential buffer overrun when processing malicious lzo compressed input mplayer 1.1.r20140418_3

Michael Niedermayer and Luca Barbato report in upstream ffmpeg:

avutil/lzo: Fix integer overflow

http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=ccda51b14c0fcae2fad73a24872dce75a7964996 http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=d6af26c55c1ea30f85a7d9edbc373f53be1743ee CVE-2014-4610 2014-06-24 2014-06-28 LZO -- potential buffer overrun when processing malicious input data lzo2 2.07 busybox 1.22.1_2

Markus Franz Xaver Johannes Oberhumer reports, in the package's NEWS file:

Fixed a potential integer overflow condition in the "safe" decompressor variants which could result in a possible buffer overrun when processing maliciously crafted compressed input data.

As this issue only affects 32-bit systems and also can only happen if you use uncommonly huge buffer sizes where you have to decompress more than 16 MiB (2^24 bytes) compressed bytes within a single function call, the practical implications are limited.

http://www.oberhumer.com/opensource/lzo/download/lzo-2.07.tar.gz CVE-2014-4608 2014-06-25 2014-06-26 2015-01-06 gnupg -- possible DoS using garbled compressed data packets gnupg1 1.4.17 gnupg 2.0.24

Werner Koch reports:

This release includes a *security fix* to stop a possible DoS using garbled compressed data packets which can be used to put gpg into an infinite loop.

http://lists.gnupg.org/pipermail/gnupg-announce/2014q2/000344.html http://lists.gnupg.org/pipermail/gnupg-announce/2014q2/000345.html 2014-06-23 2014-06-23 samba -- multiple vulnerabilities samba36 3.6.24 samba4 4.0.19 samba41 4.1.9

The samba project reports:

A malformed packet can cause the nmbd server to loop the CPU and prevent any further NetBIOS name service.

Valid unicode path names stored on disk can cause smbd to crash if an authenticated client attempts to read them using a non-unicode request.

CVE-2014-0244 CVE-2014-3493 https://www.samba.org/samba/security/CVE-2014-0244 https://www.samba.org/samba/security/CVE-2014-3493 2014-06-23 2014-06-23 phpMyAdmin -- two XSS vulnerabilities due to unescaped db/table names phpMyAdmin 4.1.04.2.4

The phpMyAdmin development team reports:

Self-XSS due to unescaped HTML output in recent/favorite tables navigation.

When marking a crafted database or table name as favorite or having it in recent tables, it is possible to trigger an XSS.

This vulnerability can be triggered only by someone who logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required form.

Self-XSS due to unescaped HTML output in navigation items hiding feature.

When hiding or unhiding a crafted table name in the navigation, it is possible to trigger an XSS.

This vulnerability can be triggered only by someone who logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required form.

CVE-2014-4348 CVE-2014-4349 http://www.phpmyadmin.net/home_page/security/PMASA-2014-2.php http://www.phpmyadmin.net/home_page/security/PMASA-2014-3.php 2014-06-20 2014-06-20 2014-06-24 iodined -- authentication bypass iodine 0.7.0

Erik Ekman of the iodine project reports:

The client could bypass the password check by continuing after getting error from the server and guessing the network parameters. The server would still accept the rest of the setup and also network traffic.

https://github.com/yarrick/iodine/commit/b715be5cf3978fbe589b03b09c9398d0d791f850 2014-06-16 2014-06-18 asterisk -- multiple vulnerabilities asterisk11 11.10.1 asterisk18 1.8.28.1

The Asterisk project reports:

Asterisk Manager User Unauthorized Shell Access. Manager users can execute arbitrary shell commands with the MixMonitor manager action. Asterisk does not require system class authorization for a manager user to use the MixMonitor action, so any manager user who is permitted to use manager commands can potentially execute shell commands as the user executing the Asterisk process.

Exhaustion of Allowed Concurrent HTTP Connections. Establishing a TCP or TLS connection to the configured HTTP or HTTPS port respectively in http.conf and then not sending or completing a HTTP request will tie up a HTTP session. By doing this repeatedly until the maximum number of open HTTP sessions is reached, legitimate requests are blocked.

CVE-2014-4046 CVE-2014-4047 http://downloads.asterisk.org/pub/security/AST-2014-006.pdf http://downloads.asterisk.org/pub/security/AST-2014-007.pdf https://www.asterisk.org/security 2014-06-12 2014-06-17 dbus -- local DoS dbus 1.8.01.8.4 1.6.20

Simon MvVittie reports:

Alban Crequy at Collabora Ltd. discovered and fixed a denial-of-service flaw in dbus-daemon, part of the reference implementation of D-Bus. Additionally, in highly unusual environments the same flaw could lead to a side channel between processes that should not be able to communicate.

CVE-2014-3477 http://lists.freedesktop.org/archives/dbus/2014-June/016220.html 2014-06-10 2014-06-14 chromium -- multiple vulnerabilities chromium 35.0.1916.153

Google Chrome Releases reports:

4 security fixes in this release, including:

[369525] High CVE-2014-3154: Use-after-free in filesystem api. Credit to Collin Payne.

[369539] High CVE-2014-3155: Out-if-bounds read in SPDY. Credit to James March, Daniel Sommermann and Alan Frindell of Facebook.

[369621] Medium CVE-2014-3156: Buffer overflow in clipboard. Credit to Atte Kettunen of OUSPG.

[368980] CVE-2014-3157: Heap overflow in media.

CVE-2014-3154 CVE-2014-3155 CVE-2014-3156 CVE-2014-3157 http://googlechromereleases.blogspot.nl 2014-06-10 2014-06-10 mozilla -- multiple vulnerabilities firefox 30.0,1 firefox-esr 24.6.0,1 seamonkey 2.26.1 linux-firefox 30.0,1 linux-seamonkey 2.26.1 linux-thunderbird 24.6.0 nspr 4.10.6 thunderbird 24.6.0

The Mozilla Project reports:

MFSA 2014-48 Miscellaneous memory safety hazards (rv:30.0 / rv:24.6)

MFSA 2014-49 Use-after-free and out of bounds issues found using Address Sanitizer

MFSA 2014-51 Use-after-free in Event Listener Manager

MFSA 2014-52 Use-after-free with SMIL Animation Controller

MFSA 2014-53 Buffer overflow in Web Audio Speex resampler

MFSA 2014-54 Buffer overflow in Gamepad API

MFSA 2014-55 Out of bounds write in NSPR

CVE-2014-1533 CVE-2014-1534 CVE-2014-1536 CVE-2014-1537 CVE-2014-1540 CVE-2014-1541 CVE-2014-1542 CVE-2014-1543 CVE-2014-1545 https://www.mozilla.org/security/announce/2014/mfsa2014-48.html https://www.mozilla.org/security/announce/2014/mfsa2014-49.html https://www.mozilla.org/security/announce/2014/mfsa2014-51.html https://www.mozilla.org/security/announce/2014/mfsa2014-52.html https://www.mozilla.org/security/announce/2014/mfsa2014-53.html https://www.mozilla.org/security/announce/2014/mfsa2014-54.html https://www.mozilla.org/security/announce/2014/mfsa2014-55.html 2014-06-10 2014-06-10 OpenSSL -- multiple vulnerabilities openssl 1.0.11.0.1_13 mingw32-openssl 1.0.11.0.1h FreeBSD 8.08.4_12 9.19.1_15 9.29.2_8 10.010.0_5

The OpenSSL Project reports:

An attacker using a carefully crafted handshake can force the use of weak keying material in OpenSSL SSL/TLS clients and servers. This can be exploited by a Man-in-the-middle (MITM) attack where the attacker can decrypt and modify traffic from the attacked client and server. [CVE-2014-0224]

By sending an invalid DTLS handshake to an OpenSSL DTLS client the code can be made to recurse eventually crashing in a DoS attack. [CVE-2014-0221]

A buffer overrun attack can be triggered by sending invalid DTLS fragments to an OpenSSL DTLS client or server. This is potentially exploitable to run arbitrary code on a vulnerable client or server. [CVE-2014-0195]

OpenSSL TLS clients enabling anonymous ECDH ciphersuites are subject to a denial of service attack. [CVE-2014-3470]

CVE-2014-0195 CVE-2014-0221 CVE-2014-0224 CVE-2014-3470 SA-14:14.openssl http://www.openssl.org/news/secadv_20140605.txt 2014-06-05 2014-06-05 gnutls -- client-side memory corruption gnutls 2.12.23_6

GnuTLS project reports:

This vulnerability affects the client side of the gnutls library. A server that sends a specially crafted ServerHello could corrupt the memory of a requesting client.

CVE-2014-3466 http://www.gnutls.org/security.html#GNUTLS-SA-2014-3 2014-05-14 2014-06-04 gnutls -- client-side memory corruption gnutls3 3.13.1.25

GnuTLS project reports:

This vulnerability affects the client side of the gnutls library. A server that sends a specially crafted ServerHello could corrupt the memory of a requesting client.

CVE-2014-3466 http://www.gnutls.org/security.html#GNUTLS-SA-2014-3 2014-05-14 2014-06-03 mumble -- multiple vulnerabilities mumble 1.2.01.2.6

Mumble reports:

SVG images with local file references could trigger client DoS

The Mumble client did not properly HTML-escape some external strings before using them in a rich-text (HTML) context.

http://mumble.info/security/Mumble-SA-2014-005.txt http://mumble.info/security/Mumble-SA-2014-006.txt 2014-04-16 2014-05-29 mumble -- NULL pointer dereference and heap-based buffer overflow mumble 1.2.41.2.4_6

Mumble reports:

A malformed Opus voice packet sent to a Mumble client could trigger a NULL pointer dereference or an out-of-bounds array access.

A malformed Opus voice packet sent to a Mumble client could trigger a heap-based buffer overflow.

CVE-2014-0044 CVE-2014-0045 http://mumble.info/security/Mumble-SA-2014-001.txt http://mumble.info/security/Mumble-SA-2014-002.txt 2014-01-25 2014-05-29 linux-flashplugin -- multiple vulnerabilities linux-f10-flashplugin 11.2r202.359

Adobe reports:

These updates address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.

CVE-2014-0510 CVE-2014-0516 CVE-2014-0517 CVE-2014-0518 CVE-2014-0519 CVE-2014-0520 https://helpx.adobe.com/security/products/flash-player/apsb14-14.html 2014-03-13 2014-05-26 openjpeg -- Multiple vulnerabilities openjpeg 1.5.2

Openjpeg release notes report:

That CVE-2012-3535 and CVE-2012-3358 are fixed in the 1.5.1 release.

That CVE-2013-4289, CVE-2013-4290, CVE-2013-1447, CVE-2013-6045, CVE-2013-6052, CVE-2013-6054, CVE-2013-6053, CVE-2013-6887, where fixed in the 1.5.2 release.

CVE-2012-3358 CVE-2012-3535 CVE-2013-1447 CVE-2013-4289 CVE-2013-4290 CVE-2013-6045 CVE-2013-6052 CVE-2013-6053 CVE-2013-6054 CVE-2013-6887 http://openjpeg.googlecode.com/svn/tags/version.1.5.1/NEWS http://openjpeg.googlecode.com/svn/tags/version.1.5.2/NEWS 2012-05-13 2014-05-24 chromium -- multiple vulnerabilities chromium 35.0.1916.114

Google Chrome Releases reports:

23 security fixes in this release, including:

[356653] High CVE-2014-1743: Use-after-free in styles. Credit to cloudfuzzer.

[359454] High CVE-2014-1744: Integer overflow in audio. Credit to Aaron Staple.

[346192] High CVE-2014-1745: Use-after-free in SVG. Credit to Atte Kettunen of OUSPG.

[364065] Medium CVE-2014-1746: Out-of-bounds read in media filters. Credit to Holger Fuhrmannek.

[330663] Medium CVE-2014-1747: UXSS with local MHTML file. Credit to packagesu.

[331168] Medium CVE-2014-1748: UI spoofing with scrollbar. Credit to Jordan Milne.

[374649] CVE-2014-1749: Various fixes from internal audits, fuzzing and other initiatives.

[358057] CVE-2014-3152: Integer underflow in V8 fixed in version 3.25.28.16.

CVE-2014-1743 CVE-2014-1744 CVE-2014-1745 CVE-2014-1746 CVE-2014-1747 CVE-2014-1748 CVE-2014-1749 CVE-2014-3152 http://googlechromereleases.blogspot.nl/ 2014-05-20 2014-05-20 chromium -- multiple vulnerabilities chromium 34.0.1847.137

Google Chrome Releases reports:

3 security fixes in this release:

[358038] High CVE-2014-1740: Use-after-free in WebSockets. Credit to Collin Payne.

[349898] High CVE-2014-1741: Integer overflow in DOM ranges. Credit to John Butler.

[356690] High CVE-2014-1742: Use-after-free in editing. Credit to cloudfuzzer.

CVE-2014-1740 CVE-2014-1741 CVE-2014-1742 http://googlechromereleases.blogspot.nl/ 2014-05-13 2014-05-14 libXfont -- X Font Service Protocol and Font metadata file handling issues libXfont 1.4.7_3 linux-c6-xorg-libs 7.4_2 linux-f10-xorg-libs *

Alan Coopersmith reports:

Ilja van Sprundel, a security researcher with IOActive, has discovered several issues in the way the libXfont library handles the responses it receives from xfs servers, and has worked with X.Org's security team to analyze, confirm, and fix these issues.

Most of these issues stem from libXfont trusting the font server to send valid protocol data, and not verifying that the values will not overflow or cause other damage. This code is commonly called from the X server when an X Font Server is active in the font path, so may be running in a setuid-root process depending on the X server in use. Exploits of this path could be used by a local, authenticated user to attempt to raise privileges; or by a remote attacker who can control the font server to attempt to execute code with the privileges of the X server.

CVE-2014-0209 CVE-2014-0210 CVE-2014-0211 http://lists.x.org/archives/xorg-announce/2014-May/002431.html 2014-05-13 2014-05-13 2015-07-15 libxml2 -- lack of end-of-document check DoS libxml2 2.9.1 linux-c6-libxml2 2.7.6_2 linux-f10-libxml2 *

CVE MITRE reports:

parser.c in libxml2 before 2.9.0, as used in Google Chrome before 28.0.1500.71 and other products, allows remote attackers to cause a denial of service (out-of-bounds read) via a document that ends abruptly, related to the lack of certain checks for the XML_PARSER_EOF state.

CVE-2013-2877 https://git.gnome.org/browse/libxml2/tag/?id=CVE-2013-2877 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2877 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-2877 2013-04-11 2013-07-10 2015-07-15 libxml2 -- entity substitution DoS libxml2 2.9.1 linux-c6-libxml2 2.7.6_2 linux-f10-libxml2 *

Stefan Cornelius reports:

It was discovered that libxml2, a library providing support to read, modify and write XML files, incorrectly performs entity substitution in the doctype prolog, even if the application using libxml2 disabled any entity substitution. A remote attacker could provide a specially-crafted XML file that, when processed, would lead to the exhaustion of CPU and memory resources or file descriptors.

This issue was discovered by Daniel Berrange of Red Hat.

CVE-2014-0191 http://www.openwall.com/lists/oss-security/2014/05/06/4 https://git.gnome.org/browse/libxml2/tag/?id=CVE-2014-0191 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0191 2013-12-03 2014-05-06 2015-07-15 OpenSSL -- NULL pointer dereference / DoS openssl 1.0.11.0.1_12 FreeBSD 10.010.0_3

OpenBSD and David Ramos reports:

Applications that use SSL_MODE_RELEASE_BUFFERS, such as nginx/apache, are prone to a race condition which may allow a remote attacker to crash the current service.

http://www.openwall.com/lists/oss-security/2014/05/02/5 https://rt.openssl.org/Ticket/Display.html?user=guest&pass=guest&id=3321 SA-14:10.openssl CVE-2014-0198 2014-05-02 2014-05-03 2016-08-09 qt4-xml -- XML Entity Expansion Denial of Service qt4-xml 4.8.6

Richard J. Moore reports:

QXmlSimpleReader in Qt versions prior to 5.2 supports expansion of internal entities in XML documents without placing restrictions to ensure the document does not cause excessive memory usage. If an application using this API processes untrusted data then the application may use unexpected amounts of memory if a malicious document is processed.

It is possible to construct XML documents using internal entities that consume large amounts of memory and other resources to process, this is known as the 'Billion Laughs' attack. Qt versions prior to 5.2 did not offer protection against this issue.

CVE-2013-4549 http://lists.qt-project.org/pipermail/announce/2013-December/000036.html 2013-12-05 2014-05-05 strongswan -- Remote Authentication Bypass strongswan 5.1.3

strongSwan developers report:

Remote attackers are able to bypass authentication by rekeying an IKE_SA during (1) initiation or (2) re-authentication, which triggers the IKE_SA state to be set to established.

Only installations that actively initiate or re-authenticate IKEv2 IKE_SAs are affected.

CVE-2014-2338 http://www.strongswan.org/blog/2014/04/14/strongswan-authentication-bypass-vulnerability-%28cve-2014-2338%29.html 2014-03-12 2014-05-04 mohawk -- multiple vulnerabilities mohawk 2.0.12

The mohawk project reports:

Segfault when parsing malformed / unescaped url, coredump when setting syslog facility.

http://fossil.bsdsx.fr/mohawk/tktview?name=1707f0e351 http://fossil.bsdsx.fr/mohawk/tktview?name=1c7565019e 2014-04-10 2014-04-30 chromium -- multiple vulnerabilities chromium 34.0.1847.132

Google Chrome Releases reports (belatedly):

9 security fixes in this release, including:

[354967] High CVE-2014-1730: Type confusion in V8. Credit to Anonymous.

[349903] High CVE-2014-1731: Type confusion in DOM. Credit to John Butler.

[359802] High CVE-2014-1736: Integer overflow in V8. Credit to SkyLined working with HP's Zero Day Initiative.

[352851] Medium CVE-2014-1732: Use-after-free in Speech Recognition. Credit to Khalil Zhani.

[351103] Medium CVE-2014-1733: Compiler bug in Seccomp-BPF. Credit to Jed Davis.

[367314] CVE-2014-1734: Various fixes from internal audits, fuzzing and other initiatives.

[359130, 359525, 360429] CVE-2014-1735: Multiple vulnerabilities in V8 fixed in version 3.24.35.33.

CVE-2014-1730 CVE-2014-1731 CVE-2014-1732 CVE-2014-1733 CVE-2014-1734 CVE-2014-1735 CVE-2014-1736 http://googlechromereleases.blogspot.nl/ 2014-04-24 2014-04-30 mozilla -- multiple vulnerabilities firefox 29.0,1 firefox-esr 24.5.0,1 linux-firefox 29.0,1 linux-seamonkey 2.26 linux-thunderbird 24.5.0 seamonkey 2.26 thunderbird 24.5.0

The Mozilla Project reports:

MFSA 2014-34 Miscellaneous memory safety hazards (rv:29.0 / rv:24.5)

MFSA 2014-35 Privilege escalation through Mozilla Maintenance Service Installer

MFSA 2014-36 Web Audio memory corruption issues

MFSA 2014-37 Out of bounds read while decoding JPG images

MFSA 2014-38 Buffer overflow when using non-XBL object as XBL

MFSA 2014-39 Use-after-free in the Text Track Manager for HTML video

MFSA 2014-41 Out-of-bounds write in Cairo

MFSA 2014-42 Privilege escalation through Web Notification API

MFSA 2014-43 Cross-site scripting (XSS) using history navigations

MFSA 2014-44 Use-after-free in imgLoader while resizing images

MFSA 2014-45 Incorrect IDNA domain name matching for wildcard certificates

MFSA 2014-46 Use-after-free in nsHostResolve

MFSA 2014-47 Debugger can bypass XrayWrappers with JavaScript

CVE-2014-1492 CVE-2014-1518 CVE-2014-1519 CVE-2014-1520 CVE-2014-1522 CVE-2014-1523 CVE-2014-1524 CVE-2014-1525 CVE-2014-1526 CVE-2014-1527 CVE-2014-1528 CVE-2014-1529 CVE-2014-1530 CVE-2014-1531 CVE-2014-1532 https://www.mozilla.org/security/announce/2014/mfsa2014-34.html https://www.mozilla.org/security/announce/2014/mfsa2014-35.html https://www.mozilla.org/security/announce/2014/mfsa2014-36.html https://www.mozilla.org/security/announce/2014/mfsa2014-37.html https://www.mozilla.org/security/announce/2014/mfsa2014-38.html https://www.mozilla.org/security/announce/2014/mfsa2014-39.html https://www.mozilla.org/security/announce/2014/mfsa2014-41.html https://www.mozilla.org/security/announce/2014/mfsa2014-42.html https://www.mozilla.org/security/announce/2014/mfsa2014-43.html https://www.mozilla.org/security/announce/2014/mfsa2014-44.html https://www.mozilla.org/security/announce/2014/mfsa2014-45.html https://www.mozilla.org/security/announce/2014/mfsa2014-46.html https://www.mozilla.org/security/announce/2014/mfsa2014-47.html http://www.mozilla.org/security/known-vulnerabilities/ 2014-04-29 2014-04-29 django -- multiple vulnerabilities py26-django 1.61.6.3 py27-django 1.61.6.3 py31-django 1.61.6.3 py32-django 1.61.6.3 py33-django 1.61.6.3 py34-django 1.61.6.3 py26-django15 1.51.5.6 py27-django15 1.51.5.6 py31-django15 1.51.5.6 py32-django15 1.51.5.6 py33-django15 1.51.5.6 py34-django15 1.51.5.6 py26-django14 1.41.4.11 py27-django14 1.41.4.11 py31-django14 1.41.4.11 py32-django14 1.41.4.11 py33-django14 1.41.4.11 py34-django14 1.41.4.11 py26-django-devel 20140423,1 py27-django-devel 20140423,1

The Django project reports:

These releases address an unexpected code-execution issue, a caching issue which can expose CSRF tokens and a MySQL typecasting issue. While these issues present limited risk and may not affect all Django users, we encourage all users to evaluate their own risk and upgrade as soon as possible.

https://www.djangoproject.com/weblog/2014/apr/21/security/ CVE-2014-0472 CVE-2014-0473 CVE-2014-0474 2014-04-21 2014-04-23 2014-04-30 OpenSSL -- Remote Data Injection / DoS openssl 1.0.11.0.1_11 mingw32-openssl 1.0.11.0.1g FreeBSD 10.010.0_2

Applications that use SSL_MODE_RELEASE_BUFFERS, such as nginx, are prone to a race condition which may allow a remote attacker to inject random data into other connections.

https://rt.openssl.org/Ticket/Display.html?id=2167 http://www.tedunangst.com/flak/post/analysis-of-openssl-freelist-reuse SA-14:09.openssl CVE-2010-5298 2010-02-09 2014-04-23 2016-08-09 bugzilla -- Cross-Site Request Forgery bugzilla40 2.0.04.4.3 bugzilla42 2.0.04.4.3 bugzilla44 2.0.04.4.3

A Bugzilla Security Advisory reports:

The login form had no CSRF protection, meaning that an attacker could force the victim to log in using the attacker's credentials. If the victim then reports a new security sensitive bug, the attacker would get immediate access to this bug.

Due to changes involved in the Bugzilla API, this fix is not backported to the 4.0 and 4.2 branches, meaning that Bugzilla 4.0.12 and older, and 4.2.8 and older, will remain vulnerable to this issue.

CVE-2014-1517 https://bugzilla.mozilla.org/show_bug.cgi?id=713926 2014-04-17 2014-04-18 2014-04-18 bugzilla -- Social Engineering bugzilla40 2.0.04.0.12 bugzilla42 4.1.14.2.8 bugzilla44 4.4.04.4.3

A Bugzilla Security Advisory reports:

Dangerous control characters can be inserted into Bugzilla, notably into bug comments. If the text, which may look safe, is copied into a terminal such as xterm or gnome-terminal, then unexpected commands could be executed on the local machine.

https://bugzilla.mozilla.org/show_bug.cgi?id=968576 2014-04-17 2014-04-18 2014-04-18 OpenLDAP -- incorrect handling of NULL in certificate Common Name openldap24-client 2.4.18 linux-f10-openldap 2.4.18

Jan Lieskovsky reports:

OpenLDAP does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority

CVE-2009-3767 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-3767 2009-08-07 2014-04-11 cURL -- inappropriate GSSAPI delegation curl 7.10.67.21.6 linux-f10-curl 7.10.67.21.6

cURL reports:

When doing GSSAPI authentication, libcurl unconditionally performs credential delegation. This hands the server a copy of the client's security credentials, allowing the server to impersonate the client to any other using the same GSSAPI mechanism.

CVE-2011-2192 http://curl.haxx.se/docs/adv_20110623.html 2011-06-23 2014-04-11 2014-04-30 dbus-glib -- privledge escalation dbus-glib 0.100.1 linux-f10-dbus-glib 0.100.1

Sebastian Krahmer reports:

A privilege escalation flaw was found in the way dbus-glib, the D-Bus add-on library to integrate the standard D-Bus library with the GLib thread abstraction and main loop, performed filtering of the message sender (message source subject), when the NameOwnerChanged signal was received. A local attacker could use this flaw to escalate their privileges.

CVE-2013-0292 https://bugs.freedesktop.org/show_bug.cgi?id=60916 2013-02-15 2014-04-11 2014-04-30 nas -- multiple vulnerabilities nas 1.9.4 linux-f10-nas-libs 1.9.4

Hamid Zamani reports:

multiple security problems (buffer overflows, format string vulnerabilities and missing input sanitising), which could lead to the execution of arbitrary code.

CVE-2013-4256 CVE-2013-4257 CVE-2013-4258 http://radscan.com/pipermail/nas/2013-August/001270.html 2013-08-07 2014-04-11 libaudiofile -- heap-based overflow in Microsoft ADPCM compression module libaudiofile 0.2.7 linux-f10-libaudiofile 0.2.7

Debian reports:

Heap-based buffer overflow in msadpcm.c in libaudiofile in audiofile 0.2.6 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted WAV file.

CVE-2014-0159 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=510205 2008-12-30 2014-04-11 2014-04-30 ChaSen -- buffer overflow chasen-base 2.4.5 chasen 2.4.5

JVN iPedia reports:

ChaSen provided by Nara Institute of Science and Technology is a software for morphologically analyzing Japanese. ChaSen contains an issue when reading in strings, which may lead to a buffer overflow.

An arbitrary script may be executed by an attacker with access to a system that is running a product listed in "Products Affected."

CVE-2011-4000 http://jvn.jp/en/jp/JVN16901583/index.html 2011-11-08 2014-04-13 OpenSSL -- Local Information Disclosure openssl 1.0.11.0.1_10 mingw32-openssl 1.0.11.0.1g FreeBSD 8.38.3_15 8.48.4_8 9.19.1_11 9.29.2_4 10.010.0_1

OpenSSL reports:

A flaw in the implementation of Montgomery Ladder Approach would create a side-channel that leaks sensitive timing information.

A local attacker might be able to snoop a signing process and might recover the signing key from it.

CVE-2014-0076 SA-14:06.openssl https://www.openssl.org/news/vulnerabilities.html#2014-0076 2014-04-07 2014-04-11 openafs -- Denial of Service openafs 1.4.81.6.7

The OpenAFS development team reports:

An attacker with the ability to connect to an OpenAFS fileserver can trigger a buffer overflow, crashing the server.

The buffer overflow can be triggered by sending an unauthenticated request for file server statistical information.

Clients are not affected.

CVE-2014-0159 http://openafs.org/security/OPENAFS-SA-2014-001.txt 2014-04-09 2014-04-09 chromium -- multiple vulnerabilities chromium 34.0.1847.116

Google Chrome Releases reports:

31 vulnerabilities fixed in this release, including:

[354123] High CVE-2014-1716: UXSS in V8. Credit to Anonymous.

[353004] High CVE-2014-1717: OOB access in V8. Credit to Anonymous.

[348332] High CVE-2014-1718: Integer overflow in compositor. Credit to Aaron Staple.

[343661] High CVE-2014-1719: Use-after-free in web workers. Credit to Collin Payne.

[356095] High CVE-2014-1720: Use-after-free in DOM. Credit to cloudfuzzer.

[350434] High CVE-2014-1721: Memory corruption in V8. Credit to Christian Holler.

[330626] High CVE-2014-1722: Use-after-free in rendering. Credit to miaubiz.

[337746] High CVE-2014-1723: Url confusion with RTL characters. Credit to George McBay.

[327295] High CVE-2014-1724: Use-after-free in speech. Credit to Atte Kettunen of OUSPG.

[357332] Medium CVE-2014-1725: OOB read with window property. Credit to Anonymous

[346135] Medium CVE-2014-1726: Local cross-origin bypass. Credit to Jann Horn.

[342735] Medium CVE-2014-1727: Use-after-free in forms. Credit to Khalil Zhani.

[360298] CVE-2014-1728: Various fixes from internal audits, fuzzing and other initiatives.

[345820, 347262, 348319, 350863, 352982, 355586, 358059] CVE-2014-1729: Multiple vulnerabilities in V8 fixed in version 3.24.35.22.

CVE-2014-1716 CVE-2014-1717 CVE-2014-1718 CVE-2014-1719 CVE-2014-1720 CVE-2014-1721 CVE-2014-1722 CVE-2014-1723 CVE-2014-1724 CVE-2014-1725 CVE-2014-1726 CVE-2014-1727 CVE-2014-1728 CVE-2014-1729 http://googlechromereleases.blogspot.nl/ 2014-04-08 2014-04-08 OpenSSL -- Remote Information Disclosure openssl 1.0.11.0.1_10 mingw32-openssl 1.0.11.0.1g FreeBSD 10.010.0_1

OpenSSL Reports:

A missing bounds check in the handling of the TLS heartbeat extension can be used to reveal up to 64k of memory to a connected client or server.

Affected users should upgrade to OpenSSL 1.0.1g. Users unable to immediately upgrade can alternatively recompile OpenSSL with -DOPENSSL_NO_HEARTBEATS.

The bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software. This compromises the secret keys used to identify the service providers and to encrypt the traffic, the names and passwords of the users and the actual content. This allows attackers to eavesdrop communications, steal data directly from the services and users and to impersonate services and users.

The code used to handle the Heartbeat Extension does not do sufficient boundary checks on record length, which allows reading beyond the actual payload.

CVE-2014-0160 SA-14:06.openssl https://www.openssl.org/news/secadv_20140407.txt https://www.openssl.org/news/vulnerabilities.html#2014-0076 http://www.heartbleed.com 2014-04-07 2014-04-07 2014-04-11 otrs -- Clickjacking issue otrs 3.1.21 3.2.*3.2.16 3.3.*3.3.6

The OTRS Project reports:

An attacker could embed OTRS in a hidden iframe tag of another page, tricking the user into clicking links in OTRS.

http://www.w3.org/1999/xhtml CVE-2014-2554 2014-04-01 2014-04-03 LibYAML input sanitization errors libyaml 0.1.6 mingw32-libyaml 0.1.6

oCERT reports:

The LibYAML project is an open source YAML 1.1 parser and emitter written in C.

The library is affected by a heap-based buffer overflow which can lead to arbitrary code execution. The vulnerability is caused by lack of proper expansion for the string passed to the yaml_parser_scan_uri_escapes() function.

A specially crafted YAML file, with a long sequence of percent-encoded characters in a URL, can be used to trigger the overflow.

CVE-2014-2525 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2525 2014-03-11 2014-03-26 Icinga -- buffer overflow in classic web interface icinga 1.11.1

The Icinga Team reports:

Wrong strlen check against MAX_INPUT_BUFFER without taking '\0' into account [...]

CVE-2014-2386 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-2386 2014-02-18 2014-03-29 file -- out-of-bounds access in search rules with offsets from input file file 5.18

Aaron Reffett reports:

softmagic.c in file ... and libmagic allows context-dependent attackers to cause a denial of service (out-of-bounds memory access and crash) via crafted offsets in the softmagic of a PE executable.

CVE-2014-2270 http://bugs.gw.com/view.php?id=31 2013-12-20 2014-03-29 Joomla! -- Core - Multiple Vulnerabilities joomla2 2.5.*2.5.18 joomla3 3.0.*3.2.2

The JSST and the Joomla! Security Center report:

[20140301] - Core - SQL Injection

Inadequate escaping leads to SQL injection vulnerability.

[20140302] - Core - XSS Vulnerability

Inadequate escaping leads to XSS vulnerability in com_contact.

[20140303] - Core - XSS Vulnerability

Inadequate escaping leads to XSS vulnerability.

[20140304] - Core - Unauthorised Logins

Inadequate checking allowed unauthorised logins via GMail authentication.

http://developer.joomla.org/security/578-20140301-core-sql-injection.html http://developer.joomla.org/security/579-20140302-core-xss-vulnerability.html http://developer.joomla.org/security/580-20140303-core-xss-vulnerability.html http://developer.joomla.org/security/581-20140304-core-unauthorised-logins.html 2014-03-01 2014-03-23 2014-04-30 mail/trojita -- may leak mail contents (not user credentials) over unencrypted connection trojita 0.4.1

Jan Kundrát reports:

An SSL stripping vulnerability was discovered in Trojitá, a fast Qt IMAP e-mail client. User's credentials are never leaked, but if a user tries to send an e-mail, the automatic saving into the "sent" or "draft" folders could happen over a plaintext connection even if the user's preferences specify STARTTLS as a requirement.

CVE-2014-2567 http://jkt.flaska.net/blog/Trojita_0_4_1__a_security_update_for_CVE_2014_2567.html 2014-03-20 2014-03-23 nginx-devel -- SPDY heap buffer overflow nginx-devel 1.3.151.5.12

The nginx project reports:

A bug in the experimental SPDY implementation in nginx was found, which might allow an attacker to cause a heap memory buffer overflow in a worker process by using a specially crafted request, potentially resulting in arbitrary code execution (CVE-2014-0133).

The problem affects nginx 1.3.15 - 1.5.11, compiled with the ngx_http_spdy_module module (which is not compiled by default) and without --with-debug configure option, if the "spdy" option of the "listen" directive is used in a configuration file.

The problem is fixed in nginx 1.5.12, 1.4.7.

CVE-2014-0133 http://mailman.nginx.org/pipermail/nginx-announce/2014/000135.html 2014-03-18 2014-03-23 nginx -- SPDY heap buffer overflow nginx 1.4.7

The nginx project reports:

A bug in the experimental SPDY implementation in nginx was found, which might allow an attacker to cause a heap memory buffer overflow in a worker process by using a specially crafted request, potentially resulting in arbitrary code execution (CVE-2014-0133).

The problem affects nginx 1.3.15 - 1.5.11, compiled with the ngx_http_spdy_module module (which is not compiled by default) and without --with-debug configure option, if the "spdy" option of the "listen" directive is used in a configuration file.

The problem is fixed in nginx 1.5.12, 1.4.7.

CVE-2014-0133 http://mailman.nginx.org/pipermail/nginx-announce/2014/000135.html 2014-03-18 2014-03-23 apache -- several vulnerabilities apache24 2.4.02.4.9 apache22 2.2.02.2.27 apache22-event-mpm 2.2.02.2.27 apache22-itk-mpm 2.2.02.2.27 apache22-peruser-mpm 2.2.02.2.27 apache22-worker-mpm 2.2.02.2.27

Apache HTTP SERVER PROJECT reports:

Clean up cookie logging with fewer redundant string parsing passes. Log only cookies with a value assignment. Prevents segfaults when logging truncated cookies.

mod_dav: Keep track of length of cdata properly when removing leading spaces. Eliminates a potential denial of service from specifically crafted DAV WRITE requests.

CVE-2014-0098 CVE-2013-6438 2014-02-25 2014-03-22 mozilla -- multiple vulnerabilities firefox 28.0,1 firefox-esr 24.4.0,1 linux-firefox 28.0,1 linux-seamonkey 2.25 linux-thunderbird 24.4.0 seamonkey 2.25 thunderbird 24.4.0

The Mozilla Project reports:

MFSA 2014-15 Miscellaneous memory safety hazards (rv:28.0 / rv:24.4)

MFSA 2014-16 Files extracted during updates are not always read only

MFSA 2014-17 Out of bounds read during WAV file decoding

MFSA 2014-18 crypto.generateCRMFRequest does not validate type of key

MFSA 2014-19 Spoofing attack on WebRTC permission prompt

MFSA 2014-20 onbeforeunload and Javascript navigation DOS

MFSA 2014-21 Local file access via Open Link in new tab

MFSA 2014-22 WebGL content injection from one domain to rendering in another

MFSA 2014-23 Content Security Policy for data: documents not preserved by session restore

MFSA 2014-24 Android Crash Reporter open to manipulation

MFSA 2014-25 Firefox OS DeviceStorageFile object vulnerable to relative path escape

MFSA 2014-26 Information disclosure through polygon rendering in MathML

MFSA 2014-27 Memory corruption in Cairo during PDF font rendering

MFSA 2014-28 SVG filters information disclosure through feDisplacementMap

MFSA 2014-29 Privilege escalation using WebIDL-implemented APIs

MFSA 2014-30 Use-after-free in TypeObject

MFSA 2014-31 Out-of-bounds read/write through neutering ArrayBuffer objects

MFSA 2014-32 Out-of-bounds write through TypedArrayObject after neutering

CVE-2014-1493 CVE-2014-1494 CVE-2014-1496 CVE-2014-1497 CVE-2014-1498 CVE-2014-1499 CVE-2014-1500 CVE-2014-1501 CVE-2014-1502 CVE-2014-1504 CVE-2014-1505 CVE-2014-1506 CVE-2014-1507 CVE-2014-1508 CVE-2014-1509 CVE-2014-1510 CVE-2014-1511 CVE-2014-1512 CVE-2014-1513 CVE-2014-1514 https://www.mozilla.org/security/announce/2014/mfsa2014-15.html https://www.mozilla.org/security/announce/2014/mfsa2014-16.html https://www.mozilla.org/security/announce/2014/mfsa2014-17.html https://www.mozilla.org/security/announce/2014/mfsa2014-18.html https://www.mozilla.org/security/announce/2014/mfsa2014-19.html https://www.mozilla.org/security/announce/2014/mfsa2014-20.html https://www.mozilla.org/security/announce/2014/mfsa2014-21.html https://www.mozilla.org/security/announce/2014/mfsa2014-22.html https://www.mozilla.org/security/announce/2014/mfsa2014-23.html https://www.mozilla.org/security/announce/2014/mfsa2014-24.html https://www.mozilla.org/security/announce/2014/mfsa2014-25.html https://www.mozilla.org/security/announce/2014/mfsa2014-26.html https://www.mozilla.org/security/announce/2014/mfsa2014-27.html https://www.mozilla.org/security/announce/2014/mfsa2014-28.html https://www.mozilla.org/security/announce/2014/mfsa2014-29.html https://www.mozilla.org/security/announce/2014/mfsa2014-30.html https://www.mozilla.org/security/announce/2014/mfsa2014-31.html https://www.mozilla.org/security/announce/2014/mfsa2014-32.html http://www.mozilla.org/security/known-vulnerabilities/ 2014-03-19 2014-03-19 2014-03-20 www/chromium -- multiple vulnerabilities chromium 33.0.1750.152

Google Chrome Releases reports:

New vulnerabilities after the Pwn2Own competition:

[352369] Code execution outside sandbox. Credit to VUPEN.

[352374] High CVE-2014-1713: Use-after-free in Blink bindings

[352395] High CVE-2014-1714: Windows clipboard vulnerability

[352420] Code execution outside sandbox. Credit to Anonymous.

[351787] High CVE-2014-1705: Memory corruption in V8

[352429] High CVE-2014-1715: Directory traversal issue

CVE-2014-1705 CVE-2014-1713 CVE-2014-1714 CVE-2014-1715 http://googlechromereleases.blogspot.nl/ 2014-03-14 2014-03-15 mutt -- denial of service, potential remote code execution mutt 1.5.23

Beatrice Torracca and Evgeni Golov report:

A buffer overflow has been discovered that could result in denial of service or potential execution of arbitrary code.

This condition can be triggered by malformed RFC2047 header lines

CVE-2014-0467 http://packetstormsecurity.com/files/cve/CVE-2014-0467 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0467 2014-03-12 2014-03-14 wemux -- read-only can be bypassed wemux 3.2.0

JonApps reports:

The read-only mode can be bypassed and any command sent to bash session

https://github.com/zolrath/wemux/issues/36 2013-12-24 2014-03-13 samba -- multiple vulnerabilities samba34 0 samba35 0 samba36 3.6.*3.6.23 samba4 4.0.*4.0.16 samba41 4.1.*4.1.6

Samba project reports:

In Samba's SAMR server we neglect to ensure that attempted password changes will update the bad password count, nor set the lockout flags. This would allow a user unlimited attempts against the password by simply calling ChangePasswordUser2 repeatedly.

This is available without any other authentication.

smbcacls can remove a file or directory ACL by mistake.

CVE-2013-4496 CVE-2013-6442 http://www.samba.org/samba/security/CVE-2013-4496 http://www.samba.org/samba/security/CVE-2013-6442 2014-03-11 2014-03-11 asterisk -- multiple vulnerabilities asterisk11 11.8.1 asterisk18 1.8.26.1

The Asterisk project reports:

Stack Overflow in HTTP Processing of Cookie Headers. Sending a HTTP request that is handled by Asterisk with a large number of Cookie headers could overflow the stack. You could even exhaust memory if you sent an unlimited number of headers in the request.

Denial of Service Through File Descriptor Exhaustion with chan_sip Session-Timers. An attacker can use all available file descriptors using SIP INVITE requests. Asterisk will respond with code 400, 420, or 422 for INVITEs meeting this criteria. Each INVITE meeting these conditions will leak a channel and several file descriptors. The file descriptors cannot be released without restarting Asterisk which may allow intrusion detection systems to be bypassed by sending the requests slowly.

Remote Crash Vulnerability in PJSIP channel driver. A remotely exploitable crash vulnerability exists in the PJSIP channel driver if the "qualify_frequency" configuration option is enabled on an AOR and the remote SIP server challenges for authentication of the resulting OPTIONS request. The response handling code wrongly assumes that a PJSIP endpoint will always be associated with an outgoing request which is incorrect.

CVE-2014-2286 CVE-2014-2287 CVE-2014-2288 http://downloads.asterisk.org/pub/security/AST-2014-001.pdf http://downloads.asterisk.org/pub/security/AST-2014-002.pdf http://downloads.asterisk.org/pub/security/AST-2014-003.pdf https://www.asterisk.org/security 2014-03-10 2014-03-10 www/chromium --multiple vulnerabilities chromium 33.0.1750.149

Google Chrome Releases reports:

7 vulnerabilities fixed in this release, including:

[344881] High CVE-2014-1700: Use-after-free in speech. Credit to Chamal de Silva.

[342618] High CVE-2014-1701: UXSS in events. Credit to aidanhs.

[333058] High CVE-2014-1702: Use-after-free in web database. Credit to Collin Payne.

[338354] High CVE-2014-1703: Potential sandbox escape due to a use-after-free in web sockets.

[328202, 349079, 345715] CVE-2014-1704: Multiple vulnerabilities in V8 fixed in version 3.23.17.18.

CVE-2014-1700 CVE-2014-1701 CVE-2014-1702 CVE-2014-1703 CVE-2014-1704 http://googlechromereleases.blogspot.nl/ 2014-03-11 2014-03-11 freetype2 -- Out of bounds read/write freetype2 2.5.3

Mateusz Jurczyk reports:

Out of bounds stack-based read/write in cf2_hintmap_build.

This is a critical vulnerability in the CFF Rasterizer code recently contributed by Adobe, leading to potential arbitrary code execution in the context of the FreeType2 library client.

http://savannah.nongnu.org/bugs/?41697 2014-02-25 2014-03-09 xmms -- Integer Overflow And Underflow Vulnerabilities xmms 1.2.11_20

Secunia reports:

Secunia Research has discovered two vulnerabilities in XMMS, which can be exploited by malicious people to compromise a user's system.

1) An integer underflow error exists in the processing of skin bitmap images. This can be exploited to cause a stack-based buffer overflow via specially crafted skin images containing manipulated header information.

Successful exploitation allows execution of arbitrary code.

2) An integer overflow error exists in the processing of skin bitmap images. This can be exploited to cause memory corruption via specially crafted skin images containing manipulated header information.

Successful exploitation may allow the execution of arbitrary code.

CVE-2007-0653 CVE-2007-0654 2007-02-06 2014-03-06 nginx -- SPDY memory corruption nginx-devel 1.5.10

The nginx project reports:

A bug in the experimental SPDY implementation in nginx 1.5.10 was found, which might allow an attacker to corrupt worker process memory by using a specially crafted request, potentially resulting in arbitrary code execution (CVE-2014-0088).

The problem only affects nginx 1.5.10 on 32-bit platforms, compiled with the ngx_http_spdy_module module (which is not compiled by default), if the "spdy" option of the "listen" directive is used in a configuration file.

CVE-2014-0088 http://mailman.nginx.org/pipermail/nginx-announce/2014/000132.html 2014-03-04 2014-03-06 chromium -- multiple vulnerabilities chromium 33.0.1750.146

Google Chrome Releases reports:

19 vulnerabilities fixed in this release, including:

[344492] High CVE-2013-6663: Use-after-free in svg images. Credit to Atte Kettunen of OUSPG.

[326854] High CVE-2013-6664: Use-after-free in speech recognition. Credit to Khalil Zhani.

[337882] High CVE-2013-6665: Heap buffer overflow in software rendering. Credit to cloudfuzzer.

[332023] Medium CVE-2013-6666: Chrome allows requests in flash header request. Credit to netfuzzerr.

[348175] CVE-2013-6667: Various fixes from internal audits, fuzzing and other initiatives.

[343964, 344186, 347909] CVE-2013-6668: Multiple vulnerabilities in V8 fixed in version 3.24.35.10.

CVE-2013-6663 CVE-2013-6664 CVE-2013-6665 CVE-2013-6666 CVE-2013-6667 CVE-2013-6668 http://googlechromereleases.blogspot.nl/ 2014-03-03 2014-03-05 gnutls -- multiple certificate verification issues gnutls 2.12.23_4 linux-f10-gnutls 2.12.23_4 gnutls-devel 3.1.22 3.2.03.2.12 gnutls3 3.1.22 3.2.03.2.12

GnuTLS project reports:

A vulnerability was discovered that affects the certificate verification functions of all gnutls versions. A specially crafted certificate could bypass certificate validation checks. The vulnerability was discovered during an audit of GnuTLS for Red Hat.

Suman Jana reported a vulnerability that affects the certificate verification functions of gnutls 2.11.5 and later versions. A version 1 intermediate certificate will be considered as a CA certificate by default (something that deviates from the documented behavior).

CVE-2014-0092 CVE-2014-1959 http://www.gnutls.org/security.html#GNUTLS-SA-2014-1 http://www.gnutls.org/security.html#GNUTLS-SA-2014-2 2014-03-03 2014-03-04 2014-04-30 file -- denial of service file 5.17

The Fine Free file project reports:

file before 5.17 allows context-dependent attackers to cause a denial of service (infinite recursion, CPU consumption, and crash) via a crafted indirect offset value in the magic of a file.

CVE-2014-1943 http://mx.gw.com/pipermail/file/2014/001327.html 2014-02-16 2014-03-03 Python -- buffer overflow in socket.recvfrom_into() python27 2.7.6_3 python31 3.1.5_10 python32 3.2.5_7 python33 3.3.3_2

Vincent Danen via Red Hat Issue Tracker reports:

A vulnerability was reported in Python's socket module, due to a boundary error within the sock_recvfrom_into() function, which could be exploited to cause a buffer overflow. This could be used to crash a Python application that uses the socket.recvfrom_info() function or, possibly, execute arbitrary code with the permissions of the user running vulnerable Python code.

This vulnerable function, socket.recvfrom_into(), was introduced in Python 2.5. Earlier versions are not affected by this flaw.

65379 CVE-2014-1912 https://mail.python.org/pipermail/python-dev/2014-February/132758.html http://bugs.python.org/issue20246 https://bugzilla.redhat.com/show_bug.cgi?id=1062370 2014-01-14 2014-03-01 subversion -- mod_dav_svn vulnerability subversion 1.3.01.7.16 1.8.01.8.8 subversion16 1.3.01.7.16 subversion17 1.3.01.7.16

Subversion Project reports:

Subversion's mod_dav_svn Apache HTTPD server module will crash when it receives an OPTIONS request against the server root and Subversion is configured to handle the server root and SVNListParentPath is on. This can lead to a DoS. There are no known instances of this problem being exploited in the wild, but the details of how to exploit it have been disclosed on the Subversion development mailing list.

CVE-2014-0032 https://subversion.apache.org/security/CVE-2014-0032-advisory.txt 2014-01-10 2014-02-26 2014-04-30 otrs -- XSS Issue otrs 3.1.20 3.2.*3.2.15 3.3.*3.3.5

The OTRS Project reports:

An attacker could send a specially prepared HTML email to OTRS. If he can then trick an agent into following a special link to display this email, JavaScript code would be executed.

https://www.otrs.com/security-advisory-2014-03-xss-issue/ CVE-2014-1695 2014-02-25 2014-02-25 chromium -- multiple vulnerabilities chromium 33.0.1750.117

Google Chrome Releases reports:

28 security fixes in this release, including:

[334897] High CVE-2013-6652: Issue with relative paths in Windows sandbox named pipe policy. Credit to tyranid.

[331790] High CVE-2013-6653: Use-after-free related to web contents. Credit to Khalil Zhani.

[333176] High CVE-2013-6654: Bad cast in SVG. Credit to TheShow3511.

[293534] High CVE-2013-6655: Use-after-free in layout. Credit to cloudfuzzer.

[331725] High CVE-2013-6656: Information leak in XSS auditor. Credit to NeexEmil.

[331060] Medium CVE-2013-6657: Information leak in XSS auditor. Credit to NeexEmil.

[322891] Medium CVE-2013-6658: Use-after-free in layout. Credit to cloudfuzzer.

[306959] Medium CVE-2013-6659: Issue with certificates validation in TLS handshake. Credit to Antoine Delignat-Lavaud and Karthikeyan Bhargavan from Prosecco, Inria Paris.

[332579] Low CVE-2013-6660: Information leak in drag and drop. Credit to bishopjeffreys.

[344876] Low-High CVE-2013-6661: Various fixes from internal audits, fuzzing and other initiatives. Of these, seven are fixes for issues that could have allowed for sandbox escapes from compromised renderers.

CVE-2013-6652 CVE-2013-6653 CVE-2013-6654 CVE-2013-6655 CVE-2013-6656 CVE-2013-6657 CVE-2013-6658 CVE-2013-6659 CVE-2013-6660 CVE-2013-6661 http://googlechromereleases.blogspot.nl/ 2014-02-20 2014-02-24 PostgreSQL -- multiple privilege issues postgresql-server 8.4.20 9.0.09.0.16 9.1.09.1.12 9.2.09.2.7 9.3.09.3.3

PostgreSQL Project reports:

This update fixes CVE-2014-0060, in which PostgreSQL did not properly enforce the WITH ADMIN OPTION permission for ROLE management. Before this fix, any member of a ROLE was able to grant others access to the same ROLE regardless if the member was given the WITH ADMIN OPTION permission. It also fixes multiple privilege escalation issues, including: CVE-2014-0061, CVE-2014-0062, CVE-2014-0063, CVE-2014-0064, CVE-2014-0065, and CVE-2014-0066. More information on these issues can be found on our security page and the security issue detail wiki page.

With this release, we are also alerting users to a known security hole that allows other users on the same machine to gain access to an operating system account while it is doing "make check": CVE-2014-0067. "Make check" is normally part of building PostgreSQL from source code. As it is not possible to fix this issue without causing significant issues to our testing infrastructure, a patch will be released separately and publicly. Until then, users are strongly advised not to run "make check" on machines where untrusted users have accounts.

CVE-2014-0060 CVE-2014-0061 CVE-2014-0062 CVE-2014-0063 CVE-2014-0064 CVE-2014-0065 CVE-2014-0066 CVE-2014-0067 2014-02-20 2014-02-20 phpMyAdmin -- Self-XSS due to unescaped HTML output in import. phpMyAdmin 3.3.14.1.7

The phpMyAdmin development team reports:

When importing a file with crafted filename, it is possible to trigger an XSS. We consider this vulnerability to be non critical.

http://www.phpmyadmin.net/home_page/security/PMASA-2014-1.php CVE-2014-1879 2014-02-15 2014-02-15 jenkins -- multiple vulnerabilities jenkins 1.551 jenkins-lts 1.532.2

Jenkins Security Advisory reports:

This advisory announces multiple security vulnerabilities that were found in Jenkins core.

iSECURITY-105

In some places, Jenkins XML API uses XStream to deserialize arbitrary content, which is affected by CVE-2013-7285 reported against XStream. This allows malicious users of Jenkins with a limited set of permissions to execute arbitrary code inside Jenkins master.

SECURITY-76 & SECURITY-88 / CVE-2013-5573

Restrictions of HTML tags for user-editable contents are too lax. This allows malicious users of Jenkins to trick other unsuspecting users into providing sensitive information.

SECURITY-109

Plugging a hole in the earlier fix to SECURITY-55. Under some circimstances, a malicious user of Jenkins can configure job X to trigger another job Y that the user has no access to.

SECURITY-108

CLI job creation had a directory traversal vulnerability. This allows a malicious user of Jenkins with a limited set of permissions to overwrite files in the Jenkins master and escalate privileges.

SECURITY-106

The embedded Winstone servlet container is susceptive to session hijacking attack.

SECURITY-93

The password input control in the password parameter definition in the Jenkins UI was serving the actual value of the password in HTML, not an encrypted one. If a sensitive value is set as the default value of such a parameter definition, it can be exposed to unintended audience.

SECURITY-89

Deleting the user was not invalidating the API token, allowing users to access Jenkins when they shouldn't be allowed to do so.

SECURITY-80

Jenkins UI was vulnerable to click jacking attacks.

SECURITY-79

"Jenkins' own user database" was revealing the presence/absence of users when login attempts fail.

SECURITY-77

Jenkins had a cross-site scripting vulnerability in one of its cookies. If Jenkins is deployed in an environment that allows an attacker to override Jenkins cookies in victim's browser, this vulnerability can be exploited.

SECURITY-75

Jenkins was vulnerable to session fixation attack. If Jenkins is deployed in an environment that allows an attacker to override Jenkins cookies in victim's browser, this vulnerability can be exploited.

SECURITY-74

Stored XSS vulnerability. A malicious user of Jenkins with a certain set of permissions can cause Jenkins to store arbitrary HTML fragment.

SECURITY-73

Some of the system diagnostic functionalities were checking a lesser permission than it should have. In a very limited circumstances, this can cause an attacker to gain information that he shouldn't have access to.

Severity

SECURITY-106, and SECURITY-80 are rated high. An attacker only needs direct HTTP access to the server to mount this attack.

SECURITY-105, SECURITY-109, SECURITY-108, and SECURITY-74 are rated high. These vulnerabilities allow attackes with valid Jenkins user accounts to escalate privileges in various ways.

SECURITY-76, SECURIT-88, and SECURITY-89 are rated medium. These vulnerabilities requires an attacker to be an user of Jenkins, and the mode of the attack is limited.

SECURITY-93, and SECURITY-79 are rated low. These vulnerabilities only affect a small part of Jenkins and has limited impact.

SECURITY-77, SECURITY-75, and SECURITY-73 are rated low. These vulnerabilities are hard to exploit unless combined with other exploit in the network.

https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14 CVE-2013-5573 CVE-2013-7285 2014-02-14 2014-02-15 lighttpd -- multiple vulnerabilities lighttpd 1.4.34

lighttpd security advisories report:

It is possible to inadvertantly enable vulnerable ciphers when using ssl.cipher-list.

In certain cases setuid() and similar can fail, potentially triggering lighttpd to restart running as root.

If FAMMonitorDirectory fails, the memory intended to store the context is released; some lines below the "version" compoment of that context is read. Reading invalid data doesn't matter, but the memory access could trigger a segfault.

http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_01.txt http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_02.txt http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_03.txt CVE-2013-4508 CVE-2013-4559 CVE-2013-4560 2013-11-28 2014-02-14 phpmyfaq -- multiple vulnerabilities phpmyfaq 2.8.6

The phpMyFAQ team reports:

An arbitrary script may be executed on the user's Internet Explorer when using an older version of the browser. If a user views a malicious page while logged in, settings may be changed unintentionally.

CVE-2014-0813 CVE-2014-0814 http://www.phpmyfaq.de/advisory_2014-02-04.php 2014-02-04 2014-02-06 linux-flashplugin -- multiple vulnerabilities linux-f10-flashplugin 11.2r202.336

Adobe reports:

These updates address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.

CVE-2014-0497 http://www.adobe.com/support/security/bulletins/apsb14-04.html 2014-02-04 2014-02-04 2014-02-05 mozilla -- multiple vulnerabilities firefox 25.0,127.0,1 24.3.0,1 linux-firefox 27.0,1 linux-seamonkey 2.24 linux-thunderbird 24.3.0 seamonkey 2.24 thunderbird 24.3.0

The Mozilla Project reports:

MFSA 2014-01 Miscellaneous memory safety hazards (rv:27.0 / rv:24.3)

MFSA 2014-02 Clone protected content with XBL scopes

MFSA 2014-03 UI selection timeout missing on download prompts

MFSA 2014-04 Incorrect use of discarded images by RasterImage

MFSA 2014-05 Information disclosure with *FromPoint on iframes

MFSA 2014-06 Profile path leaks to Android system log

MFSA 2014-07 XSLT stylesheets treated as styles in Content Security Policy

MFSA 2014-08 Use-after-free with imgRequestProxy and image proccessing

MFSA 2014-09 Cross-origin information leak through web workers

MFSA 2014-10 Firefox default start page UI content invokable by script

MFSA 2014-11 Crash when using web workers with asm.js

MFSA 2014-12 NSS ticket handling issues

MFSA 2014-13 Inconsistent JavaScript handling of access to Window objects

CVE-2014-1477 CVE-2014-1478 CVE-2014-1479 CVE-2014-1480 CVE-2014-1481 CVE-2014-1482 CVE-2014-1483 CVE-2014-1484 CVE-2014-1485 CVE-2014-1486 CVE-2014-1487 CVE-2014-1488 CVE-2014-1489 CVE-2014-1490 CVE-2014-1491 https://www.mozilla.org/security/announce/2014/mfsa2014-01.html https://www.mozilla.org/security/announce/2014/mfsa2014-02.html https://www.mozilla.org/security/announce/2014/mfsa2014-03.html https://www.mozilla.org/security/announce/2014/mfsa2014-04.html https://www.mozilla.org/security/announce/2014/mfsa2014-05.html https://www.mozilla.org/security/announce/2014/mfsa2014-06.html https://www.mozilla.org/security/announce/2014/mfsa2014-07.html https://www.mozilla.org/security/announce/2014/mfsa2014-08.html https://www.mozilla.org/security/announce/2014/mfsa2014-09.html https://www.mozilla.org/security/announce/2014/mfsa2014-10.html https://www.mozilla.org/security/announce/2014/mfsa2014-11.html https://www.mozilla.org/security/announce/2014/mfsa2014-12.html http://www.mozilla.org/security/known-vulnerabilities/ 2014-02-04 2014-02-04 libyaml heap overflow resulting in possible code execution libyaml 0.1.4_3 pkg 1.2.6 pkg-devel 1.2.6

libyaml was prone to a heap overflow that could result in arbitrary code execution. Pkg uses libyaml to parse the package manifests in some cases. Pkg also used libyaml to parse the remote repository until 1.2.

RedHat Product Security Team reports on libyaml:

A heap-based buffer overflow flaw was found in the way libyaml parsed YAML tags. A remote attacker could provide a specially-crafted YAML document that, when parsed by an application using libyaml, would cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application.

CVE-2013-6393 https://bugzilla.redhat.com/show_bug.cgi?id=1033990 2013-11-24 2014-02-01 2014-02-01 socat -- buffer overflow with data from command line socat 1.7.2.3

Florian Weimer of the Red Hat Product Security Team reports:

Due to a missing check during assembly of the HTTP request line a long target server name in the PROXY-CONNECT address can cause a stack buffer overrun. Exploitation requires that the attacker is able to provide the target server name to the PROXY-CONNECT address in the command line. This can happen for example in scripts that receive data from untrusted sources.

CVE-2014-0019 http://www.dest-unreach.org/socat/contrib/socat-secadv5.txt 2014-01-24 2014-01-29 otrs -- multiple vulnerabilities otrs 3.1.19 3.2.*3.2.14 3.3.*3.3.4

The OTRS Project reports:

SQL injection issue

An attacker that managed to take over the session of a logged in customer could create tickets and/or send follow-ups to existing tickets due to missing challenge token checks.

CVE-2014-1471 https://www.otrs.com/security-advisory-2014-02-sql-injection-issue/ https://www.otrs.com/security-advisory-2014-01-csrf-issue-customer-web-interface/ 2014-01-28 2014-01-28 2014-02-06 chromium -- multiple vulnerabilities chromium 32.0.1700.102

Google Chrome Releases reports:

14 security fixes in this release, including:

[330420] High CVE-2013-6649: Use-after-free in SVG images. Credit to Atte Kettunen of OUSPG.

[331444] High CVE-2013-6650: Memory corruption in V8. This issue was fixed in v8 version 3.22.24.16. Credit to Christian Holler.

CVE-2013-6649 CVE-2013-6650 http://googlechromereleases.blogspot.nl/ 2014-01-27 2014-01-27 rt42 -- denial-of-service attack via the email gateway rt42 4.24.2.1_3 4.2.24.2.2_2 p5-Email-Address-List 0.02

The RT development team reports:

Versions of RT between 4.2.0 and 4.2.2 (inclusive) are vulnerable to a denial-of-service attack via the email gateway; any installation which accepts mail from untrusted sources is vulnerable, regardless of the permissions configuration inside RT. This vulnerability is assigned CVE-2014-1474.

This vulnerability is caused by poor parsing performance in the Email::Address::List module, which RT depends on. We recommend that affected users upgrade their version of Email::Address::List to v0.02 or above, which resolves the issue. Due to a communications mishap, the release on CPAN will temporarily appear as "unauthorized," and the command-line cpan client will hence not install it. We expect this to be resolved shortly; in the meantime, the release is also available from our server.

CVE-2014-1474 http://blog.bestpractical.com/2014/01/security-vulnerability-in-rt-42.html 2014-01-27 2014-01-27 strongswan -- multiple DoS vulnerabilities strongswan 5.1.1

strongSwan Project reports:

A DoS vulnerability triggered by crafted IKEv1 fragmentation payloads was discovered in strongSwan's IKE daemon charon. All versions since 5.0.2 are affected.

A DoS vulnerability and potential authorization bypass triggered by a crafted ID_DER_ASN1_DN ID payload was discovered in strongSwan. All versions since 4.3.3 are affected.

A DoS vulnerability in strongSwan was discovered, which is triggered by XAuth usernames and EAP identities in versions 5.0.3 and 5.0.4.

CVE-2013-5018 CVE-2013-6075 CVE-2013-6076 http://www.strongswan.org/blog/2013/08/01/strongswan-denial-of-service-vulnerability-%28cve-2013-5018%29.html http://www.strongswan.org/blog/2013/11/01/strongswan-denial-of-service-vulnerability-%28cve-2013-6075%29.html http://www.strongswan.org/blog/2013/11/01/strongswan-denial-of-service-vulnerability-%28cve-2013-6076%29.html 2013-11-01 2014-01-27 varnish -- DoS vulnerability in Varnish HTTP cache varnish 3.0.5

Varnish Cache Project reports:

If Varnish receives a certain illegal request, and the subroutine 'vcl_error{}' restarts the request, the varnishd worker process will crash with an assert.

The varnishd management process will restart the worker process, but there will be a brief interruption of service and the cache will be emptied, causing more traffic to go to the backend.

We are releasing this advisory because restarting from vcl_error{} is both fairly common and documented.

This is purely a denial of service vulnerability, there is no risk of privilege escalation.

Workaround

Insert this at the top of your VCL file:
 		sub vcl_error {
 			if (obj.status == 400 || obj.status == 413) {
 				return(deliver);
 			}
 		}
 
 		Or add this test at the top of your existing vcl_error{}.
 	  

CVE-2013-4484 https://www.varnish-cache.org/lists/pipermail/varnish-announce/2013-October/000686.html 2013-10-30 2014-01-25 linux-flashplugin -- multiple vulnerabilities linux-f10-flashplugin 11.2r202.335

Adobe reports:

These updates address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.

CVE-2014-0491 CVE-2014-0492 http://helpx.adobe.com/security/products/flash-player/apsb14-02.html 2014-01-14 2014-01-24 HTMLDOC -- buffer overflow issues when reading AFM files and parsing page sizes htmldoc 1.8.28

Michael Sweet reports:

HTMLDOC 1.8.28 fixes some known security issues and formatting bugs. Changes include:

SECURITY: Fixed three buffer overflow issues when reading AFM files and parsing page sizes.

http://www.msweet.org/projects.php?Z1 2014-01-06 2014-01-22 2014-01-23 virtualbox-ose -- local vulnerability virtualbox-ose 4.2.22

Oracle reports:

Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.22, and 4.3.6 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core.

CVE-2013-5892 http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html 2014-01-15 2014-01-16 chromium -- multiple vulnerabilities chromium 32.0.1700.77

Google Chrome Releases reports:

11 security fixes in this release, including:

[249502] High CVE-2013-6646: Use-after-free in web workers. Credit to Collin Payne.

[326854] High CVE-2013-6641: Use-after-free related to forms. Credit to Atte Kettunen of OUSPG.

[324969] High CVE-2013-6642: Address bar spoofing in Chrome for Android. Credit to lpilorz.

[321940] High CVE-2013-6643: Unprompted sync with an attacker’s Google account. Credit to Joao Lucas Melo Brasio.

[318791] Medium CVE-2013-6645 Use-after-free related to speech input elements. Credit to Khalil Zhani.

[333036] CVE-2013-6644: Various fixes from internal audits, fuzzing and other initiatives.

CVE-2013-6641 CVE-2013-6642 CVE-2013-6643 CVE-2013-6644 CVE-2013-6645 CVE-2013-6646 http://googlechromereleases.blogspot.nl/ 2014-01-14 2014-01-15 ntpd DRDoS / Amplification Attack using ntpdc monlist command ntp 4.2.7p26 FreeBSD 8.38.3_14 8.48.4_7 9.19.1_10 9.29.2_3

ntp.org reports:

Unrestricted access to the monlist feature in ntp_request.c in ntpd in NTP before 4.2.7p26 allows remote attackers to cause a denial of service (traffic amplification) via forged (1) REQ_MON_GETLIST or (2) REQ_MON_GETLIST_1 requests, as exploited in the wild in December 2013

Use noquery to your default restrictions to block all status queries.

Use disable monitor to disable the ``ntpdc -c monlist'' command while still allowing other status queries.

CVE-2013-5211 SA-14:02.ntpd http://support.ntp.org/bin/view/Main/SecurityNotice#DRDoS_Amplification_Attack_using 2014-01-01 2014-01-14 2016-08-09 nagios -- denial of service vulnerability nagios 3.5.1_3

Eric Stanley reports:

Most CGIs previously incremented the input variable counter twice when it encountered a long key value. This could cause the CGI to read past the end of the list of CGI variables.

CVE-2013-7108 CVE-2013-7205 http://sourceforge.net/p/nagios/nagioscore/ci/d97e03f32741a7d851826b03ed73ff4c9612a866/ https://bugzilla.redhat.com/show_bug.cgi?id=1046113 2013-12-20 2014-01-14 bind -- denial of service vulnerability bind99 9.9.4.2 bind99-base 9.9.4.2 bind98 9.8.6.2 bind98-base 9.8.6.2 bind96 9.6.3.2.ESV.R10.2 bind96-base 9.6.3.2.ESV.R10.2 FreeBSD 9.29.2_3 9.19.1_10 8.48.4_7 8.38.3_14

ISC reports:

Because of a defect in handling queries for NSEC3-signed zones, BIND can crash with an "INSIST" failure in name.c when processing queries possessing certain properties. By exploiting this defect an attacker deliberately constructing a query with the right properties could achieve denial of service against an authoritative nameserver serving NSEC3-signed zones.

CVE-2014-0591 SA-14:04.bind https://kb.isc.org/article/AA-01078/74/ 2014-01-08 2014-01-13 2016-08-09 libXfont -- Stack buffer overflow in parsing of BDF font files in libXfont libXfont 1.4.7,1

freedesktop.org reports:

A BDF font file containing a longer than expected string can cause a buffer overflow on the stack. Testing in X servers built with Stack Protector restulted in an immediate crash when reading a user-proveded specially crafted font.

As libXfont is used to read user-specified font files in all X servers distributed by X.Org, including the Xorg server which is often run with root privileges or as setuid-root in order to access hardware, this bug may lead to an unprivileged user acquiring root privileges in some systems.

CVE-2013-6462 http://lists.x.org/archives/xorg-announce/2014-January/002389.html 2013-12-24 2014-01-08 openssl -- multiple vulnerabilities openssl 1.0.1_9

OpenSSL development team reports:

Major changes between OpenSSL 1.0.1e and OpenSSL 1.0.1f [6 Jan 2014]:

Fix for TLS record tampering bug [CVE-2013-4353]

Fix for TLS version checking bug [CVE-2013-6449]

Fix for DTLS retransmission bug [CVE-2013-6450]

SA-14:03.openssl CVE-2013-4353 CVE-2013-6449 CVE-2013-6450 http://www.openssl.org/news/openssl-1.0.1-notes.html 2014-01-06 2014-01-06 2016-08-09 OpenX -- SQL injection vulnerability openx 3.0.2

Revive reports:

An SQL-injection vulnerability was recently discovered and reported to the Revive Adserver team by Florian Sander. The vulnerability is known to be already exploited to gain unauthorised access to the application using brute force mechanisms, however other kind of attacks might be possible and/or already in use. The risk is rated to be critical as the most common end goal of the attackers is to spread malware to the visitors of all the websites and ad networks that the ad server is being used on.

The vulnerability is also present and exploitable in OpenX Source 2.8.11 and earlier versions, potentially back to phpAdsNew 2.0.x.

http://www.revive-adserver.com/security/revive-sa-2013-001/ http://www.kreativrauschen.com/blog/2013/12/18/zero-day-vulnerability-in-openx-source-2-8-11-and-revive-adserver-3-0-1/ CVE-2013-7149 2013-12-20 2013-12-22 cURL library -- cert name check ignore with GnuTLS curl 7.21.47.33.0_2

cURL project reports:

libcurl is vulnerable to a case of missing out the checking of the certificate CN or SAN name field when the digital signature verification is turned off.

libcurl offers two separate and independent options for verifying a server's TLS certificate. CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST. The first one tells libcurl to verify the trust chain using a CA cert bundle, while the second tells libcurl to make sure that the name fields in the server certificate meets the criteria. Both options are enabled by default.

This flaw had the effect that when an application disabled CURLOPT_SSL_VERIFYPEER, libcurl mistakenly also skipped the CURLOPT_SSL_VERIFYHOST check. Applications can disable CURLOPT_SSL_VERIFYPEER and still achieve security by doing the check on its own using other means.

The curl command line tool is not affected by this problem as it either enables both options or disables both at the same time.

http://curl.haxx.se/docs/adv_20131217.html CVE-2013-6422 2013-12-17 2013-12-18 gnupg -- RSA Key Extraction via Low-Bandwidth Acoustic Cryptanalysis attack gnupg 1.4.16 gnupg1 1.4.16

Werner Koch reports:

CVE-2013-4576 has been assigned to this security bug.

The paper describes two attacks. The first attack allows to distinguish keys: An attacker is able to notice which key is currently used for decryption. This is in general not a problem but may be used to reveal the information that a message, encrypted to a commonly not used key, has been received by the targeted machine. We do not have a software solution to mitigate this attack.

The second attack is more serious. It is an adaptive chosen ciphertext attack to reveal the private key. A possible scenario is that the attacker places a sensor (for example a standard smartphone) in the vicinity of the targeted machine. That machine is assumed to do unattended RSA decryption of received mails, for example by using a mail client which speeds up browsing by opportunistically decrypting mails expected to be read soon. While listening to the acoustic emanations of the targeted machine, the smartphone will send new encrypted messages to that machine and re-construct the private key bit by bit. A 4096 bit RSA key used on a laptop can be revealed within an hour.

CVE-2013-4576 http://lists.gnupg.org/pipermail/gnupg-announce/2013q4/000337.html 2013-12-18 2013-12-18 2014-04-30 asterisk -- multiple vulnerabilities asterisk10 10.12.4 asterisk11 11.6.1 asterisk18 1.8.24.1

The Asterisk project reports:

A 16 bit SMS message that contains an odd message length value will cause the message decoding loop to run forever. The message buffer is not on the stack but will be overflowed resulting in corrupted memory and an immediate crash.

External control protocols, such as the Asterisk Manager Interface, often have the ability to get and set channel variables; this allows the execution of dialplan functions. Dialplan functions within Asterisk are incredibly powerful, which is wonderful for building applications using Asterisk. But during the read or write execution, certain diaplan functions do much more. For example, reading the SHELL() function can execute arbitrary commands on the system Asterisk is running on. Writing to the FILE() function can change any file that Asterisk has write access to. When these functions are executed from an external protocol, that execution could result in a privilege escalation.

CVE-2013-7100 http://downloads.asterisk.org/pub/security/AST-2013-006.pdf http://downloads.asterisk.org/pub/security/AST-2013-007.pdf https://www.asterisk.org/security 2013-12-16 2013-12-17 phpmyfaq -- arbitrary PHP code execution vulnerability phpmyfaq 2.8.4

The phpMyFAQ team reports:

Secunia noticed while analysing the advisory that authenticated users with "Right to add attachments" are able to exploit an already publicly known issue in the bundled Ajax File Manager of phpMyFAQ version 2.8.3, which leads to arbitrary PHP code execution for authenticated users with the permission "Right to add attachments".

http://en.securitylab.ru/lab/PT-2013-41 http://www.phpmyfaq.de/advisory_2013-11-26.php 2013-11-26 2013-12-16 2013-12-17 zabbix -- shell command injection vulnerability zabbix2-agent 2.0.10

Recurity Labs Team project reports:

Zabbix agent is vulnerable to remote command execution from the Zabbix server in some cases.

CVE-2013-6824 https://support.zabbix.com/browse/ZBX-7479 2013-12-03 2013-12-16 PHP5 -- memory corruption in openssl_x509_parse() php5 5.4.05.4.23 php53 5.3.28 php55 5.5.05.5.7

Stefan Esser reports:

The PHP function openssl_x509_parse() uses a helper function called asn1_time_to_time_t() to convert timestamps from ASN1 string format into integer timestamp values. The parser within this helper function is not binary safe and can therefore be tricked to write up to five NUL bytes outside of an allocated buffer.

This problem can be triggered by x509 certificates that contain NUL bytes in their notBefore and notAfter timestamp fields and leads to a memory corruption that might result in arbitrary code execution.

Depending on how openssl_x509_parse() is used within a PHP application the attack requires either a malicious cert signed by a compromised/malicious CA or can be carried out with a self-signed cert.

CVE-2013-6420 https://www.sektioneins.de/advisories/advisory-012013-php-openssl_x509_parse-memory-corruption-vulnerability.html 2013-12-13 2013-12-14 mozilla -- multiple vulnerabilities firefox 25.0,126.0,1 24.2.0,1 linux-firefox 26.0,1 linux-seamonkey 2.23 linux-thunderbird 24.2.0 seamonkey 2.23 thunderbird 24.2.0

The Mozilla Project reports:

MFSA 2013-116 JPEG information leak

MFSA 2013-105 Application Installation doorhanger persists on navigation

MFSA 2013-106 Character encoding cross-origin XSS attack

MFSA 2013-107 Sandbox restrictions not applied to nested object elements

MFSA 2013-108 Use-after-free in event listeners

MFSA 2013-109 Use-after-free during Table Editing

MFSA 2013-110 Potential overflow in JavaScript binary search algorithms

MFSA 2013-111 Segmentation violation when replacing ordered list elements

MFSA 2013-112 Linux clipboard information disclosure though selection paste

MFSA 2013-113 Trust settings for built-in roots ignored during EV certificate validation

MFSA 2013-114 Use-after-free in synthetic mouse movement

MFSA 2013-115 GetElementIC typed array stubs can be generated outside observed typesets

MFSA 2013-116 JPEG information leak

MFSA 2013-117 Mis-issued ANSSI/DCSSI certificate

CVE-2013-5609 CVE-2013-5610 CVE-2013-5611 CVE-2013-5612 CVE-2013-5613 CVE-2013-5614 CVE-2013-5615 CVE-2013-5616 CVE-2013-5618 CVE-2013-5619 CVE-2013-6629 CVE-2013-6630 CVE-2013-6671 CVE-2013-6672 CVE-2013-6673 https://www.mozilla.org/security/announce/2013/mfsa2013-104.html https://www.mozilla.org/security/announce/2013/mfsa2013-105.html https://www.mozilla.org/security/announce/2013/mfsa2013-106.html https://www.mozilla.org/security/announce/2013/mfsa2013-107.html https://www.mozilla.org/security/announce/2013/mfsa2013-108.html https://www.mozilla.org/security/announce/2013/mfsa2013-109.html https://www.mozilla.org/security/announce/2013/mfsa2013-110.html https://www.mozilla.org/security/announce/2013/mfsa2013-111.html https://www.mozilla.org/security/announce/2013/mfsa2013-112.html https://www.mozilla.org/security/announce/2013/mfsa2013-113.html https://www.mozilla.org/security/announce/2013/mfsa2013-114.html https://www.mozilla.org/security/announce/2013/mfsa2013-115.html https://www.mozilla.org/security/announce/2013/mfsa2013-116.html https://www.mozilla.org/security/announce/2013/mfsa2013-117.html http://www.mozilla.org/security/known-vulnerabilities/ 2013-12-09 2013-12-14 samba -- multiple vulnerabilities samba34 0 samba35 0 samba36 3.6.*3.6.22 samba4 4.0.*4.0.13 samba41 4.1.*4.1.3

The Samba project reports:

These are security releases in order to address CVE-2013-4408 (DCE-RPC fragment length field is incorrectly checked) and CVE-2012-6150 (pam_winbind login without require_membership_of restrictions).

CVE-2012-6150 CVE-2013-4408 http://www.samba.org/samba/security/CVE-2012-6150 http://www.samba.org/samba/security/CVE-2013-4408 2012-06-12 2013-12-11 rails -- multiple vulnerabilities rubygem-actionmailer 3.2.16 rubygem-actionpack 3.2.16 rubygem-activemodel 3.2.16 rubygem-activerecord 3.2.16 rubygem-activeresource 3.2.16 rubygem-activesupport 3.2.16 rubygem-rails 3.2.16 rubygem-railties 3.2.16 rubygem-actionpack4 4.0.2 rubygem-activesupport4 4.0.2

Rails weblog:

Rails 3.2.16 and 4.0.2 have been released! These two releases contain important security fixes, so please upgrade as soon as possible! In order to make upgrading as smooth as possible, we've only included commits directly related to each security issue.

The security fixes in 3.2.16 are:

CVE-2013-4491

CVE-2013-6414

CVE-2013-6415

CVE-2013-6417

The security fixes in 4.0.2 are:

CVE-2013-4491

CVE-2013-6414

CVE-2013-6415

CVE-2013-6416

CVE-2013-6417

CVE-2013-4491 CVE-2013-6414 CVE-2013-6415 CVE-2013-6416 CVE-2013-6417 http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released/ 2013-12-03 2013-12-08 2014-04-23 drupal -- multiple vulnerabilities drupal6 6.29 drupal7 7.24

Drupal Security Team reports:

Multiple vulnerabilities were fixed in the supported Drupal core versions 6 and 7.

Multiple vulnerabilities due to optimistic cross-site request forgery protection (Form API validation - Drupal 6 and 7)

Multiple vulnerabilities due to weakness in pseudorandom number generation using mt_rand() (Form API, OpenID and random password generation - Drupal 6 and 7)

Code execution prevention (Files directory .htaccess for Apache - Drupal 6 and 7)

Access bypass (Security token validation - Drupal 6 and 7)

Cross-site scripting (Image module - Drupal 7)

Cross-site scripting (Color module - Drupal 7)

Open redirect (Overlay module - Drupal 7)

https://drupal.org/SA-CORE-2013-003 2013-11-20 2013-12-06 chromium -- multiple vulnerabilities chromium 31.0.1650.63

Google Chrome Releases reports:

15 security fixes in this release, including:

[307159] Medium CVE-2013-6634: Session fixation in sync related to 302 redirects. Credit to Andrey Labunets.

[314469] High CVE-2013-6635: Use-after-free in editing. Credit to cloudfuzzer.

[322959] Medium CVE-2013-6636: Address bar spoofing related to modal dialogs. Credit to Bas Venis.

[325501] CVE-2013-6637: Various fixes from internal audits, fuzzing and other initiatives.

[319722] Medium CVE-2013-6638: Buffer overflow in v8. This issue was fixed in v8 version 3.22.24.7. Credit to Jakob Kummerow of the Chromium project.

[319835] High CVE-2013-6639: Out of bounds write in v8. This issue was fixed in v8 version 3.22.24.7. Credit to Jakob Kummerow of the Chromium project.

[319860] Medium CVE-2013-6640: Out of bounds read in v8. This issue was fixed in v8 version 3.22.24.7. Credit to Jakob Kummerow of the Chromium project.

CVE-2013-6634 CVE-2013-6635 CVE-2013-6636 CVE-2013-6637 CVE-2013-6638 CVE-2013-6639 CVE-2013-6640 http://googlechromereleases.blogspot.nl/ 2013-12-04 2013-12-05 Joomla! -- Core XSS Vulnerabilities joomla2 2.5.*2.5.14 joomla3 3.0.*3.1.5

The JSST and the Joomla! Security Center report:

[20131101] Core XSS Vulnerability

Inadequate filtering leads to XSS vulnerability in com_contact.

[20131102] Core XSS Vulnerability

Inadequate filtering leads to XSS vulnerability in com_contact, com_weblinks, com_newsfeeds.

[20131103] Core XSS Vulnerability

Inadequate filtering leads to XSS vulnerability in com_contact.

http://developer.joomla.org/security/570-core-xss-20131101.html http://developer.joomla.org/security/571-core-xss-20131102.html http://developer.joomla.org/security/572-core-xss-20131103.html 2013-11-01 2013-12-04 2014-04-23 OpenTTD -- Denial of service using forcefully crashed aircrafts openttd 0.3.61.3.3

The OpenTTD Team reports:

The problem is caused by incorrectly handling the fact that the aircraft circling the corner airport will be outside of the bounds of the map. In the 'out of fuel' crash code the height of the tile under the aircraft is determined. In this case that means a tile outside of the allocated map array, which could occasionally trigger invalid reads.

CVE-2013-6411 https://security.openttd.org/en/CVE-2013-6411 http://bugs.openttd.org/task/5820 http://vcs.openttd.org/svn/changeset/26134 2013-11-28 2013-11-28 monitorix -- serious bug in the built-in HTTP server monitorix 3.3.1

Monitorix Project reports:

A serious bug in the built-in HTTP server. It was discovered that the handle_request() routine did not properly perform input sanitization which led into a number of security vulnerabilities. An unauthenticated, remote attacker could exploit this flaw to execute arbitrary commands on the remote host. All users still using older versions are advised to upgrade to this version, which resolves this issue.

http://www.monitorix.org/news.html#N331 https://github.com/mikaku/Monitorix/issues/30 2013-11-21 2013-12-01 subversion -- multiple vulnerabilities subversion 1.4.01.7.14 1.8.01.8.5

Subversion Project reports:

mod_dontdothat does not restrict requests from serf based clients

mod_dontdothat allows you to block update REPORT requests against certain paths in the repository. It expects the paths in the REPORT request to be absolute URLs. Serf based clients send relative URLs instead of absolute URLs in many cases. As a result these clients are not blocked as configured by mod_dontdothat.

mod_dav_svn assertion triggered by non-canonical URLs in autoversioning commits

When SVNAutoversioning is enabled via SVNAutoversioning on commits can be made by single HTTP requests such as MKCOL and PUT. If Subversion is built with assertions enabled any such requests that have non-canonical URLs, such as URLs with a trailing /, may trigger an assert. An assert will cause the Apache process to abort.

CVE-2013-4505 CVE-2013-4558 http://subversion.apache.org/security/CVE-2013-4505-advisory.txt http://subversion.apache.org/security/CVE-2013-4558-advisory.txt 2013-11-15 2013-11-25 ruby-gems -- Algorithmic Complexity Vulnerability ruby19-gems 1.8.27 ruby20-gems 1.8.27

Ruby Gem developers report:

The patch for CVE-2013-4363 was insufficiently verified so the combined regular expression for verifying gem version remains vulnerable following CVE-2013-4363.

RubyGems validates versions with a regular expression that is vulnerable to denial of service due to backtracking. For specially crafted RubyGems versions attackers can cause denial of service through CPU consumption.

CVE-2013-4363 2013-09-24 2013-11-24 ruby-gems -- Algorithmic Complexity Vulnerability ruby19-gems 1.8.26 ruby20-gems 1.8.26

Ruby Gem developers report:

RubyGems validates versions with a regular expression that is vulnerable to denial of service due to backtracking. For specially crafted RubyGems versions attackers can cause denial of service through CPU consumption.

CVE-2013-4287 2013-09-09 2013-11-24 ruby -- Heap Overflow in Floating Point Parsing ruby19 1.9.3.484,1 ruby20 2.0.0.353,1

Ruby developers report:

Any time a string is converted to a floating point value, a specially crafted string can cause a heap overflow. This can lead to a denial of service attack via segmentation faults and possibly arbitrary code execution. Any program that converts input of unknown origin to floating point values (especially common when accepting JSON) are vulnerable.

https://www.ruby-lang.org/en/news/2013/11/22/ruby-1-9-3-p484-is-released/ https://www.ruby-lang.org/en/news/2013/11/22/ruby-2-0-0-p353-is-released/ CVE-2013-4164 2013-11-22 2013-11-23 samba -- Private key in key.pem world readable samba4 4.0.*4.0.11 samba41 4.1.*4.1.1

The Samba project reports:

Samba 4.0.x before 4.0.11 and 4.1.x before 4.1.1, when LDAP or HTTP is provided over SSL, uses world-readable permissions for a private key, which allows local users to obtain sensitive information by reading the key file, as demonstrated by access to the local filesystem on an AD domain controller.

CVE-2013-4476 http://www.samba.org/samba/security/CVE-2013-4476 2013-06-12 2013-11-19 samba -- ACLs are not checked on opening an alternate data stream on a file or directory samba34 0 samba35 0 samba36 3.6.*3.6.20 samba4 4.0.*4.0.11 samba41 4.1.*4.1.1

The Samba project reports:

Samba versions 3.2.0 and above (all versions of 3.2.x, 3.3.x, 3.4.x, 3.5.x, 3.6.x, 4.0.x and 4.1.x) do not check the underlying file or directory ACL when opening an alternate data stream.

According to the SMB1 and SMB2+ protocols the ACL on an underlying file or directory should control what access is allowed to alternate data streams that are associated with the file or directory.

CVE-2013-4475 http://www.samba.org/samba/security/CVE-2013-4475 2013-06-12 2013-11-19 nginx -- Request line parsing vulnerability nginx 0.8.411.4.4,1 nginx-devel 0.8.411.5.7

The nginx project reports:

Ivan Fratric of the Google Security Team discovered a bug in nginx, which might allow an attacker to bypass security restrictions in certain configurations by using a specially crafted request, or might have potential other impact (CVE-2013-4547).

CVE-2013-4547 http://mailman.nginx.org/pipermail/nginx-announce/2013/000125.html 2013-11-19 2013-11-19 chromium -- multiple memory corruption issues chromium 31.0.1650.57

Google Chrome Releases reports:

[319117] [319125] Critical CVE-2013-6632: Multiple memory corruption issues. Credit to Pinkie Pie.

CVE-2013-6632 http://googlechromereleases.blogspot.nl/ 2013-11-14 2013-11-15 linux-flashplugin -- multiple vulnerabilities linux-f10-flashplugin 11.2r202.327

Adobe reports:

These updates address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.

CVE-2013-5329 CVE-2013-5330 http://www.adobe.com/support/security/bulletins/apsb13-26.html 2013-11-12 2013-11-12 chromium -- multiple vulnerabilities chromium 31.0.1650.48

Google Chrome Releases reports:

25 security fixes in this release, including:

[268565] Medium CVE-2013-6621: Use after free related to speech input elements. Credit to Khalil Zhani.

[272786] High CVE-2013-6622: Use after free related to media elements. Credit to cloudfuzzer.

[282925] High CVE-2013-6623: Out of bounds read in SVG. Credit to miaubiz.

[290566] High CVE-2013-6624: Use after free related to “id” attribute strings. Credit to Jon Butler.

[295010] High CVE-2013-6625: Use after free in DOM ranges. Credit to cloudfuzzer.

[295695] Low CVE-2013-6626: Address bar spoofing related to interstitial warnings. Credit to Chamal de Silva.

[299892] High CVE-2013-6627: Out of bounds read in HTTP parsing. Credit to skylined.

[306959] Medium CVE-2013-6628: Issue with certificates not being checked during TLS renegotiation. Credit to Antoine Delignat-Lavaud and Karthikeyan Bhargavan from Prosecco of INRIA Paris.

[315823] Medium-Critical CVE-2013-2931: Various fixes from internal audits, fuzzing and other initiatives.

[258723] Medium CVE-2013-6629: Read of uninitialized memory in libjpeg and libjpeg-turbo. Credit to Michal Zalewski of Google.

[299835] Medium CVE-2013-6630: Read of uninitialized memory in libjpeg-turbo. Credit to Michal Zalewski of Google.

[296804] High CVE-2013-6631: Use after free in libjingle. Credit to Patrik Höglund of the Chromium project.

CVE-2013-2931 CVE-2013-6621 CVE-2013-6622 CVE-2013-6623 CVE-2013-6624 CVE-2013-6625 CVE-2013-6626 CVE-2013-6627 CVE-2013-6628 CVE-2013-6629 CVE-2013-6630 CVE-2013-6631 http://googlechromereleases.blogspot.nl/ 2013-11-12 2013-11-12 OpenSSH -- Memory corruption in sshd openssh-portable 6.2.p2,16.4.p1,1 openssh-portable-base 6.2.p2,16.4.p1,1

The OpenSSH development team reports:

A memory corruption vulnerability exists in the post- authentication sshd process when an AES-GCM cipher (aes128-gcm@openssh.com or aes256-gcm@openssh.com) is selected during kex exchange.

If exploited, this vulnerability might permit code execution with the privileges of the authenticated user and may therefore allow bypassing restricted shell/command configurations.

Either upgrade to 6.4 or disable AES-GCM in the server configuration. The following sshd_config option will disable AES-GCM while leaving other ciphers active:

Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc

http://www.openssh.com/txt/gcmrekey.adv 2013-11-07 2013-11-08 2013-11-13 Quassel IRC -- SQL injection vulnerability quassel 0.9.1

Quassel IRC developers report:

SQL injection vulnerability in Quassel IRC before 0.9.1, when Qt 4.8.5 or later and PostgreSQL 8.2 or later are used, allows remote attackers to execute arbitrary SQL commands via a \ (backslash) in a message.

CVE-2013-4422 2013-10-07 2013-11-06 mozilla -- multiple vulnerabilities firefox 24.1.0,1 linux-firefox 25.0,1 linux-seamonkey 2.22 linux-thunderbird 24.1.0 seamonkey 2.22 thunderbird 24.1.0

The Mozilla Project reports:

MFSA 2013-93 Miscellaneous memory safety hazards (rv:25.0 / rv:24.1 / rv:17.0.10)

MFSA 2013-94 Spoofing addressbar though SELECT element

MFSA 2013-95 Access violation with XSLT and uninitialized data

MFSA 2013-96 Improperly initialized memory and overflows in some JavaScript functions

MFSA 2013-97 Writing to cycle collected object during image decoding

MFSA 2013-98 Use-after-free when updating offline cache

MFSA 2013-99 Security bypass of PDF.js checks using iframes

MFSA 2013-100 Miscellaneous use-after-free issues found through ASAN fuzzing

MFSA 2013-101 Memory corruption in workers

MFSA 2013-102 Use-after-free in HTML document templates

CVE-2013-1739 CVE-2013-5590 CVE-2013-5591 CVE-2013-5592 CVE-2013-5593 CVE-2013-5595 CVE-2013-5596 CVE-2013-5597 CVE-2013-5598 CVE-2013-5599 CVE-2013-5600 CVE-2013-5601 CVE-2013-5602 CVE-2013-5603 CVE-2013-5604 https://www.mozilla.org/security/announce/2013/mfsa2013-93.html https://www.mozilla.org/security/announce/2013/mfsa2013-94.html https://www.mozilla.org/security/announce/2013/mfsa2013-95.html https://www.mozilla.org/security/announce/2013/mfsa2013-96.html https://www.mozilla.org/security/announce/2013/mfsa2013-97.html https://www.mozilla.org/security/announce/2013/mfsa2013-98.html https://www.mozilla.org/security/announce/2013/mfsa2013-99.html https://www.mozilla.org/security/announce/2013/mfsa2013-100.html https://www.mozilla.org/security/announce/2013/mfsa2013-101.html https://www.mozilla.org/security/announce/2013/mfsa2013-102.html http://www.mozilla.org/security/known-vulnerabilities/ 2013-10-29 2013-10-30 2013-10-31 mod_pagespeed -- critical cross-site scripting (XSS) vulnerability mod_pagespeed 1.2.24.2,1

mod_pagespeed developers report:

Various versions of mod_pagespeed are subject to critical cross-site scripting (XSS) vulnerability, CVE-2013-6111. This permits a hostile third party to execute JavaScript in users' browsers in context of the domain running mod_pagespeed, which could permit theft of users' cookies or data on the site.

CVE-2013-6111 2013-10-04 2013-10-28 gnutls -- denial of service gnutls3 3.1.16

Salvatore Bonaccorso reports:

This vulnerability affects the DANE library of gnutls 3.1.x and gnutls 3.2.x. A server that returns more 4 DANE entries could corrupt the memory of a requesting client.

CVE-2013-4466 http://www.gnutls.org/security.html#GNUTLS-SA-2013-3 2013-10-25 2013-10-25 2013-11-01 xorg-server -- use-after-free xorg-server 1.7.01.7.7_11 1.12.01.12.4_4

Alan Coopersmith reports:

Pedro Ribeiro (pedrib at gmail.com) reported an issue to the X.Org security team in which an authenticated X client can cause an X server to use memory after it was freed, potentially leading to crash and/or memory corruption.

CVE-2013-4396 http://lists.x.org/archives/xorg-announce/2013-October/002332.html 2013-10-08 2013-10-24 pycrypto -- PRNG reseed race condition py26-pycrypto 2.6.1 py27-pycrypto 2.6.1 py31-pycrypto 2.6.1 py32-pycrypto 2.6.1 py33-pycrypto 2.6.1

Dwayne Litzenberger reports:

In PyCrypto before v2.6.1, the Crypto.Random pseudo-random number generator (PRNG) exhibits a race condition that may cause it to generate the same 'random' output in multiple processes that are forked from each other. Depending on the application, this could reveal sensitive information or cryptographic keys to remote attackers.

CVE-2013-1445 http://lists.dlitz.net/pipermail/pycrypto/2013q4/000702.html 2013-10-17 2013-10-19 2014-04-30 wordpress -- multiple vulnerabilities zh-wordpress-zh_CN 3.6.1 zh-wordpress-zh_TW 3.6.1 de-wordpress 3.6.1 ja-wordpress 3.6.1 ru-wordpress 3.6.1 wordpress 3.6.1

The wordpress development team reports:

Block unsafe PHP unserialization that could occur in limited situations and setups, which can lead to remote code execution.

Prevent a user with an Author role, using a specially crafted request, from being able to create a post "written by" another user.

Fix insufficient input validation that could result in redirecting or leading a user to another website.

Additionally, we've adjusted security restrictions around file uploads to mitigate the potential for cross-site scripting.

CVE-2013-4338 CVE-2013-4339 CVE-2013-4340 CVE-2013-5738 CVE-2013-5739 http://wordpress.org/news/2013/09/wordpress-3-6-1/ 2013-09-11 2013-10-19 2014-04-30 node.js -- DoS Vulnerability node 0.10.21 node-devel 0.11.7

node.js developers report

This release contains a security fix for the http server implementation, please upgrade as soon as possible.

http://blog.nodejs.org/2013/10/18/node-v0-10-21-stable/ 2013-10-19 2013-10-19 bugzilla -- multiple vulnerabilities bugzilla 4.0.04.0.11 bugzilla40 4.0.04.0.11 bugzilla42 4.2.04.2.7 bugzilla44 4.44.4.1

A Bugzilla Security Advisory reports:

Cross-Site Request Forgery

When a user submits changes to a bug right after another user did, a midair collision page is displayed to inform the user about changes recently made. This page contains a token which can be used to validate the changes if the user decides to submit his changes anyway. A regression in Bugzilla 4.4 caused this token to be recreated if a crafted URL was given, even when no midair collision page was going to be displayed, allowing an attacker to bypass the token check and abuse a user to commit changes on his behalf.

Cross-Site Request Forgery

When an attachment is edited, a token is generated to validate changes made by the user. Using a crafted URL, an attacker could force the token to be recreated, allowing him to bypass the token check and abuse a user to commit changes on his behalf.

Cross-Site Scripting

Some parameters passed to editflagtypes.cgi were not correctly filtered in the HTML page, which could lead to XSS.

Cross-Site Scripting

Due to an incomplete fix for CVE-2012-4189, some incorrectly filtered field values in tabular reports could lead to XSS.

CVE-2013-1733 https://bugzilla.mozilla.org/show_bug.cgi?id=911593 CVE-2013-1734 https://bugzilla.mozilla.org/show_bug.cgi?id=913904 CVE-2013-1742 https://bugzilla.mozilla.org/show_bug.cgi?id=924802 CVE-2013-1743 https://bugzilla.mozilla.org/show_bug.cgi?id=924932 2013-10-16 2013-10-17 2014-04-30 dropbear -- exposure of sensitive information, DoS dropbear 2012.552013.59

The Dropbear project reports:

A weakness and a vulnerability have been reported in Dropbear SSH Server, which can be exploited by malicious people to disclose certain sensitive information and cause a DoS.

62958 62993 CVE-2013-4421 CVE-2013-4434 http://secunia.com/advisories/55173 2013-05-08 2013-10-17 chromium -- multiple vulnerabilities chromium 30.0.1599.101

Google Chrome Releases reports:

5 security fixes in this release, including:

[292422] High CVE-2013-2925: Use after free in XHR. Credit to Atte Kettunen of OUSPG.

[294456] High CVE-2013-2926: Use after free in editing. Credit to cloudfuzzer.

[297478] High CVE-2013-2927: Use after free in forms. Credit to cloudfuzzer.

[305790] High CVE-2013-2928: Various fixes from internal audits, fuzzing and other initiatives.

CVE-2013-2925 CVE-2013-2926 CVE-2013-2927 CVE-2013-2928 http://googlechromereleases.blogspot.nl/ 2013-10-15 2013-10-15 mod_fcgid -- possible heap buffer overwrite ap22-mod_fcgid 2.3.9 ap24-mod_fcgid 2.3.9

Apache Project reports:

Fix possible heap buffer overwrite.

CVE-2013-4365 2013-09-29 2013-10-10 gnupg -- possible infinite recursion in the compressed packet parser gnupg 1.4.15 2.0.02.0.22

Werner Koch reports:

Special crafted input data may be used to cause a denial of service against GPG (GnuPG's OpenPGP part) and some other OpenPGP implementations. All systems using GPG to process incoming data are affected..

CVE-2013-4402 2013-10-05 2013-10-05 xinetd -- ignores user and group directives for TCPMUX services xinetd 2.3.15_1

xinetd would execute configured TCPMUX services without dropping privilege to match the service configuration allowing the service to run with same privilege as the xinetd process (root).

CVE-2013-4342 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=324678 https://bugzilla.redhat.com/show_bug.cgi?id=1006100 2005-08-23 2013-10-03 polarssl -- Timing attack against protected RSA-CRT implementation polarssl 1.2.9

PolarSSL Project reports:

The researchers Cyril Arnaud and Pierre-Alain Fouque investigated the PolarSSL RSA implementation and discovered a bias in the implementation of the Montgomery multiplication that we used. For which they then show that it can be used to mount an attack on the RSA key. Although their test attack is done on a local system, there seems to be enough indication that this can properly be performed from a remote system as well.

All versions prior to PolarSSL 1.2.9 and 1.3.0 are affected if a third party can send arbitrary handshake messages to your server.

If correctly executed, this attack reveals the entire private RSA key after a large number of attack messages (> 600.000 on a local machine) are sent to show the timing differences.

CVE-2013-5915 https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2013-05 https://polarssl.org/tech-updates/releases/polarssl-1.2.9-released 2013-10-01 2013-10-02 chromium -- multiple vulnerabilities chromium 30.0.1599.66

Google Chrome Releases reports:

50 security fixes in this release, including:

[223962][270758][271161][284785][284786] Medium CVE-2013-2906: Races in Web Audio. Credit to Atte Kettunen of OUSPG.

[260667] Medium CVE-2013-2907: Out of bounds read in Window.prototype object. Credit to Boris Zbarsky.

[265221] Medium CVE-2013-2908: Address bar spoofing related to the “204 No Content” status code. Credit to Chamal de Silva.

[265838][279277] High CVE-2013-2909: Use after free in inline-block rendering. Credit to Atte Kettunen of OUSPG.

[269753] Medium CVE-2013-2910: Use-after-free in Web Audio. Credit to Byoungyoung Lee of Georgia Tech Information Security Center (GTISC).

[271939] High CVE-2013-2911: Use-after-free in XSLT. Credit to Atte Kettunen of OUSPG.

[276368] High CVE-2013-2912: Use-after-free in PPAPI. Credit to Chamal de Silva and 41.w4r10r(at)garage4hackers.com.

[278908] High CVE-2013-2913: Use-after-free in XML document parsing. Credit to cloudfuzzer.

[279263] High CVE-2013-2914: Use after free in the Windows color chooser dialog. Credit to Khalil Zhani.

[280512] Low CVE-2013-2915: Address bar spoofing via a malformed scheme. Credit to Wander Groeneveld.

[281256] High CVE-2013-2916: Address bar spoofing related to the “204 No Content” status code. Credit to Masato Kinugawa.

[281480] Medium CVE-2013-2917: Out of bounds read in Web Audio. Credit to Byoungyoung Lee and Tielei Wang of Georgia Tech Information Security Center (GTISC).

[282088] High CVE-2013-2918: Use-after-free in DOM. Credit to Byoungyoung Lee of Georgia Tech Information Security Center (GTISC).

[282736] High CVE-2013-2919: Memory corruption in V8. Credit to Adam Haile of Concrete Data.

[285742] Medium CVE-2013-2920: Out of bounds read in URL parsing. Credit to Atte Kettunen of OUSPG.

[286414] High CVE-2013-2921: Use-after-free in resource loader. Credit to Byoungyoung Lee and Tielei Wang of Georgia Tech Information Security Center (GTISC).

[286975] High CVE-2013-2922: Use-after-free in template element. Credit to Jon Butler.

[299016] CVE-2013-2923: Various fixes from internal audits, fuzzing and other initiatives (Chrome 30).

[275803] Medium CVE-2013-2924: Use-after-free in ICU. Upstream bug here.

CVE-2013-2906 CVE-2013-2907 CVE-2013-2908 CVE-2013-2909 CVE-2013-2910 CVE-2013-2911 CVE-2013-2912 CVE-2013-2913 CVE-2013-2914 CVE-2013-2915 CVE-2013-2916 CVE-2013-2917 CVE-2013-2918 CVE-2013-2919 CVE-2013-2920 CVE-2013-2921 CVE-2013-2922 CVE-2013-2923 CVE-2013-2924 http://googlechromereleases.blogspot.nl/ 2013-10-01 2013-10-01 py-graphite-web -- Multiple vulnerabilities py26-graphite-web 0.9.50.9.11 py27-graphite-web 0.9.50.9.11 py31-graphite-web 0.9.50.9.11 py32-graphite-web 0.9.50.9.11 py33-graphite-web 0.9.50.9.11

Graphite developers report:

This release contains several security fixes for cross-site scripting (XSS) as well as a fix for a remote-execution exploit in graphite-web (CVE-2013-5903).

CVE-2013-5093 https://github.com/rapid7/metasploit-framework/pull/2260 2013-08-21 2013-09-30 2014-04-30 django -- denial-of-service via large passwords py26-django 1.51.5.4 1.41.4.8 py27-django 1.51.5.4 1.41.4.8 py26-django-devel 20130922,1 py27-django-devel 20130922,1

The Django project reports:

These releases address a denial-of-service attack against Django's authentication framework. All users of Django are encouraged to upgrade immediately.

CVE-2013-1443 https://www.djangoproject.com/weblog/2013/sep/15/security/ 2013-09-15 2013-09-22 2014-04-30 FreeBSD -- Cross-mount links between nullfs(5) mounts FreeBSD 9.19.1_7 8.48.4_4 8.38.3_11

Problem Description:

The nullfs(5) implementation of the VOP_LINK(9) VFS operation does not check whether the source and target of the link are both in the same nullfs instance. It is therefore possible to create a hardlink from a location in one nullfs instance to a file in another, as long as the underlying (source) filesystem is the same.

Impact:

If multiple nullfs views into the same filesystem are mounted in different locations, a user with read access to one of these views and write access to another will be able to create a hard link from the latter to a file in the former, even though they are, from the user's perspective, different filesystems. The user may thereby gain write access to files which are nominally on a read-only filesystem.

CVE-2013-5710 SA-13:13.nullfs 2013-09-10 2013-09-19 2016-08-09 FreeBSD -- Insufficient credential checks in network ioctl(2) FreeBSD 9.19.1_7 8.48.4_4 8.38.3_11

Problem Description:

As is commonly the case, the IPv6 and ATM network layer ioctl request handlers are written in such a way that an unrecognized request is passed on unmodified to the link layer, which will either handle it or return an error code.

Network interface drivers, however, assume that the SIOCSIFADDR, SIOCSIFBRDADDR, SIOCSIFDSTADDR and SIOCSIFNETMASK requests have been handled at the network layer, and therefore do not perform input validation or verify the caller's credentials. Typical link-layer actions for these requests may include marking the interface as "up" and resetting the underlying hardware.

Impact:

An unprivileged user with the ability to run arbitrary code can cause any network interface in the system to perform the link layer actions associated with a SIOCSIFADDR, SIOCSIFBRDADDR, SIOCSIFDSTADDR or SIOCSIFNETMASK ioctl request; or trigger a kernel panic by passing a specially crafted address structure which causes a network interface driver to dereference an invalid pointer.

Although this has not been confirmed, the possibility that an attacker may be able to execute arbitrary code in kernel context can not be ruled out.

CVE-2013-5691 SA-13:12.ifioctl 2013-09-10 2013-09-19 2016-08-09 mozilla -- multiple vulnerabilities firefox 18.0,124.0,1 17.0.9,1 linux-firefox 17.0.9,1 linux-seamonkey 2.21 linux-thunderbird 17.0.9 seamonkey 2.21 thunderbird 24.0

The Mozilla Project reports:

MFSA 2013-76 Miscellaneous memory safety hazards (rv:24.0 / rv:17.0.9)

MFSA 2013-77 Improper state in HTML5 Tree Builder with templates

MFSA 2013-78 Integer overflow in ANGLE library

MFSA 2013-79 Use-after-free in Animation Manager during stylesheet cloning

MFSA 2013-80 NativeKey continues handling key messages after widget is destroyed

MFSA 2013-81 Use-after-free with select element

MFSA 2013-82 Calling scope for new Javascript objects can lead to memory corruption

MFSA 2013-83 Mozilla Updater does not lock MAR file after signature verification

MFSA 2013-84 Same-origin bypass through symbolic links

MFSA 2013-85 Uninitialized data in IonMonkey

MFSA 2013-86 WebGL Information disclosure through OS X NVIDIA graphic drivers

MFSA 2013-87 Shared object library loading from writable location

MFSA 2013-88 compartment mismatch re-attaching XBL-backed nodes

MFSA 2013-89 Buffer overflow with multi-column, lists, and floats

MFSA 2013-90 Memory corruption involving scrolling

MFSA 2013-91 User-defined properties on DOM proxies get the wrong "this" object

MFSA 2013-92 GC hazard with default compartments and frame chain restoration

CVE-2013-1718 CVE-2013-1719 CVE-2013-1720 CVE-2013-1721 CVE-2013-1722 CVE-2013-1723 CVE-2013-1724 CVE-2013-1725 CVE-2013-1726 CVE-2013-1727 CVE-2013-1728 CVE-2013-1729 CVE-2013-1730 CVE-2013-1731 CVE-2013-1732 CVE-2013-1735 CVE-2013-1736 CVE-2013-1737 CVE-2013-1738 https://www.mozilla.org/security/announce/2013/mfsa2013-76.html https://www.mozilla.org/security/announce/2013/mfsa2013-77.html https://www.mozilla.org/security/announce/2013/mfsa2013-78.html https://www.mozilla.org/security/announce/2013/mfsa2013-79.html https://www.mozilla.org/security/announce/2013/mfsa2013-80.html https://www.mozilla.org/security/announce/2013/mfsa2013-81.html https://www.mozilla.org/security/announce/2013/mfsa2013-82.html https://www.mozilla.org/security/announce/2013/mfsa2013-83.html https://www.mozilla.org/security/announce/2013/mfsa2013-84.html https://www.mozilla.org/security/announce/2013/mfsa2013-85.html https://www.mozilla.org/security/announce/2013/mfsa2013-86.html https://www.mozilla.org/security/announce/2013/mfsa2013-87.html https://www.mozilla.org/security/announce/2013/mfsa2013-88.html https://www.mozilla.org/security/announce/2013/mfsa2013-89.html https://www.mozilla.org/security/announce/2013/mfsa2013-90.html https://www.mozilla.org/security/announce/2013/mfsa2013-91.html https://www.mozilla.org/security/announce/2013/mfsa2013-92.html http://www.mozilla.org/security/known-vulnerabilities/ 2013-08-17 2013-08-18 2013-09-19 linux-flashplugin -- multiple vulnerabilities linux-f10-flashplugin 11.2r202.310

Adobe reports:

These updates address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.

CVE-2013-3361 CVE-2013-3362 CVE-2013-3363 CVE-2013-5324 http://www.adobe.com/support/security/bulletins/apsb13-21.html 2013-09-10 2013-09-13 django -- multiple vulnerabilities py26-django 1.51.5.3 1.41.4.7 py27-django 1.51.5.3 1.41.4.7 py26-django-devel 20130912,1 py27-django-devel 20130912,1

The Django project reports:

These releases address a directory-traversal vulnerability in one of Django's built-in template tags. While this issue requires some fairly specific factors to be exploitable, we encourage all users of Django to upgrade promptly.

CVE-2013-4315 https://www.djangoproject.com/weblog/2013/sep/10/security-releases-issued/ 2013-09-10 2013-09-12 2014-04-30 svnserve is vulnerable to a local privilege escalation vulnerability via symlink attack. subversion 1.4.01.6.23_2 1.7.01.7.13 1.8.01.8.3

Subversion Project reports:

svnserve takes a --pid-file option which creates a file containing the process id it is running as. It does not take steps to ensure that the file it has been directed at is not a symlink. If the pid file is in a directory writeable by unprivileged users, the destination could be replaced by a symlink allowing for privilege escalation. svnserve does not create a pid file by default.

All versions are only vulnerable when the --pid-file=ARG option is used.

CVE-2013-4277 http://subversion.apache.org/security/CVE-2013-4277-advisory.txt 2013-08-30 2013-09-02 cacti -- allow remote attackers to execute arbitrary SQL commands cacti 0.8.8b

Cacti release reports:

Multiple security vulnerabilities have been fixed:

SQL injection vulnerabilities

CVE-2013-1434 CVE-2013-1435 http://www.cacti.net/release_notes_0_8_8b.php 2013-08-06 2013-08-29 asterisk -- multiple vulnerabilities asterisk11 11.*11.5.1 asterisk10 10.*10.12.3 asterisk18 1.8.*1.8.21.1

The Asterisk project reports:

Remote Crash From Late Arriving SIP ACK With SDP

Remote Crash when Invalid SDP is sent in SIP Request

CVE-2013-5641 CVE-2013-5642 http://downloads.asterisk.org/pub/security/AST-2013-004.html http://downloads.asterisk.org/pub/security/AST-2013-005.html https://www.asterisk.org/security 2013-08-27 2013-08-28 2013-08-29 chromium -- multiple vulnerabilities chromium 29.0.1547.57

Google Chrome Releases reports:

25 security fixes in this release, including:

[181617] High CVE-2013-2900: Incomplete path sanitization in file handling. Credit to Krystian Bigaj.

[254159] Low CVE-2013-2905: Information leak via overly broad permissions on shared memory files. Credit to Christian Jaeger.

[257363] High CVE-2013-2901: Integer overflow in ANGLE. Credit to Alex Chapman.

[260105] High CVE-2013-2902: Use after free in XSLT. Credit to cloudfuzzer.

[260156] High CVE-2013-2903: Use after free in media element. Credit to cloudfuzzer.

[260428] High CVE-2013-2904: Use after free in document parsing. Credit to cloudfuzzer.

[274602] CVE-2013-2887: Various fixes from internal audits, fuzzing and other initiatives (Chrome 29).

CVE-2013-2887 CVE-2013-2900 CVE-2013-2901 CVE-2013-2902 CVE-2013-2903 CVE-2013-2904 CVE-2013-2905 http://googlechromereleases.blogspot.nl/ 2013-08-20 2013-08-21 gstreamer-ffmpeg -- Multiple vulnerabilities in bundled libav gstreamer-ffmpeg 0.10.13_1

Bundled version of libav in gstreamer-ffmpeg contains a number of vulnerabilities.

CVE-2011-3892 CVE-2011-3893 CVE-2011-3895 CVE-2011-3929 CVE-2011-3936 CVE-2011-3937 CVE-2011-3940 CVE-2011-3945 CVE-2011-3947 CVE-2011-3951 CVE-2011-3952 CVE-2011-4031 CVE-2011-4351 CVE-2011-4352 CVE-2011-4353 CVE-2011-4364 CVE-2011-4579 CVE-2012-0848 CVE-2012-0850 CVE-2012-0851 CVE-2012-0852 CVE-2012-0853 CVE-2012-0858 CVE-2012-0947 CVE-2012-2772 CVE-2012-2775 CVE-2012-2777 CVE-2012-2779 CVE-2012-2783 CVE-2012-2784 CVE-2012-2786 CVE-2012-2787 CVE-2012-2788 CVE-2012-2790 CVE-2012-2791 CVE-2012-2793 CVE-2012-2794 CVE-2012-2798 CVE-2012-2800 CVE-2012-2801 CVE-2012-2803 CVE-2012-5144 http://libav.org/releases/libav-0.7.7.changelog 2013-08-20 2013-08-20 GnuPG and Libgcrypt -- side-channel attack vulnerability libgcrypt 1.5.3 linux-f10-libgcrypt 1.5.3

Werner Koch of the GNU project reports:

Noteworthy changes in version 1.5.3:

Mitigate the Yarom/Falkner flush+reload side-channel attack on RSA secret keys...

Note that Libgcrypt is used by GnuPG 2.x and thus this release fixes the above problem. The fix for GnuPG less than 2.0 can be found in the just released GnuPG 1.4.14.

CVE-2013-4242 http://eprint.iacr.org/2013/448 http://lists.gnupg.org/pipermail/gnupg-announce/2013q3/000329.html http://lists.gnupg.org/pipermail/gnupg-announce/2013q3/000330.html 2013-07-18 2013-08-17 puppet -- multiple vulnerabilities puppet 2.72.7.23 3.03.2.4

Puppet Labs reports:

By using the `resource_type` service, an attacker could cause puppet to load arbitrary Ruby files from the puppet master node's file system. While this behavior is not enabled by default, `auth.conf` settings could be modified to allow it. The exploit requires local file system access to the Puppet Master.

Puppet Module Tool (PMT) did not correctly control permissions of modules it installed, instead transferring permissions that existed when the module was built.

CVE-2013-4761 CVE-2013-4956 http://puppetlabs.com/security/cve/cve-2013-4761/ http://puppetlabs.com/security/cve/cve-2013-4956/ 2013-07-05 2013-08-16 lcms2 -- Null Pointer Dereference Denial of Service Vulnerability lcms2 2.5

Mageia security team reports:

It was discovered that Little CMS did not properly verify certain memory allocations. If a user or automated system using Little CMS were tricked into opening a specially crafted file, an attacker could cause Little CMS to crash (CVE-2013-4160).

CVE-2013-4160 http://advisories.mageia.org/MGASA-2013-0240.html https://bugs.mageia.org/show_bug.cgi?id=10816 2013-07-22 2013-08-15 2013-08-19 polarssl -- denial of service vulnerability polarssl 1.2.8

Paul Bakker reports:

A bug in the logic of the parsing of PEM encoded certificates in x509parse_crt() can result in an infinite loop, thus hogging processing power.

While parsing a Certificate message during the SSL/TLS handshake, PolarSSL extracts the presented certificates and sends them on to be parsed. As the RFC specifies that the certificates in the Certificate message are always X.509 certificates in DER format, bugs in the decoding of PEM certificates should normally not be triggerable via the SSL/TLS handshake.

Versions of PolarSSL prior to 1.1.7 in the 1.1 branch and prior to 1.2.8 in the 1.2 branch call the generic x509parse_crt() function for parsing during the handshake. x509parse_crt() is a generic functions that wraps parsing of both PEM-encoded and DER-formatted certificates. As a result it is possible to craft a Certificate message that includes a PEM encoded certificate in the Certificate message that triggers the infinite loop.

CVE-2013-4623 https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2013-03 2013-06-21 2013-08-13 2013-08-15 samba -- denial of service vulnerability samba34 0 samba35 0 samba36 3.6.*3.6.17 samba4 4.0.*4.0.8

The Samba project reports:

All current released versions of Samba are vulnerable to a denial of service on an authenticated or guest connection. A malformed packet can cause the smbd server to loop the CPU performing memory allocations and preventing any further service.

A connection to a file share, or a local account is needed to exploit this problem, either authenticated or unauthenticated if guest connections are allowed.

CVE-2013-4124 http://www.samba.org/samba/security/CVE-2013-4124 2013-08-05 2013-08-09 2013-08-09 mozilla -- multiple vulnerabilities firefox 18.0,123.0,1 17.0.8,1 linux-firefox 17.0.8,1 linux-seamonkey 2.20 linux-thunderbird 17.0.8 seamonkey 2.20 thunderbird 11.017.0.8

The Mozilla Project reports:

MFSA 2013-63 Miscellaneous memory safety hazards (rv:23.0 / rv:17.0.8)

MFSA 2013-64 Use after free mutating DOM during SetBody

MFSA 2013-65 Buffer underflow when generating CRMF requests

MFSA 2013-66 Buffer overflow in Mozilla Maintenance Service and Mozilla Updater

MFSA 2013-67 Crash during WAV audio file decoding

MFSA 2013-68 Document URI misrepresentation and masquerading

MFSA 2013-69 CRMF requests allow for code execution and XSS attacks

MFSA 2013-70 Bypass of XrayWrappers using XBL Scopes

MFSA 2013-71 Further Privilege escalation through Mozilla Updater

MFSA 2013-72 Wrong principal used for validating URI for some Javascript components

MFSA 2013-73 Same-origin bypass with web workers and XMLHttpRequest

MFSA 2013-74 Firefox full and stub installer DLL hijacking

MFSA 2013-75 Local Java applets may read contents of local file system

CVE-2013-1701 CVE-2013-1702 CVE-2013-1704 CVE-2013-1705 CVE-2013-1706 CVE-2013-1707 CVE-2013-1708 CVE-2013-1709 CVE-2013-1710 CVE-2013-1711 CVE-2013-1712 CVE-2013-1713 CVE-2013-1714 CVE-2013-1715 CVE-2013-1717 https://www.mozilla.org/security/announce/2013/mfsa2013-63.html https://www.mozilla.org/security/announce/2013/mfsa2013-64.html https://www.mozilla.org/security/announce/2013/mfsa2013-65.html https://www.mozilla.org/security/announce/2013/mfsa2013-66.html https://www.mozilla.org/security/announce/2013/mfsa2013-67.html https://www.mozilla.org/security/announce/2013/mfsa2013-68.html https://www.mozilla.org/security/announce/2013/mfsa2013-69.html https://www.mozilla.org/security/announce/2013/mfsa2013-70.html https://www.mozilla.org/security/announce/2013/mfsa2013-71.html https://www.mozilla.org/security/announce/2013/mfsa2013-72.html http://www.mozilla.org/security/known-vulnerabilities/ 2013-08-06 2013-08-08 PuTTY -- Four security holes in versions before 0.63 putty 0.63

Simon Tatham reports:

This [0.63] release fixes multiple security holes in previous versions of PuTTY, which can allow an SSH-2 server to make PuTTY overrun or underrun buffers and crash. [...]
These vulnerabilities can be triggered before host key verification, which means that you are not even safe if you trust the server you think you're connecting to, since it could be spoofed over the network and the host key check would not detect this before the attack could take place.
Additionally, when PuTTY authenticated with a user's private key, the private key or information equivalent to it was accidentally kept in PuTTY's memory for the rest of its run, where it could be retrieved by other processes reading PuTTY's memory, or written out to swap files or crash dumps. This release fixes that as well.

CVE-2013-4206 CVE-2013-4207 CVE-2013-4208 CVE-2013-4852 http://lists.tartarus.org/pipermail/putty-announce/2013/000018.html http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-modmul.html http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-bignum-division-by-zero.html http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-wiped.html http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-signature-stringlen.html 2013-07-08 2013-08-07 typo3 -- Multiple vulnerabilities in TYPO3 Core typo3 4.5.04.5.29 4.7.04.7.14 6.1.06.1.3

Typo Security Team reports:

It has been discovered that TYPO3 Core is vulnerable to Cross-Site Scripting and Remote Code Execution.

TYPO3 bundles flash files for video and audio playback. Old versions of FlowPlayer and flashmedia are susceptible to Cross-Site Scripting. No authentication is required to exploit this vulnerability.

The file upload component and the File Abstraction Layer are failing to check for denied file extensions, which allows authenticated editors (even with limited permissions) to upload php files with arbitrary code, which can then be executed in web server's context.

CVE-2011-3642 CVE-2013-1464 2013-07-30 2013-08-05 phpMyAdmin -- clickJacking protection can be bypassed phpMyAdmin 4.0.5

The phpMyAdmin development team reports:

phpMyAdmin has a number of mechanisms to avoid a clickjacking attack, however these mechanisms either work only in modern browser versions, or can be bypassed.

"We have no solution for 3.5.x, due to the proposed solution requiring JavaScript. We don't want to introduce a dependency to JavaScript in the 3.5.x family."

http://www.phpmyadmin.net/home_page/security/PMASA-2013-10.php 2013-08-04 2013-08-04 chromium -- multiple vulnerabilities chromium 28.0.1500.95

Google Chrome Releases reports:

Eleven vulnerabilities, including:

[257748] Medium CVE-2013-2881: Origin bypass in frame handling. Credit to Karthik Bhargavan.

[260106] High CVE-2013-2882: Type confusion in V8. Credit to Cloudfuzzer.

[260165] High CVE-2013-2883: Use-after-free in MutationObserver. Credit to Cloudfuzzer.

[248950] High CVE-2013-2884: Use-after-free in DOM. Credit to Ivan Fratric of Google Security Team.

[249640] [257353] High CVE-2013-2885: Use-after-free in input handling. Credit to Ivan Fratric of Google Security Team.

[261701] High CVE-2013-2886: Various fixes from internal audits, fuzzing and other initiatives.

CVE-2013-2881 CVE-2013-2882 CVE-2013-2883 CVE-2013-2884 CVE-2013-2885 CVE-2013-2886 http://www.googlechromereleases.blogspot.nl/ 2013-07-30 2013-08-03 phpMyAdmin -- multiple vulnerabilities phpMyAdmin 4.04.0.4.2 phpMyAdmin35 3.53.5.8.2

The phpMyAdmin development team reports:

XSS due to unescaped HTML Output when executing a SQL query.

Using a crafted SQL query, it was possible to produce an XSS on the SQL query form.

This vulnerability can be triggered only by someone who logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required form.

5 XSS vulnerabilities in setup, chart display, process list, and logo link.

In the setup/index.php, using a crafted # hash with a Javascript event, untrusted JS code could be executed.

In the Display chart view, a chart title containing HTML code was rendered unescaped, leading to possible JavaScript code execution via events.

A malicious user with permission to create databases or users having HTML tags in their name, could trigger an XSS vulnerability by issuing a sleep query with a long delay. In the server status monitor, the query parameters were shown unescaped.

By configuring a malicious URL for the phpMyAdmin logo link in the navigation sidebar, untrusted script code could be executed when a user clicked the logo.

The setup field for "List of trusted proxies for IP allow/deny" Ajax validation code returned the unescaped input on errors, leading to possible JavaScript execution by entering arbitrary HTML.

If a crafted version.json would be presented, an XSS could be introduced.

Due to not properly validating the version.json file, which is fetched from the phpMyAdmin.net website, could lead to an XSS attack, if a crafted version.json file would be presented.

This vulnerability can only be exploited with a combination of complicated techniques and tricking the user to visit a page.

Full path disclosure vulnerabilities.

By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed.

This path disclosure is possible on servers where the recommended setting of the PHP configuration directive display_errors is set to on, which is against the recommendations given in the PHP manual.

XSS vulnerability when a text to link transformation is used.

When the TextLinkTransformationPlugin is used to create a link to an object when displaying the contents of a table, the object name is not properly escaped, which could lead to an XSS, if the object name has a crafted value.

The stored XSS vulnerabilities can be triggered only by someone who logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required forms.

Self-XSS due to unescaped HTML output in schema export.

When calling schema_export.php with crafted parameters, it is possible to trigger an XSS.

This vulnerability can be triggered only by someone who logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required form.

SQL injection vulnerabilities, producing a privilege escalation (control user).

Due to a missing validation of parameters passed to schema_export.php and pmd_pdf.php, it was possible to inject SQL statements that would run with the privileges of the control user. This gives read and write access to the tables of the configuration storage database, and if the control user has the necessary privileges, read access to some tables of the mysql database.

These vulnerabilities can be triggered only by someone who logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required form. Moreover, a control user must have been created and configured as part of the phpMyAdmin configuration storage installation.

http://www.phpmyadmin.net/home_page/security/PMASA-2013-8.php http://www.phpmyadmin.net/home_page/security/PMASA-2013-9.php http://www.phpmyadmin.net/home_page/security/PMASA-2013-11.php http://www.phpmyadmin.net/home_page/security/PMASA-2013-12.php http://www.phpmyadmin.net/home_page/security/PMASA-2013-13.php http://www.phpmyadmin.net/home_page/security/PMASA-2013-14.php http://www.phpmyadmin.net/home_page/security/PMASA-2013-15.php http://sourceforge.net/projects/phpmyadmin/files/phpMyAdmin/3.5.8.2/phpMyAdmin-3.5.8.2-notes.html/view http://sourceforge.net/projects/phpmyadmin/files/phpMyAdmin/4.0.4.2/phpMyAdmin-4.0.4.2-notes.html/view 2013-07-28 2013-07-28 2013-07-29 wordpress -- multiple vulnerabilities wordpress 3.5.2,1 zh-wordpress-zh_CN 3.5.2 zh-wordpress-zh_TW 3.5.2 de-wordpress 3.5.2 ja-wordpress 3.5.2 ru-wordpress 3.5.2

The wordpress development team reports:

Blocking server-side request forgery attacks, which could potentially enable an attacker to gain access to a site

Disallow contributors from improperly publishing posts

An update to the SWFUpload external library to fix cross-site scripting vulnerabilities

Prevention of a denial of service attack, affecting sites using password-protected posts

An update to an external TinyMCE library to fix a cross-site scripting vulnerability

Multiple fixes for cross-site scripting

Avoid disclosing a full file path when a upload fails

CVE-2013-2199 CVE-2013-2200 CVE-2013-2201 CVE-2013-2202 CVE-2013-2203 CVE-2013-2204 CVE-2013-2205 https://wordpress.org/news/2013/06/wordpress-3-5-2/ 2013-06-21 2013-07-27 2014-04-30 bind -- denial of service vulnerability bind99 9.9.39.9.3.2 bind99-base 9.9.39.9.3.2 bind98 9.8.59.8.5.2 bind98-base 9.8.59.8.5.2 FreeBSD 9.09.1_5 8.48.4_2

ISC reports:

A specially crafted query that includes malformed rdata can cause named to terminate with an assertion failure while rejecting the malformed query.

CVE-2013-4854 SA-13:07.bind https://kb.isc.org/article/AA-01015/0 2013-07-26 2013-07-26 2016-08-09 gnupg -- side channel attack on RSA secret keys gnupg 1.4.14

A Yarom and Falkner paper reports:

Flush+Reload is a cache side-channel attack that monitors access to data in shared pages. In this paper we demonstrate how to use the attack to extract private encryption keys from GnuPG. The high resolution and low noise of the Flush+Reload attack enables a spy program to recover over 98% of the bits of the private key in a single decryption or signing round. Unlike previous attacks, the attack targets the last level L3 cache. Consequently, the spy program and the victim do not need to share the execution core of the CPU. The attack is not limited to a traditional OS and can be used in a virtualised environment, where it can attack programs executing in a different VM.

http://eprint.iacr.org/2013/448 http://lists.gnupg.org/pipermail/gnupg-announce/2013q3/000330.html 2013-07-18 2013-07-25 2013-07-26 openafs -- single-DES cell-wide key brute force vulnerability openafs 1.6.5

OpenAFS Project reports:

The small size of the DES key space permits an attacker to brute force a cell's service key and then forge traffic from any user within the cell. The key space search can be performed in under 1 day at a cost of around $100 using publicly available services.

CVE-2013-4134 http://openafs.org/pages/security/OPENAFS-SA-2013-003.txt http://openafs.org/pages/security/how-to-rekey.txt http://openafs.org/pages/security/install-rxkad-k5-1.6.txt 2013-07-24 2013-07-25 subversion -- remotely triggerable "Assertion failed" DoS vulnerability or read overflow. subversion 1.8.01.8.1 1.7.01.7.11

Subversion Project reports:

Subversion's mod_dav_svn Apache HTTPD server module will trigger an assertion on some requests made against a revision root. This can lead to a DoS. If assertions are disabled it will trigger a read overflow which may cause a SEGFAULT (or equivalent) or undefined behavior.

Commit access is required to exploit this.

CVE-2013-4131 http://subversion.apache.org/security/CVE-2013-4131-advisory.txt 2013-07-19 2013-07-24 2013-07-25 suPHP -- Privilege escalation suphp 0.7.2

suPHP developer Sebastian Marsching reports:

When the suPHP_PHPPath was set, mod_suphp would use the specified PHP executable to pretty-print PHP source files (MIME type x-httpd-php-source or application/x-httpd-php-source).

However, it would not sanitize the environment. Thus a user that was allowed to use the SetEnv directive in a .htaccess file (AllowOverride FileInfo) could make PHP load a malicious configuration file (e.g. loading malicious extensions).

As the PHP process for highlighting the source file was run with the privileges of the user Apache HTTPd was running as, a local attacker could probably execute arbitrary code with the privileges of this user.

https://lists.marsching.com/pipermail/suphp/2013-May/002552.html 2013-05-20 2013-07-22 apache24 -- several vulnerabilities apache24 2.4.6

Apache HTTP SERVER PROJECT reports:

mod_dav: Sending a MERGE request against a URI handled by mod_dav_svn with the source href (sent as part of the request body as XML) pointing to a URI that is not configured for DAV will trigger a segfault.

mod_session_dbd: Make sure that dirty flag is respected when saving sessions, and ensure the session ID is changed each time the session changes. This changes the format of the updatesession SQL statement. Existing configurations must be changed.

CVE-2013-1896 CVE-2013-2249 http://www.apache.org/dist/httpd/Announcement2.4.html 2013-07-11 2013-07-20 2013-07-21 gallery -- multiple vulnerabilities gallery3 3.0.9

Red Hat Security Response Team reports:

Gallery upstream has released 3.0.9 version, correcting two security flaws:

Issue #1 - Improper stripping of URL fragments in flowplayer SWF file might lead to reply attacks (a different flaw than CVE-2013-2138).

Issue #2 - gallery3: Multiple information exposure flaws in data rest core module.

CVE-2013-2240 CVE-2013-2241 http://sourceforge.net/apps/trac/gallery/ticket/2073 https://bugzilla.redhat.com/show_bug.cgi?id=981197 http://sourceforge.net/apps/trac/gallery/ticket/2074 https://bugzilla.redhat.com/show_bug.cgi?id=981198 http://galleryproject.org/gallery_3_0_9 2013-06-28 2013-07-17 PHP5 -- Heap corruption in XML parser php53 5.3.27

The PHP development team reports:

ext/xml/xml.c in PHP before 5.3.27 does not properly consider parsing depth, which allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a crafted document that is processed by the xml_parse_into_struct function.

CVE-2013-4113 https://bugs.php.net/bug.php?id=65236 2013-07-10 2013-07-16 PHP5 -- Integer overflow in Calendar module php5 5.4.05.4.16 php53 5.3.26

The PHP development team reports:

Integer overflow in the SdnToJewish function in jewish.c in the Calendar component in PHP before 5.3.26 and 5.4.x before 5.4.16 allows context-dependent attackers to cause a denial of service (application hang) via a large argument to the jdtojewish function.

CVE-2013-4635 https://bugs.php.net/bug.php?id=64895 2013-05-22 2013-07-16 linux-flashplugin -- multiple vulnerabilities linux-f10-flashplugin 11.2r202.297

Adobe reports:

These updates address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.

CVE-2013-3344 CVE-2013-3345 CVE-2013-3347 http://www.adobe.com/support/security/bulletins/apsb13-17.html 2013-07-09 2013-07-15 2013-07-18 squid -- denial of service squid 3.23.2.12 3.33.3.8

Squid project reports:

Due to incorrect data validation Squid is vulnerable to a denial of service attack when processing specially crafted HTTP requests

This problem allows any client who can generate HTTP requests to perform a denial of service attack on the Squid service.

CVE-2013-4123 http://www.squid-cache.org/Advisories/SQUID-2013_3.txt 2013-07-13 2013-07-15 libzrtpcpp -- multiple security vulnerabilities libzrtpcpp 2.3.4

Mark Dowd reports:

Vulnerability 1. Remote Heap Overflow: If an attacker sends a packet larger than 1024 bytes that gets stored temporarily (which occurs many times - such as when sending a ZRTP Hello packet), a heap overflow will occur, leading to potential arbitrary code execution on the vulnerable host.

Vulnerability 2. Multiple Stack Overflows: ZRTPCPP contains multiple stack overflows that arise when preparing a response to a client's ZRTP Hello packet.

Vulnerability 3. Information Leaking / Out of Bounds Reads: The ZRTPCPP library performs very little validation regarding the expected size of a packet versus the actual amount of data received. This can lead to both information leaking and out of bounds data reads (usually resulting in a crash). Information leaking can be performed for example by sending a malformed ZRTP Ping packet.

CVE-2013-2221 CVE-2013-2222 CVE-2013-2223 2013-06-27 2013-07-11 ruby -- Hostname check bypassing vulnerability in SSL client ruby19 1.9.3.448,1 ruby18 1.8.7.374,1

Ruby Developers report:

Ruby's SSL client implements hostname identity check but it does not properly handle hostnames in the certificate that contain null bytes.

CVE-2013-4073 http://www.ruby-lang.org/en/news/2013/06/27/hostname-check-bypassing-vulnerability-in-openssl-client-cve-2013-4073/ 2013-06-27 2013-07-11 2013-09-24 otrs -- Sql Injection + Xss Issue otrs 3.2.9

The OTRS Project reports:

An attacker with a valid agent login could manipulate URLs leading to SQL injection. An attacker with a valid agent login could manipulate URLs in the ITSM ConfigItem search, leading to a JavaScript code injection (XSS) problem.

CVE-2013-4717 CVE-2013-4718 http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-05/ 2013-07-09 2013-07-11 chromium -- multiple vulnerabilities chromium 28.0.1500.71

Google Chrome Releases reports:

A special reward for Andrey Labunets for his combination of CVE-2013-2879 and CVE-2013-2868 along with some (since fixed) server-side bugs.

[252216] Low CVE-2013-2867: Block pop-unders in various scenarios.

[252062] High CVE-2013-2879: Confusion setting up sign-in and sync. Credit to Andrey Labunets.

[252034] Medium CVE-2013-2868: Incorrect sync of NPAPI extension component. Credit to Andrey Labunets.

[245153] Medium CVE-2013-2869: Out-of-bounds read in JPEG2000 handling. Credit to Felix Groebert of Google Security Team.

[244746] [242762] Critical CVE-2013-2870: Use-after-free with network sockets. Credit to Collin Payne.

[244260] Medium CVE-2013-2853: Man-in-the-middle attack against HTTP in SSL. Credit to Antoine Delignat-Lavaud and Karthikeyan Bhargavan from Prosecco at INRIA Paris.

[243991] [243818] High CVE-2013-2871: Use-after-free in input handling. Credit to miaubiz.

[Mac only] [242702] Low CVE-2013-2872: Possible lack of entropy in renderers. Credit to Eric Rescorla.

[241139] High CVE-2013-2873: Use-after-free in resource loading. Credit to miaubiz.

[233848] Medium CVE-2013-2875: Out-of-bounds-read in SVG. Credit to miaubiz.

[229504] Medium CVE-2013-2876: Extensions permissions confusion with interstitials. Credit to Dev Akhawe.

[229019] Low CVE-2013-2877: Out-of-bounds read in XML parsing. Credit to Aki Helin of OUSPG.

[196636] None: Remove the "viewsource" attribute on iframes. Credit to Collin Jackson.

[177197] Medium CVE-2013-2878: Out-of-bounds read in text handling. Credit to Atte Kettunen of OUSPG.

CVE-2013-2853 CVE-2013-2867 CVE-2013-2868 CVE-2013-2869 CVE-2013-2870 CVE-2013-2871 CVE-2013-2872 CVE-2013-2873 CVE-2013-2875 CVE-2013-2876 CVE-2013-2877 CVE-2013-2878 CVE-2013-2879 http://googlechromereleases.blogspot.nl/ 2013-07-09 2013-07-10 apache22 -- several vulnerabilities apache22 2.2.02.2.25 apache22-event-mpm 2.2.02.2.25 apache22-itk-mpm 2.2.02.2.25 apache22-peruser-mpm 2.2.02.2.25 apache22-worker-mpm 2.2.02.2.25

Apache HTTP SERVER PROJECT reports:

The mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator.

mod_dav: Sending a MERGE request against a URI handled by mod_dav_svn with the source href (sent as part of the request body as XML) pointing to a URI that is not configured for DAV will trigger a segfault.

CVE-2013-1862 CVE-2013-1896 2013-06-21 2013-07-05 2013-07-10 phpMyAdmin -- Global variable scope injection phpMyAdmin 4.04.0.4.1

The phpMyAdmin development team reports:

The import.php script was vulnerable to GLOBALS variable injection. Therefore, an attacker could manipulate any configuration parameter.

This vulnerability can be triggered only by someone who logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required form.

http://www.phpmyadmin.net/home_page/security/PMASA-2013-7.php CVE-2013-4729 2013-06-30 2013-06-30 apache-xml-security-c -- heap overflow during XPointer evaluation apache-xml-security-c 1.7.2

The Apache Software Foundation reports:

The attempted fix to address CVE-2013-2154 introduced the possibility of a heap overflow, possibly leading to arbitrary code execution, in the processing of malformed XPointer expressions in the XML Signature Reference processing code.

CVE-2013-2210 http://santuario.apache.org/secadv.data/CVE-2013-2210.txt 2013-06-27 2013-06-28 mozilla -- multiple vulnerabilities firefox 18.0,122.0,1 17.0.7,1 linux-firefox 17.0.7,1 linux-seamonkey 2.19 linux-thunderbird 17.0.7 seamonkey 2.19 thunderbird 11.017.0.7

The Mozilla Project reports:

Miscellaneous memory safety hazards (rv:22.0 / rv:17.0.7)

Title: Memory corruption found using Address Sanitizer

Privileged content access and execution via XBL

Arbitrary code execution within Profiler

Execution of unmapped memory through onreadystatechange

Data in the body of XHR HEAD requests leads to CSRF attacks

SVG filters can lead to information disclosure

PreserveWrapper has inconsistent behavior

Sandbox restrictions not applied to nested frame elements

X-Frame-Options ignored when using server push with multi-part responses

XrayWrappers can be bypassed to run user defined methods in a privileged context

getUserMedia permission dialog incorrectly displays location

Homograph domain spoofing in .com, .net and .name

Inaccessible updater can lead to local privilege escalation

CVE-2013-1682 CVE-2013-1683 CVE-2013-1684 CVE-2013-1685 CVE-2013-1686 CVE-2013-1687 CVE-2013-1688 CVE-2013-1690 CVE-2013-1692 CVE-2013-1693 CVE-2013-1694 CVE-2013-1695 CVE-2013-1696 CVE-2013-1697 CVE-2013-1698 CVE-2013-1699 CVE-2013-1700 http://www.mozilla.org/security/announce/2013/mfsa2013-49.html http://www.mozilla.org/security/announce/2013/mfsa2013-50.html http://www.mozilla.org/security/announce/2013/mfsa2013-51.html http://www.mozilla.org/security/announce/2013/mfsa2013-52.html http://www.mozilla.org/security/announce/2013/mfsa2013-53.html http://www.mozilla.org/security/announce/2013/mfsa2013-54.html http://www.mozilla.org/security/announce/2013/mfsa2013-55.html http://www.mozilla.org/security/announce/2013/mfsa2013-56.html http://www.mozilla.org/security/announce/2013/mfsa2013-57.html http://www.mozilla.org/security/announce/2013/mfsa2013-58.html http://www.mozilla.org/security/announce/2013/mfsa2013-59.html http://www.mozilla.org/security/announce/2013/mfsa2013-60.html http://www.mozilla.org/security/announce/2013/mfsa2013-61.html http://www.mozilla.org/security/announce/2013/mfsa2013-62.html http://www.mozilla.org/security/known-vulnerabilities/ 2013-06-25 2013-06-26 cURL library -- heap corruption in curl_easy_unescape curl 7.77.24.0_4

cURL developers report:

libcurl is vulnerable to a case of bad checking of the input data which may lead to heap corruption.

The function curl_easy_unescape() decodes URL-encoded strings to raw binary data. URL-encoded octets are represented with %HH combinations where HH is a two-digit hexadecimal number. The decoded string is written to an allocated memory area that the function returns to the caller.

The function takes a source string and a length parameter, and if the length provided is 0 the function will instead use strlen() to figure out how much data to parse.

The "%HH" parser wrongly only considered the case where a zero byte would terminate the input. If a length-limited buffer was passed in which ended with a '%' character which was followed by two hexadecimal digits outside of the buffer libcurl was allowed to parse alas without a terminating zero, libcurl would still parse that sequence as well. The counter for remaining data to handle would then be decreased too much and wrap to become a very large integer and the copying would go on too long and the destination buffer that is allocated on the heap would get overwritten.

We consider it unlikely that programs allow user-provided strings unfiltered into this function. Also, only the not zero-terminated input string use case is affected by this flaw. Exploiting this flaw for gain is probably possible for specific circumstances but we consider the general risk for this to be low.

The curl command line tool is not affected by this problem as it doesn't use this function.

There are no known exploits available at this time.

CVE-2013-2174 http://curl.haxx.se/docs/adv_20130622.html 2013-06-22 2013-06-23 2013-07-01 puppet -- Unauthenticated Remote Code Execution Vulnerability puppet 2.72.7.22 3.03.2.2

Puppet Developers report:

When making REST api calls, the puppet master takes YAML from an untrusted client, deserializes it, and then calls methods on the resulting object. A YAML payload can be crafted to cause the deserialization to construct an instance of any class available in the ruby process, which allows an attacker to execute code contained in the payload.

CVE-2013-3567 2013-06-13 2013-06-22 2013-08-01 otrs -- information disclosure otrs 3.2.8

The OTRS Project reports:

An attacker with a valid agent login could manipulate URLs in the ticket watch mechanism to see contents of tickets they are not permitted to see.

CVE-2013-4088 http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-04/ 2013-06-18 2013-06-19 FreeBSD -- Privilege escalation via mmap FreeBSD 9.09.1_4

Due to insufficient permission checks in the virtual memory system, a tracing process (such as a debugger) may be able to modify portions of the traced process's address space to which the traced process itself does not have write access.

CVE-2013-2171 SA-13:06.mmap 2013-06-18 2013-06-18 2016-08-09 apache-xml-security-c -- heap overflow apache-xml-security-c 1.7.1

The Apache Software Foundation reports:

A heap overflow exists in the processing of the PrefixList attribute optionally used in conjunction with Exclusive Canonicalization, potentially allowing arbitary code execution. If verification of the signature occurs prior to actual evaluation of a signing key, this could be exploited by an unauthenticated attacker.

CVE-2013-2156 http://santuario.apache.org/secadv.data/CVE-2013-2156.txt 2013-06-18 2013-06-18 tor -- guard discovery tor-devel 0.2.4.13.a_1

The Tor Project reports:

Disable middle relay queue overfill detection code due to possible guard discovery attack

https://trac.torproject.org/projects/tor/ticket/9072 2013-06-15 2013-06-16 dbus -- local dos dbus 1.6.12

Simon McVittie reports:

Alexandru Cornea discovered a vulnerability in libdbus caused by an implementation bug in _dbus_printf_string_upper_bound(). This vulnerability can be exploited by a local user to crash system services that use libdbus, causing denial of service. It is platform-specific: x86-64 Linux is known to be affected.

CVE-2013-2168 http://lists.freedesktop.org/archives/dbus/2013-June/015696.html 2013-06-13 2013-06-13 linux-flashplugin -- multiple vulnerabilities linux-f10-flashplugin 11.2r202.291

Adobe reports:

These updates address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.

CVE-2013-3343 2013-06-11 2013-06-14 2013-06-18 owncloud -- Multiple security vulnerabilities owncloud 5.0.7

The ownCloud development team reports:

oC-SA-2013-019 / CVE-2013-2045: Multiple SQL Injections. Credit to Mateusz Goik (aliantsoft.pl).

oC-SA-2013-020 / CVE-2013-[2039,2085]: Multiple directory traversals. Credit to Mateusz Goik (aliantsoft.pl).

oC-SQ-2013-021 / CVE-2013-[2040-2042]: Multiple XSS vulnerabilities. Credit to Mateusz Goik (aliantsoft.pl) and Kacper R. (http://devilteam.pl).

oC-SA-2013-022 / CVE-2013-2044: Open redirector. Credit to Mateusz Goik (aliantsoft.pl).

oC-SA-2013-023 / CVE-2013-2047: Password autocompletion.

oC-SA-2013-024 / CVE-2013-2043: Privilege escalation in the calendar application. Credit to Mateusz Goik (aliantsoft.pl).

oC-SA-2013-025 / CVE-2013-2048: Privilege escalation and CSRF in the API.

oC-SA-2013-026 / CVE-2013-2089: Incomplete blacklist vulnerability.

oC-SA-2013-027 / CVE-2013-2086: CSRF token leakage.

oC-SA-2013-028 / CVE-2013-[2149-2150]: Multiple XSS vulnerabilities.

http://owncloud.org/about/security/advisories/oC-SA-2013-019/ http://owncloud.org/about/security/advisories/oC-SA-2013-020/ http://owncloud.org/about/security/advisories/oC-SA-2013-021/ http://owncloud.org/about/security/advisories/oC-SA-2013-022/ http://owncloud.org/about/security/advisories/oC-SA-2013-023/ http://owncloud.org/about/security/advisories/oC-SA-2013-024/ http://owncloud.org/about/security/advisories/oC-SA-2013-025/ http://owncloud.org/about/security/advisories/oC-SA-2013-026/ http://owncloud.org/about/security/advisories/oC-SA-2013-027/ http://owncloud.org/about/security/advisories/oC-SA-2013-028/ CVE-2013-2039 CVE-2013-2040 CVE-2013-2041 CVE-2013-2042 CVE-2013-2043 CVE-2013-2044 CVE-2013-2045 CVE-2013-2047 CVE-2013-2048 CVE-2013-2085 CVE-2013-2086 CVE-2013-2089 CVE-2013-2149 CVE-2013-2150 2013-05-14 2013-06-11 php5 -- Heap based buffer overflow in quoted_printable_encode php5 5.4.16 php53 5.3.26

The PHP development team reports:

A Heap-based buffer overflow flaw was found in the php quoted_printable_encode() function. A remote attacker could use this flaw to cause php to crash or execute arbirary code with the permission of the user running php

CVE-2013-2110 https://bugzilla.redhat.com/show_bug.cgi?id=964969 2013-06-06 2013-06-07 dns/bind9* -- A recursive resolver can be crashed by a query for a malformed zone bind99 9.9.39.9.3.1 bind99-base 9.9.39.9.3.1 bind98 9.8.59.8.5.1 bind98-base 9.8.59.8.5.1 bind96 9.6.3.1.ESV.R99.6.3.2.ESV.R9 bind96-base 9.6.3.1.ESV.R99.6.3.2.ESV.R9

ISC reports:

A bug has been discovered in the most recent releases of BIND 9 which has the potential for deliberate exploitation as a denial-of-service attack. By sending a recursive resolver a query for a record in a specially malformed zone, an attacker can cause BIND 9 to exit with a fatal "RUNTIME_CHECK" error in resolver.c.

CVE-2013-3919 2013-06-04 2013-06-06 2013-06-07 phpMyAdmin -- XSS due to unescaped HTML output in Create View page phpMyAdmin 4.04.0.3

The phpMyAdmin development team reports:

When creating a view with a crafted name and an incorrect CREATE statement, it is possible to trigger an XSS.

This vulnerability can be triggered only by someone who logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required form.

http://www.phpmyadmin.net/home_page/security/PMASA-2013-6.php CVE-2013-3742 2013-06-05 2013-06-05 telepathy-gabble -- TLS verification bypass telepathy-gabble 0.16.6

Simon McVittie reports:

This release fixes a man-in-the-middle attack.

If you use an unencrypted connection to a "legacy Jabber" (pre-XMPP) server, this version of Gabble will not connect until you make one of these configuration changes:

. upgrade the server software to something that supports XMPP 1.0; or

. use an encrypted "old SSL" connection, typically on port 5223 (old-ssl); or

. turn off "Encryption required (TLS/SSL)" (require-encryption).

CVE-2013-1431 http://lists.freedesktop.org/archives/telepathy/2013-May/006449.html 2013-05-27 2013-06-05 chromium -- multiple vulnerabilities chromium 27.0.1453.110

Google Chrome Releases reports:

[242322] Medium CVE-2013-2855: Memory corruption in dev tools API. Credit to "daniel.zulla".

[242224] High CVE-2013-2856: Use-after-free in input handling. Credit to miaubiz.

[240124] High CVE-2013-2857: Use-after-free in image handling. Credit to miaubiz.

[239897] High CVE-2013-2858: Use-after-free in HTML5 Audio. Credit to "cdel921".

[237022] High CVE-2013-2859: Cross-origin namespace pollution. to "bobbyholley".

[225546] High CVE-2013-2860: Use-after-free with workers accessing database APIs. Credit to Collin Payne.

[209604] High CVE-2013-2861: Use-after-free with SVG. Credit to miaubiz.

[161077] High CVE-2013-2862: Memory corruption in Skia GPU handling. Credit to Atte Kettunen of OUSPG.

[232633] Critical CVE-2013-2863: Memory corruption in SSL socket handling. Credit to Sebastian Marchand of the Chromium development community.

[239134] High CVE-2013-2864: Bad free in PDF viewer. Credit to Mateusz Jurczyk, with contributions by Gynvael Coldwind, both from Google Security Team.

[246389] High CVE-2013-2865: Various fixes from internal audits, fuzzing and other initiatives.

CVE-2013-2855 CVE-2013-2856 CVE-2013-2857 CVE-2013-2858 CVE-2013-2859 CVE-2013-2860 CVE-2013-2861 CVE-2013-2862 CVE-2013-2863 CVE-2013-2864 CVE-2013-2865 http://googlechromereleases.blogspot.nl/ 2013-06-04 2013-06-04 xorg -- protocol handling issues in X Window System client libraries libX11 1.6.0 libXext 1.3.2 libXfixes 5.0.1 libXi 1.7_1 libXinerama 1.1.3 libXp 1.0.2 libXrandr 1.4.1 libXrender 0.9.7_1 libXres 1.0.7 libXtst 1.2.2 libXv 1.0.8 libXvMC 1.0.7_1 libXxf86dga 1.1.4 libdmx 1.1.3 libxcb 1.9.1 libGL 7.6.1_4 7.8.08.0.5_4 xf86-video-openchrome 0.3.3 libFS 1.0.5 libXxf86vm 1.1.3 libXt 1.1.4 libXcursor 1.1.14

freedesktop.org reports:

Ilja van Sprundel, a security researcher with IOActive, has discovered a large number of issues in the way various X client libraries handle the responses they receive from servers, and has worked with X.Org's security team to analyze, confirm, and fix these issues.

Most of these issues stem from the client libraries trusting the server to send correct protocol data, and not verifying that the values will not overflow or cause other damage. Most of the time X clients & servers are run by the same user, with the server more privileged from the clients, so this is not a problem, but there are scenarios in which a privileged client can be connected to an unprivileged server, for instance, connecting a setuid X client (such as a screen lock program) to a virtual X server (such as Xvfb or Xephyr) which the user has modified to return invalid data, potentially allowing the user to escalate their privileges.

The vulnerabilities include:

Integer overflows calculating memory needs for replies.

Sign extension issues calculating memory needs for replies.

Buffer overflows due to not validating length or offset values in replies.

Integer overflows parsing user-specified files.

Unbounded recursion parsing user-specified files.

Memory corruption due to unchecked return values.

CVE-2013-1981 CVE-2013-1982 CVE-2013-1983 CVE-2013-1984 CVE-2013-1985 CVE-2013-1986 CVE-2013-1987 CVE-2013-1988 CVE-2013-1989 CVE-2013-1990 CVE-2013-1991 CVE-2013-1992 CVE-2013-1993 CVE-2013-1994 CVE-2013-1995 CVE-2013-1996 CVE-2013-1997 CVE-2013-1998 CVE-2013-1999 CVE-2013-2000 CVE-2013-2001 CVE-2013-2002 CVE-2013-2003 CVE-2013-2004 CVE-2013-2005 CVE-2013-2062 CVE-2013-2063 CVE-2013-2064 CVE-2013-2066 2013-05-23 2013-06-04 krb5 -- UDP ping-pong vulnerability in the kpasswd (password changing) service. [CVE-2002-2443] krb5 1.11.2

No advisory has been released yet.

schpw.c in the kpasswd service in kadmind in MIT Kerberos 5 (aka krb5) before 1.11.3 does not properly validate UDP packets before sending responses, which allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged packet that triggers a communication loop, as demonstrated by krb_pingpong.nasl, a related issue to CVE-1999-0103. [CVE-2002-2443].

CVE-2002-2443 http://web.mit.edu/kerberos/www/krb5-1.11/ 2013-05-10 2013-06-03 net/openafs -- buffer overflow openafs 1.6.2.*

Nickolai Zeldovich reports:

An attacker with the ability to manipulate AFS directory ACLs may crash the fileserver hosting that volume. In addition, once a corrupt ACL is placed on a fileserver, its existence may crash client utilities manipulating ACLs on that server.

http://www.openafs.org/pages/security/OPENAFS-SA-2013-001.txt CVE-2013-1794 2013-02-27 2013-06-03 www/mod_security -- NULL pointer dereference DoS mod_security 2.7.3

SecurityFocus reports:

When ModSecurity receives a request body with a size bigger than the value set by the "SecRequestBodyInMemoryLimit" and with a "Content-Type" that has no request body processor mapped to it, ModSecurity will systematically crash on every call to "forceRequestBodyVariable".

CVE-2013-2765 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-2765 2013-05-27 2013-06-03 passenger -- security vulnerability rubygem-passenger 4.0.5

The Phusion reports:

A denial of service and arbitrary code execution by hijacking temp files. [CVE-2013-2119]

CVE-2013-2119 http://blog.phusion.nl/2013/05/29/phusion-passenger-4-0-5-released/ 2013-05-29 2013-06-01 devel/subversion -- svnserve remotely triggerable DoS subversion 1.7.01.7.10 1.0.01.6.23

Subversion team reports:

Subversion's svnserve server process may exit when an incoming TCP connection is closed early in the connection process.

CVE-2013-2112 2013-05-31 2013-05-31 devel/subversion -- contrib hook-scripts can allow arbitrary code execution subversion 1.7.01.7.10 1.2.01.6.23

Subversion team reports:

The script contrib/hook-scripts/check-mime-type.pl does not escape argv arguments to 'svnlook' that start with a hyphen. This could be used to cause 'svnlook', and hence check-mime-type.pl, to error out.

The script contrib/hook-scripts/svn-keyword-check.pl parses filenames from the output of 'svnlook changed' and passes them to a further shell command (equivalent to the 'system()' call of the C standard library) without escaping them. This could be used to run arbitrary shell commands in the context of the user whom the pre-commit script runs as (the user who owns the repository).

CVE-2013-2088 2013-05-31 2013-05-31 devel/subversion -- fsfs repositories can be corrupted by newline characters in filenames subversion 1.7.01.7.10 1.1.01.6.23

Subversion team reports:

If a filename which contains a newline character (ASCII 0x0a) is committed to a repository using the FSFS format, the resulting revision is corrupt.

CVE-2013-1968 2013-05-31 2013-05-31 irc/bitchx -- multiple vulnerabilities BitchX 1.2.*,1

bannedit reports:

Stack-based buffer overflow in BitchX 1.1 Final allows remote IRC servers to execute arbitrary code via a long string in a MODE command, related to the p_mode variable.

Nico Golde reports:

There is a security issue in ircii-pana in bitchx' hostname command. The e_hostname function (commands.c) uses tmpnam to create a temporary file which is known to be insecure.

Chris reports:

Chris has reported a vulnerability in the Cypress script for BitchX, which can be exploited by malicious people to disclose potentially sensitive information or to compromise a vulnerable system.

The vulnerability is caused due to malicious code being present in the modules/mdop.m file. This can be exploited to disclose the content of various system files or to execute arbitrary shell commands.

Successful exploitation allows execution of arbitrary code, but requires the control of the "lsyn.webhop.net" domain.

CVE-2007-4584 CVE-2007-5839 CVE-2007-5922 2007-08-28 2013-05-31 znc -- null pointer dereference in webadmin module znc 1.0_1

No advisory has been released yet.

Fix NULL pointer dereference in webadmin.

https://github.com/znc/znc/commit/2bd410ee5570cea127233f1133ea22f25174eb28 2013-05-27 2013-05-28 socat -- FD leak socat 1.7.2.2

Gerhard Rieger reports:

Under certain circumstances an FD leak occurs and can be misused for denial of service attacks against socat running in server mode.

CVE-2013-3571 http://seclists.org/oss-sec/2013/q2/411 2013-05-26 2013-05-26 ruby -- Object taint bypassing in DL and Fiddle in Ruby ruby19 1.9.3.429,1

Ruby Developers report:

There is a vulnerability in DL and Fiddle in Ruby where tainted strings can be used by system calls regardless of the $SAFE level set in Ruby.

Native functions exposed to Ruby with DL or Fiddle do not check the taint values set on the objects passed in. This can result in tainted objects being accepted as input when a SecurityError exception should be raised.

CVE-2013-2065 http://www.ruby-lang.org/en/news/2013/05/14/taint-bypass-dl-fiddle-cve-2013-2065/ 2013-05-14 2013-05-26 couchdb -- DOM based Cross-Site Scripting via Futon UI couchdb 1.2.1,1

Jan Lehnardt reports:

Query parameters passed into the browser-based test suite are not sanitised, and can be used to load external resources. An attacker may execute JavaScript code in the browser, using the context of the remote user.

CVE-2012-5650 http://mail-archives.apache.org/mod_mbox/couchdb-user/201301.mbox/%3C2FFF2FD7-8EAF-4EBF-AFDA-5AEB6EAC853F@apache.org%3E 2012-01-14 2013-05-26 otrs -- information disclosure otrs 3.2.7

The OTRS Project reports:

An attacker with a valid agent login could manipulate URLs in the ticket split mechanism to see contents of tickets and they are not permitted to see.

CVE-2013-3551 http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-03/ 2013-05-22 2013-05-23 otrs -- XSS vulnerability otrs 3.1.8

The OTRS Project reports:

An attacker with permission to write changes, workorder items or FAQ articles could inject JavaScript code into the articles which would be executed by the browser of other users reading the article.

CVE-2013-2637 http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-02/ 2013-04-02 2013-05-23 RT -- multiple vulnerabilities rt38 3.83.8.17 rt40 4.04.0.13

Thomas Sibley reports:

We discovered a number of security vulnerabilities which affect both RT 3.8.x and RT 4.0.x. We are releasing RT versions 3.8.17 and 4.0.13 to resolve these vulnerabilities, as well as patches which apply atop all released versions of 3.8 and 4.0.

The vulnerabilities addressed by 3.8.17, 4.0.13, and the below patches include the following:

RT 4.0.0 and above are vulnerable to a limited privilege escalation leading to unauthorized modification of ticket data. The DeleteTicket right and any custom lifecycle transition rights may be bypassed by any user with ModifyTicket. This vulnerability is assigned CVE-2012-4733.

RT 3.8.0 and above include a version of bin/rt that uses semi-predictable names when creating tempfiles. This could possibly be exploited by a malicious user to overwrite files with permissions of the user running bin/rt. This vulnerability is assigned CVE-2013-3368.

RT 3.8.0 and above allow calling of arbitrary Mason components (without control of arguments) for users who can see administration pages. This could be used by a malicious user to run private components which may have negative side-effects. This vulnerability is assigned CVE-2013-3369.

RT 3.8.0 and above allow direct requests to private callback components. Though no callback components ship with RT, this could be used to exploit an extension or local callback which uses the arguments passed to it insecurely. This vulnerability is assigned CVE-2013-3370.

RT 3.8.3 and above are vulnerable to cross-site scripting (XSS) via attachment filenames. The vector is difficult to exploit due to parsing requirements. Additionally, RT 4.0.0 and above are vulnerable to XSS via maliciously-crafted "URLs" in ticket content when RT's "MakeClicky" feature is configured. Although not believed to be exploitable in the stock configuration, a patch is also included for RTIR 2.6.x to add bulletproofing. These vulnerabilities are assigned CVE-2013-3371.

RT 3.8.0 and above are vulnerable to an HTTP header injection limited to the value of the Content-Disposition header. Injection of other arbitrary response headers is not possible. Some (especially older) browsers may allow multiple Content-Disposition values which could lead to XSS. Newer browsers contain security measures to prevent this. Thank you to Dominic Hargreaves for reporting this vulnerability. This vulnerability is assigned CVE-2013-3372.

RT 3.8.0 and above are vulnerable to a MIME header injection in outgoing email generated by RT. The vectors via RT's stock templates are resolved by this patchset, but any custom email templates should be updated to ensure that values interpolated into mail headers do not contain newlines. This vulnerability is assigned CVE-2013-3373.

RT 3.8.0 and above are vulnerable to limited session re-use when using the file-based session store, Apache::Session::File. RT's default session configuration only uses Apache::Session::File for Oracle. RT instances using Oracle may be locally configured to use the database-backed Apache::Session::Oracle, in which case sessions are never re-used. The extent of session re-use is limited to information leaks of certain user preferences and caches, such as queue names available for ticket creation. Thank you to Jenny Martin for reporting the problem that lead to discovery of this vulnerability. This vulnerability is assigned CVE-2013-3374.

http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html CVE-2012-4733 CVE-2013-3368 CVE-2013-3369 CVE-2013-3370 CVE-2013-3371 CVE-2013-3372 CVE-2013-3373 CVE-2013-3374 2013-05-22 2013-05-23 chromium -- multiple vulnerabilities chromium 27.0.1453.93

Google Chrome Releases reports:

[235638] High CVE-2013-2837: Use-after-free in SVG. Credit to Slawomir Blazek.

[235311] Medium CVE-2013-2838: Out-of-bounds read in v8. Credit to Christian Holler.

[230176] High CVE-2013-2839: Bad cast in clipboard handling. Credit to Jon of MWR InfoSecurity.

[230117] High CVE-2013-2840: Use-after-free in media loader. Credit to Nils of MWR InfoSecurity.

[227350] High CVE-2013-2841: Use-after-free in Pepper resource handling. Credit to Chamal de Silva.

[226696] High CVE-2013-2842: Use-after-free in widget handling. Credit to Cyril Cattiaux.

[222000] High CVE-2013-2843: Use-after-free in speech handling. Credit to Khalil Zhani.

[196393] High CVE-2013-2844: Use-after-free in style resolution. Credit to Sachin Shinde (@cons0ul).

[188092] [179522] [222136] [188092] High CVE-2013-2845: Memory safety issues in Web Audio. Credit to Atte Kettunen of OUSPG.

[177620] High CVE-2013-2846: Use-after-free in media loader. Credit to Chamal de Silva.

[176692] High CVE-2013-2847: Use-after-free race condition with workers. Credit to Collin Payne.

[176137] Medium CVE-2013-2848: Possible data extraction with XSS Auditor. Credit to Egor Homakov.

[171392] Low CVE-2013-2849: Possible XSS with drag+drop or copy+paste. Credit to Mario Heiderich.

[241595] High CVE-2013-2836: Various fixes from internal audits, fuzzing and other initiatives.

CVE-2013-2836 CVE-2013-2837 CVE-2013-2838 CVE-2013-2839 CVE-2013-2840 CVE-2013-2841 CVE-2013-2842 CVE-2013-2843 CVE-2013-2844 CVE-2013-2845 CVE-2013-2846 CVE-2013-2847 CVE-2013-2848 CVE-2013-2849 http://googlechromereleases.blogspot.nl/search/Stable%20Updates 2013-05-21 2013-05-22 plib -- stack-based buffer overflow plib 1.8.5_4

CVE reports:

Stack-based buffer overflow in the error function in ssg/ssgParser.cxx in PLIB 1.8.5 allows remote attackers to execute arbitrary code via a crafted 3d model file that triggers a long error message, as demonstrated by a .ase file.

55839 CVE-2012-4552 http://www.openwall.com/lists/oss-security/2012/10/29/8 2012-10-09 2013-05-19 plib -- buffer overflow plib 1.8.5_4

Secunia reports:

A vulnerability has been discovered in PLIB, which can be exploited by malicious people to compromise an application using the library. The vulnerability is caused due to a boundary error within the "ulSetError()" function (src/util/ulError.cxx) when creating the error message, which can be exploited to overflow a static buffer.

Successful exploitation allows the execution of arbitrary code but requires that the attacker can e.g. control the content of an overly long error message passed to the "ulSetError()" function.

The vulnerability is confirmed in version 1.8.5. Other versions may also be affected.

Originally reported in TORCS by Andres Gomez.

CVE-2011-4620 http://openwall.com/lists/oss-security/2011/12/21/2 2011-12-21 2013-05-19 linux-flashplugin -- multiple vulnerabilities linux-f10-flashplugin 11.2r202.285

Adobe reports:

These updates address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.

CVE-2013-2728 CVE-2013-3324 CVE-2013-3325 CVE-2013-3326 CVE-2013-3327 CVE-2013-3328 CVE-2013-3329 CVE-2013-3330 CVE-2013-3331 CVE-2013-3332 CVE-2013-3333 CVE-2013-3334 CVE-2013-3335 2013-05-14 2013-05-16 mozilla -- multiple vulnerabilities firefox 18.0,121.0,1 17.0.6,1 linux-firefox 17.0.6,1 linux-seamonkey 2.17.1 linux-thunderbird 17.0.6 seamonkey 2.17.1 thunderbird 11.017.0.6

The Mozilla Project reports:

MFSA 2013-41 Miscellaneous memory safety hazards (rv:21.0 / rv:17.0.6)

MFSA 2013-42 Privileged access for content level constructor

MFSA 2013-43 File input control has access to full path

MFSA 2013-44 Local privilege escalation through Mozilla Maintenance Service

MFSA 2013-45 Mozilla Updater fails to update some Windows Registry entries

MFSA 2013-46 Use-after-free with video and onresize event

MFSA 2013-47 Uninitialized functions in DOMSVGZoomEvent

MFSA 2013-48 Memory corruption found using Address Sanitizer

CVE-2012-1942 CVE-2013-0801 CVE-2013-1669 CVE-2013-1670 CVE-2013-1671 CVE-2013-1672 CVE-2013-1674 CVE-2013-1675 CVE-2013-1676 CVE-2013-1677 CVE-2013-1678 CVE-2013-1679 CVE-2013-1680 CVE-2013-1681 http://www.mozilla.org/security/announce/2013/mfsa2013-40.html http://www.mozilla.org/security/announce/2013/mfsa2013-41.html http://www.mozilla.org/security/announce/2013/mfsa2013-42.html http://www.mozilla.org/security/announce/2013/mfsa2013-43.html http://www.mozilla.org/security/announce/2013/mfsa2013-44.html http://www.mozilla.org/security/announce/2013/mfsa2013-45.html http://www.mozilla.org/security/announce/2013/mfsa2013-46.html http://www.mozilla.org/security/announce/2013/mfsa2013-47.html http://www.mozilla.org/security/announce/2013/mfsa2013-48.html http://www.mozilla.org/security/known-vulnerabilities/ 2013-05-14 2013-05-15 2013-05-21 nginx -- multiple vulnerabilities nginx 1.2.0,11.2.8,1 1.3.0,11.4.1,1 nginx-devel 1.1.41.2.8 1.3.01.5.0

The nginx project reports:

A stack-based buffer overflow might occur in a worker process process while handling a specially crafted request, potentially resulting in arbitrary code execution. [CVE-2013-2028]

A security problem related to CVE-2013-2028 was identified, affecting some previous nginx versions if proxy_pass to untrusted upstream HTTP servers is used.

The problem may lead to a denial of service or a disclosure of a worker process memory on a specially crafted response from an upstream proxied server. [CVE-2013-2070]

CVE-2013-2028 CVE-2013-2070 http://mailman.nginx.org/pipermail/nginx-announce/2013/000114.html http://mailman.nginx.org/pipermail/nginx-announce/2013/000112.html 2013-05-07 2013-05-07 2013-05-16 strongSwan -- ECDSA signature verification issue strongswan 5.0.4

strongSwan security team reports:

If the openssl plugin is used for ECDSA signature verification an empty, zeroed or otherwise invalid signature is handled as a legitimate one. Both IKEv1 and IKEv2 are affected.

Affected are only installations that have enabled and loaded the OpenSSL crypto backend (--enable-openssl). Builds using the default crypto backends are not affected.

CVE-2013-2944 2013-04-30 2013-05-03 jenkins -- multiple vulnerabilities jenkins 1.514

Jenkins Security Advisory reports:

This advisory announces multiple security vulnerabilities that were found in Jenkins core.

SECURITY-63 / CVE-2013-2034

This creates a cross-site request forgery (CSRF) vulnerability on Jenkins master, where an anonymous attacker can trick an administrator to execute arbitrary code on Jenkins master by having him open a specifically crafted attack URL.

There's also a related vulnerability where the permission check on this ability is done imprecisely, which may affect those who are running Jenkins instances with a custom authorization strategy plugin.

SECURITY-67 / CVE-2013-2033

This creates a cross-site scripting (XSS) vulnerability, where an attacker with a valid user account on Jenkins can execute JavaScript in the browser of other users, if those users are using certain browsers.

SECURITY-69 / CVE-2013-2034

This is another CSRF vulnerability that allows an attacker to cause a deployment of binaries to Maven repositories. This vulnerability has the same CVE ID as SEUCRITY-63.

SECURITY-71 / CVE-2013-1808

This creates a cross-site scripting (XSS) vulnerability.

https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-05-02 CVE-2013-2034 CVE-2013-2033 CVE-2013-2034 CVE-2013-1808 2013-05-02 2013-05-03 FreeBSD -- NFS remote denial of service FreeBSD 8.38.3_8 9.19.1_3

Insufficient input validation in the NFS server allows an attacker to cause the underlying file system to treat a regular file as a directory.

CVE-2013-3266 SA-13:05.nfsserver 2013-04-21 2013-04-29 2016-08-09 Joomla! -- XXS and DDoS vulnerabilities joomla 2.0.*2.5.10

The JSST and the Joomla! Security Center report:

[20130405] - Core - XSS Vulnerability

Inadequate filtering leads to XSS vulnerability in Voting plugin.

[20130403] - Core - XSS Vulnerability

Inadequate filtering allows possibility of XSS exploit in some circumstances.

[20130402] - Core - Information Disclosure

Inadequate permission checking allows unauthorised user to see permission settings in some circumstances.

[20130404] - Core - XSS Vulnerability

Use of old version of Flash-based file uploader leads to XSS vulnerability.

[20130401] - Core - Privilege Escalation

Inadequate permission checking allows unauthorised user to delete private messages.

[20130406] - Core - DOS Vulnerability

Object unserialize method leads to possible denial of service vulnerability.

[20130407] - Core - XSS Vulnerability

Inadequate filtering leads to XSS vulnerability in highlighter plugin

CVE-2013-3059 CVE-2013-3058 CVE-2013-3057 http://developer.joomla.org/security/83-20130404-core-xss-vulnerability.html CVE-2013-3056 CVE-2013-3242 CVE-2013-3267 2013-04-24 2013-04-27 phpMyAdmin -- Multiple security vulnerabilities phpMyAdmin 3.53.5.8.1

The phpMyAdmin development team reports:

In some PHP versions, the preg_replace() function can be tricked into executing arbitrary PHP code on the server. This is done by passing a crafted argument as the regular expression, containing a null byte. phpMyAdmin does not correctly sanitize an argument passed to preg_replace() when using the "Replace table prefix" feature, opening the way to this vulnerability..

This vulnerability can be triggered only by someone who logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users to access the required form.

phpMyAdmin can be configured to save an export file on the web server, via its SaveDir directive. With this in place, it's possible, either via a crafted filename template or a crafted table name, to save a double extension file like foobar.php.sql. In turn, an Apache webserver on which there is no definition for the MIME type "sql" (the default) will treat this saved file as a ".php" script, leading to remote code execution.

This vulnerability can be triggered only by someone who logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users to access the required form. Moreover, the SaveDir directive is empty by default, so a default configuration is not vulnerable. The $cfg['SaveDir'] directive must be configured, and the server must be running Apache with mod_mime to be exploitable.

CVE-2013-3238 CVE-2013-3239 2013-04-24 2013-04-24 tinc -- Buffer overflow tinc 1.0.21

tinc-vpn.org reports:

Drop packets forwarded via TCP if they are too big.

CVE-2013-1428 2013-01-26 2013-04-22 phpMyAdmin -- XSS due to unescaped HTML output in GIS visualisation page phpMyAdmin 3.53.5.8

The phpMyAdmin development team reports:

When modifying a URL parameter with a crafted value it is possible to trigger an XSS.

These XSS can only be triggered when a valid database is known and when a valid cookie token is used.

CVE-2013-1937 http://www.phpmyadmin.net/home_page/security/PMASA-2013-1.php 2013-04-18 2013-04-20 roundcube -- arbitrary file disclosure vulnerability roundcube 0.8.6,1

RoundCube development team reports:

After getting reports about a possible vulnerability of Roundcube which allows an attacker to modify its users preferences in a way that he/she can then read files from the server, we now published updated packages as well as patches that fix this security issue.

CVE-2013-1904 https://secunia.com/advisories/52806/ 2013-03-27 2013-04-19 jasper -- buffer overflow jasper 1.900.1_12

Fedora reports:

JasPer fails to properly decode marker segments and other sections in malformed JPEG2000 files. Malformed inputs can cause heap buffer overflows which in turn may result in execution of attacker-controlled code.

CVE-2008-3520 CVE-2008-3522 CVE-2011-4516 CVE-2011-4517 http://www.kb.cert.org/vuls/id/887409 2011-12-09 2013-04-18 ModSecurity -- XML External Entity Processing Vulnerability mod_security 2.*2.7.3

Positive Technologies has reported a vulnerability in ModSecurity, which can be exploited by malicious people to disclose potentially sensitive information or cause a DoS (Denial Of Serice).

The vulnerability is caused due to an error when parsing external XML entities and can be exploited to e.g. disclose local files or cause excessive memory and CPU consumption.

.

CVE-2013-1915 https://secunia.com/advisories/52847/ https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-1915 https://bugs.gentoo.org/show_bug.cgi?id=464188 2013-04-02 2013-04-16 sieve-connect -- TLS hostname verification was not occurring sieve-connect 0.85

sieve-connect developer Phil Pennock reports:

sieve-connect was not actually verifying TLS certificate identities matched the expected hostname.

http://mail.globnix.net/pipermail/sieve-connect-announce/2013/000005.html 2013-04-14 2013-04-15 linux-flashplugin -- multiple vulnerabilities linux-f10-flashplugin 11.2r202.280

Adobe reports:

These updates address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.

CVE-2013-1383 CVE-2013-1384 CVE-2013-1385 CVE-2013-1386 2013-04-09 2013-04-10 rubygem-rails -- multiple vulnerabilities rubygem-rails 3.2.13 rubygem-actionpack 3.2.13 rubygem-activerecord 3.2.13 rubygem-activesupport 3.2.13

Ruby on Rails team reports:

Rails versions 3.2.13 has been released. This release contains important security fixes. It is recommended users upgrade as soon as possible.

Four vulnerabilities have been discovered and fixed:

(CVE-2013-1854) Symbol DoS vulnerability in Active Record

(CVE-2013-1855) XSS vulnerability in sanitize_css in Action Pack

(CVE-2013-1856) XML Parsing Vulnerability affecting JRuby users

(CVE-2013-1857) XSS Vulnerability in the `sanitize` helper of Ruby on Rails

CVE-2013-1854 CVE-2013-1856 CVE-2013-1856 CVE-2013-1857 http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-3-2-13-3-1-12-and-2-3-18-have-been-released/ https://groups.google.com/forum/#!topic/ruby-security-ann/o0Dsdk2WrQ0 https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/4_QHo4BqnN8 https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/KZwsQbYsOiI https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/zAAU7vGTPvI 2013-03-18 2013-04-10 NVIDIA UNIX driver -- ARGB cursor buffer overflow in "NoScanout" mode nvidia-driver 310.14310.44 195.22304.88

NVIDIA Unix security team reports:

When the NVIDIA driver for the X Window System is operated in "NoScanout" mode, and an X client installs an ARGB cursor that is larger than the expected size (64x64 or 256x256, depending on the driver version), the driver will overflow a buffer. This can cause a denial of service (e.g., an X server segmentation fault), or could be exploited to achieve arbitrary code execution. Because the X server runs as setuid root in many configurations, an attacker could potentially use this vulnerability in those configurations to gain root privileges.

CVE-2013-0131 http://nvidia.custhelp.com/app/answers/detail/a_id/3290 2013-03-27 2013-04-08 opera -- moderately severe issue opera 12.15 opera-devel 12.15 linux-opera 12.15 linux-opera-devel 12.15

Opera reports:

Fixed a moderately severe issue, as reported by Attila Suszte.

http://www.opera.com/docs/changelogs/unified/1215/ http://www.opera.com/support/kb/view/1046/ http://www.opera.com/support/kb/view/1047/ 2013-04-04 2014-04-30 Subversion -- multiple vulnerabilities subversion 1.7.01.7.9 1.0.01.6.21

Subversion team reports:

Subversion's mod_dav_svn Apache HTTPD server module will use excessive amounts of memory when a large number of properties are set or deleted on a node.

Subversion's mod_dav_svn Apache HTTPD server module will crash when a LOCK request is made against activity URLs.

Subversion's mod_dav_svn Apache HTTPD server module will crash in some circumstances when a LOCK request is made against a non-existent URL.

Subversion's mod_dav_svn Apache HTTPD server module will crash when a PROPFIND request is made against activity URLs.

Subversion's mod_dav_svn Apache HTTPD server module will crash when a log REPORT request receives a limit that is out of the allowed range.

CVE-2013-1845 CVE-2013-1846 CVE-2013-1847 CVE-2013-1849 CVE-2013-1884 2013-04-05 2013-04-05 otrs -- Information disclosure and Data manipulation otrs 3.1.14

The OTRS Project reports:

An attacker with a valid agent login could manipulate URLs in the object linking mechanism to see titles of tickets and other objects that are not obliged to be seen. Furthermore, links to objects without permission can be placed and removed.

CVE-2013-2625 http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-01/ 2013-04-02 2013-04-05 PostgreSQL -- anonymous remote access data corruption vulnerability postgresql-server 8.3.08.3.21_1 8.4.08.4.17 9.0.09.0.13 9.1.09.1.9 9.2.09.2.4

PostgreSQL project reports:

The PostgreSQL Global Development Group has released a security update to all current versions of the PostgreSQL database system, including versions 9.2.4, 9.1.9, 9.0.13, and 8.4.17. This update fixes a high-exposure security vulnerability in versions 9.0 and later. All users of the affected versions are strongly urged to apply the update *immediately*.

A major security issue (for versions 9.x only) fixed in this release, [CVE-2013-1899](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1899), makes it possible for a connection request containing a database name that begins with "-" to be crafted that can damage or destroy files within a server's data directory. Anyone with access to the port the PostgreSQL server listens on can initiate this request. This issue was discovered by Mitsumasa Kondo and Kyotaro Horiguchi of NTT Open Source Software Center.

Two lesser security fixes are also included in this release: [CVE-2013-1900](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1900), wherein random numbers generated by contrib/pgcrypto functions may be easy for another database user to guess (all versions), and [CVE-2013-1901](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1901), which mistakenly allows an unprivileged user to run commands that could interfere with in-progress backups (for versions 9.x only).

CVE-2013-1899 CVE-2013-1900 CVE-2013-1901 2013-04-04 2013-04-04 mozilla -- multiple vulnerabilities firefox 18.0,120.0,1 17.0.5,1 linux-firefox 17.0.5,1 linux-seamonkey 2.17 linux-thunderbird 17.0.5 seamonkey 2.17 thunderbird 11.017.0.5

The Mozilla Project reports:

MFSA 2013-30 Miscellaneous memory safety hazards (rv:20.0 / rv:17.0.5)

MFSA 2013-31 Out-of-bounds write in Cairo library

MFSA 2013-32 Privilege escalation through Mozilla Maintenance Service

MFSA 2013-33 World read and write access to app_tmp directory on Android

MFSA 2013-34 Privilege escalation through Mozilla Updater

MFSA 2013-35 WebGL crash with Mesa graphics driver on Linux

MFSA 2013-36 Bypass of SOW protections allows cloning of protected nodes

MFSA 2013-37 Bypass of tab-modal dialog origin disclosure

MFSA 2013-38 Cross-site scripting (XSS) using timed history navigations

MFSA 2013-39 Memory corruption while rendering grayscale PNG images

MFSA 2013-40 Out-of-bounds array read in CERT_DecodeCertPackage

CVE-2013-0788 CVE-2013-0789 CVE-2013-0790 CVE-2013-0791 CVE-2013-0792 CVE-2013-0793 CVE-2013-0794 CVE-2013-0795 CVE-2013-0796 CVE-2013-0797 CVE-2013-0798 CVE-2013-0799 CVE-2013-0800 http://www.mozilla.org/security/announce/2013/mfsa2013-30.html http://www.mozilla.org/security/announce/2013/mfsa2013-31.html http://www.mozilla.org/security/announce/2013/mfsa2013-32.html http://www.mozilla.org/security/announce/2013/mfsa2013-33.html http://www.mozilla.org/security/announce/2013/mfsa2013-34.html http://www.mozilla.org/security/announce/2013/mfsa2013-35.html http://www.mozilla.org/security/announce/2013/mfsa2013-36.html http://www.mozilla.org/security/announce/2013/mfsa2013-37.html http://www.mozilla.org/security/announce/2013/mfsa2013-38.html http://www.mozilla.org/security/announce/2013/mfsa2013-39.html http://www.mozilla.org/security/announce/2013/mfsa2013-40.html http://www.mozilla.org/security/known-vulnerabilities/ 2013-04-02 2013-04-03 2013-04-08 FreeBSD -- BIND remote denial of service FreeBSD 9.09.0_7 9.19.1_2

A flaw in a library used by BIND allows an attacker to deliberately cause excessive memory consumption by the named(8) process. This affects both recursive and authoritative servers.

CVE-2013-2266 SA-13:04.bind https://kb.isc.org/article/AA-00871 2013-04-02 2013-04-02 2016-08-09 FreeBSD -- OpenSSL multiple vulnerabilities FreeBSD 8.38.3_7 9.09.0_7 9.19.1_2

A flaw in the OpenSSL handling of OCSP response verification could be exploited to cause a denial of service attack.

OpenSSL has a weakness in the handling of CBC ciphersuites in SSL, TLS and DTLS. The weakness could reveal plaintext in a timing attack.

CVE-2013-0166 CVE-2013-0169 SA-13:03.openssl http://www.openssl.org/news/secadv_20130205.txt 2013-04-02 2013-04-02 2016-08-09 OpenVPN -- potential side-channel/timing attack when comparing HMACs openvpn 2.0.9_4 2.1.02.2.2_2 2.3.02.3.1

The OpenVPN project reports:

OpenVPN 2.3.0 and earlier running in UDP mode are subject to chosen ciphertext injection due to a non-constant-time HMAC comparison function.

https://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-f375aa67cc CVE-2013-2061 http://www.openwall.com/lists/oss-security/2013/05/06/6 https://github.com/OpenVPN/openvpn/commit/11d21349a4e7e38a025849479b36ace7c2eec2ee 2013-03-19 2013-03-31 2013-06-01 libxml2 -- cpu consumption Dos libxml2 2.8.0

Kurt Seifried reports:

libxml2 is affected by the expansion of internal entities (which can be used to consume resources) and external entities (which can cause a denial of service against other services, be used to port scan, etc.)..

CVE-2013-0338 CVE-2013-0339 http://seclists.org/oss-sec/2013/q1/391 https://security-tracker.debian.org/tracker/CVE-2013-0338 https://security-tracker.debian.org/tracker/CVE-2013-0339 2013-02-21 2013-03-29 asterisk -- multiple vulnerabilities asterisk11 11.*11.2.2 asterisk10 10.*10.12.2 asterisk18 1.8.*1.8.20.2

Asterisk project reports:

Buffer Overflow Exploit Through SIP SDP Header

Username disclosure in SIP channel driver

Denial of Service in HTTP server

CVE-2013-2685 CVE-2013-2686 CVE-2013-2264 http://downloads.asterisk.org/pub/security/AST-2013-001.html http://downloads.asterisk.org/pub/security/AST-2013-002.html http://downloads.asterisk.org/pub/security/AST-2013-003.html https://www.asterisk.org/security 2013-03-27 2013-03-29 dns/bind9* -- Malicious Regex Can Cause Memory Exhaustion bind99 9.9.2.2 bind99-base 9.9.2.2 bind98 9.8.4.2 bind98-base 9.8.4.2

ISC reports:

A critical defect in BIND 9 allows an attacker to cause excessive memory consumption in named or other programs linked to libdns.

CVE-2013-2266 2013-03-11 2013-03-27 chromium -- multiple vulnerabilities chromium 26.0.1410.43

Google Chrome Releases reports:

[172342] High CVE-2013-0916: Use-after-free in Web Audio. Credit to Atte Kettunen of OUSPG.

[180909] Low CVE-2013-0917: Out-of-bounds read in URL loader. Credit to Google Chrome Security Team (Cris Neckar).

[180555] Low CVE-2013-0918: Do not navigate dev tools upon drag and drop. Credit to Vsevolod Vlasov of the Chromium development community.

[Linux only] [178760] Medium CVE-2013-0919: Use-after-free with pop-up windows in extensions. Credit to Google Chrome Security Team (Mustafa Emre Acer).

[177410] Medium CVE-2013-0920: Use-after-free in extension bookmarks API. Credit to Google Chrome Security Team (Mustafa Emre Acer).

[174943] High CVE-2013-0921: Ensure isolated web sites run in their own processes.

[174129] Low CVE-2013-0922: Avoid HTTP basic auth brute force attempts. Credit to "t3553r".

[169981] [169972] [169765] Medium CVE-2013-0923: Memory safety issues in the USB Apps API. Credit to Google Chrome Security Team (Mustafa Emre Acer).

[169632] Low CVE-2013-0924: Check an extension's permissions API usage again file permissions. Credit to Benjamin Kalman of the Chromium development community.

[168442] Low CVE-2013-0925: Avoid leaking URLs to extensions without the tabs permissions. Credit to Michael Vrable of Google.

[112325] Medium CVE-2013-0926: Avoid pasting active tags in certain situations. Credit to Subho Halder, Aditya Gupta, and Dev Kar of xys3c (xysec.com).

CVE-2013-0916 CVE-2013-0917 CVE-2013-0918 CVE-2013-0919 CVE-2013-0920 CVE-2013-0921 CVE-2013-0922 CVE-2013-0923 CVE-2013-0924 CVE-2013-0925 CVE-2013-0926 http://googlechromereleases.blogspot.nl/search/Stable%20Updates 2013-03-26 2013-03-26 firebird -- Remote Stack Buffer Overflow firebird25-server 2.5.02.5.2 firebird21-server 2.1.02.1.5

Firebird Project reports:

The FirebirdSQL server is vulnerable to a stack buffer overflow that can be triggered when an unauthenticated user sends a specially crafted packet. The result can lead to remote code execution as the user which runs the FirebirdSQL server.

CVE-2013-2492 https://gist.github.com/zeroSteiner/85daef257831d904479c 2013-01-31 2013-03-06 optipng -- use-after-free vulnerability optipng 0.70.7.4

Secunia reports:

A vulnerability has been reported in OptiPNG, which can be exploited by malicious people to potentially compromise a user's system.

The vulnerability is caused due to a use-after-free error related to the palette reduction functionality. No further information is currently available.

Success exploitation may allow execution of arbitrary code.

CVE-2012-4432 https://secunia.com/advisories/50654 2012-09-16 2013-03-21 php5 -- Multiple vulnerabilities php5 5.4.13 php53 5.3.23

The PHP development team reports:

PHP does not validate the relationship between the soap.wsdl_cache_dir directive and the open_basedir directive, which allows remote attackers to bypass intended access restrictions by triggering the creation of cached SOAP WSDL files in an arbitrary directory.

The SOAP parser in PHP allows remote attackers to read arbitrary files via a SOAP WSDL file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue in the soap_xmlParseFile and soap_xmlParseMemory functions.

CVE-2013-1635 CVE-2013-1643 2013-03-04 2013-03-18 piwigo -- CSRF/Path Traversal piwigo 2.4.7

High-Tech Bridge Security Research Lab reports:

The CSRF vulnerability exists due to insufficient verification of the HTTP request origin in "/admin.php" script. A remote attacker can trick a logged-in administrator to visit a specially crafted webpage and create arbitrary PHP file on the remote server.

The path traversal vulnerability exists due to insufficient filtration of user-supplied input in "dl" HTTP GET parameter passed to "/install.php" script. The script is present on the system after installation by default, and can be accessed by attacker without any restrictions.

CVE-2013-1468 CVE-2013-1469 http://piwigo.org/bugs/view.php?id=0002843 http://piwigo.org/bugs/view.php?id=0002844 http://dl.packetstormsecurity.net/1302-exploits/piwigo246-traversalxsrf.txt 2013-02-06 2013-03-18 libexif -- multiple remote vulnerabilities libexif 0.6.21

libexif project security advisory:

A number of remotely exploitable issues were discovered in libexif and exif, with effects ranging from information leakage to potential remote code execution.

CVE-2012-2812 CVE-2012-2813 CVE-2012-2814 CVE-2012-2836 CVE-2012-2837 CVE-2012-2840 CVE-2012-2841 CVE-2012-2845 54437 2012-07-12 2013-03-13 linux-flashplugin -- multiple vulnerabilities linux-f10-flashplugin 11.2r202.275

Adobe reports:

These updates address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.

CVE-2013-0646 CVE-2013-0650 CVE-2013-1371 CVE-2013-1375 2013-03-12 2013-03-12 puppet27 and puppet -- multiple vulnerabilities puppet 3.03.1.1 puppet27 2.72.7.21

Moses Mendoza reports:

A vulnerability found in Puppet could allow an authenticated client to cause the master to execute arbitrary code while responding to a catalog request. Specifically, in order to exploit the vulnerability, the puppet master must be made to invoke the 'template' or 'inline_template' functions during catalog compilation.

A vulnerability found in Puppet could allow an authenticated client to connect to a puppet master and perform unauthorized actions. Specifically, given a valid certificate and private key, an agent could retrieve catalogs from the master that it is not authorized to access or it could poison the puppet master's caches for any puppet-generated data that supports caching such as catalogs, nodes, facts, and resources. The extent and severity of this vulnerability varies depending on the specific configuration of the master: for example, whether it is using storeconfigs or not, which version, whether it has access to the cache or not, etc.

A vulnerability has been found in Puppet which could allow authenticated clients to execute arbitrary code on agents that have been configured to accept kick connections. This vulnerability is not present in the default configuration of puppet agents, but if they have been configured to listen for incoming connections ('listen=true'), and the agent's auth.conf has been configured to allow access to the `run` REST endpoint, then a client could construct an HTTP request which could execute arbitrary code. The severity of this issue is exacerbated by the fact that puppet agents typically run as root.

A vulnerability has been found in Puppet that could allow a client negotiating a connection to a master to downgrade the master's SSL protocol to SSLv2. This protocol has been found to contain design weaknesses. This issue only affects systems running older versions (pre 1.0.0) of openSSL. Newer versions explicitly disable SSLv2.

A vulnerability found in Puppet could allow unauthenticated clients to send requests to the puppet master which would cause it to load code unsafely. While there are no reported exploits, this vulnerability could cause issues like those described in Rails CVE-2013-0156. This vulnerability only affects puppet masters running Ruby 1.9.3 and higher.

This vulnerability affects puppet masters 0.25.0 and above. By default, auth.conf allows any authenticated node to submit a report for any other node. This can cause issues with compliance. The defaults in auth.conf have been changed.

CVE-2013-1640 CVE-2013-1652 CVE-2013-1653 CVE-2013-1654 CVE-2013-1655 CVE-2013-2275 https://puppetlabs.com/security/cve/cve-2013-1640/ https://puppetlabs.com/security/cve/cve-2013-1652/ https://puppetlabs.com/security/cve/cve-2013-1653/ https://puppetlabs.com/security/cve/cve-2013-1654/ https://puppetlabs.com/security/cve/cve-2013-1655/ https://puppetlabs.com/security/cve/cve-2013-2275/ https://groups.google.com/forum/?fromgroups=#!topic/puppet-announce/f_gybceSV6E https://groups.google.com/forum/?fromgroups=#!topic/puppet-announce/kgDyaPhHniw 2013-03-13 2013-03-13 puppet26 -- multiple vulnerabilities puppet26 2.62.6.18

Moses Mendoza reports:

A vulnerability found in Puppet could allow an authenticated client to cause the master to execute arbitrary code while responding to a catalog request. Specifically, in order to exploit the vulnerability, the puppet master must be made to invoke the 'template' or 'inline_template' functions during catalog compilation.

A vulnerability found in Puppet could allow an authenticated client to connect to a puppet master and perform unauthorized actions. Specifically, given a valid certificate and private key, an agent could retrieve catalogs from the master that it is not authorized to access or it could poison the puppet master's caches for any puppet-generated data that supports caching such as catalogs, nodes, facts, and resources. The extent and severity of this vulnerability varies depending on the specific configuration of the master: for example, whether it is using storeconfigs or not, which version, whether it has access to the cache or not, etc.

A vulnerability has been found in Puppet that could allow a client negotiating a connection to a master to downgrade the master's SSL protocol to SSLv2. This protocol has been found to contain design weaknesses. This issue only affects systems running older versions (pre 1.0.0) of openSSL. Newer versions explicitly disable SSLv2.

A vulnerability found in Puppet could allow an authenticated client to execute arbitrary code on a puppet master that is running in the default configuration, or an agent with `puppet kick` enabled. Specifically, a properly authenticated and connected puppet agent could be made to construct an HTTP PUT request for an authorized report that actually causes the execution of arbitrary code on the master.

This vulnerability affects puppet masters 0.25.0 and above. By default, auth.conf allows any authenticated node to submit a report for any other node. This can cause issues with compliance. The defaults in auth.conf have been changed.

CVE-2013-1640 CVE-2013-1652 CVE-2013-1654 CVE-2013-2274 CVE-2013-2275 https://puppetlabs.com/security/cve/cve-2013-1640/ https://puppetlabs.com/security/cve/cve-2013-1652/ https://puppetlabs.com/security/cve/cve-2013-1654/ https://puppetlabs.com/security/cve/cve-2013-2274/ https://puppetlabs.com/security/cve/cve-2013-2275/ 2013-03-13 2013-03-13 perl -- denial of service via algorithmic complexity attack on hashing routines perl perl-threaded 5.12.4_5 5.14.05.14.2_3 5.16.05.16.2_1

Perl developers report:

In order to prevent an algorithmic complexity attack against its hashing mechanism, perl will sometimes recalculate keys and redistribute the contents of a hash. This mechanism has made perl robust against attacks that have been demonstrated against other systems.

Research by Yves Orton has recently uncovered a flaw in the rehashing code which can result in pathological behavior. This flaw could be exploited to carry out a denial of service attack against code that uses arbitrary user input as hash keys.

Because using user-provided strings as hash keys is a very common operation, we urge users of perl to update their perl executable as soon as possible.

CVE-2013-1667 http://www.nntp.perl.org/group/perl.perl5.porters/2013/03/msg199755.html 2013-03-04 2013-03-10 2016-08-22 libpurple -- multiple vulnerabilities libpurple 2.10.7

Pidgin reports:

libpurple

Fix a crash when receiving UPnP responses with abnormally long values.

MXit

Fix two bugs where a remote MXit user could possibly specify a local file path to be written to.

Fix a bug where the MXit server or a man-in-the-middle could potentially send specially crafted data that could overflow a buffer and lead to a crash or remote code execution.

Sametime

Fix a crash in Sametime when a malicious server sends us an abnormally long user ID.

CVE-2013-0274 CVE-2013-0271 CVE-2013-0272 CVE-2013-0273 https://developer.pidgin.im/wiki/ChangeLog 2013-02-13 2013-03-10 2013-03-16 mozilla -- use-after-free in HTML Editor firefox 18.0,119.0.2,1 17.0.3,1 linux-firefox 17.0.4,1 linux-seamonkey 2.16.1 linux-thunderbird 17.0.4 seamonkey 2.16.1 thunderbird 11.017.0.4 10.0.12

The Mozilla Project reports:

MFSA 2013-29 Use-after-free in HTML Editor

CVE-2013-0787 http://www.mozilla.org/security/announce/2013/mfsa2013-29.html http://www.mozilla.org/security/known-vulnerabilities/ 2013-03-07 2013-03-08 chromium -- WebKit vulnerability chromium 25.0.1364.160

Google Chrome Releases reports:

[180763] High CVE-2013-0912: Type confusion in WebKit. Credit to Nils and Jon of MWR Labs.

CVE-2013-0912 http://googlechromereleases.blogspot.nl/search/Stable%20Updates 2013-03-07 2013-03-08 typo3 -- Multiple vulnerabilities in TYPO3 Core typo3 4.5.04.5.23 4.6.04.6.16 4.7.04.7.8 6.0.06.0.2

Typo Security Team reports:

Extbase Framework - Failing to sanitize user input, the Extbase database abstraction layer is susceptible to SQL Injection. TYPO3 sites which have no Extbase extensions installed are not affected. Extbase extensions are affected if they use the Query Object Model and relation values are user generated input. Credits go to Helmut Hummel and Markus Opahle who discovered and reported the issue.

Access tracking mechanism - Failing to validate user provided input, the access tracking mechanism allows redirects to arbitrary URLs. To fix this vulnerability, we had to break existing behaviour of TYPO3 sites that use the access tracking mechanism (jumpurl feature) to transform links to external sites. The link generation has been changed to include a hash that is checked before redirecting to an external URL. This means that old links that have been distributed (e.g. by a newsletter) will not work any more.

http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-001/ 2013-03-06 2013-03-06 chromium -- multiple vulnerabilities chromium 25.0.1364.152

Google Chrome Releases reports:

[176882] High CVE-2013-0902: Use-after-free in frame loader. Credit to Chamal de Silva.

[176252] High CVE-2013-0903: Use-after-free in browser navigation handling. Credit to "chromium.khalil".

[172926] [172331] High CVE-2013-0904: Memory corruption in Web Audio. Credit to Atte Kettunen of OUSPG.

[168982] High CVE-2013-0905: Use-after-free with SVG animations. Credit to Atte Kettunen of OUSPG.

[174895] High CVE-2013-0906: Memory corruption in Indexed DB. Credit to Google Chrome Security Team (Juri Aedla).

[174150] Medium CVE-2013-0907: Race condition in media thread handling. Credit to Andrew Scherkus of the Chromium development community.

[174059] Medium CVE-2013-0908: Incorrect handling of bindings for extension processes.

[173906] Low CVE-2013-0909: Referer leakage with XSS Auditor. Credit to Egor Homakov.

[172573] Medium CVE-2013-0910: Mediate renderer -> browser plug-in loads more strictly. Credit to Google Chrome Security Team (Chris Evans).

[172264] High CVE-2013-0911: Possible path traversal in database handling. Credit to Google Chrome Security Team (Juri Aedla).

CVE-2013-0902 CVE-2013-0903 CVE-2013-0904 CVE-2013-0905 CVE-2013-0906 CVE-2013-0907 CVE-2013-0908 CVE-2013-0909 CVE-2013-0910 CVE-2013-0911 http://googlechromereleases.blogspot.nl/search/Stable%20Updates 2013-03-04 2013-03-06 stunnel -- Remote Code Execution stunnel 4.214.55

Michal Trojnara reports:

64-bit versions of stunnel with the following conditions: * NTLM authentication enabled * CONNECT protocol negotiation enabled * Configured in SSL client mode * An attacker that can either control the proxy server specified in the "connect" option or execute MITM attacks on the TCP session between stunnel and the proxy

Can be exploited for remote code execution. The code is executed within the configured chroot directory, with privileges of the configured user and group.

CVE-2013-1762 https://www.stunnel.org/CVE-2013-1762.html 2013-03-03 2013-03-03 apache22 -- several vulnerabilities apache22 2.2.02.2.24 apache22-event-mpm 2.2.02.2.24 apache22-itk-mpm 2.2.02.2.24 apache22-peruser-mpm 2.2.02.2.24 apache22-worker-mpm 2.2.02.2.24

Apache HTTP SERVER PROJECT reports:

low: XSS due to unescaped hostnames CVE-2012-3499

Various XSS flaws due to unescaped hostnames and URIs HTML output in mod_info, mod_status, mod_imagemap, mod_ldap, and mod_proxy_ftp.

moderate: XSS in mod_proxy_balancer CVE-2012-4558

A XSS flaw affected the mod_proxy_balancer manager interface.

CVE-2012-3499 CVE-2012-4558 2012-10-07 2013-03-02 sudo -- Authentication bypass when clock is reset sudo 1.8.6.p7

Todd Miller reports:

The flaw may allow someone with physical access to a machine that is not password-protected to run sudo commands without knowing the logged in user's password. On systems where sudo is the principal way of running commands as root, such as on Ubuntu and Mac OS X, there is a greater chance that the logged in user has run sudo before and thus that an attack would succeed.

CVE-2013-1775 http://www.sudo.ws/sudo/alerts/epoch_ticket.html 2013-02-27 2013-03-01 sudo -- Potential bypass of tty_tickets constraints sudo 1.8.6.p7

Todd Miller reports:

A (potentially malicious) program run by a user with sudo access may be able to bypass the "tty_ticket" constraints. In order for this to succeed there must exist on the machine a terminal device that the user has previously authenticated themselves on via sudo within the last time stamp timeout (5 minutes by default).

CVE-2013-1776 http://www.sudo.ws/sudo/alerts/tty_tickets.html 2013-02-27 2013-03-01 rubygem-dragonfly -- arbitrary code execution rubygem18-dragonfly rubygem19-dragonfly rubygem20-dragonfly 0.9.14

Mark Evans reports:

Unfortnately there is a security vulnerability in Dragonfly when used with Rails which would potentially allow an attacker to run arbitrary code on a host machine using carefully crafted requests.

CVE-2013-1756 2013-02-19 2013-02-28 linux-flashplugin -- multiple vulnerabilities linux-f10-flashplugin 11.2r202.273

Adobe reports:

These updates address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.

CVE-2013-0504 CVE-2013-0643 CVE-2013-0648 2013-02-26 2013-02-27 otrs -- XSS vulnerability could lead to remote code execution otrs 3.1.*3.1.11

The OTRS Project reports:

This advisory covers vulnerabilities discovered in the OTRS core system. This is a variance of the XSS vulnerability, where an attacker could send a specially prepared HTML email to OTRS which would cause JavaScript code to be executed in your browser while displaying the email. In this case this is achieved by using javascript source attributes with whitespaces.

Affected by this vulnerability are all releases of OTRS 2.4.x up to and including 2.4.14, 3.0.x up to and including 3.0.16 and 3.1.x up to and including 3.1.10.

CVE-2012-4751 http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-03 2012-10-16 2013-02-25 otrs -- XSS vulnerability in Firefox and Opera could lead to remote code execution otrs 3.1.*3.1.10

The OTRS Project reports:

This advisory covers vulnerabilities discovered in the OTRS core system. This is a variance of the XSS vulnerability, where an attacker could send a specially prepared HTML email to OTRS which would cause JavaScript code to be executed in your browser while displaying the email in Firefox and Opera. In this case this is achieved with an invalid HTML structure with nested tags.

Affected by this vulnerability are all releases of OTRS 2.4.x up to and including 2.4.13, 3.0.x up to and including 3.0.15 and 3.1.x up to and including 3.1.9 in combination with Firefox and Opera.

CVE-2012-4600 http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-02 2012-08-30 2013-02-25 otrs -- XSS vulnerability in Internet Explorer could lead to remote code execution otrs 3.1.*3.1.9

The OTRS Project reports:

This advisory covers vulnerabilities discovered in the OTRS core system. Due to the XSS vulnerability in Internet Explorer an attacker could send a specially prepared HTML email to OTRS which would cause JavaScript code to be executed in your Internet Explorer while displaying the email.

Affected by this vulnerability are all releases of OTRS 2.4.x up to and including 2.4.12, 3.0.x up to and including 3.0.14 and 3.1.x up to and including 3.1.8 in combination with Internet Explorer.

CVE-2012-2582 http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-01 2012-08-22 2013-02-25 ruby -- DoS vulnerability in REXML ruby 1.9,11.9.3.392,1

Ruby developers report:

Unrestricted entity expansion can lead to a DoS vulnerability in REXML. (The CVE identifier will be assigned later.) We strongly recommend to upgrade ruby.

When reading text nodes from an XML document, the REXML parser can be coerced in to allocating extremely large string objects which can consume all of the memory on a machine, causing a denial of service.

http://www.ruby-lang.org/en/news/2013/02/22/rexml-dos-2013-02-22/ 2013-02-22 2013-02-24 rubygem-ruby_parser -- insecure tmp file usage rubygem18-ruby_parser rubygem19-ruby_parser rubygem20-ruby_parser 3.1.1

Michael Scherer reports:

This is a relatively minor tmp file usage issue.

CVE-2013-0162 2013-02-24 2013-02-24 django -- multiple vulnerabilities py26-django py27-django 1.31.3.6 1.41.4.4

The Django Project reports:

These security releases fix four issues: one potential phishing vector, one denial-of-service vector, an information leakage issue, and a range of XML vulnerabilities.

Host header poisoning

an attacker could cause Django to generate and display URLs that link to arbitrary domains. This could be used as part of a phishing attack. These releases fix this problem by introducing a new setting, ALLOWED_HOSTS, which specifies a whitelist of domains your site is known to respond to.

Important: by default Django 1.3.6 and 1.4.4 set ALLOWED_HOSTS to allow all hosts. This means that to actually fix the security vulnerability you should define this setting yourself immediately after upgrading.

Formset denial-of-service

an attacker can abuse Django's tracking of the number of forms in a formset to cause a denial-of-service attack. This has been fixed by adding a default maximum number of forms of 1,000. You can still manually specify a bigger max_num, if you wish, but 1,000 should be enough for anyone.

XML attacks

Django's serialization framework was vulnerable to attacks via XML entity expansion and external references; this is now fixed. However, if you're parsing arbitrary XML in other parts of your application, we recommend you look into the defusedxml Python packages which remedy this anywhere you parse XML, not just via Django's serialization framework.

Data leakage via admin history log

Django's admin interface could expose supposedly-hidden information via its history log. This has been fixed.

CVE-2013-1664 CVE-2013-1665 CVE-2013-0305 CVE-2013-0306 58022 58061 2013-02-21 2013-02-24 chromium -- multiple vulnerabilities chromium 25.0.1364.97

Google Chrome Releases reports:

[172243] High CVE-2013-0879: Memory corruption with web audio node. Credit to Atte Kettunen of OUSPG.

[171951] High CVE-2013-0880: Use-after-free in database handling. Credit to Chamal de Silva.

[167069] Medium CVE-2013-0881: Bad read in Matroska handling. Credit to Atte Kettunen of OUSPG.

[165432] High CVE-2013-0882: Bad memory access with excessive SVG parameters. Credit to Renata Hodovan.

[142169] Medium CVE-2013-0883: Bad read in Skia. Credit to Atte Kettunen of OUSPG.

[172984] Low CVE-2013-0884: Inappropriate load of NaCl. Credit to Google Chrome Security Team (Chris Evans).

[172369] Medium CVE-2013-0885: Too many API permissions granted to web store.

[171065] [170836] Low CVE-2013-0887: Developer tools process has too many permissions and places too much trust in the connected server.

[170666] Medium CVE-2013-0888: Out-of-bounds read in Skia. Credit to Google Chrome Security Team (Inferno).

[170569] Low CVE-2013-0889: Tighten user gesture check for dangerous file downloads.

[169973] [169966] High CVE-2013-0890: Memory safety issues across the IPC layer. Credit to Google Chrome Security Team (Chris Evans).

[169685] High CVE-2013-0891: Integer overflow in blob handling. Credit to Google Chrome Security Team (Jüri Aedla).

[169295] [168710] [166493] [165836] [165747] [164958] [164946] Medium CVE-2013-0892: Lower severity issues across the IPC layer. Credit to Google Chrome Security Team (Chris Evans).

[168570] Medium CVE-2013-0893: Race condition in media handling. Credit to Andrew Scherkus of the Chromium development community.

[168473] High CVE-2013-0894: Buffer overflow in vorbis decoding. Credit to Google Chrome Security Team (Inferno).

[Linux / Mac] [167840] High CVE-2013-0895: Incorrect path handling in file copying. Credit to Google Chrome Security Team (Jüri Aedla).

[166708] High CVE-2013-0896: Memory management issues in plug-in message handling. Credit to Google Chrome Security Team (Cris Neckar).

[165537] Low CVE-2013-0897: Off-by-one read in PDF. Credit to Mateusz Jurczyk, with contributions by Gynvael Coldwind, both from Google Security Team.

[164643] High CVE-2013-0898: Use-after-free in URL handling. Credit to Alexander Potapenko of the Chromium development community.

[160480] Low CVE-2013-0899: Integer overflow in Opus handling. Credit to Google Chrome Security Team (Jüri Aedla).

[152442] Medium CVE-2013-0900: Race condition in ICU. Credit to Google Chrome Security Team (Inferno).

CVE-2013-0879 CVE-2013-0880 CVE-2013-0881 CVE-2013-0882 CVE-2013-0883 CVE-2013-0884 CVE-2013-0885 CVE-2013-0887 CVE-2013-0888 CVE-2013-0889 CVE-2013-0890 CVE-2013-0891 CVE-2013-0892 CVE-2013-0893 CVE-2013-0894 CVE-2013-0895 CVE-2013-0896 CVE-2013-0897 CVE-2013-0898 CVE-2013-0899 CVE-2013-0900 http://googlechromereleases.blogspot.nl/search/label/Stable%20updates 2013-02-21 2013-02-22 krb5 -- null pointer dereference in the KDC PKINIT code [CVE-2013-1415] krb5 1.11

No advisory has been released yet.

Fix a null pointer dereference in the KDC PKINIT code [CVE-2013-1415].

CVE-2013-1415 http://web.mit.edu/kerberos/www/krb5-1.11/ 2013-02-21 2013-02-22 FreeBSD -- glob(3) related resource exhaustion FreeBSD 7.47.4_12 8.38.3_6 9.09.0_6 9.19.1_1

Problem description:

GLOB_LIMIT is supposed to limit the number of paths to prevent against memory or CPU attacks. The implementation however is insufficient.

SA-13:02.libc CVE-2010-2632 2013-02-19 2013-02-21 2016-08-09 FreeBSD -- BIND remote DoS with deliberately crafted DNS64 query FreeBSD 9.09.0_6 9.19.1_1

Problem description:

Due to a software defect a crafted query can cause named(8) to crash with an assertion failure.

SA-13:01.bind CVE-2012-5688 2013-02-19 2013-02-21 drupal7 -- Denial of service drupal7 7.19

Drupal Security Team reports:

Drupal core's Image module allows for the on-demand generation of image derivatives. This capability can be abused by requesting a large number of new derivatives which can fill up the server disk space, and which can cause a very high CPU load. Either of these effects may lead to the site becoming unavailable or unresponsive.

CVE-2013-0316 https://drupal.org/SA-CORE-2013-002 2013-02-20 2013-02-21 nss-pam-ldapd -- file descriptor buffer overflow nss-pam-ldapd 0.8.12

Garth Mollett reports:

A file descriptor overflow issue in the use of FD_SET() in nss-pam-ldapd can lead to a stack-based buffer overflow. An attacker could, under some circumstances, use this flaw to cause a process that has the NSS or PAM module loaded to crash or potentially execute arbitrary code.

CVE-2013-0288 2013-02-18 2013-02-20 bugzilla -- multiple vulnerabilities bugzilla de-bugzilla ru-bugzilla ja-bugzilla 3.6.03.6.13 4.0.04.0.10 4.2.04.2.5

A Bugzilla Security Advisory reports:

Cross-Site Scripting

When viewing a single bug report, which is the default, the bug ID is validated and rejected if it is invalid. But when viewing several bug reports at once, which is specified by the format=multiple parameter, invalid bug IDs can go through and are sanitized in the HTML page itself. But when an invalid page format is passed to the CGI script, the wrong HTML page is called and data are not correctly sanitized, which can lead to XSS.

Information Leak

When running a query in debug mode, the generated SQL query used to collect the data is displayed. The way this SQL query is built permits the user to determine if some confidential field value (such as a product name) exists. This problem only affects Bugzilla 4.0.9 and older. Newer releases are not affected by this issue.

CVE-2013-0785 https://bugzilla.mozilla.org/show_bug.cgi?id=842038 CVE-2013-0786 https://bugzilla.mozilla.org/show_bug.cgi?id=824399 2013-02-19 2013-02-20 2013-03-31 mozilla -- multiple vulnerabilities firefox 18.0,119.0,1 17.0.3,1 linux-firefox 17.0.3,1 linux-seamonkey 2.16 linux-thunderbird 17.0.3 seamonkey 2.16 thunderbird 11.017.0.3 10.0.12 libxul 1.9.2.*10.0.12

The Mozilla Project reports:

MFSA 2013-21 Miscellaneous memory safety hazards (rv:19.0 / rv:17.0.3)

MFSA 2013-22 Out-of-bounds read in image rendering

MFSA 2013-23 Wrapped WebIDL objects can be wrapped again

MFSA 2013-24 Web content bypass of COW and SOW security wrappers

MFSA 2013-25 Privacy leak in JavaScript Workers

MFSA 2013-26 Use-after-free in nsImageLoadingContent

MFSA 2013-27 Phishing on HTTPS connection through malicious proxy

MFSA 2013-28 Use-after-free, out of bounds read, and buffer overflow issues found using Address Sanitizer

CVE-2013-0765 CVE-2013-0772 CVE-2013-0773 CVE-2013-0774 CVE-2013-0775 CVE-2013-0776 CVE-2013-0783 CVE-2013-0784 http://www.mozilla.org/security/announce/2013/mfsa2013-20.html http://www.mozilla.org/security/announce/2013/mfsa2013-21.html http://www.mozilla.org/security/announce/2013/mfsa2013-22.html http://www.mozilla.org/security/announce/2013/mfsa2013-23.html http://www.mozilla.org/security/announce/2013/mfsa2013-24.html http://www.mozilla.org/security/announce/2013/mfsa2013-25.html http://www.mozilla.org/security/announce/2013/mfsa2013-26.html http://www.mozilla.org/security/announce/2013/mfsa2013-27.html http://www.mozilla.org/security/known-vulnerabilities/ 2013-02-19 2013-02-19 2013-02-20 Ruby Rack Gem -- Multiple Issues rubygem18-rack 1.4.5 rubygem19-rack 1.4.5

Rack developers report:

Today we are proud to announce the release of Rack 1.4.5.

Fix CVE-2013-0263, timing attack against Rack::Session::Cookie

Fix CVE-2013-0262, symlink path traversal in Rack::File

CVE-2013-0262 CVE-2013-0263 2013-02-08 2013-02-17 Ruby Activemodel Gem -- Circumvention of attr_protected rubygem18-activemodel 3.2.12 rubygem19-activemodel 3.2.12

Aaron Patterson reports:

The attr_protected method allows developers to specify a blacklist of model attributes which users should not be allowed to assign to. By using a specially crafted request, attackers could circumvent this protection and alter values that were meant to be protected.

All users running an affected release should either upgrade or use one of the work arounds immediately. Users should also consider switching from attr_protected to the whitelist method attr_accessible which is not vulnerable to this attack.

CVE-2013-0276 2013-02-11 2013-02-17 jenkins -- multiple vulnerabilities jenkins 1.501

Jenkins Security Advisory reports:

This advisory announces multiple security vulnerabilities that were found in Jenkins core.

One of the vulnerabilities allows cross-site request forgery (CSRF) attacks on Jenkins master, which causes an user to make unwanted actions on Jenkins. Another vulnerability enables cross-site scripting (XSS) attacks, which has the similar consequence. Another vulnerability allowed an attacker to bypass the CSRF protection mechanism in place, thereby mounting more CSRF attackes. These attacks allow an attacker without direct access to Jenkins to mount an attack.

In the fourth vulnerability, a malicious user of Jenkins can trick Jenkins into building jobs that he does not have direct access to.

And lastly, a vulnerability allows a malicious user of Jenkins to mount a denial of service attack by feeding a carefully crafted payload to Jenkins.

https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-02-16 2013-02-16 2013-02-17 poweradmin -- multiple XSS vulnerabilities poweradmin 2.1.6

Multiple cross-site scripting (XSS) vulnerabilities

Multiple scripts are vulnerable to XSS attacks.

55619 http://packetstormsecurity.com/files/116698/Poweradmin-Cross-Site-Scripting.html 2012-01-12 2013-02-16 Ruby -- Denial of Service and Unsafe Object Creation Vulnerability in JSON ruby 1.9,11.9.3.385,1 rubygem18-json 1.7.7 rubygem19-json 1.7.7 rubygem18-json_pure 1.7.7 rubygem19-json_pure 1.7.7

Aaron Patterson reports:

When parsing certain JSON documents, the JSON gem can be coerced in to creating Ruby symbols in a target system. Since Ruby symbols are not garbage collected, this can result in a denial of service attack.

The same technique can be used to create objects in a target system that act like internal objects. These "act alike" objects can be used to bypass certain security mechanisms and can be used as a spring board for SQL injection attacks in Ruby on Rails.

CVE-2013-0269 2013-02-11 2013-02-16 Ruby -- XSS exploit of RDoc documentation generated by rdoc ruby 1.9,11.9.3.385,1 rubygem18-rdoc 3.12.1 rubygem19-rdoc 3.12.1

Ruby developers report:

RDoc documentation generated by rdoc bundled with ruby are vulnerable to an XSS exploit. All ruby users are recommended to update ruby to newer version which includes security-fixed RDoc. If you are publishing RDoc documentation generated by rdoc, you are recommended to apply a patch for the documentaion or re-generate it with security-fixed RDoc.

CVE-2013-0256 2013-02-06 2013-02-16 linux-flashplugin -- multiple vulnerabilities linux-f10-flashplugin 11.2r202.262

Adobe reports:

These updates address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.

CVE-2013-0633 CVE-2013-0634 https://www.adobe.com/support/security/bulletins/apsb13-04.html 2013-02-07 2013-02-08 OpenSSL -- TLS 1.1, 1.2 denial of service openssl 1.0.1_6

OpenSSL security team reports:

A flaw in the OpenSSL handling of CBC mode ciphersuites in TLS 1.1 and TLS 1.2 on AES-NI supporting platforms can be exploited in a DoS attack.

A flaw in the OpenSSL handling of OCSP response verification can be exploited in a denial of service attack.

CVE-2012-2686 CVE-2013-0166 CVE-2013-0169 http://www.openssl.org/news/secadv_20120510.txt 2013-02-05 2013-02-06 mysql/mariadb/percona server -- multiple vulnerabilities mysql-server 5.15.1.67 5.55.5.29 mariadb-server 5.35.3.12 5.55.5.29 percona-server 5.55.5.29.29.4

ORACLE reports:

Multiple SQL injection vulnerabilities in the replication code

Stack-based buffer overflow

Heap-based buffer overflow

CVE-2012-4414 CVE-2012-5611 CVE-2012-5612 CVE-2012-5615 CVE-2012-5627 https://mariadb.atlassian.net/browse/MDEV-4029 https://mariadb.atlassian.net/browse/MDEV-MDEV-729 https://mariadb.atlassian.net/browse/MDEV-MDEV-729 http://www.mysqlperformanceblog.com/2013/01/23/announcing-percona-server-5-5-29-29-4/ 2012-12-01 2013-02-01 opera -- execution of arbitrary code opera opera-devel linux-opera linux-opera-devel 12.13

Opera reports:

Particular DOM event manipulations can cause Opera to crash. In some cases, this crash might occur in a way that allows execution of arbitrary code. To inject code, additional techniques would have to be employed.

http://www.opera.com/support/kb/view/1042/ http://www.opera.com/support/kb/view/1043/ 2013-01-30 2013-02-01 upnp -- multiple vulnerabilities upnp 1.6.18

Project changelog reports:

This patch addresses three possible buffer overflows in function unique_service_name().The three issues have the folowing CVE numbers:

CVE-2012-5958 Issue #2: Stack buffer overflow of Tempbuf

CVE-2012-5959 Issue #4: Stack buffer overflow of Event->UDN

CVE-2012-5960 Issue #8: Stack buffer overflow of Event->UDN

Notice that the following issues have already been dealt by previous work:

CVE-2012-5961 Issue #1: Stack buffer overflow of Evt->UDN

CVE-2012-5962 Issue #3: Stack buffer overflow of Evt->DeviceType

CVE-2012-5963 Issue #5: Stack buffer overflow of Event->UDN

CVE-2012-5964 Issue #6: Stack buffer overflow of Event->DeviceType

CVE-2012-5965 Issue #7: Stack buffer overflow of Event->DeviceType

CVE-2012-5958 CVE-2012-5959 CVE-2012-5960 CVE-2012-5961 CVE-2012-5962 CVE-2012-5963 CVE-2012-5964 CVE-2012-5965 2012-11-21 2013-01-30 wordpress -- multiple vulnerabilities wordpress 3.5.1,1 zh-wordpress-zh_CN 3.5.1 zh-wordpress-zh_TW 3.5.1 de-wordpress 3.5.1 ja-wordpress 3.5.1 ru-wordpress 3.5.1

Wordpress reports:

WordPress 3.5.1 also addresses the following security issues:

A server-side request forgery vulnerability and remote port scanning using pingbacks. This vulnerability, which could potentially be used to expose information and compromise a site, affects all previous WordPress versions. This was fixed by the WordPress security team. We'd like to thank security researchers Gennady Kovshenin and Ryan Dewhurst for reviewing our work.

Two instances of cross-site scripting via shortcodes and post content. These issues were discovered by Jon Cave of the WordPress security team.

A cross-site scripting vulnerability in the external library Plupload. Thanks to the Moxiecode team for working with us on this, and for releasing Plupload 1.5.5 to address this issue.

CVE-2013-0235 CVE-2013-0236 CVE-2013-0237 2013-01-24 2013-01-29 2014-04-30 django-cms -- XSS Vulnerability py-django-cms 2.3.5

Cross-site scripting (XSS) vulnerability

Jonas Obrist reports: The security issue allows users with limited admin access to elevate their privileges through XSS injection using the page_attribute template tag. Only users with admin access and the permission to edit at least one django CMS page object could exploit this vulnerability. Websites that do not use the page_attribute template tag are not affected.

https://www.django-cms.org/en/blog/2012/12/04/2-3-5-security-release/ 2012-12-04 2013-01-25 chromium -- multiple vulnerabilities chromium 24.0.1312.56

Google Chrome Releases reports:

[151008] High CVE-2013-0839: Use-after-free in canvas font handling. Credit to Atte Kettunen of OUSPG.

[170532] Medium CVE-2013-0840: Missing URL validation when opening new windows.

[169770] High CVE-2013-0841: Unchecked array index in content blocking. Credit to Google Chrome Security Team (Chris Evans).

[166867] Medium CVE-2013-0842: Problems with NULL characters embedded in paths. Credit to Google Chrome Security Team (Jüri Aedla).

CVE-2013-0839 CVE-2013-0840 CVE-2013-0841 CVE-2013-0842 http://googlechromereleases.blogspot.nl/search/label/Stable%20updates 2013-01-22 2013-01-23 drupal -- multiple vulnerabilities drupal6 6.28 drupal7 7.19

Drupal Security Team reports:

Cross-site scripting (Various core and contributed modules)

Access bypass (Book module printer friendly version)

Access bypass (Image module)

https://drupal.org/SA-CORE-2013-001 2013-01-16 2013-01-20 ettercap -- buffer overflow in target list parsing ettercap 0.7.4.1 0.7.50.7.5.2

Host target list parsing routine in ettercap 0.7.4-series prior to 0.7.4.1 and 0.7.5-series is prone to the stack-based buffer overflow that may lead to the code execution with the privileges of the ettercap process.

In order to trigger this vulnerability, user or service that use ettercap should be tricked to pass the crafted list of targets via the "-j" option.

CVE-2013-0722 http://www.exploit-db.com/exploits/23945/ https://secunia.com/advisories/51731/ 2013-01-07 2013-01-16 java 7.x -- security manager bypass openjdk7 0 linux-sun-jdk 7.07.11 linux-sun-jre 7.07.11

US CERT reports:

Java 7 Update 10 and earlier versions of Java 7 contain a vulnerability that can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system.

The Java JRE plug-in provides its own Security Manager. Typically, a web applet runs with a security manager provided by the browser or Java Web Start plugin. Oracle's document states, "If there is a security manager already installed, this method first calls the security manager's checkPermission method with a RuntimePermission("setSecurityManager") permission to ensure it's safe to replace the existing security manager. This may result in throwing a SecurityException".

By leveraging the vulnerability in the Java Management Extensions (JMX) MBean components, unprivileged Java code can access restricted classes. By using that vulnerability in conjunction with a second vulnerability involving the Reflection API and the invokeWithArguments method of the MethodHandle class, an untrusted Java applet can escalate its privileges by calling the the setSecurityManager() function to allow full privileges, without requiring code signing. Oracle Java 7 update 10 and earlier Java 7 versions are affected. The invokeWithArguments method was introduced with Java 7, so therefore Java 6 is not affected.

This vulnerability is being attacked in the wild, and is reported to be incorporated into exploit kits. Exploit code for this vulnerability is also publicly available.

Esteban Guillardoy from Immunity Inc. additionally clarifies on the recursive reflection exploitation technique:

The real issue is in the native sun.reflect.Reflection.getCallerClass method.

We can see the following information in the Reflection source code:

Returns the class of the method realFramesToSkip frames up the stack (zero-based), ignoring frames associated with java.lang.reflect.Method.invoke() and its implementation.

So what is happening here is that they forgot to skip the frames related to the new Reflection API and only the old reflection API is taken into account.

This exploit does not only affect Java applets, but every piece of software that relies on the Java Security Manager for sandboxing executable code is affected: malicious code can totally disable Security Manager.

For users who are running native Web browsers with enabled Java plugin, the workaround is to remove the java/icedtea-web port and restart all browser instances.

For users who are running Linux Web browser flavors, the workaround is either to disable the Java plugin in browser or to upgrade linux-sun-* packages to the non-vulnerable version.

It is not recommended to run untrusted applets using appletviewer, since this may lead to the execution of the malicious code on vulnerable versions on JDK/JRE.

CVE-2013-0433 625617 http://www.oracle.com/technetwork/topics/security/alert-cve-2013-0422-1896849.html https://partners.immunityinc.com/idocs/Java%20MBeanInstantiator.findClass%200day%20Analysis.pdf 2013-01-10 2013-01-14 nagios -- buffer overflow in history.cgi nagios 3.4.3_1

full disclosure reports:

history.cgi is vulnerable to a buffer overflow due to the use of sprintf with user supplied data that has not been restricted in size.

CVE-2012-6096 http://archives.neohapsis.com/archives/fulldisclosure/2012-12/0108.html http://nagios.svn.sourceforge.net/viewvc/nagios?view=revision&revision=2547 2012-12-21 2013-01-10 chromium -- multiple vulnerabilities chromium 24.0.1312.52

Google Chrome Releases reports:

[162494] High CVE-2012-5145: Use-after-free in SVG layout. Credit to Atte Kettunen of OUSPG.

[165622] High CVE-2012-5146: Same origin policy bypass with malformed URL. Credit to Erling A Ellingsen and Subodh Iyengar, both of Facebook.

[165864] High CVE-2012-5147: Use-after-free in DOM handling. Credit to José A. Vázquez.

[167122] Medium CVE-2012-5148: Missing filename sanitization in hyphenation support. Credit to Google Chrome Security Team (Justin Schuh).

[166795] High CVE-2012-5149: Integer overflow in audio IPC handling. Credit to Google Chrome Security Team (Chris Evans).

[165601] High CVE-2012-5150: Use-after-free when seeking video. Credit to Google Chrome Security Team (Inferno).

[165538] High CVE-2012-5151: Integer overflow in PDF JavaScript. Credit to Mateusz Jurczyk, with contribution from Gynvael Coldwind, both of Google Security Team.

[165430] Medium CVE-2012-5152: Out-of-bounds read when seeking video. Credit to Google Chrome Security Team (Inferno).

[164565] High CVE-2012-5153: Out-of-bounds stack access in v8. Credit to Andreas Rossberg of the Chromium development community.

[Mac only] [163208] Medium CVE-2012-5155: Missing Mac sandbox for worker processes. Credit to Google Chrome Security Team (Julien Tinnes).

[162778] High CVE-2012-5156: Use-after-free in PDF fields. Credit to Mateusz Jurczyk, with contribution from Gynvael Coldwind, both of Google Security Team.

[162776] [162156] Medium CVE-2012-5157: Out-of-bounds reads in PDF image handling. Credit to Mateusz Jurczyk, with contribution from Gynvael Coldwind, both of Google Security Team.

[162153] High CVE-2013-0828: Bad cast in PDF root handling. Credit to Mateusz Jurczyk, with contribution from Gynvael Coldwind, both of Google Security Team.

[162114] High CVE-2013-0829: Corruption of database metadata leading to incorrect file access. Credit to Google Chrome Security Team (Jüri Aedla).

[161836] Low CVE-2013-0831: Possible path traversal from extension process. Credit to Google Chrome Security Team (Tom Sepez).

[160380] Medium CVE-2013-0832: Use-after-free with printing. Credit to Google Chrome Security Team (Cris Neckar).

[154485] Medium CVE-2013-0833: Out-of-bounds read with printing. Credit to Google Chrome Security Team (Cris Neckar).

[154283] Medium CVE-2013-0834: Out-of-bounds read with glyph handling. Credit to Google Chrome Security Team (Cris Neckar).

[152921] Low CVE-2013-0835: Browser crash with geolocation. Credit to Arthur Gerkis.

[150545] High CVE-2013-0836: Crash in v8 garbage collection. Credit to Google Chrome Security Team (Cris Neckar).

[145363] Medium CVE-2013-0837: Crash in extension tab handling. Credit to Tom Nielsen.

[Linux only] [143859] Low CVE-2013-0838: Tighten permissions on shared memory segments. Credit to Google Chrome Security Team (Chris Palmer).

CVE-2012-5145 CVE-2012-5146 CVE-2012-5147 CVE-2012-5148 CVE-2012-5149 CVE-2012-5150 CVE-2012-5151 CVE-2012-5152 CVE-2012-5153 CVE-2012-5155 CVE-2012-5156 CVE-2012-5157 CVE-2013-0828 CVE-2013-0829 CVE-2013-0831 CVE-2013-0832 CVE-2013-0833 CVE-2013-0834 CVE-2013-0835 CVE-2013-0836 CVE-2013-0837 CVE-2013-0838 http://googlechromereleases.blogspot.nl/search/label/Stable%20updates 2013-01-10 2013-01-11 mozilla -- multiple vulnerabilities firefox 11.0,117.0.2,1 10.0.12,1 linux-firefox 17.0.2,1 linux-seamonkey 2.15 linux-thunderbird 17.0.2 seamonkey 2.15 thunderbird 11.017.0.2 10.0.12 libxul 1.9.2.*10.0.12 ca_root_nss 3.14.1

The Mozilla Project reports:

MFSA 2013-01 Miscellaneous memory safety hazards (rv:18.0/ rv:10.0.12 / rv:17.0.2)

MFSA 2013-02 Use-after-free and buffer overflow issues found using Address Sanitizer

MFSA 2013-03 Buffer Overflow in Canvas

MFSA 2013-04 URL spoofing in addressbar during page loads

MFSA 2013-05 Use-after-free when displaying table with many columns and column groups

MFSA 2013-06 Touch events are shared across iframes

MFSA 2013-07 Crash due to handling of SSL on threads

MFSA 2013-08 AutoWrapperChanger fails to keep objects alive during garbage collection

MFSA 2013-09 Compartment mismatch with quickstubs returned values

MFSA 2013-10 Event manipulation in plugin handler to bypass same-origin policy

MFSA 2013-11 Address space layout leaked in XBL objects

MFSA 2013-12 Buffer overflow in Javascript string concatenation

MFSA 2013-13 Memory corruption in XBL with XML bindings containing SVG

MFSA 2013-14 Chrome Object Wrapper (COW) bypass through changing prototype

MFSA 2013-15 Privilege escalation through plugin objects

MFSA 2013-16 Use-after-free in serializeToStream

MFSA 2013-17 Use-after-free in ListenerManager

MFSA 2013-18 Use-after-free in Vibrate

MFSA 2013-19 Use-after-free in Javascript Proxy objects

MFSA 2013-20 Mis-issued TURKTRUST certificates

CVE-2012-5829 CVE-2013-0743 CVE-2013-0744 CVE-2013-0745 CVE-2013-0746 CVE-2013-0747 CVE-2013-0748 CVE-2013-0749 CVE-2013-0750 CVE-2013-0751 CVE-2013-0752 CVE-2013-0753 CVE-2013-0754 CVE-2013-0755 CVE-2013-0756 CVE-2013-0757 CVE-2013-0758 CVE-2013-0759 CVE-2013-0760 CVE-2013-0761 CVE-2013-0762 CVE-2013-0763 CVE-2013-0764 CVE-2013-0766 CVE-2013-0767 CVE-2013-0768 CVE-2013-0769 CVE-2013-0770 CVE-2013-0771 http://www.mozilla.org/security/announce/2013/mfsa2013-01.html http://www.mozilla.org/security/announce/2013/mfsa2013-02.html http://www.mozilla.org/security/announce/2013/mfsa2013-03.html http://www.mozilla.org/security/announce/2013/mfsa2013-04.html http://www.mozilla.org/security/announce/2013/mfsa2013-05.html http://www.mozilla.org/security/announce/2013/mfsa2013-06.html http://www.mozilla.org/security/announce/2013/mfsa2013-07.html http://www.mozilla.org/security/announce/2013/mfsa2013-08.html http://www.mozilla.org/security/announce/2013/mfsa2013-09.html http://www.mozilla.org/security/announce/2013/mfsa2013-10.html http://www.mozilla.org/security/announce/2013/mfsa2013-11.html http://www.mozilla.org/security/announce/2013/mfsa2013-12.html http://www.mozilla.org/security/announce/2013/mfsa2013-13.html http://www.mozilla.org/security/announce/2013/mfsa2013-14.html http://www.mozilla.org/security/announce/2013/mfsa2013-15.html http://www.mozilla.org/security/announce/2013/mfsa2013-16.html http://www.mozilla.org/security/announce/2013/mfsa2013-17.html http://www.mozilla.org/security/announce/2013/mfsa2013-18.html http://www.mozilla.org/security/announce/2013/mfsa2013-19.html http://www.mozilla.org/security/announce/2013/mfsa2013-20.html http://www.mozilla.org/security/known-vulnerabilities/ 2013-01-08 2013-01-09 rubygem-rails -- multiple vulnerabilities rubygem-rails 3.2.11 rubygem-actionpack 3.2.11 rubygem-activerecord 3.2.11 rubygem-activesupport 3.2.11

Ruby on Rails team reports:

Two high-risk vulnerabilities have been discovered:

(CVE-2013-0155) There is a vulnerability when Active Record is used in conjunction with JSON parameter parsing.

Due to the way Active Record interprets parameters in combination with the way that JSON parameters are parsed, it is possible for an attacker to issue unexpected database queries with "IS NULL" or empty "WHERE" clauses. This issue does not let an attacker insert arbitrary values into an SQL query, however they can cause the query to check for NULL or eliminate a WHERE clause when most users would not expect it.

(CVE-2013-0156) There are multiple weaknesses in the parameter parsing code for Ruby on Rails which allows attackers to bypass authentication systems, inject arbitrary SQL, inject and execute arbitrary code, or perform a DoS attack on a Rails application.

The parameter parsing code of Ruby on Rails allows applications to automatically cast values from strings to certain data types. Unfortunately the type casting code supported certain conversions which were not suitable for performing on user-provided data including creating Symbols and parsing YAML. These unsuitable conversions can be used by an attacker to compromise a Rails application.

CVE-2013-0155 CVE-2013-0156 http://weblog.rubyonrails.org/2013/1/8/Rails-3-2-11-3-1-10-3-0-19-and-2-3-15-have-been-released/ https://groups.google.com/forum/?fromgroups#!topic/rubyonrails-security/t1WFuuQyavI https://groups.google.com/forum/?fromgroups#!topic/rubyonrails-security/61bkgvnSGTQ 2013-01-08 2013-01-08 rubygem-rails -- SQL injection vulnerability rubygem-rails 3.2.10

Ruby on Rails team reports:

There is a SQL injection vulnerability in Active Record in ALL versions. Due to the way dynamic finders in Active Record extract options from method parameters, a method parameter can mistakenly be used as a scope. Carefully crafted requests can use the scope to inject arbitrary SQL.

CVE-2012-5664 https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/DCNTNp_qjFM 2013-01-02 2013-01-07 jenkins -- HTTP access to the server to retrieve the master cryptographic key jenkins 1.498

Jenkins Security Advisory reports:

This advisory announces a security vulnerability that was found in Jenkins core.

An attacker can then use this master cryptographic key to mount remote code execution attack against the Jenkins master, or impersonate arbitrary users in making REST API calls.

There are several factors that mitigate some of these problems that may apply to specific installations.

The particular attack vector is only applicable on Jenkins instances that have slaves attached to them, and allow anonymous read access.

Jenkins allows users to re-generate the API tokens. Those re-generated API tokens cannot be impersonated by the attacker.

https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-01-04 2013-01-04 2013-01-08 django -- multiple vulnerabilities django 1.4.3 django13 1.3.5

The Django Project reports:

Host header poisoning

Several earlier Django security releases focused on the issue of poisoning the HTTP Host header, causing Django to generate URLs pointing to arbitrary, potentially-malicious domains.

In response to further input received and reports of continuing issues following the previous release, we're taking additional steps to tighten Host header validation. Rather than attempt to accommodate all features HTTP supports here, Django's Host header validation attempts to support a smaller, but far more common, subset:

Hostnames must consist of characters [A-Za-z0-9] plus hyphen ('-') or dot ('.').

IP addresses -- both IPv4 and IPv6 -- are permitted.

Port, if specified, is numeric.

Any deviation from this will now be rejected, raising the exception django.core.exceptions.SuspiciousOperation.

Redirect poisoning

Also following up on a previous issue: in July of this year, we made changes to Django's HTTP redirect classes, performing additional validation of the scheme of the URL to redirect to (since, both within Django's own supplied applications and many third-party applications, accepting a user-supplied redirect target is a common pattern).

Since then, two independent audits of the code turned up further potential problems. So, similar to the Host-header issue, we are taking steps to provide tighter validation in response to reported problems (primarily with third-party applications, but to a certain extent also within Django itself). This comes in two parts:

A new utility function, django.utils.http.is_safe_url, is added; this function takes a URL and a hostname, and checks that the URL is either relative, or if absolute matches the supplied hostname. This function is intended for use whenever user-supplied redirect targets are accepted, to ensure that such redirects cannot lead to arbitrary third-party sites.

All of Django's own built-in views -- primarily in the authentication system -- which allow user-supplied redirect targets now use is_safe_url to validate the supplied URL.

https://www.djangoproject.com/weblog/2012/dec/10/security/ 2012-12-10 2013-01-06 freetype -- Multiple vulnerabilities freetype2 2.4.11

The FreeType Project reports:

Some vulnerabilities in the BDF implementation have been fixed. Users of this font format should upgrade.

http://sourceforge.net/projects/freetype/files/freetype2/2.4.11/README/view 2012-12-20 2013-01-05 moinmoin -- Multiple vulnerabilities moinmoin 1.9.6

MoinMoin developers report the following vulnerabilities as fixed in version 1.9.6:

remote code execution vulnerability in twikidraw/anywikidraw action,

path traversal vulnerability in AttachFile action,

XSS issue, escape page name in rss link.

CVE entries at MITRE furher clarify:

Multiple unrestricted file upload vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory, as exploited in the wild in July 2012.

Directory traversal vulnerability in the _do_attachment_move function in the AttachFile action (action/AttachFile.py) in MoinMoin 1.9.3 through 1.9.5 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in a file name.

Cross-site scripting (XSS) vulnerability in the rsslink function in theme/__init__.py in MoinMoin 1.9.5 allows remote attackers to inject arbitrary web script or HTML via the page name in a rss link.

CVE-2012-6081 CVE-2012-6080 CVE-2012-6082 http://hg.moinmo.in/moin/1.9/raw-file/1.9.6/docs/CHANGES http://www.debian.org/security/2012/dsa-2593 2012-12-29 2013-01-05 2013-01-06 asterisk -- multiple vulnerabilities asterisk11 11.*11.1.2 asterisk10 10.*10.11.1 asterisk18 1.8.*1.8.19.1

Asterisk project reports:

Crashes due to large stack allocations when using TCP

Denial of Service Through Exploitation of Device State Caching

CVE-2012-5976 CVE-2012-5977 http://downloads.digium.com/pub/security/AST-2012-014.html http://downloads.digium.com/pub/security/AST-2012-015.html https://www.asterisk.org/security 2013-01-02 2013-01-03 ircd-ratbox and charybdis -- remote DoS vulnerability ircd-ratbox 2.*3.0.8 charybdis 3.4.2

atheme.org reports:

All versions of Charybdis are vulnerable to a remotely-triggered crash bug caused by code originating from ircd-ratbox 2.0. (Incidentally, this means all versions since ircd-ratbox 2.0 are also vulnerable.)

http://www.ratbox.org/ASA-2012-12-31.txt 2012-12-31 2013-01-02 puppet -- multiple vulnerabilities puppet 2.6.*2.6.17

puppet -- multiple vulnerabilities

Arbitrary file read on the puppet master from authenticated clients (high). It is possible to construct an HTTP get request from an authenticated client with a valid certificate that will return the contents of an arbitrary file on the Puppet master that the master has read-access to.

Arbitrary file delete/D.O.S on Puppet Master from authenticated clients (high). Given a Puppet master with the "Delete" directive allowed in auth.conf for an authenticated host, an attacker on that host can send a specially crafted Delete request that can cause an arbitrary file deletion on the Puppet master, potentially causing a denial of service attack. Note that this vulnerability does *not* exist in Puppet as configured by default.

Insufficient input validation for agent hostnames (low). An attacker could trick the administrator into signing an attacker's certificate rather than the intended one by constructing specially crafted certificate requests containing specific ANSI control sequences. It is possible to use the sequences to rewrite the order of text displayed to an administrator such that display of an invalid certificate and valid certificate are transposed. If the administrator signs the attacker's certificate, the attacker can then man-in-the-middle the agent.

CVE-2012-3864 CVE-2012-3865 CVE-2012-3867 http://projects.puppetlabs.com/projects/puppet/wiki/Release_Notes#2.6.17 http://puppetlabs.com/security/cve/cve-2012-3864/ http://puppetlabs.com/security/cve/cve-2012-3865/ http://puppetlabs.com/security/cve/cve-2012-3867/ 2012-07-10 2012-12-30 otrs -- XSS vulnerability otrs 3.1.11

OTRS Security Advisory reports:

This advisory covers vulnerabilities discovered in the OTRS core system. This is a variance of the XSS vulnerability, where an attacker could send a specially prepared HTML email to OTRS which would cause JavaScript code to be executed in your browser while displaying the email. In this case this is achieved by using javascript source attributes with whitespaces.

CVE-2012-4751 http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-03/ http://www.kb.cert.org/vuls/id/603276 2012-10-16 2012-12-30 otrs -- XSS vulnerability in Firefox and Opera otrs 3.1.10

OTRS Security Advisory reports:

This advisory covers vulnerabilities discovered in the OTRS core system. This is a variance of the XSS vulnerability, where an attacker could send a specially prepared HTML email to OTRS which would cause JavaScript code to be executed in your browser while displaying the email in Firefox and Opera. In this case this is achieved with an invalid HTML structure with nested tags.

CVE-2012-4600 http://www.otrs.com/open-source/community-news/security-advisories/security-advisory-2012-02/ 2012-08-30 2012-12-30 otrs -- XSS vulnerability in Internet Explorer otrs 3.1.9

OTRS Security Advisory reports:

This advisory covers vulnerabilities discovered in the OTRS core system. Due to the XSS vulnerability in Internet Explorer an attacker could send a specially prepared HTML email to OTRS which would cause JavaScript code to be executed in your Internet Explorer while displaying the email.

CVE-2012-2582 http://www.otrs.com/open-source/community-news/security-advisories/security-advisory-2012-01/ 2012-08-22 2012-12-30 squid -- denial of service squid 2.7.9_4 3.13.1.23 3.23.2.6 3.33.3.0.3

Squid developers report:

Due to missing input validation Squid cachemgr.cgi tool is vulnerable to a denial of service attack when processing specially crafted requests.

This problem allows any client able to reach the cachemgr.cgi to perform a denial of service attack on the service host.

The nature of the attack may cause secondary effects through resource consumption on the host server.

CVE-2012-5643 CVE-2013-0189 http://www.squid-cache.org/Advisories/SQUID-2012_1.txt 2012-12-17 2012-12-28 2013-05-02 opera -- execution of arbitrary code opera 12.12 opera-devel 12.12 linux-opera 12.12 linux-opera-devel 12.12

Opera reports:

When loading GIF images into memory, Opera should allocate the correct amount of memory to store that image. Specially crafted image files can cause Opera to allocate the wrong amount of memory. Subsequent data may then overwrite unrelated memory with attacker-controlled data. This can lead to a crash, which may also execute that data as code.

http://www.opera.com/support/kb/view/1038/ http://www.opera.com/support/kb/view/1039/ 2012-12-18 2012-12-18 2014-04-30 linux-flashplugin -- multiple vulnerabilities linux-f10-flashplugin 11.2r202.258

Adobe reports:

These updates address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.

CVE-2012-5676 CVE-2012-5677 CVE-2012-5678 https://www.adobe.com/support/security/bulletins/apsb12-27.html 2012-12-11 2012-12-14 chromium -- multiple vulnerabilities chromium 23.0.1271.97

Google Chrome Releases reports:

[158204] High CVE-2012-5139: Use-after-free with visibility events. Credit to Chamal de Silva.

[159429] High CVE-2012-5140: Use-after-free in URL loader. Credit to Chamal de Silva.

[160456] Medium CVE-2012-5141: Limit Chromoting client plug-in instantiation. Credit to Google Chrome Security Team (Jüri Aedla).

[160803] Critical CVE-2012-5142: Crash in history navigation. Credit to Michal Zalewski of Google Security Team.

[160926] Medium CVE-2012-5143: Integer overflow in PPAPI image buffers. Credit to Google Chrome Security Team (Cris Neckar).

[161639] High CVE-2012-5144: Stack corruption in AAC decoding. Credit to pawlkt.

CVE-2012-5139 CVE-2012-5140 CVE-2012-5141 CVE-2012-5142 CVE-2012-5143 CVE-2012-5144 http://googlechromereleases.blogspot.nl/search/label/Stable%20updates 2012-12-11 2012-12-12 tomcat -- bypass of CSRF prevention filter tomcat 6.0.06.0.35 tomcat7 7.0.07.0.31

The Apache Software Foundation reports:

The CSRF prevention filter could be bypassed if a request was made to a protected resource without a session identifier present in the request.

CVE-2012-4431 http://tomcat.apache.org/security-6.html http://tomcat.apache.org/security-7.html 2012-12-04 2012-12-04 2017-03-18 tomcat -- denial of service tomcat 6.0.06.0.35 tomcat7 7.0.07.0.27

The Apache Software Foundation reports:

When using the NIO connector with sendfile and HTTPS enabled, if a client breaks the connection while reading the response an infinite loop is entered leading to a denial of service.

CVE-2012-4534 http://tomcat.apache.org/security-6.html http://tomcat.apache.org/security-7.html 2012-12-04 2012-12-04 2017-03-18 tomcat -- bypass of security constraints tomcat 6.0.06.0.35 tomcat7 7.0.07.0.29

The Apache Software Foundation reports:

When using FORM authentication it was possible to bypass the security constraint checks in the FORM authenticator by appending "/j_security_check" to the end of the URL if some other component (such as the Single-Sign-On valve) had called request.setUserPrincipal() before the call to FormAuthenticator#authenticate().

CVE-2012-3546 http://tomcat.apache.org/security-6.html http://tomcat.apache.org/security-7.html 2012-12-04 2012-12-04 2017-03-18 dns/bind9* -- servers using DNS64 can be crashed by a crafted query bind99 9.9.2.1 bind99-base 9.9.2.1 bind98 9.8.4.1 bind98-base 9.8.4.1

ISC reports:

BIND 9 nameservers using the DNS64 IPv6 transition mechanism are vulnerable to a software defect that allows a crafted query to crash the server with a REQUIRE assertion failure. Remote exploitation of this defect can be achieved without extensive effort, resulting in a denial-of-service (DoS) vector against affected servers.

CVE-2012-5688 2012-11-27 2012-12-04 bogofilter -- heap corruption by invalid base64 input bogofilter 1.2.3 bogofilter-sqlite 1.2.3 bogofilter-tc 1.2.3

David Relson reports:

Fix a heap corruption in base64 decoder on invalid input. Analysis and patch by Julius Plenz, [FU Berlin, Germany].

CVE-2012-5468 http://bogofilter.sourceforge.net/security/bogofilter-SA-2012-01 2012-10-17 2012-12-03 chromium -- multiple vulnerabilities chromium 23.0.1271.95

Google Chrome Releases reports:

[161564] High CVE-2012-5138: Incorrect file path handling. Credit to Google Chrome Security Team (Jüri Aedla).

[162835] High CVE-2012-5137: Use-after-free in media source handling. Credit to Pinkie Pie.

CVE-2012-5137 CVE-2012-5138 http://googlechromereleases.blogspot.nl/search/label/Stable%20updates 2012-11-29 2012-11-30 YUI JavaScript library -- JavaScript injection exploits in Flash components yahoo-ui 2.8.2

The YUI team reports:

Vulnerability in YUI 2.4.0 through YUI 2.9.0

A XSS vulnerability has been discovered in some YUI 2 .swf files from versions 2.4.0 through 2.9.0. This defect allows JavaScript injection exploits to be created against domains that host affected YUI .swf files.

If your site loads YUI 2 from a CDN (yui.yahooapis.com, ajax.googleapis.com, etc.) and not from your own domain, you are not affected. YUI 3 is not affected by this issue.

CVE-2012-5881 CVE-2012-5882 http://yuilibrary.com/support/20121030-vulnerability/ 2012-10-30 2012-11-27 2012-11-29 chromium -- multiple vulnerabilities chromium 23.0.1271.91

Google Chrome Releases reports:

[156567] High CVE-2012-5133: Use-after-free in SVG filters. Credit to miaubiz.

[148638] Medium CVE-2012-5130: Out-of-bounds read in Skia. Credit to Atte Kettunen of OUSPG.

[155711] Low CVE-2012-5132: Browser crash with chunked encoding. Credit to Attila Szász.

[158249] High CVE-2012-5134: Buffer underflow in libxml. Credit to Google Chrome Security Team (Jüri Aedla).

[159165] Medium CVE-2012-5135: Use-after-free with printing. Credit to Fermin Serna of Google Security Team.

[159829] Medium CVE-2012-5136: Bad cast in input element handling. Credit to Google Chrome Security Team (Inferno).

CVE-2012-5130 CVE-2012-5132 CVE-2012-5133 CVE-2012-5134 CVE-2012-5135 CVE-2012-5136 http://googlechromereleases.blogspot.nl/search/label/Stable%20updates 2012-11-26 2012-11-27 FreeBSD -- Linux compatibility layer input validation error FreeBSD 7.47.4_11 8.38.3_5 9.09.0_5

Problem description:

A programming error in the handling of some Linux system calls may result in memory locations being accessed without proper validation.

SA-12:08.linux CVE-2012-4576 2012-11-22 2012-11-24 FreeBSD -- Insufficient message length validation for EAP-TLS messages FreeBSD 8.38.3_5 9.09.0_5

Problem description:

The internal authentication server of hostapd does not sufficiently validate the message length field of EAP-TLS messages.

SA-12:07.hostapd CVE-2012-4445 2012-11-22 2012-11-24 FreeBSD -- Multiple Denial of Service vulnerabilities with named(8) FreeBSD 7.47.4_11 8.38.3_5 9.09.0_5

Problem description:

The BIND daemon would crash when a query is made on a resource record with RDATA that exceeds 65535 bytes.

The BIND daemon would lock up when a query is made on specific combinations of RDATA.

SA-12:06.bind CVE-2012-4244 CVE-2012-5166 2012-11-22 2012-11-24 opera -- execution of arbitrary code opera 12.11 opera-devel 12.11 linux-opera 12.11 linux-opera-devel 12.11

Opera reports:

When requesting pages using HTTP, Opera temporarily stores the response in a buffer. In some cases, Opera may incorrectly allocate too little space for a buffer, and may then store too much of the response in that buffer. This causes a buffer overflow, which in turn can lead to a memory corruption and crash. It is possible to use this crash to execute the overflowing data as code, which may be controlled by an attacking site.

http://www.opera.com/support/kb/view/1036/ 2012-11-19 2012-11-22 2014-04-30 lighttpd -- remote DoS in header parsing lighttpd 1.4.301.4.32

Lighttpd security advisory reports:

Certain Connection header values will trigger an endless loop, for example: "Connection: TE,,Keep-Alive"

On receiving such value, lighttpd will enter an endless loop, detecting an empty token but not incrementing the current string position, and keep reading the ',' again and again.

This bug was introduced in 1.4.31, when we fixed an "invalid read" bug (it would try to read the byte before the string if it started with ',', although the value wasn't actually used).

CVE-2012-5533 2012-11-17 2012-11-21 mozilla -- multiple vulnerabilities firefox 11.0,117.0,1 10.0.11,1 linux-firefox 10.0.11,1 linux-seamonkey 2.14 linux-thunderbird 10.0.11 seamonkey 2.14 thunderbird 11.017.0 10.0.11 libxul 1.9.2.*10.0.11

The Mozilla Project reports:

MFSA 2012-91 Miscellaneous memory safety hazards (rv:17.0/ rv:10.0.11)

MFSA 2012-92 Buffer overflow while rendering GIF images

MFSA 2012-93 evalInSanbox location context incorrectly applied

MFSA 2012-94 Crash when combining SVG text on path with CSS

MFSA 2012-95 Javascript: URLs run in privileged context on New Tab page

MFSA 2012-96 Memory corruption in str_unescape

MFSA 2012-97 XMLHttpRequest inherits incorrect principal within sandbox

MFSA 2012-98 Firefox installer DLL hijacking

MFSA 2012-99 XrayWrappers exposes chrome-only properties when not in chrome compartment

MFSA 2012-100 Improper security filtering for cross-origin wrappers

MFSA 2012-101 Improper character decoding in HZ-GB-2312 charset

MFSA 2012-102 Script entered into Developer Toolbar runs with chrome privileges

MFSA 2012-103 Frames can shadow top.location

MFSA 2012-104 CSS and HTML injection through Style Inspector

MFSA 2012-105 Use-after-free and buffer overflow issues found

MFSA 2012-106 Use-after-free, buffer overflow, and memory corruption issues found using Address Sanitizer

CVE-2012-4201 CVE-2012-4202 CVE-2012-4203 CVE-2012-4204 CVE-2012-4205 CVE-2012-4206 CVE-2012-4207 CVE-2012-4208 CVE-2012-4209 CVE-2012-4210 CVE-2012-4212 CVE-2012-4213 CVE-2012-4214 CVE-2012-4215 CVE-2012-4216 CVE-2012-4217 CVE-2012-4218 CVE-2012-5829 CVE-2012-5830 CVE-2012-5833 CVE-2012-5835 CVE-2012-5836 CVE-2012-5837 CVE-2012-5838 CVE-2012-5839 CVE-2012-5840 CVE-2012-5841 CVE-2012-5842 CVE-2012-5843 http://www.mozilla.org/security/announce/2012/mfsa2012-90.html http://www.mozilla.org/security/announce/2012/mfsa2012-91.html http://www.mozilla.org/security/announce/2012/mfsa2012-92.html http://www.mozilla.org/security/announce/2012/mfsa2012-93.html http://www.mozilla.org/security/announce/2012/mfsa2012-94.html http://www.mozilla.org/security/announce/2012/mfsa2012-95.html http://www.mozilla.org/security/announce/2012/mfsa2012-96.html http://www.mozilla.org/security/announce/2012/mfsa2012-97.html http://www.mozilla.org/security/announce/2012/mfsa2012-98.html http://www.mozilla.org/security/announce/2012/mfsa2012-99.html http://www.mozilla.org/security/announce/2012/mfsa2012-100.html http://www.mozilla.org/security/announce/2012/mfsa2012-101.html http://www.mozilla.org/security/announce/2012/mfsa2012-102.html http://www.mozilla.org/security/announce/2012/mfsa2012-103.html http://www.mozilla.org/security/announce/2012/mfsa2012-104.html http://www.mozilla.org/security/announce/2012/mfsa2012-105.html http://www.mozilla.org/security/announce/2012/mfsa2012-106.html http://www.mozilla.org/security/known-vulnerabilities/ 2012-11-20 2012-11-20 weechat -- Arbitrary shell command execution via scripts weechat 0.3.00.3.9.2 weechat-devel 20121118

Sebastien Helleu reports:

Untrusted command for function hook_process could lead to execution of commands, because of shell expansions.

Workaround with a non-patched version: remove/unload all scripts calling function hook_process (for maximum safety).

http://weechat.org/security/ https://savannah.nongnu.org/bugs/?37764 2012-11-15 2012-11-18 2012-11-18 bugzilla -- multiple vulnerabilities bugzilla 3.6.03.6.12 4.0.04.0.9 4.2.04.2.4

A Bugzilla Security Advisory reports:

The following security issues have been discovered in Bugzilla:

Information Leak

If the visibility of a custom field is controlled by a product or a component of a product you cannot see, their names are disclosed in the JavaScript code generated for this custom field despite they should remain confidential.

Calling the User.get method with a 'groups' argument leaks the existence of the groups depending on whether an error is thrown or not. This method now also throws an error if the user calling this method does not belong to these groups (independently of whether the groups exist or not).

Trying to mark an attachment in a bug you cannot see as obsolete discloses its description in the error message. The description of the attachment is now removed from the error message.

Cross-Site Scripting

Due to incorrectly filtered field values in tabular reports, it is possible to inject code leading to XSS.

A vulnerability in swfstore.swf from YUI2 allows JavaScript injection exploits to be created against domains that host this affected YUI .swf file.

CVE-2012-4199 https://bugzilla.mozilla.org/show_bug.cgi?id=731178 CVE-2012-4198 https://bugzilla.mozilla.org/show_bug.cgi?id=781850 CVE-2012-4197 https://bugzilla.mozilla.org/show_bug.cgi?id=802204 CVE-2012-4189 https://bugzilla.mozilla.org/show_bug.cgi?id=790296 CVE-2012-5881 CVE-2012-5882 CVE-2012-5883 https://bugzilla.mozilla.org/show_bug.cgi?id=808845 http://yuilibrary.com/support/20121030-vulnerability/ 2012-11-13 2012-11-14 2012-11-27 typo3 -- Multiple vulnerabilities in TYPO3 Core typo3 4.5.04.5.21 4.6.04.6.14 4.7.04.7.6

Typo Security Team reports:

TYPO3 Backend History Module - Due to missing encoding of user input, the history module is susceptible to SQL Injection and Cross-Site Scripting. A valid backend login is required to exploit this vulnerability. Credits go to Thomas Worm who discovered and reported the issue.

TYPO3 Backend API - Failing to properly HTML-encode user input the tree render API (TCA-Tree) is susceptible to Cross-Site Scripting. TYPO3 Versions below 6.0 does not make us of this API, thus is not exploitable, if no third party extension is installed which uses this API. A valid backend login is required to exploit this vulnerability. Credits go to Richard Brain who discovered and reported the issue.

http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-005/ 2012-11-08 2012-11-12 DomainKeys Identified Mail (DKIM) Verifiers may inappropriately convey message trust opendkim 2.7.1

US-CERT reports:

DomainKeys Identified Mail (DKIM) Verifiers may inappropriately convey message trust when messages are signed using test or small bit signing keys.

268267 2012-10-24 2012-11-12 weechat -- Crash or freeze when decoding IRC colors in strings weechat 0.3.60.3.9.1 weechat-devel 2011061420121110

Sebastien Helleu reports:

A buffer overflow is causing a crash or freeze of WeeChat when decoding IRC colors in strings.

Workaround for a non-patched version: /set irc.network.colors_receive off

CVE-2012-5854 ports/173513 http://weechat.org/security/ https://savannah.nongnu.org/bugs/?37704 2012-11-09 2012-11-10 2012-11-13 ruby -- Hash-flooding DoS vulnerability for ruby 1.9 ruby 1.91.9.3.327

The official ruby site reports:

Carefully crafted sequence of strings can cause a denial of service attack on the service that parses the sequence to create a Hash object by using the strings as keys. For instance, this vulnerability affects web application that parses the JSON data sent from untrusted entity.

This vulnerability is similar to CVS-2011-4815 for ruby 1.8.7. ruby 1.9 versions were using modified MurmurHash function but it's reported that there is a way to create sequence of strings that collide their hash values each other. This fix changes the Hash function of String object from the MurmurHash to SipHash 2-4.

CVE-2012-5371 http://www.ruby-lang.org/en/news/2012/11/09/ruby19-hashdos-cve-2012-5371/ 2012-11-10 2012-11-10 tomcat -- authentication weaknesses tomcat 5.5.05.5.36 6.0.06.0.36 7.0.07.0.30

The Apache Software Foundation reports:

Three weaknesses in Tomcat's implementation of DIGEST authentication were identified and resolved:

Tomcat tracked client rather than server nonces and nonce count.

When a session ID was present, authentication was bypassed.

The user name and password were not checked before when indicating that a nonce was stale.

These issues reduced the security of DIGEST authentication making replay attacks possible in some circumstances.

The first issue was identified by Tilmann Kuhn. The second and third issues were identified by the Tomcat security team during the code review resulting from the first issue.

CVE-2012-3439 http://tomcat.apache.org/security.html http://tomcat.apache.org/security-5.html http://tomcat.apache.org/security-6.html http://tomcat.apache.org/security-7.html 2012-11-05 2012-11-08 2012-11-09 tomcat -- Denial of Service tomcat 6.0.06.0.36 7.0.07.0.28

The Apache Software Foundation reports:

The checks that limited the permitted size of request headers were implemented too late in the request parsing process for the HTTP NIO connector. This enabled a malicious user to trigger an OutOfMemoryError by sending a single request with very large headers. This issue was identified by Josh Spiewak.

CVE-2012-2733 http://tomcat.apache.org/security.html http://tomcat.apache.org/security-6.html http://tomcat.apache.org/security-7.html 2012-11-05 2012-11-08 2012-11-09 linux-flashplugin -- multiple vulnerabilities linux-f10-flashplugin 11.2r202.243

Adobe reports:

These vulnerabilities could cause a crash and potentially allow an attacker to take control of the affected system.

CVE-2012-5274 CVE-2012-5275 CVE-2012-5276 CVE-2012-5277 CVE-2012-5278 CVE-2012-5279 CVE-2012-5280 https://www.adobe.com/support/security/bulletins/apsb12-24.html 2012-10-08 2012-11-02 chromium -- multiple vulnerabilities chromium 23.0.1271.64

Google Chrome Releases reports:

[157079] Medium CVE-2012-5127: Integer overflow leading to out-of-bounds read in WebP handling. Credit to Phil Turnbull.

[Linux 64-bit only] [150729] Medium CVE-2012-5120: Out-of-bounds array access in v8. Credit to Atte Kettunen of OUSPG.

[143761] High CVE-2012-5116: Use-after-free in SVG filter handling. Credit to miaubiz.

[Mac OS only] [149717] High CVE-2012-5118: Integer bounds check issue in GPU command buffers. Credit to miaubiz.

[154055] High CVE-2012-5121: Use-after-free in video layout. Credit to Atte Kettunen of OUSPG.

[145915] Low CVE-2012-5117: Inappropriate load of SVG subresource in img context. Credit to Felix Gröbert of the Google Security Team.

[149759] Medium CVE-2012-5119: Race condition in Pepper buffer handling. Credit to Fermin Serna of the Google Security Team.

[154465] Medium CVE-2012-5122: Bad cast in input handling. Credit to Google Chrome Security Team (Inferno).

[154590] [156826] Medium CVE-2012-5123: Out-of-bounds reads in Skia. Credit to Google Chrome Security Team (Inferno).

[155323] High CVE-2012-5124: Memory corruption in texture handling. Credit to Al Patrick of the Chromium development community.

[156051] Medium CVE-2012-5125: Use-after-free in extension tab handling. Credit to Alexander Potapenko of the Chromium development community.

[156366] Medium CVE-2012-5126: Use-after-free in plug-in placeholder handling. Credit to Google Chrome Security Team (Inferno).

[157124] High CVE-2012-5128: Bad write in v8. Credit to Google Chrome Security Team (Cris Neckar).

CVE-2012-5127 CVE-2012-5120 CVE-2012-5116 CVE-2012-5118 CVE-2012-5121 CVE-2012-5117 CVE-2012-5119 CVE-2012-5122 CVE-2012-5123 CVE-2012-5124 CVE-2012-5125 CVE-2012-5126 CVE-2012-5128 http://googlechromereleases.blogspot.nl/search/label/Stable%20updates 2012-11-06 2012-11-07 opera -- multiple vulnerabilities opera 12.10 opera-devel 12.10 linux-opera 12.10 linux-opera-devel 12.10

Opera reports:

CORS (Cross-Origin Resource Sharing) allows web pages to retrieve the contents of pages from other sites, with their permission, as they would appear for the current user. When requests are made in this way, the browser should only allow the page content to be retrieved if the target site sends the correct headers that give permission for their contents to be used in this way. Specially crafted requests may trick Opera into thinking that the target site has given permission when it had not done so. This can result in the contents of any target page being revealed to untrusted sites, including any sensitive information or session IDs contained within the source of those pages.

Also reported are vulnerabilities involving SVG graphics and XSS.

http://www.opera.com/support/kb/view/1030/ http://www.opera.com/support/kb/view/1031/ http://www.opera.com/support/kb/view/1033/ 2012-11-06 2012-11-06 2014-04-30 linux-flashplugin -- multiple vulnerabilities linux-f10-flashplugin 11.2r202.238

Adobe reports:

These vulnerabilities could cause a crash and potentially allow an attacker to take control of the affected system.

CVE-2012-5248 CVE-2012-5249 CVE-2012-5250 CVE-2012-5251 CVE-2012-5252 CVE-2012-5253 CVE-2012-5254 CVE-2012-5255 CVE-2012-5256 CVE-2012-5257 CVE-2012-5258 CVE-2012-5259 CVE-2012-5260 CVE-2012-5261 CVE-2012-5262 CVE-2012-5263 CVE-2012-5264 CVE-2012-5265 CVE-2012-5266 CVE-2012-5267 CVE-2012-5269 CVE-2012-5270 CVE-2012-5271 CVE-2012-5272 CVE-2012-5285 CVE-2012-5286 CVE-2012-5287 CVE-2012-5673 CVE-2012-2034 CVE-2012-2035 CVE-2012-2036 CVE-2012-2037 CVE-2012-2038 CVE-2012-2039 CVE-2012-2040 https://www.adobe.com/support/security/bulletins/apsb12-22.html 2012-10-08 2012-11-02 apache22 -- several vulnerabilities apache22 2.2.02.2.23 apache22-event-mpm 2.2.02.2.23 apache22-itk-mpm 2.2.02.2.23 apache22-peruser-mpm 2.2.02.2.23 apache22-worker-mpm 2.2.02.2.23

Apache HTTP SERVER PROJECT reports:

low: XSS in mod_negotiation when untrusted uploads are supported CVE-2012-2687

Possible XSS for sites which use mod_negotiation and allow untrusted uploads to locations which have MultiViews enabled.

low: insecure LD_LIBRARY_PATH handling CVE-2012-0883

This issue was already fixed in port version 2.2.22_5

CVE-2012-2687 CVE-2012-0833 2012-09-13 2012-11-02 webmin -- potential XSS attack via real name field webmin 1.600_1

The webmin updates site reports

Module: Change Passwords; Version: 1.600; Problem: Fix for potential XSS attack via real name field; Solution: New module.

http://www.webmin.com/updates.html 2012-11-02 2012-11-02 ruby -- Unintentional file creation caused by inserting an illegal NUL character ruby 1.9.3,11.9.3.286,1

The official ruby site reports:

A vulnerability was found that file creation routines can create unintended files by strategically inserting NUL(s) in file paths. This vulnerability has been reported as CVE-2012-4522.

Ruby can handle arbitrary binary patterns as Strings, including NUL chars. On the other hand OSes and other libraries tend not. They usually treat a NUL as an End of String mark. So to interface them with Ruby, NUL chars should properly be avoided.

However methods like IO#open did not check the filename passed to them, and just passed those strings to lower layer routines. This led to create unintentional files.

CVE-2012-4522 http://www.ruby-lang.org/en/news/2012/10/12/poisoned-NUL-byte-vulnerability/ https://access.redhat.com/security/cve/CVE-2012-4522/ 2012-10-12 2012-11-01 ruby -- $SAFE escaping vulnerability about Exception#to_s/NameError#to_s ruby 1.8.7,11.8.7.371,1 1.9.3,11.9.3.286,1

The official ruby site reports:

Vulnerabilities found for Exception#to_s, NameError#to_s, and name_err_mesg_to_s() which is Ruby interpreter-internal API. A malicious user code can bypass $SAFE check by utilizing one of those security holes.

Ruby's $SAFE mechanism enables untrusted user codes to run in $SAFE >= 4 mode. This is a kind of sandboxing so some operations are restricted in that mode to protect other data outside the sandbox.

The problem found was around this mechanism. Exception#to_s, NameError#to_s, and name_err_mesg_to_s() interpreter-internal API was not correctly handling the $SAFE bits so a String object which is not tainted can destructively be marked as tainted using them. By using this an untrusted code in a sandbox can modify a formerly-untainted string destructively.

Ruby 1.8 once had a similar security issue. It fixed Exception#to_s and NameError#to_s, but name_err_mesg_to_str() issue survived previous security fix

CVE-2012-4464 CVE-2012-4466 http://www.ruby-lang.org/en/news/2012/10/12/cve-2012-4464-cve-2012-4466/ https://access.redhat.com/security/cve/CVE-2012-4464/